dsh-autorestart 0.8.0 → 0.8.1

package/CHANGELOG.md

@@ -0,0 +1,47 @@
+# Changelog
+
+## 0.8.1 — 2026-10-29
+
+**修复打包遗漏**：0.8.0 的 npm 包按 `package.json` 的 `files` 白名单打包，而那份白名单只收了 `scripts/*.ps1` 与 `scripts/*.cmd`——**三个 POSIX 自救脚本（`restore-profile.sh` / `emergency-disable.sh` / `drill-rescue.sh`）、`scripts/README.md`、`scripts/rescue-strings.zh.json` 全都没进包**。Linux / WSL 用户装完 0.8.0 后，文档让他去双击/运行 `scripts/restore-profile.sh`，那个文件却不存在。
+
+现在把白名单补齐（`.sh`、`.mjs`、`scripts/README.md`、`scripts/rescue-strings.zh.json`、`CHANGELOG.md`），并用 `npm pack --dry-run` 逐项确认：**54 → 61 个文件**，三个 `.sh` 都在。单元测试 740 项仍全绿。
+
+0.8.0 的内容与行为没有其它变化；只是那个包缺文件。
+
+## 0.8.0 — 2026-10-29
+
+这一版把"出事之后怎么办"做成真正的闭环：**起不来就自动还原、再拉起、留下报告**，并且桌面端与各种 Web 托管端（Windows / Linux / WSL）都覆盖。
+
+### 新增
+
+- **看门狗（watchdog v2）**：重启前登记一个一次性监护者；新实例按约定报到就算过关，否则**先复查一次**（防误判），确认真的没起来才**自动还原重启前的快照 → 再自动拉起一次 → 把结果写进报告**。最多还原一次、拉起一次，绝不死循环；回滚前先探活，绝不双开。
+- **三档调度，跨环境都可用**：Windows 一次性计划任务 → Linux/WSL 的 systemd-run → 自建后台进程（setsid nohup）。都没有时**明确告知"没有自动回滚"**，绝不假装有保护。
+- **同一时刻只有一个监护者**：v2 可用时不启动旧的 v1；v2 不可用时才回落 v1；报告里记 arbiter 字段，出事能一眼看出当时是谁在监护。
+- **POSIX 版自救包**：restore-profile.sh / emergency-disable.sh / drill-rescue.sh（与 Windows 的 .cmd/.ps1 同一套规则：先把坏的那份挪走留证、还原后回读校验、路径闸门、不自动重启）。
+- **设置页「出事了怎么办」**：按平台显示对应的救命脚本绝对路径，可复制、可打开文件夹；Windows 还能一键在桌面放一个快捷方式（只有你点才创建）。
+- **装上就告诉你有没有兜底**：第一次启用时真的建一个空计划任务验证能力（建 → 回读校验 → 删 → 再确认删掉），不能用就直接说清"会丢失：重启后起不来时不会自动恢复"。
+- **平台能力矩阵**：docs/platform-matrix.md 列出 13 条能力 × 5 个平台，逐格标清能用、有前提（并写明用户会看到什么）与做不到。
+
+### 修复
+
+- **同一次重启出现两个看门狗会互相废掉**：旧的 PowerShell 看门狗只还原不拉起，若它先抢到锁，新的看门狗会放弃 → 结果是"配置回滚了却没有任何东西在运行"。已改成仲裁者，同一时刻只允许一个。
+- **集成测试会往真实机器注册计划任务**（留下空壳任务）。测试改为注入，不再碰系统。
+- 计划任务的触发时间曾写成 UTC，导致**任务会晚 8 小时才触发**；改为本地时间。
+- 看门狗里一个忘记 await 的探活判断让 Promise 恒为真，看门狗每次都"放弃"；已修并加回归用例。
+
+### 文档
+
+- 讲清**关机倒数会关掉哪台机器**：Windows 桌面 / Windows web → 关这台 Windows；**WSL 里的 web → 关掉整台 Windows**（不是关 WSL）；容器里没有可靠的关机方式（界面会这么说）。
+- 自救包补齐"Windows 用哪个、Linux/WSL 用哪个"，并写明 restore-profile 与 emergency-disable 的分工与选择口诀。
+- 记录写 POSIX 脚本踩过的三个坑（dash 数单引号里的括号、双引号里的 sed 转义被吃、嵌套 JSON 平铺 grep 找不到）。
+
+### 验证
+
+- 单元测试 **740 项全绿**（node --test plugins/dsh-autorestart/test/*.test.mjs）。
+- 看门狗演练（三档都真触发）+ Windows 自救演练 + **WSL 里的 POSIX 自救演练** 全部 exit 0。
+- 全部脚本字节级纯 ASCII（rescue-strings.zh.json 无 BOM），机器上无残留计划任务。
+- 未真关电：POSIX 的关机链路只验证到"计划层"（用户决定不为一条常识证据断开会话），矩阵里如实标注。
+
+## 0.7.0 — 2026-10-29
+
+这一版的主题是**认得出自己在什么环境里、并且永远不双开**，外加一个用户真能点到的问题反馈入口。

package/README.md

@@ -198,7 +198,7 @@ what it adds before you install it.
