dsh-mnemos
为 DeepSeek Harness 提供跨会话记忆、治理、自我演化和需审批的写入路径。包括按热度排序的召回、环境约定、遗忘生命周期、替代链、投毒防御、自动提炼和开放的测量 ABI。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add dsh-mnemos@0.2.0Mnemos 以 dsh-mnemos 发布，当前版本为 0.2.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
A governed, self-evolving, extensible DSH plugin for cross-session memory.
Compatibility: adapted to DSH v0.1.2-rc.1.
The whole thing hangs on four design principles.
Every memory passes a gate — auditable. Every write — model tools, /memory, third-party plugins, the browser — goes through one approval gate: sensitive / duplicate / out-of-budget writes are rejected, risky ones wait for a human. Model/import/third-party memories are marked unverified and bounded at injection (anti-poisoning). Every write / approval / rejection is audited.
It evolves and corrects itself. Sessions distill into ordinary memories. Any active non-protocol memory can be formally written as a DSH SKILL, a standard Markdown skill file any agent can load on demand, after which the source memory is soft-deleted so the skill is the only active form. Facts update in place (the old value stays recoverable in git); only genuine conflicts become replacement proposals for a human. Heat-based cleanup keeps the store bounded (active → archived → restorable; pinned never leaves).
Your data — importable from other agents, manageable, cross-device syncable. Local SQLite (WAL + FTS5); every memory is also a Markdown file in a git repo — history, diff, rollback, restore, backup, and cross-device sync (via push/pull). Imports ChatGPT / Claude Code / Codex / DSH history.
An open memory bus. ctx.mnemosBus is an open memory bus: any DSH plugin can recall memories, record its own (stamped with a declared identity, always routed to the human approval queue), and subscribe to memory changes — plus runtime blacklist and revocation. A versioned ABI (ctx.mnemosAbi) exposes real effect numbers to external tools, proven by a conformance suite. Details in the For developers section.
memory_search (recall) · memory_record (write one entry now, gated, can update an outdated memory in place) · memory_distill (batch-distill the buffered conversation → memory candidates, incremental dedup) · memory_to_skill (formalize one memory as a skill) · memory_list · memory_stats.memory_get or memory_research. When more than N minutes have passed and a keyword hits, the matching index entries are injected again.protocol-typed memories (environment/tool conventions, e.g. sandbox constraints) ride a separate channel: injected once at the session's first step and re-attached after each context compaction, so they are always present before the agent acts; they never enter the memory index.memory_get or memory_search call counts as a hit./memory search <query> | list | stats
/memory approve <id> | reject <id>
/memory import <source> <path> auto-detected: chatgpt|claude|codex|dsh
/memory distill [path]
/memory skill list
/memory git <status|log|rollback|restore|remote|push|pull|backup>
/memory bus <blacklist|unblacklist|list|revoke|writers>
memory_record (one entry written now), distillation hands the whole buffered conversation to a dedicated specialist that batch-mines memory candidates and conflict-replacement proposals in one pass; an incremental cursor ensures already-distilled content is never reprocessed. Each memory carries 2–5 keywords (triggering injection), and all candidates pass the approval gate. memory_to_skill formally writes an approved active non-protocol memory as a portable DSH SKILL and then soft-deletes the source memory.ctx.mnemosBusdsh-mnemos isn't just for the model and the human — it exposes its memory store to any other DSH plugin through a bus. A plugin mounts it with ctx.inject(['mnemosBus']) and gets three primitives:
| Primitive | What it does | Guardrails |
|---|---|---|
bus.recall({ query, limit }) | Search memories (or list by scope/workspace). Read-only — never writes, never bumps the usage ledger. | — |
bus.record(input, identity) | Request a memory write. | Must declare who it is ({ name, version } → stamped plugin:<name>@<version>, source: third_party). The write always enters the human approval queue — never direct, never auto-approved, regardless of confidence. Audited. |
bus.subscribe(listener) | Watch store changes: memory committed / proposal pending / memory replaced / memory revoked. | Subscriber errors never break the bus. |
Governance that applies to every third-party write:
bus.blacklistPlugin('name', reason) (or /memory bus blacklist): from then on that plugin's writes are denied with an audit entry. unblacklistPlugin / listBlacklist to manage.bus.revoke(memoryId, identity): a third-party write can be deleted, but only the owning plugin or a human may revoke it.bus.state() / bus.listByWriter(name) let the approval panel group pending items by which plugin proposed them.So another plugin gets the same treatment as the model: an identity stamp, the approval gate, an audit trail, and a kill switch. The bus does not trust anything by default — sharing memory with mnemos is permissioned, not assumed.
ctx.mnemosAbiVersioned recall / get / state / probe for external tools and evals to read real numbers (active / pending / unverified / verified / injections / hit-rate).
src/domain/imports/ — chatgpt, claude-code, codex, dsh; auto source detection in detect.ts.
