dsh-continual-evolve 0.12.0 → 0.12.1

package/README.md

@@ -7,9 +7,9 @@ English | [中文](README.zh.md)
 [![CI](https://github.com/ZK-Andy/dsh-continual-evolve/actions/workflows/ci.yml/badge.svg)](https://github.com/ZK-Andy/dsh-continual-evolve/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node](https://img.shields.io/badge/node-%5E22.19%20%7C%7C%20%3E%3D24-339933)](package.json)
-[![Tests](https://img.shields.io/badge/tests-32%20passing-brightgreen)]()
+[![Tests](https://img.shields.io/badge/tests-62%20passing-brightgreen)]()
 [![Coverage · statements](https://img.shields.io/badge/coverage_statements-98%25-brightgreen)]()
-[![Coverage · branches](https://img.shields.io/badge/coverage_branches-98%25-green)]()
+[![Coverage · branches](https://img.shields.io/badge/coverage_branches-95%25-green)]()
 [![Coverage · functions](https://img.shields.io/badge/coverage_functions-100%25-brightgreen)]()
 
 A workspace-memory plugin for the [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (`dsh`): one plain-markdown memory store per workspace (`<workspace>/.evolve/memory/`), the index injected at session start, used by the model with its **native file tools** — and nothing else.
@@ -23,6 +23,7 @@ Reusable experience gathered in one session (user preferences, pitfalls, project
 1. **Session-start injection** — the plugin registers a single system-prompt section: the `MEMORY.md` index content (whole-line truncated over budget, with a read-the-directory hint), the absolute store path, and the when_to_save guide. The section is computed once per session and reused byte-for-byte, keeping the system prompt stable and the prompt cache warm; an empty store costs zero tokens.
 2. **Native read/write** — DSH fully permits file access inside the workspace (reads are never fenced; the write fence only covers paths outside the workspace, see [`docs/FAQ.md`](docs/FAQ.md) #6). The model reads, writes, and edits memory files and maintains the index directly; the store is bootstrapped on first use.
 3. **Governance is the file** — no versions, no snapshots, no approvals, no background extraction: a bad memory is a visible file in the workspace, and deleting it is the retirement path. Memories are personal context — on bootstrap in a git workspace the store appends `.evolve/` to the workspace `.gitignore` (non-git workspaces are left untouched).
+4. **Read-only card** — the plugin mounts a read-only memory card on its own page in the official plugin manager (the `plugins.bundle.config` slot; hosts without it silently degrade to no card): recently served workspaces, per-workspace entry and index counts, and index-drift warnings (unindexed files, index rows whose file is gone). The card is a request-time projection of the files on disk — the single source of truth remains `.evolve/memory/`; the card has no edit path, edit the files directly.
 
 Memory file format (same as ZCode): frontmatter with `name` / `description` (the hook that decides whether a future session recalls it) / `metadata.type` (`user | feedback | project | reference`); `feedback` bodies must carry **Why:** and **How to apply:** lines.
 
@@ -40,7 +41,7 @@ After installing or updating, restart the DSH profile you actually use (`dsh web
 
 ## Usage
 
-No commands, no tools. On the first session after restart, `.evolve/memory/` is created and the index is injected automatically. Just tell the model "remember …" / "forget …" — the memory files plus their index lines are the entire persistent state. Memories written mid-session become visible in the next session (the section is frozen to protect the prompt cache); for an immediate look the model simply reads the directory.
+No commands, no tools. On the first session after restart, `.evolve/memory/` is created and the index is injected automatically. Just tell the model "remember …" / "forget …" — the memory files plus their index lines are the entire persistent state. Memories written mid-session become visible in the next session (the section is frozen to protect the prompt cache); for an immediate look the model simply reads the directory. To see the whole store, open the plugin's page in the official plugin manager: the read-only card shows each workspace's entries and index drift.
 
 ## Configuration
 
@@ -50,6 +51,7 @@ No commands, no tools. On the first session after restart, `.evolve/memory/` is
 | `memoryIndex.guide` | `true` | Inject the when_to_save guide (zero tokens when off and the index is empty) |
 | `memoryIndex.order` | `400` | Section order (upstream named slots start at `PLAN_POLICY=500`) |
 | `memoryIndex.maxChars` | `6000` | Hard character budget for the injected index |
+| `memoryCard.enabled` | `true` | Read-only memory card in the official plugin manager (degrades to no card when the host lacks `webServer`/`plugins.bundle.config`) |
 
 Profile patch example:
 
@@ -64,7 +66,7 @@ Profile patch example:
 
 ```bash
 pnpm install && pnpm build   # deps + tsc -> lib/
-pnpm test                    # vitest (32 tests)
+pnpm test                    # vitest (62 tests)
 pnpm test:coverage           # v8 coverage, CI-enforced thresholds
 pnpm lint                    # oxlint src test
 ```
@@ -73,10 +75,15 @@ Layout:
 
 ```
 ├── src/
-│   ├── index.ts           # registration: the one section + config
+│   ├── index.ts           # registration: the one section + config + card route wiring
 │   ├── memory-section.ts  # injection: read index / bootstrap / truncate / session freeze
-│   └── memory-guide.ts    # guide: when_to_save and upkeep (adapted from ZCode)
-├── test/                  # vitest suite (3 files)
+│   ├── memory-guide.ts    # guide: when_to_save and upkeep (adapted from ZCode)
+│   ├── memory-snapshot.ts # card: read-only store projection (entries / drift / error degrade)
+│   ├── known-workspaces.ts# card: in-process LRU workspace allowlist (the API read fence)
+│   └── card-routes.ts     # card: GET-only read API on the host webServer
+├── client/
+│   └── client.js          # hand-written client bundle: read-only card in the plugin manager
+├── test/                  # vitest suite (7 files)
 ├── lib/                   # build output (tsc)
 ├── docs/                  # design.md (design) · FAQ.md (real-world pitfalls)
 └── .agents/               # AI collaboration layer (AGENTS.md, skills, ADR notes)

package/README.zh.md

@@ -7,9 +7,9 @@
 [![CI](https://github.com/ZK-Andy/dsh-continual-evolve/actions/workflows/ci.yml/badge.svg)](https://github.com/ZK-Andy/dsh-continual-evolve/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node](https://img.shields.io/badge/node-%5E22.19%20%7C%7C%20%3E%3D24-339933)](package.json)
-[![Tests](https://img.shields.io/badge/tests-32%20passing-brightgreen)]()
+[![Tests](https://img.shields.io/badge/tests-62%20passing-brightgreen)]()
 [![Coverage · statements](https://img.shields.io/badge/coverage_statements-98%25-brightgreen)]()
-[![Coverage · branches](https://img.shields.io/badge/coverage_branches-98%25-green)]()
+[![Coverage · branches](https://img.shields.io/badge/coverage_branches-95%25-green)]()
 [![Coverage · functions](https://img.shields.io/badge/coverage_functions-100%25-brightgreen)]()
 
 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)（`dsh`）的工作区记忆插件：每个工作区一个纯 markdown 记忆库（`<workspace>/.evolve/memory/`），会话开局注入索引，模型用**原生文件读写工具**直接使用——仅此而已。
@@ -23,6 +23,7 @@ Agent 每个会话积累的可复用经验（用户偏好、踩坑教训、项
 1. **开局注入** —— 插件只注册一个 system-prompt section：注入 `MEMORY.md` 索引正文（超预算按整行截断并提示读目录）、记忆目录绝对路径、when_to_save 指南。该 section 每会话只算一次并逐字节复用，system prompt 稳定、prompt cache 持续命中；空 store 零 token。
 2. **原生读写** —— DSH 对工作区内文件读写全放行（读路径从不设防，写围栏只围工作区外，见 [`docs/FAQ.md`](docs/FAQ.md) #6）。模型直接 Read/Write/Edit 记忆文件并维护索引；store 不存在时自动 bootstrap。
 3. **治理即文件** —— 无版本、无快照、无审批、无后台提取：一条坏记忆就是工作区里一个可见的文件，删掉它就是退役。记忆是个人上下文——bootstrap 时若工作区是 git 仓库会自动把 `.evolve/` 追加进 `.gitignore`（非 git 工作区不碰任何文件）。
+4. **只读卡片** —— 插件在官方插件管理的本 bundle 页面挂一张只读记忆卡片（`plugins.bundle.config` slot，老宿主自动降级为无卡片）：最近服务过的工作区、各自记忆库的条目数/索引行数、索引漂移警告（未索引文件与索引失联文件）。卡片是磁盘文件的请求时投影——单一事实源永远是 `.evolve/memory/` 里的文件，卡片没有编辑路径，编辑请直接改文件。
 
 记忆文件格式（与 ZCode 一致）：frontmatter 带 `name` / `description`（决定未来会话会不会想起它）/ `metadata.type`（`user | feedback | project | reference`）；`feedback` 正文必带 **Why:** 与 **How to apply:**。
 
@@ -40,7 +41,7 @@ dsh plugin add ZK-Andy/dsh-continual-evolve
 
 ## 使用
 
-无需命令、无需工具。重启后第一场会话，`.evolve/memory/` 会自动生成，索引自动注入开场；对模型直接说"记住……"/"忘掉……"即可，写入的记忆文件 + 索引行就是全部持久状态。会话中途写入的记忆下个会话生效（会话内冻结守 prompt cache）；需要立即查看时，模型直接读目录。
+无需命令、无需工具。重启后第一场会话，`.evolve/memory/` 会自动生成，索引自动注入开场；对模型直接说"记住……"/"忘掉……"即可，写入的记忆文件 + 索引行就是全部持久状态。会话中途写入的记忆下个会话生效（会话内冻结守 prompt cache）；需要立即查看时，模型直接读目录。想看记忆库全貌，打开官方插件管理里本插件的页面：只读卡片展示各工作区的记忆条目与索引漂移。
 
 ## 配置
 
@@ -50,6 +51,7 @@ dsh plugin add ZK-Andy/dsh-continual-evolve
 | `memoryIndex.guide` | `true` | 是否注入 when_to_save 指南（关闭且索引为空时该 section 零 token） |
 | `memoryIndex.order` | `400` | section 顺序（上游命名槽位自 `PLAN_POLICY=500` 起） |
 | `memoryIndex.maxChars` | `6000` | 注入索引的硬字符预算 |
+| `memoryCard.enabled` | `true` | 官方插件管理内的只读记忆卡片（宿主缺 `webServer`/`plugins.bundle.config` 时自动降级为无卡片） |
 
 profile patch 示例：
 
@@ -64,7 +66,7 @@ profile patch 示例：
 
