fix(memhub): refresh harness skills and MCP entry after an upgrade

After an upgrade, hosts kept the call-rule skill and MCP entry an older
release wrote, so models were still told to call MemHub_ask and the other
removed tools, and WorkBuddy kept listing them from its tool-list cache.

- Stamp every managed MCP entry with ONE_MEMORY_MCP_TOOLSET, a tool
  contract version kept beside the tool list (mcp-toolset.ts). WorkBuddy
  fingerprints the stdio transport, env included, so a new stamp makes it
  restart the server and drop the cached list. An entry without the
  current stamp reads as stale in skill drift; verify still passes it.
- HostPermissions.refreshInstalledHosts runs the existing repoint and
  stale-sync planners for every host this data dir installed, leaves
  user-edited skills alone, emits allowlisted host_refresh.* diagnostics
  (host ids and counts only), and records the build it completed in
  host-permissions/host-refresh.json so it runs once per build.
- The Runtime calls it as it starts (covering App and `memhub upgrade`),
  and Desktop calls it after an embedded Runtime is up.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -4,6 +4,14 @@ Hy Memory and MemHub are versioned and released independently.
 
 ## Unreleased
 
+- MemHub shows when working and coding experiences were talked about. After
+  the SDK upgrade every one of them read "时间未知" (time unknown) because the
+  SDK never stored their conversation time; hy-memory 2.0.7 stores it and
+  Core now passes it through the memory list, detail, search and home
+  summary. An experience stored before 2.0.7 shows its write time, labelled
+  "写入于" / "写入时间", instead of "时间未知". Metadata repair also writes
+  the conversation time it recovers from the migration bundle into the SDK's
+  coding/working stores when they already have the column.
 - The SDK migration no longer fails its first run on a home with legacy
   vectors: reattaching them left a Chroma instance open with its own settings,
   and the readback that followed could not open the same store
@@ -70,6 +78,8 @@ Hy Memory and MemHub are versioned and released independently.
 
 ## Hy Memory 2.0.7 — 2026-10-28
 
+- Published
+  [`hy-memory==2.0.7`](https://pypi.org/project/hy-memory/2.0.7/).
 - Coding and working experiences and facts now keep their conversation time.
   `add(..., memory_at=...)` reached only the chat path before; the
   productivity path dropped it, so every experience had only its write time

memhub/README.md

@@ -18,7 +18,7 @@ If you run into a problem, please open an Issue with the version, platform,repro
 
 ## 发行与平台合同
 
-源码当前固定使用公开 PyPI 正式版 `hy-memory==2.0.6`。MemHub 源码版本为 `1.0.5`
+源码当前固定使用公开 PyPI 正式版 `hy-memory==2.0.7`。MemHub 源码版本为 `1.0.5`
 （build 14），GitHub 仓库为
 [`Tencent-Hunyuan/Hy-Memory`](https://github.com/Tencent-Hunyuan/Hy-Memory)，npm 包名为
 `memhub-cli`。当前代码架构见
@@ -118,7 +118,7 @@ MemHub 的 SQLite 数据默认位于 `~/.one-memory`，不在 npm 包或 Runtime
 
 ## Hy Memory
 
-SDK 依赖固定为公开 PyPI 正式版 `hy-memory==2.0.6`。SDK 配置、权限边界及 search
+SDK 依赖固定为公开 PyPI 正式版 `hy-memory==2.0.7`。SDK 配置、权限边界及 search
 返回格式见 [`MEMORY.md`](MEMORY.md)。HY search 返回的 `content` 已包含 SDK 统一生成的
 逻辑时间和演化上下文；调用方不应再次转换时间戳或重复拼接 `When`。
 

memhub/SBOM.spdx.json

@@ -2352,7 +2352,7 @@
     {
       "SPDXID": "SPDXRef-Package-hy-memory",
       "name": "hy-memory",
-      "versionInfo": "2.0.6",
+      "versionInfo": "2.0.7",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "Apache-2.0",

memhub/THIRD_PARTY_NOTICES.md

@@ -9,7 +9,7 @@ Per-package license texts are not reproduced here yet; the license
 column is filled in as part of release review, and the SBOM records
 `NOASSERTION` until then rather than guessing.
 
-## hy-memory 2.0.6
+## hy-memory 2.0.7
 
 License: Apache-2.0
 

memhub/apps/core/pyproject.toml

@@ -12,7 +12,7 @@ dependencies = [
     "fastapi>=0.141.1",
     "filelock>=3.32.4",
     # Public SDK version validated against MemHub's permission and recall contracts.
-    "hy-memory==2.0.6",
+    "hy-memory==2.0.7",
     # chromadb arrives through the HY SDK; locked here so an unrelated upgrade
     # cannot move the SDK's store. Built-in embedding consumes numpy directly.
     "chromadb==1.5.9",

memhub/apps/core/src/one_memory/hy_runtime_config.py

@@ -14,7 +14,7 @@ from pathlib import Path
 from typing import Literal, cast
 
 HY_MEMORY_DISTRIBUTION = "hy-memory"
-HY_MEMORY_VERSION = "2.0.6"
+HY_MEMORY_VERSION = "2.0.7"
 HY_MEMORY_NAMESPACE = "governed-v2"
 DiagnosticLogLevel = Literal["error", "warning", "info", "debug"]
 

memhub/apps/core/src/one_memory/hy_sdk_migration.py

@@ -426,6 +426,7 @@ def _repair_coding(
         path = root / name
         if not path.is_file():
             continue
+        _ensure_coding_schema(path)
         with closing(sqlite3.connect(path)) as database:
             tables = {
                 str(row[0])
@@ -437,10 +438,14 @@ def _repair_coding(
             ):
                 if table not in tables:
                     continue
+                # _ensure_coding_schema added it; an SDK without the column
+                # (before 2.0.7) leaves the time to the vector repair alone.
+                has_memory_at = "memory_at" in _columns(database, table)
                 rows = database.execute(
-                    f"SELECT {identifier},source,created_at FROM {table}"
+                    f"SELECT {identifier},source,created_at,"
+                    f"{'memory_at' if has_memory_at else 'NULL'} FROM {table}"
                 ).fetchall()
-                for memory_id, source, created_at in rows:
+                for memory_id, source, created_at, memory_at in rows:
                     desired = mapping.get(str(memory_id))
                     if desired is None:
                         continue
@@ -449,6 +454,13 @@ def _repair_coding(
                     if desired.source and source in {None, "", "default"}:
                         updates.append("source=?")
                         values.append(desired.source)
+                    if (
+                        has_memory_at
+                        and desired.memory_at is not None
+                        and memory_at != desired.memory_at
+                    ):
+                        updates.append("memory_at=?")
+                        values.append(desired.memory_at)
                     if desired.created_at is not None:
                         desired_created_at = (
                             datetime.fromtimestamp(desired.created_at, tz=UTC)
@@ -470,6 +482,32 @@ def _repair_coding(
     return repaired
 
 
+def _ensure_coding_schema(path: Path) -> None:
+    """Bring a Coding/Working store to the installed SDK's schema.
+
+    A migrated home's stores were written by an older SDK and may lack columns
+    the repair writes (``memory_at`` since hy-memory 2.0.7). The repair runs
+    before any SDK client opens them, so the SDK's own schema step is run here
+    rather than repeating its DDL. ``CodingMemoryStore`` has no public
+    schema-only entry point: ``initialize()`` also opens its Chroma
+    collections, which must stay closed during the offline repair. So only its
+    SQLite step runs, on a store object that carries nothing but that path.
+    """
+    from hy_memory.coding.store import (  # type: ignore[import-untyped]
+        CodingMemoryStore,
+    )
+
+    # Relies on the pinned SDK's internals (hy-memory==2.0.7 is pinned exactly).
+    store = CodingMemoryStore.__new__(CodingMemoryStore)
+    store._db_path = str(path)
+    store._conn = None
+    try:
+        store._init_sqlite_sync()
+    finally:
+        if store._conn is not None:
+            store._conn.close()
+
+
 def _batches[T](values: list[T] | tuple[T, ...]) -> Iterator[tuple[T, ...]]:
     for start in range(0, len(values), _BATCH):
         yield tuple(values[start : start + _BATCH])

memhub/apps/core/src/one_memory/hy_sdk_types.py

@@ -151,6 +151,7 @@ class HySdkMemoryRecord(BaseModel):
         if not content.strip():
             raise HySdkReadError("hy_memory_record_shape_unknown")
         status = str(raw.get("status") or "active")
+        memory_at = raw.get("memory_at")
         created_at = _epoch(raw.get("created_at"))
         updated_at = _epoch(raw.get("updated_at"))
         try:
@@ -167,6 +168,9 @@ class HySdkMemoryRecord(BaseModel):
                     str(raw["session_id"]) if isinstance(raw.get("session_id"), str) else None
                 ),
                 source=str(raw["source"]) if isinstance(raw.get("source"), str) else None,
+                # Conversation time; hy-memory 2.0.7 stores it for experiences
+                # and facts. Older stores leave it unknown.
+                memory_at=memory_at if isinstance(memory_at, int) else None,
                 gmt_created=created_at,
                 scene=cast(MemoryScene, variant),
                 kind=cast(MemoryKindName, kind),

