opencode-self-improvement 0.8.2 → 0.8.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-self-improvement",
-  "version": "0.8.2",
+  "version": "0.8.4",
   "description": "Durable memory for opencode: remember facts, decisions, and commands across sessions, plus a one-command per-repo setup (/repo-init).",
   "main": "index.ts",
   "exports": {

package/src/index.ts

@@ -399,7 +399,7 @@ const impl = {
       editor.add(validated(UndoArgs, {
         name: "memory_undo",
         description:
-          "List memory snapshots, or restore one (rollback). SAFE BY DEFAULT: daily store files are shared across sessions, so if the current file has rows added or edited since the snapshot, restore REFUSES and lists them — re-run with merge=true to restore AND keep those rows, or force=true for the exact rollback. `snapshot` accepts a bare name from the list or a full path.",
+          "List memory snapshots, or restore one (rollback). Only snapshots inside this store's snapshots directory are accepted: pass a bare name from the list or its full path. SAFE BY DEFAULT: restore refuses if the current file has rows added or edited since the snapshot, and audited human/tool deletions stay deleted. Re-run with merge=true to restore AND keep divergent rows, or force=true for an explicit exact rollback. Blocklisted rows remain inactive in every mode.",
         options: direct,
         async execute(args): Promise<{ content: string }> {
           if (args.snapshot) {
@@ -420,7 +420,10 @@ const impl = {
               ? ` Kept ${res.concurrentAdded.length} added / ${res.concurrentChanged.length} changed row(s) written after the snapshot.`
               : "";
             const safety = res.safety ? ` Pre-restore file snapshotted -> ${res.safety}.` : "";
-            return { content: `Restored ${basename(res.target)} from ${res.mode} snapshot -> ${res.target}.${kept}${safety}` };
+            const omitted = res.deletedOmitted.length
+              ? ` Omitted ${res.deletedOmitted.length} deliberately deleted row(s); use force=true to recover them.`
+              : "";
+            return { content: `Restored ${basename(res.target)} from ${res.mode} snapshot -> ${res.target}.${kept}${safety}${omitted}` };
           }
           const snaps = await listSnapshots();
           if (!snaps.length) return { content: "No snapshots" };
@@ -602,10 +605,13 @@ const impl = {
 
     // Per-session frozen injection epochs: the relevance block plus the store
     // fingerprint it was computed against. Recomputed ONLY on the first prompt
-    // of a session, when the store changes, or after a compaction (see the
-    // prompt/compaction hooks) — so the system prefix, and with it the
-    // provider prompt cache, survives ordinary turns.
+    // of a session, when injectable rows change, or after a compaction (see the
+    // prompt/context/compaction hooks) — so the system prefix, and with it the
+    // provider prompt cache, survives ordinary requests.
     const epoch = new Map<string, { version: string; block: string; at: string; reason: "first" | "store_changed" }>();
+    // Latest user prompt per session. A changed store is re-scored against it
+    // even when the change happened during a tool loop with no new prompt.
+    const latestPrompt = new Map<string, string>();
     // Recomputes since server start: every one invalidated a prompt cache, so
     // it is the honest cost number the surfaces show (status files / tools).
     let epochRecomputes = 0;
@@ -654,6 +660,47 @@ const impl = {
     const flushStatus = (sid: string): Promise<void> =>
       buildPayload(sid).then((p) => (p ? writeStatus(p) : undefined));
 