 
 ## Install
 
-Current version: **0.8.0**.
+Current version: **0.8.1**.
 
 From npm — the package is published under the name `dsh-autorestart`:
 

package/docs/README.zh.md

@@ -328,7 +328,7 @@ agent/status(running) ──► 写 checkpoint（<DSH_HOME>\storages\dsh-autores
 
 ## 安装
 
-当前版本：**0.8.0**。
+当前版本：**0.8.1**。
 
 ```powershell
 # 在 dsh 里（或对 Agent 说）：把工作区里的这个包安装为 profile bundle

package/index.js

@@ -374,7 +374,7 @@ function snapGraceChoice(value, fallback = DEFAULT_RESTART_GRACE_MS) {
  * `pluginVersion()`), but a bundled installation may not ship that file — so
  * the constant below is the last resort. A test keeps the two in sync.
  */
-const PLUGIN_VERSION_FALLBACK = '0.8.0'
+const PLUGIN_VERSION_FALLBACK = '0.8.1'
 
 /**
  * The version of the graceful-shutdown FEATURE, not the version of the package.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-autorestart",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "type": "module",
   "description": "DeepSeek Harness plugin: restart without losing work. Waits until every conversation is idle, restarts the host, then automatically resumes the interrupted sessions. AI-generated, not human-reviewed: use with caution.",
   "license": "MIT",
@@ -34,12 +34,17 @@
     "supervisor/supervisor.js",
     "scripts/*.ps1",
     "scripts/*.cmd",
+    "scripts/*.sh",
+    "scripts/*.mjs",
+    "scripts/README.md",
+    "scripts/rescue-strings.zh.json",
     "cordis.patch.yml",
     "locale/*.json",
     "icon.svg",
     "assets/*.png",
     "screenshots.json",
     "README.md",
+    "CHANGELOG.md",
     "docs/*.md"
   ],
   "dsh": {

package/scripts/drill-rescue.sh

@@ -0,0 +1,427 @@
+#!/bin/sh
+# The rescue drill (POSIX): break a profile on purpose, put it back, prove it.
+#
+# Three traps this file avoids (the whole story: scripts/README.md):
+#   1. the wording lives in rescue-strings.zh.json and is NESTED - it is read
+#      by path with node, never by a flat grep;
+#   2. the English fallbacks below must NOT contain parentheses: dash counts
+#      them even inside single quotes, and one stray ")" breaks the script;
+#   3. the sed expressions stay single-quoted: the shell eats the backslashes
+#      in a double-quoted sed program and truncates it.
+#
+# The same assertions as drill-rescue.ps1, in a directory of its own under the
+# temp directory. Nothing here touches the profile of a running DSH.
+#
+# The wording comes from rescue-strings.zh.json; the English fallbacks keep
+# the script working without it.
