dsh-engramory 0.2.8 → 0.3.0

package/README.md

@@ -69,9 +69,14 @@ end up with two engramory rows and the original caps still enforced):
 
 A patch replaces the targeted row's whole `config`, so list every key you mean to keep.
 
-For the store itself and the always-on block, use the installer in the Engramory repo
-(`python tools/engramory_init.py dsh --install-skill`). This plugin enforces the cap and
-supplies the protocol; it does not create the store.
+With the plugin alone, the memory is one global store, `$DSH_HOME/.engramory-memory/`
+(`$DSH_HOME` defaults to `~/.dsh`): the skill tells the AI where it is, and the AI
+creates it on its first save. A project can have a store of its own,
+`.engramory-memory/` in its root, which only you create — the installer does it and
+git-ignores it (`python tools/engramory_init.py dsh --project-root <project>`). The AI
+never creates one; where one exists, what holds only in that project goes there, and
+everything else stays in the global store. The installer also writes the always-on block
+into `AGENTS.md` (`python tools/engramory_init.py dsh --install-skill`).
 
 To uninstall:
 
@@ -79,17 +84,155 @@ To uninstall:
 dsh plugin --profile <name> remove dsh-engramory
 ```
 
+## Companion mode (大肥鱼模式)
+
+For a character the user chats with — the community's 大肥鱼, or any persona. Turn it on
+with `companion: true`, or the 大肥鱼模式 switch on the settings page (below).
+
+- **Three more types for the character's own life** ([SKILL.md §2.2](../../../SKILL.md)):
+  `moment` — something the character and the user shared, with its date; kept, and
+  folded into a monthly archive when the index fills. `upcoming` — something coming up
+  in the user's life; asked about once its date passes, and rewritten as a `moment`
+  once the user has said how it went. `self` —
+  a change in the character itself, such as a nickname; updated in place, never folded.
+  A `moment` or `self` note is deleted only when the user asks to forget. In a Chinese
+  store their headings are `## 经历`, `## 约定` and `## 我自己`. The other four types
+  keep their meaning.
+- **Recall in character.** The agent is told that, when it plays a character for you,
+  any message, a greeting included, may call for recall, and to speak of what it
+  remembered — or failed to save — in character, without naming files or tools.
+- **The persona preset decides what it can do with memory.** With companion mode or
+  social mode on, what a conversation is given — the memory and its rules, or social
+  mode's note — is a *required* runtime context, so it arrives even under a preset that
+  turns optional context off (dsh-persona's `includeRuntimeContext: false`, as dsh's
+  `minimal` preset does). Saving is another matter: the preset needs dsh's file tools and
+  the skill tool for the character to write notes the way the skill describes. A preset
+  with only a shell can read the memory it is given, and its writes go past the guard.
+
+## Social mode
+
+A choice inside companion mode, for a character other people can talk to as well — one
+wired to QQ, WeChat, Douyin or Bilibili through a bridge plugin. With companion mode on,
+choose *Social* (社交) under *Memory access* (记忆权限) on the settings page, or set
+`audience: social`. The default, *Private* (专属), gives every conversation the memory:
+if only you talk to this dsh, keep it. Without companion mode, `audience` changes
+nothing.
+
+- **Only your own conversations get the memory.** A conversation is yours when you have
+  written in it in dsh's own window — the desktop app or `dsh web` — and nobody else has.
+  dsh stamps every user message with where it came from, and its browser client sends
+  each prompt with a request id and the browser's time zone: that is how a message you
+  typed there is told apart. Everything else is someone else's:
+  - a message a bridge plugin submits, under a kind of its own (`plugin:<name>`, as
+    dsh-onebot writes, or any other kind dsh's own producers do not use) or dsh's plain
+    `user` kind, unless the bridge marks it as yours (the standard below);
+  - a program calling dsh web's API, `dsh headless`, an editor or terminal client;
+  - a conversation an automation or a plugin opened, until you write in it;
+  - a caller dsh itself names as someone other than the owner.