+    // Called when a prompt arrives (to keep status surfaces current) and again
+    // at the injection decision on every model request. The latter keeps
+    // removals fail-closed: an out-of-band redaction or a block during a tool
+    // loop cannot ride one more request waiting for another user prompt.
+    const injectableRows = async (): Promise<Memory[]> =>
+      (await loadAll()).filter((m) => isActive(m) && isVisibleHere(m));
+    const refreshEpoch = async (sid: string, rows?: Memory[]): Promise<void> => {
+      if (!latestPrompt.has(sid)) return;
+      const mems = rows ?? await injectableRows();
+      const version = await storeVersion(mems);
+      const cached = epoch.get(sid);
+      if (cached?.version === version) return;
+      const raw = await relevantKnowledge(latestPrompt.get(sid) ?? "", 5, mems); // widen candidate pool
+      const block = raw ? capToBudget(raw, budget) : "";
+      const at = new Date().toISOString();
+      const reason: "first" | "store_changed" = cached ? "store_changed" : "first";
+      epoch.set(sid, { version, block, at, reason });
+      await record(
+        "epoch_recompute",
+        {
+          session: sid,
+          reason,
+          chars: block.length,
+        },
+        false,
+      );
+      epochRecomputes++;
+      // Ledger: a store_changed recompute of a live epoch is an
+      // invalidation (the first epoch of a session busts nothing). The
+      // epoch request count restarts with the new block.
+      const st = statsFor(sid);
+      st.epochRequests = 0;
+      if (reason === "store_changed") {
+        st.invalidations++;
+        st.lastInvalidation = { at, reason };
+      }
+      // Status hand-off for the terminal panel (src/tui.tsx) and any
+      // out-of-process surface. Best-effort; never breaks injection.
+      await flushStatus(sid);
+    };
+
     // ---- hooks (all fail-closed) -------------------------------------------
     // Bookkeeping: track the active session/tool/call before a tool runs.
     await ctx.tool?.hook("execute.before", (event: any) =>
@@ -691,12 +738,14 @@ const impl = {
       guarded("session.context (systemDigest)", async () => {
         // Route store reads in this hook through the right session's scope.
         setCurrent({ sessionID: event?.sessionID });
+        const sid = event?.sessionID;
+        const mems = await injectableRows();
+        if (typeof sid === "string") await refreshEpoch(sid, mems);
         const parts: string[] = [];
-        await systemDigest({ sessionID: event?.sessionID }, { system: parts });
+        await systemDigest({ sessionID: event?.sessionID }, { system: parts }, mems);
         for (const text of parts) event?.system?.push?.({ type: "text", text });
         // Deliver this epoch's relevance-ranked memory via the system channel.
         // The UI never renders system parts, unlike appended prompt text.
-        const sid = event?.sessionID;
         const knowledge = typeof sid === "string" ? epoch.get(sid)?.block : undefined;
         if (knowledge) event?.system?.push?.({ type: "text", text: knowledge });
         // Count AT THE INJECTION DECISION so badge/panel numbers match exactly
@@ -712,10 +761,11 @@ const impl = {
       }),
     );
 
-    // Memory-first injection, frozen per epoch (cache-safe). The block is
-    // relevance-scored against the prompt that STARTED the epoch — accepted
-    // staleness, traded for a stable system prefix across ordinary turns. An
-    // epoch is invalidated only on first prompt, store change, or compaction.
+    // Memory-first injection, frozen per epoch (cache-safe). Remember the
+    // latest user prompt here; the request-time context hook builds or
+    // invalidates the epoch immediately before delivery. Relevance staleness
+    // is accepted while the injectable rows stay unchanged, preserving a
+    // stable system prefix across ordinary turns.
     // Never mutate event.prompt.text — it is stored verbatim and rendered in
     // the UI.
     await ctx.session?.hook("prompt", (event: any) =>
@@ -726,38 +776,8 @@ const impl = {
           markTurn(sid);
           await checkNewSession(sid);
           await bindSessionFromMessages(sid);
-          const version = await storeVersion();
-          const cached = epoch.get(sid);
-          if (!cached || cached.version !== version) {
-            const text = event?.prompt?.text ?? "";
-            const raw = await relevantKnowledge(text, 5); // widen candidate pool
-            const block = raw ? capToBudget(raw, budget) : "";
-            const at = new Date().toISOString();
-            const reason: "first" | "store_changed" = cached ? "store_changed" : "first";
-            epoch.set(sid, { version, block, at, reason });
-            await record(
-              "epoch_recompute",
-              {
-                session: sid,
-                reason,
-                chars: block.length,
-              },
-              false,
-            );
-            epochRecomputes++;
-            // Ledger: a store_changed recompute of a live epoch is an
-            // invalidation (the first epoch of a session busts nothing). The
-            // epoch request count restarts with the new block.
-            const st = statsFor(sid);
-            st.epochRequests = 0;
-            if (reason === "store_changed") {
-              st.invalidations++;
-              st.lastInvalidation = { at, reason };
-            }
-            // Status hand-off for the terminal panel (src/tui.tsx) and any
-            // out-of-process surface. Best-effort; never breaks injection.
-            await flushStatus(sid);
-          }
+          latestPrompt.set(sid, event?.prompt?.text ?? "");
+          await refreshEpoch(sid);
         }
       }),
     );
@@ -772,7 +792,10 @@ const impl = {
       guarded("session.compaction (onCompacting)", async () => {
         setCurrent({ sessionID: event?.sessionID });
         await onCompacting({ sessionID: event?.sessionID });
-        if (typeof event?.sessionID === "string") epoch.delete(event.sessionID);
+        if (typeof event?.sessionID === "string") {
+          epoch.delete(event.sessionID);
+          latestPrompt.delete(event.sessionID);
+        }
         const anchor = await compactionAnchor();
         if (anchor) event?.system?.push?.({ type: "text", text: anchor });
       }),

