dsh-config-manager 0.1.53 → 0.1.55

package/README.md

@@ -7,7 +7,7 @@ Backup, restore, export, import, migrate and sync your complete DeepSeek Harness
 - 🔄 **Backup & Restore** DeepSeek Harness configuration
 - 📦 **Export / Import** complete DSH configuration
 - 🚚 **Migrate** DSH to another machine
-- ⏰ **Scheduled full backups** — automatic, on your own cadence (6h / 12h / 24h / 7d), secrets never included
+- ⏰ **Scheduled full backups** — automatic, on your own cadence (6h / 12h / 24h / 7d / custom weekly), secrets never included
 - 🔌 Backup installed **plugins** and plugin configuration
 - 🧩 Backup **MCP servers** and **Skills**
 - 🔐 Encrypted backups with optional credentials
@@ -56,7 +56,7 @@ Keep portable configuration synchronized between machines through a private Git
 
 ### Schedule automatic full backups
 
-Turn on scheduled backups (6h / 12h / 24h / 7d) and DSH quietly keeps a fresh full backup of your configuration in the background — secrets are never included, so it stays safe on disk without a password.
+Turn on scheduled backups (6h / 12h / 24h / 7d — or a **custom weekly weekday & time**) and DSH quietly keeps a fresh full backup of your configuration in the background — secrets are never included, so it stays safe on disk without a password. Consecutive failures are highlighted in red in the settings card.
 
 ### Discover & install configurations from the marketplace
 
@@ -79,7 +79,7 @@ Browse the built-in official market for ready-made configurations (model provide
 | 🔄 | **Remote Sync** | Push/pull portable config via **Git private repo or WebDAV** (secrets never sync) |
 | ⏰ | **Scheduled backups** | Full backup on a fixed cadence (6h / 12h / 24h / 7d) — set-and-forget, secrets never included |
 | 🛒 | **Config Marketplace** | Browse & one-click install community configs — supply-chain warnings + per-section approval |
-| 🗂️ | **Profiles** | Save multiple setups (Work / Personal) and switch anytime |
+| 🗂️ | **Profiles** | Save multiple setups (Work / Personal) and switch anytime — preview + auto-backup + rollback |
 | 🌐 | **Bilingual UI** | Interface, reports and error details follow the DSH app language (中文 / English) |
 | 🤖 | **Agent tools** | Backup / snapshot / restore / sync right from an agent session |
 
@@ -186,11 +186,16 @@ Copy the ZIP to Machine B (import)
 
 > Output: `dsh-config-<date>.zip` with manifest + per-category data + SHA-256 checksums.
 
+**Export extras:**
+- **Preview before export** — see what will be packaged (section count + estimated size, no secrets) before anything is written
+- **Custom file name & note** — name the ZIP yourself (auto-naming is the default) and attach an optional note that shows in the **Backup Files** list (the note travels with the self section when you sync/backup the config)
+
 ### 📥 Import (safe flow)
 
 - **Nothing is written before confirmation** — analyze & preview are zero-write
 - **Backup before applying** — the target config is snapshotted automatically
 - **Automatic rollback on failure** — full rollback or skip-and-continue, your choice
+- **Next-steps checklist after import** — the result page lists what needs a DSH restart (per plugin/MCP), credentials to re-enter, and failed/skipped items you can retry
 
 ### 👀 Import Preview (dry run)
 
@@ -242,13 +247,15 @@ Push / pull your portable config between machines through **either of two channe
 - **Switching channels starts fresh**: Git and WebDAV do **not** share snapshots or a common ancestor. When you switch transport, sync begins again from the new remote's empty baseline — push a fresh snapshot first.
 - **WebDAV auth** uses HTTP Basic: the `username` is stored in the config and may be echoed back into the UI, while the `password` is read live from the DSH credentials slot `DSH_CONFIG_MANAGER_SYNC_WEBDAV_PASSWORD` — it never appears in any sync file or log.
 - **Plugins auto-install**: when pulling diffs, plugins that are new in the backup are **installed automatically** on confirm — no manual per-item ticking in the diff list. Only **version-conflict** plugins still ask you to pick "Keep Current / Use Imported".
+- **Push preview before uploading** — the Push button first shows a read-only preview of what will be sent (sections + per-section counts + changed-vs-baseline markers, first-baseline notice) and only writes the remote after you confirm.
 
