open-memex 0.7.0-alpha.3 → 0.7.0-alpha.4

package/AGENTS.md

@@ -136,6 +136,7 @@ Every write path (tool, keyword hook, CLI `add`) must:
 2. If `hadSecret` → the matched secret is **masked in place** (first 4 characters kept, the rest replaced with `x`) and the write proceeds; never save the unmasked original. `<private>…</private>` spans are stripped to `[REDACTED]` instead (design D14).
 3. Check `findDuplicates` (design §3.4): identical content is idempotent (return existing id); near-duplicates (similarity ≥ 0.8) warn but save — suggest `supersede` when the new content replaces the old.
 4. `writeMemoryFile` first, then `readMemoryFile` + `upsertFromFile` to keep FTS in sync.
+5. Deletion reports honestly (D63): only ENOENT counts as "deleted"; any other unlink failure keeps the index row and returns failure — the file is the source of truth and would otherwise resurrect the memory on next sync.
 
 Capture-time aliases (D61): `memory_add`/`supersede` may carry up to 4
 `aliases` (alternate phrasings) into frontmatter; they index in their own FTS

package/CHANGELOG.md

@@ -9,6 +9,17 @@ the `@alpha` tag are development snapshots and are not listed individually.
 
 ## [Unreleased]
 
+## Correctness fixes from the whole-project review (D63)
+
+Six silent-wrong-answer bugs found by an external three-lens review, each fixed with a regression test:
+
+- `init --client visualstudio` no longer wipes other servers from an existing `.mcp.json` (the parsed config was dropped instead of merged).
+- `memory_forget` / `forget` tell the truth: when the memory file can't be deleted (locked, in use), they report failure and keep the index entry, instead of claiming success while the file — the source of truth — brings the memory back on next sync.
+- Config parsing is string-aware: a redact pattern like `src/**/secrets` is no longer eaten as a block comment and silently disabled. `doctor` and the config loader now share one parser.
+- `loadConfig` enforces the `memoryDir` invariant on hand-edited configs; an escaping value (`../../shared`) falls back to the default with a warning instead of writing project memories outside the repo.
+- `migrate` re-scopes as well as re-keys: migrated files get the destination's `scope`/`visibility`, so personal→project migrations are submittable and project→personal memories stay private in exports. Conflict resolution compares parsed timestamps, not RFC-3339 strings.
+- `import` rejects bundle entries whose paths escape the bundle (`../` or symlinks) instead of reading arbitrary local files into the store; rejected paths are printed.
+
 ## Environment variable names (D62)
 
 - The override variables now answer to `OPEN_MEMEX_HOME` (storage root) and `OPEN_MEMEX_CONFIG` (config path). The pre-rename `MY_O_MEMORY_HOME` / `MY_O_MEMORY_CONFIG` names keep working as fallbacks — nothing to migrate, the data root itself does not move. `doctor` notes when the storage root came from the legacy variable.

package/dist/cli.js

@@ -954,12 +954,18 @@ async function main() {
             process.exit(1);
         }
         // Delete by indexed file_path — location-agnostic (appdata or in-repo, 2B/D24).
+        // Only ENOENT = success; anything else means the file survives and
+        // would be re-indexed — fail loudly (P0 review, 2026-10-03).
         if (row.file_path) {
             try {
                 fs.unlinkSync(row.file_path);
             }
-            catch {
-                /* already gone */
+            catch (e) {
+                const code = e.code;
+                if (code !== "ENOENT") {
+                    console.error(`could not delete ${row.file_path} (${code ?? "error"}) — memory not forgotten`);
+                    process.exit(1);
+                }
             }
         }
         deleteFromIndex(id);
@@ -1176,6 +1182,9 @@ async function main() {
                 syncScope(PERSONAL_SCOPE.key, "cli");
             }
             console.log(`${dryRun ? "DRY RUN: " : ""}imported ${r.imported}, skipped ${r.skippedIdentical} identical`);
+            for (const rp of r.rejectedPaths) {
+                console.log(`  rejected: ${rp} (path outside the bundle)`);
+            }
             for (const c of r.skippedConflict) {
                 console.log(`  conflict (kept existing): ${c.id} from ${c.file}`);
             }

