threadnote 1.6.1 → 1.6.2

package/dist/mcp_server.cjs

@@ -35501,6 +35501,82 @@ function shouldUseColor() {
   return import_node_process2.stdout.isTTY === true && process.env.NO_COLOR === void 0 && process.env.CI === void 0 && process.env.TERM !== "dumb";
 }
 
+// src/scrubber.ts
+var SCRUBBER_PATTERNS = [
+  { name: "private key", regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
+  { name: "API key (sk-...)", regex: /\bsk-[A-Za-z0-9_-]{16,}/ },
+  { name: "GitHub token", regex: /\bgh[pousr]_[A-Za-z0-9_]{16,}/ },
+  { name: "GitHub fine-grained PAT", regex: /\bgithub_pat_[A-Za-z0-9_]{20,}/ },
+  { name: "GitLab PAT", regex: /\bglpat-[A-Za-z0-9_-]{20,}/ },
+  { name: "bearer token", regex: /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/i },
+  { name: "basic auth header", regex: /\bBasic\s+[A-Za-z0-9+/]{16,}={0,2}\b/i },
+  { name: "JWT", regex: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/ },
+  { name: "AWS access key", regex: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/ },
+  { name: "AWS secret access key", regex: /\baws_secret_access_key\s*[:=]\s*["']?[A-Za-z0-9/+=]{35,}["']?/i },
+  { name: "AWS session token", regex: /\baws_session_token\s*[:=]\s*["']?[A-Za-z0-9/+=]{40,}["']?/i },
+  { name: "Google API key", regex: /\bAIza[0-9A-Za-z_-]{35}\b/ },
+  { name: "Google OAuth token", regex: /\bya29\.[0-9A-Za-z_-]{20,}/ },
+  { name: "Stripe key", regex: /\b(?:sk|rk)_(?:live|test)_[0-9A-Za-z]{16,}\b/ },
+  { name: "Stripe webhook secret", regex: /\bwhsec_[0-9A-Za-z]{16,}\b/ },
+  {
+    name: "Discord token",
+    regex: /\b(?:mfa\.[A-Za-z0-9_-]{20,}|[MN][A-Za-z0-9_-]{23}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,})\b/
+  },
+  {
+    name: "Discord webhook",
+    regex: /https:\/\/(?:canary\.|ptb\.)?discord(?:app)?\.com\/api\/webhooks\/\d+\/[A-Za-z0-9_-]+/i
+  },
+  { name: "Slack token", regex: /\bx(?:app|ox[abcdeprs])(?:-\d-)?[A-Za-z0-9._-]{10,}/i },
+  { name: "Slack webhook", regex: /https:\/\/hooks\.slack\.com\/services\/[A-Z0-9]+\/[A-Z0-9]+\/[A-Za-z0-9]+/i },
+  {
+    name: "database URI",
+    regex: /\b(?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/@]+:[^@\s]+@[^\s)>"'`,]+/i
+  },
+  { name: "URL basic auth", regex: /\bhttps?:\/\/[^:\s/@]+:[^@\s]+@[^\s)>"'`,]+/i },
+  { name: "macOS home path", placeholder: "<local-path>", regex: /\/Users\/[^\s)>"'`,]+/ },
+  { name: "linux home path", placeholder: "<local-path>", regex: /\/home\/[^\s)>"'`,]+/ }
+];
+function applyScrubber(content, { redact }) {
+  let cleaned = content;
+  const redactions = [];
+  for (const pattern of SCRUBBER_PATTERNS) {
+    if (!pattern.regex.test(cleaned)) {
+      continue;
+    }
+    if (!pattern.placeholder || !redact) {
+      return { blocker: pattern.name, cleaned: content, redactions: [] };
+    }
+    const globalRegex = globalize(pattern.regex);
+    const matches = cleaned.match(globalRegex) ?? [];
+    cleaned = cleaned.replace(globalRegex, pattern.placeholder);
+    redactions.push({ count: matches.length, name: pattern.name });
+  }
+  return { cleaned, redactions };
+}
+function credentialScrubberBlocker(content) {
+  for (const pattern of SCRUBBER_PATTERNS) {
+    if (pattern.placeholder === void 0 && pattern.regex.test(content)) {
+      return pattern.name;
+    }
+  }
+  return void 0;
+}
+function redactSensitiveText(content) {
+  let redacted = content.replace(
+    /([A-Za-z0-9_.-]*(?:token|secret|password|api[_-]?key|authorization|credential|session)[A-Za-z0-9_.-]*\s*[:=]\s*)("[^"]+"|'[^']+'|Bearer\s+[^'"\s]+|\S+)/gi,
+    "$1[REDACTED]"
+  );
+  for (const pattern of SCRUBBER_PATTERNS) {
+    const placeholder = pattern.placeholder ?? "<secret>";
+    redacted = redacted.replace(globalize(pattern.regex), placeholder);
+  }
+  return redacted;
+}
+function globalize(regex) {
+  const flags = regex.flags.includes("g") ? regex.flags : `${regex.flags}g`;
+  return new RegExp(regex.source, flags);
+}
+
 // src/utils.ts
 function isJsonObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -35514,10 +35590,7 @@ function parseJsonConfigObject(content) {
   }
 }
 function redactText(content) {
-  return content.replace(
-    /([A-Za-z0-9_.-]*(?:token|secret|password|api[_-]?key|authorization)[A-Za-z0-9_.-]*\s*[:=]\s*)("[^"]+"|'[^']+'|Bearer\s+[^'"\s]+|\S+)/gi,
-    "$1[REDACTED]"
-  ).replace(/Bearer\s+[A-Za-z0-9._~+/=-]+/gi, "Bearer [REDACTED]").replace(/sk-[A-Za-z0-9_-]{16,}/g, "sk-[REDACTED]").replace(/gh[pousr]_[A-Za-z0-9_]{16,}/g, "gh_[REDACTED]");
+  return redactSensitiveText(content);
 }
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -36778,53 +36851,6 @@ var PACK_FILES_DIR = "files";
 var PACK_ROOT_TOKEN = "${THREADNOTE_PACK_ROOT}";
 var AUTO_SHARE_FETCH_INTERVAL_MS = 5 * 60 * 1e3;
 var DEFAULT_GIT_REMOTE_NAME = "origin";
-var SCRUBBER_PATTERNS = [
-  // Credentials: never redactable. Blocking is the only safe response —
-  // automated redaction risks false negatives that leave material in git.
-  { name: "private key", regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
-  { name: "API key (sk-...)", regex: /\bsk-[A-Za-z0-9_-]{16,}/ },
-  { name: "GitHub token", regex: /\bgh[pousr]_[A-Za-z0-9_]{16,}/ },
-  { name: "GitHub fine-grained PAT", regex: /\bgithub_pat_[A-Za-z0-9_]{20,}/ },
-  { name: "GitLab PAT", regex: /\bglpat-[A-Za-z0-9_-]{20,}/ },
-  { name: "bearer token", regex: /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/i },
-  // Matches bare JWTs (three base64url segments). May surface a JWE token in
-  // legitimate docs; if that becomes noisy we can switch to warn-only.
