@logictan/dsh-config-manager 0.1.60

package/src/adapters/providers.test.ts

@@ -0,0 +1,126 @@
+/**
+ * providers adapter 测试：llm-deepseek（单 provider）与 llm-pi-ai（多 provider）导出、
+ * Create/Skip/Conflict 分析、整体 namespace 写回（raw + 乐观锁）。
+ */
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { ProvidersAdapter } from './providers.ts';
+import { createSecretScanner } from '../security/secret-scanner.ts';
+import { makeContext, makeImportContext } from './test-helpers.ts';
+import type { PlanItem } from '../core/types.ts';
+
+test('providers: 导出单/多 provider section（含 revision 与 raw）', async () => {
+  const ctx = makeContext('win32', 'C:\\Users\\alice');
+  ctx.settings.ns.set('llm-deepseek', {
+    value: { apiKeyEnv: 'DEEPSEEK_API_KEY', baseURL: 'https://api.deepseek.com', model: 'deepseek-chat', apiKey: 'sk-secret' },
+    revision: 5,
+    secrets: [{ path: ['apiKey'], set: true }],
+  });
+  ctx.settings.ns.set('llm-pi-ai', {
+    value: {
+      providers: {
+        openai: { apiKeyEnv: 'OPENAI_API_KEY', baseURL: 'https://api.openai.com', models: ['gpt-4o'] },
+        local: { apiKeyEnv: 'LOCAL_KEY', baseURL: 'http://127.0.0.1:11434' },
+      },
+    },
+    revision: 2,
+    secrets: [],
+  });
+
+  const adapter = new ProvidersAdapter();
+  const out = await adapter.export(ctx, { includeSecrets: false });
+  assert.equal(out.data.version, 1);
+  const routes = Object.keys(out.data.providers).sort();
+  assert.deepEqual(routes, ['llm-deepseek', 'local', 'openai']);
+  const deepseek = out.data.providers['llm-deepseek'];
+  assert.equal(deepseek?.namespace, 'llm-deepseek');
+  assert.equal(deepseek?.revision, 5);
+  assert.equal(deepseek?.apiKeyEnv, 'DEEPSEEK_API_KEY');
+  assert.ok(deepseek?.raw, 'raw 保存完整 redacted namespace 值');
+  const openai = out.data.providers['openai'];
+  assert.equal(openai?.namespace, 'llm-pi-ai');
+  assert.equal(openai?.baseURL, 'https://api.openai.com');
+  assert.equal(out.counts.providers, 3);
+
+  const v = await adapter.validate(out.data);
+  assert.equal(v.valid, true);
+});
+
+test('providers: analyzeImport Create/Skip/Conflict + applyItem 写回整个 namespace', async () => {
+  const src = makeContext('win32', 'C:\\Users\\alice');
+  src.settings.ns.set('llm-pi-ai', {
+    value: { providers: { openai: { apiKeyEnv: 'OPENAI_API_KEY', baseURL: 'https://api.openai.com' } } },
+    revision: 2,
+    secrets: [],
+  });
+  const adapter = new ProvidersAdapter();
+  const exported = await adapter.export(src, { includeSecrets: false });
+  const sections = new Map([['providers', exported.data]]);
+
+  const dst = makeContext('linux', '/home/bob');
+  dst.settings.registered.add('llm-pi-ai'); // 目标已安装提供该命名空间的插件（空值 → Create 初始化）
+  let items = await adapter.analyzeImport(exported.data, makeImportContext(dst, sections));
+  assert.equal(items.length, 1);
+  assert.equal(items[0]?.kind, 'Create');
+  assert.equal(items[0]?.id, 'provider:openai');
+  assert.equal(items[0]?.target?.ref, 'llm-pi-ai', '快照定位 namespace');
+  let r = await adapter.applyItem(items[0]!, makeImportContext(dst, sections));
+  assert.equal(r.ok, true);
+  assert.deepEqual(dst.settings.ns.get('llm-pi-ai')?.value, { providers: { openai: { apiKeyEnv: 'OPENAI_API_KEY', baseURL: 'https://api.openai.com' } } });
+
+  // 幂等：一致 → Skip
+  items = await adapter.analyzeImport(exported.data, makeImportContext(dst, sections));
+  assert.equal(items[0]?.kind, 'Skip');
+
+  // 目标不同 → Conflict；useImported 覆盖
+  dst.settings.ns.set('llm-pi-ai', {
+    value: { providers: { openai: { apiKeyEnv: 'OTHER_KEY', baseURL: 'https://other.example.com' } } },
+    revision: 8,
+    secrets: [],
+  });
+  items = await adapter.analyzeImport(exported.data, makeImportContext(dst, sections));
+  assert.equal(items[0]?.kind, 'Conflict');
+  const useItem: PlanItem = { ...items[0]!, kind: 'Update' };
+  await adapter.applyItem(useItem, makeImportContext(dst, sections));
