memory-eternal 0.10.51 → 0.10.53

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "memory-eternal",
-  "version": "0.10.51",
+  "version": "0.10.53",
   "description": "记忆核心（Memory Eternal）：对话结束后自动沉淀知识卡到本地记忆库（~/.dsh/memory-vault），支持检索 / 召回 / 审核中心。",
   "author": {
     "name": "EternalNight996",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "memory-eternal",
-  "version": "0.10.51",
+  "version": "0.10.53",
   "description": "记忆核心（Memory Eternal）：对话结束后自动沉淀知识卡到本地记忆库（~/.dsh/memory-vault），支持检索 / 召回 / 审核中心。",
   "author": {
     "name": "EternalNight996",

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "memory-eternal",
-  "version": "0.10.51",
+  "version": "0.10.53",
   "description": "记忆核心（Memory Eternal）：对话结束后自动沉淀知识卡到本地记忆库（~/.dsh/memory-vault），支持检索 / 召回 / 审核中心。",
   "author": {
     "name": "EternalNight996",

package/README.en.md

@@ -361,14 +361,16 @@ curl http://127.0.0.1:7999/memory-eternal/api/web-info    # is the standalone we
 
 | Version | Date | Highlights |
 |---|---|---|
-| **v0.10.51** | 2026-10-19 | **One-command diagnostic bundle: dsh-memory support** (reliability line; in #47 the user-pasted context was truncated by GitHub so I could not see the full picture — this exists for exactly that kind of exchange). A single command produces a **zip** with meta (version matrix / platform / node / vault), doctor, align, status, the watchdog lock, the host heartbeat, the shared config, the tail of the capture log (200 lines by default) and a README; everything is **redacted before writing** (home directory to <home>, sk-/ghp_/github_pat/Bearer and key-like config fields to ***). Implemented with **no dependencies**: a hand-written store/deflate ZIP writer (lib/zip.js) whose output opens in Windows Explorer (verified by extracting with Expand-Archive). In restricted environments --no-spawn skips the sub-processes, while --out and --tail N control destination and log length. Adds tests/support-bundle.test.mjs (redaction, zip structure, no plaintext secrets inside the bundle, CLI wiring). npm test now runs **433 checks** |
-| **v0.10.50** | 2026-10-19 | **Models that ignore JSON no longer burn a call every turn (a follow-up to #47)**. ① "The model replied with prose and produced no JSON object at all" is now separated from the generic UNPARSEABLE_OUTPUT failure and gets its own code **MODEL_NOT_JSON**, with wording that says the model likely does not follow structured output. ② New `lib/model-strikes.js` records which provider/model recently ignored the format (24h window, at most 50 entries) and the host moves those to the end of the candidate list when routing (never removing them; if every candidate was struck the original order is kept, so we never run out), logging a "candidates reordered" line. ③ Effect: models such as stepfun/step-api, which answer distillation prompts conversationally, stop being tried first from the second turn on, saving a pointless call each time. Adds `tests/model-strikes.test.mjs` (prose detection, stable ranking, record window and trimming, wiring guards). npm test now runs **429 checks** |
+| **v0.10.53** | 2026-10-20 | **Health panel (reliability line): all previously invisible state in one place**. A new "Health" card at the top of the usage page shows: ① **database** (journal mode, writability, last health check, with doctor guidance when bad); ② **backups** (count and age of the newest, amber past 7 days, red at zero); ③ **auto capture** (last success/failure with reason); ④ **versions** (disk / resident / host, plus a Start check button because align needs the npm registry and cannot run automatically). Data comes from existing endpoints: /overview now includes a **backups summary** (count/newestAt/last five filenames) alongside /capture-log and /align. Also **fixes a white-screen bug**: the card initially used tf(), which only exists in the ConfigPanel scope, so opening the usage page blanked the whole app; the panel checker gained two gates — **page alive (textLen<20 counts as blank)** and **Runtime.exceptionThrown capture** — because a blank page previously passed the overflow assertions. Adds tests/health-panel.test.mjs (4 checks). npm test now runs **437 checks** |
+| **v0.10.52** | 2026-10-19 | **Redaction hole in the diagnostic bundle (privacy fix; upgrade recommended)**. The 0.10.51 one-command bundle had a gap: the home directory appears in **JSON-escaped form** (C:\\Users\\x) inside doctor/align --json output and meta.json, while only the plain and forward-slash variants were replaced, so the bundle could still be grepped for the home path. All three variants (plain, forward slash, JSON escaped) now become <home>, with a test assert added for the escaped form; a freshly generated bundle on this machine verifies as **no home path and no sk- keys**. If you already generated and shared a bundle with 0.10.51, please regenerate it before sharing. npm test now runs **433 checks** |
 
