@logictan/dsh-config-manager 0.1.60 → 0.1.61

package/src/adapters/plugins.test.ts

@@ -4,10 +4,16 @@
  */
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { PluginsAdapter, USER_PATCH_FILE } from './plugins.ts';
+import { PluginsAdapter } from './plugins.ts';
 import { makeContext, makeImportContext } from './test-helpers.ts';
+import { HOME_PATCH_FILE, PROFILE_PATCH_FILE, patchLayerKey } from '../core/patch-layers.ts';
 import type { PlanItem } from '../core/types.ts';
 
+/** 计划项 id：层限定复合键的投影（`patch:<file>#<lineId>`）。 */
+function patchItemId(file: string, lineId: string): string {
+  return `patch:${patchLayerKey(file, lineId)}`;
+}
+
 test('issue #35：patch 文件随分区迁移；目标缺失的 patchedDependencies 声明导入时剔除', async () => {
   const ws = [
     'allowBuilds:',
@@ -167,7 +173,9 @@ test('plugins: 导出清单与 patch 行', async () => {
   ctx.plugins.installed.set('@linxin666/dsh-ssh', { name: '@linxin666/dsh-ssh', version: '0.1.12', enabled: true, isBundle: true, inBundles: ['@linxin666/dsh-web-ui-all'] });
   ctx.plugins.installed.set('dsh-memory-evolve', { name: 'dsh-memory-evolve', version: '1.0.0', enabled: true, spec: 'github:csyangwen/dsh-memory-evolve' });
   ctx.plugins.installed.set('@deepseek-ai/dsh-base', { name: '@deepseek-ai/dsh-base', version: '0.1.0-rc.6', enabled: true });
-  ctx.patchFile.lines.set('skill-badge', { lineId: 'skill-badge', raw: { id: 'skill-badge', disabled: true } });
+  // 层寻址契约：导出同时读 home 与 profile 两层，单层的 MemPatch 对任何 file 都返回同一批行，
+  // 会让同一行被当成两层的两行。此处改用按层键控的门面，夹具才与真实门面同语义。
+  ctx.useLayeredPatch().set(HOME_PATCH_FILE, 'skill-badge', { id: 'skill-badge', disabled: true });
 
   const adapter = new PluginsAdapter();
   const out = await adapter.export(ctx, { includeSecrets: false });
@@ -235,11 +243,11 @@ test('plugins: 已装同版本 Skip / 未装 Install / 版本不同 Conflict / p
   const byId = new Map(items.map((i) => [i.id, i]));
   assert.equal(byId.get('plugin:pkg-a')?.kind, 'Skip');
   assert.equal(byId.get('plugin:pkg-b')?.kind, 'Conflict');
-  assert.equal(byId.get('patch:my-line')?.kind, 'Create');
-  assert.equal(byId.get('patch:my-line')?.target?.ref, 'my-line');
+  assert.equal(byId.get(patchItemId(HOME_PATCH_FILE, 'my-line'))?.kind, 'Create');
+  assert.equal(byId.get(patchItemId(HOME_PATCH_FILE, 'my-line'))?.target?.ref, patchLayerKey(HOME_PATCH_FILE, 'my-line'));
 
   // patch 行写入（Create）
-  const r = await adapter.applyItem(byId.get('patch:my-line')!, makeImportContext(dst, sections));
+  const r = await adapter.applyItem(byId.get(patchItemId(HOME_PATCH_FILE, 'my-line'))!, makeImportContext(dst, sections));
   assert.equal(r.ok, true);
   assert.equal(r.needsRestart, true);
   assert.deepEqual(dst.patchFile.lines.get('my-line')?.raw, { id: 'my-line', name: 'pkg-c', config: { x: 1 } });

package/src/adapters/plugins.ts

@@ -1,9 +1,9 @@
 /**
  * plugins 分区 adapter（设计 §3.3/§8）：
- * 数据源 = ctx.plugins.listInstalled()（插件清单）+ 用户 patch 层（profile cordis.patch.yml）。
+ * 数据源 = ctx.plugins.listInstalled()（插件清单）+ 两个 patch 层（home 与 profile 的 cordis.patch.yml）。
  *
  * 安全不变量：绝不打包插件二进制；导入走 DSH 官方机制（dsh plugin CLI → needsRestart 提示）。
- * patch 行导入（用户自定义行：启用/禁用/插入）写回 cordis.patch.yml，同样 needsRestart。
+ * patch 行导入（用户自定义行：启用/禁用/插入）写回该行自带的层（home 或 profile），同样 needsRestart。
  *
  * T1（本地源插件迁移）：`link:` / `file:` 来源的插件指向本机路径，换机后必然不可达
  * （曾导致插件被静默丢失）。导出时经注入的 `localPack` 执行 `npm pack`，把 tarball 作为
@@ -19,6 +19,7 @@ import { msgOf, zhMsg } from '../core/messages.ts';
 import type { MsgFunc } from '../core/messages.ts';
 import { isPathSafe, normalizePath } from '../utils/paths.ts';
 import { PLUGIN_PATCH_REF_PREFIX } from '../core/backup.ts';
+import { HOME_PATCH_FILE, PROFILE_PATCH_FILE, patchLayerKey, parsePatchLayerKey } from '../core/patch-layers.ts';
 import { parsePnpmPatchedDependencies, sanitizePnpmWorkspacePatches } from './pnpm-workspace.ts';
 import type { LocalPluginTarball, PatchLine, PluginEntry, PluginsSection, PnpmPatchFile } from '../schema/types.ts';
 import type {
@@ -26,7 +27,6 @@ import type {
   ImportContext, PlanItem, ValidationResult,
 } from '../core/types.ts';
 
