deepclean-mydisk 0.12.1 → 0.13.0

package/lib/index.js

@@ -39,7 +39,7 @@ let lastReportAt = 0
 // disk_audit 的临时报告：只给 disk_inspect 解析 itemId / 覆盖路径，绝不参与清理放行。
 let lastToolReport = null
 let lastToolReportAt = 0
-let activeChild = null
+let scanController = null
 const lastBatches = []
 
 const scanState = {
@@ -49,14 +49,18 @@ const scanState = {
   startedAt: 0,
   finishedAt: 0,
   error: '',
+  errorCode: '',
   full: false,
   canceled: false,
 }
 
 function killTree(child) {
-  if (!child || child.killed) return
+  if (!child?.pid || child.killed) return
   if (process.platform === 'win32') {
-    try { spawn('taskkill', ['/pid', String(child.pid), '/T', '/F'], { stdio: 'ignore' }) } catch { /* ignore */ }
+    try {
+      spawn('taskkill', ['/pid', String(child.pid), '/T', '/F'], { stdio: 'ignore', windowsHide: true })
+        .on('error', () => {})
+    } catch { /* ignore */ }
     return
   }
   try { process.kill(-child.pid, 'SIGTERM') } catch { try { child.kill('SIGTERM') } catch { /* ignore */ } }
@@ -65,20 +69,89 @@ function killTree(child) {
   }, 1500).unref?.()
 }
 
-function pythonCommand() {
-  const win = process.platform === 'win32'
-  return { cmd: win ? 'py' : 'python3', args: win ? ['-3'] : [] }
+// DSH 自带运行时里可能就有可用的 Python：用户机器上常见只有 Microsoft Store
+// 的占位别名（执行即退出 9009），PATH 探测会全部失败。这里只做存在性检查，
+// 真正的可用性仍由下面的版本探针判定，所以不会误用一个坏的运行时。
+function bundledPythonCandidates() {
+  const relatives = process.platform === 'win32'
+    ? [['python', 'python.exe']]
+    : [['python', 'bin', 'python3'], ['python', 'bin', 'python'], ['python', 'python3']]
+  let runtimes = []
+  try {
+    runtimes = fs.readdirSync(path.join(DSH_HOME, 'dsh-runtimes'), { withFileTypes: true })
+      .filter((entry) => entry.isDirectory())
+      .map((entry) => entry.name)
+      .sort()
+  } catch {
+    return []
+  }
+  const found = []
+  for (const runtime of runtimes) {
+    for (const relative of relatives) {
+      const exe = path.join(DSH_HOME, 'dsh-runtimes', runtime, 'dependencies', ...relative)
+      if (!fs.existsSync(exe)) continue
+      found.push([exe])
+      break
+    }
+  }
+  return found
+}
+
+// 解释器探测：只跑版本探针，不跑扫描器，真实扫描失败（含超时）绝不触发换解释器重试。
+const PYTHON_PROBE = ['-I', '-S', '-c', 'import sys; print("deepclean-python-ok" if (3, 9) <= sys.version_info < (4,) else "")']
+
+// 顺序：显式 PYTHON → PATH 上的启动器 → DSH 自带运行时（兜底）。
+function pythonCandidates(win) {
+  const launchers = win ? [['py', '-3'], ['python'], ['python3']] : [['python3'], ['python']]
+  const candidates = []
+  const seen = new Set()
+  for (const candidate of [process.env.PYTHON ? [process.env.PYTHON] : null, ...launchers, ...bundledPythonCandidates()]) {
+    if (!candidate || seen.has(candidate.join('\u0000'))) continue
+    seen.add(candidate.join('\u0000'))
+    candidates.push(candidate)
+  }
+  return candidates
+}
+
+async function pickPython(candidates, env, opts) {
+  for (const [cmd, ...args] of candidates) {
+    opts.signal?.throwIfAborted()
+    const result = await runScannerProcess(cmd, [...args, ...PYTHON_PROBE], 5000, { env, signal: opts.signal }).catch(() => null)
+    opts.signal?.throwIfAborted()
+    if (result?.code === 0 && result.out.trim() === 'deepclean-python-ok') return [cmd, ...args]
+  }
+  return null
 }
 
