shieldcortex 3.5.0 → 4.0.1

package/dist/memory/staleness.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Memory Staleness Scoring — v4.0.0
+ *
+ * Provides staleness awareness to memories based on age.
+ * Used by search and recall to surface freshness warnings.
+ */
+/**
+ * Days since memory was created.
+ */
+export declare function memoryAgeDays(createdAt: number): number;
+/**
+ * Human-readable age string.
+ */
+export declare function memoryAge(createdAt: number): string;
+/**
+ * Freshness score: 1.0 for today, exponentially decaying.
+ * Half-life of ~7 days: score ≈ 0.5 after a week.
+ */
+export declare function memoryFreshnessScore(createdAt: number): number;
+/**
+ * Warning text for stale memories (>2 days old). Returns null for fresh memories.
+ */
+export declare function memoryFreshnessWarning(createdAt: number): string | null;
+/**
+ * Append staleness warning to a memory's content for display.
+ */
+export declare function appendStalenessWarning(content: string, createdAt: Date): string;

package/dist/memory/staleness.js

@@ -0,0 +1,68 @@
+/**
+ * Memory Staleness Scoring — v4.0.0
+ *
+ * Provides staleness awareness to memories based on age.
+ * Used by search and recall to surface freshness warnings.
+ */
+const MS_PER_DAY = 86_400_000;
+/**
+ * Days since memory was created.
+ */
+export function memoryAgeDays(createdAt) {
+    return Math.max(0, Math.floor((Date.now() - createdAt) / MS_PER_DAY));
+}
+/**
+ * Human-readable age string.
+ */
+export function memoryAge(createdAt) {
+    const days = memoryAgeDays(createdAt);
+    if (days === 0)
+        return 'today';
+    if (days === 1)
+        return 'yesterday';
+    if (days < 7)
+        return `${days} days ago`;
+    if (days < 14)
+        return '1 week ago';
+    if (days < 30)
+        return `${Math.floor(days / 7)} weeks ago`;
+    if (days < 60)
+        return '1 month ago';
+    if (days < 365)
+        return `${Math.floor(days / 30)} months ago`;
+    return `${Math.floor(days / 365)} year${Math.floor(days / 365) > 1 ? 's' : ''} ago`;
+}
+/**
+ * Freshness score: 1.0 for today, exponentially decaying.
+ * Half-life of ~7 days: score ≈ 0.5 after a week.
+ */
+export function memoryFreshnessScore(createdAt) {
+    const days = memoryAgeDays(createdAt);
+    if (days === 0)
+        return 1.0;
+    // Exponential decay with half-life of 7 days
+    return Math.max(0.01, Math.exp(-0.099 * days));
+}
+/**
+ * Warning text for stale memories (>2 days old). Returns null for fresh memories.
+ */
+export function memoryFreshnessWarning(createdAt) {
+    const days = memoryAgeDays(createdAt);
+    if (days <= 2)
+        return null;
+    const age = memoryAge(createdAt);
+    const score = memoryFreshnessScore(createdAt);
+    if (score < 0.1) {
+        return `⚠️ Very stale memory (${age}, freshness ${(score * 100).toFixed(0)}%) — verify before relying on this`;
+    }
+    return `⚠️ Aging memory (${age}, freshness ${(score * 100).toFixed(0)}%) — may need verification`;
+}
+/**
+ * Append staleness warning to a memory's content for display.
+ */
+export function appendStalenessWarning(content, createdAt) {
+    const warning = memoryFreshnessWarning(createdAt.getTime());
+    if (!warning)
+        return content;
+    return `${content}\n\n${warning}`;
+}