+
+  Once anyone else has written in a conversation it stays theirs, even after you write
+  in it too: what the memory put into it earlier stays in its history. Messages dsh
+  adds itself (runtime context, skills, compaction, agent-to-agent messages) decide
+  nothing.
+- **Someone else's conversation gets no memory:** no index, a note saying so, no full path
+  to the store (the skill, which every conversation reads, gives none in social mode; your
+  own conversations are told it in their runtime context), and file tools that may name
+  files only. A directory is refused (so grep, glob and directory
+  views are — any tree may hold a store), and so is any path into a store, however it is
+  spelled or linked, including a store that does not exist yet, so none can be planted
+  for you. A subagent is yours while its live parent is — read afresh on every call —
+  and nobody else has written to it directly; a forked conversation is judged by its own
+  history, the part it inherited included. A call with no session, a
+  dsh without session projections, or a network path counts as someone else's.
+
+This keeps the user's memory out of others' context by the routes dsh's own file tools
+take. It is **not** a security boundary: a shell tool reads any file, and a different
+profile on the same account can still read the store's files. Keeping others away from
+the store needs filesystem permissions or a sandbox.
+
+### For bridge authors: marking who wrote a message
+
+With social mode on, every message a bridge submits counts as someone else's. For the
+owner's own chat to get the memory — their private QQ chat with the character, say —
+put a `speaker` on the message's source:
+
+```js
+agent.followup(createUserMessage({
+  content: [{ type: 'text', text }],
+  source: { kind: 'plugin:your-bridge', speaker: { role: 'owner' } },
+}))
+```
+
+| `speaker.role` | Meaning |
+|---|---|
+| `owner` | The dsh owner wrote it: a message from the account the user set as theirs in your bridge. |
+| `guest` | Someone else wrote it — the same as no `speaker` at all. |
+| `none` | Nobody wrote it: your plugin's own report, reminder or notice. It does not turn the owner's conversation into someone else's. |
+
+Mark a message `owner` only when it comes from the owner's own account. A group's
+conversation stays someone else's once anyone else in it speaks. dsh keeps unknown
+source fields in the session log, so the role survives a restart.
+
+A program that talks to dsh only through dsh web's API cannot set a source, and its
+messages count as someone else's — unless it sends `clientTimeZone` with a prompt: dsh
+then records exactly what its own page sends, and the message counts as the owner's. A
+program forwarding other people's messages must leave `clientTimeZone` out.
+
+## Settings page
+
+On dsh's **Plugins** page, open *Engramory memory*: its page sets companion mode (a
+switch) and, while it is on, its memory access (private or social), and the index cap.
+The memory's language follows dsh's own (see `language` below).
+
+Saving goes through dsh's own profile editor: it validates the whole config, writes it
+to your profile's `cordis.patch.yml`, and reloads the plugin with it — or leaves the
+file as it was. A save made against settings that changed elsewhere in the meantime is
+refused, and the page reads them again. Settings put back to their defaults remove
+their override instead of pinning it. Other fields (`indexName`, `indexPath`, …) stay
+in the file.
+
+Only you reach the page's route — your signed-in browser, or a program holding your
+login: dsh answers 401 to a request without it and 403 to a cross-site one, so an agent
+cannot call it to switch social mode off. A dsh without the profile editor shows the page read-only.
+Companion mode and its memory access are also at the top of the memory page (below).
+
+## Memory page
+
+dsh's sidebar gets a **Memory** entry. Its page lists the stores recall can use — the
+global store under `$DSH_HOME` and each workspace's project store, found as recall finds
+one, or, with `indexPath` pinned, that index's directory alone — with each index's size
+against the cap, its notes' names by type, and its archive. It is read-only and shows
+names only, never a note's text: a name opens the note in your computer's default app,
+through dsh's own opener, on the machine dsh runs on. Where dsh says it cannot open there
+(over SSH, say), the names are plain text and the page shows where the files are.
