@modusensus/dsh-mneme 0.7.7 → 0.7.9

package/CHANGELOG.md

@@ -1,6 +1,6 @@
 # Changelog
 
-> **完整版本历史见 [dsh-mneme/CHANGELOG.md](dsh-mneme/CHANGELOG.md)**（正式版本正源，0.3.8 → 0.7.7）。以下为仓库早期开发记录（0.1.0–0.2.x，2026-08-13~14，已归档）。
+> **完整版本历史见 [dsh-mneme/CHANGELOG.md](dsh-mneme/CHANGELOG.md)**（正式版本正源，0.3.8 → 0.7.8）。以下为仓库早期开发记录（0.1.0–0.2.x，2026-08-13~14，已归档）。
 
 All notable changes to dsh-mneme are documented here.
 

package/CONTRIBUTING.md

@@ -102,6 +102,22 @@ Common scripts (all run under `dsh-mneme/`):
 
 ---
 
+## Scope: Platform Adaptation & Wrapper PRs
+
+DSH upstream is still in developer preview — APIs and service interfaces change frequently. Until DSH reaches a stable release (RC or GA), **PRs that adapt dsh-mneme to secondary platforms or wrap it into other hosts are not a priority** and are reviewed with extra caution:
+
+- Desktop shells (e.g. a Tauri/Electron wrapper around `dsh web`)
+- Standalone CLI packaging
+- Ports/wrappers of dsh-mneme into other plugin ecosystems
+
+These tend to bind against unstable upstream APIs: a single upstream change can break them, and the maintenance burden falls back on this project. The currently supported platform is the **Web Profile** (`dsh web`).
+
+Exceptions: if a contributor is willing to **own long-term maintenance** (track upstream changes and fix breakage), open a Discussion first to scope the work — maintainers will evaluate and review the PR.
+
+Bug-fix PRs for existing desktop compatibility issues are still welcome.
+
+---
+
 ## Release Process (Maintainers)
 
 Versioning follows semantic versioning (`MAJOR.MINOR.PATCH`). Full flow:
@@ -115,6 +131,13 @@ Versioning follows semantic versioning (`MAJOR.MINOR.PATCH`). Full flow:
 
 ---
 
+## Contact
+
+- **General questions & contributions**: [GitHub Discussions](https://github.com/modusensus/dsh-mneme/discussions) or `work@modusensus.space`
+- **Security vulnerabilities**: report privately via [SECURITY.md](SECURITY.md) — never open a public issue for vulnerabilities
+
+---
+
 ## Miscellaneous
 
 - Security issues go through [SECURITY.md](SECURITY.md) or a GitHub Security Advisory — never paste sensitive info into a public Issue.
@@ -226,6 +249,22 @@ npm run test:coverage # c8 覆盖率
 
 ---
 
+## 范围：平台适配与封装 PR
+
+DSH 上游仍处于 developer preview 阶段，API 与服务接口变动频繁。在 DSH 稳定（RC 或正式版）之前，以下方向的 PR **不作为优先项**，且会以额外谨慎的态度审查：
+
+- 桌面端适配（例如基于 `dsh web` 的 Tauri/Electron 桌面壳）
+- 独立 CLI 封装
+- 把 dsh-mneme 移植/封装到其他插件体系
+
+这类 PR 往往绑定不稳定的上游接口——上游一次变动就可能使其失效，而维护责任会落到本项目头上。当前唯一受支持的平台是 **Web Profile**（`dsh web`）。
+
+例外：如果贡献者愿意**承担长期维护**（跟进上游变更并修复 break），请先开 Discussion 沟通范围，维护者会评估并 review 该 PR。
+
+针对现有 desktop 兼容问题的 **bug 修复 PR 依然欢迎**。
+
+---
+
 ## 发布流程（维护者）
 
 版本号遵循语义化版本（`MAJOR.MINOR.PATCH`）。完整流程：
@@ -239,6 +278,13 @@ npm run test:coverage # c8 覆盖率
 
 ---
 
+## 联系方式
+
+- **一般问题与贡献咨询**：[GitHub Discussions](https://github.com/modusensus/dsh-mneme/discussions) 或 `work@modusensus.space`
+- **安全漏洞**：请通过 [SECURITY.md](SECURITY.md) 私有提交，不要在公开 Issue 中提交漏洞
+
+---
+
 ## 其他
 
 - 安全问题请走 [SECURITY.md](SECURITY.md) 或 GitHub Security Advisory，不要在公开 Issue 贴敏感信息。

