dsh-trivium 0.4.14 → 0.4.16

package/lib/extract.js

@@ -1,4 +1,5 @@
 import { mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { EDGE_LABELS, clip, looksSecret, nowIso } from "./schema.js";
 import { sanitizeForWrite } from "./hygiene.js";
@@ -73,10 +74,10 @@ export function loadPending(cwd) {
   }
 }
 
-export function savePending(cwd, payload) {
+export async function savePending(cwd, payload) {
   const file = pendingPath(cwd);
   mkdirSync(dirname(file), { recursive: true });
-  writeFileSync(
+  await writeFile(
     file,
     JSON.stringify(
       {

package/lib/index.js

@@ -149,14 +149,14 @@ async function runExtract(ctx, { cwd, turns, sessionId, session, agent, log, opt
       llmFailed: result.llmFailed,
     };
     if (result.llmFailed) {
-      savePending(cwd, { sessionId, turns, error: "llm failed" });
+      await savePending(cwd, { sessionId, turns, error: "llm failed" });
     } else {
       clearPending(cwd);
     }
   } catch (err) {
     log.warn?.(`[dsh-trivium] extract skipped: ${err.message}`);
     try {
-      savePending(cwd, { sessionId, turns, error: String(err.message || err) });
+      await savePending(cwd, { sessionId, turns, error: String(err.message || err) });
     } catch {
       // ignore
     }
@@ -192,6 +192,7 @@ function onSessionEvent(session, event) {
     case "tool/result": {
       const callId = event.data?.message?.source?.callId || event.data?.callId;
       const name = buf.calls[callId] || "tool";
+      delete buf.calls[callId];
       const msg = event.data?.message || event.data;
       const content0 = Array.isArray(msg?.content) ? msg.content[0] : null;
       const err = event.data?.error || msg?.error;
@@ -213,7 +214,7 @@ function onSessionEvent(session, event) {
     }
     case "turn/end": {
       if (buf.dirty && buf.cwd && buf.turns.length) {
-        savePending(buf.cwd, { sessionId: buf.sessionId, turns: buf.turns });
+        savePending(buf.cwd, { sessionId: buf.sessionId, turns: buf.turns }).catch(() => {});
       }
       buf.lastTurnEndSeq = event.seq;
       break;
@@ -342,7 +343,12 @@ export function apply(ctx, config = {}) {
           log,
           options: optionsOf(),
           reason: "compaction/end",
-        }).catch((err) => log.warn?.(`[dsh-trivium] compaction extract: ${err.message}`));
+        })
+          .then(() => {
+            buf.dirty = false;
+            buf.turns = [];
+          })
+          .catch((err) => log.warn?.(`[dsh-trivium] compaction extract: ${err.message}`));
         const cwd = buf.cwd || session.header?.cwd;
         const sessionId = buf.sessionId || session.id;
         if (cwd && sessionId && sessionLayerEnabledOf(optionsOf())) {
@@ -404,6 +410,7 @@ export function apply(ctx, config = {}) {
           })
             .then(() => {
               buf.dirty = false;
+              buf.turns = [];
             })
             .catch((err) => log.warn?.(`[dsh-trivium] idle extract: ${err.message}`));
         }, 12000);
@@ -502,7 +509,7 @@ export function apply(ctx, config = {}) {
       clearIdle(sessionKey(session));
       const buf = bufOf(session);
       if (buf.dirty && buf.cwd && buf.turns.length) {
-        savePending(buf.cwd, { sessionId: buf.sessionId, turns: buf.turns });
+        savePending(buf.cwd, { sessionId: buf.sessionId, turns: buf.turns }).catch(() => {});
       }
       buffers.delete(sessionKey(session));
       mapInjected.delete(sessionKey(session));

package/lib/server.js

@@ -1,4 +1,5 @@
 import { existsSync } from "node:fs";
+import { resolve } from "node:path";
 import {
   generateSidecarFromDb,
   archiveNode,
@@ -17,7 +18,7 @@ import {
   updateNode,
 } from "./store.js";
 import { embeddingPublicStatus } from "./embed.js";
-import { chipsEnabledOf, configPanelOpenOf, gitSidecarEnabledOf, pluginLocaleOf, recallModeOf, sessionLayerEnabledOf, writeUiSettings } from "./settings.js";
+import { chipsEnabledOf, configPanelOpenOf, gitSidecarEnabledOf, listedWorkspaces, pluginLocaleOf, recallModeOf, sessionLayerEnabledOf, writeUiSettings } from "./settings.js";
 import { discoverWorkbuddyFiles, discoverExternalFiles, exportMarkdown, importWorkbuddy, importExternal } from "./markdown.js";
 import { checkNpmUpdate, installedVersion } from "./update.js";
 import { writeGateMessage } from "./hygiene.js";
@@ -31,6 +32,26 @@ function isLoopback(req) {
   return ra === "127.0.0.1" || ra === "::1" || ra === "::ffff:127.0.0.1";
 }
 