 ```bash
 pnpm install && pnpm build   # 依赖 + tsc -> lib/
-pnpm test                    # vitest（32 例）
+pnpm test                    # vitest（62 例）
 pnpm test:coverage           # v8 覆盖率，CI 强制阈值
 pnpm lint                    # oxlint src test
 ```
@@ -73,10 +75,15 @@ pnpm lint                    # oxlint src test
 
 ```
 ├── src/
-│   ├── index.ts           # 注册：唯一 section + 配置
+│   ├── index.ts           # 注册：唯一 section + 配置 + 卡片路由接线
 │   ├── memory-section.ts  # 注入：读索引 / bootstrap / 截断 / 会话冻结
-│   └── memory-guide.ts    # 指南：when_to_save 与维护纪律（改编自 ZCode）
-├── test/                  # vitest 测试（3 个文件）
+│   ├── memory-guide.ts    # 指南：when_to_save 与维护纪律（改编自 ZCode）
+│   ├── memory-snapshot.ts # 卡片：记忆库只读投影（条目 / 漂移 / 错误降级）
+│   ├── known-workspaces.ts# 卡片：进程内 LRU 工作区白名单（API 读围栏）
+│   └── card-routes.ts     # 卡片：webServer 上的 GET-only 只读 API
+├── client/
+│   └── client.js          # 手写 client bundle：官方插件管理内只读卡片
+├── test/                  # vitest 测试（7 个文件）
 ├── lib/                   # 构建产物（tsc）
 ├── docs/                  # design.md（设计）· FAQ.md（踩坑）
 └── .agents/               # AI 协作层（AGENTS.md、技能、ADR 笔记）

package/client/client.js

@@ -0,0 +1,253 @@
+/**
+ * dsh-continual-evolve — client bundle for the official plugin manager card.
+ *
+ * Hand-written (no bundler: docs/coding-standard.md forbids a second one) in
+ * the host loader's factory shape, verified against dshmarket's built
+ * bundle: `window.__ModuleLoader__.load({ id, factory })`, where the factory
+ * resolves host-provided modules through the passed `require` (here: only
+ * react) and returns its `module.exports`. The host mounts the bundle via
+ * package.json `dsh.client` + the `./client` export.
+ *
+ * The card registers one slot, `plugins.bundle.config` — the seat the 0.1.7+
+ * plugin manager declares for a bundle's own page. Slot detection is the
+ * compatibility contract: a host that never declares the slot never runs the
+ * registration, so the card is silently absent while the memory section is
+ * unaffected. The render function answers the host's `view === "summary"`
+ * call with null (the bundle list row shows the package description; the
+ * card is the page).
+ *
+ * The card is a read-only projection of the workspace memory store, fetched
+ * at render time from this plugin's host routes (same-origin). No editor, no
+ * write path, no cached state — refresh refetches everything.
+ */
+window.__ModuleLoader__.load({
+	id: "dsh-continual-evolve",
+	factory: function (require) {
+		var module = { exports: {} };
+		var exports = module.exports;
+		var react = undefined;
+		try {
+			react = require("react");
+		} catch (error) {
+			// Browser side: this runs before any cordis logger exporter exists,
+			// so console is the only outlet (same escape hatch dshmarket uses).
+			console.warn(
+				"[dsh-continual-evolve] host react module unavailable — card disabled: " +
+					(error instanceof Error ? error.message : String(error)),
+			);
+			return module.exports;
+		}
+		if (react === undefined || typeof react.createElement !== "function") {
+			// A module table that resolves react to nothing is the same downgrade:
+			// render would throw and blank the whole settings dialog (dshmarket #671 shape).
+			console.warn("[dsh-continual-evolve] host react module has no createElement — card disabled");
+			return module.exports;
+		}
+
+		var createElement = react.createElement;
+		var useState = react.useState;
+		var useEffect = react.useEffect;
+
+		var NS = "dsh-continual-evolve";
+		var SLOT = "plugins.bundle.config";
+		var API_ROOT = "/dsh-continual-evolve/api/v1";
+
+		/**
+		 * Assemble the card's view model: the workspace allowlist, then one
+		 * snapshot per workspace. Network or API failure per workspace degrades
+		 * to an `error` string on that workspace's entry — one bad store never
+		 * blanks the whole card.
+		 *
+		 * @param {typeof fetch} fetchImpl - injectable for tests.
+		 * @returns {Promise<{workspaces: Array<object>}>}
+		 */
+		async function loadCardModel(fetchImpl) {
+			var listResponse = await fetchImpl(API_ROOT + "/workspaces");
+			if (!listResponse.ok) {
+				throw new Error("workspaces API answered HTTP " + listResponse.status);
+			}
+			var listBody = await listResponse.json();
+			var workspaces = Array.isArray(listBody.workspaces) ? listBody.workspaces : [];
+			var entries = await Promise.all(
+				workspaces.map(async function (workspace) {
+					var root = typeof workspace.root === "string" ? workspace.root : "";
+					var lastSeen = typeof workspace.lastSeen === "string" ? workspace.lastSeen : "";
+					try {
+						var snapshotResponse = await fetchImpl(API_ROOT + "/memory?root=" + encodeURIComponent(root));
+						if (!snapshotResponse.ok) {
+							return { root: root, lastSeen: lastSeen, snapshot: null, error: "HTTP " + snapshotResponse.status };
+						}
+						return { root: root, lastSeen: lastSeen, snapshot: await snapshotResponse.json(), error: null };
+					} catch (error) {
+						return {
+							root: root,
+							lastSeen: lastSeen,
+							snapshot: null,
+							error: error instanceof Error ? error.message : String(error),
+						};
+					}
+				}),
+			);
+			return { workspaces: entries };
+		}
+
+		/** One workspace block: root, stats, drift warnings, per-file lines. */
+		function WorkspaceBlock(props) {
+			var entry = props.entry;
+			var snapshot = entry.snapshot;
+			var children = [
+				createElement("div", { key: "root", style: { fontFamily: "monospace", wordBreak: "break-all" } }, entry.root),
+			];
+			if (entry.error !== null) {
+				children.push(createElement("div", { key: "error" }, "读取失败：" + entry.error));
+				return createElement("div", { style: { marginBottom: "12px" } }, children);
+			}
+			if (snapshot === null || !snapshot.exists) {
+				children.push(createElement("div", { key: "absent" }, "该工作区尚无记忆库（开一次会话自动创建）。"));
+				return createElement("div", { style: { marginBottom: "12px" } }, children);
+			}
+			if (snapshot.readError !== null) {
+				children.push(createElement("div", { key: "readError" }, "记忆库读取失败：" + snapshot.readError));
+				return createElement("div", { style: { marginBottom: "12px" } }, children);
+			}
+			children.push(
+				createElement(
+					"div",
+					{ key: "stats" },
+					snapshot.fileCount + " 条记忆 · 索引 " + snapshot.indexEntryCount + " 行",
+				),
+			);
+			if (snapshot.missingFiles.length > 0) {
+				children.push(
+					createElement(
+						"div",
+						{ key: "missing" },
+						"索引失联（索引引用但文件已删）：" + snapshot.missingFiles.join("、"),
+					),
+				);
+			}
+			if (snapshot.unindexedFiles.length > 0) {
+				children.push(
+					createElement(
+						"div",
+						{ key: "unindexed" },
+						"未入索引（文件存在但索引没有行）：" + snapshot.unindexedFiles.join("、"),
+					),
+				);
+			}
+			children.push(
+				createElement(
+					"ul",
+					{ key: "files", style: { margin: "4px 0 0", paddingLeft: "18px" } },
+					snapshot.files.map(function (file) {
+						return createElement(
+							"li",
+							{ key: file.file },
+							createElement("strong", null, file.file) +
+								(file.description !== "" ? " — " + file.description : ""),
+						);
+					}),
+				),
+			);
+			return createElement("div", { style: { marginBottom: "12px" } }, children);
+		}
+
+		/** The card page: refresh control + one block per known workspace. */
+		function MemoryCard() {
+			var state = useState({ status: "loading", model: null, message: "" });
+			var model = state[0];
+			var setModel = state[1];
+			var reloadState = useState(0);
+			var reload = reloadState[1];
+			useEffect(
+				function () {
+					var alive = true;
+					loadCardModel(fetch).then(
+						function (data) {
+							if (alive) setModel({ status: "ready", model: data, message: "" });
+						},
+						function (error) {
+							if (alive) {
+								setModel({ status: "error", model: null, message: error instanceof Error ? error.message : String(error) });
+							}
+						},
+					);
+					return function () {
+						alive = false;
+					};
+				},
+				[reloadState[0]],
+			);
+			var children = [
+				createElement(
+					"div",
+					{ key: "head", style: { display: "flex", alignItems: "baseline", gap: "12px" } },
+					createElement("strong", null, "工作区记忆（只读投影）"),
+					createElement(
+						"button",
+						{
+							type: "button",
+							onClick: function () {
+								setModel({ status: "loading", model: null, message: "" });
+								reload(function (n) {
+									return n + 1;
+								});
+							},
+						},
+						"刷新",
+					),
+				),
+				createElement(
+					"div",
+					{ key: "hint" },
+					"事实源是各工作区 .evolve/memory/ 下的 markdown 文件——模型原生读写；本卡片只展示，编辑请直接改文件。",
+				),
+			];
+			if (model.status === "loading") {
+				children.push(createElement("div", { key: "body" }, "读取中…"));
+			} else if (model.status === "error") {
+				children.push(createElement("div", { key: "body" }, "卡片数据加载失败：" + model.message));
+			} else if (model.model.workspaces.length === 0) {
+				children.push(
+					createElement(
+						"div",
+						{ key: "body" },
+						"本进程还没有服务过任何工作区会话——在某个工作区开一次会话后回来刷新。",
+					),
+				);
+			} else {
+				children.push(
+					createElement(
+						"div",
+						{ key: "body" },
+						model.model.workspaces.map(function (entry) {
+							return createElement(WorkspaceBlock, { key: entry.root, entry: entry });
+						}),
+					),
+				);
+			}
+			return createElement("div", null, children);
+		}
+
+		exports.name = NS;
+		exports.inject = ["slots"];
+		exports.loadCardModel = loadCardModel;
+		exports.apply = function apply(ctx) {
+			ctx.slots.inject(SLOT, function () {
+				return ctx.slots.register(
+					{
+						name: SLOT,
+						key: NS,
+						inject: function () {
+							return {};
+						},
+					},
+					function (ownerProps) {
+						return ownerProps && ownerProps.view === "summary" ? null : createElement(MemoryCard);
+					},
+				);
+			});
+		};
+		return module.exports;
+	},
+});

