solopup-memory 0.21.0-beta.2 → 0.21.0-beta.3

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.21.0-beta.3 - private-memory exposure reduction
+
+- Exclude recognized personal profiles, birth details, health, intimate and private contact information from automatic index projection and unrelated capture/review context, including private source quotations.
+- Hide these records from default current/history memory searches; explicit includePrivate=true enables on-demand retrieval and its normal log/model exposure.
+- Preserve stored records, source identities and append-only session logs. Forget results now distinguish index withdrawal from historical erasure.
+- This is a conservative content classifier, not exhaustive PII detection, encryption, a file-access boundary, or remote deletion. Raw Markdown, source ledgers and existing archives still require separate handling.
+
 ## 0.21.0-beta.2 — explicit memory workflow
 
 - Move model-facing memory instructions into a separate protocol context, available with an empty index and reporting scoped write-tool availability.

package/README.en.md

@@ -2,7 +2,7 @@
 
 **Remember what matters. Keep up when you change your mind.** · [中文](README.md)
 
-Source-linked, layered **text memory** for DeepSeek Harness. **0.21.0-beta.2 is a public beta, not a stable release.** See [RELEASE.md](RELEASE.md) for tested scope and known gaps.
+Source-linked, layered **text memory** for DeepSeek Harness. **0.21.0-beta.3 is a public beta, not a stable release.** See [RELEASE.md](RELEASE.md) for tested scope and known gaps.
 
 - Separate global preferences from project decisions.
 - Keep original owner-message citations, conditions, exceptions and optional expiry.
@@ -14,10 +14,10 @@ Source-linked, layered **text memory** for DeepSeek Harness. **0.21.0-beta.2 is
 ## Install in DSH
 
 ```sh
-dsh plugin --profile desktop add solopup-memory@beta --ignore-scripts
+dsh plugin --profile desktop add github:OakcoderX/solopup-memory#v0.21.0-beta.3 --ignore-scripts
 ```
 
-The package is published on npm; use `solopup-memory@0.21.0-beta.2` for an exact version. Git installation remains available with `dsh plugin --profile desktop add github:OakcoderX/solopup-memory#v0.21.0-beta.2 --ignore-scripts`; the release page supplies a full commit SHA for an immutable Git pin. This package ships executable ESM and has no dependency installation or build scripts. Alternatively download its release tarball and install the local file with `dsh plugin --profile desktop add /absolute/path/to/solopup-memory-0.21.0-beta.2.tgz --offline --ignore-scripts`.
+This pins the privacy update; the release page supplies a full commit SHA for an immutable Git pin. npm availability may follow the GitHub release: check the registry and release notes before installing `solopup-memory@0.21.0-beta.3`. The npm beta tag may still point to an earlier release. This package ships executable ESM and has no dependency installation or build scripts. Alternatively download its release tarball and install the local file with `dsh plugin --profile desktop add /absolute/path/to/solopup-memory-0.21.0-beta.3.tgz --offline --ignore-scripts`.
 
 Restart the profile and use `memory_status`. Existing legacy stores may require explicit local review. Do not delete control files to bypass that review. If upgrading from `dsh-memory`, create a full private backup, stop the hosts using that data, remove the old package, then install SoloPup Memory. Do not run both packages together. The data location and legacy format identifiers are intentionally retained.
 
@@ -60,3 +60,5 @@ node accept.mjs --profile desktop
 MIT License. Copyright © 2026 oakfilm.
 
 Explicit requests to remember durable information are directed to the native `memory_write` tool in the same turn. A separate protocol context is available even when the memory store is empty. Personal self-reports remain claims; assistant guesses are not confirmed facts. Automatic capture uses short, code-bound source labels before the original identity and quote checks. This remains a public beta, and instructions do not guarantee model compliance.
+
+Recognized private content is excluded from automatic memory projection and unrelated saved-memory context in capture/admission review. Current and historical search hide it by default; includePrivate=true enables explicit on-demand retrieval. These are conservative content rules, not exhaustive classification or a filesystem security boundary. Raw Markdown and provenance remain local plaintext. Explicit retrieval still enters session history and model requests. Existing session archives, exports, backups and already-sent data are not erased.

package/README.md

@@ -2,10 +2,16 @@
 
 **记住重要的事，跟上你的改变。** · [English](README.en.md)
 
-当前公开版本为 **0.21.0-beta.2**，是文字记忆测试版，尚未通过稳定版验收。已验证范围和已知问题见 [RELEASE.md](RELEASE.md)。
+当前公开版本为 **0.21.0-beta.3**，是文字记忆测试版，尚未通过稳定版验收。已验证范围和已知问题见 [RELEASE.md](RELEASE.md)。
 
 把用户明确表达的长期偏好、项目决定、可查证线索和暂定信念保存下来，在后续对话中按项目与适用条件找回。首次公开版本只处理文字。
 
+## 个人资料与按需读取
+
+已识别的生日、性别、健康、亲密关系和私人联系方式默认不进入自动索引投影，也不作为无关后台整理或写入审查的旧记忆发送。普通 `memory_search` 默认隐藏这些内容；用户询问相关资料时，才明确使用 `includePrivate: true`。主题文件含有未分段的敏感内容时，普通搜索会保守跳过整个主题文件，安全的索引摘要仍可检索。
+
+这是内容规则提供的降载保护，不是完整的隐私分类器。未识别的改写仍可能漏过；文件工具仍能读原始文件，按需读取结果也会进入当前会话日志和模型请求。此版本没有把原始 `MEMORY.md` 改成无明文的指针库，没有擦除既有日志、缓存、备份或已发送数据。`memory_forget` 表示停止使用索引条目，不表示彻底删除个人信息。
+
 ## 工作过程
 