+function isAllowedOrigin(req) {
+  const origin = req.headers?.origin;
+  if (!origin) return true;
+  try {
+    const u = new URL(origin);
+    const h = u.hostname;
+    return h === "127.0.0.1" || h === "localhost" || h === "::1";
+  } catch {
+    return false;
+  }
+}
+
+function isKnownCwd(cwd) {
+  if (!cwd) return false;
+  const r = resolve(cwd);
+  if (listOpenWorkspaces().some((c) => resolve(c.cwd) === r)) return true;
+  if (listedWorkspaces().some((c) => resolve(c) === r)) return true;
+  return false;
+}
+
 function sendText(res, status, body, contentType) {
   const data = Buffer.from(String(body || ""), "utf8");
   res.writeHead(status, {
@@ -61,8 +82,10 @@ function readBody(req) {
 }
 
 async function dbForRequest(url) {
-  const cwd = url.searchParams.get("cwd") || getActiveCwd();
+  const paramCwd = url.searchParams.get("cwd");
+  const cwd = paramCwd || getActiveCwd();
   if (!cwd) return { cwd: null, db: null };
+  if (paramCwd && !isKnownCwd(cwd)) return { cwd: null, db: null };
   return { cwd, db: await openWorkspaceDb(cwd) };
 }
 
@@ -76,6 +99,12 @@ export function registerMemoryApi(ctx, { liveOptions, status }) {
         res.end("forbidden");
         return;
       }
+      const m = req.method || "GET";
+      if (m !== "GET" && m !== "HEAD" && !isAllowedOrigin(req)) {
+        res.writeHead(403);
+        res.end("forbidden origin");
+        return;
+      }
       try {
         await handle(req, res, { liveOptions, status });
       } catch (err) {
@@ -93,7 +122,8 @@ async function handle(req, res, { liveOptions, status }) {
 
   if (path === "/api/dsh-trivium/status" && method === "GET") {
     const opts = liveOptions();
-    const cwd = url.searchParams.get("cwd") || getActiveCwd();
+    const paramCwd = url.searchParams.get("cwd");
+    const cwd = paramCwd ? (isKnownCwd(paramCwd) ? paramCwd : "") : getActiveCwd();
     let nodeCount = 0;
     let dbPath = cwd ? dbPathFor(cwd) : "";
     if (cwd) {

package/lib/store.js

@@ -114,7 +114,7 @@ export async function openWorkspaceDb(cwd) {
   if (dbs.has(key)) return dbs.get(key);
   mkdirSync(join(key, ".dsh"), { recursive: true });
   const Engine = loadEngine();
-  const db = new Engine(dbPathFor(key), DIM);
+  const db = new Engine(dbPathFor(key), { dim: DIM });
   try {
     db.createIndex("type");
     db.createIndex("status");
@@ -191,8 +191,10 @@ function normalizeTql(rows) {
   return rows
     .map((row) => {
       const node = row?._ || row?.["*"] || row?.a || Object.values(row || {})[0];
-      if (!node || typeof node.id !== "number") return null;
-      return { id: node.id, payload: node.payload || {} };
+      if (!node) return null;
+      const id = Number(node.id);
+      if (!Number.isFinite(id)) return null;
+      return { id, payload: node.payload || {} };
     })
     .filter(Boolean);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-trivium",
-  "version": "0.4.14",
+  "version": "0.4.16",
   "description": "In-process graph memory for DeepSeek Harness, backed by TriviumDB.",
   "license": "MIT",
   "type": "module",
@@ -55,7 +55,7 @@
     "@deepseek-ai/dsh-tools": ">=0.1.0-rc.8 <0.1.1 || >=0.1.1-rc.2 <0.2.0"
   },
   "dependencies": {
-    "triviumdb": "^0.8.1"
+    "triviumdb": "^0.8.4"
   },
   "keywords": [
     "dsh-plugin",