
Security News
vlt 1.5.0 Adds Agent Skills Management
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.
@zheexinn/dsh-memory
Advanced tools
Long-term shared memory plugin for the DeepSeek Harness: LLM auto-extraction, fusion recall (semantic + entity graph), self-maintenance, own-your-storage file backend, remote API & MCP
Long-term shared memory for the DeepSeek Harness.
Cross-session · multi-agent · self-managing · with a visual panel
English | 中文
dsh-memory gives every session of the DeepSeek Harness a real long-term memory. It extracts, scores, stores, and recalls memories automatically; it shares them across sessions, subagents, and workflows; and it maintains itself — archiving what decays, distilling insights, consolidating noise — while you just keep working.
Why? Every session starts with amnesia: your name, your preferences, last week's hard-won debugging lesson — gone. dsh-memory fixes that with one process-singleton memory service that every agent reads and writes, plus an LLM pipeline that mines your conversations in the background.
| 🧠 Five memory types | semantic · episodic · procedural · preference · insight |
| 🔄 Cross-session sharing | one host-plane singleton; sessions, subagents and workflow workers share one store |
| ⚙️ Auto-extraction (LLM) | every N turns, the session transcript is condensed into memory candidates with importance/confidence scores |
| 📉 Forgetting curve | score = importance × confidence × 2^(−t/half-life) — stale memories decay naturally |
| 🔍 Fusion recall | score × character n-gram semantic similarity (TF-IDF cosine) × entity co-occurrence graph |
| 🕸️ Entity graph | paths, identifiers, versions, quoted phrases and frequent CJK terms become nodes; co-occurrence becomes edges |
| 🧹 Self-maintenance | decayed memories auto-archive; LLM reflection distills insights; consolidation folds entity clusters into single facts |
| 🗄️ Own-your-storage | self-owned file backend — point storage.root at any folder (an Obsidian vault included); one human-readable JSON file is the single source of truth |
| 🤝 External agents | zero-dep CLI, documented file format, token-gated HTTP API, and a stdio MCP server for Claude Code & friends |
| 🎛️ Visual panel | timeline / relations / archive tabs with an interactive force-directed graph |
| 🪶 Zero runtime deps | plain ESM over the harness plugin protocol — no zod, no SDK, no native binaries |
From npm (recommended — pin the exact version):
dsh plugin --profile web add @zheexinn/dsh-memory@0.5.2 # then restart dsh web
From source (local development):
// ~/.dsh/profiles/web/package.json
{
"dependencies": { "@zheexinn/dsh-memory": "link:<repo path>" },
"dsh": { "profile": { "bundles": ["@zheexinn/dsh-memory"] } }
}
cd ~/.dsh/profiles/web && pnpm install # then restart dsh web
That's it. Write one memory from the 记忆 panel (or let the model call memory_remember), then ask a new session "what do you remember?" — the model has memory_recall, and every turn ends with the top memories auto-injected into its runtime context.
flowchart LR
U[User turn] --> A[Agent loop]
A --> E["turn/end hook"]
E --> X[LLM extraction<br/>transcript → candidates]
X --> S[(Memory service<br/>host-plane singleton)]
A --> C[Context assembly]
C -->|"systemPrompt.context<br/>top memories"| S
S --> F[memory.json<br/>single source of truth]
M[Background tasks] -->|"archive · reflect · consolidate"| S
P[Panel] <-->|"/memory/api/*"| S
R[External agents] -->|"HTTP / MCP / CLI"| S
R -->|"or the file itself"| F
Three planes, one memory:
memory service singleton, the self-owned storage backend, the panel + remote APIs.request/header route) returns a JSON array of candidates with type / content / importance / confidence / scope.confidence < minConfidence is dropped; < verifyConfidence lands as unverified (halved retrieval score, dashed in the panel).content + scope merges into the existing entry instead of duplicating, raising its importance.memory.json (atomic tmp+rename rewrite).# profile cordis.patch.yml
- id: memory-hub
name: '@zheexinn/dsh-memory'
config:
storage:
root: 'D:/_Tools/Obsidian/memory' # default: ${DSH_HOME|~/.dsh}/storages
recallTopK: 5
recallBudget: 1500
importanceLearningRate: 0.01
semanticWeight: 0.6
graphWeight: 0.4
archiveThreshold: 0.05
server: # remote API (off by default)
enabled: true
token: 'a-long-random-token'
- id: memory-agent
name: '@zheexinn/dsh-memory/agent'
config:
recallTopK: 5
recallBudget: 1200
extraction:
enabled: true
everyNTurns: 1 # >1 batches several turns per extraction
maxInputChars: 6000
minTranscriptChars: 40 # skip trivial turns
minConfidence: 0.3
verifyConfidence: 0.6
maxCandidates: 8
timeoutMs: 60000
maxTokens: 1024
archiveEveryNTurns: 10 # 0 disables
reflectEveryNTurns: 10 # 0 disables
consolidateEveryNTurns: 20 # 0 disables
# Optional fixed route for background LLM calls; by default the session's
# own request/header route is reused:
# provider: deepseek
# model: deepseek-chat
Full reference: every knob is a code default, so the plugin runs with zero configuration.