 1. 从本会话已接收的用户消息提出候选，并绑定原话引用。
@@ -42,10 +48,10 @@ Markdown 索引和主题正文便于阅读；来源、候选、历史与调用
 使用 DeepSeek Harness 官方插件管理器安装。代码为可直接执行的 ESM，无安装时构建脚本，也不需要 npm 账户。以下以 desktop profile 为例。
 
 ```sh
-dsh plugin --profile desktop add solopup-memory@beta --ignore-scripts
+dsh plugin --profile desktop add github:OakcoderX/solopup-memory#v0.21.0-beta.3 --ignore-scripts
 ```
 
-npm 包已公开发布，可使用 `solopup-memory@0.21.0-beta.2` 固定版本。Git 安装仍可用：`dsh plugin --profile desktop add github:OakcoderX/solopup-memory#v0.21.0-beta.2 --ignore-scripts`；需要不可变 Git 来源时，用发行页的完整提交 SHA 替换标签。也可下载发行页的 `.tgz`，使用 `dsh plugin --profile desktop add /absolute/path/to/solopup-memory-0.21.0-beta.2.tgz --offline --ignore-scripts`。
+以上固定本次修复版本；需要不可变 Git 来源时，用发行页的完整提交 SHA 替换标签。npm 发布可能晚于 GitHub，请先核对注册表和发行说明，再使用 `dsh plugin --profile desktop add solopup-memory@0.21.0-beta.3 --ignore-scripts`；旧的 `beta` 标签可能仍指向先前版本。也可下载发行页的 `.tgz`，使用 `dsh plugin --profile desktop add /absolute/path/to/solopup-memory-0.21.0-beta.3.tgz --offline --ignore-scripts`。
 
 已安装旧名 `dsh-memory` 时，先完成完整备份、关闭使用该库的宿主，用官方管理器移除旧包，再安装新包；不要同时启用两个记忆插件。新名字继续使用原记忆库和控制格式。
 

package/RELEASE.md

@@ -1,3 +1,13 @@
+# 0.21.0-beta.3 - private-memory exposure reduction
+
+Public beta. Conservative known-category filtering, not full privacy isolation or stable semantic acceptance.
+
+Recognized private summaries, details and quoted evidence are excluded from automatic memory projection and unrelated saved-memory context for capture and admission review. Default current/history searches hide this content; includePrivate=true allows on-demand retrieval. Existing records and original session logs are preserved. File tools can still read raw data, classifier coverage is incomplete, and on-demand output still enters logs and model requests. Raw-index pointer migration and physical history cleanup are not part of this release.
+
+Prior beta.2 evidence below is historical and not automatically a beta.3 result.
+
+---
+
 # 0.21.0-beta.2 — explicit memory workflow update
 
 Public beta, not stable semantic acceptance. The beta.1 evidence in the historical section below is not automatically a beta.2 result.

package/SECURITY.md

@@ -71,3 +71,7 @@
 ## 报告问题
 
 私密报告：在本机开 issue 或直接告知维护者，不要在公开渠道贴出可利用细节。
+
+## beta.3 privacy boundary
+
+Recognized private records, including their quoted evidence, are omitted from automatic projection and unrelated saved-memory contexts. The classifier is heuristic and incomplete; explicit [private] or [private:category] text is conservatively treated as on-demand. Searches default to excluding recognized private content; includePrivate=true is a disclosure control, not a user authentication boundary. Other tools can read the raw files. Private facts explicitly present in the current conversation or prior ordinary messages remain in that conversation. Existing append-only archives, caches, exports, backups and provider-side copies are not purged. Never claim that hiding an index or memory_forget erases those copies. Physical raw-index migration and reviewed local erasure are separate work.

