sage-mem 2.1.3 → 2.1.4

package/README.md

@@ -12,7 +12,7 @@
 
 **Cross-session memory for DeepSeek Harness — plain markdown files, no database, no worker.**
 
-**Current release: `2.1.3`** — the npm badge above is the dynamic source of truth. **Contract baseline: `1.0.0`** — the first stable release, whose public commitments, the capability boundaries and the list of things it explicitly cannot do are frozen in the
+**Current release: `2.1.4`** — the npm badge above is the dynamic source of truth. **Contract baseline: `1.0.0`** — the first stable release, whose public commitments, the capability boundaries and the list of things it explicitly cannot do are frozen in the
 [frozen contract](https://github.com/gezi-wen/sage-mem/blob/main/docs/1.0.0-contract.md).
 
 If it is useful to you, a Star is the most direct feedback.

package/README.zh.md

@@ -14,7 +14,7 @@
 
 > File-based cross-session memory for DeepSeek Harness — every memory is a plain markdown file you can open, edit and delete. No database, no worker, no port.
 
-**当前发布版本：`2.1.3`** —— 顶部 npm 徽章是动态权威。**契约基线：`1.0.0`** —— 第一个稳定版，公开承诺、能力边界与「明确做不到」的清单冻结在
+**当前发布版本：`2.1.4`** —— 顶部 npm 徽章是动态权威。**契约基线：`1.0.0`** —— 第一个稳定版，公开承诺、能力边界与「明确做不到」的清单冻结在
 [契约冻结](https://github.com/gezi-wen/sage-mem/blob/main/docs/1.0.0-contract.md)。
 
 如果它对你有用，给个 Star 是最直接的反馈。

package/lib/autodream/tools.js

@@ -36,7 +36,7 @@ import { writeFileAtomic, warnLog } from '../memory/util.js'
 import { buildConflict, listConflicts, readConflict, sameConflict, writeConflict } from '../memory/conflicts.js'
 import { memoryPathOf } from '../memory/paths.js'
 import { decideWriteIntent } from '../memory/write-gate.js'
-import { inspectMemoryEntry, reservedIdentitySet } from '../memory/scan.js'
+import { inspectMemoryEntry, readVerified, reservedIdentitySet } from '../memory/scan.js'
 
 /** 单次 read_memory 返回的正文上限（字符）。超过就截断并明确告诉模型。 */
 const READ_LIMIT = 20000
@@ -121,7 +121,8 @@ async function scanEntries(memoryDir, ctx) {
       continue
     }
     try {
-      const content = await readFile(full, 'utf8')
+      // 同上：清单也要从闸门检查过的那个句柄读（N03 —— 检查后换文件不能把外部标题带进来）。
+      const content = await readVerified(full, gate, 'utf8')
       const meta = parseFrontmatterLite(content)
       const body = content.replace(/^---\r?\n[\s\S]*?\r?\n---/, '')
       const h1 = body.match(/^#\s+(.+)$/m)
@@ -538,9 +539,16 @@ export function createToolRunner(opts) {
     const before = await hostStat()
     let content
     try {
-      content = await readFile(full, 'utf8')
+      /**
+       * 内容走**公共句柄读取入口**（外部审查 2026-10-31，N03）：`inspectMemoryEntry` 是按路径
+       * `lstat`，`readFile(路径)` 是另一次按路径打开 —— 两次之间把普通文件换成符号链接 / 另一份
+       * 文件，读的就是没检查过的东西（审查用真符号链接复现出目录外内容）。`readVerified`
+       * 改成 open 句柄 + fstat 比对 `dev:ino` / 大小，只从那个句柄读；体积上限也在全文读入
+       * **之前**生效，不会先整份读进内存再判。
+       */
+      content = await readVerified(full, gate, 'utf8')
     } catch (err) {
-      // 扫到读之间被删是正常状态；其余读失败照旧抛给上层（外层会转成一次工具失败）。
+      // 扫到读之间被删是正常状态；其余读失败（含「检查后被换掉」）照旧抛给上层。
       if (err?.code === 'ENOENT') return { ok: false, gate: { ok: false, code: 'missing' } }
       throw err
     }
@@ -982,10 +990,11 @@ export function createToolRunner(opts) {
               return '错误：report_contradiction 必须给 note —— 一句话说明这两条到底哪里互斥。'
             }
             // 两份正文都存进记录：面板上人要对照着判，只留一边等于没得判。
+            // 同样走句柄读取入口（N03）：记录里的正文会被人和模型看到，不能来自目录外。
             const readBody = async (full) => {
               const gate = await inspectMemoryEntry(full)
               if (!gate.ok) return null
-              return await readFile(full, 'utf8').catch(() => null)
+              return await readVerified(full, gate, 'utf8').catch(() => null)
             }
             const onDisk = await readBody(oldFull)
             const incoming = await readBody(newFull)

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sage-mem",
   "description": "Cross-session memory for DeepSeek Harness — plain markdown files, no database, no worker.",
-  "version": "2.1.3",
+  "version": "2.1.4",
   "type": "module",
   "main": "lib/index.js",
   "icon": "./icon.png",