dsh-instruction-memory 1.5.5 → 1.5.7

package/CHANGELOG.md

@@ -7,6 +7,114 @@
 > 1.0.13 起由 CI 经 OIDC Trusted Publishing 发布（首个带 provenance 的版本）。
 > 这些历史 tag **不应回填**——npm 上的版本号已被占用。
 
+## [1.5.7] — 2026-11-14
+
+针对**最新版桌面端（`dsh-desktop-runtime 0.2.2-rc.3`，Electron）与网页端**全量审查后的修复轮。
+审查结论先说清楚：**功能性缺陷只有 1 条**（测试守卫读错宿主），其余是注入链路的加固、一处
+无鉴权无确认的自动写路径、以及若干"声明/文档与实现不符"。审查同时**撤回了一条看起来该改、
+实测不该改**的建议（见末节）。
+
+### 修复
+
+- **回归守卫读错宿主，对着错误的版本虚假通过（B1）**：`host-range-test.mjs` 的 LIVE GUARD
+  只在 `profiles/*/node_modules`、`/usr/lib…`、`/usr/local/lib…` 和 TRAE 字面路径里找宿主。
+  桌面端把 dsh 打包进 `app.asar`，这些路径**永远不命中**；本机因此命中一条与本机无关的软链
+  （TRAE 捆绑的 `0.2.2-alpha.2`），并在桌面端实际运行 `0.2.2-rc.3` 时打印
+  `PASS LIVE GUARD: the installed host 0.2.2-alpha.2 ...`。这正是该守卫注释里声称要防的
+  false negative。现在优先读取 `resources/runtime/primary-runtime/runtime.json` 的
+  `desktopVersion`（可选 `DSH_DESKTOP_RUNTIME_ROOT` 覆盖），桌面证据存在时以它为准，
+  `profiles/node_modules` 的软链树降级为"没有桌面安装时"的证据；标签里**打印版本来源路径**，
+  免得下次读错树又是静默通过。
+- **`systemPrompt` 一次性捕获，服务重发布后注入静默死亡（A1）**：`apply()` 里
+  `const systemPrompt = ctx.systemPrompt` 只取一次。宿主 dispose 并重新 publish 该服务后
+  （宿主重启、fiber 重挂、profile 重载），旧实例仍然接受 `section()` 并返回 disposer、
+  不抛错，新实例一个 section 都收不到 —— 于是此后整轮对话都不再有指令记忆，且没有任何报错。
+  改为可变引用 + 非阻塞 `ctx.inject(['systemPrompt'], …)`（与 `webServer` 注册同构）：
+  服务换实例时先 dispose 旧注册再在新实例上重建；服务下线时把
+  `注入服务已重新发布/下线` 写进 `injection.error`，而不是假装无事发生。
+
+### 安全
+
+- **旧位置文件不再自动采纳（A4）**：`process.cwd()` 下的 `.dsh-instruction-memory.json`
+  过去会被**直接写进 memory.json 并在下一轮注入**——没有鉴权门、没有确认，是全插件唯一
+  这样的写路径。`cwd` 不属于插件：任何同权限进程在那里放一份 store 形状的 JSON，就能变成
+  "用户的长期指令"。现在只**检出**（`storage.legacyPending`，设置页显示条数与路径），
+  由用户点「导入旧位置数据」才采纳（`adopt-legacy`，走与其他写入相同的门禁，且在接纳前
+  重新读取并复核该路径**仍是**本插件的 store）；「忽略」为 `dismiss-legacy`，原文件不动。
+- **注入文本剥离不可见字符（A3）**：`cleanText` 过去只归一 `\r`。现在剥离 C0 控制符
+  （保留 `\n`/`\t`）、DEL、`U+200B–U+200F`、`U+202A–U+202E`、`U+2066–U+2069`、`U+FEFF`，
+  并把 `U+2028/2029` 归一成换行。理由是**设置页所见必须等于模型所读**：bidi override 能让
+  一行显示成另一个词（Trojan-Source 类），零宽字符能拆词躲过关键词与去重检查。
+- **注入块加不可伪造定界（A2）**：整段现在由 `<user-instruction-memory>` /
+  `</user-instruction-memory>` 包裹，且 `content` 中同形的标签、本插件自己的段头
+  （`## 用户长期指令记忆`、`## 关于用户（用户形象）`）与条目前缀（`[始终｜优先级`/`[按需｜优先级`）
+  会被换成全角近似字符，无法再冒充系统段头或伪造优先级。普通 Markdown 标题
+  （如 `## 实验步骤`）不受影响。
+- **无鉴权门时，写方法要求浏览器来源标记（A9/A12）**：`requestOriginVerdict` 的每条分支都以
+  "有 Origin"为前提，因此**本机脚本/curl 不带 Origin 就能在无 `connection` 服务的 profile 上
+  直接改记忆**。回环在"同机任意程序都以该用户身份运行"的机器上不再是边界。现在：
+  ① 无鉴权门且主机名白名单被放宽（`hostGuarded === false` + `trustedHostCount > 0`）时，
+  写方法一律 **503**；② 无鉴权门时，写方法必须带 `Origin` 或 `Sec-Fetch-Site: same-origin`
+  （浏览器必发其一，设置页不受影响），否则 **403**。只读方法（`state`、`history-list`、
+  `read-source`、`export-data`、`export-to-dir`、`reload`、`send-feedback`）不受限制。
+  `DSH_INSTRUCTION_MEMORY_REQUIRE_AUTH_FENCE=1` 仍可让整条路由 fail closed。
+- **崩溃残留的临时副本会被清理（A13）**：原子写用
+  `memory.json.tmp-<pid>-<uuid>`，在 `open` 与 `rename` 之间崩溃会留下**一份完整的记忆明文**，
+  且永不清理。载入时按插件自己的命名模式清扫；记录里的 pid 仍存活则跳过（那是另一个进程
+  正在写，不是垃圾）。
+
+### 变更
+
+- 新字段 `injection.envelopeChars`：`chars` 里有多少是定界包裹。面板的用量条改为
+  `entryChars + profileChars + envelopeChars`（旧宿主不发该字段，按 0 计），这样条上的数字
+  与宿主真正执行的预算一致。
+- 新字段 `storage.legacyPending`（`{ path, entries, profiles }` 或 `null`）与
+  `security.routeRegistered`（设置页路由是否真的挂上了 —— 没有 `webServer` 的 profile 里过去
+  只有一行 `console.error`，面板无法自述其缺席）。
+- 新方法 `adopt-legacy` / `dismiss-legacy`。
+- `peerDependenciesMeta` 把 `@deepseek-ai/dsh-system-prompt` 标为 **optional**：插件代码
+  全文只 import `node:` 内置模块，服务靠 `inject = ['systemPrompt']` 与鸭子类型取得，
+  把 peer 标成强制只会在 `strict-peer-dependencies` 下误伤安装。
+- `description` 措辞更正：从"模型没有任何写入口"改为"**插件不注册任何面向模型的工具**，
+  模型没有插件内的写入口"——原话与本仓库 README 自述（同权限进程可直接改文件）自相矛盾。
+
+### 未改动（审查建议过，复核后撤回）
+
+- **冗余区间段不能删（A14 撤回）**：`>=0.2.1-alpha.0`、`>=0.2.2-alpha.0` 在
+  `includePrerelease: true`（宿主门）下确实被 `>=0.2.0-0 <0.3.0-0` 吸收，但在**默认 semver
+  语义**（pnpm / npm 的 peer 解析）下，预发布版本要求**同一 tuple** 的比较器存在，删掉这两段
+  会让 `0.2.1-alpha.x` / `0.2.2-alpha.x` 被判不兼容。宿主门用 includePrerelease、包管理器用
+  默认语义，两套并存，所以每一段都是必需的。README 的兼容性小节据此更正了
+  `peerDependencies` 被称作"真正的门禁"的说法。
+
+## [1.5.6] — 2026-11-13
+
+### 新增
+
+- **导出可以真正落到文件（仅在 DSH Go 里生效）**：`doExport()` 现在先探测 `window.DshGoIsland`
+  ——那是 DSH Go 的 island 桥。存在时把 JSON 按 6,000 字符一块（不切断代理对）`postMessage` 给 App，
+  由 App 写文件并唤起系统分享面板，面板提示「已交给 DSH Go 保存」。不存在时行为不变：普通 WebView
+  回退到面板内 JSON，浏览器/Electron 仍是 `<a download>`。
+  壳侧需要配套补丁（island 协议新增 `t:'save'` 分块消息），已在仓库外单独产出
+  （`dsh-go-patch` 的 `README-PATCH.md`，放在本机独立目录，未随本仓库或 npm 包分发）；
+  本仓库不含任何上游代码。
+
+### 文档更正
+
+只改文档的部分，**更正 1.5.5 发布说明里两处对 DSH Go 壳的描述**——都是读源码（`ccch1mneyyy/dsh-go`，2026-11-12）后确认写错的：
+
+- **引擎环境不是 `/usr/bin/env -i`**：壳用 `ProcessBuilder`，`environment().clear()` 后逐项填
+  `PATH/HOME/TMPDIR/ANDROID_ROOT/ANDROID_DATA/PROOT_TMP_DIR`，再合并运行时清单的 `launchEnv`。
+  `HOME` 是 App 的 `filesDir`，不是 `/root`。结论不变（宿主变量不继承、备份开关仍不可达），
+  但机制与取值之前写错了。
+- **文件选择器壳里已经实现**：`island_handle.dart:197` 的 `_files.attach()` →
+  `web_file_chooser.dart:26` 的 `setOnShowFileSelector` → 原生 `dsh/web-files` 通道
+  （content:// 校验、按文档代际取消）。所以 1.5.5 里"导入依赖文件选择器、壳没实现"的说法不成立；
+  面板那行提示保留为兜底（非 http(s) 页面、`canChoose()` 为假、旧版 App）。
+
+仍未实现、且确实在壳侧的只有三件：**导出用的保存/分享桥**（island 消息协议上限 16 KB，需分块）、
+`onJsPrompt`（webview_flutter 不暴露，插件已绕开，可不做）、**备份开关的环境变量**（壳能加，现未加）。
+
 ## [1.5.5] — 2026-11-12
 
