@jonathanleelx/meddle 0.5.0-beta.8 → 0.5.0

package/bin/commands/route/update.js

@@ -1,126 +1,169 @@
 /**
  * meddle route update - Update a rule in a route file
+ *
+ * Issue #149: `--exclusions=` clears a rule's exclusions. Omitting the flag
+ * (and any !path in the pattern) still keeps them.
  */
 
 const output = require('../../lib/output')
 const { isProxyRunning } = require('../../lib/proxy-detect')
 const { apiGet, apiPut } = require('../../lib/api-client')
-const { getRuleFileContent, saveRuleFileContent, parseEprc, ruleMapToEprcText } = require('../../lib/file-access')
+const { getRuleFileContent, saveRuleFileContent } = require('../../lib/file-access')
+const { updateRouteRule, patternKey, parseRuleLine } = require('../../lib/rule-file-edit')
+const { isRulesetReadonlyError, exitRulesetReadonly } = require('../../lib/ruleset-readonly')
+const {
+  parseRouteWriteArgs,
+  parsePatternArg,
+  resolveExclusions,
+  UPDATE_HELP,
+} = require('../../lib/route-write-args')
 
-// Parse arguments (skip 'route' and 'update' from argv)
 const args = process.argv.slice(4)
-const jsonFlag = args.includes('--json')
+
+function fail(message, jsonFlag) {
+  if (jsonFlag) {
+    console.log(JSON.stringify({ success: false, error: { message } }))
+    console.error(message)
+  } else {
+    output.setJsonMode(false)
+    output.error(message)
+  }
+  process.exit(1)
+}
+
+let parsed
+try {
+  parsed = parseRouteWriteArgs(args)
+} catch (e) {
+  fail(e.message, args.includes('--json'))
+}
+
+if (parsed.help) {
+  console.log(UPDATE_HELP.trim())
+  process.exit(0)
+}
+
+const jsonFlag = parsed.json
 output.setJsonMode(jsonFlag)
 
-// Get positional arguments: file, pattern, newTarget
-const positionalArgs = args.filter(a => !a.startsWith('--'))
-const fileName = positionalArgs[0]
-const pattern = positionalArgs[1]
-const newTarget = positionalArgs[2]
+const fileName = parsed.positional[0]
+const pattern = parsed.positional[1]
+const newTarget = parsed.positional[2]
 
-async function run() {
-  if (!fileName) {
-    output.error('Missing required argument: <file>')
-    process.exit(1)
+/** Set once arguments are valid. `explicit` means the user asked to set exclusions, including clear. */
+let explicitExclusions = false
+let appliedExclusions = []
+
+function planUpdate() {
+  const { patterns, exclusions: patternExclusions } = parsePatternArg(pattern)
+  if (patterns.length === 0) {
+    fail('Missing required argument: <pattern>', jsonFlag)
   }
-  if (!pattern) {
-    output.error('Missing required argument: <pattern>')
-    process.exit(1)
+  const resolved = resolveExclusions(patternExclusions, parsed.exclusions)
+  explicitExclusions = resolved.explicit
+  appliedExclusions = resolved.exclusions || []
+  return { patterns, exclusions: resolved.explicit ? resolved.exclusions : undefined }
+}
+
+/**
+ * Issue #145: rewrite only the line(s) holding this pattern. The rule keeps its
+ * own `!exclusions` unless new ones are given. Issue #149: `--exclusions=` passes
+ * `[]`, which removes `!path` from that line. Every other line keeps its bytes.
+ */
+function applyUpdate(text, plan) {
+  const target = newTarget ? newTarget.trim() : undefined
+  let next = text
+  for (const p of plan.patterns) {
+    const result = updateRouteRule(next, { pattern: p, target, exclusions: plan.exclusions })
+    if (!result.found) {
+      fail(`Pattern not found: ${pattern.trim()}`, jsonFlag)
+    }
+    next = result.content
   }
-  if (!newTarget) {
-    output.error('Missing required argument: <target>')
-    process.exit(1)
+  return next
+}
+
+/** Target token actually written, for feedback when the user did not pass one. */
+function targetOnDisk(content, patternToken) {
+  const key = patternKey(patternToken)
+  const lines = content.split(/\r?\n/)
+  for (const line of lines) {
+    const parsedLine = parseRuleLine(line)
+    if (parsedLine && parsedLine.patterns.some((p) => patternKey(p) === key)) return parsedLine.target
   }
+  return ''
+}
 
