自动记忆：官方 memories 对齐的提取+注入闭环（确定性 v1）

开关默认关（generate/use），设置接口 GET/PUT /users/me/auto-memory-settings，任务级覆盖 POST /tasks/{id}/auto-memory-flags，手动触发 POST /users/me/auto-memory/run，日志 GET /users/me/auto-memory-log。

提取：worker run_loop 轮次边界扫 completed 任务，闲置/时长/长度/外部上下文/配额剩余百分比五道门，脱敏后写 project 级 identity_memories，同一任务去重、同一目标 supersede 合并；只写 project 级，不跨项目泄漏。

注入：worker run_one 首轮把最新各 5 条用户/项目记忆拼进内存 prompt 副本（goal 任务同步改内存 goal），库原 prompt 不动；续跑/断点/协调员不注入，注入失败 fail-open。

v1 诚实边界：extract/consolidation 模型只存设置不调模型；MCP/web 线程内调用暂无 tasks 表标记，外部上下文门只认任务间消息与协调员子任务；无控制台 UI。

cloud/server.py

@@ -110,6 +110,8 @@ from cloud.approvals import ensure_approvals_table as _appr_ensure
 from cloud.approvals import expire_overdue as _appr_expire
 from cloud.approvals import get_approval as _appr_get
 from cloud.approvals import list_approvals as _appr_list
+from cloud.auto_memory import AutoMemoryStore
+from cloud.auto_memory import process_due_tasks as _auto_process_due
 from cloud.identity import IdentityStore
 from cloud.kb import KBStore
 from cloud.memory import MemoryStore
@@ -1895,6 +1897,15 @@ class CloudControlPlaneHandler(BaseHTTPRequestHandler):
             self._identity_user_memory_create(user_id)
         elif path == "/users/me/identity-context" and method == "GET":
             self._identity_context(user_id, query)
+        elif path == "/users/me/auto-memory-settings" and method == "GET":
+            self._auto_memory_settings_get(user_id)
+        elif path == "/users/me/auto-memory-settings" and \
+                method in ("PUT", "POST"):
+            self._auto_memory_settings_upsert(user_id)
+        elif path == "/users/me/auto-memory-log" and method == "GET":
+            self._auto_memory_log(user_id, query)
+        elif path == "/users/me/auto-memory/run" and method == "POST":
+            self._auto_memory_run(user_id)
         elif path.startswith("/users/me/memories/"):
             _mid = path[len("/users/me/memories/"):]
             if _mid and "/" not in _mid and method == "DELETE":
@@ -1943,6 +1954,9 @@ class CloudControlPlaneHandler(BaseHTTPRequestHandler):
                 self._retry_task(user_id, rest[: -len("/retry")])
             elif rest.endswith("/goal-resume") and method == "POST":
                 self._goal_resume_task(user_id, rest[: -len("/goal-resume")])
+            elif rest.endswith("/auto-memory-flags") and method == "POST":
+                self._task_auto_memory_flags(
+                    user_id, rest[: -len("/auto-memory-flags")])
             elif rest.endswith("/heartbeat") and method == "POST":
                 self._heartbeat_task(user_id, rest[: -len("/heartbeat")])
             elif rest.endswith("/followups") and method == "POST":
@@ -3268,6 +3282,116 @@ class CloudControlPlaneHandler(BaseHTTPRequestHandler):
             "project_summaries_context": summaries_context,
         })
 
+    # -- 自动记忆（官方 memories 对齐：设置 + 提取触发） ------------
+    # 设置与提取日志只归属本人；任务级开关走项目 create_task 门。
+
+    def _auto_memory_store(self):
+        return AutoMemoryStore(self.server.db_path)
+
+    def _auto_memory_close(self, store):
+        try:
+            store.close()
+        except Exception:
+            pass
+
+    def _auto_memory_settings_get(self, user_id):
+        store = self._auto_memory_store()
+        try:
+            self._send_json(200, store.get_settings(user_id))
+        finally:
+            self._auto_memory_close(store)
+
+    def _auto_memory_settings_upsert(self, user_id):
+        body, err = self._read_json()
+        if err:
+            self._send_json(400, {"error": err})
+            return
+        if not isinstance(body, dict):
+            self._send_json(400, {"error": "body must be an object"})
+            return
+        store = self._auto_memory_store()
+        try:
+            try:
+                settings = store.upsert_settings(user_id, **body)
+            except (ValueError, TypeError) as exc:
+                self._send_json(400, {"error": str(exc)})
+                return
+        finally:
+            self._auto_memory_close(store)
+        with _auth_store(self.server.db_path) as auth:
+            auth.audit(user_id, "", "auto_memory_settings_updated", "")
+        self._send_json(200, settings)
+
+    def _auto_memory_log(self, user_id, query):
+        try:
+            limit = int((query.get("limit") or ["50"])[0])
+        except (TypeError, ValueError):
+            self._send_json(400, {"error": "limit must be an integer"})
+            return
+        store = self._auto_memory_store()
+        try:
+            rows = store.list_log(user_id, limit=limit)
+        finally:
+            self._auto_memory_close(store)
+        self._send_json(200, {"user_id": user_id, "log": rows})
+
+    def _auto_memory_run(self, user_id):
+        body, err = self._read_json()
+        if err:
+            self._send_json(400, {"error": err})
+            return
+        force = False
+        if isinstance(body, dict) and body.get("force") is not None:
+            if body.get("force") not in (True, False, 0, 1):
+                self._send_json(400, {"error": "force must be a boolean"})
+                return
+            force = bool(body.get("force"))
+        results = _auto_process_due(
+            self.server.db_path, force=force, owner_id=user_id)
+        for item in results:
+            if item.get("status") == "extracted":
+                # 提取日志已在 process_due_tasks 里落库，这里只补
+                # 一条审计（不查任务归属：run 只扫本人的任务）。
+                task_id = item.get("task_id") or ""
+                with _auth_store(self.server.db_path) as auth:
+                    auth.audit(user_id, "", "auto_memory_extracted",
+                               task_id)
+        self._send_json(200, {"user_id": user_id, "results": results})
+
+    def _task_auto_memory_flags(self, user_id, task_id):
+        body, err = self._read_json()
+        if err:
+            self._send_json(400, {"error": err})
+            return
+        if not isinstance(body, dict):
+            self._send_json(400, {"error": "body must be an object"})
+            return
+        task = self._fetch_task(task_id)
+        if task is None:
+            self._send_json(404, {"error": "task not found"})
+            return
+        err = self._check_project(
+            user_id, task["project_id"], "create_task")
+        if err:
+            self._send_json(err[0], {"error": err[1]})
+            return
+        store = self._auto_memory_store()
+        try:
+            try:
+                flags = store.set_task_flags(
+                    task_id,
+                    use_memories=body.get("use_memories"),
+                    generate_memories=body.get("generate_memories"))
+            except ValueError as exc:
+                self._send_json(400, {"error": str(exc)})
+                return
+        finally:
+            self._auto_memory_close(store)
+        with _auth_store(self.server.db_path) as auth:
+            auth.audit(user_id, task["project_id"],
+                       "task_auto_memory_flags", task_id)
+        self._send_json(200, {"task_id": task_id, "flags": flags})
+
     def _project_identity_memory_create(self, user_id, project_id):
         body, err = self._read_json()
         if err: