npm - dsh-engramory - Versions diffs - 0.2.3 → 0.2.6 - Mend

dsh-engramory 0.2.3 → 0.2.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/LICENSE CHANGED Viewed

@@ -1,21 +1,21 @@
-MIT License
-Copyright (c) 2026 Beijing Tinqiao Technology Co., Ltd.
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+Copyright (c) 2026 Beijing Tinqiao Technology Co., Ltd.
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md CHANGED Viewed

@@ -1,124 +1,150 @@
-[English](README.md) | [简体中文](README.zh-CN.md)
-# dsh-engramory
-[![dsh-xray](https://img.shields.io/endpoint?url=https%3A%2F%2Funstone.github.io%2Fdsh-xray%2Fbadge%2Ftinqiao-oss__engramory.json)](https://unstone.github.io/dsh-xray/registry.html#tinqiao-oss__engramory)
-<sub>`C2` is the level `manifest.bundle.patch` puts every mountable dsh plugin at (74.6% of the scanned ecosystem); it is the only flag on this card — no `exec`, `eval`, install script, outbound domain, or environment read.</sub>
-Curated, file-based long-term memory for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) —
-plain markdown notes you can open with anything, one store shared across every host you
-use, and an index cap that is a **real refusal** rather than a request. (If the store
-lives inside a project's git repo it must be git-ignored — memories carry machine-local
-detail; see SKILL.md §1. A *dedicated private* repo for the store itself is fine.)
-Part of [Engramory](https://github.com/tinqiao-oss/engramory).
-## Why a plugin, when an `AGENTS.md` block already works
-The block does carry the discipline, and for recall that is enough. Two things it cannot
-do:
-**The cap becomes deterministic.** Engramory keeps its index under 200 lines / 25 KB
-because the index loads every session and everything past the cap silently stops being
-recalled. On most hosts that limit is rules plus a checker the agent has to remember to
-run. dsh exposes `ctx.tools.guard()` — a synchronous, **monotonic** refusal: once a guard
-returns a reason, no later listener can turn it back into an allow. So here the limit is
-enforced, not requested. Use **0.2.1 or later**: 0.2.0 shipped before profile installs
-worked upstream and carried an `inject` declaration this Cordis does not accept — it
-installed but never activated (issue #8). Outside Claude Code, dsh is the first host with
-the shim actually written (a few others expose equivalent pre-write seams — see
-PORTING.md — but have no shim yet).
-**The protocol arrives with the plugin.** The skill is registered at runtime through
-dsh's skill registry — via a reactive `ctx.inject(['skills'], …)` child, so a profile
-without a registry still gets the cap and one whose registry activates late still gets
-the skill — which means it does not depend on landing files in one of the five skill
-roots dsh scans, a path that is easy to get subtly wrong and fails silently when you do.
-## Install
-```sh
-dsh plugin --profile <name> add dsh-engramory
-```
-That is the whole install. The package ships a `dsh.bundle` manifest pointing at its own
-`cordis.patch.yml`, so the row is inserted into the profile's plugin tree for you — no
-hand-editing. To change a default, patch the EXISTING row by id in your profile's own
-patch layer — do **not** use a second `- insert:` (insert always appends, so you would
-end up with two engramory rows and the original caps still enforced):
-```yaml
-- id: engramory
-  config:
-    indexName: MEMORY.md
-    maxLines: 200
-    maxBytes: 25600
-```
-A patch replaces the targeted row's whole `config`, so list every key you mean to keep.
-For the store itself and the always-on block, use the installer in the Engramory repo
-(`python tools/engramory_init.py dsh --install-skill`). This plugin enforces the cap and
-supplies the protocol; it does not create the store.
-## Configuration
-| Field | Default | Meaning |
-|---|---|---|
-| `indexName` | `MEMORY.md` | Basename treated as the memory index (case-insensitive; both `file_path` and `str_replace_editor`'s `path` are checked). An empty or non-string value falls back to the default. Nothing else is inspected. |
-| `maxLines` | `200` | Hard line cap. Non-positive or non-finite values fall back to the default. |
-| `maxBytes` | `25600` | Hard UTF-8 byte cap (25 KB). |
-| `indexPath` | unset | Absolute path of the ONE index to guard. Without it the guard matches on basename alone, so an unrelated `MEMORY.md` in another project is gated too; set this and only that exact file is. Compared by identity (symlinks and `..` resolved; case-folded on Windows only), and a path that does not exist yet still has its first write guarded. |
-| `registerSkill` | `true` | Set `false` to keep the cap but skip the runtime skill. |
-| `skill` | built-in | Replace the skill body with your own markdown. |
-## What the guard actually does
-| Call | Decision |
-|---|---|
-| `write` (or `str_replace_editor` `create`) ending within caps | allow |
-| `write`/`create` that GROWS the index past a cap | **deny**, naming the numbers and what to compact |
-| `write`/`create` that SHRINKS or keeps an over-cap index | allow — incremental compaction (210 → 205 → 198) must stay possible |
-| Edit carrying `old_str`/`new_str`: result simulated | judged by the RESULT, same grow/shrink rule as a write |
-| Unsimulable partial (e.g. `insert`) on an over-cap index | **deny**, telling the agent a shrinking whole-file write passes |
-| Unsimulable partial on a healthy index | allow |
-| `read`, `view`, or any unknown tool | allow — recall must never be blocked, even over cap |
-| Any write to any other file | allow — not the guard's business |
-| Missing/unreadable current index on a whole-file write | treated as EMPTY (mirrors the Python guard) — a within-caps write passes, an over-cap first write is refused |
-| Missing/unreadable index on a partial edit | allow — a guard must never block work over a path it cannot read |
-| Malformed execution (no arguments, non-string path/content) | allow — not recognisably a write |
-The deny rule mirrors `hooks/engramory_index_guard.py` exactly: refuse only a result
-that is over a cap AND grew past the current file. The line count ignores a trailing
-newline, so an index sitting exactly at the cap stays writable.
-## Known limits
-- **An unsimulable partial that crosses the cap from under it is not caught.** `insert`
-  and friends do not carry the resulting text. The breach is caught by the next
-  whole-file write, or by `engramory_check.py`. What is guaranteed: an already-over
-  index cannot be grown further, and a shrinking write always passes.
-- **The tool roster follows dsh's documented tool-fs contract** (`write`/`edit` with
-  `file_path`, `str_replace_editor` with `path`) and is deliberately conservative:
-  unknown tools pass.
