memory-eternal 0.21.0 → 0.23.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "memory-eternal",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "description": "记忆核心（Memory Eternal）：对话结束后自动沉淀知识卡到本地记忆库（~/.dsh/memory-vault），支持检索 / 召回 / 审核中心。",
   "author": {
     "name": "EternalNight996",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "memory-eternal",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "description": "记忆核心（Memory Eternal）：对话结束后自动沉淀知识卡到本地记忆库（~/.dsh/memory-vault），支持检索 / 召回 / 审核中心。",
   "author": {
     "name": "EternalNight996",

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "memory-eternal",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "description": "记忆核心（Memory Eternal）：对话结束后自动沉淀知识卡到本地记忆库（~/.dsh/memory-vault），支持检索 / 召回 / 审核中心。",
   "author": {
     "name": "EternalNight996",

package/README.md

@@ -2,7 +2,7 @@
 
 [![GitHub stars](https://img.shields.io/github/stars/EternalNight996/memory-eternal?style=flat)](https://github.com/EternalNight996/memory-eternal/stargazers)
 [![npm](https://img.shields.io/npm/v/memory-eternal)](https://www.npmjs.com/package/memory-eternal)
-[![release](https://img.shields.io/badge/release-v0.20.0-FF7A45)](https://github.com/EternalNight996/memory-eternal/releases)
+[![release](https://img.shields.io/badge/release-v0.23.0-FF7A45)](https://github.com/EternalNight996/memory-eternal/releases)
 [![license](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
 
 **English (default)** · [简体中文](README.zh-CN.md)
@@ -17,6 +17,7 @@
 > Local-first, review-gated, measurable — one SQLite vault shared by DSH, Claude Code, Codex, Cursor and any MCP client.
 
 - 🔍 **Review before it counts** — new cards wait in a review queue; approve or reject from the Web UI or terminal; every change is written to an immutable audit log.
+- ✏️ **Editable & revisable** — fix a card by hand in the reader, or let an agent submit a **revised copy** (`memory_revise`); the queue labels it a revision, and an approved card is only overwritten when you approve it.
 - 🧾 **Token ledger** — see how much recall injected, how many distillation calls ran, and how often recall was actually useful.
 - 🏠 **Local-first, no cloud** — SQLite + Markdown on your own disk. No third-party memory framework, no account. Memory data never leaves the machine; only the News page fetches public RSS / Hacker News on demand (titles, excerpts and outbound links only).
 - ⭐ **Core memory** — promote approved cards to always-on memory; every session gets them automatically, and the review queue still decides what qualifies.
@@ -84,6 +85,7 @@ A memory system that silently ingests everything will eventually recall a wrong
 - approve, reject or bulk-process from the Web UI, the terminal TUI, or the CLI;
 - every status change is appended to an **immutable audit log** (who / what / when / why) — enforced at the SQLite layer, not by convention;
 - agents can read and propose, but **cannot approve their own cards**;
+- agents can also submit a **revision**: a copy of an approved card lands in the queue marked “✏️ revision of …”; approving it overwrites the original (id, path and status preserved, an entry appended to the card's update log), rejecting it leaves the original untouched;
 - deleted cards go to a recycle bin (30 days by default).
 
 ## ⭐ Core memory
@@ -154,3 +156,30 @@ Not everything should be injected into every session. Core memory is the small,
 ## 📄 License
 
 MIT — use it, self-host it, build on it.
+
+## 🖋 Author's Quotes
+
+_Verses from 《蛊真人》(Reverend Insanity). Kept in the original Chinese — a translation would lose the meter. Also rotating at the bottom of the panel's left rail._
+
+> 落魄谷中寒风吹，春秋蝉鸣少年归。<br>
+> 荡魂山处石人泪，定仙游走魔向北。<br>
+> 逆流河上万仙退，爱情不敌坚持泪。<br>
+> 宿命天成命中败，仙尊悔而我不悔。
+
+> 早岁已知世事艰，仍许飞鸿荡云间。
+
+> 男儿不展凌云志，空负天生八尺躯。
+
+> 千古地仙随风逝，昔日三王归青冢。<br>
+> 阳莽悍陨谁无败？卷土重来再称王。
+
+> 天河一挂淘龙鱼，逆天独行顾八荒。<br>
+> 今朝暂且展翼去，明朝飞仙笞凤凰！
+
+> 独帜入渊深未知，身似浮萍命难持。<br>
+> 千舟皆朝归海处，一苇青拨戏浪巅。<br>
+> 惊鸿四散鱼逃尽，唯有残帆傲此间。<br>
+> 待到天开云雾散，负手直望笑苍天。
+
+<p align="right"><sub>——《蛊真人》· 大爱仙尊</sub></p>
+