 ### 🛒 Configuration Marketplace
 
 Browse and install ready-made configurations (model providers, plugins, MCP servers, skills, agent presets…) shared by the community:
 
 - **Built-in official market** — read-only, bound to the official public repo (official badge shown, not editable); first open auto-refreshes, manual refresh also available
-- **Search & filter** — keyword search, category filter, source filter (Official / Community), sorting (recently updated / most starred / name A–Z), and a ⭐ badge showing the **source repo's** star count (queried anonymously, no token involved)
+- **Search & filter** — keyword search (matches name / description / author / **categories**), category filter, **section filter** (items already downloaded list their sections; others are excluded with a hint), source filter (Official / Community), sorting (recently updated / most starred / name A–Z), and a ⭐ badge showing the **source repo's** star count (queried anonymously, no token involved)
+- **Impact preview** — the detail view shows "what installing this will change" (items updated / identical / conflicts / secrets to re-enter / DSH restart needed) before you approve anything
 - **Supply-chain warnings always shown** — source repo URL, "not officially reviewed", download time; **per-section approval** — high-risk sections (sessions / arbitrary files) are banned from listing outright, and every remaining section must be explicitly approved before the import is confirmed
 - **Install reuses the safe import pipeline** — analyze → preview → auto-backup → apply → rollback; nothing is written before you confirm
 - **"My Configs"** — sign in with GitHub (device flow), upload a config to **your own public repo** in one click, and an **auto listing PR** is opened against the official market repo; manage your listings (status badges: not listed / PR pending / listed), update in one click, install back locally, or delist (auto de-listing PR)
@@ -257,6 +264,11 @@ Browse and install ready-made configurations (model providers, plugins, MCP serv
 
 Save multiple configurations (Work / Personal) and switch anytime; switching includes preview + auto-backup + rollback.
 
+- **Save current config** — pick a name and store the current DSH configuration (settings / providers / plugins / skills / agent presets…; no secrets, file sections embedded)
+- **Switch with safety** — preview first (zero writes) → confirm → automatic snapshot → staged apply; any failure rolls back fully
+- **Manage** — rename / delete (confirmed) / import an exported profile.json
+- Library is an independent tab: Settings → "Backup & Migration" → **Profiles**
+
 ### 📸 Snapshot restore (undo an import)
 
 Every import creates a **safety snapshot** first. If something feels off afterwards, restore the target back to its pre-import state:
@@ -270,6 +282,16 @@ Every import creates a **safety snapshot** first. If something feels off afterwa
 
 **GUI**: Settings → "Backup & Migration" → **Snapshots & Restore** tab → pick a snapshot → preview the plan (dry-run, zero writes) → confirm.
 
+**Snapshot management:**
+- **Retention is visible** — up to **10** snapshots are kept automatically (oldest pruned); the hint is shown in the list
+- **Pin important snapshots** — a pinned snapshot is exempt from auto-pruning and can only be deleted manually
+- **Manual delete** — remove any snapshot (danger, confirmed) when you no longer need that rollback point
+
+**Backup Files management** (same tab → "Backup Files"):
+- List every export ZIP (manual + scheduled) with source badge, size, time and your custom **note**
+- **Search** by file name or note
+- **Inspect / Compare** — read-only preview of what the backup contains (sections + per-section counts) and the diff against your current config (zero writes) before deciding to import
+
 ---
 