+set -eu
+
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+RESTORE="$SCRIPT_DIR/restore-profile.sh"
+DISABLE="$SCRIPT_DIR/emergency-disable.sh"
+STRINGS_FILE="$SCRIPT_DIR/rescue-strings.zh.json"
+PACKAGE_NAME='dsh-autorestart'
+
+DRILL_DIR="${TMPDIR:-/tmp}/dsh-rescue-drill-$$"
+FAILED=0
+
+usage() {
+  printf 'Usage: %s [drill-directory]\n' "$0"
+}
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --help|-h) usage; exit 0 ;;
+    *) DRILL_DIR="$1" ;;
+  esac
+  shift
+done
+
+NODE_BIN=''
+if command -v node >/dev/null 2>&1; then
+  NODE_BIN=$(command -v node)
+fi
+
+# t <key> <english fallback>
+#
+# The key is a PATH into the strings file ("drill.passed"), because that file
+# is nested. Node reads it (it is on every machine that runs DSH); without
+# node every message falls back to English.
+t() {
+  key="$1"
+  fallback="$2"
+  if [ -n "$NODE_BIN" ] && [ -f "$STRINGS_FILE" ]; then
+    value=$("$NODE_BIN" -e '
+      const fs = require("fs");
+      try {
+        const doc = JSON.parse(fs.readFileSync(process.argv[1], "utf8").replace(/^\uFEFF/, ""));
+        let value = doc;
+        for (const part of process.argv[2].split(".")) value = value == null ? undefined : value[part];
+        if (typeof value !== "string" || value === "") process.exit(1);
+        process.stdout.write(value);
+      } catch (error) { process.exit(1); }
+    ' "$STRINGS_FILE" "$key" 2>/dev/null) || value=''
+    if [ -n "$value" ]; then
+      printf '%s' "$value"
+      return 0
+    fi
+  fi
+  printf '%s' "$fallback"
+}
+
+# fmt <text> <value> ...
+#
+# Node does the replacement when it is there: the Chinese wording is UTF-8 and
+# a byte-wise sed would mangle it. Without node only the English fallbacks are
+# used, and those are plain ASCII.
+fmt() {
+  text="$1"
+  shift
+  if [ -n "$NODE_BIN" ]; then
+    if "$NODE_BIN" -e '
+      let text = process.argv[1];
+      process.argv.slice(2).forEach((value, index) => { text = text.split("{" + index + "}").join(value); });
+      process.stdout.write(text);
+    ' "$text" "$@" 2>/dev/null; then
+      return 0
+    fi
+  fi
+  index=0
+  for value in "$@"; do
+    safe=$(printf '%s' "$value" | sed 's/[&|\\]/\\&/g')
+    text=$(printf '%s' "$text" | sed "s|{$index}|$safe|g")
+    index=$((index + 1))
+  done
+  printf '%s' "$text"
+}
+
+say() {
+  printf '%s\n' "$1"
+}
+
+assert_pass() {
+  say "$(fmt "$(t 'drill.assertPass' '  [pass] {0}')" "$1")"
+}
+
+assert_fail() {
+  FAILED=$((FAILED + 1))
+  say "$(fmt "$(t 'drill.assertFail' '  [FAIL] {0} -- {1}')" "$1" "$2")"
+}
+
+# The keywords a refusal has to carry (the same file the Windows drill uses).
+keyword_list() {
+  key="$1"
+  if [ -n "$NODE_BIN" ] && [ -f "$STRINGS_FILE" ]; then
+    "$NODE_BIN" -e '
+      const fs = require("fs");
+      try {
+        const doc = JSON.parse(fs.readFileSync(process.argv[1], "utf8").replace(/^\uFEFF/, ""));
+        let value = doc;
+        for (const part of process.argv[2].split(".")) value = value == null ? undefined : value[part];
+        if (!Array.isArray(value)) process.exit(1);
+        process.stdout.write(value.join("\n"));
+      } catch (error) { process.exit(1); }
+    ' "$STRINGS_FILE" "$key" 2>/dev/null
+    return $?