+  assert.deepEqual(dst.settings.ns.get('llm-pi-ai')?.value, { providers: { openai: { apiKeyEnv: 'OPENAI_API_KEY', baseURL: 'https://api.openai.com' } } });
+});
+
+test('providers: validate 拒绝缺 namespace/revision 的记录', async () => {
+  const adapter = new ProvidersAdapter();
+  const bad = await adapter.validate({ version: 1, providers: { x: { route: 'x' } as never } });
+  assert.equal(bad.valid, false);
+});
+
+test('providers: 多 route 共享 secrets 引用不触发强化 scanner 循环误报（m4 createSecretScanner）', async () => {
+  const ctx = makeContext('win32', 'C:\\Users\\alice');
+  ctx.settings.ns.set('llm-pi-ai', {
+    value: {
+      providers: {
+        openai: { apiKeyEnv: 'OPENAI_API_KEY', baseURL: 'https://api.openai.com', models: ['gpt-4o'], apiKey: 'sk-openai-123' },
+        local: { apiKeyEnv: 'LOCAL_KEY', baseURL: 'http://127.0.0.1:11434', token: 'local-token-456' },
+      },
+    },
+    revision: 2,
+    secrets: [{ path: ['apiKey'], set: true }],
+  });
+  const adapter = new ProvidersAdapter();
+  const exported = await adapter.export(ctx, { includeSecrets: false });
+  assert.equal(Object.keys(exported.data.providers).length, 2);
+
+  // 隔离断言：route 间 secrets / raw 必须独立引用（共享引用会被 visited 循环检测误判）
+  const openai = exported.data.providers['openai'];
+  const local = exported.data.providers['local'];
+  assert.notStrictEqual(openai?.secrets, local?.secrets, 'route 间 secrets 数组必须独立');
+  assert.notStrictEqual(openai?.raw, local?.raw, 'route 间 raw 必须独立');
+
+  // m4 强化版 scanner 扫描导出数据：不得抛「检测到循环引用」，且敏感字段被剥离
+  const scanner = createSecretScanner();
+  let scanned: { sanitized: unknown; hits: import('../core/types.ts').SensitiveHit[] };
+  assert.doesNotThrow(() => { scanned = scanner.scanAndRedact(exported.data); }, '共享引用不得被误判为循环');
+  assert.ok(scanned!.hits.length >= 2, `apiKey/token 字段应被剥离（实际 ${scanned!.hits.length}）`);
+  const sanitizedProviders = (scanned!.sanitized as { providers: Record<string, Record<string, unknown>> }).providers;
+  assert.equal(sanitizedProviders['openai']?.['apiKey'], '', 'apiKey 值剥离');
+  assert.equal(sanitizedProviders['local']?.['token'], '', 'token 值剥离');
+  assert.equal(sanitizedProviders['openai']?.['apiKeyEnv'], 'OPENAI_API_KEY', '引用字段 apiKeyEnv 保留');
+  assert.equal(sanitizedProviders['openai']?.['baseURL'], 'https://api.openai.com', '非敏感字段保留');
+});

package/src/adapters/providers.ts

@@ -0,0 +1,173 @@
+/**
+ * providers 分区 adapter（设计 §3.3/§13.1）：
+ * 数据源 = settings.yaml 的 llm-deepseek / llm-pi-ai section（providers 与 models 天然同 section，不拆文件）。
+ *
+ * 导入走 settings 写通道（replace llm-* namespace + 乐观锁）：
+ * 每项携带 raw（该 namespace 的完整 redacted 值）用于整体写回，apiKey 值经 credentials 状态占位（不导出值）。
+ */
+import { isDeepStrictEqual } from 'node:util';
+import { msgOf, zhMsg } from '../core/messages.ts';
+import type { MsgFunc } from '../core/messages.ts';
+import type { ProviderEntry } from '../schema/types.ts';
+import type {
+  ApplyResult, ConfigAdapter, ExportOptions, ExportSection, HostContext,
+  ImportContext, NamespaceInfo, PlanItem, ValidationResult,
+} from '../core/types.ts';
+import { resolveNamespaces, isEmptyValue, type NamespaceProvider } from './settings.ts';
+
+/** 导出记录：ProviderEntry 之外附加 namespace 级元数据（导入写回用），满足 ProvidersSection 形状 */
+export interface ProviderExportEntry extends ProviderEntry {
+  /** 来源 settings namespace（llm-deepseek / llm-pi-ai） */
+  namespace: string;
+  /** 乐观锁 revision（导入时检测并发修改） */
+  revision: number;
+  secrets?: { path: string[]; set: boolean }[];
+  /** 该 namespace 的完整 redacted 值（导入整体写回，避免按字段重建丢失结构） */
+  raw?: Record<string, unknown>;
+}
+
+export interface ProviderExportSection { version: 1; providers: Record<string, ProviderExportEntry>; }
+
+export const DEFAULT_PROVIDER_NAMESPACES: readonly string[] = ['llm-deepseek', 'llm-pi-ai'];
+
+/** 无 raw 时的兜底重建：只取 ProviderEntry 已知字段 */
+function stripEntry(entry: ProviderExportEntry): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  for (const key of ['apiKeyEnv', 'displayName', 'baseURL', 'models', 'modelOverrides', 'reasoning', 'transport', 'retryPolicy'] as const) {
