@modusensus/dsh-mneme 0.7.5 → 0.7.7

package/.github/workflows/publish.yml

@@ -0,0 +1,58 @@
+name: Publish to npm
+
+# 发布路径：registry.npmjs.org 在本机云服务器被出口 SNI 过滤 + 17897 隧道不稳定，
+# 改由 GitHub runner 发布（不依赖本机出网）。打 v* tag 自动触发，或 workflow_dispatch 手动。
+#
+# ⚠️ 版本号机制（血的教训）：
+#   root package.json 在 git 里永远停在 0.7.2，真实版本号在 dsh-mneme/package.json。
+#   npm 在跑 prepublishOnly 之前就已加载 manifest，脚本里改 root 版本不生效，
+#   会把 root 的旧版本（0.7.2）发出去。必须在 npm publish 之前显式同步 root 版本。
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org/
+
+      - name: Registry current state (diagnostic)
+        run: |
+          npm view @modusensus/dsh-mneme versions --json || true
+          npm view @modusensus/dsh-mneme time --json || true
+
+      # 关键：先同步 root 版本 → 再 publish（prepublishOnly 改版本不可靠）
+      - name: Sync root version from dsh-mneme
+        run: |
+          V="$(node -p "require('./dsh-mneme/package.json').version")"
+          echo "Syncing root package.json to v${V}"
+          node -e "const fs=require('fs');const v=process.argv[1];const p=JSON.parse(fs.readFileSync('./package.json','utf8'));p.version=v;fs.writeFileSync('./package.json',JSON.stringify(p,null,2)+'\n')" "$V"
+          node -p "console.log('root now:', require('./package.json').version)"
+
+      - name: Publish @modusensus/dsh-mneme (skip if exists)
+        run: |
+          V="$(node -p "require('./dsh-mneme/package.json').version")"
+          if npm view "@modusensus/dsh-mneme@${V}" version >/dev/null 2>&1; then
+            echo "v${V} already published on registry — skipping"
+          else
+            npm publish
+          fi
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Verify published version
+        run: |
+          V="$(node -p "require('./dsh-mneme/package.json').version")"
+          echo "Published: $(npm view "@modusensus/dsh-mneme@${V}" version)"

package/CHANGELOG.md

@@ -1,5 +1,7 @@
 # Changelog
 
+> **完整版本历史见 [dsh-mneme/CHANGELOG.md](dsh-mneme/CHANGELOG.md)**（正式版本正源，0.3.8 → 0.7.7）。以下为仓库早期开发记录（0.1.0–0.2.x，2026-08-13~14，已归档）。
+
 All notable changes to dsh-mneme are documented here.
 
 ## [Unreleased]

package/README.md

@@ -5,14 +5,14 @@
 <h1 align="center">dsh-mneme</h1>
 
 <p align="center">
-  <a href="https://www.npmjs.com/package/@modusensus/dsh-mneme"><img src="https://img.shields.io/npm/v/@modusensus/dsh-mneme?color=blue&label=npm" alt="npm version"></a>
-  <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-green" alt="license"></a>
+  <a href="https://www.npmjs.com/package/@modusensus/dsh-mneme"><img src="https://img.shields.io/npm/v/@modusensus/dsh-mneme?style=flat-square&color=3E63DD&label=npm" alt="npm version"></a>
+  <a href="https://www.npmjs.com/package/@modusensus/dsh-mneme"><img src="https://img.shields.io/npm/dm/@modusensus/dsh-mneme?style=flat-square&color=3E63DD&label=downloads" alt="npm downloads"></a>
+  <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-3E63DD?style=flat-square" alt="license"></a>
+  <a href="https://github.com/modusensus/dsh-mneme/actions"><img src="https://img.shields.io/github/actions/workflow/status/modusensus/dsh-mneme/test.yml?style=flat-square&label=CI" alt="CI"></a>
+  <a href="https://nodejs.org"><img src="https://img.shields.io/badge/node-24%2B-3E63DD?style=flat-square&logo=nodedotjs&logoColor=white" alt="node"></a>
+  <a href="https://github.com/modusensus/dsh-mneme"><img src="https://img.shields.io/badge/tests-810%20passed-3E63DD?style=flat-square" alt="tests"></a>
+  <a href="https://codecov.io/gh/modusensus/dsh-mneme"><img src="https://img.shields.io/codecov/c/github/modusensus/dsh-mneme/main?style=flat-square" alt="coverage"></a>
   <a href="https://github.com/awesome-dsh-plugin/awesome-dsh-plugin"><img src="https://awesome-dsh-plugin.com/badge.svg" alt="Awesome"></a>
-  <a href="https://github.com/modusensus/dsh-mneme/actions"><img src="https://img.shields.io/github/actions/workflow/status/modusensus/dsh-mneme/test.yml" alt="CI"></a>
-  <a href="https://nodejs.org"><img src="https://img.shields.io/badge/node-24%2B-blue" alt="node"></a>
-  <a href="https://github.com/modusensus/dsh-mneme"><img src="https://img.shields.io/badge/tests-782%20passed-success" alt="tests"></a>
-  <a href="https://www.npmjs.com/package/@modusensus/dsh-mneme"><img src="https://img.shields.io/npm/dm/@modusensus/dsh-mneme?color=blue&label=downloads" alt="npm downloads"></a>
-  <a href="https://codecov.io/gh/modusensus/dsh-mneme"><img src="https://img.shields.io/codecov/c/github/modusensus/dsh-mneme/main" alt="coverage"></a>
 </p>
 