package/dist/memory/store.js

@@ -198,6 +198,8 @@ export function rowToMemory(row) {
         sensitivityLevel: row.sensitivity_level ?? 'INTERNAL',
         source: row.source ?? null,
         cloudExcluded: Boolean(row.cloud_excluded),
+        memoryPurpose: (row.memory_purpose ?? 'project'),
+        memoryScope: (row.memory_scope ?? 'private'),
     };
 }
 /**
@@ -417,9 +419,9 @@ export function addMemory(input, config = DEFAULT_CONFIG, source) {
     const stmt = db.prepare(`
     INSERT INTO memories (
       uuid, type, category, title, content, project, tags, salience, metadata, scope, transferable,
-      status, pinned, reviewed_at, reviewed_by, source_kind, capture_method, cloud_excluded, updated_at
+      status, pinned, reviewed_at, reviewed_by, source_kind, capture_method, cloud_excluded, memory_purpose, memory_scope, updated_at
     )
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP)
   `);
     // Anti-bloat: Truncate content if too large
     const truncationResult = truncateContent(input.content);
@@ -432,7 +434,7 @@ export function addMemory(input, config = DEFAULT_CONFIG, source) {
     // Transaction: INSERT + defence UPDATE must be atomic to prevent wrong trust scores
     const insertedId = db.transaction(() => {
         const memoryUuid = randomUUID();
-        const result = stmt.run(memoryUuid, type, category, input.title, truncationResult.content, input.project || null, JSON.stringify(tags), salience, JSON.stringify(input.metadata || {}), scope, transferable, status, pinned, input.reviewedBy ? new Date().toISOString() : null, input.reviewedBy ?? null, sourceDetails.sourceKind, sourceDetails.captureMethod, cloudExcluded);
+        const result = stmt.run(memoryUuid, type, category, input.title, truncationResult.content, input.project || null, JSON.stringify(tags), salience, JSON.stringify(input.metadata || {}), scope, transferable, status, pinned, input.reviewedBy ? new Date().toISOString() : null, input.reviewedBy ?? null, sourceDetails.sourceKind, sourceDetails.captureMethod, cloudExcluded, input.memoryPurpose || 'project', input.memoryScope || 'private');
         if (defenceResult) {
             db.prepare(`UPDATE memories SET trust_score = ?, sensitivity_level = ?, source = ? WHERE id = ?`)
                 .run(defenceResult.trust.score, defenceResult.sensitivity.level, sourceDetails.sourceValue, result.lastInsertRowid);
@@ -653,6 +655,14 @@ export function updateMemory(id, updates) {
         fields.push('cloud_excluded = ?');
         values.push(updates.cloudExcluded ? 1 : 0);
     }
+    if (updates.memoryPurpose !== undefined) {
+        fields.push('memory_purpose = ?');
+        values.push(updates.memoryPurpose);
+    }
+    if (updates.memoryScope !== undefined) {
+        fields.push('memory_scope = ?');
+        values.push(updates.memoryScope);
+    }
     if (fields.length === 0)
         return existing;
     values.push(id);

