@modusensus/dsh-mneme 0.7.11 → 0.7.13

package/lib/api-standalone.js

@@ -0,0 +1,264 @@
+// Standalone HTTP API (v0.7.12): a plain node:http server for ecosystem
+// integrations that live outside the DSH host and cannot reach the plugin's
+// internal webServer routes (/api/dsh-mneme/*). Mirrors the JSON semantics of
+// those routes but with mandatory Bearer-token auth on everything except
+// GET /health, so the store can be exposed safely on loopback.
+//
+// Security: the default bind host is 127.0.0.1. Pointing externalApiHost at a
+// non-loopback address exposes the whole memory store to the network — that is
+// the operator's explicit responsibility (documented in README).
+import { createServer } from "node:http";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { TYPES } from "./store.js";
+
+const DEFAULT_PORT = 8790;
+const DEFAULT_HOST = "127.0.0.1";
+// Hardcoded release version (package.json is bumped at publish time and may
+// lag the code that ships in between).
+const VERSION = "0.7.12";
+
+function sendJson(res, status, payload) {
+  res.writeHead(status, { "Content-Type": "application/json; charset=utf-8" });
+  res.end(JSON.stringify(payload));
+}
+
+/** True when the request carries the configured token. */
+function isAuthorized(req, apiToken) {
+  const raw = req.headers?.authorization ?? req.headers?.["x-dsh-mneme-token"] ?? "";
+  const token = raw.startsWith("Bearer ") ? raw.slice(7).trim() : raw.trim();
+  if (token === "" || token.length !== apiToken.length) return false;
+  // Constant-time comparison: no timing oracle on the token.
+  return timingSafeEqual(Buffer.from(token), Buffer.from(apiToken));
+}
+
+/** Collect the request body as text (tolerant of transport errors). */
+function readBody(req) {
+  return new Promise((resolve) => {
+    let body = "";
+    req.on("data", (chunk) => { body += chunk; });
+    req.on("end", () => resolve(body));
+    req.on("error", () => resolve(""));
+  });
+}
+
+/**
+ * Create (and start) the standalone API server.
+ * Accepts { service, store, config, logger, settings, port, host }:
+ *   - token: persisted settings kv "external_api" wins; auto-generated
+ *     (crypto.randomBytes(24).toString("base64url")) and persisted when empty.
+ *   - port:  explicit arg > persisted settings > config.externalApiPort > 8790.
+ *   - host:  explicit arg > config.externalApiHost > "127.0.0.1".
+ * Returns { server, port, host, token, ready }: `port` is the effective bound
+ * port (updated to the OS-assigned one after `ready` resolves when asked to
+ * bind port 0), `ready` resolves once listening and rejects if the bind fails.
+ */
+export function createStandaloneApi({ service, store, config = {}, logger, settings, port, host }) {
+  const persisted = settings?.getExternalApi?.() ?? {};
+
+  let token = typeof persisted.token === "string" ? persisted.token : "";
+  if (!token) {
+    token = randomBytes(24).toString("base64url");
+    // Persist only the token; enabled/port keys stay as they are (merge).
+    try {
+      settings?.setExternalApi?.({ token });
+    } catch (error) {
+      logger?.warn?.(`[dsh-mneme] standalone API token persistence failed: ${String(error)}`);
+    }
+  }
+
+  // Persisted host (set from the panel) wins over the bundle config, same
+  // precedence as port; the explicit argument still wins over both.
+  const boundHost = host
+    ?? (typeof persisted.host === "string" && persisted.host ? persisted.host : undefined)
+    ?? config.externalApiHost
+    ?? DEFAULT_HOST;
+  const persistedPort = Number(persisted.port);
+  const boundPort = port
+    ?? (Number.isInteger(persistedPort) && persistedPort > 0 ? persistedPort : undefined)
+    ?? config.externalApiPort
+    ?? DEFAULT_PORT;
+
+  const server = createServer((req, res) => {
+    try {
+      const url = new URL(req.url ?? "/", "http://localhost");
+      const pathname = url.pathname;
+
+      // Health is the single unauthenticated probe (monitor checks).