+*Open the index* opens the index the same way; *Open the folder* shows the index in your
+file manager (Explorer and Finder select it in the store's folder; on Linux the folder
+opens), so a store with no index has no such button. At the top, companion mode and its
+memory access save as they are switched; what they mean, and the index cap, are on the
+settings page.
+
+The listing is bounded — 2000 entries looked at per folder, 200 workspaces, 5000 names in
+all — and never looks into a workspace on a network share path (`\\server\share\…`), or
+one whose folder has since become a link to somewhere else. A note that is a link is not
+listed; what is opened is a note or the index found again, by name, directly in its store,
+and refused if it has become a link. A relative `indexPath` follows each conversation's
+directory, so the page cannot list it. Only you reach the page's route, as the settings
+page's.
+
 ## Configuration
 
 | Field | Default | Meaning |
 |---|---|---|
-| `indexName` | `MEMORY.md` | Basename treated as the memory index (case-insensitive; both `file_path` and `str_replace_editor`'s `path` are checked) — the name a write is called by, or the name of the file it lands on, so a symlink under another name is caught too. An empty or non-string value falls back to the default. |
+| `indexName` | `MEMORY.md` | Basename treated as the memory index (case-insensitive; both `file_path` and `str_replace_editor`'s `path` are checked) — the name a write is called by, or the name of the file it lands on, so a symlink under another name is caught too. An empty or non-string value falls back to the default, and so does one that is not a plain file name (a path separator, a `:`, `.` or `..`). |
 | `maxLines` | `200` | Hard line cap. Non-positive or non-finite values fall back to the default. |
 | `maxBytes` | `25600` | Hard UTF-8 byte cap (25 KB). |
-| `indexPath` | unset | Absolute path of the ONE index to guard. Without it the guard matches on basename alone, so an unrelated `MEMORY.md` in another project is gated too; set this and only that exact file is. Compared by identity — the file the write lands on, whatever it is called (symlinks and `..` resolved; case-folded on Windows only) — and a path that does not exist yet still has its first write guarded. |
+| `indexPath` | unset | Path of the ONE index to guard: absolute, or relative to each session's working directory (resolved there by the guard as by recall; the memory page lists only an absolute pin). Without it the guard matches on basename alone, so an unrelated `MEMORY.md` in another project is gated too; set this and only that exact file is. Compared by identity — the file the write lands on, whatever it is called (symlinks and `..` resolved; case-folded on Windows only) — and a path that does not exist yet still has its first write guarded. |
 | `registerSkill` | `true` | Set `false` to keep the cap but skip the runtime skill. |
 | `injectIndex` | `true` | Put the memory index into dsh's runtime context on every step (see above). Set `false` to recall by reading the file instead. |
-| `skill` | built-in | Replace the skill body with your own markdown. |
+| `language` | dsh's | Unset (or empty), the memory follows dsh's language — the one chosen in dsh's Settings → General, else the language of the system dsh runs on (dsh's page, with no choice made, follows the browser's, so on a remote `dsh web` the two can differ); a change applies once dsh restarts. Set it to pin one: `zh` writes the store in Chinese (SKILL.md §1.1): Chinese note names, `## 用户` / `## 反馈` / `## 项目` / `## 参考` headings, `**为什么：**` / `**怎么用：**` labels, and the skill and the injected index in Chinese. Frontmatter keys and `type:` values stay English, so every host still reads the store. The cap's refusals stay English. `zh` and its regional forms (`zh-CN`, `zh-TW`, …) select Chinese; any other string selects `en`. |
+| `companion` | `false` | `true` turns companion mode on (above): three more types for the character's own life, and recall in character. Only the boolean `true` counts. |
+| `audience` | `private` | With companion mode on, `social` turns social mode on (above): only your own conversations get the memory. Any other value is `private`, where every conversation does. Without companion mode it changes nothing. |
+| `skill` | built-in | Replace the skill body with your own markdown — which must then say where the store is itself. |
 
 ## What the guard actually does
 
@@ -136,10 +279,37 @@ file's line endings when sizing the result, including CRLF bytes.
   from `$DSH_HOME`, resolved the way dsh resolves it. What is injected is framed as notes,
   not instructions, that may be stale; a host without runtime context
   (no `ctx.systemPrompt.context`) goes without it.