memhub/apps/core/tests/test_memory_library_all_scenes.py

@@ -55,6 +55,9 @@ def chat_row(memory_id, content, *, source="cursor"):
     }
 
 
+EXPERIENCE_MEMORY_AT = 1_789_990_000
+
+
 def experience_row(memory_id, task, solution, *, variant="working", source="codebuddy"):
     return {
         "experience_id": memory_id,
@@ -63,6 +66,8 @@ def experience_row(memory_id, task, solution, *, variant="working", source="code
         "task": task,
         "solution": solution,
         "source": source,
+        # Conversation time, epoch seconds like chat (hy-memory 2.0.7).
+        "memory_at": EXPERIENCE_MEMORY_AT,
         "created_at": "2026-10-01T08:00:00",
         "updated_at": "2026-10-02T08:00:00",
         "_variant": variant,
@@ -446,6 +451,7 @@ def test_keyword_filter_reads_experience_and_fact_text(tmp_path, monkeypatch):
         assert experience["content"] == "Fix flaky tests\nPin the pytest seed"
         assert experience["status"] == "active"
         assert experience["updated_at"] > experience["created_at"]
+        assert experience["memory_at"] == EXPERIENCE_MEMORY_AT
         fact = by_id["fact-1"]
         assert (fact["scene"], fact["kind"], fact["variant"]) == ("coding", "fact", "coding")
         assert fact["content"] == "The pytest suite runs in CI"
@@ -488,6 +494,10 @@ def test_empty_query_lists_all_scenes_with_source_filter_and_totals(tmp_path, mo
             "chat",
             "chat",
         ]
+        assert [item["memory_at"] for item in body["memories"][:2]] == [
+            EXPERIENCE_MEMORY_AT,
+            EXPERIENCE_MEMORY_AT,
+        ]
         call = sdk.list_calls[0]
         assert call["scene"] == "all"
         assert call["include_sources"] is None
@@ -527,6 +537,7 @@ def test_detail_edit_delete_pass_kind_and_variant(tmp_path, monkeypatch):
         assert record["task"] == "Old task"
         assert record["solution"] == "Old solution"
         assert record["content"] == "Old task\nOld solution"
+        assert record["memory_at"] == EXPERIENCE_MEMORY_AT
         assert sdk.get_calls[-1] == ("exp-1", "experience", "working")
 
         # Chat detail with no namespace keeps the plain SDK call.
@@ -692,5 +703,6 @@ def test_home_summary_counts_what_the_memory_page_lists(tmp_path, monkeypatch):
         assert (home_list["offset"], home_list["limit"], home_list["order"]) == (0, 1, "desc")
         assert body["latest"]["memory_id"] == "exp-w"
         assert body["latest"]["scene"] == "working"
+        assert body["latest"]["memory_at"] == EXPERIENCE_MEMORY_AT
 
     run_with_sdk(tmp_path, monkeypatch, scenario)

memhub/apps/core/tests/test_sdk_data_plane_migration.py

@@ -137,19 +137,38 @@ def test_post_cutover_metadata_repair_restores_source_and_original_times(store):
     )
     coding = data_dir / "hy-memory" / "governed-v2" / "coding_cv.sqlite3"
     with sqlite3.connect(coding) as database:
-        database.execute(
-            "CREATE TABLE coding_memory_meta ("
-            "experience_id TEXT,user_id TEXT,agent_id TEXT,solution TEXT,"
-            "source TEXT,created_at TEXT,updated_at TEXT)"
+        # A store written by hy-memory 2.0.6, before the conversation time
+        # column: the repair must add it through the SDK and then fill it.
+        database.executescript(
+            """
+            CREATE TABLE coding_memory_meta (
+                experience_id TEXT PRIMARY KEY, user_id TEXT NOT NULL,
+                agent_id TEXT NOT NULL DEFAULT 'default_agent', task TEXT NOT NULL,
+                search_keys TEXT NOT NULL DEFAULT '[]', solution TEXT NOT NULL,
+                boundary_envs TEXT NOT NULL DEFAULT '', workspace_id TEXT,
+                branch TEXT, session_id TEXT, files TEXT NOT NULL DEFAULT '[]',
+                source_fact_ids TEXT NOT NULL DEFAULT '[]',
+                confidence REAL NOT NULL DEFAULT 0.7,
+                source TEXT NOT NULL DEFAULT 'default',
+                extraction_source TEXT NOT NULL DEFAULT 'auto_extract',
+                created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+            );
+            CREATE TABLE working_fact (
+                fact_id TEXT PRIMARY KEY, user_id TEXT NOT NULL,
+                agent_id TEXT NOT NULL DEFAULT 'default_agent', session_id TEXT,
+                workspace_id TEXT, branch TEXT, source TEXT NOT NULL DEFAULT 'default',
+                statement TEXT NOT NULL, files TEXT NOT NULL DEFAULT '[]',
+                subject TEXT NOT NULL DEFAULT '', details TEXT NOT NULL DEFAULT '',
+                fact_link TEXT, derived_experience_ids TEXT NOT NULL DEFAULT '[]',
+                status TEXT NOT NULL DEFAULT 'active',
+                fact_chain_summary TEXT NOT NULL DEFAULT '', created_at TEXT NOT NULL
+            );
+            """
         )
         database.execute(
-            "CREATE TABLE working_fact ("
-            "fact_id TEXT,user_id TEXT,agent_id TEXT,statement TEXT,"
-            "source TEXT,created_at TEXT)"
-        )
-        database.execute(
-            "INSERT INTO coding_memory_meta VALUES "
-            "('sdk-1','local','scope','remember','default','now','now')"
+            "INSERT INTO coding_memory_meta "
+            "(experience_id,user_id,agent_id,task,solution,source,created_at,updated_at) "
+            "VALUES ('sdk-1','local','scope','remember','remember','default','now','now')"
         )
 
     result = repair_sdk_metadata_from_bundle(
@@ -168,10 +187,11 @@ def test_post_cutover_metadata_repair_restores_source_and_original_times(store):
         2026, 10, 18, tzinfo=UTC
     )
     with sqlite3.connect(coding) as database:
-        source, created_at = database.execute(
-            "SELECT source,created_at FROM coding_memory_meta WHERE experience_id='sdk-1'"
+        source, memory_at, created_at = database.execute(
+            "SELECT source,memory_at,created_at FROM coding_memory_meta WHERE experience_id='sdk-1'"
         ).fetchone()
     assert source == "workbuddy"
+    assert datetime.fromtimestamp(memory_at, tz=UTC) == datetime(2026, 10, 17, tzinfo=UTC)
     assert created_at.startswith("2026-10-18T00:00:00")
 
     repeated = repair_sdk_metadata_from_bundle(

memhub/apps/core/tests/test_sdk_migration_bundle.py

@@ -91,7 +91,7 @@ def test_bundle_contains_management_sdk_config_and_verified_manifest(tmp_path):
     assert manifest["bundle_id"] == "migration-1"
     assert manifest["sdk_namespace"] == "governed-v2"
     assert manifest["runtime_build"] == "build-13"
-    assert manifest["snapshot_sdk_version"] == "2.0.6"
+    assert manifest["snapshot_sdk_version"] == "2.0.7"
     paths = {item["path"]: item for item in manifest["files"]}
     assert {
         "management/one-memory.sqlite3",

memhub/apps/core/uv.lock

@@ -991,7 +991,7 @@ wheels = [
 
 [[package]]
 name = "hy-memory"
-version = "2.0.6"
+version = "2.0.7"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "chromadb" },
@@ -1008,9 +1008,9 @@ dependencies = [
     { name = "scikit-learn" },
     { name = "tiktoken" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/18/98/312ac8bcbe41e63200a93d296300b2e6748e1a532dad01f009dad57ba408/hy_memory-2.0.6.tar.gz", hash = "sha256:d0f54d54867ee7e722a8dd1a88a00c0576904435f15ae7899fe640840bff74bc", size = 855200, upload-time = "2026-10-27T07:53:10.022Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/17/b5/87a43c8d8b77fdfbbe7974d1e93af50ddf82317c5d56e180b865fb19e181/hy_memory-2.0.7.tar.gz", hash = "sha256:85636487e5bd4b6595a8c15301499efb365b6010c236a45c51c144f6986a4222", size = 854913, upload-time = "2026-10-28T03:35:38.127Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/27/f1/d4866cffe426d77b857168cc694b15df866f3d9f45152c17c148e1595db4/hy_memory-2.0.6-py3-none-any.whl", hash = "sha256:b0e666f8e89d1763bb31c0e67502df74434134a638ff6fd1912de9e936be2483", size = 918955, upload-time = "2026-10-27T07:53:07.686Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/b8/a6e0bfd17aeb432b0470f4dc707271e6476f5ac34f3b301ab3ad2e1c0d83/hy_memory-2.0.7-py3-none-any.whl", hash = "sha256:80a501e17987202ee1150a91b071313e890300620f353f9e89c967286dc1a645", size = 919841, upload-time = "2026-10-28T03:35:35.399Z" },
 ]
 
