@noob-stupid/dsh-plugin-console 0.5.95 → 0.5.97

package/lib/client.js

@@ -387,6 +387,51 @@
 			gateRowFromUpgrade: "来源：框架升级预扫",
 			gateRowAt: " · {t}",
 			gateRowAdoptable: " · 已通过源码扫描，可解锁",
+			// ★ 0.5.x 加法（用户 2026-10-18）：「安全启动」在界面上的入口 —— 门控面板里的一个分区。
+			//   用户原话「现在这能力藏得太深，只有命令行能用」；这里只做展示 + 两段式上膛，
+			//   判据与动作白名单全在服务端 POST /plugin-console/safe-boot。
+			safeBootSectionTitle: "安全启动",
+			safeBootToggleTitle: "展开/收起安全启动面板（只有展开那一下才读一次快照列表，收起时零请求）",
+			safeBootSectionHint: "服务还能应答时的出路：回到上次好的补丁状态、或只禁可疑行。服务起不来时用下面的命令行兜底。",
+			safeBootLoading: "正在读取快照列表…",
+			safeBootReload: "重新读取",
+			safeBootListFailed: "读取快照失败：",
+			safeBootEmpty: "还没有快照：",
+			safeBootNotWritten: "本次没有写新快照：",
+			safeBootReasonPatchInvalid: "补丁结构校验没过，快照闸门没放行",
+			safeBootReasonNoPatch: "没有补丁文件，没有可写的材料",
+			safeBootReasonEnvChanged: "环境指纹刚变过，还没确认服务正常",
+			safeBootReasonUnchanged: "内容与最新快照逐字节相同，无需再写一份",
+			safeBootReasonNotYet: "还没到该写的时机（快照只在服务确认正常、且环境指纹未变时才写）",
+			safeBootCount: "快照 {n} 份",
+			safeBootLastGoodId: "最后标记为良好：",
+			safeBootLastGood: "良好（last-good）",
+			safeBootRowAt: "时间",
+			safeBootRowSha: "sha256",
+			safeBootRestore: "恢复上次好的状态",
+			safeBootRestoreTitle: "两段式：第一下只是上膛并写明要恢复到哪份快照，确认后才真发请求",
+			safeBootDisable: "只禁用可疑行",
+			safeBootDisableTitle: "两段式：只给自动预检点名的行追加 disabled: true，不做整树回滚",
+			safeBootMarkGood: "标记当前为好的状态",
+			safeBootMarkGoodTitle: "把最新这份快照标记为良好（永不随保留策略删除）；成功后自动刷新列表",
+			safeBootArmRestore: "要恢复到的快照：",
+			safeBootArmRestoreOverwrite: "会把这个补丁文件整份覆盖成快照内容（不做合并），改前先另存备份：",
+			safeBootArmDisable: "只给这些行追加 disabled: true：",
+			safeBootArmDisableNote: "不删任何行、不做整树回滚，改前先另存备份。",
+			safeBootConfirm: "确认执行",
+			safeBootCancel: "取消（不发任何请求）",
+			safeBootDoneRestore: "已按快照逐字节恢复（改前状态已备份）",
+			safeBootDoneDisable: "已只给点名行追加 disabled: true（其余逐字节未动）：",
+			safeBootDoneMarkGood: "已标记为良好：这份快照不再随保留策略删除：",
+			safeBootDisabledSkipped: "跳过",
+			safeBootNoopRestore: "当前补丁与快照逐字节一致，无需恢复（已备份当前状态）",
+			safeBootNoSuspects: "服务端没点名任何可疑行，一个字节都没改",
+			safeBootSuspectsTitle: "自动预检点名的可疑行：",
+			safeBootSuspectsNone: "自动预检还没点名任何可疑行 —— 所以这里不显示「只禁用可疑行」按钮（点了也没东西可禁）",
+			safeBootNoSnapshotActions: "没有快照可操作：「恢复」与「标记为良好」都要先有快照，所以这两个按钮不显示",
+			safeBootFailed: "操作失败：",
+			safeBootCmdHint: "服务起不来时（命令行兜底，无需服务在跑）：",
+			safeBootBusy: "进行中…",
 			starHint: "喜欢这个插件？去 GitHub 点个 Star",
 			starHintTitle: "在新标签页打开 GitHub 项目",
 			fwFailedButUpgraded: "框架本体其实已经升到 {v} 并已生效——失败的只是脚本最后「重启服务」那一步。可点「重启服务」确认，或必要时回滚。",
@@ -1120,6 +1165,48 @@
 			gateRowFromUpgrade: "Source: framework upgrade pre-scan",
 			gateRowAt: " · {t}",
 			gateRowAdoptable: " · passed the source scan, can be unlocked",
+			safeBootSectionTitle: "Safe boot",
+			safeBootToggleTitle: "Expand/collapse the safe-boot panel (the snapshot list is read once per expand — zero requests while collapsed)",
+			safeBootSectionHint: "Ways out while the service still answers: return to the last good patch state, or disable suspect rows only. When the service cannot start, use the command below.",
+			safeBootLoading: "Reading the snapshot list…",
+			safeBootReload: "Reload",
+			safeBootListFailed: "Could not read snapshots: ",
+			safeBootEmpty: "No snapshot yet: ",
+			safeBootNotWritten: "No new snapshot was written this time: ",
+			safeBootReasonPatchInvalid: "the patch failed the structural check, so the snapshot gate refused to write",
+			safeBootReasonNoPatch: "there is no patch file, so there is nothing to snapshot",
+			safeBootReasonEnvChanged: "the environment fingerprint just changed, the service is not confirmed healthy yet",
+			safeBootReasonUnchanged: "byte-identical to the newest snapshot, no need to write another one",
