@wangxiaocuo/dsh-session-trash 0.5.1 → 0.6.0

package/lib/inventory.js

@@ -1,12 +1,15 @@
 import fs from 'node:fs/promises'
 import path from 'node:path'
-import { entryKind, isSafeDirectoryPath, isSafeTrashId, samePath } from './fsops.js'
+import { entryKind, isSafeDirectoryPath, isSafeMemberId, isSafeTrashId, samePath } from './fsops.js'
 
 /** Every state the durable index understands. */
 export const ENTRY_STATES = new Set(['trashing', 'trashed', 'restoring', 'purging', 'missing'])
 
 /** Sidecar schema version understood by this release. */
-const META_VERSION = 1
+const META_VERSION = 2
+
+/** Maximum directories one trashed item may own. */
+const MAX_MEMBERS = 64
 
 /**
  * @param {unknown} value candidate timestamp.
@@ -16,6 +19,77 @@ function isFiniteNumber(value) {
   return typeof value === 'number' && Number.isFinite(value)
 }
 
+/**
+ * @param {unknown} value candidate metric.
+ * @returns {boolean} whether the value is a usable number or absent.
+ */
+function isMetric(value) {
+  return value === undefined || value === null || isFiniteNumber(value)
+}
+
+/**
+ * Validate one v2 member's absolute paths. The parent's sidecar is validated
+ * field by field so a hand-edited file is rejected instead of guessed at.
+ *
+ * @param {unknown} member candidate member.
+ * @returns {boolean} whether the member names safe, coherent paths.
+ */
+function isValidMemberPaths(member) {
+  if (member === null || typeof member !== 'object' || Array.isArray(member)) return false
+  if (!isSafeMemberId(member.sessionId)) return false
+  if (member.origin !== undefined && member.origin !== null && member.origin !== 'subagent') return false
+  if (member.title !== undefined && typeof member.title !== 'string') return false
+  if (
+    member.formatStatus !== undefined &&
+    member.formatStatus !== 'current' &&
+    member.formatStatus !== 'migration-required'
+  ) {
+    return false
+  }
+  if (!isMetric(member.sizeBytes) || !isMetric(member.fileCount)) return false
+  if (!isSafeDirectoryPath(member.originalSessionDir)) return false
+  if (typeof member.originalLogPath !== 'string' || !path.isAbsolute(member.originalLogPath)) return false
+  if (
+    typeof member.persistenceProjectDirHint !== 'string' ||
+    !path.isAbsolute(member.persistenceProjectDirHint)
+  ) {
+    return false
+  }
+  if (!samePath(path.dirname(path.resolve(member.originalSessionDir)), path.resolve(member.persistenceProjectDirHint))) {
+    return false
+  }
+  if (!samePath(path.dirname(path.resolve(member.originalLogPath)), path.resolve(member.originalSessionDir))) {
+    return false
+  }
+  return true
+}
+
+/**
+ * Validate the v2 member list of one sidecar.
+ *
+ * @param {object} meta candidate sidecar.
+ * @returns {boolean} whether the list is coherent with its parent fields.
+ */
+function isValidMetaMembers(meta) {
+  if (!Array.isArray(meta.members) || meta.members.length === 0 || meta.members.length > MAX_MEMBERS) return false
+  if (!meta.members.every((member) => isValidMemberPaths(member))) return false
+  const seen = new Set()
+  for (const member of meta.members) {
+    if (seen.has(member.sessionId)) return false
+    seen.add(member.sessionId)
+  }
+  const parent = meta.members[0]
+  if (parent.sessionId !== meta.sessionId) return false
+  if (!samePath(path.resolve(parent.originalSessionDir), path.resolve(meta.originalSessionDir))) return false
+  if (!samePath(path.resolve(parent.originalLogPath), path.resolve(meta.originalLogPath))) return false
+  if (
+    !samePath(path.resolve(parent.persistenceProjectDirHint), path.resolve(meta.persistenceProjectDirHint))
+  ) {
+    return false
+  }
+  return true
+}
+
 /**
  * Validate one object sidecar strictly enough to be rebuilt into an index
  * entry. A malformed sidecar is reported as an unindexed object instead of
@@ -27,7 +101,7 @@ function isFiniteNumber(value) {
  */
 export function isValidMeta(meta, trashId) {
   if (meta === null || typeof meta !== 'object' || Array.isArray(meta)) return false
-  if (meta.version !== undefined && meta.version !== META_VERSION) return false
+  if (meta.version !== undefined && meta.version !== META_VERSION && meta.version !== 1) return false
   if (typeof meta.sessionId !== 'string' || meta.sessionId === '' || meta.sessionId.length > 256) return false
   if (meta.trashId !== trashId) return false
   if (!ENTRY_STATES.has(meta.state)) return false
@@ -48,20 +122,58 @@ export function isValidMeta(meta, trashId) {
   ) {
     return false
   }
+  if (meta.version === META_VERSION) return isValidMetaMembers(meta)
   return true
 }
 
