dsh-memu-memory 1.1.0 → 1.1.2

package/lib/rpc.js

@@ -12,6 +12,7 @@ import { privateList, privateUpdate, privateRemember, privateRecall, privateArch
 import { normalizeMemoryContext } from './context.js'
 import { requestPrivateConsolidation } from './private.js'
 import { startGlobalCuration, getCurationJob, cancelCurationJob, listCurationJobs } from './curator.js'
+import { maybeMigrateLibraries } from './migrate.js'
 import { getPromptStates, savePromptOverride, resetPrompt, resetAllPrompts } from './prompts.js'
 import { statsView } from './stats.js'
 import { getMemuConfig, saveMemuConfig, setEmbeddingSource, testMemuConfig, getSummaryConfig, getVisionConfig } from './memu-config.js'
@@ -377,6 +378,11 @@ async function dispatch(ctx, endpoint, payload = {}) {
         return { revision: memoryRevision(), stamp: memoryStamp() }
       }
       if (!sessionId) throw new Error('getSidebarState requires a sessionId')
+      // An older version could still be on disk (the user upgraded without restarting).
+      // Reads are already correct — `loadPrivateIndex` normalizes the removed `session`
+      // level — but opening the sidebar is a good moment to persist the conversion so the
+      // files stop disagreeing with what is displayed. Throttled, no-op when clean.
+      maybeMigrateLibraries()
       const binding = getSessionBinding(sessionId)
       const folder = binding?.scopeKey ? getWorkspacePolicy(binding.scopeKey) : null
       const effective = binding ? effectiveScope(binding, folder) : null
@@ -560,7 +566,10 @@ async function dispatch(ctx, endpoint, payload = {}) {
       const allowed = new Set([
         'autoInject', 'privateTopK', 'globalTopK', 'anchorTokens', 'turnTokens',
         'relevanceThreshold', 'dedupeTurns', 'globalEveryNTurns', 'minUserChars',
-        'mustRememberCap', 'randomCueChance', 'newSessionPromptDismissed', 'curatorModel',
+        // newSessionDefault has to be writable here: "remember my choice" stores
+        // it, and a dropped patch silently turned every remembered answer into
+        // the 'both' fallback that the dismissed branch then applied.
+        'mustRememberCap', 'randomCueChance', 'newSessionPromptDismissed', 'newSessionDefault', 'curatorModel',
         'autoInstallEngine', 'pipIndexes',
         'sleepConsolidation', 'sleepAfterIdleMinutes', 'autoCurateEveryHours', 'autoCurateSessionLimit',
         'memoryMode', 'memoryBackend', 'habitsInjection', 'purgeArchivedAfterDays',
@@ -723,12 +732,6 @@ async function dispatch(ctx, endpoint, payload = {}) {
       const id = String(payload?.libraryId || '')
       if (!getLibrary(id)) throw new Error('library not found')
       const layer = payload?.layer || 'long_term'
-      // Session-scoped memory needs an owning conversation; the library browser
-      // has none, and writing one here used to produce an entry no session can
-      // ever see (sessionId null). Point the user at the right surface instead.
-      if (payload?.visibility === 'session') {
-        throw new Error('session-scoped memories belong to one conversation; add this from that conversation instead of the library browser')
-      }
       if (layer === 'must_remember' && !String(payload?.pinReason || '').trim()) {
         throw new Error('pinReason is required for must_remember')
       }
@@ -772,12 +775,6 @@ async function dispatch(ctx, endpoint, payload = {}) {
       // needs a pin reason, which only the creation path collects. Promoting to
       // must_remember here would hit privateUpdate's refusal anyway.
       if (patch?.layer === 'must_remember') throw new Error('must_remember needs a pin_reason; write it with memu_private_remember from a conversation')
-      // Without a session context a session-scoped edit has no owner; refuse
-      // instead of silently orphaning the entry (visibility session + null
-      // sessionId is unreachable from every conversation).
-      if (payload?.libraryId && patch?.visibility === 'session') {
-        throw new Error('session visibility can only be set from the owning conversation')
-      }
       const args = { id }
       for (const key of allowed) if (patch[key] !== undefined) args[key] = patch[key]
       if (payload?.libraryId) args.libraryId = String(payload.libraryId)
@@ -954,7 +951,9 @@ async function dispatch(ctx, endpoint, payload = {}) {
     }
     case 'generatePrivate': {
       const sessionId = requireSessionId(payload)
-      return requestPrivateConsolidation(ctx, sessionId)
+      // Explicit button press: the user already decided this conversation is worth
+      // summarizing, so the automatic "is there anything in it" gate does not apply.
+      return requestPrivateConsolidation(ctx, sessionId, { force: true })
     }
     case 'generateGlobal': {
       const sessionId = requireSessionId(payload)

