@jjh32456/dsh-longlive 1.6.7 → 1.8.0

package/src/recall/index.js

@@ -1,7 +1,7 @@
 /**
  * dsh-auto-recall — 插件骨架（**未安装**，见 ../README.md 与 WIRING.md §9）。
  *
- * 与 WIRING.md §3 的差异（红队第三轮 mustFix 已修）：
+ * 与 WIRING.md §3 的差异（评审第三轮 mustFix 已修）：
  *   - 注册用显式 `{ prepend: false }`，不跟 identity-router 抢外层；
  *     identity-router 在 `next()` 之前把开机卡插到第一条真实 user 之后，auto 作为内层
  *     一定看得到它，最终顺序固定为 `[user, boot, runtime, auto]`（真实 Cordis
@@ -10,7 +10,7 @@
  *   - firstUserText 只认真正的用户消息：`session/event` 里跳过 `【开机卡】`/`【自动想起】`
  *     注入（它们不再是 kind:'user'，但历史消息仍可能带标记），否则开机卡会污染之后
  *     每一轮的查询词；第 1 轮内后来到达的真人消息覆盖先前候选，防外部插件用
- *     kind:'user' 把文本插到真实提问之前（红队 ADV1）；
+ *     kind:'user' 把文本插到真实提问之前（评审 ADV1）；
  *   - 注入前过 privacyScan（privacy-gate 的 scanPrivacy）；标题、摘要、路径都扫，
  *     路径命中整卡丢弃；
  *   - identity-router 已注入的卡路径进 seenPaths（路径级排除），不再无条件排除
@@ -23,6 +23,13 @@
  */
 
 import { loadCards } from './cards.mjs';
+import { sharedVisibility } from './shared-visibility.js';
+import { extractTimeRefs } from './time-normalizer.mjs';
+import { readEntityAliases, resolveEntityAliases, expandQueryWithEntities } from './entities.mjs';
+import { resolveAnaphora, expandQueryWithAnaphora } from './anaphora.mjs';
+import { appendAuditRecord } from '../memory/audit-records.js';
+import { buildEvidencePackage, writeEvidencePackage } from '../memory/evidence.js';
+import { fastAnswerFromRecallItems } from '../memory/recall-v2.js';
 import { buildQueryText, chooseRecall, decideTrigger, renderInjection } from './recall-core.mjs';
 import { createEmbeddingRuntime } from './embedding.mjs';
 import { privacyScan } from './privacy.mjs';
@@ -34,10 +41,13 @@ import {
   isRealUserMessage,
   mergeInjectionOrder,
 } from './inject-order.mjs';
-import { appendFileSync, mkdirSync } from 'node:fs';
+import { appendFileSync, mkdirSync, readdirSync, statSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { dshHome } from '../home.js';
 import { DEFAULT_MEMORY_DIRNAME } from '../memory/paths.js';
+import { startPrestepPhase, notePrestepDegrade, setPrestepMeta } from '../metrics/prestep-latency.mjs';
+import { readVerifiedAutoCards } from '../memory/auto-cards.js';
+import { sampleContentHash } from '../memory/auto-cards.js';
 
 export const name = 'dsh-auto-recall';
 export const inject = [];
@@ -72,12 +82,13 @@ const DEFAULTS = Object.freeze({
   privacyPolicy: 'drop',
   skipSubagents: true,
   log: false,
-  embedding: { enabled: false },
+  embedding: { enabled: true },
+  evidencePackage: true,
 });
 
 function normalize(config = {}) {
   const cfg = { ...DEFAULTS, ...config };
-  // 红队 M1：空 / 未配置时走可移植默认链，绝不落到构建机的绝对路径。
+  // 评审 M1：空 / 未配置时走可移植默认链，绝不落到构建机的绝对路径。
   const root = typeof cfg.memoryRoot === 'string' ? cfg.memoryRoot.trim() : '';
   cfg.memoryRoot = root === '' ? defaultMemoryRoot() : root;
   // 注入硬上限 2K token/轮（A4）；下限保留 200，避免误配把注入挤成一条。
@@ -90,7 +101,11 @@ function normalize(config = {}) {
   // 测试/嵌入时可注入消息工厂，避免依赖 @deepseek-ai/dsh-llm 的解析环境。
   cfg.createUserMessage = typeof config.createUserMessage === 'function' ? config.createUserMessage : null;
   // embedding 由 embedding.mjs 自己归一化（enabled 默认 false、modelPath 必填）。
-  cfg.embedding = config.embedding && typeof config.embedding === 'object' ? { ...config.embedding } : { enabled: false };
+  cfg.embedding = config.embedding && typeof config.embedding === 'object' ? { ...config.embedding } : { enabled: true };
+  cfg.evidencePackage = cfg.evidencePackage !== false;
+  cfg.evidenceAuditKey = config.evidenceAuditKey && (Buffer.isBuffer(config.evidenceAuditKey) || typeof config.evidenceAuditKey === 'string')
+    ? config.evidenceAuditKey
+    : null;
   return cfg;
 }
 
