opencode-self-improvement 0.8.6 → 0.8.8

package/README.md

@@ -50,6 +50,33 @@ LLMs waste a lot of tokens reading and re-reading your code and asking you for c
 - Automatically looks for insights when you complete the verification gates (tests, linting, etc)
 - Always defaults to memories first before sending a prompt to the LLM, which saves tokens! 
 
+## Secret redaction
+
+`src/secrets.ts` provides one best-effort credential rule set. It runs over the
+auto-capture prompt before that prompt leaves the plugin, at the write gate
+before content is hashed or analysed, and again in `appendMemory`, the final
+write choke point used by gated writes and the viewer's edit/restore-entry
+paths. Credential-shaped values in memory content become `[redacted]`.
+Credential-shaped `scope`, `tags`, or `issue` metadata is rejected instead of
+being silently rewritten.
+
+The rules cover OpenAI `sk-` tokens; GitHub `ghp_`, `gho_`, and `github_pat_`
+tokens; Slack `xoxb-` and `xoxp-` tokens; AWS `AKIA` access-key IDs; Google
+`AIza` API keys; bearer tokens containing digits; PEM private-key blocks; and
+high-entropy values assigned to names ending in `_KEY`, `_TOKEN`, `_SECRET`,
+or `_PASSWORD` (plus `password`). This is deliberately best-effort, not a
+guarantee: it can miss hex-only secrets, passwords with few character classes,
+and credentials written in prose without an assignment.
+
+`memory_remember` still replies `Remembered` when content was redacted, so the
+stored text can differ from what was sent. Redaction is forward-only: existing
+stores are not scrubbed, and `memory_export` writes whatever is already stored
+verbatim. See [issue #74](https://github.com/abogartz/opencode-self-improvement/issues/74)
+for the separate existing-store work.
+
+Auto-capture is off by default, so capture-prompt redaction protects opt-in
+installs. The write-gate and `appendMemory` checks apply to every install.
+
 ## Token cost, on purpose
 
 Memory plugins have a reputation for burning tokens and busting the provider's
@@ -65,8 +92,10 @@ prompt cache on every message. This one is built the other way around:
   queries (one or two words — a deliberate search) need only one. Injection
   stays quiet on single-word coincidences, which `memory_recall` still
   reaches on the pull path — rare and right beats frequent and maybe.
-- **Hard character budget.** The block is capped at 1200 characters by default
-  (see Options) and trimmed at whole-memory boundaries — never cut mid-sentence.
+- **Hard character budgets.** The relevance block and each contextual pull are
+  capped at 1200 characters by default; the session-start open-threads frontier
+  has its own 3600-character cap (see Options). All are trimmed at whole-memory
+  boundaries — never cut mid-sentence.
 - **Evidence is never injected**, and the standing system digest is two lines.
 - **Receipts, not promises.** The plugin measures your session's actual
   prompt-cache usage (from each turn's `tokens.cache` accounting) and shows it
@@ -263,13 +292,14 @@ the plugin entry in `opencode.json(c)` instead of the plain string:
 
 ```json
 {
-  "plugins": [{ "package": "opencode-self-improvement", "options": { "injectBudget": 1200 } }]
+  "plugins": [{ "package": "opencode-self-improvement", "options": { "injectBudget": 1200, "frontierBudget": 3600 } }]
 }
 ```
 
