dsh-autorestart 0.8.4 → 0.8.6

package/scripts/clear-dsh-auth-cookies.mjs

@@ -0,0 +1,257 @@
+/**
+ * dsh-autorestart - remove the stale handshake cookies of the desktop app.
+ *
+ * WHY THIS FILE EXISTS:
+ *
+ * The desktop app mints ONE session cookie per launch:
+ *
+ *   dsh-auth-<base64url(sha256(host:port))>
+ *
+ * The name carries the port and the port is random on every launch, so every
+ * launch leaves a NEW cookie behind. The cookie lives 30 days (Max-Age=2592000)
+ * and a cookie does NOT carry a port - so the browser sends ALL of them, on
+ * every request, to 127.0.0.1.
+ *
+ * The host answers with Node's default max header size of 16384 bytes. With 71
+ * cookies the Cookie header alone is 16188 bytes; add the browser's own headers
+ * and the request is 16559 bytes -> the host answers 431 (Request Header Fields
+ * Too Large), the desktop app reports the misleading "desktop welcome: Web
+ * authentication failed" and dies on startup. The crash loop then triggers the
+ * official native-fatal recovery, which wipes the profile.
+ *
+ * Measured on this machine (real cookies, real browser headers):
+ *   70 cookies -> 16331 bytes -> 200 OK
+ *   71 cookies -> 16559 bytes -> 431 Request Header Fields Too Large
+ *
+ * The restart helper runs this BETWEEN the kill and the relaunch: at that
+ * moment Chromium has already exited and the database is not locked any more.
+ *
+ * THE MATCH IS DELIBERATELY WIDE (user decision, 2026-10-30):
+ *
+ *   host_key = '127.0.0.1' AND name LIKE 'dsh-auth-%'
+ *
+ * The official code that mints these cookies always writes `Path=/`, so the
+ * old condition `path = '/'` looked safe - and it was one assumption away from
+ * silently missing a cookie. A missed cookie still travels to 127.0.0.1 and
+ * still counts against the 16 KB header, while deleting one cookie too many
+ * costs a single re-login. The path is therefore NOT part of the condition.
+ * Nothing else in the jar is addressed: another host, another prefix, another
+ * column - all untouched.
+ *
+ * THE RESULT IS WRITTEN DOWN: this is the only process that knows how many
+ * rows it deleted, so it writes `<stateDir>/last-cookie-clear.json`
+ * (`{at, ok, removed, reason}`) and the plugin's health route reports it. The
+ * state directory is `DSH_AUTORESTART_STATE_DIR` when it is set (a drill or a
+ * test redirects it), otherwise the plugin's own state directory.
+ *
+ * RULES:
+ *   - Only the dsh-auth-* cookies of 127.0.0.1 are touched. The rest of the
+ *     jar is never read and never written.
+ *   - The whole Cookies FILE is never deleted.
+ *   - Every failure ends with exit code 0: a restart must never be blocked by
+ *     a cleanup that could not run.
+ *   - Pure ASCII, no byte order mark (see test/scripts-encoding.test.mjs).
+ */
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+/** The host whose cookies are addressed. */
+const HOST_KEY = '127.0.0.1';
+
+/** The name prefix the desktop app mints (`%` is the LIKE wildcard). */
+const COOKIE_PREFIX = 'dsh-auth-%';
+
+/** How many times the delete is retried while the database is still locked. */
+export const RETRIES = 20;
+
+/** How long the script waits between two attempts, in milliseconds. */
+export const RETRY_DELAY_MS = 500;
+
+/** The name of the file this script leaves its result in. */
+export const REPORT_NAME = 'last-cookie-clear.json';