package/index.mjs

@@ -5,6 +5,7 @@ export {initializeManagedMemory,managedMemoryStatus} from './managed-access.mjs'
 import {createObservationTracker,observationRoots,OBSERVATION_REFERENCE_SCHEMA,OBSERVATION_LIST_SCHEMA} from './tool-observations.mjs'
 import {createToolInputTracker} from './tool-inputs.mjs'
 import {memoryProtocol} from './memory-protocol.mjs'
+import {privateMemory,publicMemoryRecords,publicMemoryIndex,PRIVATE_MEMORY_NOTICE} from './privacy.mjs'
 import {nativeOwnerEvidence,validateNativeWrite} from './native-write-validation.mjs'
 import {toolProposal} from './source-record.mjs'
 import {revisionMode,prepareValueRevision,inheritedRoots} from './field-lineage.mjs'
@@ -291,8 +292,9 @@ function renderScopeLocal(scope, dir) {
   let flagged = 0
   const kept = []
   const policy = withdrawalPolicy(dir)
-  const typed=activeMeanings(candidateSnapshot(dir,scope).records),assessmentRecords=effectiveSourceRecords(dir,scope)
+  const typed=activeMeanings(candidateSnapshot(dir,scope).records),assessmentRecords=publicMemoryRecords(effectiveSourceRecords(dir,scope))
   for (const line of filterWithdrawn(index.text, policy, true).split('\n')) {
+    if (privateMemory(meaningForLine(typed,line),line)) continue
     if (line.trim().startsWith('- [')) {
       if (isExpired(line, now)) {
         hidden += 1
@@ -1048,16 +1050,19 @@ function writeMemoryLocal({ type, dir, line, detail, summary, expires, supersede
       evidence: provenance?.evidence,
       basis: provenance?.basis,
     })
+    const privateLines=new Set(liveSourceRecords(dir,scope).filter(privateMemory).map(record=>record.indexLine).filter(Boolean))
+    const hiddenLine=line=>privateLines.has(line)||privateMemory(line)
+    const visibleWarnings=warnings.filter(w=>!privateMemory(w)&&![...privateLines].some(line=>w.includes(summaryOf(line))))
     return {
       path: indexFile,
       indexLine: cleanLine,
       duplicate: false,
       lineCount: next.split(/\r?\n/).length,
       ...(detailPath === undefined ? {} : { detailPath }),
-      ...(supersededLine === undefined ? {} : { superseded: supersededLine }),
+      ...(supersededLine === undefined||hiddenLine(supersededLine) ? {} : { superseded: supersededLine }),
       id: newId,
-      related,
-      ...(warnings.length === 0 ? {} : { warning: warnings.join('；') }),
+      related:related.filter(edge=>!hiddenLine(edge.line)),
+      ...(visibleWarnings.length === 0 ? {} : { warning: visibleWarnings.join('；') }),
     }
   }
   return lockToken === REVIEW_LOCK ? execute() : withLock(dir, execute)
@@ -1245,7 +1250,7 @@ function effectiveSourceRecords(dir,scope,indexText,includeUntyped=false){
 }
 
 /** Current index-only legacy entries are visible as unclassified data, never inherited sources. */
-function validationCurrentRecords(dir,scope,records){
+function validationCurrentRecords(dir,scope,records,privateTarget){
  const policy=withdrawalPolicy(dir),index=filterWithdrawn(readTextSafe(join(dir,'MEMORY.md'))??'',policy,true)
  const known=new Set(records.map(r=>r.indexLine??indexLine(r.type,r.summary,r.expires,r.detail!==undefined))),rows=[...records]
  for(const line of new Set(index.split(/\r?\n/).map(line=>line.trim()))){
@@ -1253,7 +1258,7 @@ function validationCurrentRecords(dir,scope,records){
   const type=/^- \[(user|feedback|project|reference)\] /.exec(line)?.[1];if(!type)continue
   rows.push({id:createHash('sha256').update('memory-unclassified-current-index:'+scope+':'+line).digest('hex'),status:'recorded',scope,type,summary:summaryOf(line),indexLine:line,legacyIndexOnly:true,expires:/ \(exp:(\d{4}-\d{2}-\d{2})\)$/.exec(line)?.[1]})
  }
- return rows
+ return rows.filter(row=>!privateMemory(row)||typeof privateTarget==='string'&&privateTarget.length>0&&row.indexLine?.includes(privateTarget))
 }
 
 function publishIndexChange(dir,before,after,reason){
@@ -1269,6 +1274,7 @@ function searchHistoricalStores(stores,needle,options,context,task,limit,mode){
     const policy=withdrawalPolicy(dir),index=filterWithdrawn(readTextSafe(join(dir,'MEMORY.md'))??'',policy,true)
     const result=historyRows(dir,{scope,index,revoked:policy.revoked,atSequence:options.atSequence,asOf:options.asOf,expiredAt:isExpired});coverage.push(result.coverage)
     for(const {row,line,history}of result.rows){
+      if(options.includePrivate!==true&&privateMemory(row.source,row.line))continue
       const interpretation=row.source.meaning?meaningView(row.source,context,task):undefined
       if(interpretation?.applicability==='not-applicable')continue
       if(interpretation)interpretation.advice={action:'continue',reason:'historical-record-is-not-a-current-instruction',authority:'none'}
@@ -1298,6 +1304,7 @@ function searchScopedStoresLocal(stores, query, options = {}) {
   if (needle.length > 200) throw new Error('memory_search: query 太长（上限 200 字）')
   const limit = Math.max(1, Math.min(20, options.limit ?? 8))
   const mode = options.mode ?? 'ranked'
+  if(options.includePrivate!==undefined&&typeof options.includePrivate!=='boolean')throw Error('memory-search-invalid-private-option')
   if (mode !== 'exact' && mode !== 'ranked') throw new Error('memory_search: mode 必须是 exact 或 ranked')
   const context=normalizeContext(options.context),task=normalizeTask(options.task)
   if(options.view!==undefined&&!['current','history'].includes(options.view))throw new Error('memory-search-invalid-view')
@@ -1306,7 +1313,7 @@ function searchScopedStoresLocal(stores, query, options = {}) {
 