-  const running = await isProxyRunning()
+function emitUpdated({ fileOnly, target }) {
+  const payload = { success: true, file: fileName, pattern: pattern.trim(), newTarget: target }
+  if (explicitExclusions) payload.exclusions = appliedExclusions
+  if (fileOnly) {
+    payload.fileOnly = true
+    payload.warning = output.FILE_ONLY_WARNING
+  }
+  if (jsonFlag) {
+    output.jsonRaw(payload)
+    return
+  }
+  output.header('Route Rule Updated')
+  output.success(`${pattern.trim()} -> ${target}`)
+  if (explicitExclusions) {
+    output.kv('Exclusions', appliedExclusions.length ? appliedExclusions.map((e) => `!${e}`).join(' ') : 'cleared')
+  }
+  output.kv('File', fileName)
+}
+
+async function run() {
+  if (!fileName) fail('Missing required argument: <file>', jsonFlag)
+  if (!pattern) fail('Missing required argument: <pattern>', jsonFlag)
+  if (parsed.positional.length > 3) fail(`Unexpected argument: ${parsed.positional[3]}`, jsonFlag)
+
+  let plan
+  try {
+    plan = planUpdate()
+  } catch (e) {
+    fail(e.message, jsonFlag)
+  }
+  if (!newTarget && !explicitExclusions) fail('Missing required argument: <target>', jsonFlag)
 
-  const pat = pattern.trim()
-  const tgt = newTarget.trim()
+  const running = await isProxyRunning()
 
-  // Handle [marker] syntax for lookup
-  const bm = pat.match(/\[([^\]]+)\]/)
-  const internalKey = bm ? pat.replace(bm[0], bm[1]) : pat
+  const finish = (content, fileOnly) => {
+    const target = newTarget ? newTarget.trim() : targetOnDisk(content, plan.patterns[0])
+    emitUpdated({ fileOnly, target })
+  }
 