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 [![GitHub stars](https://img.shields.io/github/stars/EternalNight996/memory-eternal?style=flat)](https://github.com/EternalNight996/memory-eternal/stargazers)
 [![npm](https://img.shields.io/npm/v/memory-eternal)](https://www.npmjs.com/package/memory-eternal)
-[![release](https://img.shields.io/badge/release-v0.20.0-FF7A45)](https://github.com/EternalNight996/memory-eternal/releases)
+[![release](https://img.shields.io/badge/release-v0.23.0-FF7A45)](https://github.com/EternalNight996/memory-eternal/releases)
 [![license](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
 
 [English (default)](README.md) · **简体中文（镜像）**
@@ -17,6 +17,7 @@
 > 本地优先、先审后入、可度量 —— 一个 SQLite 库，DSH / Claude Code / Codex / Cursor 与任意 MCP 客户端共享。
 
 - 🔍 **先审核，再入库** —— 新卡先进待审队列，Web 或终端里批准/驳回；每次状态变更写入不可篡改的审计日志。
+- ✏️ **可编辑、可修订** —— 在阅读器里直接改卡片，或让 agent 提交**修改副本**（`memory_revise`）；审核中心把它标成「✏️ 修改」，人批准后才覆盖原卡。
 - 🧾 **记忆账本** —— 召回注入了多少、蒸馏调了几次、召回到底有没有用，全部可查。
 - 🏠 **本地优先，零云端** —— SQLite + Markdown 存在你自己的磁盘上。没有第三方记忆框架、不需要账号；记忆数据不外发，只有「动态」资讯会按需请求公开 RSS / Hacker News（只取标题、摘要与外链）。
 - ⭐ **核心记忆** —— 已批准的卡可提升为「每次会话强制注入」的核心记忆；自动沉淀可以建议，但最终仍由审核中心决定。
@@ -84,6 +85,7 @@ npx -y -p memory-eternal dsh-memory tui   # 终端里的实时待审队列
 - 在 Web、终端 TUI 或 CLI 里批准 / 驳回 / 批量处理；
 - 每次状态变更追加到**不可篡改的审计日志**（谁 / 什么 / 何时 / 为什么）—— 由 SQLite 层强制，而不是靠约定；
 - Agent 可以读取和提议，但**不能批准自己写的卡**；
+- Agent 也可以提交**修改**：已批准卡的副本进待审队列并标注「✏️ 修改原卡：…」；批准 = 用副本覆盖原卡（id / path / 状态不变，更新记录留痕），驳回 = 原卡一字不动；
 - 删除的卡进回收站（默认保留 30 天）。
 
 ## ⭐ 核心记忆
@@ -154,3 +156,30 @@ npx -y -p memory-eternal dsh-memory tui   # 终端里的实时待审队列
 ## 📄 License
 
 MIT —— 随便用、随便自托管、随便二次开发。
+
+## 🖋 作者语录
+
+_「大爱」二字，是全篇最大的反讽。面板左栏底部同步轮播。_
+
+> 落魄谷中寒风吹，春秋蝉鸣少年归。<br>
+> 荡魂山处石人泪，定仙游走魔向北。<br>
+> 逆流河上万仙退，爱情不敌坚持泪。<br>
+> 宿命天成命中败，仙尊悔而我不悔。
+
+> 早岁已知世事艰，仍许飞鸿荡云间。
+
+> 男儿不展凌云志，空负天生八尺躯。
+
+> 千古地仙随风逝，昔日三王归青冢。<br>
+> 阳莽悍陨谁无败？卷土重来再称王。
+
+> 天河一挂淘龙鱼，逆天独行顾八荒。<br>
+> 今朝暂且展翼去，明朝飞仙笞凤凰！
+
+> 独帜入渊深未知，身似浮萍命难持。<br>
+> 千舟皆朝归海处，一苇青拨戏浪巅。<br>
+> 惊鸿四散鱼逃尽，唯有残帆傲此间。<br>
+> 待到天开云雾散，负手直望笑苍天。
+
+<p align="right"><sub>——《蛊真人》· 大爱仙尊</sub></p>
+

package/cursor-extension/package.json

@@ -2,7 +2,7 @@
   "name": "memory-eternal",
   "displayName": "Memory Atlas",
   "description": "Memory-eternal: open the local Memory Atlas library, review queue and knowledge graph in a Cursor/VS Code webview.",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "publisher": "EternalNight996",
   "license": "MIT",
   "repository": {