-  { name: "JWT", regex: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/ },
-  { name: "AWS access key", regex: /\bAKIA[0-9A-Z]{16}\b/ },
-  // Slack tokens: xoxa/xoxb/xoxc (configuration)/xoxd (legacy user cookie)/
-  // xoxe (refresh)/xoxp/xoxr/xoxs, with optional -N- segment for the workspace tier.
-  { name: "Slack token", regex: /\bxox[abcdeprs](?:-\d-)?[A-Za-z0-9._-]{10,}/i },
-  // Soft leaks: block by default (so the agent sees them and decides), but
-  // allow opt-in redaction so curated memories with incidental matches can
-  // ship without a manual rewrite. Local home paths are the recurring
-  // real-world leak; the regexes greedily consume the whole path segment
-  // (including subdirectories) up to whitespace or common closing punctuation
-  // so redaction collapses an entire path to a single placeholder rather than
-  // leaving the subpath visible.
-  { name: "macOS home path", placeholder: "<local-path>", regex: /\/Users\/[^\s)>"'`,]+/ },
-  // No leading \b: it only matches when a word char precedes the slash, which
-  // misses the common cases (after =, :, whitespace, or line start). Mirror the
-  // macOS pattern so /home/... is caught in every position.
-  { name: "linux home path", placeholder: "<local-path>", regex: /\/home\/[^\s)>"'`,]+/ }
-];
-function applyScrubber(content, { redact }) {
-  let cleaned = content;
-  const redactions = [];
-  for (const pattern of SCRUBBER_PATTERNS) {
-    if (!pattern.regex.test(cleaned)) {
-      continue;
-    }
-    if (!pattern.placeholder || !redact) {
-      return { blocker: pattern.name, cleaned: content, redactions: [] };
-    }
-    const flags = pattern.regex.flags.includes("g") ? pattern.regex.flags : `${pattern.regex.flags}g`;
-    const globalRegex = new RegExp(pattern.regex.source, flags);
-    const matches = cleaned.match(globalRegex) ?? [];
-    cleaned = cleaned.replace(globalRegex, pattern.placeholder);
-    redactions.push({ count: matches.length, name: pattern.name });
-  }
-  return { cleaned, redactions };
-}
 var autoShareStates = /* @__PURE__ */ new Map();
 function startShareBackgroundFetch(config2) {
   const state = autoShareState(config2);
@@ -37053,7 +37079,7 @@ async function publishShareGitChange(worktree, relativePath, commitMessage, opti
   const git = await requiredExecutable("git");
   const messages = [];
   const paths = typeof relativePath === "string" ? [relativePath] : [...relativePath];
-  const stageArgs = verb === "rm" ? ["-C", worktree, "rm", ...paths] : ["-C", worktree, "add", "--", ...paths];
+  const stageArgs = verb === "rm" ? ["-C", worktree, "rm", "--", ...paths] : ["-C", worktree, "add", "--", ...paths];
   const stageResult = await runGitCommand(dryRun, git, stageArgs, `git ${verb} failed`);
   if (stageResult) {
     messages.push(`git ${verb}: ${stageResult.stdout.trim() || "ok"}`);
@@ -37396,13 +37422,7 @@ function isProbablyBinary(buffer) {
   }
 }
 function detectBinaryCredential(buffer) {
-  const latin1 = buffer.toString("latin1");
-  for (const pattern of SCRUBBER_PATTERNS) {
-    if (pattern.placeholder === void 0 && pattern.regex.test(latin1)) {
-      return pattern.name;
-    }
-  }
-  return void 0;
+  return credentialScrubberBlocker(buffer.toString("latin1"));
 }
 function detectBinaryLocalPath(buffer, rewriteRoots) {
   const latin1 = buffer.toString("latin1");
@@ -38653,6 +38673,18 @@ function stripPersonalProvenance(content) {
   }
   return cleaned.join("\n");
 }
+async function readMemoryContent(config2, ov, uri, dryRun) {
+  const args = withIdentity(config2, ["read", uri]);
+  if (dryRun) {
+    console.log(`Would run: ${formatShellCommand(ov, args)}`);
+    return "<dry-run memory body>";
+  }
+  const result = await runCommand(ov, args);
+  if (!result.stdout.trim()) {
+    throw new Error(`Refusing to publish empty memory at ${uri}`);
+  }
+  return result.stdout;
+}
 async function ensureSharedDirectoryChain(config2, ov, memoryUri, dryRun, options = {}) {
   const directoryUri = parentUri(memoryUri);
   for (const uri of sharedDirectoryChain(config2, directoryUri)) {
@@ -38810,9 +38842,19 @@ function isResourceBusyFailure(stderr, stdout2) {
 ${stdout2}`.toLowerCase();
   return output.includes("resource is busy") || output.includes("resource is being processed");
 }
-async function ingestSingleFile(ov, config2, uri, filePath, initialMode, options = {}) {
-  const content = await (0, import_promises4.readFile)(filePath, "utf8");
-  await writeMemoryFile(config2, ov, uri, content, initialMode, false, options);
+async function readSharedInboundFileContent(uri, filePath) {
+  if (!await isRegularFileNoSymlink(filePath)) {
+    throw new Error(`Refusing to ingest non-regular shared file: ${filePath}`);
+  }
+  return prepareSharedInboundContent(uri, await (0, import_promises4.readFile)(filePath, "utf8"));
+}
+function prepareSharedInboundContent(uri, rawContent) {
+  const stripped = stripPersonalProvenance(rawContent);
+  const scrub = applyScrubber(stripped, { redact: false });
+  if (scrub.blocker) {
+    throw new Error(`Refusing to ingest ${uri}: possible ${scrub.blocker}. Strip the sensitive value upstream first.`);
+  }
+  return scrub.cleaned;
 }
 async function removeMemoryUri(config2, ov, uri, dryRun, options = {}) {
   const args = withIdentity(config2, ["rm", uri]);
@@ -38860,8 +38902,10 @@ async function gitOutput(worktree, args, dryRun) {
   }
   return result.stdout.trim();
 }
+var GIT_MODE_ABSENT = "000000";
+var GIT_MODE_SYMLINK = "120000";
 async function listChangedFiles(worktree, beforeRev, afterRev) {
-  const result = await runCommand("git", ["-C", worktree, "diff", "--name-status", "-z", `${beforeRev}..${afterRev}`], {
+  const result = await runCommand("git", ["-C", worktree, "diff", "--raw", "-z", `${beforeRev}..${afterRev}`], {
     allowFailure: true
   });
   if (result.exitCode !== 0) {
@@ -38870,27 +38914,65 @@ async function listChangedFiles(worktree, beforeRev, afterRev) {
   const entries = result.stdout.split("\0").filter((part) => part.length > 0);
   const changes = [];
   for (let index = 0; index < entries.length; ) {
-    const raw = entries[index];
-    const head = raw.slice(0, 1);
+    const raw = entries[index++];
+    const match = raw.match(/^:(\d{6}) (\d{6}) [0-9a-f]+ [0-9a-f]+ ([A-Z])\d*/);
+    if (!match) {
+      continue;
+    }
+    const [, oldMode, newMode, head] = match;
     if (head === "R" || head === "C") {
-      const oldRel = entries[index + 1];
-      const newRel = entries[index + 2];
-      if (oldRel && newRel) {
-        changes.push({ path: (0, import_node_path3.join)(worktree, oldRel), relativePath: oldRel, status: "removed" });