   if (running) {
     try {
       let content = await apiGet(`/api/rule-files/${encodeURIComponent(fileName)}/content`)
       const text = typeof content === 'string' ? content : String(content)
-      const ruleMap = parseEprc(text)
-
-      if (!Object.prototype.hasOwnProperty.call(ruleMap, internalKey)) {
-        output.error(`Pattern not found: ${pat}`)
-        process.exit(1)
-      }
-
-      ruleMap[internalKey] = bm ? tgt + bm[0] : tgt
-      const newContent = ruleMapToEprcText(ruleMap)
+      const newContent = applyUpdate(text, plan)
       await apiPut(`/api/rule-files/${encodeURIComponent(fileName)}/content`, { content: newContent })
-
-      if (jsonFlag) {
-        output.jsonRaw({ success: true, file: fileName, pattern: pat, newTarget: tgt })
-        return
-      }
-
-      output.header('Route Rule Updated')
-      output.success(`${pat} -> ${tgt}`)
-      output.kv('File', fileName)
+      finish(newContent, false)
+      return
     } catch (e) {
+      // Issue #137: a locked ruleset is a final answer, never a cue to write the file directly.
+      if (isRulesetReadonlyError(e)) exitRulesetReadonly(e, { json: jsonFlag, ruleFile: fileName })
       // Fallback to file mode
       const content = getRuleFileContent(fileName)
-      if (!content) {
-        output.error(`Route file not found: ${fileName}`)
-        process.exit(1)
-      }
-
-      const ruleMap = parseEprc(content)
-      if (!Object.prototype.hasOwnProperty.call(ruleMap, internalKey)) {
-        output.error(`Pattern not found: ${pat}`)
-        process.exit(1)
-      }
-
-      ruleMap[internalKey] = bm ? tgt + bm[0] : tgt
-      const newContent = ruleMapToEprcText(ruleMap)
+      if (!content) fail(`Route file not found: ${fileName}`, jsonFlag)
+      const newContent = applyUpdate(content, plan)
       saveRuleFileContent(fileName, newContent)
-
-      if (jsonFlag) {
-        output.jsonRaw({ success: true, file: fileName, pattern: pat, newTarget: tgt })
-        return
-      }
-
-      output.header('Route Rule Updated')
-      output.success(`${pat} -> ${tgt}`)
-      output.kv('File', fileName)
-    }
-  } else {
-    // File mode
-    const content = getRuleFileContent(fileName)
-    if (!content) {
-      output.error(`Route file not found: ${fileName}`)
-      process.exit(1)
-    }
-
-    const ruleMap = parseEprc(content)
-    if (!Object.prototype.hasOwnProperty.call(ruleMap, internalKey)) {
-      output.error(`Pattern not found: ${pat}`)
-      process.exit(1)
-    }
-
-    ruleMap[internalKey] = bm ? tgt + bm[0] : tgt
-    const newContent = ruleMapToEprcText(ruleMap)
-    saveRuleFileContent(fileName, newContent)
-
-    if (jsonFlag) {
-      output.jsonRaw({ success: true, file: fileName, pattern: pat, newTarget: tgt })
+      output.warnFileOnlyMode()
+      finish(newContent, true)
       return
     }
-
-    output.header('Route Rule Updated')
-    output.success(`${pat} -> ${tgt}`)
-    output.kv('File', fileName)
   }
+
+  const content = getRuleFileContent(fileName)
+  if (!content) fail(`Route file not found: ${fileName}`, jsonFlag)
+  const newContent = applyUpdate(content, plan)
+  saveRuleFileContent(fileName, newContent)
+  output.warnFileOnlyMode()
+  finish(newContent, true)
 }
 
 run().catch(e => {
-  output.error(e.message)
-  process.exit(1)
-})
+  if (isRulesetReadonlyError(e)) exitRulesetReadonly(e, { json: jsonFlag, ruleFile: fileName })
+  fail(e.message, jsonFlag)
+})

package/bin/commands/update.js

@@ -77,6 +77,10 @@ meddle update - 检查并升级 meddle
   meddle update --auto on|off     启用/禁用自动更新 (默认关闭)
   meddle update status            查看安装方式、当前版本和自动更新开关
   meddle update --help, -h        显示帮助
+
+私有仓库二进制更新需要设置 GH_TOKEN 或 GITHUB_TOKEN（优先 GH_TOKEN；
+权限：repo，或 fine-grained contents:read）。也可：
+  gh release download -R JonathanLee-LX/meddle -p 'meddle-*'
 `)
 }
 

package/bin/index.js

@@ -59,7 +59,7 @@ if (command === 'mock' || command === 'route' || command === 'session') {
   // No command or only flags - start proxy (default behavior)
   require('../index.js')
 } else {
-  console.log(`Unknown command: ${command}`)
+  console.error(`Unknown command: ${command}`)
   showHelp()
   process.exit(1)
 }
@@ -106,8 +106,10 @@ Route 命令:
   meddle route active             查看当前激活的路由文件
   meddle route active set <file>  设置激活的路由文件
   meddle route create <name>      创建路由文件
-  meddle route add <file> <pattern> <target>   添加路由规则
-  meddle route update <file> <pattern> <target> 更新路由规则
+  meddle route add <file> <pattern> <target> [--exclusions=]
+                              添加路由规则；--exclusions= 清空排除项
+  meddle route update <file> <pattern> [<target>] [--exclusions=]
+                              更新路由规则；--exclusions= 清空排除项
   meddle route delete <file> <pattern> 删除路由规则
 
