dsh-instruction-memory 1.5.4 → 1.5.6

package/CHANGELOG.md

@@ -7,6 +7,73 @@
 > 1.0.13 起由 CI 经 OIDC Trusted Publishing 发布（首个带 provenance 的版本）。
 > 这些历史 tag **不应回填**——npm 上的版本号已被占用。
 
+## [1.5.6] — 2026-11-13
+
+### 新增
+
+- **导出可以真正落到文件（仅在 DSH Go 里生效）**：`doExport()` 现在先探测 `window.DshGoIsland`
+  ——那是 DSH Go 的 island 桥。存在时把 JSON 按 6,000 字符一块（不切断代理对）`postMessage` 给 App，
+  由 App 写文件并唤起系统分享面板，面板提示「已交给 DSH Go 保存」。不存在时行为不变：普通 WebView
+  回退到面板内 JSON，浏览器/Electron 仍是 `<a download>`。
+  壳侧需要配套补丁（island 协议新增 `t:'save'` 分块消息），已在仓库外单独产出，见
+  `D:\Users\34332\AI\dsh-go-patch\README-PATCH.md`；本仓库不含任何上游代码。
+
+### 文档更正
+
+只改文档的部分，**更正 1.5.5 发布说明里两处对 DSH Go 壳的描述**——都是读源码（`ccch1mneyyy/dsh-go`，2026-11-12）后确认写错的：
+
+- **引擎环境不是 `/usr/bin/env -i`**：壳用 `ProcessBuilder`，`environment().clear()` 后逐项填
+  `PATH/HOME/TMPDIR/ANDROID_ROOT/ANDROID_DATA/PROOT_TMP_DIR`，再合并运行时清单的 `launchEnv`。
+  `HOME` 是 App 的 `filesDir`，不是 `/root`。结论不变（宿主变量不继承、备份开关仍不可达），
+  但机制与取值之前写错了。
+- **文件选择器壳里已经实现**：`island_handle.dart:197` 的 `_files.attach()` →
+  `web_file_chooser.dart:26` 的 `setOnShowFileSelector` → 原生 `dsh/web-files` 通道
+  （content:// 校验、按文档代际取消）。所以 1.5.5 里"导入依赖文件选择器、壳没实现"的说法不成立；
+  面板那行提示保留为兜底（非 http(s) 页面、`canChoose()` 为假、旧版 App）。
+
+仍未实现、且确实在壳侧的只有三件：**导出用的保存/分享桥**（island 消息协议上限 16 KB，需分块）、
+`onJsPrompt`（webview_flutter 不暴露，插件已绕开，可不做）、**备份开关的环境变量**（壳能加，现未加）。
+
+## [1.5.5] — 2026-11-12
+
+DSH Go（Android / WebView）适配。**没有真机验证**（本机 `adb devices` 为空），所以这一版只做
+"插件侧能自救的部分"：把所有**静默失败**变成可见的降级路径，其余列给平台侧。存储格式、注入文本
+与面板在浏览器/桌面上的行为均不变。
+
+### 修复（Android / WebView 静默失败）
+
+- **导出在 WebView 上点了没反应**（P1）：`<a download>` 只在宿主实现 `DownloadListener` 时才有
+  意义，且 Chromium WebView 拿不到 `blob:` 的字节。现在识别 WebView 后不再点那个必然失败的链接，
+  直接把完整 JSON 渲染在面板里（可全选复制）；非 WebView 路径补上「已开始下载」反馈。
+- **导入 / 从备份恢复依赖文件选择器**（P1）：WebView 未实现 `onShowFileChooser` 时点击完全无反应。
+  面板在 WebView 上常驻一行提示，指向不依赖任何原生能力的「源码模式」粘贴通道。
+- **批量加标签被误判成"用户取消"**（P1）：这段判定当初是为 Electron（`prompt` 抛错）写的；Android
+  WebView 是第四种形态——`typeof === 'function'`、不抛错、但返回 `null` 且不弹框。现在 WebView 上
+  把 `null` 判为"问不了"，直接走内联输入框。
+- **SSE 断流后静默陈旧**（P2）：连续 6 次（≈30 秒）订阅失败后显示「实时更新已断开，请重新载入」，
+  收到下一帧自动清除。此前只有手动「重新载入」能救。同时给事件流 socket 打开 TCP keepalive 与
+  `setNoDelay`，让被系统杀掉的 WebView 能被 OS 更快发现（半开连接占满 32 条上限的窗口收窄）。
+
+### 加固
+
+- **新增 fail-closed 开关** `DSH_INSTRUCTION_MEMORY_REQUIRE_AUTH_FENCE=1`：缺少宿主 `connection`
+  服务时直接 503，而不是退回"仅回环"。Android 的回环由整机共享，"仅回环"在手机上不构成边界。
+- **备份目录的提示在 Linux / Android 上不再给死指令**：原来一律让用户"设置环境变量后重启宿主"，
+  而 DSH Go 用 `/usr/bin/env -i` 启动引擎，那条路根本走不通；现在补一句"该变量设不了，请改用
+  「导出」复制 JSON"。
+
+### 其它
+
+- 面板 `-webkit-text-size-adjust:100%`（挡住 Android 系统字号把固定 px 卡片排成乱行）、挂载失败
+  提示避开 `env(safe-area-inset-bottom)`。
+- `docs/demo.html` 进入 npm 发布物（手机上可直接打开预演布局）。
+
+### 测试
+
+- `contract-test.mjs`：新增 fail-closed 三连断言（开开关 503 / 文案点名开关 / 关掉同一 handler 恢复
+  200），确保"503 是开关造成的"而不是别的原因。
+- `ui-test.mjs`：新增「6 次流错误后必须出现重新载入提示」，并在同一渲染里验证订阅的是 `?lite=1`。
+
 ## [1.5.4] — 2026-11-12
 
 2026-11-12 的三方评审（架构 / 安全 / 验收，桌面端 0.2.2-rc.1 + 网页端同进程）落地的一轮修复。

package/README.md

@@ -67,7 +67,7 @@ profile 的解析顺序是 **`$DSH_PROFILE_DIR` → `--profile <名字>` → `$D
 | `host-range-test.mjs` | 宿主版本范围契约测试：固定矩阵 × 两种 semver 判定模式，并把 `peerDependencies`（**被执行的那个**）、`dsh.engines.dsh`、`dsh.compatibility.dsh` 三处声明锁到同一个生成值 |
 | `lint.mjs` | 静态门禁，已并入 `npm test`：`node --check` 解析所有随包发布与本仓库运行的 JS 文件，并断言 `lib/` 里不出现 `@deepseek-ai/*` 的包名导入（插件只该通过宿主传进来的上下文对象接触宿主，按包名 import 会把插件钉死在某个安装位置，在 headless / CI / 检出目录里直接解析失败） |
 | `live-host-smoke.mjs` | 双端冒烟（**1.4.8 起宿主有鉴权门，需 `--token <启动 token>` 换会话 cookie**，否则全 401）：对**正在运行**的 web / 桌面宿主各测 `state` p50/p95、SSE 首事件、注入注册与字符数，并比对两端快照（除 `injection.pulls` 外须逐字段相同）；`npm run smoke:hosts`，`--require-pulls` 可把「从未经历真实 Agent 回合」判为失败。单宿主拓扑（桌面应用自己服务 `11685`）用 `--base http://127.0.0.1:11685`，parity 会**显式跳过**而不是假装比过；`--web` / `--desktop` 各选一端，同时给直接报错、零探测时打印 `NO HOST PROBED` 而不是 `ALL CHECKS PASSED`。**刻意不进 `npm test`**——CI 没有桌面端。请求走 Node `http` 直连，绕开 `http_proxy`（否则回环请求也会被代理转发，读数虚高） |
-| `docs/demo.html` | 离线演示页：桩掉 DSH 外壳、加载真实 Client 半渲染设置页（不随 npm 包发布） |
+| `docs/demo.html` | 离线演示页：桩掉 DSH 外壳、加载真实 Client 半渲染设置页（1.5.5 起随 npm 包发布，手机上也能直接打开预演布局） |
 | `memory.schema.json` | 手改存储文件用的 JSON Schema（随包发布，并被宿主复制到 `memory.json` 旁边） |
 
 ## 生效方式
@@ -457,6 +457,9 @@ DSH 就会得到第二份空记忆，看起来像"记忆消失"。相对的 `$DS
   把这些设置放在别的盘（比如 Windows 上的 D:）就得显式打开：
   `DSH_INSTRUCTION_MEMORY_ALLOW_EXTERNAL_BACKUP=1`（重启宿主生效）。导出目录受同一条限制；
   手改存储文件把 `backupDir` 指到外面也同样被拒——这条路不能变成创建任意目录的通道。
+  **在 Linux / Android 上这句话会说全**：DSH Go 用 `/usr/bin/env -i` 启动引擎，用户根本没有
+  设置该变量的途径，因此提示会补上"该变量设不了，请改用「导出」把 JSON 复制出来备份"，
+  而不是给一条无法执行的指令（1.5.5 起）。
   这条规则在**写入时**也执行，不只在校验时：设置页、导出、以及每次保存附带的 `.bak` 与历史
   快照都走同一个判断（1.5.1 起）。检测到越界的外来 `backupDir` 会被忽略并**在面板上披露**，
   备份与快照写回默认位置，而不是在外目录里悄悄留下文件。
@@ -787,6 +790,10 @@ nginx / Caddy 等反向代理之后远程访问，需要注意：
 5. **限制来源**：至少用代理层做 IP 白名单或加 Basic Auth——插件本身不带任何鉴权，它只会
    转用宿主发布的 `connection` 服务（没有该服务时非回环绑定直接 503）。
 
