@xiaoyuyu6420/dsh-backup 0.14.1 → 0.14.3

package/lib/index.js

@@ -54,6 +54,7 @@
  * 插件的自有存储。
  */
 import { createHash, randomUUID } from 'node:crypto';
+import { AsyncLocalStorage } from 'node:async_hooks';
 import { createReadStream, existsSync, readFileSync, realpathSync } from 'node:fs';
 import { spawn } from 'node:child_process';
 import { mkdir, open, copyFile, chmod, readdir, readFile, rename, rm, stat as fsStat, lstat, unlink, writeFile, link } from 'node:fs/promises';
@@ -63,9 +64,11 @@ import { basename, dirname, join, resolve } from 'node:path';
 import { StringDecoder } from 'node:string_decoder';
 import { fileURLToPath } from 'node:url';
 import * as zlib from 'node:zlib';
-import { encryptBuffer, decryptBuffer } from './encrypt.js';
+import { decryptFile, encryptFile } from './encrypt.js';
 import { buildZip, listZip, extractZip, readZipEntry } from './zip.js';
 import { gfsProtectedSet } from './gfs.js';
+import { safeRelativePath, safeDestination, backupRootRelative, tarLiteralPattern } from './paths.js';
+import { matchesRedaction } from './redact.js';
 import { acquireLock, releaseLock, heartbeatLock, reclaimLock as reclaimOplock, isLockStale, LOCK_HEARTBEAT_MS } from './oplock.js';
 import { s3Put, webdavPut, gistSync, gistContent } from './sync-channels.js';
 import { defineTool } from '@deepseek-ai/dsh-tools';
@@ -151,7 +154,7 @@ const EXPORT_SECTIONS = Object.freeze([
   { key: 'settings', label: '设置', paths: ['settings.yaml', 'settings.json'] },
   { key: 'ui', label: '界面设置', paths: ['ui.json', 'ui-state.json', '.ui'] },
   { key: 'providers', label: '模型供应商', paths: ['providers'] },
-  { key: 'plugins', label: '插件 profiles', paths: ['profiles'] },
+  { key: 'plugins', label: '插件 profiles', paths: ['profiles', 'local-plugins'] },
   { key: 'mcp', label: 'MCP 配置', paths: ['cordis.patch.yml', 'cordis.yml'] },
   { key: 'skills', label: '技能', paths: ['skills'] },
   { key: 'prompts', label: '提示词', paths: ['prompts'] },
@@ -1351,7 +1354,33 @@ export function apply(ctx, pluginConfig) {
    * （rel 本身可含 glob）。
    */
   function redactExcludeFlags(base) {
-    return sensitivePaths().flatMap((rel) => [`--exclude=${base}/${rel}`, `--exclude=*/${rel}`]);
+    return sensitivePatterns().flatMap((rel) => [`--exclude=${base}/${rel}`, `--exclude=*/${rel}`]);
+  }
+
+  // Old releases left rollback copies beside live credentials. Exclude these too.
+  function sensitivePatterns() {
+    return sensitivePaths().flatMap((rel) => [rel, `${rel}.pre-merge-*`, `${rel}.pre-import-*`]);
+  }
+
+  function isSensitiveRelative(rel) {
+    return sensitivePatterns().some((pattern) => matchesRedaction(rel, pattern));
+  }
+
+  async function retainBeforeOverwrite(rel, kind, stamp) {
+    const { dshHome, root } = paths();
+    const sensitive = isSensitiveRelative(rel);
+    const keep = sensitive
+      ? await safeDestination(`${root}/${VAULT_DIR}/${PRESERVED_DIR}`, `${kind}-${stamp}/${rel}`)
+      : await safeDestination(dshHome, `${rel}.pre-${kind}-${stamp}`);
+    await mkdir(dirname(keep), { recursive: true, mode: 0o700 });
+    // Create exclusively and privately before copying; never follow a retained
+    // path left by an earlier operation or expose plaintext through the umask.
+    const fh = await open(keep, 'wx', 0o600);
+    // copyFile copies the source mode too, which could turn a private rollback
+    // file back into 0644. Stream through the already-private file descriptor.
+    try { await fh.writeFile(createReadStream(`${dshHome}/${rel}`)); }
+    finally { await fh.close(); }
+    return keep;
   }
 
   /**
@@ -1687,26 +1716,30 @@ export function apply(ctx, pluginConfig) {
   // 备份/恢复/导入/同步/doctor 这类重活会动 ~/.dsh 与备份目录（vault 刷新、
   // .dsh 挪旁、归档轮换），多实例/多 profile 并发会互相踩。锁文件在备份目录根
   // .oplock.json，记 pid+token+心跳；死锁（pid 已死）下次自动回收，活锁绝不误踢。
-  // 同进程重入（restore 内部的快照 doBackup 等）经 heldLock 内存标记直接放行。
+  // 同一异步操作链可重入（restore 内部的快照 doBackup 等）。
   let heldLock = null;
-  let heartbeatTimer = null;
+  const operationScope = new AsyncLocalStorage();
 
   async function withOperationLock(operation, fn) {
-    if (heldLock) return fn(); // 同进程重入：本进程已持锁，直接跑
+    // Only descendants of the current operation may reenter (restore -> snapshot).
+    // An unrelated RPC in the same process must still compete for the lock.
+    if (heldLock && operationScope.getStore() === heldLock.token) return fn();
     const { root } = paths();
     const lockPath = `${root}/${LOCK_FILE}`;
     const r = await acquireLock(lockPath, operation);
     if (!r.acquired) {
-      throw new Error(`另一操作正在进行（${r.heldBy?.operation ?? '未知'}，pid=${r.heldBy?.pid}）——请稍后重试；若确认是残留死锁可用 /backup lock reclaim 回收`);
+      throw new Error(`另一操作正在进行（${r.heldBy?.operation ?? '未知'}，pid=${r.heldBy?.pid ?? '未知'}）：${r.reason ?? ''}——请稍后重试；若确认是残留死锁可用 /backup lock reclaim 回收`);
     }
     heldLock = r.lock;
-    heartbeatTimer = setInterval(() => { heartbeatLock(lockPath, r.lock.token).catch(() => {}); }, LOCK_HEARTBEAT_MS);
+    let heartbeat = Promise.resolve();
+    const heartbeatTimer = setInterval(() => { heartbeat = heartbeat.then(() => heartbeatLock(lockPath, r.lock.token)).catch(() => {}); }, LOCK_HEARTBEAT_MS);
     try {
-      return await fn();
+      return await operationScope.run(r.lock.token, fn);
     } finally {
-      if (heartbeatTimer) { clearInterval(heartbeatTimer); heartbeatTimer = null; }
+      clearInterval(heartbeatTimer);
+      await heartbeat;
       await releaseLock(lockPath, r.lock.token).catch(() => {});
-      heldLock = null;
+      if (heldLock?.token === r.lock.token) heldLock = null;
     }
   }
 
