@michengai/dsh-archive-manager 0.1.30 → 0.1.32

package/CHANGELOG.md

@@ -4,6 +4,19 @@
 
 Published release notes are retained below; new versions are added without removing earlier entries.
 
+## Unreleased
+
+## 0.1.32 - 2026-09-07
+
+- Fixed leftover session directories after deletion (#16): remove the entire session-owned directory after validating the official JSONL layout, preserve shared/unknown-backend parent directories, and refuse deletion through directory links.
+- Added regression coverage for directory and attachment cleanup, path encoding, shared-directory protection, and failed-deletion retries.
+- Kept relative JSONL storage roots stable across host working-directory changes and added warnings when directory ownership cannot be verified.
+
+## 0.1.31 - 2026-09-07
+
+- Added independent in-product update checks with automatic updates when a verified DSH update service is available and a profile-specific manual fallback otherwise.
+- Removed the update-button dependency on `react-dom/client` so the client can load on Hosts that do not register that module id.
+
 ## 0.1.30 — 2026-09-04
 
 - Kept failed archived-session deletions retryable until their transcript artifact is removed.

package/CHANGELOG.zh-CN.md

@@ -4,6 +4,19 @@
 
 以下发布说明会持续保留；新增版本时不再删除较早记录。
 
+## 未发布
+
+## 0.1.32 - 2026-09-07
+
+- 修复删除会话后遗留目录的问题（#16）：校验官方 JSONL 存储布局后清理完整会话专属目录，保留共享目录和未知后端的父目录，并拒绝通过目录符号链接进行删除。
+- 补充目录与附件清理、路径编码、共享目录保护及删除失败重试的回归测试。
+- 修复宿主工作目录变化导致相对 JSONL 存储根路径失效的问题，并为无法验证目录归属的降级删除增加警告。
+
+## 0.1.31 - 2026-09-07
+
+- 新增独立的插件内检查更新能力：仅在已验证的 DSH 更新服务可用时自动更新，其余环境提供与 Profile 对应的手工更新命令。
+- 更新按钮图标不再依赖 `react-dom/client`，避免宿主未注册该模块 id 时客户端无法加载。
+
 ## 0.1.30 — 2026-09-04
 
 - 归档会话物理删除失败时保留可重试状态，直至转录工件删除成功。

package/README.md

@@ -23,7 +23,7 @@
 
 - Archive a session from the sidebar session menu.
 - Archive every active chat in a workspace from its sidebar action menu.
-- Search archived chats, sort them by update time, creation time, or title, and filter them by workspace in **Settings → Archived**.
+- Search archived chats, sort them by update time, creation time, or title, and filter them by workspace in **Settings → Archived sessions**.
 - Restore a session to its original workspace with **Unarchive**.
 - Restore or permanently delete every archived chat in a project group.
 - Restore all archived chats from the page header.
@@ -38,9 +38,9 @@ Open the sidebar session menu and choose **Archive session**:
 
 ![Archive a session from the session menu](assets/screenshots/archive-session-menu.png)
 
-Search, sort, filter by project, unarchive, or permanently delete chats in **Settings → Archived**:
+Search, sort, filter by project, unarchive, or permanently delete chats in **Settings → Archived sessions**:
 
-![Archived chats settings page](assets/screenshots/archived-sessions.png)
+![Archived sessions settings page](assets/screenshots/archived-sessions.png)
 
 ## DSH product ecosystem
 
@@ -85,7 +85,7 @@ Install the DSH plugin from source at https://github.com/MichengAI/dsh-archive-m
 | Codex | Send one of the sentences above to Codex and let it install locally. |
 | WorkBuddy | Send one of the sentences above to WorkBuddy; for a source install you can also paste `https://github.com/MichengAI/dsh-archive-manager`. |
 
-Codex and WorkBuddy only install the plugin. After that, open DSH Web and use **Settings → Archived**.
+Codex and WorkBuddy only install the plugin. After that, open DSH Web and use **Settings → Archived sessions**.
 
 You can also run the same npm command yourself:
 
@@ -128,10 +128,14 @@ dsh --profile web --dump-config
 
 Restart DSH Web and hard-refresh the browser. `dsh plugin ... add .` reads the package metadata and `cordis.patch.yml`; do not install by copying `lib` directly.
 
+## Updates
+
+The settings title shows the installed version and a **Check for updates** button. When a newer release is available, **Update automatically** runs only when the DSH CLI or Desktop update service is available; otherwise, the dialog provides a profile-specific manual command to copy and run.
+
 ## Usage
 
 1. Open the sidebar session menu and choose **Archive session**.
-2. Open **Settings → Archived** to inspect sessions by workspace.
+2. Open **Settings → Archived sessions** to inspect sessions by workspace.
 3. Search by title, sort by update time, creation time, or title, or filter the list by project.
 4. Select **Unarchive** to restore one session, or select **Restore all** in the page header.
 5. Open a project heading's action menu to restore or delete all of that project's archived chats.
@@ -142,7 +146,10 @@ If the entry is missing after installation or upgrade, restart DSH Web and hard-
 ## Data handling limits
 
 - Deletion always requires confirmation.
-- It removes the session directory, workspace records, archive set, and projection cache.
+- It removes workspace records, archive markers, and the projection cache. For the official JSONL backend, a validated layout also allows removal of the session-owned directory and its contents, including attachments. Other backends or unknown layouts only lose the located transcript artifact, never its parent directory.
+- Project containers and storage roots are retained. Deletion refuses symbolic links or Windows junctions at the official layout's project/session directory levels and keeps the operation retryable.
+- Layout validation uses the official backend's initialized absolute root, so a relative root remains stable across host working-directory changes. If that field is unavailable, only an absolute configured root is accepted. An unverified official JSONL layout emits a warning with the session ID and artifact path before falling back to artifact-only deletion.
+- Directory validation is not a cross-process filesystem lock: do not concurrently move or replace storage directories or change directory links during deletion. Storage paths writable by untrusted processes are not a security isolation boundary.
 - A live session finishes writing before cleanup to prevent data truncation.
 - The plugin replaces DSH’s default workspace and projection services. Install through the DSH profile instead of manually composing the patch.
 

package/README.zh-CN.md

@@ -23,7 +23,7 @@
 
 - 在侧栏会话菜单中选择「归档会话」。
 - 在工作区侧栏操作菜单中一键归档该工作区全部未归档聊天。
-- 在「设置 → 已归档」按工作区查看归档会话，并支持搜索、按更新时间/创建时间/标题排序和按项目筛选。
+- 在「设置 → 归档会话」按工作区查看归档会话，并支持搜索、按更新时间/创建时间/标题排序和按项目筛选。
 - 安全取消归档，将会话恢复到原工作区位置。
 - 在项目分组中批量恢复或永久删除该项目的全部已归档聊天。
 - 在页面顶部一键恢复全部已归档聊天。
@@ -38,7 +38,7 @@
 
