Skip to content

Add durable startup memory context#4

Open
coe0718 wants to merge 3 commits intoghostwright:mainfrom
coe0718:startup-durable-context
Open

Add durable startup memory context#4
coe0718 wants to merge 3 commits intoghostwright:mainfrom
coe0718:startup-durable-context

Conversation

@coe0718
Copy link
Copy Markdown
Contributor

@coe0718 coe0718 commented Mar 31, 2026 •
edited
Loading

Summary

Adds a small startup-only durable memory section for brand-new sessions so Phantom begins with a bit of long-term continuity before normal retrieval takes over.

What Changed

  • passes isNewSession from the runtime into the memory context builder on the first turn of a fresh session
  • adds a compact Durable Context section that only appears on new sessions
  • selects durable facts from the normal semantic recall using high confidence filtering
  • adds a metadata-ranked episodic recall pass for startup memories and deduplicates those memories from the normal sections
  • preserves stale low-signal episodic filtering from the current main branch during normal context injection
  • documents the new startup behavior in docs/memory.md

Why

This keeps the contribution focused on startup retrieval rather than adding a parallel memory system. It gives new sessions more continuity while staying aligned with the existing episodic + semantic + procedural memory design.

Testing

  • bash -lc 'export PATH="$HOME/.bun/bin:$PATH" && /home/coemedia/.bun/bin/bun test src/memory/__tests__/context-builder.test.ts'
  • bash -lc 'export PATH="$HOME/.bun/bin:$PATH" && /home/coemedia/.bun/bin/bun test'
  • /home/coemedia/.bun/bin/bun run typecheck
  • /home/coemedia/.bun/bin/bun run lint

Notes

  • Rebasing onto current main required carrying forward the startup-only durable context while preserving the newer stale-memory filtering already merged in context-builder.ts.

@mcheemaa mcheemaa mentioned this pull request Mar 31, 2026
Closed
@mcheemaa mcheemaa self-requested a review March 31, 2026 04:59
mcheemaa
mcheemaa reviewed Mar 31, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@mcheemaa mcheemaa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

#2 just landed on main. Can you rebase this on main when you get a chance? Will review once it's updated.

@coe0718 coe0718 force-pushed the startup-durable-context branch from 7e9c3ba to 19e97aa Compare March 31, 2026 21:14
@coe0718
Copy link
Copy Markdown
Contributor Author

coe0718 commented Mar 31, 2026

Rebased

imonlinux added a commit to imonlinux/phantom that referenced this pull request Apr 24, 2026
@imonlinux @claude
Fix 21 Nextcloud Talk security and code quality issues
c650e1f 
Complete security review and implementation of fixes for Nextcloud Talk
integration based on comprehensive security audit findings.

HIGH PRIORITY fixes (security-critical):
- ghostwright#1: Implement replay attack protection with LRU cache (5-minute TTL)
- ghostwright#2: Add 64KB request size limit before body buffering
- ghostwright#4: Replace Date.now() with crypto.randomUUID() for unique IDs
- ghostwright#7: Fix JSON unwrap logic for ActivityStreams Note objects
- ghostwright#11: Replace 'Error:' text sniffing with runtime error events

Logic and security fixes:
- ghostwright#3: Fix msgId/msg name collision in error handling
- ghostwright#5: Improve parseConversationId to handle colons in tokens
- ghostwright#6: Reject webhooks without target.id instead of silent fallback
- ghostwright#8: Normalize emoji to avoid variation selector validation issues
- ghostwright#9: Handle 404/409 reaction responses as success conditions
- ghostwright#10: Make setReaction return boolean for proper error handling
- ghostwright#12: Improve bot loop guard with actorId checking

Best practices and polish:
- ghostwright#13: Make port configurable instead of hardcoded 3200
- ghostwright#14: Move webhookPath default normalization to constructor
- ghostwright#15: Fix health check path precedence (check webhook first)
- ghostwright#16: Add exponential backoff retry for 5xx/429 responses
- ghostwright#17: Add URL validation and encoding for talkServer config
- ghostwright#18: Document HMAC signing asymmetry (inbound vs outbound)
- ghostwright#20: Import randomUUID explicitly from node:crypto
- ghostwright#21: Add reactions: true to channel capabilities
- ghostwright#22: Namespace environment variables with NEXTCLOUD_ prefix

