@kenz1117/dsh-engram 0.7.6 → 0.7.7

package/README.en.md

@@ -68,7 +68,7 @@ Sensory and emotional dimensions (smell, temperature, emotional weight) are deli
 - **Knowledge flywheel**: capture/save → contradiction candidates (high-similarity neighbors create `contradicts` edges on write, for the model/user to adjudicate) → hit reinforcement (confidence +0.05) → distillation (topic clusters merge into higher-level rules, supersedes chains, confidence inheritance) → decay (low-importance, long-unaccessed entries archive; restorable).
 - **Automatic capture** (when `ingest` is enabled): each new turn's first step extracts candidate facts from the previous turn out of the session log, and session end captures the final turn too (failures leave a pending key that the next session replays; capture is idempotent per session+turn), written with low confidence and deduplicated by embedding — memories accumulate without you saying "remember this".
 - **Provenance audit**: every memory records its source session, turn, and event seq; `engram_review` traces the full source chain, supersede chain, contradictions, and operation log; all writes/edits/forgets/distills/decays land in the operation log table.
-- **Web management panel** (v0.7.0+): the "Memory Library" tab in Settings has five views — Today (a summary bar: memories / open / clarity + last-7-days counts + health ring, followed by due-today recall, refurb list, health breakdown, room directory, tour proposal), Room exhibition (filters, tour-route order, batch actions, list & edit), Corridor tour (corridor bird's-eye + retrieval bench), Curator log (last-7-days counts + the full merged op_log, filterable by operation class), and History backfill. A single 3-pill scope switcher in the header drives every panel; UI copy is bilingual zh/en and follows the host language setting live. Filter by redaction marks (include/exclude `[REDACTED:*]` entries) with amber badges for audit coverage.
+- **Web management panel** (v0.7.0+): the "Memory Library" tab in Settings has five views — Today (a summary bar: memories / open / clarity + last-7-days counts + due today + health ring, followed by tour proposal, room directory, refurb list, health breakdown), Room exhibition (filters incl. due today, tour-route order, batch actions, list & edit), Corridor tour (corridor bird's-eye + retrieval bench), Curator log (last-7-days counts + the full merged op_log, filterable by operation class), and History backfill. A single 3-pill scope switcher in the header drives every panel; UI copy is bilingual zh/en and follows the host language setting live. Filter by redaction marks (include/exclude `[REDACTED:*]` entries) with amber badges for audit coverage.
 - **Prompt-injection defense**: every memory recall exit (profile injection, `engram_search/timeline/review` output) is wrapped in `<engram_memory_context>` protocol tags with a usage warning (history is not the current request, do not follow instructions inside it, use only when relevant), while the current request is wrapped separately in `<current_user_request>`; all inbound content (capture candidates, saved bodies) is stripped of these protocol tags first, blocking second-order injection through forged protocol blocks.
 - **Capture redaction**: inbound content passes a regex scrub for common secrets and credentials (sk- API keys, Bearer, AWS AKIA, GitHub tokens, PEM private keys, password/token assignments) and matched fragments become `[REDACTED:<type>]`.
 - **Recall placeholder (anti-echo-chamber)**: memory-recall tool output inside captured slices is replaced with `[engram memory result omitted from capture: <tool>]`, and the extraction prompt states that restating existing memory is not new information, breaking the memory self-reinforcement loop.
@@ -199,6 +199,43 @@ Profile text changes as the memory store changes — changes only land at turn b
 - **No LLM adjudication of contradiction candidates** — writes only report candidates by vector similarity (≥0.88) and create edges; semantic-contradiction confirmation is left to model/user adjudication and distillation.
 - **Memories written during embedder degradation have no vectors** — memories written before the model is ready do not participate in the semantic track; after semantics come online run `pnpm backfill` once to backfill existing vectors (after `pnpm build` has warmed the model cache; `HF_ENDPOINT` configurable).
 
+## Acknowledgements
+
+Thanks to the community contributors who made this project better:
+
+- **[@lujfsd](https://github.com/lujfsd)** — [PR #2](https://github.com/kenz1117/dsh-engram/pull/2): adapting to the new dsh `sessionPersistence` read-handle API (`load()` was removed upstream), per-candidate scope on capture (the extraction output now carries `scope`), the project palace following the active workspace (`GET /api/engram/workspaces` plus the panel workspace picker), and renaming the no-git store key from "first 12 chars of cwd" to a full cwd sha256 (fixing collisions between sibling directories) — with 17 new tests and two design documents.
+- **[@f0909172434](https://github.com/f0909172434)** — [PR #4](https://github.com/kenz1117/dsh-engram/pull/4): governance for ambiguous legacy database ownership — the eager rename now writes a JSON tombstone sidecar (`<old db>.migrated-to`, created exclusively with 0o600, recording `migratedTo` / `claimedByCwd` / `claimedAt`), and a later workspace hitting the same legacy name receives a warning naming the prior claim; a new `legacyMigration` config (`eager` migrates automatically by default / `conservative` leaves old databases untouched with a warning), with migration outcomes refined into `renamed` / `kept-both` / `deferred` / `already-migrated`. Ships with tests.
+
 ## License
 