package/dist/config.js

@@ -37,13 +37,64 @@ export const DEFAULT_CONFIG = {
     memoryDir: ".ai/open-memex",
     sync: { autoPull: false },
 };
-function stripJsonComments(raw) {
-    // Line comments
-    let out = raw.replace(/^\s*\/\/.*$/gm, "");
-    // Block comments (non-greedy)
-    out = out.replace(/\/\*[\s\S]*?\*\//g, "");
-    // Trailing commas before closing brackets
-    out = out.replace(/,(\s*[}\]])/g, "$1");
+/**
+ * Strip JSONC comments and trailing commas with a string-aware scanner.
+ * The previous regex version was not string-aware: a config value like
+ * "src/**\/secrets" had its `/**…*\/` eaten as a block comment, silently
+ * corrupting the user's redact pattern (P0 review, 2026-10-03). Shared
+ * with doctor.ts — one parser, not two.
+ */
+export function stripJsonComments(raw) {
+    let out = "";
+    let i = 0;
+    let inStr = false;
+    let esc = false;
+    while (i < raw.length) {
+        const c = raw[i];
+        const n = raw[i + 1];
+        if (inStr) {
+            out += c;
+            if (esc)
+                esc = false;
+            else if (c === "\\")
+                esc = true;
+            else if (c === '"')
+                inStr = false;
+            i++;
+            continue;
+        }
+        if (c === '"') {
+            inStr = true;
+            out += c;
+            i++;
+            continue;
+        }
+        if (c === "/" && n === "/") {
+            while (i < raw.length && raw[i] !== "\n")
+                i++;
+            continue;
+        }
+        if (c === "/" && n === "*") {
+            i += 2;
+            while (i < raw.length && !(raw[i] === "*" && raw[i + 1] === "/"))
+                i++;
+            i += 2;
+            continue;
+        }
+        if (c === ",") {
+            // Trailing comma: drop it when the next significant char closes a
+            // container. Whitespace/comments between are tolerated.
+            let j = i + 1;
+            while (j < raw.length && /\s/.test(raw[j]))
+                j++;
+            if (raw[j] === "}" || raw[j] === "]") {
+                i++;
+                continue;
+            }
+        }
+        out += c;
+        i++;
+    }
     return out;
 }
 /**
@@ -132,7 +183,19 @@ export function loadConfig() {
         try {
             const raw = fs.readFileSync(p, "utf8");
             const parsed = JSON.parse(stripJsonComments(raw));
-            return { ...DEFAULT_CONFIG, ...parsed };
+            const merged = { ...DEFAULT_CONFIG, ...parsed };
+            // The config file is hand-editable, so the load path must enforce
+            // the same invariants `config set` does (P0 review, 2026-10-03):
+            // an unvalidated memoryDir like "../../shared" would put
+            // committed project memories outside the repo.
+            try {
+                merged.memoryDir = toRelativeDir(merged.memoryDir);
+            }
+            catch {
+                console.error(`[open-memex] invalid memoryDir "${merged.memoryDir}" in ${p} — using default "${DEFAULT_CONFIG.memoryDir}"`);
+                merged.memoryDir = DEFAULT_CONFIG.memoryDir;
+            }
+            return merged;
         }
         catch (err) {
             console.error(`[open-memex] failed to parse ${p}:`, err);

package/dist/doctor.js

@@ -7,7 +7,7 @@ import os from "node:os";
 import path from "node:path";
 import { spawn, execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { loadConfig, configSource, DEFAULT_CONFIG } from "./config.js";
+import { loadConfig, configSource, DEFAULT_CONFIG, stripJsonComments } from "./config.js";
 import { paths, homeOverride } from "./paths.js";
 import { resolveCwdScope } from "./scope.js";
 import { db, backendName } from "./store/db.js";
@@ -407,7 +407,8 @@ function mcpCheck() {
     });
 }
 /** Parse JSON tolerating line/block comments plus trailing commas
- * (VS Code's settings.json is JSONC). Health-check grade, not a full parser. */
+ * (VS Code's settings.json is JSONC). Uses config.ts's string-aware
+ * stripper — one parser, not two (P0 review, 2026-10-03). */
 function parseLenientJson(raw) {
     try {
         return JSON.parse(raw);
@@ -415,47 +416,7 @@ function parseLenientJson(raw) {
     catch {
         /* fall through to comment stripping */
     }
-    let out = "";
-    let i = 0;
-    let inStr = false;
-    let esc = false;
-    while (i < raw.length) {
-        const c = raw[i];
-        const n = raw[i + 1];
-        if (inStr) {
-            out += c;
-            if (esc)
-                esc = false;
-            else if (c === "\\")
-                esc = true;
-            else if (c === '"')
-                inStr = false;
-            i++;
-            continue;
-        }
-        if (c === '"') {
-            inStr = true;
-            out += c;
-            i++;
-            continue;
-        }
-        if (c === "/" && n === "/") {
-            while (i < raw.length && raw[i] !== "\n")
-                i++;
-            continue;
-        }
-        if (c === "/" && n === "*") {
-            i += 2;
-            while (i < raw.length && !(raw[i] === "*" && raw[i + 1] === "/"))
-                i++;
-            i += 2;
-            continue;
-        }
-        out += c;
-        i++;
-    }
-    out = out.replace(/,\s*([}\]])/g, "$1");
-    return JSON.parse(out);
+    return JSON.parse(stripJsonComments(raw));
 }
 function vscodeSettingsPath() {
     const home = os.homedir();