+  fi
+  printf ''
+}
+
+# refused <name> <output> <exit code> <keyword key>
+refused() {
+  name="$1"
+  output="$2"
+  code="$3"
+  key="$4"
+  if [ "$code" -eq 0 ]; then
+    assert_fail "$name" "$(fmt "$(t 'drill.refusedNotRefused' '  [FAIL] {0} -- the exit code is 0, the script did not refuse')" "$name")"
+    return
+  fi
+  found=''
+  for word in $(keyword_list "$key"); do
+    [ -n "$word" ] || continue
+    if printf '%s' "$output" | grep -q "$word"; then
+      found="$word"
+      break
+    fi
+  done
+  if [ -z "$found" ]; then
+    assert_fail "$name" "$(fmt "$(t 'drill.refusedNoReason' '  [FAIL] {0} -- the exit code is {1}, but the output has no reason')" "$name" "$code")"
+    return
+  fi
+  detail=$(fmt "$(t 'drill.refusedOk' '  [pass] {0} -- exit code {1}, the output says why')" "$name" "$code")
+  assert_pass "$name ($detail)"
+}
+
+if [ ! -x "$RESTORE" ] && [ ! -f "$RESTORE" ]; then
+  say "$(fmt "$(t 'drill.noScript' 'the drill failed: {0} not found')" "$RESTORE")"
+  exit 1
+fi
+if [ -e "$DRILL_DIR" ]; then
+  say "$(fmt "$(t 'drill.dirOccupied' 'the drill failed: this drill directory is already there: {0}')" "$DRILL_DIR")"
+  exit 1
+fi
+
+say "$(fmt "$(t 'drill.dir' 'drill directory: {0}')" "$DRILL_DIR")"
+mkdir -p -- "$DRILL_DIR"
+
+PROFILE="$DRILL_DIR/profile"
+STATE="$DRILL_DIR/state"
+BACKUPS="$STATE/backups"
+SNAPSHOT="$BACKUPS/20260101-000000"
+mkdir -p -- "$PROFILE/node_modules/$PACKAGE_NAME" "$SNAPSHOT/config" "$SNAPSHOT/node_modules/$PACKAGE_NAME"
+
+# --- the profile and the snapshot ---
+cat > "$PROFILE/package.json" <<'JSON'
+{
+  "name": "dsh-profile",
+  "dsh": {
+    "profile": {
+      "bundles": [
+        "dsh-autorestart"
+      ]
+    }
+  }
+}
+JSON
+cat > "$PROFILE/cordis.patch.yml" <<'YML'
+# the profile configuration
+YML
+cat > "$PROFILE/node_modules/$PACKAGE_NAME/package.json" <<'JSON'
+{
+  "name": "dsh-autorestart",
+  "version": "1.2.3"
+}
+JSON
+cp "$PROFILE/package.json" "$SNAPSHOT/config/package.json"
+cp "$PROFILE/cordis.patch.yml" "$SNAPSHOT/config/cordis.patch.yml"
+cp "$PROFILE/node_modules/$PACKAGE_NAME/package.json" "$SNAPSHOT/node_modules/$PACKAGE_NAME/package.json"
+cat > "$SNAPSHOT/manifest.json" <<'JSON'
+{
+  "at": 1767225600000,
+  "atLocal": "2026-01-01T00:00:00",
+  "includePlugins": true
+}
+JSON
+
+# A NEWER decoy without a manifest: it must be skipped.
+DECOY="$BACKUPS/20260202-000000"
+mkdir -p -- "$DECOY/config"
+cp "$PROFILE/package.json" "$DECOY/config/package.json"
+
+# --- break it on purpose ---
+printf '{ this is not json' > "$PROFILE/package.json"
+rm -rf -- "$PROFILE/node_modules/$PACKAGE_NAME"
+
+say "$(t 'drill.broke' 'broken on purpose: package.json is invalid JSON, the plugin directory is gone.')"
+
+# --- 1) the dry run changes nothing ---
+set +e
+DRY_OUT=$("$RESTORE" --dry-run --profile "$PROFILE" --state-dir "$STATE" 2>&1)
+DRY_CODE=$?
