memory-eternal 0.10.6 → 0.10.8

package/lib/watchdog.js

@@ -421,6 +421,203 @@ export async function waitForServedVersion(port, expect, { timeoutMs = 15000, in
   }
 }
 
+// -- 常驻实例的「版本漂移自愈」--------------------------------------------------
+//
+// 为什么需要它：常驻 web（默认 7999）**比 DSH 宿主活得久**。升级 npm 包只换磁盘上的
+// 文件，端口上那个进程仍在跑「启动时加载进内存」的旧代码；而 index.js 的启动策略是
+// 「同端口已有活着的 watchdog 就让位（delegated）」，于是重启 DSH 多少次都不会替换它 ——
+// 表现就是「启动 dsh 后，运行中依旧是旧版本」（issue #19 / #23）。
+//
+// 自愈的正确形态是「用新代码重启那个常驻进程」，**不是**热替换内存里的模块：ESM 模块缓存 +
+// 闭包状态（settings / vault 路由 / SSE hub / fs.watch / 已监听的端口）没法安全热换，
+// 缓存失效重 import 只会得到第二份模块图（双实例、双监听、双写）。
+//
+// 由此定下接口：
+//   inspectResident()       体检：端口上真正服务的版本 / 占用者 / 常驻看门狗
+//   decideResidentAction()  纯函数决策：delegate | spawn | restart | warn
+//   restartResident()       执行替换：spawn 一个 --replace 助手，再自检新版本
+//   clearResidentForTakeover()  --replace 助手的主体：收掉旧实例 → 等端口空出来
+
+/**
+ * 常驻实例体检（宿主启动自愈与 /restart-self 共用）。
+ *
+ * 版本一律**问端口**而不是读锁：锁里的 pkgVersion 是 watchdog 自己写的自述，
+ * 与端口上真正跑着的代码无关（issue #23）。
+ *
+ * @param {{env?:object, port:number, probeVersion?:Function, findListener?:Function}} opts
+ * @returns {Promise<{port:number, served:string, occupant:{pid:number,command:string}|null,
+ *   occupantIsOurs:boolean, watchdog:object|null, watchdogAlive:boolean, residentStartedAt:number}>}
+ */
+export async function inspectResident({ env = process.env, port, probeVersion, findListener } = {}) {
+  const p = Number(port) || 0
+  const entry = readWatchdogLock(env).watchdogs.find((w) => Number(w.port) === p && isPidAlive(w.pid)) || null
+  let served = ''
+  if (p) {
+    try { served = String((await (probeVersion || probeServedVersion)(p)) || '') } catch { served = '' }
+  }
+  let occupant = null
+  // 只有「探不到版本」时才需要问端口占用者：能自报版本就已经证明是我们的服务了
+  if (p && !served) {
+    try { occupant = await (findListener || findPortListener)(p) } catch { occupant = null }
+  }
+  const occupantIsOurs = Boolean(occupant && occupant.pid && looksLikeOurWeb(occupant.command))
+  return {
+    port: p,
+    served,
+    occupant,
+    occupantIsOurs,
+    watchdog: entry,
+    watchdogAlive: Boolean(entry),
+    residentStartedAt: entry ? (Date.parse(String(entry.startedAt || '')) || 0) : 0,
+  }
+}
+
+/**
+ * 「端口上的常驻实例该拿它怎么办」的纯决策（便于单测，不含任何 IO）。
+ *
+ * @param {object} o
+ * @param {string} [o.served]         端口上**真正服务**的版本（取不到 = 空串）
+ * @param {string} [o.expect]         本机磁盘上的包版本
+ * @param {boolean} [o.watchdogAlive] 同端口是否有活着的常驻 watchdog
+ * @param {boolean} [o.occupantIsOurs] 占用端口的进程是不是本插件的 web
+ * @param {boolean} [o.autoRestart]   autoRestartOnDrift 开关
+ * @param {number} [o.residentStartedAt] 现有 watchdog 的启动时间（做防抖）
+ * @param {number} [o.now]
+ * @param {number} [o.debounceMs]
+ * @returns {{action:'delegate'|'spawn'|'restart'|'warn', stale:boolean, reason:string}}
+ */
+export function decideResidentAction({
+  served = '', expect = '', watchdogAlive = false, occupantIsOurs = false,
+  autoRestart = true, residentStartedAt = 0, now = Date.now(), debounceMs = 60000,
+} = {}) {
+  const s = String(served || '')
+  const e = String(expect || '')
+  // ① 版本一致：端口上跑的就是本机这份代码
