dsh-instruction-memory 1.5.6 → 1.6.0

package/CHANGELOG.md

@@ -7,6 +7,115 @@
 > 1.0.13 起由 CI 经 OIDC Trusted Publishing 发布（首个带 provenance 的版本）。
 > 这些历史 tag **不应回填**——npm 上的版本号已被占用。
 
+## [1.6.0] — 2026-11-14
+
+让「按需（auto）」条目第一次真正有机会被执行。此前的 auto 只在会话开头注入一次、措辞是「参考」，
+模型读完第一轮就忘了；而「每次给最终答案前」这类时机，从来没有任何东西提醒过它。
+
+### 新增
+
+- **触发词提升（`triggers`）**：条目可配置最多 8 个触发词（每项 ≤24 字）。每个真人回合
+  （`user/message`，`source.kind === 'user'`）用户话匹配一次，命中即把该条目在本回合提升为
+  「本轮强制」，并重新注册 prompt section，使**当轮**注入立刻带上新标记。未配触发词的条目行为不变。
+- **设置页触发词输入**：`mode=auto` 时编辑器多一个触发词输入（回车添加，复用现有标签组件），
+  中英双语文案齐备；`memory.schema.json` 同步新增 `triggers` 定义。
+
+### 变更（行为）
+
+- **auto 的注入语义从「按需」改为「条件必做」**：条目前缀 `[按需｜优先级 X]` 改为
+  `[条件必做｜…]`；场景行 `适用场景：…` 改为 `出现以下情形时必须执行，不得跳过：…`。
+  起因是注入块头部那句「[按需] 条目仅在与当前问题或任务相关时生效；不相关时直接忽略」——
+  它等于插件自己给了模型一个合法跳过的理由。
+- 伪造前缀中和正则同步扩到 `条件必做`（保留 `按需` 以兼容历史内容）。
+
+### 修复
+
+- `ctx.on` 在没有事件总线的假宿主（测试与裁剪环境）上会抛 `TypeError`，改为能力检测后再订阅。
+
+### 兼容性
+
+- 存储格式不变（`version: 2`）；新字段缺省为空数组。旧版本读到含 `triggers` 的文件会忽略该字段。
+
+## [1.5.7] — 2026-11-14
+
+针对**最新版桌面端（`dsh-desktop-runtime 0.2.2-rc.3`，Electron）与网页端**全量审查后的修复轮。
+审查结论先说清楚：**功能性缺陷只有 1 条**（测试守卫读错宿主），其余是注入链路的加固、一处
+无鉴权无确认的自动写路径、以及若干"声明/文档与实现不符"。审查同时**撤回了一条看起来该改、
+实测不该改**的建议（见末节）。
+
+### 修复
+
+- **回归守卫读错宿主，对着错误的版本虚假通过（B1）**：`host-range-test.mjs` 的 LIVE GUARD
+  只在 `profiles/*/node_modules`、`/usr/lib…`、`/usr/local/lib…` 和 TRAE 字面路径里找宿主。
+  桌面端把 dsh 打包进 `app.asar`，这些路径**永远不命中**；本机因此命中一条与本机无关的软链
+  （TRAE 捆绑的 `0.2.2-alpha.2`），并在桌面端实际运行 `0.2.2-rc.3` 时打印
+  `PASS LIVE GUARD: the installed host 0.2.2-alpha.2 ...`。这正是该守卫注释里声称要防的
+  false negative。现在优先读取 `resources/runtime/primary-runtime/runtime.json` 的
+  `desktopVersion`（可选 `DSH_DESKTOP_RUNTIME_ROOT` 覆盖），桌面证据存在时以它为准，
+  `profiles/node_modules` 的软链树降级为"没有桌面安装时"的证据；标签里**打印版本来源路径**，
+  免得下次读错树又是静默通过。
+- **`systemPrompt` 一次性捕获，服务重发布后注入静默死亡（A1）**：`apply()` 里
+  `const systemPrompt = ctx.systemPrompt` 只取一次。宿主 dispose 并重新 publish 该服务后
+  （宿主重启、fiber 重挂、profile 重载），旧实例仍然接受 `section()` 并返回 disposer、
+  不抛错，新实例一个 section 都收不到 —— 于是此后整轮对话都不再有指令记忆，且没有任何报错。
+  改为可变引用 + 非阻塞 `ctx.inject(['systemPrompt'], …)`（与 `webServer` 注册同构）：
+  服务换实例时先 dispose 旧注册再在新实例上重建；服务下线时把
+  `注入服务已重新发布/下线` 写进 `injection.error`，而不是假装无事发生。
+
+### 安全
+
+- **旧位置文件不再自动采纳（A4）**：`process.cwd()` 下的 `.dsh-instruction-memory.json`
+  过去会被**直接写进 memory.json 并在下一轮注入**——没有鉴权门、没有确认，是全插件唯一
+  这样的写路径。`cwd` 不属于插件：任何同权限进程在那里放一份 store 形状的 JSON，就能变成
+  "用户的长期指令"。现在只**检出**（`storage.legacyPending`，设置页显示条数与路径），
+  由用户点「导入旧位置数据」才采纳（`adopt-legacy`，走与其他写入相同的门禁，且在接纳前
+  重新读取并复核该路径**仍是**本插件的 store）；「忽略」为 `dismiss-legacy`，原文件不动。
+- **注入文本剥离不可见字符（A3）**：`cleanText` 过去只归一 `\r`。现在剥离 C0 控制符
+  （保留 `\n`/`\t`）、DEL、`U+200B–U+200F`、`U+202A–U+202E`、`U+2066–U+2069`、`U+FEFF`，
+  并把 `U+2028/2029` 归一成换行。理由是**设置页所见必须等于模型所读**：bidi override 能让
+  一行显示成另一个词（Trojan-Source 类），零宽字符能拆词躲过关键词与去重检查。
+- **注入块加不可伪造定界（A2）**：整段现在由 `<user-instruction-memory>` /
+  `</user-instruction-memory>` 包裹，且 `content` 中同形的标签、本插件自己的段头
+  （`## 用户长期指令记忆`、`## 关于用户（用户形象）`）与条目前缀（`[始终｜优先级`/`[按需｜优先级`）
+  会被换成全角近似字符，无法再冒充系统段头或伪造优先级。普通 Markdown 标题
+  （如 `## 实验步骤`）不受影响。
+- **无鉴权门时，写方法要求浏览器来源标记（A9/A12）**：`requestOriginVerdict` 的每条分支都以
+  "有 Origin"为前提，因此**本机脚本/curl 不带 Origin 就能在无 `connection` 服务的 profile 上
+  直接改记忆**。回环在"同机任意程序都以该用户身份运行"的机器上不再是边界。现在：
+  ① 无鉴权门且主机名白名单被放宽（`hostGuarded === false` + `trustedHostCount > 0`）时，
+  写方法一律 **503**；② 无鉴权门时，写方法必须带 `Origin` 或 `Sec-Fetch-Site: same-origin`
+  （浏览器必发其一，设置页不受影响），否则 **403**。只读方法（`state`、`history-list`、
+  `read-source`、`export-data`、`export-to-dir`、`reload`、`send-feedback`）不受限制。
+  `DSH_INSTRUCTION_MEMORY_REQUIRE_AUTH_FENCE=1` 仍可让整条路由 fail closed。
+- **崩溃残留的临时副本会被清理（A13）**：原子写用
+  `memory.json.tmp-<pid>-<uuid>`，在 `open` 与 `rename` 之间崩溃会留下**一份完整的记忆明文**，
+  且永不清理。载入时按插件自己的命名模式清扫；记录里的 pid 仍存活则跳过（那是另一个进程
+  正在写，不是垃圾）。
+
+### 变更
+
+- 新字段 `injection.envelopeChars`：`chars` 里有多少是定界包裹。面板的用量条改为
+  `entryChars + profileChars + envelopeChars`（旧宿主不发该字段，按 0 计），这样条上的数字
+  与宿主真正执行的预算一致。
+- 新字段 `storage.legacyPending`（`{ path, entries, profiles }` 或 `null`）与
+  `security.routeRegistered`（设置页路由是否真的挂上了 —— 没有 `webServer` 的 profile 里过去
+  只有一行 `console.error`，面板无法自述其缺席）。
+- 新方法 `adopt-legacy` / `dismiss-legacy`。
+- `peerDependenciesMeta` 把 `@deepseek-ai/dsh-system-prompt` 标为 **optional**：插件代码
+  全文只 import `node:` 内置模块，服务靠 `inject = ['systemPrompt']` 与鸭子类型取得，
+  把 peer 标成强制只会在 `strict-peer-dependencies` 下误伤安装。
+- `description` 措辞更正：从"模型没有任何写入口"改为"**插件不注册任何面向模型的工具**，
+  模型没有插件内的写入口"——原话与本仓库 README 自述（同权限进程可直接改文件）自相矛盾。
+
+### 未改动（审查建议过，复核后撤回）
+
+- **冗余区间段不能删（A14 撤回）**：`>=0.2.1-alpha.0`、`>=0.2.2-alpha.0` 在
+  `includePrerelease: true`（宿主门）下确实被 `>=0.2.0-0 <0.3.0-0` 吸收，但在**默认 semver
+  语义**（pnpm / npm 的 peer 解析）下，预发布版本要求**同一 tuple** 的比较器存在，删掉这两段
+  会让 `0.2.1-alpha.x` / `0.2.2-alpha.x` 被判不兼容。宿主门用 includePrerelease、包管理器用
+  默认语义，两套并存，所以每一段都是必需的。README 的兼容性小节据此更正了
+  `peerDependencies` 被称作"真正的门禁"的说法。
+
 ## [1.5.6] — 2026-11-13
 