package/lib/card-routes.d.ts

@@ -0,0 +1,32 @@
+import type { KnownWorkspaces } from "./known-workspaces.js";
+/** URL prefix of the card API (kind-exact routes registered under it). */
+export declare const CARD_API_WORKSPACES_PATH = "/dsh-continual-evolve/api/v1/workspaces";
+export declare const CARD_API_MEMORY_PATH = "/dsh-continual-evolve/api/v1/memory";
+/** Minimal request shape the handlers touch (Node IncomingMessage subset). */
+export interface CardRequest {
+    method?: string;
+    url?: string;
+}
+/** Minimal response shape the handlers touch (Node ServerResponse subset). */
+export interface CardResponse {
+    writeHead(status: number, headers?: Record<string, string>): unknown;
+    end(body?: string): unknown;
+}
+/** One `kind: "exact"` route registration on the host web server. */
+export interface CardRoute {
+    kind: "exact";
+    path: string;
+    handler(request: CardRequest, response: CardResponse): void;
+}
+/** Minimal webServer surface the card mounts on. */
+export interface CardWebServer {
+    register(route: CardRoute): unknown;
+}
+/**
+ * Register the two card routes and return a disposer that removes them.
+ * Registration return values are passed through untouched: whatever disposer
+ * shape the host hands back (or none, as on some host versions), the
+ * disposer calls only the functions among them.
+ */
+export declare function mountCardRoutes(webServer: CardWebServer, workspaces: KnownWorkspaces): () => void;
+//# sourceMappingURL=card-routes.d.ts.map

package/lib/card-routes.js

@@ -0,0 +1,92 @@
+/**
+ * The read-only HTTP surface the plugin management card fetches from.
+ *
+ * Mounted through the host's `webServer` service (same registration shape
+ * dshmarket uses: `kind: "exact"` routes on the profile's web server), the
+ * two endpoints are GET-only projections: the workspace allowlist and, for a
+ * known root, the memory snapshot. The allowlist IS the security fence — the
+ * memory endpoint resolves its `root` parameter only against roots the
+ * running process has actually served, so the API cannot read arbitrary
+ * paths. Handlers are synchronous and never throw past the response.
+ */
+import { resolve } from "node:path";
+import { memorySnapshot } from "./memory-snapshot.js";
+/** URL prefix of the card API (kind-exact routes registered under it). */
+export const CARD_API_WORKSPACES_PATH = "/dsh-continual-evolve/api/v1/workspaces";
+export const CARD_API_MEMORY_PATH = "/dsh-continual-evolve/api/v1/memory";
+function sendJson(response, status, body) {
+    response.writeHead(status, { "content-type": "application/json; charset=utf-8" });
+    response.end(JSON.stringify(body));
+}
+function isGet(request) {
+    return (request.method ?? "GET") === "GET";
+}
+/**
+ * Register the two card routes and return a disposer that removes them.
+ * Registration return values are passed through untouched: whatever disposer
+ * shape the host hands back (or none, as on some host versions), the
+ * disposer calls only the functions among them.
+ */
+export function mountCardRoutes(webServer, workspaces) {
+    const disposers = [];
+    disposers.push(webServer.register({
+        kind: "exact",
+        path: CARD_API_WORKSPACES_PATH,
+        handler(request, response) {
+            if (!isGet(request)) {
+                response.writeHead(405, { allow: "GET" });
+                response.end();
+                return;
+            }
+            sendJson(response, 200, { workspaces: workspaces.list() });
+        },
+    }));
+    disposers.push(webServer.register({
+        kind: "exact",
+        path: CARD_API_MEMORY_PATH,
+        handler(request, response) {
+            if (!isGet(request)) {
+                response.writeHead(405, { allow: "GET" });
+                response.end();
+                return;
+            }
+            const root = rootParamOf(request);
+            if (root === null) {
+                sendJson(response, 400, { error: "root query parameter is required and must be an absolute path" });
+                return;
+            }
+            const known = workspaces.list().find((workspace) => workspace.root === resolve(root));
+            if (known === undefined) {
+                // The allowlist answers 404 without distinguishing "never
+                // served" from "wrong path": no filesystem oracle here.
+                sendJson(response, 404, { error: "unknown workspace root" });
+                return;
+            }
+            sendJson(response, 200, memorySnapshot(known.root));
+        },
+    }));
+    return () => {
+        for (const disposer of disposers) {
+            if (typeof disposer === "function") {
+                disposer();
+            }
+        }
+    };
+}
+/** The decoded `root` query parameter, or null when absent/relative. */
+function rootParamOf(request) {
+    try {
+        const url = new URL(request.url ?? "/", "http://dsh-card.invalid");
+        const root = url.searchParams.get("root");
+        if (root === null || root.trim().length === 0) {
+            return null;
+        }
+        return root;
+    }
+    catch (error) {
+        // A malformed URL is a bad request, not a crash: null maps to 400.
+        void error;
+        return null;
+    }
+}
+//# sourceMappingURL=card-routes.js.map