 ![从会话菜单归档会话](assets/screenshots/archive-session-menu.png)
 
-在「设置 → 已归档」中搜索、排序、按项目筛选、取消归档或永久删除：
+在「设置 → 归档会话」中搜索、排序、按项目筛选、取消归档或永久删除：
 
 ![已归档聊天设置页面](assets/screenshots/archived-sessions.png)
 
@@ -85,7 +85,7 @@
 | Codex | 把上面其中一句发给 Codex，让它在本机执行安装。 |
 | WorkBuddy | 把上面其中一句发给 WorkBuddy；源码安装也可同时粘贴仓库地址 `https://github.com/MichengAI/dsh-archive-manager`。 |
 
-Codex 和 WorkBuddy 只负责代装；装好后仍要打开 DSH Web 使用「设置 → 已归档」。
+Codex 和 WorkBuddy 只负责代装；装好后仍要打开 DSH Web 使用「设置 → 归档会话」。
 
 也可以自己执行同一条 npm 命令：
 
@@ -128,10 +128,14 @@ dsh --profile web --dump-config
 
 完成后重启 DSH Web 并硬刷新浏览器。`dsh plugin ... add .` 会读取当前目录的包信息和 `cordis.patch.yml`；不要改为直接复制 `lib` 目录。
 
+## 在线更新
+
+设置标题会显示当前版本和“检查更新”按钮。发现新版后，只有检测到 DSH CLI 或 Desktop 更新服务时才可使用“自动更新”；其他环境会在弹窗中提供可复制、与当前 Profile 对应的手工更新命令。
+
 ## 使用
 
 1. 在侧栏右键或打开会话菜单，选择「归档会话」。
-2. 打开「设置 → 已归档」，按工作区查看归档会话。
+2. 打开「设置 → 归档会话」，按工作区查看归档会话。
 3. 按标题搜索，按更新时间、创建时间或标题排序，或按项目筛选列表。
 4. 点击「取消归档」恢复单个会话，或在顶部点击「全部恢复」。
 5. 打开项目标题右侧菜单，可恢复或删除该项目的全部已归档聊天。
@@ -142,7 +146,10 @@ dsh --profile web --dump-config
 ## 数据处理边界
 
 - 删除操作始终需要确认。
-- 删除会移除会话目录、工作区记录、归档集合和投影缓存。
+- 删除会移除工作区记录、归档标记和投影缓存。官方 JSONL 后端在目录布局校验通过后，会一并删除会话专属目录及其中的附件等内容；其他后端或未知布局仅删除定位到的转录工件，不删除其父目录。
+- 不清理项目分组目录或存储根目录。官方布局的项目/会话目录若为符号链接或 Windows junction，会拒绝删除并保留可重试状态。
+- 布局校验优先使用官方后端初始化时确定的绝对根路径，相对路径配置不再受宿主工作目录变化影响；若无法取得该字段，则只接受绝对路径配置。官方 JSONL 布局校验失败时，会记录包含会话 ID 和工件路径的警告，再降级为仅删除工件。
+- 目录校验不是跨进程文件锁：删除期间不要由其他进程迁移、替换存储目录或改写目录链接。插件不将可被不可信进程改写的存储路径视为安全隔离边界。
 - 正在写入的会话会在完成写入后清理，避免截断数据。
 - 本插件替换 DSH 默认的工作区和会话投影服务；请仅通过 DSH profile 安装，避免手工拼接补丁配置。
 