package/dsh-tui-plugin/dsh-plugin.json

@@ -2,7 +2,7 @@
   "$schema": "urn:dsh-std:community-draft:dsh-plugin:0.15",
   "id": "memory-eternal-tui",
   "name": "memory-eternal-tui",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "manifestVersion": "0.15",
   "description": "Open Memory Atlas from dsh-TUI: native /audit scene plus browser launcher.",
   "facets": {

package/dsh-tui-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memory-eternal-tui",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "description": "Memory Atlas for dsh-TUI: /audit scene with reason/severity, batch confirmation and reject reasons.",
   "type": "module",
   "main": "main.js",

package/index.js

@@ -58,6 +58,11 @@ export const Config = z.object({
   coreMemoryEnabled: z.boolean().default(true),
   coreMemoryLimit: z.number().min(1).max(20).default(6),
   coreMemoryMaxChars: z.number().min(200).max(10000).default(2000),
+  // 关注摘要推送：开启后按间隔抓取「新闻关注」，有新内容时注入 systemPrompt，
+  // 让 Agent 在下一轮主动告诉用户。**默认关闭** —— 这是会打扰人的功能，必须用户显式开启。
+  newsDigestEnabled: z.boolean().default(false),
+  newsDigestIntervalMinutes: z.number().min(30).max(10080).default(720),
+  newsDigestMaxItems: z.number().min(1).max(10).default(5),
   // 技能卡（kind=skill）：从「本机实际安装/可用的技能」生成卡，强制待审。
   // 不由 agent 对话沉淀（见 lib/capture.js AGENT_CARD_KINDS 不含 skill）；
   // 默认开：宿主启动 / 技能安装变化时后台同步，新技能自动进审核中心。
@@ -1082,6 +1087,75 @@ export function apply(ctx, config) {
     }
   }, 'memory-eternal: core memory section')
 
+  // -- 2c. 关注摘要：默认关闭；开启后按间隔抓取，只把「还没送过」的那一份推一轮 ----
+  // 送达方式与核心记忆一致：systemPrompt 分段。不新增宿主能力，也不往会话里插消息。
+  ctx.effect(() => {
+    let disposeSection = null
+    let timer = null
+    let alive = true
+    let lastText = ''
+    const clearSection = () => {
+      if (!disposeSection) return
+      const dispose = disposeSection
+      disposeSection = null
+      dispose()
+    }
+    const render = async () => {
+      try {
+        const cfg = settings.get() ?? {}
+        if (cfg.enabled === false || cfg.newsDigestEnabled !== true) { clearSection(); lastText = ''; return }
+        const { readDigest, digestPrompt } = await import('./lib/news-digest.js')
+        const d = await readDigest(vaultDir())
+        if (!alive) return
+        // 没有新内容、或这一份已经被某一轮消费过 → 不注入（宁可不提，也不反复念旧闻）
+        if (!d || !Array.isArray(d.items) || !d.items.length || Number(d.consumedAt) >= Number(d.generatedAt)) {
+          clearSection(); lastText = ''
+          return
+        }
+        const text = digestPrompt(d, { maxItems: Number(cfg.newsDigestMaxItems) || 5 })
+        if (!text) { clearSection(); lastText = ''; return }
+        if (text === lastText) return
+        lastText = text
+        clearSection()
+        disposeSection = ctx.systemPrompt.section({ name: 'memory-eternal: news-digest', order: 130, text })
+      } catch { /* 摘要失败绝不能影响正常对话 */ }
+    }
+    const tick = async () => {
+      const cfg = settings.get() ?? {}
+      if (cfg.enabled === false || cfg.newsDigestEnabled !== true) { await render(); return }
+      try {
+        const { readDigest, buildDigest } = await import('./lib/news-digest.js')
+        const d = await readDigest(vaultDir())
+        const intervalMs = Math.max(30, Number(cfg.newsDigestIntervalMinutes) || 720) * 60000
+        if (!d || Date.now() - (Number(d.generatedAt) || 0) >= intervalMs) {
+          await buildDigest(vaultDir(), {
+            windowHours: Math.max(1, Math.round(intervalMs / 3600000)),
+            maxItems: Number(cfg.newsDigestMaxItems) || 5,
+          })
+        }
+      } catch { /* 抓取失败就等下一个周期，不打扰用户 */ }
+      await render()
+    }
+    tick()
+    timer = setInterval(tick, 60000)
+    if (timer && typeof timer.unref === 'function') timer.unref()
+    // 一轮会话开始 = 这份摘要已经进过 systemPrompt，标记消费，下一轮不再重复。
+    const onClaim = async () => {
+      try {
+        const { readDigest, consumeDigest } = await import('./lib/news-digest.js')
+        const d = await readDigest(vaultDir())
+        if (d && Number(d.generatedAt) > Number(d.consumedAt || 0)) await consumeDigest(vaultDir(), d.generatedAt)
+      } catch { /* ignore */ }
+    }
+    if (typeof ctx.on === 'function') ctx.on('agent/inbox/claimed', onClaim)
+    return () => {
+      alive = false
+      if (timer) clearInterval(timer)
+      if (typeof ctx.off === 'function') { try { ctx.off('agent/inbox/claimed', onClaim) } catch { /* 已卸载 */ } }
+      clearSection()
+    }
+  }, 'memory-eternal: news digest section')
+
   const tools = ctx.get('tools')
   if (tools !== undefined) {
     tools.register(defineTool({
@@ -1360,6 +1434,10 @@ export function apply(ctx, config) {
                 recallEmbedding: cfg.recallEmbedding || '',
                 sessionBudgetChars: cfg.sessionBudgetChars ?? 80000,
                 skillCardsAutoSync: cfg.skillCardsAutoSync !== false,
+                // 关注摘要推送（默认关；覆盖测试要求每个 Config 字段都能被 /config 读出）
+                newsDigestEnabled: cfg.newsDigestEnabled === true,
+                newsDigestIntervalMinutes: cfg.newsDigestIntervalMinutes ?? 720,
+                newsDigestMaxItems: cfg.newsDigestMaxItems ?? 5,
               }
               const descriptor = (ctx.get('settings') ?? {}).describe?.({ redactSecrets: true }) ?? []
               const me = descriptor.find((d) => d.ns === 'memory-eternal')