# from the deepseek-harness directory
node --import tsx/esm /path/to/dsh-mnemos/scripts/eval/run-eval.mts
| Metric | Value |
|---|---|
| Fact recall hit@1 | 0.94 |
| Fact recall MRR | 0.94 |
| Noise-query precision (don't recall what shouldn't be) | 1.00 |
| State tracking (current value after revision) | pass |
| Frozen memory index per session | 8 lines ≈ 207 tokens (KV-cache friendly) |
| Index covers the correct memory | 100% |
Measured on the production retrieval path (FTS5 multi-level ladder: all-words AND → any-word OR → substring, fused with bigram-similarity via RRF) against deja-vu's published numbers, same protocol. Methodology details: scripts/bench/BENCHMARKS.md.
| Dataset | dsh-mnemos (production path) | deja-vu (official) |
|---|---|---|
| LongMemEval-S (cleaned, 470 q, hit@1) | 87.2% | 85.3% |
| LoCoMo-10 (1982 QA, R@1) | 60.9% | 69.8% |
Honest notes:
Compatibility (honest): developed and verified on Linux / Node ≥ 22.19 / DSH web profile. Windows/macOS are untested.
# npm channel
dsh plugin --profile web add dsh-mnemos
# git channel
dsh plugin --profile web add git+https://github.com/Rottenwooood/dsh-mnemos.git
# tarball channel
npm pack # in this repo
dsh plugin --profile web add ./dsh-mnemos-<version>.tgz
Restart with dsh web; configure under Settings → dsh-mnemos; the "记忆" tab appears in the sidebar. Uninstall: dsh plugin --profile web remove dsh-mnemos (the memory database is kept).
3 steps to your first memory:
memory_record), or import history from the settings page (default directory ~/.dsh/sessions).distillAuto — so the LLM turns buffered sessions into memories.memory_get.All settings live in Settings → dsh-mnemos and mostly apply live. Highlights:
| Key | Purpose |
|---|---|
enabled | master switch |
autoApprove / autoApproveConfidence | auto-approve high-confidence model writes / threshold |
injectionEnabled / injectLimit / injectMaxBytes | injection on/off, count and byte budgets |
protocolInjectEnabled | inject environment/tool-convention (protocol) memories — once at the session's first step, re-attached after each context compaction; not part of the memory index |
gitRemoteUrl / gitBackend / syncEnabled | cross-machine sync: remote / backend / auto-sync |
distillAuto / distillEveryNTurns | auto-distill on/off and interval (user turns) |
cleanupDays | archive-candidate age: how many days without any injection/hit or update before a memory becomes a cleanup candidate |
sessionLogDirs / backfillEnabled | backfill historical session logs at startup |
The full 34-field table, YAML snippets, usage scenarios, and troubleshooting: docs/HANDOVER.md.
Different philosophies. dsh-memento is a capability seam: a typed ctx.memory contract, hard per-track/per-layer character budgets, and a dsh-memory-protocol with an adapter registry (mem0 / Hermes / CLAUDE.md) and a read-only MCP server — strong on ecosystem interoperability. dsh-mnemos is a complete memory product: distillation, memory/SKILL formalization, a full lifecycle, and measured retrieval.
| Dimension | dsh-mnemos | dsh-memento |
|---|---|---|
| Retrieval | FTS5 ladder + bigram RRF, public benchmark numbers | substring search (no FTS5), no published numbers |
| Lifecycle / heat eviction / pinned | yes | no |
| Distillation / memory / SKILL | yes (LLM, approval-gated) | no |
| git version history + cross-machine sync | yes (one .md per memory) | no |
| Third-party writes | bus: identity-stamped, approval-queue, blacklist, revoke | adapter registry (pure data conversion), MCP server |
| Protocol spec / MCP / adapters | bus + ABI + conformance; no MCP yet | dsh-memory-protocol v1 + MCP + adapters |
| npm / releases | not yet published | published, multi-channel install |
| README | English + 中文 | 5 languages |
deja-vu is a Go memory engine whose public long-memory benchmarks we replicate same-protocol. We win LongMemEval-S (87.2% vs 85.3%) and trail LoCoMo (60.9% vs 69.8%) — details in Benchmarks. We bring, on top of retrieval, the governance/lifecycle layer (approval gate, trust tiers, conflict replacement proposals, git) that deja-vu does not have.
These are the gaps between "functional and measured" and "formally released":
isomorphic git backend — it can time out / be flaky on slow connections in our testing; worth a reliability pass or documenting system as the recommended sync backend.| dsh-mnemos mechanism | Aligns with |
|---|---|
Frozen index injection + memory_get drill-down (recall ≠ injection) | engram / meow / memory-manager / LongMemEval |
| Power-law heat ranking + reinforcement counts | dsh-evolve decay semantics |
| Bounded occupancy + source-marked anti-poisoning | 2608.21230 / Veracium |
| Active → archived → deleted + pinned (never hard-delete) | dsh-evolve state machine |
| Conflict replacement proposal (new value supersedes old; contradictions never silently dropped) | StateMemBench / MELD |
| Environment conventions re-attached at first step + after compaction (compression-cliff defense) | 2608.22752 |
| Open measurement ABI + conformance | memento conformance suite |
| Effect ledger + reproducible eval | memlab / LongMemEval methodology |
| Third-party memory bus (identity + approval + blacklist + revoke) | memento adapters / tool-memory sharing |
| Multi-source history import (ChatGPT/Claude Code/Codex/DSH) | migration-tool convention (import → distill) |
pnpm install
pnpm run typecheck
pnpm test # 156 unit tests
pnpm run build:client # after touching src/client/
scripts/run-verify.sh # typecheck+unit → deterministic eval → ABI conformance → real registry composition
MIT