package/lib/state.js

@@ -5,6 +5,7 @@ import {
   dataDir, librariesDir, indexDir, backupsDir,
   ensureDir, readJson, readFailure, readFailuresUnder, writeJson, withFileLock, assertJsonShape, warn, stamp, shortHash, libraryIdForScope, isSafeId,
 } from './paths.js'
+import { migrateIndexVisibility } from './visibility.js'
 
 const STATE_FILE = () => path.join(dataDir(), 'state.json')
 const GLOBAL_DB = () => path.join(dataDir(), 'global.sqlite3')
@@ -74,9 +75,12 @@ export const DEFAULT_SETTINGS = {
   // new-session prompt, domestic texture, and idle consolidation are all on.
   // These stay ordinary switches, and an existing saved choice is preserved.
   sleepConsolidation: true,
-  // Group chat arrives in bursts. 8 idle minutes is long enough to know a burst
-  // ended, short enough that fragments do not sit unconsolidated all day.
-  sleepAfterIdleMinutes: 8,
+  // Group chat arrives in bursts, but a burst is seconds apart and the per-turn
+  // timestamps already cover that. Three idle minutes is long enough that an
+  // ordinary pause (reading a diff, thinking about the next question) is not
+  // "gone", and short enough that a conversation which ended gets tidied in the
+  // same sitting instead of waiting for a quiet hour that may never arrive.
+  sleepAfterIdleMinutes: 3,
   autoCurateEveryHours: 0,
   autoCurateSessionLimit: 8,
   // 'local' keeps every memory on this machine; 'cloud' hands MemU's own backend
@@ -311,7 +315,7 @@ export function updateSettings(patch) {
     unpinBudgetPerSession: [1, 20], unpinCooldownMinutes: [0, 1440], sleepAfterIdleMinutes: [1, 1440],
     autoCurateEveryHours: [0, 8760], autoCurateSessionLimit: [1, 10], purgeArchivedAfterDays: [0, 36500],
   }
-  const enums = { autoInject: ['smart', 'anchor-only', 'per-turn', 'off'], memoryMode: ['local', 'cloud'], memoryBackend: ['agent', 'api'], newSessionDefault: ['off', 'auto', 'both'] }
+  const enums = { autoInject: ['smart', 'anchor-only', 'per-turn', 'off'], memoryMode: ['local', 'cloud'], memoryBackend: ['agent', 'api'], newSessionDefault: ['off', 'auto', 'global', 'both'] }
   for (const [key, value] of Object.entries(patch || {})) {
     if (!Object.hasOwn(DEFAULT_SETTINGS, key)) continue
     if (enums[key]) {
@@ -979,20 +983,26 @@ export function memoryStamp() {
   return parts.join("|")
 }
 