+      if (req.method === "GET" && pathname === "/health") {
+        sendJson(res, 200, { ok: true });
+        return;
+      }
+
+      // Everything else requires the Bearer token.
+      if (!isAuthorized(req, token)) {
+        sendJson(res, 401, { error: "unauthorized" });
+        return;
+      }
+
+      // --- GET /status: version + store shape + uptime -----------------------
+      if (req.method === "GET" && pathname === "/status") {
+        const byType = {};
+        for (const type of TYPES) byType[type] = service.count(type);
+        let entities = 0;
+        try {
+          entities = store.db.prepare("SELECT count(*) AS c FROM entities").get().c;
+        } catch { /* entities storage unavailable → 0 */ }
+        sendJson(res, 200, {
+          version: VERSION,
+          memories: { total: service.count(), byType },
+          entities,
+          uptime_s: Math.floor(process.uptime())
+        });
+        return;
+      }
+
+      // --- GET /memories: paged + filtered list (same semantics as the
+      //     internal /api/dsh-mneme/list) ------------------------------------
+      if (req.method === "GET" && pathname === "/memories") {
+        const type = url.searchParams.get("type") ?? undefined;
+        const limit = Number(url.searchParams.get("limit") ?? 50);
+        const offset = Number(url.searchParams.get("offset") ?? 0);
+        const order = url.searchParams.get("order") ?? undefined;
+        const minRaw = url.searchParams.get("minImportance");
+        const minImportance = minRaw !== null && minRaw !== "" && !Number.isNaN(Number(minRaw))
+          ? Number(minRaw)
+          : undefined;
+        const source = url.searchParams.get("source") || undefined;
+        const items = service.toApiList(service.list({ type, limit, offset, order, minImportance, source }));
+        // Total honors the same filters so pager math stays correct.
+        sendJson(res, 200, { items, total: service.count(type, { minImportance, source }) });
+        return;
+      }
+
+      // --- GET/DELETE /memories/:id ------------------------------------------
+      const idMatch = pathname.match(/^\/memories\/([^/]+)$/);
+      if (idMatch) {
+        let id = idMatch[1];
+        try { id = decodeURIComponent(id); } catch { /* keep raw */ }
+        if (req.method === "GET") {
+          const row = service.getById(id);
+          if (!row) {
+            sendJson(res, 404, { error: "not-found" });
+            return;
+          }
+          sendJson(res, 200, service.toApiList([row])[0]);
+          return;
+        }
+        if (req.method === "DELETE") {
+          // store.remove deletes silently — precheck for a distinguishable 404.
+          if (!service.getById(id)) {
+            sendJson(res, 404, { error: "not-found" });
+            return;
+          }
+          service.remove(id);
+          sendJson(res, 200, { ok: true });
+          return;
+        }
+        sendJson(res, 404, { error: "not-found" });
+        return;
+      }
+
+      // --- POST /memories: save with title-dedupe (safer than raw save) ------
+      if (req.method === "POST" && pathname === "/memories") {
+        void readBody(req).then((text) => {
+          let body;
+          try {
+            body = JSON.parse(text || "{}");
+          } catch {
+            sendJson(res, 400, { error: "invalid-json" });
+            return;
+          }
+          if (body === null || typeof body !== "object" || Array.isArray(body)) {
+            sendJson(res, 400, { error: "invalid-body" });
+            return;
+          }
+          // Pre-validate what store.save would throw on, so clients get a
+          // clean 400 instead of a leaked SQLite error.