-- dsh's plugin API can change. The plugin uses `ctx.tools.guard()` and three reactive
-  `ctx.inject()` children for the skill registry, the session working directory, and
-  the prompt registry; a compatible-release declaration needs recorded host evidence,
-  not just unit tests.
+- **Social mode knows your typing by what dsh's browser client sends.** A program that
+  sends the same request id and time zone as dsh's own page is taken for you, and a
+  browser whose time zone cannot be read leaves your messages unmarked. dsh's terminal,
+  editor (ACP) and SDK clients do not mark them either: with social mode on, only
+  dsh's own window counts.
+- **Some of dsh's messages carry no author.** An answer to the agent's question, a
+  scheduled prompt and a message a slash command adds (`/plan <text>`, `/goal`'s
+  attachments) count as nobody's, and a queued message edited through dsh's API keeps the
+  author it had. On dsh 0.2.1 only the owner can answer, schedule or edit — in dsh's
+  window, or through a program with the owner's login, which can read the store's files
+  through dsh's own file API anyway — and a chat bridge that forwards a command runs it in
+  its own conversation, which its other messages already make someone else's.
+- **A kind of message a later dsh adds counts as someone else's** until this plugin knows
+  it: a conversation of yours may lose the memory, never the other way round.
+- **The memory page reads the disks as they answer.** On a filesystem whose directory
+  entries carry no type (some network mounts), Node stats each listed entry on dsh's main
+  thread, at most 2000 per folder; and a listing stuck on a drive that never answers keeps
+  reporting a timeout until it does, rather than starting another that would get stuck too.
+- **What the memory page opens is checked by path.** dsh's opener takes a path, which it
+  resolves once more before the desktop opens it; a process changing a store's files at
+  that very moment could still redirect what the desktop opens — as with dsh's own opener
+  for any workspace file — though not to a link the page saw.
+- dsh's plugin API can change. The plugin uses `ctx.tools.guard()` and reactive
+  `ctx.inject()` children for the skill registry, the session working directory, the
+  prompt registry, and — in social mode — dsh's session projections, where it folds
+  who has written in each session; a compatible-release declaration needs recorded host
+  evidence, not just unit tests. The recorded end-to-end runs cover the cap, the skill
+  and the injected index; companion mode, social mode, the settings page and the memory page were checked by hand on
+  a real dsh (0.2.1-rc.5) — messages typed in dsh's window, sent by `dsh headless` and by
+  a program through dsh web's API, a save through the page, and the memory page's listing,
+  a switch saved from it and a note opened from it — but are not part of that record yet.
