threadnote 1.6.0 → 1.6.2

package/dist/mcp_server.cjs

@@ -35501,6 +35501,82 @@ function shouldUseColor() {
   return import_node_process2.stdout.isTTY === true && process.env.NO_COLOR === void 0 && process.env.CI === void 0 && process.env.TERM !== "dumb";
 }
 
+// src/scrubber.ts
+var SCRUBBER_PATTERNS = [
+  { name: "private key", regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
+  { name: "API key (sk-...)", regex: /\bsk-[A-Za-z0-9_-]{16,}/ },
+  { name: "GitHub token", regex: /\bgh[pousr]_[A-Za-z0-9_]{16,}/ },
+  { name: "GitHub fine-grained PAT", regex: /\bgithub_pat_[A-Za-z0-9_]{20,}/ },
+  { name: "GitLab PAT", regex: /\bglpat-[A-Za-z0-9_-]{20,}/ },
+  { name: "bearer token", regex: /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/i },
+  { name: "basic auth header", regex: /\bBasic\s+[A-Za-z0-9+/]{16,}={0,2}\b/i },
+  { name: "JWT", regex: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/ },
+  { name: "AWS access key", regex: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/ },
+  { name: "AWS secret access key", regex: /\baws_secret_access_key\s*[:=]\s*["']?[A-Za-z0-9/+=]{35,}["']?/i },
+  { name: "AWS session token", regex: /\baws_session_token\s*[:=]\s*["']?[A-Za-z0-9/+=]{40,}["']?/i },
+  { name: "Google API key", regex: /\bAIza[0-9A-Za-z_-]{35}\b/ },
+  { name: "Google OAuth token", regex: /\bya29\.[0-9A-Za-z_-]{20,}/ },
+  { name: "Stripe key", regex: /\b(?:sk|rk)_(?:live|test)_[0-9A-Za-z]{16,}\b/ },
+  { name: "Stripe webhook secret", regex: /\bwhsec_[0-9A-Za-z]{16,}\b/ },
+  {
+    name: "Discord token",
+    regex: /\b(?:mfa\.[A-Za-z0-9_-]{20,}|[MN][A-Za-z0-9_-]{23}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,})\b/
+  },
+  {
+    name: "Discord webhook",
+    regex: /https:\/\/(?:canary\.|ptb\.)?discord(?:app)?\.com\/api\/webhooks\/\d+\/[A-Za-z0-9_-]+/i
+  },
+  { name: "Slack token", regex: /\bx(?:app|ox[abcdeprs])(?:-\d-)?[A-Za-z0-9._-]{10,}/i },
+  { name: "Slack webhook", regex: /https:\/\/hooks\.slack\.com\/services\/[A-Z0-9]+\/[A-Z0-9]+\/[A-Za-z0-9]+/i },
+  {
+    name: "database URI",
+    regex: /\b(?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/@]+:[^@\s]+@[^\s)>"'`,]+/i
+  },
+  { name: "URL basic auth", regex: /\bhttps?:\/\/[^:\s/@]+:[^@\s]+@[^\s)>"'`,]+/i },
+  { name: "macOS home path", placeholder: "<local-path>", regex: /\/Users\/[^\s)>"'`,]+/ },
+  { name: "linux home path", placeholder: "<local-path>", regex: /\/home\/[^\s)>"'`,]+/ }
+];
+function applyScrubber(content, { redact }) {
+  let cleaned = content;
+  const redactions = [];
+  for (const pattern of SCRUBBER_PATTERNS) {
+    if (!pattern.regex.test(cleaned)) {
+      continue;
+    }
+    if (!pattern.placeholder || !redact) {
+      return { blocker: pattern.name, cleaned: content, redactions: [] };
+    }
+    const globalRegex = globalize(pattern.regex);
+    const matches = cleaned.match(globalRegex) ?? [];
+    cleaned = cleaned.replace(globalRegex, pattern.placeholder);
+    redactions.push({ count: matches.length, name: pattern.name });
+  }
+  return { cleaned, redactions };
+}
+function credentialScrubberBlocker(content) {
+  for (const pattern of SCRUBBER_PATTERNS) {
+    if (pattern.placeholder === void 0 && pattern.regex.test(content)) {
+      return pattern.name;
+    }
+  }
+  return void 0;
+}
+function redactSensitiveText(content) {
+  let redacted = content.replace(
+    /([A-Za-z0-9_.-]*(?:token|secret|password|api[_-]?key|authorization|credential|session)[A-Za-z0-9_.-]*\s*[:=]\s*)("[^"]+"|'[^']+'|Bearer\s+[^'"\s]+|\S+)/gi,
+    "$1[REDACTED]"
+  );
+  for (const pattern of SCRUBBER_PATTERNS) {
+    const placeholder = pattern.placeholder ?? "<secret>";
+    redacted = redacted.replace(globalize(pattern.regex), placeholder);
+  }
+  return redacted;
+}
+function globalize(regex) {
+  const flags = regex.flags.includes("g") ? regex.flags : `${regex.flags}g`;
+  return new RegExp(regex.source, flags);
+}
+
 // src/utils.ts
 function isJsonObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -35514,10 +35590,7 @@ function parseJsonConfigObject(content) {
   }
 }
 function redactText(content) {
-  return content.replace(
-    /([A-Za-z0-9_.-]*(?:token|secret|password|api[_-]?key|authorization)[A-Za-z0-9_.-]*\s*[:=]\s*)("[^"]+"|'[^']+'|Bearer\s+[^'"\s]+|\S+)/gi,
-    "$1[REDACTED]"
-  ).replace(/Bearer\s+[A-Za-z0-9._~+/=-]+/gi, "Bearer [REDACTED]").replace(/sk-[A-Za-z0-9_-]{16,}/g, "sk-[REDACTED]").replace(/gh[pousr]_[A-Za-z0-9_]{16,}/g, "gh_[REDACTED]");
+  return redactSensitiveText(content);
 }
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -36778,53 +36851,6 @@ var PACK_FILES_DIR = "files";
 var PACK_ROOT_TOKEN = "${THREADNOTE_PACK_ROOT}";
 var AUTO_SHARE_FETCH_INTERVAL_MS = 5 * 60 * 1e3;
 var DEFAULT_GIT_REMOTE_NAME = "origin";
-var SCRUBBER_PATTERNS = [
-  // Credentials: never redactable. Blocking is the only safe response —
-  // automated redaction risks false negatives that leave material in git.
-  { name: "private key", regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
-  { name: "API key (sk-...)", regex: /\bsk-[A-Za-z0-9_-]{16,}/ },
-  { name: "GitHub token", regex: /\bgh[pousr]_[A-Za-z0-9_]{16,}/ },
-  { name: "GitHub fine-grained PAT", regex: /\bgithub_pat_[A-Za-z0-9_]{20,}/ },
-  { name: "GitLab PAT", regex: /\bglpat-[A-Za-z0-9_-]{20,}/ },
-  { name: "bearer token", regex: /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/i },
-  // Matches bare JWTs (three base64url segments). May surface a JWE token in
-  // legitimate docs; if that becomes noisy we can switch to warn-only.
-  { name: "JWT", regex: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/ },
-  { name: "AWS access key", regex: /\bAKIA[0-9A-Z]{16}\b/ },
-  // Slack tokens: xoxa/xoxb/xoxc (configuration)/xoxd (legacy user cookie)/
-  // xoxe (refresh)/xoxp/xoxr/xoxs, with optional -N- segment for the workspace tier.
-  { name: "Slack token", regex: /\bxox[abcdeprs](?:-\d-)?[A-Za-z0-9._-]{10,}/i },
-  // Soft leaks: block by default (so the agent sees them and decides), but
-  // allow opt-in redaction so curated memories with incidental matches can
-  // ship without a manual rewrite. Local home paths are the recurring
-  // real-world leak; the regexes greedily consume the whole path segment
-  // (including subdirectories) up to whitespace or common closing punctuation
-  // so redaction collapses an entire path to a single placeholder rather than
-  // leaving the subpath visible.
-  { name: "macOS home path", placeholder: "<local-path>", regex: /\/Users\/[^\s)>"'`,]+/ },
-  // No leading \b: it only matches when a word char precedes the slash, which
-  // misses the common cases (after =, :, whitespace, or line start). Mirror the
-  // macOS pattern so /home/... is caught in every position.
-  { name: "linux home path", placeholder: "<local-path>", regex: /\/home\/[^\s)>"'`,]+/ }
-];
-function applyScrubber(content, { redact }) {
-  let cleaned = content;
-  const redactions = [];
-  for (const pattern of SCRUBBER_PATTERNS) {
-    if (!pattern.regex.test(cleaned)) {
-      continue;
-    }
-    if (!pattern.placeholder || !redact) {
-      return { blocker: pattern.name, cleaned: content, redactions: [] };
-    }
-    const flags = pattern.regex.flags.includes("g") ? pattern.regex.flags : `${pattern.regex.flags}g`;
-    const globalRegex = new RegExp(pattern.regex.source, flags);
-    const matches = cleaned.match(globalRegex) ?? [];
-    cleaned = cleaned.replace(globalRegex, pattern.placeholder);