-function cachedIndex(file, loader) {
+function cachedIndex(file, loader, normalize) {
   const cached = indexCache.get(file)
   const stat = statOf(file)
-  if (cached && stat && cached.mtimeMs === stat.mtimeMs && cached.size === stat.size) return indexSnapshot(cached.index)
+  if (cached && stat && cached.mtimeMs === stat.mtimeMs && cached.size === stat.size) return indexSnapshot(cached.index, normalize)
   const index = loader()
   // Never cache a fallback produced by a failed read: it would keep shadowing the
   // real file (whose mtime/size did not change) even after the read recovers.
   if (stat && !readFailure(file)) indexCache.set(file, { mtimeMs: stat.mtimeMs, size: stat.size, index })
-  return indexSnapshot(index)
+  return indexSnapshot(index, normalize)
 }
 
-function indexSnapshot(index) {
+// `normalize` upgrades the *view* (a level an older version stored), while the baseline
+// stays exactly what is on disk. That split is what lets an ordinary write persist the
+// upgrade: `writeIndex` diffs against the baseline, sees the change, and checks the file
+// still matches what we read before accepting it.
+function indexSnapshot(index, normalize) {
+  const baseline = structuredClone(index)
   const copy = structuredClone(index)
-  indexBases.set(copy, structuredClone(index))
+  if (normalize) normalize(copy)
+  indexBases.set(copy, baseline)
   return copy
 }
 
@@ -1044,6 +1054,13 @@ export function loadPrivateIndex(libraryId) {
     let raw = readJson(file, null)
     if (raw !== null) raw = assertJsonShape(file, raw, validIndex)
     return raw && typeof raw === 'object' ? { version: 1, entries: raw.entries || {} } : { version: 1, entries: {} }
+  }, (index) => {
+    // An older version stored `visibility: 'session'` (a lease on one conversation).
+    // That level is gone; libraries written by it are read as `shared` here — the one
+    // chokepoint every reader and writer passes through — so no consumer has to know
+    // the level ever existed. Only the view is upgraded; the baseline stays the raw file
+    // so the next ordinary write persists the conversion (see `indexSnapshot`).
+    migrateIndexVisibility(index, stamp())
   })
 }
 

package/lib/tools.js

@@ -94,9 +94,12 @@ function formatPrivateItem(item, index, options = {}) {
   if (entry.disclosure && entry.disclosure !== 'can_tell') lines.push(`   disclosure=${entry.disclosure}`)
   if (entry.owner && entry.owner !== 'me') lines.push(`   owner=${entry.owner}`)
   if (entry.visibility && entry.visibility !== 'shared') {
-    // 'session' is scoped to the conversation that wrote it, so say so — the model
-    // should not expect the same memory to be reachable in the next chat.
-    const note = entry.visibility === 'secret' ? '（只有你自己知道，别在正文里复述）' : '（只在写出它的那段对话里可见）'
+    // 'secret' is a presentation rule, not a lock: it stays out of the prompt and out of
+    // automatic recall, but anyone in the same folder can still pull it up on purpose.
+    // Saying so is what keeps the model from treating it as a private vault.
+    const note = entry.visibility === 'secret'
+      ? '（不进提示词、不会自动浮现；同文件夹里主动检索仍可读到，别在正文里复述）'
+      : ''
     lines.push(`   visibility=${entry.visibility}${note}`)
   }
   if (entry.peak === true) lines.push('   peak')
@@ -178,7 +181,7 @@ export function registerTools(ctx) {
       open_loop: { type: 'boolean', description: 'Mark an unfinished promise/task/unsaid thing.' },
       disclosure: { type: 'string', description: 'can_tell, only_if_asked, or never_say.' },
       owner: { type: 'string', description: 'me, us, about_user, or about_project.' },
-      visibility: { type: 'string', description: 'shared, session, or secret.' },
+      visibility: { type: 'string', description: 'shared (default: the whole folder) or secret (kept out of the prompt and out of automatic recall; still readable by an explicit recall from the same folder). Scope a memory to one channel / character / world / branch with the context field instead of trying to hide it.' },
       source: {
         type: 'string',
         description: 'Where this came from: inferred (default — you concluded it), user_said (only when the words are actually theirs and quotable), imagined, or told.',
@@ -292,7 +295,7 @@ export function registerTools(ctx) {
       open_loop: { type: 'boolean' },
       disclosure: { type: 'string', description: 'can_tell, only_if_asked, or never_say. Changing this changes how the memory is phrased when it is injected.' },
       owner: { type: 'string', description: 'me, us, about_user, or about_project.' },
-      visibility: { type: 'string', description: 'shared, session, or secret. session pins it to the conversation that wrote it; secret keeps it out of the prompt entirely (recall only).' },
+      visibility: { type: 'string', description: 'shared or secret. secret keeps it out of the prompt and out of automatic recall; an explicit recall from the same folder can still read it.' },
       confidence: { type: 'number' },
       // Provenance and track are claims about what a memory *is*; both were writable
       // in memory.js and the panel while staying unreachable from the tool surface,