 <p align="center"><strong><a href="#中文">中文</a> | <a href="#english">English</a></strong></p>
@@ -87,7 +87,7 @@ dsh web
 | 语义架构 | [dsh-mneme/docs/SEMANTIC.md](dsh-mneme/docs/SEMANTIC.md) |
 | 本地模型部署指南 | [dsh-mneme/docs/LOCAL_MODEL.md](dsh-mneme/docs/LOCAL_MODEL.md) |
 | v0.1 迁移说明 | [dsh-mneme/docs/MIGRATION.md](dsh-mneme/docs/MIGRATION.md) |
-| 版本历史 | [CHANGELOG.md](CHANGELOG.md) |
+| 版本历史 | [dsh-mneme/CHANGELOG.md](dsh-mneme/CHANGELOG.md) |
 | 安全策略 | [SECURITY.md](SECURITY.md) |
 
 ## 🗺️ 路线图
@@ -107,14 +107,17 @@ dsh web
 | **v0.7.2** | issue #35 删除按钮内联确认修复 + issue #34 对话开始注入当前时间（opt-in） | ✅ |
 | **v0.7.3** | issue #38 左下角入口按钮可选开关 `showSidebarTrigger` | ✅ |
 | **v0.7.4** | issue #40 记忆花括号转义 + issue #41 记忆窗口关闭按钮重叠修复 | ✅ |
-| **v0.8.0** | 图谱增强：兴趣漂移 + 跨 workspace 共享 | 🚧 计划中（9 月末） |
+| **v0.7.5** | 分层记忆类型 user/fact + Web 总览视图 + stats 端点 | ✅ |
+| **v0.7.6** | issue #48 修复：截断/前缀 id 也能精确操作（统一 resolveMemoryId）+ client.js 改 src 正源 | ✅ |
+| **v0.7.7** | issue #23 图谱回填：sleep 批量实体抽取 phase + node:sqlite 兼容修复 | ✅ |
+| **v0.8.0** | 图谱增强：兴趣漂移可视化 + scope 隔离（issue #17）+ 跨 workspace 共享 | 🚧 计划中（9 月末） |
 
 ## 🧪 本地开发
 
 ```bash
 cd dsh-mneme
 npm install
-npm test          # 782 个测试
+npm test          # 810 个测试
 npm run stress    # 三轴线压测
 npm run sync      # src → lib 同步
 ```
@@ -192,7 +195,7 @@ Works out of the box. Enable these as needed:
 | Semantic architecture | [dsh-mneme/docs/SEMANTIC.md](dsh-mneme/docs/SEMANTIC.md) |
 | Local model guide | [dsh-mneme/docs/LOCAL_MODEL.md](dsh-mneme/docs/LOCAL_MODEL.md) |
 | v0.1 migration | [dsh-mneme/docs/MIGRATION.md](dsh-mneme/docs/MIGRATION.md) |
-| Changelog | [CHANGELOG.md](CHANGELOG.md) |
+| Changelog | [dsh-mneme/CHANGELOG.md](dsh-mneme/CHANGELOG.md) |
 | Security | [SECURITY.md](SECURITY.md) |
 
 ## 🗺️ Roadmap
@@ -212,14 +215,16 @@ Works out of the box. Enable these as needed:
 | **v0.7.2** | Issue #35 delete button inline-confirm fix + Issue #34 inject current time at conversation start (opt-in) | ✅ |
 | **v0.7.3** | Issue #38 optional sidebar trigger `showSidebarTrigger` | ✅ |
 | **v0.7.4** | Issue #40 prompt-brace escaping + Issue #41 overlay close-button overlap fix | ✅ |
-| **v0.8.0** | Graph enhancement: interest drift + cross-workspace sharing | 🚧 Planned (late Sep) |
+| **v0.7.5** | Layered memory types (user/fact) + Overview view + stats endpoint | ✅ |
+| **v0.7.6** | Issue #48 fix: truncated/prefix ids resolve for exact ops (unified resolveMemoryId) + client.js now src-authored | ✅ |
+| **v0.8.0** | Graph enhancement: interest-drift visualization + scope isolation (issue #17) + cross-workspace sharing | 🚧 Planned (late Sep) |
 
 ## 🧪 Local Development
 
 ```bash
 cd dsh-mneme
 npm install
-npm test          # 782 tests
+npm test          # 810 tests
 npm run stress    # three-axis stress test
 npm run sync      # src → lib sync
 ```

package/SECURITY.md

@@ -56,7 +56,7 @@ The following security features are implemented and maintained in the project:
 
 ### Please DO
 
-1. **Email** `guanqishi26@gmail.com` (or open a **private security advisory** via [GitHub Security Advisories](https://github.com/modusensus/dsh-mneme/security/advisories))
+1. **Email** `work@modusensus.space` (or open a **private security advisory** via [GitHub Security Advisories](https://github.com/modusensus/dsh-mneme/security/advisories))
 2. Include:
    - A clear description of the vulnerability
    - Steps to reproduce (minimal test case preferred)
@@ -392,7 +392,7 @@ This project is licensed under the **MIT License**. See [LICENSE](https://github
 
