@rsrsai/magpie 0.3.3 → 0.3.4

package/README.md

@@ -18,6 +18,8 @@
 
 [npm](https://www.npmjs.com/package/@rsrsai/magpie) 已提供公开包，首次发布版本为 0.3.2。[GitHub Releases](https://github.com/risense-ai/respire-magpie/releases) 同时提供分发包与 SHA256SUMS。
 
+[0.3.3 npm 自动发布验收报告](docs/NPM-PUBLISH-0.3.3.md)：Chrome 可信发布连接显示 Valid；GitHub OIDC 发布、公共 npm 安装及签名/attestation 校验通过。
+
 ## 让 AI 安装
 
 复制给本地助手：
@@ -60,7 +62,6 @@ magpie plugin add @rsrsai/magpie
   "limit": 3,
   "remember": true,
   "readOnly": false,
-  "injectRules": true,
   "showMemoryStatus": false,
   "capture": false,
   "archive": true,
@@ -77,11 +78,10 @@ magpie plugin add @rsrsai/magpie
 | project | 非空时过滤召回、标注新写入并限制后台更新目标；留空可使用当前整个库。不是权限或账号边界。 |
 | gatewayTimeoutMs | 宿主 Hook 超时，100–10000 毫秒；整个链另有总预算。后台模型处理不占用这段预算。 |
 | requestTimeoutMs | 前台每个 Runtime 请求含正文读取的预算，100–5000 毫秒。 |
-| maxBytes | 记忆与回执注入预算，1024–32768 字节。完整政策另有最多 128 KiB 预算及固定宿主适配说明，每轮完整注入，不裁剪政策；总上下文成本会增加。 |
+| maxBytes | 记忆与回执注入预算，1024–32768 字节。完整政策另有最多 128 KiB 预算及固定宿主适配说明，不裁剪政策。每轮仍读取完整政策；同一会话只在首次和政策变化时注入全文，其余回合只增加记忆与读取回执。 |
 | limit | 候选 1–5 条，默认 3；超预算或含疑似凭据的正文跳过。 |
 | remember | 处理“记：”“存：”“记录：”“记住：”“remember:”前缀，默认开启。 |
 | readOnly | 禁止本插件显式存储、采集及后台写入，不限制其他客户端工具。 |
-| injectRules | 兼容旧配置保留；0.3.0 不再允许此项关闭每轮完整政策读取与注入。 |
 | showMemoryStatus | 提供 Memory、Used 及上次归档状态提示，默认关闭；不能保证客户端显示，严格格式应省略标签。 |
 | capture | 完成回合原始文字与工具记录保存为 trivial 日记，默认关闭。 |
 | archive | 每个完成回合保存过程日记，并用独立模型提炼、查重、更新或挂靠与回读，默认开启；必须配置模型。关闭即不满足完整每轮必存。 |

package/docs/FEATURES.md

@@ -1,6 +1,6 @@
 # respire-memory capabilities and boundaries
 
-Applies to **v0.3.2–v0.3.3**. v0.3.3 handles observed Windows/macOS Bun errors during concurrent lock acquisition within the existing deadline, and updates npm distribution documentation. See the [review repair report](REVIEW-RESPONSE-0.3.1.md), [policy-correction report](TEST-REPORT-0.3.0.md) and [historical v0.2.1 acceptance report](TEST-REPORT.md). A working memory round trip is not proof of full engine-policy compliance.
+Applies to **v0.3.4**. Each new turn still reads the complete engine policy; identical policy text is injected once per conversation and again only on change. The ineffective injectRules option is removed. See the [review repair report](REVIEW-RESPONSE-0.3.1.md), [policy-correction report](TEST-REPORT-0.3.0.md) and [historical v0.2.1 acceptance report](TEST-REPORT.md). A working memory round trip is not proof of full engine-policy compliance.
 
