memgit 0.12.0__tar.gz → 0.13.0__tar.gz

{memgit-0.12.0 → memgit-0.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: memgit
-Version: 0.12.0
+Version: 0.13.0
 Summary: Git for AI memory — version-controlled context persistence across Claude, GPT, Gemini, Cursor, Windsurf, and more
 License: MIT
 Project-URL: Homepage, https://memgit.dev
@@ -284,6 +284,8 @@ Once registered via MCP, every AI tool gets 6 tools:
 
 The tool descriptions teach the AI **judgment** — "does this request depend on state you don't have in context?" — rather than keyword triggers. Measured cost of the whole tool surface: ~1,150 tokens once per session; a `resume_session` reply is ~335.
 
+**A save that arrives damaged is refused, not stored** (v0.13.0). A model sometimes closes a value with a tag named after the field (`</rule>`), and the host then delivers the next parameters inside that value: `why`, `when`, `tags` and `type_code` never arrive, and the memory is stored with defaults. On one machine that was 748 of 3,025 saves. `save_memory` now refuses any value carrying tool-call markup, names the field and the parameters it swallowed, and the model retries in the same turn. Markup quoted on purpose inside backticks is allowed. Every successful save echoes the length of each field it stored, which fields arrived empty, and which values came from a default. Damaged memories already in a store are never served back into context: the digest, the recall hook and read results show each field cut at the damage. `memgit doctor` counts them, and `memgit doctor --repair-markup` splits them back into their fields.
+
 ---
 
 ## Core operating guide (v0.5.0)
@@ -415,6 +417,8 @@ memgit doctor                     # hygiene + scope losses: split labels, quaran
 memgit doctor --audit             # every split and stranded label, the save landing rate, throughput
 memgit doctor --audit --json      # the same report as JSON
 memgit doctor --relabel map.json  # bulk re-project memories ({"slug": "Label" | ""}); one checkpoint
+memgit doctor --repair-markup     # dry run: memories whose fields swallowed other parameters on save
+memgit doctor --repair-markup --yes [--project LABEL]   # split them back into their fields; one checkpoint
 memgit lint                       # validate all memories (flags unknown provenance)
 memgit fsck                       # verify store integrity
 

{memgit-0.12.0 → memgit-0.13.0}/README.md

@@ -250,6 +250,8 @@ Once registered via MCP, every AI tool gets 6 tools:
 
 The tool descriptions teach the AI **judgment** — "does this request depend on state you don't have in context?" — rather than keyword triggers. Measured cost of the whole tool surface: ~1,150 tokens once per session; a `resume_session` reply is ~335.
 
+**A save that arrives damaged is refused, not stored** (v0.13.0). A model sometimes closes a value with a tag named after the field (`</rule>`), and the host then delivers the next parameters inside that value: `why`, `when`, `tags` and `type_code` never arrive, and the memory is stored with defaults. On one machine that was 748 of 3,025 saves. `save_memory` now refuses any value carrying tool-call markup, names the field and the parameters it swallowed, and the model retries in the same turn. Markup quoted on purpose inside backticks is allowed. Every successful save echoes the length of each field it stored, which fields arrived empty, and which values came from a default. Damaged memories already in a store are never served back into context: the digest, the recall hook and read results show each field cut at the damage. `memgit doctor` counts them, and `memgit doctor --repair-markup` splits them back into their fields.
+
 ---
 
 ## Core operating guide (v0.5.0)
@@ -381,6 +383,8 @@ memgit doctor                     # hygiene + scope losses: split labels, quaran
 memgit doctor --audit             # every split and stranded label, the save landing rate, throughput
 memgit doctor --audit --json      # the same report as JSON
 memgit doctor --relabel map.json  # bulk re-project memories ({"slug": "Label" | ""}); one checkpoint
+memgit doctor --repair-markup     # dry run: memories whose fields swallowed other parameters on save
+memgit doctor --repair-markup --yes [--project LABEL]   # split them back into their fields; one checkpoint
 memgit lint                       # validate all memories (flags unknown provenance)
 memgit fsck                       # verify store integrity
 

{memgit-0.12.0 → memgit-0.13.0}/memgit/__init__.py

@@ -1,3 +1,3 @@
 """memgit — git for AI memory."""
 
-__version__ = "0.12.0"
+__version__ = "0.13.0"

{memgit-0.12.0 → memgit-0.13.0}/memgit/cli.py

@@ -193,6 +193,15 @@ def add(slug, rule, type_code, why, when, tags, priority, body, project,
     tag_list = [t.strip() for t in tags.split(',')] if tags else []
     if body == '-':
         body = sys.stdin.read().strip() or None
+    from .markup import check_save_arguments
+    problems = check_save_arguments(
+        {'slug': slug, 'rule': rule, 'why': why, 'when': when, 'body': body,
+         'tags': tag_list})
+    if problems:
+        err.print('[red]refused: ' + '; '.join(problems) + '. Nothing was '
+                  'saved. Wrap markup in backticks to quote it on '
+                  'purpose.[/red]')
+        sys.exit(1)
     # Same scoping semantics as MCP save_memory: absent → this workspace,
     # --global (or explicit empty string) → deliberately global. Detection
     # failing must never silently produce a global memory — quarantine it
@@ -2491,8 +2500,15 @@ def gc(dry_run, squash_keep, reflog_keep, fmt_json):
                    'save landing rate, and throughput')
 @click.option('--json', 'fmt_json', is_flag=True,
               help='Emit the audit as JSON')
+@click.option('--repair-markup', is_flag=True,
+              help='Split memories whose fields carry tool-call markup back '
+                   'into their fields. Dry run unless --yes is given')
+@click.option('--project', 'repair_project', default=None, metavar='LABEL',
+              help='With --repair-markup: only this project')
+@click.option('--yes', 'confirm', is_flag=True,
+              help='With --repair-markup: write the repair as one checkpoint')
 def doctor(relabel_path, prune_slugs, clean_caches, prune_sessions,
-           full_audit, fmt_json):
+           full_audit, fmt_json, repair_markup, repair_project, confirm):
     """Diagnose and repair store hygiene: provenance, usage ledger, caches.
 