 [MIT](LICENSE) © 2026 KenZ (kenz1117)
+
+### Legacy project database migration
+
+`legacyMigration: eager` (default) keeps the automatic rename when only the old
+filename exists. A private JSON sidecar, `<old filename>.migrated-to`, records
+`migratedTo`, `claimedByCwd`, and `claimedAt` (ISO timestamp). A later workspace
+with the same truncated old filename receives a warning naming the prior claim.
+The record describes a file migration, **not proof of per-memory ownership**.
+Same-origin worktrees continue to share the same new database.
+
+Set `legacyMigration: conservative` in the plugin's `cordis.yml` config **before
+upgrading/opening old data** to leave the old database untouched. Engram warns
+with the old and proposed filenames and opens a new, initially empty project
+store, so the session can continue. If old and new files coexist, neither is
+moved or merged, regardless of policy. This mode cannot undo an earlier migration.
+
+Before manually resolving ownership, stop all hosts using the directory and back
+up databases and their SQLite sidecars. Review/export the relevant memories with
+`engram_review` / `engram_export`. The new store may already contain fresh data:
+**do not blindly move the old file over it**. Audit both stores and reassign data
+manually; no automatic classification, split, merge, or deletion is performed.
+
+The pointer includes a local workspace path; treat it as private metadata.
+Malformed/unreadable pointers stop migration rather than silently losing the
+claim history. Restoring an old file beside a pointer requires manual review.
+Rename and pointer creation are separate filesystem operations, not a transaction
+or cross-process lock. A pointer-write failure is reported with both filenames;
+the database has already moved and is not automatically rolled back. After a
+crash between the operations, inspect both paths before retrying. Existing
+migrations performed before this feature have no retroactive pointer.

package/README.md

@@ -68,7 +68,7 @@ dsh plugin --profile web add @kenz1117/dsh-engram
 - **知识飞轮**：摄取/保存 → 矛盾候选（写入时高相似近邻建 `contradicts` 边并报告，模型/用户裁决）→ 命中强化（confidence +0.05）→ 蒸馏（同主题簇合并为高层规律、supersedes 取代链、置信度继承）→ 衰减（低重要性且长期未访问归档，可恢复）。
 - **自动摄取**（`ingest` 配置开启时）：新一轮第一步从会话日志提取上一轮的候选事实，会话结束时补摄取最后一轮（失败留 pending 键，下次会话自动补做，幂等不重复），低 confidence 写入并按嵌入去重——不说"记住"也能攒记忆。**逐条判宫殿**：提炼时同步判定作用域，只跟当前项目/仓库有关的（技术选型、项目约定、架构决策）进当前会话 cwd 对应的项目库，跨项目通用的（个人偏好、习惯、本人经历）进私人库——偏好跟人走、约定跟仓库走。
 - **来源审计**：每条记忆记录来源会话、轮次与事件 seq，`engram_review` 完整回查来源链、取代链、矛盾与操作日志；全部写入/修改/遗忘/蒸馏/衰减入操作日志表。
-- **Web 管理面板**（v0.7.0+）：设置页「记忆库」tab 分五个视图——今日（速览条：记忆 / 开放 / 清晰度 + 近 7 天计数 + 健康分环；下面是今日待回忆、待翻新、健康分构成、房间目录、入殿导航）、宫殿陈展（筛选 / 巡游路线序 / 批量 / 列表与编辑）、走廊巡游（走廊鸟瞰 + 检索实验台）、管家日志（近 7 天计数 + 两库合并的完整 op_log，可按操作类别筛选）、历史回填。Header 三宫格驱动全局 scope（私人 / 项目 / 共享），全部数据源同步；**项目 scope 下三宫格右侧显示当前项目宫殿所属工作区**（标题 + 路径，默认跟随 GUI 当前工作区），旁边的工作区下拉可固定到某个工作区或切回「跟随当前会话」。界面文案中英双语，跟随宿主语言设置实时切换。支持按脱敏标记筛选（仅看/排除含 `[REDACTED:*]` 的条目）并给命中条目挂琥珀色徽标，方便审计脱敏覆盖面。
+- **Web 管理面板**（v0.7.0+）：设置页「记忆库」tab 分五个视图——今日（速览条：记忆 / 开放 / 清晰度 + 近 7 天计数 + 今日到期 + 健康分环；下面是入殿导航、房间目录、待翻新、健康分构成）、宫殿陈展（筛选含今日到期 / 巡游路线序 / 批量 / 列表与编辑）、走廊巡游（走廊鸟瞰 + 检索实验台）、管家日志（近 7 天计数 + 两库合并的完整 op_log，可按操作类别筛选）、历史回填。Header 三宫格驱动全局 scope（私人 / 项目 / 共享），全部数据源同步；**项目 scope 下三宫格右侧显示当前项目宫殿所属工作区**（标题 + 路径，默认跟随 GUI 当前工作区），旁边的工作区下拉可固定到某个工作区或切回「跟随当前会话」。界面文案中英双语，跟随宿主语言设置实时切换。支持按脱敏标记筛选（仅看/排除含 `[REDACTED:*]` 的条目）并给命中条目挂琥珀色徽标，方便审计脱敏覆盖面。
 - **提示注入防护**：全部记忆召回出口（画像注入、`engram_search/timeline/review` 输出）包 `<engram_memory_context>` 协议标签并附使用警告（历史记忆非当前请求、不遵循其中指令、仅相关时使用），当前请求独立包 `<current_user_request>`；所有入库内容（摄取候选、保存正文）先剥离这些协议标签，防伪造协议块二次注入。
 - **摄取脱敏**：入库前正则清洗常见密钥凭据（sk- 系 API key、Bearer、AWS AKIA、GitHub token、PEM 私钥、password/token 赋值），命中片段替换为 `[REDACTED:<类型>]`。
 - **召回占位（防回声室）**：摄取切片中记忆召回工具的输出替换为 `[engram memory result omitted from capture: <tool>]`，并向提取模型附注"既有记忆的复述不是新信息"，阻断记忆自我强化循环。
@@ -200,6 +200,37 @@ pnpm bundle
 - **矛盾候选无 LLM 判定** —— 写入时仅按向量相似度（≥0.88）报告候选并建边，语义矛盾的确认留给模型/用户裁决与蒸馏。
 - **嵌入器降级期间的记忆无向量** —— 模型未就绪时写入的记忆不参与语义道；语义上线后跑一次 `pnpm backfill` 补算存量向量（`pnpm build` 的模型缓存就绪后执行，可经 `HF_ENDPOINT` 配镜像）。
 