package/lib/index.d.ts

@@ -9,6 +9,13 @@
  * background extraction, and no governance. See
  * .agents/notes/implemented/architecture/2026-10-04-zcode-alignment-teardown.md.
  *
+ * The 2026-10-04 plugin-management card adds a read-only surface: the
+ * workspace roots the section has served feed an in-memory allowlist, and a
+ * `webServer` route pair projects any known workspace's store for the card
+ * in the official plugin manager (`plugins.bundle.config`, client bundle in
+ * client/client.js). The card is a viewer — see
+ * .agents/notes/implemented/feature/2026-10-04-plugin-management-card.md.
+ *
  * The host API surface is declared locally (the minimal shape this plugin
  * touches) instead of importing the DSH type packages — the section call is
  * the same one every prior release used, verified in production.
@@ -52,6 +59,17 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
         order: z<number, number, "plain">;
         maxChars: z<number, number, "plain">;
     }>>, "plain">;
+    /**
+     * The read-only memory card in the official plugin manager
+     * (`plugins.bundle.config`). Defaults to on; hosts without the
+     * `webServer` service or the `plugins.bundle.config` slot degrade to no
+     * card, with the memory section unaffected.
+     */
+    memoryCard: z<Schemastery.ObjectS<NoInfer<{
+        enabled: z<boolean, boolean, "plain">;
+    }>>, Schemastery.ObjectT<NoInfer<{
+        enabled: z<boolean, boolean, "plain">;
+    }>>, "plain">;
 }>>, Schemastery.ObjectT<NoInfer<{
     /**
      * The memory section: injects the workspace memory index at session
@@ -71,6 +89,17 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
         order: z<number, number, "plain">;
         maxChars: z<number, number, "plain">;
     }>>, "plain">;
+    /**
+     * The read-only memory card in the official plugin manager
+     * (`plugins.bundle.config`). Defaults to on; hosts without the
+     * `webServer` service or the `plugins.bundle.config` slot degrade to no
+     * card, with the memory section unaffected.
+     */
+    memoryCard: z<Schemastery.ObjectS<NoInfer<{
+        enabled: z<boolean, boolean, "plain">;
+    }>>, Schemastery.ObjectT<NoInfer<{
+        enabled: z<boolean, boolean, "plain">;
+    }>>, "plain">;
 }>>, "plain">;
 /**
  * Structurally typed resolved config (loader passes the validated object).

package/lib/index.js

@@ -9,12 +9,21 @@
  * background extraction, and no governance. See
  * .agents/notes/implemented/architecture/2026-10-04-zcode-alignment-teardown.md.
  *
+ * The 2026-10-04 plugin-management card adds a read-only surface: the
+ * workspace roots the section has served feed an in-memory allowlist, and a
+ * `webServer` route pair projects any known workspace's store for the card
+ * in the official plugin manager (`plugins.bundle.config`, client bundle in
+ * client/client.js). The card is a viewer — see
+ * .agents/notes/implemented/feature/2026-10-04-plugin-management-card.md.
+ *
  * The host API surface is declared locally (the minimal shape this plugin
  * touches) instead of importing the DSH type packages — the section call is
  * the same one every prior release used, verified in production.
  */
 import z from "@deepseek-ai/schemastery";
-import { createFrozenMemorySection, DEFAULT_MAX_CHARS, DEFAULT_MEMORY_SECTION_ORDER, MEMORY_SECTION_NAME, memorySectionText, } from "./memory-section.js";
+import { mountCardRoutes } from "./card-routes.js";
+import { createKnownWorkspaces } from "./known-workspaces.js";
+import { createFrozenMemorySection, cwdOf, DEFAULT_MAX_CHARS, DEFAULT_MEMORY_SECTION_ORDER, MEMORY_SECTION_NAME, memorySectionText, } from "./memory-section.js";
 export const name = "continual-evolve";
 export const inject = ["systemPrompt"];
 export const Config = z.object({
@@ -31,20 +40,60 @@ export const Config = z.object({
         order: z.natural(),
         maxChars: z.natural(),
     }),
+    /**
+     * The read-only memory card in the official plugin manager
+     * (`plugins.bundle.config`). Defaults to on; hosts without the
+     * `webServer` service or the `plugins.bundle.config` slot degrade to no
+     * card, with the memory section unaffected.
+     */
+    memoryCard: z.object({
+        enabled: z.boolean(),
+    }),
 });
+/**
+ * Mount the card routes on the host web server through a nested inject, so
+ * the plugin stays mountable on hosts without that service. Called only when
+ * the card is enabled.
+ */
+function mountCardWhenAvailable(host, workspaces) {
+    const nested = host;
+    if (typeof nested.inject !== "function") {
+        host.logger("continual-evolve").warn("host context exposes no inject — memory card routes not mounted (memory section unaffected)");
+        return;
+    }
+    nested.inject(["webServer"], (scoped) => {
+        const webServer = scoped.webServer;
+        if (webServer === undefined) {
+            host.logger("continual-evolve").warn("webServer service present but empty — memory card routes not mounted (memory section unaffected)");
+            return;
+        }
+        mountCardRoutes(webServer, workspaces);
+    });
+}
 export function apply(host, config) {
     if (config.memoryIndex?.enabled === false) {
         return;
     }
+    const workspaces = createKnownWorkspaces();
     const frozen = createFrozenMemorySection();
     host.systemPrompt.section({
         name: MEMORY_SECTION_NAME,
         order: config.memoryIndex?.order ?? DEFAULT_MEMORY_SECTION_ORDER,
-        text: (context) => frozen.textFor(context.agent, (agent) => memorySectionText(agent, {
-            maxChars: config.memoryIndex?.maxChars ?? DEFAULT_MAX_CHARS,
-            guide: config.memoryIndex?.guide ?? true,
-        })),
+        text: (context) => {
+            const cwd = cwdOf(context.agent);
+            if (cwd !== undefined) {
+                workspaces.remember(cwd);
+            }
+            return frozen.textFor(context.agent, (agent) => memorySectionText(agent, {
+                maxChars: config.memoryIndex?.maxChars ?? DEFAULT_MAX_CHARS,
+                guide: config.memoryIndex?.guide ?? true,
+            }));
+        },
     });
     host.logger("continual-evolve").info("continual-evolve memory section registered (workspace .evolve/memory, native file read/write)");
+    if (config.memoryCard?.enabled === false) {
+        return;
+    }
+    mountCardWhenAvailable(host, workspaces);
 }
 //# sourceMappingURL=index.js.map

package/lib/known-workspaces.d.ts

@@ -0,0 +1,22 @@
+/** One known workspace: the resolved root and when it was last served. */
+export interface KnownWorkspace {
+    root: string;
+    /** ISO timestamp of the most recent section assembly seen for this root. */
+    lastSeen: string;
+}
+/** The allowlist the card routes read through. */
+export interface KnownWorkspaces {
+    /**
+     * Record (or refresh) a workspace root. A relative or blank cwd is a
+     * silent no-op — the caller is the injection path, where a bad cwd
+     * already renders an empty section and must not turn into a throw.
+     */
+    remember(cwd: string): void;
+    /** Known roots, most recently served first. */
+    list(): KnownWorkspace[];
+}
+/** How many recent workspaces the card tracks. */
+export declare const DEFAULT_KNOWN_WORKSPACE_LIMIT = 8;
+/** Create the in-memory allowlist; `limit` is the LRU bound. */
+export declare function createKnownWorkspaces(limit?: number): KnownWorkspaces;
+//# sourceMappingURL=known-workspaces.d.ts.map

package/lib/known-workspaces.js

@@ -0,0 +1,42 @@
+/**
+ * The workspace roots the card may look at, in memory only.
+ *
+ * Populated as a side effect of section assembly (the plugin already knows
+ * each session's cwd there), this list is the card's read allowlist: the
+ * memory API refuses any root the running process has not served a session
+ * in, so the endpoint cannot be used to probe the filesystem. Bounded LRU,
+ * never persisted — a restart starts empty and one session in a workspace
+ * puts it back. No second store on disk.
+ */
+import { isAbsolute, resolve } from "node:path";
+/** How many recent workspaces the card tracks. */
+export const DEFAULT_KNOWN_WORKSPACE_LIMIT = 8;
+/** Create the in-memory allowlist; `limit` is the LRU bound. */
+export function createKnownWorkspaces(limit = DEFAULT_KNOWN_WORKSPACE_LIMIT) {
+    const max = Math.max(1, limit);
+    // Insertion order encodes recency: the most recently served root is last.
+    const recent = new Map();
+    return {
+        remember(cwd) {
+            const trimmed = cwd.trim();
+            if (trimmed.length === 0 || !isAbsolute(trimmed)) {
+                return;
+            }
+            recent.delete(resolve(trimmed));
+            recent.set(resolve(trimmed), new Date().toISOString());
+            while (recent.size > max) {
+                const oldest = recent.keys().next();
+                if (oldest.done === true) {
+                    break;
+                }
+                recent.delete(oldest.value);
+            }
+        },
+        list() {
+            return [...recent.entries()]
+                .reverse()
+                .map(([root, lastSeen]) => ({ root, lastSeen }));
+        },
+    };
+}
+//# sourceMappingURL=known-workspaces.js.map