-    redactions.push({ count: matches.length, name: pattern.name });
-  }
-  return { cleaned, redactions };
-}
 var autoShareStates = /* @__PURE__ */ new Map();
 function startShareBackgroundFetch(config2) {
   const state = autoShareState(config2);
@@ -37053,7 +37079,7 @@ async function publishShareGitChange(worktree, relativePath, commitMessage, opti
   const git = await requiredExecutable("git");
   const messages = [];
   const paths = typeof relativePath === "string" ? [relativePath] : [...relativePath];
-  const stageArgs = verb === "rm" ? ["-C", worktree, "rm", ...paths] : ["-C", worktree, "add", "--", ...paths];
+  const stageArgs = verb === "rm" ? ["-C", worktree, "rm", "--", ...paths] : ["-C", worktree, "add", "--", ...paths];
   const stageResult = await runGitCommand(dryRun, git, stageArgs, `git ${verb} failed`);
   if (stageResult) {
     messages.push(`git ${verb}: ${stageResult.stdout.trim() || "ok"}`);
@@ -37396,13 +37422,7 @@ function isProbablyBinary(buffer) {
   }
 }
 function detectBinaryCredential(buffer) {
-  const latin1 = buffer.toString("latin1");
-  for (const pattern of SCRUBBER_PATTERNS) {
-    if (pattern.placeholder === void 0 && pattern.regex.test(latin1)) {
-      return pattern.name;
-    }
-  }
-  return void 0;
+  return credentialScrubberBlocker(buffer.toString("latin1"));
 }
 function detectBinaryLocalPath(buffer, rewriteRoots) {
   const latin1 = buffer.toString("latin1");
@@ -38653,6 +38673,18 @@ function stripPersonalProvenance(content) {
   }
   return cleaned.join("\n");
 }
+async function readMemoryContent(config2, ov, uri, dryRun) {
+  const args = withIdentity(config2, ["read", uri]);
+  if (dryRun) {
+    console.log(`Would run: ${formatShellCommand(ov, args)}`);
+    return "<dry-run memory body>";
+  }
+  const result = await runCommand(ov, args);
+  if (!result.stdout.trim()) {
+    throw new Error(`Refusing to publish empty memory at ${uri}`);
+  }
+  return result.stdout;
+}
 async function ensureSharedDirectoryChain(config2, ov, memoryUri, dryRun, options = {}) {
   const directoryUri = parentUri(memoryUri);
   for (const uri of sharedDirectoryChain(config2, directoryUri)) {
@@ -38810,9 +38842,19 @@ function isResourceBusyFailure(stderr, stdout2) {
 ${stdout2}`.toLowerCase();
   return output.includes("resource is busy") || output.includes("resource is being processed");
 }
-async function ingestSingleFile(ov, config2, uri, filePath, initialMode, options = {}) {
-  const content = await (0, import_promises4.readFile)(filePath, "utf8");
-  await writeMemoryFile(config2, ov, uri, content, initialMode, false, options);
+async function readSharedInboundFileContent(uri, filePath) {
+  if (!await isRegularFileNoSymlink(filePath)) {
+    throw new Error(`Refusing to ingest non-regular shared file: ${filePath}`);
+  }
+  return prepareSharedInboundContent(uri, await (0, import_promises4.readFile)(filePath, "utf8"));
+}
+function prepareSharedInboundContent(uri, rawContent) {
+  const stripped = stripPersonalProvenance(rawContent);
+  const scrub = applyScrubber(stripped, { redact: false });
+  if (scrub.blocker) {
+    throw new Error(`Refusing to ingest ${uri}: possible ${scrub.blocker}. Strip the sensitive value upstream first.`);
+  }
+  return scrub.cleaned;
 }
 async function removeMemoryUri(config2, ov, uri, dryRun, options = {}) {
   const args = withIdentity(config2, ["rm", uri]);
@@ -38860,8 +38902,10 @@ async function gitOutput(worktree, args, dryRun) {
   }
   return result.stdout.trim();
 }
+var GIT_MODE_ABSENT = "000000";
+var GIT_MODE_SYMLINK = "120000";
 async function listChangedFiles(worktree, beforeRev, afterRev) {
-  const result = await runCommand("git", ["-C", worktree, "diff", "--name-status", "-z", `${beforeRev}..${afterRev}`], {
+  const result = await runCommand("git", ["-C", worktree, "diff", "--raw", "-z", `${beforeRev}..${afterRev}`], {
     allowFailure: true
   });
   if (result.exitCode !== 0) {
@@ -38870,27 +38914,65 @@ async function listChangedFiles(worktree, beforeRev, afterRev) {
   const entries = result.stdout.split("\0").filter((part) => part.length > 0);
   const changes = [];
   for (let index = 0; index < entries.length; ) {
-    const raw = entries[index];
-    const head = raw.slice(0, 1);
+    const raw = entries[index++];
+    const match = raw.match(/^:(\d{6}) (\d{6}) [0-9a-f]+ [0-9a-f]+ ([A-Z])\d*/);
+    if (!match) {
+      continue;
+    }
+    const [, oldMode, newMode, head] = match;
     if (head === "R" || head === "C") {
-      const oldRel = entries[index + 1];
-      const newRel = entries[index + 2];
-      if (oldRel && newRel) {
-        changes.push({ path: (0, import_node_path3.join)(worktree, oldRel), relativePath: oldRel, status: "removed" });
+      const oldRel = entries[index];
+      const newRel = entries[index + 1];
+      if (oldRel) {
+        changes.push({
+          path: (0, import_node_path3.join)(worktree, oldRel),
+          previousContent: oldMode === GIT_MODE_SYMLINK ? void 0 : await gitFileContent(worktree, beforeRev, oldRel),
+          relativePath: oldRel,
+          status: "removed"
+        });
+      }
+      if (newRel && newMode !== GIT_MODE_SYMLINK) {
         changes.push({ path: (0, import_node_path3.join)(worktree, newRel), relativePath: newRel, status: "added" });
       }
-      index += 3;
+      index += 2;
       continue;
     }
-    const rel = entries[index + 1];
+    const rel = entries[index];
     if (rel) {
-      const status = head === "A" ? "added" : head === "D" ? "removed" : "modified";
-      changes.push({ path: (0, import_node_path3.join)(worktree, rel), relativePath: rel, status });
+      if (head === "D") {
+        changes.push({
+          path: (0, import_node_path3.join)(worktree, rel),
+          previousContent: oldMode === GIT_MODE_SYMLINK ? void 0 : await gitFileContent(worktree, beforeRev, rel),
+          relativePath: rel,
+          status: "removed"
+        });
+      } else if (newMode === GIT_MODE_SYMLINK) {
+        if (oldMode !== GIT_MODE_ABSENT) {
+          changes.push({
+            path: (0, import_node_path3.join)(worktree, rel),
+            previousContent: oldMode === GIT_MODE_SYMLINK ? void 0 : await gitFileContent(worktree, beforeRev, rel),
+            relativePath: rel,
+            status: "removed"
+          });
+        }
+      } else {
+        const status = head === "A" ? "added" : "modified";
+        changes.push({
+          path: (0, import_node_path3.join)(worktree, rel),
+          previousContent: oldMode === GIT_MODE_ABSENT || oldMode === GIT_MODE_SYMLINK ? void 0 : await gitFileContent(worktree, beforeRev, rel),
+          relativePath: rel,
+          status
+        });
+      }
     }
-    index += 2;
+    index += 1;
   }
   return changes;
 }
+async function gitFileContent(worktree, rev, relativePath) {
+  const result = await runCommand("git", ["-C", worktree, "show", `${rev}:${relativePath}`], { allowFailure: true });
+  return result.exitCode === 0 ? result.stdout : void 0;
+}
 async function applyChangesToOpenViking(config2, team, changes, options = {}) {
   const ov = await openVikingCliForMode(false);
   const failed = [];
@@ -38905,22 +38987,37 @@ async function applyChangesToOpenViking(config2, team, changes, options = {}) {
     const uri = workfileToVikingUri(config2, team, change.path);
     try {
       if (change.status === "removed") {
+        const currentContent2 = await readExistingMemoryContent(config2, ov, uri);
