@hyzyn/dsh-safe 0.3.2 → 0.4.0

package/README.en.md

@@ -67,6 +67,7 @@ Every short flag has an equivalent long form (`-u` = `--update`, `-y` = `--yes`,
 | `--to <version>` | Target dsh version, also how you roll back (explicit downgrades allowed); dsh-safe itself always upgrades to the latest |
 | `--self` | Update dsh-safe itself only; dsh and quarantine state untouched |
 | `--no-restore` | Do not auto-restore quarantined plugins after upgrading dsh |
+| `--no-verify` | Skip the post-upgrade parser self-check (boots the new dsh with a throwaway profile to confirm error recognition still works) |
 | `--pm <npm\|pnpm>` | Force the package manager (auto-detected by default) |
 
 ### Environment variables
@@ -98,7 +99,7 @@ How upgrading works: `dsh-safe update` auto-detects the dsh package name and ins
 - If the patch file itself fails YAML parsing (e.g. broken by hand-editing), plugins cannot be identified and the failure is passed through.
 - Rows inserted via `--patch` overlay layers are not part of the mapping (only the profile patch, the home patch and bundle patches are scanned).
 - To capture stderr, the wrapper pipes dsh's stderr (content is still echoed to the terminal in real time); stdout/stdin pass through unaffected.
-- Match patterns target the dsh 0.1.x error formats; a major dsh upgrade that changes them requires updating the parser.
+- Match patterns target the dsh 0.1.x error formats; a major dsh upgrade that changes them requires updating the parser. Mitigation: after update/-u upgrades dsh it runs a parser self-check — boots the new dsh with a throwaway profile and confirms failures are still recognized, warning right away on mismatch (`--no-verify` skips it).
 - Windows is best-effort: update / --self / list / restore are adapted (.cmd shim parsing, shelled npm/pnpm invocations); the wrapped boot resolves the node entry embedded in dsh's .cmd/.ps1 shim on PATH and spawns `node <entry>` directly (.exe runs as-is, unparseable shims fall back to a shelled spawn), sidestepping Node's ban on spawning .cmd files. Not yet verified end-to-end on a real Windows machine — feedback welcome.
 
 ## Development

package/README.md

@@ -67,6 +67,7 @@ Error: dsh: plugin tree failed to load: failed to apply loader entry smoke-broke
 | `--to <版本>` | 指定 dsh 的目标版本，也是回滚方式（显式允许降级）；dsh-safe 自身始终升到最新 |
 | `--self` | 只更新 dsh-safe 自身，不动 dsh 与隔离状态 |
 | `--no-restore` | 升级 dsh 后不自动恢复被隔离的插件 |
+| `--no-verify` | 跳过升级后的解析器自校验（临时 profile 试启新版 dsh，验证报错识别仍有效） |
 | `--pm <npm\|pnpm>` | 强制指定包管理器（缺省自动探测） |
 
 ### 环境变量
@@ -98,7 +99,7 @@ Error: dsh: plugin tree failed to load: failed to apply loader entry smoke-broke
 - patch 文件本身 YAML 解析错误（如手改坏了）时无法识别插件，只会透传。
 - `--patch` 覆盖层里插入的行不参与对照表（对照表只扫 profile patch、home patch 与 bundle patch）。
 - 为了捕获 stderr，包装器把 dsh 的 stderr 接到管道（内容仍实时回显到终端）；stdout/stdin 直通不受影响。
-- 本项目针对 dsh 0.1.x 的报错格式做匹配；dsh 大版本升级后格式变化时需要同步更新解析器。
+- 本项目针对 dsh 0.1.x 的报错格式做匹配；dsh 大版本升级后格式变化时需要同步更新解析器。缓解：update/-u 升级 dsh 后会自动做解析器自校验——临时 profile 试启新版 dsh 并确认报错仍可识别，失配当场告警（`--no-verify` 跳过）。
 - Windows 为尽力支持：update / --self / list / restore 已适配（.cmd shim 解析、shell 方式调用 npm/pnpm）；包装启动会把 PATH 上 dsh 的 .cmd/.ps1 shim 解析出内嵌的 node 入口、改为 `node <入口>` 直接启动（.exe 直接运行，shim 解析失败退回 shell 方式），绕开 Node 禁止 spawn .cmd 的限制。尚未在真实 Windows 上端到端验证，欢迎反馈。
 