+			safeBootReasonNotYet: "the moment has not arrived yet (snapshots are written only once the service is confirmed healthy and the environment fingerprint has not changed)",
+			safeBootCount: "Snapshots: {n}",
+			safeBootLastGoodId: "Last marked good: ",
+			safeBootLastGood: "good (last-good)",
+			safeBootRowAt: "at",
+			safeBootRowSha: "sha256",
+			safeBootRestore: "Restore last-good state",
+			safeBootRestoreTitle: "Two steps: the first click only arms it and names the snapshot, the request goes out after you confirm",
+			safeBootDisable: "Disable suspect rows only",
+			safeBootDisableTitle: "Two steps: append disabled: true to the rows named by auto-preflight only, never a whole-tree rollback",
+			safeBootMarkGood: "Mark the current state as good",
+			safeBootMarkGoodTitle: "Mark the newest snapshot as good (never removed by retention); the list refreshes afterwards",
+			safeBootArmRestore: "Snapshot to restore:",
+			safeBootArmRestoreOverwrite: "It overwrites this whole patch file with the snapshot content (no merge); the current state is backed up first:",
+			safeBootArmDisable: "Append disabled: true to these rows only:",
+			safeBootArmDisableNote: "No row is deleted and there is no whole-tree rollback; the current state is backed up first.",
+			safeBootConfirm: "Confirm",
+			safeBootCancel: "Cancel (sends nothing)",
+			safeBootDoneRestore: "Restored byte-for-byte from the snapshot (previous state backed up)",
+			safeBootDoneDisable: "Appended disabled: true to the named rows only (everything else untouched):",
+			safeBootDoneMarkGood: "Marked as good: this snapshot is never removed by retention:",
+			safeBootDisabledSkipped: "skipped",
+			safeBootNoopRestore: "The patch is already byte-identical to the snapshot — nothing to restore (current state was backed up)",
+			safeBootNoSuspects: "The server named no suspect rows, so not a single byte changed",
+			safeBootSuspectsTitle: "Rows named by auto-preflight:",
+			safeBootSuspectsNone: "Auto-preflight has not named any suspect row yet — so the \"disable suspect rows only\" button is not shown (there would be nothing to disable)",
+			safeBootNoSnapshotActions: "Nothing to act on: restore and mark-as-good both need an existing snapshot, so those two buttons are not shown",
+			safeBootFailed: "Action failed: ",
+			safeBootCmdHint: "When the service cannot start (offline fallback, no running server needed):",
+			safeBootBusy: "working…",
 			starHint: "Enjoying this plugin? Star it on GitHub",
 			starHintTitle: "Open the GitHub project in a new tab",
 			fwFailedButUpgraded: "The framework itself is already on {v} and active — only the final \"restart service\" step failed. Use Restart service to confirm, or roll back if needed.",
@@ -5695,6 +5782,312 @@ const RESTART_FAILED_NOTE = "重启请求失败";
 			const [compatNoticeClosed, setCompatNoticeClosed] = react.useState(false);
 			const gateRows = gateReady ? (state.data.gating ?? null) : null;
 			const gateTime = (ms) => (typeof ms === "number" && ms > 0 ? new Date(ms).toLocaleString() : "—");
+			// ══ 安全启动（门控面板里的一个分区）══════════════════════════════════════════════
+			// 用户 2026-10-18 原话：「现在这能力藏得太深，只有命令行能用」。后端 POST /safe-boot 早就有了
+			// （lib/server/routes/safe-boot.js；动作白名单 list / restore-last-good / disable-suspects /
+			// mark-good），界面上却一个入口都没有 —— 这里补的就是这四个动作的手套。
+			//
+			// 为什么放**门控面板**里（不是 fwPanel、更不是新工具栏按钮）：
+			//   safe-boot 救的正是「门控/兼容判断没拦住、框架被别的通道换坏之后打不开」那种局面 ——
+			//   它和门控是**同一条链**（先拦、拦不住再回退），放在一起，用户出事时只有一个地方要想起。
+			//   用户也明确不许再加工具栏按钮（已经挤），所以它挂在已有门控面板里，排在门控正文之后。
+			//
+			// 三条硬约束（用户定）：① 不许"点了没反应" —— 每个动作要么有成功/失败/进行中反馈，要么这个
+			//   按钮根本不显示；② 危险写动作**两段式** —— 第一下只上膛并写明影响面（改哪份文件、会覆盖什么），
+			//   确认后才真发请求；③ 拿不到的数据如实显示「—」，不编造。
+			// 判据一条都不搬过来：动作白名单、快照挑选、写盘闸门全在服务端 —— 客户端不重算、不预测结果。
