dsh-instruction-memory 1.4.5 → 1.4.7

package/CHANGELOG.md

@@ -7,6 +7,68 @@
 > 1.0.13 起由 CI 经 OIDC Trusted Publishing 发布（首个带 provenance 的版本）。
 > 这些历史 tag **不应回填**——npm 上的版本号已被占用。
 
+## [1.4.7] — 2026-10-31
+
+**文档版**：没有一行运行时代码变更，只把 2026-10-31「插件在 DSH Go（Android）上的适配性」
+审计结论写进 README，并补上新跑的一组实机证据。
+
+### 新增证据
+
+- `0.2.1-rc.4`（正是 DSH Go 锁定的内核版本）在隔离 `DSH_HOME` 上复跑
+  `compat-1016-live-check.mjs`：**21/21**；注入 `chars=292 / budget=4000`、`state` p95 1.09 ms、
+  SSE 首帧 0.71 ms。证据文件 `dsh-memory-verification/out/compat-1016-live-rc4-audit.json`。
+
+### 文档
+
+- README「请求来源防护」新增一节：**DSH Go 的鉴权来自平台补丁** `runtime/patches/route-guard.diff`
+  （钉在 `0.2.1-rc.4`），在 `route.handler` 之前对 `exact`/`prefix` 路由统一执行
+  `connection.requestRejection()`，缺 cookie → 401、`connection` 未挂载 → 503；
+  并写明这层保护是**平台属性**——手动 `dsh web` 不带 `--patch`、或升级到锚点对不上的内核，
+  就会回退成"仅回环、无鉴权"。
+- README「兼容性」新增「在 DSH Go（Android）上运行」：引擎经 `/usr/bin/env -i` 启动，
+  `HOME=/root`、`DSH_HOME=/root/.dsh`（App 侧设置的 `HOME` 对引擎无效）；数据落在
+  `/root/.dsh/instruction-memory/memory.json`（App 私有、与桌面端不共享）；配置入口是网页岛
+  （本插件没有 config schema）；发现页索引 `api.dshfind.com/market/dsh-index.json` 仍只登记
+  `1.4.2`，要最新版需在 guest shell 里 `dsh plugin --profile web add dsh-instruction-memory`。
+
+## [1.4.6] — 2026-10-30
+
+针对 1.4.5 的三方复核（架构 / 安全 / 验收）结论做的修复版本。安全面**没有新增对外暴露**，
+下面的每一条都是"本该做对但做漏了"的一致性缺陷；无鉴权路由属已知设计取舍，本版不改。
+
+### 修复
+
+- **非回环绑定的 `Origin` 校验此前是自证**（`requestOriginVerdict`）：绑定具体地址时 Host 校验
+  关闭，而 `Origin` 仍与**请求自带的 `Host`** 比较——两者都由攻击者提供，于是
+  `Host: attacker.example` + `Origin: http://attacker.example` 在 LAN 绑定上直接通过。现在绑定
+  具体地址时 `Origin` 必须等于**该绑定地址**；通配绑定（`0.0.0.0` / `::`）仍无从得知合法来源，
+  行为不变。回环绑定不受影响，`127.0.0.1` / `localhost` / `[::1]` / `[::ffff:127.0.0.1]` 互访照旧。
+- **`export-to-dir` 的成功消息泄露绝对路径**：消息里回的是 `已写入 C:\Users\<账号>\...`，而同
+  一响应的 `storage.path` 早已折叠——1.4.4 的路径折叠漏了这条命令。现在同样折叠。
+- **`storage.migratedFrom` 未折叠**：迁移提示里的旧库绝对路径原样下发，现与其它路径字段一致。
+- **`displayPath` 大小写敏感**：Windows 上 `c:\users\me` 与 `C:\Users\me` 是同一目录，早期按
