@hyzyn/dsh-docker 0.7.2 → 0.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyzyn/dsh-docker",
-  "version": "0.7.2",
+  "version": "0.8.0",
   "description": "DSH Web GUI 的 Docker 容器面板插件：本机或 SSH 主机上的容器列表 / 启停删 / 日志 / 统计 / 镜像 / 一次性 exec，默认只读，配套只读优先的 agent 工具。",
   "keywords": [
     "dsh",
@@ -31,26 +31,28 @@
     "./package.json": "./package.json"
   },
   "dsh": {
+    "manifestVersion": 1,
     "bundle": {
       "patch": "./cordis.patch.yml"
     },
     "engines": {
-      "dsh": ">=0.1.2-rc.1"
+      "dsh": ">=0.1.7-rc.2"
     },
     "client": {
       "platform": "web"
     }
   },
   "dependencies": {
-    "@deepseek-ai/schemastery": "^3.18.2",
-    "@hyzyn/dsh-kit": "0.4.1",
+    "@deepseek-ai/schemastery": "^3.18.4",
+    "@hyzyn/dsh-kit": "0.4.2",
     "ssh2": "^1.17.0"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh-tools": "^0.1.2-rc.1"
+    "@deepseek-ai/dsh": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-tools": "^0.1.7-rc.2"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/cordis": "^4.0.4",
     "@deepseek-ai/dsh-host-webserver": "0.1.2-rc.1",
     "@deepseek-ai/dsh-tools": "0.1.2-rc.1",
     "@types/node": "^22.20.0",
@@ -79,10 +81,16 @@
   "publishConfig": {
     "access": "public"
   },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/dsh": {
+      "optional": true
+    }
+  },
   "scripts": {
     "build": "tsc -p tsconfig.json && node scripts/build-client.mjs",
     "typecheck": "tsc --noEmit && node ../../scripts/client-lint.mjs",
     "smoke": "node scripts/smoke.mjs && node scripts/route-smoke.mjs && node scripts/client-smoke.mjs",
+    "perf:logs": "node scripts/log-perf.mjs",
     "lint:client": "node ../../scripts/client-lint.mjs"
   }
 }

package/scripts/client-smoke.mjs

@@ -752,6 +752,39 @@ await test('日志级别档位：共用一份定义，含 INFO+（真实日志
   }
 })
 
+await test('日志级别过滤：`%5p` 右填充的 `[INFO ]` / `[WARN ]` 必须认出来（否则门槛整个失效）', () => {
+  const agg = aggLogsApi()
+  /*
+   * 回归现场（用户截图）：Logback / Spring 的 `%5p` 把级别右填充到 5 字符，
+   * 于是 INFO/WARN/DEBUG 写成 `[INFO ]`，而 ERROR/FATAL 恰好 5 字符不带空格。
+   * 旧正则只认 `[INFO]`，这些行被判成「无级别」——looks 无害，实则致命：
+   * filterByLevelCore 对未知级别走「不误杀」分支（rank=null 一律保留），
+   * 所以选了 WARN+ 仍会显示一屏 INFO，过滤像没生效。
+   */
+  assert.equal(agg.levelName('[INFO ] [2026-09-25 11:31:00] [scheduling-1] ==> x'), 'INFO')
+  assert.equal(agg.levelName('[WARN ] [2026-09-25 11:31:00] [scheduling-1] ==> x'), 'WARN')
+  assert.equal(agg.levelName('[DEBUG] [2026-09-25 11:31:00] [scheduling-1] ==> x'), 'DEBUG')
+  assert.equal(agg.levelName('[ERROR] [2026-09-25 11:31:00] [scheduling-1] ==> x'), 'ERROR')
+  // 既有形态不能被这次放宽改坏：未填充 / 前导空格 / Spring 竖线 / 无级别
+  assert.equal(agg.levelName('[INFO] [2026-09-09 18:05:52] unpadded'), 'INFO')
+  assert.equal(agg.levelName('[ INFO] leading pad'), 'INFO')
+  assert.equal(agg.levelName('16:11:34,150 |INFO in Spring'), 'INFO')
+  assert.equal(agg.levelName('没有待处理的考试，定时任务结束'), null)
+
+  // 端到端：WARN+ 滤掉填充过的 INFO 行，且紧邻的续行继承语义不受影响
+  const lines = [
+    '[INFO ] [2026-09-25 11:31:00] [scheduling-1] ==> 没有待处理的考试，定时任务结束',
+    '[WARN ] [2026-09-25 11:31:05] [scheduling-1] ==> 磁盘将满',
+    '  续行继承上一行的级别',
+  ]
+  assert.deepEqual(agg.filterLinesByLevel(lines, 3), [lines[1], lines[2]], 'WARN+ 必须滤掉填充过的 INFO')
+  assert.deepEqual(agg.filterLinesByLevel(lines, 2), lines, 'INFO+ 三行都该留下')
