@logictan/dsh-config-manager 0.1.60 → 0.1.62

package/src/core/exporter.ts

@@ -3,11 +3,9 @@
  *   adapter 收集各分区 → Secret 过滤 → manifest → checksum → ZIP。
  *
  * 安全不变量：
- *  - Secret 值默认永不进入导出数据（结构化分区逐一过 SecretScanner）；
- *  - includeSecrets=true 必须注入 EncryptionProvider（m4 实现），否则拒绝导出；
- *  - 注入 EncryptionProvider 时备份标记为加密（encrypted=true）：includeSecrets=false
- *    时 secrets.enc 加密空内容占位，备份仍需要密码导入，但不含任何凭据值；
- *  - 加密密码/秘密值绝不写入 manifest 与日志。
+ *  - Secret 值默认永不进入导出数据（结构化分区逐一过 SecretScanner 剥离值）；
+ *  - 备份恒为明文（encrypted=false / encryption=null）：本插件不再有加密层；
+ *  - 秘密值绝不写入 manifest 与日志。
  */
 import fs from 'node:fs/promises';
 import path from 'node:path';
@@ -21,7 +19,7 @@ import { msgOf } from './messages.ts';
 import type { MsgFunc } from './messages.ts';
 import type { Manifest, SectionId } from '../schema/types.ts';
 import type {
-  ConfigAdapter, EncryptionProvider, ExportOptions, ExportReport,
+  ConfigAdapter, ExportOptions, ExportReport,
   ExportSection, HostContext, SecretScanner, SensitiveHit,
 } from './types.ts';
 
@@ -39,8 +37,6 @@ export interface ExporterOptions {
   adapters: ConfigAdapter[];
   /** Secret 扫描器；缺省用字段名黑名单剥离（m4 可注入强化版） */
   scanner?: SecretScanner;
-  /** 加密提供者（m4 用 node:crypto 实现）；includeSecrets 时必填；提供时备份标记 encrypted=true */
-  encryption?: EncryptionProvider | null;
   /** 插件自身版本（manifest.exporter.version） */
   exporterVersion?: string;
   now?: () => Date;
@@ -176,7 +172,6 @@ export class Exporter {
   private readonly ctx: HostContext;
   private readonly adapters: ConfigAdapter[];
   private readonly scanner: SecretScanner;
-  private readonly encryption: EncryptionProvider | null;
   private readonly exporterVersion: string;
   private readonly now: () => Date;
   private readonly msg: MsgFunc;
@@ -187,7 +182,6 @@ export class Exporter {
     this.ctx = opts.ctx;
     this.adapters = opts.adapters;
     this.scanner = opts.scanner ?? defaultSecretScanner();
-    this.encryption = opts.encryption ?? null;
     this.exporterVersion = opts.exporterVersion ?? '0.1.0';
     this.now = opts.now ?? (() => new Date());
     this.msg = opts.msg ?? msgOf(opts.ctx);
@@ -201,9 +195,6 @@ export class Exporter {
    */
   async export(options: ExportOptions): Promise<{ zipPath: string; manifest: Manifest; report: ExportReport }> {
     const { includeSecrets, only } = options;
-    if (includeSecrets && !this.encryption) {
-      throw new Error(this.msg('export.encryptionRequired'));
-    }
 
     // 1. 选定分区（only 过滤 + 默认包含）
     const selected = this.adapters
@@ -214,6 +205,8 @@ export class Exporter {
     const sections: ExportSection[] = [];
     const warnings: string[] = [];
     const redactedHits: SensitiveHit[] = [];
+    /** 文件类分区实扫到的命中数：只有它能让 containsSecrets 为真（结构化分区已被剥离） */
+    let fileSectionSecretHits = 0;
     const included: ExportReport['included'] = [];
     const excluded: SectionId[] = this.adapters.filter((a) => !selected.includes(a.id)).map((a) => a.id);
 
@@ -249,6 +242,7 @@ export class Exporter {
         if (fileHits.length > 0) {
           // redactedHits 是**报告统计**通道（非告警通道）：仍计入全量命中（含同一文件的多行/多形态命中）。
           redactedHits.push(...fileHits);
+          fileSectionSecretHits += fileHits.length;
           // 告警按**文件**去重（G-09/H1）：同一路径只告警一次。
           // 修复前按 hit 计数，同一行同时命中「字段名」与「值形状」会产出两条同路径告警，
           // 使少数文件就吃满上限，导致含真实明文凭据的其它文件被静默淹没（实测 redactedHits=8 而 5 条告警全属一个文件）。
@@ -278,12 +272,13 @@ export class Exporter {
       warnings.push(...section.warnings);
     }
 