+    if (entry[key] !== undefined) out[key] = entry[key];
+  }
+  return out;
+}
+
+export class ProvidersAdapter implements ConfigAdapter<ProviderExportSection> {
+  readonly id = 'providers' as const;
+  readonly displayName = 'Providers & Models';
+  readonly defaultIncluded = true;
+  readonly portability = 'portable' as const;
+  private readonly namespaces: string[] | NamespaceProvider;
+
+  constructor(namespaces: string[] | NamespaceProvider = DEFAULT_PROVIDER_NAMESPACES as unknown as string[]) {
+    this.namespaces = namespaces;
+  }
+
+  async export(ctx: HostContext, _options: ExportOptions): Promise<ExportSection<ProviderExportSection>> {
+    const providers: Record<string, ProviderExportEntry> = {};
+    const warnings: string[] = [];
+    for (const ns of await resolveNamespaces(this.namespaces, ctx)) {
+      let info: NamespaceInfo;
+      try {
+        info = await ctx.settings.describe(ns, { redactSecrets: true });
+      } catch (err) {
+        warnings.push(msgOf(ctx)('adapter.providerNsReadFailed', { ns, reason: err instanceof Error ? err.message : String(err) }));
+        continue;
+      }
+      const value = (info.value ?? {}) as Record<string, unknown>;
+      // llm-pi-ai 形态：value.providers = { route: {...} }；llm-deepseek 形态：value 即单 provider 配置
+      const routes: [string, unknown][] =
+        value.providers !== null && typeof value.providers === 'object'
+          ? Object.entries(value.providers as Record<string, unknown>)
+          : [[ns, value]];
+      for (const [route, pv] of routes) {
+        // 每个 route 独立深拷贝 secrets / pv / raw：同一 namespace 的多 route 若共享引用，
+        // m4 强化版 createSecretScanner 的 visited 循环检测会误判「检测到循环引用」（见 providers.test.ts）。
+        providers[route] = {
+          route,
+          namespace: ns,
+          revision: info.revision,
+          secrets: structuredClone(info.secrets),
+          ...structuredClone(pv as Record<string, unknown>),
+          raw: structuredClone(value),
+        };
+      }
+    }
+    return {
+      sectionId: 'providers',
+      data: { version: 1, providers },
+      counts: { providers: Object.keys(providers).length },
+      warnings,
+    };
+  }
+
+  async analyzeImport(data: ProviderExportSection, ctx: ImportContext): Promise<PlanItem[]> {
+    const msg = ctx.msg;
+    const items: PlanItem[] = [];
+    for (const [route, entry] of Object.entries(data.providers)) {
+      const id = `provider:${route}`;
+      let current: NamespaceInfo | null = null;
+      let targetUnavailable = false;
+      try {
+        current = await ctx.target.settings.describe(entry.namespace, { redactSecrets: true });
+      } catch {
+        // 目标未注册该 namespace（缺少提供它的插件）→ 写入必失败，按依赖缺失处理（§15）
+        targetUnavailable = true;
+      }
+      if (targetUnavailable) {
+        items.push({
+          id, kind: 'MissingDependency', adapter: 'providers',
+          description: msg('adapter.providerUnregistered', { route, ns: entry.namespace }),
+          severity: 'warning', target: { adapter: 'providers', ref: entry.namespace },
+        });
+      } else if (current === null || isEmptyValue(current.value)) {
+        // 目标已注册但为空 → 初始化（Create）
+        items.push({
+          id, kind: 'Create', adapter: 'providers',
+          description: msg('adapter.providerCreate', { route, ns: entry.namespace }), severity: 'info',
+          target: { adapter: 'providers', ref: entry.namespace },
+        });
+      } else if (isDeepStrictEqual(current.value, entry.raw ?? stripEntry(entry))) {
+        items.push({ id, kind: 'Skip', adapter: 'providers', description: msg('adapter.providerSame', { route }), severity: 'info' });
+      } else {
+        items.push({
+          id, kind: 'Conflict', adapter: 'providers',
+          description: msg('adapter.providerDiff', { route }),
+          detail: `namespace=${entry.namespace} current=${JSON.stringify(current.value)} imported=${JSON.stringify(entry.raw ?? stripEntry(entry))}`.slice(0, 200),