 DSH Go（Android / WebView）适配。**没有真机验证**（本机 `adb devices` 为空），所以这一版只做

package/README.md

@@ -229,7 +229,10 @@ DSH 就会得到第二份空记忆，看起来像"记忆消失"。相对的 `$DS
 没有理由读得到。
 
 > 1.0.0 之前的构建曾把数据写在宿主进程 cwd 下（`.dsh-instruction-memory.json`）。
-> 首次启动新版本时会自动迁移到上述位置，并把原文件改名为 `*.migrated` 保留。
+> **1.5.7 起不再自动迁移**：启动时只**检出**该文件并在设置页提示（「导入旧位置数据 / 忽略」两项），
+> 由用户确认后才写入正式位置，并把原文件改名为 `*.migrated` 保留。原因是这条旧路径**既没有鉴权门、
+> 也没有人在回路里**：`process.cwd()` 不属于插件，任何同权限进程在那里放一份 store 形状的 JSON，
+> 下一轮就会被注入成"用户的长期指令"。检出状态在 `storage.legacyPending` 里，未确认前不读入、不注入。
 
 **当前存储格式为版本 2**（1.1.0 及更早写的是版本 1，见下文「多情境配置集」）。
 两者都能载入：版本 1 的文件会**平滑迁移**——其中的条目与用户形象全部归入一个名为
@@ -820,7 +823,7 @@ DSH Go 给官方 Web 服务器包了一层**构建期补丁** `runtime/patches/r
 
 | 位置 | 谁读它 | 作用 |
 | --- | --- | --- |
-| **`peerDependencies`**（`@deepseek-ai/dsh-system-prompt`） | **宿主**：`evaluatePluginCompatibility()`（`dsh-app-boot/lib/index.js`），在**安装**与 **profile 启动**时执行 | **真正的门禁**。不满足即拒绝（或要求显式授予精确版本豁免：`dsh plugin allow-version`）。门禁把 peer 的**范围值**与宿主版本（`dsh --version`）比较，peer 的**包名不参与解析**，只用来点名报错 |
+| **`peerDependencies`**（`@deepseek-ai/dsh-system-prompt`） | **宿主**：`evaluatePluginCompatibility()`（`dsh-app-boot`），在**安装**与 **profile 启动**时执行 | **门禁之一**，不是唯一。1.5.7 起两处实测结论必须同时写在这里：① 门禁读的是**宿主自身版本**（`getDshRuntimeVersion()` → `dsh-app-boot` 的 package.json），并用 `{ includePrerelease: true }` 求值，所以预发布行不会被误判；② 在 `0.2.2-rc.3` 的宿主实现里**存在 `engines.dsh` 时 `peerDependencies` 的区间被忽略**（`dsh-app-boot/src/plugin-compatibility.ts:52`）——也就是说这段 peer 区间可能完全不参与判定，只用来在报错时点名。本仓库仍让三处**逐字节同值**，就是为了不依赖"到底哪一处生效"。这条已从"真正的门禁"更正：**能证明它生效的只有实测，不能靠读声明推断** |
 | `dsh.engines.dsh` | 插件市场（第三方，服务端读取） | 市场卡片上的兼容性判定与展示 |
 | `dsh.compatibility.dsh` | 未找到读取方（官方文档与 DSH 树内均无） | 仅作人类可读的重复声明 |
 
@@ -956,9 +959,14 @@ FAIL  LIVE GUARD: the installed host 0.1.8-rc.1 is admitted by both modes  -> ..
 
 DSH Go（Android 客户端）内置的引擎就是**真实 DSH**，锁定 `@deepseek-ai/dsh` **`0.2.1-rc.4`**
 （`runtime/locks/dsh-0.2.1-rc.4/package.json`），在 PRoot rootfs 内以
-`dsh web --patch /etc/dsh-app/dsh-web.patch.yml --host 127.0.0.1 --port N --no-open` 运行；
-环境经 `/usr/bin/env -i` 清空后只注入 `HOME=/root`、`DSH_HOME=/root/.dsh`——**App 侧设置的
-`HOME` 对引擎无效**，别按字面读 `DshProcess.kt`。
+`dsh web --patch /etc/dsh-app/dsh-web.patch.yml --host 127.0.0.1 --port N --no-open` 运行。
+
+引擎进程的环境**不是** `/usr/bin/env -i`（早先这里写错了，2026-11-12 读源码更正）：壳用
+`ProcessBuilder(argv)`，先 `environment().clear()`，再逐个填 `PATH` / `HOME`（= **App 的
+`filesDir`**，不是 `/root`）/ `TMPDIR` / `ANDROID_ROOT` / `ANDROID_DATA` / `PROOT_TMP_DIR`，
+最后合并运行时清单的 `launchEnv` 与 guest 环境（`DshProcess.kt:172-188`）。也就是说：宿主变量
+一律不继承（这一点与 `env -i` 等效），但**壳想加什么变量都能加**——只是它目前没有加
+`DSH_INSTRUCTION_MEMORY_ALLOW_EXTERNAL_BACKUP`，所以备份目录开关在手机上仍然不可达。
 
 - **兼容性**：`0.2.1-rc.4` 正好是上表①档已实测的版本。2026-10-31 又用同一个 rc.4 在隔离的
   `DSH_HOME` 上复跑一遍 **21/21**（`compat-1016-live-check.mjs`；1.5.1 起该脚本第四个参数给启动
@@ -980,21 +988,28 @@ DSH Go（Android 客户端）内置的引擎就是**真实 DSH**，锁定 `@deep
 #### Android / WebView 适配（1.5.5 起）
 