 ## Agent self-evolution through experience
 
@@ -15,7 +15,7 @@ This feedback loop changes reusable memory, not model weights. Readback confirms
 | Capability | Implementation | Evidence / limitation |
 | --- | --- | --- |
 | Per-turn read | Recall, complete policy from summary.instructions, selected full records; causal chain for decision/lesson/agreement/error-like hits | Four protocol fixtures; real Runtime complete-policy injection inspected. Same-turn retries reuse durable results |
-| Policy presence | Full policy is supplied every new turn, independently of the obsolete injectRules flag | Legacy small recall budgets do not clip policy; separate 128 KiB allowance plus fixed adapter; increases context cost |
+| Policy presence | Complete policy read every new turn; full text supplied on first turn and policy changes, with per-turn read receipts | Identical text is retained once in stable history, including after restart; separate 128 KiB allowance plus fixed adapter. Removed injectRules does not disable mandatory reads |
 | Explicit remember | Front end reads policy/candidates, reports pending and defers classification and writes | No direct foreground remember that bypasses classification; pending is not saved |
 | Automatic archival | Default on; detached worker uses a separately configured Chat Completions model | Requires generation setup. Disabled/unconfigured archival is disclosed as incomplete, not successful |
 | Mandatory process diary | Writable success requires a new trivial write in this archival and readback of its returned ID | No-write nothing-to-store is rejected. Existing long-term facts still must not be duplicated |
@@ -25,7 +25,7 @@ This feedback loop changes reusable memory, not model weights. Readback confirms
 | Read-only and caller control | Local/magpie-key only; explicit readOnly and engine restrictions remain authoritative | Shared-key fixture rejection checked; old host magpie-key classification remains limited |
 | Optional raw capture | Trivial raw turn diary when explicitly enabled | Default off; distinct from model-produced process diary; no live raw-capture acceptance claimed |
 | Settings and status | Settings page, Memory/Used/prior-save hints, adaptive local light/dark icon | v0.2.1 actual Magpie web rendering inspected; hints depend on the answering model |
-| Delivery | Three-OS Node/Bun checks and tagged GitHub Release tarball/SHA256 | npm deferred; community registry delivery requires maintainer merge |
+| Delivery | Three-OS Node/Bun checks, tagged GitHub Release and verified npm OIDC publication/install | Public package @rsrsai/magpie; see [0.3.3 publication acceptance](NPM-PUBLISH-0.3.3.md). Community registry delivery still requires maintainer merge |
 
