dsh-trivium 0.4.13 → 0.4.15

package/README.md

@@ -242,6 +242,8 @@ Off by default. After you turn **Chips (memory whitelist)** on in Settings, the
 
 ## Changelog
 
+**0.4.14** — Storage bump to `triviumdb@0.8.1` (harder WAL/locks, optional read-only share, ARM64 fixes). Four tools / short map / find paths unchanged.
+
 **0.4.13** — Title-bar tab is **Chips** (short); the Settings switch stays **Chips (memory whitelist)**. Toggling the session layer refreshes the Chips tab immediately. Settings / Chips screenshots updated.
 
 **0.4.12** — Git sidecar: workspace `.dsh/trivium.jsonl` is the text source of truth (business nodes and edges). `.tdb` stays the local index. Writes are debounced (~1.5s), no extra model calls. Clone / `git pull` re-imports when the file changed. Switch is **off** by default. **Generate** overwrites jsonl from the current `.tdb`; **Delete jsonl** (switch off) removes known files. Settings folds optional config below Check for updates. Plugin language can follow the host or lock zh/en.
@@ -292,7 +294,7 @@ Local source checkout: `npm install`, then `node scripts/link-dsh.mjs`, then res
 ## Release info
 
 - GitHub: https://github.com/QWQcool/dsh-trivium
-- npm: [`dsh-trivium@0.4.13`](https://www.npmjs.com/package/dsh-trivium)
+- npm: [`dsh-trivium@0.4.14`](https://www.npmjs.com/package/dsh-trivium)
 - Tested host: `@deepseek-ai/dsh@0.1.1-rc.2` (also `0.1.0-rc.8`)
 - License: MIT (depends on [TriviumDB](https://github.com/YoKONCy/TriviumDB), Apache-2.0)
 

package/README.zh-CN.md

@@ -238,6 +238,8 @@ Trivium 是记忆内核，不是日记、日历或聊天伴侣。它按**节点
 
 ## 更新说明
 
+**0.4.14** — 存储升到 `triviumdb@0.8.1`（WAL/锁更硬、可选只读共享、ARM64 修复）。四工具 / 短地图 / find 路径不变。
+
 **0.4.13** — 标题栏只显示 **芯片**；设置里的开关仍叫 **芯片（记忆白名单）**。会话层开关立刻刷新芯片页。设置 / 芯片截图更新。
 
 **0.4.12** — Git 旁路：工作区 `.dsh/trivium.jsonl` 作为文本源（业务节点和边）。`.tdb` 仍是本地索引。写入延迟约 1.5 秒，不额外调模型。clone / `git pull` 后文件变了会导回。开关**默认关**。**生成** 用当前 `.tdb` 覆盖写出 jsonl；关掉后 **删除 jsonl** 会清掉已知文件。设置页把可选项收到「检查更新」下的配置折叠里。界面语言可跟随宿主或锁定中/英。
@@ -288,7 +290,7 @@ Trivium 是记忆内核，不是日记、日历或聊天伴侣。它按**节点
 ## 发布信息
 
 - GitHub: https://github.com/QWQcool/dsh-trivium
-- npm: [`dsh-trivium@0.4.13`](https://www.npmjs.com/package/dsh-trivium)
+- npm: [`dsh-trivium@0.4.14`](https://www.npmjs.com/package/dsh-trivium)
 - 测试宿主：`@deepseek-ai/dsh@0.1.1-rc.2`（兼 `0.1.0-rc.8`）
 - License: MIT（依赖 [TriviumDB](https://github.com/YoKONCy/TriviumDB) 为 Apache-2.0）
 

package/lib/extract.js

@@ -1,4 +1,5 @@
 import { mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { EDGE_LABELS, clip, looksSecret, nowIso } from "./schema.js";
 import { sanitizeForWrite } from "./hygiene.js";
@@ -73,10 +74,10 @@ export function loadPending(cwd) {
   }
 }
 
-export function savePending(cwd, payload) {
+export async function savePending(cwd, payload) {
   const file = pendingPath(cwd);
   mkdirSync(dirname(file), { recursive: true });
-  writeFileSync(
+  await writeFile(
     file,
     JSON.stringify(
       {