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@truffle-dev truffle-dev mentioned this pull request Apr 25, 2026
Open
imonlinux added a commit to imonlinux/phantom that referenced this pull request Apr 26, 2026
@imonlinux
Fix ghostwright#19: Add comprehensive test coverage for Nextcloud Tal…
6717aec 
…k adapter

Implements full test suite for nextcloud.ts addressing all critical areas
identified in the nextcloud-talk-review document. 943 lines of tests
covering security, functionality, and edge cases.

Test coverage by category:

1. Signature verification (Fix ghostwright#1, ghostwright#18) - Security Critical
   - Valid HMAC signature acceptance
   - Invalid HMAC signature rejection
   - Replay attack protection via nonce cache
   - Nonce cache size limits (1000 entries, FIFO eviction)
   - Nonce expiration and periodic pruning (5-minute TTL)
   - Asymmetric signing (inbound: random+body, outbound: random+content)

2. Request size limits (Fix ghostwright#2) - Security Critical
   - Content-Length validation before buffering
   - Double-check after reading (missing Content-Length)
   - 64 KB limit enforcement (Nextcloud caps at 32k chars)

3. JSON unwrapping (Fix ghostwright#7) - Functionality Critical
   - ActivityStreams Note objects unwrap correctly
   - Plain text passes through unchanged
   - Literal JSON-like text not corrupted (only Note type unwraps)
   - Invalid JSON fallback to plain text

4. parseConversationId (Fix ghostwright#5) - Correctness Critical
   - Valid conversationId format parsing
   - Missing prefix returns null
   - Tokens containing colons handled correctly (indexOf+slice)
   - Thread-scoped ID to room token extraction

5. Bot loop guard (Fix ghostwright#12) - Multi-Bot Safety
   - Application actor filtering (actorType === "Application")
   - Self-filtering (actorId === config.botId)
   - Person messages processed normally
   - Multi-bot room scenarios

6. Retry and backoff (Fix ghostwright#16) - Resilience
   - 429 rate limiting with Retry-After header
   - 5xx server errors with exponential backoff + jitter
   - Network error retry logic
   - Non-retryable 4xx handling

7. Reaction error handling (Fix ghostwright#9)
   - 404 on remove treated as success
   - 409 on add treated as success
   - 5xx retry for reaction operations

8. URL validation and encoding (Fix ghostwright#17)
   - talkServer scheme removal (http://, https://)
   - Trailing slash removal
   - URL-encoding of roomToken and messageId

9. Target validation (Fix ghostwright#6)
   - Missing target.id rejection (no silent fallback)

10. Emoji normalization (Fix ghostwright#8)
    - Variation selector removal (U+26A0 vs U+26A0 U+FE0F)

11. Unique message IDs (Fix ghostwright#4)
    - crypto.randomUUID() vs Date.now()
    - Uniqueness across concurrent calls

12. Config normalization (Fix ghostwright#13, ghostwright#14)
    - webhookPath default in constructor
    - Configurable port
    - Session window configuration

13. Health check (Fix ghostwright#15)
    - Path precedence (webhook before health)

14. Message ID extraction
    - Numeric and string ID handling
    - Missing ID handling

15. Time-window session coalescing
    - Recent session continuation
    - New session creation
    - Parent message ID handling

16. Capabilities declaration (Fix ghostwright#21)
    - reactions: true declared

All tests use bun:test with mocked dependencies and follow existing
patterns from webhook.test.ts, slack.test.ts, and email.test.ts.

Related: nextcloud-talk-review.md Issue ghostwright#19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mcheemaa mcheemaa mcheemaa left review comments

+1 more reviewer

@Ari4ka Ari4ka Ari4ka approved these changes

Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@coe0718 @mcheemaa @Ari4ka