myagentmemory 0.4.12 → 0.4.13

package/dist/core.js

@@ -115,6 +115,100 @@ const CONTEXT_MAX_CHARS = 16_000;
 function normalizeContent(content) {
     return content.trim();
 }
+const SECRET_PATTERNS = [
+    /\bsk-[A-Za-z0-9_-]{16,}\b/g,
+    /\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,
+    /\bAKIA[0-9A-Z]{16}\b/g,
+    /\b(?:api[_-]?key|access[_-]?token|secret)\s*[:=]\s*["']?[A-Za-z0-9_./+=-]{16,}["']?/gi,
+];
+/** Redact common credential shapes before content reaches disk or agent context. */
+export function redactSecrets(content) {
+    let redactedContent = content;
+    for (const pattern of SECRET_PATTERNS) {
+        redactedContent = redactedContent.replace(pattern, "[REDACTED_SECRET]");
+    }
+    return { content: redactedContent, redacted: redactedContent !== content };
+}
+function isInactiveMemoryEntry(entry, now) {
+    const metadataHeader = entry.split(/\n\s*\n/, 1)[0];
+    if (/^\s*(?:[-*]\s*)?Trust:\s*untrusted\s*\.?\s*$/im.test(metadataHeader))
+        return true;
+    if (/^\s*(?:[-*]\s*)?Status:\s*(?:expired|superseded|revoked|retired)\s*\.?\s*$/im.test(metadataHeader)) {
+        return true;
+    }
+    const validUntil = metadataHeader.match(/^\s*(?:[-*]\s*)?Valid until:?\s+(\d{4}-\d{2}-\d{2})\s*\.?\s*$/im)?.[1];
+    if (validUntil && validUntil < now.toISOString().slice(0, 10))
+        return true;
+    return false;
+}
+function splitLogicalMemoryEntries(content) {
+    const normalized = content.replace(/^\uFEFF/, "");
+    const marker = /^<!--\s*(?:last updated:\s*)?\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2} \[[^\]]+\]\s*-->$/gm;
+    const starts = [...normalized.matchAll(marker)].map((match) => match.index ?? 0);
+    if (starts.length === 0) {
+        return { entries: normalized.split(/\n\s*\n/), timestampDelimited: false };
+    }
+    const entries = [];
+    const preamble = normalized.slice(0, starts[0]).trim();
+    if (preamble)
+        entries.push(preamble);
+    for (let i = 0; i < starts.length; i++) {
+        entries.push(normalized.slice(starts[i], starts[i + 1] ?? normalized.length).trim());
+    }
+    return { entries, timestampDelimited: true };
+}
+function isUnmarkedInactiveHeader(entry, now) {
+    if (!isInactiveMemoryEntry(entry, now))
+        return false;
+    return entry.split("\n").every((line) => {
+        const trimmed = line.trim();
+        return (!trimmed ||
+            /^#{1,6}\s+/.test(trimmed) ||
+            /^<!--.*-->$/.test(trimmed) ||
+            /^(?:[-*]\s*)?(?:Trust:|Status:|Valid until:?\s|Source:)/i.test(trimmed));
+    });
+}
+/** Apply trust, lifecycle, and secret policy to complete logical write entries. */
+export function filterMemoryForContext(content, now = new Date()) {
+    const { entries, timestampDelimited } = splitLogicalMemoryEntries(content);
+    const activeEntries = [];
+    for (const entry of entries) {
+        const inactive = isInactiveMemoryEntry(entry, now);
+        if (!timestampDelimited && isUnmarkedInactiveHeader(entry, now)) {
+            // Without write markers there is no reliable boundary after a metadata-only
+            // header. Fail closed instead of treating the following body paragraphs as
+            // independent trusted entries.
