oh-memos-mcp 3.1.6 → 3.1.8

package/CHANGELOG.md

@@ -6,6 +6,121 @@ This project follows [Semantic Versioning](https://semver.org/).
 
 ---
 
+## [3.1.8] - 2026-08-27
+
+仅 MCP server（npm `oh-memos-mcp`）。Python 包与容器镜像无改动，仍为 3.1.5。
+
+### 🏷️ `memos_get` 报 root 无权限，而 root 从未被传入
+
+`memos_get` 打自己项目的 cube 时回：
+
+```
+❌ [API_ERROR] Get failed: User 'root' does not have access to cube
+   'jincaizhaopin_cube'. Please register the cube first or request access.
+```
+
+但 `MEMOS_USER=dev_user`，root 不在任何调用参数里。
+
+root 来自后端的默认回退：`start_api.py` 的 `get_memory(mem_cube_id, memory_id,
+user_id=None)` 把 `user_id` 声明为可选，缺失时 `core.py` 的 `get()` 回退到
+`self.user_id`（MOS 实例自己的用户，即 root）。而 `ensureCubeRegistered` 注册的是
+`MEMOS_USER`，于是 root 对该 cube 无授权，`_validate_cube_access` 抛 ValueError，
+被 ValueError handler 映射成 400。
+
+**`handleMemosGet` 是唯一漏传 `user_id` 的调用点** —— save / list / search /
+stats / calendar / siblings 全都传了，admin 的 delete 路径也拼了查询串。
+
+`apiCallWithRetry` 的 400 分支救不回来：它把 400 当「cube 未加载」，重注册后重试
+—— 但重注册仍按 `MEMOS_USER` 注册，重试请求仍然不带 `user_id`，第二次照样落到 root。
+
+实测对照（同一个不存在的 id，`jincaizhaopin_cube`）：
+
+```
+不带 user_id        -> User 'root' does not have access to cube 'jincaizhaopin_cube'
+带 user_id=dev_user -> Memory with ID ... not found        ← 正常语义
+```
+
+为什么以前没人踩到：cube 的**归属**决定是否触发。root 名下的 cube（`dev_cube`、
+`claude_cube`、`memos_cube` 等）不受影响；只有 owner 是 `MEMOS_USER` 的项目 cube
+才会报错 —— 也就是每一个用 `project_path` 自动派生出来的 cube。
+
+同源缺陷也修了 `wiki-import.ts` 的 `getStoredMemory`。那里更隐蔽：该消息既不含
+`not found` 也不是 404，会被当成真实故障，把整页 import 判成失败而不是「记忆不存在」。
+
+`apiErrorResponse` 另加了对 `does not have access` 的识别。该消息同时含 `user` 和
+cube 字样，却不匹配任何既有分支，此前只能给通用的「查 health / 看日志」。新提示先
+指向 `user_id`，因为最常见的成因是调用方漏传它，而不是用户或 cube 不存在。
+
+回归测试 `get-user-id-param.test.ts` 的 fetch stub **按 `user_id` 是否存在分流**
+应答，复刻上面的实测对照。无条件回 not-found 的 stub 守不住这个缺陷 —— 变异验证
+（把 params 改回 `{}`）时三条断言必须全红，写测试时实际拿它验过。
+
+## [3.1.7] - 2026-08-27
+
+仅 MCP server（npm `oh-memos-mcp`）。Python 包与容器镜像无改动，仍为 3.1.5。
+
+### 🏷️ `open` 报出的画布名，`list` 找不到
+
+goal 足够长时，`actionOpen` 报出的名字比磁盘上真实存在的多一个字符：
+
+```
+open  reports: 000-verify-3-1-6-canvas-delete-and-ref-escaping-over-live-mcp  (61)
+list  shows  : 000-verify-3-1-6-canvas-delete-and-ref-escaping-over-live-mc   (60)
+on disk      : ...-live-mc.mmd
+```
+
+`actionOpen` 先 `slugify(goal)` 拿到最多 `SLUG_MAX`（60）字符，再拼 `${prefix}-`，
+总长可达 64。`saveCanvas` → `canvasPath` 在落盘路上又 slugify 一次，砍回 60。
+**前缀那 4 个字符的预算从来没被算进去。**
+
+`canvasPath` 里那处「slug 与原名不同就拒绝」的检查本该拦住它，但它只在名字
+「像路径」（含 `/`、`\` 或 `..`）时抛错 —— 截断不像路径，于是静默放过。
+
+影响是**报错的句柄，不是损坏的数据**：前缀仍让每个画布互不相同，
+两个前 60 字符相同的长 goal 得到 `000-`/`001-` 两个独立文件，各自节点都在；
+`update`/`delete` 传 `open` 报的长名字也照样能用，因为 `canvasPath` 的截断是幂等的。
+坏的只有一件事：调用方拿到的名字，`list` 永远不会显示，磁盘上也不存在。
+
+修法是把名字组装收进 `canvas-format.ts` 的新函数 `canvasName(prefix, goal)` ——
+让它紧挨着自己必须遵守的那个上限，而不是让 handler 去做预算算术：
+
+```ts
+export function canvasName(prefix: string, goal: string): string {
+  const head = `${prefix}-`;
+  const slug = slugify(goal, SLUG_MAX - head.length);
+  return slug ? `${head}${slug}` : `${head}task`;
+}
+```
+
+`slugify` 因此多一个可选的 `maxLength`，**向内钳制到 `SLUG_MAX`** ——
+调用方能收紧上限，不能放宽它，否则「每个画布文件名都装得进 `SLUG_MAX`」
+这个不变量就成了各调用点的自选项。截断后仍走一次尾部连字符清理，
+所以 `000-abc-.mmd` 这种名字不会出现。
+
+### 🧪 测试
+
+canvas-format 单测 41 → 50，canvas e2e 34 → 40 项。
+
+核心断言是**不动点**而不是长度：`slugify(canvasName(p, g)) === canvasName(p, g)`，
+跨 3 个前缀 × 6 种 goal（超长、纯 CJK、尾部连字符诱饵、前 60 字符相同的两个变体）。
+长度只是症状 —— `canvasPath` 会再 slugify 一次，任何不是不动点的名字都是
+「告诉了调用方、但文件系统从没见过」的名字。
+
+e2e 补的 5 项跨 open/list/show/delete 与磁盘：`open` 报的名字必须等于
+`list` 显示的名字、等于磁盘上存在的文件。反向验证还原实现后 3 项变红
+（长度 64、磁盘上无此名、`list` 显示另一个名字）。
+
+另两项（`reported name still routes to its canvas` / `... to delete`）
+在修复前后都通过 —— `canvasPath` 截断幂等使然。**保留但改名如实**：
+它们守的是「如果有人改用『让 `canvasPath` 对有损名字抛错』来修这个缺陷，
+这条回归会被抓到」，不是这次的不变量。
+
+门禁：vitest 520 passed、tsc、canvas e2e 40 项、pack 契约 104 文件、
+schema budget +0.8%、semantic 快照 17 工具、protocol legacy + v2、
+lite smoke、host-env smoke、spread smoke。
+
+---
+
 ## [3.1.6] - 2026-08-26
 