@@ -1716,6 +1749,7 @@ export function apply(ctx, pluginConfig) {
 
   async function doBackupInner(keep, signal, opts = {}) {
     const { home, dshHome, root } = paths();
+    const backupRel = backupRootRelative(dshHome, root);
     const keepN = keep && keep > 0 ? Math.floor(keep) : defaultKeep();
     // 状态文件先写：writeText 会自动创建备份目录，替代 mkdir -p（Windows 无 mkdir.exe）。
     await saveAutoState();
@@ -1735,10 +1769,11 @@ export function apply(ctx, pluginConfig) {
     // 不知情的情况下删掉最后一份好副本。检出项记入 meta.quarantined，恢复侧
     // 如实提示。体检失败不阻断备份（fail-open）。
     let quarantined = [];
+    let scanFailed = false;
     if (!opts?.skipScan) {
       try {
         quarantined = (await runDoctorScan(signal)).corrupt.map((c) => c.rel);
-      } catch { /* 扫描异常按无隔离处理 */ }
+      } catch { scanFailed = true; }
     }
     const quarantineFlags = quarantined.map((rel) => `--exclude=${base}/${rel}`);
 
@@ -1761,8 +1796,9 @@ export function apply(ctx, pluginConfig) {
     const redacted = skipVault ? await existingSensitive(dshHome) : await refreshVault(dshHome, home, signal);
     const tar = await ctx.subprocess.resolveExecutable('tar');
     const redactFlags = isTyped ? [] : redactExcludeFlags(base);
+    const destinationFlags = backupRel === null ? [] : [`--exclude=${tarLiteralPattern(`${base}/${backupRel}`)}`];
     try {
-      await spawnRun([tar, '--exclude=*node_modules*', '--exclude=.system', ...quarantineFlags, ...redactFlags, ...extraExcludes(), '-czf', name, '-C', parentTar(parent), ...(isTyped ? typePaths : [base])], root, signal);
+      await spawnRun([tar, '--exclude=*node_modules*', '--exclude=.system', ...destinationFlags, ...quarantineFlags, ...redactFlags, ...extraExcludes(), '-czf', name, '-C', parentTar(parent), ...(isTyped ? typePaths : [base])], root, signal);
     } catch (err) {
       // tar 失败前已创建 -f 目标——空壳归档留在备份目录会被面板当正常备份
       // 列出来（#88：29 字节静默空包）。删掉空壳再抛，让失败可见。
@@ -1777,9 +1813,17 @@ export function apply(ctx, pluginConfig) {
     // 替换——旧版插件遇到它只会 tar 解不开，边车只增不改、不误删不误读。
     let encrypted = false;
     if (typeof opts?.password === 'string' && opts.password) {
-      const plain = await readFile(out);
-      const enc = await encryptBuffer(plain, opts.password);
-      await writeBinary(out, enc.ciphertext);
+      // 流式加密 + 临时文件后原子替换：绝不在原路径「整包读入 → 原地覆盖」。
+      // 中途崩溃只会留下完整明文或完整密文，不会留半截密文（#103 同类教训）。
+      const tmpEnc = `${out}.enc-${stampNow()}.tmp`;
+      let enc;
+      try {
+        enc = await encryptFile(out, tmpEnc, opts.password);
+        await rename(tmpEnc, out);
+      } catch (err) {
+        await rm(tmpEnc, { force: true }).catch(() => {});
+        throw err;
+      }
       await writeOwned(`${out}.encrypted.json`, `${JSON.stringify(enc.sidecar)}\n`);
       encrypted = true;
     }
@@ -1840,7 +1884,8 @@ export function apply(ctx, pluginConfig) {
       monthly: Number(gfsCfg.gfsMonthly) > 0 ? Math.floor(Number(gfsCfg.gfsMonthly)) : 0,
       yearly: Number(gfsCfg.gfsYearly) > 0 ? Math.floor(Number(gfsCfg.gfsYearly)) : 0,
     });
-    const rotateStale = opts.skipRotate
+    const retentionPaused = quarantined.length > 0 || scanFailed;
+    const rotateStale = opts.skipRotate || retentionPaused || SNAPSHOT_PREFIXES.some((p) => name.startsWith(p))
       ? []
       : rotateTail.filter((b) => !tierProtectedSet(rotateTail, rotateBase[0]?.name).has(b.name) && !gfsProtect.has(b.name)).map((b) => b.name);
     if (rotateStale.length) await removeFiles(rotateStale.flatMap((n) => sidecarsFor(n)), root, signal);
@@ -1863,14 +1908,14 @@ export function apply(ctx, pluginConfig) {
       await saveAutoState();
     }
 
-    return { path: out, name, sha: shaText, total: rotateBase.length, stale: rotateStale.length, keep: keepN, quarantined, sync, ...(encrypted ? { encrypted: true } : {}), ...(isTyped ? { types, hasCredentials } : {}) };
+    return { path: out, name, sha: shaText, total: rotateBase.length, stale: rotateStale.length, keep: keepN, quarantined, retentionPaused, sync, ...(encrypted ? { encrypted: true } : {}), ...(isTyped ? { types, hasCredentials } : {}) };
   }
 
   /** 备份回执的隔离提示行：体检发现坏会话文件未入档时如实告知 + 指路修复。 */
   function quarantineNote(r) {
     return Array.isArray(r?.quarantined) && r.quarantined.length
-      ? `\n⚠️ ${r.quarantined.length} 个损坏会话文件未入档（防轮换毁掉好副本）；/backup doctor --repair 修复后可正常备份`
-      : '';
+      ? `\n⚠️ ${r.quarantined.length} 个损坏会话文件未入档，已暂停轮换以保留健康副本；/backup doctor --repair 修复后恢复轮换`
+      : r?.retentionPaused ? '\n⚠️ 会话体检未完成，已暂停轮换；体检恢复后再清理旧备份' : '';
   }
 