package/lib/align.js

@@ -19,7 +19,8 @@ import { probeServedVersion } from './watchdog.js'
 import { nodeBinary } from './node-bin.js'
 
 /**
- * 纯函数：把「版本现状 + 接线现状」翻译成结论清单（便于单测，无任何 IO）。
+ * 纯函数：把「版本现状 + 接线现状」翻译成结论清单（便于单测）。唯一 IO 是 sameNodePath 的
+ * realpathSync 归一化（issue #56），且它只在路径存在时生效、失败即回退原串，不改变判定语义。
  * @returns {{ok:boolean, findings:Array<{id:string,level:'ok'|'warn'|'fix',title:string,detail:string,command:string}>, counts:{ok:number,warn:number,fix:number}}}
  */
 export function alignFindings({
@@ -27,6 +28,19 @@ export function alignFindings({
   latest = '', updateCommand = '', wiring = [], hookPaths = [], configMirror = null, knownKeys = null,
 } = {}) {
   const findings = []
+  // issue #56：node 路径比较必须**归一化**。配置里写的是稳定 shim（/opt/homebrew/bin/node），
+  // 当前解析出的可能是真实路径（…/Cellar/node/26.13.0_2/bin/node）—— 纯字符串比较必然不等，
+  // 于是 align 把**正确**的接线判成错误；用户按提示跑 setup 又写回带版本号的路径，形成死循环。
+  const sameNodePath = (a, b) => {
+    const norm = (p) => {
+      const raw = String(p || '')
+      if (!raw) return ''
+      try { return fs.realpathSync(raw) } catch { return raw }
+    }
+    const na = norm(a)
+    const nb = norm(b)
+    return process.platform === 'win32' ? na.toLowerCase() === nb.toLowerCase() : na === nb
+  }
   const push = (id, level, title, detail, command) => findings.push({ id, level, title, detail: detail || '', command: command || '' })
 
   // ① 宿主进程（最容易被忽略、也是"旧接口"的主因）
@@ -79,7 +93,7 @@ export function alignFindings({
     if (a.mcpMatchesCurrentNode === false) {
       // 措辞必须准确：`mcpMatchesCurrentNode` 比较的是**整条 MCP 条目**（node 路径 + 脚本路径 + 参数），
       // 两条路径相同时也可能因为**脚本路径/参数是旧写法**而不一致（升级后最常见）。
-      const sameNode = String(a.configuredNodePath || '') === String(a.currentNodePath || '')
+      const sameNode = sameNodePath(a.configuredNodePath, a.currentNodePath)
       push('wiring-node-' + a.name, 'fix',
         sameNode ? `${a.name}：MCP 条目与当前版本写出的不一致（脚本路径 / 参数是旧写法）` : `${a.name}：MCP 记的 node 路径与当前不一致`,
         sameNode

