dsh-memu-memory 1.1.3 → 1.2.0

package/tests/appendix-b2.test.mjs

@@ -0,0 +1,166 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+const home = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-memu-memory-appb2-'))
+process.env.DSH_MEMU_HOME = home
+
+const state = await import('../lib/state.js')
+const memory = await import('../lib/memory.js')
+const inject = await import('../lib/inject.js')
+
+test.after(() => {
+  try { fs.rmSync(home, { recursive: true, force: true }) } catch {}
+})
+
+function execFor(sessionId, cwd) {
+  return { agent: { session: { header: { id: sessionId, cwd, agentPreset: 'coding' } } } }
+}
+
+function setup(name) {
+  const cwd = path.join(home, 'proj-' + name)
+  const sessionId = 'appb2-' + name
+  const binding = state.ensureSession(sessionId, { cwd, agentPreset: 'coding' })
+  return { cwd, sessionId, binding, exec: execFor(sessionId, cwd) }
+}
+
+function daysAgo(n) {
+  return new Date(Date.now() - n * 86_400_000).toISOString()
+}
+
+// ---- 10: negativity bias and self-reference stretch the half-life ----
+
+test('an unpleasant memory fades slower than a neutral one of the same age', () => {
+  const plain = { layer: 'long_term', strength: 1, createdAt: daysAgo(60), moodValence: 0 }
+  const sore = { layer: 'long_term', strength: 1, createdAt: daysAgo(60), moodValence: -0.9 }
+  // Both change how long it lives, never the score today.
+  assert.ok(memory.decayStrength(sore) > memory.decayStrength(plain))
+  assert.ok(memory.negativityBias(plain) === 1, 'a neutral memory gets no bonus')
+  assert.ok(memory.negativityBias(sore) > 1 && memory.negativityBias(sore) <= 1.3)
+  assert.ok(memory.negativityBias({ moodValence: -0.05 }) === 1, 'a trace of displeasure is not a bias')
+})
+
+test('memories about me or us outlive memories about the world', () => {
+  // Kept well inside the 14-day half-life, or the 0.05 floor flattens the difference.
+  const theirs = { layer: 'long_term', strength: 1, createdAt: daysAgo(10), owner: 'them' }
+  const mine = { layer: 'long_term', strength: 1, createdAt: daysAgo(10), owner: 'me' }
+  const ours = { layer: 'long_term', strength: 1, createdAt: daysAgo(10), owner: 'us' }
+  assert.ok(memory.decayStrength(mine) > memory.decayStrength(theirs))
+  assert.ok(memory.decayStrength(ours) > memory.decayStrength(theirs))
+  assert.equal(memory.selfReferenceBias({ owner: 'them' }), 1)
+})
+
+// ---- 11: a pinned memory still fades, and the tip-of-the-tongue effect ----
+
+test('must_remember decays on a one-year half-life but never below the floor', () => {
+  const fresh = { layer: 'must_remember', strength: 1, createdAt: daysAgo(0) }
+  const twoYears = { layer: 'must_remember', strength: 1, createdAt: daysAgo(730) }
+  const tenYears = { layer: 'must_remember', strength: 1, createdAt: daysAgo(3650) }
+  assert.ok(Math.abs(memory.decayStrength(fresh) - 1) < 1e-7)
+  assert.ok(memory.decayStrength(twoYears) < 1, 'permanent stopped meaning verbatim forever')
+  assert.ok(memory.decayStrength(tenYears) >= 0.35, 'the floor keeps a pin from evaporating')
+})
+
+test('tip-of-tongue is about reachability, not importance', () => {
+  assert.equal(memory.isTipOfTongue({ layer: 'must_remember', confidence: 0.1 }), false, 'a pin is never half-remembered')
+  assert.equal(memory.isTipOfTongue({ layer: 'long_term', marginalized: true, confidence: 0.9 }), true)
+  assert.equal(memory.isTipOfTongue({ layer: 'long_term', confidence: 0.3 }), true)
+  assert.equal(memory.isTipOfTongue({ layer: 'long_term', confidence: 0.9, strength: 1, createdAt: daysAgo(1) }), false)
+})
+
+test('injection gives the gist, not the wording, when a memory is half-remembered', async () => {
+  const { sessionId, binding, exec } = setup('tongue')
+  const content = '周四晚上在厨房，他一边擦杯子一边说那句关于不要再改需求的话，说完就把杯子放回架子上，转身去阳台抽了一支烟，很久都没有再开口，客厅的电视一直在放同一档节目。'
+  const saved = await memory.privateRemember({ exec, content, title: '厨房里那句话', confidence: 0.3 })
+  const index = state.loadPrivateIndex(binding.libraryId)
+  index.entries[saved.id].confidence = 0.3
+  state.savePrivateIndex(binding.libraryId, index)
+
+  const out = await inject.buildRecall(binding, '厨房 那句话', 1, { ...state.getSettings(), privateTopK: 3, relevanceThreshold: 0 }, exec, sessionId)
+  assert.ok(out.text.includes('只记得大概'), 'the model is told it only remembers the gist')
+  assert.ok(!out.text.includes('客厅的电视一直在放同一档节目'), 'the exact wording must not be handed over as if quoted')
+  assert.ok(out.text.includes(saved.id), 'the id and the tool are how the original is still reachable')
+})
+
+// ---- 12: fading affect bias ----
+
+test('a bad feeling goes neutral faster than a good one', () => {
+  const grudge = { moodValence: -0.8, updatedAt: daysAgo(60) }
+  const fondness = { moodValence: 0.8, updatedAt: daysAgo(60) }
+  const fadedGrudge = Math.abs(memory.fadedValence(grudge))
+  const fadedFondness = Math.abs(memory.fadedValence(fondness))
+  assert.ok(fadedGrudge < fadedFondness, 'the event stays, the sting fades')
+  assert.ok(fadedGrudge < 0.2)
+  // Fresh memories keep their colour.