-    // 4. 组装 ZIP 条目（JSON 分区 + 文件类分区 + secrets.enc + checksums + manifest）
+    // 4. 组装 ZIP 条目（JSON 分区 + 文件类分区 + checksums + manifest）
     const entries: { name: string; data: Uint8Array }[] = [];
     const sectionFlags = buildSectionFlags(sections);
-    let containsSecrets = false;
-    let encrypted = false;
-    let encryption: Manifest['security']['encryption'] = null;
+    // 备份恒为明文：本插件不再有加密层。containsSecrets 只认「文件类分区实扫到的命中」——
+    // 结构化分区的敏感值已被 scanner 剥离，不构成「含秘密」；文件类分区只报告不改写，
+    // 命中即代表归档里确有明文，必须如实标注。
+    const containsSecrets = fileSectionSecretHits > 0;
 
     for (const section of sections) {
       if (isFileSection(section.sectionId)) {
@@ -302,33 +297,8 @@ export class Exporter {
       });
     }
 
-    // secrets.enc：有加密提供者即生成。includeSecrets=true 时加密真实的凭据原文；
-    // 只勾选加密（不导出密钥）时加密空内容占位，备份仍标记 encrypted（导入需密码），
-    // 但绝不把凭据值放进去（containsSecrets 保持 false；安全不变量不破）。
-    if (this.encryption) {
-      const credentialsFile = path.join(this.ctx.homeDir, '.credentials.yaml');
-      let plaintext: string;
-      if (includeSecrets) {
-        try {
-          const raw = await this.ctx.fs.readFile(credentialsFile);
-          plaintext = Buffer.from(raw).toString('utf8');
-        } catch (err) {
-          warnings.push(this.msg('export.credentialsReadFailed', { reason: err instanceof Error ? err.message : String(err) }));
-          plaintext = '';
-        }
-      } else {
-        plaintext = '';
-      }
-      const result = await this.encryption.encrypt(plaintext);
-      entries.push({ name: 'security/secrets.enc', data: result.blob });
-      encryption = result.info;
-      containsSecrets = includeSecrets && plaintext !== '';
-      encrypted = true;
-    }
-
     // 4b. 文件级 vault（includeSecrets=false：敏感文件明文不进归档 → 镜像到本机 vault）。
-    //     尽力而为：任何失败仅记警告，不中断导出。includeSecrets=true 时秘密已加密进归档，
-    //     无需镜像（vault 只服务于「明文不进备份」的本机留存场景）。
+    //     尽力而为：任何失败仅记警告，不中断导出。
     let vaultRefreshed = 0;
     if (!includeSecrets) {
       try {
@@ -357,8 +327,8 @@ export class Exporter {
       arch: this.ctx.arch,
       sections: sectionFlags,
       containsSecrets,
-      encrypted,
-      encryption,
+      encrypted: false,
+      encryption: null,
       exportedAt: this.now().toISOString(),
     });
     entries.push({ name: MANIFEST_FILE, data: Buffer.from(stringifyJsonSafe(manifest, { space: 2 }), 'utf8') });
@@ -375,7 +345,6 @@ export class Exporter {
       sections: Object.keys(sectionFlags).filter((k) => sectionFlags[k as SectionId]),
       redactedFields: redactedHits.length,
       containsSecrets,
-      encrypted,
       vaultRefreshed,
     });
 
@@ -385,7 +354,6 @@ export class Exporter {
       security: {
         secretsExcluded: !includeSecrets,
         containsSecrets,
-        encrypted,
         redactedHits: redactedHits.length,
         vaultRefreshed,
       },

package/src/core/importer.ts

@@ -36,7 +36,7 @@ export interface ExecuteOptions {
   confirm: boolean;
   /** 用户补录的秘密值（仅内存） */
   secretInputs?: Record<string, string>;
-  /** 加密备份解密结果（仅内存；解密必须经 m4 encryption provider） */
+  /** 旧版加密备份的解密结果（仅内存；宿主解密后注入，本插件不再产生加密备份） */
   decryptedCredentials?: Map<string, string>;
   /** 任一项失败立即整体回滚（默认 false：单项失败如实记录并继续其余项） */
   rollbackOnError?: boolean;

package/src/core/index.ts

@@ -47,7 +47,7 @@ export type {
   ExportOptions, ExportSection, ValidationResult, HostContext,
   SettingsFacade, CredentialsFacade, PluginsFacade, WorkspaceFacade,
   PatchFileFacade, FileSystemFacade, NamespaceInfo, PluginInfo,
-  ConfigAdapter, Portability, SecretScanner, SensitiveHit, EncryptionProvider,
+  ConfigAdapter, Portability, SecretScanner, SensitiveHit,
   PlanItem, PlanItemKind, ItemResolution, GlobalConflictStrategy,
   ImportAnalysis, ImportDecisions, ImportPlan, ImportResult, ExecutedItem,
   ImportContext, SnapshotTarget, SnapshotEntry, Snapshot, SnapshotStore,

