peaks-loop 4.0.53 → 4.1.0

package/dist/services/memory/project-memory-service/parsers/frontmatter-parse.js

@@ -0,0 +1,104 @@
+// ---------------------------------------------------------------------------
+// Frontmatter extract-path surface for project memory files.
+//
+// Split out of `./frontmatter.ts` by the `b1-filesplit-campaign` (wave 3,
+// leaf `b1w3-c-memory`): the accepted-kind allow-list, the `slugify` helper,
+// and the extract-path block parser / renderer. `./frontmatter.ts` re-exports
+// every name here so the `index.ts` barrel, `markdown-pure.ts` and the CLI
+// keep importing them from `./parsers/frontmatter.js` unchanged.
+// ---------------------------------------------------------------------------
+import { PROJECT_MEMORY_KINDS } from '../types.js';
+/** Accepted-kind set, derived from the canonical `PROJECT_MEMORY_KINDS`
+ *  tuple so the parser cannot drift from the union type / tier map. */
+export const VALID_MEMORY_KINDS = new Set(PROJECT_MEMORY_KINDS);
+/** Exported for guard tests + tooling that needs to enumerate the accepted
+ *  set (CLI help text, `--kind` validation) without duplicating the literal. */
+export const VALID_PROJECT_MEMORY_KINDS = PROJECT_MEMORY_KINDS;
+export function slugify(title) {
+    const slug = title
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    return slug.length > 0 ? slug : 'project-memory';
+}
+/**
+ * Single implementation of the extract-path block parse. Returns a
+ * discriminated result so the caller can say WHY a found block was rejected.
+ *
+ * The precondition order mirrors the original combined `if` exactly
+ * (separator → title → kind present → kind valid → body non-empty), so the
+ * accepted set is bit-for-bit what it always was; only the explanation is new.
+ */
+export function parseBlockResult(block, sourceArtifact) {
+    const normalizedBlock = block.replace(/\r\n/g, '\n');
+    const separatorIndex = normalizedBlock.indexOf('\n---\n');
+    if (separatorIndex < 0) {
+        return {
+            ok: false,
+            reason: 'missing-separator',
+            detail: "block header is not followed by a '---' separator line"
+        };
+    }
+    const header = normalizedBlock.slice(0, separatorIndex).trim();
+    const body = normalizedBlock.slice(separatorIndex + '\n---\n'.length).trim();
+    const fields = new Map();
+    for (const line of header.split('\n')) {
+        const [key, ...valueParts] = line.split(':');
+        const normalizedKey = key?.trim();
+        const value = valueParts.join(':').trim();
+        if (normalizedKey && value) {
+            fields.set(normalizedKey, value);
+        }
+    }
+    const title = fields.get('title')?.trim();
+    const kind = fields.get('kind')?.trim();
+    if (!title) {
+        return {
+            ok: false,
+            reason: 'missing-title',
+            detail: "block header has no non-empty 'title:' field"
+        };
+    }
+    if (!kind) {
+        return {
+            ok: false,
+            reason: 'missing-kind',
+            detail: "block header has no non-empty 'kind:' field"
+        };
+    }
+    if (!VALID_MEMORY_KINDS.has(kind)) {
+        return {
+            ok: false,
+            reason: 'unknown-kind',
+            detail: `block declares kind '${kind}', which is not an accepted memory kind`
+        };
+    }
+    if (body.length === 0) {
+        return { ok: false, reason: 'empty-body', detail: 'block body is empty' };
+    }
+    return { ok: true, memory: { title, kind, body, sourceArtifact } };
+}
+/**
+ * `null`-on-failure projection of `parseBlockResult`. Kept because callers
+ * (and the parser's own contract) consume a plain nullable value; both views
+ * come from the one implementation above, so they cannot diverge.
+ */
+export function parseBlock(block, sourceArtifact) {
+    const parsed = parseBlockResult(block, sourceArtifact);
+    return parsed.ok ? parsed.memory : null;
+}
+export function renderMemoryFile(memory) {
+    const name = slugify(memory.title);
+    return [
+        '---',
+        `name: ${name}`,
+        `description: ${memory.title}`,
+        'metadata:',
+        `  type: ${memory.kind}`,
+        `  sourceArtifact: ${memory.sourceArtifact}`,
+        '---',
+        '',
+        memory.body,
+        ''
+    ].join('\n');
+}