+  assert.deepEqual(agg.filterLinesByLevel(lines, 4), [], 'ERROR+ 该清空（续行继承 WARN）')
+  // 行对象适配器与纯文本适配器必须给出同一结论
+  const rows = lines.map((text) => ({ text }))
+  assert.deepEqual(agg.filterByLevel(rows, 3).map((row) => row.text), agg.filterLinesByLevel(lines, 3))
+})
+
 await test('日志导出对齐：两种格式共用构建器，只有标题与作用域不同', () => {
   const pick = aggLogsApi()
   const rows = [{ service: 'web', ts: 1755000000000, text: 'ERROR boom' }]
@@ -769,6 +802,34 @@ await test('日志导出对齐：两种格式共用构建器，只有标题与
   assert.match(many, /容器（2）：web、db/)
 })
 
+await test('日志导出：两个格式合并成一个菜单按钮（D137 —— 窄面板下不再各占一格）', () => {
+  const exports_ = registration.factory((spec) => SEED[spec])
+  const agg = exports_.__aggLogs
+  const decoded = decodeBundle(code)
+
+  // 「一份定义」不是口号：按钮文案在产物里出现两次 = 两个视图又各写了一套
+  // （级别档位、过滤内核当初就是这么漂的）
+  assert.equal(typeof agg.EXPORT_LABEL, 'string', '缺少 __aggLogs.EXPORT_LABEL 测试缝')
+  assert.ok(decoded.includes(agg.EXPORT_LABEL), '产物里没有导出按钮文案')
+  assert.equal(
+    decoded.split(agg.EXPORT_LABEL).length - 1,
+    1,
+    agg.EXPORT_LABEL + ' 在产物里出现了多次（视图各写了一套按钮？）',
+  )
+  // 两个视图的按钮都必须是「菜单触发器」——否则「这是个菜单」对读屏用户不可知
+  assert.equal(decoded.split('aria-haspopup').length - 1, 2, '两个视图的导出按钮都要标 aria-haspopup')
+  // 旧的「一个格式一个按钮」不许回来（正是它把 .md 挤到第二行）
+  assert.ok(!decoded.includes('导出当前显示内容为 .log'), '旧的单格式按钮文案残留（又拆回两个按钮了？）')
+
+  // 菜单里两个格式都在，且各自把正确的 format 交回导出函数
+  const picked = []
+  const items = agg.exportMenuItems((format) => picked.push(format))
+  assert.equal(items.length, 2, '导出菜单必须恰好两个格式')
+  assert.deepEqual(items.map((item) => item.label), ['⬇ .log', '⬇ .md'])
+  for (const item of items) item.onPick()
+  assert.deepEqual(picked, ['log', 'md'], '菜单项必须把对应的 format 传回导出函数')
+})
+
 await test('渲染期守卫：面板组件体直接跑一遍不能抛（TDZ 那类错误曾让面板整个空白）', () => {
   const exports_ = registration.factory((spec) => SEED[spec])
   assert.ok(exports_.__render !== undefined, '缺少 __render 测试缝')
@@ -776,6 +837,9 @@ await test('渲染期守卫：面板组件体直接跑一遍不能抛（TDZ 那
     ['DockerTabBody', {}],
     ['ContainerPanel', { carrier: 'tab', onClose: () => {}, initialTarget: '' }],
     ['ContainerPanel', { onClose: () => {}, initialTarget: '' }], // 模态 / docked 形态（carrier 缺省）
+    // 聚合日志视图（D137 也动了它的导出按钮）：它的工具条与单容器那条共用同一份定义，
+    // 但只在「多选聚合 / compose 详情」下才挂载，上面两个入口都盖不到它
+    ['ComposeLogs', { target: '目标1', targetLabel: '目标1', items: [{ id: 'a', name: 'web' }, { id: 'b', name: 'db' }] }],
   ]
   for (const [name, props] of cases) {
     const component = exports_.__render[name]
@@ -1831,6 +1895,203 @@ await test('总览：degraded 目标出提示（inspect 降级 / 候选超预算
   assert.match(value.attentionNotice, /已降级/)
 })
 
+/* ------------------------------------------------------------------ *
+ * 日志缓冲(D63 根治):环形上限 / 残行分片 / 单调 id——突发灌入的内存护栏。
+ * 真实 EventSource 时序进不了 Node 桩,但「缓冲吃多少、渲染信号发多少次」
+ * 是纯逻辑,在这里钉死。
+ * ------------------------------------------------------------------ */
+
+await test('日志缓冲:burst 灌入上行数/字节双限与单调 id(D63 根治)', () => {
+  const exports_ = registration.factory((spec) => SEED[spec])
+  const seam = exports_.__logBuffer
+  assert.ok(seam !== undefined && typeof seam.create === 'function', '缺少 __logBuffer 测试缝')
+  const { create, MAX_LINES, BYTE_LIMIT, PENDING_MAX, FLUSH_MS } = seam
+  // 常量在场:缓冲行数/字节上限与合帧节奏(显示层不再另设截断)
+  assert.equal(MAX_LINES, 5000)
+  assert.equal(BYTE_LIMIT, 4 * 1024 * 1024)
+  assert.equal(PENDING_MAX, 1024 * 1024)
