@xiaoyuyu6420/dsh-backup 0.14.1 → 0.14.2

package/lib/encrypt.js

@@ -23,6 +23,10 @@ import {
   randomBytes,
   scrypt as scryptCb,
 } from 'node:crypto';
+import { createReadStream, createWriteStream } from 'node:fs';
+import { rm } from 'node:fs/promises';
+import { Transform } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
 import { promisify } from 'node:util';
 
 const scrypt = promisify(scryptCb);
@@ -91,15 +95,10 @@ export async function encryptBuffer(plaintext, password) {
 }
 
 /**
- * 解密一段密文。口令错误 / 密文被篡改时 AES-GCM 认证失败，抛出口令错误人话报错
- * （调用方可直接展示）；未知版本 / 未知算法 / 边车字段缺失一律拒绝，不猜着解。
- *
- * @param {Buffer|Uint8Array} ciphertext 密文（归档文件内容）
- * @param {object} sidecar `.encrypted.json` 解析出的对象
- * @param {string} password 口令（内存态）
- * @returns {Promise<Buffer>} 明文（tar.gz 字节）
+ * 校验边车并派生出解开这段密文所需的 { key, nonce, authTag }。
+ * 版本/算法/字段缺失一律拒绝（宁可不恢复，也不拿不认识的参数猜着解）。
  */
-export async function decryptBuffer(ciphertext, sidecar, password) {
+async function unlock(sidecar, password) {
   if (typeof password !== 'string' || !password) {
     throw new Error('这份备份已加密，恢复需要口令（口令只经内存传入，绝不写盘）');
   }
@@ -120,16 +119,116 @@ export async function decryptBuffer(ciphertext, sidecar, password) {
     throw new Error('加密边车字段缺失（salt/nonce/authTag），无法解密');
   }
   const key = await deriveKey(password, { ...(sidecar.kdfParams || KDF_PARAMS), salt });
+  return { key, nonce, authTag };
+}
+
+/** GCM 认证失败的统一人话报错（不泄露具体原因）。 */
+function authFailed(err) {
+  if (/unable to authenticate|authentication/i.test(String(err && err.message ? err.message : err))) {
+    return new Error('口令错误或归档已损坏（AES-GCM 认证失败）——请核对口令后重试');
+  }
+  return err;
+}
+
+/**
+ * 解密一段密文（内存版，供小体积数据/测试用）。口令错误 / 密文被篡改时 AES-GCM
+ * 认证失败，抛出口令错误人话报错（调用方可直接展示）。
+ *
+ * @param {Buffer|Uint8Array} ciphertext 密文（归档文件内容）
+ * @param {object} sidecar `.encrypted.json` 解析出的对象
+ * @param {string} password 口令（内存态）
+ * @returns {Promise<Buffer>} 明文（tar.gz 字节）
+ */
+export async function decryptBuffer(ciphertext, sidecar, password) {
+  const { key, nonce, authTag } = await unlock(sidecar, password);
   const decipher = createDecipheriv(CIPHER, key, nonce);
   decipher.setAuthTag(authTag);
   const body = Buffer.isBuffer(ciphertext) ? ciphertext : Buffer.from(ciphertext);
   try {
     return Buffer.concat([decipher.update(body), decipher.final()]);
   } catch (err) {
-    // GCM final() 认证失败：口令错或密文被改。两条都指向同一句人话，不泄露具体原因。
-    if (/unable to authenticate|authentication/i.test(String(err && err.message ? err.message : err))) {
-      throw new Error('口令错误或归档已损坏（AES-GCM 认证失败）——请核对口令后重试');
-    }
+    throw authFailed(err);
+  }
+}
+
+/**
+ * 加密文件：**分块流式**，不整包入内存（归档可以远超 Buffer 上限）。
+ * 调用方负责把输出写到临时路径后自己 `rename` 覆盖（本函数只保证「要么完整
+ * 密文、要么失败且不留半截文件」）。
+ *
+ * @param {string} inPath 明文文件
+ * @param {string} outPath 密文输出文件
+ * @param {string} password 口令
+ * @returns {Promise<{ sidecar: object, ciphertextSize: number }>}
+ */
+export async function encryptFile(inPath, outPath, password) {
+  if (typeof password !== 'string' || !password) {
+    throw new Error('加密需要非空口令（口令只经内存传入，绝不写盘）');
+  }
+  const salt = randomBytes(SALT_BYTES);
+  const nonce = randomBytes(NONCE_BYTES);
+  const key = await deriveKey(password, { ...KDF_PARAMS, salt });
+  const cipher = createCipheriv(CIPHER, key, nonce);
+  let ciphertextSize = 0;
+  const counter = new Transform({
+    transform(chunk, _enc, done) {
+      ciphertextSize += chunk.length;
+      done(null, chunk);
+    },
+  });
+  try {
+    await pipeline(
+      createReadStream(inPath),
+      cipher,
+      counter,
+      createWriteStream(outPath, { mode: 0o600 }),
+    );
+  } catch (err) {
+    await rm(outPath, { force: true }).catch(() => {});
     throw err;
   }
+  const authTag = cipher.getAuthTag();
+  return {
+    ciphertextSize,
+    sidecar: {
+      version: ENCRYPT_VERSION,
+      cipher: CIPHER,
+      kdf: KDF_PARAMS.algorithm,
+      kdfParams: {
+        N: KDF_PARAMS.N,
+        r: KDF_PARAMS.r,
+        p: KDF_PARAMS.p,
+        keyLen: KDF_PARAMS.keyLen,
+      },
+      salt: salt.toString('base64'),
+      nonce: nonce.toString('base64'),
+      authTag: authTag.toString('base64'),
+      ciphertextSize,
+    },
+  };
+}
+
+/**
+ * 解密文件：**分块流式**。认证通过才产出完整明文；口令错/密文被改时删除半截
+ * 输出并抛人话报错（绝不留下「解了一半」的明文）。
+ *
+ * @param {string} inPath 密文文件
+ * @param {string} outPath 明文输出文件（可能不完整；失败时已被删除）
+ * @param {object} sidecar `.encrypted.json` 内容
+ * @param {string} password 口令
+ */
+export async function decryptFile(inPath, outPath, sidecar, password) {
+  const { key, nonce, authTag } = await unlock(sidecar, password);
+  const decipher = createDecipheriv(CIPHER, key, nonce);
+  decipher.setAuthTag(authTag);
+  try {
+    await pipeline(
+      createReadStream(inPath),
+      decipher,
+      createWriteStream(outPath, { mode: 0o600 }),
+    );
+  } catch (err) {
+    await rm(outPath, { force: true }).catch(() => {});
+    throw authFailed(err);
+  }
 }