package/dist/services/memory/project-memory-service/parsers/frontmatter.d.ts

@@ -1,27 +1,5 @@
-import type { ExtractedProjectMemory, MemoryBlockParse, ProjectMemoryKind, StoredProjectMemory } from '../types.js';
-/** Accepted-kind set, derived from the canonical `PROJECT_MEMORY_KINDS`
- *  tuple so the parser cannot drift from the union type / tier map. */
-export declare const VALID_MEMORY_KINDS: ReadonlySet<ProjectMemoryKind>;
-/** Exported for guard tests + tooling that needs to enumerate the accepted
- *  set (CLI help text, `--kind` validation) without duplicating the literal. */
-export declare const VALID_PROJECT_MEMORY_KINDS: readonly ProjectMemoryKind[];
-export declare function slugify(title: string): string;
-/**
- * Single implementation of the extract-path block parse. Returns a
- * discriminated result so the caller can say WHY a found block was rejected.
- *
- * The precondition order mirrors the original combined `if` exactly
- * (separator → title → kind present → kind valid → body non-empty), so the
- * accepted set is bit-for-bit what it always was; only the explanation is new.
- */
-export declare function parseBlockResult(block: string, sourceArtifact: string): MemoryBlockParse;
-/**
- * `null`-on-failure projection of `parseBlockResult`. Kept because callers
- * (and the parser's own contract) consume a plain nullable value; both views
- * come from the one implementation above, so they cannot diverge.
- */
-export declare function parseBlock(block: string, sourceArtifact: string): ExtractedProjectMemory | null;
-export declare function renderMemoryFile(memory: ExtractedProjectMemory): string;
+import type { ProjectMemoryKind, StoredProjectMemory } from '../types.js';
+export { parseBlock, parseBlockResult, renderMemoryFile, slugify, VALID_MEMORY_KINDS, VALID_PROJECT_MEMORY_KINDS } from './frontmatter-parse.js';
 /**
  * Where a stored memory file's `kind` came from. `'none'` means the file
  * has no resolvable kind (no `metadata.type`, no `kind:`, no `type:`, or