 全局选项:
@@ -137,6 +139,8 @@ Route 命令:
   meddle route preview "https://api.example.com/v1/users"  # 预览转发目标
   meddle route preview "https://cdn.com/assets/js/app.js" --file dev-rules --json
   meddle route add dev-rules "api.test.com" "localhost:3000"
+  meddle route add dev-rules "api.test.com" "localhost:3000" --exclusions=
+  meddle route update dev-rules "api.test.com" --exclusions=
   meddle route active set beta-rules
 
 更多信息请访问: https://github.com/JonathanLee-LX/meddle

package/bin/lib/api-client.js

@@ -25,14 +25,26 @@ async function apiRequest(method, pathname, body, timeoutMs = DEFAULT_TIMEOUT) {
 
   if (!response.ok) {
     const text = await response.text()
-    throw new Error(text || response.statusText)
+    const err = new Error(text || response.statusText)
+    err.status = response.status
+    // Structured errors (e.g. issue #137 RULESET_READONLY) keep their code.
+    try {
+      const data = JSON.parse(text)
+      if (data && typeof data === 'object') {
+        if (typeof data.code === 'string') err.code = data.code
+        if (typeof data.ruleFile === 'string') err.ruleFile = data.ruleFile
+      }
+    } catch (_) {}
+    throw err
   }
 
   const contentType = response.headers.get('content-type')
   if (contentType && contentType.includes('application/json')) {
     return response.json()
   }
-  return response.text()
+  // Issue #145: `Response.text()` strips a leading UTF-8 BOM, so a rule file
+  // read and written back through the API would silently lose it.
+  return new TextDecoder('utf-8', { ignoreBOM: true }).decode(await response.arrayBuffer())
 }
 
 /**

package/bin/lib/file-access.js

@@ -5,6 +5,7 @@
 const fs = require('fs')
 const path = require('path')
 const { meddleDir } = require('./proxy-detect')
+const { RulesetReadonlyError } = require('./ruleset-readonly')
 
 const routeRulesDir = path.join(meddleDir, 'route-rules')
 const settingsPath = path.join(meddleDir, 'settings.json')
@@ -51,6 +52,33 @@ function setActiveRuleFileNames(names) {
   saveSettings(settings)
 }
 
+/**
+ * Issue #137: locked rule files (settings.json `readonlyRuleFiles`). Entries
+ * whose file no longer exists are dropped silently. A missing field = none locked.
+ */
+function getReadonlyRuleFileNames() {
+  const settings = loadSettings()
+  if (!Object.prototype.hasOwnProperty.call(settings, 'readonlyRuleFiles')) return []
+  const raw = settings.readonlyRuleFiles
+  const names = Array.isArray(raw) ? raw.filter((n, i, arr) => typeof n === 'string' && n && arr.indexOf(n) === i) : []
+  const live = names.filter((name) => fs.existsSync(path.join(routeRulesDir, `${name}.txt`)))
+  if (!Array.isArray(raw) || live.length !== raw.length) {
+    settings.readonlyRuleFiles = live
+    saveSettings(settings)
+  }
+  return live
+}
+
+function isRuleFileReadonly(name) {
+  const fold = (n) => (process.platform === 'darwin' || process.platform === 'win32' ? n.toLowerCase() : n)
+  return getReadonlyRuleFileNames().some((item) => fold(item) === fold(name))
+}
+
+/** Throws RulesetReadonlyError (code RULESET_READONLY) for a locked rule file. */
+function assertRuleFileWritable(name) {
+  if (isRuleFileReadonly(name)) throw new RulesetReadonlyError(name)
+}
+
 // ========== Mocks ==========
 