+            break;
+        }
+        if (!inactive)
+            activeEntries.push(entry);
+    }
+    return redactSecrets(activeEntries.join("\n\n")).content.trim();
+}
+function sanitizeSourceUri(sourceUri) {
+    if (!sourceUri?.trim())
+        return undefined;
+    const singleLine = [...sourceUri]
+        .map((char) => {
+        const code = char.charCodeAt(0);
+        return code <= 31 || code === 127 ? " " : char;
+    })
+        .join("")
+        .trim()
+        .slice(0, 2_048);
+    return redactSecrets(singleLine).content;
+}
+function escapeEntryMarkers(content) {
+    return content.replace(/^<!--\s*(?:last updated:\s*)?\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2} \[[^\]]+\]\s*-->$/gm, (line) => line.replace("<!--", "&lt;!--"));
+}
+function formatStoredEntry(content, metadata, sourceUri) {
+    const safeContent = redactSecrets(escapeEntryMarkers(content));
+    const source = sanitizeSourceUri(sourceUri);
+    return {
+        entry: `${metadata}\n${safeContent.content}${source ? `\nSource: ${source}` : ""}`,
+        redacted: safeContent.redacted || (!!sourceUri && source !== sourceUri.trim()),
+    };
+}
 export function truncateLines(lines, maxLines, mode) {
     if (maxLines <= 0 || lines.length <= maxLines) {
         return { lines, truncated: false };
@@ -251,7 +345,7 @@ export function buildMemoryContext(searchResults) {
     if (scratchpad?.trim()) {
         const openItems = parseScratchpad(scratchpad).filter((i) => !i.done);
         if (openItems.length > 0) {
-            const serialized = serializeScratchpad(openItems);
+            const serialized = filterMemoryForContext(serializeScratchpad(openItems));
             const section = formatContextSection("## SCRATCHPAD.md (working context)", serialized, "start", CONTEXT_SCRATCHPAD_MAX_LINES, CONTEXT_SCRATCHPAD_MAX_CHARS);
             if (section)
                 sections.push(section);
@@ -263,25 +357,29 @@ export function buildMemoryContext(searchResults) {
     const today = todayStr();
     const yesterday = yesterdayStr();
     const todayContent = readFileSafe(dailyPath(today));
-    if (todayContent?.trim()) {
-        const section = formatContextSection(`## Daily log: ${today} (today)`, todayContent, "end", CONTEXT_DAILY_MAX_LINES, CONTEXT_DAILY_MAX_CHARS);
+    const safeTodayContent = todayContent ? filterMemoryForContext(todayContent) : "";
+    if (safeTodayContent) {
+        const section = formatContextSection(`## Daily log: ${today} (today)`, safeTodayContent, "middle", CONTEXT_DAILY_MAX_LINES, CONTEXT_DAILY_MAX_CHARS);
         if (section)
             sections.push(section);
     }
-    if (searchResults?.trim()) {
-        const section = formatContextSection("## Relevant memories (auto-retrieved)", searchResults, "start", CONTEXT_SEARCH_MAX_LINES, CONTEXT_SEARCH_MAX_CHARS);
+    const safeSearchResults = searchResults ? filterMemoryForContext(searchResults) : "";
+    if (safeSearchResults) {
+        const section = formatContextSection("## Relevant memories (auto-retrieved)", safeSearchResults, "start", CONTEXT_SEARCH_MAX_LINES, CONTEXT_SEARCH_MAX_CHARS);
         if (section)
             sections.push(section);
     }
     const longTerm = readFileSafe(MEMORY_FILE);
-    if (longTerm?.trim()) {
-        const section = formatContextSection("## MEMORY.md (long-term)", longTerm, "middle", CONTEXT_LONG_TERM_MAX_LINES, CONTEXT_LONG_TERM_MAX_CHARS);
+    const safeLongTerm = longTerm ? filterMemoryForContext(longTerm) : "";
+    if (safeLongTerm) {
+        const section = formatContextSection("## MEMORY.md (long-term)", safeLongTerm, "middle", CONTEXT_LONG_TERM_MAX_LINES, CONTEXT_LONG_TERM_MAX_CHARS);
         if (section)
             sections.push(section);
