nexusmem 0.10.1 → 0.10.2

package/CHANGELOG.md

@@ -11,6 +11,18 @@ built from, matched by publish timestamp: `v0.1.0` → `67a4776`, `v0.1.1` → `
 
 No unreleased changes yet.
 
+## [0.10.2] — 2026-08-30
+
+### Security
+
+- `shell_command` nodes never ran through the same secret-redaction pass `conversation_turn` and
+  `code_diff` nodes already get: a command like `export API_KEY=...` landed verbatim in `title`/`body`,
+  which is exactly what the FTS index and vector embeddings are built from — a secret typed at a
+  prompt could resurface later through `search_memory`/`nexusmem query`. Fixed by running `redact()`
+  over the command before it reaches those fields. `meta.command` is kept raw on purpose: project-id
+  reconciliation and failure/fix correlation both hash or exact-match against the real command text,
+  and redacting that copy too would have silently orphaned nodes on a project-id migration.
+
 ## [0.10.1] — 2026-08-30
 
 ### Added

package/dist/cli/index.js

@@ -3989,8 +3989,8 @@ function scoreShellCommand(entry) {
   else if (cmd.length <= 3) score -= 0.05;
   return Number(Math.min(1, Math.max(0.05, score)).toFixed(3));
 }
-function renderBody2(entry, maxChars) {
-  const parts = [`$ ${entry.command}`];
+function renderBody2(entry, command, maxChars) {
+  const parts = [`$ ${command}`];
   const metaLine = [];
   if (entry.cwd) metaLine.push(`cwd: ${entry.cwd}`);
   if (entry.exitCode !== null) metaLine.push(`exit: ${entry.exitCode}`);
@@ -4000,7 +4000,8 @@ function renderBody2(entry, maxChars) {
 }
 function toMemoryNode3(entry, projectId, opts = {}) {
   const maxBody = opts.maxBodyChars ?? DEFAULT_MAX_BODY_CHARS5;
-  const titleLine = entry.command.split(/\r?\n/)[0] ?? entry.command;
+  const { text: redactedCommand } = redact(entry.command);
+  const titleLine = redactedCommand.split(/\r?\n/)[0] ?? redactedCommand;
   return {
     id: makeNodeId(projectId, "shell_command", entry.naturalKey),
     kind: "shell_command",
@@ -4008,7 +4009,7 @@ function toMemoryNode3(entry, projectId, opts = {}) {
     ts: entry.ts,
     source: `shell:${entry.shell}`,
     title: truncate(titleLine, MAX_TITLE_CHARS7),
-    body: renderBody2(entry, maxBody),
+    body: renderBody2(entry, redactedCommand, maxBody),
     files: [],
     signal: scoreShellCommand(entry),
     provenance: "observed",
@@ -5735,6 +5736,44 @@ async function getStatus(input) {
     store.close();
   }
 }
+async function listStaleSuggestions(input) {
+  const repo = await readRepoInfo(input.projectRoot);
+  const ws = resolveWorkspace(repo.root);
+  const projectId = makeProjectId({ root: repo.root, originUrl: repo.originUrl });
+  const store = MemoryStore.open(ws.dbPath);
+  try {
+    return { suggestions: store.listContradictionSuggestions(projectId, { limit: input.limit }) };
+  } finally {
+    store.close();
+  }
+}
+async function resolveStaleSuggestion(input) {
+  if (input.action === "dismiss") {
+    const repo = await readRepoInfo(input.projectRoot);
+    const ws = resolveWorkspace(repo.root);
+    const projectId = makeProjectId({ root: repo.root, originUrl: repo.originUrl });
+    const store = MemoryStore.open(ws.dbPath);
+    try {
+      const dismissed = store.dismissContradictionSuggestion(projectId, input.candidateId);
+      return {
+        summary: dismissed > 0 ? `dismissed the contradiction suggestion for ${input.candidateId}` : `no open contradiction suggestion for ${input.candidateId}`
+      };
+    } finally {
+      store.close();
+    }
+  }
+  if (!input.againstId) {
+    throw new Error("againstId is required to accept a stale suggestion");
+  }
+  const chunks = [];
+  await runMarkStale({
+    cwd: input.projectRoot,
+    nodeId: input.candidateId,
+    supersedesId: input.againstId,
+    out: (chunk2) => chunks.push(chunk2)
+  });
+  return { summary: stripAnsi(chunks.join("").trim()) };
+}
 
 // src/mcp/server.ts
 function createServer() {
@@ -5824,6 +5863,41 @@ function createServer() {
       };
     }
   );
+  server.registerTool(
+    "list_stale_suggestions",
+    {
+      title: "List open contradiction suggestions",
+      description: 'List open contradiction verdicts for a NexusMem-tracked repository -- candidates flagged by "nexusmem stale --check-contradictions" (or automatically during sync) as likely superseded by a newer, similar node. Nothing has been written yet; use resolve_stale_suggestion to act on one.',
+      inputSchema: {
+        projectRoot: z4.string().describe("Absolute path to the repository root"),
+        limit: z4.number().int().positive().optional().describe("Max suggestions to return, most recently judged first. Default 50.")
+      }
+    },
+    async ({ projectRoot, limit }) => {
+      const result = await listStaleSuggestions({ projectRoot, limit });
+      return {
+        content: [{ type: "text", text: JSON.stringify(result.suggestions, null, 2) }],
+        structuredContent: { suggestions: result.suggestions }
+      };
+    }
+  );
+  server.registerTool(
+    "resolve_stale_suggestion",
+    {
+      title: "Accept or dismiss a contradiction suggestion",
+      description: '"accept" writes a supersede link from candidateId to againstId (the same effect as "nexusmem mark-stale") -- the ranker down-weights candidateId from then on but never deletes it. "dismiss" silences the suggestion without changing ranking, so it stops resurfacing on future stale/sync runs.',
+      inputSchema: {
+        projectRoot: z4.string().describe("Absolute path to the repository root"),
+        candidateId: z4.string().describe("Id of the stale/superseded node"),
+        action: z4.enum(["accept", "dismiss"]).describe("Whether to write the supersede link or silence the suggestion"),
+        againstId: z4.string().optional().describe('Id of the superseding node. Required for "accept", ignored for "dismiss".')
+      }
+    },
+    async ({ projectRoot, candidateId, action, againstId }) => {
+      const result = await resolveStaleSuggestion({ projectRoot, candidateId, action, againstId });
+      return { content: [{ type: "text", text: result.summary }] };
+    }
+  );
   return server;
 }
 async function runMcpServer() {