dsh-any-agent 0.3.5 → 0.3.7

package/CHANGELOG.md

@@ -7,8 +7,62 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+Post-0.3.7 hardening.
+
+## [0.3.7] — 2026-11-02
+
+### Fixed
+
+- **Session-header lookup no longer blocks the event loop.** `Hub.get()`,
+  `Hub.load()` and `pruneStaleTombstones()` now use a streaming
+  `readHeaderAsync()` that stops at the first newline, with a 5 s timeout and
+  1 MiB header cap. Large session logs can no longer stall MCP requests,
+  heartbeat renewal, or approval handling while recovering an unknown
+  conversation. The synchronous reader remains only in the explicit
+  workspace CLI/test-cleanup path.
+- **Website robots policy mirrors Cloudflare Managed content.** The generated
+  `robots.txt` now states `Content-Signal: search=yes, ai-train=no` and
+  disallows GPTBot/ClaudeBot/Google-Extended/CCBot, so non-Cloudflare hosts
+  and the repository agree with the production policy.
+- Website tests now cover the English locale, robots policy, hreflang, CSP
+  hash, and bilingual pages (20 tests).
+
+## [0.3.6] — 2026-11-02
+
 Post-0.3.5 hardening (remaining completeness-audit items).
 
+### Fixed
+
+- `dsh_status` now reports `lock_holder_reason` and no longer calls `none`
+  "your GUI" when the conversation is simply idle/released; the GUI hint is
+  only shown after an actual lock conflict.
+- `dsh_get` reports `title_source` (`native` / `title_hint` / `null`) and no
+  longer labels a `title_hint` fallback as "DSH generated".
+- `dsh_read` caps a single output entry at 200k characters (keeps the tail)
+  so one runaway tool output cannot grow the in-memory buffer without bound.
+- `dsh_list` exposes `probe_ok` / `probe_error` / `probe_cached`; a failed
+  on-disk probe is no longer indistinguishable from "no sessions".
+- MCP clients that send `notifications/roots/list_changed` now invalidate the
+  cached project directory and re-request `roots/list`.
+- Client config backups rotate (default 20 per file, `DSH_MCP_BACKUP_KEEP`);
+  `dsh-any-agent-restore` writes atomically and preserves the target mode.
+- The shared `workspace.json` writer keeps a `<file>.bak-dsh` last-known-good
+  copy before replacing it.
+- `dsh_takeover` now compares the child's OS start time with the registration
+  before sending SIGKILL; a mismatched PID (reuse) is refused.
+- Website: full English page at `/en/`, hreflang alternates, bilingual sitemap,
+  JSON-LD, Cloudflare Insights domains in CSP, and a pre-paint theme script
+  (CSP sha256) so light-system users no longer see a dark flash.
+
+### Known residual items
+
+- Cloudflare Managed robots.txt / Content Signals are dashboard-managed; the
+  repository documents the split instead of trying to override them.
+- Session-log header decompression is still synchronous; it is bounded by the
+  fact that only the header is parsed, but a very large log can still block
+  the event loop briefly. A fully async reader needs a broader refactor of
+  `Hub.get`/`findSessionHeader`.
+
 ## [0.3.5] — 2026-11-02
 
 Completeness-audit follow-up. Data-safety and privilege boundaries first,
@@ -616,7 +670,9 @@ First public release, published to npm as [`dsh-any-agent`](https://www.npmjs.co
   profiles, sessions and client configs. The product name changed; the on-disk
   contract did not. See the README FAQ.
 
-[Unreleased]: https://github.com/xmtlzzz/dsh-any-agent/compare/v0.3.5...HEAD
+[Unreleased]: https://github.com/xmtlzzz/dsh-any-agent/compare/v0.3.7...HEAD
+[0.3.7]: https://github.com/xmtlzzz/dsh-any-agent/compare/v0.3.6...v0.3.7
+[0.3.6]: https://github.com/xmtlzzz/dsh-any-agent/compare/v0.3.5...v0.3.6
 [0.3.5]: https://github.com/xmtlzzz/dsh-any-agent/compare/v0.3.4...v0.3.5
 [0.3.4]: https://github.com/xmtlzzz/dsh-any-agent/compare/v0.3.3...v0.3.4
 [0.3.3]: https://github.com/xmtlzzz/dsh-any-agent/compare/v0.3.2...v0.3.3

package/DESIGN.md

@@ -2,7 +2,7 @@
 
 > 目标：做一个 MCP Server，让 **Codex / Claude Code** 能调用 **DeepSeek Harness (DSH)** 当"外包工程师"——写代码、搭脚手架、跑任务，并且 DSH 自己还能挂它自己的 MCP。
 >
-> 本文只谈**功能与接口**，不写实现代码；其中 M2/M3 工具（`dsh_rename` 等）是分期计划，不是当前 0.3.5 的缺失功能。技术判断最初基于 DSH 0.1.7-rc.2，当前验证基线是 **DSH 0.2.1-rc.5**（见 §2 证据）。
+> 本文只谈**功能与接口**，不写实现代码；其中 M2/M3 工具（`dsh_rename` 等）是分期计划，不是当前 0.3.7 的缺失功能。技术判断最初基于 DSH 0.1.7-rc.2，当前验证基线是 **DSH 0.2.1-rc.5**（见 §2 证据）。
 
 ---
 

package/README.md

@@ -15,7 +15,7 @@
 
 </div>
 
-🧪 815 checks green on 0.3.5 on this machine (851 when all nine client fixtures exist); 519 of them are in the client-registration suites (555 with all fixtures) · 🔌 MCP over stdio · 📦 Zero dependencies · 📜 MIT
+🧪 815 checks green on 0.3.7 on this machine (851 when all nine client fixtures exist); 519 of them are in the client-registration suites (555 with all fixtures) · 🔌 MCP over stdio · 📦 Zero dependencies · 📜 MIT
 
 An MCP server that drives DeepSeek Harness as a **long-lived coding agent**. Hand it a goal, let it write code and run scripts, steer it mid-flight, and collect the result when you are ready.
 