package/lib/index.js

@@ -149,14 +149,14 @@ async function runExtract(ctx, { cwd, turns, sessionId, session, agent, log, opt
       llmFailed: result.llmFailed,
     };
     if (result.llmFailed) {
-      savePending(cwd, { sessionId, turns, error: "llm failed" });
+      await savePending(cwd, { sessionId, turns, error: "llm failed" });
     } else {
       clearPending(cwd);
     }
   } catch (err) {
     log.warn?.(`[dsh-trivium] extract skipped: ${err.message}`);
     try {
-      savePending(cwd, { sessionId, turns, error: String(err.message || err) });
+      await savePending(cwd, { sessionId, turns, error: String(err.message || err) });
     } catch {
       // ignore
     }
@@ -192,6 +192,7 @@ function onSessionEvent(session, event) {
     case "tool/result": {
       const callId = event.data?.message?.source?.callId || event.data?.callId;
       const name = buf.calls[callId] || "tool";
+      delete buf.calls[callId];
       const msg = event.data?.message || event.data;
       const content0 = Array.isArray(msg?.content) ? msg.content[0] : null;
       const err = event.data?.error || msg?.error;
@@ -213,7 +214,7 @@ function onSessionEvent(session, event) {
     }
     case "turn/end": {
       if (buf.dirty && buf.cwd && buf.turns.length) {
-        savePending(buf.cwd, { sessionId: buf.sessionId, turns: buf.turns });
+        savePending(buf.cwd, { sessionId: buf.sessionId, turns: buf.turns }).catch(() => {});
       }
       buf.lastTurnEndSeq = event.seq;
       break;
@@ -342,7 +343,12 @@ export function apply(ctx, config = {}) {
           log,
           options: optionsOf(),
           reason: "compaction/end",
-        }).catch((err) => log.warn?.(`[dsh-trivium] compaction extract: ${err.message}`));
+        })
+          .then(() => {
+            buf.dirty = false;
+            buf.turns = [];
+          })
+          .catch((err) => log.warn?.(`[dsh-trivium] compaction extract: ${err.message}`));
         const cwd = buf.cwd || session.header?.cwd;
         const sessionId = buf.sessionId || session.id;
         if (cwd && sessionId && sessionLayerEnabledOf(optionsOf())) {
@@ -404,6 +410,7 @@ export function apply(ctx, config = {}) {
           })
             .then(() => {
               buf.dirty = false;
+              buf.turns = [];
             })
             .catch((err) => log.warn?.(`[dsh-trivium] idle extract: ${err.message}`));
         }, 12000);
@@ -502,7 +509,7 @@ export function apply(ctx, config = {}) {
       clearIdle(sessionKey(session));
       const buf = bufOf(session);
       if (buf.dirty && buf.cwd && buf.turns.length) {
-        savePending(buf.cwd, { sessionId: buf.sessionId, turns: buf.turns });
+        savePending(buf.cwd, { sessionId: buf.sessionId, turns: buf.turns }).catch(() => {});
       }
       buffers.delete(sessionKey(session));
       mapInjected.delete(sessionKey(session));

package/lib/server.js

@@ -1,4 +1,5 @@
 import { existsSync } from "node:fs";
+import { resolve } from "node:path";
 import {
   generateSidecarFromDb,
   archiveNode,
@@ -17,7 +18,7 @@ import {
   updateNode,
 } from "./store.js";
 import { embeddingPublicStatus } from "./embed.js";
-import { chipsEnabledOf, configPanelOpenOf, gitSidecarEnabledOf, pluginLocaleOf, recallModeOf, sessionLayerEnabledOf, writeUiSettings } from "./settings.js";
+import { chipsEnabledOf, configPanelOpenOf, gitSidecarEnabledOf, listedWorkspaces, pluginLocaleOf, recallModeOf, sessionLayerEnabledOf, writeUiSettings } from "./settings.js";
 import { discoverWorkbuddyFiles, discoverExternalFiles, exportMarkdown, importWorkbuddy, importExternal } from "./markdown.js";
 import { checkNpmUpdate, installedVersion } from "./update.js";
 import { writeGateMessage } from "./hygiene.js";
@@ -31,6 +32,26 @@ function isLoopback(req) {
   return ra === "127.0.0.1" || ra === "::1" || ra === "::ffff:127.0.0.1";
 }
 
+function isAllowedOrigin(req) {
+  const origin = req.headers?.origin;
+  if (!origin) return true;
+  try {
+    const u = new URL(origin);
+    const h = u.hostname;
+    return h === "127.0.0.1" || h === "localhost" || h === "::1";
+  } catch {
+    return false;
+  }
+}
+
+function isKnownCwd(cwd) {
+  if (!cwd) return false;
+  const r = resolve(cwd);
+  if (listOpenWorkspaces().some((c) => resolve(c.cwd) === r)) return true;
+  if (listedWorkspaces().some((c) => resolve(c) === r)) return true;
+  return false;
+}
+
 function sendText(res, status, body, contentType) {
   const data = Buffer.from(String(body || ""), "utf8");
   res.writeHead(status, {
@@ -61,8 +82,10 @@ function readBody(req) {
 }
 
 async function dbForRequest(url) {
-  const cwd = url.searchParams.get("cwd") || getActiveCwd();
+  const paramCwd = url.searchParams.get("cwd");
+  const cwd = paramCwd || getActiveCwd();
   if (!cwd) return { cwd: null, db: null };
+  if (paramCwd && !isKnownCwd(cwd)) return { cwd: null, db: null };
   return { cwd, db: await openWorkspaceDb(cwd) };
 }
 
@@ -76,6 +99,12 @@ export function registerMemoryApi(ctx, { liveOptions, status }) {
         res.end("forbidden");
         return;
       }
+      const m = req.method || "GET";
+      if (m !== "GET" && m !== "HEAD" && !isAllowedOrigin(req)) {
+        res.writeHead(403);
+        res.end("forbidden origin");
+        return;
+      }
       try {
         await handle(req, res, { liveOptions, status });
       } catch (err) {
@@ -93,7 +122,8 @@ async function handle(req, res, { liveOptions, status }) {
 
   if (path === "/api/dsh-trivium/status" && method === "GET") {
     const opts = liveOptions();
-    const cwd = url.searchParams.get("cwd") || getActiveCwd();
+    const paramCwd = url.searchParams.get("cwd");
+    const cwd = paramCwd ? (isKnownCwd(paramCwd) ? paramCwd : "") : getActiveCwd();
     let nodeCount = 0;
     let dbPath = cwd ? dbPathFor(cwd) : "";
     if (cwd) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-trivium",
-  "version": "0.4.13",
+  "version": "0.4.15",
   "description": "In-process graph memory for DeepSeek Harness, backed by TriviumDB.",
   "license": "MIT",
   "type": "module",
@@ -55,7 +55,7 @@
     "@deepseek-ai/dsh-tools": ">=0.1.0-rc.8 <0.1.1 || >=0.1.1-rc.2 <0.2.0"
   },
   "dependencies": {
-    "triviumdb": "^0.7.6"
+    "triviumdb": "^0.8.2"
   },
   "keywords": [
     "dsh-plugin",