-export const USER_PATCH_FILE = 'cordis.patch.yml';
 
 /**
  * 本地源插件打包钩子（由宿主注入，见 src/index.ts createAdapters）。
@@ -170,12 +170,16 @@ export class PluginsAdapter implements ConfigAdapter<PluginsSection> {
     } catch (err) {
       warnings.push(msgOf(ctx)('adapter.pluginListReadFailed', { reason: err instanceof Error ? err.message : String(err) }));
     }
+    // 两层都读：home 层（全机偏好）与 profile 层（该 profile 专属）。缺 profile 层文件不是故障
+    // （readPatchLines 对不存在的文件返回空数组），只有真读失败才告警。
     const patch: PatchLine[] = [];
-    try {
-      const lines = await ctx.patchFile.readPatchLines(USER_PATCH_FILE);
-      for (const l of lines) patch.push({ file: USER_PATCH_FILE, lineId: l.lineId, raw: l.raw });
-    } catch (err) {
-      warnings.push(msgOf(ctx)('adapter.patchReadFailed', { reason: err instanceof Error ? err.message : String(err) }));
+    for (const file of [HOME_PATCH_FILE, PROFILE_PATCH_FILE]) {
+      try {
+        const lines = await ctx.patchFile.readPatchLines(file);
+        for (const l of lines) patch.push({ file, lineId: l.lineId, raw: l.raw });
+      } catch (err) {
+        warnings.push(msgOf(ctx)('adapter.patchReadFailed', { reason: err instanceof Error ? err.message : String(err) }));
+      }
     }
     // pnpm-workspace.yaml（allowBuilds / minimumReleaseAgeExclude 等）：随插件分区迁移，
     // 否则目标 profile 的 pnpm 可能因构建白名单/冷静期拒绝安装插件（§34.17 同款语义）。
@@ -414,16 +418,25 @@ export class PluginsAdapter implements ConfigAdapter<PluginsSection> {
 