+      const oldRel = entries[index];
+      const newRel = entries[index + 1];
+      if (oldRel) {
+        changes.push({
+          path: (0, import_node_path3.join)(worktree, oldRel),
+          previousContent: oldMode === GIT_MODE_SYMLINK ? void 0 : await gitFileContent(worktree, beforeRev, oldRel),
+          relativePath: oldRel,
+          status: "removed"
+        });
+      }
+      if (newRel && newMode !== GIT_MODE_SYMLINK) {
         changes.push({ path: (0, import_node_path3.join)(worktree, newRel), relativePath: newRel, status: "added" });
       }
-      index += 3;
+      index += 2;
       continue;
     }
-    const rel = entries[index + 1];
+    const rel = entries[index];
     if (rel) {
-      const status = head === "A" ? "added" : head === "D" ? "removed" : "modified";
-      changes.push({ path: (0, import_node_path3.join)(worktree, rel), relativePath: rel, status });
+      if (head === "D") {
+        changes.push({
+          path: (0, import_node_path3.join)(worktree, rel),
+          previousContent: oldMode === GIT_MODE_SYMLINK ? void 0 : await gitFileContent(worktree, beforeRev, rel),
+          relativePath: rel,
+          status: "removed"
+        });
+      } else if (newMode === GIT_MODE_SYMLINK) {
+        if (oldMode !== GIT_MODE_ABSENT) {
+          changes.push({
+            path: (0, import_node_path3.join)(worktree, rel),
+            previousContent: oldMode === GIT_MODE_SYMLINK ? void 0 : await gitFileContent(worktree, beforeRev, rel),
+            relativePath: rel,
+            status: "removed"
+          });
+        }
+      } else {
+        const status = head === "A" ? "added" : "modified";
+        changes.push({
+          path: (0, import_node_path3.join)(worktree, rel),
+          previousContent: oldMode === GIT_MODE_ABSENT || oldMode === GIT_MODE_SYMLINK ? void 0 : await gitFileContent(worktree, beforeRev, rel),
+          relativePath: rel,
+          status
+        });
+      }
     }
-    index += 2;
+    index += 1;
   }
   return changes;
 }
+async function gitFileContent(worktree, rev, relativePath) {
+  const result = await runCommand("git", ["-C", worktree, "show", `${rev}:${relativePath}`], { allowFailure: true });
+  return result.exitCode === 0 ? result.stdout : void 0;
+}
 async function applyChangesToOpenViking(config2, team, changes, options = {}) {
   const ov = await openVikingCliForMode(false);
   const failed = [];
@@ -38905,22 +38987,37 @@ async function applyChangesToOpenViking(config2, team, changes, options = {}) {
     const uri = workfileToVikingUri(config2, team, change.path);
     try {
       if (change.status === "removed") {
+        const currentContent2 = await readExistingMemoryContent(config2, ov, uri);
+        if (currentContent2 === void 0) {
+          continue;
+        }
+        assertInboundPreviousContentMatches(change, uri, currentContent2);
         await removeMemoryUri(config2, ov, uri, false, options);
         continue;
       }
-      if (!await isFile(change.path)) {
+      if (!await isRegularFileNoSymlink(change.path)) {
         continue;
       }
-      const ovHasResource = await vikingResourceExists(ov, config2, uri);
-      if (ovHasResource) {
-        const reason = change.status === "modified" ? "overwriting local with upstream (local edits to the shared subtree are not preserved across sync)" : "aligning OV to upstream (resource pre-existed in OV, likely from an earlier local publish or sync)";
+      const content = await readSharedInboundFileContent(uri, change.path);
+      const currentContent = await readExistingMemoryContent(config2, ov, uri);
+      if (currentContent !== void 0) {
+        if (change.status === "added") {
+          if (currentContent === content) {
+            continue;
+          }
+          throw new Error(
+            `Refusing to ingest newly added shared file over existing local OpenViking resource ${uri}; inspect and resolve the local edit first.`
+          );
+        }
+        assertInboundPreviousContentMatches(change, uri, currentContent);
+        const reason = change.status === "modified" ? "updating from upstream after verifying local content matches the previous shared version" : "aligning OV to upstream (resource pre-existed in OV, likely from an earlier local publish or sync)";
         if (options.quiet !== true) {
           console.warn(`share sync: ${uri}: ${reason}.`);
         }
       }
       await ensureSharedDirectoryChain(config2, ov, uri, false, options);
-      const writeMode = ovHasResource ? "replace" : "create";
-      await ingestSingleFile(ov, config2, uri, change.path, writeMode, options);
+      const writeMode = currentContent !== void 0 ? "replace" : "create";
+      await writeMemoryFile(config2, ov, uri, content, writeMode, false, options);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       if (options.quiet !== true) {
@@ -38931,6 +39028,25 @@ async function applyChangesToOpenViking(config2, team, changes, options = {}) {
   }
   return { failed };
 }
+async function readExistingMemoryContent(config2, ov, uri) {
+  if (!await vikingResourceExists(ov, config2, uri)) {
+    return void 0;
+  }
+  return readMemoryContent(config2, ov, uri, false);
+}
+function assertInboundPreviousContentMatches(change, uri, currentContent) {
+  if (change.previousContent === void 0) {
+    throw new Error(
+      `Refusing to apply inbound shared change for ${uri}: previous shared content is unavailable, so local edits cannot be distinguished from upstream edits.`
+    );
+  }
+  const expectedContent = prepareSharedInboundContent(uri, change.previousContent);
+  if (currentContent !== expectedContent) {
+    throw new Error(
+      `Refusing to apply inbound shared change for ${uri}: local OpenViking content differs from the previous shared version. Inspect and resolve the local edit first.`
+    );
+  }
+}
 function mergeChanges(...lists) {
   const map2 = /* @__PURE__ */ new Map();
   for (const list of lists) {
@@ -39659,6 +39775,10 @@ function registerTools(server, config2) {
       if (!checkedPattern.ok) {
         return checkedPattern.error;
       }
+      const checkedLiteralPattern = rejectLeadingDash(checkedPattern.value, "grep", "pattern");
+      if (!checkedLiteralPattern.ok) {
+        return checkedLiteralPattern.error;
+      }
       const checkedUri = optionalVikingUri(uri, "grep");
       if (!checkedUri.ok) {
         return checkedUri.error;
@@ -39666,7 +39786,7 @@ function registerTools(server, config2) {
       return runOpenVikingMcpTool(config2, "grep", {
         case_insensitive: caseInsensitive ?? case_insensitive,
         node_limit: nodeLimit ?? node_limit,