package/dist/memory/types.d.ts

@@ -5,6 +5,8 @@ export type MemoryType = 'short_term' | 'long_term' | 'episodic';
 export type MemoryStatus = 'active' | 'archived' | 'suppressed' | 'canonical';
 export type MemorySourceKind = 'user' | 'cli' | 'hook' | 'plugin' | 'agent' | 'import' | 'cloud' | 'api' | 'system';
 export type MemoryCaptureMethod = 'manual' | 'hook' | 'plugin' | 'import' | 'cloud' | 'api' | 'auto' | 'review';
+export type MemoryPurpose = 'user' | 'feedback' | 'project' | 'reference';
+export type MemoryScope = 'private' | 'team';
 export type MemoryCategory = 'architecture' | 'pattern' | 'preference' | 'error' | 'context' | 'learning' | 'todo' | 'note' | 'relationship' | 'custom';
 export interface Memory {
     id: number;
@@ -35,6 +37,8 @@ export interface Memory {
     sensitivityLevel: string;
     source: string | null;
     cloudExcluded: boolean;
+    memoryPurpose: MemoryPurpose;
+    memoryScope: MemoryScope;
 }
 export interface MemoryInput {
     type?: MemoryType;
@@ -56,6 +60,8 @@ export interface MemoryInput {
     sensitivityLevel?: string;
     source?: string | null;
     cloudExcluded?: boolean;
+    memoryPurpose?: MemoryPurpose;
+    memoryScope?: MemoryScope;
 }
 export interface SearchOptions {
     query: string;
@@ -69,6 +75,8 @@ export interface SearchOptions {
     includeGlobal?: boolean;
     includeArchived?: boolean;
     includeSuppressed?: boolean;
+    memoryPurpose?: MemoryPurpose;
+    memoryScope?: MemoryScope;
 }
 export interface SearchResult {
     memory: Memory;
@@ -149,3 +157,7 @@ export declare const DEFAULT_CONFIG: MemoryConfig;
  * Lower threshold = harder to delete (more valuable)
  */
 export declare const DELETION_THRESHOLDS: Record<MemoryCategory, number>;
+export declare const VALID_MEMORY_PURPOSES: MemoryPurpose[];
+export declare const VALID_MEMORY_SCOPES: MemoryScope[];
+export declare function isValidMemoryPurpose(value: unknown): value is MemoryPurpose;
+export declare function isValidMemoryScope(value: unknown): value is MemoryScope;

package/dist/memory/types.js

@@ -27,3 +27,12 @@ export const DELETION_THRESHOLDS = {
     todo: 0.25, // Todos - easier to delete
     custom: 0.22, // Custom memories
 };
+// ── Memory Purpose Validation ────────────────────────────────────
+export const VALID_MEMORY_PURPOSES = ['user', 'feedback', 'project', 'reference'];
+export const VALID_MEMORY_SCOPES = ['private', 'team'];
+export function isValidMemoryPurpose(value) {
+    return typeof value === 'string' && VALID_MEMORY_PURPOSES.includes(value);
+}
+export function isValidMemoryScope(value) {
+    return typeof value === 'string' && VALID_MEMORY_SCOPES.includes(value);
+}

package/dist/setup/openclaw.d.ts

@@ -5,6 +5,14 @@
  * the real-time plugin into the OpenClaw extensions directory.
  * Supports both Claude Code (native binary) and legacy OpenClaw (Node.js).
  */
+/**
+ * Detect whether ShieldCortex is running inside a Docker container
+ * or similar isolated environment (Umbrel, Unraid, NixOS sandbox, etc.).
+ *
+ * In these environments, OpenClaw hook/plugin installation may crash or
+ * produce broken state. We warn and skip by default.
+ */
+export declare function isDockerEnvironment(): boolean;
 /**
  * Find ALL valid hook directories for install/uninstall/status.
  *
@@ -12,7 +20,16 @@
  * Creates the hooks/ subdirectory if the parent config dir exists.
  */
 export declare function findAllHooksDirs(): string[];
-export declare function installOpenClawHook(): Promise<void>;
+/**
+ * Install options for `shieldcortex openclaw install`.
+ */
+export interface OpenClawInstallOptions {
+    /** Skip hook installation (--no-hooks flag) */
+    noHooks?: boolean;
+    /** Skip plugin installation (--no-plugins flag) */
+    noPlugins?: boolean;
+}
+export declare function installOpenClawHook(options?: OpenClawInstallOptions): Promise<void>;
 export declare function uninstallOpenClawHook(): Promise<void>;
 export declare function openClawHookStatus(): Promise<void>;
-export declare function handleOpenClawCommand(subcommand: string): Promise<void>;
+export declare function handleOpenClawCommand(subcommand: string, extraArgs?: string[]): Promise<void>;