     }
     const yesterdayContent = readFileSafe(dailyPath(yesterday));
-    if (yesterdayContent?.trim()) {
-        const section = formatContextSection(`## Daily log: ${yesterday} (yesterday)`, yesterdayContent, "end", CONTEXT_DAILY_MAX_LINES, CONTEXT_DAILY_MAX_CHARS);
+    const safeYesterdayContent = yesterdayContent ? filterMemoryForContext(yesterdayContent) : "";
+    if (safeYesterdayContent) {
+        const section = formatContextSection(`## Daily log: ${yesterday} (yesterday)`, safeYesterdayContent, "end", CONTEXT_DAILY_MAX_LINES, CONTEXT_DAILY_MAX_CHARS);
         if (section)
             sections.push(section);
     }
@@ -290,15 +388,8 @@ export function buildMemoryContext(searchResults) {
     }
     const context = `# Memory\n\n${sections.join("\n\n---\n\n")}`;
     if (context.length > CONTEXT_MAX_CHARS) {
-        const result = buildPreview(context, {
-            maxLines: Number.POSITIVE_INFINITY,
-            maxChars: CONTEXT_MAX_CHARS,
-            mode: "start",
-        });
-        const note = result.truncated
-            ? `\n\n[truncated overall context: showing ${result.previewChars}/${result.totalChars} chars]`
-            : "";
-        return `${result.preview}${note}`;
+        const note = "\n\n[truncated overall context to 16000 chars]";
+        return context.slice(0, CONTEXT_MAX_CHARS - note.length).trimEnd() + note;
     }
     return context;
 }
@@ -319,11 +410,12 @@ function buildTopicsContextSection() {
     for (const file of topicFiles) {
         const slug = file.replace(/\.md$/, "");
         const content = readFileSafe(path.join(TOPICS_DIR, file));
-        if (!content?.trim())
+        const safeContent = content ? filterMemoryForContext(content) : "";
+        if (!safeContent)
             continue;
-        const titleMatch = content.match(/^# Topic:\s*(.+)$/m);
+        const titleMatch = safeContent.match(/^# Topic:\s*(.+)$/m);
         const title = titleMatch?.[1]?.trim() || slug;
-        entries.push(...parseTopicEntries(title, slug, content));
+        entries.push(...parseTopicEntries(title, slug, safeContent));
     }
     if (entries.length === 0)
         return null;
@@ -711,6 +803,12 @@ export function installSkills() {
             destDir: path.join(homeDir, ".cursor", "skills", "agent-memory"),
             homeMarker: path.join(homeDir, ".cursor"),
         },
+        {
+            label: "Agent CLI skill",
+            srcDir: path.join(skillsDir, "agent"),
+            destDir: path.join(homeDir, ".agents", "skills", "agent-memory"),
+            homeMarker: path.join(homeDir, ".agents"),
+        },
     ];
     const detected = [];
     const installed = [];
@@ -765,6 +863,7 @@ export function uninstallSkills() {
         { label: "Claude Code skill", destDir: path.join(homeDir, ".claude", "skills", "agent-memory") },
         { label: "Codex skill", destDir: path.join(homeDir, ".codex", "skills", "agent-memory") },
         { label: "Cursor skill", destDir: path.join(homeDir, ".cursor", "skills", "agent-memory") },
+        { label: "Agent CLI skill", destDir: path.join(homeDir, ".agents", "skills", "agent-memory") },
     ];
     const removed = [];
     const skipped = [];
@@ -844,10 +943,63 @@ export async function getQmdHealth() {
         });
     });
 }
+function resolveCaseInsensitivePath(root, relativePath) {
+    let current = root;
+    for (const segment of relativePath.split(/[/\\]+/).filter(Boolean)) {
+        if (segment === "." || segment === "..")
+            return null;
+        let children;
+        try {
+            children = fs.readdirSync(current);
+        }
+        catch {
+            return null;
+        }
+        const child = children.find((name) => name === segment) ??
