@logictan/dsh-config-manager 0.1.60 → 0.1.62

package/lib/index.js

@@ -20,8 +20,8 @@
  *    (isLoopbackRequest); LAN-exposed deployments never serve these endpoints;
  *  - uploads/exported ZIPs are staged under $DSH_HOME/dsh-config-manager/{tmp,exports}
  *    and every `path`/`zipPath` reference is confined to those roots;
- *  - the encryption password is in-memory only: used to derive the AES-256-GCM
- *    key for secrets.enc, never written to any file, manifest, or log;
+ *  - there is no encryption layer: every backup is plaintext, and secret values are
+ *    stripped by the secret scanner before they reach any file, manifest, or log;
  *  - the import execute endpoint refuses to run without `confirm: true`
  *    (core ImportNotConfirmedError safety valve).
  *
@@ -65,11 +65,11 @@ import { registerModelTools } from './core/model-tools.js';
 import { computeConsultReport } from './core/migration-consult.js';
 import { readExportZipSource, buildLocalSnapshotSource, buildProfileSource } from './core/consult-source.js';
 import { makeMsg, msgOf, zhMsg } from './core/messages.js';
-import { cleanupAbortedInstall, hasDshBundlePatch, installErrorFor, installSpecFor, listInstalledPlugins, resolveProfileDir, resolveProfileNameFromArgv, readProfileManifest, runDshPlugin, validateProfileName, } from './core/plugin-cli.js';
+import { cleanupAbortedInstall, hasDshBundlePatch, installErrorFor, installSpecFor, listInstalledPlugins, resolveProfileDir, resolveProfileNameFromArgv, runDshPlugin, validateProfileName, } from './core/plugin-cli.js';
 import { ImportNotConfirmedError, ImportUserSkippedError } from './core/types.js';
-import { createAdapters, USER_PATCH_FILE } from './adapters/index.js';
+import { createAdapters } from './adapters/index.js';
+import { HOME_PATCH_FILE, PROFILE_PATCH_FILE } from './core/patch-layers.js';
 import { createLocalPluginPackHook } from './core/local-plugin-host.js';
-import { createEncryptionProvider, decryptCredentials, decryptArchive, SecurityError, encryptArchive, isArchiveBlob, verifyEncryptedBlob } from './security/index.js';
 import { createHardenedZipParser } from './security/zip-security.js';
 import { atomicCopyFile, atomicWriteFile } from './utils/atomic-write.js';
 import { EnvironmentLockManager, runWithMutationLock, EnvironmentLockUnavailableError } from './utils/env-lock.js';
@@ -93,10 +93,9 @@ import { readUiPrefs, updateUiPrefs } from './sync/ui-prefs.js';
 import { redact } from './security/redaction.js';
 import { createConfiguredSecretScanner } from './security/secret-scanner.js';
 import { sha256Hex } from './utils/hashing.js';
-import { MANIFEST_FILE, parseManifest } from './schema/manifest.js';
 import { isFileSection, SECTION_IDS } from './schema/config.js';
 import { stringifyJsonSafe } from './utils/json.js';
-import { parseZip, zipToBuffer } from './utils/zip.js';
+import { zipToBuffer } from './utils/zip.js';
 import { isSameOrChild, normalizePath } from './utils/paths.js';
 import { createLogger } from './utils/logger.js';
 /* ---------------------------------------------------------------- identity */
@@ -105,7 +104,7 @@ export const name = 'config-manager';
 /** Services required before the engine can mount (present in every profile). */
 export const inject = ['settings', 'credentials'];
 /** Plugin version, kept in sync with package.json ("version"). */
-const PLUGIN_VERSION = '0.1.60';
+const PLUGIN_VERSION = '0.1.62';
 /** Plugin own package name — excluded from its own exported plugins list. */