+  assert.equal(FLUSH_MS, 150)
+
+  // burst:3 万行一次灌入,行数上限收口;id 严格递增(渲染 key 稳定性的前提)
+  const buffer = create({ maxLines: MAX_LINES, maxBytes: BYTE_LIMIT, maxPendingBytes: PENDING_MAX })
+  const lines = Array.from({ length: 30_000 }, (_, index) => 'line-' + String(index))
+  assert.equal(buffer.pushChunk(lines.join('\n') + '\n').appended, lines.length)
+  assert.equal(buffer.count(), MAX_LINES)
+  const snap = buffer.snapshot()
+  assert.equal(snap[0].text, 'line-' + String(lines.length - MAX_LINES))
+  for (let i = 1; i < snap.length; i++) assert.ok(snap[i].id > snap[i - 1].id, '行 id 必须单调递增')
+  assert.equal(buffer.takeDropped(), true)
+  assert.equal(buffer.takeDropped(), false)
+
+  // 大行:字节上限收口(旧行为只限行数,大行场景能吃掉数百 MB)
+  const bigLine = 'x'.repeat(64 * 1024)
+  const buffer2 = create({ maxLines: MAX_LINES, maxBytes: 1024 * 1024, maxPendingBytes: PENDING_MAX })
+  for (let i = 0; i < 64; i++) buffer2.pushChunk(bigLine + '\n')
+  const live = buffer2.snapshot().reduce((sum, entry) => sum + entry.bytes, 0)
+  assert.ok(live <= 1024 * 1024, '存活字节必须 ≤ maxBytes,实际 ' + String(live))
+})
+
+await test('日志流重连:首连带 tail、重连一律 tail=0（D133 不重放历史）', () => {
+  const exports_ = registration.factory((spec) => SEED[spec])
+  const seam = exports_.__logStream
+  assert.ok(seam !== undefined && typeof seam.subscribe === 'function', '缺少 __logStream 测试缝')
+  assert.equal(seam.RECONNECT_BASE_MS, 1000)
+  assert.equal(seam.RECONNECT_MAX_MS, 15000)
+  // 规则本身：首连保持调用方给的 tail,重连恒为 0
+  assert.equal(seam.reconnectTail(200, false), 200)
+  assert.equal(seam.reconnectTail(200, true), 0)
+  assert.equal(seam.reconnectTail(5000, true), 0)
+
+  // 用可注入的假 EventSource 真跑一遍订阅：首连 URL 带 200,断线重连后带 0
+  const urls = []
+  const instances = []
+  class FakeEventSource {
+    constructor(url) {
+      this.url = url
+      this.readyState = 0
+      this.listeners = new Map()
+      urls.push(url)
+      instances.push(this)
+    }
+    addEventListener(name, fn) {
+      const list = this.listeners.get(name) ?? []
+      list.push(fn)
+      this.listeners.set(name, list)
+    }
+    /** data 省略 = 连接层错误那种「没有 data 的普通 Event」。 */
+    emit(name, data) {
+      for (const fn of this.listeners.get(name) ?? []) fn(data === undefined ? {} : { data: JSON.stringify(data) })
+    }
+    open() {
+      this.readyState = 1
+      if (this.onopen) this.onopen()
+    }
+    close() {
+      this.readyState = 2
+    }
+  }
+  const previous = globalThis.EventSource
+  const previousSetTimeout = globalThis.setTimeout
+  globalThis.EventSource = FakeEventSource
+  // 退避定时器直接同步执行,免得用例等着真实 1s
+  globalThis.setTimeout = (fn) => {
+    fn()
+    return 0
+  }
+  try {
+    const lines = []
+    const handle = seam.subscribe({
+      buildUrl: (tail) => '/api/dsh-docker/logs/stream?tail=' + String(tail),
+      tail: 200,
+      onLine: (text) => lines.push(text),
+    })
+    assert.deepEqual(urls, ['/api/dsh-docker/logs/stream?tail=200'])
+    instances[0].open()
+    instances[0].emit('line', { d: 'first\n' })
+    // 连接层错误（无 data 的 Event）：触发手动重连,URL 必须换成 tail=0
+    instances[0].emit('error')
+    assert.deepEqual(urls, [
+      '/api/dsh-docker/logs/stream?tail=200',
+      '/api/dsh-docker/logs/stream?tail=0',
+    ])
+    instances[1].open()
+    instances[1].emit('line', { d: 'second\n' })
+    assert.deepEqual(lines, ['first\n', 'second\n'])