package/lib/visibility.js

@@ -0,0 +1,63 @@
+// Visibility used to have three levels: `shared`, `session` (a lease on the one
+// conversation that wrote it) and `secret`. The session level is gone.
+//
+// It could never answer the question people actually ask — "can the same character in
+// another conversation read this?" — because a lease that dies with its conversation
+// is wrong in both of its states: while that conversation is alive it hides the memory
+// from every other conversation of the same character (breaking continuity), and once
+// the conversation is deleted it falls back to the whole folder (protecting nothing).
+// Anything that has to stay out of another conversation is expressed with `context`
+// (channelId / characterId / worldId / branchId) instead: that survives conversation
+// deletion, and it is the only dimension the reader checks.
+//
+// Stored data from an older version is still read here, so a library that has not been
+// rewritten yet behaves exactly like a migrated one: `session` is read as `shared`, and
+// the entry keeps a marker saying where it came from.
+export const STORED_VISIBILITIES = ['shared', 'secret']
+export const LEGACY_SESSION = 'session'
+
+export function normalizeVisibility(value) {
+  return value === LEGACY_SESSION ? 'shared' : value
+}
+
+export function isLegacySession(entry) {
+  return entry?.visibility === LEGACY_SESSION
+}
+
+// Rewrites one entry in place. The timestamp is recorded so a reader can tell a memory
+// that was always shared from one that inherited its folder during the upgrade.
+export function migrateEntryVisibility(entry, now) {
+  if (!entry || typeof entry !== 'object') return false
+  let changed = false
+  if (isLegacySession(entry)) {
+    entry.visibility = 'shared'
+    entry.migratedFromVisibility = LEGACY_SESSION
+    entry.visibilityMigratedAt = now
+    changed = true
+  }
+  // `sessionId` meant nothing outside the lease it belonged to; older writes also left
+  // `sessionId: null` on ordinary entries. Either way it is a dead pointer, and a later
+  // reader must not mistake it for a live scope.
+  if ('sessionId' in entry) {
+    delete entry.sessionId
+    changed = true
+  }
+  return changed
+}
+
+export function migrateIndexVisibility(index, now = new Date().toISOString()) {
+  const entries = index?.entries
+  if (!entries || typeof entries !== 'object') return 0
+  let migrated = 0
+  for (const entry of Object.values(entries)) if (migrateEntryVisibility(entry, now)) migrated += 1
+  return migrated
+}
+
+// Counted against the raw file, before load-time normalization, so a pass can tell a
+// library that still needs rewriting from one that is already migrated. A leftover
+// `sessionId` counts: it is the same old shape, just without the level that used it.
+export function countLegacyInRaw(raw) {
+  const entries = raw?.entries
+  if (!entries || typeof entries !== 'object') return 0
+  return Object.values(entries).filter((entry) => isLegacySession(entry) || (entry && 'sessionId' in entry)).length
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-memu-memory",
   "icon": "./assets/icon.png",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "面向长篇 RP 与陪伴对话的 DeepSeek Harness 记忆插件：三层记忆、逐轮召回、来源标注、关系图、图片附件与独立 WebUI。",
   "keywords": [
     "deepseek-harness",

