dsh-plugin-tool-management 0.12.1 → 0.14.0

package/README_EN.md

@@ -12,14 +12,13 @@
 
 [简体中文](README.md) · **English** · [Changelog](CHANGELOG.md) · [Release overview](docs/update.md)
 
-- An **MCP, skills, scenes, memories, subagents, prompts & archived sessions** manager for DeepSeek Harness.
-- Eight tabs: **Scenes**, **MCP**, **Skills**, **Subagents**, **Prompts**, **Memories**, **Sessions**, **Host**.
+An **MCP, skills, scenes, memories, subagents, prompts & archived sessions** manager for DeepSeek Harness. Eight tabs: Scenes / MCP / Skills / Subagents / Prompts / Memories / Sessions / Host.
 
 ```sh
 dsh plugin --profile web add dsh-plugin-tool-management@latest
 ```
 
-Hard-refresh the browser (Cmd/Ctrl+Shift-R) afterwards — a **Tools** panel in Settings means it worked. No hand-editing of `cordis.patch.yml`, no skill source files touched, configuration survives restarts and upgrades.
+Hard-refresh the browser (Cmd/Ctrl+Shift+R) afterwards — a **Tools** panel in Settings means it worked. The plugin only writes its own files, never touches skill sources, and your configuration survives restarts and upgrades.
 
 ---
 
@@ -38,22 +37,22 @@ Hard-refresh the browser (Cmd/Ctrl+Shift-R) afterwards — a **Tools** panel in
 
 ## Highlights
 
-In one line: **set up a scene for each kind of work — "day job / writing / coding" — and switch the whole stack with one click. Everything the plugin manages, the model can actually see.**
-
-| Highlight                             | What it means                                                                                                                                                                                                                                                                                                           |
-| ------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| One-click scene switch                | Each scene carries its own set: which MCP servers, which skills, which personas, which memories; flip it on and the whole stack follows, turn it off and everything comes back                                                                                                                                          |
-| Memories reach the model on their own | Write a few `.md` files under a scene and they become its knowledge base — injected automatically, no copy-pasting every session                                                                                                                                                                                        |
-| Notes for MCP servers                 | Write "if A is down, fall back to B" as a note — the model sees it and acts on it                                                                                                                                                                                                                                       |
-| Disable a single tool                 | Keep a server but mute one tool: invisible and uncallable; "Restart" only reconnects and never flips switches                                                                                                                                                                                                           |
-| Skills at a glance                    | Which copy is in effect, which is shadowed by a same-name skill, which is preferred — all marked in the list                                                                                                                                                                                                            |
-| Subagent = one file, one role         | Write a role file and delegate; only the result comes back and it never clutters your History; which roles are available can follow the scene                                                                                                                                                                           |
-| Several prompt presets                | Keep multiple AGENTS.md baselines (terse mode, teaching tone, …), switch with one click; a scene can bind its own                                                                                                                                                                                                       |
-| Sessions no longer lost               | Archive grouped by project, searchable, batch-restorable; import transcripts from Claude Code / Cursor / Codex                                                                                                                                                                                                          |
-| The model always sees it              | Everything the plugin manages (memories / MCP / skills / subagents / prompts) is announced to the model — one message per domain, republished only on change; under Minimal nothing is injected by default (follows the preset), force any domain on in the Host tab                                                    |
-| Lock it and relax                     | Lock a scene to make create/update/delete in all five domains read-only; unlock first to change anything (creating/renaming/binding/activating a scene, the recycle bin, restart, export and token settings are **not** in the frozen list — see Scene lock)                                                            |
-| Deleted is not gone                   | Deletes of skills / memories / personas / presets / scenes land in a recycle bin and can be restored; they also zip out and back in. **Session history is the exception: permanent delete skips the recycle bin and cannot be undone**                                                                                  |
-| Safe by default                       | Secrets masked, plaintext needs a token; only the plugin's own files are written, skill sources stay untouched, and your config survives restarts and upgrades. **Masking is display-only**: secrets stay in cleartext in `cordis.patch.yml` and in up to 5 backup copies per patch file (see Configuration & security) |
+In one line: **configure "work / writing / coding" each as a scene and switch the whole stack with one click — and the model always sees whatever this plugin manages.**
+
+| Highlight                     | What it means                                                                                                                                                             |
+| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| One-click scene switch        | Each scene carries its own MCP / skills / personas / memories; entering applies them, leaving restores. The model can switch them for you too                             |
+| Memories reach the model      | A few `.md` files under a scene become its knowledge base — injected automatically, no copy-pasting                                                                       |
+| Notes for MCP servers         | Write "if A is down, fall back to B" as a note; the model sees it every turn and acts on it                                                                               |
+| Disable a single tool         | Keep a server but mute one tool: invisible and uncallable. "Restart" only reconnects and never flips your switches                                                        |
+| Skills at a glance            | The copy in effect is marked *preferred*; shadowed ones name the source that wins                                                                                         |
+| Subagent = one file, one role | Write a role file and delegate to it; only the result comes back, and it never clutters your History                                                                      |
+| Several prompt presets        | Keep multiple `AGENTS.md` baselines and switch with one click; each scene can bind its own                                                                                |
+| Sessions no longer lost       | Archives grouped by project, searchable, batch-restorable; imports Claude Code / Cursor / Codex transcripts                                                               |
+| The model always sees it      | One context message per domain, republished only when the content changes. Under suppressing presets nothing is injected by default — force any domain on in the Host tab |
+| Lock it and relax             | Locking a scene makes create/update/delete across the five domains read-only until you unlock                                                                             |
+| Deleted is not gone           | Skills / memories / personas / presets / scenes land in a recycle bin and can be restored (permanent session deletion is the exception)                                   |
+| Safe by default               | Secrets masked, plaintext needs a token, only the plugin's own files are written. Masking is display-only — see Configuration & security                                  |
 
 ## Quick start
 
@@ -61,7 +60,7 @@ Prerequisites: DSH installed (`dsh web` runs), Node.js ≥ 18.
 
 ```sh
 dsh plugin --profile web add dsh-plugin-tool-management@latest   # install / update
-dsh plugin --profile web remove dsh-plugin-tool-management       # uninstall
+dsh plugin --profile web remove dsh-plugin-tool-management        # uninstall
 ```
 
 Hard-refresh the browser — a **Tools** panel with eight tabs means it worked. Client changes hot-reload; host-side changes need `dsh web` restarted.
@@ -74,139 +73,119 @@ dsh plugin --profile web add dsh-plugin-tool-management@latest
 Then remind me to hard-refresh the browser.
 ```
 
-The model can manage everything above via 14 tools (`mcp_manager_*` / `skill_manager_*` / `prompt_manager_*` / `memory_manager_*` / `subagent_manager_*`); scripts use `POST /dsh-plugin-tool-management/api` (`{op, args}` protocol).
-
----
-
 ## Features
 
 ### Scenes & memories
 
-- **A scene = a group, a memory = a `.md` file**. `memories/<scene>/<name>.md`, the whole body is injected, file names can be non-ASCII.
-- **Single-choice toggle**: only one scene at a time (others greyed out); turning all off = only `global` and `_shared` inject. New scenes start off.
-- **Scene-bound prompt**: switching scenes rewrites `~/.dsh/AGENTS.md` (5-gen backup, auto-restore on exit).