 const PLUGIN_NAME = 'dsh-config-manager';
 /**
@@ -126,6 +125,8 @@ export const DEFAULT_GITHUB_CLIENT_ID = 'Ov23liq4i7n8UsylGRfb';
 /* ---------------------------------------------------------------- constants */
 /** Route family — must match the browser half's CONFIG_MANAGER_API exactly. */
 const API = {
+    // 设置页页脚版本行（pluginVersion / dshVersion）。只读，loopback fence。
+    status: '/api/dsh-config-manager/status',
     // P2-⑫：导出前只读预览（不落盘 ZIP；返回各分区 counts + 估算大小）
     // P1-⑧：快照管理（手动删除 + 置顶豁免自动清理）
     // m-backup-schedule：定时全量备份（读/存 backup-schedule.json + 立即执行一次）
@@ -520,11 +521,12 @@ class DshWorkspaceFacade {
         await registry.delete(id);
     }
 }
-/** Profile 目录内的 patch 文件（非 bundle 插件激活行写入处，marketplace 同款路径）。 */
-const PROFILE_PATCH_FILE = 'cordis.patch.yml';
 /** Patch-file facade：用户 patch 层（$DSH_HOME/cordis.patch.yml）+ profile patch 层
- * （$DSH_HOME/profiles/<name>/cordis.patch.yml），两者都在 home 根内。 */
-class DshPatchFileFacade {
+ * （$DSH_HOME/profiles/<name>/cordis.patch.yml），两者都在 home 根内。
+ *
+ * 导出仅为让测试能用**真实门面**（而非 mock）钉住层寻址——mock 会让两个层 token 的取值
+ * 撞车无处暴露（DshPluginsFacade 同款做法）。 */
+export class DshPatchFileFacade {
     homeDir;
     profile;
     msg;
@@ -534,11 +536,11 @@ class DshPatchFileFacade {
         this.msg = msg;
     }
     patchPath(file) {
-        if (file === USER_PATCH_FILE)
-            return join(this.homeDir, USER_PATCH_FILE);
+        if (file === HOME_PATCH_FILE)
+            return join(this.homeDir, HOME_PATCH_FILE);
         if (file === PROFILE_PATCH_FILE)
-            return join(this.homeDir, 'profiles', this.profile, PROFILE_PATCH_FILE);
-        throw new Error(this.msg('host.patchUnsupported', { user: USER_PATCH_FILE, profile: PROFILE_PATCH_FILE, file }));
+            return join(this.homeDir, 'profiles', this.profile, HOME_PATCH_FILE);
+        throw new Error(this.msg('host.patchUnsupported', { user: HOME_PATCH_FILE, profile: PROFILE_PATCH_FILE, file }));
     }
     async readPatchLines(file) {
         const p = this.patchPath(file);
@@ -781,50 +783,6 @@ async function withTimeout(promise, ms, message) {
             clearTimeout(timer);
     }
 }
-/** Decrypt an encrypted backup's credentials (in-memory only; undefined when not applicable). */
-async function tryDecryptCredentials(zipPath, password) {
-    if (password === undefined || password === '')
-        return undefined;
-    const raw = await fs.readFile(zipPath);
-    const archive = parseZip(raw);
-    if (!archive.has(MANIFEST_FILE))
-        return undefined;
-    let manifest;
-    try {
-        manifest = parseManifest(archive.readEntryText(MANIFEST_FILE));
-    }
-    catch {
-        return undefined;
-    }
-    if (!manifest.security.encrypted || manifest.security.encryption === null)
-        return undefined;
-    if (!archive.has('security/secrets.enc'))
-        return undefined;
-    const blob = archive.readEntry('security/secrets.enc');
-    const plaintext = await decryptCredentials(blob, manifest.security.encryption, password);
-    let parsed;
-    try {
-        parsed = yaml.load(plaintext);
-    }
-    catch {
-        return undefined;
-    }
-    const map = new Map();
-    if (parsed !== null && typeof parsed === 'object') {
-        for (const [k, v] of Object.entries(parsed)) {
-            if (typeof v === 'string' && v !== '')
-                map.set(k, v);
-        }
-    }
-    return map;
-}
-/** 解密错误 → 用户可读文本：BAD_PASSWORD 只报「密码错误」（不泄内部细节），其余原文 */
-function decryptErrorText(error, msg) {