@@ -168,19 +183,57 @@ export function apply(ctx, config = {}) {
     }
   };
 
+  // B2: entity alias registry is read lazily (missing file => no-op, no latency).
+  let entityAliasesCache = null;
+  const getEntityAliases = () => {
+    if (entityAliasesCache !== null) return entityAliasesCache;
+    try {
+      entityAliasesCache = readEntityAliases({ memoryRoot: cfg.memoryRoot });
+    } catch {
+      entityAliasesCache = { present: false, aliases: {} };
+    }
+    return entityAliasesCache;
+  };
+
   const states = new Map();
   const stateFor = (key) => {
     let st = states.get(key);
     if (!st) {
-      st = { turn: 0, seen: new Set(), lastQuery: '', compacted: false, warned: false, firstUserText: '' };
+      st = { turn: 0, seen: new Set(), lastQuery: '', compacted: false, warned: false, firstUserText: '', sharedInjected: false };
       states.set(key, st);
     }
     return st;
   };
 
+  /** Cheap mtime/size signature so new or edited cards are visible next turn. */
+  const cardSignature = () => {
+    const parts = [];
+    const walk = (dir) => {
+      let entries = [];
+      try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return; }
+      for (const entry of entries) {
+        const full = join(dir, entry.name);
+        if (entry.isDirectory()) walk(full);
+        else if (entry.isFile() && /\.md$/i.test(entry.name)) {
+          try {
+            const st = statSync(full);
+            parts.push(`${full}:${st.mtimeMs}:${st.size}:${sampleContentHash(full, st.size)}`);
+          } catch { /* unreadable card is not part of the signature */ }
+        }
+      }
+    };
+    for (const dir of cfg.dirs) walk(join(cfg.memoryRoot, dir));
+    parts.sort();
+    return parts.join('|');
+  };
+
   let cards = null;
+  let cardsSignature = '';
   const getCards = () => {
-    if (cards) return cards;
+    const signature = cardSignature();
+    if (cards && signature === cardsSignature) return cards;
+    cardsSignature = signature;
+    cards = null;
     try {
       cards = loadCards(cfg.memoryRoot, { dirs: cfg.dirs });
     } catch (error) {
@@ -239,13 +292,55 @@ export function apply(ctx, config = {}) {
     const st = stateFor(key);
     const messages = Array.isArray(decision.messages) ? decision.messages : [];
     const turn = Number.isFinite(Number(payload?.turn)) ? Number(payload.turn) : st.turn + 1;
-
+    // M2-C R1–R6: shared visibility block is injected on the FIRST turn only.
+    const rawSharedNow = payload?.at ?? payload?.eventTime ?? payload?.now ?? null;
+    const sharedNow = rawSharedNow === null || rawSharedNow === undefined
+      ? Date.now()
+      : (Number.isFinite(Number(rawSharedNow)) ? Number(rawSharedNow) : (Date.parse(String(rawSharedNow)) || Date.now()));
+    let sharedMessage = null;
+    let sharedVisibilityResult = null;
+    const attachShared = (value) => (sharedMessage === null ? value : { ...value, messages: mergeInjectionOrder(Array.isArray(value?.messages) ? value.messages : messages, sharedMessage) });
+
+    // B3: recall phase wraps the whole recall decision/injection (timing only).
+    const recallPhase = startPrestepPhase(key, turn, 'recall');
     try {
+      if (turn === 1 && st.sharedInjected !== true && cfg.memoryRoot) {
+        try {
+          const visibility = sharedVisibility({
+            memoryRoot: cfg.memoryRoot,
+            currentSessionId: payload?.agent?.session?.id ?? key,
+            now: sharedNow,
+            privacyScan,
+          });
+          if (visibility && visibility.block) {
+            const factory = await getCreateUserMessage();
+            if (factory) {
+              sharedMessage = assertInjectionMessage(factory({ content: [{ type: 'text', text: visibility.block }], source: injectionSource() }));
+              sharedVisibilityResult = { count: visibility.count, chars: visibility.block.length, sessions: visibility.sessions.map((session) => session.sessionId) };
+              st.sharedInjected = true;
+            }
+          }
+        } catch { /* shared visibility must never block the turn */ }
+      }
+      const recentTexts = userTexts(messages).slice(-2);
       const queryText = buildQueryText({
         firstUserText: st.firstUserText,
-        recentTexts: userTexts(messages).slice(-2),
+        recentTexts,
         cwd: process.cwd(),
       });
+      // B2: entity aliases + anaphora expansion run before retrieval (read-only channels).
+      const aliases = getEntityAliases();
+      const aliasResolution = aliases.present ? resolveEntityAliases(queryText, aliases.aliases) : { terms: [], matches: [] };
+      const entityExpanded = expandQueryWithEntities(queryText, aliasResolution);
+      const anaphora = resolveAnaphora({ text: queryText, recentTexts });
+      const anaphoraExpanded = expandQueryWithAnaphora(entityExpanded.text, anaphora);
+      const expandedQuery = anaphoraExpanded.text;
+      // Event time only when the host/pre-step provides it; never Date.now() here.
+      const rawEventNow = payload?.at ?? payload?.eventTime ?? payload?.now ?? null;
+      const eventNow = rawEventNow === null || rawEventNow === undefined
+        ? null
+        : (Number.isFinite(Number(rawEventNow)) ? Number(rawEventNow) : (Date.parse(String(rawEventNow)) || null));
+      const queryTimeRefs = eventNow === null ? [] : extractTimeRefs(queryText, { now: eventNow });
 