     With no options, prints a report: quarantined (`_unknown`) and
@@ -2575,6 +2591,10 @@ def doctor(relabel_path, prune_slugs, clean_caches, prune_sessions,
         console.print(f'[green]doctor[/green]  removed {deleted} stale + '
                       f'{pruned} named session-cache file(s)')
 
+    if repair_markup:
+        acted = True
+        _repair_markup(repo, repair_project, confirm)
+
     if acted:
         return
 
@@ -2622,6 +2642,20 @@ def doctor(relabel_path, prune_slugs, clean_caches, prune_sessions,
     # Scope losses run in the DEFAULT report, not behind the flag. A split
     # raises no error and passes fsck, so the only way anyone learns of one is
     # a report that volunteers it. `--audit` adds the detail, never the finding.
+    from .markup import TEXT_FIELDS, has_markup
+    damaged = [m for m in mnemonics
+               if any(has_markup(getattr(m, f)) for f in TEXT_FIELDS)]
+    if damaged:
+        by_proj = Counter(m.project or '(global)' for m in damaged)
+        console.print(f'[yellow]{len(damaged)} memories carry tool-call markup '
+                      f'in their fields[/yellow] — parameters swallowed on '
+                      f'save; repair with `memgit doctor --repair-markup` '
+                      f'(dry run), then add --yes')
+        console.print('  by project: ' + ' · '.join(
+            f'{p} ({n})' for p, n in by_proj.most_common(8)))
+    else:
+        console.print('no memory carries tool-call markup in its fields')
+
     from .audit import audit as _audit
     rep = _audit(repo)
     _render_scope_losses(rep, full_audit)
@@ -2629,6 +2663,49 @@ def doctor(relabel_path, prune_slugs, clean_caches, prune_sessions,
         console.print_json(data=rep)
 
 
+def _repair_markup(repo, project, confirm) -> None:
+    """Split damaged memories back into their fields; dry run without confirm.
+
+    Covers superseded memories too: a swallowed supersedes inside one of them
+    is still a broken chain. One checkpoint for the whole repair, so a single
+    `memgit rollback` undoes it while no other save has landed since.
+    """
+    from .markup import repair
+    mems = repo.list()
+    if project is not None:
+        mems = [m for m in mems if (m.project or '') == project]
+    reps = [r for r in (repair(m) for m in mems) if r is not None]
+    fixed = [r for r in reps if r.fixed is not None]
+    failed = [r for r in reps if r.fixed is None]
+    retyped = [r for r in fixed if r.type_changed]
+    conflicts = [r for r in fixed if r.conflicts]
+    mode = 'repaired' if confirm else 'would repair'
+    console.print(f'[bold]doctor --repair-markup[/bold]  {mode} {len(fixed)} '
+                  f'memor{"ies" if len(fixed) != 1 else "y"}'
+                  + (f' in {project}' if project is not None else ''))
+    for r in retyped:
+        console.print(f'  type  {r.slug}: {r.type_changed[0]} → '
+                      f'{r.type_changed[1]}')
+    for r in conflicts:
+        console.print(f'  [yellow]merged[/yellow] {r.slug}: '
+                      + ', '.join(f'{a}→{b}' for a, b in r.conflicts)
+                      + ' held different text; both kept')
+    for r in failed:
+        console.print(f'  [red]skipped[/red] {r.slug}: '
+                      + '; '.join(r.unparsed))
+    if not fixed:
+        return
+    if not confirm:
+        console.print('[dim]dry run — nothing written; add --yes to apply[/dim]')
+        return
+    for r in fixed:
+        repo.add(r.fixed)
+    sha = repo.commit(
+        message=f'doctor: repair {len(fixed)} memories with tool-call markup '
+                'in their fields', trigger='explicit')
+    console.print(f'[green]doctor[/green]  checkpoint {(sha or "")[:8]}')
+
+
 def _render_scope_losses(rep: dict, full: bool) -> None:
     """Print the split, strand and landing-rate findings from an audit."""
     splits, stranded = rep['splits'], rep['stranded']

{memgit-0.12.0 → memgit-0.13.0}/memgit/delivery.py

@@ -31,6 +31,8 @@ from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Callable, Optional
 
+from .markup import clean_for_context
+
 MARKER_START = "<!-- MEMGIT:BEGIN -->"
 MARKER_END = "<!-- MEMGIT:END -->"
 
@@ -420,7 +422,7 @@ def compute_auto_section(repo, project, now, curated: str = "") -> str:
     ]
     total = 0
     for _score, m in candidates:
-        rule = (m.rule or "").strip()
+        rule = clean_for_context(m.rule).strip()
         line = f"- [{m.slug}] {rule[:120]}"
         if len(lines) - 2 >= _AUTO_MAX_ITEMS or total + len(line) > _AUTO_MAX_CHARS:
             break

{memgit-0.12.0 → memgit-0.13.0}/memgit/hooks.py

@@ -26,6 +26,8 @@ import sys
 from pathlib import Path
 from typing import Optional
 
+from .markup import clean_for_context
+
 # Prompts shorter than this can't carry enough signal to search on.
 MIN_PROMPT_CHARS = 20
 # BM25 score below which a match is noise, not recall (empirically, real
@@ -132,7 +134,8 @@ def prompt_recall() -> int:
     lines = ['<memgit-recall># Saved memories relevant to this request:']
     for r in results:
         m = r.mnemonic
-        rule = m.rule if len(m.rule) <= 220 else m.rule[:219] + '…'
+        rule = clean_for_context(m.rule)
+        rule = rule if len(rule) <= 220 else rule[:219] + '…'
         detail = ' (full detail: get_memory)' if m.body else ''
         # Unverified = candidate content (imported/injection-flagged): surface it
         # but never as trusted — the agent must not follow it as instruction.
@@ -231,7 +234,7 @@ def _depth_hint(results, mnemonics, seen: set[str],
     # the same state always advertises the same example.
     example = max(best_pool,
                   key=lambda m: (m.priority, len(m.rule or ''), m.slug))
-    teaser = (example.rule or '').strip().replace('\n', ' ')
+    teaser = clean_for_context(example.rule).strip().replace('\n', ' ')
     if len(teaser) > 110:
         teaser = teaser[:109] + '…'
     line = (f'- +{best_n} more saved on \'{best_tag}\', including '

