Promote staging → main (WALM-617)

.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "memwal",
       "source": "./packages/mcp/plugin",
       "description": "Automatic Walrus Memory — proactive recall and durable-fact saving via the MemWal MCP + lifecycle hooks.",
-      "version": "0.0.12"
+      "version": "0.0.13"
     }
   ]
 }

.cursor-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "memwal",
       "source": "./packages/mcp/plugin",
       "description": "Automatic Walrus Memory — proactive recall and durable-fact saving via the MemWal MCP + lifecycle hooks.",
-      "version": "0.0.12"
+      "version": "0.0.13"
     }
   ]
 }

.github/workflows/test.yml

@@ -34,6 +34,8 @@ jobs:
             script: scripts/check-docs-freshness.mjs
           - name: SEAL cross-account synthetic parser
             script: scripts/synthetic-seal-cross-account.test.mjs
+          - name: Migration / Completion artifact
+            script: scripts/write-migration-completion-artifact.mjs --self-test
 
     steps:
       - uses: actions/checkout@v4

SKILL.md

@@ -155,7 +155,7 @@ const stored = await memwal.waitForRememberJob(accepted.job_id, {
 | `recall({ query, limit?, topK?, namespace?, maxDistance? })` *(preferred)* or `recall(query, limit?, namespace?)` | Semantic search for memories | `{ results: [{ blob_id, text, distance }], total }` |
 | `analyze(text, namespace?)` | Extract facts and accept one memory job per fact | `{ job_ids, facts, fact_count, status, owner }` |
 | `analyzeAndWait(text, namespace?, opts?)` | Extract facts and wait for all fact jobs to complete | `{ results, facts, total, succeeded, failed, owner }` |
-| `restore(namespace, limit?)` | Rebuild missing index entries from Walrus | `{ restored, skipped, total, namespace, owner, truncated }` |
+| `restore(namespace, limit?)` | Rebuild missing index entries from Walrus | `{ restored, skipped, failed, total, namespace, owner, truncated }` |
 | `health()` | Check relayer health | `{ status, version }` |
 | `getPublicKeyHex()` | Get hex-encoded public key | `string` |
 
@@ -271,6 +271,7 @@ interface EmbedResult {
 interface RestoreResult {
   restored: number;
   skipped: number;
+  failed: number;
   total: number;
   namespace: string;
   owner: string;
@@ -363,15 +364,16 @@ Cross-namespace and cross-owner reads are not just filtered out of results — t
 | Field | Counts | Notes |
 |---|---|---|
 | `restored` | Blobs the relayer just rebuilt this call | Pulled from Walrus → SEAL decrypted → re-embedded → inserted as a new row |
-| `skipped` | On-chain blobs already in the local index | No work needed; relayer left them as-is |
+| `skipped` | On-chain blobs already in the local **success** index | No work needed; relayer left them as-is. Does not include decrypt/UTF-8 failures. |
+| `failed` | Permanent decrypt/UTF-8 failures | On-chain blobs in this page that are negative-cached, plus new permanent failures this call. Older relayers omit the field; SDKs default it to `0`. |
 | `total` | All on-chain blobs the relayer saw for `(owner, namespace)` | Before the limit was applied |
 | `namespace` | Echo of the request | |
 | `owner` | Resolved owner address | |
 | `truncated` | Known-retryable-incomplete | `true` is not a hard failure; `false` is not completeness |
 
 `truncated=true` means this restore is **known-retryable-incomplete**: more missing blobs than `limit` allowed this call to restore, **or** the sidecar's owner-wide candidate fetch hit its cap **and** raising `limit` can still expand that fetch (`limit < 20`). Once the sidecar cap is saturated (`limit >= 20`, cap pinned at 100), truncation follows this call's missing-blob page length, not onchain `total`. A fully restored namespace does not loop. `truncated=false` is **not** proof the sidecar saw every onchain blob; blobs beyond the owner-wide sidecar candidate cap can still be missing. WALM-451 tracks a `sourceCapped` field for that case. Relayers older than WALM-319 omit `truncated`; SDKs default it to `false`.
 
-**Silent drops.** A blob that *cannot* be decrypted or embedded (e.g. wrong delegate key, malformed ciphertext, embedding API down) is dropped without counting in `restored` *or* `skipped`. `restored + skipped` is therefore a lower bound on healthy entries, not a strict equality with `total`.
+Permanent decrypt or invalid-UTF-8 failures count in `failed`, not `skipped`. Transient download/decrypt/embed errors are still not counted in `restored`, `skipped`, or `failed` and may be retried (`truncated=true` when a page yields only those). `restored + skipped + failed` therefore never exceeds `total`, and falls short of it whenever transient errors leave blobs uncounted.
 