+          if (!TYPES.has(body.type)) {
+            sendJson(res, 400, { error: "invalid-type" });
+            return;
+          }
+          if (typeof body.title !== "string" || !body.title.trim()) {
+            sendJson(res, 400, { error: "missing-title" });
+            return;
+          }
+          if (typeof body.content !== "string") {
+            sendJson(res, 400, { error: "missing-content" });
+            return;
+          }
+          if (body.tags !== undefined && !Array.isArray(body.tags)) {
+            sendJson(res, 400, { error: "tags-must-be-an-array" });
+            return;
+          }
+          try {
+            const { action, memory } = service.saveWithDedupe({
+              type: body.type,
+              title: body.title,
+              content: body.content,
+              importance: body.importance,
+              tags: body.tags,
+              source: body.source
+            });
+            sendJson(res, action === "created" ? 201 : 200, service.toApiList([memory])[0]);
+          } catch (error) {
+            logger?.warn?.(`[dsh-mneme] standalone API save failed: ${String(error)}`);
+            sendJson(res, 500, { error: "internal" });
+          }
+        });
+        return;
+      }
+
+      // --- GET /search: unified recall pipeline (keyword + vector + BM25) ----
+      if (req.method === "GET" && pathname === "/search") {
+        const q = url.searchParams.get("q") ?? "";
+        const limit = Number(url.searchParams.get("topK") ?? url.searchParams.get("limit") ?? 20);
+        const mode = url.searchParams.get("mode") ?? "auto";
+        const rerank = url.searchParams.get("rerank") !== "false";
+        const query = q.trim();
+        if (!query) {
+          sendJson(res, 200, { items: [], mode: "keyword" });
+          return;
+        }
+        // Any vector/rerank failure degrades to keyword inside searchMemories.
+        void Promise.resolve(
+          service.searchMemories(query, { mode, topK: limit, useRerank: rerank })
+        ).then((rows) => {
+          const used = rows.some((m) => m.vector === true) ? "vector" : "keyword";
+          sendJson(res, 200, { items: service.toApiList(rows), mode: used });
+        }).catch(() => {
+          sendJson(res, 200, { items: service.toApiList(service.search(query, { limit })), mode: "keyword" });
+        });
+        return;
+      }
+
+      sendJson(res, 404, { error: "not-found" });
+    } catch {
+      sendJson(res, 500, { error: "internal" });
+    }
+  });
+
+  // A permanent error listener keeps an EADDRINUSE / runtime socket error from
+  // crashing the host process; `ready` still surfaces the first bind failure.
+  server.on("error", (error) => {
+    logger?.warn?.(`[dsh-mneme] standalone API error: ${String(error)}`);
+  });
+  const ready = new Promise((resolve, reject) => {
+    server.once("listening", resolve);
+    server.once("error", reject);
+  });
+  server.listen(boundPort, boundHost);
+  ready.then(() => {
+    const address = server.address();
+    if (address && typeof address === "object") {
+      logger?.info?.(`[dsh-mneme] standalone API listening on http://${address.address}:${address.port}`);
+    }
+  }).catch(() => { /* already logged by the error handler above */ });
+
+  const api = { server, port: boundPort, host: boundHost, token, ready };
+  // After the OS assigns the real port (bind port 0), reflect it for callers.
+  ready.then(() => {
+    const address = server.address();
+    if (address && typeof address === "object") api.port = address.port;
+  }).catch(() => { /* bind failed: port stays as configured */ });
+  return api;
+}

package/lib/api.js

@@ -1,11 +1,25 @@
 import { URL } from "node:url";
-import { timingSafeEqual } from "node:crypto";
+import { timingSafeEqual, randomBytes } from "node:crypto";
 
 function sendJson(res, status, payload) {
   res.writeHead(status, { "Content-Type": "application/json; charset=utf-8" });
   res.end(JSON.stringify(payload));
 }
 
+// Defaults for the standalone external API — keep in step with the schema
+// defaults in config.js (externalApiPort / externalApiHost).
