bookmark-research 0.5.0-beta.6 → 0.5.0-beta.7

package/.agents/plugins/marketplace.json

@@ -9,7 +9,7 @@
       "source": {
         "source": "npm",
         "package": "bookmark-research",
-        "version": "0.5.0-beta.5",
+        "version": "0.5.0-beta.7",
         "registry": "https://registry.npmjs.org"
       },
       "policy": {

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "bookmark-research",
-  "version": "0.5.0-beta.6",
+  "version": "0.5.0-beta.7",
   "description": "Check bookmark URLs or Canvas packages, compare sources with host-led research, and retain verifiable reports.",
   "author": {
     "name": "kwenxu"

package/README.md

@@ -22,13 +22,13 @@ Works in **Codex, Claude Code, Pi and DSH (DeepSeek Harness)**.
 
 ## Install
 
-**Current beta (`0.5.0-beta.6`)**, interactive on macOS, Linux and Windows:
+**Current beta (`0.5.0-beta.7`)**, interactive on macOS, Linux and Windows:
 
 ```sh
-npx bookmark-research@0.5.0-beta.6 install --source npm:bookmark-research@0.5.0-beta.6
+npx bookmark-research@0.5.0-beta.7 install --source npm:bookmark-research@0.5.0-beta.7
 ```
 
-This pins both the installer and the content. The `@latest` examples below follow the default channel, which remains `0.5.0-beta.3`; `@beta` currently points to `0.5.0-beta.6`. Changing only the npx selector does not change the installer's default content source.
+This pins both the installer and the content. The `@latest` examples below follow the default channel, which remains `0.5.0-beta.3`; `@beta` currently points to `0.5.0-beta.7`. Changing only the npx selector does not change the installer's default content source.
 
 **Default-channel interactive installation:**
 
@@ -129,7 +129,7 @@ A bundle of one Skill, one local MCP server, and the remote MCPs and services th
 | Layer | Component | Runs as | Setup |
 | --- | --- | --- | --- |
 | Skill | [`bookmark-research`](skills/bookmark-research/SKILL.md) and 11 method references, each with a [Chinese copy](skills/bookmark-research/references/zh/skill-guide.md) | Loaded by the client | None |
-| Local MCP | `bookmark-research`, 37 tools (below) | Python process started by the client | Installed for you |
+| Local MCP | `bookmark-research`, 40 tools (below; the list grows with capabilities) | Python process started by the client | Installed for you |
 | Remote MCPs, called by the local MCP | [Exa](https://exa.ai) (search, page reading), [Parallel](https://parallel.ai) (search, fallback reading), [Tavily](https://tavily.com) (search fallback) | HTTPS, no local process | Optional API keys |
 | HTTP service, called by the local MCP | [Jina Reader](https://jina.ai/reader) (fallback reading; search with a key) | HTTPS | Optional `JINA_API_KEY` |
 | Optional client MCPs | Exa Agent, Parallel Task MCP, Tavily Research | Added to your client by you | `bookmark-research setup` shows the steps |
@@ -138,12 +138,12 @@ Local MCP tools:
 
 | Group | Tools |
 | --- | --- |
-| Bookmarks | `sync_package`, `index_status`, `source_history`, `search_bookmarks`, `get_context` |
+| Bookmarks | `sync_package`, `index_status`, `source_history`, `source_remove`, `source_merge`, `search_bookmarks`, `get_context` |
 | Web | `search_web`, `fetch_web`, `search_archive`, `search_providers` |
 | Research | `research_readiness`, `research_start`, `research_status`, `research_search`, `research_fetch`, `research_source`, `research_record`, `research_inventory`, `research_coverage`, `research_import_evidence`, `research_finish`, `research_route` |
 | Research services (optional) | `research_services`, `research_service_prepare`, `_start`, `_status`, `_result`, `_cancel`, `_attach`, `_import` |
 | Settings | `get_settings`, `update_settings` |
-| Wiki and evaluation | `wiki_write`, `wiki_get`, `wiki_list`, `wiki_search`, `wiki_lint`, `evaluate_research` |
+| Wiki and evaluation | `wiki_write`, `wiki_get`, `wiki_list`, `wiki_search`, `wiki_lint`, `wiki_acknowledge`, `evaluate_research` |
 
 Tool descriptions: [details](docs/details.en.md#mcp-tools).
 