 /**
@@ -62,36 +90,163 @@ function getMocksPath() {
 }
 
 /**
- * Load mock rules from file
+ * Offset of the first JSON syntax error. Kept in sync with
+ * core/mock-handler.ts findJsonErrorOffset (V8 often omits a position).
  */
-function loadMockRules() {
-  const mocksPath = getMocksPath()
-  try {
-    if (fs.existsSync(mocksPath)) {
-      const data = JSON.parse(fs.readFileSync(mocksPath, 'utf8'))
-      return data.rules || []
+function findJsonErrorOffset(t) {
+  let i = 0
+  const ws = () => { while (i < t.length && ' \t\n\r'.includes(t[i])) i++ }
+  const fail = () => { throw i }
+  const str = () => {
+    i++
+    while (i < t.length && t[i] !== '"') {
+      if (t[i] === '\\') i++
+      else if (t.charCodeAt(i) < 0x20) fail()
+      i++
     }
-  } catch (_) {}
-  return []
+    if (i >= t.length) fail()
+    i++
+  }
+  const value = () => {
+    ws()
+    const c = t[i]
+    if (c === '{') {
+      i++; ws()
+      if (t[i] === '}') { i++; return }
+      for (;;) {
+        ws(); if (t[i] !== '"') fail(); str(); ws()
+        if (t[i] !== ':') fail(); i++; value(); ws()
+        if (t[i] === ',') { i++; continue }
+        if (t[i] === '}') { i++; return }
+        fail()
+      }
+    } else if (c === '[') {
+      i++; ws()
+      if (t[i] === ']') { i++; return }
+      for (;;) {
+        value(); ws()
+        if (t[i] === ',') { i++; continue }
+        if (t[i] === ']') { i++; return }
+        fail()
+      }
+    } else if (c === '"') str()
+    else if (/[-0-9]/.test(c || '')) {
+      const m = /^-?(0|[1-9]\d*)(\.\d+)?([eE][+-]?\d+)?/.exec(t.slice(i))
+      if (!m) fail(); i += m[0].length
+    } else {
+      for (const w of ['true', 'false', 'null']) if (t.startsWith(w, i)) { i += w.length; return }
+      fail()
+    }
+  }
+  try {
+    value(); ws()
+    return i < t.length ? i : t.length
+  } catch (at) {
+    return typeof at === 'number' ? Math.min(at, t.length) : t.length
+  }
+}
+
+/** `第 <line> 行第 <column> 列：<short message>`, same rules as core/mock-handler.ts. */
+function describeMocksParseFailure(text, err) {
+  const message = String((err && err.message) || err)
+  const body = text.replace(/^\uFEFF/, '')
+  let line = null
+  let column = null
+  const lc = /\(line (\d+) column (\d+)\)/.exec(message)
+  const pos = /at position (\d+)/.exec(message)
+  const offset = lc ? null : pos ? Number(pos[1]) : findJsonErrorOffset(body)
+  if (lc) {
+    line = Number(lc[1]); column = Number(lc[2])
+  } else {
+    const before = body.slice(0, offset == null ? body.length : offset).split('\n')
+    line = before.length
+    column = before[before.length - 1].length + 1
+  }
+  const short = message.replace(/\s*\(line \d+ column \d+\)/, '').split(/,\s*(?:\.\.\.)?"/s)[0].replace(/\s+in JSON at position \d+/, '').trim()
+  const loc = line != null ? `第 ${line} 行第 ${column} 列：` : ''
+  return `${loc}${short}`
 }
 