+const EXTERNAL_API_DEFAULTS = { enabled: false, port: 8790, host: "127.0.0.1" };
+
+/** Merge persisted external-api kv over the defaults for client display. */
+function fullExternalConfig(kv = {}) {
+  return {
+    enabled: kv.enabled === true,
+    port: Number.isInteger(kv.port) && kv.port > 0 ? kv.port : EXTERNAL_API_DEFAULTS.port,
+    host: kv.host || EXTERNAL_API_DEFAULTS.host,
+    token: kv.token || ""
+  };
+}
+
 /**
  * Mask an API key for client display: keep a recognizable prefix and suffix,
  * hide the middle. Empty keys stay empty; short keys are fully hidden.
@@ -535,6 +549,81 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
     }
   });
 
+  // --- panel mode (v0.7.12): light / standard -------------------------------
+  // Persists the Web panel's feature preset into the settings kv
+  // ("panel_mode"). PUT requires auth like every other settings write; the
+  // value is validated against the enum. index.js applies the light preset on
+  // the next boot (persisted mode wins over the bundle config).
+  register({
+    kind: "exact",
+    path: "/api/dsh-mneme/mode",
+    handler(req, res) {
+      try {
+        if (req.method === "PUT" || req.method === "POST") {
+          if (!requireAuth(req, res, apiToken)) return;
+          return readBody(req).then((text) => {
+            const body = parseBody(text);
+            if (body.mode !== "light" && body.mode !== "standard") {
+              sendJson(res, 400, { error: "invalid-mode" });
+              return;
+            }
+            settings.setPanelMode(body.mode);
+            sendJson(res, 200, { mode: settings.getPanelMode() });
+          });
+        }
+        sendJson(res, 200, { mode: settings.getPanelMode() });
+      } catch {
+        sendJson(res, 500, { error: "internal" });
+      }
+    }
+  });
+
+  // --- external API settings (the standalone server's panel-facing config) ---
+  register({
+    kind: "exact",
+    path: "/api/dsh-mneme/external-api",
+    handler(req, res) {
+      try {
+        if (req.method === "PUT" || req.method === "POST") {
+          if (!requireAuth(req, res, apiToken)) return;
+          return readBody(req).then((text) => {
+            const body = parseBody(text);
+            const patch = {};
+            if (body.enabled !== undefined) patch.enabled = body.enabled === true;
+            if (body.port !== undefined) {
+              const port = Number(body.port);
+              if (!Number.isInteger(port) || port < 1 || port > 65535) {
+                sendJson(res, 400, { error: "invalid-port" });
+                return;
+              }
+              patch.port = port;
+            }
+            if (body.host !== undefined) {
+              const host = String(body.host).trim();
+              if (!host || host.includes("://")) {
+                sendJson(res, 400, { error: "invalid-host" });
+                return;
+              }
+              patch.host = host;
+            }
+            sendJson(res, 200, { config: fullExternalConfig(settings.setExternalApi(patch)) });
+          });
+        }
+        // GET: always hand back a token — the standalone server generates its
+        // own on first enabled boot, but the panel displays it before that,
+        // so materialize and persist one here.