+> **手机 / 多租户环境请打开 fail-closed**：设 `DSH_INSTRUCTION_MEMORY_REQUIRE_AUTH_FENCE=1`
+> 后，"没有 `connection` 服务"直接变成 **503**，而不再退回"仅回环"。桌面单用户机器上回环还能
+> 当边界用；Android 上不能——整机共享回环命名空间，任何装了 App 的程序都能连 127.0.0.1。
+
 > **桌面端渲染器 origin 的一个已知边界**（2026-11-12 实测）：宿主对 `Origin: dsh-app://app`
 > 的请求返回 **403**，本插件在没有 `connection` 服务时的自判（`requestOriginVerdict`）同样拒绝
 > 该 origin（它按 Origin ↔ Host 同源比较）。当前桌面窗口发的是 `http://127.0.0.1:<port>`，
@@ -949,9 +956,14 @@ FAIL  LIVE GUARD: the installed host 0.1.8-rc.1 is admitted by both modes  -> ..
 
 DSH Go（Android 客户端）内置的引擎就是**真实 DSH**，锁定 `@deepseek-ai/dsh` **`0.2.1-rc.4`**
 （`runtime/locks/dsh-0.2.1-rc.4/package.json`），在 PRoot rootfs 内以
-`dsh web --patch /etc/dsh-app/dsh-web.patch.yml --host 127.0.0.1 --port N --no-open` 运行；
-环境经 `/usr/bin/env -i` 清空后只注入 `HOME=/root`、`DSH_HOME=/root/.dsh`——**App 侧设置的
-`HOME` 对引擎无效**，别按字面读 `DshProcess.kt`。
+`dsh web --patch /etc/dsh-app/dsh-web.patch.yml --host 127.0.0.1 --port N --no-open` 运行。
+
+引擎进程的环境**不是** `/usr/bin/env -i`（早先这里写错了，2026-11-12 读源码更正）：壳用
+`ProcessBuilder(argv)`，先 `environment().clear()`，再逐个填 `PATH` / `HOME`（= **App 的
+`filesDir`**，不是 `/root`）/ `TMPDIR` / `ANDROID_ROOT` / `ANDROID_DATA` / `PROOT_TMP_DIR`，
+最后合并运行时清单的 `launchEnv` 与 guest 环境（`DshProcess.kt:172-188`）。也就是说：宿主变量
+一律不继承（这一点与 `env -i` 等效），但**壳想加什么变量都能加**——只是它目前没有加
+`DSH_INSTRUCTION_MEMORY_ALLOW_EXTERNAL_BACKUP`，所以备份目录开关在手机上仍然不可达。
 
 - **兼容性**：`0.2.1-rc.4` 正好是上表①档已实测的版本。2026-10-31 又用同一个 rc.4 在隔离的
   `DSH_HOME` 上复跑一遍 **21/21**（`compat-1016-live-check.mjs`；1.5.1 起该脚本第四个参数给启动
@@ -970,6 +982,40 @@ DSH Go（Android 客户端）内置的引擎就是**真实 DSH**，锁定 `@deep
 - **双端记忆不共享**：手机与"遥控 PC"各自维护自己的 `memory.json`，没有同步——这是当前形态，
   不是缺陷。
 
+#### Android / WebView 适配（1.5.5 起）
+
+WebView 不是浏览器：它能把 `window.prompt` 保留成函数却永不弹框，能暴露 `<a download>` 却没有
+下载管线。这两处以前都是**点了没反应、也不报错**，而它们恰好是手机上数据进出口的一半。现在插件侧
+这样处理：
+
+| 场景 | WebView 上的行为 | 依据 |
+| --- | --- | --- |
+| 导出 | 不再点击一个必然失败的链接，直接把完整 JSON 渲染在面板里（全选即可复制） | `client.js` 的 `isAndroidWebView()` + `exportFallback` 分支 |
+| 导入 / 从备份恢复 | **壳已实现文件选择**（`island_handle.dart:197` 的 `_files.attach()` → `web_file_chooser.dart:26` 的 `setOnShowFileSelector` → 原生 `dsh/web-files` 通道，content:// 校验 + 按文档代际取消）；面板那行提示只是兜底：页面不是 http(s)、`canChoose()` 为假、或旧版 App 时，请改用「源码模式」粘贴 JSON | 2026-11-12 读 DSH Go 源码确认 |
+| 批量加标签 | 不再调用 `window.prompt`：WebView 返回的 `null` 被判为"问不了"，直接走内联输入框 | `batchTagOutcome(..., { nullMeansUnavailable: true })` |
+| 实时更新 | 连续 6 次（≈30 秒）订阅失败后显示「实时更新已断开，请重新载入」；收到下一帧自动清除 | `source.onerror` 计数 |
+| 字号 / 手势条 | `text-size-adjust:100%` 挡住系统字号重排；挂载失败提示避开安全区 | CSS |
+
+**插件侧做不到、必须平台提供的**（逐条都已核对 DSH Go 源码）：
+
+1. **保存/分享桥**：`<a download>` 的 `blob:` 字节 WebView 不会交给 `DownloadListener`，插件无法
+   自救。壳已有 `DshGoIsland` 通道和 `share_plus`，但没有任何"把这段文本存成文件"的消息类型 →
+   要新增一条（注意 island 消息协议上限只有 **16 KB**，`IslandMessageLimits.maxBytes`，而一次导出
+   可达 MB 级，必须分块）。
+2. **`onJsPrompt`**：webview_flutter 不暴露 JS 对话框，壳也没包 `WebChromeClient`；插件已改走内联
+   表单，所以**这是可选项**，不做也不影响功能。
+3. **环境变量白名单**：壳会 `environment().clear()` 后逐项填（`DshProcess.kt:172-188`），加一个
+   `DSH_INSTRUCTION_MEMORY_ALLOW_EXTERNAL_BACKUP=1` 就能让备份目录走出 rootfs。
+4. **WebView 销毁/后台时关闭 SSE**，否则半开连接会占满 32 条上限。
+
+**纵深开关**：Android 的回环是全机共享的，没有宿主鉴权门时"仅回环"不构成边界。设置
+`DSH_INSTRUCTION_MEMORY_REQUIRE_AUTH_FENCE=1` 后，缺少 `connection` 服务的 profile **直接
+503**（fail-closed），宁可设置页打不开，也不留一个可被同机任何 App 改写的长期指令入口。
+
+> **证据等级**：以上为代码级适配，`adb devices` 在本机为空，**没有任何真机验证**。
+> 真机验收顺序见 `dsh-memory-verification/DSH-VERSION-COMPAT.md`；第一条永远先确认平台门在位
+> （无 cookie 请求必须返回 `401` 且带 `x-dsh-go-guard: reject`），否则后续结论都不成立。
+
 ## 发布（维护者）
 