package/README.md

@@ -10,7 +10,7 @@
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-3E63DD?style=flat-square" alt="license"></a>
   <a href="https://github.com/modusensus/dsh-mneme/actions"><img src="https://img.shields.io/github/actions/workflow/status/modusensus/dsh-mneme/test.yml?style=flat-square&label=CI" alt="CI"></a>
   <a href="https://nodejs.org"><img src="https://img.shields.io/badge/node-24%2B-3E63DD?style=flat-square&logo=nodedotjs&logoColor=white" alt="node"></a>
-  <a href="https://github.com/modusensus/dsh-mneme"><img src="https://img.shields.io/badge/tests-810%20passed-3E63DD?style=flat-square" alt="tests"></a>
+  <a href="https://github.com/modusensus/dsh-mneme"><img src="https://img.shields.io/badge/tests-812%20passed-3E63DD?style=flat-square" alt="tests"></a>
   <a href="https://codecov.io/gh/modusensus/dsh-mneme"><img src="https://img.shields.io/codecov/c/github/modusensus/dsh-mneme/main?style=flat-square" alt="coverage"></a>
   <a href="https://github.com/awesome-dsh-plugin/awesome-dsh-plugin"><img src="https://awesome-dsh-plugin.com/badge.svg" alt="Awesome"></a>
 </p>
@@ -110,6 +110,7 @@ dsh web
 | **v0.7.5** | 分层记忆类型 user/fact + Web 总览视图 + stats 端点 | ✅ |
 | **v0.7.6** | issue #48 修复：截断/前缀 id 也能精确操作（统一 resolveMemoryId）+ client.js 改 src 正源 | ✅ |
 | **v0.7.7** | issue #23 图谱回填：sleep 批量实体抽取 phase + node:sqlite 兼容修复 | ✅ |
+| **v0.7.8** | issues #58 #59 修复：DSH 0.1.2-rc.1 兼容——Session.events 改为 snapshotEvents() 垫片，autoSummarize 与 hot-context 注入恢复 | ✅ |
 | **v0.8.0** | 图谱增强：兴趣漂移可视化 + scope 隔离（issue #17）+ 跨 workspace 共享 | 🚧 计划中（9 月末） |
 
 ## 🧪 本地开发
@@ -117,7 +118,7 @@ dsh web
 ```bash
 cd dsh-mneme
 npm install
-npm test          # 810 个测试
+npm test          # 812 个测试
 npm run stress    # 三轴线压测
 npm run sync      # src → lib 同步
 ```
@@ -217,6 +218,8 @@ Works out of the box. Enable these as needed:
 | **v0.7.4** | Issue #40 prompt-brace escaping + Issue #41 overlay close-button overlap fix | ✅ |
 | **v0.7.5** | Layered memory types (user/fact) + Overview view + stats endpoint | ✅ |
 | **v0.7.6** | Issue #48 fix: truncated/prefix ids resolve for exact ops (unified resolveMemoryId) + client.js now src-authored | ✅ |
+| **v0.7.7** | Issue #23 graph backfill: sleep batch entity extraction phase + node:sqlite compat fix | ✅ |
+| **v0.7.8** | Issues #58 #59 fix: DSH 0.1.2-rc.1 compat — Session.events moved to snapshotEvents() shim; autoSummarize & hot-context injection restored | ✅ |
 | **v0.8.0** | Graph enhancement: interest-drift visualization + scope isolation (issue #17) + cross-workspace sharing | 🚧 Planned (late Sep) |
 
 ## 🧪 Local Development
@@ -224,7 +227,7 @@ Works out of the box. Enable these as needed:
 ```bash
 cd dsh-mneme
 npm install
-npm test          # 810 tests
+npm test          # 812 tests
 npm run stress    # three-axis stress test
 npm run sync      # src → lib sync
 ```

package/SECURITY.md

@@ -65,6 +65,22 @@ The following security features are implemented and maintained in the project:
    - Your proposed fix (if any)
    - Whether you are requesting credit / disclosure preferences
 
+### Scope and Out of Scope
+
+**In scope** — issues this policy covers:
+- Remote API authentication or authorization bypass (`apiToken`-protected surfaces)
+- Memory integrity violations (CAS/fence bypass, unauthorized overwrite, replay paths)
+- Mirror consistency and recovery logic that can cause silent data corruption
+- Exploitable vulnerabilities in shipped runtime dependencies (supported versions only)
+
+**Out of scope** — we will not act on:
+- Social engineering or phishing against maintainers or users
+- DoS claims that require unrealistic local resource exhaustion with no product defect
+- Vulnerabilities present only in unsupported versions (`< 0.6.0`)
+- Best-practice hardening suggestions with no demonstrable security impact
+
+Not sure whether your finding is in scope? Report it anyway via the private channel — we will triage and respond.
+
 ### Response Timeline
 
 | Phase | Time | Action |
@@ -77,6 +93,12 @@ The following security features are implemented and maintained in the project:
 
 **Note**: For Critical vulnerabilities, if a full fix cannot be developed within 14 days, we will provide a temporary mitigation or workaround within that timeframe.
 
+### Escalation (If You Do Not Hear Back)
+
+- If you do not receive an acknowledgment within **48 hours**, re-send to `work@modusensus.space` with subject prefix: `[SECURITY][FOLLOW-UP]`.
+- If there is still no response after another **48 hours**, open a **private security advisory** via [GitHub Security Advisories](https://github.com/modusensus/dsh-mneme/security/advisories) and reference your original report timestamp.
+- Do not disclose details publicly while escalation is in progress.
+
 ### Severity Classification
 
 We follow the [CVSS v3.1](https://www.first.org/cvss/v3.1/specification-document) standard:
@@ -322,7 +344,7 @@ All contributors must comply with the following security requirements:
 
 ## Contact
 
-- **Security Team**: `guanqishi26@gmail.com`
+- **Security Team**: `work@modusensus.space`
 - **Private Advisory**: [GitHub Security Advisories](https://github.com/modusensus/dsh-mneme/security/advisories)
 - **GPG Key**: Available upon request for encrypted communication
 
@@ -401,6 +423,22 @@ This project is licensed under the **MIT License**. See [LICENSE](https://github
    - 你建议的修复方案（如有）
    - 是否要求在公告中署名 / 披露偏好
 