 | Option | Default | What it does |
 | --- | --- | --- |
-| `injectBudget` | `1200` | Character cap on the injected relevance block, trimmed at whole-memory boundaries. Env fallback: `OPENCODE_MEMORY_INJECT_BUDGET`. |
+| `injectBudget` | `1200` | Character cap on the injected relevance block and each contextual pull; trimmed at whole-memory boundaries. Env fallback: `OPENCODE_MEMORY_INJECT_BUDGET`. |
+| `frontierBudget` | `3 × injectBudget` (`3600` by default) | Character cap on the session-start open-threads block. A thread longer than this budget is not injected and is visibly reported as omitted; raise this option (or `OPENCODE_MEMORY_FRONTIER_BUDGET`) to include longer planning threads. |
 | `autoCapture` | `false` (off) | When on, each session-idle event makes one cheap model pass that proposes memory candidates. Every candidate still goes through the 4-gate write pipeline — capture can never bypass the gates. Off by default: the zero-token install stays zero-token. |
 | `captureModel` | — | `"provider/id"` model used for auto-capture. Required when `autoCapture` is on; a missing or invalid value disables capture with a startup warning. |
 | `captureMax` | `3` | Maximum candidates proposed per idle event. |
@@ -349,15 +379,23 @@ and the tool reports a tally of outcomes per line —
 | `collapsed` | near-duplicate of an existing memory; nothing written |
 | `blocked` | rejected by a gate; reason is in `memory_evidence` |
 | `skipped` | malformed line; never reaches the gates |
-| `downgraded` | `status:"open"` without an export header to vouch for it; imported as settled |
+| `downgraded` | `status:"open"` without an export header to vouch for it, claiming `repo:"global"`, or carrying an unverifiable stamp when the importing session has no repo scope; imported as settled |
 
 The frontier policy matters because an open row is exempt from ref grounding:
 a hand-written JSONL can't hand its rows that free pass (the header is
 friction, not a signature — the real defense is that imported content always
-injects framed as data and marked `[via import]`).
-
-so re-running the same import is a no-op (everything collapses). Copying an
-export to a fresh machine is how you seed a new laptop from an old one.
+injects framed as data and marked `[via import]`). Even with a header, an
+imported open row claiming `repo:"global"` is downgraded, so one file can't add
+an open thread to every repo. Imported `repo` and `repoPath` stamps are honored
+only when they match the importing session's current repo (an explicit
+`repo:"global"` on a settled row is kept); foreign stamps are discarded and the
+row is stamped for the importing repo instead. When there is no current repo
+scope, stamps are kept as they are (dropping them would widen the row to
+global) and a stamped open row is downgraded, since its stamp can't be verified.
+
+So re-running the same import in the same repo is a no-op (everything
+collapses). Copying an export to a fresh machine and importing it from that
+repo is how you seed a new laptop from an old one.
 
 ## Memory at a glance
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-self-improvement",
-  "version": "0.8.6",
+  "version": "0.8.8",
   "description": "Durable memory for opencode: remember facts, decisions, and commands across sessions, plus a one-command per-repo setup (/repo-init).",
   "main": "index.ts",
   "exports": {

package/src/capture.ts

@@ -8,6 +8,7 @@
 // never a throw.
 import { STATUSES, TYPES } from "./types.ts";
 import { flattenMemoryText } from "./sanitize.ts";
+import { redactSecrets } from "./secrets.ts";
 
 export interface CaptureOptions {
   model: string; // "provider/id"
@@ -46,7 +47,7 @@ export function buildCapturePrompt(transcript: string, max = 3): string {
     "- If nothing is worth remembering, output [ ].",
     "",
     "Transcript:",
-    transcript,
+    redactSecrets(transcript),
   ].join("\n");
 }
 
@@ -152,15 +153,23 @@ export function flattenTranscript(msgs: unknown): string {
       const role =
         typeof info?.role === "string" ? info.role : typeof m.role === "string" ? m.role : "";
       let text = "";
+      let hadPrivatePart = false;
       if (Array.isArray(m.parts)) {
         text = m.parts
-          .map((p) =>
-            p && typeof p === "object" ? (p as Record<string, unknown>).text : undefined,
-          )
+          .map((p) => {
+            if (!p || typeof p !== "object") return undefined;
+            const part = p as Record<string, unknown>;
+            const partType = typeof part.type === "string" ? part.type.toLowerCase() : "";
+            if (partType === "reasoning" || partType === "thinking") {
+              hadPrivatePart = true;
+              return undefined;
+            }
+            return part.text;
+          })
           .filter((t): t is string => typeof t === "string" && t.length > 0)
           .join(" ");
       }
-      if (!text) {
+      if (!text && !hadPrivatePart) {
         for (const k of ["text", "content"]) {
           if (typeof m[k] === "string") {
             text = m[k] as string;

