@modusensus/dsh-mneme 0.7.15 → 0.7.17

package/test/api-routes-gaps.test.js

@@ -0,0 +1,218 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { EventEmitter } from "node:events";
+import { createStore } from "../src/store.js";
+import { createService } from "../src/service.js";
+import { createApi } from "../src/api.js";
+import { createSettings } from "../src/settings.js";
+
+// 覆盖 PR#73 删测后遗留的三个存活 API 空白（v0.7.16 回归补测）：
+//   /api/dsh-mneme/delete         面板删记忆（POST + auth + 存在性 404）
+//   /api/dsh-mneme/entities       实体目录（只读、limit 夹取）
+//   /api/dsh-mneme/external-api   独立服务配置（GET 发 token / PUT 校验）
+// 这三个路由在 src/api.js 里一直在跑，只是丢了测试。
+
+class FakeRes extends EventEmitter {
+  constructor() { super(); this.statusCode = 200; this.body = ""; }
+  writeHead(code, headers) { this.statusCode = code; this.headers = headers; return this; }
+  end(text) { this.body = text ?? ""; this.emit("end"); return this; }
+}
+
+function req(path, method = "GET", body = null) {
+  const r = new EventEmitter();
+  r.url = path;
+  r.method = method;
+  r.headers = {};
+  if (body !== null) {
+    process.nextTick(() => {
+      r.emit("data", Buffer.from(JSON.stringify(body)));
+      r.emit("end");
+    });
+  }
+  return r;
+}
+
+function setup(apiToken = "") {
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config: {} });
+  const settings = createSettings(store.db);
+  const commands = { add: () => {}, remove: () => {}, list: () => [] };
+  const routes = [];
+  const ctx = { webServer: { register(route) { routes.push(route); return () => {}; } } };
+  createApi(ctx, service, settings, commands, null, undefined, apiToken);
+  return { store, service, routes, settings };
+}
+
+function handler(routes, path) {
+  return routes.find((r) => r.path === path);
+}
+
+// ---------------------------------------------------------------------------
+// /api/dsh-mneme/delete
+// ---------------------------------------------------------------------------
+test("delete is auth-gated and rejects non-POST", async () => {
+  const { routes } = setup("secret-token");
+  const route = handler(routes, "/api/dsh-mneme/delete");
+
+  // 未带 token → 401
+  let res = new FakeRes();
+  await route.handler(req("/api/dsh-mneme/delete", "POST", { id: "x" }), res);
+  assert.equal(res.statusCode, 401);
+  assert.equal(JSON.parse(res.body).error, "unauthorized");
+
+  // 带 token 但 GET → 404
+  res = new FakeRes();
+  const ok = req("/api/dsh-mneme/delete", "GET");
+  ok.headers = { authorization: "Bearer secret-token" };
+  await route.handler(ok, res);
+  assert.equal(res.statusCode, 404);
+});
+
+test("delete validates id and reports missing/unknown 404", async () => {
+  const { routes, service } = setup("secret-token");
+  const route = handler(routes, "/api/dsh-mneme/delete");
+
+  // 空 id → 400
+  let res = new FakeRes();
+  let ok = req("/api/dsh-mneme/delete", "POST", { id: "  " });
+  ok.headers = { authorization: "Bearer secret-token" };
+  await route.handler(ok, res);
+  assert.equal(res.statusCode, 400);
+  assert.equal(JSON.parse(res.body).error, "missing-id");
+
+  // 不存在的 id → 404（store.remove 静默，靠前置 getById 区分）
+  res = new FakeRes();
+  ok = req("/api/dsh-mneme/delete", "POST", { id: "no-such-memory" });
+  ok.headers = { authorization: "Bearer secret-token" };
+  await route.handler(ok, res);
+  assert.equal(res.statusCode, 404);
+  assert.equal(JSON.parse(res.body).error, "not-found");
+
+  // 确认没被误删
+  assert.equal(service.count(), 0);
+});
+
+test("delete removes an existing memory", async () => {
+  const { routes, service } = setup("secret-token");
+  const route = handler(routes, "/api/dsh-mneme/delete");
+
+  const { memory } = service.saveWithDedupe({ type: "project", title: "要删的", content: "删掉我" });
+  assert.ok(service.getById(memory.id));
+
+  const res = new FakeRes();
+  const ok = req("/api/dsh-mneme/delete", "POST", { id: memory.id });
+  ok.headers = { authorization: "Bearer secret-token" };
+  await route.handler(ok, res);
+  assert.equal(res.statusCode, 200);
+  assert.deepEqual(JSON.parse(res.body), { ok: true });
+  assert.equal(service.getById(memory.id), undefined);
+  assert.equal(service.count(), 0);
+});
+
+// ---------------------------------------------------------------------------
+// /api/dsh-mneme/entities
+// ---------------------------------------------------------------------------