+
+/** Where the outcome is written, so a failed cleanup is never silent. */
+const LOG_DIR = path.join(os.homedir(), '.dsh', 'storages', 'dsh-autorestart');
+
+/** The log file next to the result. */
+const LOG_FILE = path.join(LOG_DIR, 'clear-cookies.log');
+
+/**
+ * The state directory this run belongs to.
+ *
+ * `DSH_AUTORESTART_STATE_DIR` exists so a drill (or a test) can point the
+ * cleanup at its own directory instead of the real installation.
+ *
+ * @returns {string}
+ */
+export function stateDirOf() {
+  const override = typeof process.env.DSH_AUTORESTART_STATE_DIR === 'string'
+    ? process.env.DSH_AUTORESTART_STATE_DIR.trim()
+    : '';
+  return override === '' ? LOG_DIR : override;
+}
+
+/** The cookie jar of the desktop app. */
+export function cookieJarPath() {
+  const roaming = typeof process.env.APPDATA === 'string' && process.env.APPDATA !== ''
+    ? process.env.APPDATA
+    : path.join(os.homedir(), 'AppData', 'Roaming');
+  return path.join(roaming, '@deepseek-ai', 'dsh-desktop', 'Network', 'Cookies');
+}
+
+/**
+ * Append one line to the log. Logging must never break the restart, so every
+ * error here is swallowed on purpose.
+ *
+ * @param {string} line
+ * @param {string} [logFile]
+ */
+export function log(line, logFile = LOG_FILE) {
+  try {
+    fs.mkdirSync(path.dirname(logFile), { recursive: true });
+    fs.appendFileSync(logFile, new Date().toISOString() + ' ' + line + '\n', 'utf8');
+  } catch {
+    // A log that cannot be written is not a reason to stop the restart.
+  }
+}
+
+/**
+ * Write the result of this run next to the state, so the plugin can report it.
+ *
+ * Written with `.tmp` + rename: a cleanup that is killed halfway must not leave
+ * a truncated record behind (the health route would report a broken file).
+ *
+ * @param {{ stateDir?: string, at?: number, ok: boolean, removed: number|null, reason: string }} options
+ * @returns {string} the path it was written to ('' when there is no state dir)
+ */
+export function writeResult({ stateDir = stateDirOf(), at = Date.now(), ok, removed, reason }) {
+  const dir = typeof stateDir === 'string' ? stateDir.trim() : '';
+  if (dir === '') return '';
+  const target = path.join(dir, REPORT_NAME);
+  const report = {
+    version: 1,
+    at,
+    atIso: new Date(at).toISOString(),
+    ok: ok === true,
+    removed: Number.isFinite(Number(removed)) ? Math.max(0, Math.trunc(Number(removed))) : null,
+    reason: typeof reason === 'string' ? reason : '',
+  };
+  try {
+    fs.mkdirSync(dir, { recursive: true });
+    const temporary = target + '.tmp';
+    fs.writeFileSync(temporary, JSON.stringify(report, null, 2) + '\n', 'utf8');
+    fs.renameSync(temporary, target);
+    return target;
+  } catch {
+    return '';
+  }
+}
+
+/** Wait a moment. @param {number} ms */
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+/**
+ * Delete the stale handshake cookies. Retries while the database is locked by
+ * a Chromium that has not exited yet.
+ *
+ * The condition is `host_key` + `name LIKE` ONLY - see the header: a cookie
+ * with another path would still be sent to 127.0.0.1, so the path is not part
+ * of the match.
+ *
+ * @param {{
+ *   jarPath?: string, retries?: number, retryDelayMs?: number,
+ *   openDb?: Function,
+ * }} [options]
+ * @returns {Promise<{ ok: boolean, removed: number, error: string|null }>}
