dsh-archived 0.3.1 → 0.3.2

package/lib/client.js

@@ -80,7 +80,15 @@ window.__ModuleLoader__.load({
       document.head.appendChild(tag);
     }
 
-    /** Same-origin call to this plugin's host routes; never throws on a JSON error body. */
+    /**
+     * Same-origin call to this plugin's host routes.
+     *
+     * A JSON error body is returned for the caller to localize, but a transport
+     * failure must reject: a 403 (refused by the trust gate) or a 500 used to
+     * resolve into whatever JSON it carried, and every caller then read a field
+     * that wasn't there — the panel ended up showing a generic failure that hid
+     * the real reason.
+     */
     function request(path, options) {
       var init = {
         method: options && options.method ? options.method : "GET",
@@ -92,9 +100,22 @@ window.__ModuleLoader__.load({
         init.body = JSON.stringify(options.body);
       }
       return fetch(path, init).then(function (response) {
-        return response.json().catch(function () {
-          throw new Error("HTTP " + response.status);
-        });
+        return response
+          .json()
+          .catch(function () {
+            return { error: "internal" };
+          })
+          .then(function (payload) {
+            if (!response.ok) {
+              // Localizing needs the panel's `t`, so carry the host's error code
+              // and status out and let the caller translate them.
+              var error = new Error("HTTP " + response.status);
+              error.code = payload && payload.error ? String(payload.error) : "internal";
+              error.status = response.status;
+              throw error;
+            }
+            return payload;
+          });
       });
     }
 
@@ -276,7 +297,10 @@ window.__ModuleLoader__.load({
             return payload;
           })
           .catch(function (error) {
-            setNotice({ kind: "error", text: String(error && error.message ? error.message : error) });
+            // A transport failure carries the host's error code; a payload-level
+            // business error already carries a localized message.
+            var text = error && error.code ? describeError(error.code) : String(error && error.message ? error.message : error);
+            setNotice({ kind: "error", text: text });
           })
           .then(function () {
             setBusy(null);
@@ -297,24 +321,39 @@ window.__ModuleLoader__.load({
         });
       }
 
+      /**
+       * Report one batch reply. The host's `delete-all` answers with a per-row
+       * `results` array; reading it unguarded turned any other reply into a
+       * TypeError that replaced the real reason on screen.
+       */
+      function reportBatch(payload) {
+        var results = payload && Array.isArray(payload.results) ? payload.results : [];
+        if (results.length === 0) {
+          setNotice({ kind: "error", text: t("error.generic") });
+          return;
+        }
+        var ok = 0;
+        var bytes = 0;
+        for (var i = 0; i < results.length; i += 1) {
+          if (results[i] && results[i].ok === true) {
+            ok += 1;
+            if (results[i].removed) bytes += results[i].removed.bytes || 0;
+          }
+        }
+        setNotice(
+          ok === results.length
+            ? { kind: "ok", text: t("deletedMany", { n: ok, size: formatBytes(bytes) }) }
+            : { kind: "error", text: t("deletedPartial", { ok: ok, failed: results.length - ok }) },
+        );
+      }
+
       function deleteSelected(mode) {
         var ids = selectedIds;
         if (ids.length === 0) return;
         setBusy("__selected__");
         run(DELETE_ALL_PATH, { ids: ids, mode: mode }, function (payload) {
-          var ok = payload.results.filter(function (result) {
-            return result.ok === true;
-          }).length;
-          var bytes = 0;
-          for (var i = 0; i < payload.results.length; i += 1) {
-            if (payload.results[i].ok && payload.results[i].removed) bytes += payload.results[i].removed.bytes || 0;
-          }
           setSelected({});
-          setNotice(
-            ok === payload.results.length
-              ? { kind: "ok", text: t("deletedMany", { n: ok, size: formatBytes(bytes) }) }
-              : { kind: "error", text: t("deletedPartial", { ok: ok, failed: payload.results.length - ok }) },
-          );
+          reportBatch(payload);
         });
       }
 