 <details>
-<summary>Older release notes (v0.10.49 and earlier · 76 releases, click to expand)</summary>
+<summary>Older release notes (v0.10.51 and earlier · 78 releases, click to expand)</summary>
 
 | Version | Date | Highlights |
 |---|---|---|
+| **v0.10.51** | 2026-10-19 | **One-command diagnostic bundle: dsh-memory support** (reliability line; in #47 the user-pasted context was truncated by GitHub so I could not see the full picture — this exists for exactly that kind of exchange). A single command produces a **zip** with meta (version matrix / platform / node / vault), doctor, align, status, the watchdog lock, the host heartbeat, the shared config, the tail of the capture log (200 lines by default) and a README; everything is **redacted before writing** (home directory to <home>, sk-/ghp_/github_pat/Bearer and key-like config fields to ***). Implemented with **no dependencies**: a hand-written store/deflate ZIP writer (lib/zip.js) whose output opens in Windows Explorer (verified by extracting with Expand-Archive). In restricted environments --no-spawn skips the sub-processes, while --out and --tail N control destination and log length. Adds tests/support-bundle.test.mjs (redaction, zip structure, no plaintext secrets inside the bundle, CLI wiring). npm test now runs **433 checks** |
+| **v0.10.50** | 2026-10-19 | **Models that ignore JSON no longer burn a call every turn (a follow-up to #47)**. ① "The model replied with prose and produced no JSON object at all" is now separated from the generic UNPARSEABLE_OUTPUT failure and gets its own code **MODEL_NOT_JSON**, with wording that says the model likely does not follow structured output. ② New `lib/model-strikes.js` records which provider/model recently ignored the format (24h window, at most 50 entries) and the host moves those to the end of the candidate list when routing (never removing them; if every candidate was struck the original order is kept, so we never run out), logging a "candidates reordered" line. ③ Effect: models such as stepfun/step-api, which answer distillation prompts conversationally, stop being tried first from the second turn on, saving a pointless call each time. Adds `tests/model-strikes.test.mjs` (prose detection, stable ranking, record window and trimming, wiring guards). npm test now runs **429 checks** |
 | **v0.10.49** | 2026-10-19 | **Fixes "cannot choose the distillation model" in the desktop app (#47): the standalone page now proxies /llm-routes and /llm-test to the host, plus one more state in the matrix**. Root cause: the desktop memory popup is a **standalone page inside an iframe** with no DSH llm service, so /llm-routes always failed and provider/model had to be typed by hand. The standalone page now reads the host heartbeat (the port in <config>.host.json, 127.0.0.1 only, valid for 120s) and forwards those two routes to the host, marking the reply as proxied; when the host is offline the panel shows the concrete reason instead of silently falling back to text inputs. ② The version-card matrix gains restartRepair: when versions already match but nothing keeps the instance alive it says "re-register and keep it alive", no longer the self-contradictory "switch to v0.10.48 (currently v0.10.48)". npm test now runs **425 checks** |
 | **v0.10.48** | 2026-10-19 | **A visual gate plus exhaustive state coverage (the option we agreed on)**. ① **New `npm run panel-check`** (scripts/panel-check.mjs, zero dependencies): drives local headless Chrome over CDP, asserts **no horizontal overflow** on each screen and saves screenshots (list / reader / config / feedback modal). On its very first run it caught two real bugs: an unbreakable long run in a card title (`(begin/chunk/probe/complete/abort)`) overflowing by 45px, and the **feedback textarea overflowing by 22px** (width:100% plus padding under content-box) — exactly the layout/scrollbar anomaly reported. ② Fixes: word-breaking on `.mc-cardrow h4` and a shared border-box rule for form controls. ③ **The version-card decision is now a pure function** `src/client/version-state.js`: versionCardState returns {showButton, emphasis, warn, hint} and the component only maps keys to text; a table-driven test **enumerates 324 combinations** and enforces the invariant that the button is shown whenever version info exists — structurally preventing the 0.10.45 regression where a third state made it disappear. npm test now runs **420 checks** |
 | **v0.10.47** | 2026-10-19 | **The panel version probe now refreshes itself, and the "resident not running" wording is fixed (user report: the panel kept saying "resident instance: not running" after a restart)**. ① The instance was in fact alive (status showed 7999 listening and serving v0.10.46), but the probe ran only once when the panel mounted, so a run that happened to land inside the restart window was cached as "not running" and stuck. It now **re-checks silently every 60 seconds** (without lighting up the Check-for-updates button) and **immediately when the tab becomes visible** (visibilitychange); a restart already triggers a re-check six seconds later. ② When the resident really is down, the hint used to interpolate an empty "currently v"; it now uses vcRestartStart: "Starts the resident instance on the current disk version v{disk} (no DSH restart needed)". npm test now runs **408 checks** |