 
 ## License
 

package/README.zh-CN.md

@@ -60,9 +60,7 @@ dsh plugin --profile <名字> add dsh-engramory
 
 一次 patch 会**整体替换**目标行的 `config`,所以你想保留的键要逐个列全。
 
-记忆库本身和常驻块,请用 Engramory 仓库里的安装器
-(`python tools/engramory_init.py dsh --install-skill`)。本插件负责强制上限、提供协议;
-**它不创建记忆库**。
+只装插件时,记忆就是一个全局库 `$DSH_HOME/.engramory-memory/`(`$DSH_HOME` 默认是 `~/.dsh`):skill 会告诉 AI 它在哪,AI 第一次保存时自己建好。项目也可以有自己的库——项目根目录下的 `.engramory-memory/`——但只能由你来建:安装器会建好并加进 .gitignore(`python tools/engramory_init.py dsh --project-root <项目>`)。AI 绝不自己建项目库;有项目库时,只在这个项目成立的事记在那里,其余的仍记在全局库。安装器还会把常驻块写进 `AGENTS.md`(`python tools/engramory_init.py dsh --install-skill`)。
 
 卸载:
 
@@ -70,17 +68,78 @@ dsh plugin --profile <名字> add dsh-engramory
 dsh plugin --profile <名字> remove dsh-engramory
 ```
 
+## 大肥鱼模式(陪伴模式)
+
+给用户聊天陪伴的角色用——社区里的大肥鱼,或任何人设。写 `companion: true` 打开,或者在设置页(见下文)里打开「大肥鱼模式」开关。
+
+- **再加三类,记角色自己的人生**([SKILL.md §2.2](../../../SKILL.md)):`moment`(经历)——和用户一起经历过的事,带日期,默认保留,索引写满时按月收进归档;`upcoming`(约定)——用户生活里将要发生的事,过了日子会问起,问到结果才改写成一条经历,绝不自己编结果;`self`(我自己)——角色自己的变化,比如外号,原地更新,不归档。经历和我自己只有用户说忘掉才删。其余四类意思不变。
+- **用角色口吻回忆。** AI 会被告知:它为你扮演角色时,用户的每句话,包括打招呼,都可能该想起点什么;记住了什么、没记上什么,都用角色口吻说,不提文件和工具。
+- **人设预设决定它能拿记忆做什么。** 大肥鱼模式或社交模式打开时,会话收到的内容——记忆和陪伴规则,或者社交模式的那条说明——是*必需*的运行时上下文,所以即使预设关掉了可选上下文(dsh-persona 的 `includeRuntimeContext: false`,dsh 自带的 `minimal` 预设就是这样),它也照样送到。保存记忆是另一回事:预设得带上 dsh 的文件工具和 skill 工具,角色才能照 skill 的格式写笔记。只有 shell 的预设读得到给它的记忆,但它写的东西绕过守卫。
+
+## 社交模式
+
+大肥鱼模式里的一个选项,给"别人也能跟它聊"的角色用——比如经接入插件接到 QQ、微信、抖音、B 站的角色。打开大肥鱼模式后,在设置页的「记忆权限」里选「社交」,或者写 `audience: social`。默认的「专属」让每个会话都能用记忆:只有你自己跟这个 dsh 聊的话,保持专属就行。大肥鱼模式没打开时,`audience` 不起作用。
+
+- **只有你本人的会话拿得到记忆。** 你在 dsh 自己的窗口(桌面版或 `dsh web`)里亲手发过消息、而且没有别人在里面说过话的会话,才算你的。dsh 给每条用户消息都盖了来源章,它的浏览器界面发消息时会带上请求编号和浏览器的时区,靠这个认出是你在界面里打的字。其余一律算别人的:
+  - 接入插件转进来的消息,不管用的是它自己的章(`plugin:<包名>`,dsh-onebot 就是这样;或者别的任何 dsh 自己不用的章)还是 dsh 的 `user` 章——除非插件按下面的标准标明是你;