 ### 请这样做
 
-1. **发送邮件**至 `guanqishi26@gmail.com`（或通过 [GitHub 私有安全公告](https://github.com/modusensus/dsh-mneme/security/advisories) 提交）
+1. **发送邮件**至 `work@modusensus.space`（或通过 [GitHub 私有安全公告](https://github.com/modusensus/dsh-mneme/security/advisories) 提交）
 2. 邮件内容请包含：
    - 漏洞的清晰描述
    - 复现步骤（优先提供最小测试用例）
@@ -671,4 +671,4 @@ dsh-mneme:
 ---
 
 *Last updated: 2026-08-28*  
-*Policy version: 2.2*
+*Policy version: 2.2*

package/dsh-mneme/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## [0.7.7] - 2026-09-05
+
+### 🆕 issue #23：sleep 批量实体抽取回填实体图谱
+
+- **背景**：写路径抽取（index.js）只有 `entityExtractionEnabled` 开启才触发——每次写入一次 LLM 调用，是刻意的成本取舍——所以默认安装下记忆从不累积实体，这正是 issue #23 报的"实体图谱面板一片空白"（用户明明有很多记忆）。
+- **新增 sleep 批量抽取 phase**：默认关 `sleepEntityExtractionEnabled`，开睡循环时按**最老优先**把没有实体属性的记忆逐条过 `extractEntities`（每轮上限 `sleepEntityExtractionMaxPerRun` 默认 20）。
+- **下沉为有界 SQL 查询**（kimi 复验意见 #2）：新增 `store.listForEntityExtraction({limit, offset})`，`WHERE` 只留行级条件（未归档/未遗忘/非 summary/内容非空/`metadata.entity_extracted_at` 为空），`ORDER BY created_at LIMIT ? OFFSET ?` 分页取最老候选；实体是否已存在是跨表检查（`getAttrsByMemory`），由 JS 在每页上过滤。不再 `service.all()` 全表加载。
+- **幂等防重**（kimi 意见 #3）：抽取前先 stamp `metadata.pending_extracted_at`，成功后替换为 `entity_extracted_at`，失败清除 pending——一条记忆不会被并发/崩溃重复抽取，失败的下轮重试。
+- **metadata 合并不覆盖**（kimi 意见 #4）：`store.setMemoryMetadata` 改为 merge 语义，打实体时间戳不会抹掉其他路径刚写入的 metadata 字段。
+- **失败不阻断**（kimi 意见 #5）：单条抽取失败只跳过该条、记入 `failed` 计数，整轮状态由 `deriveStatus` 正确折叠 `failed`——一次 LLM 抖动不会 abort 整个 sleep 周期。
+- **node:sqlite 兼容修复**（复验时抓到的实现 bug）：wxbot 初版用 better-sqlite3 的 `.pluck()`（node:sqlite 不存在），改为 `.all().map(row => getById(row.id))`；`listForEntityExtraction` 的 `forgotten IS NULL` 条件与 `save` 硬编码写入的 `forgotten=0` 永不匹配导致查询恒空，修正为 `(forgotten = 0 OR forgotten IS NULL)`（与 archived 同构）。
+- 新增 9 个用例（禁用/跳过、stamp 不重复、无实体也 stamp、backfill、失败重试、metadata merge #4、pending 清除 #3、failed 状态折叠 #5、分页最老优先 #2），全套 **810 通过**。
+
+## [0.7.6] - 2026-09-02
+
+### 🐛 issue #48：截断的短 id 也能精确操作
+
+- **现象**：`memory_update` / `memory_delete` / `memory_forget` / `memory_archive` 此前对 id 做**严格精确匹配**（`WHERE id = ?`，无任何前缀/模糊逻辑）。若宿主上下文压缩或手抄把 36 位 UUID 截断，`memory_delete` 会静默返回 `{deleted:false}`（无 warn、无日志），其余三个工具抛错——对用户都表现为"操作不进也不出"。
+- **新增 `service.resolveMemoryId`**：精确命中优先，否则把传入值当 id 前缀解析（主键前缀走索引，无性能问题）；命中多条 → 拒绝操作并列出候选完整 id，**绝不瞎猜**。
+- **四工具统一接入**：`memory_update` / `memory_forget` / `memory_archive` 未命中抛错并提示"请传完整 id（`memory_list` / `memory_search` 输出均为完整 id）"；`memory_delete` 保持幂等返回 `{deleted:false}`，未命中补 `logger.warn` 留痕，可被服务日志定位。
+- 完整 id 直连不受影响（精确命中优先，不会因"恰好是另一条的前缀"被误判歧义）。
+- 复验加固：纯通配符 id（`%`/`_`）剥空后按无匹配处理，杜绝退化成 `LIKE '%'` 全表误删单条记忆；id 首尾空白自动 trim。
+- 补 11 个用例（前缀删除/更新/归档/遗忘、歧义拒绝、未命中兜底、精确优先、通配符兜底、空白 trim、warnMiss 日志），全套 **801 通过**。
+
+### 🧹 工程：client.js 改为 src 正源
+
+- Web 面板 bundle `client.js` 历史上是 lib/ 下**手写、无 src 副本**的唯一例外（重蹈过 v0.6.7 源码漏提交）；现补 `src/client.js` 为唯一正源，`npm run sync` 统一同步出 `lib/client.js`，guard 测试改为断言两文件字节一致，杜绝 drift。
+
 ## [0.7.5] - 2026-09-02
 
