wendkeep 0.58.3 → 0.60.0

package/hooks/import-sessions.mjs

@@ -245,12 +245,12 @@ export function importSession(vaultBase, txPath, opts = {}) {
   // One iteration block per turn (insertIteration dedups by turn marker -> re-import safe).
   for (const turn of turns) {
     const block = buildIterationBlock(tx, { turn_id: turn.turnId, now: turn.timestamp });
-    insertIteration(absPath, block, turn.turnId, tx);
+    insertIteration(absPath, block, turn.turnId, tx, vaultBase);
   }
 
   // Cost + subagent telemetry, exactly like the live Stop hook. Fail-open.
   try {
-    updateSessionObservability({ sessionPath: absPath, transcriptPath: txPath });
+    updateSessionObservability({ vaultBase, sessionPath: absPath, transcriptPath: txPath });
   } catch { /* observability is best-effort */ }
 
   // Finalize: derived notes + closing section + ended_at from the last turn.
@@ -259,7 +259,7 @@ export function importSession(vaultBase, txPath, opts = {}) {
     createLinkedNotes(vaultBase, formatDate(endDate), relPath, tx),
     findLinkedDerivedNotes(vaultBase, relPath),
   );
-  finalizeSessionFile(absPath, tx, created, endedAt);
+  finalizeSessionFile(absPath, tx, created, endedAt, vaultBase);
 
   upsertSessionRegistry(vaultBase, sessionId, {
     session_file: relPath,
@@ -399,9 +399,14 @@ export function runImport(vaultBase, opts = {}) {
       }
       try {
         for (const turn of missing) {
-          insertIteration(existingNote, buildIterationBlock(tx, { turn_id: turn.turnId, now: turn.timestamp }), turn.turnId, tx);
+          insertIteration(
+            existingNote, buildIterationBlock(tx, { turn_id: turn.turnId, now: turn.timestamp }),
+            turn.turnId, tx, vaultBase,
+          );
         }
-        try { updateSessionObservability({ sessionPath: existingNote, transcriptPath: t.path }); } catch { /* best-effort */ }
+        try {
+          updateSessionObservability({ vaultBase, sessionPath: existingNote, transcriptPath: t.path });
+        } catch { /* best-effort */ }
         report.sessions.push({ sessionId: t.sessionId, turns: missing.length, repaired: true });
         report.repaired++;
         done++;

package/hooks/memory-mode.mjs

@@ -1,37 +1,87 @@
-import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 
 import { classifySharedMemory } from './memory-schema.mjs';
+import { assertVaultPathSafe } from './vault-path-safety.mjs';
 
 export const LEGACY_MEMORY_WARNING = 'Vault legado: CORE+DIGEST permanece ativo; execute `wendkeep memory migrate --apply` quando a curadoria estiver pronta.';
 
-function readText(path) {
-  if (!existsSync(path)) return { exists: false, content: '', error: null };
-  try { return { exists: true, content: readFileSync(path, 'utf8'), error: null }; }
-  catch (error) { return { exists: true, content: '', error }; }
+function aliasBoundaryError(error) {
+  return error?.code === 'VAULT_PATH_UNSAFE'
+    && /link simbólico|junction|reparse|hardlink|nlink|redirecion|escapa logicamente/i
+      .test(String(error?.message || error));
 }
 
-function hasOutboxEvidence(path) {
-  if (!existsSync(path)) return false;
-  try { return readdirSync(path, { withFileTypes: true }).some((entry) => entry.isFile()); }
-  catch { return true; }
+function readText(vaultBase, path, label) {
+  try {
+    let checked = assertVaultPathSafe(vaultBase, path, { expectedType: 'file', label });
+    if (!checked.exists) return { exists: false, content: '', error: null };
+    checked = assertVaultPathSafe(vaultBase, checked.target, {
+      allowMissing: false, expectedType: 'file', label,
+    });
+    return { exists: true, content: readFileSync(checked.target, 'utf8'), error: null };
+  }
+  catch (error) {
+    if (aliasBoundaryError(error)) throw error;
+    return { exists: true, content: '', error };
+  }
+}
+
+function hasOutboxEvidence(vaultBase, path) {
+  try {
+    let checked = assertVaultPathSafe(vaultBase, path, {
+      expectedType: 'directory', label: 'outbox de memória',
+    });
+    if (!checked.exists) return false;
+    checked = assertVaultPathSafe(vaultBase, checked.target, {
+      allowMissing: false, expectedType: 'directory', label: 'outbox de memória',
+    });
+    const entries = readdirSync(checked.target, { withFileTypes: true });
+    for (const entry of entries) {
+      assertVaultPathSafe(vaultBase, join(checked.target, entry.name), {
+        allowMissing: false, label: `entrada ${entry.name} da outbox de memória`,
+      });
+    }
+    return entries.some((entry) => entry.isFile());
+  }
+  catch (error) {
+    if (aliasBoundaryError(error)) throw error;
+    return true;
+  }
+}
+
+function preflightOptionalMemoryFile(vaultBase, path, label) {
+  try { assertVaultPathSafe(vaultBase, path, { expectedType: 'file', label }); }
+  catch (error) {
+    if (aliasBoundaryError(error)) throw error;
+    // Ordinary unreadable/wrong-type layers preserve the existing degraded-mode contract.
+  }
 }
 
 /** A single, read-only mode decision shared by injection, health and SessionStop. */
 export function detectMemoryMode(vaultBase) {
   const brain = join(vaultBase, '.brain');
-  const shared = readText(join(brain, 'SHARED_MEMORY.md'));
+  assertVaultPathSafe(vaultBase, brain, {
+    expectedType: 'directory', label: 'raiz .brain da memória',
+  });
+  // Preflight the layers consumed immediately after mode detection by injection and Stop.
+  for (const name of ['CORE.md', 'PROJECT.json', 'DIGEST.md']) {
+    preflightOptionalMemoryFile(vaultBase, join(brain, name), `camada de memória ${name}`);
+  }
+  const shared = readText(vaultBase, join(brain, 'SHARED_MEMORY.md'), 'camada SHARED_MEMORY.md');
   if (shared.error) return { mode: 'v2', reason: 'shared-unreadable' };
   const classified = classifySharedMemory(shared.content);
   if (classified.mode === 'v2') return classified;
 
-  const ledger = readText(join(brain, 'MEMORY_EVENTS.jsonl'));
+  const ledger = readText(vaultBase, join(brain, 'MEMORY_EVENTS.jsonl'), 'ledger MEMORY_EVENTS.jsonl');
   if (ledger.error) return { mode: 'v2', reason: 'ledger-unreadable' };
-  const candidates = readText(join(brain, 'MEMORY_CANDIDATES.jsonl'));
+  const candidates = readText(
+    vaultBase, join(brain, 'MEMORY_CANDIDATES.jsonl'), 'sidecar MEMORY_CANDIDATES.jsonl',
+  );
   if (candidates.error) return { mode: 'v2', reason: 'candidates-unreadable' };
   const ledgerHasEvents = ledger.content.trim().length > 0;
   const candidatesHaveEntries = candidates.content.trim().length > 0;
-  const outboxHasEvents = hasOutboxEvidence(join(brain, 'memory-outbox'));
+  const outboxHasEvents = hasOutboxEvidence(vaultBase, join(brain, 'memory-outbox'));
   if (ledgerHasEvents || candidatesHaveEntries || outboxHasEvents) {
     return { mode: 'v2', reason: 'operational-evidence' };
   }