 **正规流程是推 tag，由 CI 通过 OIDC（Trusted Publishing）发布**，不需要任何长期令牌：

package/docs/demo.html

@@ -0,0 +1,671 @@
+<!doctype html>
+<html lang="zh-CN">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>dsh-instruction-memory 设置页演示</title>
+<script src="vendor/react.production.min.js"></script>
+<script src="vendor/react-dom.production.min.js"></script>
+<style>
+  body { margin:0; background:#f5f6f8; font-family:system-ui,-apple-system,'Segoe UI','PingFang SC','Microsoft YaHei',sans-serif; }
+  #root { max-width:920px; margin:28px auto 0; padding:0 16px; }
+</style>
+</head>
+<body>
+<div id="root"></div>
+
+<script>
+  // Minimal stand-ins for the DSH web shell: module loader + require.
+  window.__ModuleLoader__ = { load: (spec) => { window.__dshSpec = spec } }
+</script>
+
+<script>
+  // In-memory host that speaks the exact route envelope of lib/index.js, so
+  // this page exercises the REAL client module (loaded below) against
+  // realistic data — no backend needed.
+  var DEMO_STORE = {
+    version: 1,
+    enabled: true,
+    // Deliberately tight so the budget meter and the "本轮不注入" marks are
+    // visible immediately; raising it in the input clears them live.
+    budgetChars: 800,
+    entries: [
+      {
+        id: 'im-demo-lang',
+        title: '回答语言',
+        content: '所有回答默认使用简体中文；技术名词首次出现时在括号里附英文原文。',
+        mode: 'always', when: '', priority: 2, enabled: true, tags: ['沟通'],
+        updatedAt: Date.now() - 86400000 * 3,
+      },
+      {
+        id: 'im-demo-confirm',
+        title: '先确认再动手',
+        content: '需求不明确或存在多种合理实现时，先列出候选方案向用户确认，再开始修改代码。',
+        mode: 'always', when: '', priority: 1, enabled: true, tags: ['沟通', '工作流'],
+        updatedAt: Date.now() - 86400000 * 2,
+      },
+      {
+        id: 'im-demo-style',
+        title: '代码风格',
+        content: '修改代码时遵循该文件既有的缩进、命名密度与注释风格，不顺手重构无关代码；\n变量命名优先使用业务领域词汇而不是数据结构词汇，例如用「订单金额」而不是「data1」；\n新增依赖前先检查 package.json 中是否已有能力等价的依赖，避免重复引入；\n公共函数需要补充输入输出说明注释，但不为改动本身添加解释性注释；\n改动完成后运行项目现有的测试与 lint 检查，若有失败先修复再交付，不留下只改了一半的状态；\n涉及对外接口或数据结构变更时，先在回复中列出受影响的调用方，确认迁移路径后再提交。\n日志打印需带关键上下文（对象标识、入参摘要），不要只输出 "error" 这类无信息内容；\n异步任务必须设置超时与重试上限，不允许无限等待外部资源；\n对外错误信息要区分用户可操作的提示与内部诊断细节，不把堆栈直接暴露给调用方；\n代码评审先核对行为变化与测试覆盖，再讨论风格偏好，意见必须可执行、可验证；\n以上要求同样适用于纯重构类提交，重构前后行为必须完全一致。',
+        mode: 'auto', when: '编写或修改代码时', priority: 1, enabled: true, tags: ['代码规范'],
+        updatedAt: Date.now() - 86400000,
+      },
+      {
+        id: 'im-demo-reply',
+        title: '回复结构',
+        content: '较长的回答先给一句结论，再展开细节；方案对比先列差异再给推荐。',
+        mode: 'auto', when: '解释性问题与方案对比', priority: 0, enabled: false, tags: ['沟通'],
+        updatedAt: Date.now() - 3600000,
+      },
+    ],
+    profiles: [
+      {
+        id: 'pf-demo-bg',
+        name: '职业背景',
+        content: '有 8 年后端开发经验，熟悉 Java 与分布式系统；技术问题可以跳过入门概念，直接讲权衡与实现细节。',
+        enabled: true,
+        updatedAt: Date.now() - 86400000,
+      },
+      {
+        id: 'pf-demo-style',
+        name: '沟通偏好',
+        content: '喜欢先给结论、再给可执行步骤，少寒暄少铺陈。',
+        enabled: true,
+        updatedAt: Date.now() - 7200000,
+      },
+      {
+        id: 'pf-demo-goal',
+        name: '长期追求（停用示例）',
+        content: '希望代码评审意见都具体可执行，不要泛泛而谈。',
+        enabled: false,
+        updatedAt: Date.now() - 3600000,
+      },
+    ],
+  }
+
+  // F13 配置集：演示数据里放两套，好让「切换」真的改变注入内容。所有既有条目
+  // 归入「默认」，另加一条只属于「工作（示例）」的条目。
+  ;(function seedSets() {
+    DEMO_STORE.version = 2
+    DEMO_STORE.$schema = './memory.schema.json'
+    DEMO_STORE.backupDir = ''
+    DEMO_STORE.disabledUntil = 0
+    DEMO_STORE.activeSetId = 'st-demo-default'
+    DEMO_STORE.sets = [
+      { id: 'st-demo-default', name: '默认' },
+      { id: 'st-demo-work', name: '工作（示例）' },
+    ]
+    DEMO_STORE.entries.forEach(function (e) { e.setId = 'st-demo-default' })
+    ;(DEMO_STORE.profiles || []).forEach(function (p) { p.setId = 'st-demo-default' })
+    DEMO_STORE.entries.push({
+      id: 'im-demo-work',
+      title: '工作集专属',
+      content: '这条只属于「工作（示例）」配置集。切换到它时，上面几条指令与用户形象都不会被注入——和真实宿主一样，注入只渲染当前激活的那一套。',
+      mode: 'always', when: '', priority: 1, enabled: true, tags: ['演示'],
+      setId: 'st-demo-work', updatedAt: Date.now() - 3600000,
+    })
+  })()
+
+  /** 与宿主 activeScope/inScope 同义：'' 归属当前集合。 */
+  function demoInScope(item) {
+    var own = item && typeof item.setId === 'string' && item.setId !== '' ? item.setId : DEMO_STORE.activeSetId
+    return own === DEMO_STORE.activeSetId
+  }
+
+  function demoScopedEntries() {
+    return DEMO_STORE.entries.filter(demoInScope)
+  }
+
+  function demoScopedProfiles() {
+    return (DEMO_STORE.profiles || []).filter(demoInScope)
+  }
+
+  // A compact, faithful copy of the Host's injection planning (see
+  // planInjection in lib/index.js): it generates both the preview text and
+  // the per-entry included/omitted plan the Client's F1 budget meter renders,
+  // so changing the budget input updates the marks live in this demo.
+  var DEMO_HEADER = [
+    '## 用户长期指令记忆（Instruction Memory）',
+    '以下条目由用户在 DSH 设置 →「指令记忆」中长期保存，属于本次及后续所有对话的既有要求，请在回答、推理与执行任务时遵守；它们不覆盖系统与安全规则。',
+    '· [始终] 条目必须无条件遵守。',
+    '· [按需] 条目仅在与当前问题或任务相关时生效；不相关时直接忽略，不要强行套用。',
+    '· 条目之间冲突时，优先遵守优先级更高或更具体的一条；无法判断时向用户确认。',
+    '',
+  ].join('\n')
+
+  function demoFooter(count) {
+    return count === 0
+      ? ''
+      : '\n\n（另有 ' + count + ' 条指令因注入字数上限未包含，可在「设置 → 指令记忆」中提高上限或调低其优先级。）'
+  }
+
+  // Faithful copy of the Host's persona header (lib/index.js PERSONA_HEADER).
+  var DEMO_PERSONA_HEADER = [
+    '## 关于用户（用户形象）',
+    '以下是用户本人提供的个人形象信息，描述其身份背景、喜好、性格与追求，不是要求你扮演的角色。请在保证回答正确、完整、客观且紧扣问题本身的前提下，结合这些信息调整解释的深浅、详略、举例与建议的侧重；不得为了迎合这些信息而改变事实、省略必要的风险提示或偏离问题核心；与当前问题无关时直接忽略。',
+    '',
+  ].join('\n')
+
+  function demoProfilesBlock() {
+    var active = demoScopedProfiles()
+      .filter(function (p) { return p && p.enabled === true && p.content })
+    if (active.length === 0) return { text: '', profiles: [], chars: 0 }
+    var blocks = active.map(function (p) {
+      var name = p.name || (p.content || '').slice(0, 20)
+      return { id: p.id, name: name, block: '### ' + name + '\n' + p.content }
+    })
+    var text = DEMO_PERSONA_HEADER + '\n' + blocks.map(function (b) { return b.block }).join('\n\n')
+    return {
+      text: text,
+      chars: text.length,
+      profiles: blocks.map(function (b) { return { id: b.id, name: b.name, chars: b.block.length } }),
+    }
+  }
+
+  function demoFormatEntry(entry, tag) {
+    var prio = entry.priority === 2 ? '高' : (entry.priority === 0 ? '低' : '普通')
+    var lines = ['[' + tag + '｜优先级 ' + prio + '] ' + entry.title]
+    if (entry.mode === 'auto' && entry.when) lines.push('适用场景：' + entry.when)
+    lines.push(entry.content)
+    return lines.join('\n')
+  }
+
+    function demoPlan() {
+    var budget = DEMO_STORE.budgetChars
+    if (typeof budget !== 'number' || !isFinite(budget)) budget = 4000
+    if (budget < 800) budget = 800
+    if (budget > 40000) budget = 40000
+    var blank = function () {
+      return { text: '', budget: budget, activeCount: 0, included: [], omitted: [], profiles: [], profileChars: 0, entryChars: 0 }
+    }
+    if (DEMO_STORE.enabled !== true) return blank()
+    // F7 临时静音：与真实宿主同义——暂停中的计划与 enabled:false 逐字节相同。
+    if (typeof DEMO_STORE.disabledUntil === 'number' && DEMO_STORE.disabledUntil > Date.now()) return blank()
+    var persona = demoProfilesBlock()
+    var active = demoScopedEntries().filter(function (e) { return e.enabled && e.content !== '' })
+
+    var blocks = []
+    var included = []
+    var omittedPlan = []
+    var used = DEMO_HEADER.length
+    var omitted = 0
+
+    function consider(entry, tag) {
+      var block = demoFormatEntry(entry, tag)
+      var reserve = demoFooter(omitted + 1).length
+      if (used + block.length + 2 + reserve <= budget) {
+        used += block.length + 2
+        blocks.push(block)
+        included.push({ id: entry.id, chars: block.length, truncated: false })
+        return
+      }
+      if (blocks.length === 0) {
+        var room = budget - used - 2 - reserve
+        var note = '\n…（本条因注入字数上限被截断）'
+        if (room > note.length + 20) {
+          var head = block.slice(0, room - note.length)
+          var body = head + note
+          blocks.push(body)
+          used += body.length + 2
+          included.push({ id: entry.id, chars: body.length, truncated: true })
+          return
+        }
+      }
+      omitted += 1
+      omittedPlan.push({ id: entry.id, chars: block.length })
+    }
+
+    active.forEach(function (entry) { if (entry.mode === 'always') consider(entry, '始终') })
+    active.forEach(function (entry) { if (entry.mode !== 'always') consider(entry, '按需') })
+
+    var entryText = blocks.length === 0
+      ? ''
+      : DEMO_HEADER + blocks.join('\n\n') + demoFooter(omitted)
+    var parts = []
+    if (persona.text !== '') parts.push(persona.text)
+    if (entryText !== '') parts.push(entryText)
+    return {
+      text: parts.join('\n\n'),
+      budget: budget,
+      activeCount: active.length,
+      included: included,
+      omitted: omittedPlan,
+      profiles: persona.profiles,
+      profileChars: persona.chars,
+      entryChars: entryText.length,
+    }
+  }
+
+  /** Where a fresh set id comes from (mirrors the Host's st- prefix). */
+  function demoSetId() {
+    return 'st-demo-' + Math.random().toString(36).slice(2, 8)
+  }
+
+  function demoSnapshot() {
+    var plan = demoPlan()
+    // The panel edits and lists ONLY the active set (exactly like the real
+    // Host's snapshot), so a demo switch really empties the list.
+    // sets.total is the WHOLE-STORE count (same rule as the real host), so it
+    // is captured from DEMO_STORE BEFORE the scoped arrays replace these