+  assert.ok(Math.abs(memory.fadedValence({ moodValence: -0.8, updatedAt: daysAgo(0) }) - -0.8) < 0.05)
+})
+
+// ---- 13: vividness is not accuracy ----
+
+test('high arousal discounts accuracy while leaving confidence alone', () => {
+  const calm = memory.accuracyOf({ peak: false, arousal: 0.2, confidence: 0.9 })
+  assert.equal(calm, 0.9, 'an ordinary memory is as accurate as it is confident')
+  const flash = memory.accuracyOf({ peak: true, arousal: 0.95, confidence: 0.9 })
+  assert.ok(flash < calm, 'a flashbulb memory is vivid, not precise')
+  assert.ok(flash >= 0.2)
+  assert.equal(memory.accuracyOf({ peak: true, arousal: 0.95, confidence: 0.1 }), 0.2, 'the floor is 0.2')
+})
+
+test('a remembered memory stores accuracy next to confidence', async () => {
+  const { exec, binding } = setup('accuracy')
+  const saved = await memory.privateRemember({
+    exec, content: 'The siren woke the whole street at 3am.', title: 'the siren', peak: true, arousal: 0.95, confidence: 0.9,
+  })
+  const entry = state.loadPrivateIndex(binding.libraryId).entries[saved.id]
+  assert.equal(entry.confidence, 0.9)
+  assert.ok(entry.accuracy < entry.confidence)
+})
+
+// ---- 14: contradiction detection inside one library ----
+
+test('a same-title rewrite is queued for review instead of being appended', async () => {
+  const { exec, binding } = setup('conflict-same')
+  const first = await memory.privateRemember({ exec, content: '部署密钥放在 vault 里的 dsh-memu-memory-prod 下面。', title: '部署密钥位置' })
+  const second = await memory.privateRemember({ exec, content: '部署密钥改成放在 1Password 的 ops 保险库里了。', title: '部署密钥位置' })
+  const entry = state.loadPrivateIndex(binding.libraryId).entries[second.id]
+  assert.equal(entry.status, 'pending_review', 'two answers to one question cannot both be active')
+  assert.equal(entry.conflictingWith, first.id)
+  assert.match(entry.reviewReason, /同题/)
+  assert.equal(second.conflict, first.id)
+})
+
+test('a flipped claim is caught even under a different title', async () => {
+  const { exec, binding } = setup('conflict-negation')
+  const first = await memory.privateRemember({ exec, content: 'We always deploy on Friday afternoons.', title: 'deploy window' })
+  const second = await memory.privateRemember({ exec, content: 'We never deploy on Friday afternoons.', title: 'release rule' })
+  const entry = state.loadPrivateIndex(binding.libraryId).entries[second.id]
+  assert.equal(entry.status, 'pending_review')
+  assert.equal(entry.conflictingWith, first.id)
+  assert.match(entry.reviewReason, /相反/)
+})
+
+test('unrelated memories are not flagged', async () => {
+  const { exec, binding } = setup('conflict-clean')
+  await memory.privateRemember({ exec, content: '他喜欢周五下午整理下周计划。', title: '周五习惯' })
+  const other = await memory.privateRemember({ exec, content: 'The kettle in the office kitchen boils slowly.', title: 'the kettle' })
+  const entry = state.loadPrivateIndex(binding.libraryId).entries[other.id]
+  assert.equal(entry.status, 'active', 'a heuristic this loose would bury the queue in noise')
+  assert.equal(other.conflict, null)
+})
+
+test('a claim under review never reaches the prompt or a recall', async () => {
+  const { exec, binding } = setup('pending-hidden')
+  await memory.privateRemember({ exec, content: 'We always deploy on Friday afternoons.', title: 'deploy window' })
+  const second = await memory.privateRemember({ exec, content: 'We never deploy on Friday afternoons.', title: 'deploy window' })
+  assert.equal(second.entry.status, 'pending_review')
+  const anchor = inject.buildAnchor(binding, state.getSettings(), null)
+  // Both halves of a contradiction in one prompt is worse than neither: the model
+  // would pick a side and sound certain about it.