@@ -541,6 +541,7 @@ Silent by default — **not one byte is written**.
 | `DSH_MCP_PROMPT_TIMEOUT_MS` | `0` (no timeout) | Wait bound for **`wait=true` only**; on expiry the turn merely moves to the background |
 | `DSH_MCP_REGISTER_WORKSPACE` | `project` | `project` / `all` / `0` |
 | `DSH_MCP_GIT_STATUS` | on | `0` disables the per-turn `git status` summary. Useful for untrusted repos (git can run repo-configured fsmonitor/filters outside DSH's sandbox) |
+| `DSH_MCP_BACKUP_KEEP` | `20` | How many `.bak-dsh-*` copies to keep per client config (rotation is best-effort) |
 | `DSH_MCP_REQUEST_TIMEOUT_MS` | `60000` | Per-request timeout on the ACP channel (initialize, session/new, …) |
 | `DSH_MCP_REAP_INTERVAL_MS` | `30000` | How often the idle reaper checks for conversations to reclaim. Values below the safe floor fall back to the default |
 | `DSH_MCP_LOG` | `silent` | `silent` / `info` / `debug` |
@@ -594,11 +595,11 @@ The suite **cleans up after itself**: `run.mjs` always ends with `cleanup.mjs`,
 | `list` | 13 | **the cost of `dsh_list`** (measured): a default call with the on-disk probe takes ~1 s (it spawns a DSH process) while **repeated calls hit a cache and drop to single-digit milliseconds**; `only_running=true` and `include_closed=false` **skip the probe** with equivalent semantics (unopened on-disk sessions are simply excluded) |
 | `reasoning-check` | 8 | **reasoning visibility**: `reasoning=hide` returns no thinking body but non-zero stats; `reasoning=full` returns the text and the rendered section |
 
-**`node test/run.mjs` runs 815 checks on a machine with five client fixtures (851 with all nine)** — smoke 29 + 786 offline checks (822 with nine). Every suite exited 0 on 0.3.5; none needs a provider (smoke needs a DSH install for its session-creation section).
+**`node test/run.mjs` runs 815 checks on a machine with five client fixtures (851 with all nine)** — smoke 29 + 786 offline checks (822 with nine). Every suite exited 0 on 0.3.7; none needs a provider (smoke needs a DSH install for its session-creation section).
 
 That is **519 assertions in the client-registration suites alone** (`setup` 41, `removal-scope` 24, `config-safety` 406, `real-configs` 48; 555 with all nine fixtures), which is where the 0.3 work actually is.
 
-The model-backed suites (`smoke` 29, `boundary` 46, `integration` 30, `async` 16, `sentinel` 36, `timeout` 38, `lock` 79, `cycle` 36, `concurrency` 31, `capability` 22, `workspace-effect` 24, `acceptance` 36, `multi` 19, `permission` 11, `list` 13, `reasoning-check` 8) total 474 and were last measured in full on 0.3.5 — they need a working provider, so re-run them yourself before trusting a release: `node test/run.mjs --all`. `acceptance` now **skips explicitly** when the DSH profile has no IDA MCP (`mcp__ida__*`).
+The model-backed suites (`smoke` 29, `boundary` 46, `integration` 30, `async` 16, `sentinel` 36, `timeout` 38, `lock` 79, `cycle` 36, `concurrency` 31, `capability` 22, `workspace-effect` 24, `acceptance` 36, `multi` 19, `permission` 11, `list` 13, `reasoning-check` 8) total 474 and were last measured in full on 0.3.7 — they need a working provider, so re-run them yourself before trusting a release: `node test/run.mjs --all`. `acceptance` now **skips explicitly** when the DSH profile has no IDA MCP (`mcp__ida__*`).
 
 > Three different totals are intentional: `node test/run.mjs` (815/851), the CI offline job (786/822, no smoke), and the model-backed set (474 nominal). Counts are the numbers each suite prints itself; don't use one number for a different runner.
 

package/README.zh.md

@@ -15,7 +15,7 @@
 
 </div>
 
-🧪 0.3.5 本机 815 项检查全绿（九种客户端配置齐全时 851 项；其中 519 项属于客户端注册器套件，齐全时 555 项） · 🔌 MCP over stdio · 📦 零依赖 · 📜 MIT
+🧪 0.3.7 本机 815 项检查全绿（九种客户端配置齐全时 851 项；其中 519 项属于客户端注册器套件，齐全时 555 项） · 🔌 MCP over stdio · 📦 零依赖 · 📜 MIT
 
 一个 MCP 服务端，把 DeepSeek Harness 当作**长驻的编码 agent** 来驱动。开个会话、扔个目标，它自己写代码、跑脚本、派子代理；你随时能看、能插话、能回头验收。
 
@@ -556,6 +556,7 @@ node bin/dsh-any-agent-workspaces.mjs --purge-test-sessions   # 删测试会话
 | `DSH_MCP_PROMPT_TIMEOUT_MS` | `0`（不设超时） | **仅 `wait=true` 时**的等待上限；到期只转后台，不取消回合 |
 | `DSH_MCP_REGISTER_WORKSPACE` | `project` | `project` / `all` / `0` |
 | `DSH_MCP_GIT_STATUS` | 开 | `0` 关闭每回合的 `git status` 摘要。分析不可信仓库时建议关掉（git 可能触发仓库配置的 fsmonitor/filter，且发生在 DSH 沙箱之外） |
+| `DSH_MCP_BACKUP_KEEP` | `20` | 每个客户端配置最多保留多少份 `.bak-dsh-*`（尽力轮转） |
 | `DSH_MCP_REQUEST_TIMEOUT_MS` | `60000` | ACP 通道单请求超时（initialize、session/new 等） |
 | `DSH_MCP_REAP_INTERVAL_MS` | `30000` | 空闲回收器多久检查一次。低于安全下限的值会回落到默认值 |
 | `DSH_MCP_LOG` | `silent` | `silent` / `info` / `debug` |
@@ -609,11 +610,11 @@ node test/cleanup.mjs      # 单独跑收尾清理（只清测试自己造的目
 | `list` | 13 | **`dsh_list` 的开销**（实测驱动）：含磁盘探测的默认调用约 1 秒（要 spawn 一个 DSH 进程），**连续调用命中缓存降到个位数毫秒**；`only_running=true` 与 `include_closed=false` **跳过探测**且语义等价（不把磁盘上的未打开会话算进来） |
 | `reasoning-check` | 8 | **思考可见性**：`reasoning=hide` 不返回思考正文但统计非零；`reasoning=full` 返回正文且渲染出思考段 |
 
