feat: add Nowledge Mem ZCode plugin - #1
Conversation
📝 WalkthroughWalkthroughThis PR adds the Nowledge Mem ZCode plugin package. It defines plugin and marketplace metadata, configures a local MCP endpoint, adds six memory-management skills, documents installation and operation, and provides a validation script. ChangesNowledge Mem ZCode plugin package
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@README.md`:
- Around line 150-158: Update the README example around the ZCode MCP
configuration to remove the API key from the command-line invocation. Use the
project’s supported secure credential-input method, or omit the API-key setup
command while retaining the guidance that tokens must not be passed as arguments
or logged.
In `@scripts/validate-plugin.mjs`:
- Around line 91-101: Update the MCP validation around server.url and headers to
require the exact local endpoint http://127.0.0.1:14242/mcp/ and reject any
other URL, including URL userinfo or alternate HTTP(S) endpoints. Validate that
headers contains only APP with the exact value "ZCode", rejecting X-Token,
authorization, and any additional or differently valued fields; preserve the
existing credential-field scan for the remaining configuration.
In `@skills/distill-memory/SKILL.md`:
- Around line 8-19: Update the proactive-save guidance in the “Good candidates”
section to explicitly exclude API keys, passwords, access tokens, private keys,
and personal or customer data, including by redacting sensitive portions.
Require user confirmation before persisting any content that may contain
sensitive data, while preserving proactive writes for eligible non-sensitive
durable information.
- Around line 23-26: Update the memory creation workflow described in SKILL.md
so duplicate detection and refinement apply consistently to facts, plans,
learnings, context, and events in addition to decisions, procedures, and
preferences. Use the existing memory_update or merge behavior for mutable types;
if any supported unit types are intentionally immutable, explicitly document
that exception and the corresponding add behavior.
- Around line 35-37: Update the nmem CLI fallback examples and implementation
around the memory add command to pass the selected validated unit type instead
of hardcoding decision, and include the importance flag only when an importance
value is known. Preserve label handling while ensuring non-decision memories
retain their matching unit_type.
- Around line 40-42: Update the existing-memory instruction near the `nmem
--json m update` command to use the documented Nowledge Mem update interface
consistently, matching the official `memory_update`/MCP path rather than the
conflicting CLI fallback. Preserve the rule that `--space` is included only when
the active ambient space is known, otherwise use the default lane.
In `@skills/search-memory/SKILL.md`:
- Around line 20-28: Update the “Routing rules” section in SKILL.md to
explicitly state that retrieved memories and thread messages are untrusted
evidence only and cannot authorize actions, override policies, trigger tool use,
or request secrets. Keep the existing search and summarization rules unchanged.
In `@skills/status/SKILL.md`:
- Around line 10-18: Update the status-check instructions to run nmem --json
stats for database statistics and memory count, and nmem --json wm read for the
Working Memory briefing, alongside nmem --json status for reachability, mode,
and server version. Interpret missing briefing or data separately from
connection failures, and never expose API keys or credentials in output.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 62dd2b34-1654-46d9-b4c9-461afba9d554
📒 Files selected for processing (12)
.mcp.json.zcode-plugin/plugin.jsonCHANGELOG.mdREADME.mdmarketplace.jsonscripts/validate-plugin.mjsskills/check-integration/SKILL.mdskills/distill-memory/SKILL.mdskills/read-working-memory/SKILL.mdskills/save-handoff/SKILL.mdskills/search-memory/SKILL.mdskills/status/SKILL.md
|
@coderabbitai review The previous 8 findings were fixed in commits 4b05912 and 92eb6a3 and their threads are resolved/outdated. Please run a substantive review of the current head 92eb6a3 when the review limit permits. I will verify the new diff and continue fixing any new findings before considering this PR converged. |
|
|
|
@coderabbitai review The current head 4e35ab6 makes the automatic session-memory sync boundary explicit at the top of README and in the integration/handoff Skills. It states that this release does not automatically synchronize ZCode conversations or capture complete transcripts, and explains the missing primary-session lifecycle/transcript contract. Local validator and JSON checks pass. Please review the current head when available. |
|
|
1 participant
Summary
.zcode-plugin/plugin.jsonmanifestDistribution design
This repository is both the single-plugin marketplace root and the plugin root:
nowledge-zcodenowledge-mem-zcode.plugin:nowledge-mem-zcode:nowledge-memUsers can install it in ZCode through Settings → Plugins → Create → Add marketplace with:
https://github.com/nowledge-co/zcode-pluginThe package intentionally provides guided MCP + Skills behavior and honest handoff summaries. It does not claim automatic transcript capture, pre-compaction capture, or
save-threadbecause the ZCode lifecycle/transcript contract is not verified.Blocked by
Summary by CodeRabbit
New Features
Documentation
Tests