sage-mem 2.1.22 → 2.1.24

package/README.md

@@ -12,7 +12,7 @@
 
 **Cross-session memory for DeepSeek Harness — plain markdown files, no database, no worker.**
 
-**Current release: `2.1.22`** — the npm badge above is the dynamic source of truth. **Contract baseline: `1.0.0`** — the first stable release, whose public commitments, the capability boundaries and the list of things it explicitly cannot do are frozen in the
+**Current release: `2.1.24`** — the npm badge above is the dynamic source of truth. **Contract baseline: `1.0.0`** — the first stable release, whose public commitments, the capability boundaries and the list of things it explicitly cannot do are frozen in the
 [frozen contract](https://github.com/gezi-wen/sage-mem/blob/main/docs/1.0.0-contract.md).
 
 If it is useful to you, a Star is the most direct feedback.

package/README.zh.md

@@ -14,7 +14,7 @@
 
 > File-based cross-session memory for DeepSeek Harness — every memory is a plain markdown file you can open, edit and delete. No database, no worker, no port.
 
-**当前发布版本：`2.1.22`** —— 顶部 npm 徽章是动态权威。**契约基线：`1.0.0`** —— 第一个稳定版，公开承诺、能力边界与「明确做不到」的清单冻结在
+**当前发布版本：`2.1.24`** —— 顶部 npm 徽章是动态权威。**契约基线：`1.0.0`** —— 第一个稳定版，公开承诺、能力边界与「明确做不到」的清单冻结在
 [契约冻结](https://github.com/gezi-wen/sage-mem/blob/main/docs/1.0.0-contract.md)。
 
 如果它对你有用，给个 Star 是最直接的反馈。

package/lib/autodream/tools.js

@@ -30,7 +30,7 @@ import { createHash } from 'node:crypto'
 import { auditMemoryDir, formatAudit, parseFrontmatterLite } from './audit.js'
 import { archiveMemory } from '../memory/archive.js'
 import { MAX_FILE_BYTES, STATE_ROOT } from '../memory/config.js'
-import { INDEX_FILE_KEY, SESSION_LOG_KEY } from '../shared/md-name.js'
+import { INDEX_FILE_KEY, SESSION_LOG_KEY, isPlainMdName } from '../shared/md-name.js'
 import { stampHuman as localStamp } from '../shared/stamp.js'
 import { writeFileAtomic, warnLog } from '../memory/util.js'
 import { buildConflict, listConflicts, readConflict, sameConflict, writeConflict } from '../memory/conflicts.js'
@@ -58,10 +58,13 @@ export function safeMemoryPath(memoryDir, raw) {
   if (typeof raw !== 'string') return null
   const trimmed = raw.trim()
   if (!trimmed) return null
-  // 显式拒绝任何路径分隔与上跳：basename 只做兜底，先拒绝更清楚。
-  if (trimmed.includes('/') || trimmed.includes('\\') || trimmed.includes('..')) return null
-  if (!/\.md$/i.test(trimmed)) return null
+  // 文件名合法性**只用唯一判据**（`shared/md-name.js`）：路径分隔符、冒号（NTFS 交替数据流）、
+  // 通配符与控制字符一律拒。这里曾经自己抄了一份、只拒了两种分隔符与上跳 ——
+  // 于是 `a:b.md` / `MEMORY.md:evil.md` 能一路走到 join，而它正是这条写路径的入口（2026-11-03 收敛）。
+  if (!isPlainMdName(trimmed)) return null
   const base = basename(trimmed)
+  // 业务约束，比「文件名合法性」更严：不写隐藏文件。它是本函数比
+  // `isPlainMdName` 多出来的**唯一**一条，`test/shared-parity-test.mjs` 第 1 组盯着它。
   if (base.startsWith('.')) return null
   return join(memoryDir, base)
 }