-- **0.2.0 never activated; 0.2.1 is the first version that runs.** While the rc.6
-  preview bug blocked all third-party profile installs upstream, the only coverage a
-  plugin could have was mocks — and 0.2.0's mock hid two activation bugs: an
-  older-Cordis `{ required, optional }` inject shape (read as waiting for services
-  literally named `required`/`optional`, pending forever) and a bare `ctx.skills` read
-  of an undeclared service (throws under Cordis' reflective context). The first field
-  install caught both the moment installs became possible (issue #8). 0.2.1 fixes them,
-  verified end to end on a live dsh 0.1.0-rc.7 web profile (0.2.0 reproduces the boot
-  failure byte for byte; 0.2.1 boots and serves) and against the vendored
-  `@deepseek-ai/cordis` resolver (activation with, without, and with a late-mounted
-  skill registry). The test mock now mirrors the reflective-context access rules, and
-  the guard's decision table stays covered by `node --test` (28 cases, run in
-  Engramory's CI).
-- dsh is a developer preview and its plugin API can change. This plugin deliberately
-  touches only `ctx.tools.guard()` and a reactive `ctx.inject(['skills'], …)` child
-  that registers the skill, so it stays cheap to fix.
-## License
-MIT — see the [Engramory repository](https://github.com/tinqiao-oss/engramory).
+[English](README.md) | [简体中文](README.zh-CN.md)
+# dsh-engramory
+[![dsh-xray](https://img.shields.io/endpoint?url=https%3A%2F%2Funstone.github.io%2Fdsh-xray%2Fbadge%2Ftinqiao-oss__engramory.json)](https://unstone.github.io/dsh-xray/registry.html#tinqiao-oss__engramory)
+<sub>`C2` is the level `manifest.bundle.patch` puts every mountable dsh plugin at (74.6% of the scanned ecosystem); it is the only flag on this card — no `exec`, `eval`, install script, outbound domain, or environment read.</sub>
+Curated, file-based long-term memory for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) —
+plain markdown notes you can open with anything, one store shared across every host you
+use, and an index cap that is a **real refusal** rather than a request. (If the store
+lives inside a project's git repo it must be git-ignored — memories carry machine-local
+detail; see SKILL.md §1. A *dedicated private* repo for the store itself is fine.)
+Part of [Engramory](https://github.com/tinqiao-oss/engramory).
+## Why a plugin, when an `AGENTS.md` block already works
+The block does carry the discipline, and for recall that is enough. Two things it cannot
+do:
+**The cap becomes deterministic.** Engramory keeps its index under 200 lines / 25 KB
+because the index loads every session and everything past the cap silently stops being
+recalled. On most hosts that limit is rules plus a checker the agent has to remember to
+run. dsh exposes `ctx.tools.guard()` — a synchronous, **monotonic** refusal: once a guard
+returns a reason, no later listener can turn it back into an allow. So here the limit is
+enforced, not requested. Use **0.2.6 or later**: 0.2.0 shipped before profile installs
+worked upstream and carried an `inject` declaration this Cordis does not accept — it
+installed but never activated (issue #8) — and up to 0.2.5 an edit could slip past the
+cap on a CRLF index, or on dsh 0.2 through a relative path after a cd (see Known limits). Outside Claude Code, dsh is the first host with
+the shim actually written (a few others expose equivalent pre-write seams — see
+PORTING.md — but have no shim yet).
+**The protocol arrives with the plugin.** The skill is registered at runtime through
+dsh's skill registry — via a reactive `ctx.inject(['skills'], …)` child, so a profile
+without a registry still gets the cap and one whose registry activates late still gets
+the skill — which means it does not depend on landing files in one of the five skill
+roots dsh scans, a path that is easy to get subtly wrong and fails silently when you do.
+## Install
+```sh
+dsh plugin --profile <name> add dsh-engramory
+```
+That is the whole install. The package ships a `dsh.bundle` manifest pointing at its own
+`cordis.patch.yml`, so the row is inserted into the profile's plugin tree for you — no
+hand-editing. To change a default, patch the EXISTING row by id in your profile's own
+patch layer — do **not** use a second `- insert:` (insert always appends, so you would
+end up with two engramory rows and the original caps still enforced):
+```yaml
+- id: engramory
+  config:
+    indexName: MEMORY.md
+    maxLines: 200
+    maxBytes: 25600
+```
+A patch replaces the targeted row's whole `config`, so list every key you mean to keep.
+For the store itself and the always-on block, use the installer in the Engramory repo
+(`python tools/engramory_init.py dsh --install-skill`). This plugin enforces the cap and
+supplies the protocol; it does not create the store.
+## Configuration
+| Field | Default | Meaning |
+|---|---|---|
+| `indexName` | `MEMORY.md` | Basename treated as the memory index (case-insensitive; both `file_path` and `str_replace_editor`'s `path` are checked). An empty or non-string value falls back to the default. Nothing else is inspected. |
+| `maxLines` | `200` | Hard line cap. Non-positive or non-finite values fall back to the default. |
+| `maxBytes` | `25600` | Hard UTF-8 byte cap (25 KB). |
+| `indexPath` | unset | Absolute path of the ONE index to guard. Without it the guard matches on basename alone, so an unrelated `MEMORY.md` in another project is gated too; set this and only that exact file is. Compared by identity (symlinks and `..` resolved; case-folded on Windows only), and a path that does not exist yet still has its first write guarded. |
+| `registerSkill` | `true` | Set `false` to keep the cap but skip the runtime skill. |
+| `skill` | built-in | Replace the skill body with your own markdown. |
+## What the guard actually does
+| Call | Decision |
+|---|---|
+| `write` (or `str_replace_editor` `create`) ending within caps | allow |
+| `write`/`create` that GROWS the index past a cap | **deny**, naming the numbers and what to compact |
+| `write`/`create` that SHRINKS or keeps an over-cap index | allow — incremental compaction (210 → 205 → 198) must stay possible |
+| Edit carrying `old_str`/`new_str`: result simulated | judged by the RESULT, same grow/shrink rule as a write |
+| Unsimulable partial (e.g. `insert`) on an over-cap index | **deny**, telling the agent a shrinking whole-file write passes |
+| Unsimulable partial on a healthy index | allow |
+| `read`, `view`, or any unknown tool | allow — recall must never be blocked, even over cap |
+| Any write to any other file | allow — not the guard's business |
+| Missing/unreadable current index on a whole-file write | treated as EMPTY (mirrors the Python guard) — a within-caps write passes, an over-cap first write is refused |
+| Missing/unreadable index on a partial edit | allow — a guard must never block work over a path it cannot read |
+| Malformed execution (no arguments, non-string path/content) | allow — not recognisably a write |
+The deny rule mirrors `hooks/engramory_index_guard.py` exactly: refuse only a result
+that is over a cap AND grew past the current file. The line count ignores a trailing
+newline, so an index sitting exactly at the cap stays writable.