+  assert.ok(!anchor.text.includes('never deploy'), 'a pending entry stays out of the anchor')
+  assert.ok(!anchor.ids.includes(second.id))
+  const recall = await inject.buildRecall(binding, 'deploy on Friday', 3, state.getSettings(), exec, null)
+  assert.ok(!recall.ids.includes(second.id), 'and out of the recall list')
+  assert.ok(!String(recall.text).includes('never deploy'))
+})

package/tests/audit-regression.test.mjs

@@ -0,0 +1,272 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+const home = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-memu-memory-audit-'))
+process.env.DSH_MEMU_HOME = home
+
+const state = await import('../lib/state.js')
+const memory = await import('../lib/memory.js')
+const inject = await import('../lib/inject.js')
+const rpc = await import('../lib/rpc.js')
+const curator = await import('../lib/curator.js')
+const memu = await import('../lib/memu.js')
+
+test.after(() => {
+  try { state.flushState() } catch {}
+  try { fs.rmSync(home, { recursive: true, force: true }) } catch {}
+})
+
+function execFor(sessionId, cwd, agentPreset = 'coding') {
+  return { agent: { session: { header: { id: sessionId, cwd, agentPreset } } } }
+}
+
+function setup(name) {
+  const cwd = path.join(home, 'proj-' + name)
+  const sessionId = 'audit-' + name
+  const binding = state.ensureSession(sessionId, { cwd, agentPreset: 'coding' })
+  return { cwd, sessionId, binding, exec: execFor(sessionId, cwd) }
+}
+
+// ---- §2.2 pending_review must not reach recall / anchor / anniversary / global
+
+test('a held (pending_review) memory never reaches recall, anchor, anniversary, or global recall', async () => {
+  const { exec, binding, sessionId } = setup('pending')
+  await memory.privateRemember({ exec, content: '部署密钥放在 vault。', title: '部署密钥位置' })
+  const held = await memory.privateRemember({ exec, content: '部署密钥改放在 1Password。', title: '部署密钥位置' })
+  assert.equal(held.entry.status, 'pending_review')
+
+  const recalled = await memory.privateRecall({ exec, query: '部署密钥位置', topK: 10, relevanceThreshold: 0 })
+  assert.ok(!recalled.files.some((f) => f.name === held.id), 'held memory must not be recalled')
+
+  const anchor = inject.buildAnchor(binding, state.getSettings(), sessionId)
+  assert.ok(!anchor.text.includes(held.id), 'held memory must not sit in the anchor')
+
+  const md = '01-01'
+  state.updatePrivateIndex(binding.libraryId, (idx) => { idx.entries[held.id].salientDate = md })
+  const anniversary = inject.buildAnniversary(sessionId, binding, new Date(2026, 0, 1))
+  assert.ok(!anniversary.ids.includes(held.id), 'held memory must not surface in anniversaries')
+
+  state.saveGlobalIndex({ entries: { g1: { title: 't', content: '部署密钥改放在 1Password。', domain: 'coding', status: 'pending_review' } } })
+  const global = await memory.globalRecall({ exec, query: '部署密钥', topK: 10, relevanceThreshold: 0 })
+  assert.ok(!global.files.some((f) => f.name === 'g1'), 'held global memory must not be recalled')
+  state.saveGlobalIndex({ entries: {} })
+})
+
+// ---- §2.4 agent backend: accepting a global review must not touch the engine
+
+test('agent backend accepts a global review without the engine', async () => {
+  state.saveGlobalIndex({ entries: { gpend: { title: 'x', content: 'y', domain: 'coding', status: 'pending_review' } } })
+  const out = await rpc.dispatch({}, 'resolveReview', { id: 'gpend', action: 'accept' })
+  assert.equal(out.status, 'active')
+  const index = state.loadGlobalIndex()
+  assert.equal(index.entries.gpend.status, 'active')
+  state.saveGlobalIndex({ entries: {} })
+})
+
+// ---- §2.1 MemU nonzero exit must reject, not crash the host
+
+test('a failing MemU command rejects with MEMU_COMMAND_FAILED (and the process survives)', async () => {
+  fs.mkdirSync(path.join(home, 'engine'), { recursive: true })
+  fs.writeFileSync(path.join(home, 'engine', 'current.json'), JSON.stringify({ python: process.execPath, venv: home }))
+  let error = null
+  try {
+    await memu.retrieve({ query: 'x', db: path.join(home, 'x.sqlite3'), timeoutMs: 15_000 })
+  } catch (e) {
+    error = e
+  }
+  assert.ok(error, 'must reject, not resolve')
+  assert.equal(error.code, 'MEMU_COMMAND_FAILED')
+  fs.rmSync(path.join(home, 'engine'), { recursive: true, force: true })
+})
+
+// ---- §2.7 globalList domain is a real filter
+
+test('globalList({domain}) returns only that domain', async () => {
+  state.saveGlobalIndex({
+    entries: {