package/dist/setup/openclaw.js

@@ -22,6 +22,35 @@ const PLUGIN_PACKAGE_SOURCE = path.resolve(__dirname, '..', '..', 'plugins', 'op
 const PLUGIN_DIR_NAME = 'shieldcortex-realtime';
 const HOOK_FILES = ['HOOK.md', 'handler.ts'];
 const OPENCLAW_SKIP_NATIVE_INSTALL_ENV = 'SHIELDCORTEX_SKIP_NATIVE_OPENCLAW_INSTALL';
+// ==================== Docker/Container Detection ====================
+/**
+ * Detect whether ShieldCortex is running inside a Docker container
+ * or similar isolated environment (Umbrel, Unraid, NixOS sandbox, etc.).
+ *
+ * In these environments, OpenClaw hook/plugin installation may crash or
+ * produce broken state. We warn and skip by default.
+ */
+export function isDockerEnvironment() {
+    // Standard Docker marker file
+    try {
+        if (fs.existsSync('/.dockerenv'))
+            return true;
+    }
+    catch { /* ignore */ }
+    // Explicit env overrides
+    if (process.env.DOCKER === 'true' || process.env.DOCKER === '1')
+        return true;
+    if (process.env.container === 'docker')
+        return true;
+    // /proc/1/cgroup contains "docker" or "kubepods" on containerised systems
+    try {
+        const cgroup = fs.readFileSync('/proc/1/cgroup', 'utf-8');
+        if (/docker|kubepods|containerd/i.test(cgroup))
+            return true;
+    }
+    catch { /* not Linux or not accessible */ }
+    return false;
+}
 /**
  * Resolve the real user's home directory.
  *
@@ -373,7 +402,27 @@ function isPluginInLoadPaths() {
         return false;
     }
 }
-function installPlugin() {
+/**
+ * Install the real-time plugin.
+ * In Docker environments, skip with a warning — plugin install can crash
+ * the gateway in containers where filesystem permissions differ.
+ *
+ * @param options.noPlugins  Skip plugin installation entirely (--no-plugins flag)
+ */
+function installPlugin(options = {}) {
+    if (options.noPlugins) {
+        console.log('  Skipping plugin install (--no-plugins flag).');
+        return 'skipped';
+    }
+    // Docker / container environments: warn and skip
+    if (isDockerEnvironment()) {
+        console.warn('  ⚠  Docker/container environment detected.');
+        console.warn('  Skipping real-time plugin install to avoid gateway crash.');
+        console.warn('  To install manually after confirming OpenClaw support:');
+        console.warn('    DOCKER=false shieldcortex openclaw install');
+        console.warn('  Or suppress this warning: shieldcortex openclaw install --no-plugins');
+        return 'skipped';
+    }
     const nativeInstall = tryNativeOpenClawPluginInstall();
     if (nativeInstall) {
         return nativeInstall;
@@ -481,7 +530,6 @@ function uninstallPlugin() {
     if (!extensionsDir)
         return false;
     const destDir = path.join(extensionsDir, PLUGIN_DIR_NAME);
-    const indexPath = path.join(destDir, 'index.js');
     if (!fs.existsSync(destDir))
         return false;
     try {
@@ -543,8 +591,7 @@ function localPluginTrustStatus(pluginPath) {
         return 'unknown';
     }
 }
-// ==================== Commands ====================
-export async function installOpenClawHook() {
+export async function installOpenClawHook(options = {}) {
     const hooksDirs = findAllHooksDirs();
     if (hooksDirs.length === 0) {
         const home = resolveUserHome();
@@ -570,52 +617,76 @@ export async function installOpenClawHook() {
     }
     // Clean up legacy plugin entry that caused config validation errors
