dsh-mnemon 0.2.2 → 0.2.3

package/cordis.patch.yml

@@ -13,5 +13,6 @@
         idleReviewMs: 30000
         tabEnabled: true
         writeEnabled: true
+        remoteAccess: read-only
         timeoutMs: 10000
         defaultRecallLimit: 10

package/lib/index.js

@@ -81,6 +81,7 @@ const Config = z.object({
 	displayMode: z.union(["sidebar", "buildin"]).default("sidebar"),
 	tabEnabled: z.boolean().default(true),
 	writeEnabled: z.boolean().default(true),
+	remoteAccess: z.union(["read-only", "trusted-host"]).default("read-only"),
 	lifecycleEnabled: z.boolean().default(true),
 	recallMode: z.union(["guided", "off"]).default("guided"),
 	writebackMode: z.union(["guided", "off"]).default("guided"),
@@ -226,6 +227,7 @@ function resolveConfig(config = {}) {
 		displayMode: config.displayMode ?? "sidebar",
 		tabEnabled: config.tabEnabled ?? true,
 		writeEnabled: config.writeEnabled ?? true,
+		remoteAccess: config.remoteAccess ?? "read-only",
 		lifecycleEnabled: config.lifecycleEnabled ?? true,
 		recallMode: config.recallMode ?? "guided",
 		writebackMode: config.writebackMode ?? "guided",
@@ -9433,7 +9435,7 @@ function createWriteHandler(input, lifecycle, runtimeMemory, versions) {
 		}
 	};
 }
-/** Backup payloads contain private memory and therefore remain loopback-only. */
+/** Backup payloads contain private memory and use the deployment's management authority. */
 function createPackHandler(input, writeEnabled = true) {
 	return async (endpoint, rawPayload) => {
 		try {
@@ -9452,15 +9454,15 @@ function createPackHandler(input, writeEnabled = true) {
 		}
 	};
 }
-/** Read and activation control are available to trusted Web hosts; all other mutations stay loopback-only. */
-function registerRpc(connection, input, lifecycle, runtimeMemory, storage, packs, versions) {
+/** Reads and activation use trusted hosts; other privileged channels require explicit promotion. */
+function registerRpc(connection, input, lifecycle, runtimeMemory, storage, packs, versions, managementAuthority = "loopback") {
 	const versionManager = versions ?? new VersionUpdateManager({ mnemonCliPath: () => findVersionCli(input) });
 	connection.rpc.handle(MNEMON_READ_CHANNEL, createReadHandler(input, lifecycle, runtimeMemory, storage, versionManager), { authority: "trusted-host" });
 	connection.rpc.handle(MNEMON_ACTIVATION_CHANNEL, createActivationHandler(input), { authority: "trusted-host" });
-	connection.rpc.handle(MNEMON_WRITE_CHANNEL, createWriteHandler(input, lifecycle, runtimeMemory, versionManager), { authority: "loopback" });
+	connection.rpc.handle(MNEMON_WRITE_CHANNEL, createWriteHandler(input, lifecycle, runtimeMemory, versionManager), { authority: managementAuthority });
 	const packManager = isRoutedRuntime(input) ? input : packs;
 	const config = input.config;
-	if (packManager !== void 0) connection.rpc.handle(MNEMON_PACK_CHANNEL, createPackHandler(packManager, () => config.writeEnabled), { authority: "loopback" });
+	if (packManager !== void 0) connection.rpc.handle(MNEMON_PACK_CHANNEL, createPackHandler(packManager, () => config.writeEnabled), { authority: managementAuthority });
 }
 function findVersionCli(input) {
 	return input.config.cliPath;
@@ -9577,8 +9579,8 @@ function createSettingsHandler(settings) {
 		}
 	};
 }
-function registerSettingsRpc(connection, settings) {
-	connection.rpc.handle(MNEMON_SETTINGS_CHANNEL, createSettingsHandler(settings), { authority: "loopback" });
+function registerSettingsRpc(connection, settings, authority = "loopback") {
+	connection.rpc.handle(MNEMON_SETTINGS_CHANNEL, createSettingsHandler(settings), { authority });
 }
 //#endregion
 //#region src/tools.ts
@@ -10284,8 +10286,9 @@ function apply(rawContext, config = {}) {
 	registerRuntimeMemoryContext(ctx, runtime.runtimeMemory);
 	ctx.inject(["connection"], (webContext) => {
 		if (webContext.connection === void 0) return;
-		registerRpc(webContext.connection, runtime, lifecycle);
-		registerSettingsRpc(webContext.connection, ctx.settings);
+		const managementAuthority = resolved.remoteAccess === "trusted-host" ? "trusted-host" : "loopback";
+		registerRpc(webContext.connection, runtime, lifecycle, void 0, void 0, void 0, void 0, managementAuthority);
+		registerSettingsRpc(webContext.connection, ctx.settings, managementAuthority);
 	});
 }
 //#endregion

package/lib/types/contracts.d.ts

@@ -1,10 +1,11 @@
 import type { RpcResult, SettingsOperation } from './shared/contracts.ts';
 export type { ClientConnectionHandle, ClientSettingsScope, ClientSettingsSnapshot, JsonPrimitive, JsonValue, RpcError, RpcResult, SettingsOperation, } from './shared/contracts.ts';
 export type HostRpcHandler = (endpoint: string, payload: unknown) => Promise<RpcResult<unknown>>;
+export type HostRpcAuthority = 'trusted-host' | 'loopback';
 export interface HostConnectionHandle {
     rpc: {
         handle(channel: string, handler: HostRpcHandler, options: {
-            authority: 'trusted-host' | 'loopback';
+            authority: HostRpcAuthority;
         }): unknown;
     };
 }