+    // fields below — `data` aliases `full`, and counting after the reassign
+    // used to report the current-set numbers as the store-wide totals.
+    var totalEntries = (DEMO_STORE.entries || []).length
+    var totalProfiles = (DEMO_STORE.profiles || []).length
+    var full = JSON.parse(JSON.stringify(DEMO_STORE))
+    var data = full
+    data.entries = demoScopedEntries().map(function (e) { return JSON.parse(JSON.stringify(e)) })
+    data.profiles = demoScopedProfiles().map(function (p) { return JSON.parse(JSON.stringify(p)) })
+    var belongsTo = function (item, id) {
+      var own = item && typeof item.setId === 'string' && item.setId !== '' ? item.setId : DEMO_STORE.activeSetId
+      return own === id
+    }
+    var setList = (DEMO_STORE.sets || []).map(function (s) {
+      return {
+        id: s.id,
+        name: s.name,
+        active: s.id === DEMO_STORE.activeSetId,
+        entries: (DEMO_STORE.entries || []).filter(function (e) { return belongsTo(e, s.id) }).length,
+        profiles: (DEMO_STORE.profiles || []).filter(function (p) { return belongsTo(p, s.id) }).length,
+      }
+    })
+    return {
+      data: data,
+      sets: {
+        activeId: DEMO_STORE.activeSetId,
+        scoped: true,
+        total: { entries: totalEntries, profiles: totalProfiles },
+        list: setList,
+      },
+      storage: {
+        // The store file NEVER moves with the backup location — only the
+        // backup copies do (same rule as the real host).
+        path: 'C:\\Users\\demo\\.dsh\\instruction-memory\\memory.json',
+        error: null,
+        warning: null,
+        savedAt: Date.now() - 5 * 60000,
+        migratedFrom: null,
+        onDisk: true,
+        backupDir: DEMO_STORE.backupDir || '',
+        isDefaultBackupDir: !DEMO_STORE.backupDir,
+        backupPath: (DEMO_STORE.backupDir || 'C:\\Users\\demo\\.dsh\\instruction-memory') + '\\memory.json.bak',
+        historyDir: (DEMO_STORE.backupDir || 'C:\\Users\\demo\\.dsh\\instruction-memory') + '\\history',
+        historyCount: 0,
+        historyError: null,
+        schemaFile: 'C:\\Users\\demo\\.dsh\\instruction-memory\\memory.schema.json',
+      },
+      injection: {
+        registered: plan.text !== '',
+        available: true,
+        error: null,
+        muted: DEMO_STORE.enabled === true && typeof DEMO_STORE.disabledUntil === 'number' && DEMO_STORE.disabledUntil > Date.now(),
+        chars: plan.text.length,
+        budget: plan.budget,
+        activeCount: plan.activeCount,
+        included: plan.included,
+        omitted: plan.omitted,
+        profiles: plan.profiles,
+        profileChars: plan.profileChars,
+        entryChars: plan.entryChars,
+        pulls: 2,
+      },
+      // F12：演示桩里路由绑定在回环地址，安全面板不告警。
+      security: { hostGuarded: true, boundHost: '127.0.0.1' },
+      diagnostics: { loadedFrom: 'demo（内存桩宿主）', rev: data.rev || 0 },
+      preview: plan.text,
+      limits: {
+        minBudget: 800, maxBudget: 40000, maxEntries: 200,
+        maxProfiles: 50, maxProfileName: 40, maxProfileContent: 4000,
+        maxSets: 20, maxSetName: 30, maxHistory: 20, maxBackupDir: 512,
+        maxBodyChars: 3218000,
+      },
+    }
+  }
+
+  /** A no-op answer: ok, nothing written (mirrors the real envelope). */
+  function demoNoop() {
+    return {
+      ok: true,
+      json: async function () {
+        return { ok: true, saved: false, message: null, snapshot: demoSnapshot() }
+      },
+    }
+  }
+
+  /** Uniform route envelope for the demo host (the real one answers the same shape). */
+  function demoReply(ok, message) {
+    return {
+      ok: true,
+      json: async function () {
+        return {
+          ok: ok === true,
+          saved: ok === true,
+          message: message === undefined ? null : message,
+          snapshot: demoSnapshot(),
+        }
+      },
+    }
+  }
+
+  /**
+   * Adopt a whole store object (源码模式 / 整体替换). Mirrors the parts of the
+   * Host's loader a demo needs to stay believable: sets are kept, every item is
+   * stamped onto an existing set, missing ids are minted.
+   */
+  function demoAdoptStore(parsed) {
+    DEMO_STORE.version = 2
+    DEMO_STORE.enabled = parsed.enabled !== false
+    DEMO_STORE.disabledUntil = typeof parsed.disabledUntil === 'number' && isFinite(parsed.disabledUntil) && parsed.disabledUntil > 0
+      ? parsed.disabledUntil
+      : 0
+    DEMO_STORE.budgetChars = typeof parsed.budgetChars === 'number' ? parsed.budgetChars : 4000
+    DEMO_STORE.sets = Array.isArray(parsed.sets) && parsed.sets.length > 0
+      ? parsed.sets.map(function (s) { return { id: String(s.id), name: String(s.name).slice(0, 30) } })
+      : [{ id: 'st-demo-default', name: '默认' }]
+    DEMO_STORE.activeSetId = DEMO_STORE.sets.some(function (s) { return s.id === parsed.activeSetId })
+      ? parsed.activeSetId
+      : DEMO_STORE.sets[0].id
+    DEMO_STORE.entries = (Array.isArray(parsed.entries) ? parsed.entries : []).map(function (e) {
+      var entry = JSON.parse(JSON.stringify(e))
+      entry.id = entry.id || ('im-demo-' + Math.random().toString(36).slice(2, 8))
+      entry.setId = DEMO_STORE.sets.some(function (s) { return s.id === entry.setId })
+        ? entry.setId
+        : DEMO_STORE.activeSetId
+      entry.tags = Array.isArray(entry.tags) ? entry.tags : []
+      return entry
+    })
+    DEMO_STORE.profiles = (Array.isArray(parsed.profiles) ? parsed.profiles : []).map(function (p) {
+      var profile = JSON.parse(JSON.stringify(p))
+      profile.id = profile.id || ('pf-demo-' + Math.random().toString(36).slice(2, 8))
+      profile.setId = DEMO_STORE.sets.some(function (s) { return s.id === profile.setId })
+        ? profile.setId
+        : DEMO_STORE.activeSetId
+      return profile
+    })
+  }
+
+  window.fetch = async function (url, options) {
+    var payload = JSON.parse(options.body)
+    switch (payload.method) {
+      case 'save-entry': {
+        var entry = Object.assign({}, payload.args.entry)
+        if (!entry.id) entry.id = 'im-demo-' + Math.random().toString(36).slice(2, 8)
+        entry.updatedAt = Date.now()
+        // The interactive path always files into the ACTIVE set (same rule as
+        // the real Host — an edit can never move an item between sets), and an
+        // id owned by another set is re-minted rather than replaced.
+        entry.setId = DEMO_STORE.activeSetId
+        var foreignId = DEMO_STORE.entries.some(function (e) {
+          return e.id === entry.id && e.setId !== DEMO_STORE.activeSetId
+        })
+        if (foreignId) entry.id = 'im-demo-' + Math.random().toString(36).slice(2, 8)
+        var list = DEMO_STORE.entries
+        var index = -1
+        for (var i = 0; i < list.length; i += 1) if (list[i].id === entry.id) { index = i; break }
+        if (index >= 0) list[index] = entry
+        else list.push(entry)
+        break
+      }
+      case 'delete-entry': {
+        var doomed = payload.args.id
+        var owned = DEMO_STORE.entries.some(function (e) {
+          return e.id === doomed && demoInScope(e)
+        })
+        if (!owned) return demoNoop()
+        DEMO_STORE.entries = DEMO_STORE.entries.filter(function (e) { return e.id !== doomed })
+        break
+      }
+      case 'set-options': {
+        if (typeof payload.args.enabled === 'boolean') {
+          DEMO_STORE.enabled = payload.args.enabled
+          DEMO_STORE.disabledUntil = 0
+        }
+        if (typeof payload.args.disabledUntil === 'number' && isFinite(payload.args.disabledUntil)
+          && payload.args.disabledUntil >= 0 && typeof payload.args.enabled !== 'boolean') {
+          var wantedMute = Math.round(payload.args.disabledUntil)
+          var muteClamped = false
+          if (wantedMute <= Date.now()) wantedMute = 0
+          else if (wantedMute > Date.now() + 7 * 86400000) { wantedMute = Date.now() + 7 * 86400000; muteClamped = true }
+          DEMO_STORE.disabledUntil = wantedMute
+          if (wantedMute > 0) {
+            // 演示桩也到期自动恢复：真实宿主由插件内的定时器负责，这里用一个页内
+            // 定时器模拟同一行为（下一个快照即恢复正常态）。
+            setTimeout(function () { DEMO_STORE.disabledUntil = 0 }, wantedMute - Date.now() + 50)
+          }
+          return demoReply(true, wantedMute === 0
+            ? '已恢复注入。'
+            : '已暂停注入至 ' + new Date(wantedMute).toLocaleString() + '（到期自动恢复；暂停期间不注入任何指令或用户形象）'
+              + (muteClamped ? '；暂停时长上限为 7 天，已按上限记录' : ''))
+        }
+        if (typeof payload.args.budgetChars === 'number') DEMO_STORE.budgetChars = payload.args.budgetChars
+        if (typeof payload.args.backupDir === 'string') {
+          DEMO_STORE.backupDir = payload.args.backupDir.trim()
+          return demoReply(true, DEMO_STORE.backupDir === ''
+            ? '已恢复默认备份位置（版本历史与导出与存储文件同目录）'
+            : '备份位置已更新：' + DEMO_STORE.backupDir + '（版本历史与「导出到备份目录」随之改变；存储文件本身不移动）')
+        }
+        break
+      }
+      case 'batch': {
+        // Demo stand-in for the Host's single-transaction batch route.
+        var b = payload.args || {}
+        var batchIds = Array.isArray(b.ids) ? b.ids : []
+        if (b.op === 'delete') {
+          DEMO_STORE.entries = DEMO_STORE.entries.filter(function (e) {
+            return batchIds.indexOf(e.id) < 0
+          })
+        } else {
+          DEMO_STORE.entries.forEach(function (e) {
+            if (batchIds.indexOf(e.id) < 0) return
+            if (b.op === 'set-enabled') {
+              e.enabled = b.value
+            } else if (b.op === 'set-priority') {
+              e.priority = b.value
+            } else if (b.op === 'add-tags') {
+              var cur = Array.isArray(e.tags) ? e.tags.slice() : []