+  字符串前缀比较，大小写不同就不折叠，等于把原始家目录漏出去。现在 Windows 路径比较不区分大小写。
+- **错误文本的折叠与快照不一致**：`describeErrorSafe` 在 Windows 折成 `~`，而快照字段用
+  `%USERPROFILE%`（资源管理器/CMD 都会展开，`~` 不会）。两者统一为同一 token。
+- **`install.mjs` 在读写 manifest 之前就动了文件系统**：`--remove` 先删 junction 再解析
+  `package.json`，安装分支先建 junction/滚备份再解析——一个损坏的 manifest 就留下"依赖还在、
+  junction 没了"的半状态，而脚本只抛一个 JSON 解析错误。现在两种情况都**先解析、后动手**，
+  失败时明确指向 `.bak` 备份且不改动任何文件。
+
+### 明确未修
+
+- **设置路由没有鉴权**：插件路由挂在宿主 Web 服务器上，宿主只保护自己的路由（无 token 时 `/` 返回
+  401），插件这条路径仍是同端口无鉴权可读写。宿主 `0.2.1-rc.5` 未提供任何鉴权 API，插件层无法
+  自行补上而不与宿主 token 逻辑打架。默认回环绑定下只有本机可达；`--host <LAN IP>` 时才暴露到
+  网络，README「对外发布」一节已标注。本版不声称此项已解决。
+
+### 测试
+
+- 新增断言：非回环绑定的 Host+Origin 伪造组合必须 403、回环绑定的映射地址写法仍须放行、
+  `export-to-dir` 消息与快照全部路径字段不含原始家目录、Windows 不同大小写的家目录仍折叠、
+  `install.mjs` 在 manifest 损坏时（装/卸两个方向）不改动文件系统并给出恢复指引。
+- 契约范围表补入 `0.2.1-rc.5`（本轮复核的宿主版本）。
+- 全套 6 个套件 945 条断言通过。
 ## [1.4.5] — 2026-10-29
 
 对 1.4.4 发布物与最新桌面端 / 网页端复核（桌面 `0.2.1-rc.3`，网页 `0.2.1-rc.4` 与

package/README.md

@@ -215,7 +215,9 @@ DSH 就会得到第二份空记忆，看起来像"记忆消失"。相对的 `$DS
 > "没活干还在动"的副作用。现在文件由**第一个真正需要它的动作**创建：一次保存、一次导入，
 > 或设置页读取 `state`（面板打开时就会读）。
 
-> **快照里的路径是折叠过的**（1.4.4 起）：`storage.path` / `backupPath` / `historyDir` / `schemaFile` 都把家目录折叠成**平台可用的占位符**——1.4.5 起 Windows 为 `%USERPROFILE%`（资源管理器、CMD、PowerShell 都会展开；1.4.4 曾用 `~`，但资源管理器不展开它），macOS/Linux 为 `~`——只用于显示；读写、备份、监听仍用绝对路径。
+> **快照里的路径是折叠过的**（1.4.4 起）：`storage.path` / `backupPath` / `historyDir` / `schemaFile` / `backupDir` / `migratedFrom`，以及 `export-to-dir` 成功消息里的目标路径（1.4.6 起）都把家目录折叠成**平台可用的占位符**——1.4.5 起 Windows 为 `%USERPROFILE%`（资源管理器、CMD、PowerShell 都会展开；1.4.4 曾用 `~`，但资源管理器不展开它），macOS/Linux 为 `~`——只用于显示；读写、备份、监听仍用绝对路径。
+> 折叠在 Windows 上**大小写不敏感**（`c:\users\me` 与 `C:\Users\me` 是同一个目录，早期实现按字符串前缀比较，换个大小写就把原始家目录漏了出去）。
+> **`install.mjs` 先读 `package.json` 再动文件系统**（1.4.6 起）：装/卸都如此。早期先把 junction 建好（或删掉）再解析 manifest，一个损坏的 `package.json` 就能留下"依赖还在、junction 没了"（或反过来）的半状态，而脚本当时只抛一个 JSON 解析错误。