   const files = stores.flatMap(({ dir, scope }) => {
     const policy = withdrawalPolicy(dir)
-    const owned=liveSourceRecords(dir,scope).filter(record=>['recorded','adopted'].includes(record.status)),typed=activeMeanings(owned),assessmentRecords=effectiveSourceRecords(dir,scope)
+    const owned=liveSourceRecords(dir,scope).filter(record=>['recorded','adopted'].includes(record.status)),typed=activeMeanings(owned),assessmentRecords=options.includePrivate===true?effectiveSourceRecords(dir,scope):publicMemoryRecords(effectiveSourceRecords(dir,scope))
     return ['MEMORY.md', ...TYPES.map(type => `${type}.md`)].map(name => ({
       name, path: join(dir, name), policy, scope, typed, owned, assessmentRecords, key: scope === undefined ? name : `${scope}/${name}`,
     }))
@@ -1319,12 +1326,16 @@ function searchScopedStoresLocal(stores, query, options = {}) {
   for (const file of files) {
     const text = readTextSafe(file.path)
     if (text === undefined) continue
+    // Legacy topic paragraphs may span lines without record markers. Never
+    // return the unlabelled continuation of a recognized private paragraph.
+    if(file.name!=='MEMORY.md'&&options.includePrivate!==true&&privateMemory(text))continue
     let lineNumber = 0
     const filtered=filterWithdrawn(text,file.policy,file.name==='MEMORY.md'),details=file.name==='MEMORY.md'?undefined:detailedMeanings(file.owned,filtered)
     for (const raw of filtered.split('\n')) {
       lineNumber += 1
       if(file.name==='MEMORY.md'&&isExpired(raw))continue
       const record=file.name==='MEMORY.md'?meaningForLine(file.typed,raw):details.get(lineNumber)
+      if(options.includePrivate!==true&&privateMemory(record,raw))continue
       if(record?.expires&&isExpired(`placeholder (exp:${record.expires})`))continue
       const interpretation=record?.meaning?meaningView(record,context,task,file.assessmentRecords):undefined
       if(interpretation?.applicability==='not-applicable')continue
@@ -1599,6 +1610,8 @@ function readLog(dir) {
  * @param query - `{ id }` 或 `{ match }`（索引行子串，必须唯一）。
  */
 function lookupLinksLocal(dir, query) {
+  const hiddenLines=new Set(liveSourceRecords(dir).filter(privateMemory).map(record=>record.indexLine).filter(Boolean))
+  const hidden=line=>hiddenLines.has(line)||privateMemory(line)
   assertPublicationClear(dir)
   const policy = withdrawalPolicy(dir)
   const events = readLog(dir).filter((e) => !policy.memoryIds.includes(e.id) && !policy.lineHashes.includes(normalizedLineHash(String(e.line ?? ''))))
@@ -1607,7 +1620,7 @@ function lookupLinksLocal(dir, query) {
   const live = new Map()
   for (const line of current.split('\n')) {
     const trimmed = line.trim()
-    if (trimmed.startsWith('- [')) live.set(entryId(trimmed), trimmed)
+    if (trimmed.startsWith('- [')&&!hidden(trimmed)) live.set(entryId(trimmed), trimmed)
   }
 
   let key = query.id
@@ -1628,8 +1641,9 @@ function lookupLinksLocal(dir, query) {
   const inserted = events.filter((event) => event.op === 'insert' && event.id === key)
   const line = live.get(key) ?? inserted.at(-1)?.line ?? events.find((event) => event.id === key)?.line
   if (line === undefined) return { found: false, related: [], backlinks: [] }
+  if(hidden(line))return{found:false,related:[],backlinks:[]}
 
-  const related = inserted.at(-1)?.related ?? []
+  const related = (inserted.at(-1)?.related ?? []).filter(item=>!hidden(item.line))
 
   // 入边要顺着取代链找：指向被取代旧条目的边，等同指向新条目。
   // 否则「改了一条记忆」就等于把它从图上拔掉。
@@ -1640,6 +1654,7 @@ function lookupLinksLocal(dir, query) {
   const backlinks = []
   for (const event of events) {
     if (event.op !== 'insert' || lineage.has(event.id)) continue
+    if(hidden(event.line))continue
     if (!(event.related ?? []).some((item) => lineage.has(item.id))) continue
     if (backlinks.some((item) => item.id === event.id)) continue
     backlinks.push({ id: event.id, line: event.line })
@@ -1661,7 +1676,7 @@ function lookupLinksLocal(dir, query) {
     backlinks: backlinks.slice(0, RELATION_LIMIT),
     backlinksTotal: backlinks.length,
     ...(replaced?.supersededById === undefined ? {} : { supersededById: replaced.supersededById }),
-    ...(supersedesLine === undefined ? {} : { supersedesLine }),
+    ...(supersedesLine === undefined||hidden(supersedesLine) ? {} : { supersedesLine }),
   }
 }
 