package/src/config.ts

@@ -54,6 +54,19 @@ export function injectBudget(): number {
   return 1200;
 }
 
+// Character budget for the session-start open-thread frontier. Kept separate
+// from relevance injection and contextual pulls: planning rows are often much
+// longer, and raising this cap must not raise those per-request surfaces too.
+// Defaults to 3x the effective injection budget.
+export function frontierBudget(baseBudget = injectBudget()): number {
+  const raw = process.env.OPENCODE_MEMORY_FRONTIER_BUDGET;
+  if (raw) {
+    const n = Number.parseInt(raw, 10);
+    if (Number.isFinite(n) && n > 0) return n;
+  }
+  return baseBudget * 3;
+}
+
 // Optional live-graph binary. When present the resolver cross-checks the local
 // source scan against the codebase-memory-mcp file graph; when absent the local
 // scan alone is authoritative (install-from-scratch requirement).

package/src/gates.ts

@@ -15,6 +15,7 @@ import {
 } from "./memory.ts";
 import { chainId, contentHash, record, recordWriteBlocked } from "./evidence.ts";
 import { flattenMemoryText } from "./sanitize.ts";
+import { containsSecret, redactSecrets } from "./secrets.ts";
 import {
   displayCall,
   extractCallForms,
@@ -251,6 +252,34 @@ export async function runWriteGate(
     };
   }
 
+  const credentialMetadata = [
+    containsSecret(candidate.scope) ? "scope" : undefined,
+    candidate.tags?.some(containsSecret) ? "tags" : undefined,
+    containsSecret(candidate.issue) ? "issue" : undefined,
+  ].filter((field): field is string => field !== undefined);
+  if (credentialMetadata.length) {
+    await recordWriteBlocked(
+      4,
+      "credential_in_metadata",
+      credentialMetadata.map((field) => `field=${field}`),
+      chain,
+    );
+    return {
+      action: "blocked",
+      reason: "credential_in_metadata",
+      chain,
+      hint: `Credential-shaped value in ${credentialMetadata.join(", ")}; remove it and retry. Only memory content is redacted automatically.`,
+    };
+  }
+
+  // This is the common boundary for manual, imported and auto-captured writes.
+  // Scrub content before hashing, analysis and persistence. Metadata is
+  // rejected above rather than silently changing where a row can be found.
+  candidate = {
+    ...candidate,
+    content: redactSecrets(candidate.content),
+  };
+
   const ch = contentHash(candidate.content);
   await record("gate_start", {
     chain,

package/src/index.ts

@@ -12,7 +12,7 @@
 // helper modules.
 import type { Cleanup, Plugin } from "@opencode/plugin/promise/plugin";
 import { basename, join } from "node:path";
-import { evidenceDir, injectBudget, memoryRoot, dateStr } from "./config.ts";
+import { evidenceDir, frontierBudget, injectBudget, memoryRoot, dateStr } from "./config.ts";
 import { STATUSES, TYPES } from "./types.ts";
 import {
   clearSuperseded,
@@ -66,6 +66,7 @@ import { getCurrent, setCurrent } from "./state.ts";
 import { resolveRepo, setRepoScope, rememberSessionDir, sessionDir } from "./repokey.ts";
 import { readLines } from "./logfmt.ts";
 import { buildCapturePrompt, flattenTranscript, parseCandidates, parseModelRef } from "./capture.ts";
+import { redactSecrets } from "./secrets.ts";
 import { flattenMemoryText } from "./sanitize.ts";
 
 // Tool/input boundaries are zod schemas (src/schema.ts): the JSON Schema the
@@ -178,10 +179,12 @@ const impl = {
     const liveRoot = setupRoot ?? process.cwd();
     setRepoScope(setupRoot ? resolveRepo(setupRoot) : null);
 
-    // Character budget for the epoch-frozen injection block: plugin options
-    // (object form in opencode.json(c)) win, then OPENCODE_MEMORY_INJECT_BUDGET,
-    // then the 1200 default.
+    // Character budgets: relevance injection and contextual pulls share the
+    // existing cap; the session-start frontier has its own larger cap. Plugin
+    // options win over env fallbacks, and the frontier defaults to 3x the
+    // effective injection budget.
     const budget = Number(ctx.options?.injectBudget) || injectBudget();
+    const openBudget = Number(ctx.options?.frontierBudget) || frontierBudget(budget);
 
