dsh-mnemon 0.1.0 → 0.1.2

package/README.en.md

@@ -75,6 +75,8 @@ Reusable knowledge produced by current work
 - A local `mnemon` CLI.
 - A subagent provider supporting `outputSchema`, `toolFilter`, `persona`, and `depthLimit`. Regular semantic work prefers `spawn`; the default background review also requires a provider named `fork` that inherits parent context.
 
+**Compatibility baseline**: `dsh-mnemon` 0.1.0 has been verified end-to-end on a live web profile running `@deepseek-ai/dsh` 0.1.0-rc.6 (2026-08-13 snapshot); last verified 2026-08-14. The plugin declares no fixed minimum-version matrix. DSH moves fast: before upgrading, re-run the [Getting Started](./docs/en/getting-started.md) verification steps in an isolated profile or a backed-up data directory.
+
 ## Quick start
 
 Install Mnemon:
@@ -108,7 +110,19 @@ For a local checkout, use an absolute path:
 dsh plugin --profile web add "link:/absolute/path/to/dsh-mnemon"
 ```
 
-Open “Settings -> Plugin Configuration -> Mnemon” to select a storage scope, then create or activate a Memory Space in the conversation's “Memory System” tab. Configuration applies after restart. Changing the scope never migrates, merges, or deletes old data automatically.
+Open the dedicated “Settings -> Memory System” page to choose both a display mode and storage scope. The default `sidebar` mode opens a dedicated “Memory System” workbench from the sidebar; switching to `buildin` restores the original conversation-area tab. Saving switches live without mounting duplicate entries. Under the `workspace` scope, the sidebar workbench selector independently chooses which DSH workspace to inspect and maintain; agents, tools, and lifecycle hooks always continue to use the current session workspace. A global banner shows both paths when they diverge and aligns them with one click. The storage root switches atomically after the new directory initializes successfully, and changing the scope never migrates, merges, or deletes old data automatically.
+
+Upgrade and uninstall (`dsh plugin` forwards to pnpm inside the profile directory):
+
+```sh
+# Upgrade
+dsh plugin --profile web update dsh-mnemon
+
+# Uninstall (also removes its bundle registration from the profile)
+dsh plugin --profile web remove dsh-mnemon
+```
+
+Uninstalling never deletes memory data: `global` data stays in `~/.mnemon`, and `workspace` / `custom` data stays in their directories, so reinstalling picks up where you left off. To pause automatic reads/writes without uninstalling, turn off `writebackMode` / `recallMode` / `lifecycleEnabled`; set `tabEnabled=false` to hide the currently selected Web entry (see the [configuration reference](./docs/en/configuration.md)).
 
 ## Minimal configuration
 
@@ -116,11 +130,12 @@ Configuration lives in `$DSH_HOME/settings.yaml` (commonly `~/.dsh/settings.yaml
 
 ```yaml
 mnemon:
+  displayMode: sidebar # sidebar | buildin; sidebar by default
   storageScope: global # global | workspace | custom
 ```
 
 - `global`: `MNEMON_DATA_DIR`, or `~/.mnemon` when unset.
-- `workspace`: `.mnemon` under the DSH Host launch directory.
+- `workspace`: `.mnemon` under each DSH workspace root; Agent execution follows the current session workspace while the Web workbench may inspect another target.
 - `custom`: an absolute or `~/...` path supplied through `dataDir`.
 
 See the [configuration reference](./docs/en/configuration.md) for every option, precedence rules, and read-only mode.
@@ -129,6 +144,12 @@ See the [configuration reference](./docs/en/configuration.md) for every option,
 
 The Web workspace contains Status, Runtime, Memory Spaces, Documents, Distill, Recall, Entities, and Content pages in three divider-separated groups: “Status” stands alone; “Runtime, Memory Spaces, Documents” cover the three storage tiers; “Distill, Recall, Entities, Content” are the read/write tools. Its main interface follows DSH's global Chinese/English locale.
 
+Memory also surfaces inside the conversation flow (conversation interface, **off by default**; enable each surface under Settings → Memory System → Conversation interface — changes apply live on save):
+
+- **Memory tool cards**: every `mnemon_*` tool call renders as a memory-flavoured card — recalls show the query and hit count, writes show the subject summary — expandable to the raw arguments and structured result, with a one-click jump to the matching Memory view page;
+- **Turn memory bar**: completed calls are separated into successful recalls, writes, document searches, and inspections, with failures reported independently; expand it for the exact tool names;
+- **Save to memory**: every finalized assistant reply carries a “Save to memory” action; the candidate is editable, and submission routes through the isolated memory subagent (judgment, dedupe, distillation) without filling the main conversation context.
+
 Common commands:
 
 ```text
@@ -141,6 +162,15 @@ Common commands:
 
 The recommended lookup order is: hot memory -> active Documents -> active Memory Spaces -> the archived original referenced by a hit. Do not persist temporary progress, raw logs, secrets, or ordinary facts that can be recovered directly from the repository.
 