@@ -1777,7 +1792,7 @@ async function admitNativeWrite(ctx,sourceInputs,config,args,exec,target){
   const revision=readOwned(()=>{
     const value=storeRevision(target.dir)
     const sourceRecords=effectiveSourceRecords(target.dir,target.scope,undefined,true)
-    currentRecords=validationCurrentRecords(target.dir,target.scope,sourceRecords)
+    currentRecords=validationCurrentRecords(target.dir,target.scope,sourceRecords,target.supersedes)
     if(target.supersedes!==undefined){
       const hits=(readTextSafe(join(target.dir,'MEMORY.md'))??'').split(/\r?\n/).filter(line=>line.trim().startsWith('- [')&&line.includes(target.supersedes));if(hits.length!==1)throw Error('memory-native-supersedes-not-unique')
       const compiled=prepareValueRevision(target,sourceRecords,hits[0].trim())
@@ -1946,6 +1961,7 @@ function defineSearchTool(ctx) {
     name: 'memory_search',
     description:
       '在记忆索引与主题文件里检索。默认 ranked 支持中英多词问题与有限英文词形归并；exact 用于精确子串定位；' +
+      '默认隐藏已识别的个人敏感内容。用户询问相关资料时才设includePrivate=true；返回内容会进入当前会话日志和模型请求，不能声称只在本地读取。' +
       '默认同时查当前项目和全局偏好，不查其他项目；可指定单库。view=history显式查询带来源的旧值、取代与移出记录，返回历史身份及覆盖范围，不能当当前指令。',
     parameters: {
       type: 'object',
@@ -1953,6 +1969,7 @@ function defineSearchTool(ctx) {
       required: ['query'],
       properties: {
         query: { type: 'string', description: '检索词，尽量具体（≤200 字）；也可给返回的完整64位recordId精确定位来源条目，不能用8位索引id' },
+        includePrivate:{type:'boolean',description:'仅在用户询问相关个人资料时明确设true，允许读取被自动降载的个人内容。默认false；不是文件访问权限或完整隐私识别器。'},
         mode: { type: 'string', enum: ['exact', 'ranked'], description: 'ranked 默认多词排序；exact 精确定位。不是语义向量检索，不支持完整同义词或英文词形分析' },
         view:{type:'string',enum:['current','history'],description:'current默认只查当前视图；history查受管历史档案（已撤回来源仍不可见）。旧日志不会被伪造成完整历史。'},
         atSequence:{type:'integer',description:'仅history：按选定单库的记录序号查询当时有效的条目，必须指定scope=project或global；不是跨库统一版本。'},
@@ -2000,10 +2017,10 @@ function defineSearchTool(ctx) {
         return searchScopedStores([
           { dir: resolveStoreDir(ctx, exec, 'memory_search', 'project'), scope: 'project' },
           { dir: resolveStoreDir(ctx, exec, 'memory_search', 'global'), scope: 'global' },
-        ], args.query, { limit: args.limit, mode: args.mode, context:args.context,task:args.task,view:args.view,atSequence:args.atSequence,asOf:args.asOf })
+        ], args.query, { includePrivate:args.includePrivate,limit: args.limit, mode: args.mode, context:args.context,task:args.task,view:args.view,atSequence:args.atSequence,asOf:args.asOf })
       }
       const dir = resolveStoreDir(ctx, exec, 'memory_search', args.scope)
-      return searchStore(dir, args.query, { limit: args.limit, mode: args.mode, context:args.context,task:args.task,view:args.view,atSequence:args.atSequence,asOf:args.asOf })
+      return searchStore(dir, args.query, { includePrivate:args.includePrivate,limit: args.limit, mode: args.mode, context:args.context,task:args.task,view:args.view,atSequence:args.atSequence,asOf:args.asOf })
     },
   }
 }
@@ -2255,7 +2272,7 @@ function defineForgetTool(ctx) {
           text:
             value.removed === 0
               ? `没有匹配到任何索引行：${value.path}`
-              : `已删除 ${value.removed} 条（${value.path}）`,
+              : `已停止使用 ${value.removed} 条索引记忆（${value.path}）。原话、主题正文、会话日志、备份及已发送内容未由此清除；这不是历史数据擦除。`,
         },
       ],
     },
@@ -2430,13 +2447,14 @@ function setupAutoCapture(ctx, config) {
         const captureDirs=[storeRoot(),projectDir].filter(Boolean)
         const memorySnapshot=managedReadMany(captureDirs,()=>{
           const stores=captureDirs.map(dir=>{const scope=dir===storeRoot()?'global':'project',policy=withdrawalPolicy(dir);return{dir,scope,policy,records:effectiveSourceRecords(dir,scope,undefined,true),indexLines:filterWithdrawn(readTextSafe(join(dir,'MEMORY.md'))??'',policy,true).split('\n').map(line=>line.trim()).filter(line=>line.startsWith('- [')).slice(-60)}})
-          const projections=stores.flatMap(store=>store.records.flatMap(record=>{
+          for(const store of stores)store.indexLines=publicMemoryIndex(store.indexLines,store.records)
+          const projections=stores.flatMap(store=>publicMemoryRecords(store.records).flatMap(record=>{
             const line=record.indexLine??indexLine(record.type,record.summary,record.expires,record.detail!==undefined)
             if(!store.indexLines.includes(line))return[]
             const topic=filterWithdrawn(readTextSafe(join(store.dir,record.type+'.md'))??'',store.policy)
             return[captureProjection(record,store.scope,`[${store.scope}] ${line}`,topic)]
           })).slice(-60)
-          return{validationRecords:stores.flatMap(store=>validationCurrentRecords(store.dir,store.scope,store.records)),sourceRecords:stores.flatMap(store=>store.records),structuredRecords:projections,relationTargets:stores.flatMap(store=>store.records.filter(record=>['claim','belief'].includes(record.meaning?.kind)&&!record.meaning.relations?.length).map(record=>({scope:store.scope,recordId:record.id,kind:record.meaning.kind,summary:record.summary}))).slice(-60),revisions:new Map(captureDirs.map(dir=>[dir,{value:storeRevision(dir)}])),indexLines:stores.flatMap(store=>store.indexLines.map(line=>`[${store.scope}] ${line}`))}
+          return{validationRecords:stores.flatMap(store=>validationCurrentRecords(store.dir,store.scope,store.records)),sourceRecords:stores.flatMap(store=>store.records),structuredRecords:projections,relationTargets:stores.flatMap(store=>publicMemoryRecords(store.records).filter(record=>['claim','belief'].includes(record.meaning?.kind)&&!record.meaning.relations?.length).map(record=>({scope:store.scope,recordId:record.id,kind:record.meaning.kind,summary:record.summary}))).slice(-60),revisions:new Map(captureDirs.map(dir=>[dir,{value:storeRevision(dir)}])),indexLines:stores.flatMap(store=>store.indexLines.map(line=>`[${store.scope}] ${line}`))}
         })
         const revisions=memorySnapshot.revisions
         // 按类型分库：跨项目的偏好/纠正进全局库，项目决定进项目库。
@@ -2803,7 +2821,7 @@ export function apply(ctx, config = {}) {
 