package/lib/client.js

@@ -1,4 +1,295 @@
 (() => {
+  // src/plugin-update-ui.js
+  var UPDATE_HEADER = "x-michengai-plugin-update";
+  var STYLE_ID = "michengai-plugin-update-ui";
+  var CSS = `
+.mpi-version{margin-left:8px;color:var(--dsw-alias-label-tertiary,#9da1aa);font-family:inherit;font-size:12px;font-weight:500;line-height:18px;letter-spacing:0;white-space:nowrap;vertical-align:baseline}.mpi-check{display:inline-flex;align-items:center;justify-content:center;gap:6px;min-height:28px;padding:0 8px;border:1px solid var(--dsw-alias-border-l2,#4b4d52);border-radius:7px;background:transparent;color:var(--dsw-alias-label-secondary,#b8bbc2);font:inherit;font-size:12px;font-weight:500;line-height:18px;white-space:nowrap;cursor:pointer}.mpi-check:hover{background:var(--dsw-alias-interactive-bg-hover,#3a3b3f);color:var(--dsw-alias-label-primary,#fff)}.mpi-check:focus-visible,.mpi-action:focus-visible,.mpi-dialog-close:focus-visible{outline:2px solid var(--dsw-alias-state-business-primary,#4f8cff);outline-offset:2px}.mpi-icon{display:inline-flex;flex:0 0 auto;width:16px;height:16px;align-items:center;justify-content:center;pointer-events:none}.mpi-icon svg{display:block;width:16px;height:16px}
+.mpi-overlay{position:fixed;inset:0;z-index:2147483647;display:flex;align-items:center;justify-content:center;padding:24px;background:rgba(0,0,0,.62)}.mpi-dialog{position:relative;box-sizing:border-box;width:min(680px,100%);max-height:calc(100vh - 48px);overflow:auto;border:1px solid var(--dsw-alias-border-l2,#4b4d52);border-radius:14px;padding:22px;background:var(--dsw-alias-bg-layer-2,var(--dsw-specific-menu,#202124));color:var(--dsw-alias-label-primary,#fff);box-shadow:var(--dsw-shadow-lv3,0 16px 48px rgba(0,0,0,.24));font-family:inherit}.mpi-head{display:flex;align-items:center;justify-content:space-between;gap:12px}.mpi-dialog h2{margin:0;font-size:18px;line-height:26px}.mpi-dialog-close{display:inline-flex;flex:0 0 28px;width:28px;height:28px;align-items:center;justify-content:center;padding:0;border:0;border-radius:8px;background:transparent;color:var(--dsw-alias-label-secondary,#b8bbc2);cursor:pointer}.mpi-dialog-close:hover{background:var(--dsw-alias-interactive-bg-hover,#3a3b3f);color:var(--dsw-alias-label-primary,#fff)}.mpi-intro{margin:8px 0 18px;color:var(--dsw-alias-label-secondary,#c2c4ca);font-size:13px;line-height:20px}.mpi-meta{display:grid;grid-template-columns:max-content minmax(0,1fr);gap:8px 18px;margin:0 0 16px;font-size:12px;line-height:18px}.mpi-meta dt{color:var(--dsw-alias-label-secondary,#c2c4ca)}.mpi-meta dd{margin:0;font-family:ui-monospace,SFMono-Regular,Consolas,monospace}.mpi-status{margin:0 0 18px;border-radius:7px;padding:12px 14px;background:var(--dsw-alias-bg-layer-3,var(--dsw-specific-menu-item-hover,#252527));font-size:13px;font-weight:600;line-height:20px}.mpi-status[data-kind=error]{color:var(--dsw-alias-state-error-primary,#ff6464)}.mpi-status[data-kind=success]{color:var(--dsw-alias-state-success-primary,#36d67a)}.mpi-manual{border-top:1px solid var(--dsw-alias-border-l2,#4b4d52);padding-top:16px}.mpi-manual h3{margin:0 0 6px;font-size:14px;line-height:20px}.mpi-manual p{margin:0 0 10px;color:var(--dsw-alias-label-secondary,#c2c4ca);font-size:12px;line-height:18px}.mpi-command{display:flex;align-items:center;gap:8px;border:1px solid var(--dsw-alias-border-l2,#4b4d52);border-radius:7px;padding:10px;background:var(--dsw-alias-bg-layer-3,var(--dsw-specific-menu-item-hover,#252527))}.mpi-command code{min-width:0;flex:1;overflow:auto;font-family:ui-monospace,SFMono-Regular,Consolas,monospace;font-size:12px;line-height:18px;white-space:nowrap}.mpi-actions{display:flex;align-items:center;justify-content:flex-end;gap:12px;margin-top:18px}.mpi-actions-group{display:flex;gap:8px}.mpi-action{display:inline-flex;align-items:center;justify-content:center;gap:6px;min-height:32px;border:1px solid var(--dsw-alias-border-l2,#4b4d52);border-radius:7px;padding:6px 10px;background:transparent;color:inherit;font:inherit;font-size:12px;cursor:pointer}.mpi-action:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover,#414247)}.mpi-action:disabled{cursor:not-allowed;opacity:.55}.mpi-primary{border-color:var(--dsw-alias-state-business-primary,#4f8cff);background:var(--dsw-alias-state-business-primary,#4f8cff);color:#fff}.mpi-progress{height:4px;margin-top:10px;overflow:hidden;border-radius:99px;background:var(--dsw-alias-border-l2,#4b4d52)}.mpi-progress::after{display:block;width:32%;height:100%;background:var(--dsw-alias-state-business-primary,#4f8cff);content:'';animation:mpi-wave 1.15s ease-in-out infinite}@keyframes mpi-wave{from{transform:translateX(-110%)}to{transform:translateX(330%)}}@media(max-width:560px){.mpi-overlay{padding:10px}.mpi-dialog{max-height:calc(100vh - 20px);padding:16px}.mpi-actions{align-items:stretch}.mpi-actions-group{justify-content:flex-end;flex-wrap:wrap}.mpi-meta{grid-template-columns:1fr;gap:2px}.mpi-meta dd{margin-bottom:6px}}
+`;
+  var ZH = {
+    check: "\u68C0\u67E5\u66F4\u65B0",
+    update: "\u66F4\u65B0",
+    close: "\u5173\u95ED",
+    recheck: "\u91CD\u65B0\u68C0\u67E5",
+    auto: "\u81EA\u52A8\u66F4\u65B0",
+    updating: "\u6B63\u5728\u66F4\u65B0\u2026",
+    copy: "\u590D\u5236\u547D\u4EE4",
+    copied: "\u5DF2\u590D\u5236",
+    copyFailed: "\u590D\u5236\u5931\u8D25",
+    checking: "\u6B63\u5728\u68C0\u67E5\u66F4\u65B0\u2026",
+    latest: "\u5DF2\u662F\u6700\u65B0\u7248\u672C",
+    found: "\u53D1\u73B0\u65B0\u7248\u672C",
+    failed: "\u68C0\u67E5\u66F4\u65B0\u5931\u8D25\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5\u3002",
+    current: "\u8FD0\u884C\u7248\u672C",
+    latestLabel: "\u6700\u65B0\u7248\u672C",
+    profile: "\u76EE\u6807 profile",
+    unknown: "\u672A\u77E5",
+    manual: "\u624B\u5DE5\u66F4\u65B0",
+    manualHint: "\u81EA\u52A8\u66F4\u65B0\u5931\u8D25\u65F6\uFF0C\u53EF\u5728\u5F53\u524D DSH \u7EC8\u7AEF\u6267\u884C\u4EE5\u4E0B\u547D\u4EE4\uFF0C\u5B8C\u6210\u540E\u91CD\u542F DSH Web\u3002",
+    intro: "\u4EC5\u68C0\u67E5\u5E76\u66F4\u65B0\u5F53\u524D\u63D2\u4EF6\uFF0C\u4E0D\u4F1A\u8054\u52A8\u5B89\u88C5\u5176\u4ED6\u63D2\u4EF6\u3002",
+    restart: "\u66F4\u65B0\u5B8C\u6210\uFF0C\u8BF7\u91CD\u542F DSH Web\u3002",
+    restarting: "\u66F4\u65B0\u5B8C\u6210\uFF0C\u6B63\u5728\u91CD\u542F DSH Desktop\u2026",
+    unavailable: "\u5F53\u524D\u73AF\u5883\u4E0D\u652F\u6301\u81EA\u52A8\u66F4\u65B0\uFF0C\u8BF7\u4F7F\u7528\u624B\u5DE5\u66F4\u65B0\u547D\u4EE4\u3002"
+  };
+  var EN = {
+    check: "Check for updates",
+    update: "Update",
+    close: "Close",
+    recheck: "Check again",
+    auto: "Update automatically",
+    updating: "Updating\u2026",
+    copy: "Copy command",
+    copied: "Copied",
+    copyFailed: "Copy failed",
+    checking: "Checking for updates\u2026",
+    latest: "You are up to date",
+    found: "New version available",
+    failed: "Could not check for updates. Try again later.",
+    current: "Running version",
+    latestLabel: "Latest version",
+    profile: "Target profile",
+    unknown: "Unknown",
+    manual: "Manual update",
+    manualHint: "If automatic update fails, run this command in the current DSH terminal, then restart DSH Web.",
+    intro: "Only this plugin is checked and updated. Other plugins are not changed.",
+    restart: "Update complete. Restart DSH Web.",
+    restarting: "Update complete. Restarting DSH Desktop\u2026",
+    unavailable: "Automatic update is unavailable. Use the manual command."
+  };
+  function strings() {