package/lib/client.js

@@ -224,59 +224,6 @@ window.__ModuleLoader__.load({
 const StarmapRuntime = (function (require, _react) {
 	let react = _react;
 	const h = react.createElement;
-// ── 手写 strict codec（浏览器无 zod，typert 只要求 parse 方法）──
-		// isStr / isNum / strSchema 来自 05-shared.js（这个 IIFE 在 factory 作用域内，看得到）。
-		const starSchema = {
-			parse(v) {
-				if (v === null || typeof v !== "object") throw new Error("invalid star");
-				isStr(v.file); isStr(v.kind); isStr(v.title); isStr(v.desc); isNum(v.bytes); isNum(v.mtimeMs);
-				return v;
-			},
-		};
-		const listSchema = {
-			parse(v) {
-				if (v === null || typeof v !== "object") throw new Error("invalid payload");
-				isNum(v.count);
-				if (!Array.isArray(v.stars)) throw new Error("expected stars array");
-				v.stars.forEach((s) => starSchema.parse(s));
-				return v;
-			},
-		};
-		const readSchema = {
-			parse(v) {
-				if (v === null || typeof v !== "object") throw new Error("invalid payload");
-				isStr(v.name); isStr(v.content);
-				return v;
-			},
-		};
-
-		const TYPERT_REMOTE = {
-			package: "sage-starmap",
-			descriptors: [
-				{
-					id: "sage-starmap#starmap/listStars",
-					service: "starmap",
-					namespace: "starmap",
-					method: "listStars",
-					invocation: { kind: "direct" },
-					parameters: [],
-					result: { mode: "strict", typeSymbol: "sage-starmap/types#StarList", schema: listSchema, create: () => listSchema },
-					sourceLocation: { "file": "lib/index.js", "line": 1, "column": 1 },
-				},
-				{
-					id: "sage-starmap#starmap/readFile",
-					service: "starmap",
-					namespace: "starmap",
-					method: "readFile",
-					invocation: { kind: "direct" },
-					parameters: [
-						{ name: "name", wire: "name", source: "json", codec: { mode: "strict", typeSymbol: "sage-starmap/types#FileName", schema: strSchema, create: () => strSchema } },
-					],
-					result: { mode: "strict", typeSymbol: "sage-starmap/types#FileContent", schema: readSchema, create: () => readSchema },
-					sourceLocation: { "file": "lib/index.js", "line": 1, "column": 1 },
-				},
-			],
-		};
 
 		/** 错误详情尽量展开，避免 "[object Object]" 式黑洞。 */
 		function detail(e) {
@@ -1694,32 +1641,6 @@ const StarmapRuntime = (function (require, _react) {
 				body);
 		}
 
-		const inject = ["slots", "remote"];
-
-		/**
-		 * Client 插件：$mount strict remote contribution（第三方 remote 不在
-		 * 宿主的固定 remote 清单里，必须自己挂），再注册星图子槽（B 方案起不再有右缘浮标与全屏 overlay）。
-		 */
-		async function apply(ctx) {
-			appCtx = ctx;
-			try {
-				await ctx.remote.$mount(TYPERT_REMOTE);
-			} catch (e) {
-				// remote 注册失败不拖死 UI：星图打开时再向用户报错
-				console.error("sage-starmap: remote mount failed", e);
-			}
-			injectCss();
-			// B 方案：星图不再占对话主界面（去掉右缘 ✦ 浮标 + 全屏 overlay），
-			// 改为注入 sage-mem 记忆管理页的「星图」子槽（settings.memory.starmap），
-			// 由记忆管理页的标签栏切换渲染，作为并列视图。
-			ctx.slots.inject("settings.memory.starmap", () => {
-				ctx.slots.register(
-					{ name: "settings.memory.starmap", id: "sage-starmap", order: 10, label: "记忆星图" },
-					() => h(StarMap, { ctx: appCtx }),
-				);
-			});
-		}
-
 		injectCss();
 		return { StarMap: StarMap };
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sage-mem",
   "description": "Cross-session memory for DeepSeek Harness — plain markdown files, no database, no worker.",
-  "version": "2.1.22",
+  "version": "2.1.24",
   "type": "module",
   "main": "lib/index.js",
   "icon": "./icon.png",