   ctx.systemPrompt.context({
     name: 'memory:protocol', order: CONTEXT_ORDER - 1, required: true,
-    interpolate: false, text: context => memoryProtocol(ctx, context),
+    interpolate: false, text: context => memoryProtocol(ctx, context)+'\n'+PRIVATE_MEMORY_NOTICE,
   })
 
   ctx.systemPrompt.context({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "solopup-memory",
-  "version": "0.21.0-beta.2",
+  "version": "0.21.0-beta.3",
   "description": "SoloPup Memory — source-linked, layered text memory for DeepSeek Harness. Public beta.",
   "type": "module",
   "main": "index.mjs",
@@ -147,7 +147,9 @@
     "RELEASE.md",
     "memory-protocol.mjs",
     "capture-source-aliases.mjs",
-    "test-explicit-memory.mjs"
+    "test-explicit-memory.mjs",
+    "privacy.mjs",
+    "test-privacy.mjs"
   ],
   "engines": {
     "node": ">=24.9",
@@ -160,7 +162,7 @@
   },
   "license": "MIT",
   "scripts": {
-    "test": "node --test --test-concurrency=4 test.mjs test-security.mjs test-adversarial.mjs test-concurrency.mjs test-supersede.mjs test-history.mjs test-smell.mjs test-links.mjs test-packaging.mjs test-patch.mjs test-compat.mjs test-conflict.mjs test-usability.mjs test-compaction-compat.mjs test-schema.mjs test-capture.mjs test-paired-analysis.mjs test-retrieval.mjs test-candidates.mjs test-publication.mjs test-withdrawal.mjs test-capture-jobs.mjs test-context-history.mjs test-capture-inputs.mjs test-inline-summary.mjs test-withdrawal-archives.mjs test-plugin-contract.mjs test-project-stores.mjs test-service-readiness.mjs test-source-key.mjs test-tool-inputs.mjs test-tool-write-lifecycle.mjs test-tool-write-guard.mjs test-source-retirement.mjs test-managed-access.mjs test-managed-activation.mjs test-runtime-startup.mjs test-capture-revision.mjs test-meaning.mjs test-episodes.mjs test-belief-revision.mjs test-tool-observations.mjs test-capture-diagnostics.mjs test-snapshots.mjs test-restore.mjs test-status-both.mjs test-text-admission.mjs test-capture-submission.mjs test-capture-projections.mjs test-capture-validation.mjs test-capture-validation-job.mjs test-capture-validation-flow.mjs test-capture-validation-lineage.mjs test-native-write-validation.mjs test-native-service-lifecycle.mjs test-field-lineage.mjs test-capture-field-lineage.mjs test-validation-transition-context.mjs test-control-schema.mjs test-revision-admission.mjs test-rule-admission.mjs test-validation-source-refs.mjs test-source-completeness.mjs test-legacy-source-identity.mjs test-explicit-memory.mjs",
+    "test": "node --test --test-concurrency=4 test.mjs test-security.mjs test-adversarial.mjs test-concurrency.mjs test-supersede.mjs test-history.mjs test-smell.mjs test-links.mjs test-packaging.mjs test-patch.mjs test-compat.mjs test-conflict.mjs test-usability.mjs test-compaction-compat.mjs test-schema.mjs test-capture.mjs test-paired-analysis.mjs test-retrieval.mjs test-candidates.mjs test-publication.mjs test-withdrawal.mjs test-capture-jobs.mjs test-context-history.mjs test-capture-inputs.mjs test-inline-summary.mjs test-withdrawal-archives.mjs test-plugin-contract.mjs test-project-stores.mjs test-service-readiness.mjs test-source-key.mjs test-tool-inputs.mjs test-tool-write-lifecycle.mjs test-tool-write-guard.mjs test-source-retirement.mjs test-managed-access.mjs test-managed-activation.mjs test-runtime-startup.mjs test-capture-revision.mjs test-meaning.mjs test-episodes.mjs test-belief-revision.mjs test-tool-observations.mjs test-capture-diagnostics.mjs test-snapshots.mjs test-restore.mjs test-status-both.mjs test-text-admission.mjs test-capture-submission.mjs test-capture-projections.mjs test-capture-validation.mjs test-capture-validation-job.mjs test-capture-validation-flow.mjs test-capture-validation-lineage.mjs test-native-write-validation.mjs test-native-service-lifecycle.mjs test-field-lineage.mjs test-capture-field-lineage.mjs test-validation-transition-context.mjs test-control-schema.mjs test-revision-admission.mjs test-rule-admission.mjs test-validation-source-refs.mjs test-source-completeness.mjs test-legacy-source-identity.mjs test-explicit-memory.mjs test-privacy.mjs",
     "eval": "node eval/run-eval.mjs",
     "gate": "node eval/run-eval.mjs --check",
     "verify": "node scripts/verify.mjs",