+## Permissions & data
+
+- **Files**: reads/writes data directories through the local `mnemon` CLI — `~/.mnemon` for the `global` scope, a user-chosen directory for `workspace` / `custom`. The plugin never writes those directories directly, and the WebUI never reads SQLite directly. `sourcePaths` cannot escape the originating session workspace or point into the managed Documents directory.
+- **Processes**: `mnemon` is started as an argument array with shell disabled, bounded output, and `SIGTERM` then `SIGKILL` on timeout.
+- **Network**: the plugin and Mnemon both run locally and make no remote calls; subagent model inference uses DSH's existing provider connection.
+- **Credentials**: the plugin stores and reads no credentials or API keys; model credentials are fully managed by DSH and your provider.
+- **User data**: all memory content (user profile, project Documents, long-term memory) stays in local SQLite / JSON and is never uploaded.
+- **Honest disclosure**: there is no deterministic credential/secret scanner yet — do not write keys, tokens, or private keys into hot memory, Documents, or Memory Spaces. For the full boundaries (process/file/Web/model) and backup/restore, see [Operations, security, and troubleshooting](./docs/en/operations.md).
+
 ## Documentation
 
 - [Documentation hub](./docs/en/README.md)
@@ -166,4 +196,4 @@ pnpm run verify
 
 ## License
 
-MIT.
+MIT. For security issues, please report privately through the channels in [SECURITY.md](./SECURITY.md) instead of opening a public issue.

package/README.md

@@ -75,6 +75,8 @@
 - 本地 `mnemon` CLI。
 - 支持 `outputSchema`、`toolFilter`、`persona` 和 `depthLimit` 的子 Agent provider。常规语义操作优先使用 `spawn`；默认后台审查还需要名为 `fork`、可继承父上下文的 provider。
 
+**兼容基线**：`dsh-mnemon` 0.1.0 已在 `@deepseek-ai/dsh` 0.1.0-rc.6（2026-08-13 快照）的 live web profile 上实测通过，最后验证日期 2026-08-14。插件不声明固定的最低版本矩阵；DSH 迭代快，升级前先在隔离 profile 或已备份的数据目录中复跑[快速开始](./docs/zh-CN/getting-started.md)的验证步骤。
+
 ## 快速开始
 
 安装 Mnemon：
@@ -108,7 +110,19 @@ dsh plugin --profile web add "github:omdsh-dev/dsh-mnemon"
 dsh plugin --profile web add "link:/absolute/path/to/dsh-mnemon"
 ```
 
-打开 DSH 的“设置 -> 插件配置 -> Mnemon”选择存储范围，再进入会话的“记忆系统”Tab 创建或激活记忆体。配置重启后生效；切换范围不会自动迁移、合并或删除旧数据。
+打开 DSH 的“设置 -> 记忆系统”独立配置页即可选择展示形态与存储范围。默认 `sidebar` 从左侧栏进入独立“记忆系统”工作台；切换为 `buildin` 则恢复原有的对话区内嵌标签页，保存后实时切换且不会重复挂载。`workspace` 范围下可在侧边栏工作台顶部独立切换要查看和维护的 DSH 工作区；Agent、工具和生命周期仍始终使用当前会话工作区。两者不一致时全局提示会同时显示查看目录和实际生效目录，并可一键对齐。存储根会在新目录初始化成功后原子切换，切换范围不会自动迁移、合并或删除旧数据。
+
+升级与卸载（`dsh plugin` 转发给 profile 目录下的 pnpm）：
+
+```sh
+# 升级
+dsh plugin --profile web update dsh-mnemon
+
+# 卸载（同时从 profile 移除其 bundle 注册）
+dsh plugin --profile web remove dsh-mnemon
+```
+
+卸载不会删除记忆数据：`global` 范围数据留在 `~/.mnemon`，`workspace` / `custom` 范围数据留在对应目录，重新安装后即可继续使用。若只想临时停用自动读写而不卸载，可在插件配置里关闭 `writebackMode` / `recallMode` / `lifecycleEnabled`；`tabEnabled=false` 可隐藏当前展示形态的 Web 入口（详见[配置参考](./docs/zh-CN/configuration.md)）。
 
 ## 最小配置
 
@@ -116,11 +130,12 @@ dsh plugin --profile web add "link:/absolute/path/to/dsh-mnemon"
 
 ```yaml
 mnemon:
+  displayMode: sidebar # sidebar | buildin；默认 sidebar
   storageScope: global # global | workspace | custom
 ```
 
 - `global`：`MNEMON_DATA_DIR`，未设置时为 `~/.mnemon`。
-- `workspace`：启动 DSH Host 时工作目录下的 `.mnemon`。
+- `workspace`：每个 DSH 工作区各自根目录下的 `.mnemon`；Agent 执行跟随当前会话工作区，Web 工作台可独立选择查看目标。
 - `custom`：`dataDir` 指定的绝对路径或 `~/...` 路径。
 
 完整配置、覆盖优先级和只读模式见[配置参考](./docs/zh-CN/configuration.md)。
@@ -129,6 +144,12 @@ mnemon:
 
 Web 工作台提供状态、运行时、记忆体、档案、沉淀、检索、实体、内容八个页面，分为三组：「状态」独立成第一组；「运行时、记忆体、档案」对应三层存储；「沉淀、检索、实体、内容」为读写工具。主要界面随 DSH 全局语言在中文与英文间切换。
 
+记忆也会在对话流中直接体现（对话内交互，**默认关闭**，可在「设置 → 记忆系统 → 对话界面」中逐项开启，保存即实时生效）：
+
+- **记忆工具卡**：每个 `mnemon_*` 工具调用都以记忆风格的卡片呈现——召回显示查询与命中数、写入显示对象摘要，可展开查看参数与结构化结果，并可一键跳到记忆视图对应页面；
+- **回合记忆条**：完成的回合若触及记忆，回合尾会按成功结果区分召回、沉淀、档案检索和检查，并单独标出失败数；展开可见具体工具名；
+- **存入记忆**：每条已定稿的助手回复旁有「存入记忆」按钮，候选内容可编辑，提交后由隔离的记忆子 Agent 判断、查重并沉淀，不占用主对话上下文。
+
 常用命令：
 
 ```text
@@ -141,6 +162,15 @@ Web 工作台提供状态、运行时、记忆体、档案、沉淀、检索、
 
 推荐的查询顺序是：热记忆 -> active Documents -> 已激活记忆体 -> 命中记录指向的归档原文。不要把临时进度、原始日志、秘密或可直接从仓库重新获得的普通事实写入长期记忆。
 
