@xiaoyuyu6420/dsh-backup 0.14.1 → 0.14.3

package/lib/oplock.js

@@ -31,7 +31,7 @@ export function isPidAlive(pid) {
     process.kill(pid, 0);
     return true;
   } catch (err) {
-    return err && err.code === 'EPERM'; // 存在但无权限 → 视为活着，绝不误踢
+    return err?.code !== 'ESRCH'; // Only a confirmed missing process may be reclaimed
   }
 }
 
@@ -53,71 +53,95 @@ async function readLockFile(lockPath) {
   }
 }
 
-async function writeLockFile(lockPath, operation) {
+/**
+ * A short filesystem transaction serializes all lock mutations across processes.
+ * mkdir is exclusive; atomic rename of JSON alone is not mutual exclusion.
+ * An unreadable/orphaned guard fails closed (never steal a potentially live writer).
+ * The owner record identifies the process for manual recovery after an interrupted
+ * metadata transaction. Normal crash recovery uses the main lock's dead PID.
+ */
+export async function withLockGuard(lockPath, fn, { wait = false } = {}) {
+  const guard = `${lockPath}.guard`;
   await mkdir(dirname(lockPath), { recursive: true });
-  const lock = {
-    pid: process.pid,
-    token: randomUUID(),
-    startedAt: new Date().toISOString(),
-    heartbeatAt: new Date().toISOString(),
-    operation: operation || 'unknown',
-  };
-  // 原子写：临时文件 + rename，避免并发读锁文件读一半
+  for (let attempt = 0; ; attempt++) {
+    try {
+      await mkdir(guard, { mode: 0o700 });
+      break;
+    } catch (err) {
+      if (err.code !== 'EEXIST') throw err;
+      if (!wait || attempt >= 100) return { busy: true, guard };
+      await new Promise((resolve) => setTimeout(resolve, 10));
+    }
+  }
+  try {
+    const fh = await open(`${guard}/owner.json`, 'wx', 0o600);
+    try { await fh.writeFile(JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString() })); }
+    finally { await fh.close(); }
+    return { value: await fn() };
+  } finally {
+    await rm(guard, { recursive: true, force: true });
+  }
+}
+
+async function writeLockFile(lockPath, lock) {
   const tmp = `${lockPath}.${randomUUID()}.tmp`;
-  await open(tmp, 'wx', 0o600).then(async (fh) => { await fh.writeFile(`${JSON.stringify(lock)}\n`, 'utf8'); await fh.close(); });
-  await rename(tmp, lockPath).catch(async (err) => { await rm(tmp, { force: true }).catch(() => {}); throw err; });
-  return lock;
+  try {
+    const fh = await open(tmp, 'wx', 0o600);
+    try { await fh.writeFile(`${JSON.stringify(lock)}\n`, 'utf8'); }
+    finally { await fh.close(); }
+    await rename(tmp, lockPath);
+  } finally {
+    await rm(tmp, { force: true }).catch(() => {});
+  }
 }
 
-/**
- * 尝试获取操作锁。
- * @returns {Promise<{acquired:boolean, lock?:object, reason?:string, heldBy?:object}>}
- *   acquired=true 时 lock 是本次写下的锁（含 token，供 release/heartbeat 使用）。
- */
+const heldBy = (lock) => ({ pid: lock.pid, operation: lock.operation, startedAt: lock.startedAt, heartbeatAt: lock.heartbeatAt });
+const busyReason = (guard) => `锁元数据正在更新（${guard}）；若进程异常退出，请先确认 guard/owner.json 中的进程已结束再清理该目录`;
+
 export async function acquireLock(lockPath, operation) {
-  const existing = await readLockFile(lockPath);
-  if (existing && !existing.unreadable && isLockStale(existing)) {
-    // 死锁：pid 已死，安全回收后重试
-    await rm(lockPath, { force: true }).catch(() => {});
-  } else if (existing) {
-    return { acquired: false, reason: '另一操作正在运行', heldBy: { pid: existing.pid, operation: existing.operation, startedAt: existing.startedAt, heartbeatAt: existing.heartbeatAt } };
-  }
-  const lock = await writeLockFile(lockPath, operation);
-  return { acquired: true, lock };
+  const result = await withLockGuard(lockPath, async () => {
+    const existing = await readLockFile(lockPath);
+    if (existing && (existing.unreadable || !isLockStale(existing))) {
+      return { acquired: false, reason: '另一操作正在运行', heldBy: heldBy(existing) };
+    }
+    const now = new Date().toISOString();
+    const lock = { pid: process.pid, token: randomUUID(), startedAt: now, heartbeatAt: now, operation: operation || 'unknown' };
+    await writeLockFile(lockPath, lock);
+    return { acquired: true, lock };
+  });
+  return result.busy ? { acquired: false, reason: busyReason(result.guard) } : result.value;
 }
 