 WebView 不是浏览器：它能把 `window.prompt` 保留成函数却永不弹框，能暴露 `<a download>` 却没有
-下载管线，也要宿主自己实现文件选择器。这三处以前都是**点了没反应、也不报错**，而它们恰好是手机上
-唯一的数据进出口。现在插件侧这样处理：
+下载管线。这两处以前都是**点了没反应、也不报错**，而它们恰好是手机上数据进出口的一半。现在插件侧
+这样处理：
 
 | 场景 | WebView 上的行为 | 依据 |
 | --- | --- | --- |
 | 导出 | 不再点击一个必然失败的链接，直接把完整 JSON 渲染在面板里（全选即可复制） | `client.js` 的 `isAndroidWebView()` + `exportFallback` 分支 |
-| 导入 / 从备份恢复 | 面板常驻一行提示：文件选择器不弹时改用「源码模式」粘贴 JSON（这条通道不依赖任何原生能力） | `import.webviewHint` |
+| 导入 / 从备份恢复 | **壳已实现文件选择**（`island_handle.dart:197` 的 `_files.attach()` → `web_file_chooser.dart:26` 的 `setOnShowFileSelector` → 原生 `dsh/web-files` 通道，content:// 校验 + 按文档代际取消）；面板那行提示只是兜底：页面不是 http(s)、`canChoose()` 为假、或旧版 App 时，请改用「源码模式」粘贴 JSON | 2026-11-12 读 DSH Go 源码确认 |
 | 批量加标签 | 不再调用 `window.prompt`：WebView 返回的 `null` 被判为"问不了"，直接走内联输入框 | `batchTagOutcome(..., { nullMeansUnavailable: true })` |
 | 实时更新 | 连续 6 次（≈30 秒）订阅失败后显示「实时更新已断开，请重新载入」；收到下一帧自动清除 | `source.onerror` 计数 |
 | 字号 / 手势条 | `text-size-adjust:100%` 挡住系统字号重排；挂载失败提示避开安全区 | CSS |
 
-**插件侧做不到、必须平台提供的**：`DownloadListener`（WebView 拿不到 `blob:` 的字节，
-插件无法自救）、`WebChromeClient.onShowFileChooser`、`onJsPrompt`、`env -i` 白名单
-（否则备份目录那个开关永远设不上）、以及 WebView 销毁/后台时显式关闭 SSE
-（否则半开连接会占满 32 条上限）。
+**插件侧做不到、必须平台提供的**（逐条都已核对 DSH Go 源码）：
+
+1. **保存/分享桥**：`<a download>` 的 `blob:` 字节 WebView 不会交给 `DownloadListener`，插件无法
+   自救。壳已有 `DshGoIsland` 通道和 `share_plus`，但没有任何"把这段文本存成文件"的消息类型 →
+   要新增一条（注意 island 消息协议上限只有 **16 KB**，`IslandMessageLimits.maxBytes`，而一次导出
+   可达 MB 级，必须分块）。
+2. **`onJsPrompt`**：webview_flutter 不暴露 JS 对话框，壳也没包 `WebChromeClient`；插件已改走内联
+   表单，所以**这是可选项**，不做也不影响功能。
+3. **环境变量白名单**：壳会 `environment().clear()` 后逐项填（`DshProcess.kt:172-188`），加一个
+   `DSH_INSTRUCTION_MEMORY_ALLOW_EXTERNAL_BACKUP=1` 就能让备份目录走出 rootfs。
+4. **WebView 销毁/后台时关闭 SSE**，否则半开连接会占满 32 条上限。
 
 **纵深开关**：Android 的回环是全机共享的，没有宿主鉴权门时"仅回环"不构成边界。设置
 `DSH_INSTRUCTION_MEMORY_REQUIRE_AUTH_FENCE=1` 后，缺少 `connection` 服务的 profile **直接

package/lib/client.js

@@ -366,6 +366,7 @@ window.__ModuleLoader__.load({
         'profiles.omitted': '本轮未包含',
         'profiles.omittedTitle': '这张形象因注入字数上限未进入本轮提示',
         'export.saved': '已开始下载；若没有文件出现，请检查浏览器的下载列表',
+        'export.savedToApp': '已交给 DSH Go 保存：在系统分享面板里选「保存到文件」即可',
         'export.fallbackHint': '当前环境无法触发文件下载，完整 JSON 已放在下面：全选复制后自行保存',
         'export.fallbackClose': '关闭',
         'import.webviewHint': 'Android / WebView 上若文件选择器不弹出，请改用「源码模式」粘贴 JSON',
@@ -383,6 +384,9 @@ window.__ModuleLoader__.load({
         'storage.savedAt': '最近保存：{time}',
         'storage.notSaved': '尚未保存到磁盘',
         'storage.migrated': '已从旧位置迁移：{path}（原文件保留为 *.migrated）',
+        'storage.legacyPending': '检测到旧位置（启动目录）有一份记忆：{path}（{entries} 条指令、{profiles} 个形象）。在你确认之前，它不会被导入，也不会进入注入。',
+        'storage.legacyAdopt': '导入旧位置数据',
+        'storage.legacyDismiss': '忽略',
         'preview.label': '当前注入到每轮系统提示词的内容',
         'preview.empty': '（当前没有生效中的指令）',
         'list.empty': '还没有指令记忆。点击「＋ 新增指令」添加第一条，例如“所有回答使用简体中文”。',
@@ -663,6 +667,7 @@ window.__ModuleLoader__.load({
         'profiles.omitted': 'Not in this turn',
         'profiles.omittedTitle': 'This persona was dropped by the injection limit and did not reach this turn',
         'export.saved': 'Download started — if no file appears, check your browser’s download list',
+        'export.savedToApp': 'Handed to DSH Go — pick “Save to Files” in the system share sheet',
         'export.fallbackHint': 'This environment cannot start a file download; the full JSON is below — select all and copy it',
         'export.fallbackClose': 'Close',
         'import.webviewHint': 'On Android / WebView, if the file picker does not open, paste the JSON into “Source mode” instead',
@@ -680,6 +685,9 @@ window.__ModuleLoader__.load({
         'storage.savedAt': 'Last saved: {time}',
         'storage.notSaved': 'Not yet saved to disk',
         'storage.migrated': 'Migrated from the old location: {path} (the original is kept as *.migrated)',
+        'storage.legacyPending': 'Found a memory store at the old location (startup directory): {path} ({entries} entries, {profiles} profiles). Nothing is imported or injected until you confirm.',
+        'storage.legacyAdopt': 'Import the old data',
+        'storage.legacyDismiss': 'Ignore',
         'preview.label': 'What the system prompt receives on every turn',
         'preview.empty': '(no active instructions right now)',
         'list.empty': 'No instructions yet. Click “＋ New instruction” to add your first one, e.g. “Always answer in Simplified Chinese”.',
@@ -1308,7 +1316,21 @@ window.__ModuleLoader__.load({
       const profileUsed = typeof inj.entryChars === 'number' && inj.entryChars >= 0
         && typeof inj.profileChars === 'number' && inj.profileChars >= 0
         ? inj.profileChars : 0
-      const used = entryUsed + profileUsed
+      // Measure the budgeted halves, never the whole section: on a host that
+      // publishes persona profiles, `chars` is the whole section while
+      // `entryChars`/`profileChars` are the two halves the Host caps against
+      // `budget`. Falling back to `chars` keeps older hosts (which publish
+      // neither half) working.
+      //
+      // A2's envelope is a third, fixed part of the section: it is reserved
+      // against the budget on the Host side, so the meter has to count it or it
+      // reads lower than the number the Host actually enforces. Older hosts do
+      // not publish it, and add zero.
+      const envelopeUsed = typeof inj.envelopeChars === 'number' && inj.envelopeChars >= 0
+        ? inj.envelopeChars : 0
+      const used = typeof inj.entryChars === 'number' && inj.entryChars >= 0
+        ? entryUsed + profileUsed + envelopeUsed
+        : (typeof inj.chars === 'number' && inj.chars >= 0 ? inj.chars : 0)
       const countFlagged = (list, wantTruncated) =>
         Array.isArray(list)
           ? list.filter((item) => item !== null && typeof item === 'object'
@@ -2633,6 +2655,23 @@ window.__ModuleLoader__.load({
         void send('export-to-dir', null)
       }
 