     // 用户 patch 行：lineId 唯一键；存在且同 → Skip；存在不同 → Conflict；不存在 → Create。
     // mcp-client 行与 systemPrompt/planMode 行由 mcp/prompts adapter 管理，此处跳过（避免重复写入覆盖）。
-    const targetLines = await ctx.target.patchFile.readPatchLines(USER_PATCH_FILE);
+    // 逐层读目标端：行自带的 file 决定比对哪一层（只读 home 层会让 profile 层行在目标机
+    // 已有同值时被误判成 Create，也会让目标机 profile 层的不同值判不出 Conflict）。
+    const targetLines = new Map<string, { lineId: string; raw: unknown }[]>();
+    for (const pl of data.patch) {
+      if (!targetLines.has(pl.file)) {
+        targetLines.set(pl.file, await ctx.target.patchFile.readPatchLines(pl.file));
+      }
+    }
     for (const pl of data.patch) {
       if (isManagedElsewhere(pl.raw)) continue;
-      const id = `patch:${pl.lineId}`;
-      const tl = targetLines.find((l) => l.lineId === pl.lineId);
+      // 层限定复合键：两层可存在同名 lineId，裸 lineId 无法指向「哪一层的哪一行」。
+      const ref = patchLayerKey(pl.file, pl.lineId);
+      const id = `patch:${ref}`;
+      const tl = targetLines.get(pl.file)?.find((l) => l.lineId === pl.lineId);
       if (!tl) {
         items.push({
           id, kind: 'Create', adapter: 'plugins',
           description: msg('adapter.patchLineCreate', { lineId: pl.lineId }), severity: 'info',
-          target: { adapter: 'plugins', ref: pl.lineId },
+          target: { adapter: 'plugins', ref },
         });
       } else if (isDeepStrictEqual(tl.raw, pl.raw)) {
         items.push({ id, kind: 'Skip', adapter: 'plugins', description: msg('adapter.patchLineSame', { lineId: pl.lineId }), severity: 'info' });
@@ -431,7 +444,7 @@ export class PluginsAdapter implements ConfigAdapter<PluginsSection> {
         items.push({
           id, kind: 'Conflict', adapter: 'plugins',
           description: msg('adapter.patchLineDiff', { lineId: pl.lineId }), severity: 'warning',
-          target: { adapter: 'plugins', ref: pl.lineId },
+          target: { adapter: 'plugins', ref },
         });
       }
     }
@@ -561,13 +574,16 @@ export class PluginsAdapter implements ConfigAdapter<PluginsSection> {
     // patch 行：Create → insert，Update/Conflict(useImported) → update
     const ref = item.target?.ref;
     if (!ref) return { ok: false, message: msg('adapter.missingTargetRef') };
+    // 复合键解析出层与 lineId：只按 lineId 查找会命中数组里先出现的 home 层行，
+    // 把 profile 层的行写进 home 层（回滚同理）。
+    const { file, lineId } = parsePatchLayerKey(ref);
     const data = ctx.sections.get('plugins') as PluginsSection | undefined;
-    const pl = data?.patch.find((p) => p.lineId === ref);
+    const pl = data?.patch.find((p) => p.file === file && p.lineId === lineId);
     if (!pl) return { ok: false, message: msg('adapter.patchMissing', { ref }) };
-    await ctx.target.patchFile.applyPatchChanges(pl.file, [
-      { lineId: ref, raw: pl.raw, action: item.kind === 'Create' ? 'insert' : 'update' },
+    await ctx.target.patchFile.applyPatchChanges(file, [
+      { lineId, raw: pl.raw, action: item.kind === 'Create' ? 'insert' : 'update' },
     ]);
-    return { ok: true, needsRestart: true, message: msg('adapter.patchWritten', { ref }) };
+    return { ok: true, needsRestart: true, message: msg('adapter.patchWritten', { ref: lineId }) };
   }
 
   async validate(data: PluginsSection, msg: MsgFunc = zhMsg): Promise<ValidationResult> {

package/src/adapters/prompts.ts

@@ -17,7 +17,7 @@ import type {
   ApplyResult, ConfigAdapter, ExportOptions, ExportSection, HostContext,
   ImportContext, PlanItem, ValidationResult,
 } from '../core/types.ts';
-import { USER_PATCH_FILE } from './plugins.ts';
+import { HOME_PATCH_FILE } from '../core/patch-layers.ts';
 
 /** 导出记录：PromptEntry 之外记录来源行名（导入需要重建行时使用） */
 export interface PromptExportEntry extends PromptEntry {
@@ -116,7 +116,7 @@ export class PromptsAdapter implements ConfigAdapter<PromptsExportSection> {
     const warnings: string[] = [];
     let lines: { lineId: string; raw: unknown }[] = [];
     try {
-      lines = await ctx.patchFile.readPatchLines(USER_PATCH_FILE);
+      lines = await ctx.patchFile.readPatchLines(HOME_PATCH_FILE);
     } catch (err) {
       warnings.push(msgOf(ctx)('adapter.patchReadFailedPrompts', { reason: err instanceof Error ? err.message : String(err) }));
     }
@@ -132,7 +132,7 @@ export class PromptsAdapter implements ConfigAdapter<PromptsExportSection> {
   async analyzeImport(data: PromptsExportSection, ctx: ImportContext): Promise<PlanItem[]> {
     const msg = ctx.msg;
     const items: PlanItem[] = [];
-    const targetLines = await ctx.target.patchFile.readPatchLines(USER_PATCH_FILE);
+    const targetLines = await ctx.target.patchFile.readPatchLines(HOME_PATCH_FILE);
     const targetPrompts = extractPrompts(targetLines);
     for (const p of data.prompts) {
       const id = p.id;
@@ -192,17 +192,17 @@ export class PromptsAdapter implements ConfigAdapter<PromptsExportSection> {
     // Create：目标无来源行 → 用记录的行名重建 patch 行（insert）
     if (item.kind === 'Create') {
       const raw = buildPromptLine(ref, prompt);
-      await ctx.target.patchFile.applyPatchChanges(USER_PATCH_FILE, [
+      await ctx.target.patchFile.applyPatchChanges(HOME_PATCH_FILE, [
         { lineId: ref, raw, action: 'insert' },
       ]);
       return { ok: true, needsRestart: true, message: msg('adapter.promptCreated', { name: prompt.name, ref }) };
     }
     // Update / Conflict(useImported)：合并进目标行 config
-    const lines = await ctx.target.patchFile.readPatchLines(USER_PATCH_FILE);
+    const lines = await ctx.target.patchFile.readPatchLines(HOME_PATCH_FILE);
     const line = lines.find((l) => l.lineId === ref);
     if (!line) return { ok: false, message: msg('adapter.patchLineMissing', { ref }) };
     const newRaw = mergePromptIntoLine(line.raw, prompt);
-    await ctx.target.patchFile.applyPatchChanges(USER_PATCH_FILE, [
+    await ctx.target.patchFile.applyPatchChanges(HOME_PATCH_FILE, [
       { lineId: ref, raw: newRaw, action: 'update' },
     ]);
     return { ok: true, needsRestart: true, message: msg('adapter.promptWritten', { name: prompt.name, ref }) };