The hub registers its own file backend on the harness storage hub. The entire memory store is one human-readable JSON file:
{storage.root}/memory.json # { unit, global, tables.entries }
storage.root at any folder — an Obsidian vault included: the file becomes a visible, searchable, version-controllable part of your notes. Move an existing store by copying memory.json over.memory relocates.npm run memory-cli -- list --scope user # recall / remember / forget / restore / purge / stats / export
Enable the token-gated remote API (server.enabled + server.token) and any external agent can read and write memories over HTTP:
| Endpoint | Purpose |
|---|---|
GET /memory/remote/stats | stats |
GET /memory/remote/list | list |
GET /memory/remote/recall?query=&scope=&top_k= | fusion recall |
POST /memory/remote/remember | write |
POST /memory/remote/forget | soft delete |
POST /memory/remote/purge | permanently delete {id} (irreversible) |
GET /memory/remote/export | full export |
The bundled zero-dependency MCP server bridges those endpoints to any MCP client:
{
"mcpServers": {
"@zheexinn/dsh-memory": {
"command": "node",
"args": [
"<repo>/scripts/mcp-server.mjs",
"--api", "http://127.0.0.1:3080/memory/remote",
"--token", "a-long-random-token"
]
}
}
}
Claude Code and friends get memory_remember / memory_recall / memory_forget / memory_reflect as first-class tools.
The default semantic layer is a dependency-free character n-gram index (CJK bigrams + whole-token extraction for paths/identifiers/versions). Any plugin can replace it without touching this package:
ctx.provide('memoryEmbedding', {
// contract: rank(texts, query) → scores[], same length as texts, 0..1
rank: async (texts, query) => texts.map((text) => similarity(text, query)),
})
Failures fall back to the built-in n-gram index automatically.
The agent row mounts globally by default. To scope it to specific agent presets, remove the memory-agent row from the global patch and add it to the preset's cordis.yml:
- id: memory-agent
name: '@zheexinn/dsh-memory/agent'
config: { recallTopK: 5, recallBudget: 1200 }
The memory-hub row must stay in the host composition — it is the process singleton.
npm test # 6 behavior suites: pipeline / hub / external / vector / graph / mcp
npm run build # client bundle (wire format)
npm run smoke # node-half load check
Does extraction cost extra LLM calls? Yes — one auxiliary call per everyNTurns completed turns, reusing the session's own model route. Raise everyNTurns, or disable with extraction.enabled: false and keep using the tools manually.
Is the remote API safe to expose? It is off by default and Bearer-gated. Bind dsh to a trusted network and prefer HTTPS via a reverse proxy before exposing it beyond localhost.
What happens to old memories? Nothing is ever hard-deleted by the plugin. Memories decay → archive (hidden, restorable), and deletes are tombstones recoverable from the archive tab.
Can I use sqlite instead? The self-owned backend keeps a single JSON file by design (it is the external-agent format). A sqlite backend is a possible future variant; the format doc is the migration surface.
MIT © 2026 zhang66633 · Report security issues privately via GitHub security advisory.
FAQs
Long-term shared memory plugin for the DeepSeek Harness: LLM auto-extraction, fusion recall (semantic + entity graph), self-maintenance, own-your-storage file backend, remote API & MCP
The npm package @zheexinn/dsh-memory receives a total of 4 weekly downloads. As such, @zheexinn/dsh-memory popularity was classified as not popular.
We found that @zheexinn/dsh-memory demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.

Security News
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.