+            children.find((name) => name.toLowerCase() === segment.toLowerCase());
+        if (!child)
+            return null;
+        current = path.join(current, child);
+    }
+    return current;
+}
+function resolveQmdSourcePath(filePath) {
+    const qmdUri = filePath.match(/^qmd:\/\/([^/]+)\/?(.*)$/i);
+    let relativePath = qmdUri ? qmdUri[2] : filePath;
+    if (relativePath.toLowerCase().startsWith(`${QMD_COLLECTION_NAME.toLowerCase()}/`)) {
+        relativePath = relativePath.slice(QMD_COLLECTION_NAME.length + 1);
+    }
+    const root = path.resolve(MEMORY_DIR);
+    if (path.isAbsolute(relativePath)) {
+        const candidate = path.resolve(relativePath);
+        if (candidate !== root && !candidate.startsWith(`${root}${path.sep}`))
+            return null;
+        return fs.existsSync(candidate) ? candidate : null;
+    }
+    return resolveCaseInsensitivePath(root, relativePath.replace(/^\/+/, ""));
+}
+function qmdResultPassesSourcePolicy(filePath, snippet) {
+    if (!filePath)
+        return false;
+    const sourcePath = resolveQmdSourcePath(filePath);
+    if (!sourcePath)
+        return false;
+    const source = readFileSafe(sourcePath);
+    if (!source)
+        return false;
+    const activeSource = filterMemoryForContext(source);
+    const snippetLines = snippet
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line.length >= 8);
+    return snippetLines.length > 0 && snippetLines.every((line) => activeSource.includes(line));
+}
 /** Search for memories relevant to the user's prompt. Returns formatted markdown or empty string on error. */
 export async function searchRelevantMemories(prompt) {
     if (!qmdAvailable || !prompt.trim())
         return "";
+    let timer;
+    const controller = new AbortController();
     // Sanitize: strip control chars, limit to 200 chars for the search query
     const sanitized = prompt
         // biome-ignore lint/suspicious/noControlCharactersInRegex: we intentionally strip control chars.
@@ -861,19 +1013,26 @@ export async function searchRelevantMemories(prompt) {
         if (!hasCollection)
             return "";
         const results = await Promise.race([
-            runQmdSearch("keyword", sanitized, 3),
-            new Promise((_, reject) => setTimeout(() => reject(new Error("timeout")), 3_000)),
+            runQmdSearch("keyword", sanitized, 3, { signal: controller.signal }),
+            new Promise((_, reject) => {
+                timer = setTimeout(() => {
+                    controller.abort();
+                    reject(new Error("timeout"));
+                }, 3_000);
+            }),
         ]);
         if (!results || results.results.length === 0)
             return "";
         const snippets = results.results
             .map((r) => {
-            const text = getQmdResultText(r);
-            if (!text.trim())
+            const text = filterMemoryForContext(getQmdResultText(r));
+            if (!text)
                 return null;
             const filePath = getQmdResultPath(r);
+            if (!qmdResultPassesSourcePolicy(filePath, text))
+                return null;
             const filePart = filePath ? `_${filePath}_` : "";
-            return filePart ? `${filePart}\n${text.trim()}` : text.trim();
+            return filePart ? `${filePart}\n${text}` : text;
         })
             .filter(Boolean);
         if (snippets.length === 0)
@@ -883,12 +1042,27 @@ export async function searchRelevantMemories(prompt) {
     catch {
         return "";
     }
+    finally {
+        clearTimeout(timer);
+    }
 }
 export function getQmdResultPath(r) {
     return r.path ?? r.file;
 }
 export function getQmdResultText(r) {
-    return r.content ?? r.chunk ?? r.snippet ?? "";
+    const text = r.content ?? r.chunk ?? r.snippet ?? "";
+    const folderContext = r.context?.trim();
+    let normalized = text.trimStart();
+    if (folderContext) {
+        const prefix = `Folder Context: ${folderContext}`;
+        if (normalized.startsWith(prefix)) {
+            const remainder = normalized.slice(prefix.length);
+            if (/^(?:\r?\n){2}/.test(remainder)) {
+                normalized = remainder.replace(/^(?:\r?\n){2}/, "");
+            }
+        }
+    }
+    return normalized.replace(/^@@ -\d+(?:,\d+)?(?: \+\d+(?:,\d+)?)? @@ \(\d+ before, \d+ after\)(?:\r?\n){1,2}/, "");
 }
 function stripAnsi(text) {
     // qmd may emit spinners/progress bars even with --json, especially on first model download.