package/dist/services/memory/project-memory-service/parsers/frontmatter.js

@@ -20,82 +20,12 @@
 // `slugify` helper used to derive filenames from titles.
 // ---------------------------------------------------------------------------
 import { basename } from 'node:path';
-import { PROJECT_MEMORY_KINDS } from '../types.js';
-/** Accepted-kind set, derived from the canonical `PROJECT_MEMORY_KINDS`
- *  tuple so the parser cannot drift from the union type / tier map. */
-export const VALID_MEMORY_KINDS = new Set(PROJECT_MEMORY_KINDS);
-/** Exported for guard tests + tooling that needs to enumerate the accepted
- *  set (CLI help text, `--kind` validation) without duplicating the literal. */
-export const VALID_PROJECT_MEMORY_KINDS = PROJECT_MEMORY_KINDS;
-export function slugify(title) {
-    const slug = title.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
-    return slug.length > 0 ? slug : 'project-memory';
-}
-/**
- * Single implementation of the extract-path block parse. Returns a
- * discriminated result so the caller can say WHY a found block was rejected.
- *
- * The precondition order mirrors the original combined `if` exactly
- * (separator → title → kind present → kind valid → body non-empty), so the
- * accepted set is bit-for-bit what it always was; only the explanation is new.
- */
-export function parseBlockResult(block, sourceArtifact) {
-    const normalizedBlock = block.replace(/\r\n/g, '\n');
-    const separatorIndex = normalizedBlock.indexOf('\n---\n');
-    if (separatorIndex < 0) {
-        return { ok: false, reason: 'missing-separator', detail: "block header is not followed by a '---' separator line" };
-    }
-    const header = normalizedBlock.slice(0, separatorIndex).trim();
-    const body = normalizedBlock.slice(separatorIndex + '\n---\n'.length).trim();
-    const fields = new Map();
-    for (const line of header.split('\n')) {
-        const [key, ...valueParts] = line.split(':');
-        const normalizedKey = key?.trim();
-        const value = valueParts.join(':').trim();
-        if (normalizedKey && value) {
-            fields.set(normalizedKey, value);
-        }
-    }
-    const title = fields.get('title')?.trim();
-    const kind = fields.get('kind')?.trim();
-    if (!title) {
-        return { ok: false, reason: 'missing-title', detail: "block header has no non-empty 'title:' field" };
-    }
-    if (!kind) {
-        return { ok: false, reason: 'missing-kind', detail: "block header has no non-empty 'kind:' field" };
-    }
-    if (!VALID_MEMORY_KINDS.has(kind)) {
-        return { ok: false, reason: 'unknown-kind', detail: `block declares kind '${kind}', which is not an accepted memory kind` };
-    }
-    if (body.length === 0) {
-        return { ok: false, reason: 'empty-body', detail: 'block body is empty' };
-    }
-    return { ok: true, memory: { title, kind, body, sourceArtifact } };
-}
-/**
- * `null`-on-failure projection of `parseBlockResult`. Kept because callers
- * (and the parser's own contract) consume a plain nullable value; both views
- * come from the one implementation above, so they cannot diverge.
- */
-export function parseBlock(block, sourceArtifact) {
-    const parsed = parseBlockResult(block, sourceArtifact);
-    return parsed.ok ? parsed.memory : null;
-}
-export function renderMemoryFile(memory) {
-    const name = slugify(memory.title);
-    return [
-        '---',
-        `name: ${name}`,
-        `description: ${memory.title}`,
-        'metadata:',
-        `  type: ${memory.kind}`,
-        `  sourceArtifact: ${memory.sourceArtifact}`,
-        '---',
-        '',
-        memory.body,
-        ''
-    ].join('\n');
-}
+import { VALID_MEMORY_KINDS } from './frontmatter-parse.js';
+// The kind allow-list, the `slugify` helper, and the extract-path block
+// parser / renderer now live in `./frontmatter-parse.ts`. Re-exported here so
+// the `index.ts` barrel and `markdown-pure.ts` keep resolving them from
+// `./parsers/frontmatter.js` unchanged.
+export { parseBlock, parseBlockResult, renderMemoryFile, slugify, VALID_MEMORY_KINDS, VALID_PROJECT_MEMORY_KINDS } from './frontmatter-parse.js';
 /**
  * Resolve the peaks memory kind from a stored memory file's frontmatter.
  *
@@ -170,11 +100,21 @@ export function parseMemoryFrontmatter(content) {
     const normalized = content.replace(/\r\n/g, '\n');
     const head = normalized.slice(leadingCommentPrefixLength(normalized));
     if (!head.startsWith('---\n')) {
-        return { hasFrontmatter: false, kind: { kind: null, source: 'none', rawKind: null }, frontmatter: '', body: normalized.trim() };
+        return {
+            hasFrontmatter: false,
+            kind: { kind: null, source: 'none', rawKind: null },
+            frontmatter: '',
+            body: normalized.trim()
+        };
     }
     const endIndex = head.indexOf('\n---\n', 4);
     if (endIndex < 0) {
-        return { hasFrontmatter: false, kind: { kind: null, source: 'none', rawKind: null }, frontmatter: '', body: normalized.trim() };
+        return {
+            hasFrontmatter: false,
+            kind: { kind: null, source: 'none', rawKind: null },
+            frontmatter: '',
+            body: normalized.trim()
+        };
     }
     const frontmatter = head.slice(4, endIndex);
     const body = head.slice(endIndex + '\n---\n'.length).trim();
@@ -228,7 +168,16 @@ export function parseMemoryFrontmatter(content) {
             break;
         }
     }
-    return { hasFrontmatter: true, frontmatter, ...(name !== undefined ? { name } : {}), ...(titleField !== undefined ? { title: titleField } : {}), ...(description !== undefined ? { description } : {}), ...(sourceArtifact !== undefined ? { sourceArtifact } : {}), kind, body };
+    return {
+        hasFrontmatter: true,
+        frontmatter,
+        ...(name !== undefined ? { name } : {}),
+        ...(titleField !== undefined ? { title: titleField } : {}),
+        ...(description !== undefined ? { description } : {}),
+        ...(sourceArtifact !== undefined ? { sourceArtifact } : {}),
+        kind,
+        body
+    };
 }
 /**
  * Deterministic name fallback chain for the read path:

package/dist/services/memory/project-memory-service/parsers/markdown-pure.js

@@ -60,7 +60,9 @@ export function summarizeMemoryBody(body) {
         .replace(/^\s*[-*+]\s+/gm, '')
         .replace(/\n+/g, ' ')
         .trim();
-    const sentences = cleaned.split(/(?<=[.!?])\s+/).filter((s) => s.length > MIN_BODY_SENTENCE_LENGTH && !/^\[.+\]$/.test(s));
+    const sentences = cleaned
+        .split(/(?<=[.!?])\s+/)
+        .filter((s) => s.length > MIN_BODY_SENTENCE_LENGTH && !/^\[.+\]$/.test(s));
     if (sentences.length === 0) {
         return cleaned.slice(0, MAX_DESCRIPTION_LENGTH) || 'Project memory';
     }
@@ -101,7 +103,10 @@ export function extractStableProjectMemoriesWithDiagnostics(content, sourceArtif
             memories.push(parsed.memory);
         }
         else {
-            drops.push({ index: start, drop: { sourceArtifact, reason: parsed.reason, detail: parsed.detail } });
+            drops.push({
+                index: start,
+                drop: { sourceArtifact, reason: parsed.reason, detail: parsed.detail }
+            });
         }
         searchStart = end + END_MARKER.length;
     }
@@ -120,7 +125,14 @@ export function extractStableProjectMemoriesWithDiagnostics(content, sourceArtif
         const index = match.index ?? 0;
         if (locatedRanges.some(([from, to]) => index >= from && index < to))
             continue;
-        drops.push({ index, drop: { sourceArtifact, reason: 'unrecognized-marker', detail: describeUnrecognizedMarker(found) } });
+        drops.push({
+            index,
+            drop: {
+                sourceArtifact,
+                reason: 'unrecognized-marker',
+                detail: describeUnrecognizedMarker(found)
+            }
+        });
     }
     drops.sort((left, right) => left.index - right.index);
     return {

package/dist/services/memory/project-memory-service/store/atomic-write.d.ts

@@ -1,5 +1,64 @@
 import type { ExtractedProjectMemory } from '../types.js';
+/**
+ * The names of the three checks `assertSafeMemory` can fail on, written once.
+ *
+ * The name of the check that fired rides the refusal message, so the reader is
+ * told WHICH rule stopped the write instead of only that something was
+ * refused. Callers route their remedy on these same constants (see
+ * `memoryExtractNextActions` in `src/cli/commands/core/memory-command.ts`) —
+ * two strings kept equal by hand is how a message and its advice drift apart.
+ */
+export declare const SENSITIVE_MEMORY_CHECKS: {
+    readonly metadataKey: "metadata key scan";
+    readonly content: "content scan";
+    readonly title: "title scan";
+};
+/**
+ * The credential term this title contains (as a run of words), or `null`.
+ *
+ * Returns the MATCHED TERM rather than a boolean because the refusal message
+ * names it: `title scan matched the credential term "apikey"` is actionable,
+ * while "Refusing to store sensitive memory content" is what sent slice C0's
+ * user looking for a secret that was not there. The returned string is a
+ * dictionary word from the list above — never the title's own text, and never
+ * a value — so echoing it into the error envelope cannot leak anything.
+ */
+export declare function findSensitiveMemoryTitleTerm(title: string): string | null;
 export declare function hasSensitiveMemoryContent(content: string): boolean;
+/**
+ * The refusal `assertSafeMemory` raises: the check that fired and the term it
+ * matched travel as DATA, not only as prose.
+ *
+ * WHY A TYPE RATHER THAN A MESSAGE. The envelope redactor behind every
+ * `fail()` (`packages/peaks-loop-shared/src/result.ts`) strips the words
+ * secret / token / password / api-key out of every failure MESSAGE — a blanket
+ * rule, applied to messages this module does not own. So a message that names
+ * the matched term reaches the CLI reading `… the credential term
+ * "[redacted]" …`: the term is named, and then removed, on the way out.
+ *
+ * The term is a word from `SENSITIVE_PROSE_TERMS` — a fixed vocabulary, never a
+ * value — so there is nothing about it to redact, and it rides a field
+ * instead: `fail()` redacts `message` only. The CLI routes its remedy on
+ * `check` for the same reason — a substring test against a message whose words
+ * can be rewritten is not a routing rule, it is a guess.
+ *
+ * NOTHING HERE WEAKENS THE REDACTOR. The content scan never puts its match in
+ * this object (see `matchedTerm` below), so no value can reach an envelope
+ * through it; the redactor's guarantee is intact and is pinned by the cases in
+ * `tests/unit/services/memory/memory-title-sensitive-scan.test.ts`.
+ */
+export declare class UnsafeMemoryError extends Error {
+    /** One of `SENSITIVE_MEMORY_CHECKS` — which rule refused the write. */
+    readonly check: string;
+    /**
+     * The credential term the TITLE scan matched, or `null` for the other two
+     * checks. `null` is not an omission: their match can BE the credential
+     * (`ghp_…`, the PEM header, the JWT), which is why their messages describe
+     * the pattern family and never echo the text.
+     */
+    readonly matchedTerm: string | null;
+    constructor(check: string, detail: string, matchedTerm?: string | null);
+}
 export declare function assertSafeMemory(memory: ExtractedProjectMemory): void;
 export declare function assertSafeMemoryFileContent(content: string): void;
 export declare function writeNewFile(path: string, content: string): void;

