nexusmem 0.10.3 → 0.10.5

package/CHANGELOG.md

@@ -11,6 +11,82 @@ built from, matched by publish timestamp: `v0.1.0` → `67a4776`, `v0.1.1` → `
 
 No unreleased changes yet.
 
+## [0.10.5] — 2026-09-11
+
+Security release. Existing installs need action after upgrading — see "Action required" below.
+
+### Security
+
+- Secret redaction missed keys whose secret word is part of a longer identifier: `DB_PASSWORD=x`,
+  `OPENAI_API_KEY=x`, `AUTH_TOKEN=x`, `CLIENT_SECRET=x` were kept verbatim (the rule's leading `\b`
+  never matches after `_`), as were values shorter than 8 characters or containing characters such
+  as `@ ! # $`. This affected `scan-shell` output, stored shell and conversation nodes, session
+  summaries, the FTS index, embeddings, and `search_memory` / `query` results.
+- `shell_command` nodes stored the raw command in `meta.command`, so a typed secret was written to
+  `memory.db` even when the title showed it redacted, and was printed by `scan-shell --json` and
+  `precheck`. `meta.command` is now redacted; `meta.commandHash` keeps the raw command's hash so node
+  ids and project-id reconciliation are unchanged.
+- The installed shell hooks appended every command raw to `~/.nexusmem/shell-history.jsonl`. Hooks now
+  pass each command to a NexusMem recorder over stdin; the recorder hashes and redacts it in memory
+  and writes only the redacted command. It writes no temp files and prints nothing, and it drops any
+  event it cannot process instead of writing it raw. Hooks installed by earlier versions keep writing
+  raw commands until reinstalled: `hook status` reports them as outdated, and `sync` redacts what they
+  write and warns.
+- Redaction now also covers credentials in connection URIs (`postgres://user:pass@host`),
+  `Authorization:` headers and bearer tokens, secret-named options whose value is the next argument
+  (`--password x`), and `mysql -pX`, `sshpass -p`, `mongosh -p`, `redis-cli -a`, `curl -u user:pass`.
+
+### Added
+
+- `nexusmem scrub-secrets [--all-projects] [--yes] [--no-embed]` removes secrets that earlier versions
+  already stored: shell, conversation, session-summary and code-diff rows, contradiction reasons, the
+  FTS index, embeddings, and the shell hook log. Dry run by default. `--yes` takes a backup of each
+  database first and prints its path, redacts rows in place (ids unchanged), drops and re-embeds
+  affected vectors, rebuilds the FTS index, runs `VACUUM`, and truncates the WAL. Safe to run
+  repeatedly. Existing `memory.db.backup-*` files are listed, never modified or deleted.
+
+### Action required
+
+1. Upgrade every NexusMem install (global CLI, MCP server configs, the post-commit hook's `nexusmem`),
+   then restart MCP clients and editors so no older version keeps writing.
+2. Run `nexusmem hook install` again in each shell you installed the hook for; `nexusmem hook status`
+   should say `installed`, not `OUTDATED`.
+3. Rotate any credential typed at a shell prompt or pasted into a captured conversation in the
+   affected forms. Scrubbing cannot recall copies already returned to an LLM, backed up, or synced.
+4. Run `nexusmem scrub-secrets --all-projects`, review, then re-run with `--yes`.
+5. Delete the `memory.db.backup-*` files NexusMem lists (they predate redaction) once you have
+   verified the scrubbed database.
+6. Do not use `nexusmem forget <secret>` for this: it stores the value itself in the database's
+   deny-list, and the shell hook captures a bare argument unredacted.
+
+### Known limitations
+
+- NexusMem cannot change your shell's own history files (PSReadLine `ConsoleHost_history.txt`,
+  `~/.bash_history`, `~/.zsh_history`); they still contain whatever you typed.
+- Not yet redacted: a token used as a URL username (`https://TOKEN@host`), `openssl -passin`,
+  `keytool -storepass`, `ssh-keygen -N`, secret-bearing keys without a secret word (`STRIPE_KEY`,
+  `DB_PW`), secrets passed as plain positional arguments, and commit messages, docs and GitHub
+  threads (never redacted).
+
+## [0.10.4] — 2026-09-07
+
+### Added
+
+- Fresh-project syncs classify reconstructable Git commits and diffs, timestamped shell history,
+  and already-supported opt-in coding-agent history as `backfilled` only when a trustworthy source
+  timestamp predates NexusMem initialization. Trustworthily timestamped events between initialization
+  and sync time are `observed`. Tracked Markdown, untimestamped shell history, and other records that
+  cannot be classified remain `unknown`. Retrieval exposes this origin alongside the existing evidence
+  provenance.
+
+### Changed
+
+- Historical shell entries no longer receive timestamps inferred from history-file mtimes.
+  Missing timestamp, cwd, exit code, and duration metadata remain null, and incomplete shell
+  evidence is excluded from failure-to-fix correlation.
+- Schema V13 adds `nodes.capture_mode` and nullable `nodes.source_ts`. Existing approximate
+  shell timestamps and document mtimes migrate to a null `source_ts`; other existing event timestamps are retained.
+
 ## [0.10.3] — 2026-08-31
 