package/dist/export.js

@@ -117,10 +117,20 @@ export function importBundle(bundlePath, opts) {
         if (manifest.format !== EXPORT_FORMAT) {
             fail(`unsupported bundle format: ${manifest.format} (expected ${EXPORT_FORMAT})`);
         }
-        const result = { imported: 0, skippedIdentical: 0, skippedConflict: [] };
+        const result = { imported: 0, skippedIdentical: 0, skippedConflict: [], rejectedPaths: [] };
         const existingStmt = db().prepare(`SELECT content_hash FROM memories WHERE id = ?`);
+        // The manifest comes from whoever sent the bundle: entry.file must
+        // stay inside the staging dir (P0 review, 2026-10-03 — "../" entries
+        // otherwise read arbitrary .md files into the store). realpath also
+        // catches symlinks planted by the tarball.
+        const stageRoot = fs.realpathSync(stage);
         for (const entry of manifest.memories ?? []) {
-            const src = path.join(stage, entry.file);
+            const joined = path.resolve(path.join(stage, entry.file));
+            const src = fs.existsSync(joined) ? fs.realpathSync(joined) : joined;
+            if (!src.startsWith(stageRoot + path.sep)) {
+                result.rejectedPaths.push(entry.file);
+                continue;
+            }
             const mf = readMemoryFile(src);
             if (!mf)
                 continue;

package/dist/init.js

@@ -470,6 +470,7 @@ function writeVisualStudioMcpJson(root, force) {
             });
             return null;
         }
+        doc = parsed;
     }
     const section = (doc["servers"] ??= {});
     // F30: drop the pre-rename server entry — it points at the OLD data dir.

package/dist/store/migrate.js

@@ -2,8 +2,9 @@ import fs from "node:fs";
 import path from "node:path";
 import { memoriesDirFor, memoriesDirPath } from "../paths.js";
 import { db } from "./db.js";
-import { iterMemoryFiles, readMemoryFile, serialize, } from "./markdown.js";
+import { iterMemoryFiles, readMemoryFile, serialize, timeToMs, } from "./markdown.js";
 import { syncScope } from "./sync.js";
+import { PERSONAL_SCOPE } from "../scope.js";
 /** True if this scope has at least one `.md` file on disk. Does not create
  *  the directory if it doesn't already exist. */
 export function scopeHasFiles(scopeKey) {
@@ -60,7 +61,10 @@ export function migrateScope(fromKey, toKey, opts = {}) {
             else if (strategy === "overwrite") {
                 log(`conflict: overwriting destination (--on-conflict=overwrite): ${dstPath}`);
             }
-            else if (dst.fm.updated_at >= mf.fm.updated_at) {
+            else if (timeToMs(dst.fm.updated_at) >= timeToMs(mf.fm.updated_at)) {
+                // Compare parsed instants, not RFC-3339 strings: lexicographic
+                // order breaks around fractional seconds ("…:00Z" > "…:00.005Z"),
+                // letting the older file win.
                 action = "skip";
                 log(`conflict: kept destination (newer updated_at): ${dstPath}`);
             }
@@ -72,9 +76,16 @@ export function migrateScope(fromKey, toKey, opts = {}) {
             stats.skipped++;
             continue;
         }
+        // Re-key AND re-scope: scope/visibility must follow the destination
+        // (P0 review, 2026-10-03). Rewriting only scope_key produced files
+        // submit rejects ("scope is personal") or personal memories carrying
+        // visibility: internal into exports.
+        const toPersonal = toKey === PERSONAL_SCOPE.key;
         const newFm = {
             ...mf.fm,
             scope_key: toKey,
+            scope: toPersonal ? "personal" : "project",
+            visibility: toPersonal ? "private" : "internal",
             project_name: opts.toProjectName ?? mf.fm.project_name,
         };
         const raw = serialize(newFm, mf.body);

package/dist/tools/ops.js

@@ -273,12 +273,21 @@ export async function forgetMemory(args) {
         return { title: "memory: not found", output: `No memory with id ${args.id}.` };
     }
     // Delete by indexed file_path — location-agnostic (appdata or in-repo, 2B/D24).
+    // Only ENOENT counts as "deleted": on any other unlink failure the file
+    // is still the source of truth and would be re-indexed on next sync, so
+    // report failure instead of lying (P0 review, 2026-10-03).
     if (row.file_path) {
         try {
             fs.unlinkSync(row.file_path);
         }
-        catch {
-            /* already gone */
+        catch (e) {
+            const code = e.code;
+            if (code !== "ENOENT") {
+                return {
+                    title: "memory: forget failed",
+                    output: `Could not delete ${row.file_path} (${code ?? "error"}) — the memory was NOT forgotten and is still in the index. Close anything holding the file and retry.`,
+                };
+            }
         }
     }
     deleteFromIndex(args.id);

package/docs/V2-DESIGN.md

@@ -1316,6 +1316,24 @@ requirement: personal data never touches third-party services). Benchmarks to tr
   variable, and its pre-rename-dir leftovers check reads whichever
   variable is in effect.
 