       const gate = decideTrigger({
         step: Number(payload?.step),
@@ -255,12 +350,30 @@ export function apply(ctx, config = {}) {
         options: { everyNTurns: cfg.everyNTurns },
       });
       if (!gate.recall) {
+        notePrestepDegrade(key, turn, { kind: 'gate-skip', phase: 'recall', detail: gate.why });
         logRecall(key, turn, { items: [], rejections: [] });
         observe({ key, turn, why: gate.why, queryChars: queryText.length, tokens: 0, ms: Date.now() - started });
-        return decision;
+        return attachShared(decision);
       }
 
       const loaded = getCards();
+      // 1.8.0 AutoCards: JSONL event→index cards are recall candidates too, so a
+      // matched card carries its origin anchor into the injected block.
+      let loadedForRecall = loaded;
+      if (cfg.memoryRoot) {
+        try {
+          const autoCards = readVerifiedAutoCards({ memoryRoot: cfg.memoryRoot }).map((card) => ({
+            path: `auto:${card.cardId}`,
+            title: card.title,
+            body: [card.title, Array.isArray(card.terms) ? card.terms.join(' ') : ''].filter(Boolean).join('\n'),
+            scopeIn: [],
+            aliases: Array.isArray(card.terms) ? card.terms : [],
+            cardId: card.cardId,
+            anchor: card.anchor,
+          }));
+          if (autoCards.length > 0) loadedForRecall = [...loaded, ...autoCards];
+        } catch { /* cards are additive; never block markdown recall */ }
+      }
       // 路径级排除：identity-router 本轮已经注入过的卡，不再注入第二遍。
       // 不再无条件排除首轮 handover/：没装 identity-router 时那张卡就是唯一开机卡。
       const seen = [...new Set([
@@ -274,25 +387,29 @@ export function apply(ctx, config = {}) {
       let vectors = null;
       if (embedding.enabled) {
         try {
-          const ready = await embedding.ensure(loaded);
+          const ready = await embedding.ensure(loaded, { signature: cardsSignature });
           if (ready.ok) {
             queryVector = await embedding.embedQuery(queryText);
             vectors = ready.cardVectors;
           } else if (!embeddingWarned) {
             embeddingWarned = true;
+            notePrestepDegrade(key, turn, { kind: 'embedding-fallback', phase: 'recall', detail: ready.code ?? 'not-ready' });
             warn('EMBEDDING_FALLBACK', ready.code, ready.message);
           }
         } catch (error) {
           if (!embeddingWarned) {
             embeddingWarned = true;
+            notePrestepDegrade(key, turn, { kind: 'embedding-fallback', phase: 'recall', detail: String(error?.code ?? error?.message ?? error) });
             warn('EMBEDDING_FALLBACK', error?.code ?? error?.message ?? error);
           }
         }
       }
 
