@xiaoyuyu6420/dsh-backup 0.13.0 → 0.13.1

package/README.en.md

@@ -137,6 +137,7 @@ Tried it? Tell us what broke, what's missing, what you liked — it directly sha
 <details>
 <summary>Recent releases</summary>
 
+- **0.13.1** — Two panel fixes, both from user reports: ① **the panel tab silently disappears on host 0.1.6+** (#94, @jackovibe): since 0.1.6 the host requires a `create()` lazy factory on strict codecs in client Remote contributions (older hosts only read `schema`); without it `$mount` throws during validation with only a console log, so the tab is never registered. Fix: `strictCodec()` now provides both `schema` and `create()` sharing one zod instance; `$mount` waits declaratively for the `remote` service (0.1.6 settles client modules by dependency graph); and a new `BackupTabFallback` **degraded tab** shows a visible hint plus command pointers if the mount ever fails — no more silent disappearance. peers/engines gain `^0.1.6-alpha.1 || ^0.1.7-alpha.1` (verified on real hosts 0.1.6-alpha.2 / 0.1.7-alpha.2 / 0.1.7-rc.1 / 0.1.7-rc.2). ② **the "GitHub Token" save button errored** (#97, @CheeseTJ): the client `panel` proxy never re-exported `setGithubToken` (that RPC landed in the host half in 0.12.0 and the omission lay dormant while no UI called it). Fix: wire it up, plus a new smoke-client assertion that the panel surface must mirror the contribution descriptors one-for-one.
 - **0.13.0** — Update awareness + one-command self-update: ① `/backup check-update` and a new "Plugin updates" card in the panel — checks the npm registry for a newer version (8s timeout, degrades silently offline, never blocks the plugin); when a newer version exists an "Update to x.y.z" button appears; the `updateCheck` setting (default off) silently checks on panel open. ② `/backup update [--profile <name>]` — takes a `dsh-pre-upgrade-` snapshot automatically before updating (roll back with `/backup restore`), then runs the official `dsh plugin --profile <name> update` (pnpm semantics; the plugin never rewrites its own dependency files), and tells you to restart dsh web afterwards. Note: the host settles the plugin Loader tree at startup and plugins are pnpm dependencies of the profile, so true hot-swap (no restart) is not possible in the current host architecture — one-command update + restart is the best form it can take.
 - **0.12.2** — Fix a Windows data-safety hazard (#88, thanks @Liuyeyuyangy0 for the outstanding report): when `DSH_HOME` sits directly under a drive root (e.g. `D:\dsh_data`), the string-slice parent computation degrades to the bare drive letter `D:`, and `tar -C D:` fails on both bsdtar and GNU tar — worse, tar creates the `-f` target before writing, leaving a 29-byte empty shell that the panel lists as a normal backup (no `.sha256`/`.meta.json`; silently zero usable backups, and the restore / doctor repair / rescue channels are hit by the same bug). All 7 tar `-C` call sites (backup, typed & full restore, doctor point-repair, rescue snapshot/restore/repair) now receive a separator-completed parent; `paths()` normalizes trailing slashes off `DSH_HOME` like `HOME` (a trailing slash used to empty the tar positional and produce 0-byte archives); failed tar runs now delete the empty shell before rethrowing, so failures are visible. Smoke gains scenario 28 (four path-layout assertions + a trailing-slash real-backup e2e). Archive format, settings and RPC unchanged.
 - **0.12.1** — Fix client bundle leaking top-level `var module` / `var exports` as globals (#85, thanks @geyonder): the CJS shim now lives inside the `__ModuleLoader__.load` factory body instead of creating `window.module`, which made Monaco's AMD loader (dsh-vscode-mode and friends) misdetect a Node environment and break sibling plugins on the same page. Client smoke suite gains a classic-script global-leak regression assertion (`vm.runInContext`). Client-half only; node-side behavior and archive format unchanged.

package/README.md

@@ -137,6 +137,7 @@ dsh plugin --profile web add github:xiaoyuyu6420/dsh-backup
 <details>
 <summary>最近的版本</summary>
 