 ### 🆕 新功能：分层记忆类型 user/fact

package/dsh-mneme/README.md

@@ -5,7 +5,7 @@
 [![npm version](https://img.shields.io/npm/v/@modusensus/dsh-mneme?color=blue&label=npm)](https://www.npmjs.com/package/@modusensus/dsh-mneme)
 [![license](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 [![Awesome](https://awesome-dsh-plugin.com/badge.svg)](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin)
-[![tests](https://img.shields.io/badge/tests-782%20passed-success)](https://github.com/modusensus/dsh-mneme)
+[![tests](https://img.shields.io/badge/tests-810%20passed-success)](https://github.com/modusensus/dsh-mneme)
 [![CI](https://img.shields.io/github/actions/workflow/status/modusensus/dsh-mneme/test.yml)](https://github.com/modusensus/dsh-mneme/actions)
 [![node](https://img.shields.io/badge/node-24%2B-blue)](https://nodejs.org)
 [![npm downloads](https://img.shields.io/npm/dm/@modusensus/dsh-mneme?color=blue&label=downloads)](https://www.npmjs.com/package/@modusensus/dsh-mneme)
@@ -241,6 +241,8 @@ v0.3.0 起新增**记忆基因**层：从记忆里抽取**命名实体**、**带
 
 | 版本 | 亮点 |
 |------|------|
+| **v0.7.7** | issue #23 实体图谱回填：sleep 批量实体抽取 phase（`sleepEntityExtractionEnabled` 默认关；最老优先、SQL LIMIT/OFFSET 分页下沉为有界查询不整表扫描；`pending_extracted_at` 幂等防重、成功/失败清除；metadata 合并不覆盖其他路径写入）；kimi-k2.7-code 复验 + node:sqlite 兼容修复（pluck→all+map、`forgotten=0` 查询条件）；810 测试全绿 |
+| **v0.7.6** | issue #48 修复：`memory_update`/`memory_delete`/`memory_forget`/`memory_archive` 支持截断/前缀短 id（新增 `service.resolveMemoryId`：精确命中优先 + 唯一前缀解析 + 多命中拒绝列出候选 + `memory_delete` 未命中幂等补 `logger.warn`；纯通配符/空白兜底）；Web bundle `client.js` 改 src 正源；801 测试全绿 |
 | **v0.7.5** | 分层记忆类型：新增 `user`（用户画像）/`fact`（原子事实）轻量记忆类型（单表 `type` 扩展，不动 schema）+ Web 面板「总览」视图（记忆分层卡片 + 用户画像卡 + 类型分布 + 近 7 天趋势）+ `/api/dsh-mneme/stats` 统计端点；kimi-k2.7-code 复验（days 整数化等）；790 测试全绿 |
 | **v0.7.4** | issue #40 修复：记忆内容含 `{{...}}` 模板语法时整轮崩溃（注入边界 run-based 花括号转义 `{{a}}`→`{\{a\}\}`，奇数连续如 `{{{a}}}` 也不残留字面 `{{`；新增 `escapePromptVariables` 配置默认开）；issue #41 修复：记忆窗口关闭按钮与宿主窗口控制按钮重叠无法点击（顶栏左对齐，关闭按钮离开右上角宿主控制区）；782 测试全绿 |
 | **v0.7.3** | issue #38 新功能：左下角入口按钮可选开关 `showSidebarTrigger`（默认开）——与 dsh-cost-meter 等抢占 footer slot 的插件冲突时可在 Web 面板「设置」一键关闭，仅隐藏按钮、记忆库标签不受影响；776 测试全绿 |
@@ -295,7 +297,9 @@ v0.3.0 起新增**记忆基因**层：从记忆里抽取**命名实体**、**带
 | **v0.7.3** | ✅ 完成 | issue #38 新功能 | 左下角入口按钮可选开关 `showSidebarTrigger`（默认开，settings-over-config）；Web 面板设置一键关闭，与 dsh-cost-meter 等 footer 插件冲突可隐藏按钮、记忆库标签不受影响；776 测试全绿 |
 | **v0.7.4** | ✅ 完成 | issue #40 + #41 修复 | 注入边界 run-based 花括号转义（`{{a}}`→`{\{a\}\}`、奇数连续如 `{{{a}}}` 不残留字面，`escapePromptVariables` 默认开）+ 记忆窗口顶栏左对齐、关闭按钮避开宿主窗口控制按钮区；782 测试全绿 |
 | **v0.7.5** | ✅ 完成 | 分层记忆类型 + 总览视图 | 借鉴 meow-memory 分层概念、贴合单表架构：新增 `user`（用户画像）/`fact`（原子事实）类型，注入/镜像/梦境/质量过滤全链路打通；Web 面板「总览」视图（分层卡片 + 用户画像卡 + 类型分布 + 近 7 天趋势）；`/api/dsh-mneme/stats` 端点；kimi-k2.7-code 复验；790 测试全绿 |
-| **v0.8.0** | 🚧 计划中（9 月末） | 图谱增强 | 兴趣漂移可视化 + 跨 workspace 记忆共享 + 更多 heat 信号 |
+| **v0.7.7** | ✅ 完成 | issue #23 图谱回填 | sleep 批量实体抽取 phase：默认关 `sleepEntityExtractionEnabled`，按最老优先、SQL LIMIT/OFFSET 分页（下沉为有界查询，不再整表扫描）批量抽取未打标记忆的实体（修复 issue #23 实体图谱空白）；`pending_extracted_at` 幂等防重、成功/失败清除，metadata 合并不覆盖；kimi-k2.7-code 复验 + node:sqlite 兼容修复（pluck→all+map、`forgotten=0` 查询条件）；810 测试全绿 |
+| **v0.7.6** | ✅ 完成 | issue #48 修复 | 四工具统一 `service.resolveMemoryId`：截断/前缀短 id 也能精确操作（精确命中优先、唯一前缀解析、多命中拒绝并列出候选、`memory_delete` 未命中幂等返回 + `logger.warn` 留痕）；Web bundle `client.js` 改 src 正源；801 测试全绿 |
+| **v0.8.0** | 🚧 计划中（9 月末） | 图谱增强 | 兴趣漂移可视化 + scope 隔离（issue #17）+ 跨 workspace 记忆共享 + 更多 heat 信号 |
 