+ */
+export async function clearCookies(options = {}) {
+  const jar = typeof options.jarPath === 'string' && options.jarPath !== '' ? options.jarPath : cookieJarPath();
+  const retries = Number.isFinite(Number(options.retries)) && Number(options.retries) > 0
+    ? Math.trunc(Number(options.retries))
+    : RETRIES;
+  const retryDelayMs = Number.isFinite(Number(options.retryDelayMs)) && Number(options.retryDelayMs) >= 0
+    ? Math.trunc(Number(options.retryDelayMs))
+    : RETRY_DELAY_MS;
+  const open = typeof options.openDb === 'function'
+    ? options.openDb
+    : async (target) => {
+      const { DatabaseSync } = await import('node:sqlite');
+      return new DatabaseSync(target);
+    };
+  let lastError = 'the cookie jar was never opened';
+  for (let attempt = 1; attempt <= retries; attempt += 1) {
+    try {
+      const db = await open(jar);
+      try {
+        const statement = db.prepare('delete from cookies where host_key = ? and name like ?');
+        const info = statement.run(HOST_KEY, COOKIE_PREFIX);
+        return { ok: true, removed: Number(info.changes || 0), error: null };
+      } finally {
+        if (db && typeof db.close === 'function') db.close();
+      }
+    } catch (error) {
+      lastError = String((error && error.message) || error);
+      if (attempt < retries) {
+        await sleep(retryDelayMs);
+      }
+    }
+  }
+  return { ok: false, removed: 0, error: lastError };
+}
+
+/**
+ * The whole job of this script: clear, write the result, log it.
+ *
+ * @param {{
+ *   jarPath?: string, stateDir?: string, retries?: number, retryDelayMs?: number,
+ *   logFile?: string, now?: number,
+ * }} [options]
+ * @returns {Promise<{ ok: boolean, removed: number, reason: string, reportPath: string }>}
+ */
+export async function run(options = {}) {
+  const stateDir = typeof options.stateDir === 'string' ? options.stateDir : stateDirOf();
+  const now = Number.isFinite(Number(options.now)) ? Number(options.now) : Date.now();
+  const result = await clearCookies({
+    jarPath: options.jarPath,
+    retries: options.retries,
+    retryDelayMs: options.retryDelayMs,
+  });
+  const reason = result.ok === true ? '' : String(result.error || 'the cleanup did not run');
+  const reportPath = writeResult({
+    stateDir,
+    at: now,
+    ok: result.ok === true,
+    removed: result.removed,
+    reason,
+  });
+  const jar = typeof options.jarPath === 'string' && options.jarPath !== '' ? options.jarPath : cookieJarPath();
+  if (result.ok === true) {
+    log('ok removed=' + result.removed + ' jar=' + jar, options.logFile || LOG_FILE);
+  } else {
+    log('skipped reason=' + reason + ' jar=' + jar, options.logFile || LOG_FILE);
+  }
+  return { ok: result.ok === true, removed: result.removed, reason, reportPath };
+}
+
+// The file is a script AND a module: the tests import the pieces above, the
+// restart helper RUNS it. Only a direct run does the work.
+const invokedDirectly = (() => {
+  try {
+    const entry = process.argv[1];
+    if (!entry) return false;
+    const self = new URL(import.meta.url).pathname.replace(/^\/([A-Za-z]:)/, '$1');
+    return path.resolve(entry) === path.resolve(decodeURIComponent(self));
+  } catch {
+    return false;
+  }
+})();
+
+if (invokedDirectly) {
+  await run();
+  // Always 0: a restart is never blocked by this cleanup.
+  process.exit(0);
+}