-/** 刷新心跳（仅当 token 匹配、且 pid 仍是本进程时写）。 */
 export async function heartbeatLock(lockPath, token) {
-  const existing = await readLockFile(lockPath);
-  if (!existing || existing.token !== token) return false;
-  const lock = { ...existing, heartbeatAt: new Date().toISOString() };
-  const tmp = `${lockPath}.${randomUUID()}.tmp`;
-  await open(tmp, 'wx', 0o600).then(async (fh) => { await fh.writeFile(`${JSON.stringify(lock)}\n`, 'utf8'); await fh.close(); });
-  await rename(tmp, lockPath).catch(async (err) => { await rm(tmp, { force: true }).catch(() => {}); throw err; });
-  return true;
+  const result = await withLockGuard(lockPath, async () => {
+    const existing = await readLockFile(lockPath);
+    if (!existing || existing.token !== token || existing.pid !== process.pid) return false;
+    await writeLockFile(lockPath, { ...existing, heartbeatAt: new Date().toISOString() });
+    return true;
+  }, { wait: true });
+  return result.busy ? false : result.value;
 }
 
-/** 释放锁（仅 token 匹配才删，绝不删别人的锁）。 */
 export async function releaseLock(lockPath, token) {
-  const existing = await readLockFile(lockPath);
-  if (existing && existing.token === token) {
-    await rm(lockPath, { force: true }).catch(() => {});
+  const result = await withLockGuard(lockPath, async () => {
+    const existing = await readLockFile(lockPath);
+    if (!existing || existing.token !== token) return false;
+    await rm(lockPath, { force: true });
     return true;
-  }
-  return false;
+  }, { wait: true });
+  if (result.busy) throw new Error(busyReason(result.guard));
+  return result.value;
 }
 
-/**
- * 回收入口：死锁直接回收；活锁默认拒绝，force=true 时按用户显式确认强删。
- * @returns {Promise<{reclaimed:boolean, reason?:string, heldBy?:object}>}
- */
 export async function reclaimLock(lockPath, { force = false } = {}) {
-  const existing = await readLockFile(lockPath);
-  if (!existing) return { reclaimed: false, reason: '没有锁' };
-  const heldBy = { pid: existing.pid, operation: existing.operation, startedAt: existing.startedAt, heartbeatAt: existing.heartbeatAt };
-  if (isLockStale(existing) || force) {
-    await rm(lockPath, { force: true }).catch(() => {});
-    return { reclaimed: true, heldBy };
-  }
-  return { reclaimed: false, reason: '锁持有进程仍在运行（未回收，避免误踢活锁）', heldBy };
+  const result = await withLockGuard(lockPath, async () => {
+    const existing = await readLockFile(lockPath);
+    if (!existing) return { reclaimed: false, reason: '没有锁' };
+    if (isLockStale(existing) || force) {
+      await rm(lockPath, { force: true });
+      return { reclaimed: true, heldBy: heldBy(existing) };
+    }
+    return { reclaimed: false, reason: '锁持有进程仍在运行（未回收，避免误踢活锁）', heldBy: heldBy(existing) };
+  });
+  return result.busy ? { reclaimed: false, reason: busyReason(result.guard) } : result.value;
 }