   // ---------- GitHub 同步 ----------
@@ -2008,7 +2053,8 @@ export function apply(ctx, pluginConfig) {
       } finally {
         await fh.close();
       }
-      await spawnRun([git, 'config', 'credential.helper', `store --file=${creds}`], syncDir, signal);
+      const quotedCreds = `'${creds.replace(/'/g, `'\\''`)}'`;
+      await spawnRun([git, 'config', 'credential.helper', `store --file=${quotedCreds}`], syncDir, signal);
     }
     // token 文件绝不能进仓库：git add -A 会把它当普通文件提交
     await writeOwned(`${syncDir}/.gitignore`, '.git-credentials\n');
@@ -2022,6 +2068,10 @@ export function apply(ctx, pluginConfig) {
    * 的 .git-credentials（credential helper），不进进程参数。
    */
   async function githubSync(signal) {
+    return withOperationLock('github-sync', () => githubSyncInner(signal));
+  }
+
+  async function githubSyncInner(signal) {
     const { root } = paths();
     const wt = await ensureSyncWorktree(signal);
     if (wt.reason) return { skipped: wt.reason };
@@ -2098,6 +2148,10 @@ export function apply(ctx, pluginConfig) {
    * 拉回的归档先做 sha256 校验（边车随仓库走），损坏即报且不落列表。
    */
   async function githubPull(signal) {
+    return withOperationLock('github-pull', () => githubPullInner(signal));
+  }
+
+  async function githubPullInner(signal) {
     const { root, home } = paths();
     const wt = await ensureSyncWorktree(signal);
     if (wt.reason) throw new Error(wt.reason);
@@ -2190,7 +2244,7 @@ export function apply(ctx, pluginConfig) {
   function redactSyncChannel(channel, ch) {
     if (!ch) return { channel, type: channel, configured: false };
     const out = { channel, type: ch.type, configured: true, lastPush: ch.lastPush ?? null, lastError: ch.lastError ?? null };
-    if (ch.type === 'webdav') out.url = ch.url; out.username = ch.username; out.passwordSet = Boolean(ch.password);
+    if (ch.type === 'webdav') { out.url = ch.url; out.username = ch.username; out.passwordSet = Boolean(ch.password); }
     if (ch.type === 's3') { out.endpoint = ch.endpoint; out.region = ch.region; out.bucket = ch.bucket; out.pathPrefix = ch.pathPrefix || ''; out.accessKey = ch.accessKey; out.secretKeySet = Boolean(ch.secretKey); out.pathStyle = ch.pathStyle !== false; }
     if (ch.type === 'gist') { out.gistId = ch.gistId || ''; out.tokenSet = Boolean(ch.token); }
     return out;
@@ -2273,6 +2327,10 @@ export function apply(ctx, pluginConfig) {
    * error?, skipped?, gistUrl? }，凭据绝不进返回。
    */
   async function syncNow(channel, signal) {
+    return withOperationLock('sync', () => syncNowInner(channel, signal));
+  }
+
+  async function syncNowInner(channel, signal) {
     if (channel === 'github') return githubSync(signal);
     const ch = syncChannels[channel];
     if (!ch) return { error: `未配置同步通道 ${channel}（/backup sync ${channel} set … 或面板配置）` };
@@ -2404,13 +2462,12 @@ export function apply(ctx, pluginConfig) {
       // meta.encrypted 标记了加密但边车缺失：这是不一致状态，拒绝而非猜着解
       throw new Error(`加密边车（.encrypted.json）缺失或损坏，无法解密——请核对备份是否完整（技术细节: ${snippet(String(err && err.message ? err.message : err), 80)}）`);
     }
-    const ciphertext = await readFile(`${root}/${archiveName}`);
-    const plain = await decryptBuffer(ciphertext, sidecar, password);
+    const tmpName = `.decrypt-${stampNow()}.tar.gz`;
+    // 直接流式解密到目标临时文件：大归档不整包入内存，认证失败时不留半截明文。
+    await decryptFile(`${root}/${archiveName}`, `${root}/${tmpName}`, sidecar, password);
     // 隐藏名 `.decrypt-<时间戳>.tar.gz`：listBackups 要求 `dsh-` 前缀，隐藏点开头
     // 的临时文件绝不进用户列表/轮换；位于备份目录内、相对名传 tar，规避 Windows
     // GNU tar 盘符冒号问题。finally 里必清理（明文 tar.gz 不能遗留）。
-    const tmpName = `.decrypt-${stampNow()}.tar.gz`;
-    await writeBinary(`${root}/${tmpName}`, plain);
     return { name: tmpName, cleanup: () => rm(`${root}/${tmpName}`, { force: true }) };
   }
 