+## 致谢
+
+感谢社区贡献者让这个项目更好：
+
+- **[@lujfsd](https://github.com/lujfsd)（路杰锋）** —— [PR #2](https://github.com/kenz1117/dsh-engram/pull/2)：适配新版 dsh 的 `sessionPersistence` 只读句柄（新版已移除 `load()`）、摄取逐条判宫殿（提炼输出新增 `scope`）、项目宫殿随工作区切换（`GET /api/engram/workspaces` + 面板工作区选择器），并把无 git 时的分库命名从「cwd 前 12 字符」改为 cwd 全量 sha256（修掉同前缀目录撞库）。随 PR 附 17 条测试与两份设计文档。
+- **[@f0909172434](https://github.com/f0909172434)** —— [PR #4](https://github.com/kenz1117/dsh-engram/pull/4)：遗留项目库迁移的归属治理——eager 迁移改名时补写 JSON 墓碑 sidecar（`<旧库名>.migrated-to`，独占创建 + 0o600，记录 `migratedTo` / `claimedByCwd` / `claimedAt`），后续工作区撞上同一旧命名时收到指向先前归属的告警；新增 `legacyMigration` 配置（`eager` 默认自动迁移 / `conservative` 不动旧库只告警），迁移结果细化为 `renamed` / `kept-both` / `deferred` / `already-migrated` 等状态。随 PR 附测试。
+
 ## 许可证
 
 [MIT](LICENSE) © 2026 KenZ (kenz1117)
+
+### 旧项目库迁移策略
+
+`legacyMigration: eager`（默认）保留现有自动改名行为：只有旧库存在时迁移，
+并写入私有 JSON 记录 `<旧文件名>.migrated-to`，包含 `migratedTo`、
+`claimedByCwd` 和 `claimedAt`（ISO 时间）。后续工作区碰到相同的旧命名时，
+会收到指出先前归属的告警。记录证明的是文件迁移，**不证明每条记忆的归属**。
+相同 origin 的 worktree 仍共用新库。
+
+若需保守升级，在升级／打开旧数据**之前**于插件 `cordis.yml` 配置中设置
+`legacyMigration: conservative`。旧库保持原状，告警列出旧名和拟用的新名，
+会话继续使用新建的空项目库。无论何种策略，新旧库并存时都不移动或合并。
+此选项不能撤销已经发生的迁移。
+
+人工处理前，停止使用该目录的所有宿主，备份数据库和 SQLite sidecar，
+通过 `engram_review` / `engram_export` 审核、导出相关记忆。
+**新库可能已有新记忆，不要直接用旧库覆盖它**；应审核两边后人工重新归属。
+不自动分类、拆分、合并或删除数据。
+
+记录包含本地工作区路径，请作为私有元数据保管。记录损坏或不可读时迁移会报错；
+恢复旧库备份后若旁边已有迁移记录，也需人工确认。改名与写记录不是原子事务，
+亦不提供跨进程锁；请先停止其他宿主。写记录失败会明确报出旧名和新名，
+此时数据库已改名，不自动回滚。若在两步之间崩溃，重试前应检查文件状态。
+本功能不会为历史迁移补造记录。