package/lib/index.js

@@ -63,7 +63,7 @@ import { basename, dirname, join, resolve } from 'node:path';
 import { StringDecoder } from 'node:string_decoder';
 import { fileURLToPath } from 'node:url';
 import * as zlib from 'node:zlib';
-import { encryptBuffer, decryptBuffer } from './encrypt.js';
+import { decryptFile, encryptFile } from './encrypt.js';
 import { buildZip, listZip, extractZip, readZipEntry } from './zip.js';
 import { gfsProtectedSet } from './gfs.js';
 import { acquireLock, releaseLock, heartbeatLock, reclaimLock as reclaimOplock, isLockStale, LOCK_HEARTBEAT_MS } from './oplock.js';
@@ -1777,9 +1777,17 @@ export function apply(ctx, pluginConfig) {
     // 替换——旧版插件遇到它只会 tar 解不开，边车只增不改、不误删不误读。
     let encrypted = false;
     if (typeof opts?.password === 'string' && opts.password) {
-      const plain = await readFile(out);
-      const enc = await encryptBuffer(plain, opts.password);
-      await writeBinary(out, enc.ciphertext);
+      // 流式加密 + 临时文件后原子替换：绝不在原路径「整包读入 → 原地覆盖」。
+      // 中途崩溃只会留下完整明文或完整密文，不会留半截密文（#103 同类教训）。
+      const tmpEnc = `${out}.enc-${stampNow()}.tmp`;
+      let enc;
+      try {
+        enc = await encryptFile(out, tmpEnc, opts.password);
+        await rename(tmpEnc, out);
+      } catch (err) {
+        await rm(tmpEnc, { force: true }).catch(() => {});
+        throw err;
+      }
       await writeOwned(`${out}.encrypted.json`, `${JSON.stringify(enc.sidecar)}\n`);
       encrypted = true;
     }
@@ -2190,7 +2198,7 @@ export function apply(ctx, pluginConfig) {
   function redactSyncChannel(channel, ch) {
     if (!ch) return { channel, type: channel, configured: false };
     const out = { channel, type: ch.type, configured: true, lastPush: ch.lastPush ?? null, lastError: ch.lastError ?? null };
-    if (ch.type === 'webdav') out.url = ch.url; out.username = ch.username; out.passwordSet = Boolean(ch.password);
+    if (ch.type === 'webdav') { out.url = ch.url; out.username = ch.username; out.passwordSet = Boolean(ch.password); }
     if (ch.type === 's3') { out.endpoint = ch.endpoint; out.region = ch.region; out.bucket = ch.bucket; out.pathPrefix = ch.pathPrefix || ''; out.accessKey = ch.accessKey; out.secretKeySet = Boolean(ch.secretKey); out.pathStyle = ch.pathStyle !== false; }
     if (ch.type === 'gist') { out.gistId = ch.gistId || ''; out.tokenSet = Boolean(ch.token); }
     return out;
@@ -2404,13 +2412,12 @@ export function apply(ctx, pluginConfig) {
       // meta.encrypted 标记了加密但边车缺失：这是不一致状态，拒绝而非猜着解
       throw new Error(`加密边车（.encrypted.json）缺失或损坏，无法解密——请核对备份是否完整（技术细节: ${snippet(String(err && err.message ? err.message : err), 80)}）`);
     }
-    const ciphertext = await readFile(`${root}/${archiveName}`);
-    const plain = await decryptBuffer(ciphertext, sidecar, password);
+    const tmpName = `.decrypt-${stampNow()}.tar.gz`;
+    // 直接流式解密到目标临时文件：大归档不整包入内存，认证失败时不留半截明文。
+    await decryptFile(`${root}/${archiveName}`, `${root}/${tmpName}`, sidecar, password);
     // 隐藏名 `.decrypt-<时间戳>.tar.gz`：listBackups 要求 `dsh-` 前缀，隐藏点开头
     // 的临时文件绝不进用户列表/轮换；位于备份目录内、相对名传 tar，规避 Windows
     // GNU tar 盘符冒号问题。finally 里必清理（明文 tar.gz 不能遗留）。
-    const tmpName = `.decrypt-${stampNow()}.tar.gz`;
-    await writeBinary(`${root}/${tmpName}`, plain);