+## Known limits
+- **An unsimulable partial that crosses the cap from under it is not caught.** `insert`
+  and friends do not carry the resulting text. The breach is caught by the next
+  whole-file write, or by `engramory_check.py`. What is guaranteed: an already-over
+  index cannot be grown further, and a shrinking write always passes.
+- **The tool roster follows dsh's documented tool-fs contract** (`write`/`edit` with
+  `file_path`, `str_replace_editor` with `path`) and is deliberately conservative:
+  unknown tools pass.
+- **0.2.0 never activated; 0.2.1 is the first version that runs.** While the rc.6
+  preview bug blocked all third-party profile installs upstream, the only coverage a
+  plugin could have was mocks — and 0.2.0's mock hid two activation bugs: an
+  older-Cordis `{ required, optional }` inject shape (read as waiting for services
+  literally named `required`/`optional`, pending forever) and a bare `ctx.skills` read
+  of an undeclared service (throws under Cordis' reflective context). The first field
+  install caught both the moment installs became possible (issue #8). 0.2.1 fixes them,
+  verified end to end on a live dsh 0.1.0-rc.7 web profile (0.2.0 reproduces the boot
+  failure byte for byte; 0.2.1 boots and serves) and against the vendored
+  `@deepseek-ai/cordis` resolver (activation with, without, and with a late-mounted
+  skill registry). The test mock now mirrors the reflective-context access rules, and
+  the guard's decision table stays covered by `node --test` (37 cases, run in
+  Engramory's CI).
+- **A relative path is measured where dsh writes it.** dsh 0.2 gives every session its
+  own working directory (moved by its `working_directory` tool) and resolves a
+  relative `file_path` against that. Up to 0.2.5 the guard resolved against the
+  process's cwd instead, so after a cd an edit of a bare `MEMORY.md` read no current
+  file and went through unmeasured — on dsh 0.2.1-rc.2 it grew the index to 253
+  lines. 0.2.6 reads the session's directory from dsh's `workingDirectory` service
+  when the profile has one, and falls back to the process's cwd when it does not
+  (every 0.1.x release).
+- **A CRLF index is edited the way dsh edits it.** dsh matches an edit on
+  LF-normalised text and writes the result back in the file's own line endings. Up
+  to 0.2.5 the guard matched the raw bytes, so on a CRLF `MEMORY.md` — the usual
+  shape on Windows — an LF `old_string` looked absent, the edit was predicted to
+  change nothing, and dsh applied it. 0.2.6 normalises the same way and sizes a CRLF
+  index in CRLF bytes.
+- **Checked against the dsh you are likely running, not only the one it was written
+  on.** `tests/dsh_e2e/run.py` in the Engramory repo installs a dsh release into a
+  throwaway prefix, adds this plugin with `dsh plugin add`, and drives one headless
+  task against a scripted stand-in for the DeepSeek API: a 260-line write and an edit
+  past the cap must come back refused by this guard with nothing reaching the disk, a
+  small write must land byte for byte, the skill must be advertised, every tool dsh
+  offers must already be classified (a new one could write past the cap), and removal
+  must leave a profile that still boots. The releases it passed on are listed in
+  `package.json` under `dsh.compatibility.dshReleases`; a unit test rejects a
+  `compatible` there without a recorded run of the same plugin version and code.
+- dsh is a developer preview and its plugin API can change. This plugin deliberately
+  touches only `ctx.tools.guard()` and two reactive `ctx.inject()` children — one
+  registers the skill, one reads each session's working directory — so it stays cheap
+  to fix.
+## License
+MIT — see the [Engramory repository](https://github.com/tinqiao-oss/engramory).

package/README.zh-CN.md CHANGED Viewed

@@ -1,111 +1,129 @@
-[English](README.md) | **简体中文**
-# dsh-engramory
-[![dsh-xray](https://img.shields.io/endpoint?url=https%3A%2F%2Funstone.github.io%2Fdsh-xray%2Fbadge%2Ftinqiao-oss__engramory.json)](https://unstone.github.io/dsh-xray/registry.html#tinqiao-oss__engramory)