 [[package]]
@@ -1837,7 +1837,7 @@ requires-dist = [
     { name = "fastapi", specifier = ">=0.141.1" },
     { name = "filelock", specifier = ">=3.32.4" },
     { name = "httpx", specifier = ">=0.28.1" },
-    { name = "hy-memory", specifier = "==2.0.6" },
+    { name = "hy-memory", specifier = "==2.0.7" },
     { name = "keyring", specifier = ">=25.7.0" },
     { name = "numpy", specifier = "==2.5.2" },
     { name = "onnxruntime", specifier = "==1.23.2" },

memhub/apps/desktop/src/host-control-ownership.test.ts

@@ -15,6 +15,7 @@ const fake = vi.hoisted(() => ({
   missingBroker: false,
   hostCapability: true,
   open: vi.fn(),
+  refreshHosts: vi.fn(async (_layouts: unknown, _options: unknown) => ({})),
   host: vi.fn<
     (input: {
       hostId: string;
@@ -274,7 +275,9 @@ beforeEach(async () => {
   fake.open.mockResolvedValue({
     hostGrantStore: {},
     repairInstalledCommand: vi.fn(async () => []),
+    refreshInstalledHosts: fake.refreshHosts,
   });
+  fake.refreshHosts.mockClear();
   fake.host.mockResolvedValue({ state: "synthetic-remote-result" });
   Object.defineProperty(process, "resourcesPath", {
     configurable: true,
@@ -590,5 +593,11 @@ describe("packaged Desktop host-control ownership", () => {
     expect(fake.ensureRuntime).not.toHaveBeenCalled();
     expect(fake.createClient).not.toHaveBeenCalled();
     expect(fake.windows).toHaveLength(1);
+    // The embedded Runtime is this process, so Desktop refreshes the hosts
+    // it installed once the Runtime is up, as a standalone one would itself.
+    expect(fake.refreshHosts).toHaveBeenCalledTimes(1);
+    expect(fake.refreshHosts.mock.calls[0]?.[1]).toMatchObject({
+      diagnostics: expect.anything(),
+    });
   });
 });

memhub/apps/desktop/src/host-permissions.test.ts

@@ -21,6 +21,8 @@ import {
   claudeCodeLayout,
   codexLayout,
   cursorLayout,
+  MCP_TOOLSET_KEY,
+  MCP_TOOLSET_VERSION,
   mcpConfigPath,
   piLayout,
   planRecallInstall,
@@ -29,6 +31,7 @@ import {
   workbuddyLayout,
   workbuddyScatteredLayout,
 } from "@one-memory/host-bridge/installer";
+import type { DiagnosticInput } from "@one-memory/runtime-control";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { probeRecallInstall } from "../../../packages/host-bridge/src/recall-probe.js";
 import { skillFilePath } from "../../../packages/host-bridge/src/skill-drift.js";
@@ -1384,3 +1387,197 @@ describe("upgrading installs left by an earlier release", () => {
     );
   });
 });
+
+describe("refreshing installed hosts after an upgrade", () => {
+  function recorder() {
+    const events: DiagnosticInput[] = [];
+    return {
+      events,
+      sink: {
+        log: async (event: DiagnosticInput) => {
+          events.push(event);
+        },
+      },
+    };
+  }
+
+  async function linkedWorkbuddy(context: Awaited<ReturnType<typeof fixture>>) {
+    const layout = workbuddyLayout(path.join(context.root, "workbuddy"));
+    const preview = await context.permissions.previewInstall(layout);
+    const result = await context.permissions.install(
+      layout,
+      preview.fingerprint,
+    );
+    await context.permissions.setPermission(
+      layout,
+      approval(required(result.permission.receipt)),
+    );
+    return layout;
+  }
+
+  /** Put back the skill an earlier release wrote, journaled as ours. */
+  async function ageSkill(layout: ReturnType<typeof workbuddyLayout>) {
+    const skillPath = required(skillFilePath(layout));
+    const aged = (await readFile(skillPath, "utf8"))
+      .replace(/skill-version=\d+/, "skill-version=15")
+      .replace("`MemHub_recall`", "`MemHub_ask`");
+    await writeFile(skillPath, aged);
+    const journal = JSON.parse(await readFile(layout.journalPath, "utf8"));
+    journal.installed_skill_hash = createHash("sha256")
+      .update(aged)
+      .digest("hex");
+    await writeFile(layout.journalPath, JSON.stringify(journal));
+    return aged;
+  }
+
+  it("rewrites an old skill on the first start of a build, and only once per build", async () => {
+    const context = await fixture();
+    const layout = await linkedWorkbuddy(context);
+    const current = await readFile(required(skillFilePath(layout)), "utf8");
+    await ageSkill(layout);
+    const { events, sink } = recorder();
+
+    const first = await context.permissions.refreshInstalledHosts([layout], {
+      build: "34",
+      diagnostics: sink,
+    });
+    expect(first).toMatchObject({
+      state: "refreshed",
+      synced: ["workbuddy"],
+      failed: [],
+    });
+    expect(await readFile(required(skillFilePath(layout)), "utf8")).toBe(
+      current,
+    );
+
+    // Same build again: one file read, nothing rewritten, even if stale.
+    const aged = await ageSkill(layout);
+    expect(
+      await context.permissions.refreshInstalledHosts([layout], {
+        build: "34",
+        diagnostics: sink,
+      }),
+    ).toMatchObject({ state: "already_refreshed", synced: [] });
+    expect(await readFile(required(skillFilePath(layout)), "utf8")).toBe(aged);
+
+    // The next build refreshes again.
+    expect(
+      await context.permissions.refreshInstalledHosts([layout], {
+        build: "35",
+      }),
+    ).toMatchObject({ state: "refreshed", synced: ["workbuddy"] });
+    expect(await readFile(required(skillFilePath(layout)), "utf8")).toBe(
+      current,
+    );
+
+    // Diagnostics carry host ids and counts only, never file content.
+    expect(events.map((event) => event.event)).toEqual([
+      "host_refresh.host_updated",
+      "host_refresh.completed",
+      "host_refresh.skipped",
+    ]);
+    expect(events[0].details).toEqual({ source_id: "workbuddy" });
+    expect(events[1].details).toEqual({
+      count: 1,
+      updated_count: 1,
+      error_count: 0,
+    });
+    expect(JSON.stringify(events)).not.toContain("MemHub_");
+    expect(JSON.stringify(events)).not.toContain(context.root);
+  });
+
+  it("leaves a skill the user edited untouched", async () => {
+    const context = await fixture();
+    const layout = await linkedWorkbuddy(context);
+    const edited = `${await ageSkill(layout)}\nUser addition\n`;
+    await writeFile(required(skillFilePath(layout)), edited);
+
+    expect(
+      await context.permissions.refreshInstalledHosts([layout], {
+        build: "34",
+      }),
+    ).toMatchObject({ state: "refreshed", synced: [], failed: [] });
+    expect(await readFile(required(skillFilePath(layout)), "utf8")).toBe(
+      edited,
+    );
+  });
+
+  it("rewrites an MCP entry without the tool set stamp, in the plugin manifest too", async () => {
+    const context = await fixture();
+    const layout = await linkedWorkbuddy(context);
+    const plugin = required(layout.plugin);
+    const manifests = [
+      path.join(plugin.installRoot, ".codebuddy-plugin", "plugin.json"),
+      path.join(
+        plugin.marketplaceRoot,
+        "plugins",
+        plugin.pluginName,
+        ".codebuddy-plugin",
+        "plugin.json",
+      ),
+    ];
+    // What an earlier release wrote: the same entry with no stamp, journaled.
+    const journal = JSON.parse(await readFile(layout.journalPath, "utf8"));
+    for (const manifestPath of manifests) {
+      const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+      expect(manifest.mcpServers["one-memory"].env[MCP_TOOLSET_KEY]).toBe(
+        MCP_TOOLSET_VERSION,
+      );
+      delete manifest.mcpServers["one-memory"].env[MCP_TOOLSET_KEY];
+      const text = `${JSON.stringify(manifest, null, 2)}\n`;
+      await writeFile(manifestPath, text);
+      const entry = journal.plugin_files.find(
+        (file: { path: string }) => file.path === manifestPath,
+      );
+      entry.hash = createHash("sha256").update(text).digest("hex");
+      journal.installed_server_hash = createHash("sha256")
+        .update(JSON.stringify(manifest.mcpServers["one-memory"]))
+        .digest("hex");
+    }
+    await writeFile(layout.journalPath, JSON.stringify(journal));
+    const granted = await context.permissions.getPermission(layout);
+    expect(granted.state).toBe("approved");
+    expect(
+      (await readInstalledRecallCommand(layout))?.env[MCP_TOOLSET_KEY],
+    ).toBeUndefined();
+
+    expect(
+      await context.permissions.refreshInstalledHosts([layout], {
+        build: "34",
+      }),
+    ).toMatchObject({ synced: ["workbuddy"], failed: [] });
+    for (const manifestPath of manifests) {
+      const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+      expect(manifest.mcpServers["one-memory"].env[MCP_TOOLSET_KEY]).toBe(
+        MCP_TOOLSET_VERSION,
+      );
+    }
+    // Rewriting our own entry keeps the user's authorization.
+    expect(await context.permissions.getPermission(layout)).toEqual(granted);
+  });
+
+  it("rewrites a config-file MCP entry without the stamp", async () => {
+    const context = await fixture();
+    await install(context);
+    const configPath = mcpConfigPath(context.layout);
+    const config = JSON.parse(await readFile(configPath, "utf8"));
+    delete config.mcpServers["one-memory"].env[MCP_TOOLSET_KEY];
+    await writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`);
+    const journal = JSON.parse(
+      await readFile(context.layout.journalPath, "utf8"),
+    );
+    journal.installed_server_hash = createHash("sha256")
+      .update(JSON.stringify(config.mcpServers["one-memory"]))
+      .digest("hex");
+    await writeFile(context.layout.journalPath, JSON.stringify(journal));
+
+    expect(
+      await context.permissions.refreshInstalledHosts([context.layout]),
+    ).toMatchObject({ state: "refreshed", synced: ["cursor"], failed: [] });
+    const refreshed = JSON.parse(await readFile(configPath, "utf8"));
+    expect(refreshed.mcpServers["one-memory"].env[MCP_TOOLSET_KEY]).toBe(
+      MCP_TOOLSET_VERSION,
+    );
+    expect(refreshed.mcpServers.neighbor).toEqual({ command: "keep" });
+  });
+});