package/src/adapters/test-helpers.ts

@@ -158,6 +158,46 @@ export class MemPatch implements PatchFileFacade {
   }
 }
 
+/**
+ * 分层 patch 门面 mock：patch 行按 `file`（层 token）分桶。
+ * 单层的 `MemPatch` 无法表达「同名 lineId 分布在两层」——而那正是层寻址契约的核心，
+ * 故另立一个按层键控的实现，供 plugins 适配器与快照/回滚的契约测试使用。
+ */
+export class MemLayeredPatch implements PatchFileFacade {
+  files = new Map<string, Map<string, { lineId: string; raw: unknown }>>();
+
+  /** 直接落一行（测试夹具；等价于目标机该层已存在该行）。 */
+  set(file: string, lineId: string, raw: unknown): void {
+    const layer = this.files.get(file) ?? new Map();
+    layer.set(lineId, { lineId, raw });
+    this.files.set(file, layer);
+  }
+
+  has(file: string, lineId: string): boolean {
+    return this.files.get(file)?.has(lineId) ?? false;
+  }
+
+  rawOf(file: string, lineId: string): unknown {
+    return this.files.get(file)?.get(lineId)?.raw;
+  }
+
+  async readPatchLines(file: string): Promise<{ lineId: string; raw: unknown }[]> {
+    return [...(this.files.get(file)?.values() ?? [])];
+  }
+
+  async applyPatchChanges(
+    file: string,
+    changes: { lineId: string; raw: unknown; action: 'insert' | 'update' | 'remove' }[],
+  ): Promise<void> {
+    const layer = this.files.get(file) ?? new Map<string, { lineId: string; raw: unknown }>();
+    this.files.set(file, layer);
+    for (const c of changes) {
+      if (c.action === 'remove') layer.delete(c.lineId);
+      else layer.set(c.lineId, { lineId: c.lineId, raw: c.raw });
+    }
+  }
+}
+
 export class MemSnapshotStore implements SnapshotStore {
   snapshots = new Map<string, Snapshot>();
   blobs = new Map<string, Uint8Array>();
@@ -203,6 +243,14 @@ export class MockHostContext implements HostContext {
     this.fs = new MemFs(homeDir);
     this.log = createLogger({ level: 'error', sink: () => {} });
   }
+
+  /** 换成按层键控的 patch 门面（层寻址契约测试用）。
+   *  字段的声明类型仍是单层的 MemPatch，以免既有夹具的 `.lines` 用法失型。 */
+  useLayeredPatch(): MemLayeredPatch {
+    const layered = new MemLayeredPatch();
+    this.patchFile = layered as unknown as MemPatch;
+    return layered;
+  }
 }
 
 export function makeContext(platform: string, homeDir: string, profile?: string): MockHostContext {

package/src/client/api.ts

@@ -4,19 +4,10 @@
  */
 import { zhUiT, type UiT } from '../ui/i18n.ts'
 
-/** Host 半健康检查响应（plugin 版本 / DSH 版本 / 平台，用于主页横幅与兼容性说明） */
+/** Host 半状态响应：设置页页脚版本行的两个字段（消费方只有 ConfigManagerSection） */
 export interface ServiceStatus {
-  ready: boolean
   pluginVersion: string
   dshVersion: string
-  platform: string
-  arch: string
-  homeDir?: string
-  profile?: string
-  profileManifestReadable?: boolean
-  installedPluginCount?: number
-  installedPluginNames?: string[]
-  bundles?: string[]
 }
 
 export const CONFIG_MANAGER_API = {

package/src/client/sync/sync-api.ts

@@ -30,7 +30,6 @@ import { zhUiT, type UiT } from '../../ui/i18n.ts';
 