+    const lang = document.documentElement.lang.toLowerCase();
+    const settings = document.querySelector('[role="dialog"]')?.textContent ?? "";
+    return lang.startsWith("en") || settings.includes("Settings") && !settings.includes("\u8BBE\u7F6E") ? EN : ZH;
+  }
+  function ensureStyle() {
+    if (document.getElementById(STYLE_ID) !== null) return;
+    const style = document.createElement("style");
+    style.id = STYLE_ID;
+    style.textContent = CSS;
+    (document.head ?? document.documentElement).append(style);
+  }
+  function validPayload(value) {
+    if (value === null || typeof value !== "object") return false;
+    const item = value;
+    return typeof item.packageName === "string" && typeof item.currentVersion === "string" && typeof item.updateAvailable === "boolean" && typeof item.profileName === "string" && typeof item.canAutoUpdate === "boolean" && typeof item.latestCheckFailed === "boolean" && (item.latestVersion === void 0 || typeof item.latestVersion === "string");
+  }
+  async function requestStatus(endpoint, method, signal) {
+    const signalOption = signal === void 0 ? {} : { signal };
+    const response = await fetch(endpoint, method === "GET" ? { cache: "no-store", ...signalOption } : {
+      method: "POST",
+      headers: { "content-type": "application/json", [UPDATE_HEADER]: "1" },
+      body: "{}",
+      ...signalOption
+    });
+    const value = await response.json();
+    if (!response.ok || !validPayload(value)) throw new Error(typeof value.error === "string" ? value.error : strings().failed);
+    return value;
+  }
+  function manualPluginUpdateCommand(profileName, packageName, version) {
+    const profile = profileName.trim() === "" ? "" : ` --profile ${profileName.trim()}`;
+    return `dsh plugin${profile} add ${packageName}@${version} --registry=https://registry.npmjs.org/`;
+  }
+  function handlePluginUpdateEscape(event, close) {
+    if (event.key !== "Escape") return false;
+    event.preventDefault();
+    event.stopPropagation();
+    event.stopImmediatePropagation();
+    close();
+    return true;
+  }
+  function observePluginUpdate(options) {
+    if (typeof document === "undefined" || document.body === null) return () => {
+    };
+    ensureStyle();
+    const controller = new AbortController();
+    let payload;
+    let overlay;
+    let frame;
+    const setButtonContent = (button, label, iconName) => {
+      const icon = options.createIcon(iconName);
+      icon.classList.add("mpi-icon");
+      icon.setAttribute("aria-hidden", "true");
+      const text = document.createElement("span");
+      text.dataset.mpiLabel = "";
+      text.textContent = label;
+      button.replaceChildren(icon, text);
+    };
+    const setButtonLabel = (button, label) => {
+      const text = button.querySelector("[data-mpi-label]");
+      if (text === null) button.textContent = label;
+      else text.textContent = label;
+    };
+    const applyControls = () => {
+      const row = document.querySelector(options.titleRowSelector);
+      if (row === null) return;
+      const heading = row.querySelector("h1,h2");
+      if (heading !== null && payload !== void 0) {
+        let version = heading.querySelector(`.mpi-version[data-package="${options.packageName}"]`);
+        if (version === null) {
+          version = document.createElement("span");
+          version.className = "mpi-version";
+          version.dataset.package = options.packageName;
+          heading.append(version);
+        }
+        const versionLabel = `v${payload.currentVersion}`;
+        if (version.textContent !== versionLabel) version.textContent = versionLabel;
+      }
+      const links = row.querySelector(options.linksSelector);
+      if (links === null || links.querySelector(`[data-mpi-check="${options.packageName}"]`) !== null) return;
+      const button = document.createElement("button");
+      button.type = "button";
+      button.className = "mpi-check";
+      button.dataset.mpiCheck = options.packageName;
+      setButtonContent(button, strings().check, "refresh");
+      button.addEventListener("click", openDialog);
+      links.append(button);
+    };
+    const load = async () => {
+      payload = await requestStatus(options.endpoint, "GET", controller.signal);
+      applyControls();
+      return payload;
+    };
+    const closeDialog = () => {
+      overlay?.remove();
+      overlay = void 0;
+    };
+    function openDialog() {
+      closeDialog();
+      const text = strings();
+      overlay = document.createElement("div");
+      overlay.className = "mpi-overlay";
+      const dialog = document.createElement("section");
+      dialog.className = "mpi-dialog";
+      dialog.setAttribute("role", "dialog");
+      dialog.setAttribute("aria-modal", "true");
+      dialog.innerHTML = `<header class="mpi-head"><h2></h2><button type="button" class="mpi-dialog-close" data-action="close"></button></header><p class="mpi-intro"></p><dl class="mpi-meta"><dt></dt><dd data-role="current"></dd><dt></dt><dd data-role="latest"></dd><dt></dt><dd data-role="profile"></dd></dl><div class="mpi-status" role="status"></div><div class="mpi-progress" hidden></div><section class="mpi-manual"><h3></h3><p></p><div class="mpi-command"><code></code><button type="button" class="mpi-action" data-action="copy"></button></div></section><footer class="mpi-actions"><div class="mpi-actions-group"><button type="button" class="mpi-action" data-action="check"></button><button type="button" class="mpi-action mpi-primary" data-action="update"></button></div></footer>`;
+      const name = document.documentElement.lang.toLowerCase().startsWith("en") ? options.enName : options.zhName;
+      dialog.querySelector("h2").textContent = `${name} ${text.update}`;
+      dialog.querySelector(".mpi-intro").textContent = text.intro;
+      const terms = dialog.querySelectorAll("dt");
+      terms[0].textContent = text.current;
+      terms[1].textContent = text.latestLabel;
+      terms[2].textContent = text.profile;
+      dialog.querySelector(".mpi-manual h3").textContent = text.manual;
+      dialog.querySelector(".mpi-manual p").textContent = text.manualHint;
+      const status = dialog.querySelector(".mpi-status");
+      const progress = dialog.querySelector(".mpi-progress");
+      const command = dialog.querySelector(".mpi-command code");
+      const close = dialog.querySelector("[data-action=close]");
+      const check = dialog.querySelector("[data-action=check]");
+      const update = dialog.querySelector("[data-action=update]");
+      const copy = dialog.querySelector("[data-action=copy]");
+      setButtonContent(close, text.close, "close");
+      close.querySelector("[data-mpi-label]")?.remove();
+      close.setAttribute("aria-label", text.close);
+      close.title = text.close;
+      setButtonContent(check, text.recheck, "refresh");
+      setButtonContent(update, text.auto, "download");
+      setButtonContent(copy, text.copy, "copy");
+      let busy = false;
+      const setMessage = (message, kind = "") => {
+        status.textContent = message;
+        status.dataset.kind = kind;
+      };
+      const setBusy = (value) => {
+        busy = value;
+        check.disabled = value;
+        copy.disabled = value;
+        update.disabled = value || payload?.canAutoUpdate !== true || payload.updateAvailable !== true;
+        progress.hidden = !value;
+      };
+      const render = () => {