+              ;(b.value || []).forEach(function (tg) { if (cur.indexOf(tg) < 0) cur.push(tg) })
+              e.tags = cur.slice(0, 8)
+            } else if (b.op === 'remove-tags') {
+              e.tags = (e.tags || []).filter(function (tg) { return (b.value || []).indexOf(tg) < 0 })
+            }
+          })
+        }
+        break
+      }
+      case 'save-profile': {
+        // Demo stand-in for the Host's save-profile route. Mirror
+        // sanitizeProfile: a blank name falls back to the first 20 single-line
+        // characters of content, so the card never shows an empty name (the
+        // real Host stores this fallback; it is not a client-only label).
+        var p = Object.assign({}, payload.args.profile)
+        if (!p.id) p.id = 'pf-demo-' + Math.random().toString(36).slice(2, 8)
+        if (typeof p.enabled !== 'boolean') p.enabled = true
+        if (typeof p.content !== 'string') p.content = ''
+        var oneLine = function (s, max) {
+          return String(s).split(/\r?\n/).map(function (x) { return x.trim() })
+            .filter(Boolean).join(' ').slice(0, max)
+        }
+        var trimmedName = oneLine(p.name || '', 40)
+        p.name = trimmedName !== '' ? trimmedName : oneLine(p.content, 20)
+        p.updatedAt = Date.now()
+        if (!Array.isArray(DEMO_STORE.profiles)) DEMO_STORE.profiles = []
+        var pIndex = -1
+        for (var pi = 0; pi < DEMO_STORE.profiles.length; pi += 1) {
+          if (DEMO_STORE.profiles[pi].id === p.id) { pIndex = pi; break }
+        }
+        if (pIndex >= 0) DEMO_STORE.profiles[pIndex] = p
+        else DEMO_STORE.profiles.push(p)
+        break
+      }
+      case 'delete-profile':
+        DEMO_STORE.profiles = (DEMO_STORE.profiles || [])
+          .filter(function (p) { return p.id !== payload.args.id })
+        break
+      // ---- F13 配置集 ----
+      case 'save-set': {
+        var wanted = Object.assign({}, payload.args.set)
+        var wantedName = typeof wanted.name === 'string'
+          ? wanted.name.split(/\r?\n/).join(' ').trim().slice(0, 30)
+          : ''
+        if (wantedName === '') return demoReply(false, '配置集名称不能为空（单行，最多 30 字符）')
+        var sameName = function (s) { return s.name === wantedName && s.id !== wanted.id }
+        if (DEMO_STORE.sets.some(sameName)) return demoReply(false, '已存在同名配置集「' + wantedName + '」')
+        if (!wanted.id) {
+          if (DEMO_STORE.sets.length >= 20) return demoReply(false, '最多创建 20 个配置集')
+          DEMO_STORE.sets.push({ id: demoSetId(), name: wantedName })
+          return demoReply(true, '已创建配置集「' + wantedName + '」；它是空的，点击「切换」后才会注入它')
+        }
+        var renameAt = -1
+        for (var si = 0; si < DEMO_STORE.sets.length; si += 1) {
+          if (DEMO_STORE.sets[si].id === wanted.id) { renameAt = si; break }
+        }
+        if (renameAt < 0) return demoReply(false, '没有该配置集（可能已被其他窗口删除）')
+        DEMO_STORE.sets[renameAt].name = wantedName
+        return demoReply(true, '已重命名为「' + wantedName + '」')
+      }
+      case 'delete-set': {
+        var deleteId = payload.args.id
+        var targetSet = null
+        DEMO_STORE.sets.forEach(function (s) { if (s.id === deleteId) targetSet = s })
+        if (targetSet === null) return demoReply(false, '没有该配置集')
+        if (DEMO_STORE.sets.length <= 1) return demoReply(false, '至少要保留一个配置集')
+        if (deleteId === DEMO_STORE.activeSetId) return demoReply(false, '不能删除当前激活的配置集；请先切换到其他配置集')
+        DEMO_STORE.sets = DEMO_STORE.sets.filter(function (s) { return s.id !== deleteId })
+        DEMO_STORE.entries = DEMO_STORE.entries.filter(function (e) { return e.setId !== deleteId })
+        DEMO_STORE.profiles = (DEMO_STORE.profiles || []).filter(function (p) { return p.setId !== deleteId })
+        return demoReply(true, '已删除配置集「' + targetSet.name + '」及其中的条目与形象')
+      }
+      case 'set-active-set': {
+        var activeId = payload.args.id
+        var found = DEMO_STORE.sets.some(function (s) { return s.id === activeId })
+        if (!found) return demoReply(false, '没有该配置集（可能已被其他窗口删除）')
+        if (activeId === DEMO_STORE.activeSetId) return demoNoop()
+        DEMO_STORE.activeSetId = activeId
+        var activeName = ''
+        DEMO_STORE.sets.forEach(function (s) { if (s.id === activeId) activeName = s.name })
+        return demoReply(true, '已切换到配置集「' + activeName + '」，注入内容已随之更新')
+      }
+      case 'duplicate-set': {
+        var copyFrom = null
+        DEMO_STORE.sets.forEach(function (s) { if (s.id === payload.args.id) copyFrom = s })
+        if (copyFrom === null) return demoReply(false, '没有该配置集')
+        if (DEMO_STORE.sets.length >= 20) return demoReply(false, '最多 20 个配置集')
+        var copyName = (payload.args.name || copyFrom.name + ' 副本').trim().slice(0, 30)
+        if (DEMO_STORE.sets.some(function (s) { return s.name === copyName })) return demoReply(false, '已存在同名配置集「' + copyName + '」')
+        var copyId = demoSetId()
+        var stamp = Date.now()
+        var copiedEntries = DEMO_STORE.entries.filter(function (e) { return e.setId === copyFrom.id })
+          .map(function (e) {
+            var copy = JSON.parse(JSON.stringify(e))
+            copy.id = 'im-demo-' + Math.random().toString(36).slice(2, 8)
+            copy.setId = copyId
+            copy.updatedAt = stamp
+            return copy
+          })
+        DEMO_STORE.sets.push({ id: copyId, name: copyName })
+        Array.prototype.push.apply(DEMO_STORE.entries, copiedEntries)
+        return demoReply(true, '已复制为「' + copyName + '」（' + copiedEntries.length + ' 条指令）；点击「切换」后才会注入它')
+      }
+      // ---- F14 版本历史（演示页面不落盘，因此没有快照可列） ----
+      case 'history-list':
+        return {
+          ok: true,
+          json: async function () {
+            return {
+              ok: true, saved: false, message: null, snapshot: demoSnapshot(),
+              history: { dir: '（演示页面不写历史快照；真实宿主会在存储目录的 history/ 子目录里保留最近 20 份）', items: [] },
+            }
+          },
+        }
+      case 'history-restore':
+      case 'history-delete':
+        return demoReply(false, '演示页面没有历史快照')
+      // ---- F16 源码模式 ----
+      case 'read-source':
+        return {
+          ok: true,
+          json: async function () {
+            return { ok: true, saved: false, message: null, source: JSON.stringify(DEMO_STORE, null, 2) + '\n', snapshot: demoSnapshot() }
+          },
+        }
+      case 'write-source': {
+        var text = payload.args.text
+        if (typeof text !== 'string' || text.trim() === '') return demoReply(false, '源码不能为空')
+        var parsedSource = null
+        try {
+          parsedSource = JSON.parse(text)
+        } catch (err) {
+          return demoReply(false, '源码不是有效的 JSON：' + (err && err.message ? err.message : err))
+        }
+        if (parsedSource === null || typeof parsedSource !== 'object' || Array.isArray(parsedSource)) {
+          return demoReply(false, '顶层必须是一个 JSON 对象')
+        }
+        if (typeof parsedSource.version === 'number' && parsedSource.version !== 2) {
+          return demoReply(false, '内容声明为格式版本 ' + parsedSource.version + '，本插件支持的格式版本为 1 / 2')
+        }
+        demoAdoptStore(parsedSource)
+        return demoReply(true, '已按源码保存（演示页面只改内存，不写文件）：'
+          + DEMO_STORE.entries.length + ' 条指令 / ' + (DEMO_STORE.profiles || []).length + ' 个用户形象 / '
+          + DEMO_STORE.sets.length + ' 个配置集')
+      }
+      // ---- F14 整体替换恢复 ----
+      case 'restore-data': {
+        var restorePayload = payload.args.payload
+        if (restorePayload === null || typeof restorePayload !== 'object') return demoReply(false, '恢复内容不是有效的 JSON 对象')
+        var restoreInner = restorePayload.data !== null && typeof restorePayload.data === 'object' ? restorePayload.data : restorePayload
+        var looksLikeStore = ['version', 'enabled', 'budgetChars', 'activeSetId', 'sets', 'entries', 'profiles']
+          .some(function (key) { return key in restoreInner })
+        if (!looksLikeStore) return demoReply(false, '内容不像本插件的存储文件')
+        demoAdoptStore(restoreInner)
+        return demoReply(true, '已用备份整体替换当前记忆（演示页面只改内存，不写文件）')
+      }
+      // ---- F18 备份位置 ----
+      case 'export-to-dir':
+        return demoReply(true, '演示页面不会真的写文件；真实宿主会把导出写入「'
+          + (DEMO_STORE.backupDir || '存储目录') + '」，文件名形如 dsh-instruction-memory-20261015-152355Z.json')
+      case 'export-data':
+        return {
+          ok: true,
+          json: async function () {
+            return {
+              ok: true, saved: false, message: null,
+              // 导出的是整份存储（所有配置集），不是当前激活的那一套。
+              export: { app: 'dsh-instruction-memory', version: 2, exportedAt: new Date().toISOString(), data: JSON.parse(JSON.stringify(DEMO_STORE)) },
+              snapshot: demoSnapshot(),
+            }
+          },
+        }
+      default:
+        break
+    }
+    return {
+      ok: true,
+      json: async function () {
+        return { ok: true, saved: true, message: null, snapshot: demoSnapshot() }
+      },
+    }
+  }
+</script>
+
+<!-- The real client module, unmodified. -->
+<script src="../lib/client.js"></script>
+
+<script>
+  var plugin = window.__dshSpec.factory(function (id) {
+    if (id === 'react') return window.React
+    throw new Error('unexpected require: ' + id)
+  })
+
+  var registered = []
+  plugin.apply({
+    slots: {
+      inject: function (key, callback) { callback(); return function () {} },
+      register: function (options, render) { registered.push(render); return function () {} },
+    },
+    effect: function (fn) { fn(); return function () {} },
+  })
+
+  ReactDOM.createRoot(document.getElementById('root')).render(registered[0]())
+</script>
+</body>
+</html>

