@modusensus/dsh-mneme 0.7.2 → 0.7.4

package/README.md

@@ -5,7 +5,7 @@
 [![npm version](https://img.shields.io/npm/v/@modusensus/dsh-mneme?color=blue&label=npm)](https://www.npmjs.com/package/@modusensus/dsh-mneme)
 [![license](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 [![Awesome](https://awesome-dsh-plugin.com/badge.svg)](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin)
-[![tests](https://img.shields.io/badge/tests-770%20passed-success)](https://github.com/modusensus/dsh-mneme)
+[![tests](https://img.shields.io/badge/tests-782%20passed-success)](https://github.com/modusensus/dsh-mneme)
 [![CI](https://img.shields.io/github/actions/workflow/status/modusensus/dsh-mneme/test.yml)](https://github.com/modusensus/dsh-mneme/actions)
 [![node](https://img.shields.io/badge/node-24%2B-blue)](https://nodejs.org)
 [![npm downloads](https://img.shields.io/npm/dm/@modusensus/dsh-mneme?color=blue&label=downloads)](https://www.npmjs.com/package/@modusensus/dsh-mneme)
@@ -241,6 +241,8 @@ v0.3.0 起新增**记忆基因**层：从记忆里抽取**命名实体**、**带
 
 | 版本 | 亮点 |
 |------|------|
+| **v0.7.4** | issue #40 修复：记忆内容含 `{{...}}` 模板语法时整轮崩溃（注入边界 run-based 花括号转义 `{{a}}`→`{\{a\}\}`，奇数连续如 `{{{a}}}` 也不残留字面 `{{`；新增 `escapePromptVariables` 配置默认开）；issue #41 修复：记忆窗口关闭按钮与宿主窗口控制按钮重叠无法点击（顶栏左对齐，关闭按钮离开右上角宿主控制区）；782 测试全绿 |
+| **v0.7.3** | issue #38 新功能：左下角入口按钮可选开关 `showSidebarTrigger`（默认开）——与 dsh-cost-meter 等抢占 footer slot 的插件冲突时可在 Web 面板「设置」一键关闭，仅隐藏按钮、记忆库标签不受影响；776 测试全绿 |
 | **v0.7.2** | issue #35 修复：目录页删除按钮改面板内联两步确认（不再依赖宿主 `window.confirm`）+ 删除失败可见报错；issue #34 新功能：opt-in `injectTimePrefix` 对话开始自动注入当前时间一次（默认关）；770 测试全绿 |
 | **v0.7.1** | issue #31 修复：memory_save/memory_update 的 tags 桥接进 entity_attrs 标签存储（目录/`tag:` 检索/tagBoost 立即可见，`tags: []` 清空移回 untagged）+ `store.setMemoryTags` 反向同步 `memories.tags` 列 + autoTag 面板开关成为运行时消费方（settings 覆盖 config）；764 测试全绿 |
 | **v0.7.0** | 自进化记忆（heat 热度模型 + per-type 差异化半衰期 + sleep 热联合双保护）+ updated_at 语义修正（不算访问）+ recall_runs injected 两档标记 + 90 天滚动清理 + 实体热投影（ego-graph node heat → 前端节点大小/明暗）；757 测试全绿 |
@@ -289,6 +291,8 @@ v0.3.0 起新增**记忆基因**层：从记忆里抽取**命名实体**、**带
 | **v0.7.0** | ✅ 完成 | 自进化记忆 | heat 幂律衰减 + per-type 差异化半衰期（TYPE_DECAY）+ sleep 热联合双保护 + updated_at 语义修正 + recall_runs injected 两档标记 + 90 天清理 + 实体热投影（前端节点大小/明暗）；757 测试全绿 |
 | **v0.7.1** | ✅ 完成 | issue #31 修复 | memory_save/update tags 桥接 entity_attrs 标签存储 + 列反向同步 + autoTag 面板开关生效（settings 覆盖 config）；764 测试全绿 |
 | **v0.7.2** | ✅ 完成 | issue #34 + #35 修复 | 目录页删除按钮改内联两步确认 + 删除失败可见报错；opt-in `injectTimePrefix` 对话开始注入当前时间一次（默认关）；770 测试全绿 |
+| **v0.7.3** | ✅ 完成 | issue #38 新功能 | 左下角入口按钮可选开关 `showSidebarTrigger`（默认开，settings-over-config）；Web 面板设置一键关闭，与 dsh-cost-meter 等 footer 插件冲突可隐藏按钮、记忆库标签不受影响；776 测试全绿 |
+| **v0.7.4** | ✅ 完成 | issue #40 + #41 修复 | 注入边界 run-based 花括号转义（`{{a}}`→`{\{a\}\}`、奇数连续如 `{{{a}}}` 不残留字面，`escapePromptVariables` 默认开）+ 记忆窗口顶栏左对齐、关闭按钮避开宿主窗口控制按钮区；782 测试全绿 |
 | **v0.8.0** | 🚧 计划中（9 月末） | 图谱增强 | 兴趣漂移可视化 + 跨 workspace 记忆共享 + 更多 heat 信号 |
 
