fix: harden custom memory profiles

Author: deeflect

plugins/hermes-dory/provider.py

@@ -1429,10 +1429,7 @@ def _build_tool_schemas() -> list[dict[str, Any]]:
                     "budget_tokens": {"type": "integer"},
                     "agent": {"type": "string"},
                     "project": {"type": "string"},
-                    "profile": {
-                        "type": "string",
-                        "enum": ["default", "casual", "coding", "writing", "privacy"],
-                    },
+                    "profile": {"type": "string"},
                     "include_recent_sessions": {"type": "integer"},
                     "include_pinned_decisions": {"type": "boolean"},
                 },
@@ -1460,10 +1457,7 @@ def _build_tool_schemas() -> list[dict[str, Any]]:
                             "until": {"type": "string"},
                         },
                     },
-                    "profile": {
-                        "type": "string",
-                        "enum": ["auto", "general", "coding", "writing", "privacy", "personal"],
-                    },
+                    "profile": {"type": "string"},
                     "timeout_ms": {"type": "integer", "minimum": 100, "maximum": 5000},
                     "budget_tokens": {"type": "integer", "minimum": 100, "maximum": 1200},
                     "include_wake": {"type": "boolean"},

src/dory_core/active_memory.py

@@ -107,6 +107,11 @@ def allows_result_path(self, path: str, *, corpus: str) -> bool:
     def path_weight(self, path: str) -> float:
         return self.retrieval.path_weight(path)
 
+    def needs_prefilter_expansion(self, *, corpus: str) -> bool:
+        if corpus == "sessions":
+            return False
+        return bool(self.retrieval.allow or self.retrieval.deny or not self.retrieval.include_durable_context)
+
 
 class _WakeBuilder(Protocol):
     def build(self, req: WakeReq) -> WakeResp: ...
@@ -511,13 +516,14 @@ def _search_candidates(
     source_policy: SourcePolicy | None = None,
 ) -> list[object]:
     scored_results: dict[str, tuple[float, object]] = {}
+    request_k = _expanded_candidate_limit(k, source_policy=source_policy, corpus=corpus)
     for query_index, query in enumerate(query for query in queries if query.strip()):
         if deadline is not None and deadline.expired:
             break
         response = search_engine.search(
             SearchReq(
                 query=query,
-                k=k,
+                k=request_k,
                 mode=mode,
                 corpus=corpus,
                 include_content=include_content,
@@ -529,6 +535,10 @@ def _search_candidates(
             path = _result_path(result)
             if not path:
                 continue
+            if not _is_active_memory_candidate(result, corpus=corpus):
+                continue
+            if source_policy is not None and not source_policy.allows_result_path(path, corpus=corpus):
+                continue
             raw_score = float(getattr(result, "score", 0.0) or 0.0)
             rank_score = getattr(result, "rank_score", None)
             normalized_score = getattr(result, "score_normalized", None)
@@ -549,6 +559,12 @@ def _search_candidates(
     return [result for _score, result in ordered[:k]]
 
 
+def _expanded_candidate_limit(k: int, *, source_policy: SourcePolicy | None, corpus: str) -> int:
+    if source_policy is None or not source_policy.needs_prefilter_expansion(corpus=corpus):
+        return k
+    return min(50, max(k, k * 4))
+
+
 def _preferred_active_memory_results(results: list[object]) -> list[object]:
     fresh_results = [result for result in results if not str(getattr(result, "stale_warning", "") or "").strip()]
     return fresh_results or results

src/dory_core/wake.py

@@ -74,7 +74,10 @@ def _load_hot_block_sections(self, *, profile: WakeProfile = "default", agent: s
     def _load_named_section(self, *, name: str, profile: WakeProfile, agent: str) -> HotBlockSection | None:
         if name == "privacy_boundaries":
             return self._load_privacy_boundaries_section(agent=agent)
-        path = self.root / _resolve_wake_section_path(name)
+        rel_path = _resolve_wake_section_path(name)
+        if rel_path is None:
+            return None
+        path = self.root / rel_path
         return self._load_file_section(path, name=name, profile=profile, agent=agent)
 
     def _load_file_section(
@@ -87,6 +90,8 @@ def _load_file_section(
     ) -> HotBlockSection | None:
         if not path.exists():
             return None
+        if not _is_within_root(path, self.root):
+            return None
         content = path.read_text(encoding="utf-8").strip()
         return HotBlockSection(
             path=path.relative_to(self.root),
@@ -143,7 +148,8 @@ def _compact_profile_section(
             lines.append(line)
 
         excerpt = "\n".join(lines).strip()
-        section_path = _resolve_wake_section_path(name).as_posix()
+        resolved_section_path = _resolve_wake_section_path(name)
+        section_path = resolved_section_path.as_posix() if resolved_section_path is not None else name
         if name in _CORE_SECTION_NAMES:
             suffix = f"<!-- wake excerpt truncated; use dory_get('{section_path}') for the full file -->"
         else:
@@ -440,10 +446,21 @@ def _dedupe_preserve_order(items: list[str]) -> list[str]:
     return deduped
 