+  - 通过 dsh web 接口调用的外部程序、`dsh headless`、编辑器或终端客户端;
+  - 自动化任务或插件开的会话,在你亲手发消息之前;
+  - dsh 自己标明不是主人的调用方。
+
+  一段会话只要有别人说过话,就一直算别人的,你之后再在里面发消息也一样:之前放进去的记忆还留在对话记录里。dsh 自己加的消息(运行时上下文、技能、压缩、agent 之间的消息)不影响判断。
+- **别人的会话拿不到记忆:** 没有索引,只收到一条说明,也拿不到记忆库的完整路径(社交模式下,所有会话都读的 skill 里不写完整路径;你本人的会话会在运行时上下文里得知它),而且文件工具只能指名文件:目录一律拒绝(所以 grep、glob 和目录查看都不行——任何目录树里都可能藏着记忆库),指向记忆库的路径不管怎么写、怎么链接也一律拒绝,还不存在的记忆库也算,所以没人能替你预先种下一个。子 agent 在它的父会话(每次都重新查在线的父会话)算你的、而且没有别人直接给它发过消息时,才算你的;分叉出来的会话按它自己的记录判断,继承来的那部分也算。没有会话的调用、没有会话投影服务的 dsh、网络路径,都按别人算。
+
+这只是让用户的记忆不经 dsh 自带文件工具的路径进入别人的上下文。它**不是**安全边界:shell 工具能读任何文件,同一账户下的另一个配置也照样读得到记忆库的文件。要让别人真正碰不到,得靠文件系统权限或沙箱。
+
+### 给接入插件作者:标明消息是谁发的
+
+社交模式打开时,接入插件转进来的每条消息都算别人的。想让主人自己的聊天(比如主人和角色的 QQ 私聊)用上记忆,就在消息的来源章上加一个 `speaker`:
+
+```js
+agent.followup(createUserMessage({
+  content: [{ type: 'text', text }],
+  source: { kind: 'plugin:your-bridge', speaker: { role: 'owner' } },
+}))
+```
+
+| `speaker.role` | 含义 |
+|---|---|
+| `owner` | dsh 的主人发的:来自用户在你插件里设为"自己"的那个账号。 |
+| `guest` | 别人发的——和不写 `speaker` 一样。 |
+| `none` | 不是人发的:你插件自己的汇报、提醒或通知。它不会让主人的会话变成别人的。 |
+
+只有确认来自主人自己账号的消息才标 `owner`。群聊里只要有别人说话,那个会话就一直算别人的。dsh 会把来源章里它不认识的字段原样存进会话记录,所以重启后标注还在。
+
+只通过 dsh web 接口和 dsh 交互的程序设不了来源章,它发的消息都算别人的——除非它发消息时带了 `clientTimeZone`:那样 dsh 记下的章和它自己页面发的一模一样,消息会被当成主人的。替别人转发消息的程序不要带 `clientTimeZone`。
+
+## 设置页
+
+在 dsh 的**插件**页里打开「Engramory 记忆」:它的页面上设置大肥鱼模式(一个开关)以及打开时的记忆权限(专属或社交)、索引上限。记忆用什么语言写跟随 dsh 自己的语言(见下文 `language`)。
+
+保存走 dsh 自己的配置编辑服务:它校验整份配置,写进你这个配置的 `cordis.patch.yml`,再用新配置重新加载插件——校验不过就保持文件原样。如果你打开页面之后设置在别处被改过,这次保存会被拒绝,页面重新读取。改回默认值的设置会删掉对应的覆盖,而不是把默认值钉死。其他字段(`indexName`、`indexPath` 等)仍留在文件里。
+
+只有你能访问这一页用的接口——你已登录的浏览器,或者带着你登录凭据的程序:没有凭据的请求 dsh 回 401,跨站请求回 403,所以 agent 没法调用它关掉社交模式。没有配置编辑服务的 dsh 上,这一页只读。大肥鱼模式和记忆权限在记忆页(见下文)顶部也有。
+
+## 记忆页
+