+/**
+ * @param {Record<string, unknown>} member raw member fields.
+ * @param {string} fallbackTitle title used when the member carries none.
+ * @returns {object} one normalized v2 member.
+ */
+function toMember(member, fallbackTitle) {
+  return {
+    sessionId: member.sessionId,
+    origin: member.origin === 'subagent' ? 'subagent' : null,
+    title: typeof member.title === 'string' && member.title !== '' ? member.title : fallbackTitle,
+    originalSessionDir: path.resolve(member.originalSessionDir),
+    originalLogPath: path.resolve(member.originalLogPath),
+    persistenceProjectDirHint: path.resolve(member.persistenceProjectDirHint),
+    formatStatus: member.formatStatus === 'migration-required' ? 'migration-required' : 'current',
+    sizeBytes: isFiniteNumber(member.sizeBytes) ? member.sizeBytes : null,
+    fileCount: isFiniteNumber(member.fileCount) ? member.fileCount : null,
+  }
+}
+
 /**
  * @param {Record<string, unknown>} meta valid sidecar.
  * @returns {object} a clean index entry with defaulted optional fields.
  */
-function toEntry(meta) {
+export function toEntry(meta) {
   const originalCwd = typeof meta.originalCwd === 'string' && meta.originalCwd !== '' ? meta.originalCwd : null
+  const title = typeof meta.title === 'string' && meta.title !== '' ? meta.title : meta.sessionId
+  const members =
+    Array.isArray(meta.members) && meta.members.length > 0
+      ? meta.members.map((member) => toMember(member, title))
+      : [
+          toMember(
+            {
+              sessionId: meta.sessionId,
+              originalSessionDir: meta.originalSessionDir,
+              originalLogPath: meta.originalLogPath,
+              persistenceProjectDirHint: meta.persistenceProjectDirHint,
+              formatStatus: meta.formatStatus,
+              sizeBytes: meta.sizeBytes,
+              fileCount: meta.fileCount,
+            },
+            title,
+          ),
+        ]
   return {
     sessionId: meta.sessionId,
     trashId: meta.trashId,
     state: meta.state,
-    title: meta.title,
+    title,
     trashedAt: meta.trashedAt,
     startedAt: meta.startedAt,
     originalCwd,
@@ -75,25 +187,59 @@ function toEntry(meta) {
     formatStatus: meta.formatStatus === 'migration-required' ? 'migration-required' : 'current',
     sizeBytes: isFiniteNumber(meta.sizeBytes) ? meta.sizeBytes : null,
     fileCount: isFiniteNumber(meta.fileCount) ? meta.fileCount : null,
+    members,
     lastError: typeof meta.lastError === 'string' && meta.lastError !== '' ? meta.lastError : null,
   }
 }
 
