XMemo for DeepSeek Harness

Native local-first + cloud memory for dsh.

Hybrid local storage with an offline durable write queue, plus real OAuth 2.1
login — reimplemented as an ordinary Cordis plugin instead of a thin MCP bridge.




[![License](https://img.shields.io/github/license/yonro/xmemo-deepseek-plugin?style=flat-square)](https://github.com/yonro/xmemo-deepseek-plugin/blob/a998992f5fcb986f02b590cdf40bf7035c8f7e01/LICENSE)

[![GitHub stars](https://img.shields.io/github/stars/yonro/xmemo-deepseek-plugin?style=flat-square&logo=github)](https://github.com/yonro/xmemo-deepseek-plugin/stargazers)

[Quick start](#quick-start) ·
[Auth](#auth) ·
[Config](#config) ·
[Web GUI card](#web-gui-card) ·
[Tools](#tools) ·
[Capabilities](#capabilities-and-boundaries) ·
[Limitations](#known-limitations)

A native DeepSeek Harness (dsh) plugin: hybrid local + XMemo cloud memory, with offline durable write queuing, active state, timeline, TODOs, decisions, and restart snapshots — the same tool surface as xmemo-cindy-plugin, reimplemented as an ordinary Cordis plugin instead of going through Cindy's host-specific plugin protocol.

This plugin talks directly to the MemoryOS REST API (the actual backend behind XMemo) and keeps its own local store, rather than going through XMemo's hosted MCP server (https://xmemo.dev/mcp) — dsh can also reach XMemo the MCP way via the harness's own @deepseek-ai/dsh-mcp-client bridge, but this repo is the deeper, native alternative. Endpoint paths, request/response field names, and the auth header were verified against the MemoryOS source, not guessed from another client — including live, end-to-end verification of the OAuth flow against production .


Package	`dsh-xmemo`
Plugin ID	`xmemo`
Runtime	DeepSeek Harness (`dsh`)
Version	`0.1.0`
Bundle	Native Cordis plugin (host) + web GUI settings card (browser)
Backend	MemoryOS REST API — `https://xmemo.dev`
Authentication	OAuth 2.1 + PKCE (recommended), or a static API key (compatibility)
Local storage	JSON hybrid store with a durable offline write queue
Tool surface	16 tools, same names/schemas as `xmemo-cindy-plugin`
License	MIT

Field	Default	Meaning
`mode`	`hybrid`	`hybrid` (local-first + cloud sync), `local-only` (never calls MemoryOS), or `cloud-only` (no local persistence). Overridable at runtime — see Web GUI card.
`apiKeyCredential`	`XMEMO_KEY`	Credential reference resolved through `ctx.credentials`.
`apiBaseUrl`	`https://xmemo.dev`	MemoryOS REST API base. Override for a local dev server, e.g. `http://localhost:8000`.
`defaultScope`	`dsh`	Default `scope` tag when a tool call omits one.
`agentId`	`DeepSeek Harness`	Sent as `X-Memory-OS-Agent-ID`.
`requestTimeoutMs`	`30000`	Default per-request timeout.
`longRequestTimeoutMs`	`60000`	Timeout for `xmemo_recall` and `xmemo_restore_progress`.

Area	Tools
Status & sync	`xmemo_status`, `xmemo_sync`
Working state	`xmemo_update_state`, `xmemo_save_progress`, `xmemo_restore_progress`
Timeline	`xmemo_record_event`, `xmemo_list_timeline`
Memory lifecycle	`xmemo_remember`, `xmemo_recall`, `xmemo_forget`
TODOs	`xmemo_create_todo`, `xmemo_list_todos`, `xmemo_complete_todo`
Decisions	`xmemo_create_decision`, `xmemo_list_decisions`, `xmemo_resolve_decision`

Capability	Included	Boundary
Local-first hybrid memory	Yes	Local store is not encrypted at rest
OAuth 2.1 + PKCE login	Yes	Needs a desktop session to open a browser in; headless `dsh` falls back to the API key
Static API key auth	Yes	Compatibility fallback only — never sent alongside a connected OAuth session
Durable offline write queue	Yes	Non-idempotent writes wait in `held` for explicit replay approval
Recoverable deletion	Yes	`xmemo_forget` is soft delete by default
Web GUI settings card	Yes	Only OAuth login, the API key, and memory mode are editable from the browser — the other five config fields need `cordis.patch.yml`
Recall and search	Yes	Limited to memory visible to the authenticated account, and fail-closed on any bucket/scope mismatch
Cross-agent continuity	Yes	Other agents/clients need their own authorized XMemo connection
PII redaction	No	Only credential-like text is redacted, matching `xmemo-cindy-plugin` upstream
MCP transport	No	Talks to MemoryOS REST directly; dsh's own `dsh-mcp-client` bridge is a separate, untouched path
Bundled skill instructions	No	Reuse `xmemo-claude-plugin/skills/*/SKILL.md` instead — see Tools
Encryption at rest	No	Same as upstream — honest that there isn't one, see Known Limitations

Field	Value
Package	`dsh-xmemo`
Plugin ID	`xmemo`
Runtime	DeepSeek Harness (`dsh`)
Version	`0.1.0`
Role	Native Cordis plugin + web GUI settings card
Service	`https://xmemo.dev`
Backend	MemoryOS REST API (not MCP)
Authentication	OAuth 2.1 + PKCE (recommended), or static API key via `XMEMO_KEY`
OAuth scopes	`memory:read memory:write`
Tool profile	16 tools, same names/schemas as `xmemo-cindy-plugin`
Local storage	Yes — JSON hybrid store with a durable outbox, not encrypted
Repository	`https://github.com/yonro/xmemo-deepseek-plugin`
License	MIT

dsh-xmemo

安装

说明文档

At a glance

What it adds

Quick start

Auth

Config

Tools

Web GUI card

Architecture notes

Capabilities and boundaries

Known Limitations

Security and privacy

Development

Agent-readable metadata

Links

License