dsh-hypatia-auto-memory 2.4.0 → 2.4.2

package/README.md

@@ -699,6 +699,15 @@ Deliberate, and worth knowing before you rely on them:
   flush), but older binaries lack it, so the plugin still never edits an entry
   in place: a second session title does not replace the first, and a work unit
   is never rewritten.
+- **`knowledge-update --data=""` empties the body, and nothing rolls it back.**
+  hypatia stores what it is given and answers `Updated knowledge: <name>` either
+  way — tags, scopes and `created_at` survive, the text does not, and a
+  whitespace-only payload is the same accident (measured on 4.0.0). The plugin
+  never calls the command (see above), but an agent writing a rule by hand does,
+  and the way memory is lost is a `--data="$(cat …)"` whose file was never
+  written. The guard therefore lives in the instruction layer: the
+  `hypatia-memory` skill and the `smart-memory` preset both say to verify the
+  payload is non-blank, pass it, then read the entry back with `knowledge-get`.
 - **Duplicate `knowledge-create` is detected by error text.** hypatia has no
   upsert for knowledge entries, so `hypatia-cli.js` recognises
   `UNIQUE constraint failed:` / `duplicate key` to make a replay idempotent.

package/README.zh-CN.md

@@ -547,6 +547,12 @@ shelf 清单本来就不是配置，而设置域现在只投影插件的 Config
 - **插件尚未使用 `knowledge-update`。** hypatia 在 #20 加入它（保留 `created_at`、
   丢弃旧向量并在下次 flush 时重新嵌入），但更旧的二进制没有，所以插件仍从不在原地
   编辑条目：第二个会话标题不会替换第一个，工作单元也从不重写。
+- **`knowledge-update --data=""` 会清空正文，且没有回滚。** hypatia 给什么存什么，
+  两种情况都打印 `Updated knowledge: <name>`——tags、scopes、`created_at` 全在，
+  文字没了；纯空白 payload 是同一个事故（在 4.0.0 上实测）。插件自己从不调用这个命令
+  （见上一条），但手写规则的 agent 会，而丢记忆的写法就是 `--data="$(cat …)"` 里的
+  文件从未生成。因此这道防线放在指令层：`hypatia-memory` 技能与 `smart-memory`
+  预设都要求先确认 payload 含非空白字符、再传、再用 `knowledge-get` 回读。
 - **重复的 `knowledge-create` 靠错误文本识别。** hypatia 对知识条目没有 upsert，所以
   `hypatia-cli.js` 识别 `UNIQUE constraint failed:` / `duplicate key` 使重放幂等。
   `statement-create` 自 hypatia #20 起自身幂等（重复执行退出 0 并打印 `Statement

package/cordis.patch.yml

@@ -81,12 +81,12 @@
                 查到既有决策就遵循它，并在回答里点明依据（条目名或结论）。记忆与当前代码或用户要求冲突时，明确说出冲突，以用户当前指令为准，并用 `supersedes` 语句把新结论落库——绝不删除旧条目。确实没有记录时，直接说明"记忆库中没有相关记录"，再按第一性原理推进，不要编造记忆内容。
 
                 ## 写入纪律
-                用户给出永久性规则、禁忌或纠正时立即写库（`rule` / `taboo` / `memory`，scope 用本项目的实际 scope）：先 `knowledge-get`，已存在就 `knowledge-update`，不存在才 `knowledge-create`，不要删除后重建。过程流水不要手工写。
+                用户给出永久性规则、禁忌或纠正时立即写库（`rule` / `taboo` / `memory`，scope 用本项目的实际 scope）：先 `knowledge-get`，已存在就 `knowledge-update`，不存在才 `knowledge-create`，不要删除后重建。覆盖正文前先确认 payload 含非空白字符（空或纯空白的 `--data` 会清空正文，且没有历史可回滚），写后用 `knowledge-get` 回读核对。过程流水不要手工写。
 