 ### 🚨 CLI — the first line of defense when DSH is broken

package/lib/adapters/file-collection.js

@@ -9,6 +9,7 @@
  */
 import path from 'node:path';
 import { sha256Hex } from "../utils/hashing.js";
+import { isReservedInternalRel, normalizePath } from "../utils/paths.js";
 import { msgOf, zhMsg } from "../core/messages.js";
 export class FileCollectionAdapter {
     async export(ctx, _options) {
@@ -40,6 +41,16 @@ export class FileCollectionAdapter {
         const items = [];
         for (const file of data.files) {
             const id = `${this.id}:${file.relativePath}`;
+            // F23 修复：不可信 import 不得写内部 control-plane namespace。
+            // 检查 baseDir+ref 解析后的 homeDir 相对路径（self 适配器 baseDir='dsh-config-manager' 是主投毒向量）。
+            const resolvedRel = normalizePath(path.join(this.baseDir, file.relativePath));
+            if (isReservedInternalRel(resolvedRel)) {
+                items.push({
+                    id, kind: 'Error', adapter: this.id,
+                    description: msg('adapter.fileReserved', { path: file.relativePath }), severity: 'error',
+                });
+                continue;
+            }
             let current = null;
             try {
                 current = await ctx.target.fs.readFile(path.join(this.baseDir, file.relativePath));
@@ -72,6 +83,11 @@ export class FileCollectionAdapter {
         const ref = item.target?.ref;
         if (!ref)
             return { ok: false, message: msg('adapter.missingTargetRef') };
+        // F23 修复：apply 前拒绝写内部 control-plane namespace（纵深防御，analyzeImport 已标 Error）
+        const resolvedRel = normalizePath(path.join(this.baseDir, ref));
+        if (isReservedInternalRel(resolvedRel)) {
+            return { ok: false, message: msg('adapter.fileReserved', { path: ref }) };
+        }
         const data = ctx.sections.get(this.id);
         const file = data?.files.find((f) => f.relativePath === ref);
         if (!file)

package/lib/adapters/file-collection.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-collection.js","sourceRoot":"","sources":["../../src/adapters/file-collection.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAQnD,MAAM,OAAgB,qBAAqB;IAQzC,KAAK,CAAC,MAAM,CAAC,GAAgB,EAAE,QAAuB;QACpD,MAAM,KAAK,GAA0B,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,IAAI,GAAa,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACxC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/G,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACjG,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,EAAE;YAClB,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE;YAC3B,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE;YAC/B,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAkB,EAAE,GAAkB;QACxD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,MAAM,KAAK,GAAe,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7C,IAAI,OAAO,GAAsB,IAAI,CAAC;YACtC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;YACrF,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;oBACpC,WAAW,EAAE,GAAG,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM;oBAC7G,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE;iBACrD,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1I,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;oBACtC,WAAW,EAAE,GAAG,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS;oBACtF,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE;iBACrD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAc,EAAE,GAAkB;QAChD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;QAC7B,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAA6B,CAAC;QACnE,MAAM,IAAI,GAAG,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,yBAAyB,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAClF,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAkB,EAAE,MAAe,KAAK;QACrD,MAAM,MAAM,GAA+B,EAAE,CAAC;QAC9C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,8BAA8B,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACpH,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACjI,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,wBAAwB,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAClH,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC3B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;oBACvG,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,mCAAmC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;gBACzG,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACtF,CAAC;CACF;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC"}
+{"version":3,"file":"file-collection.js","sourceRoot":"","sources":["../../src/adapters/file-collection.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAQnD,MAAM,OAAgB,qBAAqB;IAQzC,KAAK,CAAC,MAAM,CAAC,GAAgB,EAAE,QAAuB;QACpD,MAAM,KAAK,GAA0B,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,IAAI,GAAa,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACxC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/G,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACjG,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,EAAE;YAClB,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE;YAC3B,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE;YAC/B,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAkB,EAAE,GAAkB;QACxD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,MAAM,KAAK,GAAe,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7C,mDAAmD;YACnD,kFAAkF;YAClF,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;YAC9E,IAAI,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;gBACvC,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;oBACnC,WAAW,EAAE,GAAG,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO;iBACzF,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,OAAO,GAAsB,IAAI,CAAC;YACtC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;YACrF,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;oBACpC,WAAW,EAAE,GAAG,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM;oBAC7G,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE;iBACrD,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1I,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;oBACtC,WAAW,EAAE,GAAG,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS;oBACtF,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE;iBACrD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAc,EAAE,GAAkB;QAChD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;QAC7B,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACzE,2EAA2E;QAC3E,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAChE,IAAI,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC5E,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAA6B,CAAC;QACnE,MAAM,IAAI,GAAG,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,yBAAyB,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAClF,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAkB,EAAE,MAAe,KAAK;QACrD,MAAM,MAAM,GAA+B,EAAE,CAAC;QAC9C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,8BAA8B,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACpH,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACjI,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,wBAAwB,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAClH,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC3B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;oBACvG,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,mCAAmC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;gBACzG,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACtF,CAAC;CACF;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC"}