 /**
- * Save mock rules to file
+ * Read mocks.json. Missing file → null. Empty / whitespace → {}.
+ * Invalid JSON throws MOCKS_FILE_INVALID and must not be treated as [].
+ * `message` refuses a write; `listMessage` is what `mock list` prints.
  */
-function saveMockRules(rules) {
-  const mocksPath = getMocksPath()
-  const dir = path.dirname(mocksPath)
-  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true })
+function readMocksDocument(mocksPath) {
+  if (!fs.existsSync(mocksPath)) return null
+  const text = fs.readFileSync(mocksPath, 'utf8').replace(/^\uFEFF/, '')
+  if (text.trim() === '') return {}
+  try {
+    return JSON.parse(text)
+  } catch (err) {
+    const detail = describeMocksParseFailure(text, err)
+    const error = new Error(`Mock 文件格式错误，已禁止写入以免覆盖: ${mocksPath} ${detail}`)
+    error.code = 'MOCKS_FILE_INVALID'
+    error.filePath = mocksPath
+    error.detail = detail
+    error.listMessage = `Mock 文件格式错误: ${mocksPath} ${detail}`
+    throw error
+  }
+}
+
+function rulesFromDocument(data) {
+  if (!data || typeof data !== 'object' || Array.isArray(data)) return []
+  return Array.isArray(data.rules) ? data.rules : []
+}
 
-  // Find max id for sequence
+function metaFromDocument(data) {
+  if (!data || typeof data !== 'object' || Array.isArray(data)) return { nextId: 0, lastId: 0 }
+  return { nextId: Number(data.nextId) || 0, lastId: Number(data.lastId) || 0 }
+}
+
+/**
+ * Load mock rules from file. A corrupt file throws; it is not an empty list.
+ */
+function loadMockRules() {
+  const data = readMocksDocument(getMocksPath())
+  if (data == null) return []
+  return rulesFromDocument(data)
+}
+
+function readMocksFileMeta(mocksPath) {
+  const data = readMocksDocument(mocksPath)
+  if (data == null) return { nextId: 0, lastId: 0 }
+  return metaFromDocument(data)
+}
+
+function maxRuleId(rules) {
   let maxId = 0
   rules.forEach(r => {
-    if (r.id > maxId) maxId = r.id
+    if (r && Number.isInteger(r.id) && r.id > maxId) maxId = r.id
   })
+  return maxId
+}
 
+/**
+ * Next id to hand out. Shares the server's `nextId` field so ids stay
+ * monotonic across CLI file-mode and the running proxy (issue #115); also
+ * honours the legacy CLI `lastId` field.
+ */
+function nextMockId(rules, meta) {
+  return Math.max(1, meta.nextId || 0, (meta.lastId || 0) + 1, maxRuleId(rules) + 1)
+}
+
+/**
+ * Save mock rules to file
+ */
+function saveMockRules(rules, nextId) {
+  const mocksPath = getMocksPath()
+  const dir = path.dirname(mocksPath)
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true })
+
+  const meta = readMocksFileMeta(mocksPath)
+  const seq = Math.max(nextId || 0, nextMockId(rules, meta))
   const data = {
+    // `nextId` is what the proxy reads; keep it so deleting the newest rule
+    // does not make its id reusable (issue #115). `lastId` kept for older CLIs.
+    nextId: seq,
     rules,
-    lastId: maxId
+    lastId: seq - 1
   }
   fs.writeFileSync(mocksPath, JSON.stringify(data, null, 2), 'utf8')
 }
@@ -103,23 +258,14 @@ function addMockRule(rule) {
   const rules = loadMockRules()
   const mocksPath = getMocksPath()
 
-  // Get next id
-  let nextId = 1
-  try {
-    if (fs.existsSync(mocksPath)) {
-      const data = JSON.parse(fs.readFileSync(mocksPath, 'utf8'))
-      nextId = (data.lastId || 0) + 1
-    }
-  } catch (_) {}
-  if (rules.length > 0) {
-    const maxId = Math.max(...rules.map(r => r.id))
-    if (maxId >= nextId) nextId = maxId + 1
-  }
+  // Issue #115: never reuse an existing (or previously handed-out) id, and
+  // ignore any id the caller put on the rule — add never overwrites.
+  const nextId = nextMockId(rules, readMocksFileMeta(mocksPath))
 
-  rule.id = nextId
-  rules.push(rule)
-  saveMockRules(rules)
-  return rule
+  const created = { ...rule, id: nextId }
+  rules.push(created)
+  saveMockRules(rules, nextId + 1)
+  return created
 }
 