-        pattern: checkedPattern.value,
+        pattern: checkedLiteralPattern.value,
         uri: checkedUri.value ?? `viking://user/${uriSegment2(config2.user)}/memories`
       });
     }
@@ -39688,13 +39808,17 @@ function registerTools(server, config2) {
       if (!checkedPattern.ok) {
         return checkedPattern.error;
       }
+      const checkedLiteralPattern = rejectLeadingDash(checkedPattern.value, "glob", "pattern");
+      if (!checkedLiteralPattern.ok) {
+        return checkedLiteralPattern.error;
+      }
       const checkedUri = optionalVikingUri(uri, "glob");
       if (!checkedUri.ok) {
         return checkedUri.error;
       }
       return runOpenVikingMcpTool(config2, "glob", {
         node_limit: nodeLimit ?? node_limit,
-        pattern: checkedPattern.value,
+        pattern: checkedLiteralPattern.value,
         uri: checkedUri.value
       });
     }
@@ -40007,6 +40131,10 @@ function registerOpenVikingParityTools(server, config2) {
       if (!checkedPattern.ok) {
         return checkedPattern.error;
       }
+      const checkedLiteralPattern = rejectLeadingDash(checkedPattern.value, "ov_grep", "pattern");
+      if (!checkedLiteralPattern.ok) {
+        return checkedLiteralPattern.error;
+      }
       const checkedUri = optionalVikingUri(uri, "ov_grep");
       if (!checkedUri.ok) {
         return checkedUri.error;
@@ -40014,7 +40142,7 @@ function registerOpenVikingParityTools(server, config2) {
       return runOpenVikingMcpTool(config2, "grep", {
         case_insensitive: caseInsensitive ?? case_insensitive,
         node_limit: nodeLimit ?? node_limit,
-        pattern: checkedPattern.value,
+        pattern: checkedLiteralPattern.value,
         uri: checkedUri.value
       });
     }
@@ -40036,13 +40164,17 @@ function registerOpenVikingParityTools(server, config2) {
       if (!checkedPattern.ok) {
         return checkedPattern.error;
       }
+      const checkedLiteralPattern = rejectLeadingDash(checkedPattern.value, "ov_glob", "pattern");
+      if (!checkedLiteralPattern.ok) {
+        return checkedLiteralPattern.error;
+      }
       const checkedUri = optionalVikingUri(uri, "ov_glob");
       if (!checkedUri.ok) {
         return checkedUri.error;
       }
       return runOpenVikingMcpTool(config2, "glob", {
         node_limit: nodeLimit ?? node_limit,
-        pattern: checkedPattern.value,
+        pattern: checkedLiteralPattern.value,
         uri: checkedUri.value
       });
     }
@@ -40994,6 +41126,17 @@ function requiredText(value, toolName, fieldName, example) {
     ok: false
   };
 }
+function rejectLeadingDash(value, toolName, fieldName) {
+  if (!value.startsWith("-")) {
+    return { ok: true, value };
+  }
+  return {
+    error: argumentError(
+      `Threadnote MCP tool "${toolName}" rejects "${fieldName}" values that start with "-". Prefix relative file paths with "./" or use an absolute path.`
+    ),
+    ok: false
+  };
+}
 function requiredVikingUri(value, toolName, exampleUri) {
   const checked = requiredText(value, toolName, "uri", { uri: exampleUri });
   if (!checked.ok) {
@@ -41078,6 +41221,12 @@ async function runOpenVikingAddResourceTool(config2, toolName, params) {
       ].join("\n")
     );
   }
+  if (source) {
+    const checkedSource = rejectLeadingDash(source, toolName, "path");
+    if (!checkedSource.ok) {
+      return checkedSource.error;
+    }
+  }
   if (tempFileId) {
     const checkedTo2 = optionalVikingUri(params.to, toolName);
     if (!checkedTo2.ok) {

package/dist/threadnote.cjs

@@ -3576,6 +3576,91 @@ function startProgress(message) {
   };
 }
 
+// src/scrubber.ts
+var SCRUBBER_PATTERNS = [
+  { name: "private key", regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
+  { name: "API key (sk-...)", regex: /\bsk-[A-Za-z0-9_-]{16,}/ },
+  { name: "GitHub token", regex: /\bgh[pousr]_[A-Za-z0-9_]{16,}/ },
+  { name: "GitHub fine-grained PAT", regex: /\bgithub_pat_[A-Za-z0-9_]{20,}/ },
+  { name: "GitLab PAT", regex: /\bglpat-[A-Za-z0-9_-]{20,}/ },
+  { name: "bearer token", regex: /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/i },
+  { name: "basic auth header", regex: /\bBasic\s+[A-Za-z0-9+/]{16,}={0,2}\b/i },
+  { name: "JWT", regex: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/ },
+  { name: "AWS access key", regex: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/ },
+  { name: "AWS secret access key", regex: /\baws_secret_access_key\s*[:=]\s*["']?[A-Za-z0-9/+=]{35,}["']?/i },
+  { name: "AWS session token", regex: /\baws_session_token\s*[:=]\s*["']?[A-Za-z0-9/+=]{40,}["']?/i },
+  { name: "Google API key", regex: /\bAIza[0-9A-Za-z_-]{35}\b/ },
+  { name: "Google OAuth token", regex: /\bya29\.[0-9A-Za-z_-]{20,}/ },
+  { name: "Stripe key", regex: /\b(?:sk|rk)_(?:live|test)_[0-9A-Za-z]{16,}\b/ },
+  { name: "Stripe webhook secret", regex: /\bwhsec_[0-9A-Za-z]{16,}\b/ },
+  {
+    name: "Discord token",
+    regex: /\b(?:mfa\.[A-Za-z0-9_-]{20,}|[MN][A-Za-z0-9_-]{23}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,})\b/
+  },
+  {
+    name: "Discord webhook",
+    regex: /https:\/\/(?:canary\.|ptb\.)?discord(?:app)?\.com\/api\/webhooks\/\d+\/[A-Za-z0-9_-]+/i
+  },
+  { name: "Slack token", regex: /\bx(?:app|ox[abcdeprs])(?:-\d-)?[A-Za-z0-9._-]{10,}/i },
+  { name: "Slack webhook", regex: /https:\/\/hooks\.slack\.com\/services\/[A-Z0-9]+\/[A-Z0-9]+\/[A-Za-z0-9]+/i },
+  {
+    name: "database URI",
+    regex: /\b(?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/@]+:[^@\s]+@[^\s)>"'`,]+/i
+  },
+  { name: "URL basic auth", regex: /\bhttps?:\/\/[^:\s/@]+:[^@\s]+@[^\s)>"'`,]+/i },
+  { name: "macOS home path", placeholder: "<local-path>", regex: /\/Users\/[^\s)>"'`,]+/ },
+  { name: "linux home path", placeholder: "<local-path>", regex: /\/home\/[^\s)>"'`,]+/ }
+];
+function applyScrubber(content, { redact }) {
+  let cleaned = content;
+  const redactions = [];
+  for (const pattern of SCRUBBER_PATTERNS) {
+    if (!pattern.regex.test(cleaned)) {
+      continue;
+    }
+    if (!pattern.placeholder || !redact) {
+      return { blocker: pattern.name, cleaned: content, redactions: [] };
+    }
+    const globalRegex = globalize(pattern.regex);
+    const matches = cleaned.match(globalRegex) ?? [];
+    cleaned = cleaned.replace(globalRegex, pattern.placeholder);
+    redactions.push({ count: matches.length, name: pattern.name });
+  }
+  return { cleaned, redactions };
+}
+function detectSecretMatches(content) {
+  const matches = [];
+  for (const pattern of SCRUBBER_PATTERNS) {
+    if (pattern.regex.test(content)) {
+      matches.push(pattern.name);
+    }
+  }
+  return matches;
+}