     return { name: tmpName, cleanup: () => rm(`${root}/${tmpName}`, { force: true }) };
   }
 
@@ -3101,9 +3108,17 @@ export function apply(ctx, pluginConfig) {
       for (const p of packedPlugins) entryList.push({ name: `local-plugins/${p.tarballName}`, sourcePath: p.tarballPath });
       await buildZip(tmpPath, entryList, { signal });
       if (encrypted) {
-        const plain = await readFile(tmpPath);
-        const enc = await encryptBuffer(plain, password);
-        await writeBinary(finalPath, enc.ciphertext);
+        const tmpEnc = `${finalPath}.enc-${stampNow()}.tmp`;
+        let enc;
+        try {
+          enc = await encryptFile(tmpPath, tmpEnc, password);
+          await rename(tmpEnc, finalPath);
+        } catch (err) {
+          await rm(tmpEnc, { force: true }).catch(() => {});
+          throw err;
+        } finally {
+          await rm(tmpPath, { force: true }).catch(() => {});
+        }
         await writeOwned(`${finalPath}.encrypted.json`, `${JSON.stringify(enc.sidecar)}\n`);
       } else {
         await rename(tmpPath, finalPath);
@@ -4065,11 +4080,9 @@ export function apply(ctx, pluginConfig) {
     if (encrypted) {
       if (!password) throw new Error('这份导出已加密，需要口令才能读取（口令只经面板 RPC 内存态传入，绝不落盘）');
       const sidecar = JSON.parse(await readFile(sidecarPath, 'utf8'));
-      const ciphertext = await readFile(src);
-      const plain = await decryptBuffer(ciphertext, sidecar, password);
       const { root } = paths();
       const tmp = `${root}/.export-dec-${stampNow()}.zip`;
-      await writeBinary(tmp, plain);
+      await decryptFile(src, tmp, sidecar, password);
       return { zipPath: tmp, encrypted: true, cleanup: () => rm(tmp, { force: true }) };
     }
     return { zipPath: src, encrypted: false, cleanup: null };
@@ -4165,7 +4178,7 @@ export function apply(ctx, pluginConfig) {
       const remap = await remapScan(zipPath, manifest, home);
       const compatibility = compatScore(manifest, home);
       const totalFiles = sections.reduce((s, x) => s + x.files, 0);
-      const summary = `📦 导入预览 —— 只读，还没动磁盘\n来源: ${manifest.source?.host ?? '未知'}（${manifest.source?.platform ?? '未知平台'}）\n将导入 ${totalFiles} 个文件、${sections.length} 个节段${conflicts.length ? `\n⚠️ 其中 ${conflicts.length} 个目标文件已存在（默认保留本机，可在界面逐项选择覆盖）` : ''}${remap.length ? '\n⚠️ 需要跨机绝对路径 remap（见 remap 列表）' : ''}\n兼容性: ${compatibility.score}/100${compatibility.reasons.length ? `（${compatibility.reasons.join('；')}）` : ''}`;
+      const summary = `📦 导入预览 —— 只读，还没动磁盘\n来源: ${manifest.source?.host ?? '未知'}（${manifest.source?.platform ?? '未知平台'}）\n将导入 ${totalFiles} 个文件、${sections.length} 个节段${conflicts.length ? `\n⚠️ 其中 ${conflicts.length} 个目标文件已存在（默认保留本机，不改动已有文件）` : ''}${remap.length ? '\n⚠️ 需要跨机绝对路径 remap（见 remap 列表）' : ''}\n兼容性: ${compatibility.score}/100${compatibility.reasons.length ? `（${compatibility.reasons.join('；')}）` : ''}`;
       return { ok: true, encrypted, manifest, sections, totalFiles, totalBytes: manifest.totalBytes ?? 0, conflicts, remap, compatibility, summary };
     } finally {
       if (cleanup) await cleanup().catch(() => {});
@@ -4227,14 +4240,7 @@ export function apply(ctx, pluginConfig) {
         await prunePrefixedSnapshots(IMPORT_SNAPSHOT_PREFIX, 1, snap.name);
       } catch { /* 快照失败不阻断导入 */ }
 