package/dist/services/memory/project-memory-service/store/atomic-write.js

@@ -5,9 +5,13 @@
 //     PEM private keys, JWTs, GitHub / GitLab tokens, AWS access keys. Used
 //     both by the extract path (`assertSafeMemory`) and the backup path
 //     (`assertSafeMemoryFileContent`).
+//   - `findSensitiveMemoryTitleTerm` — the PROSE predicate for
+//     `memory.title`. It is deliberately NOT the config-key predicate: see
+//     the block comment above it (slice C0).
 //   - `assertSafeMemory` — full safety gate applied during extraction.
-//     Combines title/body content scan + config-service secret check +
-//     sensitive-path check on the title.
+//     Combines the metadata key scan + the content pattern scan + the title
+//     scan. Each failure names the check that fired, and the title one names
+//     the term it matched.
 //   - `assertSafeMemoryFileContent` — lighter version for backup: just
 //     the content pattern scan, since the file already lives in
 //     `.peaks/memory/` and was authored through the normal pipeline.
@@ -17,27 +21,195 @@
 //     for index.json regeneration.
 // ---------------------------------------------------------------------------
 import { closeSync, constants, openSync, writeFileSync } from 'node:fs';
-import { containsSensitiveConfigValue, isSensitiveConfigPath } from '../../../config/config-service.js';
+import { containsSensitiveConfigValue } from '../../../config/config-service.js';
+/**
+ * The names of the three checks `assertSafeMemory` can fail on, written once.
+ *
+ * The name of the check that fired rides the refusal message, so the reader is
+ * told WHICH rule stopped the write instead of only that something was
+ * refused. Callers route their remedy on these same constants (see
+ * `memoryExtractNextActions` in `src/cli/commands/core/memory-command.ts`) —
+ * two strings kept equal by hand is how a message and its advice drift apart.
+ */
+export const SENSITIVE_MEMORY_CHECKS = {
+    metadataKey: 'metadata key scan',
+    content: 'content scan',
+    title: 'title scan'
+};
+/** The stable prefix of every refusal this module raises on the extract path. */
+const SENSITIVE_MEMORY_REFUSAL = 'Refusing to store sensitive memory content';
+/**
+ * Credential TERMS as they appear in prose — the word-level counterpart of the
+ * config-key predicate `config-service.isSensitiveConfigPath`.
+ *
+ * WHY THE TITLE CHECK EXISTS AT ALL (it is not redundant with the content
+ * scanner). `hasSensitiveMemoryContent` looks for a credential *value*: its
+ * first pattern needs a `:` or `=`, so a title that is nothing but `apiKey`
+ * carries no value and slips past it. The title scan is the only rule that can
+ * see "the title IS a credential name" — so this check was kept, and only its
+ * predicate was replaced.
+ *
+ * WHY IT DOES NOT REUSE `isSensitiveConfigPath`. That predicate answers "is
+ * this a CONFIG KEY", and it answers by SUBSTRING: `includes('auth')` is true
+ * for `authority`, `author`, `unauthorized`. On a config key that breadth is
+ * harmless — an auth-bearing key IS a credential key, and the config domain is
+ * untouched here. On a prose title it is a false refusal the author cannot see
+ * the cause of: slice C0, where `peaks memory extract` refused a memory titled
+ * "Derive from the authority, never re-declare it" and told the user to
+ * "remove secrets" from a memory that had none.
+ *
+ * HOW IT MATCHES. The title is cut into alphanumeric segments (camelCase
+ * boundaries included) and a match is a CONTIGUOUS RUN of segments whose
+ * concatenation is one of the terms below. Runs — not single words — are what
+ * keep the credential-name spellings a substring check caught and a naive
+ * word-per-word check would lose: `private_key`, `api key`, `myApiKey` and
+ * `access token` all still match, while `authority`, `author`, `tokenizer`,
+ * `secretary` and `credentialed` do not.
+ *