 #### Default and limit
 

apps/chatbot/app/(auth)/api/auth/guest/route.ts

@@ -1,43 +1,22 @@
 import { NextResponse } from "next/server";
 import { signIn } from "@/app/(auth)/auth";
+import { isSafeRedirectUrl, publicRequestUrl } from "@/lib/public-request-url";
 import { getSessionToken } from "@/lib/session-token";
 
-/**
- * Validate a redirect target before forwarding to auth.
- * Allows only:
- *   - Relative paths beginning with "/" (but not "//", which is protocol-relative)
- *   - Absolute URLs whose origin matches the request origin (same-origin)
- * Anything else (external hosts, javascript:, data:, //evil.com) falls back to "/".
- */
-function isSafeRedirectUrl(redirectUrl: string, requestUrl: string): boolean {
-  // Relative path — safe as long as it isn't protocol-relative ("//host/...")
-  if (redirectUrl.startsWith("/") && !redirectUrl.startsWith("//")) {
-    return true;
-  }
-  // Absolute URL — must share the same origin as the request
-  try {
-    const redirectOrigin = new URL(redirectUrl).origin;
-    const requestOrigin = new URL(requestUrl).origin;
-    return redirectOrigin === requestOrigin;
-  } catch {
-    // Unparseable URL (e.g. "javascript:alert(1)") — reject
-    return false;
-  }
-}
-
 export async function GET(request: Request) {
   const { searchParams } = new URL(request.url);
   const rawRedirectUrl = searchParams.get("redirectUrl") || "/";
+  const publicUrl = publicRequestUrl(request);
 
-  // Reject cross-origin or protocol-relative redirect targets
-  const redirectUrl = isSafeRedirectUrl(rawRedirectUrl, request.url)
+  // Reject cross-origin, bind-address, or protocol-relative redirect targets
+  const redirectUrl = isSafeRedirectUrl(rawRedirectUrl, request)
     ? rawRedirectUrl
     : "/";
 
   const token = await getSessionToken(request);
 
   if (token) {
-    return NextResponse.redirect(new URL("/", request.url));
+    return NextResponse.redirect(new URL("/", publicUrl));
   }
 
   return signIn("guest", { redirect: true, redirectTo: redirectUrl });

apps/chatbot/app/(auth)/auth.config.ts

@@ -1,6 +1,8 @@
 import type { NextAuthConfig } from "next-auth";
 
 export const authConfig = {
+  // Railway / Docker set HOSTNAME=0.0.0.0; trust the incoming Host header.
+  trustHost: true,
   pages: {
     signIn: "/login",
     newUser: "/",

apps/chatbot/lib/public-request-url.ts

@@ -0,0 +1,79 @@
+const BIND_HOSTNAMES = new Set(["0.0.0.0", "::", "[::]"]);
+
+function isBindHostname(hostname: string): boolean {
+  return BIND_HOSTNAMES.has(hostname.toLowerCase());
+}
+
+function firstHeader(headers: Headers, name: string): string | null {
+  return headers.get(name)?.split(",")[0]?.trim() || null;
+}
+
+function usablePublicHost(host: string | null): string | null {
+  if (!host) {
+    return null;
+  }
+  try {
+    const hostname = new URL(`http://${host}`).hostname;
+    return hostname && !isBindHostname(hostname) ? host : null;
+  } catch {
+    return null;
+  }
+}
+
+export function publicRequestUrl(request: Request): URL {
+  const url = new URL(request.url);
+  const forwardedHost = usablePublicHost(
+    firstHeader(request.headers, "x-forwarded-host")
+  );
+  const publicHost =
+    forwardedHost ??
+    (isBindHostname(url.hostname)
+      ? usablePublicHost(firstHeader(request.headers, "host"))
+      : null);
+
+  if (!publicHost) {
+    return url;
+  }
+
+  const proto = firstHeader(request.headers, "x-forwarded-proto")?.toLowerCase();
+  const protocol =
+    proto === "http" || proto === "https"
+      ? proto
+      : url.protocol.replace(/:$/, "");
+
+  // Reconstruct; assigning URL.host keeps :3000 from the bind address.
+  try {
+    return new URL(`${protocol}://${publicHost}${url.pathname}${url.search}`);
+  } catch {
+    return url;
+  }
+}
+
+export function guestReturnPath(request: Request): string {
+  const url = new URL(request.url);
+  const path = `${url.pathname}${url.search}`;
+  return path.startsWith("/") && !path.startsWith("//") ? path : "/";
+}
+
+export function isSafeRedirectUrl(
+  redirectUrl: string,
+  request: Request
+): boolean {
+  if (redirectUrl.startsWith("/") && !redirectUrl.startsWith("//")) {
+    return true;
+  }
+
+  try {
+    const redirect = new URL(redirectUrl);
+    const publicUrl = publicRequestUrl(request);
+    if (
+      isBindHostname(redirect.hostname) ||
+      isBindHostname(publicUrl.hostname)
+    ) {
+      return false;
+    }
+    return redirect.origin === publicUrl.origin;
+  } catch {
+    return false;
+  }
+}

