graph-mind-memory 0.3.0__tar.gz → 0.3.1__tar.gz

{graph_mind_memory-0.3.0 → graph_mind_memory-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: graph-mind-memory
-Version: 0.3.0
+Version: 0.3.1
 Summary: Local-first memory for AI coding assistants: verbatim, on your own PC, no LLM calls at write time.
 Author-email: Yohan Ko <goyohan0611@gmail.com>
 License-Expression: AGPL-3.0-only
@@ -164,7 +164,15 @@ Then restart your AI apps. The server is also listed in the
 | Claude desktop: chat | what the model saves with `brain_remember` |
 
 Before anything is stored, these are masked: API keys, tokens from GitHub, AWS, Google and Slack,
-private keys, and passwords inside URLs.
+private keys, passwords inside URLs, values written after `password:` / `api_key=` / `token:`,
+and any long machine-random string even from a service no rule knows (by its randomness: 91% of
+random 20-64 character tokens caught; in 246,750 ordinary chat turns it fired 92 times, nearly
+all on real ids and tokens). Commit ids, hashes and UUIDs are kept, since you recall those on
+purpose.
+
+There is no switch to keep keys: a recalled memory goes to your model's provider with the question,
+so a stored key would leave your PC the first time it is useful. To have Graph-MIND remember a key,
+tell it **where the key is**, not the key: *"my OpenAI key is in 1Password, under Dev"*.
 
 Only what you actually send is captured: the service reads each app's transcript, which is written
 after you press Enter, so a paste you delete before sending never reaches it. A plain password

{graph_mind_memory-0.3.0 → graph_mind_memory-0.3.1}/README.md

@@ -138,7 +138,15 @@ Then restart your AI apps. The server is also listed in the
 | Claude desktop: chat | what the model saves with `brain_remember` |
 
 Before anything is stored, these are masked: API keys, tokens from GitHub, AWS, Google and Slack,
-private keys, and passwords inside URLs.
+private keys, passwords inside URLs, values written after `password:` / `api_key=` / `token:`,
+and any long machine-random string even from a service no rule knows (by its randomness: 91% of
+random 20-64 character tokens caught; in 246,750 ordinary chat turns it fired 92 times, nearly
+all on real ids and tokens). Commit ids, hashes and UUIDs are kept, since you recall those on
+purpose.
+
+There is no switch to keep keys: a recalled memory goes to your model's provider with the question,
+so a stored key would leave your PC the first time it is useful. To have Graph-MIND remember a key,
+tell it **where the key is**, not the key: *"my OpenAI key is in 1Password, under Dev"*.
 
 Only what you actually send is captured: the service reads each app's transcript, which is written
 after you press Enter, so a paste you delete before sending never reaches it. A plain password