+### 受理范围与不受理范围
+
+**受理范围**——本政策覆盖以下问题：
+- 远程 API 鉴权 / 授权绕过（`apiToken` 保护面）
+- 记忆完整性破坏（CAS/fence 绕过、未授权覆盖、重放路径）
+- 可导致静默数据损坏的镜像一致性与恢复逻辑缺陷
+- 在受支持版本中可利用的已发布运行时依赖漏洞
+
+**不受理范围**——以下问题我们不予处理：
+- 针对维护者或用户的社工 / 钓鱼类问题
+- 仅通过不现实的本地资源耗尽触发、且无产品缺陷支撑的 DoS 声明
+- 仅存在于不支持版本（`< 0.6.0`）的问题
+- 无可证明安全影响的"最佳实践建议"类问题
+
+不确定你的发现是否在受理范围内？仍请通过私有渠道提交——我们会评估并回复。
+
 ### 响应时间线
 
 | 阶段 | 时间 | 行动 |
@@ -413,6 +451,12 @@ This project is licensed under the **MIT License**. See [LICENSE](https://github
 
 **备注**：对于严重漏洞，如果 14 天内无法提供完整修复，我们将在该时间内提供临时缓解措施或替代方案。
 
+### 无响应升级路径
+
+- 若 **48 小时内**未收到确认，请重新发送到 `work@modusensus.space`，邮件标题加前缀：`[SECURITY][FOLLOW-UP]`。
+- 若再次等待 **48 小时**仍无回复，请通过 [GitHub 私有安全公告](https://github.com/modusensus/dsh-mneme/security/advisories) 提交，并注明首次报告时间。
+- 升级处理中请勿公开披露漏洞细节。
+
 ### 严重程度分级
 
 我们遵循 [CVSS v3.1](https://www.first.org/cvss/v3.1/specification-document) 标准：
@@ -658,7 +702,7 @@ dsh-mneme:
 
 ## 联系方式
 
-- **安全团队**：`guanqishi26@gmail.com`
+- **安全团队**：`work@modusensus.space`
 - **私有公告**：[GitHub Security Advisories](https://github.com/modusensus/dsh-mneme/security/advisories)
 - **GPG 密钥**：如需加密通信，可应请求提供
 
@@ -670,5 +714,5 @@ dsh-mneme:
 
 ---
 
-*Last updated: 2026-08-28*  
-*Policy version: 2.2*
+*Last updated: 2026-09-06*  
+*Policy version: 2.3*

package/dsh-mneme/CHANGELOG.md

@@ -1,17 +1,37 @@
 # Changelog
 
+## [0.7.9] - 2026-09-06
+
+### 🐛 修复：v0.7.8 的 rc.1 snapshotEvents 适配未同步到 lib/（issue #65）
+
+- **现象**：v0.7.8 为兼容 DSH 0.1.2-rc.1（`Session.events` → `snapshotEvents()`）只改了 `src/inject.js` 与 `src/summarize.js`，发布产物 `lib/` 从未同步——npm 包实际加载的是 `lib/`（`main` 指向 `lib/index.js`），用户在 rc.1 下安装 0.7.8 运行的仍是未适配代码。因代码带 `?.` / `?? []` 容错，**不报错但热记忆注入与会话摘要静默失效**。
+- **修复**：将 src 的兼容垫片同步到 `lib/`（两文件 3 处），`src/` 与 `lib/` 逐文件一致。
+- **防再犯（双保险）**：
+  - 新增 `scripts/check-sync.js`：断言 `src/` 与 `lib/` 一致性，root `prepack` 钩子调用——发布前不一致直接 fail；
+  - 新增 `test/lib-smoke.test.js`：从 `lib/` 直接导入复跑 snapshotEvents 关键用例 + 静态断言 src→lib 逐文件一致，CI 每次全量测试拦截。
+- 新增 3 个用例（lib 版 snapshotEvents 注入/摘要 + 一致性断言），全套 **815 通过**。
+
+## [0.7.8] - 2026-09-06
+
+### 🐛 修复：DSH 0.1.2-rc.1 兼容（issues #58 #59）
+
+- **现象**：DSH 0.1.2-rc.1 起官方移除 `Session.events` 属性、改为 `snapshotEvents()` 方法。autoSummarize（会话摘要）与 hot-context（短期上下文）注入都依赖 `session.events` 读取会话事件，升级后取到 undefined 而**静默失效**——会话摘要不再落库、短期上下文块不再渲染。
+- **修复**：`src/summarize.js` 与 `src/inject.js` 两处取事件统一改为兼容垫片 `session.snapshotEvents?.() ?? session.events`——0.1.2-rc.1 及以后走新方法，更早 0.1.x 仍走 `.events`，**新旧 DSH 通吃**。
+- **说明**：兼容垫片，老版本 DSH（0.1.x 早期）行为完全不受影响，无需任何配置改动。
+- 新增 2 个回归用例（会话只提供 `snapshotEvents()` 时 hot-context 渲染与会话摘要均恢复），全套 **812 通过**。
+
 ## [0.7.7] - 2026-09-05
 