package/scripts/emergency-disable.sh

@@ -215,6 +215,56 @@ json_parses() {
   return 0
 }
 
+# Is every field of this package.json on ONE line?
+#
+# A compact profile (a generator, a bundler, a human with `jq -c`) puts the whole
+# document on a single line. The line-oriented sed below cannot work on that: it
+# deletes a WHOLE line (which would delete the entire file) and it appends after
+# a line that ENDS with `[` (which never happens when the array has members on
+# the same line). So a compact file takes the node path instead.
+compact_file() {
+  file="$1"
+  [ -n "$NODE_BIN" ] || return 1
+  [ -f "$file" ] || return 1
+  "$NODE_BIN" -e '
+    const fs = require("fs");
+    try {
+      const text = fs.readFileSync(process.argv[1], "utf8").replace(/^\uFEFF/, "");
+      process.exit(text.replace(/\r?\n$/, "").includes("\n") ? 1 : 0);
+    } catch (error) { process.exit(1); }
+  ' "$file" >/dev/null 2>&1
+}
+
+# Rewrite a COMPACT package.json on still ONE line, without touching anything but
+# the bundles array: the document is parsed, the name is removed from (or pushed
+# into) `dsh.profile.bundles`, and the result is serialized back to a single line
+# with the keys in their original order. Every other field, the name of the
+# profile included, keeps its value.
+#
+# Prints the new document on stdout; nothing is written here (the caller writes
+# it into the temp file it already knows how to swap in).
+compact_edit() {
+  file="$1"
+  action="$2"
+  "$NODE_BIN" -e '
+    const fs = require("fs");
+    const [file, action, name] = process.argv.slice(1);
+    const text = fs.readFileSync(file, "utf8").replace(/^\uFEFF/, "");
+    let doc;
+    try { doc = JSON.parse(text); } catch (error) { process.exit(3); }
+    const profile = doc && doc.dsh && doc.dsh.profile;
+    const bundles = profile && Array.isArray(profile.bundles) ? profile.bundles : null;
+    if (bundles === null) process.exit(4);
+    const next = bundles.filter((entry) => entry !== name);
+    // FIRST in the list, like the multi-line sed path does (it inserts right
+    // after the opening bracket). The two paths agree on order.
+    if (action === "enable") next.unshift(name);
+    profile.bundles = next;
+    const single = JSON.stringify(doc);
+    process.stdout.write(single + (text.endsWith("\n") ? "\n" : ""));
+  ' "$file" "$action" "$PACKAGE_NAME"
+}
+
 # --- Start ---
 
 if [ -n "$PACKAGE_JSON" ]; then
@@ -273,14 +323,31 @@ if [ "$DRY_RUN" -eq 1 ]; then
 fi
 
 # --- Back up, then write ---
-stamp=$(date -u +%Y%m%d-%H%M%S)
+# NEVER OVERWRITE AN EARLIER BACKUP (2026-11-03): the stamp carries milliseconds, and
+# when that name is still taken a serial number is appended. Before this the stamp
+# stopped at the second, so two writes inside one second left ONE backup.
+stamp=$(date -u +%Y%m%d-%H%M%S-%3N)
 backup="$pkg.bak-emergency-$stamp"
+serial=1
+while [ -e "$backup" ]; do
+  serial=$((serial + 1))
+  backup="$pkg.bak-emergency-$stamp-$serial"
+done
 if ! cp -- "$pkg" "$backup"; then
   fail "$(fmt "$(t 'emergency.backupFailed' 'the backup failed - the original file was not touched: {0}')" "$backup")"
 fi
 
 tmp="$pkg.tmp-emergency-$$"
-if [ "$ACTION" = 'disable' ]; then
+if compact_file "$pkg"; then
+  # ONE LINE IN, ONE LINE OUT: the document is edited as JSON and written back
+  # in the same style, because the line-oriented sed below has no line to work
+  # on (it would delete the whole file, or append after a line that never ends
+  # with the opening bracket).
+  if ! compact_edit "$pkg" "$ACTION" > "$tmp"; then
+    rm -f -- "$tmp" 2>/dev/null || true
+    fail "$(fmt "$(t 'emergency.writeFailed' 'the write failed - the backup is at {0}: {1}')" "$backup" "$pkg")"
+  fi
+elif [ "$ACTION" = 'disable' ]; then
   sed "/^[[:space:]]*\"$PACKAGE_NAME\"[[:space:]]*,\{0,1\}[[:space:]]*$/d" "$pkg" > "$tmp"
 else
   sed "s/^\\([[:space:]]*\"bundles\"[[:space:]]*:[[:space:]]*\\[\\)$/\\1\\n    \"$PACKAGE_NAME\",/" "$pkg" > "$tmp"

package/scripts/emergency-toggle.ps1

@@ -154,33 +154,65 @@ function Get-ArrayRange {
   throw 'the bundles array is not closed'
 }
 