package/lib/types/rpc.d.ts

@@ -1,4 +1,4 @@
-import type { HostConnectionHandle, HostRpcHandler } from './contracts.ts';
+import type { HostConnectionHandle, HostRpcAuthority, HostRpcHandler } from './contracts.ts';
 import type { MnemonLifecycle } from './lifecycle.ts';
 import type { RuntimeMemoryController } from './runtime-memory.ts';
 import type { MnemonService } from './service.ts';
@@ -16,7 +16,7 @@ export declare function createReadHandler(input: RuntimeInput, lifecycle?: Mnemo
  */
 export declare function createActivationHandler(input: RuntimeInput): HostRpcHandler;
 export declare function createWriteHandler(input: RuntimeInput, lifecycle?: MnemonLifecycle, runtimeMemory?: RuntimeMemoryController, versions?: VersionUpdateManager): HostRpcHandler;
-/** Backup payloads contain private memory and therefore remain loopback-only. */
+/** Backup payloads contain private memory and use the deployment's management authority. */
 export declare function createPackHandler(input: MnemonPackManager | LiveMnemonRuntime, writeEnabled?: boolean | (() => boolean)): HostRpcHandler;
-/** Read and activation control are available to trusted Web hosts; all other mutations stay loopback-only. */
-export declare function registerRpc(connection: HostConnectionHandle, input: RuntimeInput, lifecycle?: MnemonLifecycle, runtimeMemory?: RuntimeMemoryController, storage?: StorageScopeInspector, packs?: MnemonPackManager, versions?: VersionUpdateManager): void;
+/** Reads and activation use trusted hosts; other privileged channels require explicit promotion. */
+export declare function registerRpc(connection: HostConnectionHandle, input: RuntimeInput, lifecycle?: MnemonLifecycle, runtimeMemory?: RuntimeMemoryController, storage?: StorageScopeInspector, packs?: MnemonPackManager, versions?: VersionUpdateManager, managementAuthority?: HostRpcAuthority): void;

package/lib/types/settings.d.ts

@@ -1,4 +1,4 @@
-import type { HostConnectionHandle, HostRpcHandler, HostSettingsService } from './contracts.ts';
+import type { HostConnectionHandle, HostRpcAuthority, HostRpcHandler, HostSettingsService } from './contracts.ts';
 export { MNEMON_SETTINGS_CHANNEL, MNEMON_SETTINGS_NAMESPACE, MNEMON_UI_SETTINGS_NAMESPACE } from './shared/contracts.ts';
 export declare function createSettingsHandler(settings: HostSettingsService): HostRpcHandler;
-export declare function registerSettingsRpc(connection: HostConnectionHandle, settings: HostSettingsService): void;
+export declare function registerSettingsRpc(connection: HostConnectionHandle, settings: HostSettingsService, authority?: HostRpcAuthority): void;

package/lib/types/shared/contracts.d.ts

@@ -81,6 +81,8 @@ export interface Config {
     displayMode?: 'sidebar' | 'buildin';
     tabEnabled?: boolean;
     writeEnabled?: boolean;
+    /** Remote Web policy for privileged Mnemon RPC. This boundary is sampled at Host startup. */
+    remoteAccess?: 'read-only' | 'trusted-host';
     lifecycleEnabled?: boolean;
     recallMode?: 'guided' | 'off';
     writebackMode?: 'guided' | 'off';
@@ -148,6 +150,7 @@ export interface ResolvedConfig {
     displayMode: 'sidebar' | 'buildin';
     tabEnabled: boolean;
     writeEnabled: boolean;
+    remoteAccess: 'read-only' | 'trusted-host';
     lifecycleEnabled: boolean;
     recallMode: 'guided' | 'off';
     writebackMode: 'guided' | 'off';

package/package.json

@@ -1,51 +1,38 @@
 {
   "name": "dsh-mnemon",
-  "version": "0.2.2",
-  "description": "Three-tier memory system for DeepSeek Harness with nine pluggable providers, smart routing, independent task Agents, WebUI, and headless tools.",
+  "version": "0.2.3",
+  "description": "Three-tier memory control plane for DeepSeek Harness: persistent runtime context, searchable project documents, pluggable long-term memory, smart routing, supervised agent workflows, WebUI, and headless tools.",
   "keywords": [
     "deepseek-harness",
     "deepseek-harness-plugin",
-    "dsh",
     "dsh-plugin",
-    "mnemon",
-    "openviking",
-    "honcho",
-    "mem0",
-    "hindsight",
-    "holographic-memory",
-    "retaindb",
-    "byterover",
-    "supermemory",
-    "memory-provider",
-    "memory-system",
-    "memory-plugin",
     "agent-memory",
-    "cross-agent-memory",
-    "shared-agent-memory",
-    "multi-agent-memory",
     "llm-memory",
     "persistent-memory",
     "long-term-memory",
     "runtime-memory",
     "working-memory",
+    "cross-session-memory",
+    "multi-agent-memory",
+    "shared-agent-memory",
+    "memory-orchestration",
+    "memory-provider",
+    "pluggable-memory",
+    "context-management",
     "project-memory",
     "project-documents",
     "document-search",
     "semantic-recall",
-    "memory-space",
-    "workspace-memory",
-    "task-agent",
-    "knowledge-graph",
-    "ai-agent",
-    "llm-agent",
-    "external-memory",
     "local-first",
-    "sqlite",
-    "typescript",
-    "cordis",
-    "web-ui",
-    "headless",
-    "sidebar"
+    "mnemon",
+    "openviking",
+    "honcho",
+    "mem0",
+    "hindsight",
+    "holographic-memory",
+    "retaindb",
+    "byterover",
+    "supermemory"
   ],
   "repository": {
     "type": "git",