package/lib/adapters/plugin-files.js

@@ -8,7 +8,7 @@
  */
 import { sha256Hex } from "../utils/hashing.js";
 import { zhMsg } from "../core/messages.js";
-import { isPathSafe } from "../utils/paths.js";
+import { isPathSafe, isReservedInternalRel } from "../utils/paths.js";
 export const DEFAULT_PLUGIN_FILE_WHITELIST = ['dsh-ssh.json', 'pet.json'];
 export class PluginFilesAdapter {
     id = 'pluginFiles';
@@ -72,6 +72,14 @@ export class PluginFilesAdapter {
         const items = [];
         for (const file of data.files) {
             const id = `pluginFile:${file.relativePath}`;
+            // F23 修复：不可信 import 不得写内部 control-plane namespace（snapshots/transactions/locks/safe-mode）
+            if (isReservedInternalRel(file.relativePath)) {
+                items.push({
+                    id, kind: 'Error', adapter: 'pluginFiles',
+                    description: msg('adapter.pluginFileReserved', { path: file.relativePath }), severity: 'error',
+                });
+                continue;
+            }
             let current = null;
             try {
                 current = await ctx.target.fs.readFile(file.relativePath);
@@ -103,6 +111,10 @@ export class PluginFilesAdapter {
         const ref = item.target?.ref;
         if (!ref)
             return { ok: false, message: ctx.msg('adapter.missingTargetRef') };
+        // F23 修复：apply 前拒绝写内部 control-plane namespace（纵深防御，analyzeImport 已标 Error）
+        if (isReservedInternalRel(ref)) {
+            return { ok: false, message: ctx.msg('adapter.pluginFileReserved', { path: ref }) };
+        }
         const data = ctx.sections.get('pluginFiles');
         const file = data?.files.find((f) => f.relativePath === ref);
         if (!file)