 > `injection.available` 也不再恒为 `true`——提示词区块注册失败时它是 `false`。
 > 设置页依赖宿主的 `slots` 服务：`@deepseek-ai/cordis` 没有"可选注入"，所以这是硬依赖，
 > 宿主不提供时插件不装载设置页（只打印一行说明）。
@@ -549,6 +551,7 @@ DNS 重绑定恰好推翻了它**：`evil.com` 解析到 `127.0.0.1` 之后，
 ```
 
 - 绑定到**任何非回环地址**（`--host 0.0.0.0`、`::` 或具体 IP，即主动对外发布）时 Host 校验**自动关闭**——那种情况下无法预知合法 Host，强行限制只会打断所有正常客户端；`Origin` 校验仍然生效。
+  但"仍然生效"必须拿**对的对象**比：`Host` 此刻受攻击者控制，把 `Origin` 与它相比等于自己跟自己比。1.4.6 起，绑定的是**具体地址**（不是 `0.0.0.0` / `::` 这种通配）时，`Origin` 的主机名必须等于**该绑定地址**（可用 DNS 名或 IP，`::1` / `::ffff:127.0.0.1` 这类同一地址的不同写法仍然等价）。回环绑定不受此改动影响：那里 Host 已被限制在回环名单内，客户端用 `127.0.0.1`、`localhost`、`[::1]` 或 `[::ffff:127.0.0.1]` 访问都能继续工作。
 - 无 `Host` 的 HTTP/1.1 请求由 Node 的 HTTP 解析器先以 400 拒掉，根本到不了路由。
 - **端口参与 `Origin` 比对**（早期版本忽略端口，于是 `127.0.0.1:1` 这种同主机不同端口的页面也算同源）：比对前先把默认端口归一（`http:80` / `https:443` 视同未写端口），其余情况要求 scheme、主机名、端口三者一致。`Host` 末尾的 FQDN 点（`localhost.`）会被忽略，避免同一台机器的两种写法被当成跨源。
 
@@ -583,6 +586,20 @@ DNS 重绑定恰好推翻了它**：`evil.com` 解析到 `127.0.0.1` 之后，
    路径前缀为 `/instruction-memory/api`，代理转发规则需覆盖它。
 5. **限制来源**：至少用代理层做 IP 白名单或加 Basic Auth——插件本身不提供任何鉴权。
 
+### 在 DSH Go（Android）上：鉴权来自平台补丁，不是本插件
+
+DSH Go 给官方 Web 服务器包了一层**构建期补丁** `runtime/patches/route-guard.diff`（钉在
+`0.2.1-rc.4`，`pins.json` 记了 before/after SHA-256，锚点对不上时构建直接失败）：它在
+`route.handler` 之前对**每一条命名路由**调用 `connection.requestRejection()`——`exact` 与
+`prefix` 都算，本插件的 `/instruction-memory/api` 属后者；放行名单只有 `/connect` 与
+`/oauth/callback`；缺 cookie → **401**，`connection` 尚未挂载 → **503**（fail-closed），拒绝响应
+带 `x-dsh-go-guard: reject`。因此 Android 上"同机其他 App 直接打本插件路由"这条路已被平台挡住；
+上面几节描述的"无鉴权"缺口只适用于桌面端 / 网页端的端口。
+
+⚠️ 这层保护是**平台属性，不是插件属性**：在 guest shell 里手动 `dsh web`（不带 `--patch`），
+或在 guest 内把内核升级到补丁锚点对不上的版本，鉴权就回退成"仅回环、无鉴权"。判断装机是否
+仍受保护，只看启动命令行里有没有 `--patch /etc/dsh-app/dsh-web.patch.yml`。
+
 ## 兼容性
 
 同一串范围写在**三处**，而**只有一处会被宿主强制执行**——这一点以前写错过，现在按实测更正：
@@ -719,6 +736,30 @@ FAIL  LIVE GUARD: the installed host 0.1.8-rc.1 is admitted by both modes  -> ..