+/**
+ * Which of one entry's member directories currently exist inside its object.
+ *
+ * @param {import('./store.js').TrashStore} store trash store owning `objects/`.
+ * @param {object} entry index entry, v1 or v2 shaped.
+ * @returns {Promise<{ total: number, present: number, missing: string[] }>} presence summary.
+ */
+export async function memberPresence(store, entry) {
+  const members =
+    Array.isArray(entry.members) && entry.members.length > 0
+      ? entry.members
+      : [{ sessionId: entry.sessionId, originalSessionDir: entry.originalSessionDir }]
+  const missing = []
+  let present = 0
+  for (let index = 0; index < members.length; index += 1) {
+    const member = members[index]
+    let kind = 'missing'
+    try {
+      kind = await entryKind(store.memberPath(entry.trashId, index, member.sessionId))
+    } catch {
+      kind = 'missing'
+    }
+    if (kind === 'directory') present += 1
+    else missing.push(typeof member.sessionId === 'string' ? member.sessionId : entry.sessionId)
+  }
+  return { total: members.length, present, missing }
+}
+
 /**
  * Reconcile a rebuilt entry with the object directory observed on disk.
  *
  * @param {object} entry index-shaped entry.
- * @param {boolean} sessionExists whether `objects/<trashId>/session` is a directory.
+ * @param {{ total: number, present: number, missing: string[] }} presence member presence.
  * @param {number} now current timestamp.
  * @returns {object} the entry whose state matches the filesystem.
  */
-export function deriveEntry(entry, sessionExists, now) {
-  if (!sessionExists) {
+export function deriveEntry(entry, presence, now) {
+  const complete = presence.total > 0 && presence.present === presence.total
+  if (!complete) {
     if (entry.state === 'purging' || entry.state === 'missing') return { ...entry }
+    const lastError =
+      presence.present === 0
+        ? 'The trash copy of this session is missing.'
+        : `The trash copy is missing these member sessions: ${presence.missing.join(', ')}.`
     return {
       ...entry,
       state: 'missing',
-      lastError: 'The trash copy of this session is missing.',
+      lastError,
     }
   }
   if (entry.state === 'missing') {
@@ -115,7 +261,7 @@ export function deriveEntry(entry, sessionExists, now) {
  *
  * @param {import('./store.js').TrashStore} store trash store owning `objects/`.
  * @param {{ warn: Function }} logger diagnostics sink.
- * @returns {Promise<{ objects: { trashId: string, sessionExists: boolean, meta: object | undefined, metaValid: boolean }[], unindexed: number }>} the inventory.
+ * @returns {Promise<{ objects: { trashId: string, sessionExists: boolean, meta: object | undefined, metaValid: boolean, entry?: object, presence?: object }[], unindexed: number }>} the inventory.
  */
 export async function scanObjects(store, logger) {
   let entries
@@ -150,13 +296,21 @@ export async function scanObjects(store, logger) {
       unindexed += 1
       continue
     }
-    let sessionExists = false
+    let presence
     try {
-      sessionExists = (await entryKind(store.sessionPath(trashId))) === 'directory'
+      presence = await memberPresence(store, toEntry(meta))
     } catch (error) {
       logger.warn(`cannot inspect the trash copy ${trashId}: ${error instanceof Error ? error.message : String(error)}`)
+      presence = { total: 0, present: 0, missing: [] }
     }
-    objects.push({ trashId, sessionExists, meta, metaValid })
+    objects.push({
+      trashId,
+      sessionExists: presence.total > 0 && presence.present === presence.total,
+      meta,
+      metaValid,
+      entry: toEntry(meta),
+      presence,
+    })
   }
   return { objects, unindexed }
 }
@@ -197,7 +351,8 @@ export async function reconcileIndex({ store, logger, now = Date.now() }) {
       changed = true
       continue
     }
-    if (entry.state === 'missing' && object.sessionExists) {
+    const presence = await memberPresence(store, entry)
+    if (entry.state === 'missing' && presence.total > 0 && presence.present === presence.total) {
       nextEntries[index] = {
         ...entry,
         state: 'trashed',
@@ -211,15 +366,15 @@ export async function reconcileIndex({ store, logger, now = Date.now() }) {
 
   for (const object of objects) {
     if (indexedTrashIds.has(object.trashId)) continue
-    if (!object.metaValid || object.meta === undefined) continue
-    const entry = toEntry(object.meta)
+    if (!object.metaValid || object.meta === undefined || object.entry === undefined || object.presence === undefined) continue
+    const entry = object.entry
     if (sessionIds.has(entry.sessionId)) {
       // Two object directories claim the same session: keep the indexed one.
       unindexed += 1
       logger.warn(`the trash object ${object.trashId} duplicates the indexed session ${entry.sessionId}`)
       continue
     }
-    const derived = deriveEntry(entry, object.sessionExists, now)
+    const derived = deriveEntry(entry, object.presence, now)
     nextEntries.push(derived)
     indexedTrashIds.add(derived.trashId)
     sessionIds.add(derived.sessionId)
@@ -254,15 +409,15 @@ export async function rebuildIndex({ store, logger, now = Date.now() }) {
   const seen = new Set()
   let unindexed = invalidObjects
   for (const object of objects) {
-    if (!object.metaValid || object.meta === undefined) continue
-    const entry = toEntry(object.meta)
+    if (!object.metaValid || object.meta === undefined || object.entry === undefined || object.presence === undefined) continue
+    const entry = object.entry
     if (seen.has(entry.sessionId)) {
       unindexed += 1
       logger.warn(`the trash object ${object.trashId} duplicates the rebuilt session ${entry.sessionId}`)
       continue
     }
     seen.add(entry.sessionId)
-    entries.push(deriveEntry(entry, object.sessionExists, now))
+    entries.push(deriveEntry(entry, object.presence, now))
   }
   entries.sort((left, right) => left.startedAt - right.startedAt || left.trashId.localeCompare(right.trashId))
   await store.commit(entries)

