celiums/celiums-memory

External security audit on the hosted celiums-memory deployment surfaced four findings in the MCP tool layer. This patch ports the fixes here so any self-hosted deployment using @celiums/memory benefits immediately. Recommended upgrade: all users.

Security (P0)

recall no longer accepts projectId="all" from arbitrary callers

Previously enabled cross-project reconnaissance from any token. Now gated behind an admin scope:

• Set the caller's userId in the CELIUMS_CROSS_PROJECT_ADMINS env (comma-separated), or
• Have the caller's context carry a scopes: ["admin:cross_project"] claim.

remember and journal_write now refuse credential-like content

A shared SECRET_PATTERNS detector blocks persistence of common credential shapes — preventing long-lived leaks via later recall calls:

• Resend (re_…), DigitalOcean Inference (sk-do-…), DO API tokens (dop_v1_…)
• Anthropic (sk-ant-…), OpenRouter (sk-or-…), Stripe (sk_live_…)
• Groq (gsk_…), xAI (xai-…), GitHub PATs (ghp_…)
• AWS Access Keys (AKIA…), Postgres managed (AVNS_…), Celiums MCP keys (cmk_…)

If you ingest customer support transcripts or chat logs, you especially want this.

journal_write schema validation hardened

• tags must be string[] — previously a malformed XML payload would persist as tags: [].
• inherit_from must be a UUIDv4-shaped string — previously ../../etc/passwd was accepted as a no-op.

Notes

• No data migration required. Existing memories and journal entries are unaffected.
• If your deployment has credentials in plaintext memories, audit them after upgrade — the new detector blocks new writes but doesn't redact existing rows.

Upgrade

```bash
npm install @celiums/[email protected]
```