+## 权限与数据
+
+- **文件**：通过本地 `mnemon` CLI 读写数据目录——`global` 范围是 `~/.mnemon`，`workspace` / `custom` 范围是用户指定的目录；插件不直接写这些目录，WebUI 也不直接读 SQLite。`sourcePaths` 不能逃出发起会话的工作区，也不能指向受管 Documents 目录。
+- **进程**：`mnemon` 以参数数组启动且禁用 shell，输出有上限，超时先 `SIGTERM` 再 `SIGKILL`。
+- **网络**：插件与 Mnemon 均本地运行，不发起远程调用；子 Agent 的模型推理走 DSH 已有的 provider 连接。
+- **凭据**：插件不存储、不读取任何凭据或 API key，模型凭据完全由 DSH 与 provider 管理。
+- **用户数据**：记忆内容（用户画像、项目档案、长期记忆）全部落在本地 SQLite / JSON，不会上传。
+- **诚实披露**：当前没有确定性的凭据/秘密检测器，请勿向热记忆、Documents 或 Memory Spaces 写入密钥、token 或私钥。完整边界（进程/文件/Web/模型）与备份恢复见[运维、安全与故障排查](./docs/zh-CN/operations.md)。
+
 ## 文档
 
 - [文档中心](./docs/zh-CN/README.md)
@@ -166,4 +196,4 @@ pnpm run verify
 
 ## License
 
-MIT。
+MIT。发现安全问题请通过 [SECURITY.md](./SECURITY.md) 中的渠道私下报告，不要直接开公开 issue。

package/SECURITY.md

@@ -0,0 +1,89 @@
+# Security Policy
+
+**English** | [简体中文](#简体中文)
+
+## Supported versions
+
+| Version | Supported |
+|---|---|
+| 0.1.x (npm `dsh-mnemon`) | ✅ |
+
+Only the latest published version receives security fixes. The plugin targets the DSH mainline snapshot it was verified against; see the compatibility baseline in [README.en.md](./README.en.md).
+
+## Reporting a vulnerability
+
+Please **do not open a public issue** for security vulnerabilities.
+
+Report privately through one of these channels, in order of preference:
+
+1. **GitHub Security Advisories** — use the “Report a vulnerability” flow on the [Security tab](../../security) of this repository (private vulnerability reporting).
+2. **Email** — `grivn.wang@gmail.com` (maintainer). Use a subject prefix like `[dsh-mnemon security]`.
+
+Please include, when possible:
+
+- affected version(s);
+- a minimal reproduction or proof of concept;
+- whether the issue is already exploited publicly;
+- your disclosure preference (e.g., coordinated disclosure, credit, embargo).
+
+## What to expect
+
+- Acknowledge receipt within **7 days**.
+- A fix or a reasoned “not a vulnerability” response within **30 days** where feasible.
+- Credit in the release notes unless you prefer to stay anonymous.
+
+## Scope
+
+In scope:
+
+- The plugin bundle (`lib/`, `cordis.patch.yml`): data-loss, privilege-escalation, path-traversal, secret-leak, and memory-corruption style issues in plugin code.
+- The control plane: lock handling, revision conflict checks, atomic writes, and subagent isolation boundaries.
+- The WebUI: XSS or injection via rendered memory content.
+
+Out of scope:
+
+- Issues in upstream dependencies (`mnemon`, `cordis`, DSH core, React) — report those upstream; we will still help triage and pin workarounds.
+- Missing features, documentation gaps, and non-security bugs — use regular issues.
+- Credentials or secrets you intentionally stored in memory data yourself; the plugin has no secret scanner (see the disclosure in the README).
+
+## Known limitations
+
+- There is no deterministic credential/secret detection today. Do not write keys, tokens, or private keys into Runtime Memory, Documents, or Memory Spaces.
+- Memory data is local; the plugin makes no remote calls, so remote-code-execution exposure is limited to what DSH and your providers already expose.
+
+---
+
+## 简体中文
+
+### 支持的版本
+
+| 版本 | 支持 |
+|---|---|
+| 0.1.x（npm `dsh-mnemon`） | ✅ |
+
+仅最新发布版本获得安全修复。插件以验证时的 DSH mainline 快照为兼容基线，见 [README.md](./README.md)。
+
+### 报告漏洞
+
+请**不要**为安全漏洞开公开 issue，按优先级使用以下渠道私下报告：
+
+1. **GitHub Security Advisories**：在本仓库 [Security 页](../../security) 使用“Report a vulnerability”（私密漏洞报告）。
+2. **邮件**：`grivn.wang@gmail.com`（维护者），主题加 `[dsh-mnemon security]` 前缀。
+
+请尽量附上：受影响版本、最小复现或 PoC、是否已被公开利用、披露偏好（协调披露 / 署名 / 保密期）。
+
+### 预期
+
+- **7 天**内确认收到；可行情况下 **30 天**内给出修复或“非漏洞”的结论。
+- 除非你要求匿名，否则在发布说明中致谢。
+
+### 范围
+
+**范围内**：插件 bundle 与 `cordis.patch.yml` 中的数据丢失、提权、路径穿越、秘密泄露类问题；控制面（锁、revision 冲突检查、原子写、子 Agent 隔离）；WebUI 对记忆内容渲染的 XSS/注入。
+
+**范围外**：上游依赖（`mnemon`、`cordis`、DSH 核心、React）自身的问题（报告给上游，我们可协助定位与临时规避）；功能缺失、文档问题（走普通 issue）；你自行写入记忆数据中的凭据或秘密（插件当前没有秘密检测器，见 README 披露）。
+
+### 已知限制
+
+- 当前没有确定性的凭据/秘密检测，请勿向热记忆、Documents 或 Memory Spaces 写入密钥、token、私钥。
+- 记忆数据全部本地存储，插件不发起远程调用；远程代码执行面受限于 DSH 与你的 provider 既有暴露面。