     // Mirror the /repo-init slash command into opencode's global commands dir
     // (idempotent, write-if-missing). OpenCode 2.x loads `*.md` from
@@ -481,7 +484,7 @@ const impl = {
       editor.add(validated(ExportArgs, {
         name: "memory_export",
         description:
-          "Export active memories as a JSONL file for backup or transfer to another machine. The first line is a metadata header ({_export,version,exportedAt,count}); each later line is one JSON object {ts,type,scope,content,status,tags,issue}. The header is what lets memory_import keep status:\"open\" frontier rows — a hand-written file without it imports such rows as settled. Defaults to <memory-root>/exports/<timestamp>.jsonl; pass `file` to choose the path, `scope` to export one scope. Superseded rows are not exported (history stays in the store).",
+          "Export active memories as a JSONL file for backup or transfer to another machine. The first line is a metadata header ({_export,version,exportedAt,count}); each later line is one JSON object {ts,type,scope,content,status,tags,issue}. The header is what lets memory_import keep repo-scoped status:\"open\" frontier rows — a hand-written file without it imports such rows as settled, as does an imported open row claiming repo:\"global\". Defaults to <memory-root>/exports/<timestamp>.jsonl; pass `file` to choose the path, `scope` to export one scope. Superseded rows are not exported (history stays in the store).",
         options: direct,
         async execute(args): Promise<{ content: string }> {
           const res = await exportMemories({ scope: args.scope, file: args.file });
@@ -492,7 +495,7 @@ const impl = {
       editor.add(validated(ImportArgs, {
         name: "memory_import",
         description:
-          "Import memories from a JSONL export (see memory_export). Every row goes through the same 4-gate write pipeline as memory_remember (tagged `import`, original tags preserved), so duplicates collapse and ungrounded rows are blocked exactly as usual — those are normal tallied outcomes, not errors. Malformed lines are skipped and counted. Frontier policy: status:\"open\" exempts a row from ref grounding, so it is honored ONLY if the file opens with a memory_export header; without one, open rows are downgraded to settled and tallied. Imported content is unverified by construction: injected rows surface a `[via import]` provenance marker.",
+          "Import memories from a JSONL export (see memory_export). Every row goes through the same 4-gate write pipeline as memory_remember (tagged `import`, original tags preserved), so duplicates collapse and ungrounded rows are blocked exactly as usual — those are normal tallied outcomes, not errors. Malformed lines are skipped and counted. Frontier policy: status:\"open\" exempts a row from ref grounding, so it requires a memory_export header and cannot claim global scope; imported repo stamps are kept only when they match the importing session's repo, otherwise the importing repo is stamped. A stamped open row is downgraded when there is no current repo scope to verify it. Imported content is unverified by construction: injected rows surface a `[via import]` provenance marker.",
         options: direct,
         async execute(args): Promise<{ content: string }> {
           try {
@@ -507,7 +510,7 @@ const impl = {
                 `Imported ${args.file}: ${t.promoted} promoted, ${t.collapsed} duplicates collapsed, ` +
                 `${t.blocked} blocked by the gate, ${t.skipped} malformed lines skipped.` +
                 (t.downgraded
-                  ? ` ${t.downgraded} open rows downgraded to settled (file has no memory_export header).`
+                  ? ` ${t.downgraded} open rows downgraded to settled (missing eligible memory_export header or verifiable repo scope).`
                   : ""),
             };
           } catch (err) {
@@ -734,7 +737,7 @@ const impl = {
         setCurrent(input);
         const out = { output: resultText(event?.result), metadata: resultMeta(event?.result) };
         await afterTool(input, out);
-        await contextualPull(input, out as { output?: unknown });
+        await contextualPull(input, out as { output?: unknown }, budget);
         // Write a contextual-pull append back when the tool result is text we own.
         if (event?.result && typeof event.result === "object" && typeof event.result.content === "string") {
           const text = resultText(event.result);
@@ -753,7 +756,11 @@ const impl = {
         const mems = await injectableRows();
         if (typeof sid === "string") await refreshEpoch(sid, mems);
         const parts: string[] = [];
-        await systemDigest({ sessionID: event?.sessionID }, { system: parts }, mems);
+        await systemDigest(
+          { sessionID: event?.sessionID },
+          { system: parts },
+          { rows: mems, frontierBudget: openBudget },
+        );
         for (const text of parts) event?.system?.push?.({ type: "text", text });
         // Deliver this epoch's relevance-ranked memory via the system channel.
         // The UI never renders system parts, unlike appended prompt text.
@@ -933,7 +940,8 @@ const impl = {
                   );
                   await record(
                     `auto_capture_${outcome.action}`,
-                    { session: sid, type: c.type, scope: c.scope, reason: outcome.reason ?? "" },
+                    // A blocked credential-shaped scope must not reach the evidence log either.
+                    { session: sid, type: c.type, scope: redactSecrets(c.scope), reason: outcome.reason ?? "" },
                     false,
                   );
                 }