package/lib/adapters/plugin-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-files.js","sourceRoot":"","sources":["../../src/adapters/plugin-files.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAQ/C,MAAM,CAAC,MAAM,6BAA6B,GAAsB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;AAE7F,MAAM,OAAO,kBAAkB;IACpB,EAAE,GAAG,aAAsB,CAAC;IAC5B,WAAW,GAAG,cAAc,CAAC;IAC7B,eAAe,GAAG,KAAK,CAAC;IACxB,WAAW,GAAG,gBAAyB,CAAC;IAChC,SAAS,CAAW;IACrC,wEAAwE;IACvD,UAAU,CAAU;IAErC,YAAY,YAAsB,CAAC,GAAG,6BAA6B,CAAC,EAAE,UAAmB;QACvF,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,kDAAkD,UAAU,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAgB,EAAE,QAAuB;QACpD,MAAM,KAAK,GAA0B,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,yCAAyC;QACzC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACxC,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACtE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;QACD,2CAA2C;QAC3C,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,IAAI,GAAa,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW;YACb,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC5B,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;oBACxC,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACxE,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO;YACL,SAAS,EAAE,aAAa;YACxB,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE;YAC3B,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE;YAC/B,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAkB,EAAE,GAAkB;QACxD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,MAAM,KAAK,GAAe,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,EAAE,GAAG,cAAc,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7C,IAAI,OAAO,GAAsB,IAAI,CAAC;YACtC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa;oBAC1C,WAAW,EAAE,GAAG,CAAC,0BAA0B,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM;oBAC3F,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE;iBAC3D,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAChJ,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa;oBAC5C,WAAW,EAAE,GAAG,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS;oBACtF,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE;iBAC3D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAc,EAAE,GAAkB;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;QAC7B,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAA6B,CAAC;QACzE,MAAM,IAAI,GAAG,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACtF,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAkB,EAAE,MAAe,KAAK;QACrD,MAAM,MAAM,GAA+B,EAAE,CAAC;QAC9C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,yBAAyB,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC3I,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACjI,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,wBAAwB,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACtF,CAAC;CACF"}
+{"version":3,"file":"plugin-files.js","sourceRoot":"","sources":["../../src/adapters/plugin-files.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAQtE,MAAM,CAAC,MAAM,6BAA6B,GAAsB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;AAE7F,MAAM,OAAO,kBAAkB;IACpB,EAAE,GAAG,aAAsB,CAAC;IAC5B,WAAW,GAAG,cAAc,CAAC;IAC7B,eAAe,GAAG,KAAK,CAAC;IACxB,WAAW,GAAG,gBAAyB,CAAC;IAChC,SAAS,CAAW;IACrC,wEAAwE;IACvD,UAAU,CAAU;IAErC,YAAY,YAAsB,CAAC,GAAG,6BAA6B,CAAC,EAAE,UAAmB;QACvF,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,kDAAkD,UAAU,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAgB,EAAE,QAAuB;QACpD,MAAM,KAAK,GAA0B,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,yCAAyC;QACzC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACxC,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACtE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;QACD,2CAA2C;QAC3C,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,IAAI,GAAa,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW;YACb,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC5B,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;oBACxC,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACxE,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO;YACL,SAAS,EAAE,aAAa;YACxB,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE;YAC3B,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE;YAC/B,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAkB,EAAE,GAAkB;QACxD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,MAAM,KAAK,GAAe,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,EAAE,GAAG,cAAc,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7C,0FAA0F;YAC1F,IAAI,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7C,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa;oBACzC,WAAW,EAAE,GAAG,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO;iBAC/F,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,OAAO,GAAsB,IAAI,CAAC;YACtC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa;oBAC1C,WAAW,EAAE,GAAG,CAAC,0BAA0B,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM;oBAC3F,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE;iBAC3D,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAChJ,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa;oBAC5C,WAAW,EAAE,GAAG,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS;oBACtF,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE;iBAC3D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAc,EAAE,GAAkB;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;QAC7B,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAC7E,2EAA2E;QAC3E,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACtF,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAA6B,CAAC;QACzE,MAAM,IAAI,GAAG,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACtF,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAkB,EAAE,MAAe,KAAK;QACrD,MAAM,MAAM,GAA+B,EAAE,CAAC;QAC9C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,yBAAyB,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC3I,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACjI,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,wBAAwB,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACtF,CAAC;CACF"}

package/lib/adapters/self.js

@@ -33,6 +33,9 @@ export const SELF_CONFIG_FILES = [
     'sync/ui-prefs.json',
     'sync/backup-schedule.json',
     'market/market-config.json',
+    // P0-④：导出产物备注清单（exports/.backup-notes.json）——随 self 分区迁移，
+    // 换机器后备份列表仍能看到手动导出时填写的备注
+    'exports/.backup-notes.json',
 ];
 export class SelfAdapter extends FileCollectionAdapter {
     id = 'self';