 > 新能力一律做成**可开关的功能**（配置启用/关闭），默认保守开启、不破坏现有行为。`failure_memories` 表与 autoDream 决策引擎已为后续反思性成长铺好路。
@@ -409,6 +413,7 @@ dsh web
 | `memoryQualityFilter` | `{enabled:true, archiveThreshold:30, degradeThreshold:60, minContentLength:10}` | 记忆质量过滤（v0.4.6，默认开）：写库前启发式打分 0-100，元记忆词汇/自指/过短/重复/近似重复扣分；≥60 正常存储，30-60 降权（注入排序按 importance×quality/100），<30 归档标记 `low_quality`（显式搜索仍可召回，永不自动注入） |
 | `llmAudit` | `{enabled:true, retentionDays:90}` | LLM 消耗审计（v0.4.6，默认开）：每次后台 LLM 调用（autoDream/autoSummarize）写 `llm_audit_logs`（tokens/duration/status/source）；失败记 error 不阻塞；只读 API `/api/dsh-mneme/semantic/llm-audit` + `/llm-audit/stats` |
 | `sessionLifecycleEnabled` | `false` | 会话生命周期（v0.6.0，默认关）：开启后会话被删除/销毁时自动把该会话出生的记忆软隐藏（`session_disposed_at`，与 `archived` 正交、可恢复）；存量无 `session_id` 的记忆永不参与清理 |
+| `showSidebarTrigger` | `true` | 侧边栏底部（左下角）记忆入口按钮（issue #38，默认开）：与其他插件（如 dsh-cost-meter）抢占同一 footer slot 导致 UI 冲突时可关掉；仅隐藏按钮，记忆库仍可通过顶部「记忆库」标签访问。Web 面板「设置」里有对应开关 |
 
 > 🔐 **API 安全**：DSH 无内置鉴权且默认仅监听 `127.0.0.1`。插件 API 默认开放（便于 Web 面板即装即用）。如需防护（如局域网暴露），在配置中设置 `apiToken`：写操作（画像/规则/命令）与密钥端点（`vector-config`、`vector-reindex`）需携带 `Authorization: Bearer <token>`（前端设置面板可填入同一 token），只读的 `list` / `search` / `semantic` 保持开放。`/api/dsh-mneme/vector-config` 返回的 `apiKey` 已掩码（`sk-***…`），存储仍保留明文供调用；前端回传空或掩码值表示"不改 key"。
 
@@ -463,7 +468,7 @@ scripts/              # e2e-dsh.js 端到端演示 · stress-dsh.js 三轴线压
 ```bash
 cd dsh-mneme
 npm install        # 安装 peer 依赖（以 devDependencies 形式，用于本地测试）
-npm test           # 运行 770 个测试
+npm test           # 运行 782 个测试
 npm run stress     # 三轴线压测：长会话检索 / 冲突仲裁 / 多 Agent 并发（离线 mock LLM）
 npm run sync       # 把 src/ 同步到 lib/（发布时由 prepack 钩子自动执行）
 ```

package/lib/api.js

@@ -238,19 +238,22 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
             }
             return true;
           };
-          if (!setIfBoolean("autoTagEnabled") || !setIfBoolean("manualTagEnabled")) return;
+          if (!setIfBoolean("autoTagEnabled") || !setIfBoolean("manualTagEnabled") || !setIfBoolean("showSidebarTrigger")) return;
           if (Object.keys(patch).length === 0) {
             sendJson(res, 400, { error: "no valid config field provided" });
             return;
           }
+          // Each setter ignores the keys it doesn't own, so one patch can feed
+          // both stores safely (tag toggles → "autoTag", UI prefs → "ui").
           settings.setAutoTagConfig(patch);
+          settings.setUiConfig(patch);
           // Respond with the effective (settings-over-config merged) toggles
           // so the panel always sees booleans that actually gate runtime
           // behaviour (issue #31).
-          sendJson(res, 200, { config: service.getTagConfig() });
+          sendJson(res, 200, { config: service.getAppConfig() });
           return;
         }
-        sendJson(res, 200, { config: service.getTagConfig() });
+        sendJson(res, 200, { config: service.getAppConfig() });
       } catch {
         sendJson(res, 500, { error: "internal" });
       }

package/lib/client.js

@@ -77,6 +77,11 @@ window.__ModuleLoader__.load({
         "memory.settings.autoTagEnabled": "自动打标签",
         "memory.settings.autoTagSave": "保存",
         "memory.settings.autoTagSaved": "已保存",
+        "memory.settings.sidebarTriggerTitle": "侧边栏入口按钮",
+        "memory.settings.sidebarTriggerHint": "关闭后隐藏侧边栏底部（左下角）的记忆入口按钮。与其他插件 UI 冲突时建议关闭；记忆库仍可通过顶部「记忆库」标签访问",
+        "memory.settings.sidebarTriggerEnabled": "显示左下角入口按钮",
+        "memory.settings.sidebarTriggerSave": "保存",
+        "memory.settings.sidebarTriggerSaved": "已保存",
         "memory.settings.ruleAdd": "添加规则",
         "memory.settings.rulePlaceholder": "例如：回答时总是先给结论",
         "memory.settings.commands": "自定义指令",
@@ -186,6 +191,11 @@ window.__ModuleLoader__.load({
         "memory.settings.autoTagEnabled": "Auto-tagging",
         "memory.settings.autoTagSave": "Save",
         "memory.settings.autoTagSaved": "Saved",
+        "memory.settings.sidebarTriggerTitle": "Sidebar trigger",
+        "memory.settings.sidebarTriggerHint": "Hide the memory entrance button at the sidebar footer (bottom-left) when it clashes with other plugins. The library stays reachable via the 记忆库 conversation tab",
+        "memory.settings.sidebarTriggerEnabled": "Show the bottom-left trigger",
+        "memory.settings.sidebarTriggerSave": "Save",
+        "memory.settings.sidebarTriggerSaved": "Saved",
         "memory.settings.ruleAdd": "Add Rule",
         "memory.settings.rulePlaceholder": "e.g. Always lead with a conclusion",
         "memory.settings.commands": "Custom Commands",
@@ -462,7 +472,11 @@ window.__ModuleLoader__.load({
       // there. This surface reuses the exact MemoryExplorer UI at full size —
       // not a side drawer — so the library stays reachable from any state.
       ".mneme-overlay{position:fixed;inset:0;z-index:1000;display:flex;flex-direction:column;background:var(--dsw-alias-bg-layer-1);animation:mneme-fadein .12s ease-out}",
-      ".mneme-overlaybar{flex:none;display:flex;align-items:center;justify-content:space-between;height:44px;padding:0 12px 0 16px;border-bottom:1px solid var(--dsw-alias-border-l2)}",
+      // issue #41: overlay 顶栏右侧原本与宿主窗口标题栏的控制按钮（最小化/最大化/关闭）
+      // 落在同一区域——宿主控制按钮浮在 web 内容最上层，抢占了 overlay"关闭"按钮的
+      // 点击热区，导致记忆窗口无法关闭。改为左对齐（标题 + 关闭按钮并排），关闭按钮
+      // 离开右上角宿主控制按钮区，任何窗口尺寸/宿主下都可见可点。
+      ".mneme-overlaybar{flex:none;display:flex;align-items:center;justify-content:flex-start;gap:12px;height:44px;padding:0 12px 0 16px;border-bottom:1px solid var(--dsw-alias-border-l2)}",
       ".mneme-overlaytitle{font-size:14px;font-weight:600;color:var(--dsw-alias-label-primary)}",
       ".mneme-overlaybody{flex:1;min-height:0;display:flex;flex-direction:column;overflow:hidden}",
       "@keyframes mneme-fadein{from{opacity:0}to{opacity:1}}"
@@ -874,6 +888,8 @@ window.__ModuleLoader__.load({
       const [apiTokenSaved, setApiTokenSaved] = react.useState(false);
       const [autoTag, setAutoTag] = react.useState(false);
       const [autoTagSaved, setAutoTagSaved] = react.useState(false);
+      const [showSidebarTrigger, setShowSidebarTrigger] = react.useState(true);
+      const [sidebarTriggerSaved, setSidebarTriggerSaved] = react.useState(false);
 