 ## 开发

package/lib/i18n.js

@@ -20,7 +20,7 @@ const ZH = {
   dsh-safe list [--profile <名>]    查看隔离名单（缺省列出全部 profile）
   dsh-safe restore --profile <名> (--id <id> | --all) [--dry-run]
                                     恢复被自动禁用的插件（升级修复后使用）
-  dsh-safe update [-y] [--to <版本>] [--self] [--no-restore] [--pm npm|pnpm]
+  dsh-safe update [-y] [--to <版本>] [--self] [--no-restore] [--no-verify] [--pm npm|pnpm]
                                     升级 dsh 与 dsh-safe 自身，并自动恢复被隔离的插件
   dsh-safe help                     显示本帮助
   dsh-safe --version                显示版本
@@ -89,6 +89,11 @@ const ZH = {
   updateRestoreSkipped: '[dsh-safe] 已按 --no-restore 跳过恢复；可稍后用 dsh-safe restore --profile <名> --all 恢复。',
   updateVerifyHint: '[dsh-safe] 请启动 dsh 验证；仍不兼容的插件会自动再次隔离。',
   updateRollbackHint: '[dsh-safe] 如需回滚: dsh-safe update --to {version}',
+  verifyRunning: '[dsh-safe] 正在自校验解析器：用临时 profile 试启新版 dsh（预期失败）…',
+  verifyPassed: '[dsh-safe] 解析器自校验通过：新版 dsh 的报错能被识别，自动隔离可用。',
+  verifyFailNoHit: '[dsh-safe] 警告：解析器自校验未通过——无法从新版 dsh 的报错里识别坏插件，自动隔离可能失效；建议回滚（dsh-safe update --to {version}）并反馈给 dsh-safe。',
+  verifyFailBoot: '[dsh-safe] 警告：解析器自校验未通过——坏插件试启意外成功，未触发报错，自动隔离未验证。',
+  verifyFailTimeout: '[dsh-safe] 警告：解析器自校验未完成（试启超时或无法启动），自动隔离未验证。',
   selfUpdateLagHint: '[dsh-safe] dsh-safe 已更新: {old} → {new}（本次运行仍是旧版，下次启动生效）',
   updateNotify: '[dsh-safe] 提示: dsh-safe 有新版本 {new}（当前 {old}）',
   updateNotifyHow: '           升级: npm i -g {name} 或 dsh-safe update --self',
@@ -112,7 +117,7 @@ Usage:
   dsh-safe list [--profile <name>] show quarantined plugins (defaults to all profiles)
   dsh-safe restore --profile <name> (--id <id> | --all) [--dry-run]
                                     re-enable auto-disabled plugins (after a fixed plugin upgrade)
-  dsh-safe update [-y] [--to <ver>] [--self] [--no-restore] [--pm npm|pnpm]
+  dsh-safe update [-y] [--to <ver>] [--self] [--no-restore] [--no-verify] [--pm npm|pnpm]
                                     upgrade dsh and dsh-safe itself, auto-restore quarantined plugins
   dsh-safe help                     show this help
   dsh-safe --version                show version
@@ -184,6 +189,11 @@ Notes:
   updateRestoreSkipped: '[dsh-safe] restore skipped due to --no-restore; restore later with dsh-safe restore --profile <name> --all.',
   updateVerifyHint: '[dsh-safe] start dsh to verify; plugins still incompatible will be auto-quarantined again.',
   updateRollbackHint: '[dsh-safe] to roll back: dsh-safe update --to {version}',
+  verifyRunning: '[dsh-safe] verifying the parser: booting the new dsh with a throwaway profile (expected to fail)…',
+  verifyPassed: '[dsh-safe] parser self-check passed: failures from the new dsh are recognized, auto-quarantine is available.',
+  verifyFailNoHit: '[dsh-safe] warning: parser self-check failed — the broken plugin could not be recognized in the new dsh errors; auto-quarantine may be broken. Consider rolling back (dsh-safe update --to {version}) and reporting it to dsh-safe.',
+  verifyFailBoot: '[dsh-safe] warning: parser self-check failed — the deliberately broken profile booted unexpectedly, no error was triggered; auto-quarantine unverified.',
+  verifyFailTimeout: '[dsh-safe] warning: parser self-check did not finish (boot timed out or could not start); auto-quarantine unverified.',
   selfUpdateLagHint: '[dsh-safe] dsh-safe updated: {old} → {new} (this run still uses the old version; takes effect on the next run)',
   updateNotify: '[dsh-safe] notice: a new dsh-safe version is available: {new} (current {old})',
   updateNotifyHow: '           to upgrade: npm i -g {name} or dsh-safe update --self',