package/lib/adapters/self.js.map

@@ -1 +1 @@
-{"version":3,"file":"self.js","sourceRoot":"","sources":["../../src/adapters/self.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAG5C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,gEAAgE;AAChE,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,uBAAuB;IACvB,yBAAyB;IACzB,0BAA0B;IAC1B,oBAAoB;IACpB,2BAA2B;IAC3B,2BAA2B;CAC5B,CAAC;AAEF,MAAM,OAAO,WAAY,SAAQ,qBAAqB;IAC3C,EAAE,GAAG,MAAe,CAAC;IACrB,WAAW,GAAG,oBAAoB,CAAC;IACnC,eAAe,GAAG,IAAI,CAAC;IACvB,WAAW,GAAG,UAAmB,CAAC;IAC3C,kEAAkE;IACzD,OAAO,CAAS;IAEzB,YAAY,OAAO,GAAG,oBAAoB;QACxC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;iGAC6F;IACpF,KAAK,CAAC,MAAM,CAAC,GAAgB,EAAE,QAAuB;QAC7D,MAAM,KAAK,GAA0B,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;YACpC,oEAAoE;YACpE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACnF,IAAI,IAAI,KAAK,IAAI;gBAAE,SAAS,CAAC,0BAA0B;YACvD,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,EAAE;YAClB,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE;YAC3B,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE;YAC/B,QAAQ;SACT,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"self.js","sourceRoot":"","sources":["../../src/adapters/self.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAG5C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,gEAAgE;AAChE,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,uBAAuB;IACvB,yBAAyB;IACzB,0BAA0B;IAC1B,oBAAoB;IACpB,2BAA2B;IAC3B,2BAA2B;IAC3B,0DAA0D;IAC1D,yBAAyB;IACzB,4BAA4B;CAC7B,CAAC;AAEF,MAAM,OAAO,WAAY,SAAQ,qBAAqB;IAC3C,EAAE,GAAG,MAAe,CAAC;IACrB,WAAW,GAAG,oBAAoB,CAAC;IACnC,eAAe,GAAG,IAAI,CAAC;IACvB,WAAW,GAAG,UAAmB,CAAC;IAC3C,kEAAkE;IACzD,OAAO,CAAS;IAEzB,YAAY,OAAO,GAAG,oBAAoB;QACxC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;iGAC6F;IACpF,KAAK,CAAC,MAAM,CAAC,GAAgB,EAAE,QAAuB;QAC7D,MAAM,KAAK,GAA0B,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;YACpC,oEAAoE;YACpE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACnF,IAAI,IAAI,KAAK,IAAI;gBAAE,SAAS,CAAC,0BAA0B;YACvD,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,EAAE;YAClB,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE;YAC3B,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE;YAC/B,QAAQ;SACT,CAAC;IACJ,CAAC;CACF"}

package/lib/cli/index.d.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { type SnapshotMeta } from '../core/restore.ts';
 import { type ReinstallItemId } from '../core/reinstall.ts';
-export type CliCommand = 'snapshots' | 'restore' | 'reinstall' | 'help';
+export type CliCommand = 'snapshots' | 'restore' | 'reinstall' | 'recover-stale-lock' | 'help';
 export interface CliOptions {
     command: CliCommand;
     /** --data-dir：快照数据目录覆盖 */
@@ -40,6 +40,8 @@ export declare function parseConfirmInput(text: string): boolean;
 export declare function resolveDshHome(env?: Record<string, string | undefined>): string;
 /** 快照数据目录：--data-dir 覆盖优先，缺省 $DSH_HOME/dsh-config-manager/snapshots */
 export declare function resolveDataDir(flag: string | undefined, env?: Record<string, string | undefined>): string;
+/** 检查 Phase 3 SAFE MODE：存在未恢复 transaction → CLI destructive 应拒绝（返回错误文案，否则 null）。 */
+export declare function checkSafeModeBlocked(homeDir: string): string | null;
 /** 快照 id 校验：拒绝路径分隔符/保留名（防 join 越界） */
 export declare function validateSnapshotId(id: string): string;
 /** 缺省快照选择：metas 已按 createdAt 倒序，取第一个 status !== 'rolled-back' */