 ### 🆕 issue #23：sleep 批量实体抽取回填实体图谱
 
 - **背景**：写路径抽取（index.js）只有 `entityExtractionEnabled` 开启才触发——每次写入一次 LLM 调用，是刻意的成本取舍——所以默认安装下记忆从不累积实体，这正是 issue #23 报的"实体图谱面板一片空白"（用户明明有很多记忆）。
 - **新增 sleep 批量抽取 phase**：默认关 `sleepEntityExtractionEnabled`，开睡循环时按**最老优先**把没有实体属性的记忆逐条过 `extractEntities`（每轮上限 `sleepEntityExtractionMaxPerRun` 默认 20）。
-- **下沉为有界 SQL 查询**（kimi 复验意见 #2）：新增 `store.listForEntityExtraction({limit, offset})`，`WHERE` 只留行级条件（未归档/未遗忘/非 summary/内容非空/`metadata.entity_extracted_at` 为空），`ORDER BY created_at LIMIT ? OFFSET ?` 分页取最老候选；实体是否已存在是跨表检查（`getAttrsByMemory`），由 JS 在每页上过滤。不再 `service.all()` 全表加载。
-- **幂等防重**（kimi 意见 #3）：抽取前先 stamp `metadata.pending_extracted_at`，成功后替换为 `entity_extracted_at`，失败清除 pending——一条记忆不会被并发/崩溃重复抽取，失败的下轮重试。
-- **metadata 合并不覆盖**（kimi 意见 #4）：`store.setMemoryMetadata` 改为 merge 语义，打实体时间戳不会抹掉其他路径刚写入的 metadata 字段。
-- **失败不阻断**（kimi 意见 #5）：单条抽取失败只跳过该条、记入 `failed` 计数，整轮状态由 `deriveStatus` 正确折叠 `failed`——一次 LLM 抖动不会 abort 整个 sleep 周期。
-- **node:sqlite 兼容修复**（复验时抓到的实现 bug）：wxbot 初版用 better-sqlite3 的 `.pluck()`（node:sqlite 不存在），改为 `.all().map(row => getById(row.id))`；`listForEntityExtraction` 的 `forgotten IS NULL` 条件与 `save` 硬编码写入的 `forgotten=0` 永不匹配导致查询恒空，修正为 `(forgotten = 0 OR forgotten IS NULL)`（与 archived 同构）。
-- 新增 9 个用例（禁用/跳过、stamp 不重复、无实体也 stamp、backfill、失败重试、metadata merge #4、pending 清除 #3、failed 状态折叠 #5、分页最老优先 #2），全套 **810 通过**。
+- **下沉为有界 SQL 查询**：新增 `store.listForEntityExtraction({limit, offset})`，`WHERE` 只留行级条件（未归档/未遗忘/非 summary/内容非空/`metadata.entity_extracted_at` 为空），`ORDER BY created_at LIMIT ? OFFSET ?` 分页取最老候选；实体是否已存在是跨表检查（`getAttrsByMemory`），由 JS 在每页上过滤。不再 `service.all()` 全表加载。
+- **幂等防重**：抽取前先 stamp `metadata.pending_extracted_at`，成功后替换为 `entity_extracted_at`，失败清除 pending——一条记忆不会被并发/崩溃重复抽取，失败的下轮重试。
+- **metadata 合并不覆盖**：`store.setMemoryMetadata` 改为 merge 语义，打实体时间戳不会抹掉其他路径刚写入的 metadata 字段。
+- **失败不阻断**：单条抽取失败只跳过该条、记入 `failed` 计数，整轮状态由 `deriveStatus` 正确折叠 `failed`——一次 LLM 抖动不会 abort 整个 sleep 周期。
+- **node:sqlite 兼容修复**：初版实现用 better-sqlite3 的 `.pluck()`（node:sqlite 不存在），改为 `.all().map(row => getById(row.id))`；`listForEntityExtraction` 的 `forgotten IS NULL` 条件与 `save` 硬编码写入的 `forgotten=0` 永不匹配导致查询恒空，修正为 `(forgotten = 0 OR forgotten IS NULL)`（与 archived 同构）。
+- 新增 9 个用例（禁用/跳过、stamp 不重复、无实体也 stamp、backfill、失败重试、metadata merge、pending 清除、failed 状态折叠、分页最老优先），全套 **810 通过**。
 
 ## [0.7.6] - 2026-09-02
 

package/dsh-mneme/README.md

@@ -5,7 +5,7 @@
 [![npm version](https://img.shields.io/npm/v/@modusensus/dsh-mneme?color=blue&label=npm)](https://www.npmjs.com/package/@modusensus/dsh-mneme)
 [![license](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 [![Awesome](https://awesome-dsh-plugin.com/badge.svg)](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin)
-[![tests](https://img.shields.io/badge/tests-810%20passed-success)](https://github.com/modusensus/dsh-mneme)
+[![tests](https://img.shields.io/badge/tests-812%20passed-success)](https://github.com/modusensus/dsh-mneme)
 [![CI](https://img.shields.io/github/actions/workflow/status/modusensus/dsh-mneme/test.yml)](https://github.com/modusensus/dsh-mneme/actions)
 [![node](https://img.shields.io/badge/node-24%2B-blue)](https://nodejs.org)
 [![npm downloads](https://img.shields.io/npm/dm/@modusensus/dsh-mneme?color=blue&label=downloads)](https://www.npmjs.com/package/@modusensus/dsh-mneme)
@@ -241,7 +241,8 @@ v0.3.0 起新增**记忆基因**层：从记忆里抽取**命名实体**、**带
 