+        if (currentContent2 === void 0) {
+          continue;
+        }
+        assertInboundPreviousContentMatches(change, uri, currentContent2);
         await removeMemoryUri(config2, ov, uri, false, options);
         continue;
       }
-      if (!await isFile(change.path)) {
+      if (!await isRegularFileNoSymlink(change.path)) {
         continue;
       }
-      const ovHasResource = await vikingResourceExists(ov, config2, uri);
-      if (ovHasResource) {
-        const reason = change.status === "modified" ? "overwriting local with upstream (local edits to the shared subtree are not preserved across sync)" : "aligning OV to upstream (resource pre-existed in OV, likely from an earlier local publish or sync)";
+      const content = await readSharedInboundFileContent(uri, change.path);
+      const currentContent = await readExistingMemoryContent(config2, ov, uri);
+      if (currentContent !== void 0) {
+        if (change.status === "added") {
+          if (currentContent === content) {
+            continue;
+          }
+          throw new Error(
+            `Refusing to ingest newly added shared file over existing local OpenViking resource ${uri}; inspect and resolve the local edit first.`
+          );
+        }
+        assertInboundPreviousContentMatches(change, uri, currentContent);
+        const reason = change.status === "modified" ? "updating from upstream after verifying local content matches the previous shared version" : "aligning OV to upstream (resource pre-existed in OV, likely from an earlier local publish or sync)";
         if (options.quiet !== true) {
           console.warn(`share sync: ${uri}: ${reason}.`);
         }
       }
       await ensureSharedDirectoryChain(config2, ov, uri, false, options);
-      const writeMode = ovHasResource ? "replace" : "create";
-      await ingestSingleFile(ov, config2, uri, change.path, writeMode, options);
+      const writeMode = currentContent !== void 0 ? "replace" : "create";
+      await writeMemoryFile(config2, ov, uri, content, writeMode, false, options);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       if (options.quiet !== true) {
@@ -38931,6 +39028,25 @@ async function applyChangesToOpenViking(config2, team, changes, options = {}) {
   }
   return { failed };
 }
+async function readExistingMemoryContent(config2, ov, uri) {
+  if (!await vikingResourceExists(ov, config2, uri)) {
+    return void 0;
+  }
+  return readMemoryContent(config2, ov, uri, false);
+}
+function assertInboundPreviousContentMatches(change, uri, currentContent) {
+  if (change.previousContent === void 0) {
+    throw new Error(
+      `Refusing to apply inbound shared change for ${uri}: previous shared content is unavailable, so local edits cannot be distinguished from upstream edits.`
+    );
+  }
+  const expectedContent = prepareSharedInboundContent(uri, change.previousContent);
+  if (currentContent !== expectedContent) {
+    throw new Error(
+      `Refusing to apply inbound shared change for ${uri}: local OpenViking content differs from the previous shared version. Inspect and resolve the local edit first.`
+    );
+  }
+}
 function mergeChanges(...lists) {
   const map2 = /* @__PURE__ */ new Map();
   for (const list of lists) {
@@ -39659,6 +39775,10 @@ function registerTools(server, config2) {
       if (!checkedPattern.ok) {
         return checkedPattern.error;
       }
+      const checkedLiteralPattern = rejectLeadingDash(checkedPattern.value, "grep", "pattern");
+      if (!checkedLiteralPattern.ok) {
+        return checkedLiteralPattern.error;
+      }
       const checkedUri = optionalVikingUri(uri, "grep");
       if (!checkedUri.ok) {
         return checkedUri.error;
@@ -39666,7 +39786,7 @@ function registerTools(server, config2) {
       return runOpenVikingMcpTool(config2, "grep", {
         case_insensitive: caseInsensitive ?? case_insensitive,
         node_limit: nodeLimit ?? node_limit,
-        pattern: checkedPattern.value,
+        pattern: checkedLiteralPattern.value,
         uri: checkedUri.value ?? `viking://user/${uriSegment2(config2.user)}/memories`
       });
     }
@@ -39688,13 +39808,17 @@ function registerTools(server, config2) {
       if (!checkedPattern.ok) {
         return checkedPattern.error;
       }
+      const checkedLiteralPattern = rejectLeadingDash(checkedPattern.value, "glob", "pattern");
+      if (!checkedLiteralPattern.ok) {
+        return checkedLiteralPattern.error;
+      }
       const checkedUri = optionalVikingUri(uri, "glob");
       if (!checkedUri.ok) {
         return checkedUri.error;
       }
       return runOpenVikingMcpTool(config2, "glob", {
         node_limit: nodeLimit ?? node_limit,
-        pattern: checkedPattern.value,
+        pattern: checkedLiteralPattern.value,
         uri: checkedUri.value
       });
     }
@@ -40007,6 +40131,10 @@ function registerOpenVikingParityTools(server, config2) {
       if (!checkedPattern.ok) {
         return checkedPattern.error;
       }
+      const checkedLiteralPattern = rejectLeadingDash(checkedPattern.value, "ov_grep", "pattern");
+      if (!checkedLiteralPattern.ok) {
+        return checkedLiteralPattern.error;
+      }
       const checkedUri = optionalVikingUri(uri, "ov_grep");
       if (!checkedUri.ok) {
         return checkedUri.error;
@@ -40014,7 +40142,7 @@ function registerOpenVikingParityTools(server, config2) {
       return runOpenVikingMcpTool(config2, "grep", {
         case_insensitive: caseInsensitive ?? case_insensitive,
         node_limit: nodeLimit ?? node_limit,
-        pattern: checkedPattern.value,
+        pattern: checkedLiteralPattern.value,
         uri: checkedUri.value
       });
     }
@@ -40036,13 +40164,17 @@ function registerOpenVikingParityTools(server, config2) {
       if (!checkedPattern.ok) {
         return checkedPattern.error;
       }
+      const checkedLiteralPattern = rejectLeadingDash(checkedPattern.value, "ov_glob", "pattern");
+      if (!checkedLiteralPattern.ok) {
+        return checkedLiteralPattern.error;
+      }
       const checkedUri = optionalVikingUri(uri, "ov_glob");
       if (!checkedUri.ok) {
         return checkedUri.error;
       }
       return runOpenVikingMcpTool(config2, "glob", {
         node_limit: nodeLimit ?? node_limit,
-        pattern: checkedPattern.value,
+        pattern: checkedLiteralPattern.value,
         uri: checkedUri.value
       });
     }
@@ -40994,6 +41126,17 @@ function requiredText(value, toolName, fieldName, example) {
     ok: false
   };
 }
+function rejectLeadingDash(value, toolName, fieldName) {
+  if (!value.startsWith("-")) {
+    return { ok: true, value };
+  }
+  return {
+    error: argumentError(
+      `Threadnote MCP tool "${toolName}" rejects "${fieldName}" values that start with "-". Prefix relative file paths with "./" or use an absolute path.`
+    ),
+    ok: false
+  };
+}
 function requiredVikingUri(value, toolName, exampleUri) {
   const checked = requiredText(value, toolName, "uri", { uri: exampleUri });
   if (!checked.ok) {
@@ -41078,6 +41221,12 @@ async function runOpenVikingAddResourceTool(config2, toolName, params) {
       ].join("\n")
     );
   }
+  if (source) {
+    const checkedSource = rejectLeadingDash(source, toolName, "path");
+    if (!checkedSource.ok) {
+      return checkedSource.error;
+    }
+  }
   if (tempFileId) {
     const checkedTo2 = optionalVikingUri(params.to, toolName);
     if (!checkedTo2.ok) {