 /** 同步端点常量（与 Host 半 src/index.ts API 常量保持一致） */
 export const SYNC_API = {
-  base: '/api/dsh-config-manager/sync',
   status: '/api/dsh-config-manager/sync/status',
   push: '/api/dsh-config-manager/sync/push',
   pull: '/api/dsh-config-manager/sync/pull',

package/src/core/backup.ts

@@ -9,6 +9,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import { parseJsonSafe } from '../utils/json.ts';
+import { parsePatchLayerKey } from './patch-layers.ts';
 import { sha256Hex } from '../utils/hashing.ts';
 import { normalizePath } from '../utils/paths.ts';
 import { atomicWriteFile } from '../utils/atomic-write.ts';
@@ -206,10 +207,11 @@ async function engineSnapshotEntry(ctx: HostContext, target: SnapshotTarget): Pr
           copiedTo: `blobs/${crypto.randomUUID()}`,
         };
       }
-      // patchLine：从组合 patch 文件读取原行（file 为必填的 file 字段约定为 'cordis.patch.yml'）
-      const file = 'cordis.patch.yml';
+      // patchLine：ref 是层限定复合键（<file>#<lineId>），据此到**对应层**读原行。
+      // 旧快照的裸 lineId 由 parsePatchLayerKey 兼容为 home 层。
+      const { file, lineId } = parsePatchLayerKey(target.ref);
       const lines = await ctx.patchFile.readPatchLines(file);
-      const line = lines.find((l) => l.lineId === target.ref);
+      const line = lines.find((l) => l.lineId === lineId);
       return { kind: 'patchLine', adapter: target.adapter, ref: target.ref, before: line?.raw ?? null, existed: line !== undefined };
     }
     case 'skills':

package/src/core/config-lifecycle.test.ts

@@ -474,7 +474,10 @@ test('自动快照端到端：真实变更 → 防抖到期 → 落盘一份 aut
   const metas = await h.lifecycle.list();
   assert.equal(metas[0]!.kind, 'auto');
   assert.equal(metas[0]!.trigger, 'watcher');
-  assert.equal(h.autoMetas.length, 1, '宿主回调必须被触发');
+  // 回调在 saveSnapshot 落盘**之后**才触发，所以「等文件出现」不等于「回调已跑」：
+  // 直接断言会在负载高时偶发失败。等回调本身，而不是等它的副作用。
+  const fired = await waitFor(async () => h.autoMetas.length === 1);
+  assert.equal(fired, true, '宿主回调必须被触发');
 });
 
 test('自动快照端到端：恢复自写文件是回声 → 不产生快照（否则会挡住重做）', async (t) => {

package/src/core/patch-layers.ts

@@ -0,0 +1,42 @@
+/**
+ * cordis patch 层的寻址契约（唯一真源）。
+ *
+ * 宿主组装 patch 栈的顺序是 `bundle → profile → home → --patch`（后者覆盖前者），两层分工不同：
+ *  - home 层 `$DSH_HOME/cordis.patch.yml`：全机偏好，对每个 profile 生效；
+ *  - profile 层 `$DSH_HOME/profiles/<profile>/cordis.patch.yml`：该 profile 专属（端口、trustedHosts、
+ *    挂载行…），换机恢复时必须跟着走。
+ *
+ * 两层的**持久化标识**是这里的两个逻辑 token，而不是相对路径：同步快照会跨机器、
+ * 跨 profile 导入，相对路径会把源机的 profile 名带过去。home 层 token 与历史快照里的
+ * `PatchLine.file` 取值逐字相同（存量快照零改动即可解析回 home 层）。
+ *
+ * 层限定复合键 `<file>#<lineId>`：两层可以存在同名 `lineId`，而计划项 id / `target.ref` /
+ * 快照条目必须唯一指向「哪一层的哪一行」，否则应用与回滚会写错层。两个 token 与 lineId 都不含
+ * `#`（后者由 `readPatchLines` 保证非空字符串，此处不额外校验），分隔符无歧义。
+ */
+
+/** home 层 token（`$DSH_HOME/cordis.patch.yml`）；取值与历史快照的 file 字段一致。 */
+export const HOME_PATCH_FILE = 'cordis.patch.yml';
+
+/** profile 层 token（`$DSH_HOME/profiles/<profile>/cordis.patch.yml`）。 */
+export const PROFILE_PATCH_FILE = 'profile:cordis.patch.yml';
+
+/** 层限定复合键的分隔符（两个层 token 与 lineId 都不含它）。 */
+const PATCH_LAYER_SEPARATOR = '#';
+
+/** 层限定复合键：`<file>#<lineId>`。 */
+export function patchLayerKey(file: string, lineId: string): string {
+  return `${file}${PATCH_LAYER_SEPARATOR}${lineId}`;
+}
+
+/**
+ * 解析层限定复合键。
+ *
+ * 兼容分支：旧快照的 `target.ref` / `SnapshotEntry.ref` 是裸 `lineId`（当时只有 home 层），
+ * 不含 `#` 即视作 home 层。lineId 本身不含 `#`，因此该分支无歧义。
+ */
+export function parsePatchLayerKey(ref: string): { file: string; lineId: string } {
+  const at = ref.indexOf(PATCH_LAYER_SEPARATOR);
+  if (at < 0) return { file: HOME_PATCH_FILE, lineId: ref };
+  return { file: ref.slice(0, at), lineId: ref.slice(at + 1) };
+}