+    handle.close()
+  } finally {
+    globalThis.EventSource = previous
+    globalThis.setTimeout = previousSetTimeout
+  }
+})
+
+await test('日志流重连:服务端 end{output-limit} 交给调用方决定重连,不静默当成正常结束', () => {
+  const exports_ = registration.factory((spec) => SEED[spec])
+  const seam = exports_.__logStream
+  const urls = []
+  const instances = []
+  class FakeEventSource {
+    constructor(url) {
+      this.url = url
+      this.readyState = 0
+      this.listeners = new Map()
+      urls.push(url)
+      instances.push(this)
+    }
+    addEventListener(name, fn) {
+      const list = this.listeners.get(name) ?? []
+      list.push(fn)
+      this.listeners.set(name, list)
+    }
+    /** data 省略 = 连接层错误那种「没有 data 的普通 Event」。 */
+    emit(name, data) {
+      for (const fn of this.listeners.get(name) ?? []) fn(data === undefined ? {} : { data: JSON.stringify(data) })
+    }
+    open() {
+      this.readyState = 1
+      if (this.onopen) this.onopen()
+    }
+    close() {
+      this.readyState = 2
+    }
+  }
+  const previous = globalThis.EventSource
+  const previousSetTimeout = globalThis.setTimeout
+  globalThis.EventSource = FakeEventSource
+  globalThis.setTimeout = (fn) => {
+    fn()
+    return 0
+  }
+  try {
+    const seen = []
+    seam.subscribe({
+      buildUrl: (tail) => '/logs/stream?tail=' + String(tail),
+      tail: 50,
+      onEnd: (payload, controls) => {
+        seen.push(payload)
+        if (payload && payload.reason === 'output-limit') controls.reconnect()
+      },
+    })
+    instances[0].open()
+    instances[0].emit('end', { reason: 'output-limit' })
+    assert.equal(seen.length, 1)
+    assert.equal(seen[0].reason, 'output-limit')
+    // 溢出后重连:同样不许带历史(否则重复回填)
+    assert.deepEqual(urls, ['/logs/stream?tail=50', '/logs/stream?tail=0'])
+  } finally {
+    globalThis.EventSource = previous
+    globalThis.setTimeout = previousSetTimeout
+  }
+})
+
+await test('日志缓冲:无换行的超长输出被残行分片钉在有界内存内', () => {
+  const exports_ = registration.factory((spec) => SEED[spec])
+  const { create, PENDING_MAX } = exports_.__logBuffer
+  const buffer = create({ maxLines: 100, maxBytes: 1024 * 1024, maxPendingBytes: PENDING_MAX })
+  // 模拟「永远不换行的输出」:32MB 连续灌入,残行每次到 1MB 强制落行
+  for (let i = 0; i < 32; i++) buffer.pushChunk('y'.repeat(PENDING_MAX))
+  const live = buffer.snapshot().reduce((sum, entry) => sum + entry.bytes, 0)
+  assert.ok(live <= 1024 * 1024 + PENDING_MAX, '存活字节必须有界,实际 ' + String(live))
+  assert.ok(buffer.pendingLength() <= PENDING_MAX)
+  assert.ok(buffer.takeDropped(), '持续超限必须置 dropped')
+})
+
+await test('日志缓冲:快照切分不把结尾换行算成一行(D136 —— --tail 201 必须显示 201 行)', () => {
+  const exports_ = registration.factory((spec) => SEED[spec])
+  const { splitLines, create } = exports_.__logBuffer
+  assert.equal(typeof splitLines, 'function', '缺少 __logBuffer.splitLines 测试缝')
+  // 现场:docker logs --tail 201 → 201 行、每行以 \n 结尾。旧的 text.split('\n') 会切出 202 段。
+  const text = Array.from({ length: 201 }, (_, i) => 'line ' + String(i)).join('\n') + '\n'
+  assert.equal(splitLines(text).length, 201, '计数必须等于 --tail 的行数')
+  assert.equal(splitLines(text).at(-1), 'line 200', '末尾不该多出一条空行')
+  // 与 FOLLOW 缓冲的结论一致:同一份文本,两个视图的行数不许不同
+  const buffer = create({ maxLines: 5000, maxBytes: 4 * 1024 * 1024 })
+  buffer.pushChunk(text)