       const load = react.useCallback(async () => {
         try {
@@ -891,7 +907,9 @@ window.__ModuleLoader__.load({
           try {
             const g = await apiFetch("/api/dsh-mneme/config").then((res) => res.json());
             setAutoTag(g.config?.autoTagEnabled === true);
-          } catch { /* keep default off */ }
+            // issue #38: sidebar trigger defaults to visible (true).
+            setShowSidebarTrigger(g.config?.showSidebarTrigger !== false);
+          } catch { /* keep defaults */ }
         } catch { /* ignore */ }
       }, []);
 
@@ -1000,6 +1018,18 @@ window.__ModuleLoader__.load({
         } catch { /* ignore */ }
       }
 
+      async function saveSidebarTrigger() {
+        try {
+          await apiFetch("/api/dsh-mneme/config", {
+            method: "PUT",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ showSidebarTrigger })
+          });
+          setSidebarTriggerSaved(true);
+          setTimeout(() => setSidebarTriggerSaved(false), 1500);
+        } catch { /* ignore */ }
+      }
+
       const inputStyle = { boxSizing: "border-box", width: "100%", height: 34, padding: "0 12px", borderRadius: 10, border: "1px solid var(--dsw-alias-border-l2, #ddd)", background: "var(--dsw-alias-bg-base, transparent)", color: "var(--dsw-alias-label-primary)", fontFamily: "inherit", fontSize: 13, outline: "none", marginBottom: 8 };
       const labelStyle = { fontSize: 12, fontWeight: 600, margin: "12px 0 4px", color: "var(--dsw-alias-label-primary)" };
       const hintStyle = { fontSize: 11, color: "var(--dsw-alias-label-tertiary, #999)", marginBottom: 8 };
@@ -1077,6 +1107,17 @@ window.__ModuleLoader__.load({
           h("button", { style: styles.footerButton, onClick: saveAutoTag }, t("memory.settings.autoTagSave")),
           autoTagSaved && h("span", { style: { fontSize: 12, color: "var(--dsw-alias-state-success, #2a7)" } }, t("memory.settings.autoTagSaved"))
         ),
+        // sidebar trigger switch (issue #38)
+        h("div", { style: { ...labelStyle, marginTop: 20 } }, t("memory.settings.sidebarTriggerTitle")),
+        h("div", { style: hintStyle }, t("memory.settings.sidebarTriggerHint")),
+        h("label", { style: { display: "flex", alignItems: "center", gap: 6, marginBottom: 8, fontSize: 13 } },
+          h("input", { type: "checkbox", checked: showSidebarTrigger, onChange: (e) => setShowSidebarTrigger(e.target.checked) }),
+          h("span", null, t("memory.settings.sidebarTriggerEnabled"))
+        ),
+        h("div", { style: { display: "flex", alignItems: "center", gap: 6 } },
+          h("button", { style: styles.footerButton, onClick: saveSidebarTrigger }, t("memory.settings.sidebarTriggerSave")),
+          sidebarTriggerSaved && h("span", { style: { fontSize: 12, color: "var(--dsw-alias-state-success, #2a7)" } }, t("memory.settings.sidebarTriggerSaved"))
+        ),
         // vector search
         h("div", { style: { ...labelStyle, marginTop: 20 } }, t("memory.settings.vectorTitle")),
         h("div", { style: hintStyle }, t("memory.settings.vectorHint")),
@@ -1749,7 +1790,22 @@ window.__ModuleLoader__.load({
     // opens the full-viewport overlay instead — the library stays reachable
     // from every conversation state.
     function SidebarTrigger({ wide, t }) {
+      // issue #38: the entrance button is now optional (settings-over-config
+      // toggle, persisted via /api/dsh-mneme/config). While the value loads we
+      // render the button (default = visible) so it never flashes out; if the
+      // user disabled it, it drops away after the config resolves. The library
+      // itself is unaffected — the 记忆库 conversation tab stays.
+      const [visible, setVisible] = useState(true);
+      useEffect(() => {
+        let cancelled = false;
+        apiFetch("/api/dsh-mneme/config")
+          .then((res) => res.json())
+          .then((d) => { if (!cancelled) setVisible(d.config?.showSidebarTrigger !== false); })
+          .catch(() => { if (!cancelled) setVisible(true); });
+        return () => { cancelled = true; };
+      }, []);
       const [, setOpen] = useOverlayOpen();
+      if (!visible) return null;
       return h("button", {
         type: "button",
         className: wide ? "mneme-trigger" : "mneme-trigger mneme-rail",