 | 版本 | 亮点 |
 |------|------|
-| **v0.7.7** | issue #23 实体图谱回填：sleep 批量实体抽取 phase（`sleepEntityExtractionEnabled` 默认关；最老优先、SQL LIMIT/OFFSET 分页下沉为有界查询不整表扫描；`pending_extracted_at` 幂等防重、成功/失败清除；metadata 合并不覆盖其他路径写入）；kimi-k2.7-code 复验 + node:sqlite 兼容修复（pluck→all+map、`forgotten=0` 查询条件）；810 测试全绿 |
+| **v0.7.8** | DSH 0.1.2-rc.1 兼容（issues #58 #59）：官方移除 `Session.events` 属性改为 `snapshotEvents()` 方法，autoSummarize 与 hot-context（短期上下文）注入取不到事件而失效；改用兼容垫片 `session.snapshotEvents?.() ?? session.events`，新旧 DSH 通吃，老版本行为不受影响；新增 2 个回归用例；812 测试全绿 |
+| **v0.7.7** | issue #23 实体图谱回填：sleep 批量实体抽取 phase（`sleepEntityExtractionEnabled` 默认关；最老优先、SQL LIMIT/OFFSET 分页下沉为有界查询不整表扫描；`pending_extracted_at` 幂等防重、成功/失败清除；metadata 合并不覆盖其他路径写入）；node:sqlite 兼容修复（pluck→all+map、`forgotten=0` 查询条件）；810 测试全绿 |
 | **v0.7.6** | issue #48 修复：`memory_update`/`memory_delete`/`memory_forget`/`memory_archive` 支持截断/前缀短 id（新增 `service.resolveMemoryId`：精确命中优先 + 唯一前缀解析 + 多命中拒绝列出候选 + `memory_delete` 未命中幂等补 `logger.warn`；纯通配符/空白兜底）；Web bundle `client.js` 改 src 正源；801 测试全绿 |
 | **v0.7.5** | 分层记忆类型：新增 `user`（用户画像）/`fact`（原子事实）轻量记忆类型（单表 `type` 扩展，不动 schema）+ Web 面板「总览」视图（记忆分层卡片 + 用户画像卡 + 类型分布 + 近 7 天趋势）+ `/api/dsh-mneme/stats` 统计端点；kimi-k2.7-code 复验（days 整数化等）；790 测试全绿 |
 | **v0.7.4** | issue #40 修复：记忆内容含 `{{...}}` 模板语法时整轮崩溃（注入边界 run-based 花括号转义 `{{a}}`→`{\{a\}\}`，奇数连续如 `{{{a}}}` 也不残留字面 `{{`；新增 `escapePromptVariables` 配置默认开）；issue #41 修复：记忆窗口关闭按钮与宿主窗口控制按钮重叠无法点击（顶栏左对齐，关闭按钮离开右上角宿主控制区）；782 测试全绿 |
@@ -297,7 +298,8 @@ v0.3.0 起新增**记忆基因**层：从记忆里抽取**命名实体**、**带
 | **v0.7.3** | ✅ 完成 | issue #38 新功能 | 左下角入口按钮可选开关 `showSidebarTrigger`（默认开，settings-over-config）；Web 面板设置一键关闭，与 dsh-cost-meter 等 footer 插件冲突可隐藏按钮、记忆库标签不受影响；776 测试全绿 |
 | **v0.7.4** | ✅ 完成 | issue #40 + #41 修复 | 注入边界 run-based 花括号转义（`{{a}}`→`{\{a\}\}`、奇数连续如 `{{{a}}}` 不残留字面，`escapePromptVariables` 默认开）+ 记忆窗口顶栏左对齐、关闭按钮避开宿主窗口控制按钮区；782 测试全绿 |
 | **v0.7.5** | ✅ 完成 | 分层记忆类型 + 总览视图 | 借鉴 meow-memory 分层概念、贴合单表架构：新增 `user`（用户画像）/`fact`（原子事实）类型，注入/镜像/梦境/质量过滤全链路打通；Web 面板「总览」视图（分层卡片 + 用户画像卡 + 类型分布 + 近 7 天趋势）；`/api/dsh-mneme/stats` 端点；kimi-k2.7-code 复验；790 测试全绿 |
-| **v0.7.7** | ✅ 完成 | issue #23 图谱回填 | sleep 批量实体抽取 phase：默认关 `sleepEntityExtractionEnabled`，按最老优先、SQL LIMIT/OFFSET 分页（下沉为有界查询，不再整表扫描）批量抽取未打标记忆的实体（修复 issue #23 实体图谱空白）；`pending_extracted_at` 幂等防重、成功/失败清除，metadata 合并不覆盖；kimi-k2.7-code 复验 + node:sqlite 兼容修复（pluck→all+map、`forgotten=0` 查询条件）；810 测试全绿 |
+| **v0.7.7** | ✅ 完成 | issue #23 图谱回填 | sleep 批量实体抽取 phase：默认关 `sleepEntityExtractionEnabled`，按最老优先、SQL LIMIT/OFFSET 分页（下沉为有界查询，不再整表扫描）批量抽取未打标记忆的实体（修复 issue #23 实体图谱空白）；`pending_extracted_at` 幂等防重、成功/失败清除，metadata 合并不覆盖；node:sqlite 兼容修复（pluck→all+map、`forgotten=0` 查询条件）；810 测试全绿 |
+| **v0.7.8** | ✅ 完成 | DSH 0.1.2-rc.1 兼容（issues #58 #59） | 官方移除 `Session.events` 属性、改用 `snapshotEvents()` 方法后 autoSummarize 与 hot-context 注入失效；改为兼容垫片 `session.snapshotEvents?.() ?? session.events`，新旧 DSH 通吃，老版本不受影响；新增 2 个回归用例；812 测试全绿 |
 | **v0.7.6** | ✅ 完成 | issue #48 修复 | 四工具统一 `service.resolveMemoryId`：截断/前缀短 id 也能精确操作（精确命中优先、唯一前缀解析、多命中拒绝并列出候选、`memory_delete` 未命中幂等返回 + `logger.warn` 留痕）；Web bundle `client.js` 改 src 正源；801 测试全绿 |
 | **v0.8.0** | 🚧 计划中（9 月末） | 图谱增强 | 兴趣漂移可视化 + scope 隔离（issue #17）+ 跨 workspace 记忆共享 + 更多 heat 信号 |
 