-<sub>`C2` 是 `manifest.bundle.patch` 给每个可挂载 dsh 插件定的档位(被扫描生态里 74.6% 都在这一档);它是这张卡片上**唯一**的标记 —— 没有 `exec`、没有 `eval`、没有安装脚本、没有外连域名、不读环境变量。</sub>
-给 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 用的**策展式、文件式**长期记忆 ——
-纯 markdown 笔记,随便什么工具都能打开;一个记忆库被你用的所有宿主共用;索引上限是一次
-**真正的拒绝**,而不是一句请求。(记忆库若位于某个项目的 git 仓库内,必须 git-ignore ——
-记忆里带着本机独有的细节,见 SKILL.md §1。给记忆库单独开一个*私有仓*则完全可以。)
-隶属于 [Engramory](https://github.com/tinqiao-oss/engramory)。
-## 已经有 `AGENTS.md` 常驻块了,为什么还要插件
-那个常驻块确实承载了纪律,单论召回也够用了。但有两件事它做不到:
-**上限从此是确定性的。** Engramory 把索引控制在 200 行 / 25 KB 以内,是因为索引每次会话
-都要加载,超出的部分会**悄无声息地不再被召回**。在多数宿主上,这个限制只是"规则 + 一个
-要靠 agent 自己记得去跑的校验器"。而 dsh 暴露了 `ctx.tools.guard()` —— 一个同步的、
-**单调**的否决:守卫一旦返回理由,后面任何监听器都无法把它翻回放行。所以在这里,上限是被
-**强制执行**的,不是被请求的。请用 **0.2.1 或更高版本**:0.2.0 发布时上游的 profile 安装还
-没打通,而且它的 `inject` 声明是这版 Cordis 不接受的写法 —— 装得上,但**永远激活不了**
-(issue #8)。在 Claude Code 之外,dsh 是第一个真正把这层垫片写出来的宿主(另有几个宿主
-同样暴露了等价的写前接缝,见 PORTING.md,但还没有垫片实现)。
-**协议随插件一起到达。** skill 是在运行时通过 dsh 的 skill 注册表注册的 —— 走一个响应式的
-`ctx.inject(['skills'], …)` 子上下文,所以没有注册表的 profile 照样拿到上限,而注册表晚一步
-挂载的 profile 也照样拿得到 skill。这意味着它**不依赖**把文件放进 dsh 扫描的那五个 skill 根
-目录之一 —— 那条路很容易在细微处放错,而一旦放错就是**静默失败**。
-## 安装
-```sh
-dsh plugin --profile <名字> add dsh-engramory
-```
-装到这里就完了。这个包自带 `dsh.bundle` manifest 指向它自己的 `cordis.patch.yml`,所以那一行
-会被自动插进 profile 的插件树里 —— 不需要手改配置。要改默认值,请在你自己 profile 的 patch
-层里**按 id 修改那一行已存在的配置**,**不要**再写一个 `- insert:`(insert 永远是追加,你会得到
-两行 engramory,而原来那行的上限依旧在生效):
-```yaml
-- id: engramory
-  config:
-    indexName: MEMORY.md
-    maxLines: 200
-    maxBytes: 25600
-```
-一次 patch 会**整体替换**目标行的 `config`,所以你想保留的键要逐个列全。
-记忆库本身和常驻块,请用 Engramory 仓库里的安装器
-(`python tools/engramory_init.py dsh --install-skill`)。本插件负责强制上限、提供协议;
-**它不创建记忆库**。
-## 配置
-| 字段 | 默认值 | 含义 |
-|---|---|---|
-| `indexName` | `MEMORY.md` | 被当作记忆索引的文件名(不区分大小写;`file_path` 与 `str_replace_editor` 的 `path` 都会检查)。空值或非字符串会回退到默认值。除此之外不检查任何东西。 |
-| `maxLines` | `200` | 硬性行数上限。非正数或非有限值回退到默认值。 |
-| `maxBytes` | `25600` | 硬性 UTF-8 字节上限(25 KB)。 |
-| `indexPath` | 未设置 | 要守护的**那一个**索引的绝对路径。不设它时,守卫只按文件名匹配,于是**别的项目里一个无关的 `MEMORY.md` 也会被拦**;设了它就只有这个确切的文件会被守。比较走的是身份而非拼写(symlink 与 `..` 都会解析;仅在 Windows 上折叠大小写),而且即使文件尚不存在,它的第一次写入照样受守护。 |
-| `registerSkill` | `true` | 设为 `false` 则保留上限、但跳过运行时 skill。 |
-| `skill` | 内置 | 用你自己的 markdown 替换 skill 正文。 |
-## 守卫到底做了什么
-| 调用 | 判决 |
-|---|---|
-| `write`(或 `str_replace_editor` 的 `create`)且结果在上限内 | 放行 |
-| `write`/`create` 会让索引**增长**并越过上限 | **拒绝**,并报出具体数字和该压缩什么 |
-| `write`/`create` 让一个已超限的索引**缩小或持平** | 放行 —— 增量压缩(210 → 205 → 198)必须走得通 |
-| 带 `old_str`/`new_str` 的 edit:结果可模拟 | 按**结果**判定,增长/缩小规则与整文件写入相同 |
-| 无法模拟的部分写入(如 `insert`)落在已超限的索引上 | **拒绝**,并告诉 agent:缩小的整文件写入是放行的 |
-| 无法模拟的部分写入落在健康的索引上 | 放行 |
-| `read`、`view`,以及任何未知工具 | 放行 —— 哪怕已超限,召回也绝不能被挡住 |
-| 对任何其他文件的写入 | 放行 —— 不关守卫的事 |
-| 整文件写入时当前索引缺失/读不到 | 视为**空**(与 Python 版守卫一致)—— 上限内的写入放行,而首次就超限的写入被拒 |
-| 部分编辑时索引缺失/读不到 | 放行 —— 守卫绝不能因为一个自己读不了的路径而挡住工作 |
-| 畸形的执行(没有 arguments、路径/内容不是字符串) | 放行 —— 它压根不像一次写入 |
-拒绝规则与 `hooks/engramory_index_guard.py` **完全一致**:只拒绝那种结果既超过上限、
-又比当前文件更大的写入。行数统计忽略结尾换行,所以一个正好卡在上限的索引仍然可写。
-## 已知限制
-- **从上限之下一跃越过上限的、无法模拟的部分写入,抓不住。** `insert` 这类调用并不携带
-  写入后的文本。这种越界会由下一次整文件写入、或 `engramory_check.py` 抓到。能保证的是:
-  一个**已经超限**的索引不会被继续撑大,而缩小的写入永远放行。
-- **工具名单遵循 dsh 文档化的 tool-fs 契约**(`write`/`edit` 用 `file_path`,
-  `str_replace_editor` 用 `path`),并且刻意保守:未知工具一律放行。
-- **0.2.0 从未激活成功;0.2.1 才是第一个真正跑得起来的版本。** 在 rc.6 预览版那个 bug
-  堵住上游所有第三方 profile 安装期间,插件能有的覆盖只有 mock —— 而 0.2.0 的 mock 恰好
-  掩盖了两个激活期 bug:一个是旧版 Cordis 的 `{ required, optional }` inject 写法(被解读成
-  在等待名字就叫 `required`/`optional` 的服务,于是永远 pending),另一个是裸读未声明的
-  `ctx.skills`(在 Cordis 的反射式上下文下会直接抛错)。安装一旦成为可能,**首个真实安装
-  当场把两个都暴露了**(issue #8)。0.2.1 修掉了它们,并在一个真跑着的 dsh 0.1.0-rc.7 web
-  profile 上端到端验证过(0.2.0 逐字节复现启动失败;0.2.1 能启动并提供服务),也对着 dsh
-  内置的 `@deepseek-ai/cordis` 解析器验过(注册表存在、不存在、以及晚挂载三种情况下的激活)。
-  测试用的 mock 现在会照着反射式上下文的访问规则来,守卫的判决表则由 `node --test`
-  持续覆盖(28 个用例,在 Engramory 的 CI 里跑)。
-- dsh 目前是开发者预览版,插件 API 可能变化。本插件刻意只碰 `ctx.tools.guard()` 和一个
-  注册 skill 的响应式 `ctx.inject(['skills'], …)` 子上下文,所以要跟着改也很便宜。