+        const kv = settings.getExternalApi() ?? {};
+        if (!kv.token) {
+          kv.token = randomBytes(24).toString("base64url");
+          settings.setExternalApi({ token: kv.token });
+        }
+        sendJson(res, 200, { config: fullExternalConfig(kv) });
+      } catch {
+        sendJson(res, 500, { error: "internal" });
+      }
+    }
+  });
+
   // --- custom commands ---
   register({
     kind: "exact",
@@ -573,7 +662,7 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   });
 
   return {
-    routes: 15,
+    routes: 17,
     dispose: () => {
       for (const dispose of disposers) dispose();
     }

package/lib/client.js

@@ -195,6 +195,23 @@ window.__ModuleLoader__.load({
         "memory.settings.apiTokenPlaceholder": "留空 = 不鉴权（默认）",
         "memory.settings.apiTokenSave": "保存 Token",
         "memory.settings.apiTokenSaved": "Token 已保存",
+        "memory.settings.mode.title": "运行模式",
+        "memory.settings.mode.desc": "轻量模式只保留核心的记忆读写与自动注入（关闭 autoDream 巩固、实体抽取、语义搜索等高级功能），适合只想「记住偏好」的轻量使用；标准模式开启全部功能。",
+        "memory.settings.mode.light": "轻量",
+        "memory.settings.mode.standard": "标准",
+        "memory.settings.mode.savedHint": "已保存，重启 DSH 后生效",
+        "memory.settings.mode.offList": "已关闭：巩固（autoDream）· 实体抽取 · 语义搜索",
+        "memory.settings.extapi.title": "外部访问 API",
+        "memory.settings.extapi.desc": "独立 HTTP 服务，供其他插件 / CLI / 桌面工具读写记忆，默认绑定 127.0.0.1。重启 DSH 后生效。",
+        "memory.settings.extapi.enabled": "启用",
+        "memory.settings.extapi.disabled": "停用",
+        "memory.settings.extapi.address": "地址",
+        "memory.settings.extapi.port": "端口",
+        "memory.settings.extapi.token": "Token",
+        "memory.settings.extapi.copy": "复制",
+        "memory.settings.extapi.copied": "已复制",
+        "memory.settings.extapi.savedHint": "已保存，重启 DSH 后生效",
+        "memory.settings.extapi.invalidPort": "端口需为 1-65535 的数字",
         "memory.explorer.delete": "删除",
         "memory.explorer.confirmDelete": "确认删除?",
         "memory.explorer.cancel": "取消",
@@ -312,6 +329,23 @@ window.__ModuleLoader__.load({
         "memory.settings.apiTokenPlaceholder": "Empty = no auth (default)",
         "memory.settings.apiTokenSave": "Save Token",
         "memory.settings.apiTokenSaved": "Token saved",
+        "memory.settings.mode.title": "Runtime mode",
+        "memory.settings.mode.desc": "Light mode keeps only the core memory read/write and auto-injection (autoDream consolidation, entity extraction and semantic search are off) — for light use where you just want preferences remembered. Standard mode enables everything.",
+        "memory.settings.mode.light": "Light",
+        "memory.settings.mode.standard": "Standard",
+        "memory.settings.mode.savedHint": "Saved. Takes effect after restarting DSH",
+        "memory.settings.mode.offList": "Off: consolidation (autoDream) · entity extraction · semantic search",
+        "memory.settings.extapi.title": "External API",
+        "memory.settings.extapi.desc": "A standalone HTTP service for other plugins / CLIs / desktop tools to read and write memories, bound to 127.0.0.1 by default. Takes effect after restarting DSH.",
+        "memory.settings.extapi.enabled": "Enable",
+        "memory.settings.extapi.disabled": "Disable",
+        "memory.settings.extapi.address": "Address",
+        "memory.settings.extapi.port": "Port",
+        "memory.settings.extapi.token": "Token",
+        "memory.settings.extapi.copy": "Copy",
+        "memory.settings.extapi.copied": "Copied",
+        "memory.settings.extapi.savedHint": "Saved. Takes effect after restarting DSH",
+        "memory.settings.extapi.invalidPort": "Port must be a number between 1 and 65535",
         "memory.explorer.delete": "Delete",
         "memory.explorer.confirmDelete": "Confirm delete?",
         "memory.explorer.cancel": "Cancel",
@@ -547,7 +581,13 @@ window.__ModuleLoader__.load({
       ".mneme-btndanger{color:var(--dsw-alias-state-error,#c33);border-color:var(--dsw-alias-state-error,#c33)}",
       ".mneme-btndanger:hover{background:color-mix(in srgb,var(--dsw-alias-state-error,#c33) 12%,transparent)}",