 ### 新增
@@ -15,8 +124,9 @@
   ——那是 DSH Go 的 island 桥。存在时把 JSON 按 6,000 字符一块（不切断代理对）`postMessage` 给 App，
   由 App 写文件并唤起系统分享面板，面板提示「已交给 DSH Go 保存」。不存在时行为不变：普通 WebView
   回退到面板内 JSON，浏览器/Electron 仍是 `<a download>`。
-  壳侧需要配套补丁（island 协议新增 `t:'save'` 分块消息），已在仓库外单独产出，见
-  `D:\Users\34332\AI\dsh-go-patch\README-PATCH.md`；本仓库不含任何上游代码。
+  壳侧需要配套补丁（island 协议新增 `t:'save'` 分块消息），已在仓库外单独产出
+  （`dsh-go-patch` 的 `README-PATCH.md`，放在本机独立目录，未随本仓库或 npm 包分发）；
+  本仓库不含任何上游代码。
 
 ### 文档更正
 

package/README.md

@@ -229,7 +229,10 @@ DSH 就会得到第二份空记忆，看起来像"记忆消失"。相对的 `$DS
 没有理由读得到。
 
 > 1.0.0 之前的构建曾把数据写在宿主进程 cwd 下（`.dsh-instruction-memory.json`）。
-> 首次启动新版本时会自动迁移到上述位置，并把原文件改名为 `*.migrated` 保留。
+> **1.5.7 起不再自动迁移**：启动时只**检出**该文件并在设置页提示（「导入旧位置数据 / 忽略」两项），
+> 由用户确认后才写入正式位置，并把原文件改名为 `*.migrated` 保留。原因是这条旧路径**既没有鉴权门、
+> 也没有人在回路里**：`process.cwd()` 不属于插件，任何同权限进程在那里放一份 store 形状的 JSON，
+> 下一轮就会被注入成"用户的长期指令"。检出状态在 `storage.legacyPending` 里，未确认前不读入、不注入。
 
 **当前存储格式为版本 2**（1.1.0 及更早写的是版本 1，见下文「多情境配置集」）。
 两者都能载入：版本 1 的文件会**平滑迁移**——其中的条目与用户形象全部归入一个名为
@@ -820,7 +823,7 @@ DSH Go 给官方 Web 服务器包了一层**构建期补丁** `runtime/patches/r
 
 | 位置 | 谁读它 | 作用 |
 | --- | --- | --- |
-| **`peerDependencies`**（`@deepseek-ai/dsh-system-prompt`） | **宿主**：`evaluatePluginCompatibility()`（`dsh-app-boot/lib/index.js`），在**安装**与 **profile 启动**时执行 | **真正的门禁**。不满足即拒绝（或要求显式授予精确版本豁免：`dsh plugin allow-version`）。门禁把 peer 的**范围值**与宿主版本（`dsh --version`）比较，peer 的**包名不参与解析**，只用来点名报错 |
+| **`peerDependencies`**（`@deepseek-ai/dsh-system-prompt`） | **宿主**：`evaluatePluginCompatibility()`（`dsh-app-boot`），在**安装**与 **profile 启动**时执行 | **门禁之一**，不是唯一。1.5.7 起两处实测结论必须同时写在这里：① 门禁读的是**宿主自身版本**（`getDshRuntimeVersion()` → `dsh-app-boot` 的 package.json），并用 `{ includePrerelease: true }` 求值，所以预发布行不会被误判；② 在 `0.2.2-rc.3` 的宿主实现里**存在 `engines.dsh` 时 `peerDependencies` 的区间被忽略**（`dsh-app-boot/src/plugin-compatibility.ts:52`）——也就是说这段 peer 区间可能完全不参与判定，只用来在报错时点名。本仓库仍让三处**逐字节同值**，就是为了不依赖"到底哪一处生效"。这条已从"真正的门禁"更正：**能证明它生效的只有实测，不能靠读声明推断** |
 | `dsh.engines.dsh` | 插件市场（第三方，服务端读取） | 市场卡片上的兼容性判定与展示 |
 | `dsh.compatibility.dsh` | 未找到读取方（官方文档与 DSH 树内均无） | 仅作人类可读的重复声明 |
 

