@GIN0076/cross-session-memory

The whole point of ~/.memory-global is cross-workspace sharing, but this engine never writes sourceWorkspace into mirrored entries. So every mirror created by any workspace has owner === undefined, the `if (owner && ...)` guard falls through, and unlinkSync removes it. Consequently the last workspace to run `mem global-sync` silently deletes every other project's global memory mirrors. The root is overridable via DSH_MEMORY_GLOBAL_DIR, so the deletion target directory is environment-controlled.

The command string comes from an entry's frontmatter (metadata.verification.command), i.e. memory content, and is handed to a real shell. In practice it is not exploitable: both regexes are fully anchored, the path class excludes all shell metacharacters, and the line-based frontmatter parser cannot emit embedded newlines into the value, so only `node --check <path>.mjs` / `git status --porcelain` can ever reach sh. The shell flag is still an unnecessary attack surface (e.g. a future parser change that admits whitespace/newlines would become command injection).