+      gd1: { title: 'a', content: 'a', domain: 'coding', status: 'active' },
+      gd2: { title: 'b', content: 'b', domain: 'rp', status: 'active' },
+    },
+  })
+  const { exec, sessionId } = setup('glist')
+  state.setSessionBinding(sessionId, { domainOverride: 'coding' })
+  const out = await memory.globalList({ exec, domain: 'coding' })
+  assert.deepEqual(out.files.map((f) => f.name), ['gd1'])
+  state.saveGlobalIndex({ entries: {} })
+})
+
+// ---- §2.8 backups carry the prompt manifest
+
+test('a backup includes prompts/manifest.json', () => {
+  fs.mkdirSync(path.join(home, 'prompts'), { recursive: true })
+  fs.writeFileSync(path.join(home, 'prompts', 'manifest.json'), '{"version":1}')
+  const dest = state.backupDatabases()
+  assert.ok(fs.existsSync(path.join(dest, 'prompts', 'manifest.json')), 'prompt manifest must be in the backup')
+})
+
+// ---- §2.9 confidence 0 survives
+
+test('confidence: 0 is stored as 0, not coerced to the default', async () => {
+  const { exec, binding } = setup('confzero')
+  const saved = await memory.privateRemember({ exec, content: 'low confidence', title: 'zero', confidence: 0 })
+  const entry = state.loadPrivateIndex(binding.libraryId).entries[saved.id]
+  assert.equal(entry.confidence, 0)
+  const updated = await memory.privateUpdate({ exec, id: saved.id, confidence: 0.35 })
+  assert.equal(updated.entry.confidence, 0.35)
+  const zeroed = await memory.privateUpdate({ exec, id: saved.id, confidence: 0 })
+  assert.equal(zeroed.entry.confidence, 0)
+})
+
+// ---- §2.6 library browser cannot orphan a session-scoped memory
+
+test('the panel refuses the removed session level with an explanation', async () => {
+  const lib = state.createLibrary({ name: 'audit-orphan', cwd: path.join(home, 'ws-orphan') })
+  // Refused by the write path itself now, not by a panel-only guard: a client that kept
+  // the old dropdown must be told what replaced the level, not silently given 'shared'.
+  await assert.rejects(
+    rpc.dispatch({}, 'addMemory', { libraryId: lib.id, content: 'x', visibility: 'session' }),
+    /visibility 'session' was removed/,
+  )
+  const saved = await rpc.dispatch({}, 'addMemory', { libraryId: lib.id, content: 'y', title: 'y' })
+  await assert.rejects(
+    rpc.dispatch({}, 'updateMemory', { libraryId: lib.id, id: saved.id, patch: { visibility: 'session' } }),
+    /visibility 'session' was removed/,
+  )
+  assert.equal(state.loadPrivateIndex(lib.id).entries[saved.id].visibility, 'shared', 'the failed edit changed nothing')
+})
+
+test('addMemory passes pin fields through for must_remember', async () => {
+  const lib = state.createLibrary({ name: 'audit-pin', cwd: path.join(home, 'ws-pin') })
+  const out = await rpc.dispatch({}, 'addMemory', {
+    libraryId: lib.id, content: 'pinned from browser', title: 'pinned',
+    layer: 'must_remember', pinReason: 'user asked to remember', pinSource: 'user_explicit',
+  })
+  assert.equal(out.entry.layer, 'must_remember')
+  assert.equal(out.entry.pinSource, 'user_explicit')
+})
+
+// ---- §2.13 switches constrain tool-level operations
+
+test('a conversation with useLibrary=false cannot read or write private memory', async () => {
+  const { exec, sessionId } = setup('switched-off')
+  await memory.privateRemember({ exec, content: 'before the switch', title: 't' })
+  state.setSessionBinding(sessionId, { useLibrary: false })
+  await assert.rejects(() => memory.privateRecall({ exec, query: 'before the switch' }), /turned off for this conversation/)
+  await assert.rejects(() => memory.privateRemember({ exec, content: 'sneaky', title: 's' }), /turned off for this conversation/)
+  state.setSessionBinding(sessionId, { useLibrary: true })
+})
+
+test('a conversation with useGlobal=false cannot recall global memory', async () => {
+  const { exec, sessionId } = setup('global-off')
+  state.setSessionBinding(sessionId, { useGlobal: false })
+  await assert.rejects(() => memory.globalRecall({ exec, query: 'anything' }), /turned off for this conversation/)
+  state.setSessionBinding(sessionId, { useGlobal: true })
+})
+
+// ---- §2.14 unbound writes are refused, not written to null.json
+
+test('writing with no library binding refuses instead of creating index/null.json', async () => {
+  const cwd = path.join(home, 'proj-unbound')
+  const sessionId = 'audit-unbound'
+  // Bind with both layers off and no library — the "no memory" new-session choice.