+  assert.equal(buffer.snapshot().length, splitLines(text).length, '快照视图与 FOLLOW 视图必须同行数')
+  // 真正以空行结尾的日志要留住那个空行(只剥终止符)
+  assert.deepEqual(splitLines('a\n\n'), ['a', ''])
+  assert.deepEqual(splitLines(''), [])
+})
+
 /* ------------------------------------------------------------------ *
  * 结果
  * ------------------------------------------------------------------ */

package/scripts/log-perf.mjs

@@ -0,0 +1,206 @@
+#!/usr/bin/env node
+/**
+ * 日志页性能门禁（D128 的浏览器侧护栏）。
+ *
+ * 为什么要有它：日志页当初「网页直接崩溃」是个**性能**缺陷——单测能钉住缓冲上限与
+ * 合帧常量，但钉不住「5000 行首屏要多久 / 突发时事件循环卡多久」。这里用真 Chrome
+ * 量这两个数并断言预算，回归就再也回不来了。
+ *
+ * 依赖 tty 的预览夹具（vendor React + mock-host + 面板外壳）：
+ *   node ../tty/scripts/preview.mjs        # 首次/夹具缺失时先生成
+ * 夹具或 Chrome 缺失时**跳过**（exit 0）——它是 npm script，不是 vitest 必跑项。
+ *
+ *   node scripts/log-perf.mjs              # 默认
+ *   CHROME_PATH=/path/to/chrome node scripts/log-perf.mjs
+ */
+import http from 'node:http'
+import { readFileSync, existsSync, copyFileSync, mkdirSync, statSync } from 'node:fs'
+import { join, extname, resolve, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { Chrome } from '../../../scripts/chrome-cdp.mjs'
+
+const here = dirname(fileURLToPath(import.meta.url))
+const pkg = resolve(here, '..')
+const repo = resolve(pkg, '../..')
+const fixtureDir = join(repo, 'packages/tty/.preview')
+
+/** 预算：宽松到不会因机器抖动误报，紧到能抓住「每 chunk 全量重渲染」那类回归。 */
+const BUDGET = {
+  snapshotMs: 2500,
+  snapshotRows: 5000,
+  burstMs: 8000,
+  burstMaxLagMs: 400,
+  maxNodes: 60_000,
+}
+
+function skip(reason) {
+  console.log('[log-perf] 跳过：' + reason)
+  process.exit(0)
+}
+
+const chromePath = process.env.CHROME_PATH ?? '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
+if (!existsSync(chromePath)) skip('没找到 Chrome（可用 CHROME_PATH 指定）')
+for (const file of ['harness.html', 'mock-host.js', 'harness.js', 'vendor/react.js', 'vendor/react-dom.js']) {
+  if (!existsSync(join(fixtureDir, file))) skip('预览夹具缺 ' + file + '（先跑 node packages/tty/scripts/preview.mjs）')
+}
+if (!existsSync(join(pkg, 'client.js'))) skip('client.js 还没构建（先跑 pnpm --filter @hyzyn/dsh-docker build）')
+
+// 把当前构建的 docker client 换进夹具（夹具读 .preview/docker-client.js）
+mkdirSync(fixtureDir, { recursive: true })
+copyFileSync(join(pkg, 'client.js'), join(fixtureDir, 'docker-client.js'))
+
+const MIME = { '.html': 'text/html', '.js': 'text/javascript', '.css': 'text/css', '.png': 'image/png' }
+const server = http.createServer((req, res) => {
+  const path = decodeURIComponent(String(req.url).split('?')[0])
+  const file = join(fixtureDir, path === '/' ? 'harness.html' : path)
+  if (!file.startsWith(fixtureDir) || !existsSync(file) || statSync(file).isDirectory()) {
+    res.writeHead(404).end('not found')
+    return
+  }
+  res.writeHead(200, { 'content-type': MIME[extname(file)] ?? 'application/octet-stream' })
+  res.end(readFileSync(file))
+})
+await new Promise((r) => server.listen(0, '127.0.0.1', r))
+const port = server.address().port
+
+/*
+ * 页面里的量测：5000 行快照的首屏耗时 / DOM 规模，然后灌 400×50 行的 FOLLOW 突发，
+ * 记录事件循环最大延迟与收敛后的行数。整段与 .preview/log-perf.mjs 一致，只多出
+ * 「返回结构化数字」以便这里断言。
+ */
+const MEASURE = `(async () => {
+  const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
+  const q = (s) => document.querySelector(s)
+  const qa = (s) => [...document.querySelectorAll(s)]
+  const waitFor = async (fn, timeout = 15000) => {
