Local-first memory for AI coding agents: shell history with exit codes, git diffs, docs, MCP.
Risky behavior the analysis could not rule out.
The `hook install` command writes a block into the user's shell profile so that every later shell session logs each command's timestamp, cwd and exit code to disk; this is a documented, opt-in, removable feature of the tool.
will now log their timestamp, cwd and exit code
What the analysis could not settle from the code alone.
Candidates the review stage examined and rejected, kept for transparency.
The adapter upserts NexusMem hooks for SessionStart and PostToolUse events into Claude Code settings (agent control-plane config), capturing Bash/Edit/Write tool events; this matches the declared purpose, preserves other tools' hooks, and writing the file is left to the CLI.
hooks[event] = [...withoutOurs(hooks[event] ?? []), ...matcherFor(commands, event)];
The hook upsert is the declared, opt-in Claude Code hook feature. It removes only NexusMem's own entries and leaves other tools' hooks alone, so it is neither undeclared nor harmful beyond the core capability.
The CLI's agent install command writes NexusMem hook commands into Claude Code settings files (settings.local.json), which then run on agent events to capture commands and inject recall output; this is a control-plane write, though it is the tool's declared, user-invoked setup.
Project scope uses settings.local.json: a committed settings.json would
The settings write only happens when the user runs `agent install`. It is declared, it prints exactly what it captures, `agent remove` undoes it, and project scope deliberately uses the local settings file so teammates are not affected.
The CLI exposes an opt-in `agent install` command that writes NexusMem hooks into Claude Code settings (user-level or project .claude/settings.local.json), an agent control-plane write that is declared in the command description but whose implementation is not shown here.
write to this repository's .claude/settings.local.json
The `agent install` command is declared as opt-in in its own description, and its implementation is shown in agent.ts as an explicit, removable settings write. That makes this the declared core capability.
The shell hook installer writes a capture snippet into the user's shell profile (rc file) and can strip it again; this is the declared shell-history capture feature, and the D18 'pipeline does not change' claim concerns ranking, not file writes, so the detector contradiction is not a real one.
await writeFile(target.profilePath, next, 'utf8');
The profile write is the declared, opt-in shell-hook install, and `removeHook` strips it again. The D18 contradiction is spurious because D18 is a claim about ranking, not about file writes.
The installer generates a PowerShell profile block that overrides the global prompt function to capture each command line, cwd and exit code and pass them to a spawned node recorder, a persistent profile modification logging all commands.
function global:prompt {The prompt override is the shell-command-logging hook that is NexusMem's declared core capability (search_memory covers 'shell commands'). It is marker-delimited, the raw command goes only to the recorder's stdin, and the recorder hashes and redacts before writing.
The installer generates a ~/.zshrc block that registers preexec/precmd hooks to record every command with cwd and exit code via a background node recorder, a persistent shell-profile modification that logs all typed commands.
precmd_functions=(__nxm_precmd "${precmd_functions[@]}")The preexec/precmd hook is the openly documented core shell-memory feature. The raw command is only piped to the recorder, which hashes and redacts it, and the block is marker-delimited with a strip function for cleanup.
The `hook git-post install` command installs a git post-commit hook that launches a detached background `nexusmem sync` after every commit, and it can be appended to an existing foreign hook; this is documented and removable.
in the background after each commit
The post-commit hook is an explicitly declared opt-in feature. It is removable, the output tells the user it runs in the background, and it only appends to a foreign hook when the user passes --force.
The `hook install` command modifies the user's shell profile to log every command's timestamp, cwd and exit code; it is explicit, user-invoked, and documented in output, but is a persistent host-config write outside the declared MCP tools.
const result = await installHook(target);
`hook install` is the declared, opt-in shell-hook feature. It runs only on explicit user invocation, prints the profile and log paths it uses, and `hook remove` undoes it.
The bash hook module inserts a command-logging block into the user's ~/.bashrc that takes over the global DEBUG trap and records every shell command, which is persistent host-config modification and shell activity capture, though it is the disclosed core feature.
Generates and manages the block NexusMem inserts into `~/.bashrc` to log
The bash hook block is the declared, opt-in shell-hook feature. The module documents how it works, takes the DEBUG trap only when it is unset, and is removed with `hook remove`.
The bash hook snippet modifies ~/.bashrc with a DEBUG trap and PROMPT_COMMAND that pipes every shell command, cwd and exit code to a node recorder that logs to a file. This is persistent command logging, though the snippet itself does no network send.
--log "$__nxm_log_path" --shell bash-hook >/dev/null 2>&1 & )
The snippet is the declared opt-in shell logger. It takes over the DEBUG trap only when nothing else holds it. The recorder redacts commands before writing them, and the snippet makes no network call.
The installer generates a ~/.bashrc block that hooks PROMPT_COMMAND and the DEBUG trap to capture every shell command with its cwd and exit code and pipe it to a background recorder, which is a persistent shell-profile modification that logs all typed commands, including any secrets in them, to disk.