package/lib/update.js

@@ -13,6 +13,7 @@ import { createInterface } from 'node:readline/promises'
 import { delimiter, dirname, join } from 'node:path'
 import { loadLedger, restoreQuarantine } from './quarantine.js'
 import { readIfExists, updateCheckFile } from './dshpaths.js'
+import { verifyParser } from './verify.js'
 import { t } from './i18n.js'
 
 const err = (line) => process.stderr.write(`${line}\n`)
@@ -235,11 +236,12 @@ export async function cmdUpdateAndBoot(args, { boot } = {}) {
 /**
  * 更新主体；bootArgs 非空时更新成功（或已最新/检查失败）后继续启动。
  * 默认同时检查 dsh 与 dsh-safe 自身，谁旧升谁（一条安装命令）；--self 只更新自身。
- * @param {{ to?: string, yes?: boolean, restore?: boolean, pm?: string, selfOnly?: boolean }} opts
+ * dsh 更新成功后默认跑解析器自校验（--no-verify 跳过）。
+ * @param {{ to?: string, yes?: boolean, restore?: boolean, pm?: string, selfOnly?: boolean, noVerify?: boolean }} opts
  * @param {string[] | null} bootArgs
- * @param {{ boot?: (args: string[]) => Promise<number> }} hooks
+ * @param {{ boot?: (args: string[]) => Promise<number>, verify?: typeof verifyParser }} hooks
  */
-async function updateAndMaybeBoot(opts, bootArgs, { boot } = {}) {
+async function updateAndMaybeBoot(opts, bootArgs, { boot, verify = verifyParser } = {}) {
   const dshPkg = opts.selfOnly ? null : resolveDshPackage()
   const selfPkg = resolveSelfPackage()
   if (!dshPkg && !selfPkg) {
@@ -317,6 +319,9 @@ async function updateAndMaybeBoot(opts, bootArgs, { boot } = {}) {
       err(t('selfUpdateLagHint', { old: p.pkg.version, new: p.target }))
     }
   }
+  if (dshUpdated && !opts.noVerify) {
+    await verify({ rollbackVersion: plans.find((p) => p.pkg === dshPkg)?.pkg.version, log: err })
+  }
 
   if (opts.restore && dshUpdated) {
     const ledger = loadLedger()
@@ -343,12 +348,13 @@ async function updateAndMaybeBoot(opts, bootArgs, { boot } = {}) {
 
 /** 解析 update 子命令参数；出错返回 { error: { key, params? } } 供 i18n。 */
 function parseUpdateArgs(args) {
-  const opts = { to: undefined, yes: false, restore: true, pm: undefined, selfOnly: false }
+  const opts = { to: undefined, yes: false, restore: true, pm: undefined, selfOnly: false, noVerify: false }
   for (let i = 0; i < args.length; i++) {
     const a = args[i]
     if (a === '-y' || a === '--yes') opts.yes = true
     else if (a === '--no-restore') opts.restore = false
     else if (a === '--self') opts.selfOnly = true
+    else if (a === '--no-verify') opts.noVerify = true
     else if (a === '--to') {
       const v = args[++i]
       if (v === undefined) return { error: { key: 'updateUnknownFlag', params: { arg: '--to' } } }
@@ -375,13 +381,14 @@ function parseUpdateArgs(args) {
  * dsh 启动参数（宽松处理——不像子命令那样对未知参数报错）。
  */
 function parseLeadingUpdateArgs(args) {
-  const opts = { to: undefined, yes: false, restore: true, pm: undefined, selfOnly: false }
+  const opts = { to: undefined, yes: false, restore: true, pm: undefined, selfOnly: false, noVerify: false }
   let i = 0
   for (; i < args.length; i++) {
     const a = args[i]
     if (a === '-y' || a === '--yes') opts.yes = true
     else if (a === '--no-restore') opts.restore = false
     else if (a === '--self') opts.selfOnly = true
+    else if (a === '--no-verify') opts.noVerify = true
     else if (a === '--to' && args[i + 1] !== undefined) opts.to = args[++i]
     else if (a.startsWith('--to=')) opts.to = a.slice('--to='.length)
     else if (a === '--pm' && args[i + 1] !== undefined) opts.pm = args[++i]