+- **0.13.1** —— 修复两个面板问题（均感谢用户报告）：① **0.1.6+ 宿主上面板标签静默消失**（#94，@jackovibe）：宿主 0.1.6 起要求客户端 Remote 贡献的 strict codec 带 `create()` 惰性工厂（旧版只读 `schema`），缺失时 `$mount` 在校验阶段抛错且只有 console 日志——标签页因此永不注册。修法：`strictCodec()` 同时提供 `schema` 与 `create()`，两代宿主共用同一 zod 实例；`$mount` 改为声明式等待 `remote` 服务就绪（0.1.6 客户端模块按依赖图结算）；并新增 `BackupTabFallback` **降级标签页**——万一挂载失败会在面板位置给出可见提示与命令指路，不再静默消失。peers/engines 追加 `^0.1.6-alpha.1 || ^0.1.7-alpha.1`（0.1.6-alpha.2 / 0.1.7-alpha.2 / 0.1.7-rc.1 / 0.1.7-rc.2 实机验证通过）。② **「GitHub Token」保存按钮报错**（#97，@CheeseTJ）：客户端 `panel` 代理漏接了 `setGithubToken`（该 RPC 0.12.0 加入宿主半时即漏，因当时面板无入口而潜伏两版）。修法：补接该行，并给 smoke-client 加「panel 面必须与贡献 descriptors 一一对应」的防漏断言。
 - **0.13.0** —— 更新感知 + 一键更新（#A+B）：① `/backup check-update` 与面板「插件更新」卡——查 npm 最新版（8s 超时、断网静默降级，绝不阻断运行），发现新版即出现「更新到 x.y.z」按钮；设置项 `updateCheck`（默认关）开启后打开面板自动静默检查一次（本插件不联网上报，检查只读 registry）。② `/backup update [--profile 名]` 一键更新——更新前自动留 `dsh-pre-upgrade-` 升级前快照（失败可 `/backup restore` 回滚），再走官方 `dsh plugin --profile <名> update`（pnpm 语义，插件不自己覆写依赖文件），完成提示重启 dsh web 生效。说明：宿主在启动时结算插件 Loader 树、插件是 profile 的 pnpm 依赖，**运行中热替换（不重启生效）在宿主现行架构下不可行**——一键更新 + 重启是此架构下的最佳形态。
 - **0.12.2** —— 修复 Windows 数据安全隐患（#88，感谢 @Liuyeyuyangy0 出色的报告）：`DSH_HOME` 位于盘符根目录（如 `D:\dsh_data`）时，求父目录的字符串截取退化成裸盘符 `D:`，`tar -C D:` 在 bsdtar/GNU tar 下必然失败——而 tar 失败前已创建归档文件，留下 29 字节空壳被面板当正常备份列出（无 `.sha256`/`.meta.json`，静默零可用备份；恢复、doctor 修复、rescue 救援通道同样中招）。备份/恢复/修复/救援共 7 处 tar `-C` 统一改传补过分隔符的父目录；`paths()` 对 `DSH_HOME` 补上与 HOME 一致的尾斜杠归一化（尾斜杠曾让 tar 位置参数变空串、产出 0 字节坏包）；tar 失败路径删除空壳归档再抛错，失败不再静默。smoke 新增场景 28（四种路径布局断言 + 尾斜杠真实备份 e2e）。归档格式、设置项、RPC 均不变。
 - **0.12.1** —— 修复 client bundle 顶层 `var module` / `var exports` 泄漏为全局变量（#85，感谢 @geyonder 报告）：CJS shim 移入 `__ModuleLoader__.load` factory 体内，不再创建 `window.module`——此前会把 Monaco 的 AMD loader（dsh-vscode-mode 等）误判成 Node 环境并破坏同页插件。冒烟测试新增经典脚本全局泄漏回归断言（`vm.runInContext`）。纯 client 半区修复，node 侧行为与归档格式不变。