memory: block dreaming self-ingestion#66852
Conversation
Greptile SummaryThis PR blocks dreaming self-ingestion by broadening narrative transcript detection in Confidence Score: 5/5Safe to merge; all findings are minor style or low-risk broadening choices. Both P2 findings are non-blocking: one is a src/memory-host-sdk/host/session-files.ts — minor: hasDreamingNarrativeRunId uses includes instead of startsWith Prompt To Fix All With AIThis is a comment left during a code review.
Path: src/memory-host-sdk/host/session-files.ts
Line: 50-52
Comment:
**`includes` vs `startsWith` for runId matching**
`hasDreamingNarrativeRunId` uses `includes`, while the `isDreamingNarrativeBootstrapRecord` it wraps uses `startsWith`. Any string containing `"dreaming-narrative-"` as a substring (e.g. a session key like `"my-context-dreaming-narrative-abc"`) would now be flagged, which is broader than the original intent. If run IDs always follow the `dreaming-narrative-<suffix>` prefix convention, `startsWith` is the safer choice here.
```suggestion
return typeof value === "string" && value.startsWith(DREAMING_NARRATIVE_RUN_PREFIX);
```
How can I resolve this? If you propose a fix, please make it concise.
---
This is a comment left during a code review.
Path: extensions/memory-core/src/short-term-promotion.ts
Line: 248
Comment:
**Inline string vs named constant**
`"dreaming-narrative-"` is used inline here while `DREAMING_NARRATIVE_PROMPT_PREFIX` and `DREAMING_PROMOTION_META_PREFIX` are pulled from module-level constants in the same file. Extracting this as `const DREAMING_NARRATIVE_RUN_PREFIX = "dreaming-narrative-"` (mirroring the `session-files.ts` constant name) would make the three sentinel strings consistent and easier to update together.
```suggestion
snippet.includes(DREAMING_NARRATIVE_PROMPT_PREFIX) ||
snippet.includes(DREAMING_PROMOTION_META_PREFIX) ||
snippet.includes(DREAMING_NARRATIVE_RUN_PREFIX)
```
How can I resolve this? If you propose a fix, please make it concise.Reviews (1): Last reviewed commit: "memory: block dreaming self-ingestion" | Re-trigger Greptile |
There was a problem hiding this comment.
Pull request overview
This PR tightens the memory system’s “dreaming” hygiene by preventing dream-diary narrative transcripts and dream/promotion-shaped artifacts from being ingested or promoted as durable memories, keeping short-term promotion grounded in real recall evidence.
Changes:
- Broaden session transcript detection to flag dreaming narrative runs via bootstrap metadata, run/session IDs, and the dream-diary prompt text; skip collecting transcript content once flagged.
- Filter dreaming-/promotion-shaped snippets throughout short-term promotion (store normalization, recall recording, candidate ranking, and apply), including protection during candidate rehydration.
- Document that dreaming diary/report artifacts are excluded from short-term promotion into
MEMORY.md.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| src/memory-host-sdk/host/session-files.ts | Adds broader dreaming narrative detection and ensures flagged transcripts don’t contribute session content for ingestion. |
| src/memory-host-sdk/host/session-files.test.ts | Adds coverage for prompt-body detection and verifies flagged transcripts yield empty content/line maps. |
| extensions/memory-core/src/short-term-promotion.ts | Introduces dreaming contamination detection and applies it across normalize/record/rank/apply promotion flow. |
| extensions/memory-core/src/short-term-promotion.test.ts | Adds tests ensuring contaminated snippets are ignored during recording, ranking, and direct apply. |
| docs/concepts/dreaming.md | Clarifies that dreaming diary/report artifacts are excluded from short-term promotion to MEMORY.md. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7c7d94114c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
c6df4e9 to
5569490
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 556949020c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a7145cac7b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Scanner note triage:
Why the remaining security claim is rejected:
So the remaining |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d307cde276
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Scanner note triage refresh on current head:
Why that remaining security claim is rejected:
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c759fc0d83
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
🔒 Aisle Security AnalysisWe found 2 potential security issue(s) in this PR:
1. 🟡 Session transcript ingestion can be suppressed by spoofed dreaming-narrative runId/sessionKey prefix
Description
This creates an integrity / audit-evasion and data-loss risk if an attacker (or any untrusted producer of JSONL records) can inject a single record with a spoofed
Vulnerable logic:
if (!generatedByDreamingNarrative && isDreamingNarrativeGeneratedRecord(record)) {
generatedByDreamingNarrative = true;
}
...