package/lib/client.js

@@ -283,13 +283,14 @@ window.__ModuleLoader__.load({
         'editor.contentPlaceholder': '例如：所有回答使用简体中文；不确定需求时先提问再动手。',
         'editor.mode': '生效方式',
         'editor.modeAlways': '始终生效（无条件遵守）',
-        'editor.modeAuto': '按需生效（按相关性自动判断）',
+        'editor.modeAuto': '条件必做（适用情形出现时必须执行）',
         'editor.priority': '优先级',
         'priority.high': '高',
         'priority.normal': '普通',
         'priority.low': '低',
         'editor.when': '适用场景（可选，帮助模型判断何时生效）',
         'editor.whenPlaceholder': '例如：编写或修改代码时',
+  'editor.triggers': '触发词（本回合用户说中即提升为「本轮强制」）',
         'editor.save': '保存',
         'editor.saving': '保存中…',
         'editor.cancel': '取消',
@@ -311,7 +312,7 @@ window.__ModuleLoader__.load({
         'tag.omittedTitle': '因超出注入字数上限，本条当前不会进入系统提示词',
         'tag.truncatedTitle': '本条过长，仅开头部分进入系统提示词',
         'rules.label': '生效规则',
-        'rules.note': '「始终」无条件生效；「按需」由模型按相关性自动判断。超出上限时按优先级保留，其余暂不注入。',
+        'rules.note': '「始终」无条件生效；「条件必做」在适用情形出现时必须执行。超出上限时按优先级保留，其余暂不注入。',
         'search.placeholder': '搜索指令：标题 / 内容 / 适用场景（共 {count} 条）',
         'search.matchCount': '匹配 {shown} / {total} 条',
         'tags.label': '标签（可选，仅用于在本页分组与筛选，不会注入提示词）',
@@ -325,7 +326,7 @@ window.__ModuleLoader__.load({
         'filter.mode': '生效方式',
         'filter.status': '状态',
         'filter.modeAlways': '始终',
-        'filter.modeAuto': '按需',
+        'filter.modeAuto': '条件必做',
         'filter.statusEnabled': '已启用',
         'filter.statusDisabled': '已停用',
         'sort.label': '排序',
@@ -384,19 +385,22 @@ window.__ModuleLoader__.load({
         'storage.savedAt': '最近保存：{time}',
         'storage.notSaved': '尚未保存到磁盘',
         'storage.migrated': '已从旧位置迁移：{path}（原文件保留为 *.migrated）',
+        'storage.legacyPending': '检测到旧位置（启动目录）有一份记忆：{path}（{entries} 条指令、{profiles} 个形象）。在你确认之前，它不会被导入，也不会进入注入。',
+        'storage.legacyAdopt': '导入旧位置数据',
+        'storage.legacyDismiss': '忽略',
         'preview.label': '当前注入到每轮系统提示词的内容',
         'preview.empty': '（当前没有生效中的指令）',
         'list.empty': '还没有指令记忆。点击「＋ 新增指令」添加第一条，例如“所有回答使用简体中文”。',
         'list.noMatch': '没有匹配“{query}”的指令。',
         'list.filteredEmpty': '没有符合当前筛选条件的指令。',
         'tag.always': '始终',
-        'tag.auto': '按需',
+        'tag.auto': '条件必做',
         'entry.enabled': '启用',
         'entry.edit': '编辑',
         'entry.delete': '删除',
         'entry.untitled': '未命名指令',
         'entry.confirmDelete': '确定删除「{title}」？删除后无法恢复。',
-        'entry.when': '适用场景：{when}',
+        'entry.when': '适用情形：{when}',
         'entry.updatedAt': '更新于 {time}',
         'undo.deleted': '已删除「{title}」',
         'undo.restore': '撤销删除',
@@ -588,6 +592,7 @@ window.__ModuleLoader__.load({
         'priority.low': 'Low',
         'editor.when': 'Applicable scenarios (optional; helps the model decide when it applies)',
         'editor.whenPlaceholder': 'e.g. When writing or modifying code',
+  'editor.triggers': 'Trigger words (promote to 本轮强制 when the user says one)',
         'editor.save': 'Save',
         'editor.saving': 'Saving…',
         'editor.cancel': 'Cancel',
@@ -682,6 +687,9 @@ window.__ModuleLoader__.load({
         'storage.savedAt': 'Last saved: {time}',
         'storage.notSaved': 'Not yet saved to disk',
         'storage.migrated': 'Migrated from the old location: {path} (the original is kept as *.migrated)',
+        'storage.legacyPending': 'Found a memory store at the old location (startup directory): {path} ({entries} entries, {profiles} profiles). Nothing is imported or injected until you confirm.',
+        'storage.legacyAdopt': 'Import the old data',
+        'storage.legacyDismiss': 'Ignore',
         'preview.label': 'What the system prompt receives on every turn',
         'preview.empty': '(no active instructions right now)',
         'list.empty': 'No instructions yet. Click “＋ New instruction” to add your first one, e.g. “Always answer in Simplified Chinese”.',
@@ -1081,6 +1089,7 @@ window.__ModuleLoader__.load({
         content: entry.content,
         mode: entry.mode,
         when: entry.when,
+        triggers: Array.isArray(entry.triggers) ? entry.triggers.slice(0, 8) : [],
         priority: entry.priority,
         enabled: entry.enabled,
         tags: Array.isArray(entry.tags) ? entry.tags.slice() : [],
@@ -1113,7 +1122,7 @@ window.__ModuleLoader__.load({
     }
 
     function blankDraft() {
-      return { id: '', title: '', content: '', mode: 'always', when: '', priority: 1, enabled: true, tags: [], updatedAt: 0 }
+      return { id: '', title: '', content: '', mode: 'always', when: '', priority: 1, enabled: true, tags: [], triggers: [], updatedAt: 0 }
     }
 
     /**
@@ -1310,7 +1319,21 @@ window.__ModuleLoader__.load({
       const profileUsed = typeof inj.entryChars === 'number' && inj.entryChars >= 0
         && typeof inj.profileChars === 'number' && inj.profileChars >= 0
         ? inj.profileChars : 0
-      const used = entryUsed + profileUsed
+      // Measure the budgeted halves, never the whole section: on a host that
+      // publishes persona profiles, `chars` is the whole section while
+      // `entryChars`/`profileChars` are the two halves the Host caps against
+      // `budget`. Falling back to `chars` keeps older hosts (which publish
+      // neither half) working.
+      //
+      // A2's envelope is a third, fixed part of the section: it is reserved
+      // against the budget on the Host side, so the meter has to count it or it
+      // reads lower than the number the Host actually enforces. Older hosts do
+      // not publish it, and add zero.
+      const envelopeUsed = typeof inj.envelopeChars === 'number' && inj.envelopeChars >= 0
+        ? inj.envelopeChars : 0
+      const used = typeof inj.entryChars === 'number' && inj.entryChars >= 0
+        ? entryUsed + profileUsed + envelopeUsed
+        : (typeof inj.chars === 'number' && inj.chars >= 0 ? inj.chars : 0)
       const countFlagged = (list, wantTruncated) =>
         Array.isArray(list)
           ? list.filter((item) => item !== null && typeof item === 'object'
@@ -1790,6 +1813,17 @@ window.__ModuleLoader__.load({
             onChange: (ev) => set({ when: ev.target.value }),
           })))
       }
+      if (draft.mode === 'auto') {
+        children.push(h('div', { key: 'tr' },
+          h('label', { className: 'im-label', htmlFor: 'im-entry-triggers' }, t('editor.triggers')),
+          h(TagInput, {
+            inputId: 'im-entry-triggers',
+            tags: Array.isArray(draft.triggers) ? draft.triggers : [],
+            limits: props.limits,
+            disabled: props.busy,
+            onChange: (next) => set({ triggers: next }),
+          })))
+      }
       children.push(h('div', { key: 'tags' },
         h('label', { className: 'im-label', htmlFor: 'im-entry-tags' }, t('tags.label')),
         h(TagInput, {
@@ -2635,6 +2669,23 @@ window.__ModuleLoader__.load({
         void send('export-to-dir', null)
       }
 
+      // ---- A4 legacy location: detected at boot, adopted only on request ----
+      //
+      // The Host no longer writes a store it finds at the startup directory into
+      // memory.json on its own. That path had no fence and no user in the loop,
+      // so anything able to drop a JSON file there could become the user's
+      // long-lived instructions. These two actions are the only way in.
+
+      function adoptLegacy() {
+        if (busy) return
+        void send('adopt-legacy', { baseRev: revOf() })
+      }
+
+      function dismissLegacy() {
+        if (busy) return
+        void send('dismiss-legacy', null)
+      }
+
       // ---- F14 whole-store restore (the "replace" door import does not open) ----
 
       async function handleRestoreFile(file) {
@@ -3739,6 +3790,23 @@ window.__ModuleLoader__.load({
           ? h('div', { className: 'im-ok' }, t('storage.migrated', { path: storage.migratedFrom }))
           : null,
         storage.warning ? h('div', { className: 'im-warn' }, storage.warning) : null,
+        // A4: an explicit decision, never an automatic import.
+        storage.legacyPending
+          ? h('div', { className: 'im-warn' },
+            h('div', null, t('storage.legacyPending', {
+              path: storage.legacyPending.path,
+              entries: storage.legacyPending.entries,
+              profiles: storage.legacyPending.profiles,
+            })),
+            h('div', { className: 'im-row-wrap' },
+              h('button', {
+                className: 'im-btn im-btn-primary',
+                disabled: busy,
+                onClick: adoptLegacy,
+              }, t('storage.legacyAdopt')),
+              h('button', { className: 'im-btn', disabled: busy, onClick: dismissLegacy },
+                t('storage.legacyDismiss'))))
+          : null,
         // ---- F18 备份位置 ----
         h('div', { key: 'backup', className: 'im-backup' },
           h('div', { className: 'im-section-title' }, t('backup.section')),