package/src/core/messages.ts

@@ -18,9 +18,7 @@ export type { MsgFunc, MsgParams } from './msg-types.ts';
 
 export const zh = {
   // ---------- 导出 ----------
-  'export.encryptionRequired': '导出包含秘密需要注入 EncryptionProvider（m4 实现），拒绝明文导出秘密',
   'export.sectionFailed': '分区 {adapter} 导出失败: {reason}',
-  'export.credentialsReadFailed': '读取凭据文件失败，跳过秘密导出: {reason}',
   'export.vaultRefreshed': '凭据明文未进入备份，已镜像到本机 vault（{count} 个文件，恢复时可回填）',
   'export.vaultRefreshSkipped': 'vault 镜像跳过 {rel}: {reason}',
   'export.vaultRefreshFailed': 'vault 镜像刷新失败（不影响导出）: {reason}',
@@ -53,9 +51,7 @@ export const zh = {
   'import.secretMissingDesc': '凭据 {ref} 需要补录',
   'import.secretNotProvided': '凭据未提供，需补录',
   'import.notConfirmed': '导入未确认：必须显式 confirm 后才允许修改任何数据',
-  'import.encryptedPasswordRequired': '该备份已加密，必须提供解密密码才能导入（拒绝无密码导入）',
-  'import.encryptedPasswordWrong': '解密密码错误，请重试',
-  'import.notEncryptedContainer': '该文件不是加密备份容器，无法解锁',
+  'import.encryptedPasswordRequired': '该备份含上游历史加密凭据（security.encrypted=true），本插件无解密能力：须由宿主解密后注入凭据（decryptedCredentials）才能导入',
   'import.userSkipped': '用户跳过（导入中点击「跳过当前插件」）',
   'import.userSkippedDetail': '插件 {name} 已由用户跳过，未安装',
   'import.vaultRestored': '凭据文件 {rel} 已从本机 vault 回填',
@@ -327,9 +323,7 @@ export const zh = {
 
 export const en: Record<keyof typeof zh, string> = {
   // ---------- export ----------
-  'export.encryptionRequired': 'Encrypted export requires an EncryptionProvider (m4); refusing to export secrets in plaintext',
   'export.sectionFailed': 'Section {adapter} export failed: {reason}',
-  'export.credentialsReadFailed': 'Failed to read the credentials file; secrets export skipped: {reason}',
   'export.vaultRefreshed': 'Credential plaintext did not enter the backup; mirrored to the local vault ({count} file(s), available for restore backfill)',
   'export.vaultRefreshSkipped': 'Vault mirror skipped {rel}: {reason}',
   'export.vaultRefreshFailed': 'Vault mirror refresh failed (export unaffected): {reason}',
@@ -362,9 +356,7 @@ export const en: Record<keyof typeof zh, string> = {
   'import.secretMissingDesc': 'Credential {ref} needs to be re-entered',
   'import.secretNotProvided': 'Credential not provided; requires re-entry',
   'import.notConfirmed': 'Import not confirmed: explicit confirm is required before any data is modified',
-  'import.encryptedPasswordRequired': 'This backup is encrypted; the decryption password is required to import it (refusing password-less import)',
-  'import.encryptedPasswordWrong': 'Wrong decryption password, please try again',
-  'import.notEncryptedContainer': 'This file is not an encrypted backup container and cannot be unlocked',
+  'import.encryptedPasswordRequired': 'This backup carries upstream-encrypted credentials (security.encrypted=true) and this plugin cannot decrypt them: a host must decrypt and inject them (decryptedCredentials) before import',
   'import.userSkipped': 'Skipped by user (clicked "Skip current plugin" during import)',
   'import.userSkippedDetail': 'Plugin {name} was skipped by the user and not installed',
   'import.vaultRestored': 'Credential file {rel} backfilled from the local vault',