+      // ---- A4 legacy location: detected at boot, adopted only on request ----
+      //
+      // The Host no longer writes a store it finds at the startup directory into
+      // memory.json on its own. That path had no fence and no user in the loop,
+      // so anything able to drop a JSON file there could become the user's
+      // long-lived instructions. These two actions are the only way in.
+
+      function adoptLegacy() {
+        if (busy) return
+        void send('adopt-legacy', { baseRev: revOf() })
+      }
+
+      function dismissLegacy() {
+        if (busy) return
+        void send('dismiss-legacy', null)
+      }
+
       // ---- F14 whole-store restore (the "replace" door import does not open) ----
 
       async function handleRestoreFile(file) {
@@ -2736,6 +2775,39 @@ window.__ModuleLoader__.load({
         }
       }
 
+      /**
+       * Hand `text` to the DSH Go island bridge, in chunks that fit its 16 KB
+       * message cap (`IslandMessageLimits.maxBytes`). The app reassembles them
+       * and opens the system share sheet — the only export path a WebView has,
+       * since it never hands a `blob:` to a download listener.
+       *
+       * Returns false when the page is not inside DSH Go (or the bridge is
+       * missing), which leaves the browser path untouched.
+       */
+      async function sendToAppBridge(text, name) {
+        try {
+          const bridge = typeof window !== 'undefined' ? window.DshGoIsland : undefined
+          if (bridge === undefined || bridge === null || typeof bridge.postMessage !== 'function') return false
+          const id = 'im-' + Date.now().toString(36) + Math.random().toString(36).slice(2, 8)
+          const CHUNK = 6000
+          let i = 0
+          while (i < text.length) {
+            let end = Math.min(text.length, i + CHUNK)
+            // Never split a surrogate pair across two messages: each one is its
+            // own JSON document and a lone surrogate would not survive it.
+            const code = text.charCodeAt(end - 1)
+            if (end < text.length && code >= 0xd800 && code <= 0xdbff) end += 1
+            bridge.postMessage(JSON.stringify({
+              t: 'save', id, name, data: text.slice(i, end), last: end >= text.length,
+            }))
+            i = end
+          }
+          return true
+        } catch {
+          return false
+        }
+      }
+
       async function doExport() {
         try {
           const result = await callHost('export-data', null)
@@ -2744,6 +2816,13 @@ window.__ModuleLoader__.load({
             return
           }
           const text = JSON.stringify(result.export, null, 2) + '\n'
+          const fileName = 'dsh-instruction-memory-' + new Date().toISOString().slice(0, 10) + '.json'
+          // Inside DSH Go the app can actually write the file; prefer that over
+          // both the download link and the in-panel copy.
+          if (await sendToAppBridge(text, fileName)) {
+            setNotice(t('export.savedToApp'))
+            return
+          }
           /**
            * A WebView can expose `<a download>` and still have nowhere to put
            * the bytes: Android only saves when the embedding app implements a
@@ -2761,7 +2840,7 @@ window.__ModuleLoader__.load({
           const url = URL.createObjectURL(blob)
           const link = document.createElement('a')
           link.href = url
-          link.download = 'dsh-instruction-memory-' + new Date().toISOString().slice(0, 10) + '.json'
+          link.download = fileName
           document.body.appendChild(link)
           link.click()
           if (link.parentNode !== null) link.parentNode.removeChild(link)
@@ -3697,6 +3776,23 @@ window.__ModuleLoader__.load({
           ? h('div', { className: 'im-ok' }, t('storage.migrated', { path: storage.migratedFrom }))
           : null,
         storage.warning ? h('div', { className: 'im-warn' }, storage.warning) : null,
+        // A4: an explicit decision, never an automatic import.
+        storage.legacyPending
+          ? h('div', { className: 'im-warn' },
+            h('div', null, t('storage.legacyPending', {
+              path: storage.legacyPending.path,
+              entries: storage.legacyPending.entries,
+              profiles: storage.legacyPending.profiles,
+            })),
+            h('div', { className: 'im-row-wrap' },
+              h('button', {
+                className: 'im-btn im-btn-primary',
+                disabled: busy,
+                onClick: adoptLegacy,
+              }, t('storage.legacyAdopt')),
+              h('button', { className: 'im-btn', disabled: busy, onClick: dismissLegacy },
+                t('storage.legacyDismiss'))))
+          : null,
         // ---- F18 备份位置 ----
         h('div', { key: 'backup', className: 'im-backup' },
           h('div', { className: 'im-section-title' }, t('backup.section')),

package/lib/index.js

@@ -458,10 +458,41 @@ export function cutText(value, max) {
   return head
 }
 
+/**
+ * Characters that render as nothing (or as a different ORDER than the bytes
+ * say) and therefore must never survive into the injected prompt.
+ *
+ * The store content is user prose that ends up inside the system prompt, so an
+ * invisible character is not a cosmetic wart — it is a place where what the
+ * settings page shows and what the model reads diverge:
+ *
+ *  - U+202A…U+202E / U+2066…U+2069 (bidi embeddings, overrides, isolates) can
+ *    reverse the visual order of a run, so `evil` can be displayed as `live`
+ *    while the model still reads `evil` — the classic Trojan-Source trick, and
+ *    it defeats exactly the review the panel exists for.
+ *  - U+200B…U+200F / U+FEFF are zero-width: a word can be split so a keyword
+ *    filter, a duplicate check or the user's own eye misses it.
+ *  - C0 controls (minus tab and newline) and DEL carry nothing but can break
+ *    downstream tooling that assumes prompt text is printable.
+ *
+ * CR/LF are normalised first, and U+2028/U+2029 become real newlines rather
+ * than vanishing, so legitimate multi-line prose is preserved byte-for-byte in
+ * meaning while nothing invisible is.
+ */
+const INVISIBLE_CHARS = /[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]/g
+
+function stripInvisible(value) {
+  if (typeof value !== 'string') return ''
+  return value
+    .split('\u2028').join('\n')
+    .split('\u2029').join('\n')
+    .replace(INVISIBLE_CHARS, '')
+}
+
 function cleanText(value, max) {
   if (typeof value !== 'string') return ''
-  const trimmed = value.split('\r\n').join('\n').split('\r').join('\n').trim()
-  return cutText(trimmed, max)
+  const normalised = stripInvisible(value.split('\r\n').join('\n').split('\r').join('\n'))
+  return cutText(normalised.trim(), max)
 }
 
 /**
@@ -1452,10 +1483,61 @@ function requestPortOf(hostHeader) {
   return port === '80' || port === '443' ? '' : port
 }
 