       ".mneme-btndangerconfirm{background:var(--dsw-alias-state-error,#c33);border-color:var(--dsw-alias-state-error,#c33);color:#fff}",
-      ".mneme-btndangerconfirm:hover{filter:brightness(.9)}"
+      ".mneme-btndangerconfirm:hover{filter:brightness(.9)}",
+      // --- settings cards: boxed cards for the runtime-mode and external-API
+      // sections — each card owns its fetch/PUT state, so it renders as a
+      // self-contained unit inside the stacked settings view ---
+      ".mneme-set-card{border:1px solid var(--dsw-alias-border-l2);border-radius:10px;padding:14px;margin-bottom:12px}",
+      ".mneme-set-token{font-family:monospace;font-size:12px;padding:7px 10px;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;background:var(--dsw-alias-bg-base,transparent);color:var(--dsw-alias-label-primary);word-break:break-all;user-select:all}",
+      ".mneme-set-hint{font-size:12px;color:var(--dsw-alias-label-tertiary)}"
     ].join("\n");
     if (typeof document !== "undefined" && document.querySelector(`style[data-plugin-css="${CSS_TAG}"]`) === null) {
       const tag = document.createElement("style");
@@ -1086,6 +1126,21 @@ window.__ModuleLoader__.load({
         (typeof window !== "undefined" && window.localStorage) ? window.localStorage.getItem("dsh-mneme-api-token") || "" : ""
       );
       const [apiTokenSaved, setApiTokenSaved] = react.useState(false);
+      // 运行模式 — light vs standard; null = still loading. The card keeps
+      // its own busy/saved/error state so it never blocks the others.
+      const [mode, setMode] = react.useState(null);
+      const [modeBusy, setModeBusy] = react.useState(false);
+      const [modeSaved, setModeSaved] = react.useState(false);
+      const [modeError, setModeError] = react.useState("");
+      // 外部访问 API — config fetched from the backend (the token is generated
+      // and kept server-side); host/port inputs are drafts, PUT only on save.
+      const [extapi, setExtapi] = react.useState(null);
+      const [extapiHost, setExtapiHost] = react.useState("127.0.0.1");
+      const [extapiPort, setExtapiPort] = react.useState("");
+      const [extapiBusy, setExtapiBusy] = react.useState(false);
+      const [extapiSaved, setExtapiSaved] = react.useState(false);
+      const [extapiCopied, setExtapiCopied] = react.useState(false);
+      const [extapiError, setExtapiError] = react.useState("");
 
       const load = react.useCallback(async () => {
         try {
@@ -1104,6 +1159,34 @@ window.__ModuleLoader__.load({
 
       react.useEffect(() => { load(); }, [load]);
 
+      // Runtime mode + external API — two independent fetches: one failing
+      // endpoint only errors its own card, never the other one.
+      react.useEffect(() => {
+        let cancelled = false;
+        const toErr = (err) => (err && err.message) || "failed";
+        apiFetch("/api/dsh-mneme/mode")
+          .then((res) => { if (!res.ok) throw new Error("HTTP " + res.status); return res.json(); })
+          .then((j) => { if (!cancelled) setMode(j.mode === "light" ? "light" : "standard"); })
+          .catch((err) => { if (!cancelled) setModeError(toErr(err)); });
+        apiFetch("/api/dsh-mneme/external-api")
+          .then((res) => { if (!res.ok) throw new Error("HTTP " + res.status); return res.json(); })
+          .then((j) => {
+            if (cancelled) return;
+            const cfg = (j && j.config) || {};
+            const next = {
+              enabled: !!cfg.enabled,
+              host: cfg.host || "127.0.0.1",
+              port: Number(cfg.port) || 0,
+              token: cfg.token || ""
+            };
+            setExtapi(next);
+            setExtapiHost(next.host);
+            setExtapiPort(next.port ? String(next.port) : "");
+          })
+          .catch((err) => { if (!cancelled) setExtapiError(toErr(err)); });
+        return () => { cancelled = true; };
+      }, []);
+
       async function saveProfile() {
         try {
           await apiFetch("/api/dsh-mneme/profile", {
@@ -1195,6 +1278,85 @@ window.__ModuleLoader__.load({
         } catch { /* ignore */ }
       }
 
+      // Runtime mode: optimistic chip flip, rolled back on failure. Both
+      // changes only take effect after a DSH restart — the saved hint says so.