 `host-range-test.mjs` 会断言 `peerDependencies` 与另外两处字段**逐字节一致**，并断言 peer 只声明这一个包名——
 三处任一被手改都会在测试里失败。
 
+### 在 DSH Go（Android）上运行
+
+DSH Go（Android 客户端）内置的引擎就是**真实 DSH**，锁定 `@deepseek-ai/dsh` **`0.2.1-rc.4`**
+（`runtime/locks/dsh-0.2.1-rc.4/package.json`），在 PRoot rootfs 内以
+`dsh web --patch /etc/dsh-app/dsh-web.patch.yml --host 127.0.0.1 --port N --no-open` 运行；
+环境经 `/usr/bin/env -i` 清空后只注入 `HOME=/root`、`DSH_HOME=/root/.dsh`——**App 侧设置的
+`HOME` 对引擎无效**，别按字面读 `DshProcess.kt`。
+
+- **兼容性**：`0.2.1-rc.4` 正好是上表①档已实测的版本。2026-10-31 又用同一个 rc.4 在隔离的
+  `DSH_HOME` 上复跑一遍 **21/21**（`compat-1016-live-check.mjs`），注入实测
+  `chars=292 / budget=4000`、`state` p95 1.09 ms、SSE 首帧 0.71 ms；证据
+  `dsh-memory-verification/out/compat-1016-live-rc4-audit.json`。
+- **数据位置**：`/root/.dsh/instruction-memory/memory.json`，在 App 私有目录的 rootfs 内，
+  与桌面端**不是同一份**；快照里的路径以 `~` 显示，不泄露绝对路径。卸载 App 会连 rootfs 一起清空，
+  卸载**插件**保留数据。
+- **配置入口**：原生设置页依赖 schema 表单，本插件没有 config schema，所以那一行点进去是
+  **网页岛**（WebView 里加载的官方 Web UI），`settings.section` 的落点在网页客户端里。
+  若从未打开过任何网页岛，这一行可能尚未出现。
+- **市场版本可能滞后**：DSH Go 的发现页只读 `api.dshfind.com/market/dsh-index.json`，该文件对本
+  插件在 2026-10-31 仍只登记 `1.4.2`（npm latest 已是 1.4.6）。要装最新版，在 guest shell 里执行
+  `dsh plugin --profile web add dsh-instruction-memory`，直接取 npm 上的版本。
+- **双端记忆不共享**：手机与"遥控 PC"各自维护自己的 `memory.json`，没有同步——这是当前形态，
+  不是缺陷。
+
 ## 发布（维护者）
 
 **正规流程是推 tag，由 CI 通过 OIDC（Trusted Publishing）发布**，不需要任何长期令牌：

package/install.mjs

@@ -43,6 +43,27 @@ function readPkg() {
   return JSON.parse(readFileSync(pkgPath, 'utf8'))
 }
 
+/**
+ * Read the profile manifest BEFORE touching anything on disk.
+ *
+ * Reading it late turned one unparsable `package.json` (interrupted write, hand
+ * edit, failed market install) into a half state: `--remove` had already
+ * unlinked the junction when the parse threw, and `install` had already created
+ * the junction and rolled the backup, so the profile either kept dependency
+ * entries for a plugin that is gone or listed a link that was never enabled.
+ * Failing first keeps the filesystem exactly as it was.
+ */
+function readPkgOrExit() {
+  try {
+    return readPkg()
+  } catch (err) {
+    console.error('cannot read ' + pkgPath + ': ' + (err && err.message ? err.message : String(err)))
+    console.error('  it is not valid JSON — an interrupted write or a hand edit is the usual cause.')
+    console.error('  nothing was changed. Restore it from ' + backupPath + ' and run this again.')
+    process.exit(1)
+  }
+}
+
 function writePkg(pkg) {
   writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n', 'utf8')
 }
@@ -56,6 +77,8 @@ function bundlesOf(pkg) {
 
 if (remove) {
   let touched = false
+  // Fail before any filesystem change: see readPkgOrExit.
+  const pkg = readPkgOrExit()
   // `link` is normally a junction, and unlinking one removes only the link —
   // the real package stays where it is. It can also be a REAL directory (pnpm
   // materialises `link:` dependencies into node_modules as a copy), and there
@@ -97,7 +120,6 @@ if (remove) {
     console.log('\nNOT UNINSTALLED — see the refusal above.')
     process.exit(process.exitCode)
   }
-  const pkg = readPkg()
   let changed = false
   if (pkg.dependencies !== undefined && Object.hasOwn(pkg.dependencies, NAME)) {
     delete pkg.dependencies[NAME]
@@ -137,6 +159,8 @@ if (!existsSync(join(PROF, 'package.json'))) {
   process.exit(1)
 }
 
+const pkg = readPkgOrExit()
+
 if (existsSync(link)) {
   console.log('junction already present: ' + link)
 } else {
@@ -159,7 +183,6 @@ if (existsSync(backupPath)) {
 copyFileSync(pkgPath, backupPath)
 console.log('backed up profile package.json -> ' + backupPath)
 
-const pkg = readPkg()
 let changed = false
 
 // Step 3: a link: dependency, so the market lists it under 「已安装」.