+/**
+ * Defuse text that would read as OUR OWN structure instead of as the user's
+ * prose (A2).
+ *
+ * The injected block distinguishes "this is the harness speaking" from "this is
+ * what the user typed" only by its own headings and entry prefixes. Anyone who
+ * can write the store (the settings page, a hand edit, an import, or the model
+ * itself through the same-permission file path the README documents) can paste
+ * `## 用户长期指令记忆（Instruction Memory）` or `[始终｜优先级 高]` into
+ * `content`, and the model then sees two headings of which one is forged: a
+ * fabricated priority, or a fabricated "system" section that the store's own
+ * renderer never produced.
+ *
+ * Only the markers that NAME this plugin's blocks are neutralised, and only at
+ * the start of a line, so ordinary Markdown (`## 实验步骤`) and ordinary
+ * bracketed prose survive untouched. The marker character is swapped for a
+ * full-width look-alike: the text stays readable to the user, but it can no
+ * longer equal the token the model was told to trust.
+ */
+const FORGED_HEADING = /^([ \t]*)(#{1,6})([ \t]*)(用户长期指令记忆|关于用户（用户形象）|关于用户|用户形象)/gm
+const FORGED_ENTRY_PREFIX = /^([ \t]*)\[(始终|按需)(｜优先级)/gm
+
+function neutralizeForgedStructure(value) {
+  if (typeof value !== 'string' || value === '') return value
+  return value
+    // A hand-written copy of the envelope would close the section early and put
+    // everything after it outside the block the model was told to trust, which
+    // is the whole point of having an envelope. Full-width brackets keep the
+    // text readable while making the token unusable.
+    .replace(/<\s*(\/?)\s*user-instruction-memory\s*>/gi,
+      (match, slash) => '〔' + (slash === '/' ? '/' : '') + 'user-instruction-memory〕')
+    .replace(FORGED_HEADING, '$1＃$3$4')
+    .replace(FORGED_ENTRY_PREFIX, '$1［$2$3')
+}
+
+/**
+ * The delimiters around the whole injected section (A2).
+ *
+ * A heading alone cannot tell the model where this block ends: the section had
+ * no closing token, so a content line shaped like the start of something else
+ * read as if it were still inside the user's memory. The envelope gives the
+ * section an unambiguous start and end that ordinary prose cannot produce by
+ * accident, and `neutralizeForgedStructure` keeps a hand-written copy of it from
+ * being reproduced inside `content`.
+ *
+ * The cost is reserved against the character budget in planInjection, so the
+ * `text.length <= budget` invariant the panel shows the user still holds.
+ */
+const MEMORY_ENVELOPE_OPEN = '<user-instruction-memory>\n'
+const MEMORY_ENVELOPE_CLOSE = '\n</user-instruction-memory>'
+
 function formatEntry(entry, tag) {
   const lines = ['[' + tag + '｜优先级 ' + priorityLabel(entry.priority) + '] ' + entry.title]
   if (entry.mode === 'auto' && entry.when !== '') lines.push('适用场景：' + entry.when)
-  lines.push(entry.content)
+  lines.push(neutralizeForgedStructure(entry.content))
   return lines.join('\n')
 }
 
@@ -1539,7 +1621,7 @@ function buildProfilesBlock(profiles, budget) {
       ? profile.name
       : singleLine(profile.content, 20)
     const id = typeof profile.id === 'string' ? profile.id : ''
-    const block = '### ' + name + '\n' + profile.content
+    const block = '### ' + name + '\n' + neutralizeForgedStructure(profile.content)
     const sep = blocks.length === 0 ? 0 : 2
     // Reserve the omission footer up front: the disclosure must never be the
     // thing squeezed out by the profiles that caused it. Reserve the WORST
@@ -1759,16 +1841,27 @@ export function planInjection(data, now = Date.now()) {
   // joined with: if the persona section took the whole budget, every entry
   // would be dropped and its footer still has to fit.
   const JOIN = '\n\n'.length
+  // The envelope costs characters, so it comes out of the budget BEFORE the
+  // persona and the entries spend it. `text.length <= budget` is the one
+  // invariant the panel shows the user; an envelope added on top would break it
+  // silently, and reserving afterwards would only move the overshoot into the
+  // persona, which is never trimmed.
+  const envelopeCost = MEMORY_ENVELOPE_OPEN.length + MEMORY_ENVELOPE_CLOSE.length
+  const innerBudget = Math.max(0, budget - envelopeCost)
   const activeEntryCount = (scoped.entries || []).filter((entry) => entry && entry.enabled === true && entry.content !== '').length
   const entryReserve = activeEntryCount > 0 ? entryOmittedFooter(activeEntryCount).length + JOIN : 0
-  const persona = buildProfilesBlock(scoped.profiles, Math.max(0, budget - entryReserve))
-  const entryPlan = planEntries(scoped, Math.max(0, budget - persona.chars))
+  const persona = buildProfilesBlock(scoped.profiles, Math.max(0, innerBudget - entryReserve))
+  const entryPlan = planEntries(scoped, Math.max(0, innerBudget - persona.chars))
   const parts = []
   if (persona.text !== '') parts.push(persona.text)
   if (entryPlan.text !== '') parts.push(entryPlan.text)
   else if (parts.length > 0 && entryPlan.omitted.length > 0) parts.push(entryOmittedFooter(entryPlan.omitted.length))
+  const inner = parts.join('\n\n')
   return {
-    text: parts.join('\n\n'),
+    // Empty stays EMPTY, byte for byte: a store with nothing to say must leave
+    // the prompt identical to a deployment without this plugin, so no envelope
+    // is emitted around nothing.
+    text: inner === '' ? '' : MEMORY_ENVELOPE_OPEN + inner + MEMORY_ENVELOPE_CLOSE,
     budget,
     activeCount: entryPlan.activeCount,
     included: entryPlan.included,
@@ -1800,7 +1893,24 @@ export function apply(ctx, deps = {}) {
    * to be deleted mid-test, which no contract test can do reproducibly.
    */
   const watchStore = typeof deps.watch === 'function' ? deps.watch : watch
-  const systemPrompt = ctx.systemPrompt
+  /**
+   * A1: the prompt service is held in a mutable slot, not a one-shot capture.
+   *
+   * `ctx.systemPrompt` read at apply() time is only valid until the host
+   * disposes and republishes the service (host restart, fiber remount, a
+   * profile reload that swaps the row's dependencies). After that the captured
+   * reference points at a DEAD service: `section()` there still returns a
+   * disposer and throws nothing, the live service never receives a section, and
+   * the prompt silently loses its memory for the rest of the process — the one
+   * failure mode this plugin exists to prevent.
+   *
+   * The webServer registration further down already treats this shape
+   * explicitly ("registering on top of the previous registration would LEAK
+   * it"). The prompt side now matches it: `systemPromptRef` is rewired by the
+   * non-blocking `ctx.inject(['systemPrompt'], …)` right where the route is
+   * wired, and `syncSection` re-registers against whatever the slot holds.
+   */
+  let systemPromptRef = ctx.systemPrompt === undefined ? null : ctx.systemPrompt
 