+      async function saveMode(next) {
+        if (modeBusy) return;
+        const prev = mode;
+        setModeBusy(true);
+        setModeError("");
+        setMode(next);
+        try {
+          const res = await apiFetch("/api/dsh-mneme/mode", {
+            method: "PUT",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ mode: next })
+          });
+          if (!res.ok) throw new Error("HTTP " + res.status);
+          setModeSaved(true);
+          setTimeout(() => setModeSaved(false), 2500);
+        } catch (err) {
+          setMode(prev);
+          setModeError((err && err.message) || "failed");
+        }
+        setModeBusy(false);
+      }
+
+      // External API: the backend owns the token and returns the full config,
+      // so every PUT response refreshes host/port/token from the server.
+      async function putExtapi(body) {
+        setExtapiBusy(true);
+        setExtapiError("");
+        try {
+          const res = await apiFetch("/api/dsh-mneme/external-api", {
+            method: "PUT",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(body)
+          });
+          const data = await res.json().catch(() => ({}));
+          if (!res.ok) throw new Error(data.error || "HTTP " + res.status);
+          const cfg = data.config || {};
+          const next = {
+            enabled: !!cfg.enabled,
+            host: cfg.host || "127.0.0.1",
+            port: Number(cfg.port) || 0,
+            token: cfg.token || ""
+          };
+          setExtapi(next);
+          setExtapiHost(next.host);
+          setExtapiPort(next.port ? String(next.port) : "");
+          setExtapiSaved(true);
+          setTimeout(() => setExtapiSaved(false), 2500);
+        } catch (err) {
+          setExtapiError((err && err.message) || "failed");
+        }
+        setExtapiBusy(false);
+      }
+
+      function saveExtapiEnabled(enabled) {
+        if (extapiBusy) return;
+        putExtapi({ enabled });
+      }
+
+      function saveExtapiAddress() {
+        if (extapiBusy) return;
+        const raw = String(extapiPort).trim();
+        const port = Number(raw);
+        if (!/^\d+$/.test(raw) || port < 1 || port > 65535) {
+          setExtapiError(t("memory.settings.extapi.invalidPort"));
+          return;
+        }
+        putExtapi({ port, host: extapiHost.trim() || "127.0.0.1" });
+      }
+
+      function copyExtapiToken() {
+        const token = extapi ? extapi.token || "" : "";
+        navigator.clipboard?.writeText(token).then(
+          () => { setExtapiCopied(true); setTimeout(() => setExtapiCopied(false), 1500); },
+          () => {}
+        );
+      }
+
       return h("div", null,
         // 用户画像 — who the agent is talking to
         h("section", { className: "mneme-set-sec" },
@@ -1271,6 +1433,86 @@ window.__ModuleLoader__.load({
             )
           )
         ),
+        // 运行模式 — light vs standard chip radios; each click PUTs and the
+        // change only lands after a DSH restart (green saved hint says so).
+        h("section", { className: "mneme-set-card" },
+          h("div", { className: "mneme-set-title" }, t("memory.settings.mode.title")),
+          h("div", { className: "mneme-set-desc" }, t("memory.settings.mode.desc")),
+          modeError && h("div", { style: { fontSize: 12, color: "var(--dsw-alias-state-error,#c33)", marginBottom: 8 } }, modeError),
+          mode === null && !modeError
+            ? h("div", { className: "mneme-set-hint" }, "…")
+            : h(react.Fragment, null,
+                h("div", { style: { display: "flex", alignItems: "center", gap: 8, flexWrap: "wrap" } },
+                  h("button", {
+                    className: mode === "light" ? "mneme-chip mneme-active" : "mneme-chip",
+                    disabled: modeBusy,
+                    onClick: () => saveMode("light")
+                  }, t("memory.settings.mode.light")),
+                  h("button", {
+                    className: mode === "standard" ? "mneme-chip mneme-active" : "mneme-chip",
+                    disabled: modeBusy,
+                    onClick: () => saveMode("standard")
+                  }, t("memory.settings.mode.standard")),
+                  modeSaved && h("span", { className: "mneme-saved" }, t("memory.settings.mode.savedHint"))
+                ),
+                mode === "light" && h("div", { className: "mneme-set-hint", style: { marginTop: 8 } },
+                  t("memory.settings.mode.offList"))
+              )
+        ),
+        // 外部访问 API — standalone HTTP service for plugins/CLI/desktop tools;
+        // the token is generated and kept by the backend, so it is read-only
+        // here with a copy affordance. Changes need a DSH restart.