+          severity: 'warning', target: { adapter: 'providers', ref: entry.namespace },
+        });
+      }
+    }
+    return items;
+  }
+
+  async applyItem(item: PlanItem, ctx: ImportContext): Promise<ApplyResult> {
+    const route = item.id.replace(/^provider:/, '');
+    const data = ctx.sections.get('providers') as ProviderExportSection | undefined;
+    const entry = data?.providers[route];
+    if (!entry) return { ok: false, message: ctx.msg('adapter.providerMissing', { route }) };
+    const value = entry.raw ?? stripEntry(entry);
+    let expected: number | undefined;
+    try {
+      expected = (await ctx.target.settings.describe(entry.namespace, { redactSecrets: true })).revision;
+    } catch {
+      expected = undefined; // 目标 namespace 不存在（Create）
+    }
+    await ctx.target.settings.replace(entry.namespace, value, expected);
+    return { ok: true };
+  }
+
+  async validate(data: ProviderExportSection, msg: MsgFunc = zhMsg): Promise<ValidationResult> {
+    const issues: ValidationResult['issues'] = [];
+    if (data === null || typeof data !== 'object') {
+      return { valid: false, issues: [{ path: '$', message: msg('adapter.validate.object', { subject: 'providers' }), severity: 'error' }] };
+    }
+    if (data.version !== 1) {
+      issues.push({ path: 'version', message: msg('adapter.validate.version', { value: String(data.version) }), severity: 'error' });
+    }
+    if (data.providers === null || typeof data.providers !== 'object') {
+      issues.push({ path: 'providers', message: msg('adapter.validate.missingObject', { subject: 'providers' }), severity: 'error' });
+    } else {
+      for (const [route, entry] of Object.entries(data.providers)) {
+        if (entry === null || typeof entry !== 'object') {
+          issues.push({ path: `providers.${route}`, message: msg('adapter.validate.recordObject', { subject: 'provider' }), severity: 'error' });
+          continue;
+        }
+        if (typeof entry.namespace !== 'string' || entry.namespace === '') {
+          issues.push({ path: `providers.${route}.namespace`, message: msg('adapter.validate.sourceNamespace'), severity: 'error' });
+        }
+        if (typeof entry.revision !== 'number') {
+          issues.push({ path: `providers.${route}.revision`, message: msg('adapter.validate.number', { subject: 'revision' }), severity: 'error' });
+        }
+      }
+    }
+    return { valid: issues.filter((i) => i.severity === 'error').length === 0, issues };
+  }
+}

package/src/adapters/roundtrip.test.ts

@@ -0,0 +1,190 @@
+/**
+ * 适配器集成往返测试：真实 adapter 列表（createAdapters）+ 核心引擎
+ * Exporter → ZIP → Importer（win32 → linux），验证：
+ *  - 全分区导出、Secret 值不进入 ZIP、路径映射、凭据补录报告、
+ *  - MCP/插件写 patch 的 needsRestart、重复导入幂等。
+ */
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import { Exporter } from '../core/exporter.ts';
+import { Importer } from '../core/importer.ts';
+import { parseZip } from '../utils/zip.ts';
+import { normalizePath } from '../utils/paths.ts';
+import { createAdapters } from './index.ts';
+import { makeContext, MemSnapshotStore, type MockHostContext } from './test-helpers.ts';
+
+const NS = ['general', 'theme', 'llm-deepseek', 'llm-pi-ai'];
+
+async function seedSource(ctx: MockHostContext): Promise<void> {
+  ctx.settings.ns.set('general', { value: { theme: 'dark', language: 'zh-CN' }, revision: 3, secrets: [] });
+  ctx.settings.ns.set('theme', { value: { mode: 'dark' }, revision: 1, secrets: [] });
+  ctx.settings.ns.set('llm-deepseek', {
+    value: { apiKeyEnv: 'DEEPSEEK_API_KEY', baseURL: 'https://api.deepseek.com', model: 'deepseek-chat', apiKey: 'sk-super-secret-value-123' },
+    revision: 5,
+    secrets: [{ path: ['apiKey'], set: true }],
+  });
+  ctx.settings.ns.set('llm-pi-ai', {
+    value: { providers: { openai: { apiKeyEnv: 'OPENAI_API_KEY', baseURL: 'https://api.openai.com', models: ['gpt-4o'] } } },