package/lib/index.js

@@ -458,10 +458,41 @@ export function cutText(value, max) {
   return head
 }
 
+/**
+ * Characters that render as nothing (or as a different ORDER than the bytes
+ * say) and therefore must never survive into the injected prompt.
+ *
+ * The store content is user prose that ends up inside the system prompt, so an
+ * invisible character is not a cosmetic wart — it is a place where what the
+ * settings page shows and what the model reads diverge:
+ *
+ *  - U+202A…U+202E / U+2066…U+2069 (bidi embeddings, overrides, isolates) can
+ *    reverse the visual order of a run, so `evil` can be displayed as `live`
+ *    while the model still reads `evil` — the classic Trojan-Source trick, and
+ *    it defeats exactly the review the panel exists for.
+ *  - U+200B…U+200F / U+FEFF are zero-width: a word can be split so a keyword
+ *    filter, a duplicate check or the user's own eye misses it.
+ *  - C0 controls (minus tab and newline) and DEL carry nothing but can break
+ *    downstream tooling that assumes prompt text is printable.
+ *
+ * CR/LF are normalised first, and U+2028/U+2029 become real newlines rather
+ * than vanishing, so legitimate multi-line prose is preserved byte-for-byte in
+ * meaning while nothing invisible is.
+ */
+const INVISIBLE_CHARS = /[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]/g
+
+function stripInvisible(value) {
+  if (typeof value !== 'string') return ''
+  return value
+    .split('\u2028').join('\n')
+    .split('\u2029').join('\n')
+    .replace(INVISIBLE_CHARS, '')
+}
+
 function cleanText(value, max) {
   if (typeof value !== 'string') return ''
-  const trimmed = value.split('\r\n').join('\n').split('\r').join('\n').trim()
-  return cutText(trimmed, max)
+  const normalised = stripInvisible(value.split('\r\n').join('\n').split('\r').join('\n'))
+  return cutText(normalised.trim(), max)
 }
 
 /**
@@ -522,6 +553,31 @@ export function sanitizeTags(raw) {
   return out
 }
 
+/** Trigger words per entry, matched against the user's own words every turn. */
+const MAX_TRIGGERS = 8
+const MAX_TRIGGER_LENGTH = 24
+
+/**
+ * Normalise one entry's `triggers`: the phrases that promote the entry to
+ * 「本轮强制」 when they appear in the user's message this turn. Same rules as
+ * tags — single line, whitespace collapsed, de-duplicated, capped — because
+ * they are matched case-insensitively against prose the user actually typed.
+ */
+export function sanitizeTriggers(raw) {
+  if (!Array.isArray(raw)) return []
+  const out = []
+  const seen = new Set()
+  for (const item of raw) {
+    if (typeof item !== 'string') continue
+    const trigger = singleLine(item, MAX_TRIGGER_LENGTH).replace(/\s+/g, ' ').trim()
+    if (trigger === '' || seen.has(trigger)) continue
+    seen.add(trigger)
+    if (out.length >= MAX_TRIGGERS) break
+    out.push(trigger)
+  }
+  return out
+}
+
 export function sanitizeEntry(raw) {
   if (raw === null || typeof raw !== 'object') return null
   const title = singleLine(raw.title, MAX_TITLE)
@@ -536,6 +592,7 @@ export function sanitizeEntry(raw) {
     priority: raw.priority === 2 || raw.priority === 0 ? raw.priority : 1,
     enabled: raw.enabled !== false,
     tags: sanitizeTags(raw.tags),
+    triggers: sanitizeTriggers(raw.triggers),
     /**
      * Which instruction set (F13) this entry belongs to. Preserved here — NOT
      * re-derived — because both the loader and the importer need to honour a
@@ -1452,10 +1509,61 @@ function requestPortOf(hostHeader) {
   return port === '80' || port === '443' ? '' : port
 }
 
+/**
+ * Defuse text that would read as OUR OWN structure instead of as the user's
+ * prose (A2).
+ *
+ * The injected block distinguishes "this is the harness speaking" from "this is
+ * what the user typed" only by its own headings and entry prefixes. Anyone who
+ * can write the store (the settings page, a hand edit, an import, or the model
+ * itself through the same-permission file path the README documents) can paste
+ * `## 用户长期指令记忆（Instruction Memory）` or `[始终｜优先级 高]` into
+ * `content`, and the model then sees two headings of which one is forged: a
+ * fabricated priority, or a fabricated "system" section that the store's own
+ * renderer never produced.
+ *
+ * Only the markers that NAME this plugin's blocks are neutralised, and only at
+ * the start of a line, so ordinary Markdown (`## 实验步骤`) and ordinary
+ * bracketed prose survive untouched. The marker character is swapped for a
+ * full-width look-alike: the text stays readable to the user, but it can no
+ * longer equal the token the model was told to trust.
+ */
+const FORGED_HEADING = /^([ \t]*)(#{1,6})([ \t]*)(用户长期指令记忆|关于用户（用户形象）|关于用户|用户形象)/gm
+const FORGED_ENTRY_PREFIX = /^([ \t]*)\[(始终|条件必做|按需)(｜优先级)/gm
+
+function neutralizeForgedStructure(value) {
+  if (typeof value !== 'string' || value === '') return value
+  return value
+    // A hand-written copy of the envelope would close the section early and put
+    // everything after it outside the block the model was told to trust, which
+    // is the whole point of having an envelope. Full-width brackets keep the
+    // text readable while making the token unusable.
+    .replace(/<\s*(\/?)\s*user-instruction-memory\s*>/gi,
+      (match, slash) => '〔' + (slash === '/' ? '/' : '') + 'user-instruction-memory〕')
+    .replace(FORGED_HEADING, '$1＃$3$4')
+    .replace(FORGED_ENTRY_PREFIX, '$1［$2$3')
+}
+
+/**
+ * The delimiters around the whole injected section (A2).
+ *
+ * A heading alone cannot tell the model where this block ends: the section had
+ * no closing token, so a content line shaped like the start of something else
+ * read as if it were still inside the user's memory. The envelope gives the
+ * section an unambiguous start and end that ordinary prose cannot produce by
+ * accident, and `neutralizeForgedStructure` keeps a hand-written copy of it from
+ * being reproduced inside `content`.
+ *
+ * The cost is reserved against the character budget in planInjection, so the
+ * `text.length <= budget` invariant the panel shows the user still holds.
+ */
+const MEMORY_ENVELOPE_OPEN = '<user-instruction-memory>\n'
+const MEMORY_ENVELOPE_CLOSE = '\n</user-instruction-memory>'
+
 function formatEntry(entry, tag) {
   const lines = ['[' + tag + '｜优先级 ' + priorityLabel(entry.priority) + '] ' + entry.title]
-  if (entry.mode === 'auto' && entry.when !== '') lines.push('适用场景：' + entry.when)
-  lines.push(entry.content)
+  if (entry.mode === 'auto' && entry.when !== '') lines.push('出现以下情形时必须执行，不得跳过：' + entry.when)
+  lines.push(neutralizeForgedStructure(entry.content))
   return lines.join('\n')
 }
 
@@ -1539,7 +1647,7 @@ function buildProfilesBlock(profiles, budget) {
       ? profile.name
       : singleLine(profile.content, 20)
     const id = typeof profile.id === 'string' ? profile.id : ''
-    const block = '### ' + name + '\n' + profile.content
+    const block = '### ' + name + '\n' + neutralizeForgedStructure(profile.content)
     const sep = blocks.length === 0 ? 0 : 2
     // Reserve the omission footer up front: the disclosure must never be the
     // thing squeezed out by the profiles that caused it. Reserve the WORST
@@ -1589,6 +1697,8 @@ export function entryOmittedFooter(count) {
  * trimming. Kept as the inner function so planInjection can prepend the
  * persona section without touching (and risking) the trimming logic.
  */
+let FORCED_IDS = new Set() // 本轮命中 triggers 的条目 id，由 turn/start 监听器写入。
+
 function planEntries(data, budget) {
   const blank = () => ({ text: '', activeCount: 0, included: [], omitted: [] })
   if (data === null || typeof data !== 'object' || data.enabled !== true) return blank()
@@ -1605,13 +1715,13 @@ function planEntries(data, budget) {
       '## 用户长期指令记忆（Instruction Memory）',
       '以下条目由用户在 DSH 设置 →「指令记忆」中长期保存，属于本次及后续所有对话的既有要求，请在回答、推理与执行任务时遵守；它们不覆盖系统与安全规则。',
       '· [始终] 条目必须无条件遵守。',
-      '· [按需] 条目仅在与当前问题或任务相关时生效；不相关时直接忽略，不要强行套用。',
+      '· [条件必做] 条目在「适用情形」出现时必须执行；跳过须在回答中说明原因。',
       '· 条目之间冲突时，优先遵守优先级更高或更具体的一条；无法判断时向用户确认。',
       '',
     ].join('\n'),
     [
       '## 用户长期指令记忆（Instruction Memory）',
-      '[始终] 条目无条件遵守；[按需] 条目仅在与当前任务相关时生效。',
+      '[始终] 条目无条件遵守；[条件必做] 条目在适用情形出现时必须执行。',
       '',
     ].join('\n'),
     '## 用户长期指令记忆\n',
@@ -1666,7 +1776,7 @@ function planEntries(data, budget) {
   }
 
