fix: comprehensive security and reliability audit

src/config.ts

@@ -8,6 +8,12 @@ import type {
   FallbackConfig,
 } from "./types.js";
 
+function safeParseInt(value: string | undefined, fallback: number): number {
+  if (!value) return fallback;
+  const parsed = parseInt(value, 10);
+  return Number.isNaN(parsed) ? fallback : parsed;
+}
+
 const DATA_DIR = join(homedir(), ".agentmemory");
 const ENV_FILE = join(DATA_DIR, ".env");
 
@@ -71,14 +77,11 @@ export function loadConfig(): AgentMemoryConfig {
 
   return {
     engineUrl: env["III_ENGINE_URL"] || "ws://localhost:49134",
-    restPort: parseInt(env["III_REST_PORT"] || "3111", 10),
-    streamsPort: parseInt(env["III_STREAMS_PORT"] || "3112", 10),
+    restPort: parseInt(env["III_REST_PORT"] || "3111", 10) || 3111,
+    streamsPort: parseInt(env["III_STREAMS_PORT"] || "3112", 10) || 3112,
     provider,
-    tokenBudget: parseInt(env["TOKEN_BUDGET"] || "2000", 10),
-    maxObservationsPerSession: parseInt(
-      env["MAX_OBS_PER_SESSION"] || "500",
-      10,
-    ),
+    tokenBudget: safeParseInt(env["TOKEN_BUDGET"], 2000),
+    maxObservationsPerSession: safeParseInt(env["MAX_OBS_PER_SESSION"], 500),
     compressionModel: provider.model,
     dataDir: DATA_DIR,
   };

src/functions/auto-forget.ts

@@ -52,9 +52,13 @@ export function registerAutoForgetFunction(sdk: ISdk, kv: StateKV): void {
         }
       }
 
-      const latestMemories = memories.filter(
-        (m) => m.isLatest !== false && !deletedIds.has(m.id),
-      );
+      const latestMemories = memories
+        .filter((m) => m.isLatest !== false && !deletedIds.has(m.id))
+        .sort(
+          (a, b) =>
+            new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime(),
+        )
+        .slice(0, 1000);
       for (let i = 0; i < latestMemories.length; i++) {
         for (let j = i + 1; j < latestMemories.length; j++) {
           const sim = jaccardSimilarity(

src/functions/compress.ts

@@ -175,7 +175,7 @@ export function registerCompressFunction(
           obsId: data.observationId,
           error: msg,
         });
-        return { success: false, error: msg };
+        return { success: false, error: "compression_failed" };
       }
     },
   );

src/functions/export-import.ts

@@ -85,6 +85,76 @@ export function registerExportImportFunction(sdk: ISdk, kv: StateKV): void {
         };
       }
 
+      const MAX_SESSIONS = 10_000;
+      const MAX_MEMORIES = 50_000;
+      const MAX_SUMMARIES = 10_000;
+      const MAX_OBS_PER_SESSION = 5_000;
+      const MAX_TOTAL_OBSERVATIONS = 500_000;
+
+      if (!Array.isArray(importData.sessions)) {
+        return { success: false, error: "sessions must be an array" };
+      }
+      if (!Array.isArray(importData.memories)) {
+        return { success: false, error: "memories must be an array" };
+      }
+      if (!Array.isArray(importData.summaries)) {
+        return { success: false, error: "summaries must be an array" };
+      }
+      if (
+        typeof importData.observations !== "object" ||
+        importData.observations === null ||
+        Array.isArray(importData.observations)
+      ) {
+        return { success: false, error: "observations must be an object" };
+      }
+
+      if (importData.sessions.length > MAX_SESSIONS) {
+        return {
+          success: false,
+          error: `Too many sessions (max ${MAX_SESSIONS})`,
+        };
+      }
+      if (importData.memories.length > MAX_MEMORIES) {
+        return {
+          success: false,
+          error: `Too many memories (max ${MAX_MEMORIES})`,
+        };
+      }
+      if (importData.summaries.length > MAX_SUMMARIES) {
+        return {
+          success: false,
+          error: `Too many summaries (max ${MAX_SUMMARIES})`,
+        };
+      }
+      const MAX_OBS_BUCKETS = 10_000;
+      const obsBuckets = Object.keys(importData.observations);
+      if (obsBuckets.length > MAX_OBS_BUCKETS) {
+        return {
+          success: false,
+          error: `Too many observation buckets (max ${MAX_OBS_BUCKETS})`,
+        };
+      }
+
+      let totalObservations = 0;
+      for (const [, obs] of Object.entries(importData.observations)) {
+        if (!Array.isArray(obs)) {
+          return { success: false, error: "observation values must be arrays" };
+        }
+        if (obs.length > MAX_OBS_PER_SESSION) {
+          return {
+            success: false,
+            error: `Too many observations per session (max ${MAX_OBS_PER_SESSION})`,
+          };
+        }
+        totalObservations += obs.length;
+      }
+      if (totalObservations > MAX_TOTAL_OBSERVATIONS) {
+        return {
+          success: false,
+          error: `Too many total observations (max ${MAX_TOTAL_OBSERVATIONS})`,
+        };
+      }
+
       const stats = {
         sessions: 0,
         observations: 0,