-**`node test/run.mjs` 在本机 5/9 客户端配置时跑 815 项（九种齐全时 851 项）** —— smoke 29 + 离线套件 786 项（九种齐全时 822 项）。0.3.5 上全部退出码 0；都不需要 provider（smoke 的建会话段需要装 DSH）。
+**`node test/run.mjs` 在本机 5/9 客户端配置时跑 815 项（九种齐全时 851 项）** —— smoke 29 + 离线套件 786 项（九种齐全时 822 项）。0.3.7 上全部退出码 0；都不需要 provider（smoke 的建会话段需要装 DSH）。
 
 其中 **519 项属于客户端注册器套件**（`setup` 41、`removal-scope` 24、`config-safety` 406、`real-configs` 48；九种齐全时 555 项）—— 0.3 的活其实都在这里。
 
-需要模型的套件（`smoke` 29、`boundary` 46、`integration` 30、`async` 16、`sentinel` 36、`timeout` 38、`lock` 79、`cycle` 36、`concurrency` 31、`capability` 22、`workspace-effect` 24、`acceptance` 36、`multi` 19、`permission` 11、`list` 13、`reasoning-check` 8）合计 474 项，**最近一次完整实测在 0.3.5** —— 它们要可用 provider，发版前请自己重跑一遍：`node test/run.mjs --all`。`acceptance` 在没有 IDA MCP（`mcp__ida__*`）时会明确 **skip**。
+需要模型的套件（`smoke` 29、`boundary` 46、`integration` 30、`async` 16、`sentinel` 36、`timeout` 38、`lock` 79、`cycle` 36、`concurrency` 31、`capability` 22、`workspace-effect` 24、`acceptance` 36、`multi` 19、`permission` 11、`list` 13、`reasoning-check` 8）合计 474 项，**最近一次完整实测在 0.3.7** —— 它们要可用 provider，发版前请自己重跑一遍：`node test/run.mjs --all`。`acceptance` 在没有 IDA MCP（`mcp__ida__*`）时会明确 **skip**。
 
 > 三个总数是刻意分开的：`node test/run.mjs`（815/851）、CI 离线 job（786/822，不含 smoke）、需要模型的集合（名义 474）。数字取各套件自己打印的汇总，不在这里手抄；不要把一个数字套到另一个 runner 上。
 

package/bin/dsh-any-agent.mjs

@@ -59,7 +59,7 @@ const { createHandlers } = await import('../src/tools.mjs');
 const log = createLogger();
 
 const hub = new Hub({ log });
-hub.load();
+await hub.load();
 hub.startReaper();
 // 启动时清一次过期哨兵（哨兵内含正文，长期不清理会无声堆积）
 const prunedSentinels = hub.pruneSentinels();

package/bin/restore.mjs

@@ -16,10 +16,10 @@
  * （后缀 .bak-dsh-pre-restore-<stamp>），退错了还能再退回来。
  */
 
-import { copyFileSync, existsSync, readdirSync, statSync } from 'node:fs';
+import { chmodSync, existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import { basename, dirname, join } from 'node:path';
 
-import { backupFile, clientList, resolveDirs, ENTRY_NAME } from '../src/clients.mjs';
+import { atomicWrite, backupFile, clientList, resolveDirs, ENTRY_NAME } from '../src/clients.mjs';
 
 const argv = process.argv.slice(2);
 const has = (f) => argv.includes(f);
@@ -127,7 +127,11 @@ for (const b of chosen) {
     try {
       // 还原也是破坏性操作：先把「现在」也存一份。
       if (existsSync(b.target)) row.safety = backupFile(b.target, 'pre-restore-' + stamp);
-      copyFileSync(b.file, b.target);
+      // tmp + rename：崩溃时不会留下半截配置；还原后保留原文件的权限位。
+      let mode = null;
+      try { mode = statSync(b.target).mode; } catch {}
+      atomicWrite(b.target, readFileSync(b.file, 'utf8'));
+      if (mode !== null) { try { chmodSync(b.target, mode); } catch {} }
     } catch (e) {
       row.action = 'failed';
       row.error = e.message;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-any-agent",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "description": "Drive DeepSeek Harness (DSH) as a long-lived coding agent from any MCP client — Claude Code, Claude Desktop, Codex, Cursor, Windsurf, Zed, Gemini CLI, opencode, VS Code. Resume-aware, interruptible, approval-capable, and it only ever touches the one config entry it owns.",
   "type": "module",
   "license": "MIT",

package/src/clients.mjs

@@ -25,13 +25,14 @@ import {
   existsSync,
   mkdirSync,
   readFileSync,
+  readdirSync,
   renameSync,
   statSync,
   unlinkSync,
   writeFileSync,
 } from 'node:fs';
 import { platform } from 'node:os';
-import { dirname } from 'node:path';
+import { basename, dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 /** 写进每个客户端的条目名。同时也是 --remove 唯一的识别依据。 */
@@ -57,9 +58,31 @@ export function backupFile(file, stamp) {
   let dst = base;
   for (let i = 2; existsSync(dst); i++) dst = base + '-' + i;
   copyFileSync(file, dst);
+  pruneBackups(file);
   return dst;
 }
 