@@ -916,11 +1090,11 @@ function parseQmdJson(stdout) {
         return [];
     return JSON.parse(jsonText);
 }
-export function runQmdSearch(mode, query, limit) {
+export function runQmdSearch(mode, query, limit, options = {}) {
     const subcommand = mode === "keyword" ? "search" : mode === "semantic" ? "vsearch" : "query";
     const args = [subcommand, "--json", "-c", QMD_COLLECTION_NAME, "-n", String(limit), query];
     return new Promise((resolve, reject) => {
-        execFileFn("qmd", args, { timeout: 60_000 }, (err, stdout, stderr) => {
+        execFileFn("qmd", args, { timeout: 60_000, signal: options.signal }, (err, stdout, stderr) => {
             if (err) {
                 reject(new Error(stderr?.trim() || err.message));
                 return;
@@ -940,6 +1114,41 @@ export function runQmdSearch(mode, query, limit) {
         });
     });
 }
+/**
+ * Best-effort check of whether vector embeddings are actually usable for
+ * semantic/deep search right now. Runs a tiny semantic probe and looks for
+ * qmd's "need embeddings" warning. Bounded by a short timeout because the very
+ * first semantic query can trigger a model download — returns "unknown" rather
+ * than blocking on it. "ready" means the probe ran without the warning; it does
+ * not prove the index has content.
+ */
+export async function probeEmbeddings() {
+    let timer;
+    // Abort the underlying qmd child when the timeout fires so it does not keep
+    // the event loop open until its own 60s timeout and hang the CLI.
+    const controller = new AbortController();
+    try {
+        const { stderr } = await Promise.race([
+            runQmdSearch("semantic", "memory", 1, { signal: controller.signal }),
+            new Promise((_, reject) => {
+                timer = setTimeout(() => {
+                    controller.abort();
+                    reject(new Error("timeout"));
+                }, 4_000);
+            }),
+        ]);
+        return /need embeddings/i.test(stderr ?? "") ? "missing" : "ready";
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (/need embeddings/i.test(msg))
+            return "missing";
+        return "unknown";
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 export async function memoryWrite(params) {
     ensureDirs();
     const target = params.target ?? "daily";
@@ -949,17 +1158,18 @@ export async function memoryWrite(params) {
     if (target === "daily") {
         const filePath = dailyPath(todayStr());
         const existing = readFileSafe(filePath) ?? "";
-        const existingPreview = buildPreview(existing, {
+        const safeExisting = redactSecrets(existing).content;
+        const existingPreview = buildPreview(safeExisting, {
             maxLines: RESPONSE_PREVIEW_MAX_LINES,
             maxChars: RESPONSE_PREVIEW_MAX_CHARS,
             mode: "end",
         });
         const existingSnippet = existingPreview.preview
-            ? `\n\n${formatPreviewBlock("Existing daily log preview", existing, "end")}`
+            ? `\n\n${formatPreviewBlock("Existing daily log preview", safeExisting, "end")}`
             : "\n\nDaily log was empty.";
         const separator = existing.trim() ? "\n\n" : "";
-        const stamped = `<!-- ${ts} [${sid}] -->\n${content}`;
-        fs.writeFileSync(filePath, existing + separator + stamped, "utf-8");
+        const stored = formatStoredEntry(content, `<!-- ${ts} [${sid}] -->`, params.sourceUri);
+        fs.writeFileSync(filePath, existing + separator + stored.entry, "utf-8");
         await ensureQmdAvailableForUpdate();
         scheduleQmdUpdate();
         return {