+  if (s && e && s === e) return { action: 'delegate', stale: false, reason: 'up-to-date' }
+  // ② 读不到本机版本 → 没有判据，绝不乱动常驻实例（宁可不换，也不误杀）
+  if (!e) {
+    if (s) return { action: 'delegate', stale: false, reason: 'expect-unknown' }
+    return { action: watchdogAlive ? 'delegate' : 'spawn', stale: false, reason: 'expect-unknown' }
+  }
+  // ③ 漂移：自报版本不同，或干脆不自报版本（< v0.10.4 的旧 web）却占着端口
+  const drift = s ? s !== e : Boolean(occupantIsOurs)
+  if (!drift) {
+    if (s) return { action: 'delegate', stale: false, reason: 'up-to-date' }
+    return { action: watchdogAlive ? 'delegate' : 'spawn', stale: false, reason: 'port-idle' }
+  }
+  if (!autoRestart) return { action: 'warn', stale: true, reason: 'auto-restart-off' }
+  // ④ 防抖：刚替换过（新 watchdog 才起来）就别在效果重跑时反复重启
+  if (residentStartedAt && now - residentStartedAt < Math.max(0, Number(debounceMs) || 0)) {
+    return { action: 'delegate', stale: true, reason: 'debounced' }
+  }
+  return { action: 'restart', stale: true, reason: s ? 'version-drift' : 'resident-silent-version' }
+}
+
+/**
+ * spawn 一个 detached 的 `watchdog.js --replace` 助手。
+ *
+ * 为什么替换要交给子进程：调用方很可能**就是**端口上那个旧 web（/restart-self 由独立页发出），
+ * 就地收掉自己会让后面的「抢锁 + 拉起新 web」永远执行不到。助手不在锁里、也不占端口，
+ * 因此不会被自己收掉。失败不抛：调用方的版本自检会把「没换成功」如实报出来。
+ */
+export function spawnReplaceHelper({ port = 7999, vaultRoot, interval = 5000, maxRestart = 10, spawnFn, bin } = {}) {
+  const script = path.join(__dirname, 'watchdog.js')
+  const args = [script, '--replace', '--port', String(port), '--interval', String(interval), '--max-restart', String(maxRestart)]
+  if (vaultRoot) args.push('--vault', vaultRoot)
+  const child = (spawnFn || spawn)(bin || nodeBinary(), args, {
+    detached: true,
+    stdio: 'ignore',
+    env: childEnv({ MEMORY_VAULT_DIR: vaultRoot || process.env.MEMORY_VAULT_DIR || '' }),
+    windowsHide: true,
+  })
+  if (child && typeof child.on === 'function') child.on('error', () => { /* 由调用方的自检暴露 */ })
+  if (child && typeof child.unref === 'function') child.unref()
+  return child
+}
+
+/**
+ * 用新代码重启常驻实例（= 「更新运行中的程序」唯一安全形态）。
+ *
+ * 步骤：spawn `--replace` 助手 → 助手收掉旧 watchdog / 旧 web、等端口空出来、抢锁、拉起新 web
+ * → 本进程轮询自检「端口上真正服务的版本 == 本机版本」（issue #23 建议 2）。
+ * 调用方若正是被替换的那个进程，会先被助手收掉（响应已发出），自检结论由新实例给出。
+ *
+ * @returns {Promise<{ok:boolean, stage:string, expect:string, served:string, waitedMs:number,
+ *   helperPid:number, before:Array<object>, error?:string}>}
+ */
+export async function restartResident({
+  port = 7999, vaultRoot, interval = 5000, maxRestart = 10, env = process.env,
+  expectVersion, timeoutMs = 25000, deps = {},
+} = {}) {
+  const p = Number(port) || 7999
+  const expect = String(expectVersion !== undefined ? expectVersion : currentPkgVersion())
+  const before = readWatchdogLock(env).watchdogs.filter((w) => Number(w.port) === p)
+  let helperPid = 0
+  try {
+    const child = (deps.spawnHelper || spawnReplaceHelper)({ port: p, vaultRoot, interval, maxRestart })
+    helperPid = Number(child && child.pid) || 0
+  } catch (error) {
+    return { ok: false, stage: 'spawn-helper', expect, served: '', waitedMs: 0, helperPid: 0, before, error: String(error?.message || error) }