@@ -307,7 +309,7 @@ v0.3.0 起新增**记忆基因**层：从记忆里抽取**命名实体**、**带
 
 ### 前置条件
 
-- [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)（DSH）
+- [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)（DSH）— 兼容 DSH 0.1.x，已验证 0.1.2-rc.1（`Session.events` → `snapshotEvents()` 变更已由插件垫片兼容，新旧版本通吃）
 - Node 24+（`node:sqlite`）
 
 ### 安装步骤
@@ -464,7 +466,7 @@ src/
 ├── client.js         # Web 面板 bundle（ModuleLoader 自注册；v0.7.6 起 src 正源）
 └── index.js          # 插件接线
 lib/                  # src 的同步分发产物（npm run sync，prepack 自动执行；无手写例外）
-test/                 # 810 个 node:test 测试（含审计与三轴线压测不变量）
+test/                 # 812 个 node:test 测试（含审计与三轴线压测不变量）
 scripts/              # e2e-dsh.js 端到端演示 · stress-dsh.js 三轴线压测 · sync-lib.js 同步 · benchmark-recall.js 召回基准
 ```
 
@@ -473,7 +475,7 @@ scripts/              # e2e-dsh.js 端到端演示 · stress-dsh.js 三轴线压
 ```bash
 cd dsh-mneme
 npm install        # 安装 peer 依赖（以 devDependencies 形式，用于本地测试）
-npm test           # 运行 810 个测试
+npm test           # 运行 812 个测试
 npm run stress     # 三轴线压测：长会话检索 / 冲突仲裁 / 多 Agent 并发（离线 mock LLM）
 npm run sync       # 把 src/ 同步到 lib/（发布时由 prepack 钩子自动执行）
 ```

package/dsh-mneme/lib/inject.js

@@ -8,7 +8,7 @@ import { createHotMemory } from "./hot-memory.js";
 // falls back to the legacy rule-based pick, never breaking the render.
 function lastUserQuery(ctx) {
   try {
-    const events = ctx?.agent?.session?.events;
+    const events = ctx?.agent?.session?.snapshotEvents?.() ?? ctx?.agent?.session?.events;
     if (!Array.isArray(events) || events.length === 0) return "";
     for (let i = events.length - 1; i >= 0; i--) {
       const event = events[i];
@@ -34,7 +34,7 @@ function lastUserQuery(ctx) {
 // returns [] on any failure, and the hot block simply does not render.
 function extractRounds(ctx, maxRounds) {
   try {
-    const events = ctx?.agent?.session?.events;
+    const events = ctx?.agent?.session?.snapshotEvents?.() ?? ctx?.agent?.session?.events;
     if (!Array.isArray(events) || events.length === 0) return [];
     const rounds = [];
     let pendingQuery = null;

package/dsh-mneme/lib/summarize.js

@@ -78,7 +78,9 @@ function toProtocolChunk(chunk) {
 // check below.
 function collectMessages(session) {
   const messages = [];
-  for (const event of session.events ?? []) {
+  // DSH 0.1.2-rc.1 起 Session 改用 snapshotEvents()，兼容旧版 .events
+  const events = session.snapshotEvents?.() ?? session.events ?? [];
+  for (const event of events) {
     const kind = event.data?.source?.kind;
     if (event.type !== "user/message") continue;
     if (kind !== undefined && kind !== "user") continue;

package/dsh-mneme/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@modusensus/dsh-mneme",
   "description": "Cross-session memory plugin for DeepSeek Harness with autoDream consolidation: SQLite store, Markdown mirrors, 7 model tools, automatic injection, session summarization, user profile/rules, custom slash commands, vector (semantic) search, and a Web GUI panel",
-  "version": "0.7.7",
+  "version": "0.7.9",
   "license": "MIT",
   "repository": {
     "type": "git",

package/dsh-mneme/scripts/check-sync.js

@@ -0,0 +1,42 @@
+// 发布前校验 src/ 与 lib/ 一致性。
+//
+// npm 包实际加载 lib/（package main → lib/index.js），而 root 层 `npm publish`
+// 不触发 dsh-mneme/ 的 prepack → sync 同步。历史教训：PR #60 只改了 src 忘了同步
+// lib，v0.7.8 发出去的 npm 包跑的还是旧代码（issue #65）。此脚本让这类漂移在发布时
+// 直接 fail，而不是带着旧产物上线。
+//
+// 用法：node scripts/check-sync.js （root package.json 的 prepack 钩子自动调用）
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = join(fileURLToPath(new URL("..", import.meta.url))); // dsh-mneme/
+const srcDir = join(root, "src");
+const libDir = join(root, "lib");
+
+function walk(dir) {
+  const out = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) out.push(...walk(full));
+    else if (entry.isFile()) out.push(full);
+  }
+  return out;
+}
+
+const bad = [];
+for (const file of walk(srcDir)) {
+  const rel = relative(srcDir, file);
+  const dest = join(libDir, rel);
+  if (!existsSync(dest)) {
+    bad.push(`missing  lib/${rel}`);
+  } else if (!readFileSync(file).equals(readFileSync(dest))) {
+    bad.push(`differ   lib/${rel}`);
+  }
+}
+if (bad.length) {
+  console.error(`✗ src/ 与 lib/ 不一致（${bad.length} 处）——npm 包实际加载 lib/，请先 npm run sync 并提交：`);
+  for (const line of bad) console.error(`  ${line}`);
+  process.exit(1);
+}
+console.log(`✓ src/ 与 lib/ 一致（${walk(srcDir).length} 个文件）`);

