Recall folds each retrieved item with NFKC (bounded, never throws) and screens the folded text, so fullwidth, circled, mathematical and ligature spellings of an injection phrase or a secret are dropped. Structured fields are judged as name=value pairs with the guard's extras(). The shared screen region is untouched.
Co-Authored-By: RuFlo <ruv@ruv.net>
The guard saw only inputPath. It now stats then reads the file (regular, 1 MB max, under the project root or home, no traversal) and screens it; it fails open on any problem.
Co-Authored-By: RuFlo <ruv@ruv.net>
Verified the claim-10 tools against the MCP registry schemas: agentdb_feedback
(patterns[]), agentdb_session-end (summary), hive-mind_memory (value) and
session_save (description) persist free text, so they join WRITERS.
memory_import (file path), rvf_ingest and hooks_compress_store (vectors) take no
text and stay unguarded.
Co-Authored-By: RuFlo <ruv@ruv.net>
The walker dropped input past its node, character and per-string budgets
silently, so 32 guards passed a secret placed after the cap. textsOf now
appends a TRUNCATED marker; names/hasSecretIn treat it as a finding. Regenerated
the 38 copies, bumped the 39 plugins, emptied the known-holes baseline.
Co-Authored-By: RuFlo <ruv@ruv.net>
Extend scripts/sync-mod-screen.mjs to a second kit: the flag() helper in hooks/options.ts of 38 mods now sits between SHARED FLAG markers and is
rewritten/checked from ruflo-agentdb. Drift, a lost marker or zero copies fails --check. Bump the 39 touched plugin versions and their version pins.
Co-Authored-By: RuFlo <ruv@ruv.net>
Run against a real initialised AgentDB with real MCP servers and headless haiku
(v3/docs/validation/agentdb-recall-live-2026-10.md, scripts/live-agentdb-recall.sh).
Defects found by the live run and fixed:
- status.json only flushed on attach/block: skipped, timed-out, cached and error
counters were invisible; add lastReader and lastError
- a permission-refused or failing reader call was swallowed and read as "nothing
relevant"; now counted in errors/lastError
- memory_search (the only semantic reader) was never used; it is now the first
reader, whole prompt only, and its 60-character value cut is completed with
memory_retrieve before the screen and the frame
- ruvector scores arrive as strings and are noise (-0.10..0.10); read numeric
strings and skip results scoring under 0.25
- an all-unsafe answer ended the search, hiding a clean memory behind a poisoned
one; the walk continues and dropped counts each note once
- readers were cached even when none was connected
- add directed-at-the-assistant phrasing rules (plugin-local): haiku followed 6 of
10 injected directives that passed the shared screen, whatever the frame said
41 plugin tests (was 26), smoke 19/19, claude plugin validate passes.
Co-Authored-By: RuFlo <ruv@ruv.net>
One canonical region in ruflo-agentdb/hooks/screen.ts, regenerated into the 37 copies by sync-mod-screen.mjs. 'key assignment' is now decided by
the value (not a call/env/path/placeholder/UUID/name; two character classes; >=2.5 bits entropy). Adds stripe, npm, huggingface, sendgrid, twilio,
slack webhook and credentialed DB URL rules; bearer and DB URL placeholders are rejected. 40 new agentdb tests; 20 KB ReDoS probe 0.57 -> 0.68 ms.
Co-Authored-By: RuFlo <ruv@ruv.net>
Opt-in safe recall into the prompt (per-prompt context, deadline-bounded, screened as
untrusted), a write guard that keeps secrets out of memory, /agentdb, a status file.
Plugin 0.4.0; 20 hook/unit tests; bench; smoke steps M1-M3.
Co-Authored-By: RuFlo <ruv@ruv.net>
ruv