{memgit-0.12.0 → memgit-0.13.0}/memgit/http_server.py

@@ -238,6 +238,11 @@ class MemgitHandler(BaseHTTPRequestHandler):
         if m:
             slug = m.group(1)
             body = self._read_body()
+            from .markup import check_save_arguments, refusal_message
+            problems = check_save_arguments(body)
+            if problems:
+                self._error(refusal_message(problems))
+                return
             rule = body.get("rule", "").strip()
             if not rule:
                 self._error("rule is required")

memgit-0.13.0/memgit/markup.py

@@ -0,0 +1,278 @@
+"""Tool-call markup that leaked into a save's field values.
+
+A model sometimes closes a save_memory value with a tag named after the field
+(`</rule>`) instead of the tool-call format's own closer. The host parser does
+not accept that as the end of the value, so the next parameter's opening tag
+and text become part of the value, and every parameter until the next closer
+it does accept never arrives as a parameter. Measured 2026-10-07 on one
+machine: 748 of 3,025 save_memory calls (24.7%), and 0 of 50,967 calls to
+every other tool in the same transcripts.
+
+The damage is silent unless something looks: the save still succeeds, the
+missing fields take their defaults, and the damaged text is injected back
+into later sessions, where it teaches the next save the same mistake.
+
+This module holds the one definition of "markup" that the save path refuses,
+the context renderers strip, and `memgit doctor --repair-markup` splits back
+into fields.
+
+What counts, outside backtick code spans (so a memory can quote the markup
+deliberately, as the lessons about this defect do):
+
+- a parameter opening tag `<parameter name="...">`, a parameter closing tag,
+  an invoke tag, or a function_calls tag, with or without a namespace prefix;
+- a closing tag named after a save_memory field (`</rule>`, `</why>`, ...)
+  when nothing but whitespace or more markup follows it. A `</body>` in the
+  middle of a note about HTML is prose, not damage.
+"""
+from __future__ import annotations
+
+import dataclasses
+import json
+import re
+from typing import Any
+
+#: Text fields of a memory, in the order save_memory declares them.
+TEXT_FIELDS = ('rule', 'why', 'when', 'body')
+#: List fields of a memory.
+LIST_FIELDS = ('tags', 'related', 'supersedes')
+#: Every argument name save_memory accepts.
+SAVE_PARAMS = frozenset(
+    ('slug', 'project', 'type_code', 'type', 'priority', 'unverified')
+    + TEXT_FIELDS + LIST_FIELDS)
+#: Names a closing tag can carry and still read as a swallowed field closer.
+#: memory_type and desc are not parameters, but models have sent both.
+_CLOSER_NAMES = sorted(SAVE_PARAMS | {'memory_type', 'desc'})
+_TYPE_CODES = ('fb', 'us', 'pj', 'rf', 'cn', 'lx', 'co', 'tr')
+
+_NS = r'(?:[A-Za-z_][\w.-]*:)?'
+# Markup that is never prose: tool-call structure itself.
+_STRUCTURAL = re.compile(
+    rf'<{_NS}parameter\s+name\s*=\s*"(?P<param>[^"]*)"\s*>'
+    rf'|</{_NS}parameter\s*>'
+    rf'|<{_NS}invoke\b[^>]*>'
+    rf'|</{_NS}invoke\s*>'
+    rf'|</?{_NS}function_calls\s*>')
+# A closer named after a field. Only damage when it ends the value or more
+# markup follows it, which the caller checks.
+_FIELD_CLOSER = re.compile(rf'</(?:{"|".join(_CLOSER_NAMES)})\s*>')
+# Only a CLOSED fence is a code span: an unclosed one (```mermaid in prose)
+# would otherwise hide every token after it.
+_CODE = re.compile(r'```.*?```|`[^`\n]*`', re.S)
+
+
+def _mask_code(text: str) -> str:
+    """Blank out backtick code spans, keeping every offset where it was."""
+    return _CODE.sub(lambda mo: ' ' * len(mo.group(0)), text)
+
+
+def _tokens(text: str) -> list[re.Match]:
+    """Markup tokens in `text`, in order, ignoring anything inside code spans.
+
+    Matches are taken against the masked copy, so their offsets index the
+    original text as well.
+    """
+    masked = _mask_code(text)
+    structural = list(_STRUCTURAL.finditer(masked))
+    starts = sorted(mo.start() for mo in structural)
+    out = list(structural)
+    for mo in _FIELD_CLOSER.finditer(masked):
+        rest = masked[mo.end():]
+        if not rest.strip():
+            out.append(mo)
+            continue
+        nxt = len(rest) - len(rest.lstrip())
+        pos = mo.end() + nxt
+        if pos in starts or _FIELD_CLOSER.match(masked, pos):
+            out.append(mo)
+    out.sort(key=lambda mo: mo.start())
+    return out
+
+
+def first_markup(text: str | None) -> int | None:
+    """Offset of the first markup token in `text`, or None when clean."""
+    if not text:
+        return None
+    toks = _tokens(text)
+    return toks[0].start() if toks else None
+
+
+def has_markup(text: str | None) -> bool:
+    return first_markup(text) is not None
+
+
+def clean_for_context(text: str | None) -> str:
+    """`text` cut at its first markup token, for injection into context.
+
+    Whatever follows the first token is the next parameter's value, which
+    belongs to another field, so cutting there leaves the field's own text.
+    Never used to rewrite the store: `memgit doctor --repair-markup` does that.
+    """
+    if not text:
+        return text or ''
+    i = first_markup(text)
+    return text if i is None else text[:i].rstrip()
+
+
+def swallowed_params(text: str | None) -> list[str]:
+    """Parameter names whose opening tag sits inside `text`, in order."""
+    if not text:
+        return []
+    names = [mo.group('param') for mo in _tokens(text)
+             if mo.re is _STRUCTURAL and mo.group('param')]
+    return list(dict.fromkeys(names))
+
+
+def check_save_arguments(arguments: dict[str, Any]) -> list[str]:
+    """Problems that make a save_memory call unsafe to store, one per field.
+
+    Empty means the values are clean. Checks every string argument and every
+    string inside a list argument, since a damaged call can push markup into
+    any of them.
+    """