+/**
+ * 备份轮转：同一目标只保留最近 N 份（默认 20，DSH_MCP_BACKUP_KEEP 可调）。
+ * 备份里可能有凭据，无限累积既占空间也扩大暴露面；保留最近若干份足够回滚。
+ */
+export function pruneBackups(file) {
+  const raw = Number(process.env.DSH_MCP_BACKUP_KEEP ?? 20);
+  const keep = Number.isFinite(raw) && raw > 0 ? Math.floor(raw) : 20;
+  try {
+    const dir = dirname(file);
+    const prefix = basename(file) + '.bak-dsh-';
+    const backups = readdirSync(dir)
+      .filter((name) => name.startsWith(prefix))
+      .sort();
+    for (const name of backups.slice(0, Math.max(0, backups.length - keep))) {
+      try { unlinkSync(join(dir, name)); } catch {}
+    }
+  } catch {
+    /* 轮转失败不影响本次备份 */
+  }
+}
+
 /**
  * 先写临时文件再改名，避免崩溃时留下半截配置。
  * 临时名带 pid + 随机后缀：同名会在并发运行时互相覆盖。
@@ -585,7 +608,7 @@ export function describeEntry(shape, entry) {
 
 import { spawnSync } from 'node:child_process';
 import { homedir } from 'node:os';
-import { join, resolve } from 'node:path';
+import { resolve } from 'node:path';
 
 /** 解析出本次要用的 home 与 appdata（--home / 环境变量 / 平台默认）。 */
 export function resolveDirs(homeOverride) {

package/src/hub.mjs

@@ -134,14 +134,15 @@ function isForgotten(id) {
  * 留着只会让测试/临时会话在 `$DSH_HOME/.dsh-any-agent-forgotten` 里堆积。
  * 会话文件还在的墓碑必须保留 —— 那正是 forget 的效力所在。
  */
-function pruneStaleTombstones() {
+async function pruneStaleTombstones() {
   let removed = 0;
   try {
     if (!existsSync(FORGOTTEN_DIR)) return 0;
     for (const f of readdirSync(FORGOTTEN_DIR)) {
       if (!f.endsWith('.json')) continue;
       const id = f.slice(0, -5);
-      if (findSessionHeader(id)) continue;
+      // 异步读会话头：启动路径不能被大日志的同步解压卡住。
+      if (await findSessionHeader(id)) continue;
       try {
         rmSync(join(FORGOTTEN_DIR, f), { force: true });
         removed++;
@@ -155,6 +156,8 @@ function pruneStaleTombstones() {
 
 /** 运行期输出环形缓冲的条目上限（仅内存，超出丢最旧的）。 */
 const MAX_OUT_ENTRIES = 500;
+/** 单条输出正文的字符上限；超出保留尾部，避免一条超长输出把内存撑爆。 */
+const MAX_OUT_TEXT = 200_000;
 /** 记录用户发话时的截断长度（避免一条把缓冲撑爆）。 */
 const MAX_PROMPT_ECHO = 4000;
 /** 保留的回合记录条数（run 结果含正文，所以只留最近若干条，仅内存）。 */
@@ -350,10 +353,15 @@ export class Conversation {
   snapshot() {
     const meta = readConversationMeta(this.id);
     const nativeTitle = meta?.title ?? null;
+    const holder = this.proc?.alive
+      ? { kind: 'self', reason: '本进程持有该会话的写锁' }
+      : classifyHolder(this.id, { knownChildPid: this.lastChildPid });
     return {
       conversation_id: this.id,
       /** 对话名来自 DSH 的 session/title 事件（自动生成）；未生成时用建会话提示兜底。 */
       title: nativeTitle ?? this.titleHint ?? null,
+      /** native = DSH 自动标题；title_hint = 建会话时给的提示；null = 还没有名字。 */
+      title_source: nativeTitle ? 'native' : this.titleHint ? 'title_hint' : null,
       /**
        * DSH 自动生成的标题是**首条消息的截断前缀**（实测 13–15 个字符，
        * 例如「这是一次连通性冒烟测试，请」），信息量很低。
@@ -390,8 +398,13 @@ export class Conversation {
         approval_id: approvalId,
         ...pending.params.details,
       })),
-      /** 不在本进程手里时，写锁在谁手上（none=多半是你自己的 GUI / stale-mcp=可抢占的孤儿 / live-mcp=另一个实例）。 */
-      lock_holder: this.proc?.alive ? 'self' : classifyHolder(this.id, { knownChildPid: this.lastChildPid }).kind,
+      /**
+       * 不在本进程手里时，写锁在谁手上：
+       * self / stale-mcp / live-mcp / none。none 只表示"没有本服务可识别的持有者"，
+       * 可能是空闲/已释放，也可能被 GUI 持有；原因见 lock_holder_reason。
+       */
+      lock_holder: holder.kind,
+      lock_holder_reason: holder.reason ?? null,
       /** ★ 最近一次"撞写锁"的持久记录。
        *  只报一次错是不够的：撞锁往往**一次就长期成立**（实测：在 GUI 里点开一次，
        *  dsh web 会一直持有写锁，切走/等待都不释放），所以要把"谁占用、怎么解"留在状态里，
@@ -569,7 +582,7 @@ export class Conversation {
     }
 