package/lib/client.js

@@ -69,7 +69,10 @@ window.__ModuleLoader__.load({
 
     const CSS = `
 .im-root { display:flex; flex-direction:column; gap:16px; padding:6px 2px 56px; max-width:860px;
-  color:var(--dsw-alias-label-primary,#1f2329); font-size:13px; line-height:1.6; }
+  color:var(--dsw-alias-label-primary,#1f2329); font-size:13px; line-height:1.6;
+  /* Android WebView honours the system text zoom unless this is pinned: at
+     150% the fixed-px cards reflow into unreadable ribbons. */
+  -webkit-text-size-adjust:100%; text-size-adjust:100%; }
 .im-h { margin:0; font-size:14px; font-weight:600; }
 .im-sub { margin:3px 0 0; font-size:12px; color:var(--dsw-alias-label-secondary,#8a9099); }
 .im-card { display:flex; flex-direction:column; gap:11px; padding:15px; border-radius:12px;
@@ -362,6 +365,12 @@ window.__ModuleLoader__.load({
         'profiles.truncatedTitle': '这张形象超过注入字数上限，只有开头进入本轮提示',
         'profiles.omitted': '本轮未包含',
         'profiles.omittedTitle': '这张形象因注入字数上限未进入本轮提示',
+        'export.saved': '已开始下载；若没有文件出现，请检查浏览器的下载列表',
+        'export.savedToApp': '已交给 DSH Go 保存：在系统分享面板里选「保存到文件」即可',
+        'export.fallbackHint': '当前环境无法触发文件下载，完整 JSON 已放在下面：全选复制后自行保存',
+        'export.fallbackClose': '关闭',
+        'import.webviewHint': 'Android / WebView 上若文件选择器不弹出，请改用「源码模式」粘贴 JSON',
+        'sse.down': '实时更新已断开（连续重试仍失败），数据可能是旧的：请点「重新载入」',
         'profiles.saving': '保存中…',
         'action.new': '＋ 新增指令',
         'action.reload': '重新载入',
@@ -654,6 +663,12 @@ window.__ModuleLoader__.load({
         'profiles.truncatedTitle': 'This persona exceeds the injection limit; only its head reached this turn',
         'profiles.omitted': 'Not in this turn',
         'profiles.omittedTitle': 'This persona was dropped by the injection limit and did not reach this turn',
+        'export.saved': 'Download started — if no file appears, check your browser’s download list',
+        'export.savedToApp': 'Handed to DSH Go — pick “Save to Files” in the system share sheet',
+        'export.fallbackHint': 'This environment cannot start a file download; the full JSON is below — select all and copy it',
+        'export.fallbackClose': 'Close',
+        'import.webviewHint': 'On Android / WebView, if the file picker does not open, paste the JSON into “Source mode” instead',
+        'sse.down': 'Live updates stopped (retries kept failing) and the data may be stale — click “Reload”',
         'profiles.saving': 'Saving…',
         'action.new': '＋ New instruction',
         'action.reload': 'Reload',
@@ -1037,7 +1052,7 @@ window.__ModuleLoader__.load({
      * @param {string} message
      * @returns {{ kind: 'unavailable' } | { kind: 'cancel' } | { kind: 'answer', text: string }}
      */
-    function batchTagOutcome(ask, message) {
+    function batchTagOutcome(ask, message, options) {
       if (typeof ask !== 'function') return { kind: 'unavailable' }
       let answer
       try {
@@ -1045,11 +1060,16 @@ window.__ModuleLoader__.load({
       } catch (err) {
         return { kind: 'unavailable' }
       }
-      // Only a real `null` means the user pressed Cancel. `undefined` and any
-      // non-string (a broken polyfill, a Promise) mean the runtime cannot
-      // deliver an answer, so the caller must show the fallback form instead of
-      // swallowing the click.
-      if (answer === null) return { kind: 'cancel' }
+      // Android WebView is a FOURTH shape this helper did not know about: it
+      // keeps `window.prompt` as a function and does not throw, but with no
+      // WebChromeClient.onJsPrompt it returns `null` immediately — never
+      // showing a dialog. Treating that as "the user pressed Cancel" turned the
+      // bulk-tag action into a silent no-op, and the inline fallback form below
+      // was unreachable. The caller passes `nullMeansUnavailable` when it knows
+      // the runtime cannot show a dialog.
+      const nullIsUnavailable = options !== null && typeof options === 'object'
+        && options.nullMeansUnavailable === true
+      if (answer === null) return nullIsUnavailable ? { kind: 'unavailable' } : { kind: 'cancel' }
       if (typeof answer !== 'string') return { kind: 'unavailable' }
       return { kind: 'answer', text: answer }
     }
@@ -2005,6 +2025,10 @@ window.__ModuleLoader__.load({
       // pretending the copy happened.
       const [diagOpen, setDiagOpen] = React.useState(false)
       const [diagFallback, setDiagFallback] = React.useState(null)
+      /** Export JSON rendered in-panel when the runtime has no download path. */
+      const [exportFallback, setExportFallback] = React.useState(null)
+      /** True once the event stream has failed long enough to stop pretending. */
+      const [liveDown, setLiveDown] = React.useState(false)
       // Feedback form: closed by default so the settings card stays compact.
       // The draft lives in the panel (not in a child) because the send handler
       // needs the same values the inputs show, and keeping them here survives
@@ -2276,7 +2300,11 @@ window.__ModuleLoader__.load({
         const ask = typeof window.prompt === 'function'
           ? (message, initial) => window.prompt(message, initial)
           : null
-        const outcome = batchTagOutcome(ask, t('batch.tagPrompt', { count: ids.length }))
+        const outcome = batchTagOutcome(ask, t('batch.tagPrompt', { count: ids.length }), {
+          // A WebView without onJsPrompt answers `null` instantly and shows no
+          // dialog: that is "cannot ask", not "the user said no".
+          nullMeansUnavailable: isAndroidWebView(),
+        })
         if (outcome.kind === 'cancel') return
         if (outcome.kind === 'answer') {
           if (commitBatchTags(outcome.text)) closeBatchTags()
@@ -2686,6 +2714,63 @@ window.__ModuleLoader__.load({
         }
       }
 