package/README.md

@@ -393,14 +393,16 @@ curl http://127.0.0.1:7999/memory-eternal/api/web-info    # 独立 web 是否活
 
 | 版本 | 日期 | 关键改动 |
 |---|---|---|
-| **v0.10.51** | 2026-10-19 | **一键诊断包 dsh-memory support**（可靠性线；#47 里用户贴的现场被 GitHub 截断，我拿不到完整信息，这功能就是为这类沟通做的）。一条命令生成 **zip**：meta（版本矩阵/平台/node/vault）/ doctor / align / status / 看门狗锁 / 宿主心跳 / 共享配置 / 沉淀日志尾巴（默认 200 行）+ README；写入前**统一脱敏**（家目录→<home>，sk-/ghp_/github_pat/Bearer/配置里 key 类字段→***）。实现为**零依赖**：自写 store/deflate ZIP 写入器（lib/zip.js，Windows 资源管理器可直接打开，实测 Expand-Archive 解压正常）。受限环境可加 --no-spawn 跳过子进程；--out 指定输出、--tail N 控制日志条数。新增 tests/support-bundle.test.mjs（4 项：脱敏、zip 结构、包内不含明文密钥、CLI 接线）。npm test 共 **433 项** |
-| **v0.10.50** | 2026-10-19 | **「模型不守 JSON」不再每轮白烧调用（#47 衍生改进）**。① 把「模型回了散文、输出里根本没有 JSON 对象」从笼统的 UNPARSEABLE_OUTPUT 里拆出来，给独立错误码 **MODEL_NOT_JSON**，文案直接说清「该模型可能不遵守结构化输出」。② 新增 `lib/model-strikes.js`：记下「哪个 provider/model 最近不守格式」（24h 窗口、最多 50 条），宿主选路时把它们**排到候选末尾**（不删除；全部命中过则按原顺序兜底，绝不没候选），并留一条「蒸馏候选已调整」日志。③ 效果：像 stepfun/step-api 这种会把蒸馏当聊天回的模型，第二轮起就不再优先尝试，省掉每次的无效调用。新增 `tests/model-strikes.test.mjs`（4 项：散文识别 / 排序稳定性 / 记录窗口与裁剪 / 接线守卫）。npm test 共 **429 项** |
+| **v0.10.53** | 2026-10-20 | **健康面板（可靠性线）：把看不见的状态集中一处**。在「用量/今日」顶部新增「🩺 健康概览」：① **知识库**（journal 模式 / 可写 / 最后一次体检时间，异常时给 doctor 指引）；② **备份**（数量 + 最近一次多久前，>7 天标黄、0 备份标红）；③ **自动沉淀**（最近一次成功/失败与原因）；④ **版本**（磁盘 / 常驻 / 宿主；未检查时给「开始检查」按钮，因为 align 要联网比 npm 不能自动跑）。数据来自既有接口：/overview 新增 **backups 摘要**（count/newestAt/最近 5 个文件名），加上 /capture-log 与 /align。**顺带修一个白屏 bug**：健康卡最初误用了 ConfigPanel 作用域的 tf() → 点开「用量/今日」整页白屏；同时给 panel-check 补了两道闸 —— **页面存活（textLen<20 判空白页）** 与 **Runtime.exceptionThrown 捕获**，因为「白屏没有横向溢出」原本会让检查通过。新增 tests/health-panel.test.mjs（4 项）。npm test 共 **437 项** |
+| **v0.10.52** | 2026-10-19 | **诊断包脱敏补漏（隐私修复，建议尽快升级）**。0.10.51 的「一键诊断包」有个漏点：doctor/align --json 与 meta.json 里的家目录是 **JSON 转义形态**（C:\\Users\\x），而我只替换了原样/正斜杠两种写法 → 包里仍能 grep 到家目录明文。现在三种写法（原样、正斜杠、JSON 转义）都替换成 <home>，并在测试里加了一条「JSON 转义形态不能漏」的断言；本机重新生成诊断包实测：**无家目录明文、无 sk- 密钥**。**如果你已经用 0.10.51 生成过诊断包并分享出去，建议重新生成一次再分享。** npm test 共 **433 项** |
 