-- **Scene profile**: every scene combines MCP tools / skills / subagents / memories (any mix); opening a scene applies and narrows injection, closing restores verbatim (the toggle is the only entry). Checked means on, unchecked means off, and **a missing section means nothing is checked — so that whole domain is off** (a scene with no MCP section therefore stops every MCP server, and exit starts them again). While a scene is active those switches (MCP, skills, subagents) still work — changes are written into that scene's profile too (they take effect immediately and are kept for the next visit); only locking freezes them. The memory domain has a single source of truth and never goes through the profile.
-- **"Entering/leaving the mode" and "enabling a scene" are two independent state axes**: the UI toggle is the only entry point (it moves both axes at once). If you bypass the UI and call the HTTP API directly, note that `scene-mode-set{scene:null}` only drops the runtime snapshot and does **not clear the enabled set** — memories and the prompt keep being injected for that scene; a full exit also needs `rules-set-active{scenes:[]}`.
-- **Import**: `.md` / `.zip` (dir name = scene, bundles carry attachments), same names skipped never overwritten, over-limit items reported.
-- **Export**: pick memories and zip them, keeping the `scene/name` layout; bundle memories bring their attachments along. Sources are read-only.
-- **Injection budget**: default 256 KiB, oversized memories skipped with a list. Deletes go to recycle bin.
-- **Subagent sessions do not receive memories**: memories are injected into the **top-level session only** — they are the parent's situation, not the facts a child needs; a child's context stays "persona + task", it can read memories on demand with `memory_manager_list/read`, and relevant facts belong in the `task`. Other domains are unaffected (MCP / skills / prompts still inject; the persona catalog follows each persona's `catalogDepth`).
-- **Scene lock**: once locked, create/update/delete across MCP / skills / subagents / memories / prompts is read-only — UI disabled plus a server-side guard; a scene must be running to lock, and a locked scene can't be closed until unlocked. **What freezes is the content, not the scene itself**: creating/deleting/renaming a scene, rebinding its prompt, switching the active set, recycle-bin restore and purge, MCP restart, export, injection settings and token settings are all outside the frozen list (they are not "content of the scene profile"). Switching the active set *is* refused while a locked scene is in effect — clearing it would leave the model-side write guard with nothing to check while the runtime still runs that scene's profile.
-- **Deleting a scene deletes its memories too**: the scene record, profile and every memory go into one recycle-bin entry, restored as a whole; a running scene refuses deletion. Scene names are renameable (dir and profile follow, memory bodies untouched).
+- **A scene = a group, a memory = a `.md` file**: `memories/<scene>/<name>.md`, the whole body is injected; file names may be non-ASCII.
+- **"Enabled" and "entered" are two axes.** Enabled decides which scene the injection follows (single-select; none enabled = only `global` and `_shared` inject). Entering applies the scene's whole MCP / skills / personas set and writes its bound prompt into `~/.dsh/AGENTS.md` (5 generations of backups, restored on exit). Both the UI toggle and `scene_manager_switch` move the two axes together.
+- **Scene profile**: each scene combines MCP tools / skills / subagents / memories. The rule is *ticked = on, unchecked = off*, and a section that was never created means that whole domain is off. Leaving restores the pre-scene state verbatim. While a scene is active, the switches in those three domains still work and are written back into its profile; only locking freezes them.
+- **Scene lock**: once locked, create/update/delete across MCP / skills / subagents / memories / prompts is read-only (UI disabled plus a server-side guard). Creating, renaming, binding a prompt, activating or entering a scene, the recycle bin, MCP restart and exports stay outside the frozen list. A scene must be running to lock, and a locked scene cannot be turned off until you unlock it.
+- **Deleting a scene deletes its memories too**: record, profile and every memory land in one recycle-bin entry and come back as a whole. A running scene refuses deletion; renaming follows through to the directory and profiles.
+- **Import / export**: `.md` / `.zip` (directory name = scene, bundles carry attachments); same names are skipped, never overwritten, and over-limit items are reported. Export packs the memories you tick and only reads source files.
+- **Injection budget**: 128 KiB by default; oversized memories are skipped with a list. Deletes go to the recycle bin.
+- **Subagent sessions do not receive memories**: memories are the parent's situation, not the facts a child needs. A child's context stays "persona + task" — put what it needs into the task. Other domains are unaffected (MCP / skills / prompts still inject; the persona catalog follows each persona's `catalogDepth`).
 
 ### Subagents
 
-- **One file per persona**: `agents/<persona>.md`, frontmatter entirely optional.
-- **A persona reaches the subagent's system prompt inside a role frame**: the body is used verbatim, wrapped in a `# Persona: <name>` heading, one authorizing line ("specified by the caller; where it conflicts with your default inclinations, it wins; the task states what to achieve, and this persona governs how") and one boundary line (it governs *how* you work, not *what* you may do), with the body fenced under `## Persona`. The frame follows the body's language. This makes the model read it as "I have been assigned a role" rather than as two stray sentences following the identity line — **the persona file itself needs no change**. The frame does not include `description`: that field exists so the *caller* can pick a persona; an introduction meant for the child belongs in the body.
-- **Tool limits per Agent preset**: each preset gets its own allow/deny list (mutually exclusive), effective at runtime by the current preset — fixes the old "union of all presets" list that broke subagents after a preset switch. Two behaviours to know: **① an allow list is merged back with every currently running `mcp__*` tool** (the official `allow` means "cut everything outside the list", and not merging would cut MCP too), so ticking only `read` will not stop an MCP server that exposes a shell; **② when none of the listed names exists right now, the result is "no restriction"** (fail-open, not fail-closed) — on minimal presets an allow list easily ends up empty. The opposite failure is naming the reserved tool `run_code`: the official `tools.restrict()` throws outright (the subagent never starts), so the plugin strips it from the list and says so in the result.
-- **`output:` hard output contract**: frontmatter may carry multiple `output:` lines (**one requirement per line**); the role frame renders them as a separate `## Output requirements (hard)` section after the persona definition. Use the prompt for how the role thinks (prose) and `output:` for what the deliverable must look like (format, severities, required markers, bans) — a persona with only an abstract requirement produces output nobody can check, and only checkable requirements actually get followed. The editor has an "Output requirements (hard)" box, and you can write the lines into the file directly.
-- **Run and discard**: `subagent_manager_run` runs with the persona, returns only the result, never enters History. A child's context is **persona + task** only: memories are not injected (the child can read them with `memory_manager_*`, and relevant facts belong in the `task`). Scenes can bind which personas are available.
-- **Two context modes**: by default the child starts fresh (it cannot see this conversation, so the task must be complete); with `inherit` the child is seeded with this conversation's **finished** turns (the same mechanism as the host's `subagent_fork`) and the task only states what is new. Only finished turns are inherited — a delegation made during the current turn cannot pass that turn's content (measured: a parent that delegated while still reading left the child to start from scratch), so treat `task` as self-contained in that case. The boundary against the host's two delegation tools (`subagent` / `subagent_fork`) is written into the context by this plugin: **work that matches a persona goes here**, and the host tools are for when no persona fits or a background job is needed.