package/cordis.patch.yml

@@ -5,6 +5,7 @@
       name: dsh-mnemon
       config:
         routingGuidance: true
+        displayMode: sidebar
         lifecycleEnabled: true
         recallMode: guided
         writebackMode: guided

package/docs/en/README.md

@@ -16,6 +16,7 @@ These documents use the current implementation as the source of truth. The root
 8. [Operations, Security, and Troubleshooting](./operations.md): locks, permissions, backup, recovery, and known limitations.
 9. [Development and Verification](./development.md): module structure, tests, builds, and release checks.
 10. [Roadmap](./roadmap.md): unfinished reliability, operations, and internationalization work.
+11. [Security Policy](../../SECURITY.md): supported versions, private vulnerability-reporting channels, and scope.
 
 ## Terminology
 

package/docs/en/configuration.md

@@ -10,14 +10,15 @@ The plugin registers the `mnemon` namespace with the DSH settings service. User
 $DSH_HOME/settings.yaml
 ```
 
-The default is commonly `~/.dsh/settings.yaml`. All current settings are marked as taking effect on `restart`; restart the DSH Host after saving them.
+The default is commonly `~/.dsh/settings.yaml`. All current settings are marked `live`; after Save, the Host initializes a candidate runtime graph and then switches to it atomically.
 
-The Web settings card edits only `storageScope` and `dataDir`. Other advanced settings must be changed directly in YAML.
+The Web settings card edits `displayMode`, `storageScope`, and `dataDir`. Other advanced settings must be changed directly in YAML.
 
 ## Complete Example
 
 ```yaml
 mnemon:
+  displayMode: sidebar # sidebar | buildin
   storageScope: global # global | workspace | custom
   # dataDir: ~/mnemon-data       # required for custom
   # cliPath: /opt/homebrew/bin/mnemon
@@ -37,6 +38,7 @@ mnemon:
 
 | Setting | Default | Range | Implementation Semantics |
 |---|---:|---|---|
+| `displayMode` | `sidebar` | `sidebar` / `buildin` | `sidebar` mounts the dedicated sidebar workbench; `buildin` restores the native DSH conversation-area tab; saving switches live and never mounts both entries together |
 | `storageScope` | `global` | `global` / `workspace` / `custom` | Controls the root for Runtime, Documents, Memory Spaces, and reserved state as one unit |
 | `dataDir` | unset | absolute path, `~`, or `~/...` | Required for `custom`; legacy configurations that set only this option automatically resolve to `custom` |
 | `cliPath` | auto-discovered | executable path | Explicitly selects the Mnemon CLI |
@@ -48,8 +50,13 @@ mnemon:
 | `recallMode` | `guided` | `guided` / `off` | Whether to inject an on-demand recall cue; does not remove explicit recall |
 | `writebackMode` | `guided` | `guided` / `off` | Whether to inject the hot-memory cue and enable score-based background review; does not remove explicit writes |
 | `idleReviewMs` | `30000` | 5000–600000 ms | Required continuous idle time after the threshold is reached |
-| `tabEnabled` | `true` | boolean | Currently gates only Host Mnemon data RPC; the client Tab is still registered—see the limitation below |
+| `tabEnabled` | `true` | boolean | Whether to mount the Web entry selected by `displayMode`; Host RPC, commands, and Agent tools remain registered when off |
 | `writeEnabled` | `true` | boolean | Whether to expose semantic write tools, write RPC, and write commands |
+| `mnemon-ui.toolviews` | `false` | boolean | In-conversation memory tool cards for `mnemon_*` calls; off by default (opt-in), **applies live after saving** |
+| `mnemon-ui.turnBar` | `false` | boolean | Turn-tail memory activity bar; off by default (opt-in), **applies live after saving** |
+| `mnemon-ui.saveAction` | `false` | boolean | “Save to memory” action on finalized assistant replies; off by default (opt-in), **applies live after saving** |
+
+Both the `mnemon` Host/storage namespace and the `mnemon-ui` browser-presentation namespace apply live. The storage root switches atomically only after the new runtime graph initializes successfully. Legacy `mnemon.conversationInteraction` values remain a migration default, but new saves write only to `mnemon-ui`.
 
 ## Storage Scopes
 
@@ -65,10 +72,11 @@ Suitable for users who want Runtime, Documents, and Memory Spaces shared across
 ### `workspace`
 
 ```text
-resolve(process.cwd(), ".mnemon")
+Agent / tool / lifecycle: resolve(currentSession.header.cwd, ".mnemon")
+Web workbench inspection: resolve(workspaceRegistry.get(selectedWorkspaceId).path, ".mnemon")
 ```
 
-Here, cwd is the DSH Host process launch directory. It is not the current browser-page directory and does not necessarily match the cwd recorded for every session. Start DSH from the target project directory.
+Each DSH workspace owns an independent three-tier memory root. Agents, model tools, commands, and lifecycle hooks route by the current session cwd and are unaffected by the Web workbench's inspection target. The workbench can select only Host-registered workspaces, never an arbitrary path. When inspection and execution differ, the header shows both paths and offers one-click alignment with the current session. Agent-backed actions are rejected while misaligned to prevent writes to the wrong project.
 