package/lib/memory-guide.d.ts

@@ -14,5 +14,5 @@
 /** Heading and framing before the `<memories>` block. Takes the absolute memory dir. */
 export declare function memoryGuideIntro(memoryDir: string): string;
 /** The file format, when_to_save / how_to_use rules, and maintenance discipline. */
-export declare const MEMORY_GUIDE_RULES = "## \u8BB0\u5FC6\u6587\u4EF6\u7684\u683C\u5F0F\n\n---\nname: <\u77ED\u6A2A\u7EBF\u5C0F\u5199\u6807\u8BC6>\ndescription: <\u4E00\u53E5\u8BDD\u76F8\u5173\u6027\u94A9\u5B50\u2014\u2014\u51B3\u5B9A\u672A\u6765\u4F1A\u8BDD\u4F1A\u4E0D\u4F1A\u60F3\u8D77\u8FD9\u6761\u8BB0\u5FC6>\nmetadata:\n  type: user | feedback | project | reference\n---\n\n<\u6B63\u6587>\n\n## \u4F55\u65F6\u5199\u5165\u8BB0\u5FC6\n\n\u7528\u6237\u660E\u786E\u8981\u6C42\u8BB0\u4F4F\u65F6\uFF0C\u7ACB\u5373\u5B58\u4E3A\u6700\u5408\u9002\u7684\u7C7B\u578B\uFF1B\u8981\u6C42\u5FD8\u8BB0\u65F6\uFF0C\u627E\u5230\u5E76\u5220\u9664\u76F8\u5173\u6587\u4EF6\u4E0E\u7D22\u5F15\u884C\u3002\n\u9664\u6B64\u4E4B\u5916\uFF0C\u5728\u5BF9\u8BDD\u4E2D\u81EA\u7136\u9047\u5230\u4EE5\u4E0B\u4FE1\u53F7\u65F6\u4E3B\u52A8\u5199\u5165\u3002\u5B58\u4E4B\u524D\u5148\u8FC7\u4E00\u9053\u7B5B\u5B50\uFF1A\n**\u80FD\u4ECE\u4EE3\u7801\u3001git \u5386\u53F2\u3001\u4ED3\u5E93\u6587\u4EF6\u91CC\u91CD\u65B0\u63A8\u5BFC\u51FA\u6765\u7684\u4E8B\u5B9E\u4E0D\u5B58**\u2014\u2014\u53EA\u5B58\u91CD\u63A8\u5BFC\u4E0D\u51FA\u6765\u7684\n\u80CC\u666F\u3001\u51B3\u7B56\u548C\u504F\u597D\u3002\u76F8\u5BF9\u65E5\u671F\u4E00\u5F8B\u8F6C\u6210\u7EDD\u5BF9\u65E5\u671F\uFF08\"\u5468\u56DB\"\u2192\"2026-10-08\"\uFF09\uFF0C\u5426\u5219\u672A\u6765\n\u7684\u4F1A\u8BDD\u65E0\u6CD5\u89E3\u8BFB\u3002\u4E00\u6761\u4E8B\u5B9E\u4E00\u4E2A\u6587\u4EF6\uFF1B\u4E0D\u786E\u5B9A\u503C\u4E0D\u503C\u5F97\u5B58\u65F6\uFF0C\u95EE\u81EA\u5DF1\"\u8FD9\u6761\u7684\u4FE1\u606F\u91CF\n\u662F\u5426\u5728'\u4E3A\u4EC0\u4E48'\u91CC\uFF0C\u800C\u4E0D\u5728'\u662F\u4EC0\u4E48'\u91CC\"\u3002\n\n<type name=\"user\">\n  <when_to_save>\u5F97\u77E5\u7528\u6237\u7684\u89D2\u8272\u3001\u6280\u672F\u6808\u3001\u7ECF\u9A8C\u6C34\u5E73\u3001\u504F\u597D\u6216\u77E5\u8BC6\u80CC\u666F\u7684\u4EFB\u4F55\u7EC6\u8282\u65F6\u3002\n  \u4F8B\u5982\u7528\u6237\u81EA\u8FF0\"\u6211\u662F\u6570\u636E\u79D1\u5B66\u5BB6\uFF0C\u5728\u67E5\u65E5\u5FD7\u7CFB\u7EDF\"\u2014\u2014\u5B58\uFF1A\u7528\u6237\u662F\u6570\u636E\u79D1\u5B66\u5BB6\uFF0C\n  \u5F53\u524D\u5173\u6CE8\u53EF\u89C2\u6D4B\u6027/\u65E5\u5FD7\u3002</when_to_save>\n  <how_to_use>\u540E\u7EED\u89E3\u91CA\u548C\u5EFA\u8BAE\u6309\u7528\u6237\u7684\u80CC\u666F\u5B9A\u5236\u6DF1\u6D45\u4E0E\u7C7B\u6BD4\uFF1B\u5BF9\u8D44\u6DF1\u5DE5\u7A0B\u5E08\n  \u4E0D\u89E3\u91CA\u57FA\u7840\u6982\u5FF5\uFF0C\u5BF9\u67D0\u9886\u57DF\u7684\u65B0\u624B\u7528\u5176\u719F\u6089\u9886\u57DF\u7684\u7C7B\u6BD4\u5207\u5165\u3002</how_to_use>\n</type>\n\n<type name=\"feedback\">\n  <when_to_save>\u4E24\u6761\u4FE1\u53F7\uFF0C\u7F3A\u4E00\u4E0D\u53EF\uFF1A\n  \uFF081\uFF09\u7EA0\u6B63\u2014\u2014\u7528\u6237\u8BF4\"\u4E0D\u662F\u8FD9\u6837\"\"\u522B\"\"\u505C\u4E0B\"\u65F6\uFF0C\u5B58\u88AB\u7EA0\u6B63\u7684\u505A\u6CD5\u4E0E\u6B63\u786E\u505A\u6CD5\uFF1B\n  \uFF082\uFF09\u786E\u8BA4\u2014\u2014\u8FD9\u662F\u66F4\u5B89\u9759\u3001\u66F4\u5BB9\u6613\u6F0F\u7684\u4FE1\u53F7\uFF1A\u7528\u6237\u63A5\u53D7\u4E86\u4F60\u4E0D\u5BFB\u5E38\u7684\u9009\u62E9\u800C\u6CA1\u6709\u5F02\u8BAE\uFF0C\n  \u6216\u660E\u786E\u8BF4\"\u5BF9\uFF0C\u5C31\u8FD9\u6837\"\"\u4FDD\u6301\u8FD9\u6837\"\u3002\u786E\u8BA4\u8FC7\u7684\u5224\u65AD\u662F\u5DF2\u9A8C\u8BC1\u7684\u65B9\u6CD5\u8BBA\uFF0C\u53EA\u5B58\u7EA0\u9519\n  \u4F1A\u8BA9\u4F60\u7684\u884C\u4E3A\u8D8A\u6765\u8D8A\u4FDD\u5B88\u3001\u504F\u79BB\u7528\u6237\u5DF2\u8BA4\u53EF\u7684\u8DEF\u3002\n  \u4F8B\uFF1A\"\u6D4B\u8BD5\u522B mock \u6570\u636E\u5E93\uFF0C\u4E0A\u6B21 mock \u8FC7\u4E86\u7EBF\u4E0A\u8FC1\u79FB\u6302\u4E86\"\u2014\u2014\u5B58\u89C4\u5219\u5E76\u5E26\u4E0A\u4E8B\u6545\u539F\u56E0\u3002\n  \u4F8B\uFF1A\"\u7ED3\u5C3E\u4E0D\u7528\u603B\u7ED3\uFF0Cdiff \u6211\u81EA\u5DF1\u4F1A\u770B\"\u2014\u2014\u5B58\uFF1A\u8BE5\u7528\u6237\u4E0D\u8981\u5C3E\u968F\u6027\u603B\u7ED3\u3002</when_to_save>\n  <how_to_use>\u8BA9\u7528\u6237\u4E0D\u5FC5\u628A\u540C\u4E00\u6761\u6307\u5BFC\u8BF4\u7B2C\u4E8C\u904D\u3002</how_to_use>\n  <body_structure>\u89C4\u5219\u5148\u884C\uFF0C\u968F\u540E\u5FC5\u5E26\u4E24\u884C\uFF1A**Why:**\uFF08\u7528\u6237\u7ED9\u7684\u7406\u7531\uFF0C\u5E38\u662F\u67D0\u6B21\n  \u4E8B\u6545\u6216\u5F3A\u504F\u597D\u2014\u2014\u77E5\u9053\u4E3A\u4EC0\u4E48\u624D\u80FD\u5224\u65AD\u8FB9\u7F18\u60C5\u51B5\u8BE5\u4E0D\u8BE5\u7834\u4F8B\uFF09\u548C **How to apply:**\n  \uFF08\u4F55\u65F6\u4F55\u5730\u751F\u6548\uFF09\u3002feedback \u7C7B\u578B\u7F3A\u8FD9\u4E24\u884C\u89C6\u4E3A\u4E0D\u5B8C\u6574\u3002</body_structure>\n</type>\n\n<type name=\"project\">\n  <when_to_save>\u5F97\u77E5\u8FDB\u884C\u4E2D\u7684\u5DE5\u4F5C\u3001\u76EE\u6807\u3001\u51B3\u7B56\u3001\u622A\u6B62\u671F\u6216\u4E8B\u6545\u7684\u80CC\u666F\u52A8\u673A\u65F6\u2014\u2014\n  \u51E1\u662F\"\u8C01\u5728\u505A\u4EC0\u4E48\u3001\u4E3A\u4EC0\u4E48\u3001\u5230\u4EC0\u4E48\u65F6\u5019\"\u4E14\u65E0\u6CD5\u4ECE\u4EE3\u7801\u6216 git \u63A8\u5BFC\u7684\u4FE1\u606F\u3002\n  \u8FD9\u7C7B\u8BB0\u5FC6\u8870\u51CF\u5FEB\uFF0C\u72B6\u6001\u53D8\u5316\u65F6\u66F4\u65B0\u5B83\uFF0C\u522B\u5806\u53E0\u65B0\u6587\u4EF6\u3002</when_to_save>\n  <how_to_use>\u7528\u5B83\u8865\u5168\u8BF7\u6C42\u80CC\u540E\u7684\u4E0A\u4E0B\u6587\u4E0E\u52A8\u673A\uFF0C\u8BA9\u5EFA\u8BAE\u8D34\u4F4F\u771F\u5B9E\u7EA6\u675F\u3002\n  \u4F8B\uFF1A\"\u5468\u56DB\u8D77\u51BB\u7ED3\u5408\u5E76\"\u2014\u2014\u5B58\uFF1A2026-03-05 \u8D77\u51BB\u7ED3\u5408\u5E76\uFF0C\u975E\u5173\u952E PR \u63D0\u524D\u6807\u8BB0\u3002</how_to_use>\n  <body_structure>\u4E8B\u5B9E/\u51B3\u7B56\u5148\u884C + **Why:**\uFF08\u52A8\u673A\uFF1A\u7EA6\u675F\u3001deadline\u3001\u5E72\u7CFB\u4EBA\u8981\u6C42\uFF09\n  + **How to apply:**\uFF08\u8FD9\u6761\u5982\u4F55\u5F71\u54CD\u540E\u7EED\u5EFA\u8BAE\uFF09\u3002</body_structure>\n</type>\n\n<type name=\"reference\">\n  <when_to_save>\u7528\u6237\u63D0\u5230\u672A\u6765\u4F1A\u7528\u5230\u7684\u5916\u90E8\u8D44\u6E90\u6307\u9488\uFF1AURL\u3001\u4EEA\u8868\u76D8\u3001\u5DE5\u5355\u3001\n  \u6587\u6863\u4F4D\u7F6E\u3002</when_to_save>\n  <how_to_use>\u9700\u8981\u65F6\u76F4\u63A5\u53D6\u7528\uFF0C\u4E0D\u91CD\u65B0\u68C0\u7D22\u3002</how_to_use>\n</type>\n\n## \u5982\u4F55\u7EF4\u62A4\n\n- \u5199\u5B8C\u8BB0\u5FC6\u6587\u4EF6\u540E\u7ACB\u5373\u5728 MEMORY.md \u8FFD\u52A0\u6216\u66F4\u65B0\u4E00\u884C\u7D22\u5F15\uFF1A`- [\u6807\u9898](\u6587\u4EF6\u540D.md) \u2014 \u94A9\u5B50`\uFF1B\u72B6\u6001\u53D8\u5316\u65F6\u539F\u6587\u4E0E\u7D22\u5F15\u884C\u4E00\u8D77\u6539\uFF0C\u522B\u8BA9\u7D22\u5F15\u8BF4\u8C0E\u3002\n- \u66F4\u65B0\u4F18\u5148\u4E8E\u65B0\u5EFA\uFF1A\u72B6\u6001\u53D8\u4E86\u6539\u539F\u6587\u4EF6\uFF0C\u4E0D\u53E6\u8D77\u4E00\u6761\uFF08\u65B0\u65E7\u5E76\u5B58\u6BD4\u6CA1\u6709\u8BB0\u5FC6\u66F4\u7CDF\uFF09\u3002\n- [[\u540D\u5B57]] \u4E92\u76F8\u5F15\u7528\u76F8\u5173\u8BB0\u5FC6\uFF1B\u5F15\u7528\u8FD8\u4E0D\u5B58\u5728\u7684\u540D\u5B57\u662F\u5408\u6CD5\u7684\uFF0C\u5B83\u6807\u8BB0\"\u503C\u5F97\u5C06\u6765\u8865\u5199\"\u3002";
+export declare const MEMORY_GUIDE_RULES = "## \u8BB0\u5FC6\u6587\u4EF6\u7684\u683C\u5F0F\n\n---\nname: <\u77ED\u6A2A\u7EBF\u5C0F\u5199\u6807\u8BC6>\ndescription: <\u4E00\u53E5\u8BDD\u76F8\u5173\u6027\u94A9\u5B50\u2014\u2014\u51B3\u5B9A\u672A\u6765\u4F1A\u8BDD\u4F1A\u4E0D\u4F1A\u60F3\u8D77\u8FD9\u6761\u8BB0\u5FC6>\nmetadata:\n  type: user | feedback | project | reference\n---\n\n<\u6B63\u6587>\n\n## \u4F55\u65F6\u5199\u5165\u8BB0\u5FC6\n\n\u7528\u6237\u660E\u786E\u8981\u6C42\u8BB0\u4F4F\u65F6\uFF0C\u7ACB\u5373\u5B58\u4E3A\u6700\u5408\u9002\u7684\u7C7B\u578B\uFF1B\u8981\u6C42\u5FD8\u8BB0\u65F6\uFF0C\u627E\u5230\u5E76\u5220\u9664\u76F8\u5173\u6587\u4EF6\u4E0E\u7D22\u5F15\u884C\u3002\n\u9664\u6B64\u4E4B\u5916\uFF0C\u5728\u5BF9\u8BDD\u4E2D\u81EA\u7136\u9047\u5230\u4EE5\u4E0B\u4FE1\u53F7\u65F6\u4E3B\u52A8\u5199\u5165\u3002\u5B58\u4E4B\u524D\u5148\u8FC7\u4E00\u9053\u7B5B\u5B50\uFF1A\n**\u80FD\u4ECE\u4EE3\u7801\u3001git \u5386\u53F2\u3001\u4ED3\u5E93\u6587\u4EF6\u91CC\u91CD\u65B0\u63A8\u5BFC\u51FA\u6765\u7684\u4E8B\u5B9E\u4E0D\u5B58**\u2014\u2014\u53EA\u5B58\u91CD\u63A8\u5BFC\u4E0D\u51FA\u6765\u7684\n\u80CC\u666F\u3001\u51B3\u7B56\u548C\u504F\u597D\u3002\u76F8\u5BF9\u65E5\u671F\u4E00\u5F8B\u8F6C\u6210\u7EDD\u5BF9\u65E5\u671F\uFF08\"\u5468\u56DB\"\u2192\"2026-10-08\"\uFF09\uFF0C\u5426\u5219\u672A\u6765\n\u7684\u4F1A\u8BDD\u65E0\u6CD5\u89E3\u8BFB\u3002\u4E00\u6761\u4E8B\u5B9E\u4E00\u4E2A\u6587\u4EF6\uFF1B\u4E0D\u786E\u5B9A\u503C\u4E0D\u503C\u5F97\u5B58\u65F6\uFF0C\u95EE\u81EA\u5DF1\"\u8FD9\u6761\u7684\u4FE1\u606F\u91CF\n\u662F\u5426\u5728'\u4E3A\u4EC0\u4E48'\u91CC\uFF0C\u800C\u4E0D\u5728'\u662F\u4EC0\u4E48'\u91CC\"\u3002\n\n<type name=\"user\">\n  <when_to_save>\u5F97\u77E5\u7528\u6237\u7684\u89D2\u8272\u3001\u6280\u672F\u6808\u3001\u7ECF\u9A8C\u6C34\u5E73\u3001\u504F\u597D\u6216\u77E5\u8BC6\u80CC\u666F\u7684\u4EFB\u4F55\u7EC6\u8282\u65F6\u3002\n  \u4F8B\u5982\u7528\u6237\u81EA\u8FF0\"\u6211\u662F\u6570\u636E\u79D1\u5B66\u5BB6\uFF0C\u5728\u67E5\u65E5\u5FD7\u7CFB\u7EDF\"\u2014\u2014\u5B58\uFF1A\u7528\u6237\u662F\u6570\u636E\u79D1\u5B66\u5BB6\uFF0C\n  \u5F53\u524D\u5173\u6CE8\u53EF\u89C2\u6D4B\u6027/\u65E5\u5FD7\u3002</when_to_save>\n  <how_to_use>\u540E\u7EED\u89E3\u91CA\u548C\u5EFA\u8BAE\u6309\u7528\u6237\u7684\u80CC\u666F\u5B9A\u5236\u6DF1\u6D45\u4E0E\u7C7B\u6BD4\uFF1B\u5BF9\u8D44\u6DF1\u5DE5\u7A0B\u5E08\n  \u4E0D\u89E3\u91CA\u57FA\u7840\u6982\u5FF5\uFF0C\u5BF9\u67D0\u9886\u57DF\u7684\u65B0\u624B\u7528\u5176\u719F\u6089\u9886\u57DF\u7684\u7C7B\u6BD4\u5207\u5165\u3002</how_to_use>\n</type>\n\n<type name=\"feedback\">\n  <when_to_save>\u4E24\u6761\u4FE1\u53F7\uFF0C\u7F3A\u4E00\u4E0D\u53EF\uFF1A\n  \uFF081\uFF09\u7EA0\u6B63\u2014\u2014\u7528\u6237\u8BF4\"\u4E0D\u662F\u8FD9\u6837\"\"\u522B\"\"\u505C\u4E0B\"\u65F6\uFF0C\u5B58\u88AB\u7EA0\u6B63\u7684\u505A\u6CD5\u4E0E\u6B63\u786E\u505A\u6CD5\uFF1B\n  \uFF082\uFF09\u786E\u8BA4\u2014\u2014\u8FD9\u662F\u66F4\u5B89\u9759\u3001\u66F4\u5BB9\u6613\u6F0F\u7684\u4FE1\u53F7\uFF1A\u7528\u6237\u63A5\u53D7\u4E86\u4F60\u4E0D\u5BFB\u5E38\u7684\u9009\u62E9\u800C\u6CA1\u6709\u5F02\u8BAE\uFF0C\n  \u6216\u660E\u786E\u8BF4\"\u5BF9\uFF0C\u5C31\u8FD9\u6837\"\"\u4FDD\u6301\u8FD9\u6837\"\u3002\u786E\u8BA4\u8FC7\u7684\u5224\u65AD\u662F\u5DF2\u9A8C\u8BC1\u7684\u65B9\u6CD5\u8BBA\uFF0C\u53EA\u5B58\u7EA0\u9519\n  \u4F1A\u8BA9\u4F60\u7684\u884C\u4E3A\u8D8A\u6765\u8D8A\u4FDD\u5B88\u3001\u504F\u79BB\u7528\u6237\u5DF2\u8BA4\u53EF\u7684\u8DEF\u3002\n  \u4F8B\uFF1A\"\u6D4B\u8BD5\u522B mock \u6570\u636E\u5E93\uFF0C\u4E0A\u6B21 mock \u8FC7\u4E86\u7EBF\u4E0A\u8FC1\u79FB\u6302\u4E86\"\u2014\u2014\u5B58\u89C4\u5219\u5E76\u5E26\u4E0A\u4E8B\u6545\u539F\u56E0\u3002\n  \u4F8B\uFF1A\"\u7ED3\u5C3E\u4E0D\u7528\u603B\u7ED3\uFF0Cdiff \u6211\u81EA\u5DF1\u4F1A\u770B\"\u2014\u2014\u5B58\uFF1A\u8BE5\u7528\u6237\u4E0D\u8981\u5C3E\u968F\u6027\u603B\u7ED3\u3002</when_to_save>\n  <how_to_use>\u8BA9\u7528\u6237\u4E0D\u5FC5\u628A\u540C\u4E00\u6761\u6307\u5BFC\u8BF4\u7B2C\u4E8C\u904D\u3002</how_to_use>\n  <body_structure>\u89C4\u5219\u5148\u884C\uFF0C\u968F\u540E\u5FC5\u5E26\u4E24\u884C\uFF1A**Why:**\uFF08\u7528\u6237\u7ED9\u7684\u7406\u7531\uFF0C\u5E38\u662F\u67D0\u6B21\n  \u4E8B\u6545\u6216\u5F3A\u504F\u597D\u2014\u2014\u77E5\u9053\u4E3A\u4EC0\u4E48\u624D\u80FD\u5224\u65AD\u8FB9\u7F18\u60C5\u51B5\u8BE5\u4E0D\u8BE5\u7834\u4F8B\uFF09\u548C **How to apply:**\n  \uFF08\u4F55\u65F6\u4F55\u5730\u751F\u6548\uFF09\u3002feedback \u7C7B\u578B\u7F3A\u8FD9\u4E24\u884C\u89C6\u4E3A\u4E0D\u5B8C\u6574\u3002</body_structure>\n</type>\n\n<type name=\"project\">\n  <when_to_save>\u5F97\u77E5\u8FDB\u884C\u4E2D\u7684\u5DE5\u4F5C\u3001\u76EE\u6807\u3001\u51B3\u7B56\u3001\u622A\u6B62\u671F\u6216\u4E8B\u6545\u7684\u80CC\u666F\u52A8\u673A\u65F6\u2014\u2014\n  \u51E1\u662F\"\u8C01\u5728\u505A\u4EC0\u4E48\u3001\u4E3A\u4EC0\u4E48\u3001\u5230\u4EC0\u4E48\u65F6\u5019\"\u4E14\u65E0\u6CD5\u4ECE\u4EE3\u7801\u6216 git \u63A8\u5BFC\u7684\u4FE1\u606F\u3002\n  \u8FD9\u7C7B\u8BB0\u5FC6\u8870\u51CF\u5FEB\uFF0C\u72B6\u6001\u53D8\u5316\u65F6\u66F4\u65B0\u5B83\uFF0C\u522B\u5806\u53E0\u65B0\u6587\u4EF6\u3002</when_to_save>\n  <how_to_use>\u7528\u5B83\u8865\u5168\u8BF7\u6C42\u80CC\u540E\u7684\u4E0A\u4E0B\u6587\u4E0E\u52A8\u673A\uFF0C\u8BA9\u5EFA\u8BAE\u8D34\u4F4F\u771F\u5B9E\u7EA6\u675F\u3002\n  \u4F8B\uFF1A\"\u5468\u56DB\u8D77\u51BB\u7ED3\u5408\u5E76\"\u2014\u2014\u5B58\uFF1A2026-03-05 \u8D77\u51BB\u7ED3\u5408\u5E76\uFF0C\u975E\u5173\u952E PR \u63D0\u524D\u6807\u8BB0\u3002</how_to_use>\n  <body_structure>\u4E8B\u5B9E/\u51B3\u7B56\u5148\u884C + **Why:**\uFF08\u52A8\u673A\uFF1A\u7EA6\u675F\u3001deadline\u3001\u5E72\u7CFB\u4EBA\u8981\u6C42\uFF09\n  + **How to apply:**\uFF08\u8FD9\u6761\u5982\u4F55\u5F71\u54CD\u540E\u7EED\u5EFA\u8BAE\uFF09\u3002</body_structure>\n</type>\n\n<type name=\"reference\">\n  <when_to_save>\u7528\u6237\u63D0\u5230\u672A\u6765\u4F1A\u7528\u5230\u7684\u5916\u90E8\u8D44\u6E90\u6307\u9488\uFF1AURL\u3001\u4EEA\u8868\u76D8\u3001\u5DE5\u5355\u3001\n  \u6587\u6863\u4F4D\u7F6E\u3002</when_to_save>\n  <how_to_use>\u9700\u8981\u65F6\u76F4\u63A5\u53D6\u7528\uFF0C\u4E0D\u91CD\u65B0\u68C0\u7D22\u3002</how_to_use>\n</type>\n\n## \u5982\u4F55\u7EF4\u62A4\n\n- \u5199\u5B8C\u8BB0\u5FC6\u6587\u4EF6\u540E\u7ACB\u5373\u5728 MEMORY.md \u8FFD\u52A0\u6216\u66F4\u65B0\u4E00\u884C\u7D22\u5F15\uFF1A`- [\u6807\u9898](\u6587\u4EF6\u540D.md) \u2014 \u94A9\u5B50`\uFF1B\u72B6\u6001\u53D8\u5316\u65F6\u539F\u6587\u4E0E\u7D22\u5F15\u884C\u4E00\u8D77\u6539\uFF0C\u522B\u8BA9\u7D22\u5F15\u8BF4\u8C0E\u3002\n- \u66F4\u65B0\u4F18\u5148\u4E8E\u65B0\u5EFA\uFF1A\u72B6\u6001\u53D8\u4E86\u6539\u539F\u6587\u4EF6\uFF0C\u4E0D\u53E6\u8D77\u4E00\u6761\uFF08\u65B0\u65E7\u5E76\u5B58\u6BD4\u6CA1\u6709\u8BB0\u5FC6\u66F4\u7CDF\uFF09\u3002\n- \u5F15\u7528\u8BB0\u5FC6\u524D\u82E5\u53D1\u73B0\u4E0E\u73B0\u5B9E\u4E0D\u7B26\uFF0C\u5F53\u573A\u4FEE\u6B63\u6216\u5220\u9664\u8BE5\u6587\u4EF6\u4E0E\u7D22\u5F15\u884C\u2014\u2014\u574F\u8BB0\u5FC6\u7684\u5371\u5BB3\u968F\u5F15\u7528\u6269\u6563\uFF0C\n  \u9000\u5F79\u4E0D\u7559\u7ED9\u7528\u6237\u3002\n- [[\u540D\u5B57]] \u4E92\u76F8\u5F15\u7528\u76F8\u5173\u8BB0\u5FC6\uFF1B\u5F15\u7528\u8FD8\u4E0D\u5B58\u5728\u7684\u540D\u5B57\u662F\u5408\u6CD5\u7684\uFF0C\u5B83\u6807\u8BB0\"\u503C\u5F97\u5C06\u6765\u8865\u5199\"\u3002";
 //# sourceMappingURL=memory-guide.d.ts.map