apps/chatbot/lib/public-request-url.unit.test.ts

@@ -0,0 +1,112 @@
+import { describe, expect, it } from "vitest";
+import {
+  guestReturnPath,
+  isSafeRedirectUrl,
+  publicRequestUrl,
+} from "./public-request-url";
+
+const STAGING_HOST = "chatbot-demo-staging.memory.walrus.xyz";
+
+function bindRequest(path = "/chat/abc", headers?: HeadersInit): Request {
+  return new Request(`https://0.0.0.0:3000${path}`, { headers });
+}
+
+describe("publicRequestUrl", () => {
+  it("uses x-forwarded-host and proto when request.url is a bind address", () => {
+    const request = bindRequest("/chat/abc", {
+      "x-forwarded-host": STAGING_HOST,
+      "x-forwarded-proto": "https",
+    });
+
+    const publicUrl = publicRequestUrl(request);
+    expect(publicUrl.origin).toBe(`https://${STAGING_HOST}`);
+    expect(publicUrl.hostname).not.toBe("0.0.0.0");
+    expect(publicUrl.pathname).toBe("/chat/abc");
+  });
+
+  it("prefers a non-bind forwarded host over request.url", () => {
+    const request = new Request("http://localhost:3000/login", {
+      headers: {
+        "x-forwarded-host": STAGING_HOST,
+        "x-forwarded-proto": "https",
+      },
+    });
+
+    expect(publicRequestUrl(request).origin).toBe(`https://${STAGING_HOST}`);
+  });
+
+  it("falls back to Host when the URL is a bind address", () => {
+    const request = bindRequest("/chat/abc", {
+      host: STAGING_HOST,
+      "x-forwarded-proto": "https",
+    });
+
+    expect(publicRequestUrl(request).origin).toBe(`https://${STAGING_HOST}`);
+  });
+});
+
+describe("guestReturnPath", () => {
+  it("returns pathname and search as a relative path", () => {
+    const forwarded = {
+      "x-forwarded-host": STAGING_HOST,
+      "x-forwarded-proto": "https",
+    };
+
+    expect(guestReturnPath(bindRequest("/chat/abc", forwarded))).toBe(
+      "/chat/abc"
+    );
+    expect(guestReturnPath(bindRequest("/chat/abc?foo=1", forwarded))).toBe(
+      "/chat/abc?foo=1"
+    );
+  });
+
+  it("rejects protocol-relative pathnames and falls back to /", () => {
+    expect(guestReturnPath(bindRequest("//evil.example"))).toBe("/");
+  });
+});
+
+describe("isSafeRedirectUrl", () => {
+  it("allows relative paths", () => {
+    const request = bindRequest("/", {
+      "x-forwarded-host": STAGING_HOST,
+      "x-forwarded-proto": "https",
+    });
+
+    expect(isSafeRedirectUrl("/", request)).toBe(true);
+    expect(isSafeRedirectUrl("/chat/1", request)).toBe(true);
+  });
+
+  it("rejects cross-origin and protocol-relative targets", () => {
+    const request = bindRequest("/chat/abc", {
+      "x-forwarded-host": STAGING_HOST,
+      "x-forwarded-proto": "https",
+    });
+
+    expect(isSafeRedirectUrl("https://evil.example", request)).toBe(false);
+    expect(isSafeRedirectUrl("//evil.example", request)).toBe(false);
+  });
+
+  it("allows same-origin absolute URLs against the public origin", () => {
+    const request = bindRequest("/chat/abc", {
+      "x-forwarded-host": STAGING_HOST,
+      "x-forwarded-proto": "https",
+    });
+
+    expect(
+      isSafeRedirectUrl(`https://${STAGING_HOST}/chat/abc`, request)
+    ).toBe(true);
+    expect(isSafeRedirectUrl("https://0.0.0.0:3000/chat/abc", request)).toBe(
+      false
+    );
+  });
+
+  it("does not treat a bind address as a safe absolute redirect target", () => {
+    const request = bindRequest("/chat/abc");
+
+    expect(isSafeRedirectUrl("https://0.0.0.0:3000/chat/abc", request)).toBe(
+      false
+    );
+    expect(isSafeRedirectUrl("https://0.0.0.0:3000/", request)).toBe(false);
+    expect(isSafeRedirectUrl("/", request)).toBe(true);
+  });
+});

apps/chatbot/proxy.ts

@@ -1,5 +1,6 @@
 import { type NextRequest, NextResponse } from "next/server";
 import { guestRegex } from "./lib/constants";
+import { guestReturnPath, publicRequestUrl } from "./lib/public-request-url";
 import { getSessionToken } from "./lib/session-token";
 
 export async function proxy(request: NextRequest) {
@@ -20,17 +21,20 @@ export async function proxy(request: NextRequest) {
   const token = await getSessionToken(request);
 
   if (!token) {
-    const redirectUrl = encodeURIComponent(request.url);
+    const redirectUrl = encodeURIComponent(guestReturnPath(request));
 
     return NextResponse.redirect(
-      new URL(`/api/auth/guest?redirectUrl=${redirectUrl}`, request.url)
+      new URL(
+        `/api/auth/guest?redirectUrl=${redirectUrl}`,
+        publicRequestUrl(request)
+      )
     );
   }
 
   const isGuest = guestRegex.test(token?.email ?? "");
 
   if (token && !isGuest && ["/login", "/register"].includes(pathname)) {
-    return NextResponse.redirect(new URL("/", request.url));
+    return NextResponse.redirect(new URL("/", publicRequestUrl(request)));
   }
 
   return NextResponse.next();