 仅 MCP server（npm `oh-memos-mcp`）。Python 包与容器镜像无改动，仍为 3.1.5。
@@ -71,7 +186,7 @@ commit message 或记忆正文引用的 `001-N3` 会变得指向两个不同画
 
 ### 🧪 测试
 
-canvas 单测 41 → 45（format）、28 → 44（store），canvas e2e 15 → 31 项。
+canvas 单测 41 → 45（format）、28 → 44（store），canvas e2e 18 → 34 项。
 两个修复都做了反向验证，还原实现后对应用例确实变红：转义 3 项、水位线 1 项（含 delete 侧那次抬升）。
 
 e2e 补了「旧 cube（无水位线）删除后不复用前缀」这条真实升级路径 ——
@@ -84,7 +199,7 @@ e2e 补了「旧 cube（无水位线）删除后不复用前缀」这条真实
 两处冻结的哈希同步重算：`schema-semantic-baseline.json` 与
 `protocol-contract.test.ts` 的 `EXPECTED_SCHEMA_HASHES`。
 
-门禁：vitest 511 passed、tsc、canvas e2e 31 项、pack 契约 104 文件、
+门禁：vitest 511 passed、tsc、canvas e2e 34 项、pack 契约 104 文件、
 schema budget +0.8%（限 5%）、semantic 快照 17 工具、protocol v2、lite smoke。
 