-function runScanner(extraArgs, timeoutMs, opts = {}, script = 'deepclean.py') {
-  const { cmd, args } = pythonCommand()
+async function runScanner(extraArgs, timeoutMs, opts = {}, script = 'deepclean.py') {
+  const win = process.platform === 'win32'
   const target = path.join(RESOURCES, 'scripts', script)
+  const env = { ...process.env, PYTHONIOENCODING: 'utf-8', ...opts.env }
+  // Windows：启动器或商店别名可能能启动但不能执行 Python，关掉商店自动安装弹窗。
+  if (win) env.PYTHON_MANAGER_AUTOMATIC_INSTALL = 'false'
+  const candidates = pythonCandidates(win)
+  const python = await pickPython(candidates, env, opts)
+  if (python) {
+    const [cmd, ...args] = python
+    return runScannerProcess(cmd, [...args, target, ...extraArgs], timeoutMs, { ...opts, env })
+  }
+  // 非 Windows 维持历史行为：把首选解释器的真实启动失败原样抛出（errorCode 留空，
+  // 客户端不会走进 Windows 专用的 Python 安装引导卡）。
+  if (!win) {
+    const [cmd, ...args] = candidates[0]
+    return runScannerProcess(cmd, [...args, target, ...extraArgs], timeoutMs, { ...opts, env })
+  }
+  throw Object.assign(new Error('找不到可用的 Python 3（需要 3.9 或更新版本）。请安装 Python 3，确认 PowerShell 中 `py -3 --version`、`python --version` 或 `python3 --version` 能显示版本，然后重启 DSH。'), { code: 'python_unavailable' })
+}
+
+function runScannerProcess(cmd, args, timeoutMs, { env, signal, onProgress }) {
   return new Promise((resolve, reject) => {
+    signal?.throwIfAborted()
     let child
     try {
-      child = spawn(cmd, [...args, target, ...extraArgs], {
+      child = spawn(cmd, args, {
         cwd: RESOURCES,
-        env: { ...process.env, PYTHONIOENCODING: 'utf-8', ...(opts.env || {}) },
+        env,
         stdio: ['ignore', 'pipe', 'pipe'],
         detached: process.platform !== 'win32',
         windowsHide: true,
@@ -87,8 +160,8 @@ function runScanner(extraArgs, timeoutMs, opts = {}, script = 'deepclean.py') {
       reject(new Error(`无法启动 ${cmd}：${err instanceof Error ? err.message : String(err)}`))
       return
     }
-    if (typeof opts.trackChild === 'function') opts.trackChild(child)
-    else activeChild = child
+    const abort = () => killTree(child)
+    signal?.addEventListener('abort', abort, { once: true })
     let out = ''
     let err = ''
     let buf = ''
@@ -97,28 +170,29 @@ function runScanner(extraArgs, timeoutMs, opts = {}, script = 'deepclean.py') {
     child.stdout.on('data', (chunk) => { out += chunk })
     child.stderr.on('data', (chunk) => {
       err += chunk
-      if (typeof opts.onProgress !== 'function') return
+      if (typeof onProgress !== 'function') return
       buf += chunk
       let idx
       while ((idx = buf.indexOf('\n')) >= 0) {
         const line = buf.slice(0, idx).trim()
         buf = buf.slice(idx + 1)
         const m = /^PROGRESS (\d+) (.+)$/.exec(line)
-        if (m) opts.onProgress(Number(m[1]), m[2])
+        if (m) onProgress(Number(m[1]), m[2])
       }
     })
     const timer = setTimeout(() => {
+      signal?.removeEventListener('abort', abort)
       try { killTree(child) } catch { /* ignore */ }
       reject(new Error(`扫描超时（${Math.round(timeoutMs / 1000)}s）；可改用快速扫描`))
     }, timeoutMs)
     child.on('error', (error) => {
       clearTimeout(timer)
+      signal?.removeEventListener('abort', abort)
       reject(new Error(`无法启动 ${cmd}：${error.message}（请确认本机已安装 Python 3）`))
     })
     child.on('close', (code) => {
       clearTimeout(timer)
-      if (typeof opts.trackChild === 'function') opts.trackChild(null)
-      else if (activeChild === child) activeChild = null
+      signal?.removeEventListener('abort', abort)
       resolve({ code, out, err })
     })
   })
@@ -182,6 +256,7 @@ function listCleanBatches(limit = 20) {
     return []
   }
   const batches = []
+  const byId = new Map()
   const latestOwner = new Map()
   const restores = new Map()
   const purged = new Set()
@@ -191,28 +266,40 @@ function listCleanBatches(limit = 20) {
       if (e.action === 'clean' && Array.isArray(e.moved) && e.moved.length) {
         const items = e.moved.map(m => ({ ...m, restored: false }))
         for (const item of items) latestOwner.set(item.to, item)