 ## Strict requirements that remain unmet
 

package/docs/NPM-PUBLISH-0.3.3.md

@@ -0,0 +1,34 @@
+# npm publication and OIDC acceptance: 0.3.3
+
+Verified on 2026-10-31. Public distribution is **@rsrsai/magpie**, with **latest=0.3.3**. Community PR [553](https://github.com/magpie-community/plugins/pull/553) is a separate distribution/review process and remains unmerged at this checkpoint.
+
+## Authentication and publishing
+
+- First publication: the existing v0.3.2 GitHub Release artifact was published after the user completed npm authentication in Chrome. Its registry integrity matched the release artifact; a separate public install and registry-signature audit passed.
+- Trusted Publisher was configured and saved in Chrome: GitHub Actions, **risense-ai/respire-magpie**, **release.yml**, no environment restriction. Direct npm publish is allowed; separate dist-tag management is not. npm also lists its built-in staged-publishing permission. Chrome later showed **Status: Valid**.
+- Repository variable **NPM_PUBLISH_ENABLED=true** enables the existing npm job. It uses a GitHub-hosted runner and id-token: write, after the matching three-OS checks and GitHub Release succeed. No NPM_TOKEN or NODE_AUTH_TOKEN repository secret is configured or referenced for authentication. No long-lived publishing credential was uploaded.
+- Push a tag matching v<package.version> for subsequent releases. Stable versions publish to latest; prereleases publish to next. Do not republish an existing version or move a published tag.
+
+## Reproducible evidence
+
+| Check | Result |
+| --- | --- |
+| [Preflight CI at b31c3d4](https://github.com/risense-ai/respire-magpie/actions/runs/41194779076) | Windows/Linux/macOS, Node 24 and Bun 1.3.6: PASS |
+| [v0.3.3 release workflow](https://github.com/risense-ai/respire-magpie/actions/runs/41194886893) | Repeated three-OS verification, GitHub Release and npm OIDC job: PASS |
+| Signed provenance | [Transparency log entry](https://search.sigstore.dev/?logIndex=3613679237), generated by GitHub Actions |
+| [Supplemental community Linux run](https://github.com/risense-ai/respire-magpie/actions/runs/41194907911) | Contribution 10184ce481eb1f15dc90a192fa953b1740d080f2: 4193 pass, 3 skip, 0 fail; 4196 tests/328 files, root checks and package dry-run passed |
+| Registry artifact | Downloaded tarball matches the GitHub Release and registry integrity |
+| Public npm install | Isolated prefix, ignore-scripts: PASS |
+| npm audit signatures | One verified registry signature and one verified attestation: PASS |
+| Installed contents | Runtime modules and icon match the exact v0.3.3 Git tag; embedded icon matches its file |
+| Local Magpie package replacement | Formal v0.3.3 artifact installed; original disabled flag and options preserved |
+
+SHA256 of rsrsai-magpie-0.3.3.tgz: **47e3f97353b980662d0127dd4f8a3995caf06375d303f10b9c77b02a2edfc2b1**. The same value is in the [release SHA256SUMS](https://github.com/risense-ai/respire-magpie/releases/tag/v0.3.3).
+
+The first v0.3.3 download attempts returned 404 after metadata and provenance were visible. No publishing job was replayed. A registry GET succeeded at 11:07:26 UTC; public installation and the signature/attestation audit then passed. The delay's internal server cause was not established.
+
+## Scope and remaining limits
+
+The stronger checks exposed further intermittent Windows/macOS Bun lock-acquisition errors after earlier passing runs. The fixes and failed preflights remain in the [review repair report](REVIEW-RESPONSE-0.3.1.md); the existing contention check verifies 64 increments and four competing child processes. No failed check was skipped to publish.
+
+This publication acceptance does not constitute a new live model/native-desktop acceptance. Strict before-send persistence remains unsupported by the current completion callback. Community workflow approval/merge, its dist release and community npm ownership are independent; supplemental upstream CI is not maintainer approval. No private authentication material or local memory evidence is included here.

package/docs/REVIEW-RESPONSE-0.3.1.md

@@ -1,5 +1,18 @@
 # Magpie PR 553 review repair report
 
+## v0.3.4 follow-up to review 5722498530
+
+The reviewer accepted the fresh per-request identity check and display name, and independently reported 4187 passing community tests, 9 skipped, 0 failures at 10184ce. Two remaining blockers concerned repeated policy text and the ineffective injectRules option.
+
+- Every newly observed turn still calls recall and reads the complete Runtime policy. A policy hash is persisted with each turn; the full rules/policy block is supplied on the first turn and whenever the policy changes. Unchanged policy remains in its original historical position. Per-turn blocks carry memories and actual read receipts. No mandatory read or automatic process-diary requirement is removed.
+- injectRules is removed from the manifest, validated options, configuration examples and checks. Stale configuration keys are ignored, as other unknown keys are; they cannot disable mandatory policy reads.
+- Failed recall/policy reads report failure through the host without adding an unsaved message to the latest turn. Successfully restored earlier prefixes remain intact.
+- The community registry entry follows its neighbours' multi-line formatting.
+
+The existing checks now exercise five consecutive turns, host resets, policy changes, unchanged follow-up and policy reversion across Chat, Responses, Anthropic and Gemini. They verify one copy of unchanged policy, a new copy only on change, one actual recall/prompt per new turn, and byte-identical historical prefixes. Node and the Bun-discovered adapter pass locally on Windows. CI and live npm acceptance will be recorded separately after execution; these local fixtures are not live deployment evidence.
+
+The first 0.3.4 preflight [41197398772](https://github.com/risense-ai/respire-magpie/actions/runs/41197398772) passed Linux/macOS but failed the Windows Bun-discovered adapter during the existing 64-increment contention check: mkdir returned EPERM on the exact lock directory. Windows can retain a released directory in delete-pending state. Acquisition now retries that exact syscall/path within the existing deadline, before ownership; sole-owner verification and unknown-write protection are unchanged. The failed candidate is retained as evidence rather than rerun unchanged.
+
 This responds to the review of community head 40fec72. It is an upstream engineering report, not a claim that community CI has approved this package. The community package links upstream reports rather than shipping copies as its own evidence.
 