   const state = {
     data: {
@@ -1837,6 +1947,15 @@ export function apply(ctx, deps = {}) {
     loadedFrom: null,
     savedAt: null,
     migratedFrom: null,
+    /**
+     * A4: a store-shaped file found at the legacy (process cwd) location, held
+     * for the user to confirm. `{ path, entries, profiles }` or null.
+     *
+     * Detection is deliberate and adoption is not: see the load branch. The
+     * panel renders this as an explicit "import the old data" action, so the
+     * decision belongs to the user the way it always should have.
+     */
+    legacyPending: null,
     /**
      * Set while the store on disk declares an unsupported format version.
      * Mutating commands are refused in that state: a save would rewrite a
@@ -1855,6 +1974,16 @@ export function apply(ctx, deps = {}) {
     shapeRejected: false,
     sectionRegistered: false,
     sectionError: null,
+    /**
+     * A7: whether the settings-page route is actually mounted.
+     *
+     * Without it, a profile that never publishes `webServer` (headless, tui, a
+     * custom shell) left the plugin working for injection while the settings
+     * page simply had no route — announced by one console.error and nothing
+     * else. The panel cannot render, so the SNAPSHOT has to carry the fact for
+     * the diagnostics view and for any support dump.
+     */
+    routeRegistered: false,
     /** Whether a store file is actually present on disk (diagnostics + the panel). */
     storeExists: false,
     /** How many history snapshots the current directory holds (diagnostics). */
@@ -2146,9 +2275,10 @@ export function apply(ctx, deps = {}) {
    */
   const resolveSectionOrder = () => {
     try {
-      if (systemPrompt === null || typeof systemPrompt.getSectionOrder !== 'function') return SECTION_ORDER
-      const lo = systemPrompt.getSectionOrder('FILE_REFERENCE')
-      const hi = systemPrompt.getSectionOrder('TOOL_BASH')
+      const service = systemPromptRef
+      if (service === null || typeof service.getSectionOrder !== 'function') return SECTION_ORDER
+      const lo = service.getSectionOrder('FILE_REFERENCE')
+      const hi = service.getSectionOrder('TOOL_BASH')
       if (!Number.isFinite(lo) || !Number.isFinite(hi) || hi <= lo) return SECTION_ORDER
       return lo + (hi - lo) / 2
     } catch {
@@ -2159,7 +2289,19 @@ export function apply(ctx, deps = {}) {
   const syncSection = () => {
     if (disposed) return
     const wanted = sectionText() !== ''
+    const service = systemPromptRef
     if (wanted && sectionDispose === null) {
+      // A1: no live service yet. That is not an error to report — the
+      // `ctx.inject(['systemPrompt'], …)` wired below re-runs syncSection the
+      // moment one is published — but registering through a null slot would
+      // throw a TypeError into the load path instead of leaving the plugin
+      // usable without its prompt half.
+      if (service === null || typeof service.section !== 'function') {
+        state.sectionRegistered = false
+        state.sectionError = null
+        scheduleMuteTimer()
+        return
+      }
       try {
         // `interpolate: false` is load-bearing, not a hint. The host runs every
         // section through `{{variable}}` interpolation by DEFAULT and THROWS on
@@ -2170,7 +2312,7 @@ export function apply(ctx, deps = {}) {
         // agent turn at renderPrompt(). This section is literal text and never
         // references a host variable, so opt out explicitly.
         const order = resolveSectionOrder()
-        sectionDispose = systemPrompt.section({
+        sectionDispose = service.section({
           name: SECTION_NAME,
           order,
           text: assembledSectionText,
@@ -3219,6 +3361,60 @@ export function apply(ctx, deps = {}) {
    *
    * @returns whether this load performed a successful write.
    */
+  /**
+   * A13: sweep temp files a crashed write left behind.
+   *
+   * `writeToDisk` is atomic by rename: it writes `memory.json.tmp-<pid>-<uuid>`,
+   * fsyncs, then renames. A crash between `open` and `rename` leaves a COMPLETE
+   * COPY OF THE USER'S INSTRUCTION MEMORY on disk under that name, in the same
+   * directory, forever — and nothing ever looked for it. It is the store's own
+   * content (not a redacted log line), so it inherits exactly the exposure of
+   * memory.json while being invisible to every UI path.
+   *
+   * Only the plugin's own name shape is touched, and a temp file whose recorded
+   * pid is still alive is left alone: that is another process in the middle of
+   * a legitimate write, not debris.
+   */
+  const cleanupOrphanTempFiles = async () => {
+    const dir = dirname(storePath)
+    const prefix = basename(storePath) + '.tmp-'
+    let names = []
+    try {
+      names = await readdir(dir)
+    } catch {
+      return 0
+    }
+    let removed = 0
+    for (const name of names) {
+      if (!name.startsWith(prefix)) continue
+      const rest = name.slice(prefix.length)
+      const dash = rest.indexOf('-')
+      const pidText = dash === -1 ? rest : rest.slice(0, dash)
+      const pid = Number.parseInt(pidText, 10)
+      if (Number.isFinite(pid) && pid > 0 && pid !== process.pid) {
+        let alive = true
+        try {
+          process.kill(pid, 0)
+        } catch (err) {
+          // ESRCH means the writer is gone; EPERM means it exists but belongs to
+          // someone else — treat that as alive and leave the file alone.
+          alive = err !== null && err !== undefined && err.code === 'EPERM'
+        }
+        if (alive) continue
+      }
+      try {
+        await unlink(join(dir, name))
+        removed += 1
+      } catch {
+        // Best effort: a file we cannot remove must not stop the load.
+      }
+    }
+    if (removed > 0) {
+      logInfo('removed ' + removed + ' orphaned temp store file(s) left by an interrupted write')
+    }
+    return removed
+  }
+
   const readFromDisk = async () => {
     state.storagePath = storePath
     state.storageDisplay = storePath
@@ -3234,6 +3430,8 @@ export function apply(ctx, deps = {}) {
     // and the panel silently disagreed. Forcing the next save to write is the
     // cheap side of that trade.
     lastPersistedKey = null
+    // A13: drop temp copies a crashed write left in the store directory.
+    await cleanupOrphanTempFiles()
 
     /**
      * A store declaring an unsupported format version: adopt nothing, write
@@ -3425,8 +3623,20 @@ export function apply(ctx, deps = {}) {
       // An unusable backup must never block a fresh store; fall through.
     }
 