+      /**
+       * Is this an Android WebView (as opposed to a normal browser or Electron)?
+       *
+       * The distinction matters because a WebView can answer `typeof
+       * window.prompt === 'function'` and still never show a dialog, and it can
+       * expose `<a download>` while having no download pipeline behind it. Both
+       * fail silently, so the panel has to detect the environment and take the
+       * in-page route instead of pretending the browser feature exists.
+       */
+      function isAndroidWebView() {
+        try {
+          const ua = typeof navigator !== 'undefined' && typeof navigator.userAgent === 'string'
+            ? navigator.userAgent
+            : ''
+          // `; wv)` is the canonical WebView marker; DSH Go's webview island may
+          // also report a stock Chromium UA, so fall back to "Android without a
+          // full browser brand".
+          return /;\s*wv\)/i.test(ua)
+            || (/Android/i.test(ua) && !/Chrome\/\d+/i.test(ua))
+        } catch {
+          return false
+        }
+      }
+
+      /**
+       * Hand `text` to the DSH Go island bridge, in chunks that fit its 16 KB
+       * message cap (`IslandMessageLimits.maxBytes`). The app reassembles them
+       * and opens the system share sheet — the only export path a WebView has,
+       * since it never hands a `blob:` to a download listener.
+       *
+       * Returns false when the page is not inside DSH Go (or the bridge is
+       * missing), which leaves the browser path untouched.
+       */
+      async function sendToAppBridge(text, name) {
+        try {
+          const bridge = typeof window !== 'undefined' ? window.DshGoIsland : undefined
+          if (bridge === undefined || bridge === null || typeof bridge.postMessage !== 'function') return false
+          const id = 'im-' + Date.now().toString(36) + Math.random().toString(36).slice(2, 8)
+          const CHUNK = 6000
+          let i = 0
+          while (i < text.length) {
+            let end = Math.min(text.length, i + CHUNK)
+            // Never split a surrogate pair across two messages: each one is its
+            // own JSON document and a lone surrogate would not survive it.
+            const code = text.charCodeAt(end - 1)
+            if (end < text.length && code >= 0xd800 && code <= 0xdbff) end += 1
+            bridge.postMessage(JSON.stringify({
+              t: 'save', id, name, data: text.slice(i, end), last: end >= text.length,
+            }))
+            i = end
+          }
+          return true
+        } catch {
+          return false
+        }
+      }
+
       async function doExport() {
         try {
           const result = await callHost('export-data', null)
@@ -2693,15 +2778,37 @@ window.__ModuleLoader__.load({
             setError(t('export.failed'))
             return
           }
-          const blob = new Blob([JSON.stringify(result.export, null, 2) + '\n'], { type: 'application/json' })
+          const text = JSON.stringify(result.export, null, 2) + '\n'
+          const fileName = 'dsh-instruction-memory-' + new Date().toISOString().slice(0, 10) + '.json'
+          // Inside DSH Go the app can actually write the file; prefer that over
+          // both the download link and the in-panel copy.
+          if (await sendToAppBridge(text, fileName)) {
+            setNotice(t('export.savedToApp'))
+            return
+          }
+          /**
+           * A WebView can expose `<a download>` and still have nowhere to put
+           * the bytes: Android only saves when the embedding app implements a
+           * DownloadListener, and Chromium's WebView cannot hand it a `blob:`.
+           * The click then produces no file, no error, and no second chance (the
+           * object URL is revoked a second later), so Android takes the in-panel
+           * route unconditionally.
+           */
+          if (isAndroidWebView() || typeof URL === 'undefined' || typeof URL.createObjectURL !== 'function') {
+            setExportFallback(text)
+            setNotice(t('export.fallbackHint'))
+            return
+          }
+          const blob = new Blob([text], { type: 'application/json' })
           const url = URL.createObjectURL(blob)
           const link = document.createElement('a')
           link.href = url
-          link.download = 'dsh-instruction-memory-' + new Date().toISOString().slice(0, 10) + '.json'
+          link.download = fileName
           document.body.appendChild(link)
           link.click()
           if (link.parentNode !== null) link.parentNode.removeChild(link)
           setTimeout(() => { URL.revokeObjectURL(url) }, 1000)
+          setNotice(t('export.saved'))
         } catch (err) {
           setError(String(err && err.message ? err.message : err))
         }
@@ -2769,6 +2876,9 @@ window.__ModuleLoader__.load({
         let alive = true
         let refreshing = false
         let missed = false
+        /** Consecutive stream errors; reset by any successful frame. */
+        let failures = 0
+        let down = false
         /**
          * Monotonic frame counter carried by lite frames. `rev` only moves when
          * the store is WRITTEN, so a snapshot that changed without a write (the
@@ -2797,6 +2907,11 @@ window.__ModuleLoader__.load({
           })
         }
         source.onmessage = (ev) => {
+          failures = 0
+          if (down) {
+            down = false
+            setLiveDown(false)
+          }
           try {
             const pushed = JSON.parse(ev.data)
             if (pushed !== null && typeof pushed === 'object' && pushed.lite === true) {
@@ -2820,6 +2935,21 @@ window.__ModuleLoader__.load({
             // A malformed frame is dropped; the next frame, or 重新载入, catches up.
           }
         }
+        /**
+         * Android kills the WebView renderer, expires the session cookie or
+         * freezes the page in Doze; EventSource then retries every 5 s forever
+         * and the panel shows stale data as if it were live. Six consecutive
+         * failures (≈30 s) is past any transient blip, so say so and let the
+         * user reload — the stream keeps retrying, and the next frame that
+         * lands clears the warning.
+         */
+        source.onerror = () => {
+          failures += 1
+          if (!down && failures >= 6) {
+            down = true
+            setLiveDown(true)
+          }
+        }
         return () => { alive = false; source.close() }
       }, [])
 