+    revision: 2,
+    secrets: [],
+  });
+  ctx.credentials.values.set('DEEPSEEK_API_KEY', 'sk-super-secret-value-123');
+  ctx.credentials.values.set('OPENAI_API_KEY', 'sk-openai-456');
+
+  await ctx.fs.writeFile('skills/coding.md', Buffer.from('# Coding skill\nUse deepseek.\n', 'utf8'));
+  await ctx.fs.writeFile('.agent-presets/work/agent.cordis.yml', Buffer.from('services:\n  - name: work\n', 'utf8'));
+  await ctx.fs.writeFile('dsh-ssh.json', Buffer.from('{"hosts":[]}', 'utf8'));
+
+  ctx.workspace.records.set('ws-ops', {
+    id: 'ws-ops', path: 'C:\\Users\\alice\\projects\\ops', title: 'OpsFlow', sessionIds: [],
+  });
+  ctx.patchFile.lines.set('mcp-fs', {
+    lineId: 'mcp-fs',
+    raw: { id: 'mcp-fs', name: 'dsh-mcp-client', config: { serverName: 'filesystem', command: 'npx', args: ['-y', '@modelcontextprotocol/server-filesystem'], cwd: 'C:\\Users\\alice\\projects' } },
+  });
+  ctx.patchFile.lines.set('persona-line', {
+    lineId: 'persona-line',
+    raw: { id: 'persona-line', name: '@deepseek-ai/dsh-web', config: { systemPrompt: { persona: 'You are a helpful assistant.' } } },
+  });
+}
+
+test('集成往返：win32 → linux（路径映射 + Secret 不泄 + 补录报告 + needsRestart + 幂等）', async () => {
+  const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'dsh-cm-adapters-'));
+  try {
+    const src = makeContext('win32', 'C:\\Users\\alice');
+    await seedSource(src);
+    const adapters = createAdapters({ namespaces: NS });
+    const zipPath = path.join(tmp, 'dsh-config-roundtrip.zip');
+    const exporter = new Exporter({
+      ctx: src, adapters, exporterVersion: '0.1.0',
+      now: () => new Date('2026-08-14T12:00:00.000Z'),
+    });
+    const result = await exporter.export({ includeSecrets: false, outPath: zipPath });
+    assert.equal(result.manifest.schemaVersion, 1);
+    assert.equal(result.manifest.security.containsSecrets, false);
+    assert.equal(result.report.security.redactedHits >= 1, true, 'apiKey 字段应被 scanner 剥离计数');
+
+    // ZIP 内容检查：secret 值绝不出现；插件二进制未打包
+    const archive = parseZip(await fs.readFile(zipPath));
+    const allText = archive.names()
+      .filter((n) => n !== 'integrity/checksums.json')
+      .map((n) => Buffer.from(archive.readEntry(n)).toString('utf8'))
+      .join('\n');
+    assert.ok(!allText.includes('sk-super-secret-value-123'), 'secret 值不得写入导出');
+    assert.ok(archive.has('config/settings.json'));
+    assert.ok(archive.has('config/ui.json'));
+    assert.ok(archive.has('ai/providers.json'));
+    assert.ok(archive.has('plugins/plugins.json'));
+    assert.ok(archive.has('mcp/servers.json'));
+    assert.ok(archive.has('custom/prompts.json'));
+    assert.ok(archive.has('custom/skills/coding.md'));
+    assert.ok(archive.has('agents/presets/work/agent.cordis.yml'));
+    assert.ok(archive.has('workspaces/workspaces.json'));
+    assert.ok(archive.has('security/credentials.json'));
+
+    // —— 目标机器（linux）导入 ——
+    const dst = makeContext('linux', '/home/bob');
+    // 目标已装相同插件（命名空间已注册但为空）→ 导入走 Create 初始化；未注册的命名空间会按 MissingDependency 跳过
+    for (const n of NS) dst.settings.registered.add(n);
+    const importer = new Importer({ ctx: dst, adapters, snapshotStore: new MemSnapshotStore() });
+
+    const analysis = await importer.analyzeImport(zipPath);
+    assert.equal(analysis.valid, true);
+    assert.equal(analysis.secretCount, 2, '两个已配置凭据（DEEPSEEK/OPENAI）需补录');
+    assert.equal(analysis.compatibility, 'partial'); // 跨平台
+    assert.ok(analysis.pathIssues.some((p) => p.kind === 'platformMismatch' && p.value.includes('C:\\Users\\alice')), '跨平台路径检测');
+
+    const plan = await importer.createImportPlan(zipPath, {
+      strategy: 'merge',
+      resolutions: {},
+      pathMappings: [{ oldPrefix: 'C:\\Users\\alice', newPrefix: '/home/bob', appliesTo: ['workspaces', 'mcp', 'pluginConfig', 'skills'] }],
+    });
+    assert.ok(plan.pathMappings.length >= 1);
+    assert.equal(plan.needsRestart, true, 'MCP/patch 行写入需要重启');
+
+    // Dry Run 零写入