package/lib/members.js

@@ -0,0 +1,95 @@
+/**
+ * One trashed item may own several session directories: the visible parent and
+ * every hidden `origin: 'subagent'` descendant. These helpers keep the v1
+ * single-directory shape readable while the durable index uses the v2
+ * `members` array.
+ *
+ * @module dsh-session-trash/members
+ */
+
+/**
+ * @param {unknown} entry index entry (v1 or v2 shape).
+ * @returns {object|null} the parent member, or null when the entry has no directory data.
+ */
+export function parentMember(entry) {
+  if (entry === null || typeof entry !== 'object') return null
+  if (typeof entry.sessionId !== 'string' || entry.sessionId === '') return null
+  return {
+    sessionId: entry.sessionId,
+    origin: null,
+    title: typeof entry.title === 'string' ? entry.title : entry.sessionId,
+    originalSessionDir: entry.originalSessionDir,
+    originalLogPath: entry.originalLogPath,
+    persistenceProjectDirHint: entry.persistenceProjectDirHint,
+    formatStatus: entry.formatStatus,
+    sizeBytes: entry.sizeBytes,
+    fileCount: entry.fileCount,
+  }
+}
+
+/**
+ * @param {unknown} entry index entry (v1 or v2 shape).
+ * @returns {object[]} every owned directory, parent first.
+ */
+export function memberList(entry) {
+  if (entry !== null && typeof entry === 'object' && Array.isArray(entry.members) && entry.members.length > 0) {
+    return entry.members
+  }
+  const parent = parentMember(entry)
+  return parent === null ? [] : [parent]
+}
+
+/**
+ * @param {readonly object[]} members member list.
+ * @returns {{ sizeBytes: number, fileCount: number }} summed measurable totals.
+ */
+export function aggregateMetrics(members) {
+  let sizeBytes = 0
+  let fileCount = 0
+  for (const member of members) {
+    if (typeof member?.sizeBytes === 'number') sizeBytes += member.sizeBytes
+    if (typeof member?.fileCount === 'number') fileCount += member.fileCount
+  }
+  return { sizeBytes, fileCount }
+}
+
+/**
+ * Shape-level validation shared by the durable index and object sidecars.
+ * Path strictness belongs to the sidecar validator.
+ *
+ * @param {unknown} member candidate member.
+ * @returns {boolean} whether the member carries the required v2 identity.
+ */
+export function isValidMemberShape(member) {
+  if (member === null || typeof member !== 'object' || Array.isArray(member)) return false
+  if (typeof member.sessionId !== 'string' || member.sessionId === '' || member.sessionId.length > 256) return false
+  if (member.origin !== undefined && member.origin !== null && member.origin !== 'subagent') return false
+  if (member.title !== undefined && typeof member.title !== 'string') return false
+  if (member.formatStatus !== undefined && member.formatStatus !== 'current' && member.formatStatus !== 'migration-required') {
+    return false
+  }
+  if (member.sizeBytes !== undefined && member.sizeBytes !== null && typeof member.sizeBytes !== 'number') return false
+  if (member.fileCount !== undefined && member.fileCount !== null && typeof member.fileCount !== 'number') return false
+  for (const key of ['originalSessionDir', 'originalLogPath', 'persistenceProjectDirHint']) {
+    if (member[key] !== undefined && member[key] !== null && typeof member[key] !== 'string') return false
+  }
+  return true
+}
+
+/**
+ * Whether the v2 member list is internally consistent with its parent entry.
+ *
+ * @param {unknown} entry index entry carrying `members`.
+ * @returns {boolean} whether the list is acceptable.
+ */
+export function isValidMemberList(entry) {
+  if (entry === null || typeof entry !== 'object') return false
+  if (!Array.isArray(entry.members) || entry.members.length === 0 || entry.members.length > 64) return false
+  const seen = new Set()
+  for (const member of entry.members) {
+    if (!isValidMemberShape(member)) return false
+    if (seen.has(member.sessionId)) return false
+    seen.add(member.sessionId)
+  }
+  return entry.members[0].sessionId === entry.sessionId
+}

package/lib/state.js

@@ -1,4 +1,5 @@
 import fs from 'node:fs/promises'
+import { memberList } from './members.js'
 