+			const [safeBootOpen, setSafeBootOpen] = react.useState(false);
+			const [safeBootData, setSafeBootData] = react.useState(null); // list 的响应（null = 还没读过 / 读取失败）
+			const [safeBootError, setSafeBootError] = react.useState(null); // 读取失败原文（不静默、不留空白）
+			const [safeBootBusy, setSafeBootBusy] = react.useState(null); // 'list' | 动作名 | null（进行中反馈）
+			const [safeBootArmed, setSafeBootArmed] = react.useState(null); // 两段式的"上膛"：{ action, id?, rowIds? }
+			const [safeBootNote, setSafeBootNote] = react.useState(null); // 写动作的结果/失败原文：{ text, level }
+			const safeBootErrText = (error) => {
+				const msg = error !== null && error !== undefined && typeof error.message === "string" ? error.message : String(error ?? "");
+				return msg === "" ? t("safetySwitchFailed") : msg;
+			};
+			const safeBootTime = (ms) => (typeof ms === "number" && ms > 0 ? new Date(ms).toLocaleString() : "—");
+			/** 快照 sha256 只显示前几位（列表里够辨认；完整值在快照文件里）。拿不到就是「—」。 */
+			const safeBootSha = (sha) => (typeof sha === "string" && sha !== "" ? sha.slice(0, 10) : "—");
+			/** 「为什么没写快照」的原因词表 —— 与 lib/server/routes/compat.js#maybeWriteSnapshot 是**同一套字符串**。
+			 *  不认识的 reason 原样显示（不翻译成瞎话，也不吞掉）。 */
+			const SAFE_BOOT_REASON_KEYS = {
+				"patch-not-yaml-valid": "safeBootReasonPatchInvalid", // 结构校验没过（有东西可写，但闸门不放行）
+				"no-patch-file": "safeBootReasonNoPatch",
+				"environment-changed": "safeBootReasonEnvChanged", // 时机未到
+				"unchanged": "safeBootReasonUnchanged", // 时机未到（已有一份一样的）
+				"not-yet": "safeBootReasonNotYet", // 时机未到（这个字符串由本面板推导出来，见下）
+			};
+			const safeBootReasonText = (reason) => {
+				const key = typeof reason === "string" ? SAFE_BOOT_REASON_KEYS[reason] : undefined;
+				if (key !== undefined) return t(key);
+				return typeof reason === "string" && reason !== "" ? reason : "—";
+			};
+			/**
+			 * 「这一次该写快照却没写，是因为什么」——**只在能说出原因时**返回 `{ written: false, reason, problems }`，
+			 * 说不出来就返回 null（面板就不显示这一行，不编一句话凑数）。
+			 *
+			 * 数据来源两条，都不猜：
+			 *   ① 响应里真带 `snapshot.written`（与 compat-status 的 safeBoot.snapshot 同形）→ 原样用它的
+			 *      written/reason；written === true 时返回 null（没东西可抱怨）。
+			 *   ② 没带时，只用 list **确实下发**的事实推导：patch.exists / patch.check（服务端当场跑
+			 *      validatePatchYaml 的结论）/ snapshots。于是两类原因分得清清楚楚：
+			 *        · 结构校验没过  → `patch-not-yaml-valid`（有补丁、但校验结论 ok:false）
+			 *        · 还没到该写的时机 → `not-yet`（补丁没问题，只是根本还没有一份快照；
+			 *          服务端只在「服务确认正常 + 环境指纹未变」时才写 —— 见 compat.js 的那段判据）
+			 *      两个文案完全不同，绝不糊成一句"没有快照"。
+			 */
+			const safeBootGateOf = (data) => {
+				if (data === null || typeof data !== "object") return null;
+				if (data.snapshot !== null && typeof data.snapshot === "object" && typeof data.snapshot.written === "boolean") {
+					if (data.snapshot.written === true) return null;
+					return { written: false, reason: data.snapshot.reason ?? null, problems: Array.isArray(data.snapshot.problems) ? data.snapshot.problems : [] };
+				}
+				const snaps = Array.isArray(data.snapshots) ? data.snapshots : [];
+				const patch = data.patch !== null && typeof data.patch === "object" ? data.patch : null;
+				if (patch === null || patch.exists !== true) return { written: false, reason: "no-patch-file", problems: [] };
+				const check = patch.check !== null && typeof patch.check === "object" ? patch.check : null;
+				if (check !== null && check.ok !== true) return { written: false, reason: "patch-not-yaml-valid", problems: Array.isArray(check.problems) ? check.problems : [] };
+				if (snaps.length === 0) return { written: false, reason: "not-yet", problems: [] };
+				return null;
+			};
+			/** 快照清单（新→旧；只认形状对的条目，坏数据不会把整块渲染拖崩）。 */
+			const safeBootSnapsOf = (data) => (data !== null && typeof data === "object" && Array.isArray(data.snapshots) ? data.snapshots : [])