memhub/apps/desktop/src/main.ts

@@ -1369,6 +1369,24 @@ async function initialize(isQuitting: () => boolean): Promise<void> {
     });
     await runtimeSupervisor.start();
     if (isQuitting()) return;
+    // A standalone Runtime refreshes the hosts it installed as it starts, so
+    // an upgrade through the App or `memhub upgrade` is covered there. An
+    // embedded one is this process: do the same here, now it is up. Only a
+    // packaged build, so a source checkout never repoints real hosts at itself.
+    if (localPermissions && app.isPackaged) {
+      void localPermissions
+        .refreshInstalledHosts(
+          hosts.map((host) => host.layout),
+          {
+            build:
+              packagedBuildNumber === undefined
+                ? undefined
+                : String(packagedBuildNumber),
+            diagnostics: hostDiagnostics,
+          },
+        )
+        .catch(() => undefined);
+    }
     if (
       app.isPackaged &&
       process.platform === "darwin" &&

memhub/apps/web/src/MemoryMap.test.tsx

@@ -517,7 +517,7 @@ it("D96: the memory page has no raw-dialogue tab and never loads the dialogue li
 it("D96: lists a memory by when its conversation happened, not when it was generated", () => {
   const today = new Date().toISOString();
   const thisYear = new Date().getFullYear();
-  const items = ["第一条", "第二条", "第三条"].map((content, i) => ({
+  const items = ["第一条", "第二条", "第三条", "第四条"].map((content, i) => ({
     ...memories[0],
     memory_id: `t${i}`,
     content,
@@ -532,10 +532,11 @@ it("D96: lists a memory by when its conversation happened, not when it was gener
         total: 519,
         offset: 100,
         limit: 100,
-        source_ids_by_memory: { t0: [], t1: [], t2: [] },
+        source_ids_by_memory: { t0: [], t1: [], t2: [], t3: [] },
         source_time_by_memory: {
           t0: { at: `${thisYear}-10-02T10:54:00`, basis: "conversation" },
           t1: { at: `${thisYear}-09-30T08:00:00`, basis: "import" },
+          t3: { at: `${thisYear}-09-29T08:00:00`, basis: "write" },
         },
       })}
     />,
@@ -547,6 +548,10 @@ it("D96: lists a memory by when its conversation happened, not when it was gener
   expect(
     within(list).getByRole("button", { name: /第二条/ }).textContent,
   ).toContain("导入于 9月30日");
+  // An experience stored without a conversation time names its write time.
+  expect(
+    within(list).getByRole("button", { name: /第四条/ }).textContent,
+  ).toContain("写入于 9月29日");
   // D99: the generated day keeps its own line, so a memory made today from an
   // old conversation still reads as new rather than looking misplaced.
   expect(

memhub/apps/web/src/MemoryMap.tsx

@@ -139,7 +139,7 @@ function monthDay(value: string, locale: GuiLocale): string | null {
 
 /** D96: when the cited conversation happened, not when the memory was generated. */
 function sourceStamp(
-  time: { at: string; basis: "conversation" | "import" } | undefined,
+  time: { at: string; basis: "conversation" | "import" | "write" } | undefined,
   fallback: string | null | undefined,
   locale: GuiLocale = "zh-CN",
 ): string {
@@ -147,7 +147,11 @@ function sourceStamp(
   if (time && day)
     return memoryText(
       locale,
-      time.basis === "conversation" ? "对话于 {day}" : "导入于 {day}",
+      time.basis === "conversation"
+        ? "对话于 {day}"
+        : time.basis === "write"
+          ? "写入于 {day}"
+          : "导入于 {day}",
       { day },
     );
   return dayStamp(fallback, locale);

memhub/apps/web/src/SelectedMemoryDetail.test.tsx

@@ -176,3 +176,41 @@ it("stamps today's source and conversation time without an evidence page", () =>
   expect(screen.getByText(/对话时间 今天 /)).toBeTruthy();
   expect(screen.queryByRole("button", { name: "查看原文" })).toBeNull();
 });
+it("shows an experience's conversation time when the SDK stored one", () => {
+  const today = new Date().toISOString();
+  render(
+    <SelectedMemoryDetail
+      detail={{
+        ...detail,
+        evidence: [],
+        sdk_status: "active",
+        source_id: "codebuddy",
+        sdk_memory_at: today,
+        sdk_created_at: today,
+        sdk_ref: { scene: "coding", kind: "experience", variant: "coding" },
+      }}
+      sources={[]}
+    />,
+  );
+  expect(screen.getByText(/对话时间 今天 /)).toBeTruthy();
+  expect(screen.queryByText(/时间未知/)).toBeNull();
+});
+it("labels an experience without a conversation time by its write time", () => {
+  render(
+    <SelectedMemoryDetail
+      detail={{
+        ...detail,
+        evidence: [],
+        sdk_status: "active",
+        source_id: "codebuddy",
+        sdk_memory_at: null,
+        sdk_created_at: new Date().toISOString(),
+        sdk_ref: { scene: "working", kind: "experience", variant: "working" },
+      }}
+      sources={[]}
+    />,
+  );
+  expect(screen.getByText(/来源 codebuddy · 写入时间 今天 /)).toBeTruthy();
+  expect(screen.queryByText(/对话时间/)).toBeNull();
+  expect(screen.queryByText(/时间未知/)).toBeNull();
+});

memhub/apps/web/src/SelectedMemoryDetail.tsx

@@ -19,7 +19,10 @@ export function SelectedMemoryDetail({
   detail: MemoryDetail;
   sources: SourceResponse[];
   /** D99: when the cited conversation happened, in the list's own terms. */
-  conversationAt?: { at: string; basis: "conversation" | "import" } | null;
+  conversationAt?: {
+    at: string;
+    basis: "conversation" | "import" | "write";
+  } | null;
 }) {
   const { locale, t } = useGuiLanguage();
   const memory = detail.memory;
@@ -42,6 +45,17 @@ export function SelectedMemoryDetail({
           ? t("selectedMemory.status.superseded")
           : t("selectedMemory.status.unknown");
   const sourceId = detail.source_id ?? evidence?.source_id;
+  const created = clockStamp(
+    detail.sdk_created_at ?? memory.updated_at,
+    locale,
+  );
+  // An SDK experience or fact stored before hy-memory 2.0.7 has no
+  // conversation time. It shows when it was written, named as such, instead
+  // of "时间未知".
+  const writtenOnly =
+    detail.sdk_ref !== undefined &&
+    detail.sdk_ref.kind !== "chat" &&
+    !detail.sdk_memory_at;
   const source =
     detail.sdk_status && sourceId === UNATTRIBUTED_SOURCE_ID
       ? t("selectedMemory.sourceUnattributed")
@@ -77,25 +91,28 @@ export function SelectedMemoryDetail({
         <p className="selected-memory-source">
           {t("selectedMemory.sourceLine", {
             source,
-            time: clockStamp(
-              detail.sdk_memory_at ?? evidence?.created_at,
-              locale,
-            ),
+            time: writtenOnly
+              ? t("selectedMemory.writeTime", { created })
+              : clockStamp(
+                  detail.sdk_memory_at ?? evidence?.created_at,
+                  locale,
+                ),
           })}
         </p>
       ) : null}
-      <p className="selected-memory-times">
-        {t("selectedMemory.timestamps", {
-          conversation: clockStamp(
-            conversationAt?.at ?? detail.sdk_memory_at ?? evidence?.created_at,
-            locale,
-          ),
-          created: clockStamp(
-            detail.sdk_created_at ?? memory.updated_at,
-            locale,
-          ),
-        })}
-      </p>
+      {writtenOnly ? null : (
+        <p className="selected-memory-times">
+          {t("selectedMemory.timestamps", {
+            conversation: clockStamp(
+              conversationAt?.at ??
+                detail.sdk_memory_at ??
+                evidence?.created_at,
+              locale,
+            ),
+            created,
+          })}
+        </p>
+      )}
     </article>
   );
 }