-# Every item of the array: the name, the indentation, the comma, the position
-# in the text.
-function Get-Items {
+# The names of the bundles array, IN ORDER, whatever the layout is.
+#
+# Only the body of the array is scanned: Get-ArrayRange has already located it,
+# so a name can never be picked up from another part of the file. A
+# pretty-printed file (one item per line) and a MINIFIED one (["a","b"]) are
+# read the same way: the old line-based reader returned ZERO items for a
+# minified array, so "disable" answered "not in the bundles" and changed
+# nothing.
+function Get-BundleNames {
   param([string] $Text, [int] $Open, [int] $Close)
   $body = $Text.Substring($Open + 1, $Close - $Open - 1)
-  $items = @()
-  $pattern = '(?m)^(?<indent>[ \t]*)"(?<name>[^"]*)"(?<comma>,?)[ \t]*\r?$'
-  foreach ($match in [regex]::Matches($body, $pattern)) {
-    $lineStart = $Open + 1 + $match.Index
-    $lineEnd = $lineStart + $match.Length
-    # The line ending of that line (\r\n or \n) belongs to the line.
-    if ($lineEnd -lt $Text.Length -and $Text[$lineEnd] -eq "`n") { $lineEnd++ }
-    $nameGroup = $match.Groups['name']
-    $commaGroup = $match.Groups['comma']
-    $items += [pscustomobject]@{
-      Name       = $nameGroup.Value
-      Indent     = $match.Groups['indent'].Value
-      HasComma   = ($commaGroup.Value -eq ',')
-      CommaIndex = $commaGroup.Index
-      # The position right after the closing quote of the name (where the
-      # comma goes).
-      ContentEnd = $nameGroup.Index + $nameGroup.Length + 1
-      LineStart  = $lineStart
-      LineEnd    = $lineEnd
-    }
+  $names = @()
+  foreach ($match in [regex]::Matches($body, '"(?<name>(?:[^"\\]|\\.)*)"')) {
+    $names += $match.Groups['name'].Value
+  }
+  return $names
+}
+
+# How the array is laid out today, so the rewritten array looks like the old one.
+function Get-BundlesLayout {
+  param([string] $Text, [int] $Open, [int] $Close)
+  $body = $Text.Substring($Open + 1, $Close - $Open - 1)
+  $multiLine = $body.Contains("`n")
+  $indent = ''
+  $closeIndent = ''
+  if ($multiLine) {
+    $firstItem = [regex]::Match($body, '(?m)^(?<indent>[ \t]*)"')
+    if ($firstItem.Success) { $indent = $firstItem.Groups['indent'].Value }
+    else { $indent = (Get-LineIndent $Text $Close) + '  ' }
+    $closeIndent = Get-LineIndent $Text $Close
   }
-  return $items
+  return [pscustomobject]@{
+    MultiLine   = $multiLine
+    Indent      = $indent
+    CloseIndent = $closeIndent
+    Eol         = (Get-LineEnding $Text)
+  }
+}
+
+# The body of a bundles array for these names (the brackets stay where they are).
+#
+# THIS is what makes the comma impossible to get wrong: it is written BETWEEN
+# two items by the serializer, never by hand at a guessed offset. A one-item
+# array gets no comma at all, and no comma can land inside a name.
+#
+# A compact array stays compact (["a","b"]); a pretty-printed one stays one item
+# per line with the indentation the file already used.
+function Format-BundlesBody {
+  param([string[]] $Names, [object] $Layout)
+  $quoted = @()
+  foreach ($name in $Names) {
+    $escaped = $name -replace '\\', '\\'
+    $escaped = $escaped -replace '"', '\"'
+    $quoted += '"' + $escaped + '"'
+  }
+  if (-not $Layout.MultiLine) { return ($quoted -join ',') }
+  if ($quoted.Count -eq 0) { return ($Layout.Eol + $Layout.CloseIndent) }
+  $body = $Layout.Eol + $Layout.Indent + ($quoted -join (',' + $Layout.Eol + $Layout.Indent))
+  return ($body + $Layout.Eol + $Layout.CloseIndent)
 }
 