+dsh 左侧栏多一个「记忆」入口。点开的页面列出召回能用到的记忆库——`$DSH_HOME` 下的全局库,以及每个工作区的项目库(找法和召回一样);设了 `indexPath` 时只列那个索引所在的目录——每个库显示索引相对上限的大小、按类型分组的笔记名字,以及归档。页面只读,只显示名字,不显示笔记正文:点名字会用电脑上的默认程序打开那条笔记,走的是 dsh 自带的打开功能,在运行 dsh 的那台机器上打开。dsh 说那台机器上打不开时(比如经 SSH 访问),名字就只是文字,页面会写出文件在哪。「打开索引」同样用默认程序打开索引;「打开文件夹」在文件管理器里显示索引(资源管理器和访达会在记忆库文件夹里选中它;Linux 上是打开那个文件夹),所以没有索引的记忆库没有这个按钮。页面顶部的大肥鱼模式和记忆权限拨了就保存;它们是什么意思、索引上限,见设置页。
+
+列出的东西有上限——每个文件夹最多看 2000 个条目、最多 200 个工作区、总共 5000 个名字——而且不去看网络共享路径(`\\server\share\…`)上的工作区,也不去看文件夹后来被换成指向别处的链接的工作区。本身是链接的笔记不列出;打开的是按名字在记忆库里重新找到的笔记或索引,这时它若已变成链接就拒绝。相对路径的 `indexPath` 跟着每个会话的目录走,所以页面列不出来。页面用的接口和设置页一样只有你能访问。
+
 ## 配置
 
 | 字段 | 默认值 | 含义 |
 |---|---|---|
-| `indexName` | `MEMORY.md` | 被当作记忆索引的文件名(不区分大小写;`file_path` 与 `str_replace_editor` 的 `path` 都会检查)—— 看写入时用的文件名,或写入实际落到的那个文件的文件名,所以换了名字的 symlink 也会被拦。空值或非字符串会回退到默认值。 |
+| `indexName` | `MEMORY.md` | 被当作记忆索引的文件名(不区分大小写;`file_path` 与 `str_replace_editor` 的 `path` 都会检查)—— 看写入时用的文件名,或写入实际落到的那个文件的文件名,所以换了名字的 symlink 也会被拦。空值或非字符串会回退到默认值,不是单纯文件名的(含路径分隔符、`:`,或是 `.`、`..`)也回退。 |
 | `maxLines` | `200` | 硬性行数上限。非正数或非有限值回退到默认值。 |
 | `maxBytes` | `25600` | 硬性 UTF-8 字节上限(25 KB)。 |
-| `indexPath` | 未设置 | 要守护的**那一个**索引的绝对路径。不设它时,守卫只按文件名匹配,于是**别的项目里一个无关的 `MEMORY.md` 也会被拦**;设了它就只有这个确切的文件会被守。比较走的是身份而非拼写 —— 看写入实际落到的那个文件,不管它叫什么名字(symlink 与 `..` 都会解析;仅在 Windows 上折叠大小写),而且即使文件尚不存在,它的第一次写入照样受守护。 |
+| `indexPath` | 未设置 | 要守护的**那一个**索引的路径:绝对路径,或相对每个会话工作目录的路径(守卫和召回都按会话目录解析;记忆页只列绝对路径的固定索引)。不设它时,守卫只按文件名匹配,于是**别的项目里一个无关的 `MEMORY.md` 也会被拦**;设了它就只有这个确切的文件会被守。比较走的是身份而非拼写 —— 看写入实际落到的那个文件,不管它叫什么名字(symlink 与 `..` 都会解析;仅在 Windows 上折叠大小写),而且即使文件尚不存在,它的第一次写入照样受守护。 |
 | `registerSkill` | `true` | 设为 `false` 则保留上限、但跳过运行时 skill。 |
 | `injectIndex` | `true` | 每一步都把记忆索引放进 dsh 的运行时上下文(见上文)。设为 `false` 则改回由 agent 读文件召回。 |
-| `skill` | 内置 | 用你自己的 markdown 替换 skill 正文。 |
+| `language` | 跟随 dsh | 不设(或留空)时跟随 dsh 的语言——你在 dsh「设置 → 通用」里选的那个,没选过就用运行 dsh 那台机器的系统语言(dsh 页面没选过时看的是浏览器语言,远程用 `dsh web` 时两者可能不同);改了要重启 dsh 才生效。设了就固定:`zh` 用中文写记忆库(SKILL.md §1.1):中文笔记名,`## 用户` / `## 反馈` / `## 项目` / `## 参考` 标题,`**为什么：**` / `**怎么用：**` 标签,skill 和注入的索引也换成中文。frontmatter 的键和 `type:` 取值保持英文,所以各宿主照样能读。超上限的拒绝提示仍是英文。`zh` 及其地区写法(`zh-CN`、`zh-TW` 等)选中文;其他字符串一律按 `en`。 |