package/dist/threadnote.cjs

@@ -3394,7 +3394,7 @@ var program = new Command();
 // src/constants.ts
 var DEFAULT_HOST = "127.0.0.1";
 var DEFAULT_PORT = 1933;
-var DEFAULT_OPENVIKING_VERSION = "0.4.5";
+var DEFAULT_OPENVIKING_VERSION = "0.4.7";
 var OPENVIKING_TOOL_PYTHON = "3.12";
 var DEFAULT_ACCOUNT = "local";
 var DEFAULT_AGENT_ID = "threadnote";
@@ -3576,6 +3576,91 @@ function startProgress(message) {
   };
 }
 
+// src/scrubber.ts
+var SCRUBBER_PATTERNS = [
+  { name: "private key", regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
+  { name: "API key (sk-...)", regex: /\bsk-[A-Za-z0-9_-]{16,}/ },
+  { name: "GitHub token", regex: /\bgh[pousr]_[A-Za-z0-9_]{16,}/ },
+  { name: "GitHub fine-grained PAT", regex: /\bgithub_pat_[A-Za-z0-9_]{20,}/ },
+  { name: "GitLab PAT", regex: /\bglpat-[A-Za-z0-9_-]{20,}/ },
+  { name: "bearer token", regex: /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/i },
+  { name: "basic auth header", regex: /\bBasic\s+[A-Za-z0-9+/]{16,}={0,2}\b/i },
+  { name: "JWT", regex: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/ },
+  { name: "AWS access key", regex: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/ },
+  { name: "AWS secret access key", regex: /\baws_secret_access_key\s*[:=]\s*["']?[A-Za-z0-9/+=]{35,}["']?/i },
+  { name: "AWS session token", regex: /\baws_session_token\s*[:=]\s*["']?[A-Za-z0-9/+=]{40,}["']?/i },
+  { name: "Google API key", regex: /\bAIza[0-9A-Za-z_-]{35}\b/ },
+  { name: "Google OAuth token", regex: /\bya29\.[0-9A-Za-z_-]{20,}/ },
+  { name: "Stripe key", regex: /\b(?:sk|rk)_(?:live|test)_[0-9A-Za-z]{16,}\b/ },
+  { name: "Stripe webhook secret", regex: /\bwhsec_[0-9A-Za-z]{16,}\b/ },
+  {
+    name: "Discord token",
+    regex: /\b(?:mfa\.[A-Za-z0-9_-]{20,}|[MN][A-Za-z0-9_-]{23}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,})\b/
+  },
+  {
+    name: "Discord webhook",
+    regex: /https:\/\/(?:canary\.|ptb\.)?discord(?:app)?\.com\/api\/webhooks\/\d+\/[A-Za-z0-9_-]+/i
+  },
+  { name: "Slack token", regex: /\bx(?:app|ox[abcdeprs])(?:-\d-)?[A-Za-z0-9._-]{10,}/i },
+  { name: "Slack webhook", regex: /https:\/\/hooks\.slack\.com\/services\/[A-Z0-9]+\/[A-Z0-9]+\/[A-Za-z0-9]+/i },
+  {
+    name: "database URI",
+    regex: /\b(?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/@]+:[^@\s]+@[^\s)>"'`,]+/i
+  },
+  { name: "URL basic auth", regex: /\bhttps?:\/\/[^:\s/@]+:[^@\s]+@[^\s)>"'`,]+/i },
+  { name: "macOS home path", placeholder: "<local-path>", regex: /\/Users\/[^\s)>"'`,]+/ },
+  { name: "linux home path", placeholder: "<local-path>", regex: /\/home\/[^\s)>"'`,]+/ }
+];
+function applyScrubber(content, { redact }) {
+  let cleaned = content;
+  const redactions = [];
+  for (const pattern of SCRUBBER_PATTERNS) {
+    if (!pattern.regex.test(cleaned)) {
+      continue;
+    }
+    if (!pattern.placeholder || !redact) {
+      return { blocker: pattern.name, cleaned: content, redactions: [] };
+    }
+    const globalRegex = globalize(pattern.regex);
+    const matches = cleaned.match(globalRegex) ?? [];
+    cleaned = cleaned.replace(globalRegex, pattern.placeholder);
+    redactions.push({ count: matches.length, name: pattern.name });
+  }
+  return { cleaned, redactions };
+}
+function detectSecretMatches(content) {
+  const matches = [];
+  for (const pattern of SCRUBBER_PATTERNS) {
+    if (pattern.regex.test(content)) {
+      matches.push(pattern.name);
+    }
+  }
+  return matches;
+}
+function credentialScrubberBlocker(content) {
+  for (const pattern of SCRUBBER_PATTERNS) {
+    if (pattern.placeholder === void 0 && pattern.regex.test(content)) {
+      return pattern.name;
+    }
+  }
+  return void 0;
+}
+function redactSensitiveText(content) {
+  let redacted = content.replace(
+    /([A-Za-z0-9_.-]*(?:token|secret|password|api[_-]?key|authorization|credential|session)[A-Za-z0-9_.-]*\s*[:=]\s*)("[^"]+"|'[^']+'|Bearer\s+[^'"\s]+|\S+)/gi,
+    "$1[REDACTED]"
+  );
+  for (const pattern of SCRUBBER_PATTERNS) {
+    const placeholder = pattern.placeholder ?? "<secret>";
+    redacted = redacted.replace(globalize(pattern.regex), placeholder);
+  }
+  return redacted;
+}
+function globalize(regex) {
+  const flags = regex.flags.includes("g") ? regex.flags : `${regex.flags}g`;
+  return new RegExp(regex.source, flags);
+}
+
 // src/utils.ts
 function isJsonObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -3589,10 +3674,7 @@ function parseJsonConfigObject(content) {
   }
 }
 function redactText(content) {
-  return content.replace(
-    /([A-Za-z0-9_.-]*(?:token|secret|password|api[_-]?key|authorization)[A-Za-z0-9_.-]*\s*[:=]\s*)("[^"]+"|'[^']+'|Bearer\s+[^'"\s]+|\S+)/gi,
-    "$1[REDACTED]"
-  ).replace(/Bearer\s+[A-Za-z0-9._~+/=-]+/gi, "Bearer [REDACTED]").replace(/sk-[A-Za-z0-9_-]{16,}/g, "sk-[REDACTED]").replace(/gh[pousr]_[A-Za-z0-9_]{16,}/g, "gh_[REDACTED]");
+  return redactSensitiveText(content);
 }
 async function walkFiles(root) {
   const files = [];
@@ -8469,53 +8551,6 @@ var PACK_FILES_DIR = "files";
 var PACK_ROOT_TOKEN = "${THREADNOTE_PACK_ROOT}";
 var AUTO_SHARE_FETCH_INTERVAL_MS = 5 * 60 * 1e3;
 var DEFAULT_GIT_REMOTE_NAME = "origin";
-var SCRUBBER_PATTERNS = [
-  // Credentials: never redactable. Blocking is the only safe response —
-  // automated redaction risks false negatives that leave material in git.
-  { name: "private key", regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
-  { name: "API key (sk-...)", regex: /\bsk-[A-Za-z0-9_-]{16,}/ },
-  { name: "GitHub token", regex: /\bgh[pousr]_[A-Za-z0-9_]{16,}/ },
-  { name: "GitHub fine-grained PAT", regex: /\bgithub_pat_[A-Za-z0-9_]{20,}/ },
-  { name: "GitLab PAT", regex: /\bglpat-[A-Za-z0-9_-]{20,}/ },
-  { name: "bearer token", regex: /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/i },
-  // Matches bare JWTs (three base64url segments). May surface a JWE token in
-  // legitimate docs; if that becomes noisy we can switch to warn-only.
-  { name: "JWT", regex: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/ },
-  { name: "AWS access key", regex: /\bAKIA[0-9A-Z]{16}\b/ },
-  // Slack tokens: xoxa/xoxb/xoxc (configuration)/xoxd (legacy user cookie)/
-  // xoxe (refresh)/xoxp/xoxr/xoxs, with optional -N- segment for the workspace tier.
-  { name: "Slack token", regex: /\bxox[abcdeprs](?:-\d-)?[A-Za-z0-9._-]{10,}/i },
-  // Soft leaks: block by default (so the agent sees them and decides), but
-  // allow opt-in redaction so curated memories with incidental matches can
-  // ship without a manual rewrite. Local home paths are the recurring
-  // real-world leak; the regexes greedily consume the whole path segment
-  // (including subdirectories) up to whitespace or common closing punctuation
-  // so redaction collapses an entire path to a single placeholder rather than
-  // leaving the subpath visible.
-  { name: "macOS home path", placeholder: "<local-path>", regex: /\/Users\/[^\s)>"'`,]+/ },
-  // No leading \b: it only matches when a word char precedes the slash, which
-  // misses the common cases (after =, :, whitespace, or line start). Mirror the
-  // macOS pattern so /home/... is caught in every position.
-  { name: "linux home path", placeholder: "<local-path>", regex: /\/home\/[^\s)>"'`,]+/ }
-];
-function applyScrubber(content, { redact }) {
-  let cleaned = content;
-  const redactions = [];
-  for (const pattern of SCRUBBER_PATTERNS) {
-    if (!pattern.regex.test(cleaned)) {
-      continue;
-    }
-    if (!pattern.placeholder || !redact) {
-      return { blocker: pattern.name, cleaned: content, redactions: [] };
-    }
-    const flags = pattern.regex.flags.includes("g") ? pattern.regex.flags : `${pattern.regex.flags}g`;
-    const globalRegex = new RegExp(pattern.regex.source, flags);
-    const matches = cleaned.match(globalRegex) ?? [];
-    cleaned = cleaned.replace(globalRegex, pattern.placeholder);
-    redactions.push({ count: matches.length, name: pattern.name });
-  }
-  return { cleaned, redactions };
-}
 var autoShareStates = /* @__PURE__ */ new Map();