 The first repair candidate, v0.3.1, failed Windows CI with a transient EPERM while removing an empty lock directory under concurrent access. Its tag is retained and no release assets were published. The follow-up candidate is v0.3.2, with bounded Windows cleanup retries. It also corrects a separate empty-recall bug: hiding display hints must not discard the complete engine policy. The existing checks now cover empty recall with hints off across all four adapters.
@@ -23,7 +36,7 @@ The first v0.3.2 main-branch CI run passed macOS/Linux but exposed a separate fi
 | 11: community README / upstream reports | Community README is rewritten around its actual package, CI entry, monorepo dist/provenance and limitations. Personal paths and upstream release-workflow instructions are removed. Upstream reports are linked and explicitly labeled, not packaged as community CI evidence |
 | 12: placement / name | Entry/README row moved after the existing memory-hook entries. The requested product/display name respire-memory is retained rather than renamed to Respire |
 
-## Final automated verification
+## v0.3.2 verification (historical)
 
 - [Three-OS upstream CI at 1a080fb](https://github.com/risense-ai/respire-magpie/actions/runs/41192351640): Windows, Linux and macOS passed with Node 24 and Bun 1.3.6, including the discovered adapter and package dry-run.
 - [Supplemental community compatibility run](https://github.com/risense-ai/respire-magpie/actions/runs/41192352925) checked out community contribution **df58d566b9ddca3aaced1b490035e0a26468a554** on Linux: **4193 pass, 3 skip, 0 fail**, 4196 tests across 328 files; root checks and the 22-file package dry-run passed. The package's adapter was discovered and passed within the full suite.
@@ -53,4 +66,6 @@ At 7f170e2, Windows passed, while macOS Bun 1.3.6 reported EINVAL on owner-file
 
 ### Remaining host limits
 
-The engine's strict before-send persistence requirement still needs an appropriate host callback or a client-owned loop: the current notification is after reply completion. Native desktop rendering, live all-protocol sessions, exhaustive crash/power-loss/account-switch recovery, npm first publication and marketplace approval remain outside the proven result. See the [feature matrix](FEATURES.md) and [0.3.0 correction report](TEST-REPORT-0.3.0.md).
+The [v0.3.3 publication acceptance](NPM-PUBLISH-0.3.3.md) records the final passing three-OS and updated full-community runs, public npm install/signature/attestation verification, and the Chrome-configured OIDC connection showing Valid. The earlier failures above remain part of this report.
+
+The engine's strict before-send persistence requirement still needs an appropriate host callback or a client-owned loop: the current notification is after reply completion. Native desktop rendering, live all-protocol sessions, exhaustive crash/power-loss/account-switch recovery and marketplace approval remain outside the proven result. See the [feature matrix](FEATURES.md) and [0.3.0 correction report](TEST-REPORT-0.3.0.md).