   for (const entry of active) if (entry.mode === 'always') consider(entry, '始终')
-  for (const entry of active) if (entry.mode !== 'always') consider(entry, '按需')
+  for (const entry of active) if (entry.mode !== 'always') consider(entry, FORCED_IDS.has(entry.id) ? '本轮强制' : '条件必做')
 
   if (blocks.length === 0) {
     return { text: '', budget, activeCount: active.length, included: [], omitted: omittedPlan }
@@ -1759,16 +1869,27 @@ export function planInjection(data, now = Date.now()) {
   // joined with: if the persona section took the whole budget, every entry
   // would be dropped and its footer still has to fit.
   const JOIN = '\n\n'.length
+  // The envelope costs characters, so it comes out of the budget BEFORE the
+  // persona and the entries spend it. `text.length <= budget` is the one
+  // invariant the panel shows the user; an envelope added on top would break it
+  // silently, and reserving afterwards would only move the overshoot into the
+  // persona, which is never trimmed.
+  const envelopeCost = MEMORY_ENVELOPE_OPEN.length + MEMORY_ENVELOPE_CLOSE.length
+  const innerBudget = Math.max(0, budget - envelopeCost)
   const activeEntryCount = (scoped.entries || []).filter((entry) => entry && entry.enabled === true && entry.content !== '').length
   const entryReserve = activeEntryCount > 0 ? entryOmittedFooter(activeEntryCount).length + JOIN : 0
-  const persona = buildProfilesBlock(scoped.profiles, Math.max(0, budget - entryReserve))
-  const entryPlan = planEntries(scoped, Math.max(0, budget - persona.chars))
+  const persona = buildProfilesBlock(scoped.profiles, Math.max(0, innerBudget - entryReserve))
+  const entryPlan = planEntries(scoped, Math.max(0, innerBudget - persona.chars))
   const parts = []
   if (persona.text !== '') parts.push(persona.text)
   if (entryPlan.text !== '') parts.push(entryPlan.text)
   else if (parts.length > 0 && entryPlan.omitted.length > 0) parts.push(entryOmittedFooter(entryPlan.omitted.length))
+  const inner = parts.join('\n\n')
   return {
-    text: parts.join('\n\n'),
+    // Empty stays EMPTY, byte for byte: a store with nothing to say must leave
+    // the prompt identical to a deployment without this plugin, so no envelope
+    // is emitted around nothing.
+    text: inner === '' ? '' : MEMORY_ENVELOPE_OPEN + inner + MEMORY_ENVELOPE_CLOSE,
     budget,
     activeCount: entryPlan.activeCount,
     included: entryPlan.included,
@@ -1800,7 +1921,24 @@ export function apply(ctx, deps = {}) {
    * to be deleted mid-test, which no contract test can do reproducibly.
    */
   const watchStore = typeof deps.watch === 'function' ? deps.watch : watch
-  const systemPrompt = ctx.systemPrompt
+  /**
+   * A1: the prompt service is held in a mutable slot, not a one-shot capture.
+   *
+   * `ctx.systemPrompt` read at apply() time is only valid until the host
+   * disposes and republishes the service (host restart, fiber remount, a
+   * profile reload that swaps the row's dependencies). After that the captured
+   * reference points at a DEAD service: `section()` there still returns a
+   * disposer and throws nothing, the live service never receives a section, and
+   * the prompt silently loses its memory for the rest of the process — the one
+   * failure mode this plugin exists to prevent.
+   *
+   * The webServer registration further down already treats this shape
+   * explicitly ("registering on top of the previous registration would LEAK
+   * it"). The prompt side now matches it: `systemPromptRef` is rewired by the
+   * non-blocking `ctx.inject(['systemPrompt'], …)` right where the route is
+   * wired, and `syncSection` re-registers against whatever the slot holds.
+   */
+  let systemPromptRef = ctx.systemPrompt === undefined ? null : ctx.systemPrompt
 
   const state = {
     data: {
@@ -1837,6 +1975,15 @@ export function apply(ctx, deps = {}) {
     loadedFrom: null,
     savedAt: null,
     migratedFrom: null,
+    /**
+     * A4: a store-shaped file found at the legacy (process cwd) location, held
+     * for the user to confirm. `{ path, entries, profiles }` or null.
+     *
+     * Detection is deliberate and adoption is not: see the load branch. The
+     * panel renders this as an explicit "import the old data" action, so the
+     * decision belongs to the user the way it always should have.
+     */
+    legacyPending: null,
     /**
      * Set while the store on disk declares an unsupported format version.
      * Mutating commands are refused in that state: a save would rewrite a
@@ -1855,6 +2002,16 @@ export function apply(ctx, deps = {}) {
     shapeRejected: false,
     sectionRegistered: false,
     sectionError: null,
+    /**
+     * A7: whether the settings-page route is actually mounted.
+     *
+     * Without it, a profile that never publishes `webServer` (headless, tui, a
+     * custom shell) left the plugin working for injection while the settings
+     * page simply had no route — announced by one console.error and nothing
+     * else. The panel cannot render, so the SNAPSHOT has to carry the fact for
+     * the diagnostics view and for any support dump.
+     */
+    routeRegistered: false,
     /** Whether a store file is actually present on disk (diagnostics + the panel). */
     storeExists: false,
     /** How many history snapshots the current directory holds (diagnostics). */
@@ -2146,9 +2303,10 @@ export function apply(ctx, deps = {}) {
    */
   const resolveSectionOrder = () => {
     try {
-      if (systemPrompt === null || typeof systemPrompt.getSectionOrder !== 'function') return SECTION_ORDER
-      const lo = systemPrompt.getSectionOrder('FILE_REFERENCE')
-      const hi = systemPrompt.getSectionOrder('TOOL_BASH')
+      const service = systemPromptRef
+      if (service === null || typeof service.getSectionOrder !== 'function') return SECTION_ORDER
+      const lo = service.getSectionOrder('FILE_REFERENCE')
+      const hi = service.getSectionOrder('TOOL_BASH')
       if (!Number.isFinite(lo) || !Number.isFinite(hi) || hi <= lo) return SECTION_ORDER
       return lo + (hi - lo) / 2
     } catch {
@@ -2159,7 +2317,19 @@ export function apply(ctx, deps = {}) {
   const syncSection = () => {
     if (disposed) return
     const wanted = sectionText() !== ''
+    const service = systemPromptRef
     if (wanted && sectionDispose === null) {
+      // A1: no live service yet. That is not an error to report — the
+      // `ctx.inject(['systemPrompt'], …)` wired below re-runs syncSection the
+      // moment one is published — but registering through a null slot would
+      // throw a TypeError into the load path instead of leaving the plugin
+      // usable without its prompt half.
+      if (service === null || typeof service.section !== 'function') {
+        state.sectionRegistered = false
+        state.sectionError = null
+        scheduleMuteTimer()
+        return
+      }
       try {
         // `interpolate: false` is load-bearing, not a hint. The host runs every
         // section through `{{variable}}` interpolation by DEFAULT and THROWS on
@@ -2170,7 +2340,7 @@ export function apply(ctx, deps = {}) {
         // agent turn at renderPrompt(). This section is literal text and never
         // references a host variable, so opt out explicitly.
         const order = resolveSectionOrder()
-        sectionDispose = systemPrompt.section({
+        sectionDispose = service.section({
           name: SECTION_NAME,
           order,
           text: assembledSectionText,
@@ -2223,6 +2393,76 @@ export function apply(ctx, deps = {}) {
     disposeStreams()
   })
 