@@ -3585,6 +3715,21 @@ window.__ModuleLoader__.load({
           }, batchMode ? t('batch.exit') : t('action.batch')),
           h('span', { className: 'im-spacer' }),
           h('span', { className: 'im-meta' }, t('stats.count', { total: entries.length, active: activeCount }))),
+        exportFallback !== null
+          ? h('div', { className: 'im-diag-fallback' },
+            h('div', { className: 'im-meta' }, t('export.fallbackHint')),
+            h('textarea', {
+              className: 'im-textarea',
+              readOnly: true,
+              value: exportFallback,
+              onFocus: (ev) => { if (typeof ev.target.select === 'function') ev.target.select() },
+            }),
+            h('div', { className: 'im-row-wrap' },
+              h('button', { className: 'im-btn', onClick: () => setExportFallback(null) }, t('export.fallbackClose'))))
+          : null,
+        isAndroidWebView()
+          ? h('div', { className: 'im-meta' }, t('import.webviewHint'))
+          : null,
         h('div', { className: 'im-divider' }),
         h('div', { className: 'im-meta' },
           storage.path ? t('storage.file', { path: storage.path }) : t('storage.noFile')),
@@ -3705,6 +3850,7 @@ window.__ModuleLoader__.load({
                   }))
                 : null)
             : null),
+        liveDown ? h('div', { className: 'im-meta', role: 'status' }, t('sse.down')) : null,
         error !== '' ? h('div', { className: 'im-err', role: 'alert' }, error) : null,
         error === '' && notice !== '' ? h('div', { className: 'im-ok', role: 'status', 'aria-live': 'polite' }, notice) : null,
         error === '' && notice === '' && storage.error ? h('div', { className: 'im-err', role: 'alert' }, storage.error) : null,
@@ -4070,7 +4216,7 @@ window.__ModuleLoader__.load({
         box.id = id
         box.setAttribute('role', 'status')
         box.style.cssText = [
-          'position:fixed', 'right:16px', 'bottom:16px', 'z-index:2147483000',
+          'position:fixed', 'right:16px', 'bottom:calc(16px + env(safe-area-inset-bottom,0px))', 'z-index:2147483000',
           'max-width:min(380px,calc(100vw - 32px))',
           'background:#3a1d1d', 'color:#ffe8e8', 'border:1px solid #7a3a3a',
           'border-radius:10px', 'padding:12px 14px',

package/lib/index.js

@@ -182,6 +182,24 @@ const TRUSTED_HOSTS_ENV = 'DSH_INSTRUCTION_MEMORY_TRUSTED_HOSTS'
  * volume.
  */
 const ALLOW_EXTERNAL_BACKUP_ENV = 'DSH_INSTRUCTION_MEMORY_ALLOW_EXTERNAL_BACKUP'
+/**
+ * Opt-in "no fence, no route" switch.
+ *
+ * Without a `connection` service the plugin falls back to its own loopback /
+ * same-origin rule. On a desktop that is a real boundary; on Android it is not,
+ * because loopback lives in a namespace every app on the device shares — any
+ * app with INTERNET can then rewrite the instructions of every later turn.
+ * DSH Go's build-time route guard normally closes that, but the guard is a
+ * platform property: a `dsh web` started without `--patch` silently loses it.
+ * Setting this to 1 makes the plugin refuse instead of degrade, so the failure
+ * mode becomes a settings page that cannot load rather than a writable one.
+ */
+const REQUIRE_AUTH_FENCE_ENV = 'DSH_INSTRUCTION_MEMORY_REQUIRE_AUTH_FENCE'
+/** Is the fail-closed switch on? Read per request so a restart is not needed. */
+const requireAuthFence = () => {
+  const raw = process.env[REQUIRE_AUTH_FENCE_ENV]
+  return typeof raw === 'string' && raw.trim() === '1'
+}
 /**
  * How often the store file is stat-ed as a fallback for `fs.watch` (F19).
  *
@@ -2532,6 +2550,17 @@ export function apply(ctx, deps = {}) {
     const raw = process.env[ALLOW_EXTERNAL_BACKUP_ENV]
     return typeof raw === 'string' && raw.trim() === '1'
   }
+  /**
+   * The "set this env var and restart" footer shared by the three backup paths.
+   *
+   * On Linux — and therefore on every Android build, DSH Go included — the
+   * engine is started through `/usr/bin/env -i`, which leaves no way for the
+   * user to set it. Telling them to export a variable they cannot export is a
+   * dead instruction; point at the route that does work instead.
+   */
+  const externalBackupHint = () => (process.platform === 'linux'
+    ? '要使用其他磁盘请设置 ' + ALLOW_EXTERNAL_BACKUP_ENV + '=1 后重启宿主（DSH Go / Android 用 env -i 启动引擎，该变量设不了，请改用「导出」把 JSON 复制出来备份）'
+    : '要使用其他磁盘请设置 ' + ALLOW_EXTERNAL_BACKUP_ENV + '=1 后重启宿主')
   /** `path`'s real location, or null when it (or a parent) is unavailable. */
   const realPathOrNull = (path) => {
     try {
@@ -2597,7 +2626,7 @@ export function apply(ctx, deps = {}) {
     if (refusedBackupDir !== configured) {
       refusedBackupDir = configured
       state.storageWarning = '备份位置 ' + displayPath(configured) + ' 不在 DSH 主目录内，已忽略（备份与历史快照一律写回默认位置）；'
-        + '要使用其他磁盘请设置 ' + ALLOW_EXTERNAL_BACKUP_ENV + '=1 后重启宿主'
+        + externalBackupHint()
       logInfo('ignoring backupDir outside the harness home: ' + configured)
     }
     return ''
@@ -4007,8 +4036,7 @@ export function apply(ctx, deps = {}) {
           return {
             ok: false,
             saved: false,
-            message: '备份位置必须位于 DSH 主目录内（' + displayPath(dshRootPath()) + '）；要使用其他磁盘请设置环境变量 '
-              + ALLOW_EXTERNAL_BACKUP_ENV + '=1 后重启宿主',
+            message: '备份位置必须位于 DSH 主目录内（' + displayPath(dshRootPath()) + '）；' + externalBackupHint(),
             snapshot: snapshot(),
           }
         }
@@ -4641,8 +4669,7 @@ export function apply(ctx, deps = {}) {
       return {
         ok: false,
         saved: false,
-        message: '导出目录必须位于 DSH 主目录内（' + displayPath(dshRootPath()) + '）；要写入其他磁盘请设置环境变量 '
-          + ALLOW_EXTERNAL_BACKUP_ENV + '=1 后重启宿主',
+        message: '导出目录必须位于 DSH 主目录内（' + displayPath(dshRootPath()) + '）；' + externalBackupHint(),
         snapshot: snapshot(),
       }
     }
@@ -5388,6 +5415,16 @@ export function apply(ctx, deps = {}) {
       'cache-control': 'no-store',
       connection: 'keep-alive',
     })
+    // Mobile renderers are killed without a FIN (Android LMK) or lose their
+    // network mid-stream (Wi-Fi → cellular). The heartbeat cannot notice a peer
+    // that never errors — every write succeeds into the socket buffer — so at
+    // least let the OS probe for a dead peer, and never sit on Nagle.
+    try {
+      if (res.socket && typeof res.socket.setKeepAlive === 'function') res.socket.setKeepAlive(true, 30_000)
+      if (res.socket && typeof res.socket.setNoDelay === 'function') res.socket.setNoDelay(true)
+    } catch {
+      // A double without a socket (tests) or a closed one: nothing to tune.
+    }
     // Ask the browser to retry politely if the stream drops (e.g. the host was
     // restarted) instead of hammering the route.
     res.write('retry: 5000\n\n')
@@ -5484,6 +5521,24 @@ export function apply(ctx, deps = {}) {
       }
       return 'gate'
     }
+    /**
+     * Deeper defence for deployments where loopback is not a boundary: on
+     * Android every app shares the loopback namespace, so "reachable only from
+     * this machine" stops meaning "reachable only from this user". With the
+     * switch set, a profile without a fence gets NO route at all — a settings
+     * page that fails to load is a far better outcome than one that can be
+     * rewritten by any installed app.
+     */
+    if (requireAuthFence()) {
+      logInfo('route refused a request: no connection fence and ' + REQUIRE_AUTH_FENCE_ENV + '=1')
+      res.writeHead(503, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
+      res.end(JSON.stringify({
+        ok: false,
+        message: '该 profile 没有宿主的 connection 服务，已按 ' + REQUIRE_AUTH_FENCE_ENV
+          + '=1 拒绝请求（fail-closed）；如需在无鉴权宿主上使用，请移除该环境变量。',
+      }))
+      return 'rejected'
+    }
     if (!guardHost) {
       logInfo('route refused a request: non-loopback bind without an authentication fence')
       res.writeHead(503, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-instruction-memory",
-  "version": "1.5.4",
+  "version": "1.5.6",
   "description": "User-only instruction memory for DSH: long-term instructions maintained in the settings UI and auto-injected into every conversation — the model has no write access. 指令记忆：只由用户在设置页维护的长期指令，自动注入此后每轮对话；模型没有任何写入口。",
   "license": "MIT",
   "type": "module",
@@ -31,7 +31,8 @@
     "CHANGELOG.md",
     "LICENSE",
     "memory.schema.json",
-    "docs/screenshot.png"
+    "docs/screenshot.png",
+    "docs/demo.html"
   ],
   "keywords": [
     "dsh",