+				.filter((s) => s !== null && typeof s === "object" && typeof s.id === "string")
+				.sort((a, b) => Number(b.at ?? 0) - Number(a.at ?? 0));
+			/** 自动预检点名的可疑行（服务端 lastPlan.suspects）；没有就是空数组 —— 那就**不显示**这个按钮。 */
+			const safeBootSuspectsOf = (data) => (data !== null && typeof data === "object" && data.lastPlan !== null && typeof data.lastPlan === "object" && Array.isArray(data.lastPlan.suspects)
+				? data.lastPlan.suspects.filter((x) => typeof x === "string" && x !== "")
+				: []);
+			/** 读一次快照列表（**只**在"展开那一下"和写动作之后调用；收起状态零请求）。
+			 *  失败时保留上一次的数据但把错误原文摆出来 —— 一次读取失手不该把已有信息抹掉。 */
+			const safeBootRead = async () => {
+				try {
+					const data = await call("/plugin-console/safe-boot", { action: "list" });
+					if (data === null || typeof data !== "object") { setSafeBootError(t("safeBootListFailed") + "—"); return; }
+					setSafeBootData(data);
+					setSafeBootError(null);
+				} catch (error) {
+					setSafeBootError(t("safeBootListFailed") + safeBootErrText(error));
+				}
+			};
+			/** 写动作结束后的一句结果（服务端说什么就说什么：changed:false / no-suspects / 具体行）。 */
+			const safeBootDoneText = (action, data) => {
+				if (data === null || typeof data !== "object") return t("safeBootFailed") + "—";
+				if (action === "restore-last-good") return data.changed === false ? t("safeBootNoopRestore") : t("safeBootDoneRestore");
+				if (action === "disable-suspects") {
+					if (data.reason === "no-suspects") return t("safeBootNoSuspects");
+					const added = Array.isArray(data.added) ? data.added.filter((x) => typeof x === "string") : [];
+					const skipped = Array.isArray(data.skipped) ? data.skipped : [];
+					if (added.length === 0) return t("safeBootNoSuspects");
+					return t("safeBootDoneDisable") + " " + added.join("、") + (skipped.length === 0 ? "" : " · " + t("safeBootDisabledSkipped") + " " + String(skipped.length));
+				}
+				if (action === "mark-good") {
+					const id = data.snapshot !== null && typeof data.snapshot === "object" && typeof data.snapshot.id === "string" ? data.snapshot.id : null;
+					return t("safeBootDoneMarkGood") + " " + (id ?? "—");
+				}
+				return "—";
+			};
+			/** 真发请求（唯一出口）：list / restore-last-good / disable-suspects / mark-good */
+			const safeBootSend = async (action, extra) => {
+				if (safeBootBusy !== null) return; // 进行中不叠加请求（按钮此刻也是 disabled）
+				setSafeBootBusy(action);
+				setSafeBootNote(null);
+				setSafeBootArmed(null); // 一旦真发请求，上膛状态作废（绝不留一个"看着像待确认"的残影）
+				if (action === "list") setSafeBootError(null);
+				try {
+					const body = { action };
+					// 只放服务端白名单认得的两个载荷字段（id / rowIds）；其余一概不传。
+					if (extra !== null && extra !== undefined) {
+						if (typeof extra.id === "string" && extra.id !== "") body.id = extra.id;
+						if (Array.isArray(extra.rowIds) && extra.rowIds.length > 0) body.rowIds = extra.rowIds.slice();
+					}
+					const data = await call("/plugin-console/safe-boot", body);
+					if (action === "list") {
+						if (data === null || typeof data !== "object") setSafeBootError(t("safeBootListFailed") + "—");
+						else { setSafeBootData(data); setSafeBootError(null); }
+					} else {
+						setSafeBootNote({ text: safeBootDoneText(action, data), level: null });
+						// 写动作之后**重新读一次列表**（mark-good 尤其必须：last-good 标记要随之变化）
+						await safeBootRead();
+					}
+				} catch (error) {
+					// 失败一律把服务端给的原文摆出来（call() 已经把 {ok:false,error} 抛成 Error.message）
+					if (action === "list") setSafeBootError(t("safeBootListFailed") + safeBootErrText(error));
+					else setSafeBootNote({ text: t("safeBootFailed") + safeBootErrText(error), level: "error" });
+				} finally { setSafeBootBusy(null); }
+			};
+			/** 展开/收起：**展开那一下**才读一次 list（收起状态零请求）；收起时把上膛清掉。 */