+        dialog.querySelector("[data-role=current]").textContent = payload === void 0 ? text.unknown : `v${payload.currentVersion}`;
+        dialog.querySelector("[data-role=latest]").textContent = payload?.latestVersion === void 0 ? text.unknown : `v${payload.latestVersion}`;
+        dialog.querySelector("[data-role=profile]").textContent = payload?.profileName ?? text.unknown;
+        command.textContent = manualPluginUpdateCommand(payload?.profileName ?? "", options.packageName, payload?.latestVersion ?? "latest");
+        update.disabled = busy || payload?.canAutoUpdate !== true || payload.updateAvailable !== true;
+        if (payload === void 0) setMessage(text.checking);
+        else if (payload.latestCheckFailed) setMessage(text.failed, "error");
+        else if (payload.updateAvailable) setMessage(`${text.found}: v${payload.latestVersion ?? text.unknown}`);
+        else setMessage(text.latest, "success");
+        if (payload !== void 0 && !payload.canAutoUpdate && payload.updateAvailable) setMessage(text.unavailable);
+      };
+      const checkNow = async () => {
+        if (busy) return;
+        setBusy(true);
+        setMessage(text.checking);
+        try {
+          await load();
+          setBusy(false);
+          render();
+        } catch (error) {
+          setBusy(false);
+          setMessage(error instanceof Error ? error.message : text.failed, "error");
+        }
+      };
+      const updateNow = async () => {
+        if (busy) return;
+        setBusy(true);
+        setButtonLabel(update, text.updating);
+        setMessage(text.updating);
+        try {
+          payload = await requestStatus(options.endpoint, "POST", controller.signal);
+          applyControls();
+          render();
+          setMessage(payload.autoReload === true ? text.restarting : text.restart, "success");
+        } catch (error) {
+          setMessage(error instanceof Error ? error.message : text.failed, "error");
+        } finally {
+          setButtonLabel(update, text.auto);
+          setBusy(false);
+        }
+      };
+      close.addEventListener("click", closeDialog);
+      check.addEventListener("click", () => {
+        void checkNow();
+      });
+      update.addEventListener("click", () => {
+        void updateNow();
+      });
+      copy.addEventListener("click", () => {
+        void navigator.clipboard?.writeText(command.textContent ?? "").then(() => {
+          setButtonLabel(copy, text.copied);
+          setTimeout(() => {
+            setButtonLabel(copy, text.copy);
+          }, 1400);
+        }).catch(() => {
+          setButtonLabel(copy, text.copyFailed);
+        });
+      });
+      overlay.addEventListener("click", (event) => {
+        if (event.target === overlay) closeDialog();
+      });
+      overlay.addEventListener("keydown", (event) => {
+        handlePluginUpdateEscape(event, closeDialog);
+      }, true);
+      overlay.append(dialog);
+      document.body.append(overlay);
+      render();
+      close.focus();
+      void checkNow();
+    }
+    const observer = new MutationObserver(() => {
+      if (frame !== void 0) return;
+      frame = window.requestAnimationFrame(() => {
+        frame = void 0;
+        applyControls();
+      });
+    });
+    observer.observe(document.body, { childList: true, subtree: true });
+    applyControls();
+    void load().catch(() => {
+    });
+    return () => {
+      controller.abort();
+      observer.disconnect();
+      closeDialog();
+      if (frame !== void 0) window.cancelAnimationFrame(frame);
+      document.querySelectorAll(`[data-mpi-check="${options.packageName}"],.mpi-version[data-package="${options.packageName}"]`).forEach((node) => node.remove());
+    };
+  }
+
+  // src/client.js
   window.__ModuleLoader__.load({
     id: "@michengai/dsh-archive-manager",
     factory: (require2) => {
@@ -16,6 +307,32 @@
       let react_jsx_runtime = require2("react/jsx-runtime");
       let react = require2("react");
       let _deepseek_ai_dsh_client_ui_primitives = require2("@deepseek-ai/dsh-client-ui-primitives");
+      const UPDATE_ICON_PATHS = {
+        refresh: ["M13.5 5.5V2.5m0 0h-3m3 0-2.1 2.1A5.5 5.5 0 1 0 13.2 12"],
+        download: ["M8 2v8m0 0 3-3m-3 3-3-3M3 13v2h10v-2"],
+        copy: ["M5 5h8v8H5z", "M3 3h8"],
+        close: ["m4 4 8 8M12 4 4 12"]
+      };
+      function createPluginUpdateIcon(name) {
+        const element = document.createElement("span");
+        const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+        svg.setAttribute("viewBox", "0 0 16 16");
+        svg.setAttribute("width", "16");
+        svg.setAttribute("height", "16");
+        svg.setAttribute("fill", "none");
+        svg.setAttribute("stroke", "currentColor");
+        svg.setAttribute("stroke-width", "1.5");
+        svg.setAttribute("stroke-linecap", "round");
+        svg.setAttribute("stroke-linejoin", "round");
+        svg.setAttribute("aria-hidden", "true");
+        for (const d of UPDATE_ICON_PATHS[name]) {
+          const path = document.createElementNS("http://www.w3.org/2000/svg", "path");
+          path.setAttribute("d", d);
+          svg.append(path);
+        }
+        element.append(svg);
+        return element;
+      }
       const sessionIdSchema = {
         parse(value) {
           if (typeof value !== "string" || value.length === 0) throw new TypeError(`sessionId must be a non-empty string, got ${String(value)}`);
@@ -3180,9 +3497,9 @@
         "menu.addWorkspace": "\u6DFB\u52A0\u5DE5\u4F5C\u533A\u2026",
         "menu.unarchive": "\u53D6\u6D88\u5F52\u6863",
         "menu.deleteSession": "\u5220\u9664\u4F1A\u8BDD",
-        "archived.badge": "\u5DF2\u5F52\u6863",
+        "archived.badge": "\u5F52\u6863\u4F1A\u8BDD",
         "archived.notOpenable": "\u5DF2\u5F52\u6863\uFF0C\u53D6\u6D88\u5F52\u6863\u540E\u53EF\u7EE7\u7EED\u5BF9\u8BDD",
-        "archives.title": "\u5DF2\u5F52\u6863\u7684\u804A\u5929",
+        "archives.title": "\u5F52\u6863\u4F1A\u8BDD",
         "archives.description": "\u7BA1\u7406\u5DF2\u5F52\u6863\u7684\u4F1A\u8BDD\u3002",
         "archives.viewProject": "GitHub",
         "archives.feedback": "\u95EE\u9898\u53CD\u9988",
@@ -3310,9 +3627,9 @@
         "menu.addWorkspace": "Add workspace\u2026",
         "menu.unarchive": "Unarchive",
         "menu.deleteSession": "Delete session",
-        "archived.badge": "Archived",
+        "archived.badge": "Archived sessions",
         "archived.notOpenable": "This session is archived. Unarchive it to continue the conversation.",
-        "archives.title": "Archived chats",
+        "archives.title": "Archived sessions",
         "archives.description": "Manage archived sessions.",
         "archives.viewProject": "GitHub",
         "archives.feedback": "Issues",
@@ -3589,6 +3906,15 @@
           zh,
           en
         }), "dsh-archive-manager: dictionaries");
+        ctx.effect(() => observePluginUpdate({
+          endpoint: "/api/michengai/dsh-archive-manager/update",
+          packageName: "@michengai/dsh-archive-manager",
+          titleRowSelector: ".dsham_settingsTitleRow",
+          linksSelector: ".dsham_settingsLinks",
+          zhName: "\u5F52\u6863\u4F1A\u8BDD",
+          enName: "Archived sessions",
+          createIcon: createPluginUpdateIcon
+        }), "dsh-archive-manager: plugin update ui");
         const uiWorkspaceAt = () => ctx.get("uiWorkspace");
         const searchSessions = async (query, signal) => {
           const result = await ctx.sessions.search(query, signal);