 # The indentation of a line (so a new line can look the same).
@@ -254,27 +286,18 @@ if ($Action -eq 'enable' -and -not $hasBundles) {
 
 $new = $raw
 $range = Get-ArrayRange $raw
-$items = Get-Items $raw $range[0] $range[1]
-$eol = Get-LineEnding $raw
+$names = @(Get-BundleNames $raw $range[0] $range[1])
+$layout = Get-BundlesLayout $raw $range[0] $range[1]
 
 if ($Action -eq 'disable') {
   if (-not $present) {
     Say ((T 'emergency.alreadyDisabled' 'already disabled: {0} was not in the bundles anyway (no file was changed).') -f $PackageName) 'Yellow'
     exit 0
   }
-  $target = $items | Where-Object { $_.Name -eq $PackageName } | Select-Object -First 1
-  if ($null -eq $target) { Fail ((T 'emergency.notInBundles' '{0} cannot be found in the bundles') -f $PackageName) }
-  $shift = 0
-  if (-not $target.HasComma) {
-    # It is the last item of the array: the comma of the item before it has to
-    # go, otherwise the JSON is invalid.
-    $previous = $items | Where-Object { $_.LineEnd -le $target.LineStart } | Select-Object -Last 1
-    if ($null -ne $previous -and $previous.HasComma) {
-      $new = $new.Remove($previous.CommaIndex, 1)
-      $shift = -1
-    }
-  }
-  $new = $new.Remove($target.LineStart + $shift, $target.LineEnd - $target.LineStart)
+  $kept = @()
+  foreach ($name in $names) { if ($name -ne $PackageName) { $kept += $name } }
+  $body = Format-BundlesBody $kept $layout
+  $new = $raw.Substring(0, $range[0] + 1) + $body + $raw.Substring($range[1])
   $summary = (T 'emergency.summaryRemove' 'take {0} out of the bundles') -f $PackageName
 } else {
   # enable
@@ -282,37 +305,20 @@ if ($Action -eq 'disable') {
     Say ((T 'emergency.alreadyEnabled' 'already enabled: {0} was in the bundles anyway (no file was changed).') -f $PackageName) 'Yellow'
     exit 0
   }
-  $anchor = $items | Where-Object { $_.Name -eq $AnchorName } | Select-Object -First 1
-  $line = ''
-  $insertAt = 0
-  if ($null -ne $anchor) {
-    if ($anchor.HasComma) {
-      $insertAt = $anchor.LineEnd
-      $line = $anchor.Indent + '"' + $PackageName + '",'
-    } else {
-      # The anchor is the last item: give it a comma first, then insert the new
-      # item (the new one has no comma).
-      $new = $new.Insert($anchor.ContentEnd, ',')
-      $insertAt = $anchor.LineEnd + 1
-      $line = $anchor.Indent + '"' + $PackageName + '"'
-    }
-  } else {
-    $last = $items | Select-Object -Last 1
-    if ($null -ne $last) {
-      if ($last.HasComma) {
-        $insertAt = $last.LineEnd
-      } else {
-        $new = $new.Insert($last.ContentEnd, ',')
-        $insertAt = $last.LineEnd + 1
-      }
-      $line = $last.Indent + '"' + $PackageName + '"'
-    } else {
-      # The array is empty.
-      $insertAt = $range[1]
-      $line = (Get-LineIndent $raw $range[1]) + '  "' + $PackageName + '"'
+  # Put it back right after the anchor when the anchor is there, otherwise at
+  # the end: the position does not matter, the JSON does.
+  $kept = @()
+  $inserted = $false
+  foreach ($name in $names) {
+    $kept += $name
+    if (-not $inserted -and $name -eq $AnchorName) {
+      $kept += $PackageName
+      $inserted = $true
     }
   }
-  $new = $new.Insert($insertAt, $line + $eol)
+  if (-not $inserted) { $kept += $PackageName }
+  $body = Format-BundlesBody $kept $layout
+  $new = $raw.Substring(0, $range[0] + 1) + $body + $raw.Substring($range[1])
   $summary = (T 'emergency.summaryAdd' 'put {0} back into the bundles') -f $PackageName
 }
 