package/lib/memory-guide.js

@@ -80,5 +80,7 @@ metadata:
 
 - 写完记忆文件后立即在 MEMORY.md 追加或更新一行索引：\`- [标题](文件名.md) — 钩子\`；状态变化时原文与索引行一起改，别让索引说谎。
 - 更新优先于新建：状态变了改原文件，不另起一条（新旧并存比没有记忆更糟）。
+- 引用记忆前若发现与现实不符，当场修正或删除该文件与索引行——坏记忆的危害随引用扩散，
+  退役不留给用户。
 - [[名字]] 互相引用相关记忆；引用还不存在的名字是合法的，它标记"值得将来补写"。`;
 //# sourceMappingURL=memory-guide.js.map

package/lib/memory-snapshot.d.ts

@@ -0,0 +1,54 @@
+/** The index file name (same store contract as the injection path). */
+export declare const MEMORY_SNAPSHOT_INDEX_FILE = "MEMORY.md";
+/** One memory file with its frontmatter fields ("" when absent). */
+export interface MemoryFileInfo {
+    file: string;
+    name: string;
+    description: string;
+    type: string;
+}
+/** One parsed index row: `- [title](file.md) — hook`. */
+export interface MemoryIndexRow {
+    title: string;
+    file: string;
+}
+/** The full read-only snapshot the card renders for one workspace root. */
+export interface MemorySnapshot {
+    root: string;
+    memoryDir: string;
+    exists: boolean;
+    fileCount: number;
+    indexEntryCount: number;
+    files: MemoryFileInfo[];
+    /** Index rows whose referenced file no longer exists on disk. */
+    missingFiles: string[];
+    /** .md files on disk that no index row references. */
+    unindexedFiles: string[];
+    /** Set when the store exists but could not be read; null otherwise. */
+    readError: string | null;
+}
+/** Minimal frontmatter fields the card shows. */
+export interface MemoryFrontmatter {
+    name: string;
+    description: string;
+    type: string;
+}
+/**
+ * Parse `- [title](file.md) …` rows out of an index text. Anything else
+ * (headings, the bootstrap hint comment, blank lines) is ignored.
+ */
+export declare function parseMemoryIndexRows(indexText: string): MemoryIndexRow[];
+/**
+ * Read the card-relevant frontmatter fields (`name`, `description`, `type`)
+ * from a leading `---` block. A missing or malformed block yields "" fields —
+ * the body text remains the source of truth the user opens in the editor.
+ */
+export declare function parseMemoryFrontmatter(text: string): MemoryFrontmatter;
+/**
+ * The read-only memory snapshot for one workspace root. A missing store
+ * reports `exists: false` (the card shows the empty state); a store that
+ * exists but fails to read reports `readError` instead of throwing — the
+ * card must observe, never break.
+ */
+export declare function memorySnapshot(root: string): MemorySnapshot;
+//# sourceMappingURL=memory-snapshot.d.ts.map

package/lib/memory-snapshot.js

@@ -0,0 +1,125 @@
+/**
+ * Read-only projection of one workspace memory store for the plugin
+ * management card. Everything here is computed from disk at call time — the
+ * card is a viewer, never a second store: no caching, no writes, no bootstrap
+ * (unlike the injection path, a missing store is reported, not created).
+ */
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { memoryDirFor } from "./memory-section.js";
+/** The index file name (same store contract as the injection path). */
+export const MEMORY_SNAPSHOT_INDEX_FILE = "MEMORY.md";
+/**
+ * Parse `- [title](file.md) …` rows out of an index text. Anything else
+ * (headings, the bootstrap hint comment, blank lines) is ignored.
+ */
+export function parseMemoryIndexRows(indexText) {
+    const rows = [];
+    for (const line of indexText.split("\n")) {
+        const match = /^-\s+\[(.+?)\]\(([^()\s]+\.md)\)/.exec(line.trim());
+        if (match?.[1] !== undefined && match?.[2] !== undefined) {
+            rows.push({ title: match[1], file: match[2] });
+        }
+    }
+    return rows;
+}
+/**
+ * Read the card-relevant frontmatter fields (`name`, `description`, `type`)
+ * from a leading `---` block. A missing or malformed block yields "" fields —
+ * the body text remains the source of truth the user opens in the editor.
+ */
+export function parseMemoryFrontmatter(text) {
+    const fields = { name: "", description: "", type: "" };
+    if (!text.startsWith("---")) {
+        return fields;
+    }
+    const blockEnd = text.indexOf("\n---", 3);
+    if (blockEnd < 0) {
+        return fields;
+    }
+    for (const line of text.slice(3, blockEnd).split("\n")) {
+        const match = /^(name|description|type):\s*(.*)$/.exec(line.trim());
+        if (match?.[1] === undefined || match?.[2] === undefined) {
+            continue;
+        }
+        const value = match[2].trim().replace(/^["']|["']$/g, "");
+        if (match[1] === "name") {
+            fields.name = value;
+        }
+        else if (match[1] === "description") {
+            fields.description = value;
+        }
+        else {
+            fields.type = value;
+        }
+    }
+    return fields;
+}
+/** Store files the card inspects: every .md except the index, sorted. */
+function listStoreFiles(memoryDir) {
+    return readdirSync(memoryDir)
+        .filter((file) => file.endsWith(".md") && file !== MEMORY_SNAPSHOT_INDEX_FILE)
+        .sort();
+}
+/** Single read pass over the store; throws on any filesystem failure. */
+function readStoreState(memoryDir) {
+    const indexText = readFileSync(join(memoryDir, MEMORY_SNAPSHOT_INDEX_FILE), "utf8");
+    const diskFiles = listStoreFiles(memoryDir);
+    const files = diskFiles.map((file) => {
+        const frontmatter = parseMemoryFrontmatter(readFileSync(join(memoryDir, file), "utf8"));
+        return { file, name: frontmatter.name, description: frontmatter.description, type: frontmatter.type };
+    });
+    return { indexRows: parseMemoryIndexRows(indexText), diskFiles, files };
+}
+/**
+ * The read-only memory snapshot for one workspace root. A missing store
+ * reports `exists: false` (the card shows the empty state); a store that
+ * exists but fails to read reports `readError` instead of throwing — the
+ * card must observe, never break.
+ */
+export function memorySnapshot(root) {
+    const workspaceRoot = resolve(root);
+    const memoryDir = memoryDirFor(workspaceRoot);
+    const absent = {
+        root: workspaceRoot,
+        memoryDir,
+        exists: false,
+        fileCount: 0,
+        indexEntryCount: 0,
+        files: [],
+        missingFiles: [],
+        unindexedFiles: [],
+        readError: null,
+    };
+    if (!existsSync(memoryDir)) {
+        return absent;
+    }
+    let state;
+    try {
+        state = readStoreState(memoryDir);
+    }
+    catch (error) {
+        // Filesystem read failure degrades to an error field: the card shows
+        // what went wrong instead of taking the host down with it.
+        return {
+            ...absent,
+            exists: true,
+            readError: error instanceof Error ? error.message : String(error),
+        };
+    }
+    const referenced = new Set(state.indexRows.map((row) => row.file));
+    return {
+        root: workspaceRoot,
+        memoryDir,
+        exists: true,
+        fileCount: state.diskFiles.length,
+        indexEntryCount: state.indexRows.length,
+        files: state.files,
+        missingFiles: state.indexRows
+            .map((row) => row.file)
+            .filter((file) => !state.diskFiles.includes(file)),
+        unindexedFiles: state.diskFiles.filter((file) => !referenced.has(file)),
+        readError: null,
+    };
+}
+//# sourceMappingURL=memory-snapshot.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-continual-evolve",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "ZCode-style workspace memory for DeepSeek Harness: a per-workspace markdown store (<workspace>/.evolve/memory/) with session-start index injection — the model reads and writes the files with its native tools.",
   "license": "MIT",
   "repository": {
@@ -19,11 +19,13 @@
       "types": "./lib/index.d.ts",
       "default": "./lib/index.js"
     },
+    "./client": "./client/client.js",
     "./package.json": "./package.json"
   },
   "files": [
     "lib/**/*.js",
     "lib/**/*.d.ts",
+    "client/client.js",
     "cordis.patch.yml",
     "README.md",
     "LICENSE"
@@ -31,6 +33,10 @@
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [],
+      "platform": "web"
     }
   },
   "engines": {