package/lib/index.js

@@ -1,5 +1,13 @@
-function apply() {
+import { registerPluginUpdater } from "./plugin-updater.js";
+const inject = ["webServer"];
+function apply(ctx) {
+  return registerPluginUpdater(ctx, {
+    endpoint: "/api/michengai/dsh-archive-manager/update",
+    packageName: "@michengai/dsh-archive-manager",
+    manifestUrl: new URL("../package.json", import.meta.url)
+  });
 }
 export {
-  apply
+  apply,
+  inject
 };

package/lib/plugin-updater.js

@@ -0,0 +1,257 @@
+import { spawn } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { basename, dirname, isAbsolute, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+const PLUGIN_UPDATE_HEADER = "x-michengai-plugin-update";
+const PLUGIN_UPDATE_IPC = "apply-plugin-updates";
+function header(request, name) {
+  const value = request.headers?.[name];
+  return Array.isArray(value) ? value[0] : value;
+}
+function isLoopbackAddress(value) {
+  const address = value?.toLowerCase().replace(/^\[|\]$/g, "");
+  return address === "localhost" || address === "localhost." || address === "::1" || address?.startsWith("127.") === true || address?.startsWith("::ffff:127.") === true;
+}
+function isTrustedUpdateRequest(request) {
+  if (header(request, PLUGIN_UPDATE_HEADER) !== "1") return false;
+  if (!isLoopbackAddress(request.socket?.remoteAddress)) return false;
+  const site = header(request, "sec-fetch-site");
+  if (site !== void 0 && site !== "same-origin") return false;
+  const origin = header(request, "origin");
+  const host = header(request, "host");
+  if (origin === void 0 || host === void 0) return false;
+  try {
+    const url = new URL(origin);
+    return (url.protocol === "http:" || url.protocol === "https:") && isLoopbackAddress(url.hostname) && url.host === host;
+  } catch {
+    return false;
+  }
+}
+function validProfileName(value) {
+  return typeof value === "string" && value !== "" && value !== "." && value !== ".." && !value.includes("/") && !value.includes("\\") && !/[\0-\x1f\x7f]/.test(value);
+}
+function profileNameFromArgv(argv) {
+  for (let index = 2; index < argv.length; index += 1) {
+    if (argv[index] === "--profile") return argv[index + 1];
+    if (argv[index]?.startsWith("--profile=")) return argv[index].slice("--profile=".length);
+  }
+  return argv[2] === "web" ? "web" : void 0;
+}
+function isDshCliEntry(entry, manifest, packageRoot) {
+  if (typeof manifest !== "object" || manifest === null) return false;
+  if (manifest.name !== "@deepseek-ai/dsh") return false;
+  const bin = typeof manifest.bin === "string" ? manifest.bin : typeof manifest.bin === "object" && manifest.bin !== null ? manifest.bin.dsh : void 0;
+  return typeof bin === "string" && bin !== "" && !isAbsolute(bin) && resolve(packageRoot, bin) === resolve(entry);
+}
+function cliEntry() {
+  const value = process.argv[1];
+  if (value === void 0 || value === "") return void 0;
+  const entry = value.startsWith("file:") ? fileURLToPath(value) : resolve(process.cwd(), value);
+  if (!existsSync(entry)) return void 0;
+  for (let directory = dirname(entry); ; ) {
+    const manifestPath = resolve(directory, "package.json");
+    if (existsSync(manifestPath)) {
+      try {
+        if (isDshCliEntry(entry, JSON.parse(readFileSync(manifestPath, "utf8")), directory)) return entry;
+      } catch {
+      }
+    }
+    const parent = dirname(directory);
+    if (parent === directory) return void 0;
+    directory = parent;
+  }
+}
+function runtime(ctx) {
+  const profiles = ctx.get?.("desktopProfiles");
+  const desktopPnpm = ctx.get?.("desktopPnpm");
+  if (profiles?.current !== void 0) {
+    const current = profiles.current;
+    if (!validProfileName(current.name) || typeof current.dir !== "string" || !isAbsolute(current.dir)) {
+      throw new Error("\u5F53\u524D Desktop Profile \u4FE1\u606F\u65E0\u6548\uFF0C\u8BF7\u91CD\u542F\u540E\u91CD\u8BD5\u3002");
+    }
+    return { profileName: current.name, profileDir: resolve(current.dir), ...typeof desktopPnpm?.runPlugin === "function" ? { desktopPnpm } : {} };
+  }
+  const profileDir = resolve(process.env.DSH_PROFILE_DIR ?? resolve(homedir(), ".dsh", "profiles", "web"));
+  const selected = profileNameFromArgv(process.argv);
+  const profileName = validProfileName(selected) ? selected : validProfileName(basename(profileDir)) ? basename(profileDir) : "web";
+  const entry = cliEntry();
+  return { profileName, profileDir, ...entry === void 0 ? {} : { cliEntry: entry } };
+}
+function parseSemver(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value);
+  if (match === null) return void 0;
+  return { core: [Number(match[1]), Number(match[2]), Number(match[3])], prerelease: match[4]?.split(".") ?? [] };
+}
+function isNewerVersion(currentValue, candidateValue) {
+  const current = parseSemver(currentValue);
+  const candidate = parseSemver(candidateValue);
+  if (current === void 0 || candidate === void 0) return false;
+  for (let index = 0; index < 3; index += 1) {
+    if (candidate.core[index] !== current.core[index]) return candidate.core[index] > current.core[index];
+  }
+  return comparePrerelease(candidate.prerelease, current.prerelease) > 0;
+}
+function comparePrerelease(left, right) {
+  if (left.length === 0 || right.length === 0) return left.length === right.length ? 0 : left.length === 0 ? 1 : -1;
+  const length = Math.max(left.length, right.length);
+  for (let index = 0; index < length; index += 1) {
+    const a = left[index];
+    const b = right[index];
+    if (a === void 0 || b === void 0) return a === b ? 0 : a === void 0 ? -1 : 1;
+    if (a === b) continue;
+    const aNumeric = /^\d+$/.test(a);
+    const bNumeric = /^\d+$/.test(b);
+    if (aNumeric && bNumeric) {
+      const aNumber = BigInt(a);
+      const bNumber = BigInt(b);
+      if (aNumber !== bNumber) return aNumber > bNumber ? 1 : -1;
+      continue;
+    }
+    if (aNumeric !== bNumeric) return aNumeric ? -1 : 1;
+    return a > b ? 1 : -1;
+  }
+  return 0;
+}
+let latestCache;
+async function latestVersion(packageName) {
+  if (latestCache?.packageName === packageName && Date.now() < latestCache.expiresAt) return latestCache.version;