{graph_mind_memory-0.3.0 → graph_mind_memory-0.3.1}/conversation_memory.py

@@ -5,8 +5,10 @@ from development_paths import use_wal
 
 from datetime import datetime
 from pathlib import Path
+import collections
 import hashlib
 import json
+import math
 import os
 import re
 import sqlite3
@@ -30,7 +32,34 @@ SECRET_PATTERNS = (
                 re.DOTALL), "[REDACTED_PRIVATE_KEY]"),
     # a database URL carries its password: postgres://user:PASSWORD@host
     (re.compile(r"(\b[a-z][a-z0-9+.-]*://[^\s:/@]+:)[^\s@/]+(@)"), r"\1[REDACTED]\2"),
+    # a password written after its name: "password: x", "pwd=x", "비밀번호: x", "비번=x"
+    (re.compile(r"(?i)((?<![a-z])(?:password|passwd|pwd)\s*[:=]\s*)\S+"), r"\1[REDACTED]"),
+    (re.compile(r"((?:비밀번호|비번|암호)\s*[:=]\s*)\S+"), r"\1[REDACTED]"),
 )
+# A token no pattern above knows: long, machine-random (mixed case and digits, no word-shaped
+# pieces, high character entropy). Measured: catches 91% of random 20-64 character tokens; in
+# LongMemEval's 246,750 chat turns it fires 92 times, nearly all on real ids and tokens (an
+# OAuth token, Drive file ids, ad click ids); in this repository's code and docs, never.
+# Commit ids, hashes and UUIDs are left alone: those get recalled on purpose.
+RANDOM_CANDIDATE = re.compile(r"(?<![A-Za-z0-9_\-])[A-Za-z0-9_\-]{20,}(?![A-Za-z0-9_\-])")
+UUID = re.compile(r"[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}")
+WORD_PIECE = re.compile(r"[A-Z]?[a-z]+|[A-Z]+(?![a-z])")
+
+
+def _looks_random(token):
+    if UUID.fullmatch(token):
+        return False
+    core = re.sub(r"[_\-]", "", token)
+    if len(core) < 18 or re.fullmatch(r"[0-9a-fA-F]+", core):
+        return False
+    if not (any(c.isupper() for c in core) and any(c.islower() for c in core)
+            and sum(c.isdigit() for c in core) >= 2):
+        return False
+    pieces = WORD_PIECE.findall(core)           # code names are words strung together
+    if pieces and sum(map(len, pieces)) / len(pieces) >= 3.0:
+        return False
+    counts = collections.Counter(core)
+    return -sum(n / len(core) * math.log2(n / len(core)) for n in counts.values()) >= 3.7
 AUTOMATIC_BLOCKS = re.compile(
     r"<(?:environment_context|recommended_plugins|in-app-browser-context)\b[^>]*>.*?"
     r"</(?:environment_context|recommended_plugins|in-app-browser-context)>",
@@ -56,7 +85,15 @@ def _redact(value):
     for pattern, replacement in SECRET_PATTERNS:
         cleaned, replacements = pattern.subn(replacement, cleaned)
         count += replacements
-    return cleaned.strip(), count
+    found = [0]
+
+    def unknown_token(match):
+        if not _looks_random(match.group(0)):
+            return match.group(0)
+        found[0] += 1
+        return "[REDACTED_SECRET]"
+    cleaned = RANDOM_CANDIDATE.sub(unknown_token, cleaned)
+    return cleaned.strip(), count + found[0]
 
 
 def _message_text(payload):

{graph_mind_memory-0.3.0 → graph_mind_memory-0.3.1}/graph_mind_memory.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: graph-mind-memory
-Version: 0.3.0
+Version: 0.3.1
 Summary: Local-first memory for AI coding assistants: verbatim, on your own PC, no LLM calls at write time.
 Author-email: Yohan Ko <goyohan0611@gmail.com>
 License-Expression: AGPL-3.0-only
@@ -164,7 +164,15 @@ Then restart your AI apps. The server is also listed in the
 | Claude desktop: chat | what the model saves with `brain_remember` |
 
 Before anything is stored, these are masked: API keys, tokens from GitHub, AWS, Google and Slack,
-private keys, and passwords inside URLs.
+private keys, passwords inside URLs, values written after `password:` / `api_key=` / `token:`,
+and any long machine-random string even from a service no rule knows (by its randomness: 91% of
+random 20-64 character tokens caught; in 246,750 ordinary chat turns it fired 92 times, nearly
+all on real ids and tokens). Commit ids, hashes and UUIDs are kept, since you recall those on
+purpose.
+
+There is no switch to keep keys: a recalled memory goes to your model's provider with the question,
+so a stored key would leave your PC the first time it is useful. To have Graph-MIND remember a key,
+tell it **where the key is**, not the key: *"my OpenAI key is in 1Password, under Dev"*.
 
 Only what you actually send is captured: the service reads each app's transcript, which is written
 after you press Enter, so a paste you delete before sending never reaches it. A plain password

{graph_mind_memory-0.3.0 → graph_mind_memory-0.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "graph-mind-memory"
-version = "0.3.0"
+version = "0.3.1"
 description = "Local-first memory for AI coding assistants: verbatim, on your own PC, no LLM calls at write time."
 readme = "README.md"
 requires-python = ">=3.10"