+    problems: list[str] = []
+    for key, value in arguments.items():
+        values = value if isinstance(value, list) else [value]
+        for v in values:
+            if not isinstance(v, str):
+                continue
+            toks = _tokens(v)
+            if not toks:
+                continue
+            shown = ', '.join(dict.fromkeys(t.group(0) for t in toks[:3]))
+            msg = f"'{key}' contains tool-call markup ({shown})"
+            lost = [p for p in swallowed_params(v) if p != key]
+            if lost:
+                msg += ('; these parameters landed inside it instead of '
+                        'arriving: ' + ', '.join(lost))
+            problems.append(msg)
+            break
+    return problems
+
+
+def refusal_message(problems: list[str]) -> str:
+    """The error a damaged save gets back, written for the model to act on."""
+    return (
+        'save_memory refused: the arguments carry tool-call markup, so some '
+        'parameters were swallowed into another field and would have been '
+        'stored wrong. ' + ' | '.join(problems) + '. Nothing was saved. '
+        'Call save_memory again with each value passed as its own parameter, '
+        'closing every value with the parameter closing tag, never with a tag '
+        'named after the field such as </rule>. Keep rule to one sentence and '
+        'put detail in body. To quote markup on purpose, wrap it in backticks.'
+    )
+
+
+# ── repair ────────────────────────────────────────────────────────────────
+
+
+def _split(field: str, value: str) -> dict[str, str]:
+    """Split one damaged value into {parameter name: text}.
+
+    Text before the first token belongs to `field`. A parameter opening tag
+    starts a new segment under its name; an invoke or function_calls opener
+    starts the next tool call, whose text is dropped.
+    """
+    segs: dict[str, list[str]] = {}
+    cur: str | None = field
+    pos = 0
+    for mo in _tokens(value):
+        if cur:
+            segs.setdefault(cur, []).append(value[pos:mo.start()])
+        pos = mo.end()
+        tok = mo.group(0)
+        if mo.re is _STRUCTURAL and mo.group('param'):
+            cur = mo.group('param')
+        elif re.match(rf'<{_NS}(?:invoke\b|function_calls)', tok):
+            cur = None
+    if cur:
+        segs.setdefault(cur, []).append(value[pos:])
+    return {k: ''.join(v).strip() for k, v in segs.items()}
+
+
+def _as_list(text: str) -> list[str] | None:
+    try:
+        v = json.loads(text)
+    except (ValueError, TypeError):
+        return None
+    return [str(x) for x in v] if isinstance(v, list) else None
+
+
+@dataclasses.dataclass
+class Repair:
+    slug: str
+    fixed: Any = None                    # the repaired Mnemonic, or None
+    type_changed: tuple | None = None    # (old, new)
+    priority_changed: tuple | None = None
+    conflicts: list = dataclasses.field(default_factory=list)
+    unparsed: list = dataclasses.field(default_factory=list)
+
+
+def repair(m) -> Repair | None:
+    """Split a damaged memory's fields back apart. None when `m` is clean.
+
+    Swallowed text fields fill the real field when it is empty, and are
+    appended to it when both hold different text (reported as a conflict).
+    Swallowed tags, related and supersedes merge into the real lists. A
+    swallowed type_code or priority is restored. The timestamp is kept, so
+    the repair does not read as a fresh save. `fixed` is None when something
+    could not be parsed, and the reason is in `unparsed`.
+    """
+    from .sanitize import detect_injection
+
+    if not any(has_markup(getattr(m, f)) for f in TEXT_FIELDS):
+        return None
+    rep = Repair(slug=m.slug)
+    new = {f: (getattr(m, f) or '') for f in TEXT_FIELDS}
+    lists = {f: list(getattr(m, f) or []) for f in LIST_FIELDS}
+    extra: dict[str, str] = {}
+    parts = {f: _split(f, new[f]) for f in TEXT_FIELDS}
+    for f in TEXT_FIELDS:
+        new[f] = parts[f].get(f, '')
+    for f in TEXT_FIELDS:
+        for k, v in parts[f].items():
+            if k == f or not v:
+                continue
+            k = {'type': 'type_code', 'memory_type': 'type_code'}.get(k, k)
+            if k in TEXT_FIELDS:
+                if not new[k].strip():
+                    new[k] = v
+                elif v.strip() != new[k].strip():
+                    rep.conflicts.append((f, k))
+                    new[k] = (new[k].rstrip() + '\n\n' + v).strip()
+            elif k in LIST_FIELDS:
+                lv = _as_list(v)
+                if lv is None:
+                    rep.unparsed.append(f'{k} is not a JSON list: {v[:60]!r}')
+                else:
+                    lists[k] = list(dict.fromkeys(lists[k] + lv))
+            else:
+                extra[k] = v
+    tc, pr = m.type_code, m.priority
+    if extra.get('type_code') in _TYPE_CODES and extra['type_code'] != tc:
+        rep.type_changed = (tc, extra['type_code'])
+        tc = extra['type_code']
+    if extra.get('priority', '').strip() in ('1', '2', '3'):
+        p = int(extra['priority'])
+        if p != pr:
+            rep.priority_changed = (pr, p)
+            pr = p
+    still = [f for f in TEXT_FIELDS if has_markup(new[f])]
+    if still:
+        rep.unparsed.append('markup remains in ' + ', '.join(still))
+    if not new['rule'].strip():
+        rep.unparsed.append('rule would be empty')
+    if rep.unparsed:
+        return rep
+    unv = m.unverified
+    # The detector may have flagged the merged blob; judge the clean text.
+    if unv and not detect_injection(new['rule'], new['body']):
+        unv = False
+    rep.fixed = dataclasses.replace(
+        m, type_code=tc, priority=pr, unverified=unv, sha=None,
+        rule=new['rule'],
+        why=new['why'] or None, when=new['when'] or None,
+        body=new['body'] or None,
+        tags=lists['tags'], related=lists['related'],
+        supersedes=lists['supersedes'])
+    return rep