+function credentialScrubberBlocker(content) {
+  for (const pattern of SCRUBBER_PATTERNS) {
+    if (pattern.placeholder === void 0 && pattern.regex.test(content)) {
+      return pattern.name;
+    }
+  }
+  return void 0;
+}
+function redactSensitiveText(content) {
+  let redacted = content.replace(
+    /([A-Za-z0-9_.-]*(?:token|secret|password|api[_-]?key|authorization|credential|session)[A-Za-z0-9_.-]*\s*[:=]\s*)("[^"]+"|'[^']+'|Bearer\s+[^'"\s]+|\S+)/gi,
+    "$1[REDACTED]"
+  );
+  for (const pattern of SCRUBBER_PATTERNS) {
+    const placeholder = pattern.placeholder ?? "<secret>";
+    redacted = redacted.replace(globalize(pattern.regex), placeholder);
+  }
+  return redacted;
+}
+function globalize(regex) {
+  const flags = regex.flags.includes("g") ? regex.flags : `${regex.flags}g`;
+  return new RegExp(regex.source, flags);
+}
+
 // src/utils.ts
 function isJsonObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -3589,10 +3674,7 @@ function parseJsonConfigObject(content) {
   }
 }
 function redactText(content) {
-  return content.replace(
-    /([A-Za-z0-9_.-]*(?:token|secret|password|api[_-]?key|authorization)[A-Za-z0-9_.-]*\s*[:=]\s*)("[^"]+"|'[^']+'|Bearer\s+[^'"\s]+|\S+)/gi,
-    "$1[REDACTED]"
-  ).replace(/Bearer\s+[A-Za-z0-9._~+/=-]+/gi, "Bearer [REDACTED]").replace(/sk-[A-Za-z0-9_-]{16,}/g, "sk-[REDACTED]").replace(/gh[pousr]_[A-Za-z0-9_]{16,}/g, "gh_[REDACTED]");
+  return redactSensitiveText(content);
 }
 async function walkFiles(root) {
   const files = [];
@@ -8469,53 +8551,6 @@ var PACK_FILES_DIR = "files";
 var PACK_ROOT_TOKEN = "${THREADNOTE_PACK_ROOT}";
 var AUTO_SHARE_FETCH_INTERVAL_MS = 5 * 60 * 1e3;
 var DEFAULT_GIT_REMOTE_NAME = "origin";
-var SCRUBBER_PATTERNS = [
-  // Credentials: never redactable. Blocking is the only safe response —
-  // automated redaction risks false negatives that leave material in git.
-  { name: "private key", regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
-  { name: "API key (sk-...)", regex: /\bsk-[A-Za-z0-9_-]{16,}/ },
-  { name: "GitHub token", regex: /\bgh[pousr]_[A-Za-z0-9_]{16,}/ },
-  { name: "GitHub fine-grained PAT", regex: /\bgithub_pat_[A-Za-z0-9_]{20,}/ },
-  { name: "GitLab PAT", regex: /\bglpat-[A-Za-z0-9_-]{20,}/ },
-  { name: "bearer token", regex: /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/i },
-  // Matches bare JWTs (three base64url segments). May surface a JWE token in
-  // legitimate docs; if that becomes noisy we can switch to warn-only.
-  { name: "JWT", regex: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/ },
-  { name: "AWS access key", regex: /\bAKIA[0-9A-Z]{16}\b/ },
-  // Slack tokens: xoxa/xoxb/xoxc (configuration)/xoxd (legacy user cookie)/
-  // xoxe (refresh)/xoxp/xoxr/xoxs, with optional -N- segment for the workspace tier.
-  { name: "Slack token", regex: /\bxox[abcdeprs](?:-\d-)?[A-Za-z0-9._-]{10,}/i },
-  // Soft leaks: block by default (so the agent sees them and decides), but
-  // allow opt-in redaction so curated memories with incidental matches can
-  // ship without a manual rewrite. Local home paths are the recurring
-  // real-world leak; the regexes greedily consume the whole path segment
-  // (including subdirectories) up to whitespace or common closing punctuation
-  // so redaction collapses an entire path to a single placeholder rather than
-  // leaving the subpath visible.
-  { name: "macOS home path", placeholder: "<local-path>", regex: /\/Users\/[^\s)>"'`,]+/ },
-  // No leading \b: it only matches when a word char precedes the slash, which
-  // misses the common cases (after =, :, whitespace, or line start). Mirror the
-  // macOS pattern so /home/... is caught in every position.
-  { name: "linux home path", placeholder: "<local-path>", regex: /\/home\/[^\s)>"'`,]+/ }
-];
-function applyScrubber(content, { redact }) {
-  let cleaned = content;
-  const redactions = [];
-  for (const pattern of SCRUBBER_PATTERNS) {
-    if (!pattern.regex.test(cleaned)) {
-      continue;
-    }
-    if (!pattern.placeholder || !redact) {
-      return { blocker: pattern.name, cleaned: content, redactions: [] };
-    }
-    const flags = pattern.regex.flags.includes("g") ? pattern.regex.flags : `${pattern.regex.flags}g`;
-    const globalRegex = new RegExp(pattern.regex.source, flags);
-    const matches = cleaned.match(globalRegex) ?? [];
-    cleaned = cleaned.replace(globalRegex, pattern.placeholder);
-    redactions.push({ count: matches.length, name: pattern.name });
-  }
-  return { cleaned, redactions };
-}
 var autoShareStates = /* @__PURE__ */ new Map();
 async function runShareInit(config, remoteUrl, options) {
   if (!remoteUrl.trim()) {
@@ -8538,7 +8573,15 @@ async function runShareInit(config, remoteUrl, options) {
   await ensureDirectory((0, import_node_path7.dirname)(worktree), dryRun);
   await ensureDirectory((0, import_node_path7.dirname)(gitdir), dryRun);
   const git = await requiredExecutable("git");
-  await maybeRun(dryRun, git, ["clone", `--separate-git-dir=${gitdir}`, "--", remoteUrl, worktree]);
+  await maybeRun(dryRun, git, [
+    "clone",
+    "-c",
+    "core.symlinks=false",
+    `--separate-git-dir=${gitdir}`,
+    "--",
+    remoteUrl,
+    worktree
+  ]);
   const newConfig = {
     addedAt: (/* @__PURE__ */ new Date()).toISOString(),
     gitdir,
@@ -8972,7 +9015,7 @@ async function publishShareGitChange(worktree, relativePath, commitMessage, opti
   const git = await requiredExecutable("git");
   const messages = [];
   const paths = typeof relativePath === "string" ? [relativePath] : [...relativePath];
-  const stageArgs = verb === "rm" ? ["-C", worktree, "rm", ...paths] : ["-C", worktree, "add", "--", ...paths];
+  const stageArgs = verb === "rm" ? ["-C", worktree, "rm", "--", ...paths] : ["-C", worktree, "add", "--", ...paths];
   const stageResult = await runGitCommand(dryRun, git, stageArgs, `git ${verb} failed`);
   if (stageResult) {
     messages.push(`git ${verb}: ${stageResult.stdout.trim() || "ok"}`);
@@ -9386,13 +9429,7 @@ function isProbablyBinary(buffer) {
   }
 }
 function detectBinaryCredential(buffer) {
-  const latin1 = buffer.toString("latin1");
-  for (const pattern of SCRUBBER_PATTERNS) {
-    if (pattern.placeholder === void 0 && pattern.regex.test(latin1)) {
-      return pattern.name;
-    }
-  }
-  return void 0;
+  return credentialScrubberBlocker(buffer.toString("latin1"));
 }
 function detectBinaryLocalPath(buffer, rewriteRoots) {
   const latin1 = buffer.toString("latin1");
@@ -10067,7 +10104,7 @@ async function runShareSetUrl(config, remoteUrl, options) {
   const git = await requiredExecutable("git");
   if (dryRun) {
     console.log(