+test("entities directory is read-only and returns empty list", async () => {
+  const { routes } = setup();
+  const route = handler(routes, "/api/dsh-mneme/entities");
+  const res = new FakeRes();
+  await route.handler(req("/api/dsh-mneme/entities"), res);
+  assert.equal(res.statusCode, 200);
+  assert.deepEqual(JSON.parse(res.body), { entities: [], total: 0 });
+});
+
+test("entities lists seeded entities without auth", async () => {
+  const { routes, service } = setup("secret-token"); // 有 token 但读路由不校验
+  service.createEntity({ name: "SQLite", type: "technology" });
+  service.createEntity({ name: "记忆", type: "concept" });
+
+  const route = handler(routes, "/api/dsh-mneme/entities");
+  const res = new FakeRes();
+  await route.handler(req("/api/dsh-mneme/entities"), res);
+  assert.equal(res.statusCode, 200);
+  const data = JSON.parse(res.body);
+  assert.equal(data.total, 2);
+  const names = data.entities.map((e) => e.name).sort();
+  assert.deepEqual(names, ["SQLite", "记忆"]);
+  for (const e of data.entities) {
+    assert.ok(e.type, "each entity carries a type");
+    assert.ok(Number.isInteger(e.mention_count));
+  }
+});
+
+test("entities clamps limit to [1, 1000]", async () => {
+  const { routes, service } = setup();
+  for (let i = 0; i < 5; i++) service.createEntity({ name: `e${i}`, type: "concept" });
+  const route = handler(routes, "/api/dsh-mneme/entities");
+
+  // 夹取语义：NaN/0 先被 `|| 500` 兜底成 500（0 不再走 max(1,) 下限），
+  // 负数才被夹到 1，超限（>1000）夹到 1000。断言按真实实现收紧。
+  for (const [qs, want] of [["limit=abc", 5], ["limit=0", 5], ["limit=-10", 1], ["limit=5000", 5]]) {
+    const res = new FakeRes();
+    await route.handler(req(`/api/dsh-mneme/entities?${qs}`), res);
+    const data = JSON.parse(res.body);
+    assert.equal(data.entities.length, want, `${qs} → ${want} (got ${data.entities.length})`);
+  }
+});
+
+// ---------------------------------------------------------------------------
+// /api/dsh-mneme/external-api
+// ---------------------------------------------------------------------------
+test("external-api GET materializes and persists a token", async () => {
+  const { routes, settings } = setup();
+  const route = handler(routes, "/api/dsh-mneme/external-api");
+
+  const res = new FakeRes();
+  await route.handler(req("/api/dsh-mneme/external-api"), res);
+  assert.equal(res.statusCode, 200);
+  const cfg = JSON.parse(res.body).config;
+  assert.ok(typeof cfg.token === "string" && cfg.token.length >= 16, "token is generated");
+
+  // 持久化后二次 GET 返回同一 token
+  const res2 = new FakeRes();
+  await route.handler(req("/api/dsh-mneme/external-api"), res2);
+  assert.equal(JSON.parse(res2.body).config.token, cfg.token);
+  assert.ok(settings.getExternalApi().token, "token persisted to settings kv");
+});
+
+test("external-api PUT requires auth and validates port/host", async () => {
+  const { routes } = setup("secret-token");
+  const route = handler(routes, "/api/dsh-mneme/external-api");
+
+  // 未带 token → 401
+  let res = new FakeRes();
+  await route.handler(req("/api/dsh-mneme/external-api", "PUT", { enabled: true }), res);
+  assert.equal(res.statusCode, 401);
+
+  // 端口越界 → 400
+  res = new FakeRes();
+  let ok = req("/api/dsh-mneme/external-api", "PUT", { port: 70000 });
+  ok.headers = { authorization: "Bearer secret-token" };
+  await route.handler(ok, res);
+  assert.equal(res.statusCode, 400);
+  assert.equal(JSON.parse(res.body).error, "invalid-port");
+
+  // host 带协议 → 400
+  res = new FakeRes();
+  ok = req("/api/dsh-mneme/external-api", "PUT", { host: "https://example.com" });
+  ok.headers = { authorization: "Bearer secret-token" };
+  await route.handler(ok, res);
+  assert.equal(res.statusCode, 400);
+  assert.equal(JSON.parse(res.body).error, "invalid-host");
+});
+
+test("external-api PUT applies valid config and echoes it", async () => {
+  const { routes } = setup("secret-token");
+  const route = handler(routes, "/api/dsh-mneme/external-api");
+
+  const res = new FakeRes();
+  const ok = req("/api/dsh-mneme/external-api", "PUT", { enabled: true, port: 8790, host: "127.0.0.1" });
+  ok.headers = { authorization: "Bearer secret-token" };
+  await route.handler(ok, res);
+  assert.equal(res.statusCode, 200);
+  const cfg = JSON.parse(res.body).config;
+  assert.equal(cfg.enabled, true);
+  assert.equal(cfg.port, 8790);
+  assert.equal(cfg.host, "127.0.0.1");
+  assert.ok(typeof cfg.token === "string");
+});