package/src/inject.ts

@@ -8,7 +8,7 @@
 import { createHash } from "node:crypto";
 import { isActive, loadAll, visibleHere, type Memory } from "./memory.ts";
 import { record } from "./evidence.ts";
-import { dateStr } from "./config.ts";
+import { dateStr, frontierBudget, injectBudget } from "./config.ts";
 import { bracketList } from "./logfmt.ts";
 import { recentConvergenceSummary } from "./triggers.ts";
 import { flattenMemoryText } from "./sanitize.ts";
@@ -135,17 +135,63 @@ function openRank(m: Memory): number {
 }
 
 // Only the newest open threads are surfaced, and each session sees the block
-// once (per process), so the frontier costs a bounded number of tokens.
+// once (per process). Rows can be long (up to the content cap), so the block is
+// also held to its own frontierBudget, with any omission shown in the block.
 const OPEN_THREAD_LIMIT = 3;
 const frontierInjectedSessions = new Set<string>();
 
+function omittedLine(count: number): string {
+  return `+ ${count} open ${count === 1 ? "thread" : "threads"} omitted: over budget`;
+}
+
+function cappedFrontier(open: Memory[], budget: number): {
+  block: string;
+  shown: Memory[];
+  omitted: number;
+} {
+  const header = `## Open threads (frontier)${FRAME}`;
+  const rendered = open.map(formatMemory);
+  const full = [header, ...rendered].join("\n");
+  if (full.length <= budget) return { block: full, shown: open, omitted: 0 };
+
+  // Keep a strict newest-first prefix. Budget the omission marker alongside
+  // each candidate row so an older row can never replace a newer one that did
+  // not fit, and the drop is always visible.
+  const kept: string[] = [];
+  let used = header.length;
+  for (let i = 0; i < rendered.length; i++) {
+    const row = rendered[i];
+    if (row === undefined) break;
+    const remaining = rendered.length - i - 1;
+    const marker = remaining ? omittedLine(remaining) : "";
+    const projected = used + 1 + row.length + (marker ? 1 + marker.length : 0);
+    if (projected > budget) break;
+    kept.push(row);
+    used += 1 + row.length;
+  }
+
+  const omitted = open.length - kept.length;
+  const lines = [header, ...kept];
+  if (omitted) lines.push(omittedLine(omitted));
+  // The header plus omission marker is the minimum useful diagnostic. For a
+  // tiny budget that cannot hold even those two lines, emit them anyway rather
+  // than silently making an existing frontier disappear.
+  return { block: lines.join("\n"), shown: open.slice(0, kept.length), omitted };
+}
+
+export interface DigestOptions {
+  // Rows the caller already loaded for this request (shared with the epoch).
+  rows?: Memory[];
+  frontierBudget?: number;
+}
+
 export async function systemDigest(
   _input: unknown,
   output: TransformOutput,
-  rows?: Memory[],
+  opts: DigestOptions = {},
 ): Promise<void> {
   // Repo-scoped: model-facing reads see this repo + global rows.
-  const mems = rows ?? visibleHere((await loadAll()).filter(isActive));
+  const mems = opts.rows ?? visibleHere((await loadAll()).filter(isActive));
   if (!mems.length) return;
   const latest = flattenMemoryText(mems.map((m) => m.ts).sort().pop() ?? "?");
   output.system.push(
@@ -160,9 +206,8 @@ export async function systemDigest(
     .slice(0, OPEN_THREAD_LIMIT);
   if (!open.length) return;
 