package/lib/client.js

@@ -3647,19 +3647,75 @@ window.__ModuleLoader__.load({
       return h('div', { className: 'im-root' }, header, list)
     }
 
+    const SLOT_RETRY_LIMIT = 20
+    const SLOT_RETRY_DELAY_MS = 50
+
+    /**
+     * Resolve the slot service, mounting the panel as soon as it exists.
+     *
+     * `slots` is a declared injection (see exports.inject below), so a host that
+     * honours declarations holds this plugin until the service is published. A
+     * host that resolves injections lazily — or publishes the service late —
+     * used to leave the panel silently missing: one console.error, no retry,
+     * and a settings page the user never sees while the plugin still looks
+     * installed. Retrying for ~1s covers that window; after the last attempt the
+     * failure is loud and names what is missing.
+     */
     function apply(ctx) {
       // Kept for lazy service lookups: the official locale service may be
       // published before or after this plugin activates.
       runtimeCtx = ctx
-      // `slots` is a declared injection (see exports.inject below), so the
-      // runtime holds this plugin until the slot service exists. The fallback
-      // covers a runtime that resolves injections lazily instead.
-      const slots = ctx.slots !== undefined ? ctx.slots : ctx.get('slots')
-      if (slots === undefined) {
-        console.error('[instruction-memory] slots service unavailable; settings page not registered')
+
+      const resolveSlots = () => (ctx.slots !== undefined ? ctx.slots : ctx.get('slots'))
+
+      // A retry can fire after the fiber was disposed (plugin disabled, host
+      // shutting down); registering into a dead context throws, and an uncaught
+      // throw inside a timer is invisible to the loader that would normally
+      // report it. Treat it as "nothing to mount" instead.
+      const safeMount = (target) => {
+        try {
+          mountPanel(ctx, target)
+          return true
+        } catch {
+          return false
+        }
+      }
+
+      const immediate = resolveSlots()
+      if (immediate !== undefined) {
+        safeMount(immediate)
         return
       }
 
+      let attempt = 0
+      const retry = () => {
+        attempt += 1
+        const late = resolveSlots()
+        if (late !== undefined) {
+          safeMount(late)
+          return
+        }
+        if (attempt >= SLOT_RETRY_LIMIT) {
+          console.error(
+            '[instruction-memory] slots service unavailable after '
+            + (SLOT_RETRY_LIMIT * SLOT_RETRY_DELAY_MS) + 'ms of retries; settings page not registered',
+          )
+          return
+        }
+        schedule(retry)
+      }
+      schedule(retry)
+    }
+
+    function schedule(fn) {
+      const timer = setTimeout(fn, SLOT_RETRY_DELAY_MS)
+      // Never hold a process open just to finish retrying.
+      if (timer !== null && typeof timer === 'object' && typeof timer.unref === 'function') timer.unref()
+      return timer
+    }
+
+    function mountPanel(ctx, slots) {
+
       // Own stylesheet: one <style> element created and removed with this fiber.
       const styleEl = document.createElement('style')
       styleEl.setAttribute('data-dsh-plugin', 'instruction-memory')

package/lib/index.js

@@ -210,8 +210,13 @@ export function displayPath(value, home = homedir(), platform = process.platform
   const base = home.endsWith(sep) ? home.slice(0, -sep.length) : home
   if (base === '') return value
   const token = platform === 'win32' ? '%USERPROFILE%' : '~'
-  if (value === base) return token
-  if (value.startsWith(base + sep)) return token + value.slice(base.length)
+  // Windows paths are case-insensitive: `c:\users\me` is the same directory as
+  // `C:\Users\me`, and a mismatch here would silently publish the raw home.