package/lib/config.js

@@ -22,6 +22,13 @@ export const Config = z.object({
   // "现在几点/周几"。只注入一次（对话开始时），同会话后续渲染不再重复；
   // 关闭时行为与之前完全一致。
   injectTimePrefix: z.boolean().default(false),
+  // 花括号转义（issue #40，默认开）：DSH 核心 interpolate() 会把 `{{name}}`
+  // 当 prompt 变量做严格校验（变量名须匹配 /^[a-z][a-z0-9_]*$/），记忆正文里
+  // 合法的模板语法（如 `{{hl|}}`、`{{挖空}}`、`{{关键词}}`）会因非法变量名
+  // 直接 throw、让整轮对话崩溃。开启后注入边界把 `{{`→`\{\{`、`}}`→`\}\}`，
+  // 文本不再含 `{{`/`}}` 子串，interpolate 不再扫描到，内容保持可读且幂等
+  // （不会二次转义）。关闭后按原样透传。
+  escapePromptVariables: z.boolean().default(true),
   autoDream: z.boolean().default(true),
   dreamThresholdCount: z.natural().min(1).max(1000).default(10),
   dreamThresholdChars: z.natural().min(100).max(100000).default(5000),
@@ -203,6 +210,16 @@ export const Config = z.object({
   // set false to disable the manual write path too.
   manualTagEnabled: z.boolean().default(true),
 
+  // --- sidebar trigger (issue #38) ---------------------------------------
+  // The memory library is reachable from two UI surfaces: a "记忆库" tab in the
+  // conversation header AND an entrance button at the sidebar footer (bottom
+  // left). Some sidebars get crowded there — dsh-cost-meter and friends also
+  // claim the footer slot — so the entrance button is now optional. Off just
+  // hides the button; the conversation tab stays, so no functionality is lost.
+  // The Web panel exposes this as a toggle (settings-over-config, see
+  // settings.getUiConfig); the value here is the plugin-config default.
+  showSidebarTrigger: z.boolean().default(true),
+
   // --- tag-weighted re-rank (v0.6.4) -------------------------------------
   // Opt-in: boost candidates whose tags overlap the query/session tags.
   tagBoostEnabled: z.boolean().default(false),

package/lib/inject.js

@@ -75,6 +75,23 @@ export function createInjector(ctx, service, settings, config) {
   const maxItems = config.maxInjectedItems ?? 5;
   const threshold = config.importanceThreshold ?? 3;
 
+  // Prompt-variable escaping (issue #40): DSH's interpolate() treats `{{name}}`
+  // as a prompt variable and strictly validates the name against
+  // /^[a-z][a-z0-9_]*$/ — memory/profile content carrying legal template syntax
+  // (Obsidian-style `{{hl|}}`, `{{挖空}}`, `{{关键词}}`) would hit an illegal
+  // variable name and throw, crashing the whole turn. At the injection boundary
+  // we escape every run of 2+ consecutive braces, inserting a `\` between each
+  // pair, so no `{{`/`}}` substring survives into the prompt: `{{a}}` → `{\{a\}\}`,
+  // and odd runs like `{{{a}}}` (which pair-wise escaping would leave with a
+  // literal `{{`) are handled too. The text keeps its readable template form,
+  // the transform is idempotent (escaped braces are single + `\`, never two
+  // adjacent), and single braces pass through untouched — interpolate only
+  // scans `{{`. Off via config.escapePromptVariables=false (default true).
+  function escapePromptVars(text) {
+    if (config.escapePromptVariables === false) return String(text);
+    return String(text).replace(/[{}]{2,}/g, (run) => run.split("").join("\\"));
+  }
+
   // Time-prefix injection (issue #34): opt-in, off by default. When enabled the
   // current date/time is injected once per conversation — at the first prompt
   // assembly of a new session — so the model can sense what time/day it is.
@@ -134,7 +151,7 @@ export function createInjector(ctx, service, settings, config) {
     for (const r of rounds) hot.add(r);
     const body = hot.getContext();
     if (!body) return "";
-    return `[短期上下文] 最近对话（共 ${rounds.length} 轮）：\n${body}`;
+    return escapePromptVars(`[短期上下文] 最近对话（共 ${rounds.length} 轮）：\n${body}`);
   }
 
   function render(candidates) {
@@ -158,7 +175,7 @@ export function createInjector(ctx, service, settings, config) {
         lines.push(`- [${m.type}] ${verified}${title}`);
       }
     }
-    return lines.join("\n");
+    return escapePromptVars(lines.join("\n"));
   }
 
   // Bug4: the system-prompt render is synchronous, so the semantic query vector
@@ -192,7 +209,7 @@ export function createInjector(ctx, service, settings, config) {
     const lines = ["[用户设置] 来自 dsh-mneme 的用户画像与规则："];
     if (profile) lines.push(`- 用户画像：${profile}`);
     for (const rule of rules) lines.push(`- 规则：${rule}`);
-    return lines.join("\n");
+    return escapePromptVars(lines.join("\n"));
   }
 
   const disposers = [

package/lib/service.js

@@ -105,6 +105,19 @@ export function createService({ store, mirror, config, onWrite, logger, settings
     };
   };
 