memhub/apps/web/src/sdk-memory-map.test.ts

@@ -119,8 +119,12 @@ it("carries each memory's scene and namespace, and edits an experience's solutio
   });
   expect(page.window_id).toBe("w1");
   expect(page.window_reset).toBe(true);
-  // An experience has no conversation time to show as "imported".
-  expect(page.source_time_by_memory?.e).toBeUndefined();
+  // Stored without a conversation time: it shows when it was written, not
+  // an "import".
+  expect(page.source_time_by_memory?.e).toEqual({
+    at: new Date((NOW - 86_400) * 1_000).toISOString(),
+    basis: "write",
+  });
   expect(page.items[1]).toMatchObject({
     kind: "working",
     updated_at: new Date((NOW - 3_600) * 1_000).toISOString(),
@@ -140,3 +144,29 @@ it("carries each memory's scene and namespace, and edits an experience's solutio
   expect(sdkEditableText(experience)).toBe("Pin seed");
   expect(sdkEditableText(record({}))).toBe("memory");
 });
+
+it("shows an experience's conversation time when the SDK stored one", () => {
+  const at = NOW - 2 * 86_400;
+  const experience = record({
+    memory_id: "e",
+    layer: "experience",
+    scene: "coding",
+    kind: "experience",
+    variant: "coding",
+    memory_at: at,
+    created_at: NOW - 3_600,
+  });
+  const page = sdkLibraryPage({
+    memories: [experience],
+    total: 1,
+    limit: 20,
+    offset: 0,
+  });
+  expect(page.source_time_by_memory?.e).toEqual({
+    at: new Date(at * 1_000).toISOString(),
+    basis: "conversation",
+  });
+  expect(sdkDetail(experience).sdk_memory_at).toBe(
+    new Date(at * 1_000).toISOString(),
+  );
+});

memhub/apps/web/src/sdk-memory-map.ts

@@ -154,22 +154,24 @@ export function sdkDetail(record: SdkMemoryRecord): MemoryDetail {
 export function sdkLibraryPage(page: SdkMemoryPage): MemoryLibraryPage {
   const sourceTime: Record<
     string,
-    { at: string; basis: "conversation" | "import" }
+    { at: string; basis: "conversation" | "import" | "write" }
   > = {};
   const sourceIds: Record<string, string[]> = {};
   const refs: Record<string, SdkMemoryRef> = {};
   for (const record of page.memories) {
     sourceIds[record.memory_id] = [sourceOf(record)];
     refs[record.memory_id] = sdkMemoryRef(record);
-    // An experience or fact has no conversation time; the list shows when it
-    // was last updated instead of calling its creation an import.
-    if (refs[record.memory_id].kind !== "chat") continue;
+    // An experience or fact stored before hy-memory 2.0.7 has no
+    // conversation time. It shows when it was written, labelled as such,
+    // rather than calling its creation an import.
+    const chat = refs[record.memory_id].kind === "chat";
     const conversation = plausible(record.memory_at);
-    const at = conversation ?? plausible(record.gmt_created);
+    const at =
+      conversation ?? plausible(chat ? record.gmt_created : record.created_at);
     if (at === null) continue;
     sourceTime[record.memory_id] = {
       at: new Date(at * 1_000).toISOString(),
-      basis: conversation !== null ? "conversation" : "import",
+      basis: conversation !== null ? "conversation" : chat ? "import" : "write",
     };
   }
   return {

memhub/docs/ARCHITECTURE.md

@@ -282,7 +282,7 @@ Support is declared per immutable GitHub Release manifest:
 - Linux x64/arm64 Runtime on native GHA runners.
 - macOS arm64/x64 App/Runtime: Developer ID, notarization, native acceptance.
 - Windows is not supported.
-- `hy-memory==2.0.6` is the current stable SDK dependency; the release
+- `hy-memory==2.0.7` is the current stable SDK dependency; the release
   lock and [`../MEMORY.md`](../MEMORY.md) are authoritative when the pin changes.
 
 See [`INSTALLATION.md`](INSTALLATION.md).

memhub/docs/contracts/one-memory-recall-install-v1.md

@@ -39,10 +39,12 @@ which talks to a broker on the same machine.
 | `ONE_MEMORY_BROKER_DISCOVERY` | absolute path to the discovery file | How the server finds the running app. Wrong value means recall returns nothing, with no error. |
 | `ONE_MEMORY_MANAGED_BY` | `one-memory` | Marks the entry as ours, so our installer will update or remove it later instead of treating it as a stranger's and leaving it alone. |
 | `ELECTRON_RUN_AS_NODE` | `1` | The MCP entry ships inside the app bundle and is started through the app's own binary. Without this the binary opens the window instead of running the script. |
+| `ONE_MEMORY_MCP_TOOLSET` | tool set version, e.g. `3` | Names the MemHub tool set the entry was written for. MemHub changes it only when tools are added, removed or renamed, so hosts that cache a server's tool list by its launch config restart the server and drop removed tools. The server itself ignores it. |
 
 `ONE_MEMORY_MANAGED_BY` is optional for a hand-made entry. Set it if you want
 MemHub to manage the entry for you afterwards; leave it out if you would
-rather own the entry yourself.
+rather own the entry yourself. `ONE_MEMORY_MCP_TOOLSET` is optional too; a
+managed entry without the current value is rewritten on the next upgrade.
 
 ## 3. MCP hosts
 
@@ -57,7 +59,8 @@ Register a stdio server named `one-memory`. The product name is MemHub; the conf
       "env": {
         "ELECTRON_RUN_AS_NODE": "1",
         "ONE_MEMORY_BROKER_DISCOVERY": "<absolute path to the discovery file>",
-        "ONE_MEMORY_MANAGED_BY": "one-memory"
+        "ONE_MEMORY_MANAGED_BY": "one-memory",
+        "ONE_MEMORY_MCP_TOOLSET": "3"
       }
     }
   }

memhub/package.json

@@ -2,7 +2,7 @@
   "name": "one-memory",
   "version": "1.0.5",
   "release": {
-    "build_number": 33,
+    "build_number": 34,
     "macos_min_version": "13.0",
     "app_update": "manual",
     "runtime_manifest_schema": 1,

memhub/packages/contracts/src/index.ts

@@ -468,10 +468,12 @@ export interface MemoryLibraryPage {
   limit: number;
   /** Active evidence sources for each returned memory, from the same authorized page snapshot. */
   source_ids_by_memory?: Record<string, string[]>;
-  /** When each returned memory's cited conversation happened (D96). `import` when only the import time is known. */
+  /** When each returned memory's cited conversation happened (D96). `import`
+   * when only the import time is known; `write` for an SDK experience or fact
+   * stored without a conversation time, which shows when it was written. */
   source_time_by_memory?: Record<
     string,
-    { at: string; basis: "conversation" | "import" }
+    { at: string; basis: "conversation" | "import" | "write" }
   >;
   /** True when the read budget ran out mid-page (typically during a history
    * import): a partial snapshot, not an authoritative view. Show "importing"

memhub/packages/host-bridge/src/install-contract.test.ts

@@ -5,6 +5,8 @@ import { describe, expect, it } from "vitest";
 import type { RecallRuntime } from "./recall-installer.js";
 import {
   DISCOVERY_KEY,
+  MCP_TOOLSET_KEY,
+  MCP_TOOLSET_VERSION,
   OWNER_KEY,
   OWNER_VALUE,
   renderConnectionMaterial,
@@ -60,6 +62,7 @@ describe("mcp install snippet", () => {
     const env = parsed.mcpServers[SERVER_NAME].env;
     expect(env[DISCOVERY_KEY]).toBe(runtime().discoveryPath);
     expect(env[OWNER_KEY]).toBe(OWNER_VALUE);
+    expect(env[MCP_TOOLSET_KEY]).toBe(MCP_TOOLSET_VERSION);
     expect(env.ELECTRON_RUN_AS_NODE).toBe("1");
   });
 