package/README.zh.md

@@ -22,13 +22,13 @@
 
 ## 安装
 
-**当前测试版（`0.5.0-beta.6`）**，支持 macOS、Linux、Windows 交互安装：
+**当前测试版（`0.5.0-beta.7`）**，支持 macOS、Linux、Windows 交互安装：
 
 ```sh
-npx bookmark-research@0.5.0-beta.6 install --source npm:bookmark-research@0.5.0-beta.6
+npx bookmark-research@0.5.0-beta.7 install --source npm:bookmark-research@0.5.0-beta.7
 ```
 
-这条命令同时固定安装器和插件内容。下面的 `@latest` 示例使用默认渠道，目前仍为 `0.5.0-beta.3`；`@beta` 当前指向 `0.5.0-beta.6`。只改 npx 的版本选择，不会改变安装器默认下载的内容来源。
+这条命令同时固定安装器和插件内容。下面的 `@latest` 示例使用默认渠道，目前仍为 `0.5.0-beta.3`；`@beta` 当前指向 `0.5.0-beta.7`。只改 npx 的版本选择，不会改变安装器默认下载的内容来源。
 
 **默认渠道的交互安装：**
 
@@ -129,7 +129,7 @@ setup 还会问研究报告和证据放在哪里：统一目录（默认 `<数
 | 层 | 组成 | 运行方式 | 需要配置 |
 | --- | --- | --- | --- |
 | Skill | [`bookmark-research`](skills/bookmark-research/SKILL.md) 及 11 份方法参考，每份都有[中文版](skills/bookmark-research/references/zh/skill-guide.md) | 由宿主加载 | 不需要 |
-| 本地 MCP | `bookmark-research`，37 个工具（见下表） | 宿主启动的 Python 进程 | 安装器自动完成 |
+| 本地 MCP | `bookmark-research`，40 个工具（见下表；随能力增长） | 宿主启动的 Python 进程 | 安装器自动完成 |
 | 本地 MCP 调用的远程 MCP | [Exa](https://exa.ai)（搜索、网页读取）、[Parallel](https://parallel.ai)（搜索、备用读取）、[Tavily](https://tavily.com)（备用搜索） | HTTPS，不启动本地进程 | 可选 API Key |
 | 本地 MCP 调用的 HTTP 服务 | [Jina Reader](https://jina.ai/reader)（备用读取；有 Key 时可搜索） | HTTPS | 可选 `JINA_API_KEY` |
 | 可选的宿主 MCP | Exa Agent、Parallel Task MCP、Tavily Research | 需自行加到宿主里 | `bookmark-research setup` 会给出步骤 |
@@ -138,12 +138,12 @@ setup 还会问研究报告和证据放在哪里：统一目录（默认 `<数
 
 | 分类 | 工具 |
 | --- | --- |
-| 书签 | `sync_package`、`index_status`、`source_history`、`search_bookmarks`、`get_context` |
+| 书签 | `sync_package`、`index_status`、`source_history`、`source_remove`、`source_merge`、`search_bookmarks`、`get_context` |
 | 网页 | `search_web`、`fetch_web`、`search_archive`、`search_providers` |
 | 研究 | `research_readiness`、`research_start`、`research_status`、`research_search`、`research_fetch`、`research_source`、`research_record`、`research_inventory`、`research_coverage`、`research_import_evidence`、`research_finish`、`research_route` |
 | 专业研究服务（可选） | `research_services`、`research_service_prepare`、`_start`、`_status`、`_result`、`_cancel`、`_attach`、`_import` |
 | 设置 | `get_settings`、`update_settings` |
-| Wiki 与评测 | `wiki_write`、`wiki_get`、`wiki_list`、`wiki_search`、`wiki_lint`、`evaluate_research` |
+| Wiki 与评测 | `wiki_write`、`wiki_get`、`wiki_list`、`wiki_search`、`wiki_lint`、`wiki_acknowledge`、`evaluate_research` |
 
 ## 更多
 

package/docs/bookmark-research-architecture.md

@@ -44,7 +44,7 @@ flowchart TB
 
   subgraph Plugin["Bookmark Research Plugin"]
     Skill["Skill：Markdown 指令<br/>查询方法、研究规则与宿主路由"]
-    MCP["本地 MCP 入口<br/>src/mcp_server.py · 35 个工具"]
+    MCP["本地 MCP 入口<br/>src/mcp_server.py · 工具随能力增长（本版 40 个）"]
     CLI["Python CLI 入口<br/>src/cli.py"]
     Core["共用 Python 运行时<br/>Python 3.9+ 标准库"]
     Sources["来源接入、增量同步与本地查询"]

package/docs/distribution.md

@@ -19,7 +19,7 @@
 
 发布顺序：修改源码版本并完成 CI，发布已经验证的 npm 包，确认 registry 可取得该版本，再更新 GitHub marketplace 的固定版本。未发布源码不能通过 npm 入口安装；需要先用源码入口测试。
 