-      const result = chooseRecall({
-        queryText,
-        cards: loaded,
+      // B3: budget phase = ranking + budget trimming inside chooseRecall.
+      const budgetPhase = startPrestepPhase(key, turn, 'budget');
+      const recallInput = {
+        queryText: expandedQuery,
+        cards: loadedForRecall,
         queryVector,
         vectors,
         budget: cfg.budget,
@@ -304,6 +421,9 @@ export function apply(ctx, config = {}) {
           privacyPolicy: cfg.privacyPolicy,
           privacyScan,
           trace: true,
+          // B2 channels: neutral when empty (legacy ordering unchanged).
+          queryTimeRefs,
+          entityAliases: aliases.present ? aliases.aliases : undefined,
           fusion: {
             keywordWeight: embedding.config.keywordWeight,
             vectorWeight: embedding.config.vectorWeight,
@@ -311,9 +431,97 @@ export function apply(ctx, config = {}) {
             minFusedScore: embedding.config.minFusedScore,
           },
         },
+      };
+      let result = chooseRecall(recallInput);
+      budgetPhase.end();
+      // 1.8.0 two-layer quota: at most 2 curated cards + 1 AutoCard per turn;
+      // curated hits always render first (tier weight 1.12 only affects order
+      // inside the curated layer, so existing output stays stable).
+      if (Array.isArray(result.items) && result.items.length > 0) {
+        const isAuto = (item) => String(item?.path ?? '').startsWith('auto:');
+        let curatedItems = result.items.filter((item) => !isAuto(item))
+          .sort((a, b) => (b.score * 1.12) - (a.score * 1.12));
+        const eventItems = result.items.filter(isAuto).slice(0, 1);
+        // Curated floor: event cards may never squeeze curated cards out.
+        if (curatedItems.length === 0 && loaded.length > 0) {
+          const curatedOnly = chooseRecall({ ...recallInput, cards: loaded });
+          if (curatedOnly.items.length > 0) {
+            result = curatedOnly;
+            curatedItems = curatedOnly.items.slice().sort((a, b) => (b.score * 1.12) - (a.score * 1.12));
+          }
+        }
+        result.items = [...curatedItems.slice(0, 2), ...eventItems].slice(0, cfg.maxItems);
+      }
+      // M2-C #6: every recall decision atomically publishes .longlive/evidence/latest.json.
+      let evidencePackage = null;
+      if (cfg.evidencePackage && cfg.memoryRoot) {
+        try {
+          const nowIso = new Date().toISOString();
+          const fast = fastAnswerFromRecallItems({ question: queryText, items: result.items });
+          const pkg = buildEvidencePackage({
+            sessionId: payload?.agent?.session?.id ?? key,
+            turn,
+            query: queryText,
+            timings: {
+              questionAt: eventNow === null ? null : new Date(eventNow).toISOString(),
+              queueMs: 0,
+              prefetchAt: new Date(started).toISOString(),
+              retrievedAt: nowIso,
+              evidenceReadyAt: nowIso,
+            },
+            anchors: result.items.map((item) => ({
+              path: item.path,
+              excerpt: `${item.title ?? ''} — ${item.excerpt ?? ''}`.trim(),
+              score: Number.isFinite(Number(item.score)) ? Number(item.score) : null,
+              l0Status: 'card',
+            })),
+            status: result.items.length > 0 ? 'ready' : 'no_evidence',
+            fastAnswer: fast.fastAnswer === null ? null : { text: fast.fastAnswer.text, valueType: fast.fastAnswer.valueType, anchor: fast.fastAnswer.anchor },
+            fallback: { used: false, reason: result.items.length > 0 ? null : 'zero-hit' },
+          });
+          const written = writeEvidencePackage({ memoryRoot: cfg.memoryRoot, pkg, auditKey: cfg.evidenceAuditKey });
+          evidencePackage = { queryId: pkg.queryId, status: pkg.status, anchors: pkg.anchors.length, fastAnswer: pkg.fastAnswer !== null, packageSha256: written.packageSha256 };
+        } catch (error) {
+          // Write failure must never block injection.
+          evidencePackage = { error: error?.code ?? 'E_EVIDENCE_WRITE' };
+          notePrestepDegrade(key, turn, { kind: 'evidence-write', phase: 'recall', detail: String(error?.code ?? error?.message ?? error) });
+          warn('EVIDENCE_WRITE_FAILED', error);
+        }
+      }
+      if (Number(result?.hits?.droppedByBudget ?? 0) > 0) {
+        notePrestepDegrade(key, turn, { kind: 'budget-trim', phase: 'budget', detail: `dropped=${result.hits.droppedByBudget}` });
+      }
+      setPrestepMeta(key, turn, {
+        budget: cfg.budget,
+        eligible: Number(result?.hits?.eligible ?? 0),
+        tokens: Number(result?.tokens ?? 0),
       });
 