package/src/core/patch-layers.ts

@@ -0,0 +1,42 @@
+/**
+ * cordis patch 层的寻址契约（唯一真源）。
+ *
+ * 宿主组装 patch 栈的顺序是 `bundle → profile → home → --patch`（后者覆盖前者），两层分工不同：
+ *  - home 层 `$DSH_HOME/cordis.patch.yml`：全机偏好，对每个 profile 生效；
+ *  - profile 层 `$DSH_HOME/profiles/<profile>/cordis.patch.yml`：该 profile 专属（端口、trustedHosts、
+ *    挂载行…），换机恢复时必须跟着走。
+ *
+ * 两层的**持久化标识**是这里的两个逻辑 token，而不是相对路径：同步快照会跨机器、
+ * 跨 profile 导入，相对路径会把源机的 profile 名带过去。home 层 token 与历史快照里的
+ * `PatchLine.file` 取值逐字相同（存量快照零改动即可解析回 home 层）。
+ *
+ * 层限定复合键 `<file>#<lineId>`：两层可以存在同名 `lineId`，而计划项 id / `target.ref` /
+ * 快照条目必须唯一指向「哪一层的哪一行」，否则应用与回滚会写错层。两个 token 与 lineId 都不含
+ * `#`（后者由 `readPatchLines` 保证非空字符串，此处不额外校验），分隔符无歧义。
+ */
+
+/** home 层 token（`$DSH_HOME/cordis.patch.yml`）；取值与历史快照的 file 字段一致。 */
+export const HOME_PATCH_FILE = 'cordis.patch.yml';
+
+/** profile 层 token（`$DSH_HOME/profiles/<profile>/cordis.patch.yml`）。 */
+export const PROFILE_PATCH_FILE = 'profile:cordis.patch.yml';
+
+/** 层限定复合键的分隔符（两个层 token 与 lineId 都不含它）。 */
+const PATCH_LAYER_SEPARATOR = '#';
+
+/** 层限定复合键：`<file>#<lineId>`。 */
+export function patchLayerKey(file: string, lineId: string): string {
+  return `${file}${PATCH_LAYER_SEPARATOR}${lineId}`;
+}
+
+/**
+ * 解析层限定复合键。
+ *
+ * 兼容分支：旧快照的 `target.ref` / `SnapshotEntry.ref` 是裸 `lineId`（当时只有 home 层），
+ * 不含 `#` 即视作 home 层。lineId 本身不含 `#`，因此该分支无歧义。
+ */
+export function parsePatchLayerKey(ref: string): { file: string; lineId: string } {
+  const at = ref.indexOf(PATCH_LAYER_SEPARATOR);
+  if (at < 0) return { file: HOME_PATCH_FILE, lineId: ref };
+  return { file: ref.slice(0, at), lineId: ref.slice(at + 1) };
+}

package/src/core/rollback.ts

@@ -8,6 +8,7 @@
  *  - settings 回滚仍走 expectedRevision 乐观锁，避免覆盖导入后用户的新修改。
  */
 import { resolveFileTarget } from './backup.ts';
+import { parsePatchLayerKey } from './patch-layers.ts';
 import { msgOf } from './messages.ts';
 import type {
   ConfigAdapter, HostContext, RollbackReport, Snapshot, SnapshotEntry, SnapshotStore,
@@ -71,10 +72,9 @@ async function compensateOne(
     }
     case 'patchLine': {
       try {
-        // 引擎只管理 profile 的 cordis.patch.yml（backup.ts 的 patchLine 快照只记 lineId 作 ref，
-        // 不含文件编码）——回滚固定写回该文件；切勿把 lineId 当文件名（否则 patchPath 抛「仅支持管理」）。
-        const file = 'cordis.patch.yml';
-        const lineId = entry.ref;
+        // 快照条目的 ref 是层限定复合键（<file>#<lineId>）——必须写回**同一层**，
+        // 否则 profile 层的原值会被写进 home 层。旧快照的裸 lineId 兼容为 home 层。
+        const { file, lineId } = parsePatchLayerKey(entry.ref);
         await ctx.patchFile.applyPatchChanges(file, [
           { lineId, raw: entry.before, action: entry.before === null ? 'remove' : 'update' },
         ]);

package/src/core/smoke.test.ts

@@ -827,15 +827,15 @@ test('兼容性评分规则', () => {
   assert.equal(computeCompatibility({ sourceDsh: '0.1.0-rc.6', targetDsh: '0.1.0-rc.6', sourcePlatform: 'win32', targetPlatform: 'win32', schemaVersion: 999, missingSections: [] }), 'unsupported');
 });
 
-test('包含秘密导出：无加密提供者时拒绝（绝不明文泄密）', async () => {
+test('包含秘密导出：本插件无加密层，明文导出照常进行且备份恒标记未加密', async () => {
   const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'dsh-cm-sec-'));
   try {
     const src = makeContext('win32', 'C:\\Users\\alice');
     const exporter = new Exporter({ ctx: src, adapters: makeAdapters(), now: () => new Date() });
-    await assert.rejects(
-      () => exporter.export({ includeSecrets: true, outPath: path.join(tmp, 'x.zip') }),
-      /EncryptionProvider/,
-    );
+    const { manifest, report } = await exporter.export({ includeSecrets: true, outPath: path.join(tmp, 'x.zip') });
+    assert.equal(manifest.security.encrypted, false, '备份恒为明文');
+    assert.equal(manifest.security.encryption, null, '不存在加密参数');
+    assert.equal(report.security.secretsExcluded, false, 'includeSecrets=true 时不走 vault 留存路径');
   } finally {
     await fs.rm(tmp, { recursive: true, force: true });
   }