-      // 测试专用故障注入（test-only）：DSH_BACKUP_IMPORT_FAIL=1 时，在「自动快照完成
-      // 之后、真正写入之前」抛一次错，模拟导入中途失败——零依赖 smoke 据此断言失败
-      // 路径与快照安全网（~/.dsh 未被改动）。生产默认绝不触发：环境变量未显式命中
-      // '1' 时此分支永不进入。
-      if (process.env.DSH_BACKUP_IMPORT_FAIL === '1') {
-        throw new Error('test-only import fault injection (DSH_BACKUP_IMPORT_FAIL=1)');
-      }
-
+      
       // 解压到暂存目录（extractZip 内 Zip Slip/符号链接/zip bomb/CRC 全套防线），再拷入 ~/.dsh
       staging = `${root}/.import-stage-${stampNow()}`;
       await extractZip(zipPath, staging, { names: new Set(willWrite.map((e) => e.name)), signal });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xiaoyuyu6420/dsh-backup",
-  "version": "0.14.1",
+  "version": "0.14.2",
   "description": "一条命令备份、恢复与迁移 DeepSeek Harness（dsh）的全部数据（~/.dsh：会话、设置、插件、MCP、技能）：定时自动备份、升级前快照、换机迁移、会话日志体检修复、宿主起不来也能用的进程外救援；凭据默认脱敏只存本机。 Backup, restore & migrate all DeepSeek Harness (~/.dsh) data — sessions, settings, plugins, MCP, skills: scheduled backups, pre-upgrade snapshots, cross-machine migration, session-log doctor, out-of-process rescue console; credentials redacted to a local-only vault.",
   "type": "module",
   "packageManager": "pnpm@11.24.0",

package/rescue/rescue.mjs

@@ -830,6 +830,10 @@ async function sessionsRepair(root, dshHome, argv) {
     }
   }
   if (!maps.length && keep === undefined) throw new Error('sessions repair 至少需要 --map old=new 或 --keep <id>');
+  // --map 会**改写会话 header 里的 cwd**（动用户自己的日志），必须显式确认。
+  if (fix && maps.length && !argv.includes('--yes')) {
+    throw new Error('sessions repair --fix --map 会原地改写会话 header 的 cwd（动用户日志）——确认请加 --yes；不加 --fix 时仅预览');
+  }
 
   const files = [];
   await collectSessionLogs(`${dshHome}/sessions`, '', 0, files);