-- **On/off toggles**: a disabled persona is not injected and invisible to the model (file untouched); newly created / imported / restored personas start **disabled** (since v0.8.5, the same rule as skills / MCP) — switch them on before delegating. Entering a scene applies the profile's persona list exactly (checked on, everything else off; no section = all off) and exit restores the pre-scene switches. Inside a scene these toggles still work and are synced into the scene profile (only locking freezes them); leaving the scene restores the pre-scene state.
-- **Persona catalog enters the system prompt**: names + descriptions only, so the model knows what it can delegate to; personas are renameable, scene bindings follow.
-- **Catalog injection (`catalogDepth`)**: which sessions the standing persona catalog is injected into — default `1` = top level only; `2` also reaches subagent sessions; `3` goes two levels down; the UI's “No nesting limit” writes `99`, which reaches every session depth. **It does not limit nesting**: subagents can always delegate further, which the host decides (`dsh-tool-subagent` defaults to `maxDepth: 3`), and this plugin no longer passes `maxDepth` at all. When the standing catalog is not injected, `subagent_manager_list` still returns every persona. One rule drives all three places (catalog filter, domain declaration, live panel), so the UI and the actual injection cannot disagree.
+- **One file per persona**: `subagents/<persona>.md`, frontmatter entirely optional. `output:` takes one requirement per line — a checkable output contract (format, severities, bans) gets followed where one abstract sentence does not.
+- **The persona reaches the child inside a role frame**: the body is used verbatim under a `# Persona: <name>` heading with an authorization line and a boundary line (it governs *how* it works, not *what* it may do). The persona file itself needs no change.
+- **Delegation**: `subagent_manager_run` runs with the persona, returns only its final result, and never enters History. By default the child starts fresh (so the task must be self-contained); with `inherit: true` it is seeded with this conversation's **finished** turns — not the current one, so a delegation made mid-turn still needs the full story.
+- **On/off and catalog**: a disabled persona is neither injected nor visible to the model (file untouched); new / imported / restored personas start **disabled**. The catalog lists names and descriptions only, so the model knows what it can delegate to; personas are renameable and scene bindings follow.
+- **Catalog injection depth (`catalogDepth`)**: default `1` = top-level sessions only; `2` also reaches subagent sessions; the UI's "No nesting limit" writes `99`. **It does not limit nesting** — how deep delegation may go is the host's decision, and this plugin never passes `maxDepth`.
+- **Tool limits per agent preset**: one allow or deny list per preset (mutually exclusive). Two behaviours worth knowing: **an allow list is merged back with every currently running `mcp__*` tool**, so ticking only `read` will not stop an MCP server that exposes a shell; and **if none of the listed names exists right now, the result is "no restriction"** (fail-open). Naming the reserved `run_code` is stripped from the list with a note, because the host would throw and the subagent would never start.
+- **Reasoning effort** sits next to *model* in the advanced options, and the available levels are declared by the selected model. After a model change, a level no longer offered is cleared and you are told. Leaving it empty while a model is set falls back to that model's own default — not the main session's level.
 
 ### MCP servers
 
-- **CRUD + immediate effect**: writes to `cordis.patch.yml`, HMR picks it up.
-- **Per-tool switches**: disable individual tools (invisible to the model, blocked at call), whole-server batch.
-- **Stopped servers still show their tools**: a server that is not running keeps the tool names and descriptions last seen (marked "as of last run"); one that has never run can be probed with "start server to read tools".
-- **Secret masking**: a credential is replaced **as a whole** by `••••••`, and only for keys that look sensitive (token / secret / password / auth / api key and friends); `$VAR` and `!!js` are indirections, so they stay readable, and a URL's query string becomes `?<redacted>`. "Reveal" needs a token.
-- **A masked value is never written back into the patch file**: the edit dialog prefills secret fields with the masked text, so on save the plugin restores the value found in the patch file (= that field was left alone). When there is no original value, or the stored one is itself masked (meaning the real value was destroyed earlier), the key is skipped and the panel says so — in the latter case you have to fill it in again. Secrets already stored as a mask are reported as soon as you open the page. **A URL gets the same protection in a different shape**: its query string is masked as `?<redacted>` and is likewise restored from the stored value on save; when the patch holds nothing to restore, **the whole save is refused** with a prompt to retype the full URL — dropping the query silently would leave an address that connects but fails authentication, which is harder to notice than an error.
-- **Migrate & back up**: cross-project/global migration rolls back on failure; JSON export/import.
-- **Status & notes enter the system prompt**: currently usable servers are listed; **one that has connected before but cannot right now is also listed and labelled** (`（当前未连上；上次连上时 N 个工具）`) — so the model says "it is not connected, check it" instead of reading "configured but unreachable" as "not configured here" and suggesting you install one. Servers that have never connected are omitted. Your notes travel along as decision hints; levels are "global / app", new servers default to global. Note: a persona-complete preset such as minimal suppresses that section — there the model reads server names, enablement, tool counts and notes with `mcp_manager_list`.
+- **CRUD with immediate effect**: written into `cordis.patch.yml`, backed up before every change. Levels are global / project, and new servers default to global.
+- **Per-tool switches**: disable individual tools (invisible to the model and blocked at call); whole servers support bulk.
+- **Stopped servers still show their tools**: one that is not running keeps the names and descriptions last seen (marked "as of last run"); one that never ran can be probed with "start server to read tools".
+- **Status and notes enter the context**: currently usable servers are listed, and **one that connected before but cannot right now is listed and labelled too** — so the model says "it is not connected, check it" instead of reading "configured but unreachable" as "not configured" and suggesting you install one. Servers that never connected are omitted; your notes travel along as decision hints.
+- **Secret masking**: a credential is replaced **as a whole** by `••••••`, and only for keys that look sensitive; `$VAR` and `!!js` are indirections and stay readable, and a URL's query string becomes `?<redacted>`. "Reveal" needs a token. A masked value is never written back into the patch file — on save the plugin restores the stored value for any field you left alone, and refuses the whole save when a URL has nothing to restore from (a silently stripped query string would leave an address that connects but fails authentication).
+- **Migrate & back up**: cross-level migration rolls back on failure; JSON export/import.
 
 ### Skills
 
-- **Sources at a glance**: project / DSH / Agents / Codex / Claude / custom dirs, grouped by source.
-- **Opposite permissions**: default sources must be read but skills can be deleted; external dirs can be disabled/removed but skills are read-only.
-- **Remove ≠ disable**: remove = directory not scanned at all (files untouched, restorable); disable = still listed but not callable.
-- **Same-name skills: see which copy is in effect**: the winning copy is marked "preferred", shadowed ones name the source that wins, and enabling a shadowed copy says so instead of pretending it worked.
-- **Custom dirs / ZIP import & export / recycle bin**.
-- **Directories can be injected**: when a preset mounts no official skills-directory line (e.g. Minimal), this plugin's injection domain delivers them as a fallback, governed by the switches on the Host page (name + blurb; the body is still read from disk).
+- **Sources at a glance**: project / DSH / Agents / Codex / Claude / custom directories, grouped by source.
+- **Opposite permissions**: default sources are readable and their skills deletable; external directories can be disabled or removed but their files stay read-only.
+- **Remove ≠ disable**: removing stops scanning the directory at all (nothing is written, restorable); disabling keeps it listed but uncallable.