+			const safeBootToggle = () => {
+				const next = !safeBootOpen;
+				setSafeBootOpen(next);
+				setSafeBootArmed(null);
+				setSafeBootNote(null);
+				if (next) void safeBootSend("list");
+			};
+			/** 两段式的第一段：只上膛，一个请求都不发（换动作 = 换载荷，上一个动作的载荷不会跟着发出去）。 */
+			const safeBootArm = (next) => {
+				setSafeBootNote(null);
+				setSafeBootArmed(next);
+			};
+			const safeBootPanel = () => {
+				const data = safeBootData;
+				const gate = safeBootGateOf(data);
+				const snaps = safeBootSnapsOf(data);
+				const suspects = safeBootSuspectsOf(data);
+				// 恢复目标的选择口径与服务端 domain/safe-boot.js#pickSnapshot 一致（kind=good 优先，其次最新）；
+				// 选好后把 id **显式传下去** —— 面板上写的是哪份，恢复的就是哪份，不可能"说 A 做 B"。
+				const goodOne = snaps.filter((s) => s.kind === "good")[0] ?? null;
+				const restoreTarget = goodOne ?? snaps[0] ?? null;
+				const newest = snaps[0] ?? null;
+				const lastGoodId = data !== null && typeof data === "object" && typeof data.lastGoodId === "string" && data.lastGoodId !== "" ? data.lastGoodId : null;
+				const patchPath = data !== null && typeof data === "object" && typeof data.patchPath === "string" && data.patchPath !== "" ? data.patchPath : null;
+				const commands = data !== null && typeof data === "object" && data.commands !== null && typeof data.commands === "object" ? data.commands : null;
+				// 上膛的那份快照对象（按 id 回查 —— 显示的时间/sha256 与"会恢复的那一份"必然是同一份）
+				const armedSnap = safeBootArmed === null || typeof safeBootArmed.id !== "string" ? null : (snaps.find((s) => s.id === safeBootArmed.id) ?? null);
+				const busy = safeBootBusy !== null;
+				const reasonOf = (x) => (x === null || typeof x !== "object" ? null : x.reason ?? null);
+				return el("div", {
+					"data-safeboot": "true",
+					style: { flexDirection: "column", gap: 6, display: "flex", marginTop: 4, paddingTop: 8, borderTop: "1px solid var(--dsw-alias-border-l2)" },
+				},
+					el("button", {
+						type: "button",
+						className: styles.toggle,
+						"data-safeboot-toggle": "true",
+						"data-open": safeBootOpen ? "true" : "false",
+						"aria-label": "safeBootToggle",
+						"aria-expanded": safeBootOpen ? "true" : "false",
+						title: t("safeBootToggleTitle"),
+						onClick: safeBootToggle,
+					}, (safeBootOpen ? "▾ " : "▸ ") + t("safeBootSectionTitle") + (busy ? " · " + t("safeBootBusy") : "")),
+					safeBootOpen ? el("div", { style: { flexDirection: "column", gap: 6, display: "flex" } },
+						el("p", { className: styles.status }, t("safeBootSectionHint")),
+						// 进行中：明确说在做什么（"点了没反应"就是这个面板最不能犯的错）
+						busy ? el("p", { className: styles.status, "data-safeboot-busy": "true" }, t("safeBootLoading")) : null,
+						// 读取失败：错误原文 + 一个「重新读取」（有反馈的出口，不是一个哑按钮）
+						safeBootError !== null
+							? el("div", { style: { flexDirection: "column", gap: 6, display: "flex" } },
+								el("p", { className: styles.message, "data-error": "true", "data-safeboot-error": "true" }, safeBootError),
+								el("button", {
+									type: "button",
+									className: styles.toggle,
+									"aria-label": "safeBootReload",
+									disabled: busy,
+									onClick: () => { void safeBootSend("list"); },
+								}, t("safeBootReload")))
+							: null,
+						data === null ? null : el("div", { style: { flexDirection: "column", gap: 6, display: "flex" } },
+							// ① 「这次没写快照」+ 原因：结构校验没过 / 时机未到 —— 两句话不一样，原因原文也照抄
+							gate === null
+								? null
+								: el("p", { className: styles.status, "data-safeboot-reason": "true", "data-reason": gate.reason ?? "—" },
+									t("safeBootNotWritten") + " " + safeBootReasonText(reasonOf(gate)) + "（" + (reasonOf(gate) ?? "—") + "）"
+									+ (gate.problems.length === 0 ? "" : " · " + gate.problems.slice(0, 3).join("；"))),