package/test/client.test.js

@@ -160,6 +160,65 @@ test("sidebar entry portals above the workspaces region with footer fallback", (
   );
 });
 
+// Three alignment/softness guarantees born from field feedback: (a) the
+// portalled entry keeps tracking the live New-Session class (host and skin
+// rewrite it asynchronously, so a mount-time snapshot goes stale), (b) it
+// fills the same width as that button and inherits its native centering,
+// (c) the toolbar dropdown escapes the transform stacking trap — the
+// container needs the z-index because transform creates the context.
+test("entry tracks native class, fills native width, and lifts the toolbar dropdown", () => {
+  assert.ok(
+    clientSource.includes("new MutationObserver"),
+    "the entry must re-sync the copied class via MutationObserver"
+  );
+  assert.ok(
+    clientSource.includes('attributeFilter: ["class"]'),
+    "the observer must watch class attribute changes"
+  );
+  assert.ok(
+    /\.mneme-topentry-native\{width:100%;/.test(clientSource),
+    "the entry button must fill the same width as the New-Session row"
+  );
+  assert.equal(
+    clientSource.includes(".mneme-topentry-native .mneme-topentry-label{flex:1;min-width:0;text-align:left;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}"),
+    false,
+    "the old left-aligned label override must go; native centering applies"
+  );
+  assert.ok(
+    /\.mneme-xtools\{[^}]*z-index:3\}/.test(clientSource),
+    "the toolbar container must carry z-index:3 (sticky month header is 2, drawer 6)"
+  );
+});
+
+// Importance renders as Lucide star glyphs (the morphicons-paired data set;
+// the runtime cannot require the ESM-only morphicons engine, so the path
+// ships inline like the other stroke icons), not raw ★ text. Only the
+// drawer's edit-mode <option> labels keep the text form — SVG cannot render
+// inside <option>.
+test("importance renders as star glyphs, not raw text stars", () => {
+  assert.ok(
+    clientSource.includes("STAR_PATH_D"),
+    "the Lucide star path data must be inlined"
+  );
+  assert.ok(
+    clientSource.includes("const ImportanceStars"),
+    "the star-row component must exist"
+  );
+  assert.equal(
+    (clientSource.match(/"★"\.repeat/g) || []).length,
+    1,
+    "only the drawer edit <option> labels may keep the ★ text form"
+  );
+  assert.ok(
+    /h\(ImportanceStars, \{ className: "mneme-dmetaval"/.test(clientSource),
+    "the drawer detail must render the star row"
+  );
+  assert.ok(
+    /h\(ImportanceStars, \{ value: m\.importance/.test(clientSource),
+    "the card foot must render the star row"
+  );
+});
+
 // The graph toggle must not read as "share": the primitives share icon is
 // banned and a custom node-graph glyph takes its place.
 test("graph toggle uses a node-graph glyph, not the share icon", () => {