package/lib/api.js

@@ -17,9 +17,11 @@ import fs, { readFileSync } from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { spawn } from 'node:child_process'
-import { listCards, countCards, readCard, search, searchAll, graph, graphAll, graphLevel, LEVEL_ERR_PATH, LEVEL_ERR_STALE, overview, exportCards, deleteCard, writeCard, parseCard, stats, optimizeCandidates, optimizeApply, addFeedback, dailyCounts, mergeCards, ensureVault, auditQueue, recycleList, purgeExpired, setCardStatus, setCardKind, restoreCard, mainStoreBodies } from './vault.js'
+import { listCards, countCards, readCard, search, searchAll, graph, graphAll, graphLevel, LEVEL_ERR_PATH, LEVEL_ERR_STALE, overview, exportCards, deleteCard, writeCard, parseCard, stats, optimizeCandidates, optimizeApply, addFeedback, dailyCounts, mergeCards, ensureVault, auditQueue, recycleList, purgeExpired, purgeAllRecycle, setCardStatus, setCardKind, restoreCard, mainStoreBodies, updateCardContent, reviseCard } from './vault.js'
 import { compressExcerpt, guessRawKind, DEFAULT_CAPTURE_MAX_TOKENS } from './capture.js'
 import { buildDiagnostics } from './feedback.js'
+import { FOLLOW_DOMAINS, parseFollowIntent, listFollows, saveFollow, removeFollow, refreshFollows, followItems } from './news-follows.js'
+import { buildDigest, readDigest, digestPrompt } from './news-digest.js'
 import { getSetupStatus, runSetup, mcpAgentAction } from './setup.js'
 import { ledgerSummary } from './ledger.js'
 import { backupDb, dbStatus, rebuildGuidance, withDbRetry } from './db.js'
@@ -199,7 +201,30 @@ export function emptyNumericFields(patch, dict = {}) {
  * **真的会写库**的路由（/card、/cards、/search 这些是读，绝不能拦）。
  * 用途：库不可写时短路径失败；撞锁（SQLITE_BUSY）时做应用层异步重试。
  */
-const DB_WRITE_ROUTES = /^\/(delete|merge|write|import|refine-apply|refine-goals-keep|refine-junk-purge|optimize-execute|feedback|skills\/sync|audit\/(approve|reject)|recycle\/(restore|purge|purge-expired)|backup)$/
+const DB_WRITE_ROUTES = /^\/(delete|merge|write|import|card\/update|card\/revise|refine-apply|refine-goals-keep|refine-junk-purge|optimize-execute|feedback|skills\/sync|audit\/(approve|reject)|recycle\/(restore|purge|purge-expired|purge-all)|backup)$/
+
+/**
+ * 解析回收站保留期参数 `?days=`。
+ *
+ * issue #57 的根因就藏在一行 `Number(query.get('days')) || 30` 里：`Number('0')` 是 0，
+ * 而 `0 || 30` 又变回 30 —— 前端「清空回收站」传的 0 被静默升级成 30 天保留期，
+ * 刚删的卡一张都不清，用户看到的就是「点了没反应」。
+ *
+ * 这里把「没传」与「显式传 0」分开；非法输入交给调用方转 400。
+ * @param {string|null|undefined} raw
+ * @param {number} fallback 未提供时的默认保留天数
+ * @returns {number}
+ */
+export function parseRetentionDays(raw, fallback = 30) {
+  if (raw === null || raw === undefined || raw === '') return fallback
+  const n = Number(raw)
+  if (!Number.isFinite(n) || n < 0) {
+    const err = new Error('days 必须是非负数字')
+    err.code = 'BAD_DAYS'
+    throw err
+  }
+  return n
+}
 