     cleanupLegacyPlugin();
-    // Install to ALL detected hook directories
+    // Docker / container: warn about environment
+    if (isDockerEnvironment()) {
+        console.warn('⚠  Docker/container environment detected.');
+        console.warn('   Hook and plugin installation may behave differently in containers.');
+        console.warn('   Use --no-plugins to skip plugin install, or --no-hooks to skip hooks.');
+        console.warn('');
+    }
     let installed = 0;
     let migratedLegacy = 0;
-    for (const hooksDir of hooksDirs) {
-        const destDir = preferredHookDir(hooksDir);
-        try {
-            const legacyDirsBeforeInstall = detectLegacyHookVariants(hooksDir);
-            copyHookFiles(HOOK_SOURCE, destDir);
-            console.log(`Installed cortex-memory hook to ${destDir}`);
-            if (legacyDirsBeforeInstall.length > 0) {
-                console.log(`Detected legacy OpenClaw hook layout in ${hooksDir} — migrating to ${destDir}`);
+    if (!options.noHooks) {
+        // Install to ALL detected hook directories
+        for (const hooksDir of hooksDirs) {
+            const destDir = preferredHookDir(hooksDir);
+            try {
+                const legacyDirsBeforeInstall = detectLegacyHookVariants(hooksDir);
+                copyHookFiles(HOOK_SOURCE, destDir);
+                console.log(`Installed cortex-memory hook to ${destDir}`);
+                if (legacyDirsBeforeInstall.length > 0) {
+                    console.log(`Detected legacy OpenClaw hook layout in ${hooksDir} — migrating to ${destDir}`);
+                }
+                for (const removedDir of removeLegacyHookVariants(hooksDir)) {
+                    console.log(`Removed legacy cortex-memory hook from ${removedDir}`);
+                    migratedLegacy++;
+                }
+                installed++;
             }
-            for (const removedDir of removeLegacyHookVariants(hooksDir)) {
-                console.log(`Removed legacy cortex-memory hook from ${removedDir}`);
-                migratedLegacy++;
+            catch (err) {
+                const code = err.code;
+                if (code === 'EACCES' || code === 'EPERM') {
+                    console.warn(`  Skipped ${destDir} (permission denied)`);
+                }
+                else {
+                    // Never throw — warn gracefully
+                    console.warn(`  Warning: Could not install hook to ${destDir}: ${err.message}`);
+                }
             }
-            installed++;
         }
-        catch (err) {
-            const code = err.code;
-            if (code === 'EACCES' || code === 'EPERM') {
-                console.warn(`  Skipped ${destDir} (permission denied)`);
-            }
-            else {
-                throw err;
-            }
+        if (installed === 0) {
+            console.warn('Could not install hooks to any directory (permission denied or error).');
+            console.log('Try one of these:');
+            console.log('  sudo "$(command -v shieldcortex)" openclaw install');
+            console.log('  sudo chown -R "$USER":"$USER" ~/.openclaw ~/.claude');
+            console.log('  shieldcortex openclaw install --no-hooks  # skip hook install');
+            // Do not exit(1) — allow plugin install to continue
         }
     }
-    if (installed === 0) {
-        console.error('Could not install to any hook directory (permission denied).');