{memgit-0.12.0 → memgit-0.13.0}/memgit/mcp_server.py

@@ -16,6 +16,7 @@ from mcp.types import (
 )
 
 from . import __version__
+from .markup import clean_for_context, has_markup
 from .models import Mnemonic
 from .repo import Repository
 from .scorer import score as bm25_score
@@ -80,6 +81,11 @@ _TYPE_DESCRIPTIONS = (
 
 _TYPE_ENUM = ["fb", "us", "pj", "rf", "cn", "lx", "co", "tr"]
 
+#: A rule longer than this draws a warning on save. The schema asks for about
+#: 200; on 2026-10-07 the median clean rule was 306 characters and the median
+#: rule damaged by swallowed parameters was 992.
+_RULE_WARN_CHARS = 400
+
 
 def _default_store() -> Path:
     from .repo import default_store_candidates
@@ -122,16 +128,20 @@ def _load_repo(store_path: Path | None) -> Repository | None:
 
 def _mnem_to_dict(m: Mnemonic, score: float | None = None,
                   include_body: bool = False) -> dict[str, Any]:
+    # Tool-call markup inside a stored field is the residue of a save whose
+    # parameters were swallowed. Serving it back teaches the next save the
+    # same mistake, so reads carry the field's own text and a flag instead.
+    damaged = any(has_markup(getattr(m, f)) for f in ("rule", "why", "when", "body"))
     d: dict[str, Any] = {
         "slug": m.slug,
         "type": m.type_code,
         "priority": m.priority,
-        "rule": m.rule,
+        "rule": clean_for_context(m.rule),
     }
     if m.why:
-        d["why"] = m.why
+        d["why"] = clean_for_context(m.why)
     if m.when:
-        d["when"] = m.when
+        d["when"] = clean_for_context(m.when)
     if m.tags:
         d["tags"] = m.tags
     if m.desc:
@@ -142,8 +152,11 @@ def _mnem_to_dict(m: Mnemonic, score: float | None = None,
         # surface candidate status on read so the agent knows not to trust it
         # blindly (and can promote it with verify_memory)
         d["unverified"] = True
+    if damaged:
+        d["damaged"] = ("fields were stored with swallowed parameters; shown "
+                        "cut at the damage. Repair: memgit doctor --repair-markup")
     if include_body and m.body:
-        d["body"] = m.body
+        d["body"] = clean_for_context(m.body)
     elif m.body:
         d["has_body"] = True  # full detail available via get_memory
     if score is not None:
@@ -730,7 +743,8 @@ def run_server(store_path: Path | None = None) -> None:
 
             lines = [f"# {len(mnemonics)} memories"]
             for m in mnemonics:
-                rule_preview = m.rule[:80] + ".." if len(m.rule) > 80 else m.rule
+                shown = clean_for_context(m.rule)
+                rule_preview = shown[:80] + ".." if len(shown) > 80 else shown
                 proj = f" {m.project}" if m.project else ""
                 sup = (f" ⊘superseded-by:{resolve_head(m.slug, all_mems)}"
                        if m.slug in hidden else "")
@@ -739,16 +753,37 @@ def run_server(store_path: Path | None = None) -> None:
             return [TextContent(type="text", text="\n".join(lines))]
 
         elif name == "save_memory":
-            slug = arguments.get("slug", "").strip()
-            rule = arguments.get("rule", "").strip()
+            # Refuse before anything else when a value carries tool-call
+            # markup: the parameters after it were swallowed into that value
+            # and would be stored as defaults. Raising marks the result
+            # isError, so the model retries the call in the same turn.
+            from .markup import (SAVE_PARAMS, check_save_arguments,
+                                 refusal_message)
+            problems = check_save_arguments(arguments)
+            if problems:
+                raise ValueError(refusal_message(problems))
+
+            slug = (arguments.get("slug") or "").strip()
+            rule = (arguments.get("rule") or "").strip()
 
             if not slug or not rule:
-                return [TextContent(type="text", text="Error: slug and rule are required.")]
+                missing = [k for k, v in (("slug", slug), ("rule", rule)) if not v]
+                return [TextContent(type="text", text=(
+                    "Error: slug and rule are required (missing: "
+                    + ", ".join(missing) + "; arguments received: "
+                    + ", ".join(sorted(arguments)) + ")."))]
 