package/test/dream.test.js

@@ -870,7 +870,7 @@ test("Bug8: runDream records llm_audit_logs rows for consolidation and summary",
   assert.deepEqual(summarize.related_memory_ids, [], "summary audit has no related ids");
   for (const row of rows) {
     assert.equal(row.status, "success");
-    assert.equal(row.model_id, "mock:stress-model");
+    assert.equal(row.model_id, "deepseek:deepseek-chat", "config-first route (Issue #25): dreamProvider/dreamModel wins");
     assert.ok(Number.isInteger(row.duration_ms) && row.duration_ms >= 0, "duration recorded");
     assert.equal(row.input_tokens, 0);
     assert.equal(row.output_tokens, 0);

package/test/lib-smoke.test.js

@@ -0,0 +1,96 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readdirSync, readFileSync } from "node:fs";
+import { join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// lib/ 运行冒烟（v0.7.16 回归补测，重建被 PR#73 删除的 lib-smoke.test.js）。
+// npm 包实际加载的是 lib/（package main → lib/index.js），历史教训 v0.7.8
+// 只改 src 忘了同步 lib 发出去旧产物（issue #65）。这里补两层守护：
+//   1) 静态：src/ 与 lib/ 逐文件字节一致（check-sync.js 的测试版，CI 常驻）；
+//   2) 运行时：直接从 lib/ 导入核心模块跑关键链路，证明打包产物可独立加载。
+
+const root = fileURLToPath(new URL("..", import.meta.url)); // dsh-mneme/
+const srcDir = join(root, "src");
+const libDir = join(root, "lib");
+
+function walk(dir) {
+  const out = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) out.push(...walk(full));
+    else if (entry.isFile()) out.push(full);
+  }
+  return out;
+}
+
+test("src/ and lib/ are byte-identical (no publish drift)", () => {
+  const srcFiles = walk(srcDir);
+  assert.ok(srcFiles.length > 0, "src tree is not empty");
+  const drift = [];
+  for (const file of srcFiles) {
+    const rel = relative(srcDir, file);
+    const dest = join(libDir, rel);
+    if (!readFileSync(dest, "utf8")) {
+      drift.push(`missing lib/${rel}`);
+    } else if (!readFileSync(file).equals(readFileSync(dest))) {
+      drift.push(`differ lib/${rel}`);
+    }
+  }
+  assert.deepEqual(drift, [], "src↔lib must stay in sync (npm run sync)");
+});
+
+// ---------------------------------------------------------------------------
+// lib 运行时冒烟：直接加载 npm 实际分发的产物
+// ---------------------------------------------------------------------------
+test("lib store+service runs a save/get/count cycle", async () => {
+  const { createStore } = await import("../lib/store.js");
+  const { createService } = await import("../lib/service.js");
+
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config: {} });
+  const { memory } = service.saveWithDedupe({ type: "preference", title: "语言", content: "中文" });
+  assert.ok(memory.id);
+  assert.ok(service.getById(memory.id));
+  assert.equal(service.count(), 1);
+});
+
+test("lib summarize parses extraction JSON robustly", async () => {
+  const { parseSummaryJson } = await import("../lib/summarize.js");
+
+  // 前后夹带杂质的原始输出 → 只取数组
+  const parsed = parseSummaryJson("```json\n[{\"type\":\"preference\",\"title\":\"x\",\"content\":\"y\",\"importance\":9}]\n```");
+  assert.equal(parsed.length, 1);
+  assert.equal(parsed[0].importance, 5, "importance clamped to [1,5]");
+
+  // 非法 JSON / 非数组 → 空数组，不抛
+  assert.deepEqual(parseSummaryJson("no array here"), []);
+  assert.deepEqual(parseSummaryJson('{"type":"preference"}'), []);
+  assert.deepEqual(parseSummaryJson(""), []);
+});
+
+test("lib summarize constructs with autoSummarize disabled", async () => {
+  const { createSummarizer } = await import("../lib/summarize.js");
+  const summarizer = createSummarizer({}, {}, { autoSummarize: false });
+  assert.equal(typeof summarizer.dispose, "function");
+  summarizer.dispose();
+});
+
+test("lib inject constructs and renders an empty block", async () => {
+  const { createInjector } = await import("../lib/inject.js");
+  const registered = [];
+  const ctx = {
+    systemPrompt: {
+      context: (def) => { registered.push(def); return () => {}; }
+    }
+  };
+  const service = { injectCandidates: () => [], injectSettings: () => [] };
+  const dispose = createInjector(ctx, service, {}, {});
+  assert.equal(typeof dispose, "function");
+  assert.equal(registered.length, 2, "memory + user-settings contexts registered");
+
+  const memoryBlock = registered.find((d) => d.name === "memory");
+  assert.equal(typeof memoryBlock.text, "function");
+  assert.equal(memoryBlock.text({}), ""); // 无候选 → 空块
+  dispose();
+});