-## 许可
-MIT —— 见 [Engramory 仓库](https://github.com/tinqiao-oss/engramory)。
+[English](README.md) | **简体中文**
+# dsh-engramory
+[![dsh-xray](https://img.shields.io/endpoint?url=https%3A%2F%2Funstone.github.io%2Fdsh-xray%2Fbadge%2Ftinqiao-oss__engramory.json)](https://unstone.github.io/dsh-xray/registry.html#tinqiao-oss__engramory)
+<sub>`C2` 是 `manifest.bundle.patch` 给每个可挂载 dsh 插件定的档位(被扫描生态里 74.6% 都在这一档);它是这张卡片上**唯一**的标记 —— 没有 `exec`、没有 `eval`、没有安装脚本、没有外连域名、不读环境变量。</sub>
+给 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 用的**策展式、文件式**长期记忆 ——
+纯 markdown 笔记,随便什么工具都能打开;一个记忆库被你用的所有宿主共用;索引上限是一次
+**真正的拒绝**,而不是一句请求。(记忆库若位于某个项目的 git 仓库内,必须 git-ignore ——
+记忆里带着本机独有的细节,见 SKILL.md §1。给记忆库单独开一个*私有仓*则完全可以。)
+隶属于 [Engramory](https://github.com/tinqiao-oss/engramory)。
+## 已经有 `AGENTS.md` 常驻块了,为什么还要插件
+那个常驻块确实承载了纪律,单论召回也够用了。但有两件事它做不到:
+**上限从此是确定性的。** Engramory 把索引控制在 200 行 / 25 KB 以内,是因为索引每次会话
+都要加载,超出的部分会**悄无声息地不再被召回**。在多数宿主上,这个限制只是"规则 + 一个
+要靠 agent 自己记得去跑的校验器"。而 dsh 暴露了 `ctx.tools.guard()` —— 一个同步的、
+**单调**的否决:守卫一旦返回理由,后面任何监听器都无法把它翻回放行。所以在这里,上限是被
+**强制执行**的,不是被请求的。请用 **0.2.6 或更高版本**:0.2.0 发布时上游的 profile 安装还
+没打通,而且它的 `inject` 声明是这版 Cordis 不接受的写法 —— 装得上,但**永远激活不了**
+(issue #8);0.2.5 及以前,在 CRLF 换行的索引上、或在 dsh 0.2 上 cd 之后用相对路径,edit
+能绕过上限(见下文「已知限制」)。在 Claude Code 之外,dsh 是第一个真正把这层垫片写出来的宿主(另有几个宿主
+同样暴露了等价的写前接缝,见 PORTING.md,但还没有垫片实现)。
+**协议随插件一起到达。** skill 是在运行时通过 dsh 的 skill 注册表注册的 —— 走一个响应式的
+`ctx.inject(['skills'], …)` 子上下文,所以没有注册表的 profile 照样拿到上限,而注册表晚一步
+挂载的 profile 也照样拿得到 skill。这意味着它**不依赖**把文件放进 dsh 扫描的那五个 skill 根
+目录之一 —— 那条路很容易在细微处放错,而一旦放错就是**静默失败**。
+## 安装
+```sh
+dsh plugin --profile <名字> add dsh-engramory
+```
+装到这里就完了。这个包自带 `dsh.bundle` manifest 指向它自己的 `cordis.patch.yml`,所以那一行
+会被自动插进 profile 的插件树里 —— 不需要手改配置。要改默认值,请在你自己 profile 的 patch
+层里**按 id 修改那一行已存在的配置**,**不要**再写一个 `- insert:`(insert 永远是追加,你会得到
+两行 engramory,而原来那行的上限依旧在生效):
+```yaml
+- id: engramory
+  config:
+    indexName: MEMORY.md
+    maxLines: 200
+    maxBytes: 25600
+```
+一次 patch 会**整体替换**目标行的 `config`,所以你想保留的键要逐个列全。
+记忆库本身和常驻块,请用 Engramory 仓库里的安装器
+(`python tools/engramory_init.py dsh --install-skill`)。本插件负责强制上限、提供协议;
+**它不创建记忆库**。
+## 配置
+| 字段 | 默认值 | 含义 |
+|---|---|---|
+| `indexName` | `MEMORY.md` | 被当作记忆索引的文件名(不区分大小写;`file_path` 与 `str_replace_editor` 的 `path` 都会检查)。空值或非字符串会回退到默认值。除此之外不检查任何东西。 |
+| `maxLines` | `200` | 硬性行数上限。非正数或非有限值回退到默认值。 |
+| `maxBytes` | `25600` | 硬性 UTF-8 字节上限(25 KB)。 |
+| `indexPath` | 未设置 | 要守护的**那一个**索引的绝对路径。不设它时,守卫只按文件名匹配,于是**别的项目里一个无关的 `MEMORY.md` 也会被拦**;设了它就只有这个确切的文件会被守。比较走的是身份而非拼写(symlink 与 `..` 都会解析;仅在 Windows 上折叠大小写),而且即使文件尚不存在,它的第一次写入照样受守护。 |
+| `registerSkill` | `true` | 设为 `false` 则保留上限、但跳过运行时 skill。 |
+| `skill` | 内置 | 用你自己的 markdown 替换 skill 正文。 |
+## 守卫到底做了什么
+| 调用 | 判决 |
+|---|---|
+| `write`(或 `str_replace_editor` 的 `create`)且结果在上限内 | 放行 |
+| `write`/`create` 会让索引**增长**并越过上限 | **拒绝**,并报出具体数字和该压缩什么 |
+| `write`/`create` 让一个已超限的索引**缩小或持平** | 放行 —— 增量压缩(210 → 205 → 198)必须走得通 |
+| 带 `old_str`/`new_str` 的 edit:结果可模拟 | 按**结果**判定,增长/缩小规则与整文件写入相同 |
+| 无法模拟的部分写入(如 `insert`)落在已超限的索引上 | **拒绝**,并告诉 agent:缩小的整文件写入是放行的 |
+| 无法模拟的部分写入落在健康的索引上 | 放行 |
+| `read`、`view`,以及任何未知工具 | 放行 —— 哪怕已超限,召回也绝不能被挡住 |
+| 对任何其他文件的写入 | 放行 —— 不关守卫的事 |
+| 整文件写入时当前索引缺失/读不到 | 视为**空**(与 Python 版守卫一致)—— 上限内的写入放行,而首次就超限的写入被拒 |
+| 部分编辑时索引缺失/读不到 | 放行 —— 守卫绝不能因为一个自己读不了的路径而挡住工作 |
+| 畸形的执行(没有 arguments、路径/内容不是字符串) | 放行 —— 它压根不像一次写入 |
+拒绝规则与 `hooks/engramory_index_guard.py` **完全一致**:只拒绝那种结果既超过上限、
+又比当前文件更大的写入。行数统计忽略结尾换行,所以一个正好卡在上限的索引仍然可写。
+## 已知限制
+- **从上限之下一跃越过上限的、无法模拟的部分写入,抓不住。** `insert` 这类调用并不携带
+  写入后的文本。这种越界会由下一次整文件写入、或 `engramory_check.py` 抓到。能保证的是:
+  一个**已经超限**的索引不会被继续撑大,而缩小的写入永远放行。
+- **工具名单遵循 dsh 文档化的 tool-fs 契约**(`write`/`edit` 用 `file_path`,
+  `str_replace_editor` 用 `path`),并且刻意保守:未知工具一律放行。
+- **0.2.0 从未激活成功;0.2.1 才是第一个真正跑得起来的版本。** 在 rc.6 预览版那个 bug
+  堵住上游所有第三方 profile 安装期间,插件能有的覆盖只有 mock —— 而 0.2.0 的 mock 恰好
+  掩盖了两个激活期 bug:一个是旧版 Cordis 的 `{ required, optional }` inject 写法(被解读成
+  在等待名字就叫 `required`/`optional` 的服务,于是永远 pending),另一个是裸读未声明的
+  `ctx.skills`(在 Cordis 的反射式上下文下会直接抛错)。安装一旦成为可能,**首个真实安装