+							// ② 计数 + last-good（拿不到就「—」）；data-count 是这份份数本身（界面上不以它为唯一来源）
+							el("p", { className: styles.status, "data-safeboot-count": "true", "data-count": String(snaps.length) },
+								t("safeBootCount").replace("{n}", String(snaps.length)) + " · " + t("safeBootLastGoodId") + " " + (lastGoodId ?? "—")),
+							// ③ 清单 / 空态（空态必须说原因，不能只说"没有快照"就完了）
+							snaps.length === 0
+								? el("p", { className: styles.status, "data-safeboot-empty": "true" },
+									t("safeBootEmpty") + " " + safeBootReasonText(reasonOf(gate)) + "（" + (reasonOf(gate) ?? "—") + "）")
+								: el("div", { style: { flexDirection: "column", gap: 4, display: "flex" }, "data-safeboot-list": "true" },
+									snaps.map((s) => el("div", {
+										key: "sb-" + String(s.id),
+										className: styles.row,
+										"data-safeboot-row": "true",
+										"data-snapshot-id": String(s.id),
+									},
+										el("div", { className: styles.rowTop },
+											el("code", { className: styles.name, style: { fontSize: 11, whiteSpace: "normal", overflow: "visible", textOverflow: "clip", wordBreak: "break-all" }, title: String(s.id) }, String(s.id)),
+											s.kind === "good" || s.id === lastGoodId
+												? el("span", { className: styles.tag, "data-lastgood": "true" }, t("safeBootLastGood"))
+												: null),
+										el("div", { className: styles.rowTop, style: { gap: 6 } },
+											el("span", { className: styles.status }, t("safeBootRowAt") + " " + safeBootTime(s.at)),
+											" · ",
+											el("span", { className: styles.status, "data-snapshot-sha": "true" }, t("safeBootRowSha") + " " + safeBootSha(s.patchSha256)))))),
+							// ④ 动作：没有可操作对象时**一个按钮都不显示**，并说明为什么（不许出现点了必失败的按钮）
+							snaps.length === 0
+								? el("p", { className: styles.status, "data-safeboot-noaction": "true" }, t("safeBootNoSnapshotActions"))
+								: el("div", { style: { flexDirection: "row", gap: 8, display: "flex", flexWrap: "wrap" } },
+									el("button", {
+										type: "button",
+										className: styles.toggle,
+										"aria-label": "safeBootRestore",
+										"data-armed": safeBootArmed !== null && safeBootArmed.action === "restore-last-good" ? "true" : undefined,
+										disabled: busy || restoreTarget === null,
+										title: t("safeBootRestoreTitle"),
+										onClick: () => safeBootArm({ action: "restore-last-good", id: restoreTarget === null ? null : String(restoreTarget.id) }),
+									}, t("safeBootRestore")),
+									suspects.length === 0
+										? null // 没有点名的行 ⇒ 不显示这个按钮（点了只会得到 no-suspects，属于"点了没反应"）
+										: el("button", {
+											type: "button",
+											className: styles.toggle,
+											"aria-label": "safeBootDisable",
+											"data-armed": safeBootArmed !== null && safeBootArmed.action === "disable-suspects" ? "true" : undefined,
+											disabled: busy,
+											title: t("safeBootDisableTitle"),
+											onClick: () => safeBootArm({ action: "disable-suspects", rowIds: suspects.slice() }),
+										}, t("safeBootDisable")),
+									el("button", {
+										type: "button",
+										className: styles.toggle,
+										"aria-label": "safeBootMarkGood",
+										disabled: busy,
+										title: t("safeBootMarkGoodTitle"),
+										onClick: () => { void safeBootSend("mark-good", { id: newest === null ? null : String(newest.id) }); },
+									}, t("safeBootMarkGood"))),
+							snaps.length === 0
+								? null
+								: (suspects.length === 0
+									? el("p", { className: styles.status, "data-safeboot-suspects": "none" }, t("safeBootSuspectsNone"))
+									: el("p", { className: styles.status, "data-safeboot-suspects": "true" }, t("safeBootSuspectsTitle") + " " + suspects.join("、"))),