package/src/inject.ts

@@ -5,6 +5,7 @@
 // results. Evidence is never injected. Open threads (status=
 // "open") get a single capped frontier block in the digest so planning sessions
 // start at the previous session's frontier instead of re-deriving it.
+import { createHash } from "node:crypto";
 import { isActive, loadAll, visibleHere, type Memory } from "./memory.ts";
 import { record } from "./evidence.ts";
 import { dateStr } from "./config.ts";
@@ -141,9 +142,10 @@ const frontierInjectedSessions = new Set<string>();
 export async function systemDigest(
   _input: unknown,
   output: TransformOutput,
+  rows?: Memory[],
 ): Promise<void> {
   // Repo-scoped: model-facing reads see this repo + global rows.
-  const mems = visibleHere((await loadAll()).filter(isActive));
+  const mems = rows ?? visibleHere((await loadAll()).filter(isActive));
   if (!mems.length) return;
   const latest = flattenMemoryText(mems.map((m) => m.ts).sort().pop() ?? "?");
   output.system.push(
@@ -190,26 +192,33 @@ export async function systemDigest(
   );
 }
 
-export async function relevantKnowledge(message: string, limit = 3): Promise<string> {
+export async function relevantKnowledge(message: string, limit = 3, rows?: Memory[]): Promise<string> {
   const text = message.trim();
   if (!text) return "";
   // Repo-scoped: model-facing reads see this repo + global rows.
-  const mems = visibleHere((await loadAll()).filter(isActive));
+  const mems = rows ?? visibleHere((await loadAll()).filter(isActive));
   const top = scoreMemories(text, mems, limit);
   if (!top.length) return "";
   return `## Relevant durable memory${FRAME}\n${top.map(formatMemory).join("\n")}`;
 }
 
-// Deterministic fingerprint of the active store: `${activeCount}:${maxActiveTs}`.
-// Cheap change detector for the per-session epoch cache in index.ts: the frozen
-// injection block is recomputed only when this string changes (or after a
-// compaction). Evidence and superseded rows never affect it (I3, memory.ts).
-export async function storeVersion(): Promise<string> {
+// Deterministic fingerprint of the rows that can affect injection. Hash the
+// exact rendered row plus its full id, in load order: content edits, blocklist
+// changes and supersession all invalidate an epoch, while evidence, hidden
+// rows and non-rendered metadata do not. This is only a linear hash over rows
+// loadAll() already had to read and parse for the request.
+export async function storeVersion(rows?: Memory[]): Promise<string> {
   // Repo-scoped: model-facing reads see this repo + global rows.
-  const mems = visibleHere((await loadAll()).filter(isActive));
+  const mems = rows ?? visibleHere((await loadAll()).filter(isActive));
+  if (!mems.length) return "0:";
   let max = "";
-  for (const m of mems) if (m.ts > max) max = m.ts;
-  return `${mems.length}:${max}`;
+  const hash = createHash("sha256");
+  for (const m of mems) {
+    if (m.ts > max) max = m.ts;
+    hash.update(JSON.stringify([m.ts, formatMemory(m)]));
+    hash.update("\n");
+  }
+  return `${mems.length}:${max}:${hash.digest("hex")}`;
 }
 
 // Trim an injection block to `budget` characters at WHOLE-line boundaries:

package/src/schema.ts

@@ -94,7 +94,7 @@ export const UndoArgs = z.object({
   list: z.boolean().describe("List snapshots").optional(),
   snapshot: z
     .string()
-    .describe("Snapshot to restore (bare name from list, or a full path)")
+    .describe("Store-owned snapshot to restore (bare name from list, or its full path)")
     .optional(),
   merge: z
     .boolean()

package/src/undo.ts

@@ -10,12 +10,15 @@
 // MERGE replays them on top of the snapshot; FORCE is the old exact rollback,
 // and additionally snapshots the file it replaces, so the state it drops stays
 // undoable (result.safety).
-import { basename, join, resolve, sep } from "node:path";
-import { snapshotDir } from "./config.ts";
-import { ensureDir, writeAtomic } from "./logfmt.ts";
+import { lstat, realpath, stat } from "node:fs/promises";
+import { basename, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { deletionsFile, snapshotDir } from "./config.ts";
+import { ensureDir, parseLine, readLines, writeAtomic } from "./logfmt.ts";
 import { withStoreLock, LOCK_RESTORE } from "./lock.ts";
 import { snapshotFiles } from "./memory.ts";
 