 ### `custom`
 
@@ -163,9 +171,11 @@ routingGuidance=false
   -> runtime-memory prompt section remains
 ```
 
-## Current `tabEnabled` Limitation
+## Display Mode and the `tabEnabled` UI Switch
+
+`displayMode=sidebar` (the default) mounts the “Memory System” sidebar entry and its dedicated center-column workbench. `displayMode=buildin` instead registers the original DSH `conversation.view` tab. Saving first disposes the active entry and then mounts the target, so the two modes never appear simultaneously.
 
-When `tabEnabled=false`, the Host does not register Mnemon read/write RPC, but the Web client still registers its conversation view slot unconditionally. The current result is therefore “the Tab entry may still appear while its data interface is unavailable,” not complete Tab removal. This is an implementation gap; do not rely on the setting to uninstall the UI.
+`tabEnabled=false` removes the currently selected Web entry live. Host RPC, commands, and tools remain registered across display-mode and enablement changes so an Agent or command already in progress stays valid.
 
 ## Profile Patch Overrides
 

package/docs/en/getting-started.md

@@ -28,7 +28,7 @@ both paths require
   -> depthLimit
 ```
 
-The plugin does not declare a fixed minimum-version matrix for DSH and Mnemon in its code. Before upgrading, run the verification steps on this page against an isolated data directory.
+The plugin does not declare a fixed minimum-version matrix for DSH and Mnemon in its code. **Verified baseline**: `dsh-mnemon` 0.1.0 has been verified end-to-end on a live web profile running `@deepseek-ai/dsh` 0.1.0-rc.6 (2026-08-13 snapshot); last verified 2026-08-14. Before upgrading, run the verification steps on this page against an isolated data directory.
 
 ## 2. Install Mnemon
 
@@ -76,6 +76,22 @@ dsh plugin --profile web add "link:/absolute/path/to/dsh-mnemon"
 
 The plugin package's `cordis.patch.yml` mounts the Host plugin; the Web client bundle registers the session workspace and plugin settings card.
 
+### Upgrade and uninstall
+
+`dsh plugin` is a pnpm forwarder that runs inside the profile directory:
+
+```sh
+# Upgrade
+dsh plugin --profile web update dsh-mnemon
+
+# Uninstall (also removes its bundle registration from the profile)
+dsh plugin --profile web remove dsh-mnemon
+```
+
+Uninstalling never deletes memory data: `global` data stays in `~/.mnemon`, and `workspace` / `custom` data stays in their directories, so reinstalling picks up where you left off.
+
+To pause automatic reads/writes without uninstalling, turn off `writebackMode` / `recallMode` / `lifecycleEnabled` in the plugin configuration (see the [configuration reference](./configuration.md), “Toggle interactions”). To hide only the Web workspace, set `tabEnabled=false`; Host RPC, commands, and Agent tools remain available.
+
 ## 4. Choose a Storage Scope
 
 Start the DSH Web profile:
@@ -84,19 +100,21 @@ Start the DSH Web profile:
 dsh --profile web
 ```
 
-Under “Settings -> Plugin Configuration -> Mnemon,” choose:
+On the dedicated “Settings -> Memory System” page, first choose a display mode: the default `sidebar` uses a dedicated sidebar workbench, while `buildin` uses the original conversation-area tab. Saving switches live. Then choose a storage scope:
 
 | Scope | Root directory | Best suited for |
 |---|---|---|
 | `global` | `MNEMON_DATA_DIR` or `~/.mnemon` | Sharing one memory set across multiple workspaces |
-| `workspace` | `.mnemon` under the DSH Host startup directory | Project isolation |
+| `workspace` | `.mnemon` under each DSH workspace root | Project isolation and cross-workspace inspection |
 | `custom` | `dataDir` | An explicit disk, mounted volume, or dedicated data directory |
 
-Settings are written to `$DSH_HOME/settings.yaml` and take effect after restarting DSH. Switching scopes does not move existing data; to preserve it, stop all writes first and manually copy the entire old root directory.
+Settings are written to `$DSH_HOME/settings.yaml` and apply live after Save. Switching scopes does not move existing data; to preserve it, stop writes first and migrate with a complete ZIP backup.
+
+After selecting `workspace`, the workbench header can switch the workspace being inspected. This choice controls only which memory set the workbench displays and maintains; Agent execution always follows the current session. A global warning appears when the two differ and offers one-click alignment.
 
 ## 5. Create Your First Memory Space
 
-Open the “Memory System” tab in any session:
+With the default `sidebar` mode, click “Memory System” in the DSH sidebar. With `buildin`, open the “Memory System” tab in the conversation area:
 
 1. Open the “Memory Spaces” page.
 2. Create a narrowly scoped Memory Space, such as “Project Decisions.”

package/docs/en/interfaces.md

@@ -4,7 +4,7 @@
 
 ## Web Workspace
 
-The main Web interface follows DSH's global language and light/dark theme. The top navigation is split into three divider-separated groups: “Status” stands alone; “Runtime, Memory Spaces, Documents” cover the three storage tiers; “Distill, Recall, Entities, Content” are the read/write tools. The “Status” page opens by default.
+`displayMode=sidebar` (the default) opens a dedicated workbench from the sidebar, while `displayMode=buildin` opens the same functional interface through the original DSH `conversation.view` tab. The settings page switches the two modes live and never mounts both simultaneously. The main Web interface follows DSH's global language and light/dark theme. The top navigation is split into three divider-separated groups: “Status” stands alone; “Runtime, Memory Spaces, Documents” cover the three storage tiers; “Distill, Recall, Entities, Content” are the read/write tools. The “Status” page opens by default.
 
 | Page | Purpose | Call Boundary |
 |---|---|---|
@@ -19,6 +19,18 @@ The main Web interface follows DSH's global language and light/dark theme. The t
 
 The graph synchronizes every 15 seconds and can also be refreshed manually. Natural layout, uniform reset, dragging, and keyboard adjustments affect only client-side presentation and do not modify Mnemon data.
 
+### In-Conversation Interaction
+
+The memory system surfaces inside the conversation flow through three native DSH slots, all purely additive registrations that replace no official rendering:
+
+| Slot | Presentation | Data and interaction |
+|---|---|---|
+| `tool.call.toolview` (keyed by tool name) | Every `mnemon_*` tool call renders as a memory-flavoured card row: state dot, Mnemon mark, recall/write title, and a tool-specific summary; hovering reveals “Open in Memory view” and “Inspect” | Summaries derive from the call arguments and the settled result JSON (recall/document-search hit counts, engine health for status, catalogue stats for bodies, …); expanding shows the raw arguments and result; jumps use the `mnemon:anchor` event channel to open the matching Memory view page (with a query seed) |
+| `conversation.chat.turnTail` (chain) | One “Turn memory · recalled N · wrote M · document search K” line above the turn-tail actions; expanding lists the exact tool names and offers a jump to the Status page | The read-only RPC `turn-activity` counts `mnemon_*` calls per turn from the Host's durable session log; the chain `select` declines open turns, and turns without memory activity render nothing |
+| `conversation.chat.assistant-actions` (list, id `mnemon-save`) | A “Save to memory” action beside finalized assistant replies (next to feedback); clicking opens the candidate panel | The panel extracts the message text by messageId through the read-only RPC `assistant-message` into an editable candidate; submission goes through the existing `supervise` write RPC (supervised writeback: memory subagent judgment, dedupe, Memory Space choice) and shows the subagent receipt; read-only deployments are disabled up front with a note |
+
+`turn-activity` and `assistant-message` are new read-only endpoints sharing the existing Host channel and error semantics. The rendering-extension contracts behind the in-conversation interaction and the follow-up inline memory-highlight plan are recorded in the Mnemon document “dsh-mnemon 对话内记忆交互侦察”.
+
 ## Model Tools
 
 ### Read-Only Tools
@@ -79,6 +91,8 @@ When a worker calls a tool with the same name, the call goes directly to the ser
 
 RPC is the internal bridge between the DSH Host and this plugin's Web client. It is not a promised stable external HTTP API.
 
+Workbench data requests carry `sessionId` and an optional `workspaceId`. The Host accepts only workspace IDs registered in `workspaceRegistry`: deterministic reads and human maintenance route to the inspected root selected by `workspaceId`, while agents, tools, and lifecycle hooks continue to route by the Agent cwd for `sessionId`. `status.workspaceContext` returns both roots and their `aligned` state; Agent-backed writes are rejected while they differ.
+
 ### Read Channel
 