package/dsh-mneme/src/inject.js

@@ -8,7 +8,7 @@ import { createHotMemory } from "./hot-memory.js";
 // falls back to the legacy rule-based pick, never breaking the render.
 function lastUserQuery(ctx) {
   try {
-    const events = ctx?.agent?.session?.events;
+    const events = ctx?.agent?.session?.snapshotEvents?.() ?? ctx?.agent?.session?.events;
     if (!Array.isArray(events) || events.length === 0) return "";
     for (let i = events.length - 1; i >= 0; i--) {
       const event = events[i];
@@ -34,7 +34,7 @@ function lastUserQuery(ctx) {
 // returns [] on any failure, and the hot block simply does not render.
 function extractRounds(ctx, maxRounds) {
   try {
-    const events = ctx?.agent?.session?.events;
+    const events = ctx?.agent?.session?.snapshotEvents?.() ?? ctx?.agent?.session?.events;
     if (!Array.isArray(events) || events.length === 0) return [];
     const rounds = [];
     let pendingQuery = null;

package/dsh-mneme/src/summarize.js

@@ -78,7 +78,9 @@ function toProtocolChunk(chunk) {
 // check below.
 function collectMessages(session) {
   const messages = [];
-  for (const event of session.events ?? []) {
+  // DSH 0.1.2-rc.1 起 Session 改用 snapshotEvents()，兼容旧版 .events
+  const events = session.snapshotEvents?.() ?? session.events ?? [];
+  for (const event of events) {
     const kind = event.data?.source?.kind;
     if (event.type !== "user/message") continue;
     if (kind !== undefined && kind !== "user") continue;

package/dsh-mneme/test/inject.test.js

@@ -179,6 +179,24 @@ test("issue #40: hot-context rounds with {{...}} are escaped", () => {
   assert.ok(!text.includes("}}"), "no raw }} in hot context");
 });
 
+test("session with only snapshotEvents() (DSH 0.1.2-rc.1) still renders hot context", () => {
+  const { contexts } = setup();
+  const text = contexts[0].text({
+    agent: {
+      session: {
+        id: "s1",
+        snapshotEvents: () => [
+          { type: "user/message", data: { source: { kind: "user" }, content: ["用快照接口提问"] } },
+          { type: "assistant/message", data: { source: { kind: "assistant" }, content: ["快照返回的答复"] } }
+        ]
+      }
+    }
+  });
+  assert.ok(text.includes("[短期上下文]"), "hot context rendered");
+  assert.ok(text.includes("用快照接口提问"), "user query picked up from snapshotEvents");
+  assert.ok(text.includes("快照返回的答复"), "assistant reply picked up from snapshotEvents");
+});
+
 test("issue #40: escapePromptVariables=false passes {{...}} through verbatim", () => {
   const { contexts, service } = setup({ escapePromptVariables: false });
   service.saveWithDedupe({ type: "preference", title: "模板", content: "{{挖空}} 与 {{hl|term}}", importance: 5 });

package/dsh-mneme/test/lib-smoke.test.js

@@ -0,0 +1,109 @@
+// lib/ 是 npm 实际加载的产物（package main 指向 lib/index.js），而现有测试只引 src/，
+// 覆盖不到发布产物——issue #65 就是 src 适配了、lib 没同步，npm 包静默跑旧代码。
+// 本文件直接从 lib/ 导入，复跑 DSH 0.1.2-rc.1 snapshotEvents 关键用例，
+// 并静态断言 src → lib 逐文件一致，防止同类回归再次发生。
+import test from "node:test";
+import assert from "node:assert/strict";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { join, relative } from "node:path";
+import { createStore } from "../lib/store.js";
+import { createService } from "../lib/service.js";
+import { createInjector } from "../lib/inject.js";
+import { createSettings } from "../lib/settings.js";
+import { createSummarizer, parseSummaryJson } from "../lib/summarize.js";
+
+function setup(over = {}) {
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config: {} });
+  const settings = createSettings(store.db);
+  const contexts = [];
+  const ctx = {
+    systemPrompt: {
+      context(def) {
+        contexts.push(def);
+        return () => {};
+      }
+    }
+  };
+  const config = { maxInjectedItems: 3, importanceThreshold: 3, ...over };
+  const injector = createInjector(ctx, service, settings, config);
+  return { contexts, injector };
+}
+
+test("lib: session with only snapshotEvents() (DSH 0.1.2-rc.1) still renders hot context", () => {
+  const { contexts } = setup();
+  const text = contexts[0].text({
+    agent: {
+      session: {
+        id: "s1",
+        snapshotEvents: () => [
+          { type: "user/message", data: { source: { kind: "user" }, content: ["用快照接口提问"] } },
+          { type: "assistant/message", data: { source: { kind: "assistant" }, content: ["快照返回的答复"] } }
+        ]
+      }