@@ -174,9 +177,10 @@ describe("public contract document", () => {
     // reports it to us. Same class of problem R-33 treated for skill text,
     // and treated the same way: one source, checked by a test.
     const doc = await fs.readFile(CONTRACT_DOC, "utf8");
-    for (const key of [DISCOVERY_KEY, OWNER_KEY]) {
+    for (const key of [DISCOVERY_KEY, OWNER_KEY, MCP_TOOLSET_KEY]) {
       expect(doc).toContain(key);
     }
+    expect(doc).toContain(`"${MCP_TOOLSET_KEY}": "${MCP_TOOLSET_VERSION}"`);
     expect(doc).toContain(OWNER_VALUE);
     expect(doc).toContain(SERVER_NAME);
   });

memhub/packages/host-bridge/src/mcp-granted-tools.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it } from "vitest";
 
 import { type GrantedTools, McpSession } from "./mcp-session.js";
+import { MCP_TOOL_NAMES, MCP_TOOLSET_VERSION } from "./mcp-toolset.js";
 
 function sessionWith(granted: GrantedTools): McpSession {
   return new McpSession(
@@ -71,3 +72,14 @@ describe("BUG-15: the listed tools follow what the grant allows", () => {
     expect(names).toHaveLength(3);
   });
 });
+
+describe("the tool set stamped on installed entries", () => {
+  it("names exactly the tools the server lists", async () => {
+    // Change a tool without moving MCP_TOOLSET_VERSION and hosts that cache
+    // tool lists by config fingerprint keep showing the old set. Update both,
+    // and this pinned version, together.
+    const names = await listedNames(sessionWith(async () => null));
+    expect(names).toEqual([...MCP_TOOL_NAMES]);
+    expect(MCP_TOOLSET_VERSION).toBe("3");
+  });
+});

memhub/packages/host-bridge/src/mcp-session.ts

@@ -127,6 +127,8 @@ export class McpSession {
   }
 
   private async listedTools() {
+    // Any change to this set moves MCP_TOOL_NAMES and MCP_TOOLSET_VERSION in
+    // `mcp-toolset.ts`, so installed entries change and hosts relist.
     const definitions = [
       recallToolDefinition(),
       writeToolDefinition(),

memhub/packages/host-bridge/src/mcp-toolset.ts

@@ -0,0 +1,29 @@
+/** The tool contract of MemHub's MCP server, and the stamp that names it.
+ *
+ * Kept apart from `mcp-session.ts` so the installer can stamp an entry without
+ * pulling in the broker client, and listed here rather than inferred so a test
+ * can hold `tools/list` to it: change a tool there and that test fails until
+ * this list, and with it the version, moves too.
+ */
+
+/** The tools `tools/list` returns, in order. */
+export const MCP_TOOL_NAMES = [
+  "MemHub_recall",
+  "MemHub_write",
+  "MemHub_diagnostic_trace",
+] as const;
+
+/** Bumped whenever a tool is added, removed or renamed.
+ *
+ * Written into every managed MCP entry under `MCP_TOOLSET_KEY`. Hosts such as
+ * WorkBuddy cache a server's tool list under a fingerprint of its launch
+ * config, and our entry is otherwise byte-identical across upgrades, since it
+ * runs through the `current` symlink. Moving this value is what changes that
+ * fingerprint, so those hosts restart the server and drop the tools it no
+ * longer has. Deliberately not the build number: that would rewrite every
+ * host's config on every upgrade, for nothing.
+ */
+export const MCP_TOOLSET_VERSION = "3";
+
+/** The env key the version is written under. */
+export const MCP_TOOLSET_KEY = "ONE_MEMORY_MCP_TOOLSET";

memhub/packages/host-bridge/src/opencode-installer.test.ts

@@ -5,6 +5,7 @@ import { describe, expect, it } from "vitest";
 
 import {
   applyRecallInstall,
+  MCP_TOOLSET_VERSION,
   mcpConfigPath,
   opencodeLayout,
   planRecallInstall,
@@ -46,6 +47,7 @@ describe("OpenCode recall installer", () => {
         ELECTRON_RUN_AS_NODE: "1",
         ONE_MEMORY_MANAGED_BY: "one-memory",
         ONE_MEMORY_BROKER_DISCOVERY: "/opt/one-memory/runtime.json",
+        ONE_MEMORY_MCP_TOOLSET: MCP_TOOLSET_VERSION,
       },
       enabled: true,
     });

memhub/packages/host-bridge/src/recall-installer.ts

@@ -58,6 +58,7 @@ import {
   readDshServer,
   removeDshServer,
 } from "./dsh-patch.js";
+import { MCP_TOOLSET_KEY, MCP_TOOLSET_VERSION } from "./mcp-toolset.js";
 import {
   RECALL_PRESENTATION_GUIDANCE,
   RECALL_PRESENTATION_GUIDANCE_ZH,
@@ -88,8 +89,12 @@ export {
   type RecallLinkState,
   type RecallProbe,
 } from "./recall-probe.js";
-
-export { planRecallRepoint, type RecallRepoint };
+export {
+  MCP_TOOLSET_KEY,
+  MCP_TOOLSET_VERSION,
+  planRecallRepoint,
+  type RecallRepoint,
+};
 
 /** Rewrite hosts whose installed command is not the one we would write now.
  *
@@ -2844,6 +2849,9 @@ function managedServer(runtime: RecallRuntime): ManagedServer {
       ELECTRON_RUN_AS_NODE: "1",
       [DISCOVERY_KEY]: runtime.discoveryPath,
       [OWNER_KEY]: OWNER_VALUE,
+      // Moves the host's fingerprint of this entry when the tool set changes;
+      // see `MCP_TOOLSET_VERSION`. An entry without it reads as stale.
+      [MCP_TOOLSET_KEY]: MCP_TOOLSET_VERSION,
       ...(runtime.credentialFile === undefined
         ? {}
         : { ONE_MEMORY_HOST_CREDENTIAL_FILE: runtime.credentialFile }),

memhub/packages/host-bridge/src/skill-drift.test.ts

@@ -5,6 +5,7 @@ import path from "node:path";
 import { describe, expect, it } from "vitest";
 
 import { applyCursorInstall, planCursorInstall } from "./cursor-installer.js";
+import { MCP_TOOLSET_KEY, MCP_TOOLSET_VERSION } from "./mcp-toolset.js";
 import {
   applyRecallInstall,
   applyRecallUninstall,
@@ -15,6 +16,7 @@ import {
   planRecallUninstall,
   SKILL_MARKER,
   SKILL_VERSION,
+  verifyRecallInstall,
 } from "./recall-installer.js";
 import {
   checkSkillDrift,
@@ -387,6 +389,59 @@ describe("skill drift (R-33)", () => {
     });
   }, 30_000);
 
+  it("marks stale an MCP entry written before the tool set was stamped, and sync stamps it", async () => {
+    // Our entry is otherwise identical across upgrades, so hosts that cache a
+    // tool list by config fingerprint keep the removed tools until it changes.
+    const cursorDir = await fixtureDir();
+    const discovery = path.join(cursorDir, "broker.json");
+    await writeFile(discovery, "{}\n");
+    await applyCursorInstall(
+      await planCursorInstall(options(cursorDir, discovery)),
+    );
+    const layout = cursorLayout(cursorDir);
+    const configPath = layout.configPath as string;
+    const config = JSON.parse(await readFile(configPath, "utf8")) as {
+      mcpServers: Record<string, { env: Record<string, string> }>;
+    };
+    expect(config.mcpServers["one-memory"].env[MCP_TOOLSET_KEY]).toBe(
+      MCP_TOOLSET_VERSION,
+    );
+    // What an earlier release wrote and journaled: the same entry, no stamp.
+    delete config.mcpServers["one-memory"].env[MCP_TOOLSET_KEY];
+    await writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`);
+    const journal = JSON.parse(await readFile(layout.journalPath, "utf8"));
+    journal.installed_server_hash = createHash("sha256")
+      .update(JSON.stringify(config.mcpServers["one-memory"]))
+      .digest("hex");
+    await writeFile(layout.journalPath, `${JSON.stringify(journal)}\n`);
+
+    // Still intact as installed, so the link is not reported broken...
+    await expect(verifyRecallInstall(layout)).resolves.toMatchObject({
+      hostId: "cursor",
+    });
+    // ...but stale against this release, and safe to sync without asking.
+    await expect(
+      checkSkillDrift(layout, runtime(discovery)),
+    ).resolves.toMatchObject({
+      state: "stale",
+      detail: "the MCP entry predates the tool set this MemHub serves",
+    });
+    const sync = await planSkillSync(layout, runtime(discovery));
+    expect(sync?.requiresConfirmation).toBe(false);
+    if (sync === null) throw new Error("expected a stale entry sync");
+    await applyRecallInstall(sync.plan);
+
+    const synced = JSON.parse(await readFile(configPath, "utf8")) as {
+      mcpServers: Record<string, { env: Record<string, string> }>;
+    };
+    expect(synced.mcpServers["one-memory"].env[MCP_TOOLSET_KEY]).toBe(
+      MCP_TOOLSET_VERSION,
+    );
+    await expect(
+      checkSkillDrift(layout, runtime(discovery)),
+    ).resolves.toMatchObject({ state: "in_sync" });
+  }, 30_000);
+
   it("requires recall for dependent answers, not on every unrelated turn", async () => {
     const cursorDir = await fixtureDir();
     const discovery = path.join(cursorDir, "broker.json");