package/lib/paths.js

@@ -0,0 +1,56 @@
+import { lstat } from 'node:fs/promises';
+import { realpathSync } from 'node:fs';
+import { basename, dirname, isAbsolute, relative, resolve, sep } from 'node:path';
+
+// Resolve existing ancestors too: a destination may not exist yet or may be
+// reached through a symlink outside DSH_HOME.
+function canonicalPath(value) {
+  const abs = resolve(value);
+  try { return realpathSync(abs); } catch (err) {
+    if (err.code !== 'ENOENT' || dirname(abs) === abs) throw err;
+    return resolve(canonicalPath(dirname(abs)), basename(abs));
+  }
+}
+
+/** Relative backup subtree to exclude, or null for an external destination. */
+export function backupRootRelative(dshHome, root) {
+  const rel = relative(canonicalPath(dshHome), canonicalPath(root));
+  if (!rel) throw new Error('备份目录不能等于 DSH_HOME，请选择独立的备份目录');
+  return rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel) ? null : rel.split(sep).join('/');
+}
+
+/** tar --exclude is a glob, even when the user configured a literal directory. */
+export function tarLiteralPattern(value) {
+  return value.replace(/[\\*?\[\]]/g, '\\$&');
+}
+
+/** Portable relative paths only; metadata is untrusted even when ZIP names are safe. */
+export function safeRelativePath(value) {
+  if (typeof value !== 'string' || !value || /[\\\u0000-\u001f\u007f:]/.test(value)
+    || value.startsWith('/') || value.split('/').some((part) => !part || part === '.' || part === '..'
+      || /[. ]$/.test(part) || /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(part))) {
+    throw new Error(`不安全的相对路径: ${String(value)}`);
+  }
+  return value;
+}
+
+/** Reject existing symlinks as well as lexical traversal before writing into a tree. */
+export async function safeDestination(root, rel) {
+  safeRelativePath(rel);
+  const base = resolve(root);
+  const target = resolve(base, rel);
+  const inside = relative(base, target);
+  if (!inside || inside === '..' || inside.startsWith(`..${sep}`) || isAbsolute(inside)) {
+    throw new Error(`写入路径越界: ${rel}`);
+  }
+  let current = base;
+  for (const part of ['', ...rel.split('/')]) {
+    if (part) current = resolve(current, part);
+    const info = await lstat(current).catch((err) => {
+      if (err.code === 'ENOENT') return null;
+      throw err;
+    });
+    if (info?.isSymbolicLink()) throw new Error(`写入路径含符号链接: ${rel}`);
+  }
+  return target;
+}

package/lib/redact.js

@@ -0,0 +1,37 @@
+const literal = (c) => c.replace(/[\\^$.*+?()[\]{}|]/g, '\\$&');
+
+// tar excludes are unanchored globs and '*' may cross directory separators.
+// POSIX character classes depend on the tar process locale; conservatively match
+// any character for those classes instead of risking a plaintext ZIP disclosure.
+export function matchesRedaction(rel, pattern) {
+  let source = '';
+  for (let i = 0; i < pattern.length; i++) {
+    const c = pattern[i];
+    if (c === '*') source += '[\\s\\S]*';
+    else if (c === '?') source += '[\\s\\S]';
+    else if (c === '\\' && i + 1 < pattern.length) source += literal(pattern[++i]);
+    else if (c === '[') {
+      let end = i + 1;
+      if (pattern[end] === '!' || pattern[end] === '^') end++;
+      if (pattern[end] === ']') end++;
+      while (end < pattern.length && pattern[end] !== ']') {
+        if (pattern[end] === '[' && ':=.'.includes(pattern[end + 1] ?? ' ')) {
+          const innerEnd = pattern.indexOf(`${pattern[end + 1]}]`, end + 2);
+          if (innerEnd !== -1) { end = innerEnd + 2; continue; }
+        }
+        end++;
+      }
+      if (end === pattern.length) { source += '\\['; continue; }
+      const body = pattern.slice(i + 1, end);
+      const negated = body.startsWith('!') || body.startsWith('^');
+      const chars = (negated ? body.slice(1) : body).replace(/\\/g, '\\\\').replace(/\]/g, '\\]');
+      const bracket = `[${negated ? '^' : ''}${chars}]`;
+      try {
+        new RegExp(bracket);
+        source += body.includes('[') ? '[\\s\\S]' : bracket;
+      } catch { source += '[\\s\\S]'; }
+      i = end;
+    } else source += literal(c);
+  }
+  return new RegExp(`(?:^|/)${source}(?:/|$)`).test(rel);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xiaoyuyu6420/dsh-backup",
-  "version": "0.14.1",
+  "version": "0.14.3",
   "description": "一条命令备份、恢复与迁移 DeepSeek Harness（dsh）的全部数据（~/.dsh：会话、设置、插件、MCP、技能）：定时自动备份、升级前快照、换机迁移、会话日志体检修复、宿主起不来也能用的进程外救援；凭据默认脱敏只存本机。 Backup, restore & migrate all DeepSeek Harness (~/.dsh) data — sessions, settings, plugins, MCP, skills: scheduled backups, pre-upgrade snapshots, cross-machine migration, session-log doctor, out-of-process rescue console; credentials redacted to a local-only vault.",
   "type": "module",
   "packageManager": "pnpm@11.24.0",