+    assert.equal(dst.settings.ns.size, 0);
+    assert.equal(dst.patchFile.lines.size, 0);
+
+    const r = await importer.executeImportPlan(zipPath, plan, {
+      confirm: true,
+      secretInputs: { DEEPSEEK_API_KEY: 'sk-reentered' },
+    });
+    assert.equal(r.ok, true);
+
+    // settings/ui/providers 写回
+    assert.deepEqual(dst.settings.ns.get('general')?.value, { theme: 'dark', language: 'zh-CN' });
+    assert.deepEqual(dst.settings.ns.get('theme')?.value, { mode: 'dark' });
+    const llm = dst.settings.ns.get('llm-deepseek')?.value as Record<string, unknown>;
+    assert.equal(llm.apiKeyEnv, 'DEEPSEEK_API_KEY');
+    assert.equal(llm.apiKey, '', 'secret 字段剥离为空串');
+
+    // 文件类写回
+    assert.equal(Buffer.from(await dst.fs.readFile('skills/coding.md')).toString(), '# Coding skill\nUse deepseek.\n');
+    assert.equal(Buffer.from(await dst.fs.readFile('.agent-presets/work/agent.cordis.yml')).toString(), 'services:\n  - name: work\n');
+
+    // workspaces 路径映射
+    const ws = dst.workspace.records.get('ws-ops');
+    assert.ok(ws);
+    assert.equal(normalizePath(ws.path), '/home/bob/projects/ops', '绝对路径被映射');
+
+    // MCP / prompt patch 行写入（needsRestart 语义）
+    assert.ok(dst.patchFile.lines.has('mcp-fs'), 'MCP patch 行写入');
+    const mcpLine = dst.patchFile.lines.get('mcp-fs')?.raw as Record<string, unknown>;
+    assert.equal((mcpLine['config'] as Record<string, unknown>)['cwd'], '/home/bob/projects', 'MCP cwd 被映射');
+    const persona = dst.patchFile.lines.get('persona-line')?.raw as Record<string, unknown>;
+    assert.equal(((persona['config'] as Record<string, unknown>)['systemPrompt'] as Record<string, unknown>)['persona'], 'You are a helpful assistant.');
+
+    // 凭据：补录写入 + 未补录如实报告
+    assert.equal(dst.credentials.values.get('DEEPSEEK_API_KEY'), 'sk-reentered');
+    assert.ok(r.missingSecrets.includes('OPENAI_API_KEY'), '未补录的凭据进入报告');
+    assert.ok(!dst.credentials.values.has('OPENAI_API_KEY'), '未提供值不得写入');
+
+    // 幂等：再次导入 → 无新写入项（除 MissingSecret 占位）
+    const plan2 = await importer.createImportPlan(zipPath, {
+      strategy: 'merge',
+      resolutions: {},
+      pathMappings: [{ oldPrefix: 'C:\\Users\\alice', newPrefix: '/home/bob', appliesTo: ['workspaces', 'mcp', 'pluginConfig', 'skills'] }],
+    });
+    assert.ok(
+      !plan2.items.some((i) => i.kind === 'Create' || i.kind === 'Update' || i.kind === 'Install'),
+      '重复导入不产生新写入项',
+    );
+    const r2 = await importer.executeImportPlan(zipPath, plan2, { confirm: true, secretInputs: {} });
+    assert.ok(r2.executed.every((e) => e.status !== 'failed'), '第二次导入无失败项');
+    assert.equal(dst.patchFile.lines.size, 2, 'patch 行未被重复插入');
+  } finally {
+    await fs.rm(tmp, { recursive: true, force: true });
+  }
+});
+
+test('集成：pluginFiles 默认不导出 / sessions 默认不导出（manifest 标记 false）', async () => {
+  const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'dsh-cm-adapters-opt-'));
+  try {
+    const src = makeContext('win32', 'C:\\Users\\alice');
+    await src.fs.writeFile('dsh-ssh.json', Buffer.from('{"hosts":[]}', 'utf8'));
+    await src.fs.writeFile('sessions/p/s/s.jsonl.zstd', Buffer.from('x', 'utf8'));
+    const adapters = createAdapters({ namespaces: NS, includeSessions: true });
+    const zipPath = path.join(tmp, 'opt.zip');
+    const exporter = new Exporter({ ctx: src, adapters, exporterVersion: '0.1.0' });
+    const result = await exporter.export({ includeSecrets: false, outPath: zipPath });
+    assert.equal(result.manifest.sections.pluginFiles, false, 'pluginFiles 默认不导出');
+    assert.equal(result.manifest.sections.sessions, false, 'sessions 默认不导出');
+    const archive = parseZip(await fs.readFile(zipPath));
+    assert.ok(!archive.has('plugin-files/dsh-ssh.json'));
+    assert.ok(!archive.has('sessions/p/s/s.jsonl.zstd'));
+
+    // 显式勾选后导出
+    const zipPath2 = path.join(tmp, 'opt2.zip');
+    await exporter.export({ includeSecrets: false, only: ['pluginFiles', 'sessions'], outPath: zipPath2 });