package/lock.mjs

@@ -52,6 +52,11 @@ export async function acquireLock(path, { waitMs = 5000 } = {}) {
         if (error.code !== 'ENOENT') throw error;
       }
     } catch (error) {
+      // Windows can keep a released directory delete-pending before the next mkdir.
+      if (process.platform === 'win32' && error.code === 'EPERM' && error.syscall === 'mkdir' && error.path === path) {
+        if (Date.now() >= deadline) throw error;
+        await delay(25); continue;
+      }
       if (error.code !== 'EEXIST') throw error;
       try {
         if ((await lstat(path)).isDirectory()) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rsrsai/magpie",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "description": "帮助 AI Agent 通过记忆召回、经验积累与后台归档持续自进化",
   "type": "module",
   "license": "MIT",
@@ -46,7 +46,6 @@
       "readOnly": false,
       "archive": true,
       "showMemoryStatus": false,
-      "injectRules": true,
       "generationBaseUrl": "",
       "generationModel": "",
       "authorizationEnv": "RESPIRE_MAGPIE_AUTHORIZATION",

package/respire.hooks.mjs

@@ -64,14 +64,18 @@ function block(data, budget) {
   return text;
 }
 
-async function prepare(o, query, signal, entry, extra = {}) {
+async function prepare(o, query, signal, entry, extra = {}, priorPolicy) {
   const data = { memories: [], ...extra };
   const scoped = o.project ? ['--project', o.project] : [];
   const recalled = SKIP_PREFIX.test(query) ? { status: 'skip', details: [] }
     : await rpc(o, ['recall', query, '--titles', '--limit', String(o.limit), ...scoped], signal);
   const policy = await rpc(o, ['prompt'], signal);
   if (policy.status !== 'ok' || typeof policy.summary?.instructions !== 'string' || !policy.summary.instructions.trim()) throw new Failure('invalid');
-  data.rules = RULES + '\n\n' + policy.summary.instructions;
+  const rules = RULES + '\n\n' + policy.summary.instructions;
+  entry.policyHash = hash(rules);
+  // Read every turn; retain the full text once in history and again on change.
+  if (entry.policyHash !== priorPolicy) data.rules = rules;
+  data.reads = { recall: recalled.status === 'skip' ? 'skipped' : 'complete', policy: 'complete', policyHash: entry.policyHash };
   data.workflow = { archive: o.archive, generationConfigured: !!(o.generationBaseUrl && o.generationModel),
     note: o.readOnly ? '只读，禁止写入。' : !o.archive ? '归档已关闭，未满足每轮读存流程。'
       : !o.generationBaseUrl || !o.generationModel ? '尚未配置归档模型，不能完成每轮存储。'
@@ -147,13 +151,13 @@ export async function onRequest(body, ctx) {
     ctx.state.respire = { body: structuredClone(body), o, key: digest(account, keyOf(latest)), account, sessionKey,
       storeRequest: STORE_PREFIX.test(originalQuery) };
   }
-  let modified = false;
+  let modified = false, priorPolicy;
   const priorTurn = async t => {
     let prior = cache.get(keyOf(t));
     if (!prior) {
       const saved = await store.get('turn-' + digest(account, keyOf(t)));
       if (saved?.phase === 'done' && saved.text) {
-        prior = { text: saved.text, storage: saved.storage, bytes: bytes(saved.text) }; retain(cache, keyOf(t), prior);
+        prior = { text: saved.text, storage: saved.storage, policyHash: saved.policyHash, bytes: bytes(saved.text) }; retain(cache, keyOf(t), prior);
       }
     }
     return prior;
@@ -161,6 +165,7 @@ export async function onRequest(body, ctx) {
   for (const t of users) {
     if (t === latest) continue;
     const prior = await priorTurn(t);
+    if (prior?.policyHash) priorPolicy = prior.policyHash;
     if (prior?.text && !t.text.endsWith(prior.text)) { t.append(prior.text); modified = true; }
   }
   if (all.at(-1) !== latest) {
@@ -178,14 +183,14 @@ export async function onRequest(body, ctx) {
     // Share the in-flight operation across concurrent requests of the same turn.
     retain(cache, key, entry);
     entry.pending = store.change(durableKey, async (saved, persist) => {
-      if (saved?.phase === 'done') { entry.storage = saved.storage; return saved.text; }
+      if (saved?.phase === 'done') { entry.storage = saved.storage; entry.policyHash = saved.policyHash; return saved.text; }
       if (saved?.phase === 'writing') return block({ storage: { status: 'uncertain', message: '该回合曾开始写入，结果未确认。先查库核实，禁止重试写入。' } }, o.maxBytes);
       await persist({ phase: 'processing' });
       entry.beforeWrite = () => persist({ phase: 'writing' });
       const extra = {};
       if (o.showMemoryStatus && session.lastArchive && session.lastArchive.source !== session.reportedSource) extra.priorSave = session.lastArchive;
-      const text = await prepare(o, STORE_PREFIX.test(originalQuery) ? originalQuery : q, ctx.signal, entry, extra);
-      await persist({ phase: 'done', text, storage: entry.storage });
+      const text = await prepare(o, STORE_PREFIX.test(originalQuery) ? originalQuery : q, ctx.signal, entry, extra, priorPolicy);
+      await persist({ phase: 'done', text, storage: entry.storage, policyHash: entry.policyHash });
       if (extra.priorSave) {
         try { await store.change('session-' + sessionKey, async (current = {}, save) => save({ ...current, reportedSource: extra.priorSave.source })); }
         catch { ctx.report?.('session-notification-failed'); }
@@ -205,8 +210,7 @@ export async function onRequest(body, ctx) {
     return modified ? changed : undefined;
   } catch (error) {
     ctx.report?.(error instanceof Failure ? error.code : 'unavailable');
-    latest.append(block({ workflow: { status: 'unavailable', note: '本轮召回或完整政策读取失败，未满足答前读忆流程；不得宣称记忆流程已完成。' } }, o.maxBytes));
-    return changed;
+    return modified ? changed : undefined;
   }
 }
 