@@ -329,7 +335,17 @@ if ($DryRun) {
 # back.
 # ---------------------------------------------------------------------------
 
-$backup = $path + '.bak-emergency-' + (Get-Date -Format 'yyyyMMdd-HHmmss')
+$stamp = Get-Date -Format 'yyyyMMdd-HHmmss-fff'
+$backup = $path + '.bak-emergency-' + $stamp
+# NEVER OVERWRITE AN EARLIER BACKUP (2026-11-03): the name carries milliseconds, and
+# if that name is still taken (two writes inside the same millisecond) a serial number
+# is appended. Before this, the name stopped at the second, so taking the plugin out
+# and putting it back within one second left ONE backup where there should be two.
+$serial = 1
+while (Test-Path -LiteralPath $backup) {
+  $serial += 1
+  $backup = $path + '.bak-emergency-' + $stamp + '-' + $serial
+}
 try {
   Copy-Item -LiteralPath $path -Destination $backup -Force
 } catch {

package/scripts/rescue-strings.zh.json

@@ -5,14 +5,12 @@
     "placeholders": "Values may contain {0}, {1} ... placeholders that the scripts fill in with -f formatting.",
     "fallback": "Every key has an English fallback inside the .ps1. If this file is missing or broken, the scripts say so in English and keep working in English."
   },
-
   "common": {
     "stringsMissing": "中文文案文件不在：{0}（改用英文兜底）",
     "stringsBroken": "中文文案文件读不出来：{0}（改用英文兜底）",
     "stringsMissingEn": "the Chinese strings file is missing: {0} (falling back to English messages)",
     "stringsBrokenEn": "the Chinese strings file could not be read: {0} (falling back to English messages)"
   },
-
   "restore": {
     "title": "dsh-autorestart —— profile 快照还原器",
     "failPrefix": "还原失败：",
@@ -30,7 +28,7 @@
     "usingSnapshot": "要用快照：{0}（{1}）",
     "snapshotMissing": "找不到这份快照：{0}",
     "snapshotNoManifest": "这份快照没有 manifest.json，不是一份快照：{0}",
-    "snapshotSuffix": "{0}（快照：{1}）",
+    "snapshotSuffix": "{0}（这份快照）",
     "dryRunMove": "[试运行] 会先把现在的 profile 挪到：{0}",
     "dryRunCopy": "[试运行] 会把 {0} 里的配置和插件复制回：{1}",
     "dryRunVerify": "[试运行] 会回读校验 package.json / dsh.profile.bundles / {0} 的版本号。",
@@ -47,20 +45,17 @@
     "noteNoPlugins": "（只有配置文件，没有插件）",
     "done": "已还原到 {0} 的快照{1}；现在可以重新打开 DSH。",
     "brokenLeft": "原来那份留在了：{0}（确认没问题之后可以自己删掉它）",
-
     "gateEmptyPath": "目标路径是空的",
     "gateDriveRoot": "拒绝动盘符根目录",
     "gateFsRoot": "拒绝动文件系统根目录",
     "gateHome": "拒绝动用户主目录本身",
     "gateSystemDir": "拒绝动系统目录：{0}",
     "gateOtherUser": "拒绝动别人的用户目录",
-
     "fingerprintNotProfile": "这里没有 package.json —— 不像 DSH profile",
     "fingerprintProfile": "profile 的 package.json 里有 dsh.profile",
     "fingerprintBrokenNoDsh": "profile 坏了（package.json 不再是 profile），但 profile 的文件还在",
     "fingerprintBrokenNoPkg": "profile 坏了（package.json 没了），但 profile 的文件还在",
