Description

filterLiveShortTermRecallEntries calls shortTermRecallSourceExists, which resolves filesystem paths from entry.path and checks them with fs.stat().

• entry.path originates from stored short-term recall entries (readShortTermRecallEntries) and is only normalized by replacing \\ with / and stripping a leading ./.
• resolveShortTermSourcePathCandidates() then uses path.resolve(workspaceDir, relativePath) on this untrusted/unchecked path.
• If an attacker can influence the recall store JSON or the upstream result.path used to populate it, they can supply traversal such as memory/../../../../etc/passwd (or absolute paths), causing path.resolve() to escape workspaceDir.
• The new code introduces an existence oracle (fs.stat) during dreaming runs; additionally, the same resolver is also used by rehydratePromotionCandidate() which performs fs.readFile() on the resolved path (turning traversal into arbitrary file read in that code path).

Vulnerable code:

const absolutePath = path.resolve(workspaceDir, relativePath);
const stat = await fs.stat(sourcePath);

Recommendation

Constrain resolved paths to an allowed root (e.g., <workspaceDir>/memory) and reject traversal/absolute inputs.

Example fix:

function resolveShortTermSourcePathCandidates(workspaceDir: string, candidatePath: string): string[] {
  const normalized = normalizeMemoryPath(candidatePath);

  ​// Reject absolute paths and any path with traversal segments
  const posix = path.posix.normalize(normalized);
  if (path.posix.isAbsolute(posix) || posix.split("/").includes("..")) {
    return [];
  }

  const allowedRoot = path.resolve(workspaceDir, "memory");
  const candidates = [posix.startsWith("memory/") ? posix : path.posix.join("memory", path.posix.basename(posix))];

  const resolved: string[] = [];
  for (const rel of candidates) {
    const abs = path.resolve(workspaceDir, rel);
    ​// Enforce containment within allowedRoot
    if (abs === allowedRoot || abs.startsWith(allowedRoot + path.sep)) {
      resolved.push(abs);
    }
  }
  return [...new Set(resolved)];
}

Also consider validating/sanitizing result.path at ingestion time (recordShortTermRecalls) and/or when loading the store (readStore) so malicious entries cannot persist.

Description

filterLiveShortTermRecallEntries checks whether each short-term recall entry’s source file still exists by running filesystem stats for every entry concurrently via Promise.all.

Because runLightDreaming/runRemDreaming call this before applying the configured limit, a large short-term recall store (potentially attacker-inflated via repeated recalls or large workspaces) can trigger N concurrent fs.stat operations on every dreaming run. This can:

• exhaust file descriptors / libuv threadpool
• saturate disk / network-mounted filesystem I/O
• block other extension operations (availability impact)

Vulnerable code:

const results = await Promise.all(
  params.entries.map(async (entry) => ({
    entry,
    exists: await shortTermRecallSourceExists({ workspaceDir: params.workspaceDir, entry }),
  })),
);

The risk is amplified because dreaming can be triggered on heartbeat (see runPhaseIfTriggered), allowing repeated invocations.

Recommendation

Add a concurrency limit (and ideally also a max-entry cap) for filesystem existence checks.

Example using p-limit:

import pLimit from "p-limit";

export async function filterLiveShortTermRecallEntries(params: {
  workspaceDir: string;
  entries: ShortTermRecallEntry[];
}): Promise<ShortTermRecallEntry[]> {
  const limit = pLimit(20); // tune based on environment

  const results = await Promise.all(
    params.entries.map((entry) =>
      limit(async () => ({
        entry,
        exists: await shortTermRecallSourceExists({ workspaceDir: params.workspaceDir, entry }),
      })),
    ),
  );

  return results.filter((r) => r.exists).map((r) => r.entry);
}

Additionally, consider:

• applying slice(0, config.limit) (or another upper bound) before doing existence checks in dreaming phases
• adding rate limiting/debouncing for heartbeat-triggered dreaming runs

Description

filterLiveShortTermRecallEntries calls shortTermRecallSourceExists, which resolves filesystem paths from ShortTermRecallEntry.path and executes fs.stat() on them.

Problems introduced/expanded by this change:

• Path traversal / workspace escape: normalizeMemoryPath() does not remove .. segments, and isShortTermMemoryPath() matches any string containing /memory/<date>.md (not necessarily starting at workspace root). A crafted entry path like ../../memory/2024-01-01.md passes validation, and path.resolve(workspaceDir, relativePath) will resolve outside workspaceDir.
• Availability (DoS) via rethrow: when fs.stat() hits non-ENOENT errors (e.g. EACCES, EPERM, ENOTDIR), the code rethrows, aborting the dreaming phase. The top-level dreaming runner logs the error, so a single crafted/bad entry can repeatedly break automated dreaming.
• Potential internal path disclosure: the thrown error message from fs.stat() commonly includes the attempted absolute path, and is logged via formatErrorMessage(err) in the dreaming runner.

Vulnerable code:

const absolutePath = path.resolve(workspaceDir, relativePath);
...
const stat = await fs.stat(sourcePath);
...
if ((err as NodeJS.ErrnoException).code === "ENOENT") continue;
throw err;

Recommendation

Harden path handling and make existence checks non-fatal.

1. Reject absolute paths and any path containing .. segments, and require the path to be under the intended memory root.
2. Ensure resolved paths stay within workspaceDir before touching the filesystem.
3. Treat common filesystem errors (EACCES, EPERM, ENOTDIR) as non-fatal (return false / skip) to avoid crashing dreaming.

Example fix:

function safeResolveWithinWorkspace(workspaceDir: string, rel: string): string | null {
  const normalized = rel.replaceAll("\\", "/");
  if (!normalized || path.posix.isAbsolute(normalized)) return null;
  const posixNorm = path.posix.normalize(normalized);
  if (posixNorm.startsWith("../") || posixNorm === ".." || posixNorm.includes("/../")) return null;

  const abs = path.resolve(workspaceDir, posixNorm);
  const ws = path.resolve(workspaceDir) + path.sep;
  if (!abs.startsWith(ws)) return null;
  return abs;
}

​// in shortTermRecallSourceExists
const abs = safeResolveWithinWorkspace(workspaceDir, relativePath);
if (!abs) continue;
try {
  const stat = await fs.stat(abs);
  if (stat.isFile()) return true;
} catch (err) {
  const code = (err as NodeJS.ErrnoException)?.code;
  if (code === "ENOENT" || code === "EACCES" || code === "EPERM" || code === "ENOTDIR") continue;
  return false; // or log debug and continue
}

Also consider validating/sanitizing ShortTermRecallEntry.path at ingestion time when reading/parsing the JSON store.