+    const t0 = performance.now()
+    for (;;) {
+      let v = null
+      try { v = fn() } catch { v = null }
+      if (v) return performance.now() - t0
+      if (performance.now() - t0 > timeout) throw new Error('waitFor 超时')
+      await sleep(25)
+    }
+  }
+  const out = { steps: [] }
+  try {
+    await waitFor(() => q('.dk_panel'))
+    await waitFor(() => qa('.dk_card').length > 0)
+    const LINE = '2026-09-24T12:00:00.000Z [INFO] request handled in 12ms path=/api/v1/orders/{id} trace=abc'
+    const BIG = Array.from({ length: 5000 }, (_, i) => LINE + ' seq=' + String(i)).join('\\n')
+    const realFetch = window.fetch.bind(window)
+    window.fetch = (url, init) => {
+      const target = typeof url === 'string' ? url : String(url && url.url ? url.url : url)
+      if (target.indexOf('/logs/stream') === -1 && target.indexOf('/logs') !== -1) {
+        return Promise.resolve({ ok: true, status: 200, json: () => Promise.resolve({ ok: true, logs: { id: 'app-web-1', text: BIG, truncated: false } }) })
+      }
+      return realFetch(url, init)
+    }
+    const card = qa('.dk_card')[0]
+    if (!card) throw new Error('没有容器卡片')
+    card.click()
+    await waitFor(() => q('.dk_tab'))
+    const logsTab = qa('.dk_tab').find((el) => el.textContent.trim() === '日志')
+    if (!logsTab) throw new Error('没有日志页签')
+    const t0 = performance.now()
+    logsTab.click()
+    await waitFor(() => qa('.dk_logLine').length >= 4000)
+    await sleep(150)
+    out.snapshotMs = Math.round(performance.now() - t0)
+    out.snapshotRows = qa('.dk_logLine').length
+    out.snapshotNodes = q('.dk_logBody') ? q('.dk_logBody').querySelectorAll('*').length : -1
+
+    let maxLag = 0
+    let last = performance.now()
+    const probe = setInterval(() => {
+      const now = performance.now()
+      maxLag = Math.max(maxLag, now - last - 16)
+      last = now
+    }, 16)
+
+    let emit = null
+    window.EventSource = class {
+      constructor() {
+        this.readyState = 0
+        this.listeners = new Map()
+        setTimeout(() => { this.readyState = 1; if (this.onopen) this.onopen() }, 0)
+        emit = (event, data) => {
+          for (const h of this.listeners.get(event) ?? []) h({ data: JSON.stringify(data) })
+        }
+      }
+      addEventListener(name, fn) {
+        const list = this.listeners.get(name) ?? []
+        list.push(fn)
+        this.listeners.set(name, list)
+      }
+      close() { this.readyState = 2 }
+    }
+    const follow = qa('.dk_pill').find((el) => el.className.indexOf('dk_pillFollow') >= 0)
+    if (!follow) throw new Error('没有 FOLLOW 开关')
+    const t1 = performance.now()
+    follow.click()
+    await waitFor(() => emit !== null, 5000)
+    const CHUNK = Array.from({ length: 50 }, (_, i) => LINE + ' burst=' + String(i)).join('\\n') + '\\n'
+    for (let i = 0; i < 400; i += 1) {
+      emit('line', { d: CHUNK })
+      if (i % 20 === 0) await sleep(0)
+    }
+    await sleep(800)
+    clearInterval(probe)
+    out.burstMs = Math.round(performance.now() - t1)
+    out.burstRows = qa('.dk_logLine').length
+    out.burstMaxLagMs = Math.round(maxLag)
+    out.burstNodes = q('.dk_logBody') ? q('.dk_logBody').querySelectorAll('*').length : -1
+    out.droppedBanner = qa('.dk_banner').some((el) => el.textContent.indexOf('丢弃最早') >= 0)