+  // App-wide effective config for the Web panel (/api/dsh-mneme/config): the
+  // tag toggles plus UI preferences (issue #38). Settings overrides plugin
+  // config when explicitly stored; unset keys fall back to the zod default.
+  const appConfig = () => {
+    const stored = settings?.getUiConfig?.() ?? {};
+    return {
+      ...tagConfig(),
+      showSidebarTrigger: typeof stored.showSidebarTrigger === "boolean"
+        ? stored.showSidebarTrigger
+        : (config.showSidebarTrigger ?? true)
+    };
+  };
+
   // Optional recall recorder, installed via setRecallRecorder after creation.
   // When searchMemories is called with recordRecall=true it receives the
   // actual merged recall scene (candidates + scores + source + threshold) so
@@ -1803,6 +1816,7 @@ export function createService({ store, mirror, config, onWrite, logger, settings
     // Effective tag toggle pair (settings-over-config merge) for the panel
     // (/api/dsh-mneme/config GET/PUT).
     getTagConfig: tagConfig,
+    getAppConfig: appConfig,
     applyMemoryTags: (memoryId, tags) => store.setMemoryTags(memoryId, tags),
     saveAttr: (r) => store.saveAttr(r),
     createEntity: (r) => store.createEntity(r),

package/lib/settings.js

@@ -176,6 +176,37 @@ export function createSettings(db) {
       else if (cur.manualTagEnabled !== undefined) cfg.manualTagEnabled = cur.manualTagEnabled === true;
       setSetting("autoTag", JSON.stringify(cfg));
       return cfg;
+    },
+    /** UI preferences (issue #38): same settings-over-config pattern as the
+     * tag toggles. null = never explicitly stored → callers fall back to the
+     * plugin-config default, so a partial update can't invent a value for a
+     * key the user never touched. */
+    getUiConfig() {
+      const raw = getSetting("ui");
+      let stored = {};
+      if (raw) {
+        try {
+          const j = JSON.parse(raw);
+          if (j && typeof j === "object") stored = j;
+        } catch { /* fall through to defaults */ }
+      }
+      return {
+        showSidebarTrigger: typeof stored.showSidebarTrigger === "boolean" ? stored.showSidebarTrigger : null
+      };
+    },
+    setUiConfig(partial) {
+      const cur = (() => {
+        const raw = getSetting("ui");
+        try {
+          const j = JSON.parse(raw);
+          return j && typeof j === "object" ? j : {};
+        } catch { return {}; }
+      })();
+      const cfg = {};
+      if (partial.showSidebarTrigger !== undefined) cfg.showSidebarTrigger = partial.showSidebarTrigger === true;
+      else if (cur.showSidebarTrigger !== undefined) cfg.showSidebarTrigger = cur.showSidebarTrigger === true;
+      setSetting("ui", JSON.stringify(cfg));
+      return cfg;
     }
   };
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@modusensus/dsh-mneme",
   "description": "Cross-session memory plugin for DeepSeek Harness with autoDream consolidation: SQLite store, Markdown mirrors, 7 model tools, automatic injection, session summarization, user profile/rules, custom slash commands, vector (semantic) search, and a Web GUI panel",
-  "version": "0.7.2",
+  "version": "0.7.4",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -75,6 +75,9 @@
     "adm-zip": "0.6.0"
   },
   "c8": {
-    "reporter": ["text", "lcov"]
+    "reporter": [
+      "text",
+      "lcov"
+    ]
   }
 }

package/src/api.js

@@ -238,19 +238,22 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
             }
             return true;
           };
-          if (!setIfBoolean("autoTagEnabled") || !setIfBoolean("manualTagEnabled")) return;
+          if (!setIfBoolean("autoTagEnabled") || !setIfBoolean("manualTagEnabled") || !setIfBoolean("showSidebarTrigger")) return;
           if (Object.keys(patch).length === 0) {
             sendJson(res, 400, { error: "no valid config field provided" });
             return;
           }
+          // Each setter ignores the keys it doesn't own, so one patch can feed
+          // both stores safely (tag toggles → "autoTag", UI prefs → "ui").
           settings.setAutoTagConfig(patch);
+          settings.setUiConfig(patch);
           // Respond with the effective (settings-over-config merged) toggles
           // so the panel always sees booleans that actually gate runtime
           // behaviour (issue #31).
-          sendJson(res, 200, { config: service.getTagConfig() });
+          sendJson(res, 200, { config: service.getAppConfig() });
           return;
         }
-        sendJson(res, 200, { config: service.getTagConfig() });
+        sendJson(res, 200, { config: service.getAppConfig() });
       } catch {
         sendJson(res, 500, { error: "internal" });
       }

package/src/config.js

@@ -22,6 +22,13 @@ export const Config = z.object({
   // "现在几点/周几"。只注入一次（对话开始时），同会话后续渲染不再重复；
   // 关闭时行为与之前完全一致。
   injectTimePrefix: z.boolean().default(false),
+  // 花括号转义（issue #40，默认开）：DSH 核心 interpolate() 会把 `{{name}}`
+  // 当 prompt 变量做严格校验（变量名须匹配 /^[a-z][a-z0-9_]*$/），记忆正文里
+  // 合法的模板语法（如 `{{hl|}}`、`{{挖空}}`、`{{关键词}}`）会因非法变量名
+  // 直接 throw、让整轮对话崩溃。开启后注入边界把 `{{`→`\{\{`、`}}`→`\}\}`，
+  // 文本不再含 `{{`/`}}` 子串，interpolate 不再扫描到，内容保持可读且幂等
+  // （不会二次转义）。关闭后按原样透传。
+  escapePromptVariables: z.boolean().default(true),
   autoDream: z.boolean().default(true),
   dreamThresholdCount: z.natural().min(1).max(1000).default(10),
   dreamThresholdChars: z.natural().min(100).max(100000).default(5000),
@@ -203,6 +210,16 @@ export const Config = z.object({
   // set false to disable the manual write path too.
   manualTagEnabled: z.boolean().default(true),
 