+const SNAPSHOT_NAME = /^(\d+)-(\d{4}-\d{2}-\d{2}\.logfmt)$/;
+
 export interface SnapshotInfo {
   file: string;
   name: string;
@@ -28,6 +31,7 @@ export async function listSnapshots(): Promise<SnapshotInfo[]> {
   const out: SnapshotInfo[] = [];
   try {
     for await (const f of glob.scan(snapshotDir())) {
+      if (!SNAPSHOT_NAME.test(f)) continue;
       const info = Bun.file(join(snapshotDir(), f));
       out.push({
         file: join(snapshotDir(), f),
@@ -55,6 +59,9 @@ export interface RestoreResult {
   // (added after it — or in-place edits, listed under their original ts).
   concurrentAdded: string[];
   concurrentChanged: string[];
+  // ts of rows intentionally deleted after this snapshot. CHECK and MERGE
+  // leave them deleted; FORCE is the explicit recovery path.
+  deletedOmitted: string[];
 }
 
 // Rows are keyed by their ts= field; unparseable lines key on the whole line.
@@ -66,33 +73,113 @@ function rows(text: string): string[] {
   return text.split("\n").filter((l) => l.trim());
 }
 
-// Restore `snapshot` over its original file. The snapshot name is
-// `<stamp>-<original>.logfmt`; strip the stamp to recover the target. A bare
-// name (as printed by the list) resolves against <memory-root>/snapshots/.
+function isWithin(parent: string, child: string): boolean {
+  const rel = relative(parent, child);
+  return rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+
+async function resolveSnapshot(
+  snapshot: string,
+  memoryRootDir: string,
+): Promise<{ path: string; original: string }> {
+  const name = basename(snapshot);
+  const match = SNAPSHOT_NAME.exec(name);
+  const original = match?.[2];
+  const stamp = match ? Number(match[1]) : Number.NaN;
+  if (!original || !Number.isSafeInteger(stamp)) {
+    throw new Error(`invalid snapshot name: ${name}`);
+  }
+  if (!isAbsolute(snapshot) && snapshot !== name) {
+    throw new Error("snapshot must be a bare name from memory_undo list or a full path");
+  }
+
+  const rootResolved = resolve(memoryRootDir);
+  const snapshotsResolved = resolve(rootResolved, "snapshots");
+  const requestedResolved = isAbsolute(snapshot)
+    ? resolve(snapshot)
+    : resolve(snapshotsResolved, name);
+  if (!isWithin(snapshotsResolved, requestedResolved)) {
+    throw new Error(`snapshot is outside the snapshots directory: ${snapshot}`);
+  }
+
+  let rootReal: string;
+  let snapshotsReal: string;
+  let snapshotReal: string;
+  try {
+    [rootReal, snapshotsReal, snapshotReal] = await Promise.all([
+      realpath(rootResolved),
+      realpath(snapshotsResolved),
+      realpath(requestedResolved),
+    ]);
+  } catch {
+    throw new Error(`snapshot not found: ${snapshot}`);
+  }
+  if (!isWithin(rootReal, snapshotsReal)) {
+    throw new Error("snapshots directory escapes the memory root");
+  }
+  if (!isWithin(snapshotsReal, snapshotReal)) {
+    throw new Error(`snapshot is outside the snapshots directory: ${snapshot}`);
+  }
+
+  const [linkInfo, fileInfo] = await Promise.all([
+    lstat(requestedResolved),
+    stat(snapshotReal),
+  ]);
+  if (linkInfo.isSymbolicLink() || !fileInfo.isFile()) {
+    throw new Error(`snapshot is not a regular file: ${snapshot}`);
+  }
+
+  return { path: snapshotReal, original };
+}
+
+// ts of every row memory_forget or a viewer delete has removed. Ordering
+// against the snapshot is not needed: a snapshot row with a deletion audit
+// that is absent from the live file was removed on purpose.
+async function auditedDeletions(): Promise<Set<string>> {
+  const deleted = new Set<string>();
+  for (const line of await readLines(deletionsFile())) {
+    const fields = parseLine(line);
+    if (fields?.action !== "deleted" || typeof fields.original_ts !== "string") continue;
+    deleted.add(fields.original_ts);
+  }
+  return deleted;
+}
+
+// Restore `snapshot` over its original file. Only `<stamp>-<YYYY-MM-DD>.logfmt`
+// files inside <memory-root>/snapshots/ are accepted (the viewer restore's
+// grammar); the stamp is stripped to recover the target day file. A bare name
+// (as printed by the list) resolves against <memory-root>/snapshots/.
 export async function restoreSnapshot(
   snapshot: string,
   memoryRootDir: string,
   mode: RestoreMode = "check",
 ): Promise<RestoreResult> {
-  const name = basename(snapshot);
-  let snapPath = snapshot;
-  if (!(await Bun.file(snapPath).exists())) {
-    const candidate = join(memoryRootDir, "snapshots", name);
-    if (await Bun.file(candidate).exists()) snapPath = candidate;
+  const snap = await resolveSnapshot(snapshot, memoryRootDir);
+  const rootReal = await realpath(resolve(memoryRootDir));
+  const realTarget = resolve(rootReal, snap.original);
+  if (!isWithin(rootReal, realTarget)) {
+    throw new Error(`snapshot target escapes the memory root: ${snap.original}`);
   }
-  const f = Bun.file(snapPath);
-  if (!(await f.exists())) throw new Error(`snapshot not found: ${snapshot}`);
-
-  const original = name.replace(/^\d+-/, "");
-  // Defense in depth: `name` is basenamed above, so `original`
-  // carries no separators — but a restore must never write outside the memory
-  // root no matter what a future caller passes.
-  const rootAbs = resolve(memoryRootDir);
-  const target = resolve(rootAbs, original);
-  if (!target.startsWith(rootAbs + sep)) {
-    throw new Error(`snapshot target escapes the memory root: ${original}`);
+  let targetInfo: Awaited<ReturnType<typeof lstat>> | undefined;
+  try {
+    targetInfo = await lstat(realTarget);
+  } catch (err) {
+    if (!(err instanceof Error && "code" in err && err.code === "ENOENT")) throw err;
   }
-  const snapLines = rows(await f.text());
+  if (targetInfo) {
+    if (targetInfo.isSymbolicLink()) {
+      throw new Error(`snapshot target must not be a symbolic link: ${snap.original}`);
+    }
+    const targetReal = await realpath(realTarget);
+    if (relative(realTarget, targetReal) !== "") {
+      throw new Error(`snapshot target must not be a symbolic link: ${snap.original}`);
+    }
+    if (!targetInfo.isFile()) throw new Error(`snapshot target is not a file: ${snap.original}`);
+  }
+  // Checks above ran on real paths; lock and write through the same lexical
+  // path every other writer uses, so the in-process lock queue is shared.
+  const target = resolve(memoryRootDir, snap.original);
+  const rawSnapLines = rows(await Bun.file(snap.path).text());
 
