{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"phant0meow-dsh-meow-memory","slug":"phant0meow-dsh-meow-memory","rank":134,"url":"https://github.com/Phant0Meow/dsh-meow-memory","name":"Phant0Meow/dsh-meow-memory","category":"memory","description":{"zh":"项目级跨会话记忆：node:sqlite 六层存储（soul/user/project/fact/lesson/topic），首条用户消息缓存友好注入，memory_remember/search/find_similar/read/update 工具，按窗口夜间整理（dream）。","en":"Project-scoped cross-session memory: six-layer SQLite store (soul/user/project/fact/lesson/topic) on node:sqlite, cache-friendly first-message injection, memory_remember/search/find_similar/read/update tools, and per-window nightly consolidation (\"dream\")."},"stars":31,"starsCheckedAt":"2026-08-21","repository":{"owner":"Phant0Meow","repo":"dsh-meow-memory","requestedRef":null,"subpath":""},"npm":"meow-memory","downloads":1645,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add meow-memory","tarball":null,"added":"2026-08-14","page":"https://awesome-dsh-plugin.com/p/Phant0Meow/dsh-meow-memory/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"phant0meow-dsh-meow-memory","slug":"phant0meow-dsh-meow-memory","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:21:18.090Z","scanStatus":"static-complete","verdict":"caution","score":95,"commit":"6d85b6825bb63c0c13cf36316e85beb2071fc7a4","commitDate":"2026-08-19T16:25:13-04:00","artifactDigest":"sha256:d2b2a6aa60e8b74f8e48379fd8ec5729b96598a9ca77bbb6f38de4f989b13f24","downloadUrl":"https://github.com/Phant0Meow/dsh-meow-memory/archive/6d85b6825bb63c0c13cf36316e85beb2071fc7a4.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add meow-memory","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"meow-memory","packageVersion":"0.12.0","bundle":{"patch":"./cordis.patch.yml"},"client":{"platform":"web"},"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"meow-memory","manifestName":"meow-memory","nameMatch":true,"npm":{"name":"meow-memory","latestVersion":"0.12.0","publishedAt":"2026-08-19T20:26:06.121Z","createdAt":"2026-08-15T06:02:58.745Z","versionCount":8,"maintainers":1,"repository":"git+https://github.com/Phant0Meow/dsh-meow-memory.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"match"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"meow-memory","name":"meow-memory","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","filesystem","host-bundle","network","session","subprocess"],"outboundHosts":[],"findings":[{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"scripts/verify-client.mjs","pathClass":"source","line":10,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","hash":"22107d4501bd71b8e8b32dc9","review":{"verdict":"placeholder","reason":"scripts/verify-client.mjs 是开发期语法校验脚本，未列入 package.json 的 files 字段不会随插件发布，new Function 仅对本地构建产物 lib/client.js 做语法检查，不执行任何远程或用户输入内容。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:20:42.720Z"}},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"src/client-dream-icon.ts","pathClass":"source","line":89,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"3617ac8d10c956b0dc2632c2"},{"id":"HT-OBFUSCATION-001","title":"源码呈现混淆或载荷隐藏特征","severity":"high","confidence":"low","layer":"static","path":"tests/client-dream-icon.mjs","pathClass":"test-example-docs","line":17,"evidence":"Buffer.from(code).toString('base64') const { readSessionId, applyDreamIcons, DREAM_ICON_ATTR, DREAMING_ATTR } = await import(","remediation":"以可读源码分发；若必须打包，请同时提供可复现构建与 source map。","note":"解码后直接进入执行；位于测试、示例或文档目录","hash":"d24d3456076e4465fc5c9319"},{"id":"HT-OBFUSCATION-001","title":"源码呈现混淆或载荷隐藏特征","severity":"high","confidence":"low","layer":"static","path":"tests/client-fold.mjs","pathClass":"test-example-docs","line":17,"evidence":"Buffer.from(code).toString('base64') const { computeFoldGroups, foldLabel, toolCallDetail, blocksToText, computeInjectionGroups } = await import(","remediation":"以可读源码分发；若必须打包，请同时提供可复现构建与 source map。","note":"解码后直接进入执行；位于测试、示例或文档目录","hash":"1e662255b6ec4bde8ffd4e44"}],"counts":{"critical":0,"high":0,"medium":1,"low":0},"rawCounts":{"critical":0,"high":3,"medium":1,"low":0},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":34,"bytesScanned":365155,"truncated":false,"lockfiles":["package-lock.json"],"pathClasses":{"markdown":3,"source":24,"cordis":1,"data":2,"manifest":1,"script":1,"test-example-docs":2}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:21:18.090Z","summary":null,"intentMatch":null,"findingsReviewed":1,"findingsCandidates":1,"fromCache":1,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:21:18.090Z","commit":"6d85b6825bb63c0c13cf36316e85beb2071fc7a4","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:20:42.720Z","commit":"6d85b6825bb63c0c13cf36316e85beb2071fc7a4","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:48:33.064Z","commit":"6d85b6825bb63c0c13cf36316e85beb2071fc7a4","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"6d85b6825bb63c0c13cf36316e85beb2071fc7a4","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:21:18.090Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"6d85b6825bb63c0c13cf36316e85beb2071fc7a4","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:20:42.720Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"6d85b6825bb63c0c13cf36316e85beb2071fc7a4","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:48:33.064Z"}]}