 <details>
-<summary>更早的更新日志（v0.10.49 及以前 · 共 76 版，点开查看）</summary>
+<summary>更早的更新日志（v0.10.51 及以前 · 共 78 版，点开查看）</summary>
 
 | 版本 | 日期 | 关键改动 |
 |---|---|---|
+| **v0.10.51** | 2026-10-19 | **一键诊断包 dsh-memory support**（可靠性线；#47 里用户贴的现场被 GitHub 截断，我拿不到完整信息，这功能就是为这类沟通做的）。一条命令生成 **zip**：meta（版本矩阵/平台/node/vault）/ doctor / align / status / 看门狗锁 / 宿主心跳 / 共享配置 / 沉淀日志尾巴（默认 200 行）+ README；写入前**统一脱敏**（家目录→<home>，sk-/ghp_/github_pat/Bearer/配置里 key 类字段→***）。实现为**零依赖**：自写 store/deflate ZIP 写入器（lib/zip.js，Windows 资源管理器可直接打开，实测 Expand-Archive 解压正常）。受限环境可加 --no-spawn 跳过子进程；--out 指定输出、--tail N 控制日志条数。新增 tests/support-bundle.test.mjs（4 项：脱敏、zip 结构、包内不含明文密钥、CLI 接线）。npm test 共 **433 项** |
+| **v0.10.50** | 2026-10-19 | **「模型不守 JSON」不再每轮白烧调用（#47 衍生改进）**。① 把「模型回了散文、输出里根本没有 JSON 对象」从笼统的 UNPARSEABLE_OUTPUT 里拆出来，给独立错误码 **MODEL_NOT_JSON**，文案直接说清「该模型可能不遵守结构化输出」。② 新增 `lib/model-strikes.js`：记下「哪个 provider/model 最近不守格式」（24h 窗口、最多 50 条），宿主选路时把它们**排到候选末尾**（不删除；全部命中过则按原顺序兜底，绝不没候选），并留一条「蒸馏候选已调整」日志。③ 效果：像 stepfun/step-api 这种会把蒸馏当聊天回的模型，第二轮起就不再优先尝试，省掉每次的无效调用。新增 `tests/model-strikes.test.mjs`（4 项：散文识别 / 排序稳定性 / 记录窗口与裁剪 / 接线守卫）。npm test 共 **429 项** |
 | **v0.10.49** | 2026-10-19 | **桌面版里「无法选择蒸馏模型」修复（#47）：独立页把 /llm-routes 与 /llm-test 代理给宿主 + 文案补一个状态**。根因：桌面版的「记忆」弹窗是 iframe 里的**独立页**，它没有 DSH 的 llm 服务 → /llm-routes 恒失败 → provider/model 只能手填。现在独立页读宿主心跳（<config>.host.json 里的端口，仅 127.0.0.1、心跳 120s 内有效），把这两个路由**转发给宿主**执行并标记 proxied；宿主不在线时给明确原因（面板直接显示，不再静默回退成手填）。② 版本卡状态矩阵补 restartRepair：**版本已对但没人保活**时提示「重新托管并保活」，不再出现「换成 v0.10.48（当前 v0.10.48）」这种自相矛盾的文案（截图实测）。npm test 共 **425 项** |
 | **v0.10.48** | 2026-10-19 | **界面验收手段 + 状态穷举（方案一落地）**。① **新增 `npm run panel-check`**（scripts/panel-check.mjs，零依赖）：用本机 Chrome headless + CDP 打开面板，逐屏断言**没有横向溢出**并截图（列表 / 阅读器 / 配置 / 反馈弹窗）。它第一次跑就抓到两个真 bug：卡片标题里的无断点长串（`（begin/chunk/probe/complete/abort）`）溢出 45px；**反馈弹窗 textarea 溢出 22px**（width:100% + padding 在 content-box 下）—— 正是用户报的「排版不对 / 滚动条异常」。② 修复：`.mc-cardrow h4` 断词、`.me-overlay input/textarea/select` 统一 border-box。③ **版本卡判定抽成纯函数** `src/client/version-state.js`：`versionCardState(...)` 返回 `{showButton, emphasis, warn, hint}`，组件只做 key→文案；新增表驱动测试**穷举 324 种组合**，并守住不变式「只要拿到版本信息，按钮永远显示」—— 0.10.45「第三种状态导致按钮消失」从结构上不可能再发生。npm test 共 **420 项** |
 | **v0.10.47** | 2026-10-19 | **面板版本探针自动复查 + 「常驻未运行」文案修正（用户反馈：重启后面板一直显示「常驻实例 未运行」）**。① 现场其实**是活的**（status 显示 7999 在听、服务 v0.10.46），但版本探针只在面板挂载时跑一次 —— 恰好撞上重启窗口就会被缓存成「未运行」并一直显示。现在**每 60 秒静默复查**（不点亮「检查更新」按钮）+ **切回页面立刻复查**（visibilitychange），重启后 6 秒本来就会复查一次。② 文案：常驻实例真没跑时，原来那句会拼出「当前 v」（空值）；现在改走 vcRestartStart：**「点击会用当前磁盘版本 v{disk} 把常驻实例拉起来（不用重启 DSH）」**。npm test 共 **408 项** |