+  state.ensureSession(sessionId, { cwd, createLibrary: false })
+  state.setSessionBinding(sessionId, { useLibrary: false, useGlobal: false })
+  const exec = execFor(sessionId, cwd)
+  await assert.rejects(() => memory.privateRemember({ exec, content: 'orphan', title: 'o' }), /no memory library/)
+  assert.ok(!fs.existsSync(path.join(home, 'index', 'null.json')), 'no null.json may appear')
+})
+
+// ---- §2.21 engine downgrade gate
+
+test('engine version comparison treats betas and finals correctly', async () => {
+  const { isVersionDowngrade } = await import('../lib/engine.js')
+  assert.equal(isVersionDowngrade('0.11.0b2', '0.11.0b3'), true)
+  assert.equal(isVersionDowngrade('0.11.0b3', '0.11.0b3'), false)
+  assert.equal(isVersionDowngrade('0.11.0', '0.11.0b3'), false, 'final release is newer than its betas')
+  assert.equal(isVersionDowngrade('0.10.0', '0.11.0'), true)
+  assert.equal(isVersionDowngrade('0.12.0', '0.11.0b3'), false)
+})
+
+// ---- §2.16 a failed state.json read must never write the fallback back
+
+test('a transient state.json read failure does not overwrite real data on recovery', () => {
+  const stateFile = path.join(home, 'state.json')
+  state.flushState()
+  const saved = fs.readFileSync(stateFile, 'utf8')
+  const parsed = JSON.parse(saved)
+  parsed.settings.marker = 'real-data'
+  fs.writeFileSync(stateFile, JSON.stringify(parsed))
+
+  // Make the file unreadable (a directory at its path), then touch bookkeeping.
+  fs.rmSync(stateFile)
+  fs.mkdirSync(stateFile)
+  state.loadState()
+  state.setWorkspacePolicy(path.join(home, 'during-failure'), { useLibrary: false })
+  assert.throws(() => state.flushState(), (error) => error.code === 'dsh-memu-memory/read-failed')
+
+  // Recover: the real file comes back. The next flush must adopt the disk truth,
+  // not the defaults that were cached while reads failed.
+  fs.rmdirSync(stateFile)
+  fs.writeFileSync(stateFile, JSON.stringify(parsed))
+  state.loadState()
+  state.flushState()
+  const after = JSON.parse(fs.readFileSync(stateFile, 'utf8'))
+  assert.equal(after.settings.marker, 'real-data', 'real settings survive the incident')
+  assert.ok(after.workspacePolicies != null, 'workspace policies map still exists')
+})
+
+// ---- §2.15 recall ids match the text that actually got injected
+
+test('buildRecall ids only contain entries present in the (possibly truncated) text', async () => {
+  const { exec, binding, sessionId } = setup('truncate')
+  const long = '内容'.repeat(400)
+  await memory.privateRemember({ exec, content: long, title: '第一条长记忆' })
+  await memory.privateRemember({ exec, content: long, title: '第二条长记忆' })
+  const settings = { ...state.getSettings(), turnTokens: 120, relevanceThreshold: 0, privateTopK: 4, dedupeTurns: 0 }
+  const out = await inject.buildRecall(binding, '长记忆', 1, settings, exec, sessionId)
+  if (out.text) {
+    assert.ok(out.text.includes('</memory-context>'), 'the block must be closed after truncation')
+    for (const id of out.ids) assert.ok(out.text.includes(`[${id}]`), `id ${id} must appear in the text`)
+  }
+})
+
+// ---- §2.17 merge + needs_review must not overwrite the target
+
+test('curator merge with needs_review holds a copy and keeps the original active', async () => {
+  state.saveGlobalIndex({
+    entries: { gtarget: { title: 'original', content: 'original body', domain: 'coding', status: 'active', createdAt: new Date().toISOString() } },
+  })
+  const job = { step: '' }
+  const out = await curator.commitCuratorOutput({
+    memories: [{ op: 'merge', target_id: 'gtarget', title: 'original', content: 'rewritten body', domain: 'coding', needs_review: true }],
+  }, { job })
+  assert.equal(out.pending, 1)
+  const index = state.loadGlobalIndex()
+  assert.equal(index.entries.gtarget.status, 'active')
+  assert.equal(index.entries.gtarget.content, 'original body')
+  const held = Object.values(index.entries).find((e) => e.status === 'pending_review')
+  assert.ok(held, 'the rewrite waits in its own pending row')
+  assert.notEqual(Object.keys(index.entries).find((id) => index.entries[id] === held), 'gtarget')