-    // 2. Migrate the pre-release location (host process cwd). This is the only
-    //    reason the legacy name is still known to this plugin.
+    // 2. A pre-release store at the host process cwd (the legacy location) is
+    //    DETECTED here, never adopted here (A4).
+    //
+    //    This used to write it straight into memory.json and inject it on the
+    //    next turn, with no user action and no confirmation. It was the only
+    //    write path in the plugin with neither an authentication fence nor a
+    //    human in the loop, and `process.cwd()` is not the plugin's to trust:
+    //    any process running as the same user could drop a store-shaped JSON
+    //    there and have it become the long-lived instruction memory injected
+    //    into every subsequent prompt.
+    //
+    //    The file is now only ANNOUNCED. Adopting it takes the explicit
+    //    `adopt-legacy` command from the settings page, which is a deliberate
+    //    user action behind the same fence every other mutation uses.
     const legacyPath = join(process.cwd(), LEGACY_FILE_NAME)
     try {
       const parsed = await readStoreFile(legacyPath)
@@ -3441,18 +3651,18 @@ export function apply(ctx, deps = {}) {
           if (loaded.rejectedVersion !== undefined) {
             // A legacy file in a future format is not ours to migrate or judge.
             state.storageError = '旧位置文件为不支持的格式版本 ' + loaded.rejectedVersion + '，已忽略'
-            return false
-          }
-          state.data = loaded.data
-          state.storageWarning = loadWarnings(loaded)
-          const migrated = await writeToDisk()
-          if (migrated) {
-            state.migratedFrom = legacyPath
-            // Keep the original as evidence instead of deleting user data.
-            await rename(legacyPath, legacyPath + '.migrated').catch(() => {})
+          } else {
+            const entryCount = loaded.data.entries.length
+            const profileCount = loaded.data.profiles.length
+            state.legacyPending = { path: legacyPath, entries: entryCount, profiles: profileCount }
+            const warnings = loadWarnings(loaded)
+            state.storageWarning = (warnings !== null ? warnings + '；' : '')
+              + '检测到旧位置（启动目录）有一份记忆：' + legacyPath
+              + '（' + entryCount + ' 条指令、' + profileCount + ' 个形象）。'
+              + '为避免未经确认就注入一个外部文件，本次没有自动导入；'
+              + '确认内容无误后在设置页点击「导入旧位置数据」。'
+            state.loadedFrom = 'legacy cwd file (detected, awaiting confirmation)'
           }
-          state.loadedFrom = 'legacy cwd file (migrated)'
-          return migrated
         }
       }
     } catch (err) {
@@ -3471,7 +3681,10 @@ export function apply(ctx, deps = {}) {
     //    `state` (see ensureStoreMaterialized). Until then the panel shows
     //    "尚未写入磁盘", a state its UI already renders.
     needsMaterialize = true
-    state.loadedFrom = 'first run (no store on disk yet)'
+    // A detected-but-unconfirmed legacy file keeps its own `loadedFrom`: the
+    // panel must be able to say "there is a store next door, waiting for you"
+    // rather than "first run, nothing anywhere" (A4).
+    if (state.legacyPending === null) state.loadedFrom = 'first run (no store on disk yet)'
     state.storeExists = false
     return false
   }
@@ -3662,6 +3875,13 @@ export function apply(ctx, deps = {}) {
          * allow-list is the only thing standing in front of a fence-less route.
          */
         trustedHostCount: trustedHosts.length,
+        /**
+         * A7: is the settings route actually mounted? `false` means this
+         * profile published no `webServer` (or the registration threw), so the
+         * panel has no way in even though injection works. Published here
+         * because a panel that cannot render cannot report its own absence.
+         */
+        routeRegistered: state.routeRegistered === true,
       },
       /**
        * F12: load-side diagnostics that used to be log-only. `loadedFrom` says
@@ -3679,6 +3899,19 @@ export function apply(ctx, deps = {}) {
         warning: state.storageWarning !== null ? state.storageWarning : state.backupError,
         savedAt: state.savedAt,
         migratedFrom: state.migratedFrom === null ? null : displayPath(state.migratedFrom),
+        /**
+         * A4: a store-shaped file sitting at the legacy (startup directory)
+         * location, waiting for the user to confirm. `null` when there is
+         * nothing pending. The panel renders this as an explicit action; the
+         * file is never read into memory.json on its own.
+         */
+        legacyPending: state.legacyPending === null
+          ? null
+          : {
+            path: displayPath(state.legacyPending.path),
+            entries: state.legacyPending.entries,
+            profiles: state.legacyPending.profiles,
+          },
         /** false until the store file has actually been written (see readFromDisk step 3). */
         onDisk: state.storeExists,
         /** Backup location (F18): '' means "next to the store file". */
@@ -3706,6 +3939,13 @@ export function apply(ctx, deps = {}) {
          */
         muted: isMuted(state.data, Date.now()),
         chars: preview.length,
+        /**
+         * A2: how much of `chars` is the fixed envelope around the block. The
+         * panel's meter measures `entryChars + profileChars + envelopeChars`
+         * (the parts the budget is actually spent on) instead of `chars`, so
+         * it has to know this number; older clients simply ignore the field.
+         */
+        envelopeChars: preview === '' ? 0 : MEMORY_ENVELOPE_OPEN.length + MEMORY_ENVELOPE_CLOSE.length,
         /**
          * The budget decision behind `preview`, for the settings page's
          * usage meter and per-entry marks. `budget` is the effective ceiling;
@@ -4761,6 +5001,76 @@ export function apply(ctx, deps = {}) {
     return settle([head + describeStoreShape(state.data), ...notes].join('；'), saved)
   }
 
+  /**
+   * A4: adopt the store-shaped file the boot load found at the legacy
+   * (process cwd) location.
+   *
+   * Reachable only from the settings page, and only when the load actually
+   * found such a file: it re-reads THAT path (never one supplied by the
+   * request), and refuses anything that stopped looking like a store since —
+   * so a file swapped in between detection and confirmation is caught rather
+   * than imported. Adoption is a deliberate user action behind the same route
+   * fence every other mutation uses, which is the whole point of the change.
+   */
+  const adoptLegacy = (baseRev) => enqueue(async () => {
+    if (state.versionRejected) return versionRefusal()
+    if (isStaleBaseRev(baseRev)) return conflictResponse()
+    const pending = state.legacyPending
+    if (pending === null) {
+      return { ok: false, saved: false, message: '没有待导入的旧位置数据', snapshot: snapshot() }
+    }
+    let parsed = null
+    try {
+      parsed = await readStoreFile(pending.path)
+    } catch (err) {
+      return {
+        ok: false,
+        saved: false,
+        message: '读取旧位置文件失败：' + describeErrorSafe(err),
+        snapshot: snapshot(),
+      }
+    }
+    if (parsed === null) {
+      state.legacyPending = null
+      state.storageWarning = '旧位置文件已不存在，待导入状态已清除：' + pending.path
+      return { ok: false, saved: false, message: '旧位置文件已不存在，待导入状态已清除', snapshot: snapshot() }
+    }
+    if (storeShapeVerdict(parsed) !== 'store') {
+      state.legacyPending = null
+      state.storageWarning = '旧位置文件的内容已不是本插件的记忆存储，待导入状态已清除'
+      return { ok: false, saved: false, message: '旧位置文件已不是本插件的记忆存储，未导入', snapshot: snapshot() }
+    }
+    const result = await commitAdoptedStore(parsed, '已导入旧位置数据：')
+    if (result !== null && result.ok === true) {
+      state.legacyPending = null
+      state.storageWarning = null
+      state.storageError = null
+      state.migratedFrom = pending.path
+      state.loadedFrom = 'legacy cwd file (adopted after confirmation)'
+      // Keep the original as evidence instead of deleting user data.
+      await rename(pending.path, pending.path + '.migrated').catch(() => {})
+      return { ...result, snapshot: snapshot() }
+    }
+    return result
+  })
+
+  /**
+   * A4: "not now" for a detected legacy file. Clears the pending flag and the
+   * announcement, and deliberately leaves the file alone — nothing was read
+   * into the store, so there is nothing to undo.
+   */
+  const dismissLegacy = () => {
+    const had = state.legacyPending !== null
+    state.legacyPending = null
+    state.storageWarning = null
+    return {
+      ok: true,
+      saved: false,
+      message: had ? '已忽略旧位置数据（原文件未改动）' : '没有待导入的旧位置数据',
+      snapshot: snapshot(),
+    }
+  }
+
   const writeSource = (text, baseRev) => enqueue(async () => {
     if (state.versionRejected) return versionRefusal()
     // Deliberately NOT gated on shapeRejected: hand-editing the source is how
@@ -5312,6 +5622,10 @@ export function apply(ctx, deps = {}) {
         return importData(
           args !== null && typeof args === 'object' ? args.payload : null,
           args !== null && typeof args === 'object' ? args.baseRev : undefined)
+      case 'adopt-legacy':
+        return adoptLegacy(args !== null && typeof args === 'object' ? args.baseRev : undefined)
+      case 'dismiss-legacy':
+        return dismissLegacy()
       case 'send-feedback':
         return sendFeedback(args)
       case 'batch':
@@ -5578,6 +5892,65 @@ export function apply(ctx, deps = {}) {
     return true
   }
 