@@ -2612,9 +2669,10 @@ export function apply(ctx, pluginConfig) {
    * cwd 为备份目录、-f 用纯文件名（规避 Windows GNU tar 盘符冒号问题），
    * 逐行解析 -tvzf 输出并拒绝备份根之外的任何条目——含不安全条目直接抛错。
    */
-  async function safeArchiveEntries(pickedName, signal) {
-    const { root, dshHome } = paths();
-    const base = dshHome.split('/').pop();
+  async function safeArchiveEntries(pickedName, signal, options = {}) {
+    const env = paths();
+    const root = options.root ?? env.root;
+    const base = options.base ?? env.dshHome.split('/').pop();
     const tar = await ctx.subprocess.resolveExecutable('tar');
     // 清单流式读取（#119）：不用有界收集——大归档的清单超过 spill 上限时会被截断，
     // 碎片会被误判成"不安全条目"而拒绝整包（详见 streamListingLines 注释）。
@@ -2639,7 +2697,7 @@ export function apply(ctx, pluginConfig) {
       // 救援台全链路失效（#112）。硬链接不能跨文件系统、也不能指向目录，目标同为
       // 归档内相对路径时解压不会逃出备份根；符号链接（l）、设备等仍一律拒绝。
       const plainOk = Boolean(parsed) && Boolean(name) && (parsed.type === '-' || parsed.type === 'd') && insideBase(name);
-      const hardOk = Boolean(parsed) && parsed.type === 'h' && insideBase(name) && insideBase(link);
+      const hardOk = options.allowHardlinks !== false && Boolean(parsed) && parsed.type === 'h' && insideBase(name) && insideBase(link);
       if (!plainOk && !hardOk) {
         bad.push(parsed ? name : s);
       } else {
@@ -2756,13 +2814,17 @@ export function apply(ctx, pluginConfig) {
           targetExists, preflight: preflightLines(preflight, profileDirs),
         };
       }
-      // 留档将覆盖的现有文件（.pre-merge-<时间戳>），失败可逐个还原。
+      const newTargets = [];
+      for (const entry of fileTargets) {
+        const rel = entry.slice(`${base}/`.length);
+        await safeDestination(dshHome, rel);
+        if (!(await existsStat(`${dshHome}/${rel}`))) newTargets.push(rel);
+      }
+      // Validate every target before creating rollback copies or changing data.
       const stamp = stampNow();
       const kept = [];
       for (const w of willOverwrite) {
-        const keep = `${dshHome}/${w.rel}.pre-merge-${stamp}`;
-        await mkdir(dirname(keep), { recursive: true });
-        await copyFile(`${dshHome}/${w.rel}`, keep);
+        const keep = await retainBeforeOverwrite(w.rel, 'merge', stamp);
         kept.push({ ...w, keep });
       }
       try {
@@ -2773,14 +2835,18 @@ export function apply(ctx, pluginConfig) {
         // 时把留档路径交代清楚，绝不静默停在半截状态。
         const reason = err && err.message ? err.message : String(err);
         const restored = new Set();
-        for (const w of willOverwrite) {
+        for (const w of kept) {
           try { await copyFile(w.keep, `${dshHome}/${w.rel}`); restored.add(w.rel); } catch { /* 逐个失败落入下方报告 */ }
         }
-        if (restored.size === willOverwrite.length) {
+        const cleanupFailed = [];
+        for (const rel of newTargets) {
+          try { await rm(`${dshHome}/${rel}`, { recursive: true, force: true }); } catch { cleanupFailed.push(rel); }
+        }
+        if (restored.size === willOverwrite.length && !cleanupFailed.length) {
           throw new Error(`分类型恢复失败（${reason}）。已从留档还原全部覆盖现场，数据保持恢复前状态；排查后可重试`);
         }
-        const missing = willOverwrite.filter((w) => !restored.has(w.rel)).map((w) => w.rel);
-        throw new Error(`分类型恢复失败（${reason}），且部分现场未自动还原: ${missing.join(', ')}。对应的 *.pre-merge-${stamp} 留档仍在原目录旁，手工拷回即可`);
+        const missing = kept.filter((w) => !restored.has(w.rel)).map((w) => `${w.rel}（留档: ${w.keep}）`);
+        throw new Error(`分类型恢复失败（${reason}），且部分现场未自动还原: ${[...missing, ...cleanupFailed].join(', ')}。请从上述留档手工还原`);
       }
       // 可选依赖重装：merge 含 profiles 时对新解出的 profile 跑 pnpm install。
       const deps = { installed: [], failed: [], note: null };
@@ -2826,6 +2892,12 @@ export function apply(ctx, pluginConfig) {
       };
     }
 
+    // Moving DSH_HOME would also move the selected archive, vault and operation
+    // lock. Require relocating the complete backup directory before replacement.
+    if (backupRootRelative(dshHome, root) !== null) {
+      throw new Error('整包恢复前请把整个备份目录（含 vault）移到 DSH_HOME 外，并更新备份路径；当前备份目录位于待替换的数据目录内');
+    }
+
     // 恢复前自动快照当前数据，并把当前数据移到旁边（而非合并覆盖）。
     // 快照用 dsh-pre-restore- 前缀与用户常规备份区分，经 listBackups 过滤
     // 后不进列表/轮换/latest 选择；每次恢复清掉上一次的快照防累积。
@@ -2936,7 +3008,7 @@ export function apply(ctx, pluginConfig) {
         '✅ 分类型恢复完成',
         `  已合并写入: ${r.restored} 项 ← 来自 ${r.archive.split('/').pop()}（类型: ${types}）`,
       ];
-      if (r.kept?.length) lines.push(`  覆盖的旧文件已留档: ${r.kept.length} 个（.pre-merge-*，确认后可自行删除）`);
+      if (r.kept?.length) lines.push(`  覆盖的旧文件已留档: ${r.kept.length} 个（敏感文件在本机 vault/preserved，其余为 .pre-merge-*，确认后可自行删除）`);
       for (const p of r.preflight ?? []) if (p.startsWith('⚠️')) lines.push(`  ${p}`);
       if (r.deps?.note) lines.push(`  插件依赖: ${r.deps.note}`);
       else if (r.deps?.installed?.length) lines.push(`  插件依赖: 已装好 ${r.deps.installed.join(', ')}`);
@@ -3023,10 +3095,12 @@ export function apply(ctx, pluginConfig) {
    * .git/.system（任意深度）；凭据节段按 includeCredentials 决定入包或记入脱敏清单。
    */
   async function walkExportFiles(dshHome, includeCredentials, signal) {
+    const backupRel = backupRootRelative(dshHome, paths().root);
     const files = [];
     const redacted = [];
     const skipDirs = new Set(['node_modules', '.git', '.system']);
     async function walk(abs, rel) {
+      if (rel === backupRel) return;
       if (signal?.aborted) throw new Error('操作已取消');
       if (files.length >= EXPORT_MAX_FILES) throw new Error(`导出文件数超过上限（${EXPORT_MAX_FILES}），请检查 ~/.dsh 是否有异常目录树`);
       let st;
@@ -3044,7 +3118,7 @@ export function apply(ctx, pluginConfig) {
       }
       if (!st.isFile()) return;
       const section = sectionKeyForTop(rel.split('/')[0]);
-      if (section === 'credentials' && !includeCredentials) { redacted.push(rel); return; }
+      if (!includeCredentials && (section === 'credentials' || isSensitiveRelative(rel))) { redacted.push(rel); return; }
       files.push({ rel, abs, bytes: st.size, section });
     }
     await walk(dshHome, '');
@@ -3069,6 +3143,10 @@ export function apply(ctx, pluginConfig) {
 