+  // --- sidebar trigger (issue #38) ---------------------------------------
+  // The memory library is reachable from two UI surfaces: a "记忆库" tab in the
+  // conversation header AND an entrance button at the sidebar footer (bottom
+  // left). Some sidebars get crowded there — dsh-cost-meter and friends also
+  // claim the footer slot — so the entrance button is now optional. Off just
+  // hides the button; the conversation tab stays, so no functionality is lost.
+  // The Web panel exposes this as a toggle (settings-over-config, see
+  // settings.getUiConfig); the value here is the plugin-config default.
+  showSidebarTrigger: z.boolean().default(true),
+
   // --- tag-weighted re-rank (v0.6.4) -------------------------------------
   // Opt-in: boost candidates whose tags overlap the query/session tags.
   tagBoostEnabled: z.boolean().default(false),

package/src/inject.js

@@ -75,6 +75,23 @@ export function createInjector(ctx, service, settings, config) {
   const maxItems = config.maxInjectedItems ?? 5;
   const threshold = config.importanceThreshold ?? 3;
 
+  // Prompt-variable escaping (issue #40): DSH's interpolate() treats `{{name}}`
+  // as a prompt variable and strictly validates the name against
+  // /^[a-z][a-z0-9_]*$/ — memory/profile content carrying legal template syntax
+  // (Obsidian-style `{{hl|}}`, `{{挖空}}`, `{{关键词}}`) would hit an illegal
+  // variable name and throw, crashing the whole turn. At the injection boundary
+  // we escape every run of 2+ consecutive braces, inserting a `\` between each
+  // pair, so no `{{`/`}}` substring survives into the prompt: `{{a}}` → `{\{a\}\}`,
+  // and odd runs like `{{{a}}}` (which pair-wise escaping would leave with a
+  // literal `{{`) are handled too. The text keeps its readable template form,
+  // the transform is idempotent (escaped braces are single + `\`, never two
+  // adjacent), and single braces pass through untouched — interpolate only
+  // scans `{{`. Off via config.escapePromptVariables=false (default true).
+  function escapePromptVars(text) {
+    if (config.escapePromptVariables === false) return String(text);
+    return String(text).replace(/[{}]{2,}/g, (run) => run.split("").join("\\"));
+  }
+
   // Time-prefix injection (issue #34): opt-in, off by default. When enabled the
   // current date/time is injected once per conversation — at the first prompt
   // assembly of a new session — so the model can sense what time/day it is.
@@ -134,7 +151,7 @@ export function createInjector(ctx, service, settings, config) {
     for (const r of rounds) hot.add(r);
     const body = hot.getContext();
     if (!body) return "";
-    return `[短期上下文] 最近对话（共 ${rounds.length} 轮）：\n${body}`;
+    return escapePromptVars(`[短期上下文] 最近对话（共 ${rounds.length} 轮）：\n${body}`);
   }
 
   function render(candidates) {
@@ -158,7 +175,7 @@ export function createInjector(ctx, service, settings, config) {
         lines.push(`- [${m.type}] ${verified}${title}`);
       }
     }
-    return lines.join("\n");
+    return escapePromptVars(lines.join("\n"));
   }
 
   // Bug4: the system-prompt render is synchronous, so the semantic query vector
@@ -192,7 +209,7 @@ export function createInjector(ctx, service, settings, config) {
     const lines = ["[用户设置] 来自 dsh-mneme 的用户画像与规则："];
     if (profile) lines.push(`- 用户画像：${profile}`);
     for (const rule of rules) lines.push(`- 规则：${rule}`);
-    return lines.join("\n");
+    return escapePromptVars(lines.join("\n"));
   }
 
   const disposers = [

package/src/service.js

@@ -105,6 +105,19 @@ export function createService({ store, mirror, config, onWrite, logger, settings
     };
   };
 
+  // App-wide effective config for the Web panel (/api/dsh-mneme/config): the
+  // tag toggles plus UI preferences (issue #38). Settings overrides plugin
+  // config when explicitly stored; unset keys fall back to the zod default.
+  const appConfig = () => {
+    const stored = settings?.getUiConfig?.() ?? {};
+    return {
+      ...tagConfig(),
+      showSidebarTrigger: typeof stored.showSidebarTrigger === "boolean"
+        ? stored.showSidebarTrigger
+        : (config.showSidebarTrigger ?? true)
+    };
+  };
+
   // Optional recall recorder, installed via setRecallRecorder after creation.
   // When searchMemories is called with recordRecall=true it receives the
   // actual merged recall scene (candidates + scores + source + threshold) so
@@ -1803,6 +1816,7 @@ export function createService({ store, mirror, config, onWrite, logger, settings
     // Effective tag toggle pair (settings-over-config merge) for the panel
     // (/api/dsh-mneme/config GET/PUT).
     getTagConfig: tagConfig,
+    getAppConfig: appConfig,
     applyMemoryTags: (memoryId, tags) => store.setMemoryTags(memoryId, tags),
     saveAttr: (r) => store.saveAttr(r),
     createEntity: (r) => store.createEntity(r),

