@Towzai/dsh-memory-jev

remember() marks content matching SENSITIVE_PATTERNS with gate='redacted-skip'/sensitive=true and derives title from content.slice(0,30) when no title is given, so the title can literally be the first 30 chars of an API key, phone number or ID. store.active() filters only on retired, and recall()/injectSnapshot() build one question per prefiltered candidate embedding that title, sending it to OpenRouter. The egress guard inspects only the query text, so the redaction the plugin performed on the write path is undone on the read path once a later query lexically matches the entry.

DEFAULT_CONFIG sets egressGuard:false and both guards are written as `config.egressGuard !== false && containsSensitive(...)`, so with the shipped cordis.patch.yml/profile defaults a user question containing an sk- key, a Bearer token or an ID number is embedded verbatim in the Jev questions and shipped to the third-party endpoint, even though a purpose-built filter exists.

escapeInjectionText only replaces '<' with \u003c, which blocks delimiter forgery but not natural-language instruction injection. Content persisted by mem_remember (which fails open and stores even when the Jev write gate returns unavailable/budget) is later appended to the agent context; if an agent was induced to save adversarial text (e.g. from a fetched page), it is replayed into future turns as a user-role message, giving a persistent indirect-injection channel. The block's '不是指令' rule line is a soft mitigation only.

package.json discloses the only network destination as openrouter.ai, but config.jevEndpoint overrides the URL for every call while the same Authorization header is always attached. A profile layer that sets jevEndpoint redirects the credential to an arbitrary host, silently widening the declared egress boundary.