+  当场把两个都暴露了**(issue #8)。0.2.1 修掉了它们,并在一个真跑着的 dsh 0.1.0-rc.7 web
+  profile 上端到端验证过(0.2.0 逐字节复现启动失败;0.2.1 能启动并提供服务),也对着 dsh
+  内置的 `@deepseek-ai/cordis` 解析器验过(注册表存在、不存在、以及晚挂载三种情况下的激活)。
+  测试用的 mock 现在会照着反射式上下文的访问规则来,守卫的判决表则由 `node --test`
+  持续覆盖(37 个用例,在 Engramory 的 CI 里跑)。
+- **相对路径按 dsh 实际写入的位置来量。** dsh 0.2 给每个会话一个自己的工作目录(由它的
+  `working_directory` 工具切换),并按这个目录解析相对的 `file_path`。0.2.5 及以前的守卫却按
+  进程的 cwd 解析,于是 cd 之后对裸 `MEMORY.md` 的 edit 读不到当前文件、不经测量就放行 ——
+  在 dsh 0.2.1-rc.2 上它把索引撑到了 253 行。0.2.6 在 profile 提供 `workingDirectory` 服务时
+  读取会话目录,没有时(所有 0.1.x 版本)退回进程 cwd。
+- **CRLF 索引按 dsh 的方式来模拟 edit。** dsh 先把文本统一成 LF 再匹配 edit,写回时恢复文件
+  原来的换行。0.2.5 及以前的守卫按原始字节匹配,于是在 CRLF 的 `MEMORY.md` 上(Windows 上很
+  常见),LF 的 `old_string` 看起来不存在,edit 被预测成"什么都不改"而放行,dsh 却照常改了。
+  0.2.6 用同样的方式归一化,并按 CRLF 字节数计算 CRLF 索引的大小。
+- **验的是你大概率正在用的 dsh,不只是写它时的那一版。** Engramory 仓库里的
+  `tests/dsh_e2e/run.py` 会把指定的 dsh 版本装进临时目录,用 `dsh plugin add` 装上本插件,
+  再对着一个脚本化的 DeepSeek API 替身跑一次 headless 任务:260 行的整文件写入、把索引撑过
+  上限的 edit,都必须被本守卫拒绝,而且磁盘上什么都没变;小写入必须逐字节落盘;skill 必须出现
+  在发给模型的技能目录里;dsh 提供的每个工具都必须已经归过类(没归类的新工具可能绕过上限写文件);卸载后
+  profile 必须还能启动。通过的版本逐个写在 `package.json` 的 `dsh.compatibility.dshReleases`
+  里;没有同一插件版本、同一份代码的通过记录,单元测试就不接受把它标成 `compatible`。
+- dsh 目前是开发者预览版,插件 API 可能变化。本插件刻意只碰 `ctx.tools.guard()` 和两个
+  响应式 `ctx.inject()` 子上下文 —— 一个注册 skill,一个读取各会话的工作目录 —— 所以要跟着改
+  也很便宜。
+## 许可
+MIT —— 见 [Engramory 仓库](https://github.com/tinqiao-oss/engramory)。

package/cordis.patch.yml CHANGED Viewed

@@ -1,16 +1,16 @@
-# The dsh-engramory bundle patch: one row, inserted over whatever layers came before
-# it. A patch replaces the targeted row's whole `config`, so a profile overriding this
-# row must restate every key it means to keep.
-#
-# The numbers below are the protocol's own caps, not this port's opinion: 200 lines /
-# 25 KB is what keeps MEMORY.md cheap enough to load at the start of every session, and
-# it is the same limit hooks/engramory_index_guard.py enforces on Claude Code. They live
-# here, beside the row, so a deployment can raise or lower them without touching code.
-- insert:
-    - id: engramory
-      name: dsh-engramory
-      config:
-        indexName: MEMORY.md
-        maxLines: 200
-        maxBytes: 25600
+# The dsh-engramory bundle patch: one row, inserted over whatever layers came before
+# it. A patch replaces the targeted row's whole `config`, so a profile overriding this
+# row must restate every key it means to keep.
+#
+# The numbers below are the protocol's own caps, not this port's opinion: 200 lines /
+# 25 KB is what keeps MEMORY.md cheap enough to load at the start of every session, and
+# it is the same limit hooks/engramory_index_guard.py enforces on Claude Code. They live
+# here, beside the row, so a deployment can raise or lower them without touching code.
+- insert:
+    - id: engramory
+      name: dsh-engramory
+      config:
+        indexName: MEMORY.md
+        maxLines: 200
+        maxBytes: 25600

package/index.js CHANGED Viewed

@@ -24,7 +24,7 @@
  * Zero dependencies, no build step: plain ESM, node: builtins only.
  */
 import { readFileSync, realpathSync } from 'node:fs'
-import { basename, dirname, join, resolve } from 'node:path'
+import { basename, dirname, isAbsolute, join, resolve, sep } from 'node:path'
 export const name = 'engramory'
@@ -79,7 +79,33 @@ export function apply(ctx, config = {}) {
     maxBytes: positive(config.maxBytes, DEFAULT_MAX_BYTES),
   }
-  ctx.tools.guard((exec) => refuseOversizedIndex(exec, settings))
+  // dsh 0.2 resolves a relative file path against the calling SESSION's working
+  // directory, which its `working_directory` tool moves away from the process's own
+  // cwd. Measured against process.cwd(), a bare `MEMORY.md` after a cd is the wrong
+  // file or none: an edit of the real index passed unmeasured, and a shrinking rewrite
+  // of an over-cap index was judged against an empty file and refused. The service is
+  // optional (0.1.x has none) and may mount late, so — like `skills` below — it is
+  // picked up reactively and never makes the cap wait.