-  output.system.push(
-    `\n## Open threads (frontier)${FRAME}\n` + open.map(formatMemory).join("\n"),
-  );
+  const frontier = cappedFrontier(open, opts.frontierBudget ?? frontierBudget());
+  output.system.push(`\n${frontier.block}`);
 
   // Aggregate of past sessions' convergence (one line, gated on data existing;
   // I3: it is a derived fact, never the raw log). Gives the next session the
@@ -183,8 +228,10 @@ export async function systemDigest(
     "frontier_injected",
     {
       session: sid,
-      scopes: bracketList([...new Set(open.map((m) => flattenMemoryText(m.scope)))]),
-      shown: open.length,
+      scopes: bracketList([...new Set(frontier.shown.map((m) => flattenMemoryText(m.scope)))]),
+      shown: frontier.shown.length,
+      omitted: frontier.omitted,
+      ...(frontier.omitted ? { reason: "over_budget" } : {}),
       open_total: openMems.length,
       ts_since: dateStr(),
     },
@@ -274,7 +321,11 @@ export async function compactionAnchor(limit = 12): Promise<string> {
   return capToBudget(block, ANCHOR_BUDGET);
 }
 
-export async function contextualPull(input: PullInput, output: PullOutput): Promise<void> {
+export async function contextualPull(
+  input: PullInput,
+  output: PullOutput,
+  budget = injectBudget(),
+): Promise<void> {
   const tool = typeof input.tool === "string" ? input.tool : "";
   if (!["grep", "glob", "read"].includes(tool)) return;
   const term = argText(input.args);
@@ -283,8 +334,9 @@ export async function contextualPull(input: PullInput, output: PullOutput): Prom
   const mems = visibleHere((await loadAll()).filter(isActive));
   const top = scoreMemories(term, mems, 3);
   if (!top.length) return;
-  const block = top.map(formatMemory).join("\n");
-  if (typeof output.output === "string") {
-    output.output += `\n## Related durable memory (pull)${FRAME}\n${block}`;
+  // Held to the injection budget too: three long rows were ~12 KB per call.
+  const block = capToBudget(`## Related durable memory (pull)${FRAME}\n${top.map(formatMemory).join("\n")}`, budget);
+  if (block && typeof output.output === "string") {
+    output.output += `\n${block}`;
   }
 }

package/src/memory.ts

@@ -11,6 +11,7 @@ import { getCurrent } from "./state.ts";
 import { appendLog, ensureDir, formatLine, parseLine, readLines, writeAtomic, type Fields } from "./logfmt.ts";
 import { withStoreLock, LOCK_WRITE } from "./lock.ts";
 import { blockedTs } from "./blocklist.ts";
+import { containsSecret, redactSecrets } from "./secrets.ts";
 import { flattenMemoryText } from "./sanitize.ts";
 
 export type MemoryStatus = "open" | "settled";
@@ -139,9 +140,9 @@ export interface AppendMemoryInput {
   issue?: string;
   tags?: string[];
   status?: MemoryStatus;
-  // "global" for explicit cross-project writes; imports carry the row's own
-  // origin stamp (hash survives the machine hop — see repokey.ts). Any other
-  // value is resolved by appendMemory against the live repo scope.
+  // "global" for explicit cross-project writes; imports may carry a validated
+  // same-repo origin stamp (see portable.ts). Any missing value is resolved by
+  // appendMemory against the live repo scope.
   repo?: string;
   repoPath?: string;
 }
@@ -159,11 +160,12 @@ async function existingTs(file: string): Promise<Set<string>> {
   return set;
 }
 