 > 新能力一律做成**可开关的功能**（配置启用/关闭），默认保守开启、不破坏现有行为。`failure_memories` 表与 autoDream 决策引擎已为后续反思性成长铺好路。
 
@@ -457,11 +461,10 @@ src/
 ├── hot-memory.js     # 会话级短期热记忆（v0.5.0：滚动轮次 + token 预算）
 ├── embedding.js      # OpenAI 兼容 embeddings 客户端 + 向量检索
 ├── api.js            # HTTP 路由（Web 面板数据通道）
+├── client.js         # Web 面板 bundle（ModuleLoader 自注册；v0.7.6 起 src 正源）
 └── index.js          # 插件接线
-lib/
-├── client.js         # Web 面板（手写 ModuleLoader bundle）
-└── *.js              # src 的同步分发产物
-test/                 # 757 个 node:test 测试（含审计与三轴线压测不变量）
+lib/                  # src 的同步分发产物（npm run sync，prepack 自动执行；无手写例外）
+test/                 # 810 个 node:test 测试（含审计与三轴线压测不变量）
 scripts/              # e2e-dsh.js 端到端演示 · stress-dsh.js 三轴线压测 · sync-lib.js 同步 · benchmark-recall.js 召回基准
 ```
 
@@ -470,14 +473,14 @@ scripts/              # e2e-dsh.js 端到端演示 · stress-dsh.js 三轴线压
 ```bash
 cd dsh-mneme
 npm install        # 安装 peer 依赖（以 devDependencies 形式，用于本地测试）
-npm test           # 运行 782 个测试
+npm test           # 运行 810 个测试
 npm run stress     # 三轴线压测：长会话检索 / 冲突仲裁 / 多 Agent 并发（离线 mock LLM）
 npm run sync       # 把 src/ 同步到 lib/（发布时由 prepack 钩子自动执行）
 ```
 
 > 压测（`npm run stress`）三条轴线：**长会话检索**（Recall@k、陈旧残留率）、**冲突裁决**（可重放仲裁集：审计快照 hash + receipt + 幂等回放）、**多 Agent 并发**（丢更新、重复合并、事务/崩溃恢复）。每次 autoDream 运行都会写入审计表 `dream_runs`（输入快照 digest + 决策清单 + 逐 id 去向 + receipt），让高通过率下也能定位静默错误。
 
-> `lib/` 是 `src/` 的同步分发产物（`npm run sync`），其中 `lib/client.js` 为手写 Web 面板源码，不受同步影响。
+> `lib/` 是 `src/` 的同步分发产物（`npm run sync`）：v0.7.6 起全部由 src 复制而来，**不再有任何手写 lib 文件**——Web 面板 bundle 也以 `src/client.js` 为唯一正源。
 
 ## 📄 设计文档
 

package/dsh-mneme/lib/config.js

@@ -274,6 +274,15 @@ export const Config = z.object({
     z.const("high"),
     z.const("none")
   ]).default("none"),
+  // Batch entity extraction during sleep (issue #23). The write-path extractor
+  // only fires when entityExtractionEnabled is on (an LLM call per write);
+  // this additive phase backfills entities/attrs/relations for memories that
+  // never went through it, so stores that leave the write-path extractor off
+  // still accumulate an ego graph as long as sleep runs. On by default (it is
+  // a no-op until a sleep cycle fires), capped per run to bound token spend.
+  sleepEntityExtractionEnabled: z.boolean().default(true),
+  // Max memories entity-extracted per sleep run (oldest un-extracted first).
+  sleepEntityExtractionMaxPerRun: z.natural().min(1).max(100).default(20),
 
   // --- epistemic trust: memory source credibility (v0.4.5) -----------------
   // Distinguish memories by source: observation (measured / witnessed),

package/dsh-mneme/lib/dream/sleep.js

@@ -19,6 +19,7 @@ import { validateDecisions, applyDecisions } from "./decisions.js";
 import { findPotentialConflicts } from "./clustering.js";
 import { buildReceipt } from "../dream.js";
 import { computeHeat } from "../heat.js";
+import { extractEntities } from "../entities/extractor.js";
 
 const SUMMARY_MAX = 120;
 // Conflict similarity threshold per strictness level (v0.4.0):
@@ -396,6 +397,123 @@ function phaseRelations(service, config, logger, runId, signal = null) {
   };
 }
 
+/**
+ * Phase 4.5 — batch entity extraction. The write-path extractor (index.js)
+ * only fires when entityExtractionEnabled is on — one LLM call per write, a
+ * deliberate cost decision — so default installs never accumulate entities,
+ * which is exactly why the ego-graph panel (issue #23) renders blank for users
+ * with plenty of memories. This phase backfills the entity graph in bulk:
+ * memories that carry no entity attrs yet are passed through extractEntities
+ * one at a time (oldest first, capped per run). Write-path stays untouched —
+ * this is an additive channel for sleep users. Fail-safe per memory: one bad
+ * extract never aborts the phase or the cycle.
+ */
+async function phaseEntityExtraction(ctx, service, config, logger, runId, signal = null) {
+  if (config.sleepEntityExtractionEnabled !== true) {
+    return { status: "skipped", reason: "disabled" };
+  }
+  const route = resolveSleepRoute(ctx, config, logger);
+  if (!route) return { status: "skipped", reason: "no llm route" };
+  const maxPerRun = config.sleepEntityExtractionMaxPerRun ?? 20;
+
+  // Oldest un-extracted first. The store returns bounded pages via SQL (no
+  // O(N) full-table scan); JS pages through offsets and only pays the
+  // getAttrsByMemory cross-table check on each page, stopping once it has
+  // maxPerRun un-extracted memories or the store is exhausted. Every memory