             # Accept "type" as an alias: read surfaces return the field as
             # "type", so an operator mirroring get_memory output naturally
             # passes it back under that name.
-            type_code = arguments.get("type_code") or arguments.get("type") or "fb"
+            defaulted: list[str] = []
+            type_code = arguments.get("type_code") or arguments.get("type")
+            if not type_code:
+                type_code = "fb"
+                defaulted.append("type_code")
+            if "priority" not in arguments:
+                defaulted.append("priority")
+            unknown_args = sorted(k for k in arguments if k not in SAVE_PARAMS)
             why = arguments.get("why")
             when = arguments.get("when")
             body = arguments.get("body")
@@ -891,6 +926,40 @@ def run_server(store_path: Path | None = None) -> None:
                         "high-authority injection until you confirm it with "
                         "verify_memory."
                     )
+            # Echo what was stored, so a call that lost fields on the way in
+            # is visible in the answer rather than only in the store.
+            out["stored"] = {
+                "rule_chars": len(rule),
+                "why_chars": len(why or ""),
+                "when_chars": len(when or ""),
+                "body_chars": len(body or ""),
+                "tags": len(m.tags),
+            }
+            empty = [f for f, v in (("why", why), ("when", when),
+                                    ("body", body)) if not (v or "").strip()]
+            if not m.tags:
+                empty.append("tags")
+            if empty:
+                out["stored"]["empty"] = empty
+            if defaulted:
+                out["defaulted"] = defaulted
+            if "type_code" in defaulted:
+                warnings.append(
+                    "no type_code arrived, so this was stored as 'fb' "
+                    "(feedback). If it is a project fact, lesson, tracker or "
+                    "anything else, save it again with type_code set.")
+            if unknown_args:
+                warnings.append(
+                    "ignored unknown argument(s): " + ", ".join(unknown_args)
+                    + ". save_memory takes type_code (or type), not "
+                    "memory_type; anything else here may mean two tool calls "
+                    "were merged into one.")
+            if len(rule) > _RULE_WARN_CHARS:
+                warnings.append(
+                    f"rule is {len(rule)} characters; it is shown in every "
+                    "search result and digest, so keep it to one sentence "
+                    f"(about 200, at most {_RULE_WARN_CHARS}) and move the "
+                    "detail to body.")
             if warnings:
                 out["warnings"] = warnings
             return [TextContent(type="text", text=json.dumps(out, indent=2))]

{memgit-0.12.0 → memgit-0.13.0}/memgit/repo.py

@@ -15,6 +15,7 @@ from typing import Optional
 from .models import (
     Checkpoint, DiffSummary, MindState, MindStateEntry, Mnemonic, Thread,
 )
+from .markup import clean_for_context
 from .store import ObjectStore, object_cache as _object_cache
 
 
@@ -1138,8 +1139,8 @@ class Repository:
         else:
             tracker_pool = [m for m in mnemonics if not m.project]
         trackers = [
-            {'slug': m.slug, 'rule': m.rule, 'timestamp': m.timestamp,
-             'tags': m.tags}
+            {'slug': m.slug, 'rule': clean_for_context(m.rule),
+             'timestamp': m.timestamp, 'tags': m.tags}
             for m in sorted((m for m in tracker_pool
                              if m.type_code == 'tr' and not m.unverified),
                             key=lambda m: m.timestamp, reverse=True)
@@ -1150,7 +1151,8 @@ class Repository:
         # to confirm) but tags them, so they're never mistaken for trusted state.
         recent_mems = [
             {'slug': m.slug, 'type': m.type_code, 'priority': m.priority,
-             'timestamp': m.timestamp, 'rule': m.rule, 'project': m.project,
+             'timestamp': m.timestamp, 'rule': clean_for_context(m.rule),
+             'project': m.project,
              'unverified': m.unverified}
             for m in pool if m.slug not in tracker_slugs
         ][:recent]
@@ -1163,7 +1165,7 @@ class Repository:
                 if not m.project or project_affinity(m.project, project) >= 1
             ]
         critical = [
-            {'slug': m.slug, 'rule': m.rule}
+            {'slug': m.slug, 'rule': clean_for_context(m.rule)}
             for m in sorted(critical_pool, key=lambda m: m.slug)
             if m.priority == 3 and not m.unverified   # candidates never "always apply"
         ]
@@ -1181,7 +1183,8 @@ class Repository:
         else:
             core_pool = [m for m in mnemonics if not m.project]
         core = [
-            {'slug': m.slug, 'rule': m.rule, 'body': m.body}
+            {'slug': m.slug, 'rule': clean_for_context(m.rule),
+             'body': clean_for_context(m.body) or None}
             for m in sorted(core_pool, key=lambda m: m.slug)
             if m.type_code == 'co' and not m.unverified   # never inject unverified guidance
         ]

{memgit-0.12.0 → memgit-0.13.0}/memgit.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: memgit
-Version: 0.12.0
+Version: 0.13.0
 Summary: Git for AI memory — version-controlled context persistence across Claude, GPT, Gemini, Cursor, Windsurf, and more
 License: MIT
 Project-URL: Homepage, https://memgit.dev
@@ -284,6 +284,8 @@ Once registered via MCP, every AI tool gets 6 tools:
 
 The tool descriptions teach the AI **judgment** — "does this request depend on state you don't have in context?" — rather than keyword triggers. Measured cost of the whole tool surface: ~1,150 tokens once per session; a `resume_session` reply is ~335.
 
+**A save that arrives damaged is refused, not stored** (v0.13.0). A model sometimes closes a value with a tag named after the field (`</rule>`), and the host then delivers the next parameters inside that value: `why`, `when`, `tags` and `type_code` never arrive, and the memory is stored with defaults. On one machine that was 748 of 3,025 saves. `save_memory` now refuses any value carrying tool-call markup, names the field and the parameters it swallowed, and the model retries in the same turn. Markup quoted on purpose inside backticks is allowed. Every successful save echoes the length of each field it stored, which fields arrived empty, and which values came from a default. Damaged memories already in a store are never served back into context: the digest, the recall hook and read results show each field cut at the damage. `memgit doctor` counts them, and `memgit doctor --repair-markup` splits them back into their fields.
+
 ---
 
 ## Core operating guide (v0.5.0)
@@ -415,6 +417,8 @@ memgit doctor                     # hygiene + scope losses: split labels, quaran
 memgit doctor --audit             # every split and stranded label, the save landing rate, throughput
 memgit doctor --audit --json      # the same report as JSON
 memgit doctor --relabel map.json  # bulk re-project memories ({"slug": "Label" | ""}); one checkpoint
+memgit doctor --repair-markup     # dry run: memories whose fields swallowed other parameters on save
+memgit doctor --repair-markup --yes [--project LABEL]   # split them back into their fields; one checkpoint
 memgit lint                       # validate all memories (flags unknown provenance)
 memgit fsck                       # verify store integrity
 