+set -e
+DRY_MARK=$(keyword_list 'drill.keywords.dryRun' | head -n 1)
+if [ "$DRY_CODE" -eq 0 ] && { [ -z "$DRY_MARK" ] || printf '%s' "$DRY_OUT" | grep -q "$DRY_MARK"; }; then
+  assert_pass "$(t 'drill.assertDryRunExit' 'the dry run exits with 0')"
+else
+  assert_fail "$(t 'drill.assertDryRunExit' 'the dry run exits with 0')" "$DRY_OUT"
+fi
+if [ -z "$(find "$DRILL_DIR" -maxdepth 1 -name 'profile.broken-*' 2>/dev/null)" ]; then
+  assert_pass "$(t 'drill.assertDryRunNoBroken' 'the dry run leaves no broken directory')"
+else
+  assert_fail "$(t 'drill.assertDryRunNoBroken' 'the dry run leaves no broken directory')" 'there is one'
+fi
+
+# --- 2) the real restore ---
+set +e
+RESTORE_OUT=$("$RESTORE" --profile "$PROFILE" --state-dir "$STATE" 2>&1)
+RESTORE_CODE=$?
+set -e
+if [ "$RESTORE_CODE" -eq 0 ]; then
+  assert_pass "$(t 'drill.assertRestoreExit' 'the restore exits with 0')"
+else
+  assert_fail "$(t 'drill.assertRestoreExit' 'the restore exits with 0')" "$RESTORE_OUT"
+fi
+
+# --- the assertions about the result ---
+if printf '%s' "$RESTORE_OUT" | LC_ALL=C grep -q '[^ -~]'; then
+  assert_pass "$(t 'drill.assertChineseOutput' 'the output of the restore script carries Chinese (the wording comes from the JSON)')"
+else
+  assert_fail "$(t 'drill.assertChineseOutput' 'the output of the restore script carries Chinese (the wording comes from the JSON)')" 'no non-ASCII byte in the output'
+fi
+
+if [ -n "$NODE_BIN" ] && "$NODE_BIN" -e 'JSON.parse(require("fs").readFileSync(process.argv[1], "utf8"))' "$PROFILE/package.json" >/dev/null 2>&1; then
+  assert_pass "$(t 'drill.assertParses' 'after the restore package.json can be parsed')"
+else
+  assert_fail "$(t 'drill.assertParses' 'after the restore package.json can be parsed')" 'it does not parse'
+fi
+
+if grep -q "$PACKAGE_NAME" "$PROFILE/package.json" 2>/dev/null; then
+  assert_pass "$(t 'drill.assertUsedSnapshot' 'the snapshot with the manifest was used (the newer decoy was skipped)')"
+else
+  assert_fail "$(t 'drill.assertUsedSnapshot' 'the snapshot with the manifest was used (the newer decoy was skipped)')" 'the plugin is not in the bundles'
+fi
+
+if grep -q '"bundles"' "$PROFILE/package.json" 2>/dev/null; then
+  assert_pass "$(t 'drill.assertBundles' 'after the restore dsh.profile.bundles has content')"
+else
+  assert_fail "$(t 'drill.assertBundles' 'after the restore dsh.profile.bundles has content')" 'there is no bundles'
+fi
+
+VERSION=$(sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$PROFILE/node_modules/$PACKAGE_NAME/package.json" 2>/dev/null | head -n 1)
+if [ -n "$VERSION" ]; then
+  assert_pass "$(t 'drill.assertVersionReadable' 'after the restore the version of the plugin can be read')"
+else
+  assert_fail "$(t 'drill.assertVersionReadable' 'after the restore the version of the plugin can be read')" 'there is no version'
+fi
+if [ "$VERSION" = '1.2.3' ]; then
+  assert_pass "$(t 'drill.assertVersionSame' 'the version is the one of the snapshot')"
+else
+  assert_fail "$(t 'drill.assertVersionSame' 'the version is the one of the snapshot')" "got '$VERSION'"
+fi
+
+BROKEN=$(find "$DRILL_DIR" -maxdepth 1 -name 'profile.broken-*' 2>/dev/null | head -n 1)
+if [ -n "$BROKEN" ]; then