 export function createApi(deps = {}) {
   const vaultDir = deps.vaultDir ?? (() => '')
@@ -664,26 +689,127 @@ export function createApi(deps = {}) {
       }
       case '/news/feed': {
         // 真实 AI 资讯：服务端按固定白名单抓 RSS / HN，缓存 20 分钟；只存摘要与外链。
+        // 带 follows=1 时主 feed 允许降级：9 个 RSS 全挂也不该把用户的 GitHub/arXiv 订阅一起吞掉。
+        const wantFollows = query.get('follows') === '1'
         try {
-          const data = await getNewsFeed(vaultRoot, {
-            period: query.get('period') === 'month' ? 'month' : 'today',
-            type: query.get('type') || '',
-            q: query.get('q') || '',
-            // lang 口径：'' / 'all' = 不过滤（一次请求拿中英全部条目）；zh / en 为显式过滤。
-            lang: (() => {
-              const raw = String(query.get('lang') == null ? '' : query.get('lang')).trim().toLowerCase()
-              if (raw === 'en') return 'en'
-              if (raw === 'zh') return 'zh'
-              return ''
-            })(),
-            force: query.get('force') === '1',
-          })
+          let data
+          try {
+            data = await getNewsFeed(vaultRoot, {
+              period: query.get('period') === 'month' ? 'month' : 'today',
+              type: query.get('type') || '',
+              q: query.get('q') || '',
+              // lang 口径：'' / 'all' = 不过滤（一次请求拿中英全部条目）；zh / en 为显式过滤。
+              lang: (() => {
+                const raw = String(query.get('lang') == null ? '' : query.get('lang')).trim().toLowerCase()
+                if (raw === 'en') return 'en'
+                if (raw === 'zh') return 'zh'
+                return ''
+              })(),
+              force: query.get('force') === '1',
+            })
+          } catch (e) {
+            if (!wantFollows) throw e
+            // 降级：主 feed 拉不到就返回空集合 + 可读错误，但继续给关注结果。
+            data = {
+              ok: true, period: 'today', lang: '', ranking: false, degraded: true,
+              items: [], types: [], counts: {}, fetchedAt: 0, stale: true,
+              errors: ['主 feed 暂不可用：' + String((e && e.message) || e)], sources: [],
+            }
+          }
+          // follows=1：把「关注」命中的条目并进主 feed（同一套 item 形状，前端零改动）。
+          // 关注抓取有 30 分钟 TTL，所以这里不会每次都打外网。
+          if (wantFollows) {
+            const follows = await refreshFollows(vaultRoot)
+            const extra = await followItems(vaultRoot, follows)
+            const seen = new Set((data.items || []).map((x) => x.url))
+            data = {
+              ...data,
+              items: [...extra.filter((x) => x.url && !seen.has(x.url)), ...(data.items || [])].slice(0, 160),
+              follows: follows.map((f) => ({
+                id: f.id, label: f.label, query: f.query, domains: f.domains,
+                count: (f.cache && f.cache.items ? f.cache.items : []).length,
+                errors: (f.cache && f.cache.errors) || [],
+                fetchedAt: (f.cache && f.cache.fetchedAt) || 0,
+              })),
+            }
+          }
           json(res, 200, data)
         } catch (e) {
           json(res, 502, { ok: false, error: '资讯源暂不可用：' + String((e && e.message) || e) })
         }
         return
       }
+      case '/news/follows': {
+        // GET 列表；POST 创建；DELETE 删除。创建只接受「已解析好的」结构化入参，
+        // 域必须来自白名单枚举（parseFollowIntent 也只产出枚举内的值）。
+        if (req.method === 'DELETE') {
+          const id = String(query.get('id') || '').trim()
+          if (!id) return json(res, 400, { ok: false, error: '缺少 id' })
+          const out = await removeFollow(vaultRoot, id)
+          return json(res, 200, { ok: true, ...out })
+        }
+        if (req.method === 'POST') {
+          const body = await readBody(req)
+          try {
+            const out = await saveFollow(vaultRoot, {
+              query: body.query, domains: body.domains, label: body.label, sourceIds: body.sourceIds,
+            })
+            return json(res, 200, { ok: true, ...out, domainsEnum: FOLLOW_DOMAINS })
+          } catch (e) {
+            return json(res, 400, { ok: false, error: String((e && e.message) || e) })
+          }
+        }
+        const follows = await listFollows(vaultRoot)
+        return json(res, 200, {
+          ok: true,
+          domains: FOLLOW_DOMAINS,
+          follows: follows.map((f) => ({
+            id: f.id, label: f.label, query: f.query, domains: f.domains, createdAt: f.createdAt, lastRunAt: f.lastRunAt,
+            count: (f.cache && f.cache.items ? f.cache.items : []).length,
+            errors: (f.cache && f.cache.errors) || [],
+          })),
+        })
+      }
+      case '/news/follows/preview': {