 ```text
@@ -111,7 +125,7 @@ authority: loopback
 | Endpoint | Behavior |
 |---|---|
 | `runtime-memory` | Hot-memory mutation |
-| `supervise` | Submit a Tab candidate to a memory worker |
+| `supervise` | Submit a workspace candidate to a memory worker |
 | `document` | create / update / archive |
 | `remember` | Semantic write with optional advanced constraints |
 | `link` | Create a relationship |
@@ -119,7 +133,7 @@ authority: loopback
 | `body-create` | Create a Memory Space |
 | `body-update` | Update metadata or active state |
 
-The entire write channel is not registered when `writeEnabled=false`.
+When `writeEnabled=false`, the write channel remains stably registered but every mutation is rejected at the Host boundary.
 
 ### Settings Channel
 

package/docs/en/operations.md

@@ -53,6 +53,10 @@ The serial queue does not replace coordination across DSH processes. When multip
 
 These boundaries are not a secret scanner. There is currently no deterministic credential/secret detection. Do not submit keys, tokens, private keys, or raw sensitive logs to hot memory, Documents, or Memory Spaces.
 
+### Security reporting
+
+Report vulnerabilities privately through the channels in [SECURITY.md](../../SECURITY.md) (GitHub Security Advisories or maintainer email) — do not open a public issue. Typical in-scope issues include data loss, path traversal, lock/revision-check bypasses, subagent isolation breaks, and injection via memory content rendered by the WebUI.
+
 ## Backup
 