     // 3) 杀 + 重试（内核在持有者进程退出时释放信号量）
-    const kill = killHolderChild(killTarget);
+    const kill = killHolderChild(killTarget, { expectedSpawnedAt: holder.marker?.spawned_at });
     report.killed_pid = killTarget;
     report.kill = kill;
     if (!kill.killed) {
@@ -949,14 +962,15 @@ export class Conversation {
   /** 追加一条输出记录；同类相邻文本会合并，避免每个 token 一条。 */
   pushOut(kind, text, extra = {}) {
     const last = this.out[this.out.length - 1];
+    const cap = (s) => (s.length > MAX_OUT_TEXT ? `…[已截断，保留尾部 ${MAX_OUT_TEXT} 字]…\n${s.slice(-MAX_OUT_TEXT)}` : s);
     if (last && last.kind === kind && last.turn === this.currentTurn && text) {
-      last.text += text;
+      last.text = cap(last.text + text);
       last.at = now();
       // ★ 合并进已有条目也必须推进修订号。否则游标已经读过这条的调用方
       //   会永远看不到后续追加的正文（旧实现用 seq 当游标，seq 不变 = 漏读）。
       last.rev = ++this.outRev;
     } else {
-      this.out.push({ seq: ++this.outSeq, rev: ++this.outRev, kind, turn: this.currentTurn, text: text ?? '', at: now(), ...extra });
+      this.out.push({ seq: ++this.outSeq, rev: ++this.outRev, kind, turn: this.currentTurn, text: cap(text ?? ''), at: now(), ...extra });
       if (this.out.length > MAX_OUT_ENTRIES) this.out.shift();
     }
     if (kind === 'text') this.turnOutChars += text?.length ?? 0;
@@ -1183,6 +1197,8 @@ export class Hub {
   constructor({ log } = {}) {
     this.conversations = new Map();
     this.log = log ?? NOOP_LOG;
+    /** 最近一次 dsh_list 磁盘探测的结果：{ok, error, cached, at}。 */
+    this.lastProbe = { ok: null, error: null, cached: false, at: 0 };
     const rawApprovalTimeout = Number(process.env.DSH_MCP_APPROVAL_TIMEOUT_MS ?? 5 * 60 * 1000);
     // 空串会变成 0 / NaN → setTimeout(0) 会把 ask 审批立刻取消；统一回落到 5 分钟。
     this.approvalTimeoutMs =
@@ -1194,7 +1210,7 @@ export class Hub {
   /** `dsh_list` 磁盘探测的短缓存（探测要 spawn 一个 DSH 进程，实测约 1 秒）。 */
   #probeCache = null;
 
-  load() {
+  async load() {
     // ★ 启动即确认三个关键目录可写。以前"写失败只记 silent 日志"会让服务
     //   看起来正常，但注册表/哨兵/锁登记全部丢失，异步等待永远醒不过来。
     assertWritableDir(dirname(STATE_FILE), '状态目录');
@@ -1219,7 +1235,7 @@ export class Hub {
       }
     }
 
-    const stale = pruneStaleTombstones();
+    const stale = await pruneStaleTombstones();
     if (stale) this.log.info(`[hub] 清理 ${stale} 个失效的 forget 墓碑`);
     if (!existsSync(STATE_FILE)) return;
     try {
@@ -1358,7 +1374,7 @@ export class Hub {
     }
   }
 
-  get(id) {
+  async get(id) {
     // ★ forget 是终态：墓碑存在时，任何按 id 的查询都必须明确失败，
     //   否则 DSH 会话存储里的记录会让它悄悄复活（"forget 不持久"）。
     if (isForgotten(id)) {
@@ -1377,7 +1393,7 @@ export class Hub {
     if (!c) {
       // 最后一道：注册表里没有，但会话可能就在磁盘上 —— 别的实例建的、注册表被并发写覆盖丢的、
       // 或者根本是别的 profile / GUI 建的。**会话存储才是权威，注册表只是缓存。**
-      const header = findSessionHeader(id);
+      const header = await findSessionHeader(id);
       if (header?.cwd) {
         // ★ 权限档必须取自**会话自己的记录**，不能一律套默认值：
         //   一个当初用 read-only 建的会话，若注册表丢了、被我们以默认档接管，
@@ -1591,7 +1607,10 @@ export class Hub {
       if (isForgotten(c.id)) continue;
       out.set(c.id, c.snapshot());
     }
-    if (!includeClosed) return [...out.values()];
+    if (!includeClosed) {
+      this.lastProbe = { ok: null, error: null, cached: false, at: now() };
+      return [...out.values()];
+    }
 
     // 磁盘探测要 spawn 一个 DSH 进程（实测约 1 秒），所以同 cwd 的结果缓存一小段时间，
     // 避免"连着列几次会话"就反复拉进程。
@@ -1603,7 +1622,9 @@ export class Hub {
 
     const probeCwd = cwd ?? [...this.conversations.values()][0]?.cwd ?? process.cwd();
     let sessions = cached;
-    if (!sessions) {
+    if (cached) {
+      this.lastProbe = { ok: true, error: null, cached: true, at: this.#probeCache.at };
+    } else if (!sessions) {
       let proc = null;
       try {
         proc = new AcpProcess({ cwd: probeCwd, permission: 'read-only' });
@@ -1612,9 +1633,12 @@ export class Hub {
         const res = await proc.request('session/list', cwd ? { cwd } : {});
         sessions = res?.sessions ?? [];
         this.#probeCache = { key: cacheKey, at: now(), sessions };
+        this.lastProbe = { ok: true, error: null, cached: false, at: this.#probeCache.at };
       } catch (e) {
         this.log.info(`[hub] session/list 探测失败: ${e.message}`);
         sessions = []; // 失败不缓存，下次重试
+        // ★ 调用方必须能区分"没有别的会话"和"探测失败"，否则会以为会话丢了。
+        this.lastProbe = { ok: false, error: e.message, cached: false, at: now() };
       } finally {
         await proc?.stop().catch(() => {});
       }