-        batches.push({ batchId: e.batchId, at: e.at, items })
-      } else if (e.action === 'purge' && e.batchId) {
-        purged.add(e.batchId)
-      } else if (e.action === 'restore' && Array.isArray(e.results)) {
-        // Replay legacy logs too, including partial successful restores.
-        for (const batch of batches) {
-          if (batch.batchId !== e.batchId) continue
-          for (const item of batch.items) {
-            if (e.results.some(r => r.ok && r.path === item.from && (!r.to || r.to === item.to))) item.restored = true
+        const batch = { batchId: e.batchId, at: e.at, items }
+        batches.push(batch)
+        byId.set(e.batchId, batch)
+      } else if ((e.action === 'restore' || e.action === 'purge') && Array.isArray(e.results)) {
+        const isRestore = e.action === 'restore'
+        if (!isRestore && e.batchId) purged.add(e.batchId)
+        for (const item of byId.get(e.batchId)?.items || []) {
+          const matched = e.results.some(r => r.ok && (isRestore
+            ? r.path === item.from && (!r.to || r.to === item.to)
+            : r.from === item.from && r.to === item.to))
+          if (!matched) continue
+          if (isRestore) {
+            item.restored = true
+            item.restoredAt ??= e.at
+          } else {
+            item.deleted = true
+            item.deletedAt ??= e.at
           }
         }
+        if (!isRestore) continue
         // 最近一次恢复是否部分失败：历史页据此提示「上次恢复失败」并给另存为副本入口。
         const failed = e.results.filter(r => !r.ok)
         const codes = {}
         for (const r of failed) codes[r.code || 'io'] = (codes[r.code || 'io'] || 0) + 1
         restores.set(e.batchId, { at: e.at, ok: e.results.length - failed.length, failed: failed.length, codes })
+      } else if (e.action === 'purge' && e.batchId) {
+        purged.add(e.batchId)
       }
     } catch { /* ignore */ }
   }
   return batches.reverse().map(batch => {
     const items = batch.items.map(item => ({
       from: item.from, to: item.to, identity: item.identity, restored: item.restored,
+      restoredAt: item.restoredAt, deleted: item.deleted === true, deletedAt: item.deletedAt,
       // 记录「清理时报告里的大小/分类」，供历史页统计与复清分析；旧日志没有这两个字段。
       kb: Number.isFinite(item.kb) ? item.kb : null,
       category: typeof item.category === 'string' ? item.category : null,
@@ -277,6 +364,7 @@ function scanSummary() {
     stage: scanState.stage,
     elapsed,
     error: scanState.error,
+    errorCode: scanState.errorCode,
     canceled: scanState.canceled,
     full: scanState.full,
     at: lastReportAt,
@@ -290,12 +378,14 @@ function startScan(full) {
   const file = path.join(dir, 'report.json')
   Object.assign(scanState, {
     status: 'running', progress: 0, stage: '准备扫描', startedAt: Date.now(), finishedAt: 0,
-    error: '', full: !!full, canceled: false,
+    error: '', errorCode: '', full: !!full, canceled: false,
   })
   const argv = []
   if (!full) argv.push('--quick')
   argv.push('--json', file)
+  scanController = new AbortController()
   runScanner(argv, 300000, {
+    signal: scanController.signal,
     onProgress: (pct, label) => {
       scanState.progress = pct
       scanState.stage = label
@@ -309,6 +399,8 @@ function startScan(full) {
     }
     if (res.code !== 0) {
       scanState.status = 'error'
+      // macOS 扫描器约定 exit 2 表示完全磁盘访问未授权。
+      if (process.platform === 'darwin' && res.code === 2) scanState.errorCode = 'full_disk_access_required'
       scanState.error = (res.out || res.err || `exit ${res.code}`).trim().slice(0, 500)
       scanState.finishedAt = Date.now()
       return
@@ -332,7 +424,8 @@ function startScan(full) {
     })
   }).catch((err) => {
     scanState.status = scanState.canceled ? 'canceled' : 'error'
-    scanState.error = String(err && err.message ? err.message : err)
+    if (scanState.canceled) scanState.stage = '已取消'
+    else Object.assign(scanState, scannerError(err))
     scanState.finishedAt = Date.now()
   }).finally(() => {
     try { fs.rmSync(dir, { recursive: true, force: true }) } catch { /* ignore */ }
@@ -341,9 +434,9 @@ function startScan(full) {
 }
 