-测试版使用 npm 的 `beta` 标签；若创建 GitHub 版本说明，则标记为预发布。不会自动移动 npm 的 `latest` 标签。安装测试版时同时固定安装器与内容来源，例如 `npx bookmark-research@0.5.0-beta.6 install --source npm:bookmark-research@0.5.0-beta.6`。仅将 npx 改为 `@beta` 不会改变默认内容来源 `latest`；已固定的旧版安装也不会自动换成测试版。
+测试版使用 npm 的 `beta` 标签；若创建 GitHub 版本说明，则标记为预发布。不会自动移动 npm 的 `latest` 标签。安装测试版时同时固定安装器与内容来源，例如 `npx bookmark-research@0.5.0-beta.7 install --source npm:bookmark-research@0.5.0-beta.7`。仅将 npx 改为 `@beta` 不会改变默认内容来源 `latest`；已固定的旧版安装也不会自动换成测试版。
 
 ## 官方资料与项目实例
 

package/docs/host-validation.json

@@ -300,10 +300,11 @@
     "host": "dsh",
     "profile": "desktop",
     "runtime_version": "0.2.0-rc.2",
-    "package_version": "0.5.0-beta.5",
+    "package_version": "0.5.0-beta.6",
     "methods": [
       "scripts/install.py install --host dsh --profile desktop with the managed export from this source tree",
-      "dsh plugin --profile <throwaway> add <packed release tarball> (registry-equivalent spec)"
+      "dsh plugin --profile <throwaway> add <packed release tarball> (registry-equivalent spec)",
+      "dsh plugin --profile desktop add bookmark-research@0.5.0-beta.6 (published registry release)"
     ],
     "observed": {
       "bundle_selected_into_profile": true,
@@ -320,8 +321,18 @@
       "unit_tests_passed": 506,
       "temporary_test_profile_removed": true
     },
+    "published_release": {
+      "version": "0.5.0-beta.6",
+      "dist_tag": "beta",
+      "tarball_shasum": "7b9a11c7ef89ae9bba442b0b59b9e5ad8d5c0242",
+      "tarball_matches_verified_local_build": true,
+      "ships_dsh_bundle_layer": true,
+      "profile_dependency": "0.5.0-beta.6",
+      "installed_as_real_directory": true,
+      "bundle_selected_by_dsh": true,
+      "mcp_tools_listed_from_installed_copy": 37
+    },
     "not_verified": [
-      "a published npm release that carries bundle.patch.yml; the released 0.5.0-beta.5 predates it",
       "Windows or Pi installation",
       "the npm cache permission retry on a failing machine (unit-tested only; this machine used npm_config_cache instead)"
     ]