+  assert_pass "$(t 'drill.assertBrokenExists' 'the broken evidence directory is there')"
+  if grep -q 'this is not json' "$BROKEN/package.json" 2>/dev/null; then
+    assert_pass "$(t 'drill.assertBrokenKeeps' 'the broken directory keeps the broken version')"
+  else
+    assert_fail "$(t 'drill.assertBrokenKeeps' 'the broken directory keeps the broken version')" 'it does not'
+  fi
+else
+  assert_fail "$(t 'drill.assertBrokenExists' 'the broken evidence directory is there')" 'there is none'
+fi
+
+# --- the refusals: the exit code AND the reason in the output ---
+NOT_A_PROFILE="$DRILL_DIR/not-a-profile"
+mkdir -p -- "$NOT_A_PROFILE"
+printf 'hello' > "$NOT_A_PROFILE/readme.txt"
+set +e
+OUT=$("$RESTORE" --profile "$NOT_A_PROFILE" --state-dir "$STATE" 2>&1)
+CODE=$?
+set -e
+refused "$(t 'drill.assertNotProfileRefused' 'a directory that is not a profile is refused')" "$OUT" "$CODE" 'drill.keywords.notProfile'
+if [ "$(cat "$NOT_A_PROFILE/readme.txt")" = 'hello' ]; then
+  assert_pass "$(t 'drill.assertNotProfileUntouched' 'the refused directory was not touched')"
+else
+  assert_fail "$(t 'drill.assertNotProfileUntouched' 'the refused directory was not touched')" 'it changed'
+fi
+
+set +e
+OUT=$("$RESTORE" --profile / --state-dir "$STATE" 2>&1)
+CODE=$?
+set -e
+refused "$(t 'drill.assertDriveRootRefused' 'the filesystem root is refused')" "$OUT" "$CODE" 'drill.keywords.driveRoot'
+
+SYSTEM_DIR=/etc
+set +e
+OUT=$("$RESTORE" --profile "$SYSTEM_DIR" --state-dir "$STATE" 2>&1)
+CODE=$?
+set -e
+refused "$(fmt "$(t 'drill.assertSystemDirRefused' 'the system directory {0} is refused')" "$SYSTEM_DIR")" "$OUT" "$CODE" 'drill.keywords.systemDir'
+if [ -d "$SYSTEM_DIR" ]; then
+  assert_pass "$(fmt "$(t 'drill.assertSystemDirIntact' 'the system directory {0} is untouched')" "$SYSTEM_DIR")"
+else
+  assert_fail "$(fmt "$(t 'drill.assertSystemDirIntact' 'the system directory {0} is untouched')" "$SYSTEM_DIR")" 'it is gone'
+fi
+
+MISSING="$DRILL_DIR/does-not-exist"
+set +e
+OUT=$("$RESTORE" --profile "$MISSING" --state-dir "$STATE" 2>&1)
+CODE=$?
+set -e
+refused "$(t 'drill.assertMissingDirRefused' 'a target profile directory that does not exist is refused')" "$OUT" "$CODE" 'drill.keywords.missingDir'
+if [ ! -e "$MISSING" ]; then
+  assert_pass "$(t 'drill.assertMissingDirNotCreated' 'the missing directory was not created')"
+else
+  assert_fail "$(t 'drill.assertMissingDirNotCreated' 'the missing directory was not created')" 'it is there'
+fi
+
+# --- "the profile says one thing, the disk another": the restore must fail ---
+LYING_PROFILE="$DRILL_DIR/lying"
+LYING_SNAPSHOT="$BACKUPS/20260303-000000"
+mkdir -p -- "$LYING_PROFILE" "$LYING_SNAPSHOT/config"
+cat > "$LYING_PROFILE/package.json" <<'JSON'
+{
+  "name": "dsh-profile",
+  "dsh": {
+    "profile": {
+      "bundles": [
+        "dsh-autorestart"
+      ]
+    }
+  }
+}
+JSON
+cp "$LYING_PROFILE/package.json" "$LYING_SNAPSHOT/config/package.json"
+cat > "$LYING_SNAPSHOT/manifest.json" <<'JSON'
+{
+  "at": 1772668800000,
+  "atLocal": "2026-03-03T00:00:00",
+  "includePlugins": false
+}
+JSON
+set +e
+OUT=$("$RESTORE" --profile "$LYING_PROFILE" --snapshot "$LYING_SNAPSHOT" --state-dir "$STATE" 2>&1)
+CODE=$?