+- **D63 — correctness fixes from a whole-project external review.** Six
+  verified silent-wrong-answer bugs, fixed as one batch: (1) VS init
+  dropped the parsed `.mcp.json` instead of merging it, wiping other
+  servers; (2) forget reported success when unlink failed — only ENOENT
+  is success now, both in the tool op and the CLI; (3) the config
+  loader's regex comment-stripper was not string-aware and corrupted
+  redact patterns (`src/**/secrets` → `srcsecrets`) — replaced with a
+  string-aware scanner now shared with doctor (one parser, not two);
+  (4) `loadConfig` enforces the `memoryDir` no-escape invariant on
+  hand-edited files, falling back to the default with a warning;
+  (5) `migrate` rewrites `scope`/`visibility` with the key, and
+  conflict resolution compares parsed timestamps (lexicographic
+  RFC-3339 order breaks at fractional seconds); (6) bundle import
+  enforces staging-dir containment (resolve + realpath), rejecting
+  `../` and symlink escapes. Rule going forward: any behavior that can
+  fail must fail loudly in its return value; "already gone" is the only
+  swallowed delete error.
+
 ## Open Questions
 
 _All resolved — see D10 (rename), D11 (type/role split), D12 (explicit pull)._

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-memex",
-  "version": "0.7.0-alpha.3",
+  "version": "0.7.0-alpha.4",
   "description": "Local-first memory layer and protocol for AI coding agents. Markdown source of truth, SQLite FTS5 index, zero cloud.",
   "type": "module",
   "license": "Apache-2.0",

package/scripts/smoke-pure.ts

@@ -13,7 +13,41 @@ import { userMcpConfigPath, mergeServerEntry, detectInstalledClients, mergePlugi
 import { z } from "zod";
 import { memoryAddArgs } from "../src/tools/ops.ts";
 import { dataRootPath, homeOverride } from "../src/paths.ts";
-import { configFilePath } from "../src/config.ts";
+import { configFilePath, loadConfig, stripJsonComments } from "../src/config.ts";
+
+console.log("== jsonc parsing + config invariants (P0) ==");
+{
+  // The pre-fix regex stripper ate "src/**/secrets" as a block comment,
+  // silently disabling the user's redact rule.
+  const doc = JSON.parse(stripJsonComments(`{
+    // a line comment with a "quote
+    "redactPatterns": ["src/**/secrets", "a /* not a comment */ b"],
+    /* a real block comment */
+    "memoryDir": ".ai/open-memex",
+  }`)) as { redactPatterns: string[] };
+  ok("redact pattern with ** survives comment stripping",
+    doc.redactPatterns[0] === "src/**/secrets" && doc.redactPatterns[1] === "a /* not a comment */ b",
+    JSON.stringify(doc.redactPatterns));
+}
+{
+  // loadConfig must enforce the memoryDir invariant on hand-edited files.
+  const saved = process.env.OPEN_MEMEX_CONFIG;
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "om-cfg-"));
+  const file = path.join(dir, "c.jsonc");
+  fs.writeFileSync(file, JSON.stringify({ memoryDir: "../../shared" }));
+  const errs: unknown[] = [];
+  const origErr = console.error;
+  console.error = (...a: unknown[]) => errs.push(a);
+  try {
+    process.env.OPEN_MEMEX_CONFIG = file;
+    ok("escaping memoryDir falls back to default", loadConfig().memoryDir === ".ai/open-memex");
+  } finally {
+    console.error = origErr;
+    if (saved === undefined) delete process.env.OPEN_MEMEX_CONFIG;
+    else process.env.OPEN_MEMEX_CONFIG = saved;
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
 
 let fails = 0;
 function ok(name: string, cond: boolean, info?: unknown) {

package/scripts/test-full.ts

@@ -176,6 +176,40 @@ ok("forget deletes", r.code === 0 && /delet/i.test(r.out), r.out.slice(0, 120));
 r = cli(["list"], PROJ);
 ok("forgotten id gone from list", !r.out.includes(idDecision));
 