 ---

package/dist/canvas-format.d.ts

@@ -45,8 +45,31 @@ export declare const SUMMARY_MAX = 120;
  *
  * Returns "" when nothing usable remains (a purely CJK title, for instance);
  * callers must have a fallback and must not write a file named "".
+ *
+ * `maxLength` narrows the cap for a caller that must leave room for a prefix.
+ * It is clamped to `SLUG_MAX`, so no caller can widen the invariant that every
+ * canvas filename fits in `SLUG_MAX` characters.
+ */
+export declare function slugify(input: string, maxLength?: number): string;
+/**
+ * Compose a canvas filename from its prefix and the task goal.
+ *
+ * The prefix has to be part of the length budget, and it was not: `actionOpen`
+ * used to slug the goal to `SLUG_MAX` and then prepend `${prefix}-`, producing a
+ * name up to `SLUG_MAX + 4` characters. `canvasPath` slugs again on the way to
+ * disk and cut it back to `SLUG_MAX`, so the name reported by `open` was not the
+ * name `list` would show, and not the file that existed. Nothing was overwritten
+ * — the numeric prefix still made every canvas distinct — but the handle handed
+ * back to the caller was wrong.
+ *
+ * So the composition lives here, next to the cap it has to respect: slug the
+ * goal into what is left after the prefix, and the result is already a fixed
+ * point of `slugify`.
+ *
+ * A goal with no ASCII (a purely CJK title) slugs to "", so fall back to
+ * `<prefix>-task` rather than writing a file named after the prefix alone.
  */
-export declare function slugify(input: string): string;
+export declare function canvasName(prefix: string, goal: string): string;
 /**
  * Make text safe to sit inside a Mermaid `["..."]` label.
  *

package/dist/canvas-format.js

@@ -36,12 +36,40 @@ const SLUG_MAX = 60;
  *
  * Returns "" when nothing usable remains (a purely CJK title, for instance);
  * callers must have a fallback and must not write a file named "".
+ *
+ * `maxLength` narrows the cap for a caller that must leave room for a prefix.
+ * It is clamped to `SLUG_MAX`, so no caller can widen the invariant that every
+ * canvas filename fits in `SLUG_MAX` characters.
  */
-export function slugify(input) {
+export function slugify(input, maxLength = SLUG_MAX) {
+    const cap = Math.max(0, Math.min(maxLength, SLUG_MAX));
     const lowered = String(input ?? "").toLowerCase();
     const kept = lowered.replace(/[^a-z0-9]+/g, "-");
     const collapsed = kept.replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
-    return collapsed.slice(0, SLUG_MAX).replace(/-+$/g, "");
+    return collapsed.slice(0, cap).replace(/-+$/g, "");
+}
+/**
+ * Compose a canvas filename from its prefix and the task goal.
+ *
+ * The prefix has to be part of the length budget, and it was not: `actionOpen`
+ * used to slug the goal to `SLUG_MAX` and then prepend `${prefix}-`, producing a
+ * name up to `SLUG_MAX + 4` characters. `canvasPath` slugs again on the way to
+ * disk and cut it back to `SLUG_MAX`, so the name reported by `open` was not the
+ * name `list` would show, and not the file that existed. Nothing was overwritten
+ * — the numeric prefix still made every canvas distinct — but the handle handed
+ * back to the caller was wrong.
+ *
+ * So the composition lives here, next to the cap it has to respect: slug the
+ * goal into what is left after the prefix, and the result is already a fixed
+ * point of `slugify`.
+ *
+ * A goal with no ASCII (a purely CJK title) slugs to "", so fall back to
+ * `<prefix>-task` rather than writing a file named after the prefix alone.
+ */
+export function canvasName(prefix, goal) {
+    const head = `${prefix}-`;
+    const slug = slugify(goal, SLUG_MAX - head.length);
+    return slug ? `${head}${slug}` : `${head}task`;
 }
 // ============================================================================
 // escapeLabel