+ * The residual narrowing is named rather than hidden: an UNSEPARATED compound
+ * with a term buried mid-word (`mysecretstuff`) no longer matches. That is the
+ * same class as the false refusals above — a word containing `secret` is not a
+ * credential term — and the memory body is scanned for values either way.
+ *
+ * The plural forms are listed explicitly instead of deriving them by stripping
+ * a trailing `s` from each match: that rule would turn `secretaries` into
+ * `secretarie` → `secret`, which is precisely the substring confusion this
+ * predicate exists to end.
+ */
+const SENSITIVE_PROSE_TERMS = new Set([
+    'apikey',
+    'apikeys',
+    'accesskey',
+    'accesskeys',
+    'privatekey',
+    'privatekeys',
+    'secretkey',
+    'secretkeys',
+    'accesstoken',
+    'accesstokens',
+    'authtoken',
+    'authtokens',
+    'authkey',
+    'authkeys',
+    'refreshtoken',
+    'refreshtokens',
+    'token',
+    'tokens',
+    'secret',
+    'secrets',
+    'password',
+    'passwords',
+    'passwd',
+    'bearer',
+    'credential',
+    'credentials'
+]);
+/** A lower→upper transition: the boundary between the words of `apiKey`. */
+const CAMEL_CASE_BOUNDARY = /([a-z0-9])([A-Z])/g;
+/** `myApiKey` → `['my', 'api', 'key']`; `private_key` → `['private', 'key']`. */
+function proseSegments(text) {
+    return text
+        .replace(CAMEL_CASE_BOUNDARY, '$1 $2')
+        .toLowerCase()
+        .split(/[^a-z0-9]+/)
+        .filter((segment) => segment.length > 0);
+}
+/**
+ * The credential term this title contains (as a run of words), or `null`.
+ *
+ * Returns the MATCHED TERM rather than a boolean because the refusal message
+ * names it: `title scan matched the credential term "apikey"` is actionable,
+ * while "Refusing to store sensitive memory content" is what sent slice C0's
+ * user looking for a secret that was not there. The returned string is a
+ * dictionary word from the list above — never the title's own text, and never
+ * a value — so echoing it into the error envelope cannot leak anything.
+ */
+export function findSensitiveMemoryTitleTerm(title) {
+    const segments = proseSegments(title);
+    for (let start = 0; start < segments.length; start += 1) {
+        let run = '';
+        for (let end = start; end < segments.length; end += 1) {
+            run += segments[end];
+            if (SENSITIVE_PROSE_TERMS.has(run))
+                return run;
+        }
+    }
+    return null;
+}
 export function hasSensitiveMemoryContent(content) {
-    return /(?:api[_-]?key|token|secret|password|credential|bearer)\s*[:=]/i.test(content)
-        || /\bauthorization\s*:\s*bearer\s+\S+/i.test(content)
-        || /\bbearer\s+[A-Za-z0-9._~+/=-]{12,}\b/i.test(content)
-        || /\bsk-[A-Za-z0-9_-]{6,}\b/.test(content)
-        || /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/.test(content)
-        || /\bgithub_pat_[A-Za-z0-9_]{20,}\b/.test(content)
-        || /\bglpat-[A-Za-z0-9_-]{20,}\b/.test(content)
-        || /\bAKIA[0-9A-Z]{16}\b/.test(content)
-        || /-----BEGIN [A-Z ]*PRIVATE KEY-----/.test(content)
-        || /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/.test(content);
+    return (/(?:api[_-]?key|token|secret|password|credential|bearer)\s*[:=]/i.test(content) ||
+        /\bauthorization\s*:\s*bearer\s+\S+/i.test(content) ||
+        /\bbearer\s+[A-Za-z0-9._~+/=-]{12,}\b/i.test(content) ||
+        /\bsk-[A-Za-z0-9_-]{6,}\b/.test(content) ||
+        /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/.test(content) ||
+        /\bgithub_pat_[A-Za-z0-9_]{20,}\b/.test(content) ||
+        /\bglpat-[A-Za-z0-9_-]{20,}\b/.test(content) ||
+        /\bAKIA[0-9A-Z]{16}\b/.test(content) ||
+        /-----BEGIN [A-Z ]*PRIVATE KEY-----/.test(content) ||
+        /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/.test(content));
+}
+/**
+ * The refusal `assertSafeMemory` raises: the check that fired and the term it