-    if (error instanceof SecurityError && error.code === 'BAD_PASSWORD') {
-        return msg('import.encryptedPasswordWrong');
-    }
-    return error instanceof Error ? error.message : String(error);
-}
 /* -------------------------------------------------- sync 路由（m-sync-ui） */
 /** 同步路由可预期的请求级错误（status 缺省 400；引擎/传输失败走 500） */
 export class SyncRouteError extends Error {
@@ -1199,31 +1157,6 @@ function parseMeForm(raw) {
 export function isGitHubAuthMissing(error) {
     return error instanceof GitHubAuthError && (error.code === 'unauthorized' || error.code === 'no_token');
 }
-/**
- * 读取插件诊断信息（issue #28）：把「插件到底读了哪个目录 / 哪个 profile / 看到什么」变成
- * 用户可自查的数据——此前只存在于宿主内部，导致「装了插件却识别不到」无从定位。
- * best-effort：失败不抛出（诊断位缺失不应拖垮 /status）。
- */
-async function readPluginDiagnostics(host) {
-    try {
-        const profileDir = resolveProfileDir(host.homeDir, host.profile ?? 'web');
-        const manifest = readProfileManifest(profileDir);
-        const installed = await host.plugins.listInstalled();
-        const bundles = manifest?.dsh?.profile?.bundles;
-        return {
-            homeDir: host.homeDir,
-            profile: host.profile ?? 'web',
-            profileManifestReadable: manifest !== null,
-            installedPluginCount: installed.length,
-            installedPluginNames: installed.map((p) => p.name),
-            bundles: Array.isArray(bundles) ? bundles : [],
-        };
-    }
-    catch (err) {
-        host.log.warn(`plugin diagnostics unavailable: ${err instanceof Error ? err.message : String(err)}`);
-        return {};
-    }
-}
 /** Build the /api/dsh-config-manager route family. */
 function makeRoutes(deps) {
     const { host, adapters, exportsDir, tmpDir, snapshotsDir, runs, syncDir, dataDir, credentials, githubClientId, githubClientSecret, history } = deps;
@@ -1605,6 +1538,19 @@ function makeRoutes(deps) {
     });
     const routesList = [
         // ------------------------------------------------------------- status
+        // 设置页页脚版本行：插件版本 + DSH 版本。只读、无 secret，loopback fence。
+        {
+            kind: 'exact',
+            path: API.status,
+            handler: async (req, res) => {
+                if (!guard(req, res, 'GET'))
+                    return;
+                writeJson(res, 200, {
+                    pluginVersion: PLUGIN_VERSION,
+                    dshVersion: host.dshVersion,
+                });
+            },
+        },
         // ------------------------------------------------------------- export
         // ---------------------------------------------------- export-preview
         // P2-⑫：导出前只读预览（不落盘 ZIP）：对选中分区逐个 adapter.export 收集 counts
@@ -1612,13 +1558,6 @@ function makeRoutes(deps) {
         // 零写入；loopback fence 必备。
         // ------------------------------------------------------------ download
         // -------------------------------------------------------------- upload
-        // ------------------------------------------------------ decrypt-archive
-        // 整体加密备份容器的解锁（只读，零写入到任何配置）：用备份密码解密上传的加密容器，
-        // 得到明文 ZIP 写入受控临时目录并返回新 zipPath，供 analyze/plan/execute 引用。
-        // 导出时容器密码与内部 secrets.enc 密码同源（同一 password 派生两层加密），
-        // 因此顺带在明文 ZIP 上解出内部凭据覆盖清单（refs，非值）一并返回——
-        // 导入全程只需输入这一次密码，无需第二个密码校验页面。
-        // 密码仅内存随请求体传入，绝不落盘/落日志；解出的明文 ZIP 亦为临时文件，导入结束后清理。
         // ------------------------------------------------------------- analyze
         // ---------------------------------------------------------------- plan
         // ------------------------------------------------------------ progress