+  /* ---------------- turn-triggered promotion ---------------- */
+
+  /**
+   * Promote entries whose `triggers` appear in THIS turn's user message to
+   * 「本轮强制」. Without this the auto mode is only advisory: the model reads
+   * 「条件必做」 at turn one and has forgotten it by the time the work is done.
+   * Matching runs on the user's own words rather than on the model's judgement,
+   * so a missed instruction becomes a plugin bug instead of a compliance
+   * failure. No triggers configured = no promotion, i.e. the old behaviour.
+   */
+  let forcedSignature = ''
+  const refreshSection = () => {
+    if (disposed) return
+    if (sectionDispose === null) {
+      syncSection()
+      return
+    }
+    const dispose = sectionDispose
+    sectionDispose = null
+    try {
+      dispose()
+    } catch (err) {
+      console.error('[instruction-memory] section refresh dispose failed:', err)
+    }
+    syncSection()
+  }
+  const recomputeForced = (text) => {
+    const list = Array.isArray(state.data.entries) ? state.data.entries : []
+    const lower = String(text || '').toLowerCase()
+    const hit = new Set()
+    for (const entry of list) {
+      if (entry.enabled !== true || entry.mode !== 'auto') continue
+      const triggers = Array.isArray(entry.triggers) ? entry.triggers : []
+      for (const trigger of triggers) {
+        if (typeof trigger === 'string' && trigger !== ''
+          && lower.includes(trigger.toLowerCase())) {
+          hit.add(entry.id)
+          break
+        }
+      }
+    }
+    const signature = Array.from(hit).sort().join(',')
+    if (signature === forcedSignature) return
+    forcedSignature = signature
+    FORCED_IDS = hit
+    logDebug('forced promotion: ' + (signature === '' ? 'none' : signature))
+    refreshSection()
+  }
+
+  const onSessionEvent = (session, event) => {
+    try {
+      if (disposed || !event || typeof event.type !== 'string') return
+      if (event.type !== 'user/message') return
+      const data = event.data || {}
+      const source = data.source || {}
+      // Only human input promotes. runtime-context, notices and plugin messages
+      // are not the user asking for anything.
+      const kind = typeof source.kind === 'string' ? source.kind : ''
+      if (kind !== '' && kind !== 'user') return
+      const text = typeof data.text === 'string' ? data.text
+        : (typeof data.content === 'string' ? data.content : '')
+      if (text === '') return
+      recomputeForced(text)
+    } catch (err) {
+      console.error('[instruction-memory] trigger match failed:', err)
+    }
+  }
+  // Fake hosts (tests) may expose no event bus; the plugin must still mount.
+  if (typeof ctx.on === 'function') ctx.on('session/event', onSessionEvent)
+
   /* ---------------- external-change watching (SSE) ---------------- */
 
   /**
@@ -3219,6 +3459,60 @@ export function apply(ctx, deps = {}) {
    *
    * @returns whether this load performed a successful write.
    */
+  /**
+   * A13: sweep temp files a crashed write left behind.
+   *
+   * `writeToDisk` is atomic by rename: it writes `memory.json.tmp-<pid>-<uuid>`,
+   * fsyncs, then renames. A crash between `open` and `rename` leaves a COMPLETE
+   * COPY OF THE USER'S INSTRUCTION MEMORY on disk under that name, in the same
+   * directory, forever — and nothing ever looked for it. It is the store's own
+   * content (not a redacted log line), so it inherits exactly the exposure of
+   * memory.json while being invisible to every UI path.
+   *
+   * Only the plugin's own name shape is touched, and a temp file whose recorded
+   * pid is still alive is left alone: that is another process in the middle of
+   * a legitimate write, not debris.
+   */
+  const cleanupOrphanTempFiles = async () => {
+    const dir = dirname(storePath)
+    const prefix = basename(storePath) + '.tmp-'
+    let names = []
+    try {
+      names = await readdir(dir)
+    } catch {
+      return 0
+    }
+    let removed = 0
+    for (const name of names) {
+      if (!name.startsWith(prefix)) continue
+      const rest = name.slice(prefix.length)
+      const dash = rest.indexOf('-')
+      const pidText = dash === -1 ? rest : rest.slice(0, dash)
+      const pid = Number.parseInt(pidText, 10)
+      if (Number.isFinite(pid) && pid > 0 && pid !== process.pid) {
+        let alive = true
+        try {
+          process.kill(pid, 0)
+        } catch (err) {
+          // ESRCH means the writer is gone; EPERM means it exists but belongs to
+          // someone else — treat that as alive and leave the file alone.
+          alive = err !== null && err !== undefined && err.code === 'EPERM'
+        }
+        if (alive) continue
+      }
+      try {
+        await unlink(join(dir, name))
+        removed += 1
+      } catch {
+        // Best effort: a file we cannot remove must not stop the load.
+      }
+    }
+    if (removed > 0) {
+      logInfo('removed ' + removed + ' orphaned temp store file(s) left by an interrupted write')
+    }
+    return removed
+  }
+
   const readFromDisk = async () => {
     state.storagePath = storePath
     state.storageDisplay = storePath
@@ -3234,6 +3528,8 @@ export function apply(ctx, deps = {}) {
     // and the panel silently disagreed. Forcing the next save to write is the
     // cheap side of that trade.
     lastPersistedKey = null
+    // A13: drop temp copies a crashed write left in the store directory.
+    await cleanupOrphanTempFiles()
 
     /**
      * A store declaring an unsupported format version: adopt nothing, write
@@ -3425,8 +3721,20 @@ export function apply(ctx, deps = {}) {
       // An unusable backup must never block a fresh store; fall through.
     }
 