package/lib/cli/index.js

@@ -15,13 +15,16 @@
  * 缺省数据目录 = $DSH_HOME/dsh-config-manager/snapshots（$DSH_HOME 缺省 ~/.dsh）。
  */
 import os from 'node:os';
+import fssync from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { execFile } from 'node:child_process';
 import { createInterface } from 'node:readline/promises';
 import { stdin as processStdin, stdout as processStdout } from 'node:process';
 import { listSnapshots, planRestore, restore, } from "../core/restore.js";
-import { REINSTALL_ITEMS, buildReinstallPlan, isWindows, } from "../core/reinstall.js";
+import { REINSTALL_ITEMS, buildReinstallPlan, isWindows, detectInstalledDshVersion, writeReinstallRecoveryPoint, } from "../core/reinstall.js";
+import { EnvironmentLockManager, runWithMutationLock, EnvironmentLockUnavailableError } from "../utils/env-lock.js";
+import { Phase3Recovery } from "../core/phase3-host.js";
 const VALUE_FLAGS = new Map([
     ['--data-dir', 'dataDir'],
     ['--id', 'id'],
@@ -32,6 +35,30 @@ const VALUE_FLAGS = new Map([
 const RESTORE_ONLY_FLAGS = new Set(['--id', '--dry-run', '--profile', '--settings']);
 /** 仅 reinstall 子命令允许的参数 */
 const REINSTALL_ONLY_FLAGS = new Set(['--yes', '--list', '--wipe-config', '--version']);
+/** recover-stale-lock 专用解析：只接受 --data-dir（用于定位 locks 目录），返回 dataDir 选项 */
+function parseCliDataDir(argv) {
+    const options = { command: 'recover-stale-lock', dryRun: false, profile: 'web', yes: false, list: false, wipeConfig: false };
+    for (let i = 1; i < argv.length; i += 1) {
+        const flag = argv[i];
+        if (flag === '--data-dir') {
+            const value = argv[i + 1];
+            if (value === undefined || value === '' || value.startsWith('-')) {
+                return { ok: false, error: '参数 --data-dir 缺少值 / missing value for --data-dir' };
+            }
+            options.dataDir = value;
+            i += 1;
+        }
+        else if (flag.startsWith('--data-dir=')) {
+            options.dataDir = flag.slice('--data-dir='.length);
+            if (options.dataDir === '')
+                return { ok: false, error: '参数 --data-dir 缺少值 / missing value for --data-dir' };
+        }
+        else {
+            return { ok: false, error: `未知参数 / unknown flag: ${flag}` };
+        }
+    }
+    return { ok: true, options };
+}
 /** 解析 CLI 参数（纯函数；help 返回 command:'help'，未知/缺值返回错误） */
 export function parseCli(argv) {
     const command = argv[0];
@@ -40,9 +67,18 @@ export function parseCli(argv) {
     if (command === '--help' || command === '-h' || command === 'help') {
         return { ok: true, options: { command: 'help', dryRun: false, profile: 'web', yes: false, list: false, wipeConfig: false } };
     }
-    if (command !== 'snapshots' && command !== 'restore' && command !== 'reinstall') {
+    if (command !== 'snapshots' && command !== 'restore' && command !== 'reinstall' && command !== 'recover-stale-lock') {
         return { ok: false, error: `未知子命令 / unknown subcommand: ${command}` };
     }
+    if (command === 'recover-stale-lock') {
+        // recover-stale-lock：独立显式 recovery，不接受 destructive 执行参数（只能 --data-dir 定位锁目录）
+        for (const flag of argv.slice(1)) {
+            if (flag !== '--data-dir' && !flag.startsWith('--data-dir=') && !flag.startsWith('-')) {
+                return { ok: false, error: `recover-stale-lock 只接受 --data-dir / accepts only --data-dir` };
+            }
+        }
+        return parseCliDataDir(argv);
+    }
     const options = { command, dryRun: false, profile: 'web', yes: false, list: false, wipeConfig: false };
     const rest = argv.slice(1);
     for (let i = 0; i < rest.length; i += 1) {
@@ -128,6 +164,26 @@ export function resolveDataDir(flag, env = process.env) {