 async function runShareInit(config, remoteUrl, options) {
   if (!remoteUrl.trim()) {
@@ -8538,7 +8573,15 @@ async function runShareInit(config, remoteUrl, options) {
   await ensureDirectory((0, import_node_path7.dirname)(worktree), dryRun);
   await ensureDirectory((0, import_node_path7.dirname)(gitdir), dryRun);
   const git = await requiredExecutable("git");
-  await maybeRun(dryRun, git, ["clone", `--separate-git-dir=${gitdir}`, "--", remoteUrl, worktree]);
+  await maybeRun(dryRun, git, [
+    "clone",
+    "-c",
+    "core.symlinks=false",
+    `--separate-git-dir=${gitdir}`,
+    "--",
+    remoteUrl,
+    worktree
+  ]);
   const newConfig = {
     addedAt: (/* @__PURE__ */ new Date()).toISOString(),
     gitdir,
@@ -8972,7 +9015,7 @@ async function publishShareGitChange(worktree, relativePath, commitMessage, opti
   const git = await requiredExecutable("git");
   const messages = [];
   const paths = typeof relativePath === "string" ? [relativePath] : [...relativePath];
-  const stageArgs = verb === "rm" ? ["-C", worktree, "rm", ...paths] : ["-C", worktree, "add", "--", ...paths];
+  const stageArgs = verb === "rm" ? ["-C", worktree, "rm", "--", ...paths] : ["-C", worktree, "add", "--", ...paths];
   const stageResult = await runGitCommand(dryRun, git, stageArgs, `git ${verb} failed`);
   if (stageResult) {
     messages.push(`git ${verb}: ${stageResult.stdout.trim() || "ok"}`);
@@ -9386,13 +9429,7 @@ function isProbablyBinary(buffer) {
   }
 }
 function detectBinaryCredential(buffer) {
-  const latin1 = buffer.toString("latin1");
-  for (const pattern of SCRUBBER_PATTERNS) {
-    if (pattern.placeholder === void 0 && pattern.regex.test(latin1)) {
-      return pattern.name;
-    }
-  }
-  return void 0;
+  return credentialScrubberBlocker(buffer.toString("latin1"));
 }
 function detectBinaryLocalPath(buffer, rewriteRoots) {
   const latin1 = buffer.toString("latin1");
@@ -10067,7 +10104,7 @@ async function runShareSetUrl(config, remoteUrl, options) {
   const git = await requiredExecutable("git");
   if (dryRun) {
     console.log(
-      `Would run: ${formatShellCommand(git, ["-C", team.config.worktree, "remote", "set-url", DEFAULT_GIT_REMOTE_NAME, remoteUrl])}`
+      `Would run: ${formatShellCommand(git, ["-C", team.config.worktree, "remote", "set-url", DEFAULT_GIT_REMOTE_NAME, "--", remoteUrl])}`
     );
     console.log(
       `Would run: ${formatShellCommand(git, ["-C", team.config.worktree, "fetch", DEFAULT_GIT_REMOTE_NAME])}`
@@ -10075,7 +10112,7 @@ async function runShareSetUrl(config, remoteUrl, options) {
     console.log(`Would write teams file: ${teamsFilePath(config)}`);
     return;
   }
-  await runCommand(git, ["-C", team.config.worktree, "remote", "set-url", DEFAULT_GIT_REMOTE_NAME, remoteUrl]);
+  await runCommand(git, ["-C", team.config.worktree, "remote", "set-url", DEFAULT_GIT_REMOTE_NAME, "--", remoteUrl]);
   await runCommand(git, ["-C", team.config.worktree, "fetch", DEFAULT_GIT_REMOTE_NAME]);
   const teamsFile = await readTeamsFile(config);
   const updatedTeam = { ...team.config, remote: remoteUrl };
@@ -10383,8 +10420,8 @@ function vikingUriToWorktreeRelative(config, uri, team) {
 }
 async function isRegularFileNoSymlink(path2) {
   try {
-    const stat6 = await (0, import_promises5.lstat)(path2);
-    return stat6.isFile();
+    const stat5 = await (0, import_promises5.lstat)(path2);
+    return stat5.isFile();
   } catch (_err) {
     return false;
   }
@@ -11123,9 +11160,23 @@ ${stdout2}`.toLowerCase();
   return output2.includes("resource is busy") || output2.includes("resource is being processed");
 }
 async function ingestSingleFile(ov, config, uri, filePath, initialMode, options = {}) {
-  const content = await (0, import_promises5.readFile)(filePath, "utf8");
+  const content = await readSharedInboundFileContent(uri, filePath);
   await writeMemoryFile(config, ov, uri, content, initialMode, false, options);
 }
+async function readSharedInboundFileContent(uri, filePath) {
+  if (!await isRegularFileNoSymlink(filePath)) {
+    throw new Error(`Refusing to ingest non-regular shared file: ${filePath}`);
+  }
+  return prepareSharedInboundContent(uri, await (0, import_promises5.readFile)(filePath, "utf8"));
+}
+function prepareSharedInboundContent(uri, rawContent) {
+  const stripped = stripPersonalProvenance(rawContent);
+  const scrub = applyScrubber(stripped, { redact: false });
+  if (scrub.blocker) {
+    throw new Error(`Refusing to ingest ${uri}: possible ${scrub.blocker}. Strip the sensitive value upstream first.`);
+  }
+  return scrub.cleaned;
+}
 async function removeMemoryUri(config, ov, uri, dryRun, options = {}) {
   const args = withIdentity(config, ["rm", uri]);
   if (dryRun) {
@@ -11172,8 +11223,10 @@ async function gitOutput(worktree, args, dryRun) {
   }
   return result.stdout.trim();
 }
+var GIT_MODE_ABSENT = "000000";
+var GIT_MODE_SYMLINK = "120000";
 async function listChangedFiles(worktree, beforeRev, afterRev) {
-  const result = await runCommand("git", ["-C", worktree, "diff", "--name-status", "-z", `${beforeRev}..${afterRev}`], {
+  const result = await runCommand("git", ["-C", worktree, "diff", "--raw", "-z", `${beforeRev}..${afterRev}`], {
     allowFailure: true
   });
   if (result.exitCode !== 0) {
@@ -11182,27 +11235,65 @@ async function listChangedFiles(worktree, beforeRev, afterRev) {
   const entries = result.stdout.split("\0").filter((part) => part.length > 0);
   const changes = [];
   for (let index = 0; index < entries.length; ) {
-    const raw = entries[index];
-    const head = raw.slice(0, 1);
+    const raw = entries[index++];
+    const match = raw.match(/^:(\d{6}) (\d{6}) [0-9a-f]+ [0-9a-f]+ ([A-Z])\d*/);
+    if (!match) {
+      continue;
+    }
+    const [, oldMode, newMode, head] = match;
     if (head === "R" || head === "C") {
-      const oldRel = entries[index + 1];
-      const newRel = entries[index + 2];
-      if (oldRel && newRel) {
-        changes.push({ path: (0, import_node_path7.join)(worktree, oldRel), relativePath: oldRel, status: "removed" });
+      const oldRel = entries[index];
+      const newRel = entries[index + 1];
+      if (oldRel) {
+        changes.push({
+          path: (0, import_node_path7.join)(worktree, oldRel),
+          previousContent: oldMode === GIT_MODE_SYMLINK ? void 0 : await gitFileContent(worktree, beforeRev, oldRel),
+          relativePath: oldRel,
+          status: "removed"
+        });
+      }
+      if (newRel && newMode !== GIT_MODE_SYMLINK) {
         changes.push({ path: (0, import_node_path7.join)(worktree, newRel), relativePath: newRel, status: "added" });
       }
-      index += 3;
+      index += 2;
       continue;
     }
-    const rel = entries[index + 1];
+    const rel = entries[index];
     if (rel) {
-      const status = head === "A" ? "added" : head === "D" ? "removed" : "modified";
-      changes.push({ path: (0, import_node_path7.join)(worktree, rel), relativePath: rel, status });
+      if (head === "D") {
+        changes.push({
+          path: (0, import_node_path7.join)(worktree, rel),
+          previousContent: oldMode === GIT_MODE_SYMLINK ? void 0 : await gitFileContent(worktree, beforeRev, rel),
+          relativePath: rel,
+          status: "removed"
+        });
+      } else if (newMode === GIT_MODE_SYMLINK) {
+        if (oldMode !== GIT_MODE_ABSENT) {
+          changes.push({
+            path: (0, import_node_path7.join)(worktree, rel),
+            previousContent: oldMode === GIT_MODE_SYMLINK ? void 0 : await gitFileContent(worktree, beforeRev, rel),
+            relativePath: rel,
+            status: "removed"
+          });
+        }
+      } else {
+        const status = head === "A" ? "added" : "modified";
+        changes.push({
+          path: (0, import_node_path7.join)(worktree, rel),
+          previousContent: oldMode === GIT_MODE_ABSENT || oldMode === GIT_MODE_SYMLINK ? void 0 : await gitFileContent(worktree, beforeRev, rel),
+          relativePath: rel,
+          status
+        });