+set -e
+if [ "$CODE" -ne 0 ]; then
+  assert_pass "$(t 'drill.assertLyingRefused' 'the profile declares the plugin but does not have it -> the restore must fail')"
+else
+  assert_fail "$(t 'drill.assertLyingRefused' 'the profile declares the plugin but does not have it -> the restore must fail')" 'it exited with 0'
+fi
+LYING_BROKEN=$(find "$DRILL_DIR" -maxdepth 1 -name 'lying.broken-*' 2>/dev/null | head -n 1)
+if [ -n "$LYING_BROKEN" ]; then
+  assert_pass "$(t 'drill.assertLyingBrokenHint' 'the failing restore says the broken directory is still there')"
+else
+  assert_fail "$(t 'drill.assertLyingBrokenHint' 'the failing restore says the broken directory is still there')" 'there is none'
+fi
+
+# --- the scripts are pure ASCII ---
+for script in "$RESTORE" "$DISABLE"; do
+  if [ ! -f "$script" ]; then
+    continue
+  fi
+  if LC_ALL=C grep -q '[^ -~]' "$script"; then
+    assert_fail "$(fmt 'the script {0} is pure ASCII' "$(basename "$script")")" 'it holds a non-ASCII byte'
+  else
+    assert_pass "$(fmt 'the script {0} is pure ASCII' "$(basename "$script")")"
+  fi
+done
+
+# --- the emergency switch ---
+if [ -f "$DISABLE" ]; then
+  EM_OUT=$("$DISABLE" --package "$PROFILE/package.json" --action disable 2>&1) || true
+  if grep -q "$PACKAGE_NAME" "$PROFILE/package.json" 2>/dev/null; then
+    assert_fail 'the emergency switch takes the plugin out of the bundles' 'it is still there'
+  else
+    assert_pass 'the emergency switch takes the plugin out of the bundles'
+  fi
+  if ls "$PROFILE"/package.json.bak-emergency-* >/dev/null 2>&1; then
+    assert_pass 'the emergency switch leaves a backup behind'
+  else
+    assert_fail 'the emergency switch leaves a backup behind' 'there is none'
+  fi
+fi
+
+# --- only the temp directory was touched ---
+if [ -n "$(find "$DRILL_DIR" -maxdepth 1 -name 'profile.broken-*' 2>/dev/null)" ]; then
+  assert_pass "$(t 'drill.assertOnlyTemp' 'the drill only touched its own temporary directory')"
+else
+  assert_fail "$(t 'drill.assertOnlyTemp' 'the drill only touched its own temporary directory')" 'nothing was touched'
+fi
+
+# --- cleanup ---
+rm -rf -- "$DRILL_DIR"
+if [ -e "$DRILL_DIR" ]; then
+  assert_fail "$(t 'drill.notCleaned' 'the temporary directory was not cleaned up, please delete it yourself: {0}')" "$DRILL_DIR"
+else
+  assert_pass "$(t 'drill.cleaned' 'the temporary directory is clean.')"
+fi
+
+if [ "$FAILED" -eq 0 ]; then
+  say "$(t 'drill.passed' 'the drill passed: broke it on purpose -> restored -> checked -> cleaned up.')"
+  exit 0
+fi
+say "$(fmt "$(t 'drill.failed' 'the drill failed: {0} assertions did not pass.')" "$FAILED")"
+exit 1