+  }
+  let check = { ok: false, version: '', waitedMs: 0 }
+  try { check = await (deps.waitForServedVersion || waitForServedVersion)(p, expect, { timeoutMs }) } catch { check = { ok: false, version: '', waitedMs: 0 } }
+  return {
+    ok: Boolean(check.ok),
+    stage: check.ok ? 'done' : 'verify',
+    expect,
+    served: String(check.version || ''),
+    waitedMs: Number(check.waitedMs) || 0,
+    helperPid,
+    before,
+    error: check.ok ? undefined : `端口 ${p} 上服务的版本是 ${check.version || '（无响应）'}，本机是 ${expect || '?'}`,
+  }
+}
+
+/**
+ * `--replace` 助手的主体：收掉同端口的旧常驻实例 → 等端口真的空出来。
+ *
+ * 本进程既不在锁里、也不占端口，所以不会被自己收掉。
+ * portFree=false 时调用方必须**中止接管**：端口没空出来，新 web 只能退让到 port+1，
+ * 旧代码继续在目标端口上服务 —— 那正是「升级静默不生效」和「孤儿 web」的同一处病根。
+ */
+export async function clearResidentForTakeover({ port = 7999, env = process.env, timeoutMs = 8000, deps = {} } = {}) {
+  const p = Number(port) || 7999
+  const findListener = deps.findListener || findPortListener
+  const out = { stopped: [], webStopped: [], portStopped: [], warnings: [], failed: [], portFree: false }
+  const rawKill = deps.kill || ((pid) => { try { process.kill(pid, 'SIGTERM'); return true } catch { return false } })
+  // 记下「已经判定收不掉」的 pid：立刻再来一次只会同样失败，白折腾还可能误导用户以为是权限抖动
+  const failedKills = new Set()
+  const killFn = (pid) => { const ok = rawKill(pid); if (!ok) failedKills.add(Number(pid)); return ok }
+  try {
+    const r = await (deps.stop || stopWatchdogs)({
+      env, port: p, checkPort: true, forcePortOccupant: true,
+      // 探测与杀戮都走同一个注入口：单测里既不能真去问生产端口，更不能真杀生产进程
+      kill: killFn, isAlive: deps.isAlive, sleep: deps.sleep, listProcesses: deps.listProcesses, findListener,
+    })
+    out.stopped = r.stopped || []
+    out.webStopped = r.webStopped || []
+    out.portStopped = r.portStopped || []
+    out.warnings = (r.warnings || []).slice()
+    out.failed = r.failed || []
+  } catch (error) {
+    out.warnings.push('停止旧实例失败：' + String(error?.message || error))
+  }
+  const wait = deps.sleep || ((ms) => new Promise((r) => setTimeout(r, ms)))
+  let left = null
+  try { left = await findListener(p) } catch { left = null }
+  const deadline = Date.now() + Math.max(0, Number(timeoutMs) || 0)
+  // 只对「确认是本插件的 web」下手：别人的进程占着端口时只如实报告，不误杀（同 issue #23 的口径）。
+  // 已经判定收不掉的 pid 不再重试 —— 立刻再来一次只会同样失败。
+  while (left && left.pid && looksLikeOurWeb(left.command) && !failedKills.has(Number(left.pid)) && Date.now() < deadline) {
+    if (!killFn(left.pid)) break
+    await wait(200)
+    try { left = await findListener(p) } catch { left = null }
+  }
+  out.portFree = !(left && left.pid)
+  if (!out.portFree) out.warnings.push(`端口 ${p} 仍被 pid ${left.pid} 占用（${left.command || '命令行未知'}）`)
+  return out
+}
+
 /**
  * 解析 `lsof -Fpcn` 的输出（每个进程一段：p<pid> / c<command> / n<name>）。
  * 纯函数，便于单测（POSIX 侧探测端口占用者用它）。
@@ -746,7 +943,18 @@ export function startWatchdog({ port = 7999, vaultRoot, interval = 5000, maxRest
   return { stop, get port() { return port }, get restartCount() { return restartCount } }
 }
 
-// 脚本入口：node lib/watchdog.js [--port N] [--interval MS] [--max-restart N] [--vault DIR]
+/**