@@ -970,6 +1180,8 @@ export async function memoryWrite(params) {
                 mode: "append",
                 sessionId: sid,
                 timestamp: ts,
+                sourceUri: sanitizeSourceUri(params.sourceUri),
+                redacted: stored.redacted,
                 qmdUpdateMode: getQmdUpdateMode(),
                 existingPreview,
             },
@@ -986,20 +1198,21 @@ export async function memoryWrite(params) {
         }
         const filePath = topicPath(slug);
         const existing = readFileSafe(filePath) ?? "";
-        const existingPreview = buildPreview(existing, {
+        const safeExisting = redactSecrets(existing).content;
+        const existingPreview = buildPreview(safeExisting, {
             maxLines: RESPONSE_PREVIEW_MAX_LINES,
             maxChars: RESPONSE_PREVIEW_MAX_CHARS,
             mode: "end",
         });
         const existingSnippet = existingPreview.preview
-            ? `\n\n${formatPreviewBlock("Existing topic preview", existing, "end")}`
+            ? `\n\n${formatPreviewBlock("Existing topic preview", safeExisting, "end")}`
             : "\n\nTopic file was empty.";
         const linkDate = params.date?.trim() || todayStr();
         const header = `# Topic: ${topic}\n\n<!-- created: ${ts} [${sid}] -->\n`;
         const separator = existing.trim() ? "\n\n" : "";
         const base = existing.trim() ? existing : header.trimEnd();
-        const stamped = `<!-- ${ts} [${sid}] -->\n${content.trim()}\nDaily: [[${linkDate}]]`;
-        fs.writeFileSync(filePath, `${base}${separator}${stamped}`, "utf-8");
+        const stored = formatStoredEntry(`${content.trim()}\nDaily: [[${linkDate}]]`, `<!-- ${ts} [${sid}] -->`, params.sourceUri);
+        fs.writeFileSync(filePath, `${base}${separator}${stored.entry}`, "utf-8");
         await ensureQmdAvailableForUpdate();
         scheduleQmdUpdate();
         return {
@@ -1013,6 +1226,8 @@ export async function memoryWrite(params) {
                 topic,
                 slug,
                 date: linkDate,
+                sourceUri: sanitizeSourceUri(params.sourceUri),
+                redacted: stored.redacted,
                 qmdUpdateMode: getQmdUpdateMode(),
                 existingPreview,
             },
@@ -1021,17 +1236,18 @@ export async function memoryWrite(params) {
     // long_term
     const memFile = getMemoryFile();
     const existing = readFileSafe(memFile) ?? "";
-    const existingPreview = buildPreview(existing, {
+    const safeExisting = redactSecrets(existing).content;
+    const existingPreview = buildPreview(safeExisting, {
         maxLines: RESPONSE_PREVIEW_MAX_LINES,
         maxChars: RESPONSE_PREVIEW_MAX_CHARS,
         mode: "middle",
     });
     const existingSnippet = existingPreview.preview
-        ? `\n\n${formatPreviewBlock("Existing MEMORY.md preview", existing, "middle")}`
+        ? `\n\n${formatPreviewBlock("Existing MEMORY.md preview", safeExisting, "middle")}`
         : "\n\nMEMORY.md was empty.";
     if (mode === "overwrite") {
-        const stamped = `<!-- last updated: ${ts} [${sid}] -->\n${content}`;
-        fs.writeFileSync(memFile, stamped, "utf-8");
+        const stored = formatStoredEntry(content, `<!-- last updated: ${ts} [${sid}] -->`, params.sourceUri);
+        fs.writeFileSync(memFile, stored.entry, "utf-8");
         await ensureQmdAvailableForUpdate();
         scheduleQmdUpdate();
         return {
@@ -1042,6 +1258,8 @@ export async function memoryWrite(params) {
                 mode: "overwrite",
                 sessionId: sid,
                 timestamp: ts,