package/src/core/rollback.ts

@@ -8,6 +8,7 @@
  *  - settings 回滚仍走 expectedRevision 乐观锁，避免覆盖导入后用户的新修改。
  */
 import { resolveFileTarget } from './backup.ts';
+import { parsePatchLayerKey } from './patch-layers.ts';
 import { msgOf } from './messages.ts';
 import type {
   ConfigAdapter, HostContext, RollbackReport, Snapshot, SnapshotEntry, SnapshotStore,
@@ -71,10 +72,9 @@ async function compensateOne(
     }
     case 'patchLine': {
       try {
-        // 引擎只管理 profile 的 cordis.patch.yml（backup.ts 的 patchLine 快照只记 lineId 作 ref，
-        // 不含文件编码）——回滚固定写回该文件；切勿把 lineId 当文件名（否则 patchPath 抛「仅支持管理」）。
-        const file = 'cordis.patch.yml';
-        const lineId = entry.ref;
+        // 快照条目的 ref 是层限定复合键（<file>#<lineId>）——必须写回**同一层**，
+        // 否则 profile 层的原值会被写进 home 层。旧快照的裸 lineId 兼容为 home 层。
+        const { file, lineId } = parsePatchLayerKey(entry.ref);
         await ctx.patchFile.applyPatchChanges(file, [
           { lineId, raw: entry.before, action: entry.before === null ? 'remove' : 'update' },
         ]);

package/src/index.facade.test.ts

@@ -10,11 +10,11 @@
  */
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
-import { DshPluginsFacade, ensureActivationRow } from './index.ts';
+import { DshPatchFileFacade, DshPluginsFacade, ensureActivationRow } from './index.ts';
 import { resolveProfileDir } from './core/plugin-cli.ts';
 import type { DshPluginResult } from './core/plugin-cli.ts';
 import type { PatchChange, PatchFileFacade } from './core/types.ts';
@@ -250,6 +250,29 @@ test('ensureActivationRow: bundle 包跳过（reconcile 已维护 bundles）', a
   }
 });
 
+test('ensureActivationRow: 非 bundle 插件补行落在 profile 层（home 层文件不受影响）', async () => {
+  const { homeDir, profileDir, cleanup } = makeTempProfile();
+  try {
+    writeInstalledPkg(profileDir, 'pkg-a', '1.0.0');
+    const patchFile = new DshPatchFileFacade(homeDir, 'web');
+    const homePatch = join(homeDir, 'cordis.patch.yml');
+    const profilePatch = join(profileDir, 'cordis.patch.yml');
+    writeFileSync(homePatch, '- id: home-line\n', 'utf8');
+    const homeBefore = readFileSync(homePatch, 'utf8');
+
+    await ensureActivationRow(patchFile, join(profileDir, 'node_modules', 'pkg-a'), 'pkg-a');
+
+    assert.match(
+      readFileSync(profilePatch, 'utf8'),
+      /id: pm-pkg-a/,
+      '激活行必须落在 profile 层（home 层对每个 profile 生效，会让只在 web 装过的插件污染其他 profile）',
+    );
+    assert.equal(readFileSync(homePatch, 'utf8'), homeBefore, 'home 层文件必须原样不变');
+  } finally {
+    cleanup();
+  }
+});
+
 test('ensureActivationRow: scope 包名 slug 形态正确（@scope/name → pm-scope-name）', async () => {
   const { profileDir, cleanup } = makeTempProfile();
   try {

package/src/index.ts

@@ -84,7 +84,7 @@ import { makeMsg, msgOf, zhMsg } from './core/messages.ts'
 import type { MsgFunc } from './core/messages.ts'
 import {
   cleanupAbortedInstall, hasDshBundlePatch, installErrorFor, installSpecFor, listInstalledPlugins,
-  resolveProfileDir, resolveProfileNameFromArgv, readProfileManifest, runDshPlugin, validateProfileName,
+  resolveProfileDir, resolveProfileNameFromArgv, runDshPlugin, validateProfileName,
 } from './core/plugin-cli.ts'
 import type {
   ConfigAdapter, CredentialsFacade, FileSystemFacade, HostContext, ImportDecisions,
@@ -92,7 +92,8 @@ import type {
   SettingsFacade, Snapshot, WorkspaceFacade,
 } from './core/types.ts'
 import { ImportNotConfirmedError, ImportUserSkippedError } from './core/types.ts'
-import { createAdapters, USER_PATCH_FILE } from './adapters/index.ts'
+import { createAdapters } from './adapters/index.ts'
+import { HOME_PATCH_FILE, PROFILE_PATCH_FILE } from './core/patch-layers.ts'
 import { createLocalPluginPackHook } from './core/local-plugin-host.ts'
 import { createEncryptionProvider, decryptCredentials, decryptArchive, SecurityError, encryptArchive, isArchiveBlob, verifyEncryptedBlob } from './security/index.ts'
 import { createHardenedZipParser } from './security/zip-security.ts'
@@ -156,7 +157,7 @@ export const name = 'config-manager'
 export const inject = ['settings', 'credentials']
 