+        // 只解析、不落库：用户先看到「我理解成了什么」，再决定要不要订阅。
+        if (req.method !== 'POST') return json(res, 405, { ok: false, error: '需 POST' })
+        const body = await readBody(req)
+        return json(res, 200, { ok: true, parsed: parseFollowIntent(body.text || ''), domainsEnum: FOLLOW_DOMAINS })
+      }
+      case '/news/follows/refresh': {
+        if (req.method !== 'POST') return json(res, 405, { ok: false, error: '需 POST' })
+        const body = await readBody(req).catch(() => ({}))
+        const follows = await refreshFollows(vaultRoot, { force: body && body.force === true })
+        return json(res, 200, {
+          ok: true,
+          follows: follows.map((f) => ({
+            id: f.id, label: f.label, query: f.query, domains: f.domains,
+            count: (f.cache && f.cache.items ? f.cache.items : []).length,
+            errors: (f.cache && f.cache.errors) || [],
+          })),
+        })
+      }
+      case '/news/digest': {
+        // GET：读当前快照；POST：现在生成一份（配置页「立即生成」按钮用，也是开启前的预览）。
+        if (req.method === 'POST') {
+          const body = await readBody(req).catch(() => ({}))
+          const cfg = (getSettings && getSettings()) || {}
+          const intervalMin = Math.max(30, Number(cfg.newsDigestIntervalMinutes) || 720)
+          try {
+            const digest = await buildDigest(vaultRoot, {
+              windowHours: Number(body.windowHours) || Math.max(1, Math.round(intervalMin / 60)),
+              maxItems: Number(body.maxItems) || Number(cfg.newsDigestMaxItems) || 5,
+              force: body.force === true,
+            })
+            return json(res, 200, { ok: true, digest, text: digestPrompt(digest, { maxItems: Number(cfg.newsDigestMaxItems) || 5 }) })
+          } catch (e) {
+            return json(res, 502, { ok: false, error: '生成摘要失败：' + String((e && e.message) || e) })
+          }
+        }
+        const digest = await readDigest(vaultRoot)
+        const cfgGet = (getSettings && getSettings()) || {}
+        return json(res, 200, { ok: true, digest, text: digest ? digestPrompt(digest, { maxItems: Number(cfgGet.newsDigestMaxItems) || 5 }) : '' })
+      }
       case '/news/feed/refresh': {
         if (req.method !== 'POST') return json(res, 405, { ok: false, error: '需 POST' })
         try {
@@ -772,9 +898,10 @@ export function createApi(deps = {}) {
         const rel = query.get('path') || body?.path || ''
         const kind = String(query.get('kind') || body?.kind || '').trim()
         if (!rel) return json(res, 400, { ok: false, error: '缺少 path' })
-        await setCardStatus(vaultRoot, rel, 'approved')
-        if (kind === 'core' || kind === 'knowledge') await setCardKind(vaultRoot, rel, kind)
-        json(res, 200, { ok: true, path: rel, status: 'approved', kind: kind || undefined })
+        const out = await setCardStatus(vaultRoot, rel, 'approved')
+        // 修改副本被批准时会覆盖原卡（out.applied），它本身已消失，不能再当独立卡设类型
+        if ((kind === 'core' || kind === 'knowledge') && !out.applied) await setCardKind(vaultRoot, rel, kind)
+        json(res, 200, { ok: true, path: out.path || rel, status: 'approved', kind: kind || undefined, applied: !!out.applied })
         return
       }
       case '/audit/reject': {
@@ -789,6 +916,57 @@ export function createApi(deps = {}) {
         json(res, 200, { ok: true, path: rel, status: 'rejected', reason })
         return
       }
+      case '/card/revise': {
+        // POST {path, title?, tags?, body?, reason?, source?}：agent 提交「审核制修改」——
+        // 生成一张待审副本（同 kind、指向原卡），**不动原卡**；只有 /audit/approve 才会覆盖。
+        // 这是给智能体用的唯一改卡入口：它不能直接改已入库内容，也不能自己批准。
+        if (req.method !== 'POST') return json(res, 405, { ok: false, error: '需要 POST' })
+        const body = await readBody(req)
+        const rel = String(query.get('path') || body.path || '').trim()
+        if (!rel) return json(res, 400, { ok: false, error: '缺少 path' })
+        const title = body.title === undefined ? undefined : String(body.title).trim()
+        if (title !== undefined && !title) return json(res, 400, { ok: false, error: '标题不能为空' })
+        const nextBody = body.body === undefined ? undefined : String(body.body)
+        if (nextBody !== undefined && !nextBody.trim()) return json(res, 400, { ok: false, error: '正文不能为空' })
+        if (nextBody !== undefined && nextBody.length > 200000) return json(res, 413, { ok: false, error: '正文过长（上限 200000 字符）' })
+        const nextTags = Array.isArray(body.tags) ? body.tags.map((x) => String(x || '').trim()).filter(Boolean).slice(0, 30) : undefined
+        try {