+      // A5 unified audit: every real recall decision lands one .longlive/audit/records.jsonl row.
+      try {
+        appendAuditRecord({
+          memoryRoot: cfg.memoryRoot,
+          action: 'recall',
+          recordId: result.items.length > 0 ? result.items.map((item) => item.path).join(',') : null,
+          readerTier: 'host',
+          questionId: 'unknown',
+          expectedTurns: null,
+          answerText: null,
+          extra: {
+            turn,
+            queryChars: queryText.length,
+            expanded: expandedQuery !== queryText,
+            expansion: { entityTerms: aliasResolution.terms ?? [], anaphoraTerms: anaphora.terms ?? [], timeRefs: queryTimeRefs.length },
+            sharedVisibility: sharedVisibilityResult,
+            evidencePackage,
+            eligible: result.hits.eligible,
+            injected: result.items.map((item) => item.path),
+            tokens: result.tokens,
+          },
+        });
+      } catch { /* recall auditing must never block injection */ }
       if (result.items.length === 0) {
+        notePrestepDegrade(key, turn, { kind: 'zero-hit', phase: 'recall', detail: `eligible=${result.hits.eligible}` });
         st.lastQuery = queryText;
         st.compacted = false;
         logRecall(key, turn, result);
@@ -328,12 +536,16 @@ export function apply(ctx, config = {}) {
             privacy: result.hits.droppedByPrivacy,
           },
         });
-        return decision; // 无命中：什么都不注入
+        return attachShared(decision); // 无命中：什么都不注入（共享可见块仍可注入）
       }
 
+      // B3: inject phase = render + message factory + merge into decision.messages.
+      const injectPhase = startPrestepPhase(key, turn, 'inject');
       const text = renderInjection(result, { privacyScan });
       const factory = await getCreateUserMessage();
       if (!factory) {
+        injectPhase.end();
+        notePrestepDegrade(key, turn, { kind: 'factory-unavailable', phase: 'inject' });
         logRecall(key, turn, { items: [], rejections: result.rejections });
         return decision;
       }
@@ -348,6 +560,7 @@ export function apply(ctx, config = {}) {
       for (const item of result.items) st.seen.add(item.path);
       st.lastQuery = queryText;
       st.compacted = false;
+      injectPhase.end();
 
       logRecall(key, turn, result);
       observe({
@@ -363,15 +576,18 @@ export function apply(ctx, config = {}) {
         },
       });
 
-      return { ...decision, messages: mergeInjectionOrder(messages, message) };
+      return { ...decision, messages: mergeInjectionOrder(sharedMessage === null ? messages : mergeInjectionOrder(messages, sharedMessage), message) };
     } catch (error) {
       if (!st.warned) {
         st.warned = true;
         warn('RECALL_FAILED', error?.code ?? error?.message ?? error);
       }
+      notePrestepDegrade(key, turn, { kind: 'error', phase: 'recall', detail: String(error?.code ?? error?.message ?? error) });
       observe({ key, turn, why: 'error', error: String(error?.code ?? error?.message ?? error), tokens: 0 });
       logRecall(key, turn, { items: [], rejections: [] });
-      return decision; // 插件失败不许拖垮本轮
+      return attachShared(decision); // 插件失败不许拖垮本轮
+    } finally {
+      try { recallPhase.end(); } catch { /* timing only */ }
     }
   }, { prepend: false });
 
@@ -381,7 +597,7 @@ export function apply(ctx, config = {}) {
       const st = stateFor(session?.id ?? 'unknown');
       if (event?.type === 'user/message' && isRealUserMessage(event?.data)) {
         const text = firstTextOf(event?.data);
-        // 红队第三轮 mustFix #1：注入的【开机卡】/【自动想起】也是 user/message，
+        // 评审第三轮 mustFix #1：注入的【开机卡】/【自动想起】也是 user/message，
         // 旧代码只看 type 就把它们当成 firstUserText，导致之后每轮 query 都混进开机卡。
         //
         // v4 / ADV1：外部插件仍可能用 kind:'user' 把一段上下文插到真实提问**之前**。