+  /**
+   * A9/A12: the last line of defence for MUTATIONS on a fence-less route.
+   *
+   * `originVerdictRefuses` above only judges what a browser volunteers. A local
+   * process (curl, a script, another app) sends no `Origin` at all, and every
+   * branch of requestOriginVerdict is conditioned on an Origin being present —
+   * so on a profile that publishes a web server WITHOUT a `connection` service
+   * the settings route accepted unauthenticated writes from anything running as
+   * the same user. Loopback used to be a boundary; it stopped being one the
+   * moment any program on the machine runs as that user.
+   *
+   * Two rules, both limited to mutating methods so a read-only panel keeps
+   * working in those deployments:
+   *
+   *  1. A widened DSH_INSTRUCTION_MEMORY_TRUSTED_HOSTS list is a HOSTNAME rule,
+   *     not an identity check. Combined with a non-loopback bind
+   *     (`hostGuarded === false`) and no fence, the only thing in front of the
+   *     route is a name an attacker picks, so writes are refused outright (503)
+   *     instead of relying on an orange warning in the panel.
+   *  2. Without a fence, a mutation must carry a browser origin marker: either
+   *     `Origin` or `Sec-Fetch-Site: same-origin`. A page always sends one of
+   *     the two, so the settings page is unaffected; a bare process is refused
+   *     (403). `Sec-Fetch-Site` is accepted because script cannot set it — it is
+   *     the browser's own claim, not the caller's.
+   *
+   * Set DSH_INSTRUCTION_MEMORY_REQUIRE_AUTH_FENCE=1 to make the whole route fail
+   * closed instead of falling back to these two rules.
+   */
+  const READ_ONLY_METHODS = new Set([
+    'state', 'history-list', 'read-source', 'export-data', 'export-to-dir', 'reload', 'send-feedback',
+  ])
+
+  const writeGateRefusal = (method, headers) => {
+    const name = typeof method === 'string' ? method : ''
+    if (READ_ONLY_METHODS.has(name)) return null
+    if (connectionGate !== null) return null
+    const head = headers !== null && typeof headers === 'object' ? headers : {}
+    if (guardHost !== true && trustedHosts.length > 0) {
+      return {
+        status: 503,
+        message: '拒绝修改请求：当前部署绑定在非回环地址、没有宿主的会话鉴权门，且仅靠一份主机名白名单（'
+          + trustedHosts.length + ' 条）。白名单是主机名规则而非身份校验，因此写操作已停用；'
+          + '请改为回环绑定，或让宿主提供 connection 服务。',
+      }
+    }
+    const origin = typeof head.origin === 'string' ? head.origin.trim() : ''
+    const fetchSite = typeof head['sec-fetch-site'] === 'string'
+      ? head['sec-fetch-site'].trim().toLowerCase() : ''
+    if (origin === '' && fetchSite !== 'same-origin') {
+      return {
+        status: 403,
+        message: '拒绝无来源标记的修改请求：当前 profile 没有宿主的会话鉴权门，因此修改必须来自浏览器'
+          + '（带 Origin 或 Sec-Fetch-Site: same-origin）。设置页读写不受影响；本机脚本 / curl 的写入会被拒绝。'
+          + '如需完全关闭该路由，设置 DSH_INSTRUCTION_MEMORY_REQUIRE_AUTH_FENCE=1。',
+      }
+    }
+    return null
+  }
+
   const handler = (req, res) => {
     // Authentication before anything else: not the method, not the body, not
     // the size. A rejection must not leak which methods exist.
@@ -5686,6 +6059,16 @@ export function apply(ctx, deps = {}) {
         let result
         try {
           const payload = body === '' ? {} : JSON.parse(body)
+          // A9/A12: mutations on a fence-less route need a browser origin
+          // marker. Checked after parsing (the method is only known now) and
+          // before dispatch, so a refused write never touches the store.
+          const gateRefusal = writeGateRefusal(payload.method, req.headers)
+          if (gateRefusal !== null) {
+            logInfo('route refused a mutation: ' + gateRefusal.message)
+            res.writeHead(gateRefusal.status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
+            res.end(JSON.stringify({ ok: false, saved: false, message: gateRefusal.message, snapshot: snapshot() }))
+            return
+          }
           result = await dispatch(payload.method, payload.args === undefined ? null : payload.args)
         } catch (err) {
           result = { ok: false, saved: false, message: describeErrorSafe(err), snapshot: snapshot() }
@@ -5702,6 +6085,56 @@ export function apply(ctx, deps = {}) {
   // losing the prompt injection along with the settings page. The callback also
   // fixes the original race properly — it runs whenever the service is
   // published, not only if it happened to beat this row to the mount.
+  /**
+   * A1: keep the prompt service subscription live for as long as this row is.
+   *
+   * `systemPrompt` is a declared dependency (`export const inject`), so the
+   * initial capture in apply() is normally valid. It is NOT valid after the host
+   * republishes the service: the old instance keeps accepting `section()` calls
+   * and keeps returning a disposer, which is why the failure is silent. Wiring
+   * a non-blocking child fiber here is the same shape the webServer route below
+   * uses, for the same reason.
+   *
+   * The callback is a no-op when the published service is the one already held,
+   * so a host that publishes once behaves exactly as before.
+   */
+  ctx.inject(['systemPrompt'], (scope) => {
+    const service = scope === null || scope === undefined ? null : scope.systemPrompt
+    if (service === null || service === undefined || typeof service.section !== 'function') return
+    if (service === systemPromptRef) return
+
+    const previous = systemPromptRef
+    systemPromptRef = service
+    // Drop the registration made against the previous instance BEFORE creating
+    // one on the new: two live registrations would both be pulled into every
+    // prompt (the block appears twice) and would keep the dead service wired.
+    if (sectionDispose !== null) {
+      const dispose = sectionDispose
+      sectionDispose = null
+      try {
+        dispose()
+      } catch (err) {
+        console.error('[instruction-memory] stale prompt section dispose failed:', err)
+      }
+    }
+    state.sectionRegistered = false
+    if (typeof scope.effect === 'function') {
+      scope.effect(() => () => {
+        if (systemPromptRef !== service) return
+        // The service went away. Stop pointing at it so the next publish can
+        // re-register, and record it instead of pretending nothing happened:
+        // an injected memory that quietly stops being injected is the one
+        // symptom a user cannot diagnose from the panel.
+        systemPromptRef = null
+        state.sectionRegistered = false
+        state.sectionError = '注入服务已重新发布/下线，发布后会自动恢复注入'
+        logInfo('systemPrompt disposed or republished while mounted; the section will re-register when it returns')
+      })
+    }
+    logInfo('systemPrompt republished; re-registering the instruction section against the new service')
+    syncSection()
+  })
+
   // F19: take the harness authentication fence when the profile has one.
   // Same non-blocking shape as the web server below — a profile without a
   // browser never publishes `connection`, and the prompt injection must not
@@ -5765,14 +6198,17 @@ export function apply(ctx, deps = {}) {
     }
     try {
       routeDispose = webServer.register({ kind: 'prefix', path: API_PREFIX, handler })
+      state.routeRegistered = true
       logDebug('settings route registered at ' + API_PREFIX + ' (boundHost=' + boundHost + ', hostGuard=' + guardHost + ')')
     } catch (err) {
       console.error('[instruction-memory] route registration failed:', err)
       routeDispose = null
+      state.routeRegistered = false
     }
     // The child fiber is owned by this one, so unmounting the plugin still
     // disposes the route even though it was registered here.
     scope.effect(() => () => {
+      state.routeRegistered = false
       if (routeDispose !== null) {
         const dispose = routeDispose
         routeDispose = null

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-instruction-memory",
-  "version": "1.5.5",
-  "description": "User-only instruction memory for DSH: long-term instructions maintained in the settings UI and auto-injected into every conversation — the model has no write access. 指令记忆：只由用户在设置页维护的长期指令，自动注入此后每轮对话；模型没有任何写入口。",
+  "version": "1.5.7",
+  "description": "User-only instruction memory for DSH: long-term instructions maintained in the settings UI and auto-injected into every conversation — the plugin registers no model-facing tool, so the model has no in-plugin write path (a same-permission process can still edit the file directly). 指令记忆：只由用户在设置页维护的长期指令，自动注入此后每轮对话；插件不注册任何面向模型的工具，模型没有插件内的写入口。",
   "license": "MIT",
   "type": "module",
   "repository": {
@@ -54,6 +54,11 @@
   "peerDependencies": {
     "@deepseek-ai/dsh-system-prompt": ">=0.1.3-alpha.2 <0.1.4 || >=0.1.4-0 <0.1.5-0 || >=0.1.5-alpha.1 <0.1.6-0 || >=0.1.6-alpha.0 <0.1.7-0 || >=0.1.7-alpha.0 <0.2.0-0 || >=0.2.1-alpha.0 <0.3.0-0 || >=0.2.2-alpha.0 <0.3.0-0 || >=0.2.0-0 <0.3.0-0"
   },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/dsh-system-prompt": {
+      "optional": true
+    }
+  },
   "publishConfig": {
     "access": "public"
   },