-      `Would run: ${formatShellCommand(git, ["-C", team.config.worktree, "remote", "set-url", DEFAULT_GIT_REMOTE_NAME, remoteUrl])}`
+      `Would run: ${formatShellCommand(git, ["-C", team.config.worktree, "remote", "set-url", DEFAULT_GIT_REMOTE_NAME, "--", remoteUrl])}`
     );
     console.log(
       `Would run: ${formatShellCommand(git, ["-C", team.config.worktree, "fetch", DEFAULT_GIT_REMOTE_NAME])}`
@@ -10075,7 +10112,7 @@ async function runShareSetUrl(config, remoteUrl, options) {
     console.log(`Would write teams file: ${teamsFilePath(config)}`);
     return;
   }
-  await runCommand(git, ["-C", team.config.worktree, "remote", "set-url", DEFAULT_GIT_REMOTE_NAME, remoteUrl]);
+  await runCommand(git, ["-C", team.config.worktree, "remote", "set-url", DEFAULT_GIT_REMOTE_NAME, "--", remoteUrl]);
   await runCommand(git, ["-C", team.config.worktree, "fetch", DEFAULT_GIT_REMOTE_NAME]);
   const teamsFile = await readTeamsFile(config);
   const updatedTeam = { ...team.config, remote: remoteUrl };
@@ -10383,8 +10420,8 @@ function vikingUriToWorktreeRelative(config, uri, team) {
 }
 async function isRegularFileNoSymlink(path2) {
   try {
-    const stat6 = await (0, import_promises5.lstat)(path2);
-    return stat6.isFile();
+    const stat5 = await (0, import_promises5.lstat)(path2);
+    return stat5.isFile();
   } catch (_err) {
     return false;
   }
@@ -11123,9 +11160,23 @@ ${stdout2}`.toLowerCase();
   return output2.includes("resource is busy") || output2.includes("resource is being processed");
 }
 async function ingestSingleFile(ov, config, uri, filePath, initialMode, options = {}) {
-  const content = await (0, import_promises5.readFile)(filePath, "utf8");
+  const content = await readSharedInboundFileContent(uri, filePath);
   await writeMemoryFile(config, ov, uri, content, initialMode, false, options);
 }
+async function readSharedInboundFileContent(uri, filePath) {
+  if (!await isRegularFileNoSymlink(filePath)) {
+    throw new Error(`Refusing to ingest non-regular shared file: ${filePath}`);
+  }
+  return prepareSharedInboundContent(uri, await (0, import_promises5.readFile)(filePath, "utf8"));
+}
+function prepareSharedInboundContent(uri, rawContent) {
+  const stripped = stripPersonalProvenance(rawContent);
+  const scrub = applyScrubber(stripped, { redact: false });
+  if (scrub.blocker) {
+    throw new Error(`Refusing to ingest ${uri}: possible ${scrub.blocker}. Strip the sensitive value upstream first.`);
+  }
+  return scrub.cleaned;
+}
 async function removeMemoryUri(config, ov, uri, dryRun, options = {}) {
   const args = withIdentity(config, ["rm", uri]);
   if (dryRun) {
@@ -11172,8 +11223,10 @@ async function gitOutput(worktree, args, dryRun) {
   }
   return result.stdout.trim();
 }
+var GIT_MODE_ABSENT = "000000";
+var GIT_MODE_SYMLINK = "120000";
 async function listChangedFiles(worktree, beforeRev, afterRev) {
-  const result = await runCommand("git", ["-C", worktree, "diff", "--name-status", "-z", `${beforeRev}..${afterRev}`], {
+  const result = await runCommand("git", ["-C", worktree, "diff", "--raw", "-z", `${beforeRev}..${afterRev}`], {
     allowFailure: true
   });
   if (result.exitCode !== 0) {
@@ -11182,27 +11235,65 @@ async function listChangedFiles(worktree, beforeRev, afterRev) {
   const entries = result.stdout.split("\0").filter((part) => part.length > 0);
   const changes = [];
   for (let index = 0; index < entries.length; ) {
-    const raw = entries[index];
-    const head = raw.slice(0, 1);
+    const raw = entries[index++];
+    const match = raw.match(/^:(\d{6}) (\d{6}) [0-9a-f]+ [0-9a-f]+ ([A-Z])\d*/);
+    if (!match) {
+      continue;
+    }
+    const [, oldMode, newMode, head] = match;
     if (head === "R" || head === "C") {
-      const oldRel = entries[index + 1];
-      const newRel = entries[index + 2];
-      if (oldRel && newRel) {
-        changes.push({ path: (0, import_node_path7.join)(worktree, oldRel), relativePath: oldRel, status: "removed" });
+      const oldRel = entries[index];
+      const newRel = entries[index + 1];
+      if (oldRel) {
+        changes.push({
+          path: (0, import_node_path7.join)(worktree, oldRel),
+          previousContent: oldMode === GIT_MODE_SYMLINK ? void 0 : await gitFileContent(worktree, beforeRev, oldRel),
+          relativePath: oldRel,
+          status: "removed"
+        });
+      }
+      if (newRel && newMode !== GIT_MODE_SYMLINK) {
         changes.push({ path: (0, import_node_path7.join)(worktree, newRel), relativePath: newRel, status: "added" });
       }
-      index += 3;
+      index += 2;
       continue;
     }
-    const rel = entries[index + 1];
+    const rel = entries[index];
     if (rel) {
-      const status = head === "A" ? "added" : head === "D" ? "removed" : "modified";
-      changes.push({ path: (0, import_node_path7.join)(worktree, rel), relativePath: rel, status });
+      if (head === "D") {
+        changes.push({
+          path: (0, import_node_path7.join)(worktree, rel),
+          previousContent: oldMode === GIT_MODE_SYMLINK ? void 0 : await gitFileContent(worktree, beforeRev, rel),
+          relativePath: rel,
+          status: "removed"
+        });
+      } else if (newMode === GIT_MODE_SYMLINK) {
+        if (oldMode !== GIT_MODE_ABSENT) {
+          changes.push({
+            path: (0, import_node_path7.join)(worktree, rel),
+            previousContent: oldMode === GIT_MODE_SYMLINK ? void 0 : await gitFileContent(worktree, beforeRev, rel),
+            relativePath: rel,
+            status: "removed"
+          });
+        }
+      } else {
+        const status = head === "A" ? "added" : "modified";
+        changes.push({
+          path: (0, import_node_path7.join)(worktree, rel),
+          previousContent: oldMode === GIT_MODE_ABSENT || oldMode === GIT_MODE_SYMLINK ? void 0 : await gitFileContent(worktree, beforeRev, rel),
+          relativePath: rel,
+          status
+        });
+      }
     }
-    index += 2;
+    index += 1;
   }
   return changes;
 }
+async function gitFileContent(worktree, rev, relativePath) {
+  const result = await runCommand("git", ["-C", worktree, "show", `${rev}:${relativePath}`], { allowFailure: true });
+  return result.exitCode === 0 ? result.stdout : void 0;
+}
 async function applyChangesToOpenViking(config, team, changes, options = {}) {
   const ov = await openVikingCliForMode(false);
   const failed = [];
@@ -11217,22 +11308,37 @@ async function applyChangesToOpenViking(config, team, changes, options = {}) {
     const uri = workfileToVikingUri(config, team, change.path);
     try {
       if (change.status === "removed") {