+  // this phase touches gets stamped entity_extracted_at (successful or
+  // entity-less extracts alike) so a text with no extractable entities is not
+  // re-queued forever; failures are NOT stamped, so a transient LLM hiccup
+  // retries next cycle.
+  const candidates = [];
+  for (let offset = 0; candidates.length < maxPerRun; offset += 100) {
+    const page = service.listForEntityExtraction({ limit: 100, offset });
+    if (page.length === 0) break;
+    candidates.push(...page.filter((m) => (service.getAttrsByMemory?.(m.id) ?? []).length === 0));
+  }
+  candidates.length = Math.min(candidates.length, maxPerRun);
+  if (candidates.length === 0) return { status: "skipped", reason: "no memories to extract" };
+  if (signal?.aborted) return { status: "aborted", reason: "user activity" };
+
+  // extractEntities expects callLLM(messages, options) → text; adapt sleep's
+  // streamText + route resolution (same precedence as the other phases).
+  const callLLM = async (messages) => {
+    const r = resolveSleepRoute(ctx, config, logger);
+    if (!r) return undefined;
+    return streamText(ctx, {
+      ...r,
+      purpose: "sleep-entity-extract",
+      maxTokens: 4096,
+      ...(config.sleepReasoningEffort && config.sleepReasoningEffort !== "none"
+        ? { reasoningEffort: config.sleepReasoningEffort }
+        : {}),
+      messages
+    });
+  };
+
+  let extracted = 0;
+  let failed = 0;
+  let aborted = false;
+  const extractedIds = [];
+  for (const m of candidates) {
+    if (signal?.aborted) {
+      aborted = true;
+      break;
+    }
+    const now = new Date().toISOString();
+    try {
+      // Stamp a pending marker BEFORE the LLM call so a crash mid-extract (the
+      // stamp and the entity writes are not one transaction) cannot re-queue
+      // this memory while we are already working it. Cleared on outcome.
+      service.setMemoryMetadata?.(m.id, { pending_extracted_at: now });
+    } catch (error) {
+      logger?.warn?.(`dsh-mneme sleep: failed to stamp pending_extracted_at for ${m.id}: ${String(error)}`);
+      failed++;
+      continue;
+    }
+    try {
+      const result = await extractEntities(m, { store: service, config, callLLM, logger });
+      if (result?.ok) {
+        extracted++;
+        extractedIds.push(m.id);
+        // Stamp done regardless of whether the LLM found entities — an empty
+        // extract is still a definitive answer for this memory.
+        try {
+          service.setMemoryMetadata?.(m.id, { entity_extracted_at: now, pending_extracted_at: null });
+        } catch (error) {
+          logger?.warn?.(`dsh-mneme sleep: failed to stamp entity_extracted_at for ${m.id}: ${String(error)}`);
+        }
+      } else {
+        failed++;
+        logger?.warn?.(`dsh-mneme sleep: entity extraction failed for ${m.id}: ${result?.error ?? "unknown"}`);
+        try {
+          service.setMemoryMetadata?.(m.id, { pending_extracted_at: null });
+        } catch (error) {
+          logger?.warn?.(`dsh-mneme sleep: failed to clear pending_extracted_at for ${m.id}: ${String(error)}`);
+        }
+      }
+    } catch (error) {
+      failed++;
+      logger?.warn?.(`dsh-mneme sleep: entity extraction threw for ${m.id}: ${String(error)}`);
+      try {
+        service.setMemoryMetadata?.(m.id, { pending_extracted_at: null });
+      } catch (err) {
+        logger?.warn?.(`dsh-mneme sleep: failed to clear pending_extracted_at for ${m.id}: ${String(err)}`);
+      }
+    }
+  }
+  return {
+    // Any success counts as ok (failures are surfaced via detail.failed + warn,
+    // matching phaseConflicts); all-failed reports failed so deriveStatus can
+    // reflect a broken route without aborting the other phases.
+    status: aborted ? "aborted" : extracted > 0 ? "ok" : failed > 0 ? "failed" : "noop",
+    scanned: candidates.length,
+    extracted,
+    failed,
+    aborted,
+    extractedIds
+  };
+}
+
 // ---------------------------------------------------------------- run
 
 function deriveStatus(phases) {
@@ -429,6 +547,9 @@ export async function runSleep(ctx, service, config, logger, semantic = null, si
   await attempt("conflicts", () => phaseConflicts(ctx, service, config, logger, runId, semantic, signal));
   await attempt("demotion", () => phaseDemotion(service, config, logger, runId, signal));
   await attempt("patterns", () => phasePatterns(ctx, service, config, logger, runId, signal));
+  // entity-extraction runs before relation completion so freshly minted