+							// ⑤ 两段式：上膛后把"要改什么、改哪份文件"写清楚，取消 = 零请求
+							safeBootArmed === null
+								? null
+								: el("div", { "data-safeboot-armed": "true", style: { flexDirection: "column", gap: 6, display: "flex", borderLeft: "2px solid var(--dsw-alias-state-warning-primary)", paddingLeft: 8 } },
+									el("p", { className: styles.message, "data-warn": "true", "data-safeboot-armedtext": "true" },
+										safeBootArmed.action === "restore-last-good"
+											? t("safeBootArmRestore") + " " + String(safeBootArmed.id ?? "—") + " · " + t("safeBootRowAt") + " "
+												+ safeBootTime(armedSnap === null ? null : armedSnap.at) + " · sha256 "
+												+ safeBootSha(armedSnap === null ? null : armedSnap.patchSha256)
+											: t("safeBootArmDisable") + " " + (Array.isArray(safeBootArmed.rowIds) ? safeBootArmed.rowIds.join("、") : "—")),
+									safeBootArmed.action === "restore-last-good"
+										? el("p", { className: styles.status }, t("safeBootArmRestoreOverwrite") + " " + (patchPath ?? "—"))
+										: el("p", { className: styles.status }, t("safeBootArmDisableNote")),
+									el("div", { style: { flexDirection: "row", gap: 8, display: "flex" } },
+										el("button", {
+											type: "button",
+											className: styles.toggle,
+											"aria-label": "safeBootConfirm",
+											disabled: busy,
+											onClick: () => { void safeBootSend(safeBootArmed.action, safeBootArmed); },
+										}, t("safeBootConfirm")),
+										el("button", {
+											type: "button",
+											className: styles.toggle,
+											"aria-label": "safeBootCancel",
+											onClick: () => { setSafeBootArmed(null); setSafeBootNote(null); },
+										}, t("safeBootCancel")))),
+							// ⑥ 结果反馈（成功/无操作/失败原文，都留在面板上）——
+							//    失败走既有 error 样式；成功用既有 success 色（没有新的 CSS 类，只借颜色令牌）。
+							safeBootNote === null
+								? null
+								: el("p", {
+									className: styles.message,
+									"data-safeboot-note": "true",
+									"data-error": safeBootNote.level === "error" ? "true" : undefined,
+									style: safeBootNote.level === "error" ? undefined : { color: "var(--dsw-alias-state-success-primary)" },
+								}, String(safeBootNote.text ?? "—")),
+							// ⑦ 服务起不来时的命令行兜底（服务端下发的原始命令，不自己拼）
+							commands !== null && typeof commands.list === "string"
+								? el("p", { className: styles.status, "data-safeboot-cmd": "true" }, t("safeBootCmdHint") + " " + commands.list)
+								: null))
+						: null,
+				);
+			};
 			// 「功能包 → 框架」按钮角标：升级进行中 ⟳ / 上次失败 ✕ / 有可用更新 ↑（优先级从高到低）
 			const fwRunning = frameworkStatus !== null
 				&& frameworkStatus.status !== "idle" && frameworkStatus.status !== "done" && frameworkStatus.status !== "failed";
@@ -6356,6 +6749,10 @@ const RESTART_FAILED_NOTE = "重启请求失败";
 												: null)
 										: null)
 								: null),
+							// ★ 0.5.x 加法（用户 2026-10-18）：「安全启动」分区 —— 挂在门控面板里（不新增工具栏按钮）。
+							//   默认收起，展开那一下才读一次快照列表；四个动作见 safeBootPanel（list / restore-last-good /
+							//   disable-suspects / mark-good）。它排在门控正文**之后**，Star 行仍在最后（贴底那条不变）。
+							safeBootPanel(),
 							// 0.5.42 加法（用户点名）：右侧贴底的 Star 提示 —— 只加这一行 UI，
 							// 不动任何开关逻辑/路由/门控语义。它是卡片的最后一个子项（整行，不占左侧内容宽度），
 							// margin-top:auto 让它在卡片有富余高度时贴底；position:sticky;bottom:0 让正文

package/lib/server/domain/patch-yaml-check.js

@@ -63,6 +63,16 @@ function blockScalarIndicator(value) {
 function scanValueQuotes(value, initialQuote = null) {
   const text = String(value)
   let quote = initialQuote
+  // 函数头注释 ⑤ 的前提「值不以引号开头 ⇒ 不跨行扫描」原先只写在注释里、代码没实现。
+  // 代价（issue #26）：`- 'D:/x/y.js'` 这类带盘符的序列项里，盘符的冒号被 key:value 正则
+  // 当成分隔符吃掉，value 变成 `/x/y.js'`（首字符不是引号），于是行尾那个 `'` 被当成
+  // 「引号开口」并一直挂到文件末尾 ⇒ 误报「文件末尾仍有未闭合的引号」，