package/test/llm-audit.test.js

@@ -50,10 +50,11 @@ test("autoDream writes llm_audit_logs rows for consolidation and summary", async
   assert.equal(summarize.trigger_source, "autoDream");
   assert.equal(consolidate.status, "success");
   assert.equal(summarize.status, "success");
-  // mockCtx resolves the route from agentDefaultModel (mock:stress-model), not
-  // the config fallback — assert the actually-used route.
-  assert.equal(consolidate.model_id, "mock:stress-model");
-  assert.equal(summarize.model_id, "mock:stress-model");
+  // config-first (Issue #25): dreamSetup sets dreamProvider/dreamModel, so it
+  // wins over mockCtx's agentDefaultModel (mock:stress-model) — assert the
+  // actually-used config route.
+  assert.equal(consolidate.model_id, "deepseek:deepseek-chat");
+  assert.equal(summarize.model_id, "deepseek:deepseek-chat");
   assert.ok(Array.isArray(consolidate.related_memory_ids) && consolidate.related_memory_ids.length === 2,
     "consolidation audit records the snapshot ids");
   assert.ok(consolidate.total_tokens >= 0 && summarize.total_tokens >= 0);
@@ -110,6 +111,35 @@ test("autoDream throwing LLM is audited as status=error", async () => {
   store.close();
 });
 
+test("autoDream parse failure is audited as status=error, not fake success", async () => {
+  const { store, service, config } = dreamSetup();
+  service.saveWithDedupe({ type: "project", title: "主题", content: "内容" });
+  // Stream completes fine but returns no JSON array — the run fails, and the
+  // audit must NOT claim success (the old bug: llm_audit said dream_consolidate
+  // success while the run recorded failed).
+  const warnings = [];
+  const ctx = {
+    logger: { warn: (m) => warnings.push(m) },
+    llm: {
+      async *stream() {
+        yield { type: "text-delta", index: 0, text: "抱歉，我无法解析成 JSON。" };
+        yield { type: "finish", reason: { kind: "stop" } };
+      }
+    }
+  };
+  const dream = createDreamScheduler({ thresholdCount: 1, thresholdChars: 0, delayMs: 0 });
+  const result = await dream.runDream(ctx, service, config);
+  assert.equal(result.ok, false);
+  assert.equal(result.error, "no json array in llm output");
+  const rows = service.listLlmAudits();
+  assert.equal(rows.length, 1, "failed consolidation still audited");
+  assert.equal(rows[0].operation_type, "dream_consolidate");
+  assert.equal(rows[0].status, "error", "stream succeeded but output unusable → audit error");
+  assert.match(rows[0].error_message, /no json array in llm output/);
+  assert.ok(warnings.some((m) => m.includes("head: 抱歉，我无法解析成")), "raw output head logged for diagnosis");
+  store.close();
+});
+
 test("autoDream audit is skipped when llmAudit.enabled === false", async () => {
   const { store, service, config } = dreamSetup({ llmAudit: { enabled: false } });
   service.saveWithDedupe({ type: "project", title: "主题", content: "内容" });

package/test/reasoning-effort.test.js

@@ -107,6 +107,70 @@ test("issue#9: dream forwards dreamReasoningEffort on both LLM calls", async ()
   store.close();
 });
 