+ * 助手是被 detached + stdio ignore 拉起的，stderr 没人看 —— 关键结论必须落进 capture 日志，
+ * 否则「重启了却没生效」又会变成一条无迹可查的静默失败。
+ */
+async function noteReplace(action, reason, env = process.env) {
+  try {
+    const { appendCaptureLog } = await import('./capture-log.js')
+    await appendCaptureLog({ time: Date.now(), sessionId: 'system', action, reason }, env)
+  } catch { /* 日志失败不影响接管 */ }
+}
+
+// 脚本入口：node lib/watchdog.js [--port N] [--interval MS] [--max-restart N] [--vault DIR] [--replace]
 if (process.argv[1] && /[\\/]watchdog\.js$/.test(process.argv[1])) {
   const argv = process.argv.slice(2)
   const argOf = (name) => {
@@ -758,22 +966,44 @@ if (process.argv[1] && /[\\/]watchdog\.js$/.test(process.argv[1])) {
   const maxRestart = Number(argOf('--max-restart')) || 10
   const vaultRoot = argOf('--vault') || undefined
   const autoStart = !argv.includes('--no-restart')
+
+  /** 正常启动路径：抢锁 → 成为看门狗（--replace 接管成功后也走这里）。 */
+  const bootWatchdog = () => {
+    const lock = acquireWatchdogLock({ port, vault: vaultRoot || '', pkgVersion: currentPkgVersion() })
+    if (!lock.acquired) {
+      log('同端口已有看门狗在跑（pid ' + (lock.previous && lock.previous.pid) + '，启动于 ' + (lock.previous && lock.previous.startedAt) + '）→ 本次启动退出，避免进程堆积')
+      process.exitCode = 0
+      return
+    }
+    if (lock.previous) log('清理陈旧看门狗记录（pid ' + lock.previous.pid + ' 已不存在）')
+    process.on('exit', () => releaseWatchdogLock())
+    startWatchdog({ port, interval, maxRestart, vaultRoot, autoStart })
+    log('看门狗已启动（pid ' + process.pid + '，端口 ' + port + '）')
+  }
+
   if (argv.includes('--reap')) {
     const out = await reapStaleWatchdogs({ port, keepPid: 0 })
     const msg = `回收孤儿看门狗：扫描 ${out.scanned} 个，清理 ${out.killed.length} 个${out.killed.length ? '（pid ' + out.killed.join(', ') + '）' : ''}，保留 ${out.skipped.length} 个`
     // 必须同步写：process.exit() 会截断 stderr 的异步写入（重定向/管道时表现为「完全没有输出」）
     try { fs.writeSync(2, `[watchdog] ${msg}\n`) } catch { log(msg) }
     process.exitCode = 0
-  } else {
-    const lock = acquireWatchdogLock({ port, vault: vaultRoot || '' })
-    if (!lock.acquired) {
-      log('同端口已有看门狗在跑（pid ' + (lock.previous && lock.previous.pid) + '，启动于 ' + (lock.previous && lock.previous.startedAt) + '）→ 本次启动退出，避免进程堆积')
-      process.exitCode = 0
-    } else {
-      if (lock.previous) log('清理陈旧看门狗记录（pid ' + lock.previous.pid + ' 已不存在）')
-      process.on('exit', () => releaseWatchdogLock())
-      startWatchdog({ port, interval, maxRestart, vaultRoot, autoStart })
-      log('看门狗已启动（pid ' + process.pid + '，端口 ' + port + '）')
+  } else if (argv.includes('--replace')) {
+    // 版本漂移自愈：先收掉旧常驻实例，再作为新一代看门狗接管（见 clearResidentForTakeover 的说明）。
+    const cleared = await clearResidentForTakeover({ port })
+    for (const w of cleared.warnings) log('⚠ ' + w)
+    const summary = `替换常驻实例：停止旧看门狗 ${cleared.stopped.length} 个`
+      + `、旧 web ${cleared.webStopped.length + cleared.portStopped.length} 个`
+      + `（端口 ${port}${cleared.portFree ? ' 已空出' : ' 仍被占用'}）`
+    log(summary)
+    if (cleared.failed.length) log('⚠ 未能停止：pid ' + cleared.failed.join(', '))
+    if (!cleared.portFree) {