+- **Who wins a shared name**: the winning copy is marked "preferred", shadowed ones name the source that wins, and enabling a shadowed copy says plainly that it will not take effect.
+- **Custom directories / ZIP import & export / recycle bin.**
 
 ### Prompt presets
 
-- Multiple `~/.dsh/AGENTS.md` baselines, one-click apply (the host re-reads that file every turn, so it takes effect on the next turn), 5-gen backup.
-- **Remembers the preset applied last**: even after you hand-edit `AGENTS.md`, the model can still answer "which preset is this from" (flagged "changed since").
-- **Description**: one line saying what a preset is for — shown in this panel only. It lives in a sibling `meta.json`, never in AGENTS.md, so it is never injected into prompts.
-- Create with body inline, edit can change id (= dir rename, scene bindings follow). A referenced preset cannot be deleted (scene binding / current contents of `AGENTS.md` / the one to restore when leaving the scene); deletes go to the recycle bin.
-- **The body can be injected**: when a preset mounts no official AGENTS.md line (e.g. Minimal), this plugin's injection domain delivers the body of `~/.dsh/AGENTS.md` as a fallback (64 KiB cap; can be turned off on the Host page).
-- **While a scene drives the baseline, Apply rebinds the scene to that preset** (bound by a scene, currently in AGENTS.md, or the baseline to restore on scene exit); deletes go to recycle bin.
-- **While a scene drives the baseline, Apply rebinds the scene to that preset** (written into the scene profile, and the binding realigns immediately; allowed while unlocked — v0.9 reversed the old "other presets are refused" behavior); **only locking refuses**. The global baseline is restored from the snapshot on scene exit.
+- Multiple `~/.dsh/AGENTS.md` baselines, applied with one click (the host re-reads that file each turn, so it lands next turn), with 5 generations of backups.
+- **It remembers the last applied preset**: even after you hand-edit `AGENTS.md`, the origin is still reported (flagged "the file changed since").
+- Each preset can carry a one-line description that lives in a sibling `meta.json` — shown in this panel, never injected.
+- **A referenced preset cannot be deleted** (scene binding / current `AGENTS.md` content / the copy to restore on scene exit); deletes go to the recycle bin.
+- **While a scene drives the baseline, Apply rebinds that scene** to the chosen preset (written into the scene profile, realigned immediately); it is refused only while the scene is locked. The global baseline is restored from the snapshot on exit.
 
 ### Archived sessions
 
-- Grouped by project, search, batch restore / delete, retention auto-cleanup.
-- Workspace registration deleted → group rebuilt from session dirs, one-click re-register.
-- Import Claude Code / Cursor / Codex / any text; export Markdown / JSONL. **An export is a readable transcript, not a full backup**: only user/assistant text blocks survive — tool calls, images, reasoning and token stats are dropped, and a `## User` line inside a Markdown body will be read as a turn boundary on re-import (the exporter does not escape it). Use archiving if you need the full record.
+- Grouped by project, searchable, batch restore / delete, retention auto-cleanup; a workspace whose registration was deleted is rebuilt from the session directories and can be re-registered in one click.
+- Import Claude Code / Cursor / Codex / any text; export Markdown / JSONL. **An export is a readable transcript, not a full backup**: only user/assistant text blocks survive — tool calls, images, reasoning and token stats are dropped. Use archiving when you need the full record.
 
 ### Host compatibility
 
-The plugin uses the host's own `@deepseek-ai/*` libraries at runtime — they must be the same physical modules, or every "adapt to host" decision degrades into guesswork.
+The plugin uses the host's own `@deepseek-ai/*` libraries at runtime — they must be the same physical modules, or every "adapt to the host" decision degrades into guesswork.
 
-- **Host tab**: host version, usable capability count, per-action routing (native/adapter/unavailable), degradations & reasons. The check-up itself is read-only, but the page has two explicit write entries: **access token** (writes the profile's `cordis.patch.yml`, takes effect after restart) and **injection settings** (writes `inject-settings.json`, takes effect immediately).
-- **Command line**: `node scripts/doctor.mjs` (check), `node scripts/host-deps.mjs --fix` (align deps), `npm run sync:profile` (mirror the build into the profile's local install — a `file:` install is a hard-linked copy, so files ADDED by a build never show up there on their own).
-- Under a **suppressing preset** such as `minimal` (persona `complete` / runtime context off) this plugin's injection is **off by default** (following the preset's intent), and the prompt and the skills are missing because their official rows are not mounted — the Host tab marks this per column, and its "Injection" block can force any domain back on.
-- **Unchecking "Skills" or "Prompt" really stops them**: under standard presets the host delivers those two itself (the plugin steps aside), so unchecking now also stops the host's copy — the `skill-catalog` / `agent-instructions` messages are no longer let through on that step. The other three domains (memory / MCP / subagents) are only ever sent by this plugin, so their toggles were already complete.
-- **What an injection looks like**: one `<system-reminder>` per domain — a `##` title, a **bold one-line action** (the decision point at which to recall it), the tool name / trigger, then the body; any `</system-reminder>` inside the body is escaped (your own text cannot close the frame early). Each message ends with "this copy replaces the earlier one in this session" — injections are only re-sent when the content changes, so the older copy is still in context and the model must know which to trust. The wording follows Claude Code's and Codex CLI's official injections item by item.
+- **Host tab**: host version, usable capability count, per-action routing (native / adapter / unavailable), degradations and reasons. The page has three write entries: **access token** (needs a restart), **injection settings**, **model tool table**.
+- **Command line**: `node scripts/doctor.mjs` (health check), `node scripts/host-deps.mjs --fix` (align dependencies), `npm run sync:profile` (mirror the build into the profile's local install — a `file:` install is a hard-linked copy, so files a build *adds* never show up there on their own).
+- Under a **suppressing preset** such as `minimal`, this plugin's injection is **off by default** (following the preset's intent) and the prompt and skills are absent because their official rows are not mounted — the Host tab marks this per column, and its Injection block can force any domain back on.
+- **Unchecking "Skills" or "Prompt" really stops them** — under standard presets the host delivers those two itself, so unchecking also stops the host's copy. The other three domains are only ever sent by this plugin, so their toggles work as written.
+- **What an injection looks like**: one `<system-reminder>` per domain — a `#` section title, then the body (MCP and subagents add one line each). The frame carries **only what is now**: no "when to recall me" instructions, no explanation of the other sections. Any `</system-reminder>` inside your content is escaped, and each message closes with "this copy replaces earlier copies of the same kind in this session" — injections are re-sent only when the content changes, so the model must be told which copy to trust.
