dsh-agy-link 0.4.80 → 0.4.82

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.4.82 (2026-10-29)
+
+### English
+
+- **Fix(sessions): don't mis-purge live bindings whose session key contains `:`.**
+  - `cleanupStaleAccounts()` split the binding key on the FIRST `:`. A DSH session id can itself be composite and contain `:` (as several plugins produce), so `ns:sess:acc_valid` parsed its "account id" as `sess:acc_valid`, which is never in the valid set — the cleanup then **deleted a live binding**. It now splits on the LAST `:` and only treats the suffix as an account id when it matches the pool shape `acc_<...>`, so colon-containing session keys are never mistaken for accounts. Adds a regression test.
+
+### 中文
+
+- **修复(sessions)：不再误删会话键本身含 `:` 的有效绑定。**
+  - `cleanupStaleAccounts()` 之前按**第一个** `:` 切分绑定键。DSH 的会话 id 有可能本身是含 `:` 的复合键（部分插件如此），于是 `ns:sess:acc_valid` 被解析出的「账号 id」为 `sess:acc_valid`，永远不在有效集合里——清理逻辑因此**删掉了一个有效绑定**。现在改为按**最后一个** `:` 切分，且仅当后缀符合账号池形态 `acc_<...>` 时才当作账号 id，含 `:` 的会话键不会被误判为账号。补充回归测试。
+
+**Full Changelog**: https://github.com/amlyczz/dsh-agy-link/compare/v0.4.81...v0.4.82
+
+## 0.4.81 (2026-10-29)
+
+### English
+
+- **Fix(parser): bound a runaway un-newline-terminated stdout buffer.**
+  - `StreamJsonParser.feed()` only split on `\n`, so a malformed/runaway stream that produced megabytes with no newline (or one giant partial line) grew the internal buffer without bound. A partial line over `MAX_STREAM_LINE_BYTES` (8 MiB) is now dropped and surfaced as a `garbage` event, keeping memory bounded; well-formed newline-delimited events are unaffected. Adds a regression test.
+
+### 中文
+
+- **修复(parser)：限制无换行结尾的超大 stdout 缓冲。**
+  - `StreamJsonParser.feed()` 只按 `\n` 切分，若输出异常/失控产生数 MB 且不含换行（或一整条超长未完成的行），内部缓冲会无界增长。现在超过 `MAX_STREAM_LINE_BYTES`（8 MiB）的未完成行会被丢弃并以 `garbage` 事件上报，内存保持有界；正常的按行 NDJSON 事件不受影响。补充回归测试。
+
+**Full Changelog**: https://github.com/amlyczz/dsh-agy-link/compare/v0.4.80...v0.4.81
+
 ## 0.4.80 (2026-10-29)
 
 ### English

package/dist/index.js

@@ -2728,6 +2728,16 @@ var StreamJsonParser = class {
 			const ev = this.takeLine(line);
 			if (ev) out.push(ev);
 		}
+		if (this.buffer.length > 8388608) {
+			const dropped = this.buffer.length;
+			this.buffer = "";
+			this.stats.garbage++;
+			this.stats.consecutiveGarbage++;
+			out.push({
+				kind: "garbage",
+				line: "<dropped over-long line: " + dropped + " bytes>"
+			});
+		}
 		return out;
 	}
 	/** Flush a trailing line without a newline (agy killed mid-write). */
@@ -29493,10 +29503,10 @@ var SessionStore = class {
 	cleanupStaleAccounts(validAccountIds) {
 		let changed = false;
 		for (const key of Object.keys(this.data)) {
-			const colon = key.indexOf(":");
+			const colon = key.lastIndexOf(":");
 			if (colon >= 0) {
 				const accId = key.slice(colon + 1);
-				if (accId && !validAccountIds.has(accId)) {
+				if (/^acc_[A-Za-z0-9_]+$/.test(accId) && !validAccountIds.has(accId)) {
 					delete this.data[key];
 					this.dirty.delete(key);
 					this.removed.add(key);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-agy-link",
-  "version": "0.4.80",
+  "version": "0.4.82",
   "description": "Google Antigravity (agy CLI) models for DeepSeek Harness — stream Gemini/Claude/GPT-OSS subscriptions into DSH with thinking, tool activity, token usage and in-GUI Google OAuth login.",
   "type": "module",
   "license": "MIT",