package/src/core/types.ts

@@ -5,7 +5,7 @@
  * HostContext 是 m3 定义、m5 实现的 DSH Service 门面（研究报告 §3.2 的叶子方法最小集），
  * 测试用内存 mock 即可驱动完整导出→导入往返。
  */
-import type { EncryptionInfo, Manifest, SectionId, WorkspaceRecord } from '../schema/types.ts';
+import type { Manifest, SectionId, WorkspaceRecord } from '../schema/types.ts';
 import type { TombstoneKind } from '../schema/tombstones.ts';
 import type { MutationLockPort } from '../utils/env-lock.ts';
 import type { RecursiveListing } from '../utils/recursive-walk.ts';
@@ -16,7 +16,11 @@ import type { MsgFunc } from './messages.ts';
 /* ---------------- 导出选项与分区产出 ---------------- */
 
 export interface ExportOptions {
-  /** 是否包含真实秘密（必须配合 encryption 提供者；缺省 false = 只导状态） */
+  /**
+   * 是否把真实秘密写入备份。本插件不再有加密层（备份恒为明文），结构化分区的秘密值
+   * 始终由 SecretScanner 剥离，故本开关当前的实际作用只剩「是否刷新本机 vault 镜像」：
+   * false → 导出后把敏感文件镜像到本机 vault（明文不进归档）。
+   */
   includeSecrets: boolean;
   /** 仅导出指定分区（缺省 = 全部默认包含分区） */
   only?: SectionId[];
@@ -235,7 +239,7 @@ export interface ImportAnalysis {
   pathIssues: PathIssue[];
   secretCount: number;
   dependencyIssues: { item: string; dependency: string }[];
-  /** 备份是否加密（manifest.security.encrypted）：加密备份的凭据必须用解密密码恢复 */
+  /** 旧版加密备份标记（manifest.security.encrypted）：本插件不再产生，仅历史产物为 true */
   encrypted: boolean;
 }
 
@@ -298,6 +302,7 @@ export interface ImportContext {
   resolutions: Record<string, ItemResolution>;
   /** 用户补录的秘密值（仅内存，永不落盘/日志） */
   secretInputs: Record<string, string>;
+  /** 旧版加密备份的解密结果（仅内存；宿主解密后注入） */
   decryptedCredentials?: Map<string, string>;
   log: Logger;
   /** 消息翻译器（analyzer 注入；适配器用它生成计划项描述/校验/结果消息） */
@@ -466,7 +471,6 @@ export interface ExportReport {
   security: {
     secretsExcluded: boolean;
     containsSecrets: boolean;
-    encrypted: boolean;
     redactedHits: number;
     /** 本次导出镜像到本机 vault 的敏感文件数（文件级 vault；0 或缺失 = 未镜像） */
     vaultRefreshed?: number;
@@ -504,14 +508,6 @@ export interface ConfigAdapter<TSection = unknown> {
   rollback?(entries: SnapshotEntry[], ctx: HostContext): Promise<void>;
 }
 
-/* ---------------- 加密提供者（m4 用 node:crypto 实现） ---------------- */
-
-export interface EncryptionProvider {
-  encrypt(plaintext: string): Promise<{ blob: Uint8Array; info: EncryptionInfo }>;
-  /** authTag 校验失败必须抛错 */
-  decrypt(blob: Uint8Array, info: EncryptionInfo, password: string): Promise<string>;
-}
-
 /* ---------------- 错误类型 ---------------- */
 
 /** 导入被确认前拒绝执行（安全阀） */

package/src/index.facade.test.ts

@@ -10,11 +10,11 @@
  */
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
-import { DshPluginsFacade, ensureActivationRow } from './index.ts';
+import { DshPatchFileFacade, DshPluginsFacade, ensureActivationRow } from './index.ts';
 import { resolveProfileDir } from './core/plugin-cli.ts';
 import type { DshPluginResult } from './core/plugin-cli.ts';
 import type { PatchChange, PatchFileFacade } from './core/types.ts';
@@ -250,6 +250,29 @@ test('ensureActivationRow: bundle 包跳过（reconcile 已维护 bundles）', a
   }
 });
 
+test('ensureActivationRow: 非 bundle 插件补行落在 profile 层（home 层文件不受影响）', async () => {
+  const { homeDir, profileDir, cleanup } = makeTempProfile();
+  try {
+    writeInstalledPkg(profileDir, 'pkg-a', '1.0.0');
+    const patchFile = new DshPatchFileFacade(homeDir, 'web');
+    const homePatch = join(homeDir, 'cordis.patch.yml');
+    const profilePatch = join(profileDir, 'cordis.patch.yml');
+    writeFileSync(homePatch, '- id: home-line\n', 'utf8');
+    const homeBefore = readFileSync(homePatch, 'utf8');
+
+    await ensureActivationRow(patchFile, join(profileDir, 'node_modules', 'pkg-a'), 'pkg-a');
+
+    assert.match(
+      readFileSync(profilePatch, 'utf8'),
+      /id: pm-pkg-a/,
+      '激活行必须落在 profile 层（home 层对每个 profile 生效，会让只在 web 装过的插件污染其他 profile）',
+    );
+    assert.equal(readFileSync(homePatch, 'utf8'), homeBefore, 'home 层文件必须原样不变');
+  } finally {
+    cleanup();
+  }
+});
+
 test('ensureActivationRow: scope 包名 slug 形态正确（@scope/name → pm-scope-name）', async () => {
   const { profileDir, cleanup } = makeTempProfile();
   try {