 
 ---
 
 ## Where data lives
 
-| Content                                                               | Location                                                                                         |
-| --------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
-| MCP definitions                                                       | `~/.dsh/cordis.patch.yml` (written by the plugin; pre-write copies land in the hub's `backups/`) |
-| Skill policy / custom dirs                                            | `~/.dsh/tool-management/skills-state.json`                                                       |
-| Skills / memories / personas / presets                                | `~/.dsh/tool-management/{skills,memories,subagents,prompts}/`                                    |
-| Subagent toggles                                                      | `~/.dsh/tool-management/subagents-index.json`                                                    |
-| Recycle bin (skills/personas/presets/scenes)                          | `~/.dsh/tool-management/trash/{skills,subagents,prompts,scenes}-trash/`                          |
-| Memory recycle bin                                                    | `~/.dsh/tool-management/memories-trash/` (**a directory at the hub root, not under `trash/`**)   |
-| Archive ledger / retention                                            | `~/.dsh/tool-management/history-*.json`                                                          |
-| Memory index / scenes / profiles                                      | `~/.dsh/tool-management/memories-index.json`                                                     |
-| MCP sidecars (disabled tools / known tools / notes / settings)        | `~/.dsh/tool-management/mcp-*.json`                                                              |
-| Injection settings (five domain switches / suppressing-preset policy) | `~/.dsh/tool-management/inject-settings.json`                                                    |
-| Runtime log / patch backups                                           | `~/.dsh/tool-management/tool-management.log` · `backups/`                                        |
+| Content                                                        | Location                                                                                         |
+| -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
+| MCP definitions                                                | `~/.dsh/cordis.patch.yml` (written by the plugin; pre-write copies land in the hub's `backups/`) |
+| Skill policy / custom dirs                                     | `~/.dsh/tool-management/skills-state.json`                                                       |
+| Skills / memories / personas / presets                         | `~/.dsh/tool-management/{skills,memories,subagents,prompts}/`                                    |
+| Subagent toggles                                               | `~/.dsh/tool-management/subagents-index.json`                                                    |
+| Recycle bin (skills / personas / presets / scenes)             | `~/.dsh/tool-management/trash/{skills,subagents,prompts,scenes}-trash/`                          |
+| Memory recycle bin                                             | `~/.dsh/tool-management/memories-trash/` (a directory at the hub root, not under `trash/`)       |
+| Archive ledger / retention                                     | `~/.dsh/tool-management/history-*.json`                                                          |
+| Memory index / scenes / profiles                               | `~/.dsh/tool-management/memories-index.json`                                                     |
+| MCP sidecars (disabled tools / known tools / notes / settings) | `~/.dsh/tool-management/mcp-*.json`                                                              |
+| Injection settings (six domain switches)                       | `~/.dsh/tool-management/inject-settings.json`                                                    |
+| Model tool table (switched-off tools + saved sets)             | `~/.dsh/tool-management/tool-table.json`                                                         |
+| Scene page preference (preview card before entering a scene)   | `~/.dsh/tool-management/scene-settings.json`                                                     |
+| Runtime log / patch backups                                    | `~/.dsh/tool-management/tool-management.log` · `backups/`                                        |
+
+**No user data is stored inside the plugin's install directory** (`dsh plugin update` replaces it wholesale). `backups/` keeps **5 copies per patch file** — the global patch and each profile patch count separately — so one bulk action can consume all five slots of a layer.
 
-**No user data is stored inside the plugin's install directory** (`dsh plugin update` replaces it wholesale).
+## Configuration & security
 
-**`backups/` keeps 5 copies per patch file**: backup names carry a layer tag (`.global` / `.profile-<name>`), so the global patch and each profile patch keep 5 each — not 5 in total. A single bulk action (e.g. `mcpm-set-all`, or the several writes of entering a scene) can consume all 5 slots of one layer and push out earlier versions.
+| Field           | What it does                                                                                                                                                                                                                                                    |
+| --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `token`         | Access token. Once set, **every write and every plaintext credential** requires `x-dsh-token`; with no token the plaintext endpoints are closed entirely. Prefer not to keep it in the config? Use the `DSH_PLUGIN_TOOL_MANAGEMENT_TOKEN` environment variable. |
+| `tokenDisabled` | `true` = the token stays in the config but is not enforced (this is the line written by "Turn protection off"). Writes no longer need it; revealing plaintext still does. Turning it back on needs no retype.                                                   |
+| `maxBodyBytes`  | Request body cap, 88 MiB by default.                                                                                                                                                                                                                            |
 
-## Configuration & security
+**Plaintext on disk (read this)**: masking is **display-only**. MCP `env` / `headers` and the plugin's own `token` stay in cleartext inside `~/.dsh/cordis.patch.yml` (and each profile copy), and every config change copies the **whole file** into `~/.dsh/tool-management/backups/` — unencrypted, never rotated, not even reclaimed on uninstall. One secret can therefore exist as `5 × (patch files holding it) + 1` plaintext copies. The token gate decides *who may read plaintext over HTTP*; it does nothing about *reading the files*, where the only real defence is your filesystem permissions. **To clean up: Settings → Tools → Host → "Clean old backups"** — pick how many to delete per layer and confirm once more in the dialog; only backup files are touched. You can also delete them by hand.
 
-| Field           | Description                                                                                                                                                                                                                                                                                                                                                                          |
-| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `token`         | Access token. When set, **all writes + plaintext secrets** require `x-dsh-token`; **unset = plaintext endpoints closed**. Also the escape hatch for curl / LAN. If you would rather not keep the token in the config file, set the `DSH_PLUGIN_TOOL_MANAGEMENT_TOKEN` environment variable instead (when both are present `config.token` wins; `tokenDisabled: true` disables both). |
-| `tokenDisabled` | `true` = the token **stays in the config** but is not in effect (this is the line written by "Turn protection off"). Writes no longer require a token; plain-text reveal still does (the plain text *is* the credential). Switch it back on any time with "Turn protection on" — no need to retype it.                                                                                 |
-| `maxBodyBytes`  | Request body cap, default 88 MiB.                                                                                                                                                                                                                                                                                                                                                    |
-
-- **Browser**: reads/writes via cookie, no token needed; but **plaintext secrets** (Reveal / export) need a token. **The token is managed under Tools → Compatibility → Access token** — a fixed entry point independent of the page. That block is one status pill + one plain sentence + three rows: the row label names the scope, the button names the verb, and the pill only answers "is protection on, is this run unlocked".
-  - **This run**: fill once, valid until DSH exits (stored in this browser only). Once accepted, the row turns into a green **Unlocked** chip plus Clear, right where the input was (it used to collapse to a lone Clear button, which read as "what I just typed is gone"); only then does the host accept this token and the two rows below become usable. The row is not shown at all while the host has no token (there is nothing to check it against).
-  - **Host config**: written into the profile's `cordis.patch.yml` (only those two lines change — comments and the `!!js` guard stay intact, and the previous file is backed up first); takes effect after a DSH restart. With no host token this row's button is the primary one ("Set token") and asks for the new token **twice** (a typo here means even you cannot match it). Once one is set, "Change token" opens a form with an extra **current token** field — changing it requires proving you know the current one, and being unlocked does **not** count (same rule as turning protection off): you must retype it in the form. The cursor lands in that field when the form opens; the three fields are **stacked** with Save/Clear below them (while the form is open it is the only row shown, and Enter submits), "Save new token" stays disabled until all three are filled, and a rejected token marks that field red.
-  - **Protection switch**: clicking "Turn protection off" opens an in-place confirm box (the only row shown while it is open — same rule as "Change token") that asks you to **type the current token again** (yes, even while unlocked — the already-verified credential in the request header does *not* count for turning protection off; otherwise one click right after unlocking would drop the guard). On confirm it only writes `tokenDisabled: true`, so **the token itself stays in the config** and "Turn protection on" brings it back without retyping. While off, writes no longer require a token; **plain-text reveal still requires it** (the plain text *is* the credential). Turning it on keeps the old rule: being unlocked, or having the token in the input box, is enough — otherwise anyone who can open the GUI could switch the protection off.