+  const fold = platform === 'win32' ? (text) => text.toLowerCase() : (text) => text
+  const cmpValue = fold(value)
+  const cmpBase = fold(base)
+  if (cmpValue === cmpBase) return token
+  if (cmpValue.startsWith(cmpBase + sep)) return token + value.slice(base.length)
   return value
 }
 
@@ -1098,6 +1103,20 @@ const isLoopbackName = (name) => {
   return false
 }
 
+/**
+ * Whether a bind address accepts every local address instead of naming one.
+ *
+ * Only a concrete bind address tells us which authority a legitimate client
+ * must use; `0.0.0.0`, `::` (and the empty default) tell us nothing, because the
+ * client may legitimately have reached any of this machine's addresses.
+ */
+export function isWildcardBindHost(value) {
+  const name = normalizeHostname(String(value === undefined || value === null ? '' : value).trim().toLowerCase())
+  if (name === '' || name === '*' || name === '0.0.0.0') return true
+  const canonical = canonicalIp(name)
+  return canonical !== null && /^(:?0{4}:){7}0{4}$/.test(canonical)
+}
+
 /**
  * Why the settings-page route checks `Host`, `Origin` and `Sec-Fetch-Site` at
  * all, when it already refuses any content-type that is not
@@ -1136,8 +1155,15 @@ const isLoopbackName = (name) => {
  * same origin, so nothing legitimate is lost. On a non-loopback bind the server
  * may sit behind a proxy that legitimately rewrites ports, so the same-site
  * rule is left off there and the README documents the trade-off.
+ *
+ * When the server is bound to a CONCRETE address (`--host 192.168.1.5`), that
+ * address — not the request's `Host` header — is the authority a browser had to
+ * use, so `Origin` must match it. Comparing `Origin` with `Host` is worthless
+ * there: both are attacker-controlled, so a published deployment used to accept
+ * `Host: attacker.example` plus `Origin: attacker.example`. Wildcard binds keep
+ * the old comparison, because the address the client used is unknowable then.
  */
-export function requestOriginVerdict(headers, guarded) {
+export function requestOriginVerdict(headers, guarded, expectedHostname = '') {
   const read = (name) => {
     if (headers === null || typeof headers !== 'object') return ''
     const value = headers[name]
@@ -1177,8 +1203,23 @@ export function requestOriginVerdict(headers, guarded) {
     // (sandboxed iframe, file://) parses to no hostname and is refused.
     // Canonical IP comparison covers the two spellings of one address:
     // ::1 vs [::1], and ::ffff:127.0.0.1 vs ::ffff:7f00:1.
-    if (originHostname === '' || !sameHostname(originHostname, requestHostname)) {
-      return { ok: false, reason: 'Origin 与 Host 不同源：' + origin }
+    // On a NON-loopback bind the request's own Host header proves nothing: it is
+    // attacker-controlled and the loopback allowlist is off, so the Origin is
+    // held to the concrete address the server actually bound instead.
+    //
+    // On a loopback bind the allowlist has already restricted Host to loopback
+    // names, and aliasing is legitimate there: a client may reach the same
+    // server as ::1, 127.0.0.1 or ::ffff:127.0.0.1, and comparing Origin to Host
+    // is what keeps those spellings working (the mapped/hex forms canonicalise).
+    const expected = !guarded && typeof expectedHostname === 'string' ? expectedHostname : ''
+    const authority = expected !== '' ? expected : requestHostname
+    if (originHostname === '' || !sameHostname(originHostname, authority)) {
+      return {
+        ok: false,
+        reason: expected !== ''
+          ? 'Origin 与服务端绑定的地址不一致：' + origin + '（绑定 ' + expected + '）'
+          : 'Origin 与 Host 不同源：' + origin,
+      }
     }
     // On loopback the port IS part of the origin, and a different local port is
     // a different application: refuse it when both sides state one. Skipped on
@@ -1647,6 +1688,12 @@ export function apply(ctx) {
    * temporal-dead-zone hazard (F12 publishes it as `security.hostGuarded`).