+      }
     }
-    index += 2;
+    index += 1;
   }
   return changes;
 }
+async function gitFileContent(worktree, rev, relativePath) {
+  const result = await runCommand("git", ["-C", worktree, "show", `${rev}:${relativePath}`], { allowFailure: true });
+  return result.exitCode === 0 ? result.stdout : void 0;
+}
 async function applyChangesToOpenViking(config, team, changes, options = {}) {
   const ov = await openVikingCliForMode(false);
   const failed = [];
@@ -11217,22 +11308,37 @@ async function applyChangesToOpenViking(config, team, changes, options = {}) {
     const uri = workfileToVikingUri(config, team, change.path);
     try {
       if (change.status === "removed") {
+        const currentContent2 = await readExistingMemoryContent(config, ov, uri);
+        if (currentContent2 === void 0) {
+          continue;
+        }
+        assertInboundPreviousContentMatches(change, uri, currentContent2);
         await removeMemoryUri(config, ov, uri, false, options);
         continue;
       }
-      if (!await isFile(change.path)) {
+      if (!await isRegularFileNoSymlink(change.path)) {
         continue;
       }
-      const ovHasResource = await vikingResourceExists(ov, config, uri);
-      if (ovHasResource) {
-        const reason = change.status === "modified" ? "overwriting local with upstream (local edits to the shared subtree are not preserved across sync)" : "aligning OV to upstream (resource pre-existed in OV, likely from an earlier local publish or sync)";
+      const content = await readSharedInboundFileContent(uri, change.path);
+      const currentContent = await readExistingMemoryContent(config, ov, uri);
+      if (currentContent !== void 0) {
+        if (change.status === "added") {
+          if (currentContent === content) {
+            continue;
+          }
+          throw new Error(
+            `Refusing to ingest newly added shared file over existing local OpenViking resource ${uri}; inspect and resolve the local edit first.`
+          );
+        }
+        assertInboundPreviousContentMatches(change, uri, currentContent);
+        const reason = change.status === "modified" ? "updating from upstream after verifying local content matches the previous shared version" : "aligning OV to upstream (resource pre-existed in OV, likely from an earlier local publish or sync)";
         if (options.quiet !== true) {
           console.warn(`share sync: ${uri}: ${reason}.`);
         }
       }
       await ensureSharedDirectoryChain(config, ov, uri, false, options);
-      const writeMode = ovHasResource ? "replace" : "create";
-      await ingestSingleFile(ov, config, uri, change.path, writeMode, options);
+      const writeMode = currentContent !== void 0 ? "replace" : "create";
+      await writeMemoryFile(config, ov, uri, content, writeMode, false, options);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       if (options.quiet !== true) {
@@ -11243,6 +11349,25 @@ async function applyChangesToOpenViking(config, team, changes, options = {}) {
   }
   return { failed };
 }
+async function readExistingMemoryContent(config, ov, uri) {
+  if (!await vikingResourceExists(ov, config, uri)) {
+    return void 0;
+  }
+  return readMemoryContent(config, ov, uri, false);
+}
+function assertInboundPreviousContentMatches(change, uri, currentContent) {
+  if (change.previousContent === void 0) {
+    throw new Error(
+      `Refusing to apply inbound shared change for ${uri}: previous shared content is unavailable, so local edits cannot be distinguished from upstream edits.`
+    );
+  }
+  const expectedContent = prepareSharedInboundContent(uri, change.previousContent);
+  if (currentContent !== expectedContent) {
+    throw new Error(
+      `Refusing to apply inbound shared change for ${uri}: local OpenViking content differs from the previous shared version. Inspect and resolve the local edit first.`
+    );
+  }
+}
 function mergeChanges(...lists) {
   const map = /* @__PURE__ */ new Map();
   for (const list of lists) {
@@ -12059,8 +12184,8 @@ async function removeVikingResourceWithRetry(ov, config, uri) {
   return false;
 }
 async function vikingResourceExists2(ov, config, uri) {
-  const stat6 = await runCommand(ov, withIdentity(config, ["stat", uri]), { allowFailure: true });
-  return stat6.exitCode === 0;
+  const stat5 = await runCommand(ov, withIdentity(config, ["stat", uri]), { allowFailure: true });
+  return stat5.exitCode === 0;
 }
 async function ensureDurableMemoryDirectory(ov, config) {
   await ensureMemoryDirectory(ov, config, durableMemoryDirectoryUri(config));
@@ -13238,8 +13363,6 @@ async function runSeed(config, options) {
         importPath,
         "--to",
         candidate.destinationUri,
-        "--reason",
-        seedResourceReason(candidate),
         ...seedWatchArgs({
           watchIntervalMinutes,
           importedOriginal: importPath === candidate.filePath,
@@ -13306,19 +13429,7 @@ async function seedDependencyGraphs(config, ov, manifest, targetProjects, dryRun
     await ensureDirectory((0, import_node_path13.dirname)(graphPath), false);
     await (0, import_promises11.writeFile)(graphPath, document, { encoding: "utf8", mode: 384 });
     await (0, import_promises11.chmod)(graphPath, 384);
-    await maybeRun(
-      false,
-      ov,
-      withIdentity(config, [
-        "add-resource",
-        graphPath,
-        "--to",
-        destinationUri,
-        "--reason",
-        `Dependency facts for ${project.name}`,
-        "--wait"
-      ])
-    );
+    await maybeRun(false, ov, withIdentity(config, ["add-resource", graphPath, "--to", destinationUri, "--wait"]));
     written += 1;
   }
   console.log(
@@ -13475,15 +13586,7 @@ async function runSeedSkills(config, options) {
       console.log(`SKIP command in native skill mode: ${skill.filePath}`);
       continue;
     }
-    const args = nativeMode ? ["add-skill", skill.filePath, "--wait"] : [
-      "add-resource",
-      skill.filePath,
-      "--to",
-      skillResourceUri(skill),
-      "--reason",
-      skillResourceReason(skill),
-      "--wait"
-    ];
+    const args = nativeMode ? ["add-skill", skill.filePath, "--wait"] : ["add-resource", skill.filePath, "--to", skillResourceUri(skill), "--wait"];
     await maybeRun(options.dryRun === true, ov, withIdentity(config, args));
   }
   console.log(
@@ -13581,17 +13684,9 @@ async function prepareSeedFile(config, candidate, dryRun) {
   await (0, import_promises11.chmod)(redactedPath, 384);
   return redactedPath;
 }
-function seedResourceReason(candidate) {
-  return `Project guidance for ${candidate.projectName}: ${candidate.relativePath}`;
-}
 function graphCacheFileName(projectName) {
   return `${uriSegment(projectName)}-${sha256(projectName).slice(0, 8)}.graph.md`;
 }
-function skillResourceReason(skill) {
-  return `${skill.kind === "command" ? "Agent command" : "Agent skill"} catalog item from ${skill.source}: ${(0, import_node_path13.basename)(
-    skill.filePath
-  )}`;
-}
 async function collectSkillCandidates(config) {
   const sources = [
     { kind: "skill", pattern: "~/.codex/skills/**/SKILL.md", source: "codex-global" },
@@ -13716,23 +13811,6 @@ function redactJsonValue(value) {
 function isSensitiveKey(key) {
   return /token|secret|password|credential|authorization|api[_-]?key|client[_-]?secret|bearer/i.test(key);
 }
-function detectSecretMatches(content) {
-  const detectors = [
-    { label: "private-key", regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
-    { label: "openai-key", regex: /sk-[A-Za-z0-9_-]{24,}/ },
-    { label: "github-token", regex: /gh[pousr]_[A-Za-z0-9_]{24,}/ },
-    { label: "slack-token", regex: /xox[abprs]-[A-Za-z0-9-]{24,}/ },
-    { label: "bearer-token", regex: /Bearer\s+[A-Za-z0-9._~+/=-]{24,}/i },
-    { label: "aws-access-key", regex: /AKIA[0-9A-Z]{16}/ }
-  ];
-  const matches = [];
-  for (const detector of detectors) {
-    if (detector.regex.test(content)) {
-      matches.push(detector.label);
-    }
-  }
-  return matches;
-}
 