package/dist/handlers/canvas.js

@@ -27,7 +27,7 @@
  * compaction, and anchors that make a summary checkable.
  */
 import { MEMOS_CUBES_DIR } from "../config.js";
-import { NODE_STATUSES, allocateNodeId, countByStatus, formatCanvasHeadline, slugify, truncateSummary, } from "../canvas-format.js";
+import { NODE_STATUSES, allocateNodeId, canvasName, countByStatus, formatCanvasHeadline, truncateSummary, } from "../canvas-format.js";
 import { CanvasPathError, deleteCanvas, listCanvases, loadCanvas, nextPrefix, saveCanvas, } from "../canvas-store.js";
 import { ERR_PARAM_INVALID, ERR_PARAM_MISSING, ERR_OPERATION_FAILED, errorResponse, getCubeIdFromArgs, } from "./utils.js";
 const STATUS_LIST = NODE_STATUSES.join(", ");
@@ -118,10 +118,9 @@ function actionOpen(cubeId, args) {
     if (prefix === null) {
         return errorResponse(`Cube '${cubeId}' already holds 1000 canvases (000-999)`, ERR_OPERATION_FAILED, ["Remove finished canvas files from the cube's canvas/ directory"]);
     }
-    // The goal supplies the slug; a goal with no ASCII (a Chinese title, say)
-    // yields none, so fall back to the prefix rather than writing a nameless file.
-    const goalSlug = slugify(goal);
-    const name = goalSlug ? `${prefix}-${goalSlug}` : `${prefix}-task`;
+    // The prefix is part of the filename budget, so composing the name is
+    // `canvasName`'s job — see the note there on why doing it inline was wrong.
+    const name = canvasName(prefix, goal);
     const now = new Date().toISOString();
     const canvas = {
         prefix,

package/dist/handlers/memory.js

@@ -286,7 +286,13 @@ export async function handleMemosGet(arguments_) {
     const [regSuccess, regError] = await ensureCubeRegistered(cubeId);
     if (!regSuccess)
         return cubeRegistrationError(cubeId, regError);
-    const result = await apiCallWithRetry("GET", `${MEMOS_URL}/memories/${cubeId}/${memoryId}`, cubeId, {}, ensureCubeRegistered);
+    const result = await apiCallWithRetry("GET", `${MEMOS_URL}/memories/${cubeId}/${memoryId}`, cubeId, 
+    // user_id 必须显式传：后端 `get_memory` 的 user_id 是可选参数，缺失时回退到
+    // MOS 实例自己的 user_id（root）。而 ensureCubeRegistered 注册的是 MEMOS_USER
+    // （dev_user），于是 root 对该 cube 无授权，校验抛 ValueError → 400
+    // "User 'root' does not have access to cube '...'"。重注册重试也救不回来：
+    // 它仍然按 MEMOS_USER 注册，重试请求仍然不带 user_id，第二次照样落到 root。
+    { params: { user_id: MEMOS_USER } }, ensureCubeRegistered);
     if (result.success && result.data) {
         const resultData = result.data
             .data;

package/dist/handlers/utils.js

@@ -53,10 +53,19 @@ export function apiErrorResponse(operation, statusOrMsg) {
     // Turn known API errors into actionable next steps on the hot paths
     // (save/search/list hit these far more often than register_cube does).
     const suggestions = [];
-    if (msg.includes("user") && (msg.includes("not exist") || msg.includes("not found"))) {
+    // 「does not have access to cube」要在 user-missing 分支之前判：它同时含 "user"
+    // 和 cube 字样，但成因完全不同 —— 用户和 cube 都存在，只是该用户没被授权。
+    // 实测最常见的触发方式是调用方漏传 user_id，后端回退到 root 去校验（root 往往
+    // 没有项目 cube 的授权），所以提示要先指向 user_id，而不是让人去建用户。
+    if (msg.includes("does not have access")) {
+        suggestions.push('Cube exists but this user is not authorized — most often the caller omitted `user_id` and the API fell back to its own default user. Verify `MEMOS_USER` matches the cube owner, then re-register: `memos_admin(action="register_cube", cube_id="...")`');
+    }
+    else if (msg.includes("user") &&
+        (msg.includes("not exist") || msg.includes("not found"))) {
         suggestions.push('User missing — run `memos_admin(action="create_user", user_id="dev_user")`, then retry');
     }
-    else if (msg.includes("not loaded") || (msg.includes("cube") && msg.includes("not found"))) {
+    else if (msg.includes("not loaded") ||
+        (msg.includes("cube") && msg.includes("not found"))) {
         suggestions.push('Cube not registered — run `memos_admin(action="register_cube", cube_id="...")` (find ids via `memos_admin(action="list_cubes")`), then retry');
     }
     suggestions.push("Check API health: `curl http://localhost:18000/health/detail`", "Check API logs for details");

