fix(tools): make claude memory customId injective to stop silent file overwrites - #1586
Open
Sravanjangam wants to merge 1 commit into
Open
Conversation
…writes normalizePathToCustomId flattened / and . to _ non-injectively, so /memories/notes.txt, /memories/notes_txt and /memories/notes/txt all mapped to memories_notes_txt — create/delete/view on one path silently hit another file's document (supermemoryai#1547). pathToCustomId now keeps the exact legacy id only for the canonical /dir/file.ext shape (no underscore, one dot, one slash) so existing documents keep resolving, and appends an 8-hex sha256 digest of the original path for every other shape, making distinct paths map to distinct ids. Round-trip collision tests included.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1547.
Hi supermemory team 👋 Thanks for building such a great product! While running a security & quality audit of the repo we hit this issue and put together a small, tested fix — details below.
Problem
ClaudeMemoryTool.normalizePathToCustomIdflattened/and.to_non-injectively:/memories/notes.txt,/memories/notes_txt, and/memories/notes/txtall mapped tomemories_notes_txt. Creating, viewing, or deleting one path therefore silently operated on a different file's document — silent data loss with no error surfaced.Solution
Exported pure
pathToCustomId()keeps the exact legacy id for the canonical single-segment shape (no underscore, exactly one dot, exactly one slash — e.g./dir/file.ext) so already-stored documents keep resolving with zero migration, and appends an 8-hex sha256 digest of the original path for every other shape, making distinct paths map to distinct IDs again.Changes
packages/tools/src/claude-memory.ts→ private method now delegates to the new exportedpathToCustomId()(all six call sites covered)packages/tools/src/claude-memory.test.ts→ +4 tests: three-way collision from the issue, legacy-id stability, determinism, distinct digests for distinct underscore pathsVerification
Fresh from the committed branch:
bunx vitest run src/claude-memory.test.ts→ 14/14 pass.packages/tools/test/**carries pre-existing type errors unrelated to this change (tracked in #1545) — this diff adds none.Happy to iterate on any of this — feedback and reworks very welcome! 🙏
Environment
fix/claude-memory-customid-collision— all gates re-run fresh at commit049a50ee0ac6