 /** Maximum concurrent filesystem probes while describing entries. */
 const PROBE_CONCURRENCY = 3
@@ -85,6 +86,7 @@ export function createStateService({ store, config, trashRootDisplay, nextSweepA
     const expiresAt =
       typeof entry.trashedAt === 'number' && entry.trashedAt > 0 ? entry.trashedAt + config.retentionDays * 86_400_000 : null
     const trashed = entry.state === 'trashed'
+    const members = memberList(entry)
     return {
       sessionId: entry.sessionId,
       title: entry.title,
@@ -103,6 +105,12 @@ export function createStateService({ store, config, trashRootDisplay, nextSweepA
       canForget: entry.state === 'missing',
       requiresOrphanRestore: cwd !== null && workspaceNowExists === false,
       lastError: entry.lastError ?? null,
+      subagentCount: Math.max(0, members.length - 1),
+      members: members.map((member) => ({
+        sessionId: member.sessionId,
+        origin: member.origin === 'subagent' ? 'subagent' : null,
+        sizeBytes: typeof member.sizeBytes === 'number' ? member.sizeBytes : null,
+      })),
     }
   }
 

package/lib/store.js

@@ -2,10 +2,11 @@ import fs from 'node:fs/promises'
 import os from 'node:os'
 import path from 'node:path'
 import { TrashError } from './errors.js'
-import { isInside, removePathWithRetry, renameWithRetry, samePath } from './fsops.js'
+import { isInside, isSafeMemberId, removePathWithRetry, renameWithRetry, samePath } from './fsops.js'
+import { isValidMemberList, parentMember } from './members.js'
 
 /** On-disk index schema version understood by this release. */
-export const INDEX_VERSION = 1
+export const INDEX_VERSION = 2
 
 /** A lock older than this is assumed abandoned and may be taken over. */
 export const LOCK_STALE_MS = 10 * 60 * 1000
@@ -21,6 +22,20 @@ export function emptyIndex(now = Date.now()) {
   return { version: INDEX_VERSION, updatedAt: now, entries: [] }
 }
 
+/**
+ * Coerce one durable entry to the v2 shape. A v1 entry names a single
+ * directory, which becomes the parent member of a one-member tree.
+ *
+ * @param {object} entry entry from either durable shape.
+ * @returns {object} the v2 entry.
+ */
+function normalizeEntry(entry) {
+  if (entry === null || typeof entry !== 'object') return entry
+  if (Array.isArray(entry.members) && entry.members.length > 0) return entry
+  const parent = parentMember(entry)
+  return parent === null ? entry : { ...entry, members: [parent] }
+}
+
 /**
  * Validate the persisted index shape strictly enough that a truncated or
  * hand-edited file enters protection mode instead of silently vanishing.
@@ -30,7 +45,7 @@ export function emptyIndex(now = Date.now()) {
  */
 export function isValidIndex(value) {
   if (value === null || typeof value !== 'object' || Array.isArray(value)) return false
-  if (value.version !== INDEX_VERSION) return false
+  if (value.version !== INDEX_VERSION && value.version !== 1) return false
   if (typeof value.updatedAt !== 'number' || !Number.isFinite(value.updatedAt)) return false
   if (!Array.isArray(value.entries)) return false
   const seen = new Set()
@@ -42,6 +57,7 @@ export function isValidIndex(value) {
     if (typeof entry.trashedAt !== 'number' || !Number.isFinite(entry.trashedAt)) return false
     if (seen.has(entry.sessionId)) return false
     seen.add(entry.sessionId)
+    if (value.version === INDEX_VERSION && !isValidMemberList(entry)) return false
   }
   return true
 }
@@ -90,6 +106,8 @@ export class TrashStore {
     this.lockOwned = false
     this.lockTimer = null
     this.queue = Promise.resolve()
+    /** Whether the last load read an older index version that must be re-committed. */
+    this.needsUpgrade = false
   }
 