+  try {
+    const response = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}/latest`, { signal: AbortSignal.timeout(8e3) });
+    if (!response.ok) return void 0;
+    const value = await response.json();
+    if (typeof value.version !== "string" || value.version === "") return void 0;
+    latestCache = { packageName, version: value.version, expiresAt: Date.now() + 5 * 6e4 };
+    return value.version;
+  } catch {
+    return void 0;
+  }
+}
+async function currentVersion(manifestUrl) {
+  const value = JSON.parse(await readFile(manifestUrl, "utf8"));
+  if (typeof value.version !== "string" || value.version === "") throw new Error("\u65E0\u6CD5\u8BFB\u53D6\u5F53\u524D\u63D2\u4EF6\u7248\u672C\u3002");
+  return value.version;
+}
+async function status(options, target) {
+  const current = await currentVersion(options.manifestUrl);
+  const latest = await latestVersion(options.packageName);
+  return {
+    packageName: options.packageName,
+    currentVersion: current,
+    ...latest === void 0 ? {} : { latestVersion: latest },
+    latestCheckFailed: latest === void 0,
+    updateAvailable: latest !== void 0 && isNewerVersion(current, latest),
+    profileName: target.profileName,
+    canAutoUpdate: target.desktopPnpm !== void 0 || target.cliEntry !== void 0
+  };
+}
+async function runCliInstall(target, packageSpec) {
+  if (target.cliEntry === void 0) throw new Error("\u5F53\u524D\u73AF\u5883\u4E0D\u652F\u6301\u81EA\u52A8\u66F4\u65B0\uFF0C\u8BF7\u4F7F\u7528\u624B\u5DE5\u66F4\u65B0\u547D\u4EE4\u3002");
+  await new Promise((resolvePromise, reject) => {
+    const child = spawn(process.execPath, [target.cliEntry, "plugin", "--profile", target.profileName, "add", "--config.minimumReleaseAge=0", packageSpec, "--registry=https://registry.npmjs.org/"], {
+      cwd: target.profileDir,
+      windowsHide: true,
+      stdio: ["ignore", "pipe", "pipe"],
+      env: { ...process.env, NO_COLOR: "1" }
+    });
+    let detail = "";
+    child.stdout?.on("data", (chunk) => {
+      detail = (detail + String(chunk)).slice(-4e3);
+    });
+    child.stderr?.on("data", (chunk) => {
+      detail = (detail + String(chunk)).slice(-4e3);
+    });
+    const timer = setTimeout(() => {
+      child.kill();
+      reject(new Error("\u66F4\u65B0\u8D85\u65F6\uFF0C\u8BF7\u6539\u7528\u624B\u5DE5\u66F4\u65B0\u3002"));
+    }, 10 * 6e4);
+    child.once("error", (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    child.once("exit", (code) => {
+      clearTimeout(timer);
+      if (code === 0) resolvePromise();
+      else reject(new Error(detail.trim() || `\u66F4\u65B0\u8FDB\u7A0B\u9000\u51FA\u7801 ${String(code)}`));
+    });
+  });
+}
+async function install(target, packageSpec) {
+  if (target.desktopPnpm === void 0) return runCliInstall(target, packageSpec);
+  const handle = target.desktopPnpm.runPlugin(["add", "--config.minimumReleaseAge=0", packageSpec, "--registry=https://registry.npmjs.org/"], target.profileDir);
+  const result = await handle.done;
+  if (result.exitCode !== 0) throw new Error(`\u66F4\u65B0\u8FDB\u7A0B\u9000\u51FA\u7801 ${String(result.exitCode)}\u3002`);
+}
+function json(response, statusCode, value) {
+  response.writeHead(statusCode, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" });
+  response.end(JSON.stringify(value));
+}
+function publicError(error) {
+  const message = error instanceof Error ? error.message : "\u66F4\u65B0\u6682\u4E0D\u53EF\u7528\u3002";
+  return /[A-Za-z]:[\\/]|\/(?:home|root|Users|var|tmp)\//.test(message) ? "\u66F4\u65B0\u5931\u8D25\uFF0C\u8BF7\u67E5\u770B\u670D\u52A1\u7AEF\u65E5\u5FD7\u3002" : message;
+}
+function registerPluginUpdater(ctx, options) {
+  const host = ctx;
+  let installing = false;
+  return host.webServer.register({
+    kind: "exact",
+    path: options.endpoint,
+    handler: async (request, response) => {
+      try {
+        const target = runtime(host);
+        if (request.method === "GET" || request.method === "HEAD") {
+          const payload = await status(options, target);
+          response.writeHead(200, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" });
+          response.end(request.method === "HEAD" ? void 0 : JSON.stringify(payload));
+          return;
+        }
+        if (request.method !== "POST") {
+          response.writeHead(405, { allow: "GET, HEAD, POST" });
+          response.end();
+          return;
+        }
+        if (!isTrustedUpdateRequest(request)) {
+          json(response, 403, { error: "\u5DF2\u62D2\u7EDD\u975E\u672C\u673A\u540C\u6E90\u66F4\u65B0\u8BF7\u6C42\u3002" });
+          return;
+        }
+        if (installing) {
+          json(response, 409, { error: "\u5F53\u524D\u63D2\u4EF6\u6B63\u5728\u66F4\u65B0\uFF0C\u8BF7\u7A0D\u5019\u3002" });
+          return;
+        }
+        const before = await status(options, target);
+        if (before.latestVersion === void 0) {
+          json(response, 503, { error: "\u6682\u65F6\u65E0\u6CD5\u83B7\u53D6\u6700\u65B0\u7248\u672C\u3002" });
+          return;
+        }
+        if (!before.updateAvailable) {
+          json(response, 200, before);
+          return;
+        }
+        installing = true;
+        try {
+          await install(target, `${options.packageName}@${before.latestVersion}`);
+        } finally {
+          installing = false;
+        }
+        const notifyParent = target.desktopPnpm === void 0 && typeof process.send === "function";
+        const autoReload = target.desktopPnpm !== void 0 || notifyParent;
+        json(response, 200, { ...before, updatedVersion: before.latestVersion, restartRequired: true, autoReload });
+        if (notifyParent) setTimeout(() => {
+          process.send?.(PLUGIN_UPDATE_IPC);
+        }, 150).unref?.();
+      } catch (error) {
+        ctx.logger.warn(`plugin updater failed: ${String(error)}`);
+        json(response, 503, { error: publicError(error) });
+      }
+    }
+  });
+}
+export {
+  PLUGIN_UPDATE_HEADER,
+  PLUGIN_UPDATE_IPC,
+  isDshCliEntry,
+  isNewerVersion,
+  isTrustedUpdateRequest,
+  registerPluginUpdater
+};