+  let workingDirectory
+  ctx.inject(['workingDirectory'], (inner) => {
+    inner.effect(() => {
+      const service = inner.workingDirectory
+      workingDirectory = service
+      return () => {
+        if (workingDirectory === service) workingDirectory = undefined
+      }
+    })
+  })
+  const sessionCwd = (exec) => {
+    try {
+      const dir = workingDirectory?.get(exec.agent.session)
+      return typeof dir === 'string' && isAbsolute(dir) ? dir : undefined
+    } catch {
+      return undefined // no agent, no session, or a service shape this port predates
+    }
+  }
+  ctx.tools.guard((exec) => refuseOversizedIndex(exec, settings, sessionCwd))
   // The skill registry is optional AND may activate after this plugin — fiber order
   // between unrelated providers is not guaranteed, so a one-shot probe here would
@@ -99,12 +125,18 @@ export function apply(ctx, config = {}) {
           'Curated file-based long-term memory: recall through MEMORY.md at the start of ' +
           'a task, save durable user/feedback/project/reference facts, run a curation ' +
           'checkpoint when a task finishes, and sync before compacting or opening a ' +
-          'fresh thread.',
+          'fresh thread. A turn that starts no work — a greeting, an acknowledgement — ' +
+          'is not a task and needs none of this, but never judge that by length: a ' +
+          'one-word reply continuing work underway inherits that task.',
         whenToUse:
           'Starting or resuming work, learning something durable worth a future session, ' +
           'finishing a task — including one that leaves nothing worth saving, since the ' +
           'checkpoint is still a decision to make — or approaching a ' +
-          'compact/clear/new-thread boundary.',
+          'compact/clear/new-thread boundary. Not for a bare greeting, ' +
+          'acknowledgement, or reaction, which starts no task — but a terse reply ' +
+          'that continues work underway does, and material already in hand (a ' +
+          'pasted diff to review) does not make work a non-task. Unsure? Treat it ' +
+          'as a task.',
         source: 'runtime',
         content: skill,
       }))
@@ -119,7 +151,7 @@ export function apply(ctx, config = {}) {
  * rejects the overwhelming majority of calls before anything is measured, and the
  * only I/O is a single read of the index on a gated write.
  */
-function refuseOversizedIndex(exec, settings) {
+function refuseOversizedIndex(exec, settings, sessionCwd) {
   const args = exec?.arguments
   if (!args || typeof args !== 'object') return undefined
@@ -146,19 +178,26 @@ function refuseOversizedIndex(exec, settings) {
       && (args.command === 'create' || args.command === 'str_replace'
         || args.command === 'insert'))
   if (!gated) return undefined
+  // Every read and identity check below uses the file the host will actually touch.
+  let target
+  try {
+    target = hostPath(sessionCwd(exec), filePath)
+  } catch {
+    return undefined // a relative path and no cwd left to resolve it (deleted under us)
+  }
   // If the guard is pinned to one file, this is where an unrelated same-named file in
   // another project drops out.
-  if (settings.indexKey !== undefined && pathKey(filePath) !== settings.indexKey) {
+  if (settings.indexKey !== undefined && pathKey(target) !== settings.indexKey) {
     return undefined
   }
   if (WHOLE_FILE_WRITES.has(tool)) {
     if (typeof args.content !== 'string') return undefined
-    return verdict(args.content, readIfPossible(filePath), filePath, settings)
+    return verdict(args.content, readIfPossible(target), filePath, settings)
   }
   if (tool === 'str_replace_editor' && args.command === 'create') {
     if (typeof args.file_text !== 'string') return undefined
-    return verdict(args.file_text, readIfPossible(filePath), filePath, settings)
+    return verdict(args.file_text, readIfPossible(target), filePath, settings)
   }
   const partial = PARTIAL_WRITES.has(tool)
@@ -166,7 +205,7 @@ function refuseOversizedIndex(exec, settings) {
       && (args.command === 'str_replace' || args.command === 'insert'))
   if (!partial) return undefined // read / view / list / unknown: never refused
-  const currentBuf = readIfPossible(filePath)
+  const currentBuf = readIfPossible(target)
   if (currentBuf === undefined) return undefined
   const current = currentBuf.toString('utf8')
   const simulated = simulateEdit(current, args)
@@ -255,19 +294,46 @@ function notMyIndexHint(settings) {
  * of them under a replace-all flag; an absent or ambiguous old-string means the
  * real tool errors and changes nothing, so the current text is the honest
  * prediction. Returns undefined when the shape isn't recognised.
+ *
+ * Matching happens on LF-normalised text and the result goes back in the file's own
+ * line endings, as dsh's local backend does it (`applyLiteralEdit` /
+ * `restoreLineEndings` in @deepseek-ai/dsh-fs-local). Matching the raw text let a CRLF
+ * index — common on Windows — read every LF `old_string` as "not found", predict no
+ * change, and pass an edit dsh then applied.
  */
 function simulateEdit(current, args) {
-  const oldStr = firstString(args.old_str, args.old_string)
-  if (oldStr === undefined || oldStr === '') return undefined
-  const newStr = firstString(args.new_str, args.new_string) ?? ''
+  const oldRaw = firstString(args.old_str, args.old_string)
+  if (oldRaw === undefined || oldRaw === '') return undefined
+  const oldStr = lf(oldRaw)
+  const newStr = lf(firstString(args.new_str, args.new_string) ?? '')
+  // dsh decodes with TextDecoder, which drops a leading BOM — from the text it
+  // matches, from the sample it detects line endings on, and from what it writes back.
+  const decoded = current.startsWith('') ? current.slice(1) : current
+  const text = lf(decoded)
+  const first = text.indexOf(oldStr)
+  if (first === -1) return current // the real tool errors: nothing changes
+  let edited
   if (args.replace_all === true || args.replaceAll === true) {
-    return current.split(oldStr).join(newStr)
+    edited = text.split(oldStr).join(newStr)
+  } else {
+    const second = text.indexOf(oldStr, first + oldStr.length)
+    if (second !== -1) return current // ambiguous: the real tool errors, nothing changes
+    edited = text.slice(0, first) + newStr + text.slice(first + oldStr.length)
   }
-  const first = current.indexOf(oldStr)
-  if (first === -1) return current // the real tool errors: nothing changes
-  const second = current.indexOf(oldStr, first + oldStr.length)
-  if (second !== -1) return current // ambiguous: the real tool errors, nothing changes
-  return current.slice(0, first) + newStr + current.slice(first + oldStr.length)
+  // Normalised once more before expanding, as dsh's restoreLineEndings does: a lone
+  // `\r` meeting an inserted `\n` at the seam is one CRLF, not `\r\r\n`.