+// P0: forget must not report success when the file cannot be deleted —
+// the file is the source of truth and would be re-indexed on next sync.
+// (Simulated by putting a directory where the file belongs: unlink fails
+// with EISDIR even for root, unlike permission bits.)
+{
+  const idF = addMem(["fulltest forget failure"], PROJ);
+  const memRoot = path.join(TESTENV.MY_O_MEMORY_HOME as string, "memories");
+  let memFile = "";
+  const findFile = (d: string) => {
+    for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+      const p2 = path.join(d, e.name);
+      if (e.isDirectory()) findFile(p2);
+      else if (e.name === idF + ".md") memFile = p2;
+    }
+  };
+  findFile(memRoot);
+  ok("forget-failure setup found the file", !!memFile);
+  const backup = fs.readFileSync(memFile, "utf8");
+  fs.rmSync(memFile);
+  fs.mkdirSync(memFile);
+  try {
+    r = cli(["forget", idF], PROJ);
+    ok("forget reports failure when unlink fails",
+      r.code !== 0 && /could not delete/i.test(r.err + r.out),
+      (r.err || r.out).slice(0, 150));
+  } finally {
+    fs.rmSync(memFile, { recursive: true });
+    fs.writeFileSync(memFile, backup);
+  }
+  r = cli(["list"], PROJ);
+  ok("memory survives failed forget", r.out.includes(idF), r.out.slice(0, 150));
+  r = cli(["forget", idF], PROJ);
+  ok("forget succeeds once the file is deletable again", r.code === 0, (r.err || r.out).slice(0, 150));
+}
 // ---------- 4. propose / submit / promote / sync-status ----------
 console.log("== review workflow: propose / submit / promote ==");
 const idProp = addMem(["fulltest proposal candidate", "--scope", "personal"], PROJ);
@@ -231,6 +265,26 @@ const cfile = path.join(T, "conflict.tar.gz");
 execFileSync("tar", ["-czf", cfile, "-C", cstage, "manifest.json", "memories"], { env: TESTENV });
 r = cli2Retry(["import", cfile], PROJ2);
 ok("import conflict reported, never overwritten", /conflict/.test(r.out) && /imported 0/.test(r.out), r.out.slice(0, 160));
+// P0: a bundle manifest pointing outside the bundle must be rejected —
+// it otherwise imports arbitrary local .md files into the store. The
+// secret is planted next to the import staging dir (os.tmpdir()), which
+// is where "../" from a manifest entry lands.
+{
+  const secretName = `outside-secret-${process.pid}.md`;
+  const secretFile = path.join(os.tmpdir(), secretName);
+  const secretId = "01ARZ3NDEKTSV4RRFFQ69G5FAV";
+  fs.writeFileSync(secretFile, `---\nid: ${secretId}\nscope: personal\nscope_key: personal\nvisibility: private\ntype: fact\nstatus: active\ncreated_at: 2026-01-01T00:00:00Z\nupdated_at: 2026-01-01T00:00:00Z\n---\n\nfulltest traversal secret\n`);
+  const tstage = path.join(T, "tstage");
+  fs.mkdirSync(tstage, { recursive: true });
+  fs.writeFileSync(path.join(tstage, "manifest.json"), JSON.stringify({ format: "open-memex-export/1", exported_at: "2026-01-01T00:00:00Z", open_memex_version: "t", include_private: true, filters: {}, memories: [{ id: secretId, scope: "personal", file: `../${secretName}` }] }));
+  const tfile = path.join(T, "traversal.tar.gz");
+  execFileSync("tar", ["-czf", tfile, "-C", tstage, "manifest.json"], { env: TESTENV });
+  r = cli2Retry(["import", tfile], PROJ2);
+  ok("import rejects path outside bundle", /imported 0/.test(r.out) && /rejected/.test(r.out), r.out.slice(0, 160));
+  r = cli2(["search", "traversal", "--scope", "personal"], PROJ2);
+  ok("traversed file never landed in store", !/traversal secret/.test(r.out), r.out.slice(0, 160));
+  fs.rmSync(secretFile, { force: true });
+}
 
 // ---------- 6. distill-agents ----------
 console.log("== distill-agents ==");
@@ -279,6 +333,24 @@ try { dbOk = fs.existsSync(dbPath) && fs.statSync(dbPath).mtimeMs >= beforeReind
 ok("reindex rebuilds", dbOk, `db exists: ${fs.existsSync(dbPath)}`);
 r = cli(["list", "--scope", "personal"], PROJ);
 ok("list works after reindex", r.out.includes(idMig) || r.out.includes(idPersonal));
+// P0: a real migrate must re-scope the file, not just re-key it — a
+// personal memory migrated to the project key must become submittable
+// project memory (scope: project in its frontmatter).
+r = cli(["migrate", "--from", "personal", "--to", "project"], PROJ);
+ok("migrate personal→project runs", r.code === 0, (r.err || r.out).slice(0, 150));
+{
+  const memRoot = path.join(TESTENV.MY_O_MEMORY_HOME as string, "memories");
+  let moved = "";
+  const walk = (d: string) => {
+    for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+      const p = path.join(d, e.name);
+      if (e.isDirectory()) walk(p);
+      else if (e.name === idMig + ".md") moved = fs.readFileSync(p, "utf8");
+    }
+  };
+  walk(memRoot);
+  ok("migrated file is now scope: project", /^scope: project$/m.test(moved), moved.slice(0, 200));
+}
 