+          const out = await reviseCard(vaultRoot, {
+            target: rel, title, tags: nextTags, body: nextBody,
+            reason: String(body.reason || '').slice(0, 300),
+            source: String(body.source || 'agent'),
+            submittedBy: String(body.submittedBy || body.source || 'agent'),
+          })
+          broadcast('audit', { path: out.path })
+          json(res, 200, { ok: true, ...out })
+        } catch (e) {
+          json(res, 400, { ok: false, error: String(e?.message || e) })
+        }
+        return
+      }
+      case '/card/update': {
+        // POST {path, title, tags, body}：人工编辑卡片内容（标题 / 标签 / 正文）。
+        // 只允许改这三样 —— 状态、类型、来源、审核流转仍由 /audit/*、/card-kind 决定，
+        // 避免「手动编辑」成为绕过审核的旁路；本路由只在本机回环 + 同源闸门下可达（见 crossOriginError）。
+        if (req.method !== 'POST') return json(res, 405, { ok: false, error: '需要 POST' })
+        const body = await readBody(req)
+        const rel = String(query.get('path') || body.path || '').trim()
+        if (!rel) return json(res, 400, { ok: false, error: '缺少 path' })
+        const title = body.title === undefined ? undefined : String(body.title).trim()
+        if (title !== undefined && !title) return json(res, 400, { ok: false, error: '标题不能为空' })
+        const nextBody = body.body === undefined ? undefined : String(body.body)
+        if (nextBody !== undefined && !nextBody.trim()) return json(res, 400, { ok: false, error: '正文不能为空' })
+        if (nextBody !== undefined && nextBody.length > 200000) return json(res, 413, { ok: false, error: '正文过长（上限 200000 字符）' })
+        const nextTags = Array.isArray(body.tags) ? body.tags.map((x) => String(x || '').trim()).filter(Boolean).slice(0, 30) : undefined
+        try {
+          const out = await updateCardContent(vaultRoot, rel, { title, tags: nextTags, body: nextBody })
+          broadcast('cards', { path: rel, reason: 'edited' })
+          json(res, 200, { ok: true, path: out.path, store: out.store, updated: out.updated, title, tags: nextTags })
+        } catch (e) {
+          json(res, 400, { ok: false, error: String(e?.message || e) })
+        }
+        return
+      }
       case '/card-kind': {
         // POST {path, kind:'core'|'knowledge'|...}：人工把已批准卡片设为核心/取消核心
         if (req.method !== 'POST') return json(res, 405, { ok: false, error: '需要 POST' })
@@ -824,11 +1002,24 @@ export function createApi(deps = {}) {
         return
       }
       case '/recycle/purge-expired': {
-        const days = Number(query.get('days')) || 30
+        // issue #57 根因：过去写的是 `Number(query.get('days')) || 30` —— `Number('0')` 是 0，
+        // 而 `0 || 30` 又变回 30，于是前端「清空回收站」传的 days=0 被静默升级成 30 天保留期，
+        // 刚删的卡一个都不清 → 用户看到的就是「点了没反应」。
+        // 现在区分「没传」与「传了 0」：没传才用默认 30。
+        let days
+        try { days = parseRetentionDays(query.get('days')) } catch (e) { return json(res, 400, { ok: false, error: String(e.message) }) }
         const r = await purgeExpired(vaultRoot, days)
         json(res, 200, r)
         return
       }
+      case '/recycle/purge-all': {
+        // 永久清空回收站（deleted + rejected）。危险操作：只收 POST，且走 DB_WRITE_ROUTES 闸门。
+        if (req.method !== 'POST') return json(res, 405, { ok: false, error: '需要 POST' })
+        const r = await purgeAllRecycle(vaultRoot)
+        broadcast('cards', { reason: 'recycle-purged', purged: r.purged })
+        json(res, 200, r)
+        return
+      }
       case '/write': {
         const chunks = []
         for await (const chunk of req) chunks.push(chunk)
@@ -1158,7 +1349,7 @@ export function createApi(deps = {}) {
           vaultProfiles: Array.isArray(cfg.vaultProfiles) ? cfg.vaultProfiles : [], activeVault: cfg.activeVault || '',
           enabled: cfg.enabled !== false, vaultDir: cfg.vaultDir || '', captureProvider: cfg.captureProvider || '', captureFollowSession: cfg.captureFollowSession === true, captureFirstOnly: cfg.captureFirstOnly === true, captureTimeoutMs: cfg.captureTimeoutMs ?? 45000,
           captureModel: cfg.captureModel || '', recallEmbedding: cfg.recallEmbedding || '', sessionBudgetChars: cfg.sessionBudgetChars ?? 80000,
-          skillCardsAutoSync: cfg.skillCardsAutoSync ?? true,
+          skillCardsAutoSync: cfg.skillCardsAutoSync ?? true, newsDigestEnabled: cfg.newsDigestEnabled === true, newsDigestIntervalMinutes: cfg.newsDigestIntervalMinutes ?? 720, newsDigestMaxItems: cfg.newsDigestMaxItems ?? 5,
           webPort: cfg.webPort ?? 7999, webCheckIntervalMs: cfg.webCheckIntervalMs ?? 5000, webMaxRestart: cfg.webMaxRestart ?? 10,
         }
         const NUM_RANGE = {