package/lib/security/index.d.ts

@@ -1,16 +1,14 @@
 /**
  * 安全模块公共出口（m4-security）：
- *  secret-scanner / encryption / integrity / zip-security / redaction。
+ *  secret-scanner / integrity / zip-security / redaction。
  *
  * 与 core 的注入点对齐：
  *  - `createSecretScanner()`        → ExporterOptions.scanner（SecretScanner 契约）
- *  - `createEncryptionProvider(pw)` → ExporterOptions.encryption（EncryptionProvider 契约）
  *  - `createHardenedZipParser()`    → ImporterOptions.parseZipOverride（(buf, limits?) => ZipArchive）
  *  - `safeExtractHardened()`        → m5 导入文件类分区落盘通道
  *  - `verifyChecksumsJson()`        → 完整性校验通道（core analyzer 已有内置校验，本模块供独立调用）
  */
 export * from './secret-scanner.ts';
-export * from './encryption.ts';
 export * from './integrity.ts';
 export * from './zip-security.ts';
 export * from './redaction.ts';

package/lib/security/index.js

@@ -1,16 +1,14 @@
 /**
  * 安全模块公共出口（m4-security）：
- *  secret-scanner / encryption / integrity / zip-security / redaction。
+ *  secret-scanner / integrity / zip-security / redaction。
  *
  * 与 core 的注入点对齐：
  *  - `createSecretScanner()`        → ExporterOptions.scanner（SecretScanner 契约）
- *  - `createEncryptionProvider(pw)` → ExporterOptions.encryption（EncryptionProvider 契约）
  *  - `createHardenedZipParser()`    → ImporterOptions.parseZipOverride（(buf, limits?) => ZipArchive）
  *  - `safeExtractHardened()`        → m5 导入文件类分区落盘通道
  *  - `verifyChecksumsJson()`        → 完整性校验通道（core analyzer 已有内置校验，本模块供独立调用）
  */
 export * from './secret-scanner.js';
-export * from './encryption.js';
 export * from './integrity.js';
 export * from './zip-security.js';
 export * from './redaction.js';

package/lib/sync/transport.d.ts

@@ -29,9 +29,9 @@ export interface SyncSnapshotMeta {
 /** 加密快照的 sections 载荷：整个明文 sections 对象序列化后整体加密（AES-256-GCM）。 */
 export interface EncryptedSections {
     encrypted: {
-        /** 加密参数（salt/iv/authTag base64；与 security/encryption.ts 的 EncryptionInfo 对齐） */
+        /** 加密参数（salt/iv/authTag base64）；本插件已不生成，仅供读取历史快照 */
         info: EncryptionInfo;
-        /** base64：带 DSC1 头的密文（明文 = 序列化的 sections Record） */
+        /** base64 密文（明文 = 序列化的 sections Record） */
         data: string;
     };
 }

package/lib/sync/transport.js

@@ -21,7 +21,7 @@ export function sectionsEqual(remote, local) {
     const r = remote.sections;
     const l = local.sections;
     if (Object.keys(l).length === 0)
-        return false; // 本地为空（加密快照）→ 无法比较
+        return false; // 本地无分区（空快照）→ 无法比较
     if (Object.keys(r).length !== Object.keys(l).length)
         return false;
     for (const key of Object.keys(r)) {

package/lib/ui/i18n.d.ts

@@ -35,11 +35,9 @@ export declare const uiZh: {
     readonly 'report.security': '安全：';
     readonly 'report.apiKeysExcluded': 'API 密钥已排除：';
     readonly 'report.containsSecrets': '包含密钥：';
-    readonly 'report.encrypted': '已加密：';
     readonly 'report.redacted': '{count} 个敏感字段已脱敏';
     readonly 'report.file': '文件：';
     readonly 'report.yes': '是';
-    readonly 'report.yesEncrypted': '是（加密）';
     readonly 'report.no': '否';
     readonly 'report.importedRestored': '已导入/恢复';
     readonly 'report.skipped': '跳过';
@@ -151,7 +149,6 @@ export declare const uiZh: {
     readonly 'sync.pushOk': '推送成功（快照 {id}）';
     readonly 'sync.pushPreviewHeadline': '将推送 {total} 个分区（{changed} 个有变化）';
     readonly 'sync.pushPreviewHint': '以上为只读预览，不会写入远端。确认后点击「推送」才真正上传。';
-    readonly 'sync.pushPreviewEncrypted': '加密快照：载荷将整体加密，各分区相对基线的变化不可比对。';
     readonly 'sync.pullFailed': '拉取失败';
     readonly 'sync.pullOk': '远端快照 {id} 差异预览：共 {count} 项变更';
     readonly 'sync.pullEmpty': '远端快照与本地一致（无变更）';