 const photosState = {
-  status: 'idle', progress: 0, stage: '', startedAt: 0, finishedAt: 0, error: '', result: null,
+  status: 'idle', progress: 0, stage: '', startedAt: 0, finishedAt: 0, error: '', errorCode: '', result: null,
 }
-let photoChild = null
+let photoController = null
 let photoAllowed = new Set()
 let photoAt = 0
 
@@ -355,6 +448,7 @@ function photosSummary() {
     stage: photosState.stage,
     elapsed: photosState.startedAt ? Math.round((end - photosState.startedAt) / 1000) : 0,
     error: photosState.error,
+    errorCode: photosState.errorCode,
     at: photoAt,
     hasResult: !!photosState.result,
   }
@@ -365,12 +459,16 @@ function startPhotoScan() {
   if (scanState.status === 'running') return false
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'deepclean-photos-'))
   const file = path.join(dir, 'photos.json')
-  Object.assign(photosState, { status: 'running', progress: 0, stage: '准备', startedAt: Date.now(), finishedAt: 0, error: '', result: null })
+  Object.assign(photosState, { status: 'running', progress: 0, stage: '准备', startedAt: Date.now(), finishedAt: 0, error: '', errorCode: '', result: null })
+  photoController = new AbortController()
+  const { signal } = photoController
   runScanner(['--json', file], 600000, {
-    onProgress: (pct, label) => { photosState.progress = pct; photosState.stage = label },
-    trackChild: (child) => { photoChild = child },
+    signal,
+    onProgress: (pct, label) => {
+      if (!signal.aborted) { photosState.progress = pct; photosState.stage = label }
+    },
   }, 'photos.py').then((res) => {
-    if (photosState.status !== 'running') return
+    if (signal.aborted) return
     if (res.code !== 0) {
       photosState.status = 'error'
       photosState.error = (res.out || res.err || `exit ${res.code}`).trim().slice(0, 500)
@@ -387,8 +485,9 @@ function startPhotoScan() {
     photoAllowed = new Set()
     for (const g of result.groups || []) for (const it of g.items || []) if (!isCloudBackedPath(it.path)) photoAllowed.add(it.path)
   }).catch((err) => {
-    photosState.status = photosState.status === 'running' ? 'error' : photosState.status
-    photosState.error = String(err && err.message ? err.message : err)
+    if (signal.aborted) return
+    photosState.status = 'error'
+    Object.assign(photosState, scannerError(err))
     photosState.finishedAt = Date.now()
   }).finally(() => {
     try { fs.rmSync(dir, { recursive: true, force: true }) } catch { /* ignore */ }
@@ -747,7 +846,11 @@ function estimateReclaim(paths) {
 function withinHome(p) {
   const home = path.resolve(process.env.HOME || os.homedir())
   const resolved = path.resolve(p)
-  return resolved === home || resolved.startsWith(home + path.sep)
+  if (process.platform !== 'win32') return resolved === home || resolved.startsWith(home + path.sep)
+  // Windows paths are case-insensitive; keep this consistent with isProtected.
+  const lhs = resolved.toLowerCase()
+  const rhs = home.toLowerCase()
+  return lhs === rhs || lhs.startsWith(rhs + path.sep)
 }
 