+test("issue#25: dreamProvider/dreamModel config wins over the agentDefaultModel route", async () => {
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config: {} });
+  const dream = createDreamScheduler({ onRun: () => Promise.resolve({ ok: true, skipped: true }) });
+  const { memory: a } = service.saveWithDedupe({ type: "project", title: "插件", content: "旧", importance: 3 });
+  const { memory: b } = service.saveWithDedupe({ type: "project", title: "插件2", content: "新细节", importance: 4 });
+  const captured = [];
+  const ctx = dreamCtx({
+    captured,
+    onConsolidation: () => JSON.stringify([
+      { action: "merge", ids: [a.id, b.id], keepSource: b.id, title: "插件总览", content: "合并内容", importance: 4 }
+    ])
+  });
+  // dreamCtx's agentDefaultModel resolves (mock:mock-model), but the explicit
+  // config route must win — otherwise dreamProvider/dreamModel is dead code in
+  // a standard DSH install and the dream can never be moved off a thinking model.
+  const result = await dream.runDream(ctx, service, { dreamProvider: "volcano", dreamModel: "deepseek-v3" });
+  assert.equal(result.ok, true);
+  assert.ok(captured.length >= 2, "consolidation + summary both hit the LLM");
+  for (const options of captured) {
+    assert.equal(options.provider, "volcano");
+    assert.equal(options.model, "deepseek-v3", "config route wins over agentDefaultModel (mock:mock-model)");
+  }
+  store.close();
+});
+
+test("issue#9: rejected reasoningEffort retries once without it and still consolidates", async () => {
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config: {} });
+  const dream = createDreamScheduler({ onRun: () => Promise.resolve({ ok: true, skipped: true }) });
+  const { memory: a } = service.saveWithDedupe({ type: "project", title: "插件", content: "旧", importance: 3 });
+  const { memory: b } = service.saveWithDedupe({ type: "project", title: "插件2", content: "新细节", importance: 4 });
+  const calls = [];
+  const ctx = {
+    logger: { warn: () => {} },
+    agentDefaultModel: { currentSelection: () => ({ provider: "mock", model: "mock-model" }) },
+    llm: {
+      async *stream(options) {
+        calls.push(options);
+        const userText = options.messages.find((m) => m.role === "user")?.content?.[0]?.text ?? "";
+        if (userText.startsWith("id=")) {
+          // First attempt forwards reasoningEffort: the provider rejects it.
+          if (options.reasoningEffort) {
+            throw new Error("UNSUPPORTED_REASONING_EFFORT: DeepSeek does not support reasoning effort \"low\"");
+          }
+          yield { type: "text-delta", index: 0, text: JSON.stringify([
+            { action: "merge", ids: [a.id, b.id], keepSource: b.id, title: "合并标题", content: "合并内容", importance: 4 }
+          ]) };
+        } else {
+          yield { type: "text-delta", index: 0, text: "记忆库总览：用户偏好中文。" };
+        }
+        yield { type: "finish", reason: { kind: "stop" } };
+      }
+    }
+  };
+  const result = await dream.runDream(ctx, service, { dreamReasoningEffort: "low" });
+  assert.equal(result.ok, true, "run survives the effort rejection via the fallback retry");
+  assert.ok(result.applied > 0, "consolidation still lands changes");
+  assert.equal(calls.length, 3, "consolidation tried (rejected) + retried without effort + summary");
+  assert.equal(calls[0].reasoningEffort, "low", "first consolidation attempt forwards the effort");
+  assert.equal("reasoningEffort" in calls[1], false, "retry omits the rejected effort field");
+  store.close();
+});
+
 // ---------------------------------------------------------------- sleep passthrough
 
 function sleepSetup() {