 // src/lifecycle.ts
 var import_node_child_process4 = require("node:child_process");
@@ -13851,6 +13929,7 @@ function escapeRegExp3(value) {
 // src/update.ts
 var NPM_PACKAGE_NAME = "threadnote";
 var DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org/";
+var ALLOW_UNTRUSTED_REGISTRY_ENV = "THREADNOTE_ALLOW_UNTRUSTED_NPM_REGISTRY";
 var UPDATE_CHECK_TTL_MS = 24 * 60 * 60 * 1e3;
 var POST_UPDATE_MIGRATIONS_FILE = "post-update-migrations.json";
 var POST_UPDATE_STATE_FILE = "post-update-state.json";
@@ -13881,7 +13960,7 @@ async function maybeNotifyUpdate(config, options = {}) {
   }
 }
 async function runUpdate(config, options) {
-  const registry = normalizeRegistry(options.registry ?? updateRegistry());
+  const registry = resolveUpdateRegistry(options.registry, options.allowUntrustedRegistry);
   const info2 = await withSpinner(
     "Checking npm for latest threadnote version",
     () => getUpdateInfo(config, {
@@ -14392,10 +14471,31 @@ function updatePackageCommand(runtime, registry) {
   };
 }
 function normalizeRegistry(registry) {
-  return registry.endsWith("/") ? registry : `${registry}/`;
+  const normalized = registry.endsWith("/") ? registry : `${registry}/`;
+  const url = new URL(normalized);
+  if (url.protocol !== "https:") {
+    throw new Error(`npm registry must use https: ${normalized}`);
+  }
+  return url.toString();
 }
 function updateRegistry() {
-  return normalizeRegistry(process.env.THREADNOTE_NPM_REGISTRY ?? DEFAULT_NPM_REGISTRY);
+  return resolveUpdateRegistry(void 0, false);
+}
+function resolveUpdateRegistry(registry, allowUntrustedRegistry) {
+  const normalized = normalizeRegistry(registry ?? process.env.THREADNOTE_NPM_REGISTRY ?? DEFAULT_NPM_REGISTRY);
+  if (normalized !== DEFAULT_NPM_REGISTRY && !allowsUntrustedRegistry(allowUntrustedRegistry)) {
+    throw new Error(
+      `Refusing custom npm registry ${normalized}: threadnote update does not verify package signatures from alternate registries. Use the default registry, pass --allow-untrusted-registry, or set ${ALLOW_UNTRUSTED_REGISTRY_ENV}=1 only for an approved mirror.`
+    );
+  }
+  return normalized;
+}
+function allowsUntrustedRegistry(option) {
+  if (option === true) {
+    return true;
+  }
+  const envValue = process.env[ALLOW_UNTRUSTED_REGISTRY_ENV]?.trim().toLowerCase();
+  return envValue === "1" || envValue === "true" || envValue === "yes";
 }
 function isUpdateNotificationDisabled() {
   return process.env.CI !== void 0 || process.env.NO_UPDATE_NOTIFIER !== void 0 || process.env.THREADNOTE_NO_UPDATE_CHECK !== void 0;
@@ -15905,7 +16005,7 @@ function parsePackageManager(value) {
 // src/version_command.ts
 async function runVersion(config, options) {
   const currentVersion = await currentPackageVersion();
-  const registry = normalizeRegistry(options.registry ?? updateRegistry());
+  const registry = resolveUpdateRegistry(options.registry, options.allowUntrustedRegistry);
   let latestVersion;
   let latestWarning;
   try {
@@ -16018,7 +16118,11 @@ async function readManagedMemory(config, uri) {
   if (!path2) {
     throw new Error(`Manager can only read current-user memory URIs: ${uri}`);
   }
-  const [content, pathStat] = await Promise.all([(0, import_promises16.readFile)(path2, "utf8"), (0, import_promises16.stat)(path2)]);
+  const pathStat = await (0, import_promises16.lstat)(path2);
+  if (!pathStat.isFile()) {
+    throw new Error(`Manager can only read regular memory files: ${uri}`);
+  }
+  const content = await (0, import_promises16.readFile)(path2, "utf8");
   const relativePath = (0, import_node_path16.relative)(localMemoriesRoot(config), path2).split(import_node_path16.sep).join("/");
   const record = parseMemoryDocument(uri, content);
   return {
@@ -16326,10 +16430,13 @@ async function serveStatic(context, url, response) {
   response.end(content);
 }
 async function readTree(config, path2, uri, relativePath, options = {}) {
-  const pathStat = await (0, import_promises16.stat)(path2);
+  const pathStat = await (0, import_promises16.lstat)(path2);
   const name = relativePath ? relativePath.split("/").at(-1) ?? relativePath : options.rootName ?? "memories";
   const isDir = pathStat.isDirectory();
   if (!isDir) {
+    if (!pathStat.isFile()) {
+      throw new Error(`Manager can only read regular files or directories: ${uri}`);
+    }
     const record = options.parseMemoryDocuments === false ? void 0 : parseMemoryDocument(uri, await (0, import_promises16.readFile)(path2, "utf8").catch(() => ""));
     return {
       isDir: false,
@@ -16346,7 +16453,7 @@ async function readTree(config, path2, uri, relativePath, options = {}) {
   }
   const entries = await (0, import_promises16.readdir)(path2, { withFileTypes: true });
   const children = await Promise.all(
-    entries.sort(
+    entries.filter((entry) => entry.isDirectory() || entry.isFile()).sort(
       (left, right) => Number(right.isDirectory()) - Number(left.isDirectory()) || left.name.localeCompare(right.name)
     ).map((entry) => {
       const childRelative = relativePath ? `${relativePath}/${entry.name}` : entry.name;
@@ -16524,7 +16631,7 @@ async function removeManagedFolder(config, uri) {
   if (!path2) {
     throw new Error(`Manager can only remove current-user memory folders: ${uri}`);
   }
-  const pathStat = await (0, import_promises16.stat)(path2);
+  const pathStat = await (0, import_promises16.lstat)(path2);
   if (!pathStat.isDirectory()) {
     throw new Error(`Not a folder: ${uri}`);
   }
@@ -16986,10 +17093,10 @@ async function main() {
     }
     await maybeNotifyUpdate(config, { dryRun: options.dryRun === true });
   });
-  program2.command("version").description("Print the installed Threadnote version, latest npm version, and release notes").option("--registry <url>", "npm registry URL", process.env.THREADNOTE_NPM_REGISTRY).action(async (options) => {
+  program2.command("version").description("Print the installed Threadnote version, latest npm version, and release notes").option("--registry <url>", "npm registry URL").option("--allow-untrusted-registry", "Allow a non-default npm registry without package signature verification").action(async (options) => {
     await runVersion(getRuntimeConfig(program2), options);
   });
-  program2.command("update").description("Update the published Threadnote package, then repair local shims and MCP config").option("--check", "Only check whether a newer version is available").option("--dry-run", "Print update and repair commands without running them").option("--force", "Run package-manager update even if this version is already current").option("--registry <url>", "npm registry URL", process.env.THREADNOTE_NPM_REGISTRY).option("--runtime <runtime>", "auto, npm, bun, or deno", parseUpdateRuntime, "auto").option("--no-repair", "Skip threadnote repair after updating the package").option("--no-post-update", "Skip post-update migration prompts").option("--yes", "Accept applicable post-update migrations without prompting").action(async (options) => {
+  program2.command("update").description("Update the published Threadnote package, then repair local shims and MCP config").option("--check", "Only check whether a newer version is available").option("--dry-run", "Print update and repair commands without running them").option("--force", "Run package-manager update even if this version is already current").option("--registry <url>", "npm registry URL").option("--allow-untrusted-registry", "Allow a non-default npm registry without package signature verification").option("--runtime <runtime>", "auto, npm, bun, or deno", parseUpdateRuntime, "auto").option("--no-repair", "Skip threadnote repair after updating the package").option("--no-post-update", "Skip post-update migration prompts").option("--yes", "Accept applicable post-update migrations without prompting").action(async (options) => {
     await runUpdate(getRuntimeConfig(program2), options);
   });
   program2.command("post-update", { hidden: true }).description("Run packaged post-update migration prompts").requiredOption("--from-version <version>", "Version before update").requiredOption("--to-version <version>", "Version after update").option("--dry-run", "Print post-update actions without running them").option("--yes", "Accept applicable post-update migrations without prompting").action(async (options) => {