package/src/recall/inject-order.mjs

@@ -12,12 +12,12 @@
  *
  *   开机卡插在**第一条真实 user 消息之后**，不再 unshift 到最前：宿主 TurnNavigator
  *   取该轮第一个可见 `kind:'user'` 节点做 tooltip 的 prompt（client.js:8373-8384），
- *   boot 在最前会让第 1 轮显示【开机卡】而不是用户提问（红队第三轮 mustFix #2）。
+ *   boot 在最前会让第 1 轮显示【开机卡】而不是用户提问（评审第三轮 mustFix #2）。
  *
  *   auto 只负责把自己 append 到最后；不再把消息插到 boot 后面（那会得到
- *   `[boot, auto, user, runtime]`，红队 S2 的顺序问题）。
+ *   `[boot, auto, user, runtime]`，评审 S2 的顺序问题）。
  *
- * v4 / 红队第四轮 M1（2026-11-04）：注入消息的 source.kind 从 'user' 改为
+ * v4 / 评审第四轮 M1（2026-11-04）：注入消息的 source.kind 从 'user' 改为
  * 'session-reference'，形状固定为
  *
  *     { kind:'session-reference', form:'recall', version:1, references:[] }
@@ -35,9 +35,9 @@
  *
  * 识别契约：
  *   - 本插件 / identity-router 的注入靠 kind 直接识别（不再依赖正文标记）；
- *   - 正文标记（【自动想起】/【开机卡】）继续保留，用于识别历史消息与外部 engram
+ *   - 正文标记（【自动想起】/【开机卡】）继续保留，用于识别历史消息与外部记忆注入
  *     风格的注入，also keeps firstUserText from eating a legacy card；
- *   - **外部插件**仍可能用 kind:'user' 把文本插到真实提问前（红队 ADV1）。识别不了
+ *   - **外部插件**仍可能用 kind:'user' 把文本插到真实提问前（评审 ADV1）。识别不了
  *     任意纯文本，所以 firstUserText 的取值在 index.js 里按「第 1 轮最后一条真人
  *     消息」锁定，isRealUserMessage 只负责排掉已知注入形态。
  */
@@ -47,6 +47,8 @@
  * 注入只允许白名单内的 kind；坏 kind 会在 append 时被本插件拒绝，避免日志被
  * 毒化（append 接受任意非空字符串，但 adoptSessionEvent 会抛 invalid source）。
  */
+import { isExternalMemoryKind } from '../adapters/constants.js';
+
 export const HOST_SOURCE_KINDS = Object.freeze([
   'user', 'model', 'tool', 'system-prompt', 'model-selection', 'runtime-context',
   'working-directory', 'user-approval', 'ptc-mode', 'tool-registry', 'user-rpc',
@@ -153,7 +155,7 @@ export function isAutoMessage(message) {
  * 且不是本插件 / identity-router / 已知外部注入形态。
  *
  * v4 起注入用 kind:'session-reference'，kind 本身就能挡掉；这里再按正文特征
- * 排一层（红队 ADV1）：带 `source.form` / `source.sections` 的、首行是已知标记的，
+ * 排一层（评审 ADV1）：带 `source.form` / `source.sections` 的、首行是已知标记的，
  * 都不算真人消息。无法凭正文区分「任意外部插件写的纯文本 kind:user」——那类消息
  * 由 firstUserText 的「第 1 轮最后一条」规则处理（见 index.js）。
  * @param {object} message
@@ -181,7 +183,7 @@ export function textsOf(message) {
 }
 
 /**
- * 本轮已经注入的文本：identity 开机卡 + 旧 plugin:* / engram 消息。
+ * 本轮已经注入的文本：identity 开机卡 + 旧 plugin:* / 外部记忆注入消息。
  * 给 chooseRecall 做文本级去重；kind 合法化成 session-reference 后不能只靠 kind 判断。
  */
 export function injectedTexts(messages) {
@@ -192,7 +194,7 @@ export function injectedTexts(messages) {
       continue;
     }
     const kind = sourceKindOf(message);
-    if (!kind.startsWith('plugin:') && !kind.includes('engram')) continue;
+    if (!kind.startsWith('plugin:') && !isExternalMemoryKind(kind)) continue;
     out.push(...textsOf(message));
   }
   return out;

package/src/recall/privacy.mjs

@@ -8,11 +8,20 @@
  * 为什么用 createRequire 而不是静态 import：
  *   - auto-recall 的核心要保持「零 import、可单测」；
  *   - 隐私门是 ESM，但 Node ≥22 支持同步 require(ESM)（本机 v24.21.0 已验证）；
- *   - 这样门缺失时模块仍能加载，退到核心自带的保守 PII 兜底，绝不因「门没装」而放行。
+ *   - 这样门缺失时模块仍能加载，退到核心自带的保守兜底，绝不因「门没装」而放行。
  *
  * 命中口径 = 隐私门的 verdict==='local_only' **或** 核心兜底正则命中（取并集，宁可多拦）。
- * 调用方：bin/eval.mjs、bin/eval-fresh.mjs、bin/recall-once.mjs、plugin/src/index.js
- *        以及 test/auto-recall.test.mjs（证明真门被调用）。
+ * 兜底分两类：
+ *   - PII：手机号 / 邮箱 / 身份证（1.6.7 起就有）；
+ *   - 密钥/令牌（1.6.8 评审 S3 补）：sk-*、Bearer …、*_API_KEY=*、token=/secret=/password=、
+ *     私钥头、AWS/GitHub/Slack 凭证前缀。活动板是跨会话共享的，
+ *     手机号只泄漏一个人的联系方式，密钥泄漏的是账号本身。
+ *
+ * 发布形态下（没有 privacy-gate 仓库）只靠兜底；DSH_PRIVACY_GATE 显式配置但不可达时
+ * 在加载期 `process.emitWarning` 一次，并强制走强化后的本地规则 —— 不允许静默放行。
+ *
+ * 调用方：bin/eval.mjs、bin/eval-fresh.mjs、bin/recall-once.mjs、plugin/src/index.js、
+ *         src/activity/{store,index}.js 以及 test/auto-recall.test.mjs（证明真门被调用）。
  */
 
 import { createRequire } from 'node:module';
@@ -22,15 +31,20 @@ import { fileURLToPath } from 'node:url';
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const require = createRequire(import.meta.url);
 