package/privacy.mjs

@@ -0,0 +1,25 @@
+/** Conservative exposure reduction, not a confidentiality boundary or exhaustive PII detector. */
+import {normalizeText} from './security.mjs'
+const patterns = [
+  ['exact-dob', /生日|出生(?:日期|年月|于|在)?|\bbirth(?:day|date)\b|\bdate\s+of\s+birth\b|\bdob\b|\bborn\b/i],
+  ['personal-profile', /个人档案|性别|男性|女性|\bpersonal\s+profile\b|\bgender\b/i],
+  ['health', /病史|医疗诊断|疾病诊断|医生诊断|诊断(?:为|出)|用药|过敏|怀孕|月经|健康状况|医疗资料|\bmedical\b|\bclinical\s+diagnosis\b|\bdiagnosed\s+with\b|\bmedication\b/i],
+  ['intimate', /亲密关系|性取向|性生活|性行为|伴侣|男朋友|女朋友|前任|恋爱|情人|\bsexual\b|\bintimate\b|\bromantic\b/i],
+  ['personal-contact', /身份证|护照号码|家庭住址|私人电话|银行卡号|\bpassport\s+number\b|\bhome\s+address\b/i],
+  ['marked-private', /\[private(?::[a-z-]+)?\]|保密资料|私密档案|敏感个人/i],
+]
+
+export function memoryPrivacy(value, line = '') {
+  const content = typeof value === 'string' ? value : value && typeof value === 'object'
+    ? [value.summary, value.detail, value.indexLine, JSON.stringify(value.meaning ?? {}),
+      ...(value.evidence ?? []).map(e => e.quote), JSON.stringify(value.fieldLineage ?? {})].filter(Boolean).join('\n') : ''
+  const text = normalizeText(content + '\n' + line)
+  const categories = patterns.filter(([, pattern]) => pattern.test(text)).map(([category]) => category)
+  return {exposure: categories.length ? 'on-demand' : 'automatic', categories}
+}
+export const privateMemory = (value, line = '') => memoryPrivacy(value, line).exposure === 'on-demand'
+export function publicMemoryRecords(records) { return records.filter(record => !privateMemory(record)) }
+export function publicMemoryIndex(lines, records) {
+  return lines.filter(line => !privateMemory(records.find(record => record.indexLine === line || line.endsWith(' ' + record.indexLine)), line))
+}
+export const PRIVATE_MEMORY_NOTICE = '个人资料可能按需保存在本地；未自动提供其内容。仅在用户询问相关资料时使用 memory_search 并明确 includePrivate=true。读取结果仍会进入当前会话及模型请求；这不是加密或文件访问隔离。'

package/test-native-write-validation.mjs

@@ -40,6 +40,12 @@ test('native approval publishes the unchanged typed candidate; exact replay is a
  assert.equal(result.status,'recorded');assert.equal(f.records()[0].summary,proposal.summary);assert.equal(f.requests.length,1)
  assert.equal((await f.tool.execute(proposal,exec)).status,'duplicate');assert.equal(f.requests.length,1)
 }))
+test('unrelated native admission does not disclose saved private records to its reviewer',()=>box({duringStream:(_f,input)=>{
+ assert.doesNotMatch(JSON.stringify(input.currentMemory),/1993|4月16|个人档案/)
+}},async f=>{
+ writeFixtureMemory({dir:f.root,type:'user',scope:'global',summary:'个人档案：出生于1993年4月16日，女性',meaning:{kind:'claim'}})
+ f.owner();const result=await f.tool.execute(proposal,f.call());assert.equal(result.status,'recorded')
+}))
 test('definite rejection leaves no current or pending memory and does not render success',()=>box({state:'unsupported'},async f=>{
  f.owner();const result=await f.tool.execute(proposal,f.call());assert.equal(result.status,'rejected');assert.equal(f.records().length,0);assert.doesNotMatch(f.rendered(result),/已写入/);assert.equal(searchStore(f.root,'长期反馈').hits.length,0)
 }))