-        console.log('Try one of these:');
-        console.log('  sudo "$(command -v shieldcortex)" openclaw install');
-        console.log('  sudo chown -R "$USER":"$USER" ~/.openclaw ~/.claude');
-        console.log('  shieldcortex openclaw install');
-        process.exit(1);
+    else {
+        console.log('Skipping hook installation (--no-hooks flag).');
+        installed = hooksDirs.length; // pretend success so plugin install proceeds
     }
     // Install the real-time plugin to the extensions directory
-    const pluginInstallMode = installPlugin();
+    const pluginInstallMode = installPlugin({ noPlugins: options.noPlugins });
     console.log('');
     if (migratedLegacy > 0) {
         console.log(`Legacy OpenClaw hook cleanup completed (${migratedLegacy} old path${migratedLegacy === 1 ? '' : 's'} removed).`);
         console.log('');
     }
     console.log('What was installed:');
-    console.log('  • cortex-memory hook (memory injection + "remember this:" trigger)');
-    console.log('    Auto-save is optional: shieldcortex config --openclaw-auto-memory true');
+    if (!options.noHooks) {
+        if (installed > 0) {
+            console.log('  • cortex-memory hook (memory injection + "remember this:" trigger)');
+            console.log('    Auto-save is optional: shieldcortex config --openclaw-auto-memory true');
+        }
+        else {
+            console.log('  • cortex-memory hook: skipped (see warnings above)');
+        }
+    }
+    else {
+        console.log('  • cortex-memory hook: skipped (--no-hooks)');
+    }
     if (pluginInstallMode !== 'skipped') {
         console.log('  • shieldcortex-realtime plugin (real-time LLM input scanning + optional output extraction)');
         if (pluginInstallMode === 'native-package') {
@@ -631,6 +702,9 @@ export async function installOpenClawHook() {
             console.log('    Installed as a local fallback, but trust pinning failed.');
         }
     }
+    else {
+        console.log('  • shieldcortex-realtime plugin: skipped');
+    }
     console.log('');
     console.log('Native OpenClaw install is also supported:');
     console.log('  openclaw hooks install shieldcortex');
@@ -701,10 +775,12 @@ export async function openClawHookStatus() {
             : 'native or unknown trust source';
     console.log(`  Real-time plugin: installed (${plugin.path}) — ${trustSuffix}`);
 }
-export async function handleOpenClawCommand(subcommand) {
+export async function handleOpenClawCommand(subcommand, extraArgs = []) {
+    const noHooks = extraArgs.includes('--no-hooks');
+    const noPlugins = extraArgs.includes('--no-plugins');
     switch (subcommand) {
         case 'install':
-            await installOpenClawHook();
+            await installOpenClawHook({ noHooks, noPlugins });
             break;
         case 'uninstall':
             await uninstallOpenClawHook();
@@ -714,6 +790,10 @@ export async function handleOpenClawCommand(subcommand) {
             break;
         default:
             console.log('Usage: shieldcortex openclaw <install|uninstall|status>');
+            console.log('');
+            console.log('Install options:');
+            console.log('  --no-hooks     Skip hook installation (useful in Docker/CI)');
+            console.log('  --no-plugins   Skip plugin installation (useful in Docker/CI)');
             process.exit(1);
     }
 }