package/lib/ui/i18n.js

@@ -38,11 +38,9 @@ export const uiZh = {
     'report.security': '安全：',
     'report.apiKeysExcluded': 'API 密钥已排除：',
     'report.containsSecrets': '包含密钥：',
-    'report.encrypted': '已加密：',
     'report.redacted': '{count} 个敏感字段已脱敏',
     'report.file': '文件：',
     'report.yes': '是',
-    'report.yesEncrypted': '是（加密）',
     'report.no': '否',
     'report.importedRestored': '已导入/恢复',
     'report.skipped': '跳过',
@@ -158,7 +156,6 @@ export const uiZh = {
     'sync.pushOk': '推送成功（快照 {id}）',
     'sync.pushPreviewHeadline': '将推送 {total} 个分区（{changed} 个有变化）',
     'sync.pushPreviewHint': '以上为只读预览，不会写入远端。确认后点击「推送」才真正上传。',
-    'sync.pushPreviewEncrypted': '加密快照：载荷将整体加密，各分区相对基线的变化不可比对。',
     'sync.pullFailed': '拉取失败',
     'sync.pullOk': '远端快照 {id} 差异预览：共 {count} 项变更',
     'sync.pullEmpty': '远端快照与本地一致（无变更）',
@@ -320,11 +317,9 @@ export const uiEn = {
     'report.security': 'Security:',
     'report.apiKeysExcluded': 'API Keys excluded:',
     'report.containsSecrets': 'Contains secrets:',
-    'report.encrypted': 'Encrypted:',
     'report.redacted': '{count} sensitive field(s) redacted',
     'report.file': 'File:',
     'report.yes': 'yes',
-    'report.yesEncrypted': 'yes (encrypted)',
     'report.no': 'no',
     'report.importedRestored': 'imported/restored',
     'report.skipped': 'skipped',
@@ -436,7 +431,6 @@ export const uiEn = {
     'sync.pushOk': 'Push succeeded (snapshot {id})',
     'sync.pushPreviewHeadline': 'Will push {total} section(s) ({changed} changed)',
     'sync.pushPreviewHint': 'Read-only preview above — nothing is written to the remote. Click "Push" to actually upload.',
-    'sync.pushPreviewEncrypted': 'Encrypted snapshot: the payload is encrypted as a whole; per-section changes vs the baseline cannot be compared.',
     'sync.pullFailed': 'Pull failed',
     'sync.pullOk': 'Remote snapshot {id} diff preview: {count} change(s)',
     'sync.pullEmpty': 'Remote snapshot matches local (no changes)',

package/lib/ui/report.js

@@ -18,8 +18,7 @@ export function renderExportReport(report, t = zhUiT) {
     }
     lines.push(t('report.security'));
     lines.push(`  ✓ ${t('report.apiKeysExcluded')} ${report.security.secretsExcluded ? t('report.yes') : t('report.no')}`);
-    lines.push(`  ✓ ${t('report.containsSecrets')} ${report.security.containsSecrets ? t('report.yesEncrypted') : t('report.no')}`);
-    lines.push(`  ✓ ${t('report.encrypted')} ${report.security.encrypted ? t('report.yes') : t('report.no')}`);
+    lines.push(`  ✓ ${t('report.containsSecrets')} ${report.security.containsSecrets ? t('report.yes') : t('report.no')}`);
     if (report.security.redactedHits > 0)
         lines.push(`  ⚠ ${t('report.redacted', { count: String(report.security.redactedHits) })}`);
     lines.push('');

package/lib/ui/test-helpers.d.ts

@@ -46,7 +46,6 @@ export declare class MockImportPort implements ImportPort {
         confirm: boolean;
         secretInputs?: Record<string, string>;
         rollbackOnError: boolean;
-        decryptPassword?: string;
         plan?: ImportPlan;
     }[];
     constructor(opts?: {
@@ -56,14 +55,9 @@ export declare class MockImportPort implements ImportPort {
     });
     analyzeImport(): Promise<ImportAnalysis>;
     createImportPlan(_zip: string, decisions: ImportDecisions): Promise<ImportPlan>;
-    decryptArchive(zipPath: string): Promise<{
-        zipPath: string;
-        refs: string[];
-    }>;
     executeImportPlan(_zip: string, plan: ImportPlan, opts: {
         confirm: boolean;
         secretInputs?: Record<string, string>;
         rollbackOnError: boolean;
-        decryptPassword?: string;
     }): Promise<ImportResult>;
 }