-// Append a durable memory. Only the gate's GATE-4 promotion step calls this.
+// Append a durable memory. GATE-4 promotions and the viewer's edit/restore-entry
+// paths all call this single write choke point.
 export async function appendMemory(input: AppendMemoryInput): Promise<string> {
   // Absolute floor: every write SHOULD arrive through the gate,
-  // which rejects oversized content politely; the viewer's restore/edit paths
-  // do not, so nothing oversized leaves this function either.
+  // which rejects invalid input politely; viewer writes do not, so enforce the
+  // same storage rules here before anything reaches disk.
   if (typeof input.content !== "string") throw new Error("memory content must be a string");
   if (input.content.length > MAX_CONTENT_CHARS) {
     throw new Error(`memory content exceeds ${MAX_CONTENT_CHARS} chars (${input.content.length})`);
@@ -180,11 +182,22 @@ export async function appendMemory(input: AppendMemoryInput): Promise<string> {
   if (input.tags?.some((tag) => flattenMemoryText(tag) !== tag)) {
     throw new Error("memory tags must not contain control characters");
   }
-  // Repo stamp at the single write choke point: gated writes, viewer restores
-  // and edits all pass through here. Explicit "global" survives; an unscoped
-  // process (viewer) stamps nothing = global. Session identity wins over the
-  // module scope so a server hosting several workspaces stamps the writing
-  // session's repo.
+  const credentialMetadata = [
+    containsSecret(input.scope) ? "scope" : undefined,
+    input.tags?.some(containsSecret) ? "tags" : undefined,
+    containsSecret(input.issue) ? "issue" : undefined,
+  ].filter((field): field is string => field !== undefined);
+  if (credentialMetadata.length) {
+    throw new Error(
+      `memory metadata contains credential-shaped value in: ${credentialMetadata.join(", ")}`,
+    );
+  }
+  const content = redactSecrets(input.content);
+  // Repo stamp at the single write choke point: gated writes plus viewer edits
+  // and restore-entry writes all pass through here. Explicit "global" survives;
+  // an unscoped process (viewer) stamps nothing = global. Session identity wins
+  // over the module scope so a server hosting several workspaces stamps the
+  // writing session's repo.
   let repo = input.repo;
   let repoPath = input.repoPath;
   if (repo === undefined) {
@@ -214,7 +227,7 @@ export async function appendMemory(input: AppendMemoryInput): Promise<string> {
         ts,
         type: input.type,
         scope: input.scope,
-        content: input.content,
+        content,
         issue: input.issue,
         tags: input.tags?.length ? input.tags.join(",") : undefined,
         status: input.status,

package/src/portable.ts

@@ -6,6 +6,8 @@
 import { join } from "node:path";
 import { memoryRoot } from "./config.ts";
 import { isActive, isVisibleHere, loadAll, type Memory } from "./memory.ts";
+import { repoScopeFor } from "./repokey.ts";
+import { getCurrent } from "./state.ts";
 import { TYPES } from "./types.ts";
 import type { WriteCandidate } from "./gates.ts";
 import { flattenMemoryText } from "./sanitize.ts";
@@ -63,8 +65,8 @@ export async function exportMemories(opts: ExportOptions = {}): Promise<ExportRe
       status: m.status,
       tags: m.tags,
       issue: m.issue,
-      // Origin stamps ride along so scoping survives the machine hop (the
-      // repo key is a remote-URL hash; the path is the secondary match).
+      // Origin stamps ride along so a same-repo machine hop can retain them.
+      // Import validates them against its current repo before promotion.
       repo: m.repo,
       repoPath: m.repoPath,
     }),
@@ -80,7 +82,7 @@ export interface ImportTally {
   collapsed: number;
   blocked: number;
   skipped: number;
-  /** Open rows downgraded to settled because the file carried no export header. */
+  /** Open rows downgraded because the file cannot grant that frontier scope. */
   downgraded: number;
 }
 