package/lib/workspace.js

@@ -1,10 +1,29 @@
-import { rm } from "node:fs/promises";
+import { lstat, rm } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import {
   WorkspaceRegistry
 } from "@deepseek-ai/dsh-workspace";
 import { bindTypertRemote, Remote } from "@deepseek-ai/dsh-typert-protocol";
 import { sessionDir } from "@deepseek-ai/dsh-spill-local";
 import { trackTombstone } from "./tombstone.js";
+function jsonlSessionDirectory(persistence, header, location) {
+  if (persistence.name !== "session-persistence-jsonl" || location.kind !== "jsonl") return;
+  const root = persistence.root ?? persistence.config?.root;
+  if (typeof root !== "string" || !isAbsolute(root) || !isAbsolute(location.path)) return;
+  if (!["session.jsonl", "session.jsonl.zstd"].includes(basename(location.path))) return;
+  if (typeof header.id !== "string" || header.id.length === 0) return;
+  const encode = (text) => text.replace(/[^A-Za-z0-9._-]/g, (ch) => `~${ch.charCodeAt(0).toString(16).toUpperCase().padStart(4, "0")}`);
+  const segment = header.id === "." ? "~002E" : header.id === ".." ? "~002E~002E" : encode(header.id);
+  let project = "_no-cwd";
+  if (header.cwd !== void 0) {
+    if (typeof header.cwd !== "string" || header.cwd.length === 0) return;
+    const readable = encode(header.cwd.replace(/[\\/:]+/g, "-")).replace(/^-+/, "") || "root";
+    project = `--${readable.slice(0, 251)}--`;
+  }
+  const directory = join(resolve(root), project, segment);
+  if (location.path !== join(directory, basename(location.path))) return;
+  return directory;
+}
 function markRemoteMethod(instance, method) {
   const context = {
     private: false,
@@ -577,7 +596,7 @@ var ArchiveWorkspaceRegistry = class extends WorkspaceRegistry {
       this.ctx.logger.warn(`archive-manager: could not publish removal for stored session "${sessionId}": ${String(error)}`);
     }
   }
-  /** 删除后端定位到的会话转录工件，绝不推导或删除其父目录。 */
+  /** 官方 JSONL 已知布局清理会话专属目录；其他后端只删除定位到的工件。 */
   async removeTranscriptDirectory(sessionId) {
     const persistence = this.ctx.get("sessionPersistence");
     if (persistence === void 0 || typeof persistence.locate !== "function") {
@@ -588,10 +607,28 @@ var ArchiveWorkspaceRegistry = class extends WorkspaceRegistry {
     if (location === void 0 || typeof location.path !== "string") {
       throw new Error(`cannot delete session "${sessionId}": the session persistence backend could not resolve its transcript artifact`);
     }
+    let target = { path: location.path, kind: "transcript artifact" };
     try {
-      await rm(location.path, { recursive: true, force: true });
+      const directory = jsonlSessionDirectory(persistence, header, location);
+      if (directory !== void 0) {
+        target = { path: directory, kind: "session directory" };
+        for (const path of [dirname(directory), directory]) {
+          let stat;
+          try {
+            stat = await lstat(path);
+          } catch (error) {
+            if (error?.code === "ENOENT") continue;
+            throw error;
+          }
+          if (stat.isSymbolicLink()) throw new Error(`refusing to delete through symbolic link "${path}"`);
+          if (!stat.isDirectory()) throw new Error(`expected session storage directory "${path}"`);
+        }
+      } else if (persistence.name === "session-persistence-jsonl") {
+        this.ctx.logger.warn(`archive-manager: session "${sessionId}": JSONL directory ownership could not be verified; falling back to artifact-only deletion at "${location.path}" (parent directory retained)`);
+      }
+      await rm(target.path, { recursive: true, force: true });
     } catch (error) {
-      const message = `cannot delete session "${sessionId}": transcript artifact "${location.path}" remains before bookkeeping cleanup`;
+      const message = `cannot delete session "${sessionId}": cleanup of ${target.kind} "${target.path}" failed; bookkeeping retained for retry`;
       const detail = `${message}: ${String(error)}`;
       this.ctx.logger.warn(`archive-manager: ${detail}`);
       throw new Error(detail, { cause: error });

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@michengai/dsh-archive-manager",
-  "version": "0.1.30",
+  "version": "0.1.32",
   "description": "NPM-installable DSH Web plugin for managing archived sessions.",
   "type": "module",
-  "packageManager": "pnpm@11.21.0",
+  "packageManager": "pnpm@11.22.0",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"
   },
@@ -43,6 +43,7 @@
     "@deepseek-ai/dsh-client-ui-primitives": ">=0.1.0-rc.5 <0.2.0",
     "@deepseek-ai/dsh-client-ui-sidebar": ">=0.1.0-rc.5 <0.2.0",
     "@deepseek-ai/dsh-client-ui-workspace": ">=0.1.0-rc.5 <0.2.0",
+    "@deepseek-ai/dsh-host-webserver": ">=0.1.0-rc.5 <0.2.0",
     "@deepseek-ai/dsh-session": ">=0.1.0-rc.5 <0.2.0",
     "@deepseek-ai/dsh-session-projection-cache": ">=0.1.0-rc.5 <0.2.0",
     "@deepseek-ai/dsh-spill-local": ">=0.1.0-rc.5 <0.2.0",
@@ -70,6 +71,7 @@
     "@deepseek-ai/dsh-client-ui-sidebar": "0.1.2-rc.1",
     "@deepseek-ai/dsh-client-ui-slots": "0.1.2-rc.1",
     "@deepseek-ai/dsh-client-ui-workspace": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "0.1.2-rc.1",
     "@deepseek-ai/dsh-invariants": "0.1.2-rc.1",
     "@deepseek-ai/dsh-scope": "0.1.2-rc.1",
     "@deepseek-ai/dsh-session": "0.1.2-rc.1",