package/lib/api.js

@@ -13,7 +13,8 @@
 
 import { gzipSync, brotliCompressSync, constants as zlibConstants } from 'node:zlib'
 import os from 'node:os'
-import { readFileSync } from 'node:fs'
+import fs, { readFileSync } from 'node:fs'
+import path from 'node:path'
 import { listCards, countCards, readCard, search, searchAll, graph, graphAll, overview, exportCards, deleteCard, writeCard, parseCard, stats, optimizeCandidates, optimizeApply, addFeedback, dailyCounts, mergeCards, ensureVault, auditQueue, recycleList, purgeExpired, setCardStatus, restoreCard, mainStoreBodies } from './vault.js'
 import { compressExcerpt, DEFAULT_CAPTURE_MAX_TOKENS } from './capture.js'
 import { buildDiagnostics } from './feedback.js'
@@ -230,11 +231,24 @@ export function createApi(deps = {}) {
         try { await ensureVault(vaultRoot) } catch (e) { return degraded((e && e.message) || e) }
         let data
         try { data = await overview(vaultRoot) } catch (e) { return degraded((e && e.message) || e) }
+        // 健康面板要看「最近一次备份多久前」：这里给摘要（最多 5 个文件名，避免把响应撑大）
+        let backups = { count: 0, newestAt: 0, files: [] }
+        try {
+          const dir = path.join(vaultRoot, 'backups')
+          const names = fs.readdirSync(dir).filter((n) => /\.db$/i.test(n)).sort()
+          let newestAt = 0
+          if (names.length) {
+            const newest = names[names.length - 1]
+            try { newestAt = fs.statSync(path.join(dir, newest)).mtimeMs } catch { newestAt = 0 }
+          }
+          backups = { count: names.length, newestAt, files: names.slice(-5) }
+        } catch { /* 没有备份目录 */ }
         json(res, 200, {
           ok: true,
           vaultDir: vaultRoot,
           version: servingVersion,
           db: dbStatus(vaultRoot),
+          backups,
           ...data,
         })
         return