     "fingerprintNotDshProfile": "package.json 里没有 dsh.profile，也没有别的东西能证明这是 profile",
-
     "snapshotDirMissing": "找不到快照目录：{0}",
     "snapshotNone": "这个目录里没有一份带 manifest 的快照：{0}",
     "snapshotNoConfigPkg": "这份快照里没有 config\\package.json",
@@ -68,7 +63,6 @@
     "snapshotNoDshProfile": "这份快照的 package.json 里没有 dsh.profile",
     "snapshotIsProfile": "这份快照里装的是一个 DSH profile",
     "snapshotUnknownTime": "时间不明",
-
     "verifyPkgLabel": "package.json 能解析",
     "verifyPkgMissing": "package.json 不存在",
     "verifyPkgBad": "不是合法的 JSON",
@@ -78,9 +72,20 @@
     "verifyPluginLabel": "{0} 的版本号读得到",
     "verifyPluginNotDeclared": "这个 profile 没有声明要装 {0}（没什么可读）",
     "verifyPluginMissing": "profile 里写着要装 {0}，但 node_modules\\{0} 不在 —— 配置说一套、磁盘是另一套",
-    "verifyPluginNoVersion": "读不到版本号"
+    "verifyPluginNoVersion": "读不到版本号",
+    "linkNone": "本快照里没有链接安装的插件",
+    "linkHeader": "本快照里链接安装的插件：{0} 个",
+    "linkKept": "  [ok] {0}：保留链接（目标目录还在）",
+    "linkReplaced": "  [ok] {0}：已用快照内容顶替链接（{1}）",
+    "linkDryRunReplaced": "  [演练] {0}：会用快照内容顶替",
+    "linkTargetMissing": "  [bad] {0}：链接目标已不存在，快照里也没有它的副本",
+    "linkNoBackup": "  [warn] {0}：快照里没有这个插件的副本，链接保持原样",
+    "linkRemoveFailed": "  [bad] {0}：删不掉这个链接，副本没有放进去",
+    "linkCopyFailed": "  [bad] {0}：副本放不进去：{1}",
+    "linkEvidence": "  （链接处置结论已写到 {0}）",
+    "linkEvidenceFailed": "  [warn] 链接处置结论没能写下来。",
+    "linkManifestUnreadable": "  [warn] 读不了备份的 manifest.json，无法检查链接安装的插件。"
   },
-
   "drill": {
     "dir": "演练目录：{0}",
     "broke": "已经故意弄坏：package.json 写成非法 JSON，插件目录删掉了。",
@@ -102,7 +107,6 @@
     "error": "演练出错：{0}",
     "noScript": "演练失败：找不到 {0}",
     "dirOccupied": "演练失败：这个演练目录已经被占用了：{0}",
-
     "assertDryRunExit": "试运行退出码是 0",
     "assertDryRunUntouched": "试运行没有改动 package.json",
     "assertDryRunNoBroken": "试运行没有留下 broken 目录",
@@ -128,17 +132,31 @@
     "assertCmdAscii": "restore-profile.cmd 是纯 ASCII",
     "assertOnlyTemp": "演练只在临时目录里动手（broken 目录在临时目录下面）",
     "assertLockFile": "演练目录里有锁文件",
-
     "keywords": {
-      "notProfile": ["不像", "不是 profile"],
-      "driveRoot": ["盘符", "根目录"],
-      "systemDir": ["系统目录", "不允许"],
-      "missingDir": ["不存在"],
-      "notValidated": ["没通过校验", "校验"],
-      "dryRun": ["试运行"]
+      "notProfile": [
+        "不像",
+        "不是 profile"
+      ],
+      "driveRoot": [
+        "盘符",
+        "根目录"
+      ],
+      "systemDir": [
+        "系统目录",
+        "不允许"
+      ],
+      "missingDir": [
+        "不存在"
+      ],
+      "notValidated": [
+        "没通过校验",
+        "校验"
+      ],
+      "dryRun": [
+        "试运行"
+      ]
     }
   },
-
   "emergency": {
     "failed": "急救开关失败：{0}",
     "notFound": "找不到 profile 的 package.json：{0}",