package/lib/ui/test-helpers.js

@@ -20,7 +20,7 @@ export function makeExportReport(overrides = {}) {
             { section: 'plugins', counts: { plugins: 8 } },
         ],
         excluded: ['sessions', 'pluginFiles'],
-        security: { secretsExcluded: true, containsSecrets: false, encrypted: false, redactedHits: 2 },
+        security: { secretsExcluded: true, containsSecrets: false, redactedHits: 2 },
         file: { name: 'dsh-config-2026-08-14.zip', sizeBytes: 20480 },
         warnings: [],
         ...overrides,
@@ -142,10 +142,6 @@ export class MockImportPort {
         this.planCalls.push(decisions);
         return this.plan;
     }
-    async decryptArchive(zipPath) {
-        // 测试用：把传入路径视为已解锁的明文 ZIP（不真正解密），无内部凭据
-        return { zipPath, refs: [] };
-    }
     async executeImportPlan(_zip, plan, opts) {
         this.executeCalls.push({ ...opts, plan });
         return this.result;

package/lib/ui/types.d.ts

@@ -118,25 +118,12 @@ export interface RollbackView {
 export interface ImportPort {
     analyzeImport(zipPath: string): Promise<ImportAnalysis>;
     createImportPlan(zipPath: string, decisions: ImportDecisions): Promise<ImportPlan>;
-    /**
-     * 解锁整体加密备份（只读，零写入）：用备份密码解密上传的加密容器，得到明文 ZIP
-     * 写入受控临时目录并返回新的 zipPath，供 analyze/plan/execute 引用。
-     * 顺带返回解密覆盖的凭据 ref 名（非值）——导出时容器密码与内部 secrets.enc
-     * 密码同源，解锁即完成凭据解密验证，无需第二次密码校验。
-     * 密码仅内存，绝不落盘/落日志；解密后的明文 ZIP 亦为临时文件，导入结束后清理。
-     */
-    decryptArchive(zipPath: string, password: string): Promise<{
-        zipPath: string;
-        refs: string[];
-    }>;
     executeImportPlan(zipPath: string, plan: ImportPlan, opts: {
         /** 用户确认（安全阀，非 true 拒绝执行） */
         confirm: boolean;
         secretInputs?: Record<string, string>;
         /** 显式回滚策略：true=任一项失败整体回滚（场景 E）；false=单项失败继续（§34.17） */
         rollbackOnError: boolean;
-        /** 加密备份的解密密码（仅内存；core 拒绝加密备份无密码执行） */
-        decryptPassword?: string;
     }): Promise<ImportResult>;
 }
 /** 选项构造辅助：从 PlanItem 提取稳定决策键（与 core analyzer.applyItemResolution 的 id 语义一致） */

package/lib/utils/env-lock.d.ts

@@ -222,6 +222,22 @@ export interface EnvLockManagerOptions {
     /** heartbeat 续期写失败回调（留痕；不中断 mutation） */
     onHeartbeatWriteFailure?: (err: unknown) => void;
 }
+/**
+ * 从 /proc/<pid>/stat 文本提取进程创建身份（starttime，字段 22）。
+ *
+ * 字段布局（man 5 proc_pid_stat）：1 pid, 2 comm, 3 state, …, 22 starttime, 23 vsize, 24 rss。
+ * comm 可能含空格与括号，故必须按**最后一个** ')' 切片；切片后 index 0 对应字段 3，
+ * 于是字段 N 的索引是 N-3 —— **starttime 的索引是 19**。
+ *
+ * 历史缺陷：此处曾取 index 21（= 字段 24 rss）。rss 随进程内存占用变化，
+ * 使同一进程的两次读取得到不同身份，被误判为「PID 复用」→ STALE_LOCK_DETECTED，
+ * 进而可能让 recoverStaleLock() 捕获一个**仍存活**的持有者的锁。
+ * 该路径仅在 Linux 生效（macOS/Windows 无 /proc），故只在 Linux CI 上暴露。
+ *
+ * @param statText /proc/<pid>/stat 全文
+ * @returns starttime 字符串；畸形/字段不足 → null（不抛错，也不编造身份）
+ */
+export declare function parseLinuxProcStartTime(statText: string): string | null;
 /**
  * EnvironmentLockManager：跨进程环境锁管理器。
  *