+  state.saveGlobalIndex({ entries: {} })
+})
+
+// ---- §2.20 the remember tool says when a memory is held for review
+
+test('memu_private_remember reports a held conflict instead of plain success', async () => {
+  const { registerTools } = await import('../lib/tools.js')
+  const registered = []
+  const dispose = registerTools({ tools: { register(t) { registered.push(t); return () => {} } }, logger: { warn() {} } })
+  try {
+    const remember = registered.find((t) => t.name === 'memu_private_remember')
+    const { exec } = setup('conflict-reply')
+    await remember.execute({ content: '周五发布。', title: '发布日' }, exec)
+    const reply = await remember.execute({ content: '改到周四发布。', title: '发布日' }, exec)
+    assert.match(reply, /待复核|pending_review/, 'the reply must say the memory is held for review')
+    assert.doesNotMatch(reply, /^已写入私有记忆/)
+  } finally {
+    dispose()
+  }
+})

package/tests/audit-safety.test.mjs

@@ -0,0 +1,227 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+const home = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-memu-memory-safety-'))
+process.env.DSH_MEMU_HOME = home
+const state = await import('../lib/state.js')
+const memory = await import('../lib/memory.js')
+const inject = await import('../lib/inject.js')
+const rpc = await import('../lib/rpc.js')
+const paths = await import('../lib/paths.js')
+const { readMood } = await import('../lib/mood.js')
+const { estTokens } = await import('../lib/budget.js')
+
+test.after(() => {
+  state.flushState()
+  fs.rmSync(home, { recursive: true, force: true })
+})
+
+function session(name, cwd = path.join(home, name)) {
+  const binding = state.ensureSession(name, { cwd, agentPreset: 'rp' })
+  return { binding, exec: { agent: { session: { header: { id: name, cwd, agentPreset: 'rp' } } } } }
+}
+
+test('a failed atomic replacement never removes the previous file', () => {
+  const file = path.join(home, 'atomic.json')
+  paths.writeJson(file, { old: true })
+  const rename = fs.renameSync
+  fs.renameSync = () => { throw Object.assign(new Error('busy'), { code: 'EBUSY' }) }
+  try { assert.throws(() => paths.writeJson(file, { new: true }), /busy/) } finally { fs.renameSync = rename }
+  assert.deepEqual(JSON.parse(fs.readFileSync(file, 'utf8')), { old: true })
+  assert.ok(!fs.readdirSync(home).some(name => name.includes('.tmp-')))
+  let attempts = 0
+  fs.renameSync = (...args) => {
+    if (++attempts <= 2) throw Object.assign(new Error('temporary Windows handle'), { code: 'EPERM' })
+    return rename(...args)
+  }
+  try { paths.writeJson(file, { recovered: true }) } finally { fs.renameSync = rename }
+  assert.equal(attempts, 3)
+  assert.deepEqual(JSON.parse(fs.readFileSync(file, 'utf8')), { recovered: true })
+})
+
+test('a throwing transaction cannot mutate either the cached or persisted memory', () => {
+  const { binding } = session('mutator')
+  state.updatePrivateIndex(binding.libraryId, index => { index.entries.a = { title: 'original' } })
+  assert.throws(() => state.updatePrivateIndex(binding.libraryId, index => {
+    index.entries.a.title = 'dirty'
+    throw new Error('refused')
+  }), /refused/)
+  assert.equal(state.loadPrivateIndex(binding.libraryId).entries.a.title, 'original')
+  state.clearCaches()
+  assert.equal(state.loadPrivateIndex(binding.libraryId).entries.a.title, 'original')
+})
+
+test('a pending state write merges external fields even when a synchronous save follows', () => {
+  state.flushState()
+  state.updateSettings({ dedupeTurns: 17 })
+  const file = path.join(home, 'state.json')
+  const external = JSON.parse(fs.readFileSync(file))
+  external.settings.globalTopK = 9
+  external.sessions['external-session'] = { libraryId: null, useLibrary: false }
+  fs.writeFileSync(file, JSON.stringify(external, null, 1))
+  state.setSessionBinding('local-session', { useGlobal: false })
+  state.saveState(state.loadState())
+  const saved = JSON.parse(fs.readFileSync(file))
+  assert.equal(saved.settings.dedupeTurns, 17)
+  assert.equal(saved.settings.globalTopK, 9)