 
-def _resolve_wake_section_path(name: str) -> Path:
+def _resolve_wake_section_path(name: str) -> Path | None:
     if name in _CORE_SECTION_PATHS:
         return _CORE_SECTION_PATHS[name]
-    return Path(name)
+    path = Path(name)
+    if path.is_absolute() or ".." in path.parts:
+        return None
+    return path
+
+
+def _is_within_root(path: Path, root: Path) -> bool:
+    try:
+        path.resolve().relative_to(root.resolve())
+    except ValueError:
+        return False
+    return True
 
 
 def _section_budget_key(name: str) -> str:

tests/integration/core/test_wake_builder.py

@@ -44,6 +44,26 @@ def test_wake_builder_loads_custom_profile_sections(tmp_path) -> None:
     assert "Dory maintenance" not in resp.block
 
 
+def test_wake_builder_rejects_custom_profile_sections_outside_corpus(tmp_path) -> None:
+    outside = tmp_path.parent / f"{tmp_path.name}-outside.md"
+    outside.write_text("Outside corpus context must not load.\n", encoding="utf-8")
+    (tmp_path / "profiles.yaml").write_text(
+        f"""
+profiles:
+  unsafe:
+    wake:
+      sections:
+        - ../{outside.name}
+""".strip(),
+        encoding="utf-8",
+    )
+
+    resp = WakeBuilder(tmp_path).build(WakeReq(agent="claude-code", profile="unsafe", budget_tokens=200))
+
+    assert resp.block == ""
+    assert resp.sources == []
+
+
 def test_writing_profile_applies_writing_voice_budget(tmp_path) -> None:
     (tmp_path / "core").mkdir(parents=True)
     (tmp_path / "knowledge" / "personal").mkdir(parents=True)

tests/unit/test_active_memory.py

@@ -772,6 +772,64 @@ def search(self, req: SearchReq):  # pragma: no cover - test stub
     assert "Dory admin ops" not in result.block
 
 
+def test_active_memory_custom_profile_filters_before_top_k_truncation(tmp_path: Path) -> None:
+    class WindowedSearchEngine:
+        def __init__(self) -> None:
+            self.requests: list[SearchReq] = []
+
+        def search(self, req: SearchReq):  # pragma: no cover - test stub
+            self.requests.append(req)
+            disallowed = [
+                _make_result(
+                    path=f"projects/dory/high-score-{index}.md",
+                    snippet=f"Disallowed project result {index}.",
+                    score=1.0 - (index * 0.01),
+                    confidence="high",
+                )
+                for index in range(10)
+            ]
+            allowed = _make_result(
+                path="profiles/brand/default.md",
+                snippet="Allowed brand profile context survives filtering.",
+                score=0.1,
+                confidence="high",
+            )
+            return _make_response([*disallowed, allowed][: req.k])
+
+    (tmp_path / "profiles" / "brand").mkdir(parents=True)
+    (tmp_path / "profiles" / "brand" / "default.md").write_text("Brand defaults.\n", encoding="utf-8")
+    (tmp_path / "profiles.yaml").write_text(
+        """
+profiles:
+  brand:
+    retrieval:
+      allow:
+        - profiles/brand/**
+      sessions: never
+""".strip(),
+        encoding="utf-8",
+    )
+    search_engine = WindowedSearchEngine()
+    engine = ActiveMemoryEngine(
+        wake_builder=WakeBuilder(root=tmp_path),
+        search_engine=search_engine,
+        root=tmp_path,
+    )
+
+    result = engine.build(
+        ActiveMemoryReq(
+            prompt="draft brand launch copy",
+            agent="codex",
+            profile="brand",
+            include_wake=False,
+        )
+    )
+
+    assert search_engine.requests[0].k > 6
+    assert "Allowed brand profile context survives filtering." in result.block
+    assert "Disallowed project result" not in result.block
+
+
 def test_active_memory_uses_planner_queries_and_llm_composition(tmp_path: Path) -> None:
     search_engine = _StubSearchEngine()
     engine = ActiveMemoryEngine(

tests/unit/test_hermes_provider_config.py

@@ -424,6 +424,16 @@ def test_hermes_provider_tool_schema_exposes_finalized_dory_surface() -> None:
     ]
 
 
+def test_hermes_fallback_tool_schema_accepts_custom_profile_names(monkeypatch) -> None:
+    module = _load_provider_module()
+    monkeypatch.setattr(module, "_build_canonical_hermes_tool_schemas", lambda: None)
+    provider = module.DoryMemoryProvider(base_url="http://dory.local:8766")
+    schemas = {schema["name"]: schema for schema in provider.get_tool_schemas()}
+
+    assert schemas["dory_wake"]["parameters"]["properties"]["profile"] == {"type": "string"}
+    assert schemas["dory_active_memory"]["parameters"]["properties"]["profile"] == {"type": "string"}
+
+
 def test_hermes_publish_research_writes_knowledge_markdown_dry_run_by_default() -> None:
     module = _load_provider_module()
     captured: dict[str, object] = {}