+| `companion` | `false` | 设为 `true` 打开大肥鱼模式(见上文):多记三类角色人生,用角色口吻回忆。只认布尔值 `true`。 |
+| `audience` | `private` | 大肥鱼模式打开时,设为 `social` 打开社交模式(见上文):只有你本人的会话拿得到记忆。其他取值一律按 `private`(专属),每个会话都能用记忆。大肥鱼模式没打开时不起作用。 |
+| `skill` | 内置 | 用你自己的 markdown 替换 skill 正文——这时记忆库在哪也得由它自己写明。 |
 
 ## 守卫到底做了什么
 
@@ -120,9 +179,17 @@ edit 在统一为 LF 的文本上匹配,计算结果大小时保留文件原有
   链接)不会被读取;如果是有意为之,请把 `indexPath` 指向它。全局库的位置来自 `$DSH_HOME`,
   解析方式与 dsh 自己一致。注入的内容被标注为"笔记而非指令、可能过时";没有运行时上下文
   (`ctx.systemPrompt.context`)的宿主则不注入。
-- dsh 的插件 API 可能变化。本插件使用 `ctx.tools.guard()` 和三个响应式 `ctx.inject()`
-  子上下文,分别接入 skill 注册表、会话工作目录和提示词注册表;兼容声明需要真实宿主的
-  运行记录,不能只凭单元测试。
+- **社交模式靠 dsh 浏览器界面发来的信息认出你。** 外部程序如果带上和 dsh 页面一样的请求编号和时区,会被当成你;浏览器读不出时区时,你发的消息也不会被认出。dsh 的终端、编辑器(ACP)和 SDK 客户端发的消息同样不带这些信息:社交模式打开时,只有 dsh 自己的窗口算数。
+- **dsh 有些消息不带发送者。** 对 AI 提问的回答、定时任务发起的消息、斜杠命令附带的消息(`/plan <内容>`、`/goal` 的附件)都算"没人发的";通过 dsh 接口编辑过的排队消息,沿用原来的发送者。在 dsh 0.2.1 上,回答、定时、编辑只有主人做得了——在 dsh 窗口里,或者通过登录了主人身份的程序,而这样的程序本来就能通过 dsh 自己的文件接口读到记忆库;接入插件转发的命令跑在它自己的会话里,那个会话已经因为它的其他消息算别人的了。
+- **以后的 dsh 新加的消息种类,在本插件认识它之前都算别人的:** 你自己的会话可能因此拿不到记忆,但不会反过来把记忆漏给别人。
+- **记忆页按磁盘的响应来读。** 在目录条目不带类型的文件系统上(部分网络挂载),Node 会在 dsh 主线程上逐个 stat 列出的条目,每个文件夹最多 2000 个;卡在永不响应的盘上的那次读取会一直报超时,直到它结束,而不是再起一次同样会卡住的读取。
+- **记忆页打开什么是按路径检查的。** dsh 的打开功能接收的是路径,它在交给桌面打开前会再解析一次;如果恰好在那一刻有进程改动记忆库里的文件,桌面最终打开的东西仍可能被换掉——dsh 自己打开任何工作区文件也是如此——但换不成页面检查时看到的链接。
+- dsh 的插件 API 可能变化。本插件使用 `ctx.tools.guard()` 和响应式 `ctx.inject()`
+  子上下文,分别接入 skill 注册表、会话工作目录、提示词注册表,以及(社交模式下)dsh 的
+  会话投影,在那里累计每个会话里谁说过话;兼容声明需要真实宿主的运行记录,不能只凭单元测试。
+  记录下来的端到端运行覆盖上限、skill 和注入的索引;大肥鱼模式、社交模式、设置页和记忆页已在真实 dsh
+  (0.2.1-rc.5)上手动验证过——在 dsh 窗口里打字、用 `dsh headless` 和外部程序经 dsh web
+  接口发消息、在设置页里保存,以及记忆页的列表、在记忆页上拨开关保存、从记忆页打开笔记——但还不在那份记录里。
 
 ## 许可