+    out.stillInteractive = qa('.dk_tab').length >= 3 && q('.dk_logBody') !== null
+    return JSON.stringify(out)
+  } catch (error) {
+    return JSON.stringify({ error: error instanceof Error ? error.message : String(error), steps: out.steps })
+  }
+})()`
+
+const chrome = await Chrome.launch({ path: chromePath, extraArgs: ['--no-sandbox'] })
+let raw = '{}'
+try {
+  await chrome.attachToPage()
+  await chrome.send('Page.enable')
+  await chrome.send('Runtime.enable')
+  await chrome.send('Page.navigate', { url: `http://127.0.0.1:${String(port)}/harness.html?scenario=docker-panel&theme=light` })
+  raw = await chrome.evaluate(MEASURE)
+} finally {
+  chrome.close()
+  server.close()
+}
+
+let result
+try {
+  result = JSON.parse(raw)
+} catch {
+  console.error('[log-perf] 量测返回不可解析：' + raw.slice(0, 400))
+  process.exit(1)
+}
+if (result.error !== undefined) {
+  console.error('[log-perf] 量测失败：' + result.error)
+  process.exit(1)
+}
+
+console.log('[log-perf] 5000 行快照：' + String(result.snapshotMs) + 'ms / ' + String(result.snapshotRows) + ' 行 / ' + String(result.snapshotNodes) + ' 个 DOM 节点')
+console.log('[log-perf] FOLLOW 突发 20000 行：' + String(result.burstMs) + 'ms / 事件循环最大延迟 ' + String(result.burstMaxLagMs) + 'ms / 收敛后 ' + String(result.burstRows) + ' 行 / ' + String(result.burstNodes) + ' 节点')
+console.log('[log-perf] 丢弃横幅 ' + String(result.droppedBanner) + ' / 仍可交互 ' + String(result.stillInteractive))
+
+const failures = []
+if (result.snapshotMs > BUDGET.snapshotMs) failures.push('快照渲染 ' + String(result.snapshotMs) + 'ms 超出预算 ' + String(BUDGET.snapshotMs) + 'ms')
+if (result.snapshotRows < BUDGET.snapshotRows) failures.push('快照只渲染了 ' + String(result.snapshotRows) + ' 行（应 ≥ ' + String(BUDGET.snapshotRows) + '）')
+if (result.burstMs > BUDGET.burstMs) failures.push('突发处理 ' + String(result.burstMs) + 'ms 超出预算 ' + String(BUDGET.burstMs) + 'ms')
+if (result.burstMaxLagMs > BUDGET.burstMaxLagMs) failures.push('事件循环最大延迟 ' + String(result.burstMaxLagMs) + 'ms 超出预算 ' + String(BUDGET.burstMaxLagMs) + 'ms')
+if (result.burstRows > BUDGET.snapshotRows) failures.push('突发后行数 ' + String(result.burstRows) + ' 超过缓冲上限 ' + String(BUDGET.snapshotRows))
+if (result.snapshotNodes > BUDGET.maxNodes || result.burstNodes > BUDGET.maxNodes) failures.push('DOM 节点数超出预算 ' + String(BUDGET.maxNodes))
+if (result.droppedBanner !== true) failures.push('突发撑爆缓冲后没有「已丢弃最早内容」横幅')
+if (result.stillInteractive !== true) failures.push('突发后界面失去可交互性')
+
+if (failures.length > 0) {
+  console.error('[log-perf] 性能预算未通过：')
+  for (const item of failures) console.error('  - ' + item)
+  process.exit(1)
+}
+console.log('[log-perf] 性能预算通过')

package/scripts/route-smoke.mjs

@@ -173,19 +173,26 @@ function makeCtx(config, options = {}) {
     settingsStored: {},
     ttyConfig: options.ttyConfig,
     disposers: [],
+    /**
+     * 本插件 entry 的安装级配置（= apply 拿到的 config）。DSH ≥0.1.7 的
+     * `settings.describe()` 返回的是「默认值 ← 组合 base ← 用户层」的 resolved 值，
+     * 这里用 base ∪ settingsStored 模拟同一件事。
+     */
+    baseConfig: config,
   }
 
-  const scopeFor = (base) => ({
-    get: () => ({ ...base, ...state.settingsStored }),
-    update: async (patch) => {
-      Object.assign(state.settingsStored, patch)
-      // 真实实现会 emit settings/updated；这里同步触发，验证热更新路径