+  assert.ok(saved.sessions['external-session'])
+  assert.ok(saved.sessions['local-session'])
+})
+
+test('state flush preserves disk-only bindings even if the cached fingerprint matches', () => {
+  state.flushState()
+  const file = path.join(home, 'state.json')
+  const external = JSON.parse(fs.readFileSync(file))
+  external.sessions['fingerprint-collision'] = { useGlobal: false }
+  const read = fs.readFileSync
+  let raced = false
+  state.clearCaches()
+  fs.readFileSync = (...args) => {
+    const result = read(...args)
+    if (String(args[0]) === file && !raced) {
+      raced = true
+      fs.writeFileSync(file, JSON.stringify(external))
+    }
+    return result
+  }
+  try { state.loadState() } finally { fs.readFileSync = read }
+  state.updateSettings({ dedupeTurns: 18 })
+  state.flushState()
+  assert.ok(raced)
+  assert.ok(JSON.parse(fs.readFileSync(file)).sessions['fingerprint-collision'])
+})
+
+test('a compact follow-up query includes only recent real user context', () => {
+  const previous = { role: 'user', source: { kind: 'user' }, content: [{ type: 'text', text: '周五去车站找小周。' }] }
+  const injection = { role: 'user', source: { kind: 'plugin:dsh-memu-memory' }, content: [{ type: 'text', text: 'do not use plugin text' }] }
+  const current = { role: 'user', source: { kind: 'user' }, content: [{ type: 'text', text: '她呢？' }] }
+  const query = inject.contextualQuery([previous, injection, current], current)
+  assert.ok(query.includes('小周'))
+  assert.ok(!query.includes('plugin'))
+})
+
+test('disjoint stale snapshots merge, but an older edit to the same entry is refused', () => {
+  const { binding } = session('snapshots')
+  state.savePrivateIndex(binding.libraryId, { entries: { a: { title: 'a' }, b: { title: 'b' } } })
+  const first = state.loadPrivateIndex(binding.libraryId)
+  const second = state.loadPrivateIndex(binding.libraryId)
+  first.entries.a.title = 'new a'
+  state.savePrivateIndex(binding.libraryId, first)
+  second.entries.b.title = 'new b'
+  state.savePrivateIndex(binding.libraryId, second)
+  assert.equal(state.loadPrivateIndex(binding.libraryId).entries.a.title, 'new a')
+  second.entries.a.title = 'stale a'
+  assert.throws(() => state.savePrivateIndex(binding.libraryId, second), /changed concurrently/)
+  assert.equal(state.loadPrivateIndex(binding.libraryId).entries.a.title, 'new a')
+})
+
+test('a Chinese body larger than the turn budget still supplies a closed context and its actual id', async () => {
+  const { exec, binding } = session('budget')
+  const saved = await memory.privateRemember({ exec, title: '月光', content: '月光映着杯子。'.repeat(120), source: 'imagined' })
+  const result = await inject.buildRecall(binding, '月光杯子', 2, { ...state.getSettings(), turnTokens: 640 }, exec)
+  assert.deepEqual(result.ids, [saved.id])
+  assert.ok(result.text.includes('source=imagined'))
+  assert.ok(result.text.endsWith('</memory-context>'))
+  assert.ok(estTokens(result.text) <= 640)
+  assert.equal(state.loadPrivateIndex(binding.libraryId).entries[saved.id].accessCount, 0, 'automatic candidate lookup does not reinforce unseen text')
+})
+
+test('secrets require an explicit recall and never appear in automatic recall', async () => {
+  const { exec, binding } = session('secret')
+  const saved = await memory.privateRemember({ exec, title: '藏钥匙', content: '钥匙在绿色花盆下。', visibility: 'secret' })
+  assert.deepEqual((await memory.privateRecall({ exec, query: '钥匙', purpose: 'automatic' })).files, [])
+  assert.ok(!(await inject.buildRecall(binding, '钥匙', 2, state.getSettings(), exec)).text.includes(saved.id))
+  assert.equal((await memory.privateRecall({ exec, query: saved.id })).files[0].name, saved.id)
+})
+
+test('lists and edits enforce the context boundary even with an explicit library id', async () => {
+  const a = session('owner-a')
+  const b = session('owner-b', path.join(home, 'owner-a'))
+  // Both conversations live in the same folder (one library); what separates them is the
+  // scope, which is the only thing left that can separate them.