package/src/settings.js

@@ -176,6 +176,37 @@ export function createSettings(db) {
       else if (cur.manualTagEnabled !== undefined) cfg.manualTagEnabled = cur.manualTagEnabled === true;
       setSetting("autoTag", JSON.stringify(cfg));
       return cfg;
+    },
+    /** UI preferences (issue #38): same settings-over-config pattern as the
+     * tag toggles. null = never explicitly stored → callers fall back to the
+     * plugin-config default, so a partial update can't invent a value for a
+     * key the user never touched. */
+    getUiConfig() {
+      const raw = getSetting("ui");
+      let stored = {};
+      if (raw) {
+        try {
+          const j = JSON.parse(raw);
+          if (j && typeof j === "object") stored = j;
+        } catch { /* fall through to defaults */ }
+      }
+      return {
+        showSidebarTrigger: typeof stored.showSidebarTrigger === "boolean" ? stored.showSidebarTrigger : null
+      };
+    },
+    setUiConfig(partial) {
+      const cur = (() => {
+        const raw = getSetting("ui");
+        try {
+          const j = JSON.parse(raw);
+          return j && typeof j === "object" ? j : {};
+        } catch { return {}; }
+      })();
+      const cfg = {};
+      if (partial.showSidebarTrigger !== undefined) cfg.showSidebarTrigger = partial.showSidebarTrigger === true;
+      else if (cur.showSidebarTrigger !== undefined) cfg.showSidebarTrigger = cur.showSidebarTrigger === true;
+      setSetting("ui", JSON.stringify(cfg));
+      return cfg;
     }
   };
 }

package/test/api.test.js

@@ -557,12 +557,26 @@ test("GET/PUT /api/dsh-mneme/config round-trips autoTag switches", async () => {
   await route.handler(req("/api/dsh-mneme/config"), res1);
   assert.equal(res1.statusCode, 200);
   // unset → effective config falls back to plugin-config defaults:
-  // autoTagEnabled=false, manualTagEnabled=true (issue #31 default unification)
-  assert.deepEqual(JSON.parse(res1.body).config, { autoTagEnabled: false, manualTagEnabled: true });
+  // autoTagEnabled=false, manualTagEnabled=true (issue #31 default unification),
+  // showSidebarTrigger=true (issue #38 default)
+  assert.deepEqual(JSON.parse(res1.body).config, { autoTagEnabled: false, manualTagEnabled: true, showSidebarTrigger: true });
   const res2 = new FakeRes();
   await route.handler(req("/api/dsh-mneme/config", "PUT", { autoTagEnabled: true, manualTagEnabled: false }), res2);
   assert.equal(res2.statusCode, 200);
-  assert.deepEqual(JSON.parse(res2.body).config, { autoTagEnabled: true, manualTagEnabled: false });
+  assert.deepEqual(JSON.parse(res2.body).config, { autoTagEnabled: true, manualTagEnabled: false, showSidebarTrigger: true });
+});
+
+test("GET/PUT /api/dsh-mneme/config round-trips the sidebar trigger toggle (issue #38)", async () => {
+  const { routes } = setup();
+  const route = routes.find((r) => r.path === "/api/dsh-mneme/config");
+  const res = new FakeRes();
+  await route.handler(req("/api/dsh-mneme/config", "PUT", { showSidebarTrigger: false }), res);
+  assert.equal(res.statusCode, 200);
+  // Toggling the UI pref must not disturb the tag toggles (settings-over-config).
+  assert.deepEqual(JSON.parse(res.body).config, { autoTagEnabled: false, manualTagEnabled: true, showSidebarTrigger: false });
+  const res2 = new FakeRes();
+  await route.handler(req("/api/dsh-mneme/config"), res2);
+  assert.deepEqual(JSON.parse(res2.body).config, { autoTagEnabled: false, manualTagEnabled: true, showSidebarTrigger: false });
 });
 
 test("DELETE /api/dsh-mneme/memories removes by id and reports misses", async () => {
@@ -597,5 +611,14 @@ test("PUT /api/dsh-mneme/config supports partial update", async () => {
   // Partial PUT only stores autoTagEnabled; manualTagEnabled stays unset and
   // falls back to the plugin-config default (true) — a lone autoTag toggle must
   // never silently disable manual tagging (issue #31).
-  assert.deepEqual(JSON.parse(res.body).config, { autoTagEnabled: true, manualTagEnabled: true });
+  assert.deepEqual(JSON.parse(res.body).config, { autoTagEnabled: true, manualTagEnabled: true, showSidebarTrigger: true });
+});
+
+test("PUT /api/dsh-mneme/config rejects non-boolean showSidebarTrigger", async () => {
+  const { routes } = setup();
+  const route = routes.find((r) => r.path === "/api/dsh-mneme/config");
+  const res = new FakeRes();
+  await route.handler(req("/api/dsh-mneme/config", "PUT", { showSidebarTrigger: "no" }), res);
+  assert.equal(res.statusCode, 400);
+  assert.match(JSON.parse(res.body).error, /showSidebarTrigger/);
 });

package/test/client.test.js

@@ -403,3 +403,23 @@ test("delete failure surfaces visible error feedback", () => {
     "a failed row must get a visible error style"
   );
 });
+
+// issue #38: the sidebar foot trigger must be disableable so it stops colliding
+// with other plugins that also claim the bottom-left footer slot (dsh-cost-meter
+// et al). The client reads the settings-over-config toggle from the /config
+// endpoint and renders no button when it is off; the 记忆库 conversation tab is
+// unaffected, so nothing is lost by hiding the entry.
+test("sidebar trigger is hidden when showSidebarTrigger is false (issue #38)", () => {
+  assert.ok(
+    clientSource.includes('apiFetch("/api/dsh-mneme/config")'),
+    "trigger must read the effective config from /api/dsh-mneme/config"
+  );
+  assert.ok(
+    /d\.config\?\.showSidebarTrigger !== false/.test(clientSource),
+    "trigger must hide when showSidebarTrigger is explicitly false and stay visible by default"
+  );
+  assert.ok(
+    clientSource.includes('"memory.settings.sidebarTriggerTitle"'),
+    "settings panel must expose a sidebar-trigger toggle"
+  );
+});