@@ -141,7 +143,12 @@ function parseRow(line: string): WriteCandidate | null {
 // Frontier policy: status="open" exempts a row from ref grounding
 // at the gate, so it is honored ONLY when the file opens with our export
 // header (version <= ours); otherwise every open row is downgraded to settled
-// and tallied. Only a missing file throws.
+// and tallied. Imported origin stamps are honored only when they match the
+// importing session's current repo (or are an explicit "global"); foreign
+// stamps are removed so the write choke point stamps the importing repo
+// instead. With no current scope, stamps are kept (removing them would widen
+// the row to global) and a stamped open row is downgraded, since its stamp
+// cannot be verified. Only a missing file throws.
 export async function importMemories(
   path: string,
   gate: (c: WriteCandidate) => Promise<{ action: string }>,
@@ -149,6 +156,7 @@ export async function importMemories(
   const file = Bun.file(path);
   if (!(await file.exists())) throw new Error(`import file not found: ${path}`);
   const tally: ImportTally = { promoted: 0, collapsed: 0, blocked: 0, skipped: 0, downgraded: 0 };
+  const currentScope = repoScopeFor(getCurrent().sid);
   let allowFrontier = false;
   let first = true;
   for (const line of (await file.text()).split("\n")) {
@@ -166,7 +174,18 @@ export async function importMemories(
       tally.skipped++;
       continue;
     }
-    if (c.status === "open" && !allowFrontier) {
+    const claimedGlobal = c.repo === "global";
+    const hadStamp = c.repo !== undefined || c.repoPath !== undefined;
+    // A foreign stamp is treated like no stamp, so appendMemory stamps the
+    // importing repo. Explicit "global" is not a foreign repo and is kept (open
+    // global rows are downgraded below). With no current scope there is nothing
+    // to re-stamp with: dropping the stamp would widen the row to global, so it
+    // is kept and only the open-row exemption is withdrawn.
+    if (currentScope && !claimedGlobal) {
+      if (c.repo !== currentScope.key) delete c.repo;
+      if (c.repoPath !== currentScope.path) delete c.repoPath;
+    }
+    if (c.status === "open" && (!allowFrontier || claimedGlobal || (hadStamp && !currentScope))) {
       c.status = "settled";
       tally.downgraded++;
     }

package/src/secrets.ts

@@ -0,0 +1,39 @@
+// Small, conservative credential scrubber shared by capture egress and the
+// write gate. Prefix patterns are intentionally limited to well-known token
+// families; generic values are redacted only when assigned to a credential-
+// named field and they look high-entropy, so ordinary identifiers survive.
+export const REDACTED_SECRET = "[redacted]";
+
+const PRIVATE_KEY_BLOCK =
+  /-----BEGIN(?: [A-Z0-9]+)* PRIVATE KEY-----[\s\S]*?-----END(?: [A-Z0-9]+)* PRIVATE KEY-----/g;
+const PREFIXED_SECRET =
+  /\b(?:sk-[A-Za-z0-9_-]{16,}|gh[po]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[bp]-[A-Za-z0-9-]{16,}|AKIA[A-Z0-9]{16}|AIza[A-Za-z0-9_-]{20,})\b/g;
+// A real bearer token has digits; prose like "Bearer authentication-scheme" doesn't.
+const BEARER_SECRET = /\bBearer\s+(?=[A-Za-z0-9._~+/=-]*\d)[A-Za-z0-9._~+/=-]{16,}/gi;
+const ASSIGNED_SECRET =
+  /(\b(?:[A-Za-z][A-Za-z0-9_]*(?:_KEY|_TOKEN|_SECRET|_PASSWORD)|password)\b["']?\s*(?::|=)\s*["']?)([A-Za-z0-9+/_=.-]{16,})/gi;
+// `API_KEY=process.env.OPENAI_API_KEY` names where the key lives; keep it.
+const DOTTED_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)+$/;
+
+function looksHighEntropy(value: string): boolean {
+  if (value.length < 16 || new Set(value).size < 10) return false;
+  if (!/[0-9]/.test(value) || DOTTED_IDENTIFIER.test(value)) return false;
+  const classes = [/[a-z]/, /[A-Z]/, /[0-9]/, /[^A-Za-z0-9]/].filter((re) =>
+    re.test(value),
+  ).length;
+  return classes >= 3;
+}
+
+export function redactSecrets(text: string): string {
+  if (!text) return text;
+  let out = text.replace(PRIVATE_KEY_BLOCK, REDACTED_SECRET);
+  out = out.replace(PREFIXED_SECRET, REDACTED_SECRET);
+  out = out.replace(BEARER_SECRET, REDACTED_SECRET);
+  return out.replace(ASSIGNED_SECRET, (match, prefix: string, value: string) =>
+    looksHighEntropy(value) ? `${prefix}${REDACTED_SECRET}` : match,
+  );
+}
+
+export function containsSecret(text: string | undefined): boolean {
+  return typeof text === "string" && redactSecrets(text) !== text;
+}