 // ---------- 9. capture / doctor / mcp --print-config / init ----------
 console.log("== capture / doctor / mcp / init ==");
@@ -290,6 +362,17 @@ for (const c of ["vscode", "cursor", "claude", "opencode", "visualstudio"]) {
 }
 r = cli(["init", "--client", "vscode", "--yes"], PROJ);
 ok("init --client vscode --yes", r.code === 0 && fs.existsSync(path.join(PROJ, ".vscode", "mcp.json")), (r.err || r.out).slice(0, 150));
+// P0: VS init must merge into an existing .mcp.json, not replace it —
+// the parsed doc used to be dropped, wiping other MCP servers.
+{
+  const mcpFile = path.join(PROJ, ".mcp.json");
+  fs.writeFileSync(mcpFile, JSON.stringify({ servers: { "other-server": { type: "stdio", command: "other" } } }));
+  r = cli(["init", "--client", "visualstudio", "--yes"], PROJ);
+  const after = JSON.parse(fs.readFileSync(mcpFile, "utf8")) as { servers?: Record<string, unknown> };
+  ok("VS init preserves other servers in .mcp.json",
+    r.code === 0 && !!after.servers?.["other-server"] && !!after.servers?.["open-memex"],
+    JSON.stringify(after).slice(0, 160));
+}
 r = cliRetry(["doctor"], PROJ);
 ok("doctor", r.code === 0 && /All checks passed/.test(r.out), (r.err || r.out).slice(0, 200));
 

package/src/cli.ts

@@ -1059,11 +1059,17 @@ async function main() {
       process.exit(1);
     }
     // Delete by indexed file_path — location-agnostic (appdata or in-repo, 2B/D24).
+    // Only ENOENT = success; anything else means the file survives and
+    // would be re-indexed — fail loudly (P0 review, 2026-10-03).
     if (row.file_path) {
       try {
         fs.unlinkSync(row.file_path);
-      } catch {
-        /* already gone */
+      } catch (e) {
+        const code = (e as NodeJS.ErrnoException).code;
+        if (code !== "ENOENT") {
+          console.error(`could not delete ${row.file_path} (${code ?? "error"}) — memory not forgotten`);
+          process.exit(1);
+        }
       }
     }
     deleteFromIndex(id);
@@ -1281,6 +1287,9 @@ function positionalArgs(argv: string[]): string[] {
       console.log(
         `${dryRun ? "DRY RUN: " : ""}imported ${r.imported}, skipped ${r.skippedIdentical} identical`,
       );
+      for (const rp of r.rejectedPaths) {
+        console.log(`  rejected: ${rp} (path outside the bundle)`);
+      }
       for (const c of r.skippedConflict) {
         console.log(`  conflict (kept existing): ${c.id} from ${c.file}`);
       }

package/src/config.ts

@@ -74,13 +74,58 @@ export const DEFAULT_CONFIG: MyOMemoryConfig = {
   sync: { autoPull: false },
 };
 
-function stripJsonComments(raw: string): string {
-  // Line comments
-  let out = raw.replace(/^\s*\/\/.*$/gm, "");
-  // Block comments (non-greedy)
-  out = out.replace(/\/\*[\s\S]*?\*\//g, "");
-  // Trailing commas before closing brackets
-  out = out.replace(/,(\s*[}\]])/g, "$1");
+/**
+ * Strip JSONC comments and trailing commas with a string-aware scanner.
+ * The previous regex version was not string-aware: a config value like
+ * "src/**\/secrets" had its `/**…*\/` eaten as a block comment, silently
+ * corrupting the user's redact pattern (P0 review, 2026-10-03). Shared
+ * with doctor.ts — one parser, not two.
+ */
+export function stripJsonComments(raw: string): string {
+  let out = "";
+  let i = 0;
+  let inStr = false;
+  let esc = false;
+  while (i < raw.length) {
+    const c = raw[i]!;
+    const n = raw[i + 1];
+    if (inStr) {
+      out += c;
+      if (esc) esc = false;
+      else if (c === "\\") esc = true;
+      else if (c === '"') inStr = false;
+      i++;
+      continue;
+    }
+    if (c === '"') {
+      inStr = true;
+      out += c;
+      i++;
+      continue;
+    }
+    if (c === "/" && n === "/") {
+      while (i < raw.length && raw[i] !== "\n") i++;
+      continue;
+    }
+    if (c === "/" && n === "*") {
+      i += 2;
+      while (i < raw.length && !(raw[i] === "*" && raw[i + 1] === "/")) i++;
+      i += 2;
+      continue;
+    }
+    if (c === ",") {
+      // Trailing comma: drop it when the next significant char closes a
+      // container. Whitespace/comments between are tolerated.
+      let j = i + 1;
+      while (j < raw.length && /\s/.test(raw[j]!)) j++;
+      if (raw[j] === "}" || raw[j] === "]") {
+        i++;
+        continue;
+      }
+    }
+    out += c;
+    i++;
+  }
   return out;
 }
 