src/functions/migrate.ts

@@ -10,10 +10,7 @@ import type {
   SessionSummary,
 } from "../types.js";
 
-const ALLOWED_DIRS = [
-  resolve(homedir(), ".agentmemory"),
-  resolve(homedir(), ".claude"),
-];
+const ALLOWED_DIRS = [resolve(homedir(), ".agentmemory")];
 
 function isAllowedPath(dbPath: string): boolean {
   const resolved = resolve(dbPath);
@@ -149,7 +146,7 @@ export function registerMigrateFunction(sdk: ISdk, kv: StateKV): void {
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         ctx.logger.error("Migration failed", { error: msg });
-        return { success: false, error: msg };
+        return { success: false, error: "Migration failed" };
       }
     },
   );

src/functions/observe.ts

@@ -18,6 +18,22 @@ export function registerObserveFunction(
     },
     async (payload: HookPayload) => {
       const ctx = getContext();
+
+      if (
+        !payload?.sessionId ||
+        typeof payload.sessionId !== "string" ||
+        !payload.hookType ||
+        typeof payload.hookType !== "string" ||
+        !payload.timestamp ||
+        typeof payload.timestamp !== "string"
+      ) {
+        return {
+          success: false,
+          error:
+            "Invalid payload: sessionId, hookType, and timestamp are required",
+        };
+      }
+
       const obsId = generateId("obs");
 
       if (dedupMap) {

src/functions/privacy.ts

@@ -1,30 +1,36 @@
-import type { ISdk } from 'iii-sdk'
+import type { ISdk } from "iii-sdk";
 
-const PRIVATE_TAG_RE = /<private>[\s\S]*?<\/private>/gi
+const PRIVATE_TAG_RE = /<private>[\s\S]*?<\/private>/gi;
 
 const SECRET_PATTERN_SOURCES = [
   /(?:api[_-]?key|secret|token|password|credential|auth)[\s]*[=:]\s*["']?[A-Za-z0-9_\-/.+]{20,}["']?/gi,
   /(?:sk|pk|rk|ak)-[A-Za-z0-9]{20,}/g,
+  /sk-ant-[A-Za-z0-9\-_]{20,}/g,
   /ghp_[A-Za-z0-9]{36}/g,
+  /github_pat_[A-Za-z0-9_]{22,}/g,
   /xoxb-[A-Za-z0-9\-]+/g,
   /AKIA[0-9A-Z]{16}/g,
+  /AIza[A-Za-z0-9\-_]{35}/g,
   /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
-]
+];
 
 export function stripPrivateData(input: string): string {
-  let result = input.replace(PRIVATE_TAG_RE, '[REDACTED]')
+  let result = input.replace(PRIVATE_TAG_RE, "[REDACTED]");
   for (const source of SECRET_PATTERN_SOURCES) {
-    const pattern = new RegExp(source.source, source.flags)
-    result = result.replace(pattern, '[REDACTED_SECRET]')
+    const pattern = new RegExp(source.source, source.flags);
+    result = result.replace(pattern, "[REDACTED_SECRET]");
   }
-  return result
+  return result;
 }
 
 export function registerPrivacyFunction(sdk: ISdk): void {
   sdk.registerFunction(
-    { id: 'mem::privacy', description: 'Strip private tags and secrets from input' },
+    {
+      id: "mem::privacy",
+      description: "Strip private tags and secrets from input",
+    },
     async (data: { input: string }) => {
-      return { output: stripPrivateData(data.input) }
-    }
-  )
+      return { output: stripPrivateData(data.input) };
+    },
+  );
 }

src/functions/relations.ts

@@ -112,15 +112,20 @@ export function registerRelationsFunction(sdk: ISdk, kv: StateKV): void {
     },
     async (data: { memoryId: string; maxHops?: number }) => {
       const ctx = getContext();
-      const maxHops = data.maxHops ?? 2;
+      const maxHops = Math.min(data.maxHops ?? 2, 5);
+      const MAX_VISITED = 500;
+
+      const allRelations = await kv
+        .list<MemoryRelation>(KV.relations)
+        .catch(() => []);
 
       const visited = new Set<string>();
       const result: Array<{ memory: Memory; hop: number }> = [];
       const queue: Array<{ id: string; hop: number }> = [
         { id: data.memoryId, hop: 0 },
       ];
 
