@modusensus/dsh-mneme 0.7.13 → 0.7.15

package/src/settings.js

@@ -31,6 +31,155 @@ function parseList(raw) {
   }
 }
 
+// --- feature flags（功能开关）白名单 -----------------------------------------
+// 面板可逐项开关的后端能力。设计约束：
+// 1. 键名与类型必须和 config.js schema 同名同型，这份白名单是唯一校验源
+//    （api.js 复用它计算 effective），schema 增删能力键时要同步改这里。
+// 2. 持久化（kv "feature_flags"）只落白名单键；读到未知键、类型损坏或越界的
+//    值一律丢弃而不是报错——kv 会残留旧版本写入的键，读路径必须向前兼容。
+// 3. 写入是逐键校验的合并写：未知键/类型/范围不符抛 TypeError（消息含键名，
+//    供 API 透传给前端定位），校验不通过不落库，坏值永远进不了 kv。
+const FEATURE_FLAG_BOOLEANS = [
+  "autoInject",
+  "autoSummarize",
+  "hotMemoryEnabled",
+  "entityExtractionEnabled",
+  "codingRetrospect",
+  "autoDream",
+  "sleepModeEnabled",
+  "hybridInject",
+  "selectiveInjectEnabled",
+  "searchSemanticDedup",
+  "rerankEnabled",
+  "adaptiveThresholdEnabled",
+  "reflectionUpdateEnabled",
+  "reflectionFailureTracking",
+  "bm25SearchEnabled",
+  "conflictFreezeEnabled",
+  "trustEpistemicWeighting",
+  // 嵌套对象开关：config.js 里是 memoryQualityFilter / llmAudit 对象的 enabled
+  // 子字段。kv 按点号键平铺存（"memoryQualityFilter.enabled": false），index.js
+  // 合并时展开回嵌套对象，api.js 的 effective 从对象子字段取值。
+  "memoryQualityFilter.enabled",
+  "llmAudit.enabled"
+];
+// 整数开关的闭区间，与 config.js 里 z.natural().min().max() 对齐。
+const FEATURE_FLAG_INT_RANGES = {
+  distillRateLimitIntervalMs: [0, 60000],
+  distillRateLimitRetries: [0, 10],
+  distillRateLimitBaseDelayMs: [100, 60000],
+  distillMaxChars: [1000, 200000],
+  codingBoostFactor: [1, 5]
+};
+// 自由字符串开关（与 config.js 的 z.string() 同名同型）：trim 后 ≤200 字符，
+// 空串合法（= 跟随主对话模型/默认路径，面板显示 placeholder）。
+const FEATURE_FLAG_STRINGS = [
+  "dreamProvider",
+  "dreamModel",
+  "localEmbedModel",
+  "ollamaModel"
+];
+// URL 字符串开关：trim 后必须为空或合法 http/https URL（new URL() 校验协议，
+// 拒绝其余协议——这是 SSRF 防线的一部分）。
+const FEATURE_FLAG_URLS = ["ollamaBaseUrl"];
+// 枚举开关（与 config.js 的 z.union(z.const(...)) 对齐）：仅允许列出的值。
+const FEATURE_FLAG_ENUMS = {
+  embedProvider: ["openai", "local", "ollama"]
+};
+const FEATURE_FLAG_STRING_MAX = 200;
+
+// 供 api.js 复用同一份白名单（effective 只在白名单键上计算）。
+export const FEATURE_FLAG_SPEC = {
+  booleans: FEATURE_FLAG_BOOLEANS,
+  ints: FEATURE_FLAG_INT_RANGES,
+  strings: FEATURE_FLAG_STRINGS,
+  urls: FEATURE_FLAG_URLS,
+  enums: FEATURE_FLAG_ENUMS
+};
+
+/** ollamaBaseUrl 的协议白名单：只接受 http/https（SSRF 防线的一部分）。 */
+function isHttpUrl(value) {
+  try {
+    const protocol = new URL(value).protocol;
+    return protocol === "http:" || protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+
+/** 校验单个开关值；不合法抛 TypeError（消息含键名）。 */
+function validateFlag(key, value) {