+ * matched travel as DATA, not only as prose.
+ *
+ * WHY A TYPE RATHER THAN A MESSAGE. The envelope redactor behind every
+ * `fail()` (`packages/peaks-loop-shared/src/result.ts`) strips the words
+ * secret / token / password / api-key out of every failure MESSAGE — a blanket
+ * rule, applied to messages this module does not own. So a message that names
+ * the matched term reaches the CLI reading `… the credential term
+ * "[redacted]" …`: the term is named, and then removed, on the way out.
+ *
+ * The term is a word from `SENSITIVE_PROSE_TERMS` — a fixed vocabulary, never a
+ * value — so there is nothing about it to redact, and it rides a field
+ * instead: `fail()` redacts `message` only. The CLI routes its remedy on
+ * `check` for the same reason — a substring test against a message whose words
+ * can be rewritten is not a routing rule, it is a guess.
+ *
+ * NOTHING HERE WEAKENS THE REDACTOR. The content scan never puts its match in
+ * this object (see `matchedTerm` below), so no value can reach an envelope
+ * through it; the redactor's guarantee is intact and is pinned by the cases in
+ * `tests/unit/services/memory/memory-title-sensitive-scan.test.ts`.
+ */
+export class UnsafeMemoryError extends Error {
+    /** One of `SENSITIVE_MEMORY_CHECKS` — which rule refused the write. */
+    check;
+    /**
+     * The credential term the TITLE scan matched, or `null` for the other two
+     * checks. `null` is not an omission: their match can BE the credential
+     * (`ghp_…`, the PEM header, the JWT), which is why their messages describe
+     * the pattern family and never echo the text.
+     */
+    matchedTerm;
+    constructor(check, detail, matchedTerm = null) {
+        super(`${SENSITIVE_MEMORY_REFUSAL}: ${check} ${detail}.`);
+        this.name = 'UnsafeMemoryError';
+        this.check = check;
+        this.matchedTerm = matchedTerm;
+    }
 }
 export function assertSafeMemory(memory) {
     const content = `${memory.title}\n${memory.kind}\n${memory.body}`;
     const metadata = { title: memory.title, kind: memory.kind, body: memory.body };
-    if (containsSensitiveConfigValue(metadata) || hasSensitiveMemoryContent(content)) {
-        throw new Error('Refusing to store sensitive memory content');
+    if (containsSensitiveConfigValue(metadata)) {
+        throw new UnsafeMemoryError(SENSITIVE_MEMORY_CHECKS.metadataKey, 'matched a credential key in the memory metadata');
+    }
+    if (hasSensitiveMemoryContent(content)) {
+        // The match is deliberately NOT echoed, in the message or in the error's
+        // fields: for most of these patterns the match IS the credential, so
+        // copying it would write the value this scan exists to keep out.
+        //
+        // The DETAIL is worded around the envelope redactor's vocabulary on
+        // purpose. Its catch-all (`/(secret|token|password|api[-_ ]?key)/gi`)
+        // rewrites those four words wherever they appear in a failure message, so
+        // naming the pattern families in their own words arrives on the CLI as
+        // "an [redacted] / [redacted] / [redacted] assignment" — a remedy sentence
+        // redacted into uselessness by the very policy it agrees with. Measured on
+        // the real CLI, both wordings; this one survives intact.
+        throw new UnsafeMemoryError(SENSITIVE_MEMORY_CHECKS.content, 'matched a credential value in the memory content (a `key=value` credential assignment, a Bearer header, a PEM private key, a JWT, or a provider credential)');
     }
-    if (isSensitiveConfigPath(memory.title)) {
-        throw new Error('Refusing to store sensitive memory content');
+    const titleTerm = findSensitiveMemoryTitleTerm(memory.title);
+    if (titleTerm !== null) {
+        throw new UnsafeMemoryError(SENSITIVE_MEMORY_CHECKS.title, `matched the credential term "${titleTerm}" in memory.title`, titleTerm);
     }
 }
 export function assertSafeMemoryFileContent(content) {