 /** Plugin version, kept in sync with package.json ("version"). */
-const PLUGIN_VERSION = '0.1.60'
+const PLUGIN_VERSION = '0.1.61'
 
 /** Plugin own package name — excluded from its own exported plugins list. */
 const PLUGIN_NAME = 'dsh-config-manager'
@@ -220,6 +221,8 @@ export interface Config {
 
 /** Route family — must match the browser half's CONFIG_MANAGER_API exactly. */
 const API = {
+  // 设置页页脚版本行（pluginVersion / dshVersion）。只读，loopback fence。
+  status: '/api/dsh-config-manager/status',
   // P2-⑫：导出前只读预览（不落盘 ZIP；返回各分区 counts + 估算大小）
   // P1-⑧：快照管理（手动删除 + 置顶豁免自动清理）
   // m-backup-schedule：定时全量备份（读/存 backup-schedule.json + 立即执行一次）
@@ -644,12 +647,12 @@ class DshWorkspaceFacade implements WorkspaceFacade {
   }
 }
 
-/** Profile 目录内的 patch 文件（非 bundle 插件激活行写入处，marketplace 同款路径）。 */
-const PROFILE_PATCH_FILE = 'cordis.patch.yml'
-
 /** Patch-file facade：用户 patch 层（$DSH_HOME/cordis.patch.yml）+ profile patch 层
- * （$DSH_HOME/profiles/<name>/cordis.patch.yml），两者都在 home 根内。 */
-class DshPatchFileFacade implements PatchFileFacade {
+ * （$DSH_HOME/profiles/<name>/cordis.patch.yml），两者都在 home 根内。
+ *
+ * 导出仅为让测试能用**真实门面**（而非 mock）钉住层寻址——mock 会让两个层 token 的取值
+ * 撞车无处暴露（DshPluginsFacade 同款做法）。 */
+export class DshPatchFileFacade implements PatchFileFacade {
   private readonly homeDir: string
   private readonly profile: string
   private readonly msg: MsgFunc
@@ -661,9 +664,9 @@ class DshPatchFileFacade implements PatchFileFacade {
   }
 
   private patchPath(file: string): string {
-    if (file === USER_PATCH_FILE) return join(this.homeDir, USER_PATCH_FILE)
-    if (file === PROFILE_PATCH_FILE) return join(this.homeDir, 'profiles', this.profile, PROFILE_PATCH_FILE)
-    throw new Error(this.msg('host.patchUnsupported', { user: USER_PATCH_FILE, profile: PROFILE_PATCH_FILE, file }))
+    if (file === HOME_PATCH_FILE) return join(this.homeDir, HOME_PATCH_FILE)
+    if (file === PROFILE_PATCH_FILE) return join(this.homeDir, 'profiles', this.profile, HOME_PATCH_FILE)
+    throw new Error(this.msg('host.patchUnsupported', { user: HOME_PATCH_FILE, profile: PROFILE_PATCH_FILE, file }))
   }
 
   async readPatchLines(file: string): Promise<{ lineId: string; raw: unknown }[]> {
@@ -1423,44 +1426,6 @@ export function isGitHubAuthMissing(error: unknown): boolean {
   return error instanceof GitHubAuthError && (error.code === 'unauthorized' || error.code === 'no_token')
 }
 