package/rescue/rescue.mjs

@@ -93,8 +93,6 @@ function run(argv, cwd) {
 const parentTar = (p) => (p.endsWith('/') ? p : `${p}/`);
 
 async function sha256File(absPath) {
-  const info = await fs.stat(absPath);
-  if (info.size > HASH_MAX_BYTES) throw new Error(`文件 ${Math.floor(info.size / 1048576)}MB 超过哈希上限`);
   return new Promise((resolve, reject) => {
     const h = createHash('sha256');
     createReadStream(absPath).on('data', (d) => h.update(d)).on('error', reject).on('end', () => resolve(h.digest('hex')));
@@ -510,6 +508,17 @@ async function restoreArchive(root, selector, apply) {
     return { dryRun: true, archive: picked.name, files: entries.length, sample: entries.slice(0, 12), preflight, profileDirs };
   }
 
+  // Keep this standalone rescue script dependency-free. A nested backup root
+  // would disappear when the source tree is moved aside during replacement.
+  const sourceReal = await fs.realpath(dshHome).catch((err) => {
+    if (err.code === 'ENOENT') return path.resolve(dshHome);
+    throw err;
+  });
+  const backupRel = path.relative(sourceReal, await fs.realpath(root));
+  if (!backupRel || (backupRel !== '..' && !backupRel.startsWith(`..${path.sep}`) && !path.isAbsolute(backupRel))) {
+    throw new Error('整包恢复前请把整个备份目录（含 vault）移到 DSH_HOME 外，并更新备份路径；当前备份目录位于待替换的数据目录内');
+  }
+
   // 现有数据：快照 + 挪旁；缺失（新机/全失）则直接解压
   let targetExists = true;
   try {
@@ -755,12 +764,30 @@ function isPidAlive(pid) {
     process.kill(pid, 0);
     return true;
   } catch (err) {
-    return err && err.code === 'EPERM';
+    return err?.code !== 'ESRCH';
   }
 }
 
 /** 回收残留死锁（owner 证明已死才回收）。 */
 async function recoverStaleLock(root) {
+  // Use the host's same exclusive transaction guard: never remove a lock while
+  // a live host is publishing a new owner or heartbeat.
+  const guard = `${root}/${LOCK_FILE}.guard`;
+  await fs.mkdir(root, { recursive: true });
+  try { await fs.mkdir(guard, { mode: 0o700 }); }
+  catch (err) {
+    if (err.code === 'EEXIST') throw new Error(`锁元数据正在更新（${guard}），请稍后重试`);
+    throw err;
+  }
+  try {
+    await fs.writeFile(`${guard}/owner.json`, JSON.stringify({ pid: process.pid }), { mode: 0o600 });
+    return await recoverStaleLockInner(root);
+  } finally {
+    await fs.rm(guard, { recursive: true, force: true });
+  }
+}
+
+async function recoverStaleLockInner(root) {
   const lockPath = `${root}/${LOCK_FILE}`;
   let lock;
   try {
@@ -830,6 +857,10 @@ async function sessionsRepair(root, dshHome, argv) {
     }
   }
   if (!maps.length && keep === undefined) throw new Error('sessions repair 至少需要 --map old=new 或 --keep <id>');
+  // --map 会**改写会话 header 里的 cwd**（动用户自己的日志），必须显式确认。
+  if (fix && maps.length && !argv.includes('--yes')) {
+    throw new Error('sessions repair --fix --map 会原地改写会话 header 的 cwd（动用户日志）——确认请加 --yes；不加 --fix 时仅预览');
+  }
 
   const files = [];
   await collectSessionLogs(`${dshHome}/sessions`, '', 0, files);