-    // 2. Migrate the pre-release location (host process cwd). This is the only
-    //    reason the legacy name is still known to this plugin.
+    // 2. A pre-release store at the host process cwd (the legacy location) is
+    //    DETECTED here, never adopted here (A4).
+    //
+    //    This used to write it straight into memory.json and inject it on the
+    //    next turn, with no user action and no confirmation. It was the only
+    //    write path in the plugin with neither an authentication fence nor a
+    //    human in the loop, and `process.cwd()` is not the plugin's to trust:
+    //    any process running as the same user could drop a store-shaped JSON
+    //    there and have it become the long-lived instruction memory injected
+    //    into every subsequent prompt.
+    //
+    //    The file is now only ANNOUNCED. Adopting it takes the explicit
+    //    `adopt-legacy` command from the settings page, which is a deliberate
+    //    user action behind the same fence every other mutation uses.
     const legacyPath = join(process.cwd(), LEGACY_FILE_NAME)
     try {
       const parsed = await readStoreFile(legacyPath)
@@ -3441,18 +3749,18 @@ export function apply(ctx, deps = {}) {
           if (loaded.rejectedVersion !== undefined) {
             // A legacy file in a future format is not ours to migrate or judge.
             state.storageError = '旧位置文件为不支持的格式版本 ' + loaded.rejectedVersion + '，已忽略'
-            return false
-          }
-          state.data = loaded.data
-          state.storageWarning = loadWarnings(loaded)
-          const migrated = await writeToDisk()
-          if (migrated) {
-            state.migratedFrom = legacyPath
-            // Keep the original as evidence instead of deleting user data.
-            await rename(legacyPath, legacyPath + '.migrated').catch(() => {})
+          } else {
+            const entryCount = loaded.data.entries.length
+            const profileCount = loaded.data.profiles.length
+            state.legacyPending = { path: legacyPath, entries: entryCount, profiles: profileCount }
+            const warnings = loadWarnings(loaded)
+            state.storageWarning = (warnings !== null ? warnings + '；' : '')
+              + '检测到旧位置（启动目录）有一份记忆：' + legacyPath
+              + '（' + entryCount + ' 条指令、' + profileCount + ' 个形象）。'
+              + '为避免未经确认就注入一个外部文件，本次没有自动导入；'
+              + '确认内容无误后在设置页点击「导入旧位置数据」。'
+            state.loadedFrom = 'legacy cwd file (detected, awaiting confirmation)'
           }
-          state.loadedFrom = 'legacy cwd file (migrated)'
-          return migrated
         }
       }
     } catch (err) {
@@ -3471,7 +3779,10 @@ export function apply(ctx, deps = {}) {
     //    `state` (see ensureStoreMaterialized). Until then the panel shows
     //    "尚未写入磁盘", a state its UI already renders.
     needsMaterialize = true
-    state.loadedFrom = 'first run (no store on disk yet)'
+    // A detected-but-unconfirmed legacy file keeps its own `loadedFrom`: the
+    // panel must be able to say "there is a store next door, waiting for you"
+    // rather than "first run, nothing anywhere" (A4).
+    if (state.legacyPending === null) state.loadedFrom = 'first run (no store on disk yet)'
     state.storeExists = false
     return false
   }
@@ -3662,6 +3973,13 @@ export function apply(ctx, deps = {}) {
          * allow-list is the only thing standing in front of a fence-less route.
          */
         trustedHostCount: trustedHosts.length,
+        /**
+         * A7: is the settings route actually mounted? `false` means this
+         * profile published no `webServer` (or the registration threw), so the
+         * panel has no way in even though injection works. Published here
+         * because a panel that cannot render cannot report its own absence.
+         */
+        routeRegistered: state.routeRegistered === true,
       },
       /**
        * F12: load-side diagnostics that used to be log-only. `loadedFrom` says
@@ -3679,6 +3997,19 @@ export function apply(ctx, deps = {}) {
         warning: state.storageWarning !== null ? state.storageWarning : state.backupError,
         savedAt: state.savedAt,
         migratedFrom: state.migratedFrom === null ? null : displayPath(state.migratedFrom),
+        /**
+         * A4: a store-shaped file sitting at the legacy (startup directory)
+         * location, waiting for the user to confirm. `null` when there is
+         * nothing pending. The panel renders this as an explicit action; the
+         * file is never read into memory.json on its own.
+         */
+        legacyPending: state.legacyPending === null
+          ? null
+          : {
+            path: displayPath(state.legacyPending.path),
+            entries: state.legacyPending.entries,
+            profiles: state.legacyPending.profiles,
+          },
         /** false until the store file has actually been written (see readFromDisk step 3). */
         onDisk: state.storeExists,
         /** Backup location (F18): '' means "next to the store file". */
@@ -3706,6 +4037,13 @@ export function apply(ctx, deps = {}) {
          */
         muted: isMuted(state.data, Date.now()),
         chars: preview.length,
+        /**
+         * A2: how much of `chars` is the fixed envelope around the block. The
+         * panel's meter measures `entryChars + profileChars + envelopeChars`
+         * (the parts the budget is actually spent on) instead of `chars`, so
+         * it has to know this number; older clients simply ignore the field.
+         */
+        envelopeChars: preview === '' ? 0 : MEMORY_ENVELOPE_OPEN.length + MEMORY_ENVELOPE_CLOSE.length,
         /**
          * The budget decision behind `preview`, for the settings page's
          * usage meter and per-entry marks. `budget` is the effective ceiling;
@@ -4761,6 +5099,76 @@ export function apply(ctx, deps = {}) {
     return settle([head + describeStoreShape(state.data), ...notes].join('；'), saved)
   }
 
+  /**
+   * A4: adopt the store-shaped file the boot load found at the legacy
+   * (process cwd) location.
+   *
+   * Reachable only from the settings page, and only when the load actually
+   * found such a file: it re-reads THAT path (never one supplied by the
+   * request), and refuses anything that stopped looking like a store since —
+   * so a file swapped in between detection and confirmation is caught rather
+   * than imported. Adoption is a deliberate user action behind the same route
+   * fence every other mutation uses, which is the whole point of the change.
+   */
+  const adoptLegacy = (baseRev) => enqueue(async () => {
+    if (state.versionRejected) return versionRefusal()
+    if (isStaleBaseRev(baseRev)) return conflictResponse()
+    const pending = state.legacyPending
+    if (pending === null) {
+      return { ok: false, saved: false, message: '没有待导入的旧位置数据', snapshot: snapshot() }
+    }
+    let parsed = null
+    try {
+      parsed = await readStoreFile(pending.path)
+    } catch (err) {
+      return {
+        ok: false,
+        saved: false,
+        message: '读取旧位置文件失败：' + describeErrorSafe(err),
+        snapshot: snapshot(),
+      }
+    }
+    if (parsed === null) {
+      state.legacyPending = null
+      state.storageWarning = '旧位置文件已不存在，待导入状态已清除：' + pending.path
+      return { ok: false, saved: false, message: '旧位置文件已不存在，待导入状态已清除', snapshot: snapshot() }
+    }
+    if (storeShapeVerdict(parsed) !== 'store') {
+      state.legacyPending = null
+      state.storageWarning = '旧位置文件的内容已不是本插件的记忆存储，待导入状态已清除'
+      return { ok: false, saved: false, message: '旧位置文件已不是本插件的记忆存储，未导入', snapshot: snapshot() }
+    }
+    const result = await commitAdoptedStore(parsed, '已导入旧位置数据：')
+    if (result !== null && result.ok === true) {
+      state.legacyPending = null
+      state.storageWarning = null
+      state.storageError = null
+      state.migratedFrom = pending.path
+      state.loadedFrom = 'legacy cwd file (adopted after confirmation)'
+      // Keep the original as evidence instead of deleting user data.
+      await rename(pending.path, pending.path + '.migrated').catch(() => {})
+      return { ...result, snapshot: snapshot() }
+    }
+    return result
+  })
+
+  /**
+   * A4: "not now" for a detected legacy file. Clears the pending flag and the
+   * announcement, and deliberately leaves the file alone — nothing was read
+   * into the store, so there is nothing to undo.
+   */
+  const dismissLegacy = () => {
+    const had = state.legacyPending !== null
+    state.legacyPending = null
+    state.storageWarning = null
+    return {
+      ok: true,
+      saved: false,
+      message: had ? '已忽略旧位置数据（原文件未改动）' : '没有待导入的旧位置数据',
+      snapshot: snapshot(),
+    }
+  }
+
   const writeSource = (text, baseRev) => enqueue(async () => {
     if (state.versionRejected) return versionRefusal()
     // Deliberately NOT gated on shapeRejected: hand-editing the source is how
@@ -5312,6 +5720,10 @@ export function apply(ctx, deps = {}) {
         return importData(
           args !== null && typeof args === 'object' ? args.payload : null,
           args !== null && typeof args === 'object' ? args.baseRev : undefined)
+      case 'adopt-legacy':
+        return adoptLegacy(args !== null && typeof args === 'object' ? args.baseRev : undefined)
+      case 'dismiss-legacy':
+        return dismissLegacy()
       case 'send-feedback':
         return sendFeedback(args)
       case 'batch':
@@ -5578,6 +5990,65 @@ export function apply(ctx, deps = {}) {
     return true
   }
 