package/test/config.test.js

@@ -55,3 +55,17 @@ test("startup probe: the reranker module never statically imports transformers/o
   );
   assert.match(src, /await import\("@huggingface\/transformers"\)/, "transformers.js loads lazily via dynamic import");
 });
+
+test("showSidebarTrigger is on by default, disabled explicitly (issue #38)", () => {
+  const cfg = Config({});
+  assert.equal(cfg.showSidebarTrigger, true, "sidebar trigger defaults to visible (behavior unchanged)");
+  const off = Config({ showSidebarTrigger: false });
+  assert.equal(off.showSidebarTrigger, false, "explicit false hides the trigger");
+});
+
+test("escapePromptVariables is on by default, disabled explicitly (issue #40)", () => {
+  const cfg = Config({});
+  assert.equal(cfg.escapePromptVariables, true, "{{...}} escaping defaults to on (protects interpolate)");
+  const off = Config({ escapePromptVariables: false });
+  assert.equal(off.escapePromptVariables, false, "explicit false passes {{...}} through verbatim");
+});

package/test/inject.test.js

@@ -129,3 +129,60 @@ test("injectTimePrefix: same session never re-injects, a new session injects aga
   const third = contexts[0].text({ agent: { session: { id: "s2" } } });
   assert.match(third, /^\[当前时间:/, "a new session injects the prefix again");
 });
+
+test("issue #40: {{...}} in memory content is escaped at the injection boundary", () => {
+  const { contexts, service } = setup();
+  service.saveWithDedupe({ type: "preference", title: "模板记忆", content: "{{hl|highlight}} 和 {{挖空}} {{关键词}}", importance: 5 });
+  const text = contexts[0].text({});
+  assert.ok(text.includes("模板记忆"), "memory still rendered by title");
+  assert.ok(text.includes("{\\{hl|highlight}\\}"), "ASCII template braces escaped");
+  assert.ok(text.includes("{\\{挖空}\\}"), "CJK template braces escaped");
+  assert.ok(!text.includes("{{"), "no raw {{ survives into the prompt");
+  assert.ok(!text.includes("}}"), "no raw }} survives into the prompt");
+});
+
+test("issue #40: odd brace runs like {{{a}}} are escaped too", () => {
+  const { contexts, service } = setup();
+  service.saveWithDedupe({ type: "preference", title: "三层模板", content: "{{{a}}} 和 }}} 结尾", importance: 5 });
+  const text = contexts[0].text({});
+  assert.ok(!text.includes("{{"), "no raw {{ for odd brace runs");
+  assert.ok(!text.includes("}}"), "no raw }} for odd brace runs");
+});
+
+test("issue #40: {{...}} in user profile/rules is escaped", () => {
+  const { contexts, settings } = setup();
+  settings.setProfile("我叫{{名字}}，前端开发者");
+  settings.setRules(["回答时用 {{hl|term}}", "以 }} 结尾的规则"]);
+  const settingsCtx = contexts.find((c) => c.name === "user-settings");
+  const text = settingsCtx.text({});
+  assert.ok(text.includes("{\\{名字}\\}"), "profile braces escaped");
+  assert.ok(text.includes("{\\{hl|term}\\}"), "rule braces escaped");
+  assert.ok(!text.includes("{{"), "no raw {{ in user-settings block");
+  assert.ok(!text.includes("}}"), "no raw }} in user-settings block");
+});
+
+test("issue #40: hot-context rounds with {{...}} are escaped", () => {
+  const { contexts } = setup();
+  const text = contexts[0].text({
+    agent: {
+      session: {
+        id: "s1",
+        events: [
+          { type: "user/message", data: { source: { kind: "user" }, content: ["用 {{hl|你好}} 测试"] } },
+          { type: "assistant/message", data: { source: { kind: "assistant" }, content: ["返回 {{答案}}"] } }
+        ]
+      }
+    }
+  });
+  assert.ok(text.includes("[短期上下文]"), "hot context rendered");
+  assert.ok(!text.includes("{{"), "no raw {{ in hot context");
+  assert.ok(!text.includes("}}"), "no raw }} in hot context");
+});
+
+test("issue #40: escapePromptVariables=false passes {{...}} through verbatim", () => {
+  const { contexts, service } = setup({ escapePromptVariables: false });
+  service.saveWithDedupe({ type: "preference", title: "模板", content: "{{挖空}} 与 {{hl|term}}", importance: 5 });
+  const text = contexts[0].text({});
+  assert.ok(text.includes("{{挖空}}"), "raw braces preserved when escaping disabled");
+  assert.ok(text.includes("{{hl|term}}"), "raw ASCII braces preserved when escaping disabled");
+});

package/test/settings.test.js

@@ -120,3 +120,25 @@ test("autoTag config coerces non-boolean to false", () => {
   assert.deepEqual(settings.getAutoTagConfig(), { autoTagEnabled: false, manualTagEnabled: false });
   store.close();
 });
+
+test("ui config (sidebar trigger) defaults to null and round-trips only explicit keys", () => {
+  const { store, settings } = setup();
+  // Issue #38: same settings-over-config pattern as the tag toggles — an unset
+  // key is null so consumers fall back to the plugin-config default (visible).
+  assert.deepEqual(settings.getUiConfig(), { showSidebarTrigger: null });
+  settings.setUiConfig({ showSidebarTrigger: false });
+  assert.deepEqual(settings.getUiConfig(), { showSidebarTrigger: false });
+  settings.setUiConfig({ showSidebarTrigger: true });
+  assert.deepEqual(settings.getUiConfig(), { showSidebarTrigger: true });
+  // A partial update with no showSidebarTrigger keeps the stored value.
+  settings.setUiConfig({});
+  assert.deepEqual(settings.getUiConfig(), { showSidebarTrigger: true });
+  store.close();
+});
+
+test("ui config coerces non-boolean to false", () => {
+  const { store, settings } = setup();
+  settings.setUiConfig({ showSidebarTrigger: "yes" });
+  assert.deepEqual(settings.getUiConfig(), { showSidebarTrigger: false });
+  store.close();
+});