{memgit-0.12.0 → memgit-0.13.0}/memgit.egg-info/SOURCES.txt

@@ -15,6 +15,7 @@ memgit/http_server.py
 memgit/importer.py
 memgit/license.py
 memgit/links.py
+memgit/markup.py
 memgit/mcp_server.py
 memgit/metrics.py
 memgit/models.py
@@ -54,6 +55,7 @@ tests/test_env_inventory.py
 tests/test_git_args.py
 tests/test_license.py
 tests/test_lock_exclusion.py
+tests/test_markup.py
 tests/test_org.py
 tests/test_savings.py
 tests/test_server_lifecycle.py

{memgit-0.12.0 → memgit-0.13.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "memgit"
-version = "0.12.0"
+version = "0.13.0"
 description = "Git for AI memory — version-controlled context persistence across Claude, GPT, Gemini, Cursor, Windsurf, and more"
 readme = "README.md"
 requires-python = ">=3.11"

memgit-0.13.0/tests/test_markup.py

@@ -0,0 +1,233 @@
+"""save_memory values that carry tool-call markup.
+
+Every fixture shape below is one measured on 2026-10-07 in a live store, where
+748 of 3,025 save_memory calls arrived with the parameters after one field
+swallowed into it. The save path must refuse each of them, the read and
+injection surfaces must not serve the markup back, and doctor must split a
+stored one back into its fields.
+"""
+import asyncio
+import json
+from datetime import datetime, timezone
+
+import pytest
+from click.testing import CliRunner
+from mcp import types
+
+from memgit import markup
+from memgit.models import Mnemonic
+from memgit.repo import Repository
+
+P = '<parameter name="{}">'
+END = '</parameter>'
+
+#: (field, damaged value, parameters it swallowed), one per measured shape.
+SHAPES = [
+    ('rule', 'X is true.</rule>\n' + P.format('why') + 'because Y', ['why']),
+    ('rule', 'X is true.</rule>\n' + P.format('type_code') + 'pj', ['type_code']),
+    ('rule', 'X is true.</rule>\n' + P.format('why') + 'because Y</why>\n'
+     + P.format('when') + 'always', ['why', 'when']),
+    ('body', 'Long detail here.</body>\n', []),
+    ('rule', 'X is true.' + END + '\n' + P.format('why') + 'because Y', ['why']),
+    ('why', 'because Y' + END + '\n' + P.format('when') + 'always', ['when']),
+    ('rule', 'X is true.</rule>\n' + P.format('why') + 'Y' + END + '\n'
+     + P.format('when') + 'W' + END + '\n' + P.format('body') + 'B' + END
+     + '\n' + P.format('tags') + '["a", "b"]', ['why', 'when', 'body', 'tags']),
+    ('why', 'because Y</why>\n' + P.format('when') + 'always' + END + '\n'
+     + P.format('tags') + '["a"]', ['when', 'tags']),
+    # the start of the next tool call, and namespaced markup
+    ('rule', 'X is true.' + END + '\n</invoke>\n<invoke name="ToolSearch">', []),
+    ('rule', 'X.</ns:parameter>\n<ns:parameter name="why">Y', ['why']),
+    # an unclosed fence in prose must not hide the damage after it
+    ('rule', 'Outline renders ```mermaid blocks.' + END + '\n'
+     + P.format('why') + 'Y', ['why']),
+]
+
+
+@pytest.fixture
+def server(tmp_path, monkeypatch):
+    """The real MCP server with its handlers registered, never run on stdio."""
+    from memgit import mcp_server
+    store = tmp_path / 'store'
+    store.mkdir()
+    Repository.init(store)
+    holder = {}
+
+    class Capture(mcp_server.Server):
+        def __init__(self, *a, **k):
+            super().__init__(*a, **k)
+            holder['s'] = self
+
+    monkeypatch.setattr(mcp_server, 'Server', Capture)
+    monkeypatch.setattr(asyncio, 'run', lambda coro: coro.close())
+    monkeypatch.setenv('MEMGIT_PROJECT', 'proj')
+    mcp_server.run_server(store)
+    srv = holder['s']
+
+    def call(arguments):
+        req = types.CallToolRequest(
+            method='tools/call',
+            params=types.CallToolRequestParams(name='save_memory',
+                                               arguments=arguments))
+        loop = asyncio.new_event_loop()
+        try:
+            res = loop.run_until_complete(
+                srv.request_handlers[types.CallToolRequest](req)).root
+        finally:
+            loop.close()
+        return res.isError, res.content[0].text
+
+    call.repo = lambda: Repository(store / '.memgit')
+    return call
+
+
+@pytest.fixture
+def repo(tmp_path):
+    store = tmp_path / 'r'
+    store.mkdir()
+    return Repository.init(store)
+
+
+class TestDetector:
+    @pytest.mark.parametrize('field,value,lost', SHAPES)
+    def test_every_measured_shape_is_markup(self, field, value, lost):
+        assert markup.has_markup(value)
+        assert [p for p in markup.swallowed_params(value) if p != field] == lost
+
+    @pytest.mark.parametrize('text', [
+        'Quote it in code: `</rule><parameter name="why">` is the defect.',
+        'Inject the script before </body> in the template, then reload.',
+        'The closing tag </rule> is prose here and continues afterwards.',
+        '```\n</rule>\n<parameter name="why">x\n```',
+        'Plain text with <b>html</b> and a <div> or two.',
+        '',
+    ])
+    def test_prose_and_quoted_markup_are_not(self, text):
+        assert not markup.has_markup(text)
+
+    def test_clean_for_context_cuts_at_the_damage(self):
+        assert markup.clean_for_context(SHAPES[0][1]) == 'X is true.'
+        assert markup.clean_for_context('fine') == 'fine'
+        assert markup.clean_for_context(None) == ''
+
+
+class TestSaveRefuses:
+    @pytest.mark.parametrize('field,value,lost', SHAPES)
+    def test_damaged_save_is_refused_and_nothing_is_stored(