+const ENV_GATE = typeof process.env.DSH_PRIVACY_GATE === 'string' && process.env.DSH_PRIVACY_GATE.trim() !== ''
+  ? process.env.DSH_PRIVACY_GATE.trim()
+  : null;
+
 /** 环境变量优先；其次是作者树旁边的 privacy-gate；最后是绝对路径兜底。 */
 export const GATE_CANDIDATES = [
-  process.env.DSH_PRIVACY_GATE,
+  ENV_GATE,
   path.resolve(HERE, '../../../privacy-gate/src/memory/privacy-gate.js'),
 ].filter((p) => typeof p === 'string' && p.trim() !== '');
 
 let realScan = null;
 let loadedFrom = null;
 let loadError = null;
+const loadErrors = [];
 for (const candidate of GATE_CANDIDATES) {
   try {
     const mod = require(candidate);
@@ -39,44 +53,116 @@ for (const candidate of GATE_CANDIDATES) {
       loadedFrom = candidate;
       break;
     }
-    loadError = `scanPrivacy not exported by ${candidate}`;
+    loadErrors.push(`scanPrivacy not exported by ${candidate}`);
   } catch (error) {
-    loadError = `${candidate}: ${error?.code ?? error?.message ?? error}`;
+    loadErrors.push(`${candidate}: ${error?.code ?? error?.message ?? error}`);
+  }
+}
+loadError = loadErrors.length > 0 ? loadErrors[loadErrors.length - 1] : null;
+// Diagnostics should name the explicitly configured gate when that is the one
+// that failed — not the author-tree fallback that was tried after it.
+if (ENV_GATE !== null) {
+  const envFailure = loadErrors.find((entry) => entry.startsWith(ENV_GATE));
+  if (envFailure) loadError = envFailure;
+}
+
+/** 显式配置了门却装不上：不静默放行，加载期告警一次，扫描强制走强化本地规则。 */
+const gateConfigured = ENV_GATE !== null;
+const forcedFallback = gateConfigured && realScan === null;
+if (forcedFallback) {
+  try {
+    process.emitWarning(
+      `[longlive:privacy] DSH_PRIVACY_GATE 已配置但不可达（${loadError ?? 'unknown'}）`
+      + '；已强制使用强化本地兜底规则（含密钥/令牌模式），不会静默放行。',
+    );
+  } catch {
+    /* warning is best effort; the scan below is what enforces the rule */
   }
 }
 
-/* 核心兜底：只认三类最硬的 PII，避免把普通数字（token 数、ID 号）误判。 */
+/* 核心兜底 · 一类最硬的 PII：避免把普通数字（token 数、ID 号）误判。 */
 const PII_PATTERNS = [
   { kind: 'phone', re: /(?<!\d)1[3-9]\d{9}(?!\d)/g },
   { kind: 'email', re: /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g },
   { kind: 'id-card', re: /(?<!\d)\d{17}[\dXx](?!\d)/g },
 ];
 