package/dist/handlers/wiki-import.js

@@ -21,8 +21,8 @@ import { MEMOS_URL, MEMOS_USER, logger } from "../config.js";
 import { apiCallWithRetry } from "../api-client.js";
 import { ensureCubeRegistered } from "../cube-manager.js";
 import { parseMemoryWriteResponse } from "../memory-write-response.js";
-import { inspectWikiPages, normalizeLedger } from "../wiki-import-safety.js";
-import { buildFileBaseIndex } from "../wiki-relations.js";
+import { inspectWikiPages, normalizeLedger, } from "../wiki-import-safety.js";
+import { buildFileBaseIndex, } from "../wiki-relations.js";
 import { writeRelationsForPage } from "./wiki-import-relations.js";
 import { buildMemoryContent, parseWikiPage, stripTypePrefix, } from "../wiki-import-format.js";
 import { ERR_OPERATION_FAILED, ERR_PARAM_MISSING, cubeRegistrationError, errorResponse, getCubeIdFromArgs, } from "./utils.js";
@@ -55,7 +55,10 @@ function collectMarkdownFiles(pagesDir) {
     return files;
 }
 function contentHash(page) {
-    return crypto.createHash("sha256").update(`${page.type}\n${page.content}`).digest("hex");
+    return crypto
+        .createHash("sha256")
+        .update(`${page.type}\n${page.content}`)
+        .digest("hex");
 }
 function loadLedger(wikiDir) {
     const ledgerPath = path.join(wikiDir, LEDGER_FILE);
@@ -89,7 +92,9 @@ function saveLedger(wikiDir, ledger) {
         try {
             fs.unlinkSync(temp);
         }
-        catch { /* best effort */ }
+        catch {
+            /* best effort */
+        }
         return false;
     }
 }
@@ -109,7 +114,10 @@ function acquireImportLock(wikiDir) {
             }
         }
         const fd = fs.openSync(lockPath, "wx");
-        fs.writeFileSync(fd, JSON.stringify({ pid: process.pid, started_at: new Date(now).toISOString() }));
+        fs.writeFileSync(fd, JSON.stringify({
+            pid: process.pid,
+            started_at: new Date(now).toISOString(),
+        }));
         fs.closeSync(fd);
         return null;
     }
@@ -121,13 +129,20 @@ function releaseImportLock(wikiDir) {
     try {
         fs.unlinkSync(path.join(wikiDir, LOCK_FILE));
     }
-    catch { /* another process may own it */ }
+    catch {
+        /* another process may own it */
+    }
 }
 /** Returns the stored node, null when the memory does not exist, or an error string. */
 async function getStoredMemory(cubeId, memoryId) {
-    const result = await apiCallWithRetry("GET", `${MEMOS_URL}/memories/${cubeId}/${memoryId}`, cubeId, {}, ensureCubeRegistered);
+    const result = await apiCallWithRetry("GET", `${MEMOS_URL}/memories/${cubeId}/${memoryId}`, cubeId, 
+    // 同 handlers/memory.ts 的 handleMemosGet：缺 user_id 会让后端回退到 root，
+    // 对 MEMOS_USER 名下的 cube 报「does not have access」。这里更隐蔽 —— 该错误
+    // 既不含 "not found" 也不是 404，会被当成真实故障返回，把整页 import 判成失败。
+    { params: { user_id: MEMOS_USER } }, ensureCubeRegistered);
     if (result.success) {
-        return result.data?.data ?? null;
+        return (result.data
+            ?.data ?? null);
     }
     const msg = String(result.data?.message ?? "");
     if (msg.toLowerCase().includes("not found") || result.status === 404)
@@ -152,7 +167,8 @@ async function savePageAsMemory(cubeId, page) {
     const result = await apiCallWithRetry("POST", `${MEMOS_URL}/memories`, cubeId, { body }, ensureCubeRegistered);
     if (!result.success) {
         return {
-            error: String(result.data?.message ?? `HTTP ${result.status}`),
+            error: String(result.data?.message ??
+                `HTTP ${result.status}`),
             memoryIds: [],
             warnings: [],
             uncertain: false,
@@ -174,12 +190,12 @@ export async function handleMemosImportWiki(arguments_) {
     const projectPath = arguments_.project_path;
     const dryRun = arguments_.dry_run === true;
     const onEdit = arguments_.on_edit === "version" ? "version" : "skip";
-    const wikiDir = arguments_.wiki_dir
-        ?? (projectPath ? path.join(projectPath, "docs", "memory-wiki") : undefined);