+                sourceUri: sanitizeSourceUri(params.sourceUri),
+                redacted: stored.redacted,
                 qmdUpdateMode: getQmdUpdateMode(),
                 existingPreview,
             },
@@ -1049,8 +1267,8 @@ export async function memoryWrite(params) {
     }
     // append (default)
     const separator = existing.trim() ? "\n\n" : "";
-    const stamped = `<!-- ${ts} [${sid}] -->\n${content}`;
-    fs.writeFileSync(memFile, existing + separator + stamped, "utf-8");
+    const stored = formatStoredEntry(content, `<!-- ${ts} [${sid}] -->`, params.sourceUri);
+    fs.writeFileSync(memFile, existing + separator + stored.entry, "utf-8");
     await ensureQmdAvailableForUpdate();
     scheduleQmdUpdate();
     return {
@@ -1061,6 +1279,8 @@ export async function memoryWrite(params) {
             mode: "append",
             sessionId: sid,
             timestamp: ts,
+            sourceUri: sanitizeSourceUri(params.sourceUri),
+            redacted: stored.redacted,
             qmdUpdateMode: getQmdUpdateMode(),
             existingPreview,
         },
@@ -1073,7 +1293,11 @@ export async function scratchpadAction(params) {
     const ts = nowTimestamp();
     const spFile = getScratchpadFile();
     const existing = readFileSafe(spFile) ?? "";
-    let items = parseScratchpad(existing);
+    let items = parseScratchpad(existing).map((item) => ({
+        ...item,
+        text: redactSecrets(item.text).content,
+        meta: redactSecrets(item.meta).content,
+    }));
     if (action === "list") {
         if (items.length === 0) {
             return { text: "Scratchpad is empty.", details: {} };
@@ -1097,7 +1321,8 @@ export async function scratchpadAction(params) {
         if (!text) {
             return { text: "Error: 'text' is required for add.", details: {} };
         }
-        items.push({ done: false, text, meta: `<!-- ${ts} [${sid}] -->` });
+        const safeText = redactSecrets(text).content;
+        items.push({ done: false, text: safeText, meta: `<!-- ${ts} [${sid}] -->` });
         const serialized = serializeScratchpad(items);
         const preview = buildPreview(serialized, {
             maxLines: RESPONSE_PREVIEW_MAX_LINES,
@@ -1108,7 +1333,7 @@ export async function scratchpadAction(params) {
         await ensureQmdAvailableForUpdate();
         scheduleQmdUpdate();
         return {
-            text: `Added: - [ ] ${text}\n\n${formatPreviewBlock("Scratchpad preview", serialized, "start")}`,
+            text: `Added: - [ ] ${safeText}\n\n${formatPreviewBlock("Scratchpad preview", serialized, "start")}`,
             details: {
                 action,
                 sessionId: sid,
@@ -1526,7 +1751,10 @@ export async function distilMemories(params) {
         const content = readFileSafe(path.join(DAILY_DIR, file));
         if (!content?.trim())
             continue;
-        allEntries.push(...parseDailyEntries(date, content));
+        const safeContent = filterMemoryForContext(content);
+        if (!safeContent)
+            continue;
+        allEntries.push(...parseDailyEntries(date, safeContent));
     }
     const topicEntriesByTopic = new Map();
     let totalTopicEntries = 0;
@@ -1535,9 +1763,12 @@ export async function distilMemories(params) {
         const content = readFileSafe(path.join(TOPICS_DIR, file));
         if (!content?.trim())
             continue;
-        const titleMatch = content.match(/^# Topic:\s*(.+)$/m);
+        const safeContent = filterMemoryForContext(content);
+        if (!safeContent)
+            continue;
+        const titleMatch = safeContent.match(/^# Topic:\s*(.+)$/m);
