docs(dsh): document the environment management tab

Describe the five Environment sections, the .env and EMBEDDING_API_KEY
contracts, local service control semantics, and the optional authToken
field in both READMEs.

integrations/dsh/README.md

@@ -113,6 +113,7 @@ If an earlier upgrade already renamed `settings.yaml` to `settings.yaml.imported
 | UI meaning             | Configuration key      | Default                 | Description                                                     |
 | ---------------------- | ---------------------- | ----------------------- | --------------------------------------------------------------- |
 | Service URL            | `endpoint`             | `http://127.0.0.1:2333` | Absolute HTTP(S) URL without credentials, query, or fragment.   |
+| Auth token (optional)  | `authToken`            | empty                   | Bearer token for a self-hosted gateway; stored in clear text in the profile, trusted networks only. |
 | Guidance language      | `language`             | `en`                    | `en` or `zh`; controls guidance injected into new sessions.     |
 | Default search results | `searchLimit`          | `5`                     | Default `reme_search` result limit, from 1 to 50.               |
 | Search timeout         | `requestTimeoutMs`     | `10000`                 | Search timeout in milliseconds, from 1,000 to 120,000.          |
@@ -130,6 +131,25 @@ If an earlier upgrade already renamed `settings.yaml` to `settings.yaml.imported
 
 Deployment configuration also supports `REME_URL`, or `REME_HOST` together with `REME_PORT`. The timer-only test option `dreamIntervalMs` is intentionally excluded from user settings.
 
+## 4.1 Environment management (Environment tab)
+
+The **Environment** tab (inside **Plugins → ReMe bundle → reme-memory → Configure**) covers setup that otherwise needs a separate terminal: local Python discovery, installing ReMe, writing credentials, and starting the service. It applies to a local endpoint; a remote service URL only shows connection state.
+
+| Section | Capability |
+| ------- | ---------- |
+| Service connection | Shows the configured URL and health; manual connection test |
+| Local Python | Discovers PEP 514 registry entries, the py launcher, PATH and conda (base and named environments), labels their origin and `reme-ai` state, and stores the selection in `pythonPath` |
+| ReMe dependency | Checks `reme-ai` version, the `[core]` extras and the `reme` CLI for the selected interpreter; installs or upgrades `reme-ai[core]` with an optional package index, live log and cancel |
+| ReMe parameters | Edits the workspace `.env`; secrets stay in that file and are shown masked (last four characters). Saving requires a non-empty `EMBEDDING_API_KEY`, because ReMe 0.4.0.x aborts startup without one (`EMPTY` is a valid placeholder). Provides an LLM connectivity test |
+| Service control | Starts and stops the local ReMe service, showing PID, version and log; startup injects UTF-8 and `NO_PROXY`, sets `enable_logo=false`, and runs inside the workspace so `.env` discovery works |
+
+Notes:
+
+- `workspace_dir` is always absolute; the default workspace is `~/.reme`.
+- Services started here record their PID and launch arguments in `$DSH_HOME/reme-memory/service.json`, enabling a one-click stop. Instances started elsewhere are only observed.
+- Installing `reme-ai[core]` downloads large dependencies (about 15 minutes in our local test); the job runs in the Host and survives closing the configuration page.
+- The optional auto-start setting pulls the service up when DSH starts; it is off by default.
+
 ## 5. Memory context injection
 
 On `agent/created`, the plugin injects long-term-memory guidance as native plugin context. Expand **Context injection · reme-memory** in the message flow to inspect both the content and provenance.

integrations/dsh/README_ZH.md

@@ -118,6 +118,7 @@ dsh web --no-open --port 3090
 | 界面含义             | 配置键                 | 默认值                  | 说明                                                                       |
 | -------------------- | ---------------------- | ----------------------- | -------------------------------------------------------------------------- |
 | 服务地址             | `endpoint`             | `http://127.0.0.1:2333` | DSH 访问的绝对 HTTP(S) 地址，不支持 URL 内嵌凭据、查询参数或片段。         |
+| 服务令牌（可选）     | `authToken`            | 空                      | 自部署网关的 Bearer 令牌；明文保存在 profile 中，仅建议内网/受信环境使用。 |
 | 记忆指引语言         | `language`             | `en`                    | `en` 或 `zh`；决定新会话中注入的指引语言。                                 |
 | 默认搜索数量         | `searchLimit`          | `5`                     | `reme_search` 未传 `limit` 时的默认结果上限，范围 1–50。                   |
 | 搜索超时（毫秒）     | `requestTimeoutMs`     | `10000`                 | `search` 请求的超时，范围 1,000–120,000。                                  |
@@ -135,6 +136,25 @@ dsh web --no-open --port 3090
 
 部署层还支持 `REME_URL`，或组合使用 `REME_HOST` 与 `REME_PORT`。仅供定时器测试的 `dreamIntervalMs` 不出现在用户设置中。
 
+## 4.1 环境管理（Environment 标签）
+
+**插件 → ReMe 插件包 → reme-memory → 配置 → 环境管理** 把「安装 Python、安装 ReMe、写凭据、启动服务」收进插件本体，无需另开终端。该标签面向本机服务；服务地址指向远程时只显示连接状态。
+
+| 分区 | 能力 |
+| ---- | ---- |
+| 服务连接 | 显示当前服务地址与健康状态，可手动测试连接 |
+| 本地 Python 环境 | 自动发现 PEP 514 注册表、py 启动器、PATH 与 conda（base 及命名环境），标注来源与 `reme-ai` 安装状态；选中即写入 `pythonPath` |
+| ReMe 依赖 | 对所选解释器检测 `reme-ai` 版本、`[core]` 依赖与 `reme` CLI；可一键安装/升级 `reme-ai[core]`（可选软件源），安装日志实时可见、可取消 |
+| ReMe 参数 | 读写 workspace 的 `.env`：密钥只保存在该文件、界面仅显示末四位；保存时强制 `EMBEDDING_API_KEY` 非空（ReMe 0.4.0.x 缺少该项会启动即退出，可填占位值 `EMPTY`）；提供 LLM 连通性测试 |
+| 服务控制 | 启动/停止本机 ReMe 服务，显示 PID、版本与日志；启动时自动注入 UTF-8/`NO_PROXY`、使用 `enable_logo=false` 并以 workspace 为工作目录，使 `.env` 发现规则生效 |
+
+要点：
+
+- `workspace_dir` 始终写绝对路径；未指定时使用 `~/.reme`。
+- 由插件启动的服务会记录 PID 与启动参数（`$DSH_HOME/reme-memory/service.json`），因此可一键停止；不是由插件启动的实例只显示状态。
+- `reme-ai[core]` 首次安装需要下载较多依赖（实测约 15 分钟），安装任务在后台执行，关闭配置页不会中断。
+- 可选「随 DSH 启动时自动拉起服务」，默认关闭。
+
 ## 5. 普通对话中的 memory 上下文注入
 
 创建一个新会话后，插件监听 DSH 的 `agent/created`，把长期记忆使用规则作为一条原生 plugin context 注入。展开消息流中的 **上下文注入 · reme-memory** 可以直接检查内容与来源元数据。