@@ -177,7 +222,20 @@ export function loadConfig(): MyOMemoryConfig {
     try {
       const raw = fs.readFileSync(p, "utf8");
       const parsed = JSON.parse(stripJsonComments(raw)) as Partial<MyOMemoryConfig>;
-      return { ...DEFAULT_CONFIG, ...parsed };
+      const merged = { ...DEFAULT_CONFIG, ...parsed };
+      // The config file is hand-editable, so the load path must enforce
+      // the same invariants `config set` does (P0 review, 2026-10-03):
+      // an unvalidated memoryDir like "../../shared" would put
+      // committed project memories outside the repo.
+      try {
+        merged.memoryDir = toRelativeDir(merged.memoryDir);
+      } catch {
+        console.error(
+          `[open-memex] invalid memoryDir "${merged.memoryDir}" in ${p} — using default "${DEFAULT_CONFIG.memoryDir}"`,
+        );
+        merged.memoryDir = DEFAULT_CONFIG.memoryDir;
+      }
+      return merged;
     } catch (err) {
       console.error(`[open-memex] failed to parse ${p}:`, err);
     }

package/src/doctor.ts

@@ -7,7 +7,7 @@ import os from "node:os";
 import path from "node:path";
 import { spawn, execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { loadConfig, configSource, DEFAULT_CONFIG } from "./config.ts";
+import { loadConfig, configSource, DEFAULT_CONFIG, stripJsonComments } from "./config.ts";
 import { paths, homeOverride } from "./paths.ts";
 import { resolveCwdScope } from "./scope.ts";
 import { db, backendName } from "./store/db.ts";
@@ -429,49 +429,15 @@ function mcpCheck(): Promise<Check> {
 }
 
 /** Parse JSON tolerating line/block comments plus trailing commas
- * (VS Code's settings.json is JSONC). Health-check grade, not a full parser. */
+ * (VS Code's settings.json is JSONC). Uses config.ts's string-aware
+ * stripper — one parser, not two (P0 review, 2026-10-03). */
 function parseLenientJson(raw: string): Record<string, unknown> {
   try {
     return JSON.parse(raw) as Record<string, unknown>;
   } catch {
     /* fall through to comment stripping */
   }
-  let out = "";
-  let i = 0;
-  let inStr = false;
-  let esc = false;
-  while (i < raw.length) {
-    const c = raw[i];
-    const n = raw[i + 1];
-    if (inStr) {
-      out += c;
-      if (esc) esc = false;
-      else if (c === "\\") esc = true;
-      else if (c === '"') inStr = false;
-      i++;
-      continue;
-    }
-    if (c === '"') {
-      inStr = true;
-      out += c;
-      i++;
-      continue;
-    }
-    if (c === "/" && n === "/") {
-      while (i < raw.length && raw[i] !== "\n") i++;
-      continue;
-    }
-    if (c === "/" && n === "*") {
-      i += 2;
-      while (i < raw.length && !(raw[i] === "*" && raw[i + 1] === "/")) i++;
-      i += 2;
-      continue;
-    }
-    out += c;
-    i++;
-  }
-  out = out.replace(/,\s*([}\]])/g, "$1");
-  return JSON.parse(out) as Record<string, unknown>;
+  return JSON.parse(stripJsonComments(raw)) as Record<string, unknown>;
 }
 
 function vscodeSettingsPath(): string | null {

package/src/export.ts

@@ -152,6 +152,8 @@ export interface ImportResult {
   imported: number;
   skippedIdentical: number;
   skippedConflict: { id: string; file: string }[];
+  /** Manifest entries refused for pointing outside the bundle. */
+  rejectedPaths: string[];
 }
 
 export function importBundle(bundlePath: string, opts: ImportOptions): ImportResult {
@@ -172,10 +174,20 @@ export function importBundle(bundlePath: string, opts: ImportOptions): ImportRes
       fail(`unsupported bundle format: ${manifest.format} (expected ${EXPORT_FORMAT})`);
     }
 