+  return crlfDominates(decoded) ? lf(edited).split('\n').join('\r\n') : edited
+}
+function lf(text) {
+  return text.replaceAll('\r\n', '\n')
+}
+/** dsh's own call (`detectLineEndings`): CRLF wins on a majority in the first 4096 chars. */
+function crlfDominates(raw) {
+  const sample = raw.slice(0, 4096)
+  const crlf = sample.split('\r\n').length - 1
+  return crlf > sample.split('\n').length - 1 - crlf
 }
 function firstString(...values) {
@@ -313,6 +379,22 @@ function positive(value, fallback) {
   return floored > 0 ? floored : fallback
 }
+/**
+ * The path the host's own file tools would touch for `p`, mirroring dsh's local
+ * backend (`localDisplayPath` in @deepseek-ai/dsh-fs-local): resolve against `cwd`,
+ * except that on POSIX a spelling with a `..` segment is kept as written, so a `..`
+ * after a symlinked segment stays physical — collapsing it could measure a different
+ * file than the one the write lands on. Without a session directory (`cwd`
+ * undefined), the process's is used, and only when `p` needs one: process.cwd()
+ * throws once that directory is deleted, and an absolute path must not care.
+ */
+function hostPath(cwd, p) {
+  const resolved = () => (cwd === undefined ? resolve(p) : resolve(cwd, p))
+  if (process.platform === 'win32') return resolved()
+  const raw = isAbsolute(p) ? p : `${cwd ?? process.cwd()}${sep}${p}`
+  return /(?:^|[\\/])\.\.(?:[\\/]|$)/u.test(raw) ? raw : resolved()
+}
 /**
  * Normalise a path for identity comparison. `realpath` resolves symlinks and `..` so
  * two spellings of the same file compare equal, but it throws for a path with no file
@@ -374,6 +456,16 @@ function builtinSkillBody() {
     '',
     '## Recall',
     '',
+    'A turn, a message, or a session is NOT BY ITSELF a task: a greeting, an',
+    'acknowledgement, or a reaction starts none, so it gets no recall and no',
+    'checkpoint. A task is user-directed work whose CORRECT handling could depend',
+    'on what the store holds — read-only work (analysis, diagnosis, planning,',
+    'review)',
+    'counts, and changing a file is not required. HAVING THE MATERIAL IN HAND does',
+    'not make work a non-task: a diff pasted for review is still a task. NEVER INFER',
+    'THIS FROM LENGTH: a one-word reply that picks an option or carries on work',
+    'underway inherits that task. Still unclear? Treat it as a task.',
+    '',
     'At the start of a task, read the index and open only the notes whose hooks look',
     'relevant. Treat what you recall as background that may be stale: re-verify any',
     'file, flag, or version against the repo before acting on it.',

package/package.json CHANGED Viewed

@@ -1,56 +1,64 @@
-{
-  "name": "dsh-engramory",
-  "version": "0.2.3",
-  "description": "Curated file-based long-term memory for DeepSeek Harness — human-readable markdown notes, one plain-file store shared across hosts (git-ignored when it lives inside a project repo), and a deterministic index cap enforced by ctx.tools.guard()",
-  "keywords": [
-    "dsh-plugin",
-    "deepseek-harness",
-    "dsh",
-    "memory",
-    "agent-memory",
-    "long-term-memory",
-    "engramory",
-    "markdown"
-  ],
-  "type": "module",
-  "main": "index.js",
-  "dsh": {
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    }
-  },
-  "exports": {
-    ".": "./index.js",
-    "./package.json": "./package.json"
-  },
-  "files": [
-    "index.js",
-    "cordis.patch.yml",
-    "README.md",
-    "LICENSE"
-  ],
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/tinqiao-oss/engramory.git",
-    "directory": "adapters/dsh/plugin"
-  },
-  "homepage": "https://github.com/tinqiao-oss/engramory/tree/master/adapters/dsh#readme",
-  "bugs": {
-    "url": "https://github.com/tinqiao-oss/engramory/issues"
-  },
-  "engines": {
-    "node": ">=18"
-  },
-  "peerDependencies": {
-    "@deepseek-ai/dsh-tools": ">=0.0.1-rc.1"
-  },
-  "peerDependenciesMeta": {
-    "@deepseek-ai/dsh-tools": {
-      "optional": false
-    }
-  },
-  "publishConfig": {
-    "access": "public"
-  }
-}
+{
+  "name": "dsh-engramory",
+  "version": "0.2.6",
+  "description": "Curated file-based long-term memory for DeepSeek Harness — human-readable markdown notes, one plain-file store shared across hosts (git-ignored when it lives inside a project repo), and a deterministic index cap enforced by ctx.tools.guard()",
+  "keywords": [
+    "dsh-plugin",
+    "deepseek-harness",
+    "dsh",
+    "memory",
+    "agent-memory",
+    "long-term-memory",
+    "engramory",
+    "markdown"
+  ],
+  "type": "module",
+  "main": "index.js",
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "compatibility": {
+      "dsh": ">=0.1.0-rc.7 <0.3.0-0",
+      "dshReleases": {
+        "0.1.5-rc.3": "compatible",
+        "0.1.7-alpha.1": "compatible",
+        "0.1.7-alpha.2": "compatible",
+        "0.1.7-rc.1": "compatible",
+        "0.1.7-rc.2": "compatible",
+        "0.2.1-alpha.5": "compatible",
+        "0.2.1-rc.1": "compatible",
+        "0.2.1-rc.2": "compatible",
+        "0.2.1-rc.3": "compatible",
+        "0.2.1-rc.4": "compatible",
+        "0.2.2-alpha.2": "compatible"
+      }
+    }
+  },
+  "exports": {
+    ".": "./index.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "index.js",
+    "cordis.patch.yml",
+    "README.md",
+    "LICENSE"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tinqiao-oss/engramory.git",
+    "directory": "adapters/dsh/plugin"
+  },
+  "homepage": "https://github.com/tinqiao-oss/engramory/tree/master/adapters/dsh#readme",
+  "bugs": {
+    "url": "https://github.com/tinqiao-oss/engramory/issues"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}