 function runShell(cmd, args, timeoutMs = 120000, input = null) {
@@ -826,18 +929,23 @@ function listVolumes() {
   return out.filter((v) => (seen.has(v.path) ? false : (seen.add(v.path), true)))
 }
 
-const treeCache = new Map()
+// 导出仅供测试断言播种顺序/字段传播/上限；生产代码只在本文件内使用。
+export const treeCache = new Map()
 const TREE_TTL_MS = 60 * 1000
-const TREE_CACHE_MAX = 500
+// One walk can seed up to MAX_DIRS (500) levels plus the target itself. Keep the
+// cap above that so seeding never evicts the target it just walked.
+const TREE_CACHE_MAX = 2000
 
 // tree.py walks the subtree once and returns a `dirs` map of per-directory
 // listings; seeding every level at once makes drill-down cache hits instead
 // of re-walking the subtree on each click.
-function seedTreeCache(target, data) {
+export function seedTreeCache(target, data) {
   const at = Date.now()
   const dirs = data.dirs && typeof data.dirs === 'object' ? data.dirs : {}
   delete data.dirs
-  treeCache.set(target, { at, data })
+  // Seed the children first and the target last: if the target were inserted
+  // first, a walk that seeds MAX_DIRS levels would push it past the cap and
+  // evict it, so every home visit re-walked the whole subtree.
   for (const [p, d] of Object.entries(dirs)) {
     treeCache.set(path.resolve(p), {
       at,
@@ -848,26 +956,72 @@ function seedTreeCache(target, data) {
         metric: data.metric,
         unavailable: d.unavailable || 0,
         skipped: d.skipped || 0,
+        skippedCloud: d.skippedCloud || 0,
+        cloudFiles: d.cloudFiles || 0,
+        sharedFiles: d.sharedFiles || 0,
+        sharedDupKb: d.sharedDupKb || 0,
+        bigFilesCap: d.bigFilesCap || 0,
         bigFiles: Array.isArray(d.bigFiles) ? d.bigFiles : [],
       },
     })
   }
+  treeCache.delete(target)
+  treeCache.set(target, { at, data })
+  // The target's size changed: refresh the cached parent rows too, otherwise
+  // going back up after a refresh shows the old size for up to TREE_TTL_MS.
+  const totalKb = (data.children || []).reduce((n, c) => n + (Number(c.kb) || 0), 0)
+  let parent = path.dirname(target)
+  for (let depth = 0; depth < 64; depth++) {
+    const entry = treeCache.get(parent)
+    if (!entry) break
+    const row = (entry.data.children || []).find((c) => path.resolve(c.path) === target)
+    if (row) row.kb = totalKb
+    const up = path.dirname(parent)
+    if (up === parent) break
+    parent = up
+  }
   while (treeCache.size > TREE_CACHE_MAX) treeCache.delete(treeCache.keys().next().value)
 }
 