 All three tiers share `storageRoot`. A consistent backup should cover the entire root, not just `mnemon.db`:
@@ -90,7 +94,7 @@ If `USER.md` / `MEMORY.md` is damaged, the control layer can repair it from a va
 The plugin does not migrate data automatically:
 
 ```text
-old scope -- change setting + restart --> new empty or existing scope
+old scope -- change setting + save --> new empty or existing scope
 
 no implicit copy
 no implicit merge
@@ -104,11 +108,12 @@ When migration is required, stop writes and copy the complete root. Two roots ca
 | Symptom | Check and Resolution |
 |---|---|
 | Mnemon is unavailable | Run `command -v mnemon` and `mnemon --version`; set `MNEMON_CLI_PATH` or `cliPath`, then restart |
-| Status is healthy but recall is empty | Check that a Memory Space is active, inspect the current `storageScope` and DSH launch cwd, and make sure the query is focused enough |
+| Status is healthy but recall is empty | Check that a Memory Space is active, inspect `storageScope`, the workbench inspection root, the current session's effective root, and make sure the query is focused enough |
+| Workbench reports a directory mismatch | This is a safety notice: the workbench is inspecting another workspace while the Agent still follows the current session; align with the session or intentionally keep cross-workspace inspection |
 | `memoryBodyId is required...` | The active count is not exactly 1; have the worker or caller select a target explicitly |
 | `memory body is not active for reading` | Activate the target in Overview; writing to an inactive space is allowed, but reading is not |
 | Subagent provider error | Regular tasks require the full isolation capabilities; background review additionally requires `fork + inheritsParentContext` |
-| Settings have no effect after saving | All options take effect after restart |
+| Settings have no effect after saving | Check the UI error; all options should apply live after a successful Save |
 | Custom directory is rejected | Use an absolute path, `~`, or `~/...` |
 | Document has no workspace | The session must correspond to a live root Agent and include cwd in its session header |
 | Source path is rejected | The path must stay within the session workspace and must not reference the managed Documents directory |
@@ -117,7 +122,7 @@ When migration is required, stop writes and copy the complete root. Two roots ca
 | Lock timeout | Check whether another instance is writing; do not delete a lock that still belongs to a live process |
 | Invalid JSON / unexpected viz | The CLI output protocol may be incompatible; validate the version against an isolated root and do not continue writing production data |
 | A remote page can read but not write | Write RPC enforces loopback by design |
-| `tabEnabled=false` still shows the Tab | The setting currently stops only Host data RPC and does not remove the client slot |
+| “Memory System” is missing from the sidebar | Check `tabEnabled=true` and `displayMode=sidebar`; `buildin` appears as a conversation-area tab; after changing a local link, run `pnpm run build` and restart the DSH profile |
 | Local link does not reflect source | Run `pnpm run build`, then restart the DSH profile |
 
 ## Known Limitations

package/docs/en/project-overview.md

@@ -170,7 +170,9 @@ These workflows can be initiated proactively through Agent tools and can also be
 
 ### Web Workspace
 
-The conversation's “Memory System” tab contains eight pages in three divider-separated groups: “Status” stands alone; “Runtime, Memory Spaces, Documents” cover the three storage tiers; “Distill, Recall, Entities, Content” are the read/write tools:
+The default `sidebar` mode opens a dedicated center-column workspace from the “Memory System” sidebar entry. Settings can switch to `buildin`, which restores the original conversation-area tab. Both modes reuse the same functional interface and are mounted mutually exclusively. It contains eight pages in three divider-separated groups: “Status” stands alone; “Runtime, Memory Spaces, Documents” cover the three storage tiers; “Distill, Recall, Entities, Content” are the read/write tools:
+
+Under the `workspace` storage scope, the header selector is an independent inspection context: it can display and maintain another registered DSH workspace without changing the current conversation. The execution context used by agents, tools, and lifecycle hooks always follows the current session cwd. When inspection and execution differ, the whole workbench shows both paths and a one-click alignment action; operations that need to start an Agent do not run while misaligned.
 
 | Page | Primary purpose |
 |---|---|

package/docs/en/roadmap.md

@@ -11,7 +11,6 @@ The Roadmap records work beyond the current implementation; it is not a commitme
 - [ ] **Backoff, circuit breaking, and manual retry**: apply bounded backoff after consecutive failures, show the reason on the Status page, and allow explicit recovery.
 - [ ] **Deterministic sensitive-data defenses**: add secret/credential pattern detection, size limits, and audit receipts beyond LLM admission.
 - [ ] **Automated real-WebUI E2E**: isolate DSH_HOME, storageRoot, workspace, and the port; cover light tasks, score-based review, cancellation, and failures without partial writes.
-- [ ] **Correct `tabEnabled` semantics**: have the Host and client use the same switch so the complete Tab capability is actually registered or removed.
 - [ ] **Correct cold-reference paths**: under every storage scope, write resolvable references that match the actual managed path.
 
 ## P1: Long-Term Maintenance and Data Operations
@@ -27,6 +26,7 @@ The Roadmap records work beyond the current implementation; it is not a commitme
 ## P2: Observability, Experience, and Release Engineering
 
 - [ ] **Background-review history**: show recent scores, checkpoints, waiting/running/failed states, worker receipts, and resulting changes.
+- [ ] **Switch to DSH's shared directory picker** (blocked on [dsh-external/issues#603](https://github.com/dsh-external/issues/issues/603)): custom storage temporarily uses a manually entered Host path because remote `browse` deployments cannot invoke the `native` picker; once DSH exposes a reusable directory-picker service for plugins, move to the provider-selected native / browse flow and retain manual entry only as a fallback if needed.
 - [ ] **Complete internationalization**: cover commands, tool cards, Host errors, compatibility default metadata, and confirmation copy.
 - [ ] **Multi-Memory-Space E2E**: cover automatic space creation, cross-space recall, one-pass migration routing, multiple relationship types, merge, and controlled forget.
 - [ ] **Capacity and fault injection**: exercise real USER/MEMORY boundaries, Document LRU, revision conflicts, CLI timeouts, and mid-operation Host restarts.

package/docs/en/storage-model.md

@@ -50,7 +50,7 @@ follow an exact cold reference when full text is required
 +-- state/                         # reserved; no persistent reviewer yet
 ```
 
-`storageScope` determines the entire root, not just the Mnemon databases. `state/` is currently recognized only by the status inspector; scored review watermarks remain in the running Host's memory.
+`storageScope` determines the entire root, not just the Mnemon databases. The `workspace` scope resolves an independent `<workspace>/.mnemon` for every registered DSH workspace. The Web inspection target and current-session execution target are independent; only the latter drives agents, tools, and lifecycle hooks. `state/` is currently recognized only by the status inspector; scored review watermarks remain in the running Host's memory.
 