package/src/index.ts

@@ -20,8 +20,8 @@
  *    (isLoopbackRequest); LAN-exposed deployments never serve these endpoints;
  *  - uploads/exported ZIPs are staged under $DSH_HOME/dsh-config-manager/{tmp,exports}
  *    and every `path`/`zipPath` reference is confined to those roots;
- *  - the encryption password is in-memory only: used to derive the AES-256-GCM
- *    key for secrets.enc, never written to any file, manifest, or log;
+ *  - there is no encryption layer: every backup is plaintext, and secret values are
+ *    stripped by the secret scanner before they reach any file, manifest, or log;
  *  - the import execute endpoint refuses to run without `confirm: true`
  *    (core ImportNotConfirmedError safety valve).
  *
@@ -84,7 +84,7 @@ import { makeMsg, msgOf, zhMsg } from './core/messages.ts'
 import type { MsgFunc } from './core/messages.ts'
 import {
   cleanupAbortedInstall, hasDshBundlePatch, installErrorFor, installSpecFor, listInstalledPlugins,
-  resolveProfileDir, resolveProfileNameFromArgv, readProfileManifest, runDshPlugin, validateProfileName,
+  resolveProfileDir, resolveProfileNameFromArgv, runDshPlugin, validateProfileName,
 } from './core/plugin-cli.ts'
 import type {
   ConfigAdapter, CredentialsFacade, FileSystemFacade, HostContext, ImportDecisions,
@@ -92,9 +92,9 @@ import type {
   SettingsFacade, Snapshot, WorkspaceFacade,
 } from './core/types.ts'
 import { ImportNotConfirmedError, ImportUserSkippedError } from './core/types.ts'
-import { createAdapters, USER_PATCH_FILE } from './adapters/index.ts'
+import { createAdapters } from './adapters/index.ts'
+import { HOME_PATCH_FILE, PROFILE_PATCH_FILE } from './core/patch-layers.ts'
 import { createLocalPluginPackHook } from './core/local-plugin-host.ts'
-import { createEncryptionProvider, decryptCredentials, decryptArchive, SecurityError, encryptArchive, isArchiveBlob, verifyEncryptedBlob } from './security/index.ts'
 import { createHardenedZipParser } from './security/zip-security.ts'
 import { atomicCopyFile, atomicWriteFile } from './utils/atomic-write.ts'
 import { EnvironmentLockManager, runWithMutationLock, EnvironmentLockUnavailableError, type MutationLockContext } from './utils/env-lock.ts'
@@ -139,11 +139,10 @@ import { createConfiguredSecretScanner } from './security/secret-scanner.ts'
 import type { ConfiguredSecretPatterns } from './security/secret-scanner.ts'
 import type { SecretScanner } from './core/types.ts'
 import { sha256Hex } from './utils/hashing.ts'
-import { MANIFEST_FILE, parseManifest } from './schema/manifest.ts'
 import { isFileSection, SECTION_IDS } from './schema/config.ts'
 import { stringifyJsonSafe } from './utils/json.ts'
-import type { Manifest, SectionId, WorkspaceRecord } from './schema/types.ts'
-import { parseZip, zipToBuffer } from './utils/zip.ts'
+import type { SectionId, WorkspaceRecord } from './schema/types.ts'
+import { zipToBuffer } from './utils/zip.ts'
 import { isSameOrChild, normalizePath } from './utils/paths.ts'
 import { createLogger, type Logger } from './utils/logger.ts'
 
@@ -156,7 +155,7 @@ export const name = 'config-manager'
 export const inject = ['settings', 'credentials']
 
 /** Plugin version, kept in sync with package.json ("version"). */
-const PLUGIN_VERSION = '0.1.60'
+const PLUGIN_VERSION = '0.1.62'
 
 /** Plugin own package name — excluded from its own exported plugins list. */
 const PLUGIN_NAME = 'dsh-config-manager'
@@ -220,6 +219,8 @@ export interface Config {
 
 /** Route family — must match the browser half's CONFIG_MANAGER_API exactly. */
 const API = {
+  // 设置页页脚版本行（pluginVersion / dshVersion）。只读，loopback fence。
+  status: '/api/dsh-config-manager/status',
   // P2-⑫：导出前只读预览（不落盘 ZIP；返回各分区 counts + 估算大小）
   // P1-⑧：快照管理（手动删除 + 置顶豁免自动清理）
   // m-backup-schedule：定时全量备份（读/存 backup-schedule.json + 立即执行一次）
@@ -644,12 +645,12 @@ class DshWorkspaceFacade implements WorkspaceFacade {
   }
 }
 