+  // entities get their orphan relations completed in the same cycle.
+  await attempt("entity-extraction", () => phaseEntityExtraction(ctx, service, config, logger, runId, signal));
   await attempt("relations", () => phaseRelations(service, config, logger, runId, signal));
 
   const status = deriveStatus(phases);

package/dsh-mneme/lib/service.js

@@ -1608,9 +1608,48 @@ export function createService({ store, mirror, config, onWrite, logger, settings
     embeddedCount: () => store.embeddedCount(),
     list: (o) => store.list(o),
     all: () => store.all(),
+    listForEntityExtraction: (opts) => store.listForEntityExtraction(opts),
     count: (type, opts) => store.count(type, opts),
     stats: (opts) => store.stats(opts),
     getById: (id) => store.getById(id),
+    // issue #48: resolve a possibly-truncated id to its canonical full id.
+    // Exact hit wins; otherwise the input is treated as a prefix of the id
+    // PRIMARY KEY. Never guesses on ambiguity — returns the candidates and the
+    // caller must pass a full id. Outcome is {ok:true,id} or {ok:false,reason,
+    // message} with reason ∈ invalid | not-found | ambiguous. warnMiss logs the
+    // silent-miss case the delete tool previously swallowed (no return channel
+    // for it, so observability has to live here in the service layer).
+    resolveMemoryId: (input, { warnMiss = false } = {}) => {
+      const bad = (reason, message) => ({ ok: false, reason, message });
+      if (typeof input !== "string") return bad("invalid", "memory id is required");
+      // 手抄/上下文压缩来的 id 可能带首尾空白，统一 trim 后再做精确与前缀解析。
+      const id = input.trim();
+      if (!id) return bad("invalid", "memory id is required");
+      const exact = store.getById(id);
+      if (exact) return { ok: true, id: exact.id };
+      const matches = store.listByIdPrefix(id);
+      if (matches.length === 0) {
+        if (warnMiss) {
+          logger?.warn?.(
+            `[dsh-mneme] memory id "${id}" matched nothing (exact or prefix) — ` +
+            "no entry was deleted; ids are full-length, pass one from memory_list/memory_search output or delete by query=…"
+          );
+        }
+        return bad(
+          "not-found",
+          `memory not found: ${id} (checked exact id and prefix; use a full id from memory_list/memory_search output)`
+        );
+      }
+      if (matches.length > 1) {
+        const sample = matches.slice(0, 5).map((m) => m.id);
+        const tail = matches.length > sample.length ? ` …(+${matches.length - sample.length})` : "";
+        return bad(
+          "ambiguous",
+          `memory id prefix "${id}" matches ${matches.length} entries (${sample.join(", ")}${tail}); refusing to guess — pass a full id`
+        );
+      }
+      return { ok: true, id: matches[0].id };
+    },
     remove: (id) => {
       store.remove(id);
       afterSync("write");
@@ -1824,9 +1863,11 @@ export function createService({ store, mirror, config, onWrite, logger, settings
     applyMemoryTags: (memoryId, tags) => store.setMemoryTags(memoryId, tags),
     saveAttr: (r) => store.saveAttr(r),
     createEntity: (r) => store.createEntity(r),
+    updateEntity: (id, patch) => store.updateEntity(id, patch),
     findEntityByName: (n) => store.findEntityByName(n),
     findEntityById: (id) => store.findEntityById(id),
     getAttrsByMemory: (id) => store.getAttrsByMemory(id),
+    setMemoryMetadata: (id, metadata) => store.setMemoryMetadata(id, metadata),
     getCurrentAttrs: (id) => store.getCurrentAttrs(id),
     migrateAttrsToMemory: (fromId, toId, now) => store.migrateAttrsToMemory(fromId, toId, now)
   };

package/dsh-mneme/lib/store.js

@@ -20,6 +20,7 @@ CREATE TABLE IF NOT EXISTS memories (
   epistemic_status TEXT NOT NULL DEFAULT 'subjective',
   last_accessed_at  TEXT,
   _full_content     TEXT,
+  metadata    TEXT,               -- JSON: free-form extras (e.g. sleep entity_extracted_at)
   created_at  TEXT NOT NULL,
   updated_at  TEXT NOT NULL
 );
@@ -314,6 +315,14 @@ function parseTags(raw) {
 
 function toRow(row) {
   if (!row) return undefined;
+  let metadata;
+  if (row.metadata != null) {
+    try {
+      metadata = JSON.parse(row.metadata);
+    } catch {
+      metadata = row.metadata;
+    }
+  }
   return {
     id: row.id,
     type: row.type,
@@ -329,6 +338,7 @@ function toRow(row) {
     content_history: parseJsonArray(row.content_history),
     quality_score: row.quality_score !== null && row.quality_score !== undefined ? Number(row.quality_score) : undefined,