@@ -323,20 +362,7 @@ window.__ModuleLoader__.load({
           return row.id;
         });
         setBusy("__all__");
-        run(DELETE_ALL_PATH, { ids: ids, mode: mode }, function (payload) {
-          var ok = payload.results.filter(function (result) {
-            return result.ok === true;
-          }).length;
-          var bytes = 0;
-          for (var i = 0; i < payload.results.length; i += 1) {
-            if (payload.results[i].ok && payload.results[i].removed) bytes += payload.results[i].removed.bytes || 0;
-          }
-          setNotice(
-            ok === payload.results.length
-              ? { kind: "ok", text: t("deletedMany", { n: ok, size: formatBytes(bytes) }) }
-              : { kind: "error", text: t("deletedPartial", { ok: ok, failed: payload.results.length - ok }) },
-          );
-        });
+        run(DELETE_ALL_PATH, { ids: ids, mode: mode }, reportBatch);
       }
 
       function restoreRow(entry) {

package/lib/host/paths.js

@@ -18,8 +18,87 @@ import { readdir, stat } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 
-/** Session ids this plugin is willing to touch: the canonical `session-<uuid>`. */
-export const SESSION_ID = /^session-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * Ids the *store* and the *host API* accept. A session is `session-<uuid>`, but
+ * a session whose header carries no prefix at all is a bare uuid (imported
+ * transcripts and delegate imports both produce those).
+ */
+const UUID = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
+const IMPORT_PREFIXES = ["import-session-", "import-"];
+const CANONICAL_PREFIX = "session-";
+export const HOST_ID = new RegExp(`^(?:${CANONICAL_PREFIX})?${UUID}$`, "i");
+
+/**
+ * Ids an archived *row* may be filed under.
+ *
+ * DSH's own sessions are `session-<uuid>`, but the import feature namespaces the
+ * id it files in the archive index: `import-session-<uuid>` for an imported
+ * transcript and `import-<uuid>` for a delegate-imported session. Every one of
+ * those is a real archived row the panel draws, so all of them must be accepted.
+ * Refusing the import namespaces was a silent, total failure: the rows rendered
+ * fine and every delete came back `invalid-session-id`.
+ *
+ * The path-safety argument is unchanged — a bare uuid is the only shape any form
+ * may carry, so no form can introduce a separator, a `..`, or a NUL.
+ */
+export const SESSION_ID = new RegExp(`^(?:import-session-|import-|${CANONICAL_PREFIX})?${UUID}$`, "i");
+
+/** The raw id a registry entry names, with its import namespace peeled off. */
+export function canonicalSessionId(raw) {
+  const text = String(raw);
+  for (const prefix of IMPORT_PREFIXES) {
+    if (text.startsWith(prefix)) return text.slice(prefix.length);
+  }
+  return text;
+}
+
+/**
+ * Ordered ids the *filesystem* may know one archived row by.
+ *
+ * The archive index is namespaced; the session store is not. `import-<uuid>` and
+ * `import-session-<uuid>` both name a session whose directory (and whose log
+ * header `id`) is the bare uuid or `session-<uuid>`. `locateArtifacts` only ever
+ * accepts a directory whose decoded name is one of these, so a namespace
+ * collision cannot make the plugin delete a different session's log.
+ */
+export function artifactIdCandidates(raw) {
+  const text = String(raw);
+  const out = [text];
+  const add = (value) => {
+    if (value.length > 0 && !out.includes(value)) out.push(value);
+  };
+  // The import namespace wraps the store shape, so peeling it off is the first
+  // and usually only step. The other store form is added as a fallback, because
+  // each import form has been seen wrapping each store shape. Peeling `import-`
+  // off `import-session-<uuid>` would leave `session-session-<uuid>`, a name
+  // nothing on disk carries.
+  for (const prefix of IMPORT_PREFIXES) {
+    if (!text.startsWith(prefix)) continue;
+    const rest = text.slice(prefix.length);
+    add(rest);
+    add(CANONICAL_PREFIX + rest);
+  }
+  return out;
+}
+
+/**
+ * Inverse of DSH's `encodeSegment`: safe units stay literal and every other code
+ * unit is `~XXXX`. Lets a directory name be compared against the candidate ids
+ * instead of guessing at string prefixes.
+ */
+export function decodeSegment(name) {
+  let out = "";
+  for (let i = 0; i < name.length; i += 1) {
+    const ch = name[i];
+    if (ch !== "~") {
+      out += ch;
+      continue;
+    }
+    out += String.fromCharCode(parseInt(name.slice(i + 1, i + 5), 16));
+    i += 4;
+  }
+  return out;
+}
 
 export function dshHome() {
   const configured = process.env.DSH_HOME;
@@ -78,8 +157,20 @@ export function quarantineMetaFile(sessionId) {
   return join(quarantineEntry(sessionId), "meta.json");
 }
 
