shieldcortex 4.38.0 → 4.39.0

package/dist/tools/context.js

@@ -6,7 +6,7 @@
  */
 import { z } from 'zod';
 import { generateContextSummary, formatContextSummary, startSession, endSession, getSuggestedContext, consolidate, previewConsolidation, exportMemories, importMemories, } from '../memory/consolidate.js';
-import { getMemoryStats } from '../memory/store.js';
+import { getMemoryStats, logAllowedRead } from '../memory/store.js';
 import { getSalienceDistribution } from '../memory/metrics.js';
 import { getDatabase } from '../database/init.js';
 import { resolveProject } from '../context/project-context.js';
@@ -61,6 +61,16 @@ export async function executeGetContext(input) {
                 }
                 break;
         }
+        // Provenance ledger: one allowed-read row per get_context call, covering
+        // every memory surfaced into the context.
+        const source = input.source;
+        if (source) {
+            const surfacedIds = [
+                ...summary.recentMemories, ...summary.keyDecisions,
+                ...summary.activePatterns, ...summary.pendingItems, ...relevantMemories,
+            ].map(m => m.id);
+            logAllowedRead(source, 'get_context', [...new Set(surfacedIds)], projectFilter);
+        }
         return {
             success: true,
             context,
@@ -270,6 +280,10 @@ export function executeExport(input) {
         // Read ACL: filter the bulk dump to rows this caller may read.
         const data = exportMemories(projectFilter, input.source);
         const memories = JSON.parse(data);
+        // Provenance ledger: a bulk export is the highest-value read to audit.
+        if (input.source) {
+            logAllowedRead(input.source, 'export_memories', memories.map(m => m.id), projectFilter);
+        }
         return {
             success: true,
             data,

package/dist/tools/recall.js

@@ -4,7 +4,7 @@
  * Search and retrieve memories using semantic search and filters.
  */
 import { z } from 'zod';
-import { searchMemories, recallWithEmbeddings, accessMemory, getRecentMemories, getHighPriorityMemories, getRelatedMemories } from '../memory/store.js';
+import { searchMemories, recallWithEmbeddings, accessMemory, getRecentMemories, getHighPriorityMemories, getRelatedMemories, logAllowedRead } from '../memory/store.js';
 import { formatTimeSinceAccess } from '../memory/decay.js';
 import { MemoryNotFoundError, formatErrorForMcp } from '../errors.js';
 import { resolveProject } from '../context/project-context.js';
@@ -115,6 +115,9 @@ export async function executeRecall(input) {
             }
             return m;
         });
+        // Provenance ledger: one allowed-read row per recall call (not per memory).
+        if (source)
+            logAllowedRead(source, `recall:${input.mode}`, memories.map(m => m.id), projectFilter);
         return {
             success: true,
             memories,
@@ -196,6 +199,8 @@ export function executeGetMemory(input) {
                 error: error.toUserMessage(),
             };
         }
+        if (input.source)
+            logAllowedRead(input.source, 'get_memory', [allowed.id], allowed.project ?? null);
         return { success: true, memory: allowed };
     }
     catch (error) {
@@ -215,6 +220,9 @@ export function executeGetRelated(input) {
     try {
         const related = getRelatedMemories(input.id);
         const allowedIds = new Set(guardReadMemories(related.map((r) => r.memory), input.source).map((m) => m.id));
+        if (input.source && allowedIds.size > 0) {
+            logAllowedRead(input.source, 'get_related', [...allowedIds]);
+        }
         return { success: true, related: related.filter((r) => allowedIds.has(r.memory.id)) };
     }
     catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shieldcortex",
-  "version": "4.38.0",
+  "version": "4.39.0",
   "description": "Trustworthy memory and security for AI agents. Recall debugging, review queue, OpenClaw session capture, and memory poisoning defence for Claude Code, Codex, OpenClaw, LangChain, and MCP agents.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",