-    const result: ImportResult = { imported: 0, skippedIdentical: 0, skippedConflict: [] };
+    const result: ImportResult = { imported: 0, skippedIdentical: 0, skippedConflict: [], rejectedPaths: [] };
     const existingStmt = db().prepare(`SELECT content_hash FROM memories WHERE id = ?`);
+    // The manifest comes from whoever sent the bundle: entry.file must
+    // stay inside the staging dir (P0 review, 2026-10-03 — "../" entries
+    // otherwise read arbitrary .md files into the store). realpath also
+    // catches symlinks planted by the tarball.
+    const stageRoot = fs.realpathSync(stage);
     for (const entry of manifest.memories ?? []) {
-      const src = path.join(stage, entry.file);
+      const joined = path.resolve(path.join(stage, entry.file));
+      const src = fs.existsSync(joined) ? fs.realpathSync(joined) : joined;
+      if (!src.startsWith(stageRoot + path.sep)) {
+        result.rejectedPaths.push(entry.file);
+        continue;
+      }
       const mf = readMemoryFile(src);
       if (!mf) continue;
       const fm = normalizeFrontmatter({ ...mf.fm } as unknown as Record<string, unknown>);

package/src/init.ts

@@ -508,6 +508,7 @@ function writeVisualStudioMcpJson(root: string, force: boolean): string | null {
       });
       return null;
     }
+    doc = parsed;
   }
   const section = ((doc["servers"] ??= {}) as Record<string, unknown>);
   // F30: drop the pre-rename server entry — it points at the OLD data dir.

package/src/store/migrate.ts

@@ -6,9 +6,11 @@ import {
   iterMemoryFiles,
   readMemoryFile,
   serialize,
+  timeToMs,
   type Frontmatter,
 } from "./markdown.ts";
 import { syncScope } from "./sync.ts";
+import { PERSONAL_SCOPE } from "../scope.ts";
 
 export type ConflictStrategy = "newer" | "overwrite" | "skip";
 
@@ -90,7 +92,10 @@ export function migrateScope(
         log(`conflict: kept destination (--on-conflict=skip): ${dstPath}`);
       } else if (strategy === "overwrite") {
         log(`conflict: overwriting destination (--on-conflict=overwrite): ${dstPath}`);
-      } else if (dst.fm.updated_at >= mf.fm.updated_at) {
+      } else if (timeToMs(dst.fm.updated_at) >= timeToMs(mf.fm.updated_at)) {
+        // Compare parsed instants, not RFC-3339 strings: lexicographic
+        // order breaks around fractional seconds ("…:00Z" > "…:00.005Z"),
+        // letting the older file win.
         action = "skip";
         log(`conflict: kept destination (newer updated_at): ${dstPath}`);
       } else {
@@ -103,9 +108,16 @@ export function migrateScope(
       continue;
     }
 
+    // Re-key AND re-scope: scope/visibility must follow the destination
+    // (P0 review, 2026-10-03). Rewriting only scope_key produced files
+    // submit rejects ("scope is personal") or personal memories carrying
+    // visibility: internal into exports.
+    const toPersonal = toKey === PERSONAL_SCOPE.key;
     const newFm: Frontmatter = {
       ...mf.fm,
       scope_key: toKey,
+      scope: toPersonal ? "personal" : "project",
+      visibility: toPersonal ? "private" : "internal",
       project_name: opts.toProjectName ?? mf.fm.project_name,
     };
     const raw = serialize(newFm, mf.body);

package/src/tools/ops.ts

@@ -388,11 +388,20 @@ export async function forgetMemory(args: MemoryForgetArgs): Promise<ToolResult>
     return { title: "memory: not found", output: `No memory with id ${args.id}.` };
   }
   // Delete by indexed file_path — location-agnostic (appdata or in-repo, 2B/D24).
+  // Only ENOENT counts as "deleted": on any other unlink failure the file
+  // is still the source of truth and would be re-indexed on next sync, so
+  // report failure instead of lying (P0 review, 2026-10-03).
   if (row.file_path) {
     try {
       fs.unlinkSync(row.file_path);
-    } catch {
-      /* already gone */
+    } catch (e) {
+      const code = (e as NodeJS.ErrnoException).code;
+      if (code !== "ENOENT") {
+        return {
+          title: "memory: forget failed",
+          output: `Could not delete ${row.file_path} (${code ?? "error"}) — the memory was NOT forgotten and is still in the index. Close anything holding the file and retry.`,
+        };
+      }
     }
   }
   deleteFromIndex(args.id);