-/** Profile 目录内的 patch 文件（非 bundle 插件激活行写入处，marketplace 同款路径）。 */
-const PROFILE_PATCH_FILE = 'cordis.patch.yml'
-
 /** Patch-file facade：用户 patch 层（$DSH_HOME/cordis.patch.yml）+ profile patch 层
- * （$DSH_HOME/profiles/<name>/cordis.patch.yml），两者都在 home 根内。 */
-class DshPatchFileFacade implements PatchFileFacade {
+ * （$DSH_HOME/profiles/<name>/cordis.patch.yml），两者都在 home 根内。
+ *
+ * 导出仅为让测试能用**真实门面**（而非 mock）钉住层寻址——mock 会让两个层 token 的取值
+ * 撞车无处暴露（DshPluginsFacade 同款做法）。 */
+export class DshPatchFileFacade implements PatchFileFacade {
   private readonly homeDir: string
   private readonly profile: string
   private readonly msg: MsgFunc
@@ -661,9 +662,9 @@ class DshPatchFileFacade implements PatchFileFacade {
   }
 
   private patchPath(file: string): string {
-    if (file === USER_PATCH_FILE) return join(this.homeDir, USER_PATCH_FILE)
-    if (file === PROFILE_PATCH_FILE) return join(this.homeDir, 'profiles', this.profile, PROFILE_PATCH_FILE)
-    throw new Error(this.msg('host.patchUnsupported', { user: USER_PATCH_FILE, profile: PROFILE_PATCH_FILE, file }))
+    if (file === HOME_PATCH_FILE) return join(this.homeDir, HOME_PATCH_FILE)
+    if (file === PROFILE_PATCH_FILE) return join(this.homeDir, 'profiles', this.profile, HOME_PATCH_FILE)
+    throw new Error(this.msg('host.patchUnsupported', { user: HOME_PATCH_FILE, profile: PROFILE_PATCH_FILE, file }))
   }
 
   async readPatchLines(file: string): Promise<{ lineId: string; raw: unknown }[]> {
@@ -916,48 +917,6 @@ async function withTimeout<T>(promise: Promise<T>, ms: number, message: string):
   }
 }
 
-/** Decrypt an encrypted backup's credentials (in-memory only; undefined when not applicable). */
-async function tryDecryptCredentials(
-  zipPath: string,
-  password: string | undefined,
-): Promise<Map<string, string> | undefined> {
-  if (password === undefined || password === '') return undefined
-  const raw = await fs.readFile(zipPath)
-  const archive = parseZip(raw)
-  if (!archive.has(MANIFEST_FILE)) return undefined
-  let manifest: Manifest
-  try {
-    manifest = parseManifest(archive.readEntryText(MANIFEST_FILE))
-  } catch {
-    return undefined
-  }
-  if (!manifest.security.encrypted || manifest.security.encryption === null) return undefined
-  if (!archive.has('security/secrets.enc')) return undefined
-  const blob = archive.readEntry('security/secrets.enc')
-  const plaintext = await decryptCredentials(blob, manifest.security.encryption, password)
-  let parsed: unknown
-  try {
-    parsed = yaml.load(plaintext)
-  } catch {
-    return undefined
-  }
-  const map = new Map<string, string>()
-  if (parsed !== null && typeof parsed === 'object') {
-    for (const [k, v] of Object.entries(parsed as Record<string, unknown>)) {
-      if (typeof v === 'string' && v !== '') map.set(k, v)
-    }
-  }
-  return map
-}
-
-/** 解密错误 → 用户可读文本：BAD_PASSWORD 只报「密码错误」（不泄内部细节），其余原文 */
-function decryptErrorText(error: unknown, msg: MsgFunc): string {
-  if (error instanceof SecurityError && error.code === 'BAD_PASSWORD') {
-    return msg('import.encryptedPasswordWrong')
-  }
-  return error instanceof Error ? error.message : String(error)
-}
-
 interface RoutesDeps {
   host: ConfigManagerHostContext
   adapters: ConfigAdapter[]
@@ -1423,44 +1382,6 @@ export function isGitHubAuthMissing(error: unknown): boolean {
   return error instanceof GitHubAuthError && (error.code === 'unauthorized' || error.code === 'no_token')
 }
 