 ### Added
@@ -630,7 +706,11 @@ First public release.
   there is no local-model summarization pass, and the conversation collector has never been audited
   for the stale-node bug that was found and fixed in the docs collector.
 
-[Unreleased]: https://github.com/yaminbkk/NexusMem/compare/v0.10.1...HEAD
+[Unreleased]: https://github.com/yaminbkk/NexusMem/compare/v0.10.5...HEAD
+[0.10.5]: https://github.com/yaminbkk/NexusMem/compare/v0.10.4...v0.10.5
+[0.10.4]: https://github.com/yaminbkk/NexusMem/compare/v0.10.3...v0.10.4
+[0.10.3]: https://github.com/yaminbkk/NexusMem/compare/v0.10.2...v0.10.3
+[0.10.2]: https://github.com/yaminbkk/NexusMem/compare/v0.10.1...v0.10.2
 [0.10.1]: https://github.com/yaminbkk/NexusMem/compare/v0.10.0...v0.10.1
 [0.10.0]: https://github.com/yaminbkk/NexusMem/compare/v0.9.1...v0.10.0
 [0.9.1]: https://github.com/yaminbkk/NexusMem/compare/v0.9.0...v0.9.1

package/README.md

@@ -23,6 +23,8 @@ The shell history is the part worth caring about. Git tells an agent what shippe
 tells it what was attempted, in what order, and which commands exited non-zero. That information
 exists nowhere else, and it disappears when your terminal scrollback rolls over.
 
+![How NexusMem works: git commits, shell commands with their real exit codes, docs, and GitHub threads flow into a local SQLite index, which returns a ranked, token-budgeted slice of that history so your coding agent answers with a real citation instead of a guess](docs/how-it-works.svg)
+
 **Contents:** [Try it](#try-it) · [Exact shell capture](#optional-exact-shell-capture) ·
 [Failure → fix chains](#failure--fix-chains-opt-in) · [How retrieval works](#how-retrieval-works) ·
 [Session summaries](#session-summaries-optional-local-model) ·
@@ -423,6 +425,9 @@ node afterward. `--verify` is a label only; it does not boost ranking. Every nod
 
 `init`, `sync`, `query <text>` (add `--as-of <date>` for a bi-temporal read, see below), `status` (add
 `--share` for a plain-text summary worth pasting somewhere), `projects`, `mcp`, `forget <value>`,
+`scrub-secrets` (re-redacts secrets that versions before 0.10.5 already stored — database rows, FTS
+index, embeddings and the shell hook log; dry-run unless `--yes`, which backs each database up first;
+`--all-projects` covers every registered repository),
 `stale` (add `--check-contradictions` for a local-SLM content check, see above), `mark-stale
 <nodeId> --supersedes <newNodeId>`, `review <nodeId> --verify|--reject` (record a human verdict on
 one node, see above), `precheck` (advisory — warns about staged files with an unresolved past
@@ -539,6 +544,11 @@ Tests are behavioral rather than snapshot-based, and several are regressions tie
 observed failures. `tests/git-errors.test.ts` injects a fake `spawn` to exercise the Windows
 process-spawn faults, which cannot be provoked on demand.
 
+Bug fixes, test coverage, and small focused features are welcome — see
+[CONTRIBUTING.md](CONTRIBUTING.md) for the workflow, or browse issues labeled
+[`good first issue`](https://github.com/yaminbkk/nexusmem/labels/good%20first%20issue)
+for something scoped and self-contained to start with.
+
 ## On how this was built
 
 This started as an experiment in whether a local context-memory engine for coding agents was viable,