+  state.setSessionBinding('owner-a', { memoryContext: { characterId: 'hero' } })
+  state.setSessionBinding('owner-b', { memoryContext: { characterId: 'villain' } })
+  const saved = await memory.privateRemember({ exec: a.exec, title: '独处', content: '只属于英雄线的片段。' })
+  assert.equal((await memory.privateList({ exec: b.exec })).files.length, 0)
+  await assert.rejects(memory.privateUpdate({ exec: b.exec, libraryId: a.binding.libraryId, id: saved.id, visibility: 'secret' }), /not visible/)
+  assert.equal(state.loadPrivateIndex(a.binding.libraryId).entries[saved.id].visibility, 'shared', 'an out-of-scope edit changes nothing')
+  state.setSessionBinding('owner-b', { useLibrary: false })
+  await assert.rejects(memory.privateList({ exec: b.exec }), /turned off/)
+})
+
+test('a read on an unbound conversation does not silently create a library', async () => {
+  const before = state.listLibrariesAll().length
+  const exec = { agent: { session: { header: { id: 'never-bound', cwd: path.join(home, 'new') } } } }
+  await assert.rejects(memory.privateList({ exec }), /no bound session/)
+  assert.equal(state.listLibrariesAll().length, before)
+})
+
+test('review acceptance replaces the old private fact in the same write and keeps its history', async () => {
+  const { exec, binding } = session('review')
+  const old = await memory.privateRemember({ exec, title: '会面地点', content: '明天在学校门口见面。' })
+  const next = await memory.privateRemember({ exec, title: '会面地点', content: '明天改在市中心图书馆见面。' })
+  await assert.rejects(memory.privateUpdate({ exec, id: next.id, status: 'active' }), /require review/)
+  await rpc.dispatch({}, 'resolveReview', { libraryId: binding.libraryId, id: next.id, action: 'accept' })
+  const index = state.loadPrivateIndex(binding.libraryId)
+  assert.equal(index.entries[old.id].status, 'superseded')
+  assert.equal(index.entries[old.id].content, old.entry.content)
+  assert.equal(index.entries[old.id].validTo, index.entries[next.id].validFrom)
+  const recalled = await memory.privateRecall({ exec, query: '会面地点', topK: 10, relevanceThreshold: 0 })
+  assert.deepEqual(recalled.files.map(file => file.name), [next.id])
+})
+
+test('review coexistence needs conditions, and global acceptance retires the conflicting fact', async () => {
+  state.saveGlobalIndex({ entries: {
+    old: { title: 'old', content: 'old', status: 'active', domain: 'coding' },
+    next: { title: 'new', content: 'new', status: 'pending_review', domain: 'coding', conflictingWith: 'old' },
+  } })
+  await assert.rejects(rpc.dispatch({}, 'resolveReview', { id: 'next', action: 'accept', resolution: 'coexist' }), /needs a reason/)
+  await rpc.dispatch({}, 'resolveReview', { id: 'next', action: 'accept' })
+  assert.equal(state.loadGlobalIndex().entries.old.status, 'superseded')
+  state.saveGlobalIndex({ entries: {} })
+})
+
+test('global list obeys switches, status and conversation domain', async () => {
+  const { exec } = session('global-gate')
+  state.setSessionBinding('global-gate', { domain: 'rp' })
+  state.saveGlobalIndex({ entries: {
+    coding: { title: 'coding', domain: 'coding', status: 'active' },
+    rp: { title: 'rp', domain: 'rp', status: 'active' },
+    held: { title: 'held', domain: 'rp', status: 'pending_review' },
+  } })
+  assert.deepEqual((await memory.globalList({ exec })).files.map(file => file.name), ['rp'])
+  state.setSessionBinding('global-gate', { useGlobal: false })
+  await assert.rejects(memory.globalList({ exec }), /turned off/)
+  state.saveGlobalIndex({ entries: {} })
+})
+
+test('anniversaries do not revive superseded or overdue drafts', () => {
+  const { binding } = session('anniversary')
+  state.savePrivateIndex(binding.libraryId, { entries: {
+    old: { title: 'old', salientDate: '10-28', status: 'superseded' },
+    due: { title: 'due', salientDate: '10-28', status: 'active', expiresAt: '2026-10-27T00:00:00Z' },
+  } })
+  assert.deepEqual(inject.buildAnniversary('anniversary', binding, new Date(2026, 9, 28)).ids, [])
+})
+
+test('Chinese negation does not turn sadness into a happy retrieval lens', () => {
+  assert.ok(readMood('我今天不开心').valence < 0)
+  assert.ok(readMood('我并不高兴').valence <= 0)
+  assert.ok(readMood('他说“开心极了”，但我没有这种感觉。').valence <= 0)
+})
+
+test('domestic texture is once per day and band, and disabled for coding', () => {
+  session('texture')
+  const random = Math.random
+  Math.random = () => 1
+  try {
+    assert.ok(inject.maybeTexture('texture', { habitsInjection: true }, new Date(2026, 9, 27, 10)))
+    assert.equal(inject.maybeTexture('texture', { habitsInjection: true }, new Date(2026, 9, 27, 10)), null)
+    assert.ok(inject.maybeTexture('texture', { habitsInjection: true }, new Date(2026, 9, 28, 10)))
+    state.setSessionBinding('texture', { domainOverride: 'coding' })
+    assert.equal(inject.maybeTexture('texture', { habitsInjection: true }, new Date(2026, 9, 29, 10)), null)
+  } finally { Math.random = random }
+})