+  /**
+   * A9/A12: the last line of defence for MUTATIONS on a fence-less route.
+   *
+   * `originVerdictRefuses` above only judges what a browser volunteers. A local
+   * process (curl, a script, another app) sends no `Origin` at all, and every
+   * branch of requestOriginVerdict is conditioned on an Origin being present —
+   * so on a profile that publishes a web server WITHOUT a `connection` service
+   * the settings route accepted unauthenticated writes from anything running as
+   * the same user. Loopback used to be a boundary; it stopped being one the
+   * moment any program on the machine runs as that user.
+   *
+   * Two rules, both limited to mutating methods so a read-only panel keeps
+   * working in those deployments:
+   *
+   *  1. A widened DSH_INSTRUCTION_MEMORY_TRUSTED_HOSTS list is a HOSTNAME rule,
+   *     not an identity check. Combined with a non-loopback bind
+   *     (`hostGuarded === false`) and no fence, the only thing in front of the
+   *     route is a name an attacker picks, so writes are refused outright (503)
+   *     instead of relying on an orange warning in the panel.
+   *  2. Without a fence, a mutation must carry a browser origin marker: either
+   *     `Origin` or `Sec-Fetch-Site: same-origin`. A page always sends one of
+   *     the two, so the settings page is unaffected; a bare process is refused
+   *     (403). `Sec-Fetch-Site` is accepted because script cannot set it — it is
+   *     the browser's own claim, not the caller's.
+   *
+   * Set DSH_INSTRUCTION_MEMORY_REQUIRE_AUTH_FENCE=1 to make the whole route fail
+   * closed instead of falling back to these two rules.
+   */
+  const READ_ONLY_METHODS = new Set([
+    'state', 'history-list', 'read-source', 'export-data', 'export-to-dir', 'reload', 'send-feedback',
+  ])
+
+  const writeGateRefusal = (method, headers) => {
+    const name = typeof method === 'string' ? method : ''
+    if (READ_ONLY_METHODS.has(name)) return null
+    if (connectionGate !== null) return null
+    const head = headers !== null && typeof headers === 'object' ? headers : {}
+    if (guardHost !== true && trustedHosts.length > 0) {
+      return {
+        status: 503,
+        message: '拒绝修改请求：当前部署绑定在非回环地址、没有宿主的会话鉴权门，且仅靠一份主机名白名单（'
+          + trustedHosts.length + ' 条）。白名单是主机名规则而非身份校验，因此写操作已停用；'
+          + '请改为回环绑定，或让宿主提供 connection 服务。',
+      }
+    }
+    const origin = typeof head.origin === 'string' ? head.origin.trim() : ''
+    const fetchSite = typeof head['sec-fetch-site'] === 'string'
+      ? head['sec-fetch-site'].trim().toLowerCase() : ''
+    if (origin === '' && fetchSite !== 'same-origin') {
+      return {
+        status: 403,
+        message: '拒绝无来源标记的修改请求：当前 profile 没有宿主的会话鉴权门，因此修改必须来自浏览器'
+          + '（带 Origin 或 Sec-Fetch-Site: same-origin）。设置页读写不受影响；本机脚本 / curl 的写入会被拒绝。'
+          + '如需完全关闭该路由，设置 DSH_INSTRUCTION_MEMORY_REQUIRE_AUTH_FENCE=1。',
+      }
+    }
+    return null
+  }
+
   const handler = (req, res) => {
     // Authentication before anything else: not the method, not the body, not
     // the size. A rejection must not leak which methods exist.
@@ -5686,6 +6157,16 @@ export function apply(ctx, deps = {}) {
         let result
         try {
           const payload = body === '' ? {} : JSON.parse(body)
+          // A9/A12: mutations on a fence-less route need a browser origin
+          // marker. Checked after parsing (the method is only known now) and
+          // before dispatch, so a refused write never touches the store.
+          const gateRefusal = writeGateRefusal(payload.method, req.headers)
+          if (gateRefusal !== null) {
+            logInfo('route refused a mutation: ' + gateRefusal.message)
+            res.writeHead(gateRefusal.status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
+            res.end(JSON.stringify({ ok: false, saved: false, message: gateRefusal.message, snapshot: snapshot() }))
+            return
+          }
           result = await dispatch(payload.method, payload.args === undefined ? null : payload.args)
         } catch (err) {
           result = { ok: false, saved: false, message: describeErrorSafe(err), snapshot: snapshot() }
@@ -5702,6 +6183,56 @@ export function apply(ctx, deps = {}) {
   // losing the prompt injection along with the settings page. The callback also
   // fixes the original race properly — it runs whenever the service is
   // published, not only if it happened to beat this row to the mount.
+  /**
+   * A1: keep the prompt service subscription live for as long as this row is.
+   *
+   * `systemPrompt` is a declared dependency (`export const inject`), so the
+   * initial capture in apply() is normally valid. It is NOT valid after the host
+   * republishes the service: the old instance keeps accepting `section()` calls
+   * and keeps returning a disposer, which is why the failure is silent. Wiring
+   * a non-blocking child fiber here is the same shape the webServer route below
+   * uses, for the same reason.
+   *
+   * The callback is a no-op when the published service is the one already held,
+   * so a host that publishes once behaves exactly as before.
+   */
+  ctx.inject(['systemPrompt'], (scope) => {
+    const service = scope === null || scope === undefined ? null : scope.systemPrompt
+    if (service === null || service === undefined || typeof service.section !== 'function') return
+    if (service === systemPromptRef) return
+
+    const previous = systemPromptRef
+    systemPromptRef = service
+    // Drop the registration made against the previous instance BEFORE creating
+    // one on the new: two live registrations would both be pulled into every
+    // prompt (the block appears twice) and would keep the dead service wired.
+    if (sectionDispose !== null) {
+      const dispose = sectionDispose
+      sectionDispose = null
+      try {
+        dispose()
+      } catch (err) {
+        console.error('[instruction-memory] stale prompt section dispose failed:', err)
+      }
+    }
+    state.sectionRegistered = false
+    if (typeof scope.effect === 'function') {
+      scope.effect(() => () => {
+        if (systemPromptRef !== service) return
+        // The service went away. Stop pointing at it so the next publish can
+        // re-register, and record it instead of pretending nothing happened:
+        // an injected memory that quietly stops being injected is the one
+        // symptom a user cannot diagnose from the panel.
+        systemPromptRef = null
+        state.sectionRegistered = false
+        state.sectionError = '注入服务已重新发布/下线，发布后会自动恢复注入'
+        logInfo('systemPrompt disposed or republished while mounted; the section will re-register when it returns')
+      })
+    }
+    logInfo('systemPrompt republished; re-registering the instruction section against the new service')
+    syncSection()
+  })
+
   // F19: take the harness authentication fence when the profile has one.
   // Same non-blocking shape as the web server below — a profile without a
   // browser never publishes `connection`, and the prompt injection must not
@@ -5765,14 +6296,17 @@ export function apply(ctx, deps = {}) {
     }
     try {
       routeDispose = webServer.register({ kind: 'prefix', path: API_PREFIX, handler })
+      state.routeRegistered = true
       logDebug('settings route registered at ' + API_PREFIX + ' (boundHost=' + boundHost + ', hostGuard=' + guardHost + ')')
     } catch (err) {
       console.error('[instruction-memory] route registration failed:', err)
       routeDispose = null
+      state.routeRegistered = false
     }
     // The child fiber is owned by this one, so unmounting the plugin still
     // disposes the route even though it was registered here.
     scope.effect(() => () => {
+      state.routeRegistered = false
       if (routeDispose !== null) {
         const dispose = routeDispose
         routeDispose = null

package/memory.schema.json

@@ -115,7 +115,13 @@
             "description": "是否启用该条目。",
             "default": true
           },
-          "tags": {
+          "triggers": {
+          "type": "array",
+          "maxItems": 8,
+          "items": { "type": "string", "maxLength": 24 },
+          "description": "触发词：本回合用户消息中出现其一即把该条提升为「本轮强制」；仅 mode=auto 有意义，留空则从不提升。"
+        },
+        "tags": {
             "type": "array",
             "maxItems": 8,
             "description": "标签：仅用于设置页分组与筛选，**不会**进入注入文本，也不影响注入顺序与取舍。",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-instruction-memory",
-  "version": "1.5.6",
-  "description": "User-only instruction memory for DSH: long-term instructions maintained in the settings UI and auto-injected into every conversation — the model has no write access. 指令记忆：只由用户在设置页维护的长期指令，自动注入此后每轮对话；模型没有任何写入口。",
+  "version": "1.6.0",
+  "description": "User-only instruction memory for DSH: long-term instructions maintained in the settings UI and auto-injected into every conversation — the plugin registers no model-facing tool, so the model has no in-plugin write path (a same-permission process can still edit the file directly). 指令记忆：只由用户在设置页维护的长期指令，自动注入此后每轮对话；插件不注册任何面向模型的工具，模型没有插件内的写入口。",
   "license": "MIT",
   "type": "module",
   "repository": {
@@ -54,6 +54,11 @@
   "peerDependencies": {
     "@deepseek-ai/dsh-system-prompt": ">=0.1.3-alpha.2 <0.1.4 || >=0.1.4-0 <0.1.5-0 || >=0.1.5-alpha.1 <0.1.6-0 || >=0.1.6-alpha.0 <0.1.7-0 || >=0.1.7-alpha.0 <0.2.0-0 || >=0.2.1-alpha.0 <0.3.0-0 || >=0.2.2-alpha.0 <0.3.0-0 || >=0.2.0-0 <0.3.0-0"
   },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/dsh-system-prompt": {
+      "optional": true
+    }
+  },
   "publishConfig": {
     "access": "public"
   },