+    const wikiDir = arguments_.wiki_dir ??
+        (projectPath ? path.join(projectPath, "docs", "memory-wiki") : undefined);
     if (!wikiDir) {
         return errorResponse("Need project_path (default wiki: <project_path>/docs/memory-wiki) or an explicit wiki_dir", ERR_PARAM_MISSING, [
             '`memos_import_wiki(project_path="/mnt/g/my/project")`',
-            'Run `memos_export_wiki` first, edit pages, then import',
+            "Run `memos_export_wiki` first, edit pages, then import",
         ]);
     }
     const resolvedDir = path.resolve(wikiDir);
@@ -189,7 +205,9 @@ export async function handleMemosImportWiki(arguments_) {
         return errorResponse(lockError, ERR_OPERATION_FAILED);
     try {
         if (!fs.existsSync(pagesDir)) {
-            return errorResponse(`No pages directory under '${resolvedDir}' — export a wiki first`, ERR_OPERATION_FAILED, [`memos_export_wiki(project_path="...") writes <project_path>/docs/memory-wiki/pages/`]);
+            return errorResponse(`No pages directory under '${resolvedDir}' — export a wiki first`, ERR_OPERATION_FAILED, [
+                `memos_export_wiki(project_path="...") writes <project_path>/docs/memory-wiki/pages/`,
+            ]);
         }
         const [regSuccess, regError] = await ensureCubeRegistered(cubeId);
         if (!regSuccess)
@@ -209,7 +227,10 @@ export async function handleMemosImportWiki(arguments_) {
             }
             const result = parseWikiPage(raw);
             if (result.ok)
-                parsed.push({ page: result.page, relPath: path.relative(resolvedDir, file) });
+                parsed.push({
+                    page: result.page,
+                    relPath: path.relative(resolvedDir, file),
+                });
             else if (result.foreign)
                 foreign += 1;
             else
@@ -252,7 +273,9 @@ export async function handleMemosImportWiki(arguments_) {
                 archived += 1;
                 continue;
             }
-            if (ledgerEntry && typeof ledgerEntry !== "string" && ledgerEntry.new_memory_ids.length > 0) {
+            if (ledgerEntry &&
+                typeof ledgerEntry !== "string" &&
+                ledgerEntry.new_memory_ids.length > 0) {
                 // The old page has already produced a new version; compare the edited
                 // content hash before doing another API lookup/version.
                 const mappedHash = ledgerEntry.content_hash;
@@ -306,7 +329,9 @@ export async function handleMemosImportWiki(arguments_) {
                 unchanged += 1;
                 continue;
             }
-            const ledgerHash = typeof ledgerEntry === "string" ? ledgerEntry : ledgerEntry?.content_hash;
+            const ledgerHash = typeof ledgerEntry === "string"
+                ? ledgerEntry
+                : ledgerEntry?.content_hash;
             if (ledgerHash === contentHash(page)) {
                 alreadyVersioned += 1;
                 continue;
@@ -370,7 +395,9 @@ export async function handleMemosImportWiki(arguments_) {
             lines.push("", `❌ 失败明细（前 ${REPORT_LIST_LIMIT} 条）：`, ...failures.slice(0, REPORT_LIST_LIMIT).map((s) => `- ${s}`));
         }
         if (apiWarnings.length > 0) {
-            lines.push("", "⚠️ API warnings:", ...apiWarnings.slice(0, REPORT_LIST_LIMIT).map((warning) => `- ${warning}`));
+            lines.push("", "⚠️ API warnings:", ...apiWarnings
+                .slice(0, REPORT_LIST_LIMIT)
+                .map((warning) => `- ${warning}`));
         }
         lines.push("", "ℹ️ 导入恢复 type/tags/confidence/status/时间字段；关联 wikilinks 写入 Neo4j 关系边；写入内容经过服务端凭据脱敏。");
         return [{ type: "text", text: lines.join("\n") }];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oh-memos-mcp",
-  "version": "3.1.6",
+  "version": "3.1.8",
   "description": "MCP Server for oh-memos — Intelligent Memory Management (Node.js, no Python required)",
   "type": "module",
   "main": "dist/index.js",