+      const why = `${summary} —— 端口没空出来，已中止接管（不退让到 port+1，避免又留一个孤儿 web）`
+      await noteReplace('fail', why)
+      process.exit(1)
     }
+    await noteReplace('boot', summary)
+    bootWatchdog()
+  } else {
+    bootWatchdog()
   }
 }

package/lib/web-assets.js

@@ -1,41 +1,41 @@
-// 记忆核心 · 插件自带前端资源（web/ 目录）的完整性判据。
-//
-// 为什么单独一个模块：**宿主启动自检**（index.js）与**独立 web 进程兜底**（lib/web.js）
-// 必须用同一份判据和同一句措辞，否则两边会给出不一样的说法。
-//
-// 背景（issue #14）：有人从插件市场装出来的副本里只有 package.json / lib/，`web/` 没落地
-// （发布物本身是齐的：npm 0.10.0 tgz 与 tag v0.10.0 都含 web/index.html）。那时侧边栏
-// 「记忆」的 iframe 只会拿到一页原始的 `{"ok":false,"error":"ENOENT ... web/index.html"}`，
-// 用户和维护者都看不出「装坏了、该怎么修」。
-
-import { existsSync } from 'node:fs'
-import path from 'node:path'
-
-/** 前端界面必需的静态资源（相对包的 web/ 目录）。 */
-export const WEB_ASSET_FILES = ['index.html', 'app.js']
-
-/**
- * 列出 web/ 下缺失的资源文件名；空数组 = 齐全。
- * @param {string} packageRoot 插件包根目录（含 package.json 的那一层）
- * @param {string[]} files 需要检查的文件名
- */
-export function missingWebAssets(packageRoot, files = WEB_ASSET_FILES) {
-  return files.filter((f) => !existsSync(path.join(packageRoot, 'web', f)))
-}
-
-/** 缺 app.js 是硬故障：界面彻底起不来（缺 index.html 还能用内置外壳兜底）。 */
-export function isHardMissing(missing) {
-  return (missing || []).includes('app.js')
-}
-
-/**
- * 写进「自动沉淀日志」的那句话（宿主与独立服务共用，保证两处措辞一致）。
- * 顺带给出可照做的修法，避免用户再开一个 issue 问「怎么修」。
- */
-export function missingAssetsReason(missing, packageRoot) {
-  const list = (missing || []).map((f) => `web/${f}`).join('、')
-  const where = path.join(packageRoot, 'web')
-  const hard = isHardMissing(missing)
-  return `插件安装不完整：缺少 ${list}（${where}）——${hard ? '侧边栏「记忆」界面无法加载' : '已用内置外壳兜底，界面仍可用'}。`
-    + `修法：完全退出 DSH → 删掉 ${path.join(path.dirname(packageRoot), 'memory-eternal')} → 重开 DSH 后「插件 → 添加插件」重新安装`
-}
+// 记忆核心 · 插件自带前端资源（web/ 目录）的完整性判据。
+//
+// 为什么单独一个模块：**宿主启动自检**（index.js）与**独立 web 进程兜底**（lib/web.js）
+// 必须用同一份判据和同一句措辞，否则两边会给出不一样的说法。
+//
+// 背景（issue #14）：有人从插件市场装出来的副本里只有 package.json / lib/，`web/` 没落地
+// （发布物本身是齐的：npm 0.10.0 tgz 与 tag v0.10.0 都含 web/index.html）。那时侧边栏
+// 「记忆」的 iframe 只会拿到一页原始的 `{"ok":false,"error":"ENOENT ... web/index.html"}`，
+// 用户和维护者都看不出「装坏了、该怎么修」。
+
+import { existsSync } from 'node:fs'
+import path from 'node:path'
+
+/** 前端界面必需的静态资源（相对包的 web/ 目录）。 */
+export const WEB_ASSET_FILES = ['index.html', 'app.js']
+
+/**
+ * 列出 web/ 下缺失的资源文件名；空数组 = 齐全。
+ * @param {string} packageRoot 插件包根目录（含 package.json 的那一层）
+ * @param {string[]} files 需要检查的文件名
+ */
+export function missingWebAssets(packageRoot, files = WEB_ASSET_FILES) {
+  return files.filter((f) => !existsSync(path.join(packageRoot, 'web', f)))
+}
+
+/** 缺 app.js 是硬故障：界面彻底起不来（缺 index.html 还能用内置外壳兜底）。 */
+export function isHardMissing(missing) {
+  return (missing || []).includes('app.js')
+}
+
+/**
+ * 写进「自动沉淀日志」的那句话（宿主与独立服务共用，保证两处措辞一致）。
+ * 顺带给出可照做的修法，避免用户再开一个 issue 问「怎么修」。
+ */
+export function missingAssetsReason(missing, packageRoot) {
+  const list = (missing || []).map((f) => `web/${f}`).join('、')
+  const where = path.join(packageRoot, 'web')
+  const hard = isHardMissing(missing)
+  return `插件安装不完整：缺少 ${list}（${where}）——${hard ? '侧边栏「记忆」界面无法加载' : '已用内置外壳兜底，界面仍可用'}。`