     epistemic_status: row.epistemic_status ?? "subjective",
+    metadata,
     created_at: row.created_at,
     updated_at: row.updated_at,
     last_accessed_at: row.last_accessed_at ?? undefined,
@@ -589,6 +599,7 @@ export function createStore(path) {
   addColumn("memories", "content_history", "ALTER TABLE memories ADD COLUMN content_history TEXT");
   addColumn("memories", "quality_score", "ALTER TABLE memories ADD COLUMN quality_score REAL");
   addColumn("memories", "session_id", "ALTER TABLE memories ADD COLUMN session_id TEXT");
+  addColumn("memories", "metadata", "ALTER TABLE memories ADD COLUMN metadata TEXT");
 
   // Composite index for session-lifecycle queries (dispose/restore/listBySession).
   // Created post-migration, NOT in SCHEMA: on legacy DBs both columns arrive via
@@ -697,6 +708,27 @@ export function createStore(path) {
     return toRow(row);
   }
 
+  /**
+   * issue #48: resolve a truncated id — as can leak through an agent's context
+   * window when list/search output is shortened — by matching it as a prefix of
+   * the id PRIMARY KEY. Exact lookups keep using getById; this only serves
+   * resolving a *candidate* id. Returns up to 51 rows so the caller can tell
+   * "unique" from "ambiguous" without a second query. LIKE wildcards are
+   * stripped from the input (a valid id fragment is hex/UUID text, never % or
+   * _). Prefix over a PK stays an index scan, so this is cheap even at scale.
+   */
+  function listByIdPrefix(idPrefix) {
+    if (typeof idPrefix !== "string" || !idPrefix.trim()) return [];
+    // LIKE 通配符不参与 id 匹配，一律剥掉。若剥完为空（如 id="%"），
+    // 不能让 SQL 退化成 `LIKE '%'` 全表命中——那会让单条记忆被误删，
+    // 一律视为无匹配返回。
+    const safe = idPrefix.replace(/[\\%_]/g, "");
+    if (!safe) return [];
+    const rows = db.prepare("SELECT * FROM memories WHERE id LIKE ? LIMIT 51")
+      .all(`${safe}%`);
+    return rows.map(toRow);
+  }
+
   /**
    * Case-insensitive exact title lookup (v0.6.1 wiki-link). COLLATE NOCASE
    * folds ASCII case (CJK titles are inherently case-free, so they match
@@ -813,6 +845,50 @@ export function createStore(path) {
     });
   }
 
+  /**
+   * Bounded scan for sleep's entity-extraction phase: oldest memories without
+   * an entity_extracted_at stamp (row-level filters only — attr presence is a
+   * cross-table check, so the caller filters the returned page via
+   * getAttrsByMemory). Caller pages with {limit, offset}; a full-table scan +
+   * JS filter would be O(N) per sleep cycle.
+   */
+  function listForEntityExtraction({ limit = 50, offset = 0 } = {}) {
+    // node:sqlite has no StatementSync#pluck; all() returns row objects.
+    return db
+      .prepare(`
+        SELECT id FROM memories
+        WHERE (archived = 0 OR archived IS NULL)
+          AND session_disposed_at IS NULL
+          AND (forgotten = 0 OR forgotten IS NULL)
+          AND type != 'summary'
+          AND content IS NOT NULL AND content != ''
+          AND (metadata IS NULL OR json_extract(metadata, '$.entity_extracted_at') IS NULL)
+        ORDER BY created_at ASC
+        LIMIT ? OFFSET ?
+      `)
+      .all(limit, offset)
+      .map((row) => getById(row.id));
+  }
+
+  /**
+   * Lightweight metadata-only update (used by sleep's batch entity extraction
+   * to stamp `entity_extracted_at` without disturbing title/content/embedding
+   * or the normal update semantics). Does not bump updated_at — metadata
+   * stamps are bookkeeping, not content, so they must not fake freshness.
+   * Incoming fields are MERGED into the existing metadata object so a stamp
+   * never clobbers metadata another path just wrote.
+   */
+  function setMemoryMetadata(id, metadata) {
+    const existing = getById(id);
+    if (!existing) throw new Error(`memory not found: ${id}`);
+    const patch = typeof metadata === "string"
+      ? JSON.parse(metadata)
+      : (metadata ?? {});
+    const merged = { ...(existing.metadata ?? {}), ...patch };
+    db.prepare("UPDATE memories SET metadata = ? WHERE id = ?").run(JSON.stringify(merged), id);
+    return getById(id);
+  }
+
   /**
    * Atomic compare-and-set update: applies `patch` only when the row still
    * carries `expectedUpdatedAt` (the version token read by the caller). Returns
@@ -2210,8 +2286,11 @@ export function createStore(path) {
     count,
     stats,
     getById,
+    listByIdPrefix,
     save,
     update,
+    listForEntityExtraction,
+    setMemoryMetadata,
     compareAndUpdate,
     remove,
     setForget,