memhub/packages/host-bridge/src/skill-drift.ts

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import path from "node:path";
 import { captureFilePath, namesCapture } from "./capture-hooks.js";
 import { PLUGIN_HOOKS } from "./codebuddy-plugin.js";
+import { MCP_TOOLSET_KEY, MCP_TOOLSET_VERSION } from "./mcp-toolset.js";
 import {
   asInstalled,
   expectedPluginHooks,
@@ -9,6 +10,7 @@ import {
   type RecallHostLayout,
   type RecallInstallPlan,
   type RecallRuntime,
+  readInstalledRecallCommand,
   renderSkillContent,
   SKILL_VERSION,
 } from "./recall-installer.js";
@@ -99,7 +101,23 @@ export async function checkSkillDrift(
   runtime: RecallRuntime,
 ): Promise<SkillDrift | null> {
   const skill = await checkSkillFileDrift(layout, runtime);
-  if (skill === null || skill.state === "modified") return skill;
+  if (skill === null) {
+    // A host with no skill mechanism still has an entry whose tool set can
+    // age. One whose skill is merely missing is left alone: syncing would put
+    // back a file somebody removed.
+    if (skillFilePath(layout) !== null) return null;
+    return (await serverToolsetDrift(layout)) === "stale"
+      ? {
+          hostId: layout.hostId,
+          state: "stale",
+          installedVersion: null,
+          currentVersion: SKILL_VERSION,
+          skillPath: null,
+          detail: TOOLSET_STALE_DETAIL,
+        }
+      : null;
+  }
+  if (skill.state === "modified") return skill;
   const hooks = await pluginHooksDrift(layout, runtime);
   if (hooks === "modified") {
     return {
@@ -108,15 +126,19 @@ export async function checkSkillDrift(
       detail: "the plugin hook file was edited after install",
     };
   }
-  if (hooks === "stale" && skill.state === "in_sync") {
+  if (skill.state === "stale") return skill;
+  if (hooks === "stale") {
     return {
       ...skill,
       state: "stale",
       detail: "plugin hooks are still ours, but have moved since install",
     };
   }
+  if ((await serverToolsetDrift(layout)) === "stale") {
+    return { ...skill, state: "stale", detail: TOOLSET_STALE_DETAIL };
+  }
   const capture = await captureHooksDrift(layout);
-  if (capture === "stale" && skill.state === "in_sync") {
+  if (capture === "stale") {
     return {
       ...skill,
       state: "stale",
@@ -126,6 +148,29 @@ export async function checkSkillDrift(
   return skill;
 }
 
+const TOOLSET_STALE_DETAIL =
+  "the MCP entry predates the tool set this MemHub serves";
+
+/** Whether our MCP entry names the tool set this release serves.
+ *
+ * The entry is otherwise identical across upgrades, so a host that caches a
+ * server's tool list under a fingerprint of its config (WorkBuddy does) keeps
+ * listing tools that are gone until the entry itself changes. Only an entry
+ * marked as ours is read; a CLI-channel host has no entry at all.
+ */
+async function serverToolsetDrift(
+  layout: RecallHostLayout,
+): Promise<"in_sync" | "stale" | null> {
+  if (layout.channel !== "mcp") return null;
+  // A config the host cannot parse either is not ours to judge here; the
+  // install and link checks report it.
+  const installed = await readInstalledRecallCommand(layout).catch(() => null);
+  if (installed === null) return null;
+  return installed.env[MCP_TOOLSET_KEY] === MCP_TOOLSET_VERSION
+    ? "in_sync"
+    : "stale";
+}
+
 /** Detect duplicated command hooks left by earlier installs.
  *
  * `checkSkillDrift` historically compared only the Skill and plugin hooks;

memhub/packages/i18n/src/gui-i18n-current.ts

@@ -108,6 +108,7 @@ export const currentChineseMessages = {
   "selectedMemory.version": "第 {revision} 版",
   "selectedMemory.sourceLine": "来源 {source} · {time}",
   "selectedMemory.timestamps": "对话时间 {conversation} · 沉淀时间 {created}",
+  "selectedMemory.writeTime": "写入时间 {created}",
   "selectedMemory.edit": "编辑",
   "selectedMemory.evidence": "原始依据",
   "selectedMemory.evidenceLine": "{author} · 原对话 {time}：",
@@ -258,6 +259,7 @@ export const currentEnglishMessages: Record<
   "selectedMemory.sourceLine": "Source {source} · {time}",
   "selectedMemory.timestamps":
     "Conversation time {conversation} · Created {created}",
+  "selectedMemory.writeTime": "Written {created}",
   "selectedMemory.edit": "Edit",
   "selectedMemory.evidence": "Original evidence",
   "selectedMemory.evidenceLine": "{author} · Original conversation {time}:",
@@ -418,6 +420,7 @@ export const currentSpanishMessages: Record<
   "selectedMemory.sourceLine": "Origen {source} · {time}",
   "selectedMemory.timestamps":
     "Conversación {conversation} · Guardada {created}",
+  "selectedMemory.writeTime": "Escrita {created}",
   "selectedMemory.edit": "Editar",
   "selectedMemory.evidence": "Evidencia original",
   "selectedMemory.evidenceLine": "{author} · Conversación original {time}:",

memhub/packages/i18n/src/gui-i18n-english.ts

@@ -1774,6 +1774,7 @@ const baseEnglishMessages = {
     " · Import count is still updating; refresh to check",
   "memory:对话于 {day}": "Conversation on {day}",
   "memory:导入于 {day}": "Imported on {day}",
+  "memory:写入于 {day}": "Written on {day}",
   "memory:已开始处理所选对话": "Processing selected conversations",
   "memory:处理请求已受理": "Processing request received",
   "memory:模型连接已通过。首批记忆生成后，会逐步出现在记忆列表里。":

memhub/packages/i18n/src/gui-i18n-memory.ts

@@ -336,6 +336,7 @@ export const memoryChineseMessages = {
   "memory: · 导入数量仍在更新，可刷新核对": " · 导入数量仍在更新，可刷新核对",
   "memory:对话于 {day}": "对话于 {day}",
   "memory:导入于 {day}": "导入于 {day}",
+  "memory:写入于 {day}": "写入于 {day}",
   "memory:已开始处理所选对话": "已开始处理所选对话",
   "memory:处理请求已受理": "处理请求已受理",
   "memory:模型连接已通过。首批记忆生成后，会逐步出现在记忆列表里。":
@@ -750,6 +751,7 @@ export const memorySpanishMessages: Record<
     " · La importación continúa; actualiza para verificar",
   "memory:对话于 {day}": "Conversación del {day}",
   "memory:导入于 {day}": "Importada el {day}",
+  "memory:写入于 {day}": "Escrita el {day}",
   "memory:已开始处理所选对话": "Procesamiento de conversaciones iniciado",
   "memory:处理请求已受理": "Solicitud de procesamiento aceptada",
   "memory:模型连接已通过。首批记忆生成后，会逐步出现在记忆列表里。":

memhub/packages/runtime-control/src/host-permissions.ts

@@ -41,6 +41,7 @@ import {
   repairInstalledRecallCommands,
   verifyRecallInstall,
 } from "@one-memory/host-bridge/installer";
+import type { DiagnosticInput, DiagnosticSink } from "./diagnostic-log.js";
 import {
   hasSyncHookArtifacts,
   loadSyncHookAssets,
@@ -96,8 +97,22 @@ interface InstallationBinding {
 }
 
 const CREDENTIAL_ENV = "ONE_MEMORY_HOST_CREDENTIAL_FILE";
+/** The build whose host refresh last completed, beside the grants. */
+const HOST_REFRESH_FILE = "host-refresh.json";
 const locks = new Map<string, Promise<void>>();
 
+/** What one pass of `refreshInstalledHosts` did, by host id. */
+export interface HostRefreshReport {
+  /** `already_refreshed` when this build had already completed a pass. */
+  state: "refreshed" | "already_refreshed";
+  checked: number;
+  /** Hosts whose installed command or discovery path was moved. */
+  repointed: string[];
+  /** Hosts whose stale skill, hooks, plugin files or MCP entry were rewritten. */
+  synced: string[];
+  failed: string[];
+}
+
 export const LOCAL_EXPERIENCE_UNAVAILABLE = "体验版暂不支持";
 