   // Comparing and publishing happen under the same lock: a divergence check on
   // a stale read would wave through a row that landed after it. A restore waits
@@ -104,6 +191,17 @@ export async function restoreSnapshot(
     async () => {
       const cur = Bun.file(target);
       const curLines = (await cur.exists()) ? rows(await cur.text()) : [];
+      // Deliberate deletions are read inside the lock too, so a forget that
+      // finished just before this restore is honoured.
+      const audited = mode !== "force" ? await auditedDeletions() : new Set<string>();
+      const live = new Set(curLines.map(rowKey));
+      const deletedOmitted: string[] = [];
+      const snapLines = rawSnapLines.filter((line) => {
+        const key = rowKey(line);
+        if (!audited.has(key) || live.has(key)) return true;
+        deletedOmitted.push(key);
+        return false;
+      });
 
       const snapByKey = new Map(snapLines.map((l) => [rowKey(l), l]));
       const concurrentAdded: string[] = [];
@@ -118,7 +216,7 @@ export async function restoreSnapshot(
       }
 
       if (mode === "check" && (concurrentAdded.length || concurrentChanged.length)) {
-        return { target, restored: false, mode, concurrentAdded, concurrentChanged };
+        return { target, restored: false, mode, concurrentAdded, concurrentChanged, deletedOmitted };
       }
 
       // FORCE is the mode that drops rows, so the file it replaces is
@@ -140,7 +238,7 @@ export async function restoreSnapshot(
       }
       await ensureDir(memoryRootDir);
       await writeAtomic(target, out.length ? out.join("\n") + "\n" : "");
-      return { target, restored: true, mode, safety, concurrentAdded, concurrentChanged };
+      return { target, restored: true, mode, safety, concurrentAdded, concurrentChanged, deletedOmitted };
     },
     LOCK_RESTORE,
   );