   /**
@@ -108,6 +126,10 @@ export class TrashStore {
     } else if (this.status === 'recovered') {
       this.logger.warn(`trash index recovered from backup: ${this.error}`)
     }
+    if (this.needsUpgrade) {
+      await this.writeIndex(this.index.entries)
+      this.logger.info(`upgraded the trash index to version ${INDEX_VERSION}`)
+    }
     return this.describe()
   }
 
@@ -150,12 +172,34 @@ export class TrashStore {
 
   /**
    * @param {string} trashId object identity.
-   * @returns {string} the moved session directory inside the object directory.
+   * @returns {string} the moved parent session directory inside the object directory.
    */
   sessionPath(trashId) {
     return path.join(this.objectDir(trashId), 'session')
   }
 
+  /**
+   * @param {string} trashId object identity.
+   * @param {string} sessionId descendant session identity.
+   * @returns {string} the moved descendant directory inside the object directory.
+   */
+  childPath(trashId, sessionId) {
+    if (!isSafeMemberId(sessionId)) {
+      throw new TrashError('IO_ERROR', 'Refusing an unsafe member directory name inside the trash object.')
+    }
+    return path.join(this.objectDir(trashId), 'children', sessionId)
+  }
+
+  /**
+   * @param {string} trashId object identity.
+   * @param {number} index member position; `0` is the visible parent.
+   * @param {string} sessionId member identity.
+   * @returns {string} the directory that owns this member inside the object.
+   */
+  memberPath(trashId, index, sessionId) {
+    return index === 0 ? this.sessionPath(trashId) : this.childPath(trashId, sessionId)
+  }
+
   /**
    * @param {string} trashId object identity.
    * @returns {string} the self-describing metadata path inside the object directory.
@@ -309,15 +353,17 @@ export class TrashStore {
   }
 
   /**
-   * Load the index, falling back to the previous committed backup.
+   * Load the index, falling back to the previous committed backup. An older
+   * schema is normalized in memory and re-committed by {@link init}.
    *
    * @returns {Promise<void>} resolution once `index` and `status` are set.
    */
   async load() {
+    this.needsUpgrade = false
     try {
       const data = await this.readJson(this.indexPath)
       if (!isValidIndex(data)) throw new Error('unsupported index shape or version')
-      this.index = data
+      this.index = this.normalizeIndex(data)
       this.status = 'ok'
       this.error = null
       return
@@ -332,7 +378,7 @@ export class TrashStore {
       try {
         const backup = await this.readJson(this.bakPath)
         if (!isValidIndex(backup)) throw new Error('unsupported backup shape or version')
-        this.index = backup
+        this.index = this.normalizeIndex(backup)
         this.status = 'recovered'
         this.error = primary
         return
@@ -345,6 +391,19 @@ export class TrashStore {
     }
   }
 
+  /**
+   * @param {{ version: number, updatedAt: number, entries: readonly object[] }} data parsed index document.
+   * @returns {{ version: number, updatedAt: number, entries: object[] }} the v2 document.
+   */
+  normalizeIndex(data) {
+    if (data.version !== INDEX_VERSION) this.needsUpgrade = true
+    return {
+      version: INDEX_VERSION,
+      updatedAt: data.updatedAt,
+      entries: data.entries.map((entry) => normalizeEntry(entry)),
+    }
+  }
+
   /**
    * Atomically commit the index: write a temporary file, preserve the previous
    * commit as `.bak`, then rename over the live index.
@@ -353,7 +412,8 @@ export class TrashStore {
    * @returns {Promise<{ version: number, updatedAt: number, entries: readonly object[] }>} the committed document.
    */
   async writeIndex(entries) {
-    const data = { version: INDEX_VERSION, updatedAt: Date.now(), entries }
+    const normalized = entries.map((entry) => normalizeEntry(entry))
+    const data = { version: INDEX_VERSION, updatedAt: Date.now(), entries: normalized }
     const json = `${JSON.stringify(data, null, 2)}\n`
     try {
       const handle = await fs.open(this.tmpPath, 'w', 0o600)
@@ -379,6 +439,7 @@ export class TrashStore {
     this.index = data
     this.status = 'ok'
     this.error = null
+    this.needsUpgrade = false
     return data
   }