-async function listChildren(dirPath, refresh = false) {
+async function listChildren(dirPath, refresh = false, signal) {
   const home = process.env.HOME || os.homedir()
   const target = dirPath ? path.resolve(dirPath) : path.resolve(home)
-  if (!withinHome(target)) throw new Error('只允许浏览个人文件夹')
-  const realHome = fs.realpathSync(process.env.HOME || os.homedir())
-  const relative = path.relative(realHome, fs.realpathSync(target))
-  if (fs.lstatSync(target).isSymbolicLink() || relative === '..' || relative.startsWith('..' + path.sep) || path.isAbsolute(relative)) throw new Error('符号链接或个人文件夹之外的路径不可浏览')
+  if (!withinHome(target)) throw Object.assign(new Error('只允许浏览个人文件夹'), { code: 'tree_outside' })
+  let realHome
+  let realTarget
+  try {
+    realHome = fs.realpathSync(process.env.HOME || os.homedir())
+    realTarget = fs.realpathSync(target)
+  } catch (err) {
+    const missing = err && err.code === 'ENOENT'
+    throw Object.assign(new Error(missing ? '目录不存在或已被删除' : '目录不可读，请检查权限'), { code: missing ? 'tree_missing' : 'tree_denied' })
+  }
+  const relative = path.relative(realHome, realTarget)
+  let lst
+  try { lst = fs.lstatSync(target) } catch (err) {
+    const missing = err && err.code === 'ENOENT'
+    throw Object.assign(new Error(missing ? '目录不存在或已被删除' : '目录不可读，请检查权限'), { code: missing ? 'tree_missing' : 'tree_denied' })
+  }
+  if (lst.isSymbolicLink() || relative === '..' || relative.startsWith('..' + path.sep) || path.isAbsolute(relative)) throw Object.assign(new Error('链接或个人文件夹之外的路径不可浏览'), { code: 'tree_symlink' })
   const cached = treeCache.get(target)
-  if (!refresh && cached && Date.now() - cached.at < TREE_TTL_MS) return cached.data
+  if (!refresh && cached && Date.now() - cached.at < TREE_TTL_MS) {
+    // LRU: refresh recency so a frequently used directory is not the oldest.
+    treeCache.delete(target)
+    treeCache.set(target, cached)
+    return cached.data
+  }
   // The independent read-only helper includes hidden entries and reports partial totals.
   // It has its own child handle so browsing never cancels an audit or photo scan.
-  const res = await runScanner([target], 120000, { trackChild() {}, env: { DEEPCLEAN_CLOUD_ROOTS: JSON.stringify(cloudRoots()) } }, 'tree.py')
-  if (res.code !== 0) throw new Error('目录统计失败或无权读取，请检查权限后重试')
+  let res
+  try {
+    res = await runScanner([target], 120000, { env: { DEEPCLEAN_CLOUD_ROOTS: JSON.stringify(cloudRoots()) }, signal }, 'tree.py')
+  } catch (err) {
+    if (signal?.aborted) throw Object.assign(new Error('已停止加载'), { code: 'aborted' })
+    if (/扫描超时/.test(String(err && err.message))) throw Object.assign(new Error('目录统计超时'), { code: 'tree_timeout' })
+    throw err
+  }
+  if (signal?.aborted) throw Object.assign(new Error('已停止加载'), { code: 'aborted' })
+  if (res.code !== 0) throw Object.assign(new Error('目录统计失败或无权读取，请检查权限后重试'), { code: 'tree_failed' })
   const data = JSON.parse(res.out)
   seedTreeCache(target, data)
   return data
@@ -881,6 +1035,16 @@ function sendJson(res, status, body) {
   res.end(JSON.stringify(body))
 }
 