+    + `修法：完全退出 DSH → 删掉 ${path.join(path.dirname(packageRoot), 'memory-eternal')} → 重开 DSH 后「插件 → 添加插件」重新安装`
+}

package/lib/web.js

@@ -147,6 +147,8 @@ export function startWebServer({ port = DEFAULT_WEB_PORT, vaultRoot = defaultVau
   const handleApi = createApi({
     vaultDir: () => vaultRoot,
     vaultRoots: () => [{ name: '', root: vaultRoot }],
+    // 本进程监听的就是「常驻实例」本身：/version-check 与 /restart-self 都要钉在这个端口上
+    selfPort: port,
     // 读 DSH 写入的共享配置文件 → web 端与 DSH 设置同步（不同步修复）
     getSettings: () => { try { return JSON.parse(readFileSync(configFilePath(process.env), 'utf8')) } catch { return {} } },
     getDshInfo: () => ({ name: 'deepseek-harness', label: 'DeepSeek Harness（当前宿主）', installed: true, memoryRecallTool: true, autoCapture: true, autoRecall: true, vaultDir: vaultRoot, version: VERSION }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memory-eternal",
-  "version": "0.10.6",
+  "version": "0.10.8",
   "description": "记忆核心（Memory Eternal）：自研的 DeepSeek Harness 记忆插件，不移植任何既有记忆框架——对话结束后自动沉淀知识卡到本地 Markdown Vault（自研去重、自研 CJK 检索、可 git 管理），设置页提供图形化知识库（统计 / 搜索 / 知识图谱 + 侧边栏一键弹窗），Agent 通过 memory_recall 工具按需召回历史上下文。零人工干预。",
   "license": "MIT",
   "repository": {
@@ -64,7 +64,7 @@
     "prepublishOnly": "node build.mjs",
     "release": "node scripts/release.mjs",
     "release:dry": "node scripts/release.mjs --dry-run",
-    "test": "node build.mjs && node tests/vault.test.mjs && node tests/capture.test.mjs && node tests/capture-route.test.mjs && node tests/stall.test.mjs && node tests/vault-path.test.mjs && node tests/vault-resolve.test.mjs && node tests/minhash.test.mjs && node tests/settings-save.test.mjs && node tests/config-coverage.test.mjs && node tests/config-sync.test.mjs && node tests/config-merge.test.mjs && node tests/sse.test.mjs && node tests/api.test.mjs && node tests/import-roundtrip.test.mjs && node tests/graph-perf.test.mjs && node tests/settings-compat.test.mjs && node tests/node-bin.test.mjs && node tests/watchdog-lock.test.mjs && node tests/markdown.test.mjs && node tests/feedback.test.mjs && node tests/graph-lod.test.mjs && node tests/ssr.test.mjs && node tests/web-assets.test.mjs && node tests/manifests.test.mjs && node tests/two-store.test.mjs && node tests/noise-gate.test.mjs && node tests/e2e-recall.test.mjs && node tests/issue-fixes.test.mjs && node tests/issue-fixes-2.test.mjs && node tests/issue-fixes-3.test.mjs && node tests/watchdog-orphans.test.mjs"
+    "test": "node build.mjs && node tests/vault.test.mjs && node tests/capture.test.mjs && node tests/capture-route.test.mjs && node tests/stall.test.mjs && node tests/vault-path.test.mjs && node tests/vault-resolve.test.mjs && node tests/minhash.test.mjs && node tests/settings-save.test.mjs && node tests/config-coverage.test.mjs && node tests/config-sync.test.mjs && node tests/config-merge.test.mjs && node tests/sse.test.mjs && node tests/api.test.mjs && node tests/import-roundtrip.test.mjs && node tests/graph-perf.test.mjs && node tests/settings-compat.test.mjs && node tests/node-bin.test.mjs && node tests/watchdog-lock.test.mjs && node tests/markdown.test.mjs && node