-/** /status 的插件诊断位（issue #28）。仅回非敏感元信息：目录、profile 名、计数。 */
-export interface PluginDiagnostics {
-  homeDir: string
-  profile: string
-  /** profile 目录的 package.json 是否可读（不可读 → 清单必然为空） */
-  profileManifestReadable: boolean
-  /** 插件清单来源 = package.json 的 dependencies 里非 in-box 的包 */
-  installedPluginCount: number
-  installedPluginNames: string[]
-  /** dsh.profile.bundles 声明（非空即「替换默认插件栈」） */
-  bundles: string[]
-}
-
-/**
- * 读取插件诊断信息（issue #28）：把「插件到底读了哪个目录 / 哪个 profile / 看到什么」变成
- * 用户可自查的数据——此前只存在于宿主内部，导致「装了插件却识别不到」无从定位。
- * best-effort：失败不抛出（诊断位缺失不应拖垮 /status）。
- */
-async function readPluginDiagnostics(host: HostContext): Promise<Partial<PluginDiagnostics>> {
-  try {
-    const profileDir = resolveProfileDir(host.homeDir, host.profile ?? 'web')
-    const manifest = readProfileManifest(profileDir)
-    const installed = await host.plugins.listInstalled()
-    const bundles = manifest?.dsh?.profile?.bundles
-    return {
-      homeDir: host.homeDir,
-      profile: host.profile ?? 'web',
-      profileManifestReadable: manifest !== null,
-      installedPluginCount: installed.length,
-      installedPluginNames: installed.map((p) => p.name),
-      bundles: Array.isArray(bundles) ? bundles : [],
-    }
-  } catch (err) {
-    host.log.warn(`plugin diagnostics unavailable: ${err instanceof Error ? err.message : String(err)}`)
-    return {}
-  }
-}
-
 /** Build the /api/dsh-config-manager route family. */
 function makeRoutes(deps: RoutesDeps): { routes: WebRoute[]; scheduler: AutoSyncScheduler; makeSyncEngine: (cfg: SyncConfig) => SyncEngine; lifecycle: ConfigLifecycle } {
   const { host, adapters, exportsDir, tmpDir, snapshotsDir, runs, syncDir, dataDir, credentials, githubClientId, githubClientSecret, history } = deps
@@ -1856,6 +1777,18 @@ function makeRoutes(deps: RoutesDeps): { routes: WebRoute[]; scheduler: AutoSync
 
   const routesList: WebRoute[] = [
     // ------------------------------------------------------------- status
+    // 设置页页脚版本行：插件版本 + DSH 版本。只读、无 secret，loopback fence。
+    {
+      kind: 'exact',
+      path: API.status,
+      handler: async (req, res) => {
+        if (!guard(req, res, 'GET')) return
+        writeJson(res, 200, {
+          pluginVersion: PLUGIN_VERSION,
+          dshVersion: host.dshVersion,
+        })
+      },
+    },
     // ------------------------------------------------------------- export
     // ---------------------------------------------------- export-preview
     // P2-⑫：导出前只读预览（不落盘 ZIP）：对选中分区逐个 adapter.export 收集 counts
@@ -1863,13 +1796,6 @@ function makeRoutes(deps: RoutesDeps): { routes: WebRoute[]; scheduler: AutoSync
     // 零写入；loopback fence 必备。
     // ------------------------------------------------------------ download
     // -------------------------------------------------------------- upload
-    // ------------------------------------------------------ decrypt-archive
-    // 整体加密备份容器的解锁（只读，零写入到任何配置）：用备份密码解密上传的加密容器，
-    // 得到明文 ZIP 写入受控临时目录并返回新 zipPath，供 analyze/plan/execute 引用。
-    // 导出时容器密码与内部 secrets.enc 密码同源（同一 password 派生两层加密），
-    // 因此顺带在明文 ZIP 上解出内部凭据覆盖清单（refs，非值）一并返回——
-    // 导入全程只需输入这一次密码，无需第二个密码校验页面。
-    // 密码仅内存随请求体传入，绝不落盘/落日志；解出的明文 ZIP 亦为临时文件，导入结束后清理。
     // ------------------------------------------------------------- analyze
     // ---------------------------------------------------------------- plan
     // ------------------------------------------------------------ progress

package/src/security/index.ts

@@ -1,16 +1,14 @@
 /**
  * 安全模块公共出口（m4-security）：
- *  secret-scanner / encryption / integrity / zip-security / redaction。
+ *  secret-scanner / integrity / zip-security / redaction。
  *
  * 与 core 的注入点对齐：
  *  - `createSecretScanner()`        → ExporterOptions.scanner（SecretScanner 契约）
- *  - `createEncryptionProvider(pw)` → ExporterOptions.encryption（EncryptionProvider 契约）
  *  - `createHardenedZipParser()`    → ImporterOptions.parseZipOverride（(buf, limits?) => ZipArchive）
  *  - `safeExtractHardened()`        → m5 导入文件类分区落盘通道
  *  - `verifyChecksumsJson()`        → 完整性校验通道（core analyzer 已有内置校验，本模块供独立调用）
  */
 export * from './secret-scanner.ts';
-export * from './encryption.ts';
 export * from './integrity.ts';
 export * from './zip-security.ts';
 export * from './redaction.ts';