   /** 导出：把 ~/.dsh 打成单文件 ZIP（可选加密）。 */
   async function exportConfig(opts, signal) {
+    return withOperationLock('export', () => exportConfigInner(opts, signal));
+  }
+
+  async function exportConfigInner(opts, signal) {
     const { home, dshHome, root } = paths();
     const includeCredentials = opts?.includeCredentials === true;
     const password = typeof opts?.password === 'string' && opts.password ? opts.password : null;
@@ -3086,9 +3164,11 @@ export function apply(ctx, pluginConfig) {
     // 本地 link:/file: 插件迁移：npm pack 成 tarball 打进导出，导入侧解包改 file:
     const localPlugins = await scanLocalPlugins(signal);
     const packedPlugins = localPlugins.filter((p) => p.status === 'packed');
+    // Different profiles may reference distinct packages with the same npm name/version.
+    for (const p of packedPlugins) p.exportName = `${randomUUID()}-${p.tarballName}`;
     const encrypted = Boolean(password);
     const manifest = buildManifest(home, encrypted, redacted, sectionStats);
-    manifest.localPlugins = localPlugins.map((p) => ({ profile: p.profile, name: p.name, spec: p.spec, status: p.status, tarball: p.tarballName ?? null, warning: p.warning ?? null }));
+    manifest.localPlugins = localPlugins.map((p) => ({ profile: p.profile, name: p.name, spec: p.spec, status: p.status, tarball: p.exportName ?? null, warning: p.warning ?? null }));
     const finalName = `dsh-config-${stampNow()}.zip`;
     const finalPath = `${root}/${finalName}`;
     const tmpPath = `${root}/.export-${stampNow()}.tmp.zip`;
@@ -3098,12 +3178,20 @@ export function apply(ctx, pluginConfig) {
     try {
       const entryList = [{ name: 'manifest.json', data: Buffer.from(JSON.stringify(manifest)) }];
       for (const f of files) entryList.push({ name: f.rel, sourcePath: f.abs });
-      for (const p of packedPlugins) entryList.push({ name: `local-plugins/${p.tarballName}`, sourcePath: p.tarballPath });
+      for (const p of packedPlugins) entryList.push({ name: `local-plugins/${p.exportName}`, sourcePath: p.tarballPath });
       await buildZip(tmpPath, entryList, { signal });
       if (encrypted) {
-        const plain = await readFile(tmpPath);
-        const enc = await encryptBuffer(plain, password);
-        await writeBinary(finalPath, enc.ciphertext);
+        const tmpEnc = `${finalPath}.enc-${stampNow()}.tmp`;
+        let enc;
+        try {
+          enc = await encryptFile(tmpPath, tmpEnc, password);
+          await rename(tmpEnc, finalPath);
+        } catch (err) {
+          await rm(tmpEnc, { force: true }).catch(() => {});
+          throw err;
+        } finally {
+          await rm(tmpPath, { force: true }).catch(() => {});
+        }
         await writeOwned(`${finalPath}.encrypted.json`, `${JSON.stringify(enc.sidecar)}\n`);
       } else {
         await rename(tmpPath, finalPath);
@@ -4065,11 +4153,9 @@ export function apply(ctx, pluginConfig) {
     if (encrypted) {
       if (!password) throw new Error('这份导出已加密，需要口令才能读取（口令只经面板 RPC 内存态传入，绝不落盘）');
       const sidecar = JSON.parse(await readFile(sidecarPath, 'utf8'));
-      const ciphertext = await readFile(src);
-      const plain = await decryptBuffer(ciphertext, sidecar, password);
       const { root } = paths();
       const tmp = `${root}/.export-dec-${stampNow()}.zip`;
-      await writeBinary(tmp, plain);
+      await decryptFile(src, tmp, sidecar, password);
       return { zipPath: tmp, encrypted: true, cleanup: () => rm(tmp, { force: true }) };
     }
     return { zipPath: src, encrypted: false, cleanup: null };
@@ -4087,6 +4173,28 @@ export function apply(ctx, pluginConfig) {
     if (Number(manifest?.version) > EXPORT_FORMAT_VERSION) {
       throw new Error(`导出包版本过新（version=${manifest.version}，本机支持 ${EXPORT_FORMAT_VERSION}）——请升级插件后导入`);
     }
+    if (manifest.localPlugins !== undefined) {
+      if (!Array.isArray(manifest.localPlugins)) throw new Error('manifest.localPlugins 必须是数组');
+      const seen = new Set();
+      manifest.localPlugins = manifest.localPlugins.map((p) => {
+        if (!p || typeof p !== 'object') throw new Error('本地插件元数据无效');
+        safeRelativePath(p.name);
+        if (!/^(?:@[A-Za-z0-9][A-Za-z0-9._-]*\/)?[A-Za-z0-9][A-Za-z0-9._-]*$/.test(p.name)) throw new Error('本地插件名称无效');
+        safeRelativePath(p.profile);
+        if (!/^[A-Za-z0-9._-]+$/.test(p.profile)) throw new Error('本地插件 profile 无效');
+        const key = `${p.profile}/${p.name}`;
+        if (seen.has(key)) throw new Error(`重复的本地插件: ${key}`);
+        seen.add(key);
+        // Canonical export field is tarball; accept the older import-side spelling too.
+        const tarball = p.tarball ?? p.tarballName;
+        if (p.tarball && p.tarballName && p.tarball !== p.tarballName) throw new Error('本地插件 tarball 字段冲突');
+        if (p.status === 'packed') {
+          safeRelativePath(tarball);
+          if (tarball.includes('/') || !tarball.endsWith('.tgz')) throw new Error('本地插件 tarball 路径无效');
+        }
+        return { ...p, tarball };
+      });
+    }
     return manifest;
   }
 