package/dist/tools/recall.js

@@ -8,6 +8,7 @@ import { searchMemories, recallWithEmbeddings, accessMemory, getRecentMemories,
 import { formatTimeSinceAccess } from '../memory/decay.js';
 import { MemoryNotFoundError, formatErrorForMcp } from '../errors.js';
 import { resolveProject } from '../context/project-context.js';
+import { memoryFreshnessWarning } from '../memory/staleness.js';
 const sourceSchema = z.object({
     type: z.enum(['user', 'cli', 'hook', 'email', 'web', 'agent', 'file', 'api', 'tool_response']),
     identifier: z.string(),
@@ -100,6 +101,14 @@ export async function executeRecall(input) {
         }
         // Access each memory to reinforce it
         memories = memories.map(m => accessMemory(m.id, undefined, source) || m);
+        // v4.0.0: Append staleness warnings to old memories
+        memories = memories.map(m => {
+            const warning = memoryFreshnessWarning(m.createdAt.getTime());
+            if (warning) {
+                return { ...m, content: m.content + '\n\n' + warning };
+            }
+            return m;
+        });
         return {
             success: true,
             memories,

package/dist/tools/remember.d.ts

@@ -15,6 +15,8 @@ export declare const rememberSchema: z.ZodObject<{
     importance: z.ZodOptional<z.ZodEnum<["low", "normal", "high", "critical"]>>;
     scope: z.ZodOptional<z.ZodEnum<["project", "global"]>>;
     transferable: z.ZodOptional<z.ZodBoolean>;
+    memoryPurpose: z.ZodOptional<z.ZodEnum<["user", "feedback", "project", "reference"]>>;
+    memoryScope: z.ZodOptional<z.ZodEnum<["private", "team"]>>;
     source: z.ZodOptional<z.ZodObject<{
         type: z.ZodEnum<["user", "cli", "hook", "email", "web", "agent", "file", "api", "tool_response"]>;
         identifier: z.ZodString;
@@ -46,6 +48,8 @@ export declare const rememberSchema: z.ZodObject<{
     sourceIdentifier?: string | undefined;
     sessionId?: string | undefined;
     sourceType?: "user" | "cli" | "hook" | "agent" | "api" | "email" | "web" | "file" | "tool_response" | undefined;
+    memoryPurpose?: "project" | "user" | "feedback" | "reference" | undefined;
+    memoryScope?: "private" | "team" | undefined;
     importance?: "critical" | "low" | "high" | "normal" | undefined;
     agentId?: string | undefined;
     workspaceDir?: string | undefined;
@@ -65,6 +69,8 @@ export declare const rememberSchema: z.ZodObject<{
     sourceIdentifier?: string | undefined;
     sessionId?: string | undefined;
     sourceType?: "user" | "cli" | "hook" | "agent" | "api" | "email" | "web" | "file" | "tool_response" | undefined;
+    memoryPurpose?: "project" | "user" | "feedback" | "reference" | undefined;
+    memoryScope?: "private" | "team" | undefined;
     importance?: "critical" | "low" | "high" | "normal" | undefined;
     agentId?: string | undefined;
     workspaceDir?: string | undefined;

package/dist/tools/remember.js

@@ -8,6 +8,7 @@ import { addMemory, searchMemories, detectRelationships, createMemoryLink, getLa
 import { analyzeSalienceFactors, explainSalience } from '../memory/salience.js';
 import { formatErrorForMcp } from '../errors.js';
 import { resolveProject } from '../context/project-context.js';
+import { shouldFilterMemory } from '../memory/save-filter.js';
 // Input schema for the remember tool
 export const rememberSchema = z.object({
     title: z.string().describe('Short title for the memory (what to remember)'),
@@ -26,6 +27,10 @@ export const rememberSchema = z.object({
         .describe('Memory scope: project (default) or global (cross-project)'),
     transferable: z.boolean().optional()
         .describe('Whether this memory can be transferred to other projects'),
+    memoryPurpose: z.enum(['user', 'feedback', 'project', 'reference']).optional()
+        .describe('Purpose of memory: user (preferences), feedback (corrections/confirmations), project (work context), reference (docs/specs)'),
+    memoryScope: z.enum(['private', 'team']).optional()
+        .describe('Scope: private (agent-specific) or team (shared across agents)'),
     source: z.object({
         type: z.enum(['user', 'cli', 'hook', 'email', 'web', 'agent', 'file', 'api', 'tool_response']),
         identifier: z.string(),
@@ -103,6 +108,14 @@ export async function executeRemember(input) {
             };
         }
         // Create the memory (use trimmed title and content)
+        // v4.0.0: Save filter — prevent storing derivable info
+        const filterResult = shouldFilterMemory(title, content);
+        if (!filterResult.allowed) {
+            return {
+                success: false,
+                error: `Memory filtered: ${filterResult.reason}${filterResult.warning ? ' — ' + filterResult.warning : ''}`,
+            };
+        }
         const memory = addMemory({
             title,
             content,
@@ -114,6 +127,8 @@ export async function executeRemember(input) {
             scope: input.scope,
             transferable: input.transferable,
             metadata: Object.keys(metadata).length > 0 ? metadata : undefined,
+            memoryPurpose: input.memoryPurpose,
+            memoryScope: input.memoryScope,
         }, undefined, derivedSource ?? { type: 'cli', identifier: 'mcp' });
         // Auto-detect and create relationships with existing memories
         let linksCreated = 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shieldcortex",
-  "version": "3.5.0",
+  "version": "4.0.1",
   "description": "Trustworthy memory and security for AI agents. Recall debugging, review queue, OpenClaw session capture, and memory poisoning defence for Claude Code, Codex, OpenClaw, LangChain, and MCP agents.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",