+        const currentContent2 = await readExistingMemoryContent(config, ov, uri);
+        if (currentContent2 === void 0) {
+          continue;
+        }
+        assertInboundPreviousContentMatches(change, uri, currentContent2);
         await removeMemoryUri(config, ov, uri, false, options);
         continue;
       }
-      if (!await isFile(change.path)) {
+      if (!await isRegularFileNoSymlink(change.path)) {
         continue;
       }
-      const ovHasResource = await vikingResourceExists(ov, config, uri);
-      if (ovHasResource) {
-        const reason = change.status === "modified" ? "overwriting local with upstream (local edits to the shared subtree are not preserved across sync)" : "aligning OV to upstream (resource pre-existed in OV, likely from an earlier local publish or sync)";
+      const content = await readSharedInboundFileContent(uri, change.path);
+      const currentContent = await readExistingMemoryContent(config, ov, uri);
+      if (currentContent !== void 0) {
+        if (change.status === "added") {
+          if (currentContent === content) {
+            continue;
+          }
+          throw new Error(
+            `Refusing to ingest newly added shared file over existing local OpenViking resource ${uri}; inspect and resolve the local edit first.`
+          );
+        }
+        assertInboundPreviousContentMatches(change, uri, currentContent);
+        const reason = change.status === "modified" ? "updating from upstream after verifying local content matches the previous shared version" : "aligning OV to upstream (resource pre-existed in OV, likely from an earlier local publish or sync)";
         if (options.quiet !== true) {
           console.warn(`share sync: ${uri}: ${reason}.`);
         }
       }
       await ensureSharedDirectoryChain(config, ov, uri, false, options);
-      const writeMode = ovHasResource ? "replace" : "create";
-      await ingestSingleFile(ov, config, uri, change.path, writeMode, options);
+      const writeMode = currentContent !== void 0 ? "replace" : "create";
+      await writeMemoryFile(config, ov, uri, content, writeMode, false, options);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       if (options.quiet !== true) {
@@ -11243,6 +11349,25 @@ async function applyChangesToOpenViking(config, team, changes, options = {}) {
   }
   return { failed };
 }
+async function readExistingMemoryContent(config, ov, uri) {
+  if (!await vikingResourceExists(ov, config, uri)) {
+    return void 0;
+  }
+  return readMemoryContent(config, ov, uri, false);
+}
+function assertInboundPreviousContentMatches(change, uri, currentContent) {
+  if (change.previousContent === void 0) {
+    throw new Error(
+      `Refusing to apply inbound shared change for ${uri}: previous shared content is unavailable, so local edits cannot be distinguished from upstream edits.`
+    );
+  }
+  const expectedContent = prepareSharedInboundContent(uri, change.previousContent);
+  if (currentContent !== expectedContent) {
+    throw new Error(
+      `Refusing to apply inbound shared change for ${uri}: local OpenViking content differs from the previous shared version. Inspect and resolve the local edit first.`
+    );
+  }
+}
 function mergeChanges(...lists) {
   const map = /* @__PURE__ */ new Map();
   for (const list of lists) {
@@ -12059,8 +12184,8 @@ async function removeVikingResourceWithRetry(ov, config, uri) {
   return false;
 }
 async function vikingResourceExists2(ov, config, uri) {
-  const stat6 = await runCommand(ov, withIdentity(config, ["stat", uri]), { allowFailure: true });
-  return stat6.exitCode === 0;
+  const stat5 = await runCommand(ov, withIdentity(config, ["stat", uri]), { allowFailure: true });
+  return stat5.exitCode === 0;
 }
 async function ensureDurableMemoryDirectory(ov, config) {
   await ensureMemoryDirectory(ov, config, durableMemoryDirectoryUri(config));
@@ -13686,23 +13811,6 @@ function redactJsonValue(value) {
 function isSensitiveKey(key) {
   return /token|secret|password|credential|authorization|api[_-]?key|client[_-]?secret|bearer/i.test(key);
 }
-function detectSecretMatches(content) {
-  const detectors = [
-    { label: "private-key", regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
-    { label: "openai-key", regex: /sk-[A-Za-z0-9_-]{24,}/ },
-    { label: "github-token", regex: /gh[pousr]_[A-Za-z0-9_]{24,}/ },
-    { label: "slack-token", regex: /xox[abprs]-[A-Za-z0-9-]{24,}/ },
-    { label: "bearer-token", regex: /Bearer\s+[A-Za-z0-9._~+/=-]{24,}/i },
-    { label: "aws-access-key", regex: /AKIA[0-9A-Z]{16}/ }
-  ];
-  const matches = [];
-  for (const detector of detectors) {
-    if (detector.regex.test(content)) {
-      matches.push(detector.label);
-    }
-  }
-  return matches;
-}
 
 // src/lifecycle.ts
 var import_node_child_process4 = require("node:child_process");
@@ -13821,6 +13929,7 @@ function escapeRegExp3(value) {
 // src/update.ts
 var NPM_PACKAGE_NAME = "threadnote";
 var DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org/";
+var ALLOW_UNTRUSTED_REGISTRY_ENV = "THREADNOTE_ALLOW_UNTRUSTED_NPM_REGISTRY";
 var UPDATE_CHECK_TTL_MS = 24 * 60 * 60 * 1e3;
 var POST_UPDATE_MIGRATIONS_FILE = "post-update-migrations.json";
 var POST_UPDATE_STATE_FILE = "post-update-state.json";
@@ -13851,7 +13960,7 @@ async function maybeNotifyUpdate(config, options = {}) {
   }
 }
 async function runUpdate(config, options) {
-  const registry = normalizeRegistry(options.registry ?? updateRegistry());
+  const registry = resolveUpdateRegistry(options.registry, options.allowUntrustedRegistry);
   const info2 = await withSpinner(
     "Checking npm for latest threadnote version",
     () => getUpdateInfo(config, {
@@ -14362,10 +14471,31 @@ function updatePackageCommand(runtime, registry) {
   };
 }
 function normalizeRegistry(registry) {
-  return registry.endsWith("/") ? registry : `${registry}/`;
+  const normalized = registry.endsWith("/") ? registry : `${registry}/`;
+  const url = new URL(normalized);
+  if (url.protocol !== "https:") {
+    throw new Error(`npm registry must use https: ${normalized}`);
+  }
+  return url.toString();
 }
 function updateRegistry() {
-  return normalizeRegistry(process.env.THREADNOTE_NPM_REGISTRY ?? DEFAULT_NPM_REGISTRY);
+  return resolveUpdateRegistry(void 0, false);
+}
+function resolveUpdateRegistry(registry, allowUntrustedRegistry) {
+  const normalized = normalizeRegistry(registry ?? process.env.THREADNOTE_NPM_REGISTRY ?? DEFAULT_NPM_REGISTRY);
+  if (normalized !== DEFAULT_NPM_REGISTRY && !allowsUntrustedRegistry(allowUntrustedRegistry)) {
+    throw new Error(