-      while (queue.length > 0) {
+      while (queue.length > 0 && visited.size < MAX_VISITED) {
         const current = queue.shift()!;
         if (visited.has(current.id) || current.hop > maxHops) continue;
         visited.add(current.id);
@@ -136,10 +141,7 @@ export function registerRelationsFunction(sdk: ISdk, kv: StateKV): void {
         const supersedes = memory.supersedes || [];
         const parentId = memory.parentId ? [memory.parentId] : [];
 
-        const kvRelations = await kv
-          .list<MemoryRelation>(KV.relations)
-          .catch(() => []);
-        const kvLinked = kvRelations
+        const kvLinked = allRelations
           .filter((r) => r.sourceId === current.id || r.targetId === current.id)
           .map((r) => (r.sourceId === current.id ? r.targetId : r.sourceId));
 

src/functions/remember.ts

@@ -14,9 +14,19 @@ export function registerRememberFunction(sdk: ISdk, kv: StateKV): void {
       files?: string[];
     }) => {
       const ctx = getContext();
-      if (!data.content || !data.content.trim()) {
+      if (
+        !data.content ||
+        typeof data.content !== "string" ||
+        !data.content.trim()
+      ) {
         return { success: false, error: "content is required" };
       }
+      if (data.files && !Array.isArray(data.files)) {
+        return { success: false, error: "files must be an array" };
+      }
+      if (data.concepts && !Array.isArray(data.concepts)) {
+        return { success: false, error: "concepts must be an array" };
+      }
       const validTypes = new Set([
         "pattern",
         "preference",

src/functions/smart-search.ts

@@ -23,13 +23,14 @@ export function registerSmartSearchFunction(
       const ctx = getContext();
 
       if (data.expandIds && data.expandIds.length > 0) {
+        const ids = data.expandIds.slice(0, 20);
         const expanded: Array<{
           obsId: string;
           sessionId: string;
           observation: CompressedObservation;
         }> = [];
 
-        for (const obsId of data.expandIds) {
+        for (const obsId of ids) {
           const obs = await findObservation(kv, obsId);
           if (obs) {
             expanded.push({
@@ -40,11 +41,14 @@ export function registerSmartSearchFunction(
           }
         }
 
+        const truncated = data.expandIds.length > ids.length;
         ctx.logger.info("Smart search expanded", {
           requested: data.expandIds.length,
-          found: expanded.length,
+          attempted: ids.length,
+          returned: expanded.length,
+          truncated,
         });
-        return { mode: "expanded", results: expanded };
+        return { mode: "expanded", results: expanded, truncated };
       }
 
       if (!data.query || typeof data.query !== "string" || !data.query.trim()) {

src/index.ts

@@ -140,19 +140,20 @@ async function main() {
     console.warn(`[agentmemory] Failed to load persisted index:`, err);
     return null;
   });
-  if (loaded?.bm25) {
-    const restoredCount = loaded.bm25.size;
-    if (restoredCount > 0) {
-      console.log(
-        `[agentmemory] Loaded persisted BM25 index (${restoredCount} docs)`,
-      );
-    }
+  if (loaded?.bm25 && loaded.bm25.size > 0) {
+    bm25Index.restoreFrom(loaded.bm25);
+    console.log(
+      `[agentmemory] Loaded persisted BM25 index (${bm25Index.size} docs)`,
+    );
+  }
+  if (loaded?.vector && vectorIndex && loaded.vector.size > 0) {
+    vectorIndex.restoreFrom(loaded.vector);
+    console.log(
+      `[agentmemory] Loaded persisted vector index (${vectorIndex.size} vectors)`,
+    );
   }
 
-  const needsRebuild =
-    !loaded?.bm25 ||
-    loaded.bm25.size === 0 ||
-    (embeddingProvider && vectorIndex && vectorIndex.size === 0);
+  const needsRebuild = bm25Index.size === 0;
 
   if (needsRebuild) {
     const indexCount = await rebuildIndex(kv).catch((err) => {