-      const listeners = state.listeners.get('settings/updated') ?? []
-      for (const listener of listeners) listener('docker', { ...base, ...state.settingsStored }, undefined, 'update')
-    },
-  })
+  /** loader 检出 volatile-only 变更后发的事件（测试里同步发，验证热更新路径）。 */
+  const emitVolatile = () => {
+    for (const listener of state.listeners.get('loader/volatile-update') ?? []) listener()
+  }
 
   const makeChild = (names) => {
+    const on = (name, listener) => {
+      const list = state.listeners.get(name) ?? []
+      list.push(listener)
+      state.listeners.set(name, list)
+      return () => {}
+    }
     const child = {
       logger: { info: () => {}, warn: () => {} },
       effect: (callback, _name) => {
@@ -198,14 +205,8 @@ function makeCtx(config, options = {}) {
         cb(grand)
         return () => {}
       },
-      events: {
-        on: (name, listener) => {
-          const list = state.listeners.get(name) ?? []
-          list.push(listener)
-          state.listeners.set(name, list)
-          return () => {}
-        },
-      },
+      on,
+      events: { on },
     }
     if (names.includes('tools')) {
       child.tools = {
@@ -227,9 +228,19 @@ function makeCtx(config, options = {}) {
       }
     }
     if (names.includes('settings')) {
+      // DSH ≥0.1.7 的 settings 服务（SettingsForms）：describe / update / configure。
+      // describe 里额外放一个 tty entry，模拟「tty 已安装、连接簿可读」。
       child.settings = {
-        register: (ns, schema, options_) => scopeFor(options_?.base ?? {}),
-        get: (ns) => (ns === 'tty' ? state.ttyConfig : undefined),
+        describe: () => [
+          { ns: 'docker', value: { ...state.baseConfig, ...state.settingsStored } },
+          ...(state.ttyConfig === undefined ? [] : [{ ns: 'tty', value: state.ttyConfig }]),
+        ],
+        update: async (ns, patch) => {
+          if (ns !== 'docker') throw new Error('未知的 entry: ' + ns)
+          Object.assign(state.settingsStored, patch)
+          emitVolatile()
+        },
+        configure: () => () => {},
       }
     }
     if (names.includes('systemPrompt')) {
@@ -700,6 +711,27 @@ await test('POST /inspect：容器名注入尝试被白名单拒绝（D37 起回
   assert.match(res.body.error, /container 含非法字符/)
 })
 
+await test('单目标连不上：回 200 + ok:false（不是不透明 500）——与 target=* 同一口径', async () => {
+  /*
+   * Windows 真机实测挖出来的不对称：同一句目标侧错误，`target:'*'` 走聚合路径回
+   * 200 + groups[].ok:false，单目标却一路冒到外层 catch 变成 500。
+   * 「直连」是 127.0.0.1:1 —— 连不上是**运维状况**，不是服务端 bug。
+   */
+  const one = await call('POST', '/containers', { target: '直连', all: true })
+  assert.equal(one.status, 200, '单目标失败不该是 5xx：' + JSON.stringify(one.body))
+  assert.equal(one.body.ok, false)
+  assert.equal(one.body.target, '直连')
+  assert.equal(typeof one.body.error, 'string')
+  assert.ok(one.body.error.length > 0, '必须带可读原因')
+  // 与聚合口径对照：同一次失败在 target='*' 下也是 ok:false
+  const all = await call('POST', '/containers', { target: '*', all: true })
+  assert.equal(all.status, 200)
+  const group = (all.body.groups ?? []).find((row) => row.target === '直连')
+  assert.equal(group?.ok, false, '聚合路径里这条目标也该是 ok:false')
+  // 载荷形状不能串：单目标失败时不该顺手给出一个空的 containers 列表
+  assert.equal(one.body.containers, undefined)
+})
+
 await test('非 loopback 请求 403', async () => {
   const res = await call('GET', '/config', undefined, '10.0.0.9')
   assert.equal(res.status, 403)