+      `Refusing custom npm registry ${normalized}: threadnote update does not verify package signatures from alternate registries. Use the default registry, pass --allow-untrusted-registry, or set ${ALLOW_UNTRUSTED_REGISTRY_ENV}=1 only for an approved mirror.`
+    );
+  }
+  return normalized;
+}
+function allowsUntrustedRegistry(option) {
+  if (option === true) {
+    return true;
+  }
+  const envValue = process.env[ALLOW_UNTRUSTED_REGISTRY_ENV]?.trim().toLowerCase();
+  return envValue === "1" || envValue === "true" || envValue === "yes";
 }
 function isUpdateNotificationDisabled() {
   return process.env.CI !== void 0 || process.env.NO_UPDATE_NOTIFIER !== void 0 || process.env.THREADNOTE_NO_UPDATE_CHECK !== void 0;
@@ -15875,7 +16005,7 @@ function parsePackageManager(value) {
 // src/version_command.ts
 async function runVersion(config, options) {
   const currentVersion = await currentPackageVersion();
-  const registry = normalizeRegistry(options.registry ?? updateRegistry());
+  const registry = resolveUpdateRegistry(options.registry, options.allowUntrustedRegistry);
   let latestVersion;
   let latestWarning;
   try {
@@ -15988,7 +16118,11 @@ async function readManagedMemory(config, uri) {
   if (!path2) {
     throw new Error(`Manager can only read current-user memory URIs: ${uri}`);
   }
-  const [content, pathStat] = await Promise.all([(0, import_promises16.readFile)(path2, "utf8"), (0, import_promises16.stat)(path2)]);
+  const pathStat = await (0, import_promises16.lstat)(path2);
+  if (!pathStat.isFile()) {
+    throw new Error(`Manager can only read regular memory files: ${uri}`);
+  }
+  const content = await (0, import_promises16.readFile)(path2, "utf8");
   const relativePath = (0, import_node_path16.relative)(localMemoriesRoot(config), path2).split(import_node_path16.sep).join("/");
   const record = parseMemoryDocument(uri, content);
   return {
@@ -16296,10 +16430,13 @@ async function serveStatic(context, url, response) {
   response.end(content);
 }
 async function readTree(config, path2, uri, relativePath, options = {}) {
-  const pathStat = await (0, import_promises16.stat)(path2);
+  const pathStat = await (0, import_promises16.lstat)(path2);
   const name = relativePath ? relativePath.split("/").at(-1) ?? relativePath : options.rootName ?? "memories";
   const isDir = pathStat.isDirectory();
   if (!isDir) {
+    if (!pathStat.isFile()) {
+      throw new Error(`Manager can only read regular files or directories: ${uri}`);
+    }
     const record = options.parseMemoryDocuments === false ? void 0 : parseMemoryDocument(uri, await (0, import_promises16.readFile)(path2, "utf8").catch(() => ""));
     return {
       isDir: false,
@@ -16316,7 +16453,7 @@ async function readTree(config, path2, uri, relativePath, options = {}) {
   }
   const entries = await (0, import_promises16.readdir)(path2, { withFileTypes: true });
   const children = await Promise.all(
-    entries.sort(
+    entries.filter((entry) => entry.isDirectory() || entry.isFile()).sort(
       (left, right) => Number(right.isDirectory()) - Number(left.isDirectory()) || left.name.localeCompare(right.name)
     ).map((entry) => {
       const childRelative = relativePath ? `${relativePath}/${entry.name}` : entry.name;
@@ -16494,7 +16631,7 @@ async function removeManagedFolder(config, uri) {
   if (!path2) {
     throw new Error(`Manager can only remove current-user memory folders: ${uri}`);
   }
-  const pathStat = await (0, import_promises16.stat)(path2);
+  const pathStat = await (0, import_promises16.lstat)(path2);
   if (!pathStat.isDirectory()) {
     throw new Error(`Not a folder: ${uri}`);
   }
@@ -16956,10 +17093,10 @@ async function main() {
     }
     await maybeNotifyUpdate(config, { dryRun: options.dryRun === true });
   });
-  program2.command("version").description("Print the installed Threadnote version, latest npm version, and release notes").option("--registry <url>", "npm registry URL", process.env.THREADNOTE_NPM_REGISTRY).action(async (options) => {
+  program2.command("version").description("Print the installed Threadnote version, latest npm version, and release notes").option("--registry <url>", "npm registry URL").option("--allow-untrusted-registry", "Allow a non-default npm registry without package signature verification").action(async (options) => {
     await runVersion(getRuntimeConfig(program2), options);
   });
-  program2.command("update").description("Update the published Threadnote package, then repair local shims and MCP config").option("--check", "Only check whether a newer version is available").option("--dry-run", "Print update and repair commands without running them").option("--force", "Run package-manager update even if this version is already current").option("--registry <url>", "npm registry URL", process.env.THREADNOTE_NPM_REGISTRY).option("--runtime <runtime>", "auto, npm, bun, or deno", parseUpdateRuntime, "auto").option("--no-repair", "Skip threadnote repair after updating the package").option("--no-post-update", "Skip post-update migration prompts").option("--yes", "Accept applicable post-update migrations without prompting").action(async (options) => {
+  program2.command("update").description("Update the published Threadnote package, then repair local shims and MCP config").option("--check", "Only check whether a newer version is available").option("--dry-run", "Print update and repair commands without running them").option("--force", "Run package-manager update even if this version is already current").option("--registry <url>", "npm registry URL").option("--allow-untrusted-registry", "Allow a non-default npm registry without package signature verification").option("--runtime <runtime>", "auto, npm, bun, or deno", parseUpdateRuntime, "auto").option("--no-repair", "Skip threadnote repair after updating the package").option("--no-post-update", "Skip post-update migration prompts").option("--yes", "Accept applicable post-update migrations without prompting").action(async (options) => {
     await runUpdate(getRuntimeConfig(program2), options);
   });
   program2.command("post-update", { hidden: true }).description("Run packaged post-update migration prompts").requiredOption("--from-version <version>", "Version before update").requiredOption("--to-version <version>", "Version after update").option("--dry-run", "Print post-update actions without running them").option("--yes", "Accept applicable post-update migrations without prompting").action(async (options) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "threadnote",
-  "version": "1.6.1",
+  "version": "1.6.2",
   "type": "commonjs",
   "main": "dist/threadnote.cjs",
   "description": "Shared local context and handoffs for development agents",