+  if (FEATURE_FLAG_BOOLEANS.includes(key)) {
+    if (typeof value !== "boolean") {
+      throw new TypeError(`feature flag "${key}" must be a boolean`);
+    }
+    return value;
+  }
+  const range = FEATURE_FLAG_INT_RANGES[key];
+  if (range) {
+    const [min, max] = range;
+    if (!Number.isInteger(value) || value < min || value > max) {
+      throw new TypeError(`feature flag "${key}" must be an integer in [${min}, ${max}]`);
+    }
+    return value;
+  }
+  if (FEATURE_FLAG_STRINGS.includes(key)) {
+    if (typeof value !== "string") {
+      throw new TypeError(`feature flag "${key}" must be a string`);
+    }
+    const trimmed = value.trim();
+    if (trimmed.length > FEATURE_FLAG_STRING_MAX) {
+      throw new TypeError(`feature flag "${key}" must be at most ${FEATURE_FLAG_STRING_MAX} characters`);
+    }
+    return trimmed; // 空串合法 = 跟随默认
+  }
+  if (FEATURE_FLAG_URLS.includes(key)) {
+    if (typeof value !== "string") {
+      throw new TypeError(`feature flag "${key}" must be a string`);
+    }
+    const trimmed = value.trim();
+    if (trimmed && !isHttpUrl(trimmed)) {
+      throw new TypeError(`feature flag "${key}" must be empty or a valid http(s) URL`);
+    }
+    return trimmed; // 空串合法 = 跟随默认
+  }
+  const allowed = FEATURE_FLAG_ENUMS[key];
+  if (allowed) {
+    if (typeof value !== "string" || !allowed.includes(value)) {
+      throw new TypeError(`feature flag "${key}" must be one of: ${allowed.join(", ")}`);
+    }
+    return value;
+  }
+  throw new TypeError(`unknown feature flag "${key}"`);
+}
+
+/** 清洗已存的 feature_flags 对象：只保留白名单键，类型/范围损坏的键丢弃。 */
+function sanitizeFlags(raw) {
+  const out = {};
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return out;
+  for (const key of FEATURE_FLAG_BOOLEANS) {
+    if (typeof raw[key] === "boolean") out[key] = raw[key];
+  }
+  for (const [key, [min, max]] of Object.entries(FEATURE_FLAG_INT_RANGES)) {
+    if (Number.isInteger(raw[key]) && raw[key] >= min && raw[key] <= max) out[key] = raw[key];
+  }
+  for (const key of FEATURE_FLAG_STRINGS) {
+    if (typeof raw[key] === "string" && raw[key].trim().length <= FEATURE_FLAG_STRING_MAX) {
+      out[key] = raw[key].trim();
+    }
+  }
+  for (const key of FEATURE_FLAG_URLS) {
+    if (typeof raw[key] === "string") {
+      const trimmed = raw[key].trim();
+      if (!trimmed || isHttpUrl(trimmed)) out[key] = trimmed;
+    }
+  }
+  for (const [key, allowed] of Object.entries(FEATURE_FLAG_ENUMS)) {
+    if (allowed.includes(raw[key])) out[key] = raw[key];
+  }
+  return out;
+}
+
 export function createSettings(db) {
   db.exec(SCHEMA);
 
@@ -177,6 +326,31 @@ export function createSettings(db) {
     },
     setPanelMode(mode) {
       setSetting("panel_mode", mode === "light" ? "light" : "standard");
+    },
+
+    /**
+     * Feature flags（kv "feature_flags"）：面板对后端能力的显式覆盖。读取只
+     * 返回白名单内的合法键（默认 {}），写入是逐键校验后的合并持久化。
+     */
+    getFeatureFlags() {
+      const raw = getSetting("feature_flags");
+      if (!raw) return {};
+      try {
+        return sanitizeFlags(JSON.parse(raw));
+      } catch {
+        return {};
+      }
+    },
+    setFeatureFlags(patch) {
+      if (typeof patch !== "object" || patch === null || Array.isArray(patch)) {
+        throw new TypeError("feature flags patch must be a plain object");
+      }
+      const merged = this.getFeatureFlags();
+      for (const [key, value] of Object.entries(patch)) {
+        merged[key] = validateFlag(key, value);
+      }
+      setSetting("feature_flags", JSON.stringify(merged));
+      return merged;
     }
   };
 }

package/src/store.js

@@ -303,6 +303,25 @@ function escapeLike(q) {
   return q.replace(/[\\%_]/g, (c) => `\\${c}`);
 }
 
+// 日期过滤参数归一化（list/count 共用，保证分页 total 与行同过滤）：接受 ISO
+// 日期（"2026-09-01"）或完整时间戳，返回闭区间的 UTC ISO 边界。date-only 的
+// updatedFrom 按当天 00:00:00.000Z 起、updatedTo 按当天 23:59:59.999Z 收；非
+// 法值一律返回 undefined → 不进 WHERE（忽略而非报错：面板传坏参数时宁可放宽
+// 过滤也不要白屏）。updated_at 列是 toISOString 产生的 UTC "Z" 字符串，字典
+// 序与时间序一致，SQL 里可直接比较。
+function updatedAtBounds(updatedFrom, updatedTo) {
+  const norm = (raw, endOfDay) => {
+    if (typeof raw !== "string" || !raw.trim()) return undefined;
+    const s = raw.trim();
+    const dateOnly = /^\d{4}-\d{2}-\d{2}$/.test(s);
+    const ms = Date.parse(dateOnly ? `${s}T00:00:00.000Z` : s);
+    if (Number.isNaN(ms)) return undefined;
+    if (dateOnly && endOfDay) return `${s}T23:59:59.999Z`;
+    return new Date(ms).toISOString();
+  };
+  return { from: norm(updatedFrom, false), to: norm(updatedTo, true) };
+}
+
 function parseTags(raw) {
   try {
     const arr = JSON.parse(raw);
@@ -618,7 +637,7 @@ export function createStore(path) {
     return ts;
   }
 
-  function count(type, { minImportance = null, source = null, includeForgotten = false, includeArchived = false } = {}) {
+  function count(type, { minImportance = null, source = null, includeForgotten = false, includeArchived = false, onlyArchived = false, updatedFrom = null, updatedTo = null } = {}) {
     const clauses = [];
     const params = [];
     if (type !== undefined) {
@@ -634,10 +653,24 @@ export function createStore(path) {
       clauses.push("source = ?");
       params.push(source);
     }
+    // updated_at 闭区间：与 list() 共用 updatedAtBounds 归一化，非法值被忽略
+    // （不进 WHERE），total 才能和行保持同过滤。
+    const bounds = updatedAtBounds(updatedFrom, updatedTo);
+    if (bounds.from) {
+      clauses.push("updated_at >= ?");
+      params.push(bounds.from);
+    }
+    if (bounds.to) {
+      clauses.push("updated_at <= ?");
+      params.push(bounds.to);
+    }
     if (!includeForgotten) {
       clauses.push("forgotten = 0");
     }
-    if (!includeArchived) {
+    // 与 list() 同过滤：total 才能和归档列表的行保持一致。
+    if (onlyArchived) {
+      clauses.push("archived = 1");
+    } else if (!includeArchived) {
       clauses.push("archived = 0");
     }
     const where = clauses.length ? `WHERE ${clauses.join(" AND ")}` : "";
@@ -891,7 +924,7 @@ export function createStore(path) {
     return rows.map(toRow);
   }
 
-  function list({ type, limit = 50, offset = 0, order = "importance", includeForgotten = false, includeArchived = false, minImportance = null, source = null } = {}) {
+  function list({ type, limit = 50, offset = 0, order = "importance", includeForgotten = false, includeArchived = false, onlyArchived = false, minImportance = null, source = null, updatedFrom = null, updatedTo = null } = {}) {
     const clauses = [];
     const params = [];
     if (type) {
@@ -908,10 +941,25 @@ export function createStore(path) {
       clauses.push("source = ?");
       params.push(source);
     }
+    // Optional updated_at closed range (date-only "to" is normalized to the
+    // end of that day). Same helper as count() so total matches the rows.
+    const bounds = updatedAtBounds(updatedFrom, updatedTo);
+    if (bounds.from) {
+      clauses.push("updated_at >= ?");
+      params.push(bounds.from);
+    }
+    if (bounds.to) {
+      clauses.push("updated_at <= ?");
+      params.push(bounds.to);
+    }
     if (!includeForgotten) {
       clauses.push("forgotten = 0");
     }
-    if (!includeArchived) {
+    // onlyArchived：只看归档（状态页的归档列表用）；与 includeArchived（含
+    // 归档混看）互斥，同时给时归档视图优先。
+    if (onlyArchived) {
+      clauses.push("archived = 1");
+    } else if (!includeArchived) {
       clauses.push("archived = 0");
     }
     const { limit: lim, offset: off } = sanitizePage(limit, offset, 50);
@@ -1598,6 +1646,30 @@ export function createStore(path) {
     ).all(memoryId).map(toAttr);
   }
 