 /**
@@ -167,6 +313,30 @@ function getRuleFilePath(name) {
 /**
  * List all rule files
  */
+function getRuleFileOrderNames() {
+  const settings = loadSettings()
+  const arr = settings.ruleFileOrder
+  return Array.isArray(arr) ? arr.filter((name) => typeof name === 'string') : []
+}
+
+function resolveRuleFileOrder(diskNames, storedOrder, activeNames) {
+  const diskSet = new Set(diskNames)
+  const ordered = []
+  const seen = new Set()
+  const pushUnique = (name) => {
+    if (!diskSet.has(name) || seen.has(name)) return
+    ordered.push(name)
+    seen.add(name)
+  }
+  if (storedOrder.length > 0) {
+    for (const name of storedOrder) pushUnique(name)
+  } else {
+    for (const name of activeNames) pushUnique(name)
+  }
+  for (const name of diskNames) pushUnique(name)
+  return ordered
+}
+
 function listRuleFiles() {
   ensureRouteRulesDir()
   const activeNames = getActiveRuleFileNames()
@@ -175,7 +345,10 @@ function listRuleFiles() {
     .filter(f => f.endsWith('.txt'))
     .map(f => f.replace(/\.txt$/, ''))
 
-  return files.map(name => {
+  const ordered = resolveRuleFileOrder(files, getRuleFileOrderNames(), activeNames)
+  const readonlyNames = new Set(getReadonlyRuleFileNames())
+
+  return ordered.map(name => {
     const filePath = getRuleFilePath(name)
     let ruleCount = 0
     let excludeCount = 0
@@ -191,6 +364,7 @@ function listRuleFiles() {
     return {
       name,
       enabled: activeNames.includes(name),
+      readonly: readonlyNames.has(name),
       ruleCount,
       excludeCount
     }
@@ -215,6 +389,7 @@ function getRuleFileContent(name) {
  */
 function saveRuleFileContent(name, content) {
   ensureRouteRulesDir()
+  assertRuleFileWritable(name)
   const filePath = getRuleFilePath(name)
   fs.writeFileSync(filePath, content, 'utf8')
 }
@@ -231,6 +406,8 @@ function createRuleFile(name, content = '', enabled = true) {
     throw new Error(`规则文件 "${safeName}" 已存在`)
   }
 
+  // Drop stale lock entries so a new file never inherits an old lock.
+  getReadonlyRuleFileNames()
   fs.writeFileSync(filePath, content, 'utf8')
 
   if (enabled) {
@@ -242,7 +419,7 @@ function createRuleFile(name, content = '', enabled = true) {
   }
 
   const ruleCount = content.trim() ? Object.keys(parseEprc(content)).length : 0
-  return { name: safeName, enabled, ruleCount }
+  return { name: safeName, enabled, readonly: false, ruleCount }
 }
 
 /**
@@ -253,6 +430,7 @@ function deleteRuleFile(name) {
   if (!fs.existsSync(filePath)) {
     throw new Error('规则文件不存在')
   }
+  assertRuleFileWritable(name)
   fs.unlinkSync(filePath)
 
   const activeNames = getActiveRuleFileNames()
@@ -274,6 +452,7 @@ function setRuleFileEnabled(name, enabled) {
 
   const activeNames = getActiveRuleFileNames()
   const idx = activeNames.indexOf(name)
+  if ((enabled && idx === -1) || (!enabled && idx !== -1)) assertRuleFileWritable(name)
 
   if (enabled && idx === -1) {
     activeNames.push(name)
@@ -309,6 +488,9 @@ module.exports = {
   saveSettings,
   getActiveRuleFileNames,
   setActiveRuleFileNames,
+  getReadonlyRuleFileNames,
+  isRuleFileReadonly,
+  assertRuleFileWritable,
 
   // Mocks
   getMocksPath,