package/src/locks.mjs

@@ -27,6 +27,7 @@
  */
 
 import { readFileSync, writeFileSync, existsSync, mkdirSync, rmSync, readdirSync, renameSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
 import { join, dirname } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { STATE_FILE, REAP_INTERVAL_MS, numEnv } from './config.mjs';
@@ -220,8 +221,21 @@ export function classifyHolder(conversationId, { knownChildPid = null } = {}) {
  * 杀掉一个 DSH 子进程。**只允许对 classification 判定为 `stale-mcp` / `live-mcp(force)`
  * 的、由本 MCP 登记过的进程调用** —— 调用方负责先做分类。
  */
-export function killHolderChild(pid) {
+export function killHolderChild(pid, { expectedSpawnedAt } = {}) {
   if (!pid || !isPidAlive(pid)) return { killed: false, reason: '进程已经不在了' };
+  // ★ PID 会被复用。抢占是"杀进程"这种不可逆动作，所以先核对启动时间：
+  //   登记时间与 OS 记录的启动时间差太多 → 这已经不是当初登记的那个进程，拒绝杀。
+  if (Number.isFinite(expectedSpawnedAt)) {
+    const actual = processStartTime(pid);
+    if (Number.isFinite(actual) && Math.abs(actual - expectedSpawnedAt) > 10 * 60 * 1000) {
+      return {
+        killed: false,
+        reason:
+          `PID ${pid} 的启动时间与登记不符（登记 ${new Date(expectedSpawnedAt).toISOString()}，` +
+          `实际 ${new Date(actual).toISOString()}），疑似 PID 已被复用，拒绝杀。`,
+      };
+    }
+  }
   try {
     process.kill(pid, 'SIGKILL');
   } catch (e) {
@@ -230,6 +244,30 @@ export function killHolderChild(pid) {
   return { killed: true, reason: `已向 PID ${pid} 发送 SIGKILL` };
 }
 
+/**
+ * 读取进程启动时间（毫秒时间戳）。拿不到时返回 null（调用方按旧行为处理）。
+ * Windows 用 PowerShell 的 Get-Process.StartTime；POSIX 用 ps -o lstart=。
+ * 只在 takeover 这种低频、不可逆动作前调用，不在热路径上。
+ */
+export function processStartTime(pid) {
+  if (!pid) return null;
+  try {
+    const args =
+      process.platform === 'win32'
+        ? ['-NoProfile', '-NonInteractive', '-Command', `(Get-Process -Id ${Number(pid)} -ErrorAction SilentlyContinue).StartTime.ToUniversalTime().ToString('o')`]
+        : ['-o', 'lstart=', '-p', String(pid)];
+    const r = spawnSync(process.platform === 'win32' ? 'powershell' : 'ps', args, {
+      encoding: 'utf8',
+      timeout: 3000,
+      windowsHide: true,
+    });
+    const t = Date.parse(String(r.stdout || '').trim());
+    return Number.isFinite(t) ? t : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * 启动清理：删掉"MCP 已死 + 子进程也死了"的登记文件。
  * 注意**不删**那些子进程还活着的登记 —— 那正是后面抢占要用的线索。

package/src/mcp.mjs

@@ -183,6 +183,12 @@ export function createMcpServer({ hub, toolDefs = TOOL_DEFS, handlers = createHa
     // 通知（无 id）：不需要回包
     if (id === undefined) {
       if (method === 'notifications/initialized') initialized = true;
+      // 客户端换了打开的项目：丢掉缓存并重新问一次，下一次 dsh_start 才会用新目录。
+      if (method === 'notifications/roots/list_changed') {
+        clientRoots = null;
+        rootsRequested = false;
+        requestRoots().catch(() => {});
+      }
       return;
     }
 

package/src/tools.mjs

@@ -403,7 +403,7 @@ export function createHandlers(hub, opts = {}) {
       if (typeof args.prompt !== 'string' || args.prompt.trim() === '') {
         throw new Error('prompt 不能为空：至少包含一个非空白字符');
       }
-      const conv = hub.get(args.conversation_id);
+      const conv = await hub.get(args.conversation_id);
       const opts = { reasoning: args.reasoning ?? DEFAULT_REASONING };
       if (args.timeout_ms) opts.timeoutMs = args.timeout_ms;
 
@@ -459,9 +459,13 @@ export function createHandlers(hub, opts = {}) {
         if (c.turns != null) bits.push(`轮数=${c.turns}`);
         return `- ${bits.join(' | ')}`;
       };
+      const probe = hub.lastProbe ?? { ok: null, error: null, cached: false };
+      const probeNote = probe.ok === false
+        ? `\n\n⚠️ 磁盘会话探测失败：${probe.error}\n   上面只列出本服务已打开的会话；磁盘上未打开的会话可能没显示。`
+        : '';
       const text = items.length
         ? `${items.length} 个会话（其中 ${running} 个正在跑）：\n${items.map(describe).join('\n')}`
-        : '(没有会话)';
+        : probe.ok === false ? '(本服务没有已打开的会话；磁盘探测失败)' : '(没有会话)';
       // 孤儿锁持有者：上一代 MCP 崩了但它的 DSH 子进程还活着握着写锁 —— 不主动报出来，
       // 用户只会在下一次撞上"被占用"时才发现。这里顺手提示，并给出可执行的动作。
       const orphans = listOrphans();
@@ -471,13 +475,21 @@ export function createHandlers(hub, opts = {}) {
           '\n→ 用 dsh_takeover 抢占即可（这些是本服务自己的残留，抢占是安全的）。'
         : '';
       return {
-        structured: { count: items.length, running, conversations: items, orphan_holders: orphans },
-        text: text + orphanNote,
+        structured: {
+          count: items.length,
+          running,
+          conversations: items,
+          orphan_holders: orphans,
+          probe_ok: probe.ok,
+          probe_error: probe.error ?? null,
+          probe_cached: probe.cached === true,
+        },
+        text: text + probeNote + orphanNote,
       };
     },
 