if (generatedByDreamingNarrative) {
continue;
}RecommendationTighten dreaming-narrative detection and avoid dropping all message content based on a single loosely-matched record. Suggested fixes (choose one or combine):
Example (only treat the explicit bootstrap record as authoritative, and never skip all messages): // Only set the flag on the explicit bootstrap marker
if (!generatedByDreamingNarrative && isDreamingNarrativeBootstrapRecord(record)) {
generatedByDreamingNarrative = true;
}
// If you still want to ingest nothing for dreaming sessions, make it explicit:
// return early once, rather than silently skipping per-message.
if (generatedByDreamingNarrative) {
return {
path: sessionPathForFile(absPath),
absPath,
mtimeMs: stat.mtimeMs,
size: stat.size,
hash: hashText(""),
content: "",
lineMap: [],
messageTimestampsMs: [],
generatedByDreamingNarrative: true,
};
}Additionally, consider logging when a transcript is classified as dreaming-narrative, and why (which line/record), to improve auditability. 2. 🔵 Content-based heuristic drops legitimate short-term memory entries (integrity/availability risk)
DescriptionThe short-term promotion pipeline introduces Because the filter is content-based (not source/path based), legitimate user-authored memory notes can be misclassified as “dreaming contamination” and then:
This creates a data integrity/availability issue where a user (or any actor able to influence memory file content/snippets) can suppress promotion of specific memories by crafting text that matches the heuristic (e.g., starting with Vulnerable logic (key points):
const hasEvidence = /\bevidence:\s*(?:memory\/\.dreams\/session-corpus\/|memory\/)/i.test(snippet);
return hasNarrativeLead && hasConfidence && hasEvidence && hasStatus && hasRecalls;
if (snippet && isContaminatedDreamingSnippet(snippet)) {
continue;
}Impact: legitimate memories matching this format can be permanently excluded from promotion workflows (and effectively dropped from the normalized in-memory store representation). RecommendationAvoid content-only heuristics for deleting/ignoring user memory entries. Suggested mitigations (combine as appropriate):
Example narrowing (conceptual): const hasEvidence = /\bevidence:\s*memory\/\.dreams\/session-corpus\//i.test(snippet);
function isContaminatedDreamingSnippet(snippet: string, path?: string): boolean {
if (path && !path.startsWith("memory/.dreams/")) return false;
...
}This reduces false positives and prevents accidental suppression of legitimate user notes. Analyzed PR: #66852 at commit Last updated on: 2026-04-15T00:38:40Z |
e4c905f to
cb1f7a7
Compare
cb1f7a7 to
4742656
Compare
|
Merged via squash.
Thanks @gumadeiras! |
Merged via squash. Prepared head SHA: 4742656 Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Reviewed-by: @gumadeiras
Merged via squash. Prepared head SHA: 4742656 Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Reviewed-by: @gumadeiras
Merged via squash. Prepared head SHA: 4742656 Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Reviewed-by: @gumadeiras
Merged via squash. Prepared head SHA: 4742656 Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Reviewed-by: @gumadeiras
Merged via squash. Prepared head SHA: 4742656 Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Reviewed-by: @gumadeiras
Merged via squash. Prepared head SHA: 4742656 Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Reviewed-by: @gumadeiras
Merged via squash. Prepared head SHA: 4742656 Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Reviewed-by: @gumadeiras
Summary
Change Type (select all)
Scope (select all touched areas)
Linked Issue/PR
Root Cause (if applicable)
Regression Test Plan (if applicable)
src/memory-host-sdk/host/session-files.test.tsextensions/memory-core/src/short-term-promotion.test.tsextensions/memory-core/src/dreaming-phases.test.tsUser-visible / Behavior Changes
Diagram (if applicable)
Security Impact (required)
No)No)No)No)No)Yes, explain risk + mitigation:Repro + Verification
Environment
Steps
Expected
Actual
Evidence
Attach at least one:
Human Verification (required)
What you personally verified (not just CI), and how:
Review Conversations
Compatibility / Migration
Yes)No)No)Risks and Mitigations