package/runtime.mjs

@@ -26,14 +26,14 @@ export function options(raw = {}) {
   const o = { url: url.href, project: raw.project ?? '', timeout: raw.requestTimeoutMs ?? 1500,
     maxBytes: raw.maxBytes ?? 8000, limit: raw.limit ?? 3, remember: raw.remember ?? true, capture: raw.capture ?? false,
     readOnly: raw.readOnly ?? false, archive: raw.archive ?? true, showMemoryStatus: raw.showMemoryStatus ?? false,
-    injectRules: raw.injectRules ?? true, stateDir: raw.stateDir ?? '', generationBaseUrl: raw.generationBaseUrl ?? '',
+    stateDir: raw.stateDir ?? '', generationBaseUrl: raw.generationBaseUrl ?? '',
     generationModel: raw.generationModel ?? '', authorizationEnv: raw.authorizationEnv ?? 'RESPIRE_MAGPIE_AUTHORIZATION' };
   if (typeof o.project !== 'string' || o.project.length > 256 || /[\x00-\x1f\x7f]/.test(o.project) ||
       typeof o.remember !== 'boolean' || typeof o.capture !== 'boolean' ||
       !Number.isInteger(o.timeout) || o.timeout < 100 || o.timeout > 5000 ||
       !Number.isInteger(o.maxBytes) || o.maxBytes < 1024 || o.maxBytes > 32768 ||
       !Number.isInteger(o.limit) || o.limit < 1 || o.limit > 5) throw new Failure('invalid');
-  for (const key of ['readOnly', 'archive', 'showMemoryStatus', 'injectRules']) if (typeof o[key] !== 'boolean') throw new Failure('invalid');
+  for (const key of ['readOnly', 'archive', 'showMemoryStatus']) if (typeof o[key] !== 'boolean') throw new Failure('invalid');
   for (const key of ['stateDir', 'generationBaseUrl', 'generationModel', 'authorizationEnv']) if (typeof o[key] !== 'string' || o[key].length > 2048 || /[\x00-\x1f\x7f]/.test(o[key])) throw new Failure('invalid');
   if (o.stateDir && !isAbsolute(o.stateDir)) throw new Failure('invalid');
   if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(o.authorizationEnv)) throw new Failure('invalid');