@@ -4165,7 +4273,7 @@ export function apply(ctx, pluginConfig) {
       const remap = await remapScan(zipPath, manifest, home);
       const compatibility = compatScore(manifest, home);
       const totalFiles = sections.reduce((s, x) => s + x.files, 0);
-      const summary = `📦 导入预览 —— 只读，还没动磁盘\n来源: ${manifest.source?.host ?? '未知'}（${manifest.source?.platform ?? '未知平台'}）\n将导入 ${totalFiles} 个文件、${sections.length} 个节段${conflicts.length ? `\n⚠️ 其中 ${conflicts.length} 个目标文件已存在（默认保留本机，可在界面逐项选择覆盖）` : ''}${remap.length ? '\n⚠️ 需要跨机绝对路径 remap（见 remap 列表）' : ''}\n兼容性: ${compatibility.score}/100${compatibility.reasons.length ? `（${compatibility.reasons.join('；')}）` : ''}`;
+      const summary = `📦 导入预览 —— 只读，还没动磁盘\n来源: ${manifest.source?.host ?? '未知'}（${manifest.source?.platform ?? '未知平台'}）\n将导入 ${totalFiles} 个文件、${sections.length} 个节段${conflicts.length ? `\n⚠️ 其中 ${conflicts.length} 个目标文件已存在（默认保留本机，不改动已有文件）` : ''}${remap.length ? '\n⚠️ 需要跨机绝对路径 remap（见 remap 列表）' : ''}\n兼容性: ${compatibility.score}/100${compatibility.reasons.length ? `（${compatibility.reasons.join('；')}）` : ''}`;
       return { ok: true, encrypted, manifest, sections, totalFiles, totalBytes: manifest.totalBytes ?? 0, conflicts, remap, compatibility, summary };
     } finally {
       if (cleanup) await cleanup().catch(() => {});
@@ -4199,7 +4307,7 @@ export function apply(ctx, pluginConfig) {
       const willWrite = [];
       const willSkip = [];
       for (const e of selected) {
-        const targetAbs = `${dshHome}/${e.name}`;
+        const targetAbs = await safeDestination(dshHome, e.name);
         const exists = await existsStat(targetAbs);
         if (exists && decisions[e.name] !== 'overwrite') { willSkip.push(e.name); continue; }
         willWrite.push({ ...e, targetAbs, conflict: exists });
@@ -4227,80 +4335,75 @@ export function apply(ctx, pluginConfig) {
         await prunePrefixedSnapshots(IMPORT_SNAPSHOT_PREFIX, 1, snap.name);
       } catch { /* 快照失败不阻断导入 */ }
 
-      // 测试专用故障注入（test-only）：DSH_BACKUP_IMPORT_FAIL=1 时，在「自动快照完成
-      // 之后、真正写入之前」抛一次错，模拟导入中途失败——零依赖 smoke 据此断言失败
-      // 路径与快照安全网（~/.dsh 未被改动）。生产默认绝不触发：环境变量未显式命中
-      // '1' 时此分支永不进入。
-      if (process.env.DSH_BACKUP_IMPORT_FAIL === '1') {
-        throw new Error('test-only import fault injection (DSH_BACKUP_IMPORT_FAIL=1)');
-      }
 
       // 解压到暂存目录（extractZip 内 Zip Slip/符号链接/zip bomb/CRC 全套防线），再拷入 ~/.dsh
-      staging = `${root}/.import-stage-${stampNow()}`;
+      staging = `${root}/.import-stage-${randomUUID()}`;
       await extractZip(zipPath, staging, { names: new Set(willWrite.map((e) => e.name)), signal });
       const stamp = stampNow();
       const backups = [];
       const applied = [];
       const overwrote = [];
+      const createdPluginDirs = [];
+      let remapped = 0;
+      let pluginsRestored = { restored: [], skipped: [] };
       try {
         for (const e of willWrite) {
           if (signal?.aborted) throw new Error('操作已取消');
+          await safeDestination(dshHome, e.name);
           await mkdir(dirname(e.targetAbs), { recursive: true });
           if (e.conflict) {
-            const keep = `${e.targetAbs}.pre-import-${stamp}`;
-            await copyFile(e.targetAbs, keep);
+            const keep = await retainBeforeOverwrite(e.name, 'import', stamp);
             backups.push({ name: e.name, targetAbs: e.targetAbs, keep });
           }
-          await copyFile(`${staging}/${e.name}`, e.targetAbs);
+          // Record before copyFile: even a failed copy may leave partial new bytes.
           applied.push(e.name);
+          await copyFile(`${staging}/${e.name}`, e.targetAbs);
           if (e.conflict) overwrote.push(e.name);
         }
+        // 校验：写入的文件必须存在（防半截写入被误判成功）
+        const missing = [];
+        for (const e of willWrite) if (!(await existsStat(e.targetAbs))) missing.push(e.name);
+        if (missing.length) throw new Error(`导入校验失败，部分文件未落盘: ${missing.slice(0, 5).join(', ')}（快照: ${snapshotName ?? '未生成'}）`);
+
+        // 跨机 remap：对写入的文本配置做 from→to 前缀替换（settings / cordis）
+        if (Array.isArray(opts?.remap) && opts.remap.length) {
+          for (const m of opts.remap) {
+            if (!m || typeof m.from !== 'string' || !m.from || typeof m.to !== 'string') continue;
+            for (const rel of ['settings.yaml', 'settings.json', 'cordis.yml', 'cordis.patch.yml']) {
+              if (!willWrite.some((e) => e.name === rel)) continue;
+              const p = `${dshHome}/${rel}`;
+              if (!(await existsStat(p))) continue;
+              const text = await readFile(p, 'utf8');
+              const next = text.split(m.from).join(m.to);
+              if (next !== text) { await writeFile(p, next, 'utf8'); remapped += 1; }
+            }
+          }
+        }
+
+        // Only selected, actually written tarballs and profile manifests may be changed.
+        pluginsRestored = await restoreLocalPlugins(manifest.localPlugins, signal, { willWrite, createdPluginDirs });
       } catch (err) {
         // 回滚：覆盖的先还原留档，新增的删除；回滚再失败则给出快照/留档指引，绝不静默停在半截。
         const failed = [];
+        for (const dir of createdPluginDirs.reverse()) {
+          try { await rm(dir, { recursive: true, force: true }); } catch { failed.push(dir); }
+        }
         for (const b of backups) {
-          try { await copyFile(b.keep, b.targetAbs); } catch { failed.push(b.name); }
+          try { await copyFile(b.keep, b.targetAbs); } catch { failed.push(`${b.name}（留档: ${b.keep}）`); }
         }
         for (const n of applied) {
-          if (!backups.some((b) => b.name === n)) await rm(`${dshHome}/${n}`, { force: true }).catch(() => {});
+          if (!backups.some((b) => b.name === n)) {
+            try { await rm(`${dshHome}/${n}`, { force: true }); } catch { failed.push(n); }
+          }
         }
         const snapNote = snapshotName ? `\n已自动快照: ${snapshotName}，可 /backup restore ${snapshotName} 整体回滚。` : '';
         if (failed.length) {
-          throw new Error(`导入失败并已尽力回滚：${friendlyReason(err)}。部分留档未还原: ${failed.join(', ')}（对应 *.pre-import-${stamp} 留档在原目录旁）。${snapNote}`);
+          throw new Error(`导入失败并已尽力回滚：${friendlyReason(err)}。部分留档未还原: ${failed.join(', ')}。${snapNote}`);
         }
         throw new Error(`导入失败，已自动回滚到导入前状态：${friendlyReason(err)}。${snapNote}`);
       }
 