package/docs/release-notes-0.5.0-beta.7.md

@@ -0,0 +1,57 @@
+# Bookmark Research 0.5.0 beta 7
+
+**Beta / 测试版.** Uses the npm `beta` channel. The npm `latest` tag remains unchanged.
+
+## Install this beta
+
+Pin both the installer and the plugin content:
+
+```sh
+npx bookmark-research@0.5.0-beta.7 install --source npm:bookmark-research@0.5.0-beta.7
+```
+
+Choose Codex, Claude Code, Pi or DSH in the installer. Existing installations retain their recorded source and version selection. The GitHub Codex marketplace advances to this npm version after the registry confirms publication.
+
+DSH installs the released layer directly:
+
+```sh
+dsh plugin --profile <name> add bookmark-research@0.5.0-beta.7
+```
+
+## Changes
+
+### Correctness
+
+- **One release-version source.** `src/release.py` reads `package.json`, and the MCP `serverInfo`, the remote client `clientInfo` and both outbound user agents use it. Runtime identity had reported `0.5.0-beta.3` while the manifests said `0.5.0-beta.6`. A regression test fails any build that reintroduces a hardcoded release version outside `release.py`, and asserts that the real handshake matches the manifest.
+- **A copied data directory resolves its own research tasks.** `research-locations.json` carries absolute paths, so a same-machine clone used to read and write the *origin's* task folder even when `--directory` named the clone. The task folder inside the data directory in use now wins, the registry stays the fallback for tasks created beside their input, and a second valid folder for the same id is reported as `location_status: "conflict"` with `alternate_path` instead of being hidden.
+- **The task lock no longer spans a network request.** A provider that answered slowly held the task lock for the whole call, so an independent process recording a finding timed out after ten seconds with a settings-worded error. Reservation, request and commit are now separate: only reserve and commit hold the lock, a mid-request fallback reservation re-reads state under it, and genuine contention returns a retryable "research task is being written by another process".
+- **Every occurrence of a merged body can be enumerated.** `search_archive` truncated a body's occurrences at 50 with no marker and no continuation. Results now carry the true `occurrence_count`, `occurrences_truncated` and `occurrences_next_offset`, and `occurrence_limit` / `occurrence_offset` page through them in a stable order.
+- **A legitimate source change can be resolved.** `source_input_changed` is a warning about the frozen research input version; re-reviewing a page could never clear it. `wiki_write` now accepts `reviewed_input_version`, `wiki acknowledge` records a review without editing content, acknowledgements carry forward while they are still current, and a later source change reopens the warning. `wiki_lint` also reports `severity: "info"` for an acknowledged change instead of leaving only the warning.
+- **`wiki.directory` applies without a restart.** A long-lived stdio server cached the Wiki store built from the directory configured at first use, so `update_settings` appeared to succeed while reads and writes continued against the old location.
+
+### Retrieval
+
+- **`items_fts` now answers queries.** The shipped FTS table used the default tokenizer, which treats a whole run of CJK characters as one token, so it could not match `推理` inside `推理加速` and the query path used `LIKE` only. The table uses the substring-based **trigram** tokenizer and is rebuilt in place when an existing database is opened. Terms of three or more characters use `MATCH`; one- and two-character terms keep the `LIKE` fallback, because a trigram index cannot answer them. Substring semantics are unchanged (`RAG` still finds `AutoRAG`). When trigram is unavailable the index stays usable and every term falls back to `LIKE`.
+- **Whitespace-separated terms are required together.** A multi-word target was matched as one literal phrase, so `linux.do topic` returned nothing. Each term must now occur; `推理 加速` requires both words.
+- **Canvas text is findable.** Group labels, edge labels and text cards were outside every search field, so asking about "the card labelled 123" returned unrelated short-substring bookmark hits with no sign that `123` was a group label. `search_bookmarks` now reports `canvas_matches` (attributed per target) and states explicitly that they are not bookmark items and never inflate `total`.
+- **Counting guardrails.** A copy anchor reports the shared tree's count, so summing per-card counts over-reported 638 bookmarks as 1239. `context.sections[]` now carries `counted_in_totals` and `anchor_of`, `context.counts` and `search.counts` give instance and unique-URL totals for the scope, `search` warns when the requested card is an anchor, and items report `shown_in_anchors`.
+- **Smaller gaps.** Folders can be enumerated (`item_types` / `--item-type folder`), the synthetic untitled tree root is marked `synthetic` and counted separately as `tree_roots`, `search` returns `next_offset`, `limit=0` / `count_only` returns counts without rows, tag colours are filterable, and Wiki search matches text whose spacing differs from the query (`唯一URL` finds `唯一 URL`).
+
+### Operations
+
+- **Duplicate imports are no longer silent, and can be undone.** Importing the same canvas from a new folder used to add a second identical source with `warnings: []` and no way back. `sync_package` now reports `duplicate_source_ids` with a warning naming the source to reuse, and `source remove` / `source merge` (MCP `source_remove` / `source_merge`, CLI `source remove` / `source merge`) clean up. Both only report until `confirm: true` / `--confirm` is passed; merge refuses sources whose content versions differ and moves the duplicate's path aliases to the survivor.
+- **`doctor` checks that it can actually write.** An unwritable data directory produced a fully green `doctor` followed by a raw SQLite error from the first import. `doctor.storage` now probes the data directory, the config directory and an existing database, and reports `next_step` with the exact environment variables to set. A read-only failure from any command is rewritten to name `BOOKMARK_RESEARCH_DATA_DIR` and `BOOKMARK_RESEARCH_CONFIG`.
+- **An incomplete DSH install says so.** The DSH entry module preflights `src/cli.py` and the Skill before registering; when either is missing it writes the reason and the reinstall command to stderr and registers nothing, instead of letting the host fail later with a bare `ENOENT`.
+- **`partial` retention is stated up front.** `status` returns `retained_missing_note` when imported files are no longer in the package.
+
+## New tools
+
+`wiki_acknowledge`, `source_remove` and `source_merge` bring the local MCP surface from 37 to 40 tools. `search_bookmarks` gained `tag_colors`, `item_types` and `count_only`; `search_archive` gained `occurrence_limit` and `occurrence_offset`.
+
+## Validation and limits
+
+561 discovered local tests pass (three conditional integration tests skipped), up from 506, with new coverage for every change above. Verified end to end on the sample canvas package (638 bookmark instances, 557 unique URLs, 5 sections, 7 canvas nodes, 3 edges): index counts still match an independent parse, the copy anchor is not double counted, `complete` still refuses an incoherent export and keeps the previous index, a fabricated citation is still rejected, and `research_finish` still refuses to claim completion while original URLs are unread.
+
+Not verified in this release: Windows and Pi installation; a fresh DSH Desktop profile (the running app still resolves the Skill from a native-install directory that a previous installer created and that no longer exists — restarting the app, or reinstalling into the profile, re-resolves it); ten-thousand-plus URL research budgets; and the still-open items listed in the evaluation report: `context()` N+1 queries, an index time field, and local-only facts entering a research report.
+
+Install from [npm](https://www.npmjs.com/package/bookmark-research/v/0.5.0-beta.7). GitHub supplies source, version notes and installation catalogs; npm remains the shared release package for all four hosts.