     async dsh_read(args) {
-      const conv = hub.get(args.conversation_id);
+      const conv = await hub.get(args.conversation_id);
       const r = conv.readOut({
         cursor: args.cursor ?? 0,
         includeReasoning: args.include_reasoning === true,
@@ -503,12 +515,17 @@ export function createHandlers(hub, opts = {}) {
     },
 
     async dsh_get(args) {
-      const conv = hub.get(args.conversation_id);
+      const conv = await hub.get(args.conversation_id);
       const snap = conv.snapshot();
       let run = null;
       const meta = [];
       // DSH 的自动标题是首条消息的截断前缀，信息量低；调用方给过 title_hint 就一并显示。
-      meta.push(`对话名: ${snap.title ?? '(尚未生成)'}（DSH 自动生成）` +
+      const titleKind = snap.title_source === 'native'
+        ? 'DSH 自动生成'
+        : snap.title_source === 'title_hint'
+          ? '来自 title_hint（DSH 尚未生成标题）'
+          : '尚未生成';
+      meta.push(`对话名: ${snap.title ?? '(尚未生成)'}（${titleKind}）` +
         (snap.title_hint && snap.title !== snap.title_hint ? ` / 标题提示: ${snap.title_hint}` : ''));
       meta.push(`工作区: ${snap.cwd}`);
       meta.push(`状态: ${snap.busy ? '忙' : snap.alive ? '空闲(进程活着)' : '未打开(可用 resume 复活)'}`);
@@ -558,7 +575,7 @@ export function createHandlers(hub, opts = {}) {
       if (typeof args.message !== 'string' || args.message.trim() === '') {
         throw new Error('message 不能为空：至少包含一个非空白字符');
       }
-      const conv = hub.get(args.conversation_id);
+      const conv = await hub.get(args.conversation_id);
       const opts = { mode: args.mode ?? 'interject', reasoning: args.reasoning ?? DEFAULT_REASONING };
       if (args.timeout_ms) opts.timeoutMs = args.timeout_ms;
       const r = await conv.interject(args.message, opts);
@@ -583,7 +600,7 @@ export function createHandlers(hub, opts = {}) {
     },
 
     async dsh_interrupt(args) {
-      const conv = hub.get(args.conversation_id);
+      const conv = await hub.get(args.conversation_id);
       const r = await conv.interrupt();
       return { structured: r, text: r.interrupted ? '已发送中断请求。' : `未中断：${r.reason}` };
     },
@@ -603,7 +620,7 @@ export function createHandlers(hub, opts = {}) {
             `\n会话日志都在磁盘上，之后派活会自动 resume；没有一个可释放时 released=0。`,
         };
       }
-      const conv = hub.get(args.conversation_id);
+      const conv = await hub.get(args.conversation_id);
       const r = await conv.close({ forget: args.forget === true });
       return {
         structured: { conversation_id: args.conversation_id, ...r },
@@ -614,19 +631,19 @@ export function createHandlers(hub, opts = {}) {
     },
 
     async dsh_takeover(args) {
-      const conv = hub.get(args.conversation_id);
+      const conv = await hub.get(args.conversation_id);
       const r = await conv.takeover({ force: args.force === true });
       return { structured: r, text: `${r.ok ? '✅' : '❌'} ${r.message}` };
     },
 
     async dsh_approval_decide(args) {
-      const conv = hub.get(args.conversation_id);
+      const conv = await hub.get(args.conversation_id);
       const r = conv.decideApproval(args.approval_id, args.decision);
       return { structured: r, text: `审批 ${r.approval_id} 已裁决为 ${r.decision}。` };
     },
 
     async dsh_status(args) {
-      const conv = hub.get(args.conversation_id);
+      const conv = await hub.get(args.conversation_id);
       const snap = conv.snapshot();
       const run = conv.getRun();
       const bits = [`状态=${snap.state}`, `轮数=${snap.turns}`];
@@ -641,11 +658,14 @@ export function createHandlers(hub, opts = {}) {
       if (snap.lock_holder && snap.lock_holder !== 'self') {
         const hint =
           snap.lock_holder === 'stale-mcp'
-            ? '（本服务残留的孤儿，可 dsh_takeover 抢占）'
+            ? '（本服务残留/卡死的持有者，可 dsh_takeover 抢占）'
             : snap.lock_holder === 'live-mcp'
               ? '（另一个活着的 dsh-any-agent 实例在用；要夺需 dsh_takeover(force=true)）'
-              : '（多半是你自己的 DSH GUI 正开着它；本服务不会去杀它）';
+              : snap.lock_conflict
+                ? '（最近撞过锁：多半是你自己的 DSH GUI 正开着它；本服务不会去杀它）'
+                : '（没有本服务的持锁登记；空闲/已释放时也会是 none，只有在撞锁时才可能是 GUI）';
         bits.push(`写锁=${snap.lock_holder}${hint}`);
+        if (snap.lock_holder_reason) bits.push(`   判定：${snap.lock_holder_reason}`);
       }
       // ★ 撞过锁就把"谁占用 + 怎么解"讲清楚。实测：GUI 点开一次就会长期持有写锁
       //   （切走、等十几分钟都不释放），所以这条信息必须持久可见，而不是一闪而过的报错。
@@ -669,6 +689,7 @@ export function createHandlers(hub, opts = {}) {
           pending_approval_details: snap.pending_approval_details,
           turns: snap.turns,
           lock_holder: snap.lock_holder,
+          lock_holder_reason: snap.lock_holder_reason,
           lock_conflict: snap.lock_conflict,
           run: run
             ? {