package/lib/utils/env-lock.js

@@ -153,16 +153,37 @@ function defaultIo() {
         } },
     };
 }
+/**
+ * 从 /proc/<pid>/stat 文本提取进程创建身份（starttime，字段 22）。
+ *
+ * 字段布局（man 5 proc_pid_stat）：1 pid, 2 comm, 3 state, …, 22 starttime, 23 vsize, 24 rss。
+ * comm 可能含空格与括号，故必须按**最后一个** ')' 切片；切片后 index 0 对应字段 3，
+ * 于是字段 N 的索引是 N-3 —— **starttime 的索引是 19**。
+ *
+ * 历史缺陷：此处曾取 index 21（= 字段 24 rss）。rss 随进程内存占用变化，
+ * 使同一进程的两次读取得到不同身份，被误判为「PID 复用」→ STALE_LOCK_DETECTED，
+ * 进而可能让 recoverStaleLock() 捕获一个**仍存活**的持有者的锁。
+ * 该路径仅在 Linux 生效（macOS/Windows 无 /proc），故只在 Linux CI 上暴露。
+ *
+ * @param statText /proc/<pid>/stat 全文
+ * @returns starttime 字符串；畸形/字段不足 → null（不抛错，也不编造身份）
+ */
+export function parseLinuxProcStartTime(statText) {
+    const close = statText.lastIndexOf(')');
+    if (close < 0)
+        return null;
+    const fields = statText.slice(close + 1).trim().split(/\s+/);
+    const starttime = fields[19];
+    return typeof starttime === 'string' && starttime !== '' ? starttime : null;
+}
 /** 默认进程探测（跨平台 best-effort；OS identity 能力由平台决定） */
 function defaultProbe() {
     const selfOsIdentity = (() => {
         try {
             if (process.platform === 'linux') {
-                // /proc/<pid>/stat 第 22 字段 = starttime（tick 数）
                 const l = fssync.readFileSync(`/proc/${process.pid}/stat`, 'utf8').toString();
-                const afterComm = l.slice(l.lastIndexOf(')') + 1).trim().split(/\s+/);
-                // 格式: state ppid ... starttime：comm 后第一字段是 state，starttime 是第 22 个（index 21 起）
-                return `linux:${afterComm[21] ?? 'unknown'}`;
+                const starttime = parseLinuxProcStartTime(l);
+                return starttime === null ? null : `linux:${starttime}`;
             }
             if (process.platform === 'darwin')
                 return `darwin:${process.pid}:${Date.now()}`; // 不可靠 → 保守返回占位
@@ -213,8 +234,8 @@ function defaultProbe() {
             if (process.platform === 'linux') {
                 try {
                     const l = fssync.readFileSync(`/proc/${pid}/stat`, 'utf8').toString();
-                    const afterComm = l.slice(l.lastIndexOf(')') + 1).trim().split(/\s+/);
-                    osIdentity = `linux:${afterComm[21] ?? 'unknown'}`;
+                    const starttime = parseLinuxProcStartTime(l);
+                    osIdentity = starttime === null ? null : `linux:${starttime}`;
                 }
                 catch {
                     osIdentity = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logictan/dsh-config-manager",
-  "version": "0.1.60",
+  "version": "0.1.62",
   "license": "MIT",
   "description": "Sync your DeepSeek Harness (DSH) configuration between machines over a private git or WebDAV channel: settings, plugins, MCP servers, skills, agent presets, workspaces and provider credentials. DSH 配置远程同步插件（私有通道，明文自用）。",
   "keywords": [
@@ -160,7 +160,7 @@
     "@deepseek-ai/dsh-client-locale": "^0.1.0-rc.6",
     "@deepseek-ai/dsh-client-runtime": "^0.1.0-rc.6",
     "@deepseek-ai/dsh-client-ui-settings": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.6-alpha.2",
     "@deepseek-ai/dsh-credentials": "^0.1.0-rc.6",
     "@deepseek-ai/dsh-home-paths": "^0.1.0-rc.6",
     "@deepseek-ai/dsh-host-plugin-inventory": "^0.1.0-rc.6",