         const title = titleMatch?.[1]?.trim() || slug;
-        const entries = parseTopicEntries(title, slug, content);
+        const entries = parseTopicEntries(title, slug, safeContent);
         if (entries.length === 0)
             continue;
         totalTopicEntries += entries.length;
@@ -1584,7 +1815,8 @@ export async function distilMemories(params) {
     let pinnedSection = "";
     const existingMemory = readFileSafe(MEMORY_FILE);
     if (existingMemory) {
-        const pinnedMatch = existingMemory.match(/## Pinned\n([\s\S]*?)(?=\n## |\n# |$)/);
+        const safeExistingMemory = filterMemoryForContext(existingMemory);
+        const pinnedMatch = safeExistingMemory.match(/## Pinned\n([\s\S]*?)(?=\n## |\n# |$)/);
         if (pinnedMatch) {
             pinnedSection = pinnedMatch[1].trim();
         }

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "myagentmemory",
-	"version": "0.4.12",
-	"description": "Persistent memory for coding agents (Claude Code, Codex, Cursor, Agent) with qmd-powered semantic search across daily logs, long-term memory, and scratchpad",
+	"version": "0.4.13",
+	"description": "agentmemory (agent-memory) is persistent memory for coding agents (Claude Code, OpenAI Codex, Cursor, Agent) with qmd-powered semantic search across daily logs, long-term memory, and scratchpad",
 	"main": "./dist/core.js",
 	"types": "./dist/core.d.ts",
 	"exports": {
@@ -11,37 +11,51 @@
 		}
 	},
 	"bin": {
-		"agent-memory": "./dist/agent-memory"
+		"agent-memory": "./dist/cli.js"
 	},
 	"type": "module",
+	"engines": {
+		"node": ">=20"
+	},
 	"keywords": [
+		"agentmemory",
+		"agent-memory",
+		"agent memory",
+		"ai-memory",
+		"llm-memory",
 		"memory",
 		"search",
 		"qmd",
+		"semantic-search",
 		"scratchpad",
 		"daily-log",
 		"claude-code",
+		"openai-codex",
 		"codex",
 		"cursor",
 		"agent",
-		"agent-memory",
-		"coding-agent"
+		"coding-agent",
+		"developer-tools",
+		"knowledge-management"
 	],
 	"author": "jayzeng",
 	"license": "MIT",
 	"repository": {
 		"type": "git",
-		"url": "git+https://github.com/jayzeng/agent-memory.git"
+		"url": "git+https://github.com/jayzeng/agentmemory.git"
 	},
 	"bugs": {
-		"url": "https://github.com/jayzeng/agent-memory/issues"
+		"url": "https://github.com/jayzeng/agentmemory/issues"
 	},
-	"homepage": "https://github.com/jayzeng/agent-memory#readme",
+	"homepage": "https://github.com/jayzeng/agentmemory#readme",
 	"files": [
 		"src",
 		"skills",
 		"scripts",
-		"dist",
+		"dist/cli.d.ts",
+		"dist/cli.js",
+		"dist/core.d.ts",
+		"dist/core.js",
 		"README.md",
 		"LICENSE"
 	],
@@ -50,18 +64,22 @@
 	},
 	"scripts": {
 		"postinstall": "node scripts/postinstall.cjs",
-		"build": "tsc -p tsconfig.json --noEmit",
+		"build": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.eval.json --noEmit",
+		"build:eval": "tsc -p tsconfig.eval.json --noEmit",
 		"build:lib": "tsc -p tsconfig.build.json",
 		"build:cli": "bun build src/cli.ts --compile --outfile dist/agent-memory --define __VERSION__=\"'$(node -p \"require('./package.json').version\")'\"",
-		"prepack": "npm run build:lib && bun run build:cli",
+		"eval:feedback": "bun eval/run.ts",
+		"prepack": "npm run build:lib",
 		"lint": "biome check .",
 		"test": "bun test test/unit.test.ts",
 		"test:unit": "bun test test/unit.test.ts",
 		"test:cli": "bun test test/cli.test.ts",
+		"test:eval": "bun test test/eval.test.ts",
 		"install-skills": "bash scripts/install-skills.sh"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "^2.4.0",
+		"@types/bun": "^1.3.14",
 		"@types/node": "^25.3.0",
 		"tsx": "^4.0.0",
 		"typescript": "^5.9.3"