                 ## 长程任务
                 复杂任务先用 todo_write 拆解并跟踪；跨轮目标用 goal 机制续跑，没有完成证据不要宣称完成。阶段收尾时把"值得留存的结论"落库，而不是把过程日志落库。
               suffix: |-
-                你的工作目录是 {{cwd}}。记忆的检索与落库通过 bash 调用 hypatia CLI 完成，scope 归属由插件决定。
+                记忆的检索与落库通过 bash 调用 hypatia CLI 完成，scope 归属由插件决定。
           - id: agent-instructions
             name: '@deepseek-ai/dsh-agent-instructions'
             config:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-hypatia-auto-memory",
-  "version": "2.4.0",
+  "version": "2.4.2",
   "description": "Event-driven Hypatia memory for DSH: automatic conversation logging via session events, queued background consolidation (span summaries + work-unit extraction) with a dedicated model route, and recall injection — zero per-call model work in the main session.",
   "icon": "./icon.svg",
   "type": "module",

package/skills/hypatia/SKILL.md

@@ -139,6 +139,8 @@ hypatia knowledge-update <name> [-d "<data>"] [-t "<tags>"] [--synonyms "<csv>"]
 
 Only the fields you pass change. An omitted field keeps its stored value, and exactly `""` clears a field, such as `-t ""`; for tags, `","` or `" "` would store blank tags instead. `--scopes` replaces the stored scopes and is parsed as on create: end the list with a comma, such as `"q,"`, to include the global scope, or the entry drops out of global lookups. The entry keeps its `created_at`. Its old vector is discarded, and a new one is generated on the next flush, as after `knowledge-create`. Updating an entry that does not exist is an error. An update that changes nothing prints `Knowledge unchanged: <name>` and writes nothing.
 
+**`-d ""` / `--data=""` is destructive, not a no-op.** It replaces the body with the empty string and still prints `Updated knowledge: <name>`; tags, scopes and `created_at` survive, the text is gone, and there is no revision history to restore from (measured on 4.0.0). The usual accident is a command substitution over a file that was never written — `--data="$(cat /tmp/x.md)"` expands to empty — and `--data="   "` is the same accident once trimmed, which is why `test -s` is not a sufficient check. Verify the payload holds a non-blank character (`grep -q '[^[:space:]]' /tmp/x.md`), pass it, then read the entry back with `hypatia knowledge-get <name>`. When the body is not what changes, omit `-d` entirely.
+
 | User says | Command |
 |---|---|
 | "update Rust's description to mention memory safety" | `hypatia knowledge-update "Rust" -d "systems programming language with memory safety"` |

package/skills/hypatia-memory/SKILL.md

@@ -164,6 +164,18 @@ hypatia knowledge-create "<short-kebab-name>" \
   vector is regenerated on the next flush. An update that changes nothing
   prints `Knowledge unchanged: <name>` and writes nothing. Updating a missing
   entry exits 1.
+- **An empty `--data` erases the body, and nothing undoes it.** The classic
+  accident is `--data="$(cat /tmp/fact.md)"` whose file was never written: the
+  expansion is empty, hypatia still answers `Updated knowledge: <name>`, and the
+  entry keeps its tags, scopes and `created_at` while its body becomes nothing.
+  A whitespace-only payload (`"   "`) does the same, so `test -s` is NOT enough
+  — check for a non-blank character (`grep -q '[^[:space:]]' /tmp/fact.md`).
+  Write the payload to a file, verify it, pass `--data="$(cat /tmp/fact.md)"`,
+  then read it back with `hypatia knowledge-get "<exact-name>"` and confirm the
+  body is what you meant to say. There is no revision history: a wiped body can
+  only be rebuilt from the conversation or the session log. When the update is
+  not about the body, omit `--data` altogether — an omitted field keeps its
+  value; only a passed empty value clears one.
 - Pass only the fields you mean to change. `--scopes` **replaces** the stored
   scopes, with the syntax above: leave off the trailing comma and a global rule
   drops out of the session seed. `--tags ""` clears every tag, and an entry