-/** Every on-disk artifact directory of one session (normally zero or one). */
+/**
+ * Every on-disk artifact directory of one session (normally zero or one).
+ *
+ * The directory is named after the id inside the session log's header, which is
+ * NOT always the id the archive index files the row under: an imported row is
+ * indexed as `import-session-<uuid>` / `import-<uuid>` while its directory is
+ * `session-<uuid>` or the bare uuid. Looking up the raw registry id therefore
+ * found nothing, so a delete freed the projection cache and the index entry and
+ * silently left the session log on disk — the exact "fake success" this plugin
+ * exists to prevent. Match on the decoded directory name instead.
+ */
 export async function locateArtifacts(sessionId) {
+  const candidates = artifactIdCandidates(sessionId);
+  const wanted = new Set(candidates.map((id) => id.toLowerCase()));
   const found = [];
   let workspaces;
   try {
@@ -89,8 +180,26 @@ export async function locateArtifacts(sessionId) {
   }
   for (const workspace of workspaces) {
     if (!workspace.isDirectory()) continue;
-    const candidate = join(sessionsRoot(), workspace.name, sessionId);
-    if (existsSync(candidate)) found.push(candidate);
+    const bucket = join(sessionsRoot(), workspace.name);
+    // The pre-encoded name is the common case; only fall back to decoding the
+    // bucket's entries when it is absent (an id that needed `encodeSegment`).
+    const direct = candidates.map((id) => join(bucket, id)).find((path) => existsSync(path));
+    if (direct !== undefined) {
+      found.push(direct);
+      continue;
+    }
+    let entries;
+    try {
+      entries = await readdir(bucket, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      if (!wanted.has(decodeSegment(entry.name).toLowerCase())) continue;
+      found.push(join(bucket, entry.name));
+      break;
+    }
   }
   return found;
 }

package/lib/host/quarantine.js

@@ -14,6 +14,7 @@ import { constants } from "node:fs";
 import { access, cp, mkdir, readdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import {
+  canonicalSessionId,
   directorySize,
   projectionCacheFile,
   quarantineArtifactDir,
@@ -133,8 +134,13 @@ export async function restoreSession(ctx, sessionId, entry) {
   const artifact = quarantineArtifactDir(sessionId);
   const cache = quarantineCacheFile(sessionId);
   const restored = { directories: 0, cache: false, rearchived: false };
+  // The registry id may be namespaced (`import-…`), while the log directory and
+  // the projection-cache document are named after the raw session id. Restoring
+  // under the registry id would put the directory back under a name nothing
+  // looks for again.
+  const rawId = canonicalSessionId(sessionId);
 
-  const target = entry.workspaceDir !== null ? join(entry.workspaceDir, sessionId) : null;
+  const target = entry.workspaceDir !== null ? join(entry.workspaceDir, rawId) : null;
   if (await exists(artifact)) {
     if (target === null) throw new Error("quarantine metadata has no workspaceDir");
     await mkdir(dirname(target), { recursive: true });
@@ -142,7 +148,7 @@ export async function restoreSession(ctx, sessionId, entry) {
     restored.directories = 1;
   }
   if (await exists(cache)) {
-    await movePath(cache, projectionCacheFile(sessionId));
+    await movePath(cache, projectionCacheFile(rawId));
     restored.cache = true;
   }
   await rm(root, { recursive: true, force: true });

package/lib/index.js

@@ -31,6 +31,8 @@ import { dirname } from "node:path";
 
 import {
   SESSION_ID,
+  artifactIdCandidates,
+  canonicalSessionId,
   directorySize,
   dshHome,
   legacyAggregateFile,
@@ -130,6 +132,33 @@ function archivedIds(ctx) {
   return Array.isArray(ids) ? [...ids] : [];
 }
 