-/** /status 的插件诊断位（issue #28）。仅回非敏感元信息：目录、profile 名、计数。 */
-export interface PluginDiagnostics {
-  homeDir: string
-  profile: string
-  /** profile 目录的 package.json 是否可读（不可读 → 清单必然为空） */
-  profileManifestReadable: boolean
-  /** 插件清单来源 = package.json 的 dependencies 里非 in-box 的包 */
-  installedPluginCount: number
-  installedPluginNames: string[]
-  /** dsh.profile.bundles 声明（非空即「替换默认插件栈」） */
-  bundles: string[]
-}
-
-/**
- * 读取插件诊断信息（issue #28）：把「插件到底读了哪个目录 / 哪个 profile / 看到什么」变成
- * 用户可自查的数据——此前只存在于宿主内部，导致「装了插件却识别不到」无从定位。
- * best-effort：失败不抛出（诊断位缺失不应拖垮 /status）。
- */
-async function readPluginDiagnostics(host: HostContext): Promise<Partial<PluginDiagnostics>> {
-  try {
-    const profileDir = resolveProfileDir(host.homeDir, host.profile ?? 'web')
-    const manifest = readProfileManifest(profileDir)
-    const installed = await host.plugins.listInstalled()
-    const bundles = manifest?.dsh?.profile?.bundles
-    return {
-      homeDir: host.homeDir,
-      profile: host.profile ?? 'web',
-      profileManifestReadable: manifest !== null,
-      installedPluginCount: installed.length,
-      installedPluginNames: installed.map((p) => p.name),
-      bundles: Array.isArray(bundles) ? bundles : [],
-    }
-  } catch (err) {
-    host.log.warn(`plugin diagnostics unavailable: ${err instanceof Error ? err.message : String(err)}`)
-    return {}
-  }
-}
-
 /** Build the /api/dsh-config-manager route family. */
 function makeRoutes(deps: RoutesDeps): { routes: WebRoute[]; scheduler: AutoSyncScheduler; makeSyncEngine: (cfg: SyncConfig) => SyncEngine; lifecycle: ConfigLifecycle } {
   const { host, adapters, exportsDir, tmpDir, snapshotsDir, runs, syncDir, dataDir, credentials, githubClientId, githubClientSecret, history } = deps
@@ -1856,6 +1821,18 @@ function makeRoutes(deps: RoutesDeps): { routes: WebRoute[]; scheduler: AutoSync
 
   const routesList: WebRoute[] = [
     // ------------------------------------------------------------- status
+    // 设置页页脚版本行：插件版本 + DSH 版本。只读、无 secret，loopback fence。
+    {
+      kind: 'exact',
+      path: API.status,
+      handler: async (req, res) => {
+        if (!guard(req, res, 'GET')) return
+        writeJson(res, 200, {
+          pluginVersion: PLUGIN_VERSION,
+          dshVersion: host.dshVersion,
+        })
+      },
+    },
     // ------------------------------------------------------------- export
     // ---------------------------------------------------- export-preview
     // P2-⑫：导出前只读预览（不落盘 ZIP）：对选中分区逐个 adapter.export 收集 counts

package/src/utils/env-lock.test.ts

@@ -22,6 +22,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import {
   EnvironmentLockManager,
   EnvironmentLockIOError,
+  parseLinuxProcStartTime,
   EnvironmentLockOwnedByAnotherError,
   EnvironmentLockUnavailableError,
   runWithMutationLock,
@@ -281,6 +282,34 @@ process.exit(1); // 期望被拒：非 0 指示「未获得锁」；父进程根
   await parent.release(pres.token!);
 });
 
+test('parseLinuxProcStartTime：取字段 22（starttime），不得取字段 24（rss）', () => {
+  // 真实 /proc/<pid>/stat 形状；comm 含空格与括号（按最后一个 ')' 切片才正确）。
+  // 字段：pid (comm) state ppid pgrp session tty_nr tpgid flags minflt cminflt majflt
+  //       cmajflt utime stime cutime cstime priority nice num_threads itrealvalue
+  //       starttime vsize rss ...
+  const line =
+    '12345 (node (worker)) S 1 12345 12345 0 -1 4194560 1000 0 0 0 5 3 0 0 20 0 11 0 999999 123456789 456 ' +
+    '18446744073709551615 1 1 0 0 0 0 0 0 0 0 0 0 17 0 0 0 0 0 0';
+  assert.equal(
+    parseLinuxProcStartTime(line),
+    '999999',
+    'starttime 是字段 22；切片后 index 0 = 字段 3，故 index = 22-3 = 19。' +
+      '取 index 21 会得到字段 24（rss）—— 该值随进程内存占用变化，' +
+      '会让同一进程的两次读取得到不同身份，被误判为 PID 复用（STALE_LOCK_DETECTED）。',
+  );
+});
+
+test('parseLinuxProcStartTime：comm 含 ")" 时仍取最后一个 ")" 之后的字段', () => {
+  const line = '7 (a)b)c) R 1 7 7 0 -1 0 0 0 0 0 0 0 0 0 20 0 1 0 424242 100 200';
+  assert.equal(parseLinuxProcStartTime(line), '424242');
+});
+
+test('parseLinuxProcStartTime：畸形输入返回 null（不得抛出，也不得编造身份）', () => {
+  assert.equal(parseLinuxProcStartTime(''), null);
+  assert.equal(parseLinuxProcStartTime('no-parens-here'), null);
+  assert.equal(parseLinuxProcStartTime('1 (x) S'), null, '字段不足 → null');
+});
+
 test('§11.1-c4 release：close→unlink；unlink 失败抛 EnvironmentLockIOError 且保留 activeToken（可重试）', async (t) => {
   const locksDir = tmp(t);
   const ctl = makeIo();