package/src/adapters/credentials.ts

@@ -5,7 +5,7 @@
  *
  * 安全不变量：永不导出值（hasValue 恒 false）；导入生成 MissingSecret 清单，
  * 用户补录值经 ctx.secretInputs / decryptedCredentials（仅内存）→ credentials.set()。
- * .credentials.yaml 文件字节交由 m4 加密层处理，本 adapter 不触碰。
+ * .credentials.yaml 文件字节由 Exporter 的文件级 vault 处理，本 adapter 不触碰。
  */
 import type { CredentialStatus, CredentialsSection } from '../schema/types.ts';
 import { msgOf, zhMsg } from '../core/messages.ts';

package/src/adapters/index.ts

@@ -79,7 +79,7 @@ export type { CredentialRefsProvider } from './credentials.ts';
 export { SettingsAdapter } from './settings.ts';
 export { UiAdapter, isUiNamespace, KNOWN_UI_NAMESPACE_PREFIXES, UI_MIGRATION_NOTES } from './ui.ts';
 export { ProvidersAdapter, DEFAULT_PROVIDER_NAMESPACES, type ProviderExportEntry, type ProviderExportSection } from './providers.ts';
-export { PluginsAdapter, USER_PATCH_FILE } from './plugins.ts';
+export { PluginsAdapter } from './plugins.ts';
 export type { LocalPluginPackHook } from './plugins.ts';
 export { McpAdapter, extractMcpServers, buildMcpPatchLine, type McpExportEntry, type McpExportSection } from './mcp.ts';
 export { PromptsAdapter, extractPrompts, mergePromptIntoLine, buildPromptLine, type PromptExportEntry, type PromptsExportSection } from './prompts.ts';

package/src/adapters/mcp.ts

@@ -14,7 +14,7 @@ import type {
   ApplyResult, ConfigAdapter, ExportOptions, ExportSection, HostContext,
   ImportContext, PlanItem, ValidationResult,
 } from '../core/types.ts';
-import { USER_PATCH_FILE } from './plugins.ts';
+import { HOME_PATCH_FILE } from '../core/patch-layers.ts';
 
 /** 导出记录：McpServerEntry 之外附加来源 patch 行 id（导入写回定位用） */
 export interface McpExportEntry extends McpServerEntry {
@@ -95,7 +95,7 @@ export class McpAdapter implements ConfigAdapter<McpExportSection> {
     const warnings: string[] = [];
     let lines: { lineId: string; raw: unknown }[] = [];
     try {
-      lines = await ctx.patchFile.readPatchLines(USER_PATCH_FILE);
+      lines = await ctx.patchFile.readPatchLines(HOME_PATCH_FILE);
     } catch (err) {
       warnings.push(msgOf(ctx)('adapter.patchReadFailedMCP', { reason: err instanceof Error ? err.message : String(err) }));
     }
@@ -111,7 +111,7 @@ export class McpAdapter implements ConfigAdapter<McpExportSection> {
   async analyzeImport(data: McpExportSection, ctx: ImportContext): Promise<PlanItem[]> {
     const msg = ctx.msg;
     const items: PlanItem[] = [];
-    const targetLines = await ctx.target.patchFile.readPatchLines(USER_PATCH_FILE);
+    const targetLines = await ctx.target.patchFile.readPatchLines(HOME_PATCH_FILE);
     const targetServers = extractMcpServers(targetLines);
     for (const server of data.servers) {
       const id = `mcp:${server.serverName}`;
@@ -157,7 +157,7 @@ export class McpAdapter implements ConfigAdapter<McpExportSection> {
     const ref = item.target?.ref;
     if (!ref) return { ok: false, message: msg('adapter.missingTargetRef') };
     const raw = buildMcpPatchLine(ref, server);
-    await ctx.target.patchFile.applyPatchChanges(USER_PATCH_FILE, [
+    await ctx.target.patchFile.applyPatchChanges(HOME_PATCH_FILE, [
       { lineId: ref, raw, action: item.kind === 'Create' ? 'insert' : 'update' },
     ]);
     return { ok: true, needsRestart: true, message: msg('adapter.mcpWritten', { serverName }) };