package/dist/services/memory/project-memory-service/store/paths.js

@@ -93,7 +93,8 @@ export function safeRealpath(path) {
     try {
         return realpathSync(path);
     }
-    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+    catch {
+        // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
         return null;
     }
 }

package/dist/services/memory/project-memory-service/types.d.ts

@@ -1,34 +1,6 @@
-/**
- * Canonical memory-kind vocabulary — the single source of truth.
- *
- * The union type, the accepted-kind set in the frontmatter parser, the
- * hot/warm tier map below, `KIND_ORDER` in the reindex view, and the CLI
- * `--kind` help text all derive from this tuple. Adding a kind here is the
- * only edit required; TypeScript then forces `MEMORY_KIND_TIER` to cover it.
- *
- * Slice 2026-09-10-memory-vocab-and-rotate (E): the original 8 kinds are
- * unchanged. The 13 appended kinds were observed on disk with real values
- * that the index schema rejected (`peaks memory reindex` reported them as
- * `unrecognized kind value`). Accepting them moves those files into the
- * index; files with no kind field at all stay reported as unclassified.
- */
-export declare const PROJECT_MEMORY_KINDS: readonly ["project", "rule", "decision", "reference", "feedback", "convention", "module", "lesson", "bug", "investigation", "technical-pattern", "project-rule", "design", "handoff", "session-handoff", "project-todo", "publish-closure", "project-closure", "slice-closure", "slice-pilot-findings", "sediment"];
-export type ProjectMemoryKind = (typeof PROJECT_MEMORY_KINDS)[number];
-/** Hot kinds keep their body in the always-available index; warm kinds are
- *  indexed with the same entry shape but read on demand. */
-export type MemoryKindTier = 'hot' | 'warm';
-/**
- * Hot/warm tier per kind. Insertion order IS the deterministic section order
- * used by the generated `MEMORY.md` (`KIND_ORDER` in `index/reindex.ts`),
- * so this object's key order is load-bearing — append new kinds at the end
- * of their tier block rather than reshuffling existing entries.
- *
- * The `Record<ProjectMemoryKind, MemoryKindTier>` annotation makes a missing
- * tier a compile error whenever `PROJECT_MEMORY_KINDS` grows.
- */
-export declare const MEMORY_KIND_TIER: Record<ProjectMemoryKind, MemoryKindTier>;
-export declare const HOT_MEMORY_KINDS: readonly ProjectMemoryKind[];
-export declare const WARM_MEMORY_KINDS: readonly ProjectMemoryKind[];
+import type { ProjectMemoryKind } from './memory-kinds.js';
+export { HOT_MEMORY_KINDS, MEMORY_KIND_TIER, PROJECT_MEMORY_KINDS, WARM_MEMORY_KINDS } from './memory-kinds.js';
+export type { MemoryKindTier, ProjectMemoryKind } from './memory-kinds.js';
 export type ExtractedProjectMemory = {
     title: string;
     kind: ProjectMemoryKind;