@xiaoyuyu6420/dsh-backup 0.13.1 → 0.13.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xiaoyuyu6420/dsh-backup",
-  "version": "0.13.1",
+  "version": "0.13.3",
   "description": "一键备份与恢复 DeepSeek Harness（dsh）的全部用户数据（~/.dsh）：定时自动备份、升级快照、会话日志体检修复、迁移预检、宿主起不来也能用的救援通道、凭据脱敏、GitHub 同步跨机迁移，附可视化面板。 One command to back up & restore all of ~/.dsh: /backup, scheduled auto-backup, upgrade snapshots, session doctor & repair, migrate precheck, out-of-process rescue console, credential redaction, GitHub sync.",
   "type": "module",
   "packageManager": "pnpm@11.24.0",
@@ -53,12 +53,12 @@
   ],
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-commands": "^0.1.1-rc.2 || ^0.1.2-rc.1 || ^0.1.5-rc.1 || ^0.1.6-alpha.1 || ^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-fs": "^0.1.1-rc.2 || ^0.1.2-rc.1 || ^0.1.5-rc.1 || ^0.1.6-alpha.1 || ^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-settings": "^0.1.1-rc.2 || ^0.1.2-rc.1 || ^0.1.5-rc.1 || ^0.1.6-alpha.1 || ^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-subprocess": "^0.1.1-rc.2 || ^0.1.2-rc.1 || ^0.1.5-rc.1 || ^0.1.6-alpha.1 || ^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-tools": "^0.1.1-rc.2 || ^0.1.2-rc.1 || ^0.1.5-rc.1 || ^0.1.6-alpha.1 || ^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-typert-protocol": "^0.1.1-rc.2 || ^0.1.2-rc.1 || ^0.1.5-rc.1 || ^0.1.6-alpha.1 || ^0.1.7-alpha.1",
+    "@deepseek-ai/dsh-commands": "^0.1.1-rc.2 || ^0.1.2-rc.1 || ^0.1.5-rc.1 || ^0.1.6-alpha.1 || ^0.1.7-alpha.1 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-fs": "^0.1.1-rc.2 || ^0.1.2-rc.1 || ^0.1.5-rc.1 || ^0.1.6-alpha.1 || ^0.1.7-alpha.1 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-settings": "^0.1.1-rc.2 || ^0.1.2-rc.1 || ^0.1.5-rc.1 || ^0.1.6-alpha.1 || ^0.1.7-alpha.1 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-subprocess": "^0.1.1-rc.2 || ^0.1.2-rc.1 || ^0.1.5-rc.1 || ^0.1.6-alpha.1 || ^0.1.7-alpha.1 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-tools": "^0.1.1-rc.2 || ^0.1.2-rc.1 || ^0.1.5-rc.1 || ^0.1.6-alpha.1 || ^0.1.7-alpha.1 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-typert-protocol": "^0.1.1-rc.2 || ^0.1.2-rc.1 || ^0.1.5-rc.1 || ^0.1.6-alpha.1 || ^0.1.7-alpha.1 || ^0.2.0-rc.1",
     "@deepseek-ai/schemastery": "^3.18.1"
   },
   "devDependencies": {
@@ -69,7 +69,7 @@
   },
   "engines": {
     "node": ">=20",
-    "dsh": "^0.1.1-rc.2 || ^0.1.2-rc.1 || ^0.1.5-rc.1 || ^0.1.6-alpha.1 || ^0.1.7-alpha.1"
+    "dsh": "^0.1.1-rc.2 || ^0.1.2-rc.1 || ^0.1.5-rc.1 || ^0.1.6-alpha.1 || ^0.1.7-alpha.1 || ^0.2.0-rc.1"
   },
   "license": "MIT",
   "repository": {

package/rescue/rescue.mjs

@@ -37,7 +37,11 @@ const HERE = path.dirname(fileURLToPath(import.meta.url));
 const SENSITIVE_DEFAULTS = ['.credentials.yaml', '.env', 'qq-bridge/config.json'];
 const VAULT_DIR = 'vault';
 const ZSTD_MAGIC = 0xfd2fb528;
-const SESSION_LOG_NAMES = new Set(['session.jsonl.zstd', 'session.jsonl']);
+// 与 lib/index.js 同源：会话日志名形如 session[.v<N>].jsonl[.zstd]（宿主
+// sessionFormatLogFilename 的形态）。写死具体名字会在格式换代当天整体失明
+// （#117）——救援台是宿主起不来时的唯一通道，更不能看不见会话。
+const SESSION_LOG_RE = /^session(?:\.v([1-9][0-9]*))?\.jsonl(?:\.zstd)?$/;
+const isSessionLogName = (name) => SESSION_LOG_RE.test(name);
 const SCAN_SKIP_DIRS = new Set(['node_modules', '.system', '.git', 'vault']);
 const SCAN_MAX_FILES = 4000;
 const SCAN_MAX_DEPTH = 8;
@@ -108,7 +112,7 @@ async function listBackups(root) {
   }
   const backups = [];
   for (const d of dirents) {
-    if (!d.name.startsWith('dsh-') || d.name.startsWith('dsh-pre-restore-') || d.name.startsWith('dsh-t-') || !d.name.endsWith('.tar.gz')) continue;
+    if (!d.name.startsWith('dsh-') || d.name.startsWith('dsh-pre-restore-') || d.name.startsWith('dsh-pre-upgrade-') || d.name.startsWith('dsh-t-') || !d.name.endsWith('.tar.gz')) continue;
     let size;
     try {
       size = (await fs.stat(`${root}/${d.name}`)).size;
@@ -173,24 +177,48 @@ function parseTarEntry(line) {
     }
   }
   if (nameIdx < 0 || nameIdx >= f.length) return null;
-  return { type: f[0][0], name: f.slice(nameIdx).join(' ').replace(/\/$/, '') };
+  const rest = f.slice(nameIdx).join(' ');
+  // 链接目标单独摘出（硬链接 `<名> link to <目标>`、符号链接 `<名> -> <目标>`）：
+  // 与插件侧 parseTarEntry 同语义，别把目标混进名字（#112）。
+  let name = rest;
+  let link = null;
+  const hardAt = rest.indexOf(' link to ');
+  if (hardAt >= 0) {
+    name = rest.slice(0, hardAt);
+    link = rest.slice(hardAt + ' link to '.length);
+  } else {
+    const symAt = rest.lastIndexOf(' -> ');
+    if (symAt >= 0) {
+      name = rest.slice(0, symAt);
+      link = rest.slice(symAt + 4);
+    }
+  }
+  return {
+    type: f[0][0],
+    name: name.replace(/\/$/, ''),
+    link: link === null ? null : link.replace(/\/$/, ''),
+  };
 }
 