-/** 核心自带的保守扫描（不依赖任何外部文件）。 */
-export function fallbackScan(text) {
-  const s = String(text ?? '');
-  const spans = [];
-  for (const { kind, re } of PII_PATTERNS) {
+/*
+ * 核心兜底 · 密钥/令牌类。全部要求「像凭证」才拦，尽量不误伤普通文本：
+ *   - sk- 前缀要求前面不是标识符字符（`task-id-1234567890` 里的 `sk-id-…` 不算）；
+ *   - `token=`/`api_key=` 这类赋值要求至少 6–8 位值，`token 数 12`、`--test` 不会命中；
+ *   - 赋值形态允许 `[a-z0-9_]{0,32}` 前缀（RE-S3.1：`my_api_key: …`、`apiKey=…`、
+ *     `secret token: …`），分隔符允许 `= : ： ,` 与两侧空格；**纯空格不算分隔符**，
+ *     所以 `password reset flow` / `password 字段在 config.js 里` 不误伤；
+ *   - PRIVATE KEY 头、AWS/GitHub/Slack 前缀是强特征，直接拦。
+ */
+const ASSIGN_VALUE = String.raw`['"]?[A-Za-z0-9._\-/+!@#$%^&*]{6,}`;
+const SECRET_PATTERNS = [
+  // RE-S3.7: sk-/SK- 前缀大小写不敏感（连续形式；空格/Unicode 变体是 P3 残余建议）。
+  { kind: 'api-key', re: /(?<![A-Za-z0-9_-])sk-[A-Za-z0-9][A-Za-z0-9_-]{8,}/gi },
+  { kind: 'api-key', re: /(?<![A-Za-z0-9_])[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)*(?:_API_KEY|_APIKEY|_KEY|_TOKEN|_SECRET|_PASSWORD|_PASSWD)\s*[=:]\s*\S+/g },
+  // RE-S3.1: 小写/带前缀的赋值形态（大小写不敏感）：my_api_key: "…"、apiKey=…。
+  {
+    kind: 'api-key',
+    re: new RegExp(
+      String.raw`(?<![A-Za-z0-9])[A-Za-z0-9_]{0,32}`
+      + String.raw`(?:api[_-]?key|access[_-]?key|secret[_-]?key|private[_-]?key|app[_-]?key|token|secret|password|passwd|pwd|credential)`
+      + String.raw`\s*[:=：,]\s*` + ASSIGN_VALUE,
+      'gi',
+    ),
+  },
+  // RE-S3.1: 多词标签（允许空格/下划线）：secret token: …、api key = …。
+  {
+    kind: 'token',
+    re: new RegExp(
+      String.raw`(?<![A-Za-z0-9])(?:api|access|secret|private|auth|refresh|session)[\s_-]+(?:key|token|secret|password)`
+      + String.raw`\s*[:=：,]\s*` + ASSIGN_VALUE,
+      'gi',
+    ),
+  },
+  { kind: 'api-key', re: /(?<![A-Za-z0-9_])(?:api[_-]?key|access[_-]?key|secret[_-]?key|private[_-]?key|app[_-]?key)\s*[=:]\s*['"]?[A-Za-z0-9._\-/+]{8,}/gi },
+  { kind: 'token', re: /(?<![A-Za-z0-9_])(?:token|auth|access[_-]?token|refresh[_-]?token|session[_-]?token)\s*[=:]\s*['"]?[A-Za-z0-9._\-/+]{8,}/gi },
+  { kind: 'password', re: /(?<![A-Za-z0-9_])(?:password|passwd|pwd)\s*[=:]\s*['"]?[A-Za-z0-9._\-/+!@#$%^&*]{6,}/gi },
+  { kind: 'bearer', re: /\bBearer\s+[A-Za-z0-9._~+/-]{12,}=*/gi },
+  { kind: 'private-key', re: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY-----/g },
+  { kind: 'aws-key', re: /(?<![A-Z0-9])(?:AKIA|ASIA)[0-9A-Z]{16}(?![0-9A-Z])/g },
+  { kind: 'github-token', re: /\bgh[pousr]_[A-Za-z0-9]{20,}/g },
+  { kind: 'slack-token', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}/g },
+];
+
+function scanWith(patterns, text, spans) {
+  for (const { kind, re } of patterns) {
     re.lastIndex = 0;
-    let m = re.exec(s);
+    let m = re.exec(text);
     while (m !== null) {
       spans.push({ start: m.index, end: m.index + m[0].length, kind });
       if (m.index === re.lastIndex) re.lastIndex += 1;
-      m = re.exec(s);
+      m = re.exec(text);
     }
   }
+}
+
+/** 核心自带的保守扫描（不依赖任何外部文件）：PII + 凭证类，两类都算 local_only。 */
+export function fallbackScan(text) {
+  const s = String(text ?? '');
+  const spans = [];
+  scanWith(PII_PATTERNS, s, spans);
+  scanWith(SECRET_PATTERNS, s, spans);
   spans.sort((a, b) => a.start - b.start);
-  if (spans.length === 0) return { verdict: 'none', spans: [], reasons: [], source: 'core-fallback' };
+  if (spans.length === 0) {
+    return { verdict: 'none', spans: [], reasons: [], source: forcedFallback ? 'core-fallback:forced' : 'core-fallback' };
+  }
   return {
     verdict: 'local_only',
     spans,
     reasons: [...new Set(spans.map((x) => x.kind))],
-    source: 'core-fallback',
+    source: forcedFallback ? 'core-fallback:forced' : 'core-fallback',
   };
 }
 
 /**
  * 注入前的隐私扫描（同步）。
+ * - 核心兜底（含凭证类）先扫，命中直接 local_only；
  * - 隐私门可用 → 调它；门抛错 → fail-closed；
  * - 门说 none 但兜底正则命中 → 仍按命中处理（并集）。
  * @param {string} text
@@ -113,6 +199,9 @@ export const privacyGateStatus = Object.freeze({
   loaded: realScan !== null,
   from: loadedFrom,
   error: realScan === null ? loadError : null,
+  configured: gateConfigured,
+  forcedFallback,
+  scope: 'pii+secret',
 });
 
 /** 给 chooseRecall 用的一次性参数：`options: { ...privacyDefaults }`。 */