-  - **Delete token** (same row as "Change token"): removes both the `token` and `tokenDisabled` lines from the config, going back to the **never-set-up** state — writes need no token and plain-text secrets become unreadable again. It also opens an in-place confirm box asking for the current token, and the result honestly notes that "old backups still hold plaintext copies" (each backup is a full copy of the config; use "Clean old backups" in the page header to clear those too). Use the protection switch instead when you only want the gate off for now and want to keep the token.
-  - **Status pill**: No token yet / Protection off / Protection on · locked / Protection on · unlocked. When the config has been changed but DSH has not restarted, an amber banner below says so (the pill reflects the running process).
-- **No "fill in the token" notice while the token is not in effect**: that notice stays only while something is actually gated (a token is in effect on the host). With the token off or unset it is dropped, and the panel's status pill tells you what is going on instead.
-- **Where the notice appears**: the "missing or wrong access token" sentence (with its "Fill in token" button) exists **exactly once** — inside the dialog while one is open (that is what blocks your action, so it belongs in plain sight), just below the tabs otherwise. It does not depend on which page you are on or how that page renders errors, so no entry point (dialog submits, imports, exports, bulk actions) can lose it.
+- **Browser**: reads and writes go through cookies, no token needed; **plaintext credentials** (reveal / export) do. The token is managed in the **Access token** block on the Host tab — filling it once unlocks the current run, writing it into the config needs a restart.
+- **Every destructive direction asks for the current token again** (turn protection off / change / delete). Being unlocked this run does not count — otherwise anyone who can open the GUI could drop the guard.
 - **curl / scripts**: send `x-dsh-token`, or carry the browser cookie.
-- **HTTP status convention**: except for the fence's 401/403, a missing token or a business failure is **HTTP 200 + `{ ok: false, error }`** — branch on `body.ok`, not on the status code.
-- **The fence's degraded mode**: when the host has no `connection` service, the fence falls back to "loopback Host + same-origin" (there is no browser cookie to check), so any local process can call write ops by faking `Host: localhost`. If you forward the port to a LAN or the public internet, **configure a token** — it is the last door on that degraded path.
-- **`dir-list`'s exposure**: the "pick a folder" dialog walks directories through it, so any caller past the fence/token can list directories at **any absolute path** (read-only). That is by design, not a hole — but do not expose the port to an untrusted network.
-- **Plaintext on disk (read this)**: masking is a **display-only** measure. MCP `env` / `headers` and the plugin's own `config.token` stay in cleartext inside `~/.dsh/cordis.patch.yml` (and its per-profile copy), and every config change copies the **whole file** into `~/.dsh/tool-management/backups/` (5 copies kept **per patch file**, unencrypted, never rotated, never reclaimed on uninstall) — one secret can end up as `5 × (patch files holding it) + 1` plaintext copies. The token gate decides *who may read plaintext over HTTP*; it does nothing about *reading the files*. Any local process with read access to that directory can take every credential at once. **To clean up: Settings → Tools → Compatibility → "Clean old backups"** (next to Refresh — the button itself shows the current count) — pick how many to delete **per layer** (N deletes that layer's N oldest; the tiers run up to that layer's current count, default 2) — each layer has its own group, so any total is reachable, odd ones included; each row states what would be left, and the dialog asks you to confirm once more, stating the total number of files in that confirmation. Only backup files are touched, never the live config. You can also delete old files under `~/.dsh/tool-management/backups/` by hand.
-- **Port forwarded to public**: configure a token — prevents strangers injecting MCP commands (≈ remote code execution) and stealing secrets.
+- **HTTP status convention**: except for the fence's 401 / 403, a missing token or a business failure is **HTTP 200 + `{ ok: false, error }`** — branch on `body.ok`, not on the status code.
+- **Port forwarding**: when the host has no `connection` service the fence falls back to "loopback Host + same origin", which any local process can imitate with `Host: localhost`. If you forward the port to a LAN or the public internet, **configure a token** — a stranger injecting MCP commands is remote code execution. The `dir-list` call behind the folder picker lists any absolute path (read-only) under the same precondition.
 
 ## FAQ
 
-| Symptom                                                           | Fix                                                                                                                                                                                                                                                                                            |
-| ----------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Pages missing after install                                       | Hard refresh; restart DSH if that fails.                                                                                                                                                                                                                                                       |
-| Duplicate MCP tabs                                                | Remove the stale loader row from `cordis.patch.yml`, restart.                                                                                                                                                                                                                                  |
-| Broken config, DSH won't boot                                     | Restore the newest `.bak-<timestamp>`.                                                                                                                                                                                                                                                         |
-| Action stopped after DSH upgrade                                  | Settings → Tools → **Host** for the reason; `doctor.mjs` → `host-deps.mjs --fix`.                                                                                                                                                                                                              |
-| Still asked to confirm in `approval=never`?                       | No card appears — straight through with a log line; switch back to "workspace write" to get asked again.                                                                                                                                                                                       |
-| `subagent_manager_run` reports provider unavailable               | The provider isn't registered: `spawn` (default) / `fork` (`inherit`) come from `@deepseek-ai/dsh-subagent-spawn-in-process` / `-fork-in-process` — mount and restart.                                                                                                                         |
-| Scene binds persona A, but official `subagent` ran something else | Those two are host tools and this plugin cannot hide them; it writes the boundary into the context instead (work matching a persona goes to `subagent_manager_run`; host tools only when no persona fits or a background job is needed), and `inherit` now matches fork's context inheritance. |
+| Symptom                                                               | Fix                                                                                                                                                                                                                                      |
+| --------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Pages missing after install                                           | Hard refresh; restart DSH if that fails.                                                                                                                                                                                                 |
+| Duplicate MCP tabs                                                    | Remove the stale loader row from `cordis.patch.yml`, restart.                                                                                                                                                                            |
+| Broken config, DSH won't boot                                         | Restore the newest `cordis.patch.yml.<level>.bak-<timestamp>` from `~/.dsh/tool-management/backups/` (5 per patch file).                                                                                                                 |
+| Action stopped working after a DSH upgrade                            | Settings → Tools → **Host** for the reason; `doctor.mjs` → `host-deps.mjs --fix`.                                                                                                                                                        |
+| The model cannot call a tool it should have                           | Check the **Model tool table** on the Host tab — 15 tools ship switched off. The panel and scripts are unaffected either way.                                                                                                            |
+| Still asked to confirm with `approval=never`?                         | No card appears — straight through with a log line. Switch back to "workspace write" to get the questions again.                                                                                                                         |
+| `subagent_manager_run` reports provider unavailable                   | The provider is not registered: `spawn` (default) / `fork` (`inherit`) come from `@deepseek-ai/dsh-subagent-spawn-in-process` / `-fork-in-process` — mount and restart.                                                                  |
+| Scene binds persona A, but the official `subagent` ran something else | Those two are host tools and this plugin cannot hide them; it writes the boundary into the context instead — work matching a persona goes to `subagent_manager_run`, host tools only when no persona fits or a background job is needed. |
 
 ---
 
@@ -215,14 +194,14 @@ The plugin uses the host's own `@deepseek-ai/*` libraries at runtime — they mu
 ```bash
 npm install
 npm run build        # tsc + sync client
-npm test             # build + i18n + contract tests (pure-function invariants & host contracts; UI tests removed 2026-09-19)
+npm test             # build + i18n + contract tests (pure-function invariants & host contracts)
 npm run check:i18n   # dictionary self-check
 npm run doctor       # host compatibility check
 ```
 
 `lib/` is not tracked — run `npm run build` after cloning. Changes need `dsh web` restarted. Runtime deps: `fflate` (export bundling) and `js-yaml` (parse check before writing host patches, loaded lazily); `@deepseek-ai/*` all come from the host.