-      // 校验：写入的文件必须存在（防半截写入被误判成功）
-      const missing = [];
-      for (const e of willWrite) if (!(await existsStat(e.targetAbs))) missing.push(e.name);
-      if (missing.length) throw new Error(`导入校验失败，部分文件未落盘: ${missing.slice(0, 5).join(', ')}（快照: ${snapshotName ?? '未生成'}）`);
-
-      // 跨机 remap：对写入的文本配置做 from→to 前缀替换（settings / cordis）
-      let remapped = 0;
-      if (Array.isArray(opts?.remap) && opts.remap.length) {
-        for (const m of opts.remap) {
-          if (!m || typeof m.from !== 'string' || !m.from || typeof m.to !== 'string') continue;
-          for (const rel of ['settings.yaml', 'settings.json', 'cordis.yml', 'cordis.patch.yml']) {
-            if (!willWrite.some((e) => e.name === rel)) continue;
-            const p = `${dshHome}/${rel}`;
-            if (!(await existsStat(p))) continue;
-            const text = await readFile(p, 'utf8');
-            const next = text.split(m.from).join(m.to);
-            if (next !== text) { await writeFile(p, next, 'utf8'); remapped += 1; }
-          }
-        }
-      }
-
-      // 本地 link:/file: 插件迁移：解包 local-plugins tarball 到 ~/.dsh/local-plugins/ 并改回 file:
-      const localPluginEntries = entries.filter((e) => !e.isDirectory && e.name.startsWith('local-plugins/'));
-      let pluginsRestored = { restored: [], skipped: [] };
-      if (localPluginEntries.length && Array.isArray(manifest?.localPlugins)) {
-        await extractZip(zipPath, dshHome, { names: new Set(localPluginEntries.map((e) => e.name)), signal });
-        pluginsRestored = await restoreLocalPlugins(manifest.localPlugins, signal);
-      }
-
-      const summary = `✅ 导入完成\n  已写入: ${applied.length} 个文件（覆盖 ${overwrote.length}、新增 ${applied.length - overwrote.length}、跳过已存在 ${willSkip.length}）${remapped ? `\n  已 remap: ${remapped} 个配置文件` : ''}${pluginsRestored.restored.length ? `\n  本地插件已装回 file:: ${pluginsRestored.restored.map((p) => p.name).join(', ')}` : ''}${pluginsRestored.skipped.length ? `\n  ⚠️ 本地插件需手动处理: ${pluginsRestored.skipped.map((p) => `${p.name}（${p.reason}）`).join(', ')}` : ''}${snapshotName ? `\n  导入前快照: ${snapshotName}` : '\n  ⚠️ 导入前快照未生成（建议确认无误后手动备份一次）'}${backups.length ? `\n  覆盖的旧文件已留档 *.pre-import-${stamp}（确认后可删）` : ''}\n  ⏸️ 待办: 重启 dsh 生效`;
+      const summary = `✅ 导入完成\n  已写入: ${applied.length} 个文件（覆盖 ${overwrote.length}、新增 ${applied.length - overwrote.length}、跳过已存在 ${willSkip.length}）${remapped ? `\n  已 remap: ${remapped} 个配置文件` : ''}${pluginsRestored.restored.length ? `\n  本地插件已装回 file:: ${pluginsRestored.restored.map((p) => p.name).join(', ')}` : ''}${pluginsRestored.skipped.length ? `\n  ⚠️ 本地插件需手动处理: ${pluginsRestored.skipped.map((p) => `${p.name}（${p.reason}）`).join(', ')}` : ''}${snapshotName ? `\n  导入前快照: ${snapshotName}` : '\n  ⚠️ 导入前快照未生成（建议确认无误后手动备份一次）'}${backups.length ? `\n  覆盖的旧文件已留档（敏感文件在本机 vault/preserved，其余在原目录旁；确认后可删）` : ''}\n  ⏸️ 待办: 重启 dsh 生效`;
       return { ok: true, encrypted, applied: applied.length, skipped: willSkip.length, overwrote: overwrote.length, snapshot: snapshotName, remapped, pluginsRestored, summary };
     } finally {
       if (staging) await rm(staging, { recursive: true, force: true }).catch(() => {});
@@ -5336,6 +5439,10 @@ export function apply(ctx, pluginConfig) {
 
