v0.1.1 — firewall bypass in the explain path

Three defects found by running 0.1.0 on a real machine rather than in CI. The first is a firewall bypass, which is why this went out the same day.

Security: why --json returned refused content

The human path withheld a refused memory's title and narrative unless --content was passed. The JSON path returned before that policy was applied. Reproduced on a live 0.1.0 daemon:

$ memwarden why <stale-id>          # correct
  title      (withheld — this memory is refused under the current policy)

$ memwarden why <stale-id> --json   # leaked
  title    : "Read README.md"
  narrative: "Read README.md. {\"success\":true,\"output\":\"<file-view path=..."

Anyone holding a refused observation id — a script, or a model told only the id — could recover firewalled content through the explain path. That contradicts the guarantee the product rests on.

Withholding is now enforced inside mem::why, before the response leaves core, so the raw HTTP endpoint is fixed and not merely the CLI. Requesting content requires an explicit boolean (include_content / --content) and returns it in a dedicated field wrapped in untrusted-data markers, rather than as bare title/narrative fields a caller would slurp by accident. (#80, closes #77)

status called every served memory "verified"

Under the default balanced policy the firewall serves verified, cosmetic, sourced and unsourced memories — each labeled — but the recorder stored a single injected total and status rendered it as N verified served. It now counts unique memories actually returned after policy filtering and token-budget packing, split by trust state.

Counts recorded before this release cannot be re-derived, so they are shown as legacy/unclassified rather than retroactively claimed as verified. (#81, closes #78)

The daemon log was world-readable and unbounded

The detached spawn path opened and chmod'd the log to 0600, but the launchd installer only pointed StandardOutPath/StandardErrorPath at the file — so launchd created it with the default 0644, measured at 3.7 MB world-readable on a real install. Logging is now descriptor-safe across both paths with regular-file, ownership, hard-link, symlink and containment checks, enforced 0600, and bounded to one 1 MiB current file plus one 1 MiB tail generation while preserving launchd's open inode. systemd continues to use journald. (#82, closes #79)

Upgrade

npm install -g memwarden@0.1.1
memwarden down && memwarden up

854 tests · firewall eval 10/10 gates · packed-artifact smoke on Linux, macOS and Windows · published with SLSA provenance.