package/lib/verify.js

@@ -0,0 +1,78 @@
+/**
+ * @hyzyn/dsh-safe — 升级 dsh 后的解析器自校验。
+ *
+ * 风险背景：报错解析器与 dsh 的 stderr 格式耦合，dsh 升级可能让特征失配，
+ * 保险丝静默失效。自校验在临时 DSH_HOME 里搭一次性 profile（引用现场生成
+ * 的坏插件），用 PATH 上新装的 dsh 试启——预期启动失败，再确认解析器能从
+ * 报错里识别出坏插件。识别失败只告警（附回滚命令），不阻断后续启动。
+ */
+import { spawnSync } from 'node:child_process'
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { parseFailureReport } from './failures.js'
+import { matchFailures } from './knownrows.js'
+import { resolveDshSpawnTarget } from './dshpaths.js'
+import { t } from './i18n.js'
+
+const BAD_ID = 'dsh-safe-verify'
+const BAD_NAME = '@dsh-safe-verify/broken'
+
+/**
+ * @param {{
+ *   rollbackVersion?: string,
+ *   log?: (line: string) => void,
+ *   timeoutMs?: number,
+ *   spawn?: typeof spawnSync,
+ * }} [options]
+ * @returns {Promise<boolean>} 自校验是否通过
+ */
+export async function verifyParser({ rollbackVersion, log = (line) => process.stderr.write(`${line}\n`), timeoutMs = 60_000, spawn = spawnSync } = {}) {
+  log(t('verifyRunning'))
+  const home = mkdtempSync(join(tmpdir(), 'dsh-safe-verify-'))
+  try {
+    // 一次性 profile：patch 行引用现场生成的坏插件（模块级 throw → import 失败）
+    const profileDir = join(home, 'profiles', 'verify')
+    const modDir = join(profileDir, 'node_modules', BAD_NAME)
+    mkdirSync(join(modDir, 'lib'), { recursive: true })
+    writeFileSync(join(profileDir, 'package.json'), JSON.stringify({ name: 'dsh-profile-verify', private: true }))
+    const patchPath = join(profileDir, 'cordis.patch.yml')
+    writeFileSync(patchPath, `- id: ${BAD_ID}\n  name: '${BAD_NAME}'\n`)
+    writeFileSync(
+      join(modDir, 'package.json'),
+      JSON.stringify({ name: BAD_NAME, version: '0.0.1', type: 'module', main: 'lib/index.js' }),
+    )
+    writeFileSync(join(modDir, 'lib', 'index.js'), `throw new Error('dsh-safe parser self-check')\n`)
+
+    const target = resolveDshSpawnTarget('dsh')
+    const { status, stderr } = spawn(target.file, [...target.prefix, '--profile', 'verify'], {
+      env: { ...process.env, DSH_HOME: home },
+      stdio: ['ignore', 'ignore', 'pipe'],
+      timeout: timeoutMs,
+      shell: target.shell,
+      encoding: 'utf8',
+    })
+
+    if (status === 0) {
+      log(t('verifyFailBoot'))
+      return false
+    }
+    if (status === null) {
+      // 超时被杀或无法启动试启进程
+      log(t('verifyFailTimeout'))
+      return false
+    }
+    const report = parseFailureReport(stderr ?? '')
+    const hits = matchFailures(report, {
+      rows: [{ id: BAD_ID, name: BAD_NAME, disabled: false, file: patchPath }],
+    })
+    if (hits.length) {
+      log(t('verifyPassed'))
+      return true
+    }
+    log(t('verifyFailNoHit', { version: rollbackVersion ?? '' }))
+    return false
+  } finally {
+    rmSync(home, { recursive: true, force: true })
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyzyn/dsh-safe",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "description": "dsh 启动保险丝：社区插件不兼容导致 dsh 启动失败时，自动禁用坏插件并重试",
   "type": "module",
   "license": "MIT",