 ## Runtime Memory
 

package/docs/zh-CN/README.md

@@ -16,6 +16,7 @@
 8. [运维、安全与故障排查](./operations.md)：锁、权限、备份、恢复和已知限制。
 9. [开发与验证](./development.md)：模块结构、测试、构建和发布检查。
 10. [Roadmap](./roadmap.md)：尚未完成的可靠性、运维和国际化工作。
+11. [安全策略](../../SECURITY.md)：支持版本、漏洞私密报告渠道与范围。
 
 ## 术语
 

package/docs/zh-CN/configuration.md

@@ -10,14 +10,15 @@
 $DSH_HOME/settings.yaml
 ```
 
-默认通常是 `~/.dsh/settings.yaml`。当前全部配置标记为 `restart` 生效；保存后需要重启 DSH Host。
+默认通常是 `~/.dsh/settings.yaml`。当前全部配置标记为 `live` 生效；保存后会先初始化候选运行图，再原子切换 Host 服务。
 
-Web 设置卡只编辑 `storageScope` 和 `dataDir`。其他高级项需要直接修改 YAML。
+Web 设置卡编辑 `displayMode`、`storageScope` 和 `dataDir`。其他高级项需要直接修改 YAML。
 
 ## 完整示例
 
 ```yaml
 mnemon:
+  displayMode: sidebar # sidebar | buildin
   storageScope: global # global | workspace | custom
   # dataDir: ~/mnemon-data       # custom 时必填
   # cliPath: /opt/homebrew/bin/mnemon
@@ -37,6 +38,7 @@ mnemon:
 
 | 配置 | 默认值 | 范围 | 实现语义 |
 |---|---:|---|---|
+| `displayMode` | `sidebar` | `sidebar` / `buildin` | `sidebar` 挂载左侧栏独立工作台；`buildin` 恢复 DSH 原生对话区标签页；保存后实时切换且不会同时挂载两个入口 |
 | `storageScope` | `global` | `global` / `workspace` / `custom` | 统一控制 Runtime、Documents、Memory Spaces 和预留 state 根目录 |
 | `dataDir` | 未设置 | 绝对路径、`~` 或 `~/...` | `custom` 时必填；旧配置只设置它时自动解析为 `custom` |
 | `cliPath` | 自动发现 | 可执行路径 | 显式指定 Mnemon CLI |
@@ -48,8 +50,13 @@ mnemon:
 | `recallMode` | `guided` | `guided` / `off` | 是否注入按需 recall cue；不移除显式召回 |
 | `writebackMode` | `guided` | `guided` / `off` | 是否注入热记忆 cue 并启用评分后台审查；不移除显式写入 |
 | `idleReviewMs` | `30000` | 5000–600000 ms | 达标后需要连续空闲的时间 |
-| `tabEnabled` | `true` | boolean | 当前只门控 Host Mnemon 数据 RPC；客户端 Tab 仍会注册，见下方限制 |
+| `tabEnabled` | `true` | boolean | 是否挂载 `displayMode` 指定的 Web 入口；关闭后 Host RPC、命令和 Agent 工具保持注册 |
 | `writeEnabled` | `true` | boolean | 是否暴露语义写工具、写 RPC 和写命令 |
+| `mnemon-ui.toolviews` | `false` | boolean | 对话内记忆工具卡（`mnemon_*` 调用的记忆风格卡片）；默认关闭（opt-in），**保存后实时生效** |
+| `mnemon-ui.turnBar` | `false` | boolean | 回合尾记忆活动条；默认关闭（opt-in），**保存后实时生效** |
+| `mnemon-ui.saveAction` | `false` | boolean | 已定稿助手回复旁的「存入记忆」按钮；默认关闭（opt-in），**保存后实时生效** |
+
+`mnemon` Host/存储命名空间和 `mnemon-ui` 浏览器呈现命名空间都实时生效。存储根只会在新运行图初始化成功后原子切换；旧版 `mnemon.conversationInteraction` 仍会作为迁移默认值读取，但新保存只写入 `mnemon-ui`。
 
 ## 存储范围
 
@@ -65,10 +72,11 @@ MNEMON_DATA_DIR when non-empty
 ### `workspace`
 
 ```text
-resolve(process.cwd(), ".mnemon")
+Agent / 工具 / 生命周期：resolve(currentSession.header.cwd, ".mnemon")
+Web 工作台查看：resolve(workspaceRegistry.get(selectedWorkspaceId).path, ".mnemon")
 ```
 
-这里的 cwd 是 DSH Host 进程启动目录，不是浏览器页面当前目录，也不一定等于每个会话记录的 cwd。应从目标项目目录启动 DSH。
+每个 DSH 工作区拥有独立的三层记忆根。Agent、模型工具、命令和生命周期按当前会话的 cwd 路由，不受 Web 工作台查看目标影响。工作台只能从 Host 已登记的工作区中选择，不能提交任意路径；查看目标与会话实际目录不一致时，顶部会显示两条路径并提供“一键对齐当前会话”。需要 Agent 子任务的操作在未对齐时会被 Host 拒绝，避免写入错误项目。
 
 ### `custom`
 
@@ -163,9 +171,11 @@ routingGuidance=false
   -> runtime-memory prompt section remains
 ```
 
-## `tabEnabled` 当前限制
+## 展示形态与 `tabEnabled` 界面开关
+
+`displayMode=sidebar`（默认）会挂载“记忆系统”侧边栏入口和独立主内容区工作台；`displayMode=buildin` 会改为注册原有的 DSH `conversation.view` 内嵌标签页。设置页保存后会先卸载当前入口再挂载目标入口，因此两种形态不会同时出现。
 
-Host 在 `tabEnabled=false` 时不注册 Mnemon read/write RPC，但 Web client 仍无条件注册 conversation view slot。因此当前效果是“Tab 入口仍可能出现但数据接口不可用”，而不是完整隐藏 Tab。这是实现缺口，不应依赖它进行 UI 卸载。
+`tabEnabled=false` 会实时移除当前形态的 Web 入口。为避免运行中的 Agent 或命令因界面设置变化而失效，Host RPC、命令和工具不会随展示形态或总开关卸载。
 
 ## Profile patch 覆盖