package/docs/index.html

@@ -25,7 +25,7 @@
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link
-      href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&family=JetBrains+Mono:wght@400;500;600&display=swap"
+      href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&amp;family=JetBrains+Mono:wght@400;500;600&amp;display=swap"
       rel="stylesheet"
     />
 
@@ -783,7 +783,7 @@
             handoffs, seeded repo docs, reusable skills, and team knowledge.
           </p>
           <div class="cta-row">
-            <span class="pill"><span id="version-tag">v1.3.2</span> · local-first · AGPL-3.0-or-later</span>
+            <span class="pill"><span id="version-tag">v1.6.0</span> · local-first · AGPL-3.0-or-later</span>
           </div>
         </div>
         <div class="scroll-cue">scroll ↓ &nbsp;·&nbsp; <span class="kbd">↓</span> / <span class="kbd">j</span></div>
@@ -1147,7 +1147,7 @@
 <span class="out">--user`, which fails on PEP 668 setups.</span>
 <span class="out">Install uv now? [Y/n] </span><span class="out-strong">Y</span>
 <span class="out">Installing uv via Homebrew…</span>
-<span class="out-strong">OK   openviking 0.4.5 ready · server healthy</span></pre>
+<span class="out-strong">OK   openviking 0.4.7 ready · server healthy</span></pre>
               </div>
               <p class="muted" style="margin-top: 0.75rem; font-size: 0.9rem">
                 Or manually: <code>npm install -g threadnote && threadnote install</code>. On a fresh macOS / modern
@@ -1203,7 +1203,7 @@
     --repo ~/src/mobile-app</span>
 <span class="out">Wrote ~/.openviking/seed-manifest.yaml (2 project(s))</span>
 
-<span class="cmd">$ threadnote seed</span>
+<span class="cmd">$ threadnote seed --graph</span>
 <span class="out-strong">Imported 47 curated path(s); skipped 6 secret-flagged.</span>
 
 <span class="cmd">$ threadnote seed-skills</span>
@@ -1228,7 +1228,11 @@ projects:
     uri: viking://resources/repos/mobile-app
     seed:
       - AGENTS.md
-      - docs/**/*.md</code></pre>
+      - docs/**/*.md
+worksets:
+  - name: mobile_web
+    description: Mobile and web app context
+    projects: [web-app, mobile-app]</code></pre>
             </div>
           </div>
 
@@ -1241,6 +1245,14 @@ projects:
               <strong>Seeding is opt-in and re-runnable.</strong> <code>threadnote seed</code> never deletes; it
               upserts.
             </li>
+            <li>
+              <strong>Worksets recall related repos together.</strong> Ask for a workset when a task crosses mobile,
+              web, API, or shared-library boundaries.
+            </li>
+            <li>
+              <strong>Dependency facts are searchable.</strong> <code>threadnote seed --graph</code> adds compact
+              package and module facts without indexing source files.
+            </li>
             <li>
               <strong>Skills are a first-class catalog.</strong> <code>seed-skills</code> makes reusable workflows
               discoverable: testing, release, on-call, debugging, plugin guidance.
@@ -1339,6 +1351,9 @@ threadnote remember \
 threadnote handoff \
   --project web-app --topic auth-token-refresh \
   --task "Address reviewer comments on token refresh PR" \
+  --pr "https://github.com/acme/web-app/pull/184" \
+  --ci "lint and auth tests passing" \
+  --reference "viking://user/&lt;you&gt;/memories/durable/projects/web-app/token-client.md" \
   --tests "make lint-lite; mocha auth_client_test 77 passing" \
   --next-step "Push and request re-review"
 
@@ -1553,6 +1568,19 @@ threadnote remember \
               </div>
             </div>
 
+            <div class="vignette reveal">
+              <div class="v-say">Find the latest mobile and web context for sign-in.</div>
+              <pre class="v-call">recall_context({query: "latest sign-in handoff", workset: "mobile_web"})</pre>
+              <pre class="v-response">
+→ mobile-app guidance, handoffs, and durable memories
+→ web-app guidance, handoffs, and durable memories</pre
+              >
+              <div class="v-answer">
+                Worksets let a manifest group related repos once, then recall them together for cross-platform work. A
+                typo fails early instead of silently falling back to broad search.
+              </div>
+            </div>
+
             <div class="vignette reveal">
               <div class="v-say">Save where we are — I'm switching to another agent.</div>
               <pre class="v-call">
@@ -1591,8 +1619,9 @@ remember_context({kind: "handoff", project: "&lt;repo&gt;", topic: "auto-precomp
 Stored: viking://user/you/memories/handoffs/active/&lt;repo&gt;/auto-precompact.md</pre
               >
               <div class="v-answer">
-                Compaction summarizes the conversation arc but loses the durable facts. Threadnote's hook captures them
-                first; the post-compaction turn recalls them and resumes without amnesia.
+                Compaction summarizes the conversation arc but loses concrete working state. Threadnote's hook captures
+                a scrubbed trace summary and current handoff first; the post-compaction turn recalls them and resumes
+                without amnesia.
               </div>
             </div>
 
@@ -1651,7 +1680,7 @@ threadnote doctor --dry-run</code></pre>
           </div>
 
           <p class="colophon">
-            threadnote · AGPL-3.0-or-later · built on OpenViking 0.4.5 · use <span class="kbd">↑</span>
+            threadnote · AGPL-3.0-or-later · built on OpenViking 0.4.7 · use <span class="kbd">↑</span>
             <span class="kbd">↓</span> / <span class="kbd">j</span> <span class="kbd">k</span> to navigate
           </p>
         </div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "threadnote",
-  "version": "1.6.0",
+  "version": "1.6.2",
   "type": "commonjs",
   "main": "dist/threadnote.cjs",
   "description": "Shared local context and handoffs for development agents",