 
-> **Deployment note**: the profile mirror produced by `npm run build` does **not** include `node_modules`, so a runtime dependency added locally (e.g. `js-yaml`) must either be installed on the profile side or accepted as "patch-write check skipped and reported" — the missing checker only disables that one safety net, it never blocks writes. Regular `npm install` deployments are unaffected (dependencies are installed with the package).
+> **Deployment note**: the profile mirror produced by `npm run build` does **not** include `node_modules`, so a runtime dependency added locally (e.g. `js-yaml`) must either be installed on the profile side or accepted as "patch-write check skipped and reported" — the missing checker only disables that one safety net and never blocks writes. Regular `npm install` deployments are unaffected.
 
 ## License
 

package/docs/update.md

@@ -4,6 +4,8 @@
 
 | 版本                         | 发布       | 主题                                                                                                                                                                      |
 | ---------------------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [0.14.0](#0140---2026-09-23) | 2026-09-23 | 场景与记忆分家（共 20 条工具）+ 模型能进入 / 退出场景 + 场景档案对模型可见、改档案会报出被挤掉的项 + 注入只写"现在是什么"（省 21.9%）+ 十五条工具出厂默认关（每轮实发 5 条 ≈1,090）+ 工具表可存方案一键换回 + 人设思考强度 + 改 MCP 配置不碰明文凭据 + 提示词「生效中」修好 |
+| [0.13.0](#0130---2026-09-23) | 2026-09-23 | 模型多五个管理工具 + 所有写操作都要用户点头 + 工具表可关（省 token）+ 进场景前先看一眼会改什么 + 悬空引用体检 + 注入实况改为只数当前这段对话 + 技能正文一步读到 + 记忆页显示体积 + 门禁清单合成登记表 + 自定义目录的技能修好 
 | [0.12.1](#0121---2026-09-22) | 2026-09-22 | 子智能体列表行：人设名与描述分行 + 客户端类型检查进门禁 + 四个注入上限抬高 |
 | [0.12.0](#0120---2026-09-20) | 2026-09-20 | 兼容页「功能总览」+ 停用工具真的从模型工具表消失 + 补丁写入前做解析校验（拦"写坏 DSH"）+ doctor 三项新检查（挂载心跳 / 裸模块名 / 版本栅栏）+ 删除入口先不切换 + 投影缓存屏障与删除前置检查加固 + 关域拦截顺序钉死 |
 | [0.11.0](#0110---2026-09-20) | 2026-09-20 | 访问令牌卡片重构（可设置 / 关闭 / 修改 / 删除）+ 没解锁时锁住输入框 + 令牌安全修复 + 批量启停可撤销 + 兼容页清理旧备份 + 两页可搜索 + 体检改为真调 + 一批凭据与数据损坏修复 + 搜索与列表提速   |
@@ -20,6 +22,67 @@
 
 ---
 
+## 0.14.0 - 2026-09-23
+
+- **场景和记忆分家了**：工具上是两族（记忆 4 条、场景 3 条 —— `_list` 查、`_switch` 进入 / 退出、`_save` 建与改），注入上是两段（「场景」讲当前启用的是哪个、它是什么；「记忆」讲各场景下的条目）。好处有两个：能**单独关掉记忆段**而保留场景说明；模型终于能查场景、配场景、进 / 退场景。注意写档案**不会**让场景生效 —— 生效要进入它。
+
+- **模型能进入 / 退出场景**（`scene_manager_switch`）：以前它看得到场景、却只能说一句"请你到界面上点"。现在你说"切到写作场景"，它就能按该场景的档案把 MCP / 技能 / 人设整套拨到位、注入收窄成这个场景的记忆、把绑定的提示词写进 `AGENTS.md`；退出按进场景前的快照还原。它改的是整个运行时环境（和你在界面上点那一下同一条路径），所以**默认要你确认**。
+
+- **改场景档案之前，模型能先看到现在勾了什么**：`scene_manager_list` 列出每个场景的档案、绑的预设、锁没锁、几条记忆。保存是**整段替换**，以前它想"再加一台服务器"就会把你原来勾的**静默挤掉**、回执还写着成功；现在回执会列出被挤掉的项（`mcp 4 项 → 2 项（-B、-C）`）。
+
+- **注入的套话全削了，只留"现在是什么"**：把四次实际注入摊开量过 —— 四个板块 823 token/轮，**真正的内容只占 46%**，其余是"我是谁、什么时候看我、以我为准"。于是六个板块开头那句加粗的"什么时候该想起我"全删（它们是指令，不是当前情况）、机制解释删、四种措辞的权威声明并成一句。现在 **643 token/轮（省 180，−21.9%）**。层级也理清：板块 `#` / 场景 `##` / 条目 `-`，一眼看得出主次。
+
+- **工具改名并合并：还是 20 条，但每族只管一件事**。五个「新建」并成 `_save`（有则改、无则建），六个域的开关统一叫 `_switch`，场景自成一族。**旧名不留别名**（别名要常驻每轮请求）。你以前"关掉了某条工具"的设置会自动搬到新名字上，包括存下的方案。
+
+- **十五条工具出厂就是关着的**：每轮真正发出去的只剩 **5 条 ≈1,090** token（整表 ≈3,769）。关的是三个「保存」、提示词两条、三个目录查询、`memory_manager_read`、场景三条与三个启停开关 —— 判据是**这些信息或动作常态下由注入段和面板承担**，平时用不到模型自己伸手。**`mcp_manager_switch` 留着**（"这台先给我关了"最常用）。代价摆明：注入的目录只列当前可用的，所以"没开的服务器 / 被同名覆盖的技能 / 没进上下文的记忆正文"在会话里查不到，模型也不再替你拨那三个启停。这条默认**只在你从没动过那一页时生效**，存过的选择不会被更新盖掉；「兼容」页可逐条打开。