+/**
+ * Ids other than the archived row that could name the *live agent* of the same
+ * session. An imported row is indexed under a namespaced id
+ * (`import-session-<uuid>` / `import-<uuid>`) while the agent table, the session
+ * store and the on-disk directory all know the bare uuid, so a running-turn
+ * check done only against the archived id would miss a live agent and delete a
+ * session out from under it.
+ */
+function agentIdCandidates(sessionId) {
+  return artifactIdCandidates(sessionId).filter((id) => id !== sessionId);
+}
+
+/**
+ * Is any candidate id for this row a live agent running a turn? The archived id
+ * is checked by the caller (it is the form the host may broadcast), so only the
+ * remaining candidates are consulted here.
+ */
+function runningAlias(ctx, sessionId) {
+  return agentIdCandidates(sessionId).find((id) => isRunning(ctx, id)) ?? null;
+}
+
+/** The raw ids a delete had to look under, for an operator-facing log line. */
+function artifactHints(sessionId) {
+  const hints = artifactIdCandidates(sessionId).filter((id) => id !== sessionId);
+  return hints.length > 0 ? `, looked up as ${hints.join(" | ")}` : "";
+}
+
 /**
  * Whether this host still offers what a destructive route needs. A host whose
  * registry lost `unarchiveSession` cannot clear the archive index, and a delete
@@ -160,9 +189,10 @@ async function stateOf(ctx) {
     const dirs = await locateArtifacts(id);
     let bytes = 0;
     for (const dir of dirs) bytes += await directorySize(dir);
-    const cacheFile = projectionCacheFile(id);
+    const rawId = canonicalSessionId(id);
+    const cacheFile = projectionCacheFile(rawId);
     const cache = existsSync(cacheFile);
-    const document = cache ? await readCacheDocument(id) : null;
+    const document = cache ? await readCacheDocument(rawId) : null;
     items.push({
       id,
       archived: true,
@@ -225,7 +255,7 @@ async function sweepResidue(ctx, sessionId) {
   if (archivedIds(ctx).includes(sessionId)) return;
   if (isRunning(ctx, sessionId)) return;
   if ((await locateArtifacts(sessionId)).length > 0) return;
-  const cacheFile = projectionCacheFile(sessionId);
+  const cacheFile = projectionCacheFile(canonicalSessionId(sessionId));
   if (existsSync(cacheFile)) await rm(cacheFile, { force: true });
 }
 
@@ -249,12 +279,17 @@ async function deleteOne(ctx, sessionId, mode) {
   if (!hostSupportsDelete(ctx)) return refuse("no-registry", { sessionId });
   if (!archivedIds(ctx).includes(sessionId)) return refuse("not-archived", { sessionId });
   if (isRunning(ctx, sessionId)) return refuse("session-running", { sessionId });
+  const alias = runningAlias(ctx, sessionId);
+  if (alias !== null) return refuse("session-running", { sessionId, runningAs: alias });
   const descendants = runningDescendants(ctx, sessionId);
   if (descendants.length > 0) return refuse("subagent-running", { sessionId, descendants });
 
   return withLock(sessionId, async () => {
+    // The archive index is namespaced; the log directory, the projection cache
+    // document and the host's own session store all use the raw id.
+    const rawId = canonicalSessionId(sessionId);
     const dirs = await locateArtifacts(sessionId);
-    const cacheFile = projectionCacheFile(sessionId);
+    const cacheFile = projectionCacheFile(rawId);
     let bytes = 0;
     for (const dir of dirs) bytes += await directorySize(dir);
 
@@ -273,7 +308,7 @@ async function deleteOne(ctx, sessionId, mode) {
       // and that the panel would not even show.
       removed = { directories: 0, bytes: 0, cache: false, parked: false };
     } else {
-      const document = existsSync(cacheFile) ? await readCacheDocument(sessionId) : null;
+      const document = existsSync(cacheFile) ? await readCacheDocument(rawId) : null;
       removed = await quarantineSession(sessionId, {
         dirs,
         cacheFile,
@@ -290,7 +325,7 @@ async function deleteOne(ctx, sessionId, mode) {
     await registryOf(ctx).unarchiveSession(sessionId);
     scheduleSweep(ctx, sessionId);
     ctx.logger?.info?.(
-      `[dsh-archived] delete ${sessionId} (${mode}): ${removed.directories} dir(s), ${removed.bytes} bytes`,
+      `[dsh-archived] delete ${sessionId} (${mode}): ${removed.directories} dir(s), ${removed.bytes} bytes${artifactHints(sessionId)}`,
     );
     return { ok: true, sessionId, mode, removed, archivedSessionIds: archivedIds(ctx) };
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-archived",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Archived-sessions page for DeepSeek Harness: per-row and batch deletion that clears the session log, the projection cache and the archive index together, with a 30-day recycle bin, subagent-aware refusals and a per-row disk footprint.",
   "type": "module",
   "main": "lib/index.js",