+    const archive2 = parseZip(await fs.readFile(zipPath2));
+    assert.ok(archive2.has('plugin-files/dsh-ssh.json'));
+    assert.ok(archive2.has('sessions/p/s/s.jsonl.zstd'));
+  } finally {
+    await fs.rm(tmp, { recursive: true, force: true });
+  }
+});

package/src/adapters/self.test.ts

@@ -0,0 +1,92 @@
+/**
+ * self 分区 adapter 测试（插件自身配置备份）：
+ * 白名单收集（存在才收、白名单外不收、不递归）、Create/Skip/Conflict 分析、
+ * applyItem 写回 $DSH_HOME/dsh-config-manager/<rel>、默认包含 + portable 语义、
+ * createAdapters 的 selfDir 挂载行为（缺省挂载 / '' 不挂）。
+ */
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createAdapters } from './index.ts';
+import { SelfAdapter, SELF_CONFIG_FILES } from './self.ts';
+import { makeContext, makeImportContext } from './test-helpers.ts';
+
+test('self: 白名单收集（存在才收，子目录路径保留，白名单外不收集）', async () => {
+  const src = makeContext('win32', 'C:\\Users\\alice');
+  await src.fs.writeFile('dsh-config-manager/sync/sync-config.json', Buffer.from('{"transport":"git","git":{"repoUrl":"https://x"},"webdav":{}}', 'utf8'));
+  await src.fs.writeFile('dsh-config-manager/sync/sync-selection.json', Buffer.from('{"schemaVersion":1,"mode":"default"}', 'utf8'));
+  await src.fs.writeFile('dsh-config-manager/sync/ui-prefs.json', Buffer.from('{"schemaVersion":1,"lastSyncChannel":"webdav"}', 'utf8'));
+  // 白名单外：历史/缓存/快照/临时产物不得收集
+  await src.fs.writeFile('dsh-config-manager/sync/sync-history.json', Buffer.from('{"schemaVersion":1}', 'utf8'));
+  await src.fs.writeFile('dsh-config-manager/market/cache/index.json', Buffer.from('{}', 'utf8'));
+  await src.fs.writeFile('dsh-config-manager/snapshots/x/snapshot.json', Buffer.from('{}', 'utf8'));
+  await src.fs.writeFile('dsh-config-manager/tmp/tmp.zip', Buffer.from('PK', 'utf8'));
+
+  const adapter = new SelfAdapter();
+  const out = await adapter.export(src, { includeSecrets: false });
+  const rels = out.data.files.map((f) => f.relativePath).sort();
+  assert.deepEqual(rels, [
+    'sync/sync-config.json',
+    'sync/sync-selection.json',
+    'sync/ui-prefs.json',
+  ]);
+  assert.equal(out.counts.files, 3);
+  assert.equal(out.warnings.length, 0, '存在文件时不告警');
+  // 白名单常量齐全（sync-autosync 未创建时自然跳过）
+  assert.ok(SELF_CONFIG_FILES.includes('sync/sync-autosync.json'));
+});
+
+test('self: 默认包含 + portable（Quick Export 推荐项）', () => {
+  const adapter = new SelfAdapter();
+  assert.equal(adapter.defaultIncluded, true, '插件自身配置默认导出');
+  assert.equal(adapter.portability, 'portable');
+});
+
+test('self: 全部缺失 → 空分区 + dirEmpty 警告', async () => {
+  const src = makeContext('win32', 'C:\\Users\\alice');
+  const adapter = new SelfAdapter();
+  const out = await adapter.export(src, { includeSecrets: false });
+  assert.equal(out.data.files.length, 0);
+  assert.ok(out.warnings.length > 0, '缺失时给出提示');
+});
+
+test('self: 导入往返（Create → 写回 $DSH_HOME/dsh-config-manager/<rel>；幂等 Skip；不同 Conflict）', async () => {
+  const src = makeContext('win32', 'C:\\Users\\alice');
+  await src.fs.writeFile('dsh-config-manager/sync/sync-config.json', Buffer.from('{"transport":"git"}', 'utf8'));
+  const adapter = new SelfAdapter();
+  const out = await adapter.export(src, { includeSecrets: false });
+
+  const sections = new Map([['self', out.data]]);
+  const dst = makeContext('linux', '/home/bob');
+  let items = await adapter.analyzeImport(out.data, makeImportContext(dst, sections));
+  assert.equal(items.length, 1);
+  assert.equal(items[0]?.kind, 'Create');
+  const r = await adapter.applyItem(items[0]!, makeImportContext(dst, sections));
+  assert.equal(r.ok, true);
+  assert.equal(
+    Buffer.from(await dst.fs.readFile('dsh-config-manager/sync/sync-config.json')).toString(),
+    '{"transport":"git"}',
+    '导入写回 $DSH_HOME/dsh-config-manager/sync/sync-config.json（基准目录 + 相对路径）',
+  );
+
+  // 幂等：一致 → Skip
+  items = await adapter.analyzeImport(out.data, makeImportContext(dst, sections));
+  assert.equal(items[0]?.kind, 'Skip');
+
+  // 内容不同 → Conflict