+    }
+  });
+  assert.ok(text.includes("[短期上下文]"), "hot context rendered");
+  assert.ok(text.includes("用快照接口提问"), "user query picked up from snapshotEvents");
+  assert.ok(text.includes("快照返回的答复"), "assistant reply picked up from snapshotEvents");
+});
+
+test("lib: session with only snapshotEvents() (DSH 0.1.2-rc.1) still summarizes", async () => {
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config: {} });
+  const events = [];
+  const ctx = {
+    on(name, fn) {
+      events.push({ name, fn });
+      return () => {};
+    },
+    llm: {
+      stream() {
+        const json = JSON.stringify([
+          { type: "decision", title: "选型", content: "确定用 node:sqlite", importance: 4 },
+          { type: "preference", title: "语言", content: "用户喜欢中文交流", importance: 5 }
+        ]);
+        return (async function* () {
+          yield { type: "finish", kind: "ok" };
+          yield { type: "block-start", block: { type: "text" } };
+          yield { type: "text-delta", delta: json };
+          yield { type: "block-end", block: { type: "text" } };
+        })();
+      }
+    }
+  };
+  const summarizer = createSummarizer(ctx, service, { autoSummarize: true });
+  const handler = events.find((e) => e.name === "session/event").fn;
+  const session = {
+    id: "s6",
+    requestHeader: () => ({ config: { provider: "deepseek", model: "deepseek-chat" } }),
+    snapshotEvents: () => [{ type: "user/message", data: { content: ["用快照接口提问"] } }, { seq: 2, type: "turn/end" }]
+  };
+  await handler(session, { seq: 2, type: "turn/end" });
+  assert.equal(store.count(), 2);
+  assert.ok(store.all().some((m) => m.type === "decision"));
+  assert.ok(store.all().some((m) => m.type === "preference"));
+  summarizer.dispose();
+});
+
+test("lib/ mirrors src/ — every src file identical in lib (npm loads lib!)", () => {
+  const srcRoot = fileURLToPath(new URL("../src/", import.meta.url));
+  const libRoot = fileURLToPath(new URL("../lib/", import.meta.url));
+  const mismatches = [];
+  const walk = (dir) => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const full = join(dir, entry.name);
+      if (entry.isDirectory()) walk(full);
+      else if (entry.isFile()) {
+        const rel = relative(srcRoot, full);
+        const counterpart = join(libRoot, rel);
+        if (!existsSync(counterpart) || !readFileSync(full).equals(readFileSync(counterpart))) {
+          mismatches.push(rel);
+        }
+      }
+    }
+  };
+  walk(srcRoot);
+  assert.deepEqual(mismatches, [], "src 文件在 lib 缺失或内容不一致——请先 npm run sync 并提交");
+});

package/dsh-mneme/test/summarize.test.js

@@ -85,6 +85,21 @@ test("turn/end event triggers summarization and stores entries", async () => {
   assert.ok(all.some((m) => m.type === "preference"));
 });
 
+test("session with only snapshotEvents() (DSH 0.1.2-rc.1) still summarizes", async () => {
+  const { events, store } = setup();
+  const handler = events.find((e) => e.name === "session/event").fn;
+  const session = {
+    id: "s6",
+    requestHeader: () => ({ config: { provider: "deepseek", model: "deepseek-chat" } }),
+    snapshotEvents: () => [userMessage("用快照接口提问"), { seq: 2, type: "turn/end" }]
+  };
+  await handler(session, { seq: 2, type: "turn/end" });
+  assert.equal(store.count(), 2);
+  const all = store.all();
+  assert.ok(all.some((m) => m.type === "decision"));
+  assert.ok(all.some((m) => m.type === "preference"));
+});
+
 test("skips summarization for events other than turn/end", async () => {
   const { events, store, calls } = setup();
   const handler = events.find((e) => e.name === "session/event").fn;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modusensus/dsh-mneme",
-  "version": "0.7.7",
+  "version": "0.7.9",
   "description": "Structured memory engine for DeepSeek Harness. Offline semantic search, entity-attribute-timeline, autoDream self-consolidation, and human-editable Markdown storage.",
   "license": "MIT",
   "repository": {
@@ -45,6 +45,7 @@
     }
   },
   "scripts": {
+    "prepack": "node dsh-mneme/scripts/check-sync.js",
     "prepublishOnly": "node -e \"const fs=require('fs');const v=JSON.parse(fs.readFileSync('./dsh-mneme/package.json','utf8')).version;const p=JSON.parse(fs.readFileSync('./package.json','utf8'));p.version=v;fs.writeFileSync('./package.json',JSON.stringify(p,null,2)+'\\n')\""
   },
   "peerDependencies": {