   /** 分级清理：'cache' 只删可再生缓存/暂存；'expired' 再删过期备份（快照/同步/vault 永不删）。 */
   async function cleanup(scope, signal) {
+    return withOperationLock('cleanup', () => cleanupInner(scope, signal));
+  }
+
+  async function cleanupInner(scope, signal) {
     const { root } = paths();
     const removed = [];
     const rmdir = (dir) => rm(`${root}/${dir}`, { recursive: true, force: true });
@@ -5350,6 +5457,10 @@ export function apply(ctx, pluginConfig) {
       }
     }
     if (scope === 'expired') {
+      const scan = await runDoctorScan(signal);
+      if (scan.corruptCount) {
+        return { ok: true, removed: removed.length, names: removed, summary: `检测到 ${scan.corruptCount} 个损坏会话，已暂停过期备份清理，保留健康副本；请先修复会话` };
+      }
       // 过期备份：keep 窗口外且不在日/周/月/年分层保护内的全量归档才删
       const keepN = defaultKeep();
       const all = await listBackups();
@@ -5402,8 +5513,9 @@ export function apply(ctx, pluginConfig) {
   /** 校验 profile 名（拒绝空/路径段/非法字符/保留名）。 */
   function validateProfileName(name) {
     if (typeof name !== 'string' || !name.trim()) return 'profile 名不能为空';
-    if (!/^[A-Za-z0-9._-]+$/.test(name)) return `profile 名只能含字母数字 . _ -（收到 ${name}）`;
-    if (APP_OWNED_PROFILES.has(name)) return `profile ${name} 是应用内置 profile，只读不可改`;
+    if (name === '.' || name === '..' || !/^[A-Za-z0-9._-]+$/.test(name)) return `profile 名只能含字母数字 . _ -，且不能是 . 或 ..（收到 ${name}）`;
+    try { safeRelativePath(name); } catch { return `不安全的 profile 名: ${name}`; }
+    if (APP_OWNED_PROFILES.has(name.toLowerCase())) return `profile ${name} 是应用内置 profile，只读不可改`;
     return null;
   }
 
@@ -5562,32 +5674,54 @@ export function apply(ctx, pluginConfig) {
     return result;
   }
 
-  /** 导入侧：把打包的本地插件解包到 `<dshHome>/local-plugins/<name>/` 并改回 file:。 */
-  async function restoreLocalPlugins(localPlugins, signal) {
-    const { dshHome, root } = paths();
+  /** 导入侧：解包到本机独立目录并把选中的 profile 依赖改回 file:。 */
+  async function restoreLocalPlugins(localPlugins, signal, { willWrite, createdPluginDirs }) {
+    const { dshHome } = paths();
     const restored = [];
     const skipped = [];
+    const written = new Set(willWrite.map((e) => e.name));
     for (const p of Array.isArray(localPlugins) ? localPlugins : []) {
-      if (p.status !== 'packed' || !p.tarballName) { skipped.push({ name: p.name, reason: p.warning || p.status }); continue; }
-      // 导入包内 tarball 已随 export 打进了 ZIP（importApply 解压到暂存后经 names 落盘到 dshHome 下）
-      const src = `${dshHome}/local-plugins/${p.tarballName}`;
-      if (!(await existsStat(src))) { skipped.push({ name: p.name, reason: 'tarball 不在导入包内' }); continue; }
-      const targetDir = `${dshHome}/local-plugins/${p.name}`;
-      await mkdir(targetDir, { recursive: true });
-      const tar = await ctx.subprocess.resolveExecutable('tar');
-      await spawnRun([tar, '-xzf', src, '-C', parentTar(targetDir)], dshHome, signal);
-      // 把 profile 的 package.json 里 link:/file: 改回 file: 指向解包目录
-      const pkgPath = `${dshHome}/profiles/${p.profile}/package.json`;
+      if (p.status !== 'packed') { skipped.push({ name: p.name, reason: p.warning || p.status }); continue; }
+      const tarRel = `local-plugins/${p.tarball}`;
+      const pkgRel = `profiles/${p.profile}/package.json`;
+      if (!written.has(tarRel) || !written.has(pkgRel)) {
+        skipped.push({ name: p.name, reason: '插件包或 profile 未选中，或已选择保留本机' });
+        continue;
+      }
+      const src = await safeDestination(dshHome, tarRel);
+      const pkgPath = await safeDestination(dshHome, pkgRel);
+      const pkg = JSON.parse(await readFile(pkgPath, 'utf8'));
+      const fields = ['dependencies', 'devDependencies'].filter((field) =>
+        pkg[field] && Object.hasOwn(pkg[field], p.name) && /^(?:link|file):/.test(pkg[field][p.name]));
+      if (!fields.length) { skipped.push({ name: p.name, reason: 'profile 没有对应的本地插件依赖' }); continue; }
+      // npm pack always wraps files in package/. Reject traversal, links, and special
+      // entries before extracting into a fresh staging directory, never into live data.
+      await safeArchiveEntries(basename(src), signal, { root: dirname(src), base: 'package', allowHardlinks: false });
+      const installRel = `local-plugins/installed-${randomUUID()}`;
+      const installRoot = await safeDestination(dshHome, installRel);
+      await mkdir(dirname(installRoot), { recursive: true });
+      await mkdir(installRoot, { mode: 0o700 });
+      createdPluginDirs.push(installRoot);
+      // Stage on the target filesystem so external-disk backup destinations do
+      // not make the final rename fail with EXDEV.
+      const stage = `${installRoot}/.unpack`;
+      await mkdir(stage, { mode: 0o700 });
       try {
-        const pkg = JSON.parse(await readFile(pkgPath, 'utf8'));
-        for (const field of ['dependencies', 'devDependencies']) {
-          if (pkg[field] && typeof pkg[field] === 'object' && pkg[field][p.name]) {
-            pkg[field][p.name] = `file:${targetDir}`;
-          }
-        }
+        const tar = await ctx.subprocess.resolveExecutable('tar');
+        await spawnRun([tar, '-xzf', basename(src), '-C', stage], dirname(src), signal);
+        const packageJson = await safeDestination(stage, 'package/package.json');
+        const packed = JSON.parse(await readFile(packageJson, 'utf8'));
+        if (!packed || typeof packed !== 'object' || Array.isArray(packed)) throw new Error('本地插件 package.json 无效');
+        const targetDir = await safeDestination(installRoot, p.name);
+        await mkdir(dirname(targetDir), { recursive: true });
+        // Point file: at the actual package root, not the tar's parent directory.
+        await rename(`${stage}/package`, targetDir);
+        for (const field of fields) pkg[field][p.name] = `file:${targetDir}`;
         await writeOwned(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
-      } catch { /* package.json 改不了就跳过，如实标注 */ }
-      restored.push({ name: p.name, profile: p.profile, dir: targetDir });
+        restored.push({ name: p.name, profile: p.profile, dir: targetDir });
+      } finally {
+        await rm(stage, { recursive: true, force: true }).catch(() => {});
+      }
     }
     return { restored, skipped };
   }