+        h("section", { className: "mneme-set-card" },
+          h("div", { className: "mneme-set-title" }, t("memory.settings.extapi.title")),
+          h("div", { className: "mneme-set-desc" }, t("memory.settings.extapi.desc")),
+          extapiError && h("div", { style: { fontSize: 12, color: "var(--dsw-alias-state-error,#c33)", marginBottom: 8 } }, extapiError),
+          extapi === null && !extapiError
+            ? h("div", { className: "mneme-set-hint" }, "…")
+            : h(react.Fragment, null,
+                h("div", { style: { display: "flex", alignItems: "center", gap: 8, flexWrap: "wrap" } },
+                  h("button", {
+                    className: extapi && extapi.enabled ? "mneme-chip mneme-active" : "mneme-chip",
+                    disabled: extapiBusy,
+                    onClick: () => saveExtapiEnabled(true)
+                  }, t("memory.settings.extapi.enabled")),
+                  h("button", {
+                    className: extapi && !extapi.enabled ? "mneme-chip mneme-active" : "mneme-chip",
+                    disabled: extapiBusy,
+                    onClick: () => saveExtapiEnabled(false)
+                  }, t("memory.settings.extapi.disabled")),
+                  extapiSaved && h("span", { className: "mneme-saved" }, t("memory.settings.extapi.savedHint"))
+                ),
+                extapi && extapi.enabled && h(react.Fragment, null,
+                  h("div", { className: "mneme-set-hint", style: { marginTop: 10 } },
+                    `${t("memory.settings.extapi.address")}: http://${extapi.host}:${extapi.port}`),
+                  h("div", { style: { display: "flex", gap: 8, marginTop: 8 } },
+                    h("input", {
+                      className: "mneme-set-input",
+                      style: { marginBottom: 0, flex: 2, minWidth: 0, width: "auto" },
+                      value: extapiHost,
+                      placeholder: "127.0.0.1",
+                      onChange: (e) => setExtapiHost(e.target.value)
+                    }),
+                    h("input", {
+                      className: "mneme-set-input",
+                      style: { marginBottom: 0, flex: 1, minWidth: 0, width: "auto" },
+                      value: extapiPort,
+                      placeholder: t("memory.settings.extapi.port"),
+                      inputMode: "numeric",
+                      onChange: (e) => setExtapiPort(e.target.value)
+                    }),
+                    h("button", { className: "mneme-btn", disabled: extapiBusy, onClick: saveExtapiAddress },
+                      t("memory.settings.vectorSave"))
+                  ),
+                  h("div", { style: { display: "flex", alignItems: "center", gap: 8, marginTop: 10 } },
+                    h("div", { className: "mneme-set-token", style: { flex: 1, minWidth: 0 } }, extapi.token || "—"),
+                    h("button", { className: "mneme-btn", onClick: copyExtapiToken },
+                      t("memory.settings.extapi.copy")),
+                    extapiCopied && h("span", { className: "mneme-saved" }, t("memory.settings.extapi.copied"))
+                  )
+                )
+              )
+        ),
         // 向量搜索 — semantic recall over an embeddings API
         h("section", { className: "mneme-set-sec" },
           h("div", { className: "mneme-set-title" }, t("memory.settings.vectorTitle")),