PROMPT_COMMAND="__nxm_precmd${PROMPT_COMMAND:+; $PROMPT_COMMAND}"The PROMPT_COMMAND/DEBUG-trap block is the declared shell-logging feature. It is opt-in and removable, the recorder redacts commands, and the DEBUG trap is taken only when unset.
The generic git hook installer writes and chmods executable hook files at a dynamic hookPath, appending to foreign hooks under --force; this is host-config persistence beyond the MCP tool surface, but it is marker-delimited, removable and refuses foreign hooks by default. The detector's contradiction with the spec's ranking-pipeline claim (D18) is a false positive.
await writeFile(target.hookPath, next, 'utf8');
This is the generic installer behind the declared opt-in git hooks. It refuses foreign hooks unless --force is passed, and it is marker-delimited and removable. The D18 contradiction is a false positive because that claim is about the ranking pipeline.
The generated post-commit hook launches a detached background `nexusmem sync` after every commit with output redirected to a log file, running silently without user interaction; this is documented, installed via an explicit command, and removable.
nohup sh -c
The detached background sync is the declared purpose of the opt-in post-commit hook. It is installed by an explicit command, removable, and only runs the project's own `nexusmem sync`.
The post-commit git hook snippet launches a detached nohup background 'nexusmem sync' resolved from PATH after each commit, so a PATH-shadowed nexusmem binary would run silently with output sent to a log file.
nexusmem sync --quiet --auto >>${LOG_PATH} 2>&1Resolving `nexusmem` from PATH is how any installed CLI is invoked, and the hook is a declared opt-in feature. A PATH-shadowing attack would need prior control of the user's environment, so the snippet adds no new harm.
The git post-commit hook installer adds a block to .git/hooks/post-commit that launches a detached background `nexusmem sync` after every commit, logging to .nexusmem/post-commit-sync.log. This is declared, local-only behavior.
detached (`nohup ... &`) so the hook process exits immediately once it has
The module documents its own detached background sync and log destination. It is declared, local-only and opt-in, so it is the core capability and nothing is concealed.
The PowerShell hook module inserts a block into the user's PowerShell profile that wraps `prompt` to log every command with its cwd and exit code; this is declared core functionality, with commands redacted by the recorder.
Generates and manages the block NexusMem inserts into a PowerShell profile
The PowerShell profile block is the declared opt-in shell hook. It wraps the existing prompt without replacing it, and the raw command only reaches the recorder's stdin, which hashes and redacts it.
The zsh hook module writes a persistent block into the user's ~/.zshrc that records every shell command, cwd and exit code to a hook log; this is the declared core feature, and the raw command is redacted before persistence.
Generates and manages the block NexusMem inserts into `~/.zshrc` to log
The finding itself says this is the declared core feature. The module header states the purpose openly, and the block is idempotent and strippable.
The sync_project tool, whose declared purpose is ingesting history, also exposes an agent-callable irreversible deletion of all nodes from a source (pruneSource/pruneStaleShell with yes=true); it is disclosed and dry-run by default, but it is a destructive capability beyond a sync tool.
dry-run unless yes is also true, since this is an irreversible full wipe of that source.
The prune option is fully disclosed in the tool description. It is dry-run unless yes=true, and it only deletes NexusMem's own derived memory nodes from a stale source, not user files.
The MCP sync_project tool forwards agent-supplied pruneSource/pruneStaleShell/yes parameters to runSync, letting a connected agent irreversibly delete memory nodes from the store without separate user confirmation.
pruneSource: input.pruneSource,
The forwarding of prune parameters implements the disclosed tool schema. Nothing is removed unless the explicit yes confirmation is passed, and the deletion is limited to NexusMem's own memory nodes.
The server resolves and reads the user's ~/.bash_history and ~/.zsh_history, which are undeclared in the target description and can contain secrets; this fits the shell-history memory purpose, and the recorder redacts content, so it is a contextual risk.
join(homedir(), '.bash_history')
The snippet only resolves a history file path. Shell-command memory is a declared capability of search_memory, so the shell-history path is not undeclared, and no exfiltration or read-to-sink chain is shown.
The server resolves the user's ~/.bashrc and ~/.zshrc profile paths (undeclared), presumably to install a shell hook; the write itself is not shown in this batch.
return join(homedir(), '.bashrc');
The function only returns the conventional ~/.bashrc path, and the documented purpose is the declared shell-hook feature. No write or concealed behavior is shown at this location.
The memory server locates and reads the user's Claude Code session transcripts under ~/.claude/projects, which can hold sensitive conversation text; they are indexed locally after redaction and no network sink appears in these units.
return join(homedir(), '.claude', 'projects', claudeProjectSlug(repoRoot));
The function only builds the transcript directory path for the current repo's slug. Reading conversation transcripts is the declared `scan-conversation` feature of a memory tool, and no network sink is shown.
search_memory accepts an allProjects flag that searches every repository NexusMem has been run in on this machine, reaching beyond the supplied projectRoot; it is disclosed in the tool schema.
Search every repository NexusMem has been run in on this machine, not just projectRoot.
The allProjects option is openly described in the tool schema. It only widens a search over NexusMem's own local memory store, which is the declared purpose of search_memory, and results are tagged by repository.