 function safeEntries(listedText, base) {
   const entries = [];
   const bad = [];
+  const insideBase = (p) => Boolean(p)
+    && !p.startsWith('/') && !/^[A-Za-z]:/.test(p)
+    && !p.split('/').includes('..')
+    && (p === base || p.startsWith(`${base}/`));
   for (const line of listedText.split('\n')) {
     const s = line.trim();
     if (!s) continue;
     const parsed = parseTarEntry(s);
     const name = parsed ? parsed.name.replace(/\\/g, '/').replace(/\/$/, '') : null;
-    if (
-      !parsed || !name
-      || (parsed.type !== '-' && parsed.type !== 'd')
-      || name.startsWith('/') || /^[A-Za-z]:/.test(name)
-      || name.split('/').includes('..')
-      || (name !== base && !name.startsWith(`${base}/`))
-    ) {
+    const link = parsed && parsed.link ? parsed.link.replace(/\\/g, '/').replace(/\/$/, '') : null;
+    // 与插件侧同语义：放行目标也在备份根内的硬链接 'h'（DSH 附件库的正常形态，
+    // 见 issue #112），符号链接/设备等仍拒绝。救援台是宿主起不来时的唯一通路，
+    // 这里漏判会让"插件写出的归档自己都恢复不了"。
+    const plainOk = Boolean(parsed) && Boolean(name) && (parsed.type === '-' || parsed.type === 'd') && insideBase(name);
+    const hardOk = Boolean(parsed) && parsed.type === 'h' && insideBase(name) && insideBase(link);
+    if (!plainOk && !hardOk) {
       bad.push(parsed ? name : s);
     } else {
       entries.push(name);
@@ -338,7 +366,7 @@ async function collectSessionLogs(dir, relPrefix, depth, out) {
     if (d.isDirectory()) {
       if (SCAN_SKIP_DIRS.has(d.name)) continue;
       await collectSessionLogs(`${dir}/${d.name}`, rel, depth + 1, out);
-    } else if (SESSION_LOG_NAMES.has(d.name)) {
+    } else if (isSessionLogName(d.name)) {
       out.push({ abs: `${dir}/${d.name}`, rel });
     }
   }
@@ -610,23 +638,27 @@ const show = (r) => {
 const log = (t) => { document.getElementById('log').textContent = typeof t === 'string' ? t : show(t); };
 const dlg = document.getElementById('confirm');
 const fmtSize = (n) => typeof n !== 'number' ? '?' : n >= 1048576 ? (n/1048576).toFixed(1) + 'MB' : Math.max(1, Math.round(n/1024)) + 'KB';
+const esc = (s) => String(s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
 async function api(op, body) {
   const res = await fetch('/api/' + op, { method: 'POST', headers: { 'Content-Type': 'application/json', 'X-Dsh-Rescue': '1' }, body: JSON.stringify(body || {}) });
   return res.json();
 }
+let listNames = [];
 async function renderList() {
   const r = await api('list');
   if (!r.ok) { log(r); return; }
-  const rows = r.backups.map(b => '<tr><td>' + b.name + '</td><td>' + fmtSize(b.size) +
-    '</td><td><button onclick="verify(\\'' + b.name + '\\')">校验</button> ' +
-    '<button class="danger" onclick="restore(\\'' + b.name + '\\')">恢复…</button></td></tr>').join('');
+  listNames = r.backups.map(b => b.name);
+  const rows = r.backups.map((b, i) => '<tr><td>' + esc(b.name) + '</td><td>' + fmtSize(b.size) +
+    '</td><td><button onclick="verify(' + i + ')">校验</button> ' +
+    '<button class="danger" onclick="restore(' + i + ')">恢复…</button></td></tr>').join('');
   document.getElementById('list').innerHTML = r.backups.length
     ? '<table><tr><th>备份</th><th>大小</th><th></th></tr>' + rows + '</table>'
     : '<p>备份目录里没有找到归档。</p>';
   log(r.summary || '');
 }
-async function verify(name) { log(await api('verify', { selector: name })); }
-async function restore(name) {
+async function verify(i) { log(await api('verify', { selector: listNames[i] })); }
+async function restore(i) {
+  const name = listNames[i];
   const pre = await api('restore', { selector: name, dryRun: true });
   log(pre);
   if (!pre.ok) return;