+  await dst.fs.writeFile('dsh-config-manager/sync/sync-config.json', Buffer.from('{"transport":"webdav"}', 'utf8'));
+  items = await adapter.analyzeImport(out.data, makeImportContext(dst, sections));
+  assert.equal(items[0]?.kind, 'Conflict');
+});
+
+test('createAdapters: selfDir 缺省挂载 dsh-config-manager；空串不挂载', () => {
+  const withSelf = createAdapters({ selfDir: undefined });
+  assert.ok(withSelf.some((a) => a.id === 'self'), '缺省挂载 self adapter');
+
+  const withoutSelf = createAdapters({ selfDir: '' });
+  assert.ok(!withoutSelf.some((a) => a.id === 'self'), '空串 = 不挂载（自定义 dataDir 在 homeDir 外）');
+
+  const custom = createAdapters({ selfDir: 'my-config-data' });
+  const self = custom.find((a) => a.id === 'self') as SelfAdapter | undefined;
+  assert.ok(self !== undefined);
+  assert.equal(self.baseDir, 'my-config-data', '自定义相对目录透传');
+});

package/src/adapters/self.ts

@@ -0,0 +1,75 @@
+/**
+ * self 分区 adapter（插件自身配置，设计「self 分区」）：
+ * 数据源 = $DSH_HOME/dsh-config-manager/ 下的插件自身配置文件（白名单收集，非递归）：
+ *   - sync/sync-config.json     同步通道配置（git repoUrl / webdav url+username；凭据值走 credentials 槽位，不含 secret）
+ *   - sync/sync-autosync.json   自动同步调度配置
+ *   - sync/sync-selection.json  同步分区选择（默认/高级模式 + 勾选分区）
+ *   - sync/ui-prefs.json        插件 UI 偏好（如上次选择的同步通道；从 localStorage 迁入）
+ *
+ * 排除项：sync/sync-history.json（执行记录，属数据非配置）、market/cache/（缓存）、
+ * snapshots/（快照）、tmp/ exports/（临时/导出产物）——只备份「配置」，不备份数据。
+ *
+ * 实现：继承 FileCollectionAdapter 复用 analyzeImport/applyItem/validate（幂等 hash 比对、
+ * 快照/回滚路径一致），仅覆写 export() 为白名单收集（self 目录内存在大量非配置子目录，
+ * 不能像 skills/sessions 那样整体递归）。
+ *
+ * relativePath 一律是「相对 baseDir」的路径（如 sync/sync-config.json），与
+ * FileCollectionAdapter 的基准目录语义一致：导入时按 path.join(baseDir, rel) 写回
+ * $DSH_HOME/dsh-config-manager/<rel>；ZIP 内位于 self/<rel>。
+ *
+ * 安全不变量：配置文件本身不含凭据值（同步凭据走 DSH credentials 槽位引用），
+ * 且文件类分区不进 SecretScanner（与 pluginFiles/skills 同语义）。
+ */
+import path from 'node:path';
+import { msgOf } from '../core/messages.ts';
+import type { ExportOptions, ExportSection, HostContext } from '../core/types.ts';
+import type { FilesSection } from '../schema/types.ts';
+import { sha256Hex } from '../utils/hashing.ts';
+import { FileCollectionAdapter } from './file-collection.ts';
+
+/** self 分区白名单文件（相对 baseDir，即 $DSH_HOME/dsh-config-manager/）。 */
+export const SELF_CONFIG_FILES: readonly string[] = [
+  'sync/sync-config.json',
+  'sync/sync-autosync.json',
+  'sync/sync-selection.json',
+  'sync/ui-prefs.json',
+  // P0-④：导出产物备注清单（exports/.backup-notes.json）——随 self 分区迁移，
+  // 换机器后备份列表仍能看到手动导出时填写的备注
+  'exports/.backup-notes.json',
+];
+
+export class SelfAdapter extends FileCollectionAdapter {
+  readonly id = 'self' as const;
+  readonly displayName = 'Plugin Self Config';
+  readonly defaultIncluded = true;
+  readonly portability = 'portable' as const;
+  /** 插件自身配置目录（相对 homeDir；宿主按 dataDir 解析注入，缺省 dsh-config-manager） */
+  readonly baseDir: string;
+
+  constructor(baseDir = 'dsh-config-manager') {
+    super();
+    this.baseDir = baseDir;
+  }
+
+  /** 白名单收集：只导出配置类文件（存在才收），不递归（排除快照/历史/缓存/临时产物）。
+   *  relativePath 产出相对 baseDir 的路径（与 analyzeImport/applyItem 的 path.join(baseDir, ref) 匹配）。 */
+  override async export(ctx: HostContext, _options: ExportOptions): Promise<ExportSection<FilesSection>> {
+    const files: FilesSection['files'] = [];
+    const warnings: string[] = [];
+    for (const rel of SELF_CONFIG_FILES) {
+      // ctx.fs.readFile 语义 = 相对 homeDir 的完整路径 → 拼接 baseDir；产出仍为相对 baseDir
+      const data = await ctx.fs.readFile(path.join(this.baseDir, rel)).catch(() => null);
+      if (data === null) continue; // 未创建过的配置文件跳过（如从未配置市场/同步）
+      files.push({ relativePath: rel, data, contentHash: sha256Hex(data) });
+    }
+    if (files.length === 0) {
+      warnings.push(msgOf(ctx)('adapter.dirEmpty', { type: this.displayName }));
+    }
+    return {
+      sectionId: this.id,
+      data: { version: 1, files },
+      counts: { files: files.length },
+      warnings,
+    };
+  }
+}