package/scripts/migrate-visibility.mjs

@@ -0,0 +1,94 @@
+#!/usr/bin/env node
+// Rewrite libraries that still store the removed `visibility: 'session'` level.
+//
+// Reading never needs this: `loadPrivateIndex` already serves those entries as `shared`
+// (see lib/visibility.js). The script exists for the disk — a library nobody writes to
+// again would otherwise keep the dead level and its `sessionId` forever, and anyone
+// reading the JSON would have to know about a level the code no longer has.
+//
+//   node scripts/migrate-visibility.mjs            # report only
+//   node scripts/migrate-visibility.mjs --apply    # back up, then rewrite
+//
+// Exit codes: 0 nothing to do or already applied, 3 changes found but not applied,
+//             1 the migration itself failed.
+import path from 'node:path'
+import { dataDir } from '../lib/paths.js'
+import * as state from '../lib/state.js'
+import { scanLegacyLibraries, migrateLibraries } from '../lib/migrate.js'
+
+const HELP = `Usage: node scripts/migrate-visibility.mjs [--apply] [--json]
+
+  --apply   rewrite the libraries (takes a backup first)
+  --json    machine-readable report
+  --help    this text
+
+Memories stored as visibility "session" by an older version become "shared" in the folder
+they live in. Their context (channel / character / world / branch) is kept untouched, so
+a memory scoped to one character stays scoped to that character.`
+const argv = process.argv.slice(2)
+if (argv.includes('--help') || argv.includes('-h')) {
+  console.log(HELP)
+  process.exit(0)
+}
+const apply = argv.includes('--apply')
+const json = argv.includes('--json')
+
+function main() {
+  const pending = scanLegacyLibraries()
+  const report = { ok: true, applied: false, dataDir: dataDir(), pending, backup: null, libraries: [] }
+
+  if (pending.length === 0) {
+    report.libraries = migrateLibraries({ dryRun: true })
+    return report
+  }
+  if (apply) {
+    // A rewrite that cannot be undone is not a repair; the same backup the panel's
+    // maintenance button takes, with a manifest the restore path understands.
+    report.backup = state.backupDatabases()
+    report.applied = true
+    report.libraries = migrateLibraries()
+    state.flushState()
+  } else {
+    report.libraries = migrateLibraries({ dryRun: true })
+  }
+  return report
+}
+
+let report
+try {
+  report = main()
+} catch (error) {
+  const failed = { ok: false, error: String(error?.message || error) }
+  if (json) console.log(JSON.stringify(failed, null, 2))
+  else console.error(`migration failed: ${failed.error}`)
+  process.exit(1)
+}
+
+const leftovers = report.libraries.filter((lib) => lib.after > 0)
+if (leftovers.length) report.ok = false
+
+if (json) {
+  console.log(JSON.stringify(report, null, 2))
+} else {
+  console.log(`data: ${report.dataDir}`)
+  if (!report.libraries.length) {
+    console.log('no library stores the removed "session" level.')
+  }
+  for (const lib of report.libraries) {
+    const where = lib.name ? `${lib.libraryId} (${lib.name})` : lib.libraryId
+    if (lib.error) console.log(`  ${where}: FAILED ${lib.error}`)
+    else if (lib.before === 0) console.log(`  ${where}: clean`)
+    else console.log(`  ${where}: ${lib.before} legacy ${plural(lib.before)} -> shared, dead session id removed (context kept)`)
+  }
+  if (report.backup) console.log(`backup: ${path.resolve(report.backup)}`)
+  if (!apply && report.libraries.some((lib) => lib.before > 0)) {
+    console.log('nothing written; re-run with --apply to rewrite (a backup is taken first).')
+  }
+  if (report.ok && report.applied) console.log('done.')
+}
+
+function plural(n) {
+  return n === 1 ? 'memory' : 'memories'
+}
+
+if (!report.ok) process.exit(report.applied ? 1 : 3)