    */
   let guardHost = true
+  /**
+   * The authority a browser had to use to reach this route, when the bind
+   * address is concrete (`192.168.1.5`, `[::1]`). Empty for a wildcard/unknown
+   * bind, where `Origin` can only be compared with the request's `Host`.
+   */
+  let expectedOriginHostname = ''
   /**
    * F7: the pending mute-expiry timer, or null. Re-armed by scheduleMuteTimer
    * (from syncSection) and cleared in the effect cleanup.
@@ -1702,7 +1749,11 @@ export function apply(ctx) {
     if (storeDir !== '' && storeDir !== '.') text = text.split(storeDir).join('<记忆目录>')
     try {
       const home = homedir()
-      if (typeof home === 'string' && home !== '') text = text.split(home).join('~')
+      // Same token as `displayPath` so a folded path looks identical wherever
+      // the user meets it (snapshot fields and error text).
+      if (typeof home === 'string' && home !== '') {
+        text = text.split(home).join(process.platform === 'win32' ? '%USERPROFILE%' : '~')
+      }
     } catch {
       // No home to redact: keep the text as it is.
     }
@@ -2908,7 +2959,7 @@ export function apply(ctx) {
         error: state.storageError,
         warning: state.storageWarning !== null ? state.storageWarning : state.backupError,
         savedAt: state.savedAt,
-        migratedFrom: state.migratedFrom,
+        migratedFrom: state.migratedFrom === null ? null : displayPath(state.migratedFrom),
         /** false until the store file has actually been written (see readFromDisk step 3). */
         onDisk: state.storeExists,
         /** Backup location (F18): '' means "next to the store file". */
@@ -3831,7 +3882,7 @@ export function apply(ctx) {
     } catch (err) {
       return { ok: false, saved: false, message: '写入备份目录失败：' + describeErrorSafe(err), snapshot: snapshot() }
     }
-    return { ok: true, saved: false, message: '已写入 ' + target, snapshot: snapshot() }
+    return { ok: true, saved: false, message: '已写入 ' + displayPath(target), snapshot: snapshot() }
   })
 
   /**
@@ -4492,7 +4543,7 @@ export function apply(ctx) {
    * `?lite=1` gets `{ rev, lite: true }` frames instead (see pushSnapshot).
    */
   const handleEventStream = (req, res) => {
-    const verdict = requestOriginVerdict(req.headers, guardHost)
+    const verdict = requestOriginVerdict(req.headers, guardHost, expectedOriginHostname)
     if (!verdict.ok) {
       logInfo('route rejected a request: ' + verdict.reason)
       res.writeHead(403, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
@@ -4601,7 +4652,7 @@ export function apply(ctx) {
     // Origin/Host guard, before anything else is read. See
     // requestOriginVerdict() for why the content-type rule below is not enough
     // on its own.
-    const verdict = requestOriginVerdict(req.headers, guardHost)
+    const verdict = requestOriginVerdict(req.headers, guardHost, expectedOriginHostname)
     if (!verdict.ok) {
       logInfo('route rejected a request: ' + verdict.reason)
       res.writeHead(403, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
@@ -4702,6 +4753,9 @@ export function apply(ctx) {
     // the README.
     const boundHost = typeof webServer.host === 'string' ? webServer.host.trim().toLowerCase() : ''
     guardHost = boundHost === '' || isLoopbackName(boundHost)
+    // A concrete address names the authority a legitimate client had to use, so
+    // the Origin check can hold it to that instead of to a spoofable Host.
+    expectedOriginHostname = isWildcardBindHost(boundHost) ? '' : normalizeHostname(boundHost)
     // F12: the settings page can only warn about a non-loopback bind if the
     // snapshot carries what the route actually saw at registration time.
     state.boundHost = boundHost

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-instruction-memory",
-  "version": "1.4.5",
+  "version": "1.4.7",
   "description": "User-only instruction memory for DSH: long-term instructions maintained in the settings UI and auto-injected into every conversation — the model has no write access. 指令记忆：只由用户在设置页维护的长期指令，自动注入此后每轮对话；模型没有任何写入口。",
   "license": "MIT",
   "type": "module",