package/hosts/dsh/plugin.js

@@ -1,4 +1,5 @@
 import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 
@@ -63,6 +64,16 @@ export function apply(ctx) {
       + "Set BOOKMARK_RESEARCH_PYTHON to select an interpreter.\n");
     python = { command: "python3", args: [] };
   }
+  // Preflight the files this provider advertises. A stale registration used to
+  // surface only as an ENOENT when the host tried to load the Skill or start
+  // the MCP child, with nothing telling the user how to recover.
+  const missing = [cli, fileURLToPath(skillUrl)].filter((path) => !existsSync(path));
+  if (missing.length > 0) {
+    process.stderr.write("bookmark-research: installation is incomplete; missing " + missing.join(", ") + ".\n"
+      + "Reinstall the plugin (for example: npx --yes --package=bookmark-research@latest bookmark-research install"
+      + " --host dsh) or remove the stale registration that points at a deleted install directory.\n");
+    return;
+  }
   const env = Object.fromEntries(FORWARDED_ENV
     .filter((key) => process.env[key] !== undefined)
     .map((key) => [key, process.env[key]]));

package/package.json

@@ -1,14 +1,53 @@
 {
   "name": "bookmark-research",
-  "version": "0.5.0-beta.6",
+  "version": "0.5.0-beta.7",
   "description": "Check bookmark URLs or Canvas packages, compare sources with host-led research, and retain verifiable reports.",
   "license": "GPL-3.0-only",
-  "repository": {"type": "git", "url": "git+https://github.com/Browser-bookmark-hub/Bookmark-Research.git"},
-  "keywords": ["bookmark-research", "mcp", "claude-code", "codex", "pi-package", "deepseek-harness"],
-  "bin": {"bookmark-research": "bin/bookmark-research.js"},
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Browser-bookmark-hub/Bookmark-Research.git"
+  },
+  "keywords": [
+    "bookmark-research",
+    "mcp",
+    "claude-code",
+    "codex",
+    "pi-package",
+    "deepseek-harness"
+  ],
+  "bin": {
+    "bookmark-research": "bin/bookmark-research.js"
+  },
   "main": "./hosts/dsh/plugin.js",
-  "engines": {"node": ">=18"},
-  "files": ["bin", "src", "scripts", "config", "skills", "hosts", "docs", "bundle.patch.yml", ".codex-plugin/plugin.json", ".agents/plugins/marketplace.json", "install.sh", "LICENSE", "README.md", "README.zh.md", "!**/__pycache__", "!**/*.pyc"],
-  "pi": {"skills": ["./skills"]},
-  "dsh": {"bundle": {"patch": "./bundle.patch.yml"}}
+  "engines": {
+    "node": ">=18"
+  },
+  "files": [
+    "bin",
+    "src",
+    "scripts",
+    "config",
+    "skills",
+    "hosts",
+    "docs",
+    "bundle.patch.yml",
+    ".codex-plugin/plugin.json",
+    ".agents/plugins/marketplace.json",
+    "install.sh",
+    "LICENSE",
+    "README.md",
+    "README.zh.md",
+    "!**/__pycache__",
+    "!**/*.pyc"
+  ],
+  "pi": {
+    "skills": [
+      "./skills"
+    ]
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./bundle.patch.yml"
+    }
+  }
 }