package/test-privacy.mjs

@@ -0,0 +1,65 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import {mkdtempSync,realpathSync,mkdirSync,readFileSync,writeFileSync,rmSync} from 'node:fs'
+import {join} from 'node:path'
+import {tmpdir} from 'node:os'
+import {apply,searchStore,lookupLinks} from './index.mjs'
+import {writeFixtureMemory} from './fixture-host.mjs'
+import {memoryPrivacy,privateMemory,publicMemoryRecords,publicMemoryIndex} from './privacy.mjs'
+
+test('actual background extractor receives no unrelated saved private source or summary',async()=>{
+  const home=realpathSync(mkdtempSync(join(tmpdir(),'memory-private-background-'))),old=process.env.DSH_HOME;process.env.DSH_HOME=home
+  const cwd=join(home,'project'),handlers=[],effects=[];mkdirSync(cwd);let requestText,finished=false
+  const llm={async prepareCall(config){return{config,async*stream(request){requestText=JSON.stringify(request);yield{type:'text-delta',text:'[]'};yield{type:'finish',reason:{kind:'stop'}};finished=true}}}}
+  try{
+    apply({llm,systemPrompt:{context(){}},workingDirectory:{get:()=>cwd},tools:{register(){}},on:(name,fn)=>handlers.push([name,fn]),effect:fn=>effects.push(fn())},
+      {autoCapture:{everyTurns:1,provider:'fixture',model:'fixture'}})
+    writeFixtureMemory({dir:join(home,'memory'),type:'user',scope:'global',summary:'个人档案：出生于1993年4月16日，女性',meaning:{kind:'claim'}})
+    const session={id:'synthetic-unrelated-work'},emit=e=>{for(const [n,f]of handlers)if(n==='session/event')f(session,e)}
+    emit({type:'user/message',seq:1,data:{source:{kind:'user'},content:[{type:'text',text:'本项目以后交付字幕时固定先检查断句。'}]}})
+    emit({type:'step/end',seq:2})
+    for(let i=0;i<100&&!finished;i++)await new Promise(r=>setTimeout(r,5))
+    assert.equal(finished,true)
+    assert.doesNotMatch(requestText,/1993|4月16|个人档案：/)
+  }finally{for(const f of effects.reverse())if(typeof f==='function')f();if(old===undefined)delete process.env.DSH_HOME;else process.env.DSH_HOME=old;rmSync(home,{recursive:true,force:true})}
+})
+
+test('known personal categories default to on-demand, including evidence-only private data',()=>{
+  for(const text of ['生日是1993年4月16日','个人档案：女性','病史与用药资料','亲密关系与伴侣','家庭住址','[private:personal] opaque','birthday is April 16'])assert.equal(privateMemory(text),true)
+  assert.equal(privateMemory({summary:'工作反馈先给结论',evidence:[{quote:'我的生日是1993年4月16日，我希望先给结论。'}]}),true)
+  assert.equal(memoryPrivacy('字幕交付先检查中英断句').exposure,'automatic')
+  assert.equal(privateMemory('工具失败的原生记录仅用于诊断'),false)
+})
+test('background projections and pointers omit private evidence without changing originals',()=>{
+  const secret={indexLine:'- [user] 个人档案：出生于1993年4月16日 — user.md',summary:'个人档案：出生于1993年4月16日',evidence:[]}
+  const mixed={indexLine:'- [user] 回答先给结论 — user.md',summary:'回答先给结论',evidence:[{quote:'我的生日是1993年4月16日，回答先给结论'}]}
+  const safe={indexLine:'- [feedback] 字幕保留断句 — feedback.md',summary:'字幕保留断句',evidence:[]}
+  const records=[secret,mixed,safe],before=JSON.stringify(records)
+  assert.deepEqual(publicMemoryRecords(records),[safe])
+  assert.deepEqual(publicMemoryIndex(records.map(r=>r.indexLine),records),[safe.indexLine])
+  assert.equal(JSON.stringify(records),before)
+})
+test('real plugin render and both current/history search hide private records by default',()=>{
+  const home=realpathSync(mkdtempSync(join(tmpdir(),'memory-privacy-'))),old=process.env.DSH_HOME;process.env.DSH_HOME=home
+  const cwd=join(home,'project'),providers=[],tools=[];mkdirSync(cwd)
+  try{
+    apply({systemPrompt:{context:p=>providers.push(p)},workingDirectory:{get:()=>cwd},tools:{register:t=>tools.push(t),schemas:()=>[{name:'memory_write'}]},on(){},effect(){}},{autoCapture:{enabled:false}})
+    const dir=join(home,'memory'),secret='固定个人档案：出生于1993年4月16日，女性。'
+    const privateWrite=writeFixtureMemory({dir,type:'user',scope:'global',summary:secret,detail:'私人资料分行\n1993-04-16\n女性',meaning:{kind:'claim'}})
+    writeFixtureMemory({dir,type:'feedback',scope:'global',summary:'字幕验收先看断句',meaning:{kind:'preference'}})
+    const before=readFileSync(join(dir,'MEMORY.md'),'utf8')
+    const rendered=providers.find(p=>p.name==='memory:index').text({agent:{session:{}}})
+    assert.doesNotMatch(rendered,/1993|女性|固定个人档案/)
+    assert.match(rendered,/字幕验收先看断句/)
+    assert.match(providers.find(p=>p.name==='memory:protocol').text({agent:{session:{}}}),/includePrivate=true/)
+    assert.equal(searchStore(dir,'1993',{mode:'exact'}).hits.length,0)
+    assert.ok(searchStore(dir,'1993',{mode:'exact',includePrivate:true}).hits.length>0)
+    assert.equal(lookupLinks(dir,{id:privateWrite.id}).found,false)
+    assert.equal(lookupLinks(dir,{match:'个人档案'}).found,false)
+    assert.equal(searchStore(dir,'1993',{mode:'exact',view:'history',scope:'global'}).hits.length,0)
+    assert.ok(searchStore(dir,'1993',{mode:'exact',view:'history',scope:'global',includePrivate:true}).hits.length>0)
+    assert.throws(()=>searchStore(dir,'1993',{includePrivate:'true'}),/private-option/)
+    assert.equal(readFileSync(join(dir,'MEMORY.md'),'utf8'),before)
+    assert.ok(tools.find(t=>t.name==='memory_search').parameters.properties.includePrivate)
+  }finally{if(old===undefined)delete process.env.DSH_HOME;else process.env.DSH_HOME=old;rmSync(home,{recursive:true,force:true})}
+})

package/version.mjs

@@ -2,4 +2,4 @@
  * 版本单点。package.json 里的 version 必须与它一致，由 test-packaging.mjs 断言。
  * 打包工具不能读 ESM 常量时会回退读 package.json，所以两处都要在。
  */
-export const VERSION = '0.21.0-beta.2'
+export const VERSION = '0.21.0-beta.3'