+  /**
+   * 一条记忆关联到的实体（记忆详情侧栏用）：entity_attrs.memory_id 反查实体，
+   * 一条 JOIN 完成。同一记忆对同一实体的多次提及（多条 attr 行）按 name 去重，
+   * 每个实体只出现一次，按提及次数降序。只取 name/type——attr 详情走
+   * entity-attrs 端点。无关联（或记忆不存在）返回空数组。
+   */
+  function entitiesForMemory(memoryId) {
+    const rows = db.prepare(
+      `SELECT e.id, e.name, e.type, e.mention_count, e.last_seen
+       FROM entity_attrs ea JOIN entities e ON e.id = ea.entity_id
+       WHERE ea.memory_id = ?
+       GROUP BY e.id
+       ORDER BY e.mention_count DESC, e.last_seen DESC, e.name ASC`
+    ).all(memoryId ?? "");
+    const seen = new Set();
+    const out = [];
+    for (const row of rows) {
+      if (seen.has(row.name)) continue;
+      seen.add(row.name);
+      out.push({ name: row.name, type: row.type ?? null });
+    }
+    return out;
+  }
+
   /**
    * Memories carrying a currently-valid attr matching key=value (deduped).
    * When value is empty/undefined, the attr_value filter is dropped and every
@@ -1941,6 +2013,7 @@ export function createStore(path) {
     getCurrentAttrs,
     getAttrHistory,
     getAttrsByMemory,
+    entitiesForMemory,
     findMemoriesByAttr,
     saveRelation,
     migrateAttrsToMemory,

package/src/summarize.js

@@ -8,7 +8,7 @@ const SUMMARY_PROMPT = `你是记忆库提炼助手。根据下面的会话内
 // 编码记忆蒸馏 prompt（codingRetrospect 开启时启用）：在通用记忆之外，额外提取
 // 三类编码专属记忆，专治重复踩坑 / 遗忘被否决方案 / 丢失工程约束。字段仍沿用
 // title/content 单列结构（store 无结构化字段），信息浓缩进 content。
-const CODING_SUMMARY_PROMPT = `你是记忆库提炼助手。根据下面的会话内容（含用户输入、助手思考/回答、工具调用与结果），提炼值得跨会话记住的原子记忆。
+const CODING_SUMMARY_PROMPT = `你是记忆库提炼助手。根据下面的会话内容（含用户输入、助手回答、工具调用与结果），提炼值得跨会话记住的原子记忆。
 原子记忆原则：每条记忆只装一个独立事实/偏好/决策，短小、自带完整上下文（把数字、报错信息、命令、路径、结论等原始细节保留在 content 里，不要抽象概括）；宁可拆成多条也绝不合并丢细节。信息量一般提 2-4 条，信息密集的对话可提 4-8 条。
 只输出 JSON 数组，每项形如 {"type":"preference|project|decision|history|rejected_solution|pitfall|constraint","title":"简短标题","content":"保留原始细节的一句话","importance":1-5}。
 若对话涉及编码/调试，可额外提取编码类记忆：
@@ -91,18 +91,22 @@ function toProtocolChunk(chunk) {
 // check below.
 //
 // codingRetrospect: the distill context is the FULL turn transcript —
-// user prompts plus assistant thinking/replies, tool calls + results and code
+// user prompts plus assistant public replies, tool calls + results and code
 // dispatch output — so the summarizer can see tool errors and extract pitfall
 // root causes, not just what the user typed. The same filtering stays: only
 // source.kind === "user" prompts enter (plugin/machine content is excluded).
 // The result is a single text transcript passed to the LLM as one user message
 // (SUMMARY_PROMPT already says "根据下面的会话内容").
+//
+// Privacy: assistant `reasoning` (private thought) blocks are deliberately NOT
+// collected — distilled memories must never sink private reasoning chains.
+// Only public text blocks (type "text") reach the summarizer.
 function collectMessages(session, maxChars = 8000) {
   // DSH 0.1.2-rc.1 起 Session 改用 snapshotEvents()，兼容旧版 .events
   const events = session.snapshotEvents?.() ?? session.events ?? [];
   const lines = [];
   // 兼容严格形状 [{type:"text",text}] 与宽松形状 ["字符串", ...]（lib-smoke 用例
-  // 直接传字符串数组）。text 之外按需抽 thinking/reasoning 块。
+  // 直接传字符串数组）。只取公开文本块；reasoning 私有推理块不进蒸馏上下文。
   const textOf = (content) => {
     if (typeof content === "string") return content;
     if (!Array.isArray(content)) return "";
@@ -127,11 +131,7 @@ function collectMessages(session, maxChars = 8000) {
         const blocks = Array.isArray(msg?.content) ? msg.content : [];
         const text = textOf(blocks);
         if (text.trim()) lines.push(`助手：${text}`);
-        const thinking = blocks
-          .map((b) => (typeof b === "string" ? "" : (b && b.type === "reasoning" && typeof b.text === "string" ? b.text : "")))
-          .filter((s) => s)
-          .join("\n");
-        if (thinking.trim()) lines.push(`助手思考：${thinking}`);
+        // 私有推理块（reasoning）刻意不采集：蒸馏记忆不得沉淀模型私有思考链。
         break;
       }
       case "tool/call": {