package/src/workspace.mjs

@@ -15,11 +15,11 @@
  * 或手动执行回填时做一次读-改-写，窗口很小；但仍与 GUI 存在理论上的覆盖可能。
  */
 
-import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync, readdirSync, rmSync, realpathSync } from 'node:fs';
+import { copyFileSync, createReadStream, readFileSync, writeFileSync, existsSync, mkdirSync, renameSync, readdirSync, rmSync, realpathSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { basename, dirname, isAbsolute, join, relative, sep } from 'node:path';
 import { tmpdir } from 'node:os';
-import { zstdDecompressSync } from 'node:zlib';
+import { createZstdDecompress, zstdDecompressSync } from 'node:zlib';
 import { DSH_HOME, REGISTER_WORKSPACE } from './config.mjs';
 
 const WORKSPACE_FILE = join(DSH_HOME, 'storages', 'workspace.json');
@@ -152,6 +152,12 @@ function readDoc() {
 
 function writeDoc(doc) {
   mkdirSync(dirname(WORKSPACE_FILE), { recursive: true });
+  // 保留上一份**可解析**的注册表：逻辑写坏时用户还能手工回滚。
+  try {
+    if (existsSync(WORKSPACE_FILE)) copyFileSync(WORKSPACE_FILE, `${WORKSPACE_FILE}.bak-dsh`);
+  } catch {
+    /* 备份失败不阻断写入 */
+  }
   // 临时文件名必须唯一：固定 `.dshmcp.tmp` 会让两个实例/CLI 并发写互相覆盖。
   const tmp = `${WORKSPACE_FILE}.${process.pid}.${randomUUID()}.tmp`;
   try {
@@ -214,7 +220,7 @@ export function registerWorkspace(cwd, sessionId) {
   }
 }
 
-/** 读取一个会话头的第一个 zstd 帧（就是头行）。 */
+/** 读取一个会话头的第一个 zstd 帧（就是头行）。仅用于 CLI/测试清理，不用于 MCP 热路径。 */
 function readHeader(file) {
   try {
     const text = zstdDecompressSync(readFileSync(file)).toString('utf8');
@@ -224,6 +230,58 @@ function readHeader(file) {
   }
 }
 
+/**
+ * 异步读取会话头：流式解压，拿到第一行就销毁流。
+ *
+ * 为什么需要它：MCP 服务在 `Hub.get()` 里找回磁盘会话时必须读头；
+ * `readHeader()` 会把整份日志同步解压，超大日志会阻塞事件循环、停掉
+ * 心跳（多实例下可能被误判 stale-mcp）。这里只解到第一个换行，
+ * 不把整份日志读进内存，也不阻塞事件循环。
+ *
+ * 超时/读失败返回 null；调用方按“找不到会话头”处理。
+ */
+export async function readHeaderAsync(file, { timeoutMs = 5000, maxHeaderBytes = 1024 * 1024 } = {}) {
+  return new Promise((resolve) => {
+    let settled = false;
+    let buf = '';
+    let timer = null;
+    const rs = createReadStream(file);
+    const zs = createZstdDecompress();
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      try { rs.destroy(); } catch {}
+      try { zs.destroy(); } catch {}
+      resolve(value);
+    };
+    const parseLine = (line) => {
+      try {
+        const value = JSON.parse(String(line).trim());
+        finish(value && typeof value === 'object' ? value : null);
+      } catch {
+        finish(null);
+      }
+    };
+    timer = setTimeout(() => finish(null), timeoutMs);
+    timer.unref?.();
+    rs.on('error', () => finish(null));
+    zs.on('error', () => finish(null));
+    zs.on('data', (chunk) => {
+      buf += chunk.toString('utf8');
+      const nl = buf.search(/\r?\n/);
+      if (nl >= 0) parseLine(buf.slice(0, nl));
+      else if (buf.length > maxHeaderBytes) finish(null);
+    });
+    zs.on('end', () => {
+      const line = buf.split(/\r?\n/).find(Boolean);
+      if (line) parseLine(line);
+      else finish(null);
+    });
+    rs.pipe(zs);
+  });
+}
+
 /**
  * 扫描磁盘上所有会话，按 header.cwd 归组。数据源是会话头，不是目录名（目录名有损）。
  *
@@ -266,7 +324,7 @@ export function scanSessions() {
  *
  * 会对 id 做形状校验（只允许 UUID / `session-` 前缀那类字符），避免 `..` 之类逃出会话目录。
  */
-export function findSessionHeader(sessionId) {
+export async function findSessionHeader(sessionId) {
   if (typeof sessionId !== 'string' || !/^[A-Za-z0-9._-]{4,80}$/.test(sessionId)) return null;
   if (!existsSync(SESSIONS_ROOT)) return null;
   let buckets;
@@ -278,7 +336,7 @@ export function findSessionHeader(sessionId) {
   for (const bucket of buckets) {
     const f = join(SESSIONS_ROOT, bucket, sessionId, 'session.v4.jsonl.zstd');
     if (!existsSync(f)) continue;
-    const header = readHeader(f);
+    const header = await readHeaderAsync(f);
     if (header?.id === sessionId) return header;
   }
   return null;
@@ -355,9 +413,10 @@ export function backfillWorkspaces({ includeTemp = false, dryRun = false, pruneM
  * 删除测试会话（**这是唯一会动磁盘会话文件的函数**，所以规则写得很死）。
  *
  * 只会删这几类，其余一律不碰：
- *   1) 会话头里的 cwd 位于系统临时目录下
- *   2) 会话头里的 cwd 匹配 Desktop\dsh-any-agent-test-* —— 传 tempOnly 可关掉这一条
- *   3) ids 里显式指定的
+ *   1) testOnly：cwd 在 `tmpdir()/dsh-any-agent-*` 下（本仓库测试自己造的）
+ *   2) cwd 匹配 Desktop\dsh-any-agent-test-*
+ *   3) tempOnly：cwd 在系统临时目录下（显式人工命令才用，范围最大）
+ *   4) ids 里显式指定的
  *
  * @param {object} opts
  * @param {boolean} [opts.testOnly] 只删**本仓库测试造的**临时目录（`tmpdir()/dsh-any-agent-*`）