+
+- **工具表的开关能成批存下来、一键换回**：「模型工具表」合计行右侧多了**「保存方案」/「恢复方案」**。存的时候起个名字，以后点一下就整套换回，不用挨个点二十个框。**名字不能重复**（保存永不覆盖已有那份）。清单第一条永远是**出厂默认**，它不写在文件里、也就删不掉；自己存的方案可以在同一个弹窗里删。每行都写着"开着几条 · 一轮大约多少 token"。
+
+- **MCP 与技能补了几处模型侧能力**：改一台已配置的服务器（只改 URL 就只给 URL，其余字段与密钥原样保住）、只停某个工具、顺手写备注；技能能整目录启停、能改本插件自己写的那份。
+
+- **人设多了「思考强度」**：在高级选项里与「模型」并排。档位是模型自己声明的，所以换模型要重新选；选了新模型之后旧档位若不在新清单里，会**自动清掉并告诉你**（留着下一次委派会被直接拒）。**指定了模型时留空不会沿用主会话那一档**，而是回落到该模型自己的默认。
+
+- **提示词页的「生效中」修好了**：场景接管时，模型拿到的清单以前报"文件里是它"、界面报"场景绑的那份"，同一件事两个答案。现在两边同源，清单里还会标出"文件里是它、但基线由场景驱动"这种真实状态。
+
+- **几处显示毛病**：记忆正文改成代码块包住（正文里手写的 `#` 以前会渲染成大标题、盖过场景分组）；子智能体高级选项折叠后的摘要固定排两行（不再把「高级选项」挤成竖排）；提示词预设的描述框补上字数上限。
+
+- **给模型的话对齐了事实，指的路都能走通**：应用提示词的回执以前说"下个会话生效"，实际**下一轮就生效**（模型会白劝你重开会话）；场景保存的参数说明还引用着已被删掉的"注入后模型会照办"那句，改成了如实说明去向；工具描述与回执不再点名出厂默认关掉的工具（改用中性说法，或按开关在不在分叉——只在你真开了那条工具时才点名它）；两条清单工具的描述也对齐了各自真实给的东西。新增一条契约测试，把"描述点名被关工具"这类静默毛病挡在构建里。
+---
+
+## 0.13.0 - 2026-09-23
+
+- **模型能管的比以前多了五个**：以前它看得到一份记忆、看得到一个人设，却开关不了也改不了（技能与 MCP 那两域早就能全操作）。现在记忆的启停与修改、人设的启停与新建修改都补上了。提示词按裁定只留「应用」。
+
+- **所有会改东西的工具都写明了"要用户开口或先同意"**。以前只有两个工具有这句话，其余靠确认门兜 —— 而那个门是可以关掉的（设置里关掉记忆确认，或会话走「完全权限」预设）。顺带把工具说明删瘦了一圈：这些文字每次请求都要发给模型，八个改过的存量工具加起来从 2,047 → 1,980 字节，**加了上面那句还净降 67**。
+
+- **点「进入场景」会先弹一张卡**：说清这次会启用/停用哪几台 MCP 服务器、哪几个工具、哪几个技能目录与技能、哪几个人设，以及记忆范围收窄到哪一场景；末尾再补两行"进入后是什么样"——**启用 N 台 MCP**、**启用 N 条记忆**（含公共基线与全局）。不想看这张卡就点「不再显示」（场景页右上角有「关闭提醒 / 开启提醒」可以随时改回来）；卡上只有「确认进入」与「不再显示」两颗按钮，关掉卡片用右上角的「关闭」。只有**真的会变**的才列：没在跑的服务器不会被写成「停用 N 个工具」，技能也只显示名字（不再带 `custom-…` 那串机器名）。
+
+- **改名留下的"悬空引用"有地方说了**：档案里存的是服务器名、技能名、人设名，场景记录里存的是预设 id。你把「代码审查」改名「复核员」，档案里那行还是旧名 —— 界面看着还绑着，委派时按新名找不到。现在场景页顶部会有一条黄横幅说清"哪一条指向谁、那个谁不在了"。只数出来、不自动改。
+
+- **读技能正文少了一步**：新工具按名字一次给到正文和路径，而且按与目录同一套规则挑副本 —— 同名几份时读到的就是真正生效的那一份，不会读到被覆盖的影子。
+
+- **工具说明可以关掉不发**：工具表每一轮请求都随工具发一遍，20 个工具的说明合计约 3,500 token，这一轮用不上也照付。兼容页新增「模型工具表」，逐个勾选（也能按域全关），关掉的**整份不进请求**——这是唯一真省钱的办法，默认一个都不关。关掉之后模型调不到它，**但插件面板一切照旧**（关掉 `mcp_manager_add` 之后 MCP 页照样能加服务器）。
+
+- **有一个工具会自动让位**：技能那条「按名字读正文」在会话里已经有官方 `skill` 工具时不再下发——两份干的是同一件事。极简模式没有官方那件，我们的照旧留着。只影响那个会话的工具表，能力不减（管理视角的"读一个被关掉的技能"在面板里做）。
+
+- **注入实况那三个数改成只数「最近这一段对话」**：以前是开机以来一路累加，用一下午之后「注入 8 次 · 从未调用」讲的是"今天这台机器"，而你打开面板问的是"眼前这段里模型用没用"。现在每段对话各记一本账，换一段重新数。
+
+- **记忆页每行显示正文体积**：记忆是唯一直接进上下文、直接吃预算的那一域（每个场景段 128 KiB），以前看不出哪条大。
+
+- **场景描述能写到 300 字了**（原来 60），输入框下面那句提示删掉了 —— 卡片上那行本来就用省略号截，60 卡的是"能存多少"，给的理由说的却是"显示多少"。四个注入上限也重新校准：记忆段 256 → 128 KiB；技能 / 子智能体 / MCP 三条目录都收到 50；MCP 备注 200 → 300 字。
+
+- **界面补了四处小东西**：新增 MCP 服务器的弹窗能顺手写备注了；MCP 备注、人设描述、技能描述、记忆描述五处输入加了「当前 / 总字数」（分母就是模型实际能读到的长度）；场景页加了搜索框；`/` 聚焦搜索框、Esc 清空它（只挂在插件自己那块 UI 上，不抢宿主的快捷键）。
+
+- **门禁那几份清单合成了一张登记表**：哪些 op 要令牌、哪些在场景锁定时不许动、哪些改完要同步进场景档案……原来是五份各自抄写的名字清单，加一个新 op 得记得挨个补，这事已经漏过四次（后果不是报错，是"没配令牌也能改"或者"锁定的场景还能改"）。现在每个 op 只登记一次，那五份清单都从它生成，派生结果与改之前**逐条相同**。启动时还会反查一遍登记表，有 op 没登记、有登记留着但 op 早改名了，都在兼容页挂提示。
+
+- **自定义技能目录里的技能能调动了**：以前列表里看得到、也标着"已启用"，模型一调却报"没有这个技能"。原因是两处用了不同的来源清单 —— 取正文时只查那五个固定目录，你添加的自定义目录永远落空。
+
+- **「采纳」这个数改准了**：以前你把某个域关掉之后模型去调它的工具，照样记一次采纳 —— 因为「××已清空」那条通知也带着域标记，被当成了"正文在眼前"，第三列其实是第二列的复印件。现在通知不算正文了，「调用 − 采纳」才有得读。
+
+- **README 里有一处说错了，已改**：原文说子智能体那两个工具"依赖宿主挂载 provider 包，缺席时不注册、界面也不提示"。实际是注册不受影响，要到**调用的那一刻**才报"子代理服务未挂载"；而真的注册失败时，界面上**是**有提示的。
+
+---
+
 ## 0.12.1 - 2026-09-22
 
 - **子智能体页的列表行改了版式**：人设名与描述分成两行。以前名字和描述挤在同一横排里、右边还压着开关和两颗按钮，名字只剩两三个字符宽（显示成 `co...`）；现在名字独占一行、装不下才按省略号截断（悬停看全名）。