+  // 而 safeBoot 的写盘前闸门正是它 ⇒ 快照/恢复/只禁可疑行全部退化成空转。
+  // 值不以引号开头时，本行的引号不可能跨行开口。
+  if (quote === null) {
+    const first = text.trimStart()[0]
+    if (first !== "'" && first !== '"') return { quote: null }
+  }
   for (let i = 0; i < text.length; i += 1) {
     const ch = text[i]
     if (quote === null) {

package/lib/server/routes/compat.js

@@ -39,6 +39,17 @@ import { preflightRoots } from './framework-preflight.js'
 
 const PREFLIGHT_TIMEOUT_ENV = 'DSH_AUTO_PREFLIGHT_TIMEOUT_MS'
 /** 自动预检的预算：到点降级成「未完成，可手动重跑」，状态查询照常返回（env 可调）。 */
+/**
+ * 安全启动的命令行兜底：拼成**可直接复制运行**的绝对路径命令。
+ * 现场问题（2026-10-29）：原先给的是相对路径 `node scripts/safe-boot.mjs --list`，
+ * 只有先 cd 到插件安装目录才成立 —— 而那是 node_modules 里的深层哈希目录，
+ * 服务起不来、界面打不开的时候，用户根本无从找到它。救火命令必须是能直接粘的。
+ */
+function safeBootCommand(args = []) {
+  const script = join(pluginRoot(), 'scripts', 'safe-boot.mjs')
+  return ['node', JSON.stringify(script), ...args].join(' ')
+}
+
 function preflightTimeoutMs() {
   const raw = Number(process.env[PREFLIGHT_TIMEOUT_ENV])
   return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_TIMEOUT_MS
@@ -218,7 +229,7 @@ function autoDisableNotice(entry = lastAutoDisable, { enabled = null } = {}) {
   if (entry === null || entry === undefined) return null
   if (on !== true && entry.code === 'auto-disabled') return null
   const added = Array.isArray(entry.disabled) ? entry.disabled : []
-  const restore = 'node scripts/safe-boot.mjs --restore-last-good'
+  const restore = safeBootCommand(['--restore-last-good'])
   if (added.length > 0) {
     return {
       at: entry.at ?? null,
@@ -318,7 +329,7 @@ async function routeCompatStatusGet(req, res, rc) {
       onEvidence: readCompatGate().autoDisableOnEvidence === true,
       switch: { file: 'compat-gate.json', key: 'autoDisableOnEvidence', route: '/plugin-console/compat-ack', body: { autoDisableOnEvidence: false } },
       notice: autoDisableNotice(),
-      restore: { route: { path: '/plugin-console/safe-boot', body: { action: 'restore-last-good' } }, command: 'node scripts/safe-boot.mjs --restore-last-good' },
+      restore: { route: { path: '/plugin-console/safe-boot', body: { action: 'restore-last-good' } }, command: safeBootCommand(['--restore-last-good']) },
       logHint: '记录落在 dshHome()/plugin-console/auto-disable.log（追加式 JSONL）',
     },
     // D2 加法字段：安全启动材料（last-known-good 快照 + 恢复入口提示）
@@ -326,7 +337,7 @@ async function routeCompatStatusGet(req, res, rc) {
       snapshot: { written: snapshot.written === true, reason: snapshot.reason ?? null, id: snapshot.snapshot?.id ?? null, at: snapshot.snapshot?.at ?? null, sha256: snapshot.snapshot?.patchSha256 ?? null },
       snapshots: listSnapshots().slice(0, 5),
       lastGoodId: readSafeBootState().lastGoodId,
-      command: { list: 'node scripts/safe-boot.mjs --list', restore: 'node scripts/safe-boot.mjs --restore-last-good', disable: 'node scripts/safe-boot.mjs --disable-suspects' },
+      command: { list: safeBootCommand(['--list']), restore: safeBootCommand(['--restore-last-good']), disable: safeBootCommand(['--disable-suspects']) },
       route: { action: 'restore-last-good | disable-suspects | list | mark-good', path: '/plugin-console/safe-boot' },
     },
   })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noob-stupid/dsh-plugin-console",
-  "version": "0.5.95",
+  "version": "0.5.97",
   "description": "DSH 框架升级安全与插件升级门控：一键升级、失败自动回滚、升级后回滚上版、旧插件不适配自动禁用；内置多源插件市场为发现层，插件源全部可自定义，可指向公司内网私有源 / 私有索引 / 本地 Git 仓库，纯内网离线可用 | Framework upgrade safety & plugin version gating for DSH, with a customizable multi-source plugin market: point every source at internal mirrors or a local file:// repo for intranet-only, offline installs.",
   "repository": {
     "type": "git",