 /** Trusted local Runtime control plane. Never exposed through MCP or the Core API.
@@ -201,11 +216,20 @@ export class HostPermissions {
    * touching authorization. A skill the user edited is left for the detail page.
    */
   async syncStaleInstalls(layouts: RecallHostLayout[]): Promise<string[]> {
+    return (await this.syncStale(layouts)).synced;
+  }
+
+  private async syncStale(
+    layouts: RecallHostLayout[],
+  ): Promise<{ synced: string[]; failed: string[] }> {
     const synced: string[] = [];
+    const failed: string[] = [];
     for (const layout of layouts) {
       try {
         await this.withHostLock(layout, async () => {
-          await this.requireLinked(layout);
+          // Not linked from this data directory is not ours to sync, and not
+          // a failure either.
+          if (!(await this.isLinked(layout))) return;
           const sync = await planSkillSync(layout, this.runtimeFor(layout));
           if (sync === null || sync.requiresConfirmation) return;
           const preview = await previewRecallInstall(sync.plan);
@@ -215,9 +239,128 @@ export class HostPermissions {
         });
       } catch {
         // One host that cannot be synced must not stop the runtime starting.
+        failed.push(layout.hostId);
       }
     }
-    return synced;
+    return { synced, failed };
+  }
+
+  /** Refresh every host this directory installed, once per build.
+   *
+   * An upgrade changes the call rules, hooks and MCP entry we would write, but
+   * nothing rewrote the copies hosts already had, so they kept telling the
+   * model to call tools that were gone. This runs the same repoint and stale
+   * sync the detail page offers, without asking, for files that are still
+   * exactly ours; an edited skill stays for the user to confirm.
+   *
+   * The build it last completed for is recorded beside the grants, so later
+   * launches of the same build cost one file read. A run in which any host
+   * failed is not recorded, so the next launch tries again. With no build to
+   * name (a source checkout) it runs every time and records nothing.
+   */
+  async refreshInstalledHosts(
+    layouts: RecallHostLayout[],
+    options: { build?: string; diagnostics?: DiagnosticSink } = {},
+  ): Promise<HostRefreshReport> {
+    const log = (input: DiagnosticInput) =>
+      options.diagnostics?.log(input).catch(() => undefined);
+    const build = options.build?.trim() || undefined;
+    if (build !== undefined && (await this.readRefreshedBuild()) === build) {
+      await log({
+        level: "info",
+        component: "host.refresh",
+        event: "host_refresh.skipped",
+        outcome: "skipped",
+        details: { reason: "already_refreshed", count: layouts.length },
+      });
+      return {
+        state: "already_refreshed",
+        checked: layouts.length,
+        repointed: [],
+        synced: [],
+        failed: [],
+      };
+    }
+    const started = Date.now();
+    const repointed: string[] = [];
+    const failed: string[] = [];
+    for (const layout of layouts) {
+      try {
+        repointed.push(...(await this.repairInstalledCommands([layout])));
+      } catch {
+        failed.push(layout.hostId);
+      }
+    }
+    const stale = await this.syncStale(layouts);
+    failed.push(...stale.failed.filter((hostId) => !failed.includes(hostId)));
+    for (const hostId of new Set([...repointed, ...stale.synced])) {
+      await log({
+        level: "info",
+        component: "host.refresh",
+        event: "host_refresh.host_updated",
+        outcome: "succeeded",
+        details: { source_id: hostId },
+      });
+    }
+    for (const hostId of failed) {
+      await log({
+        level: "warn",
+        component: "host.refresh",
+        event: "host_refresh.host_failed",
+        outcome: "failed",
+        error_code: "host_refresh_failed",
+        details: { source_id: hostId },
+      });
+    }
+    if (build !== undefined && failed.length === 0) {
+      await this.writeRefreshedBuild(build).catch(() => undefined);
+    }
+    await log({
+      level: failed.length === 0 ? "info" : "warn",
+      component: "host.refresh",
+      event: "host_refresh.completed",
+      outcome: failed.length === 0 ? "succeeded" : "degraded",
+      duration_ms: Date.now() - started,
+      details: {
+        count: layouts.length,
+        updated_count: new Set([...repointed, ...stale.synced]).size,
+        error_count: failed.length,
+      },
+    });
+    return {
+      state: "refreshed",
+      checked: layouts.length,
+      repointed,
+      synced: stale.synced,
+      failed,
+    };
+  }
+
+  private async readRefreshedBuild(): Promise<string | null> {
+    try {
+      return await storageGuard(async () => {
+        const file = path.join(this.directory, HOST_REFRESH_FILE);
+        if ((await optionalStat(file)) === null) return null;
+        const value: unknown = JSON.parse(await privateRead(file));
+        return isObject(value) &&
+          value.schemaVersion === 1 &&
+          typeof value.build === "string"
+          ? value.build
+          : null;
+      });
+    } catch {
+      // Unreadable reads as never refreshed: the refresh is idempotent.
+      return null;
+    }
+  }
+
+  private async writeRefreshedBuild(build: string): Promise<void> {
+    await storageGuard(() =>
+      privateWrite(
+        path.join(this.directory, HOST_REFRESH_FILE),
+        `${JSON.stringify({ schemaVersion: 1, build })}\n`,
+      ),
+    );
   }
 
   /** Same repair for one host. Does not revoke or reissue its authorization. */
@@ -942,6 +1085,16 @@ export class HostPermissions {
       throw new Error("host_permission_installation_incomplete");
   }
 
+  /** `requireLinked` as a question, for sweeps that skip hosts not ours. */
+  private async isLinked(layout: RecallHostLayout): Promise<boolean> {
+    if (!supported(layout)) return false;
+    const current = await this.inspect(layout, false);
+    return (
+      (current.state === "approved" || current.state === "install-only") &&
+      current.reason === null
+    );
+  }
+
   /** Turning off a host with nothing of ours on it is an empty removal, not a
    * failure; one whose state cannot be settled is an empty removal carrying
    * what to look at, which uninstall refuses. Only what is ours for certain

memhub/packages/runtime-control/src/index.ts

@@ -79,6 +79,7 @@ export {
 } from "./host-control-client.js";
 export {
   HostPermissions,
+  type HostRefreshReport,
   LOCAL_EXPERIENCE_UNAVAILABLE,
   type RecallPermissionStatus,
   type RevokeRecallPermissionInput,

memhub/packages/runtime-control/src/runtime-cli.test.ts

@@ -226,6 +226,7 @@ describe("host runtime attestation", () => {
     "repairInstalledCommand",
     "repairInstalledCommands",
     "syncStaleInstalls",
+    "refreshInstalledHosts",
     "previewInstall",
     "install",
     "setPermission",

memhub/packages/runtime-control/src/runtime-cli.ts

@@ -600,6 +600,7 @@ export function guardedPermissions(
     "previewSyncHook",
     "applySyncHook",
     "syncStaleInstalls",
+    "refreshInstalledHosts",
   ]);
   return new Proxy(owner, {
     get(target, property, receiver) {
@@ -739,10 +740,17 @@ export async function createRuntimeService(
       ).filter((host) => host.hostId !== "openclaw");
       await verifyHostRuntime().then(
         async () => {
-          await permissions.repairInstalledCommands(
+          // Every Runtime start after an upgrade, the App's or `memhub
+          // upgrade`'s, comes through here first; once per build after that.
+          await permissions.refreshInstalledHosts(
             hosts.map((host) => host.layout),
+            {
+              build:
+                config.buildIdentity?.buildNumber ??
+                config.buildIdentity?.version,
+              diagnostics: hostDiagnostics,
+            },
           );
-          await permissions.syncStaleInstalls(hosts.map((host) => host.layout));
         },
         () => undefined,
       );

memhub/scripts/generate_sbom.py

@@ -36,7 +36,7 @@ MEMMY_LICENSE = (
 MEMMY_PROVENANCE = MEMMY_LICENSE.with_name("PROVENANCE.md")
 MEMMY_PIN = "25acd5f29fc7df73b943713abe61f1b2f9839887"
 HY_MEMORY_NAME = "hy-memory"
-HY_MEMORY_VERSION = "2.0.6"
+HY_MEMORY_VERSION = "2.0.7"
 
 
 class SbomError(RuntimeError):

memhub/scripts/install-docs.test.mjs

@@ -12,7 +12,7 @@ test("installation docs disclose publication and lifecycle boundaries", async ()
     "utf8",
   );
 
-  assert.match(readme, /`hy-memory==2\.0\.6`/);
+  assert.match(readme, /`hy-memory==2\.0\.7`/);
   assert.match(readme, /`v1\.0\.5` 的发行目标是 Linux x64\/arm64 Runtime/);
   assert.match(readme, /Linux 制品由 GitHub Actions/);
   assert.match(readme, /macOS.*Developer ID 签名、公证/s);

memhub/scripts/test_generate_sbom.py

@@ -13,7 +13,7 @@ spec.loader.exec_module(module)
 
 
 def test_hy_memory_notice_comes_from_the_installed_dist_info(tmp_path: Path) -> None:
-    dist_info = tmp_path / "hy_memory-2.0.6.dist-info"
+    dist_info = tmp_path / "hy_memory-2.0.7.dist-info"
     licenses = dist_info / "licenses"
     licenses.mkdir(parents=True)
     (dist_info / "METADATA").write_text(
@@ -21,7 +21,7 @@ def test_hy_memory_notice_comes_from_the_installed_dist_info(tmp_path: Path) ->
             (
                 "Metadata-Version: 2.4",
                 "Name: hy-memory",
-                "Version: 2.0.6",
+                "Version: 2.0.7",
                 "License-Expression: Apache-2.0",
                 "",
             )
@@ -38,7 +38,7 @@ def test_hy_memory_notice_comes_from_the_installed_dist_info(tmp_path: Path) ->
     notice = module.hy_memory_notice(dist_info)
 
     assert notice["name"] == "hy-memory"
-    assert notice["version"] == "2.0.6"
+    assert notice["version"] == "2.0.7"
     assert notice["license"] == "Apache-2.0"
     assert notice["copyright"] == "Copyright (C) 2026 Tencent. All rights reserved."
     assert "Licensed under the Apache License" in notice["text"]