tests/feedback.test.mjs && node tests/graph-lod.test.mjs && node tests/ssr.test.mjs && node tests/web-assets.test.mjs && node tests/manifests.test.mjs && node tests/two-store.test.mjs && node tests/noise-gate.test.mjs && node tests/e2e-recall.test.mjs && node tests/issue-fixes.test.mjs && node tests/issue-fixes-2.test.mjs && node tests/issue-fixes-3.test.mjs && node tests/watchdog-orphans.test.mjs && node tests/watchdog-restart.test.mjs && node tests/readme-i18n.test.mjs && node tests/issue-fixes-4.test.mjs && node tests/host-drain.test.mjs && node tests/e2e-host-drain.mjs"
   },
   "dependencies": {
     "@deepseek-ai/schemastery": "^3.18.1"

package/skills/memory-recall/SKILL.md

@@ -1,14 +1,19 @@
----
-name: memory
-description: Recall relevant knowledge cards from the unified memory vault and capture durable findings. Use memory_recall before answering when prior context helps; call memory_capture when a session produces a durable insight.
----
-
-# Memory Eternal
-
-This agent has access to `memory_recall` (retrieve cards) and `memory_capture` (store a card) via the `memory` MCP server.
-
-## When to recall
-Before answering when the user's question may depend on prior project decisions, past bugs, or preferences. Combine with `memory_stats` to gauge coverage.
-
-## When to capture
-At the end of a session that produced a durable, reusable conclusion (a fix, a decision, an architecture rationale, a constraint). Capture concise findings rather than raw transcripts; the hook also auto-captures at session end into the same vault (pending → audit). Source attribution is automatic.
+---
+name: memory
+description: Recall relevant knowledge cards from the unified memory vault and capture durable findings. Use memory_recall before answering when prior context helps; call memory_capture when a session produces a durable insight.
+---
+
+# Memory Eternal
+
+This agent has access to `memory_recall` (retrieve cards) and `memory_capture` (store a card) via the `memory` MCP server.
+
+## When to recall
+Before answering when the user's question may depend on prior project decisions, past bugs, or preferences. Combine with `memory_stats` to gauge coverage.
+
+## When you need a credential (API key / token)
+Recall first: `memory_recall("密钥 目录")` (or the vault's local wording). The memory vault stores the **directory** — key names, where they live, and the local command that uses them — **never the values**.
+Then use the value through that command (typically a loader that injects it into a child process environment, e.g. `... --run -- <command>`).
+Do **not** `cat`/read credential files (`~/.dsh/.credentials.yaml`, `.env`, `*-token`): reading them puts the secret into your context, which is a leak. Never print a secret, never write one into a card, commit, or issue.
+
+## When to capture
+At the end of a session that produced a durable, reusable conclusion (a fix, a decision, an architecture rationale, a constraint). Capture concise findings rather than raw transcripts; the hook also auto-captures at session end into the same vault (pending → audit). Source attribution is automatic.