+            self, server, field, value, lost):
+        args = {'slug': 'damaged', 'rule': 'a clean rule', 'type_code': 'pj'}
+        args[field] = value
+        is_error, text = server(args)
+        assert is_error
+        assert 'refused' in text and f"'{field}'" in text
+        for p in lost:
+            assert p in text
+        assert server.repo().get('damaged') is None
+
+    def test_markup_inside_a_tag_is_refused(self, server):
+        is_error, _ = server({'slug': 's', 'rule': 'r', 'type_code': 'pj',
+                              'tags': ['ok', 'x</tags>\n' + P.format('why')]})
+        assert is_error
+
+    def test_quoted_markup_saves(self, server):
+        is_error, text = server({
+            'slug': 'lesson', 'type_code': 'lx', 'tags': ['memgit'],
+            'rule': 'A save leaked `</rule><parameter name="why">` into rule.'})
+        assert not is_error
+        assert json.loads(text)['status'] == 'ok'
+
+
+class TestSaveEchoes:
+    def test_clean_save_reports_what_was_stored(self, server):
+        _, text = server({'slug': 'a', 'rule': 'r', 'type_code': 'pj',
+                          'priority': 2, 'why': 'w', 'when': 'n',
+                          'body': 'b', 'tags': ['t']})
+        out = json.loads(text)
+        assert out['stored'] == {'rule_chars': 1, 'why_chars': 1,
+                                 'when_chars': 1, 'body_chars': 1, 'tags': 1}
+        assert 'defaulted' not in out and 'warnings' not in out
+
+    def test_missing_type_and_fields_are_named(self, server):
+        out = json.loads(server({'slug': 'b', 'rule': 'r'})[1])
+        assert out['type'] == 'fb'
+        assert out['defaulted'] == ['type_code', 'priority']
+        assert out['stored']['empty'] == ['why', 'when', 'body', 'tags']
+        assert any("stored as 'fb'" in w for w in out['warnings'])
+
+    def test_unknown_argument_is_warned(self, server):
+        out = json.loads(server({'slug': 'c', 'rule': 'r', 'type_code': 'pj',
+                                 'memory_type': 'pj'})[1])
+        assert any('memory_type' in w for w in out['warnings'])
+
+    def test_long_rule_is_warned(self, server):
+        out = json.loads(server({'slug': 'd', 'rule': 'x' * 401,
+                                 'type_code': 'pj'})[1])
+        assert any('401 characters' in w for w in out['warnings'])
+
+
+def _stored(repo, **kw):
+    base = dict(type_code='fb', slug='m', rule='r', priority=2,
+                timestamp=datetime(2026, 9, 20, tzinfo=timezone.utc),
+                project='proj')
+    base.update(kw)
+    m = Mnemonic(**base)
+    repo.add(m)
+    repo.commit(message='seed', trigger='explicit')
+    return m
+
+
+class TestRepair:
+    def test_splits_fields_lists_and_type(self, repo):
+        rule = ('FINAL timesheet: 43.0 hours.</rule>\n' + P.format('type_code')
+                + 'pj' + END + '\n' + P.format('why') + 'rebuilt' + END + '\n'
+                + P.format('tags') + '["ofo", "timesheet"]' + END + '\n'
+                + P.format('supersedes') + '["old-sheet"]')
+        _stored(repo, rule=rule, tags=['kept'])
+        rep = markup.repair(repo.get('m'))
+        f = rep.fixed
+        assert f.rule == 'FINAL timesheet: 43.0 hours.'
+        assert f.type_code == 'pj' and rep.type_changed == ('fb', 'pj')
+        assert f.why == 'rebuilt'
+        assert f.tags == ['kept', 'ofo', 'timesheet']
+        assert f.supersedes == ['old-sheet']
+        assert f.timestamp == datetime(2026, 9, 20, tzinfo=timezone.utc)
+
+    def test_drops_the_next_tool_call(self, repo):
+        _stored(repo, rule='X.' + END + '\n</invoke>\n<invoke name="Bash">'
+                + P.format('command') + 'ls')
+        f = markup.repair(repo.get('m')).fixed
+        assert f.rule == 'X.' and f.why is None
+
+    def test_stray_body_closer(self, repo):
+        _stored(repo, body='Detail.</body>\n')
+        assert markup.repair(repo.get('m')).fixed.body == 'Detail.'
+
+    def test_clean_memory_is_left_alone(self, repo):
+        _stored(repo, rule='Quoting `</rule>` is fine.')
+        assert markup.repair(repo.get('m')) is None
+
+    def test_doctor_dry_run_then_apply(self, repo, tmp_path, monkeypatch):
+        from memgit.cli import cli
+        _stored(repo, rule='X.</rule>\n' + P.format('why') + 'Y')
+        monkeypatch.chdir(tmp_path / 'r')
+        monkeypatch.setenv('MEMGIT_STORE', str(tmp_path / 'r'))
+        r = CliRunner().invoke(cli, ['doctor'])
+        assert '1 memories carry tool-call markup' in r.output
+        r = CliRunner().invoke(cli, ['doctor', '--repair-markup'])
+        assert 'would repair 1' in r.output
+        assert repo.get('m').rule.startswith('X.</rule>')
+        r = CliRunner().invoke(cli, ['doctor', '--repair-markup', '--yes'])
+        assert 'repaired 1' in r.output, r.output
+        m = repo.get('m')
+        assert (m.rule, m.why) == ('X.', 'Y')
+
+
+class TestContextNeverServesMarkup:
+    def test_resume_digest_and_recall_are_clean(self, repo):
+        damaged = 'Always X.</rule>\n' + P.format('why') + 'Y'
+        _stored(repo, slug='crit', rule=damaged, priority=3)
+        _stored(repo, slug='trk', rule=damaged, type_code='tr')
+        ctx = repo.resume_context(project='proj')
+        blob = json.dumps(ctx, default=str)
+        assert '<parameter' not in blob and '</rule>' not in blob
+        assert 'Always X.' in blob