+function scannerError(err) {
+  const error = String(err && err.message ? err.message : err)
+  const code = err && err.code
+  // 只透传可预期的稳定错误码，客户端才能本地化；其他原始 fs 错误不暴露。
+  if (typeof code === 'string' && (code === 'python_unavailable' || code === 'aborted' || code.startsWith('tree_'))) {
+    return { error, errorCode: code }
+  }
+  return { error }
+}
+
 function readBody(req, limit = 1024 * 1024) {
   return new Promise((resolve, reject) => {
     let size = 0
@@ -1498,7 +1662,7 @@ export function apply(ctx) {
         // 结构化状态由退出码决定（扫描器约定 exit 2 = 未授权），不解析文案。
         sendJson(res, 200, { code: result.code, status: result.code === 2 ? 'denied' : 'ok', text: (result.out || result.err).trim() })
       } catch (err) {
-        sendJson(res, 500, { error: String(err && err.message ? err.message : err) })
+        sendJson(res, 500, scannerError(err))
       }
     })
 
@@ -1509,7 +1673,8 @@ export function apply(ctx) {
         if (req.method !== 'POST') return sendJson(res, 405, { error: '只支持 POST' })
         if (process.platform !== 'darwin') return sendJson(res, 400, { error: '仅 macOS 支持' })
         if (process.env.DEEPCLEAN_NO_OPEN !== '1') {
-          await runShell('open', ['x-apple.systempreferences:com.apple.preference.security?Privacy_AllFiles'], 15000)
+          const result = await runShell('open', ['x-apple.systempreferences:com.apple.preference.security?Privacy_AllFiles'], 15000)
+          if (result.code !== 0) return sendJson(res, 400, { error: '无法打开系统设置' })
         }
         sendJson(res, 200, { ok: true })
       } catch (err) {
@@ -1555,7 +1720,7 @@ export function apply(ctx) {
       try {
         if (scanState.status !== 'running') return sendJson(res, 409, { error: '当前没有进行中的扫描' })
         scanState.canceled = true
-        if (activeChild) killTree(activeChild)
+        scanController?.abort()
         sendJson(res, 200, { ok: true, scan: scanSummary() })
       } catch (err) {
         sendJson(res, 400, { error: String(err && err.message ? err.message : err) })
@@ -1584,13 +1749,22 @@ export function apply(ctx) {
     })
 
     route('/dsh-deepclean/api/tree', async (req, res) => {
+      if (req.method !== 'GET') return sendJson(res, 405, { error: '只支持 GET' })
+      // 客户端点「停止加载」会断开请求：把 close 映射成 AbortSignal，杀掉 tree.py，
+      // 避免被放弃的遍历继续跑到 120s 超时。
+      const controller = new AbortController()
+      const onClose = () => { if (!res.writableEnded) controller.abort() }
+      if (typeof res.on === 'function') res.on('close', onClose)
       try {
         const url = new URL(req.url, 'http://dsh.local')
         const target = url.searchParams.get('path') || ''
-        const body = await listChildren(target, url.searchParams.get('refresh') === '1')
-        sendJson(res, 200, body)
+        const body = await listChildren(target, url.searchParams.get('refresh') === '1', controller.signal)
+        if (!controller.signal.aborted && res.writableEnded !== true) sendJson(res, 200, body)
       } catch (err) {
-        sendJson(res, 400, { error: String(err && err.message ? err.message : err) })
+        // 已断开/已取消的请求不再写响应，避免向关闭的流 end()。
+        if (!controller.signal.aborted && err?.code !== 'aborted') sendJson(res, 400, scannerError(err))
+      } finally {
+        if (typeof res.off === 'function') res.off('close', onClose)
       }
     })
 
@@ -1648,7 +1822,7 @@ export function apply(ctx) {
       photosState.status = 'canceled'
       photosState.stage = '已取消'
       photosState.finishedAt = Date.now()
-      if (photoChild) killTree(photoChild)
+      photoController?.abort()
       sendJson(res, 200, { ok: true })
     })
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepclean-mydisk",
-  "version": "0.12.1",
+  "version": "0.13.0",
   "description": "Read-only disk audit and cleanup for macOS and Windows: caches, leftovers, similar photos, space breakdown, and cross-disk file moves.",
   "author": "huangxiaoliang",
   "keywords": [