         return flag;
     return path.join(resolveDshHome(env), 'dsh-config-manager', 'snapshots');
 }
+/** Phase 3 SAFE MODE durable 标记路径：<dataDir>/transactions/safe-mode（dataDir = $DSH_HOME/dsh-config-manager）。 */
+function safeModeMarkerPath(homeDir) {
+    return path.join(homeDir, 'dsh-config-manager', 'transactions', 'safe-mode');
+}
+/** 检查 Phase 3 SAFE MODE：存在未恢复 transaction → CLI destructive 应拒绝（返回错误文案，否则 null）。 */
+export function checkSafeModeBlocked(homeDir) {
+    try {
+        const p = safeModeMarkerPath(homeDir);
+        if (fssync.existsSync(p)) {
+            const text = fssync.readFileSync(p, 'utf8');
+            if (/blocked|true/i.test(text)) {
+                return '存在未恢复的配置 transaction（SAFE MODE 激活）。destructive 操作被阻断：请先用恢复流程处理（GUI 恢复 / 显式 recover）后再重试。';
+            }
+        }
+        return null;
+    }
+    catch {
+        return null; // 读不到标记不阻断（离线 CLI 保守放行读取类）
+    }
+}
 /** 快照 id 校验：拒绝路径分隔符/保留名（防 join 越界） */
 export function validateSnapshotId(id) {
     if (id === '' || id === '.' || id === '..' || id.includes('/') || id.includes('\\')) {
@@ -334,22 +390,87 @@ async function runReinstall(options, io, env, deps) {
             printReinstallPlan(plan, io);
             return 0;
         }
-        // 执行
+        // Phase 3 SAFE MODE：存在未恢复 transaction → 拒绝 destructive（CLI 不旁路 SAFE MODE）。
+        const safeMsg = checkSafeModeBlocked(resolveDshHome(env));
+        if (safeMsg !== null) {
+            io.error(`拒绝执行：${safeMsg}`);
+            return 1;
+        }
+        // 执行（Phase 2 锁：reinstall 卸载/清扫/重装属 GLOBAL destructive，必须成功获取环境锁）
+        const lockHome = resolveDshHome(env);
+        const lock = new EnvironmentLockManager({
+            locksDir: path.join(lockHome, 'dsh-config-manager', 'locks'),
+            op: 'cli-reinstall',
+            target: plan.version,
+            lockVersion: '0.1.0',
+        });
         const failed = [];
-        io.log(`开始重装 / reinstall started — 版本 ${plan.version}`);
-        for (const step of plan.steps) {
-            if (step.dangerous) {
-                io.log(`⚠ 危险步骤 / dangerous step: ${step.label}`);
-            }
-            try {
-                await exec(step.command);
-                io.log(`✔ ${step.label}`);
-            }
-            catch (err) {
-                const reason = err instanceof Error ? err.message : String(err);
-                failed.push({ label: step.label, command: step.command, reason });
-                io.error(`✘ ${step.label} — ${reason}`);
+        // Phase 3 P0-A：CLI reinstall 也建 intent journal（外部副作用不可证明 → crash 后 NEEDS_ATTENTION）。
+        const cliDataDir = path.join(lockHome, 'dsh-config-manager');
+        const recovery = new Phase3Recovery({ dataDir: cliDataDir, packageVersion: '0.1.0', fingerprintDataDir: cliDataDir });
+        await recovery.initFingerprint().catch(() => undefined);
+        try {
+            await runWithMutationLock(lock, { op: 'cli-reinstall', target: plan.version }, async (lockCtx) => {
+                const runReinstall = async (journalCtx) => {
+                    io.log(`开始重装 / reinstall started — 版本 ${plan.version}`);
+                    // Phase 4 F29/F30：在首个 destructive side effect（npm uninstall -g）前，写 durable
+                    // operation-bound recovery point。若涉及 program 步但无法探测旧版本 → fail-closed，不继续 uninstall。
+                    if (selection.has('program')) {
+                        const prev = await detectInstalledDshVersion(exec);
+                        if (prev === null) {
+                            const message = '无法探测当前已安装 DSH 版本，拒绝执行 program 步（fail-closed）：先手动确认 dsh --version 可用';
+                            failed.push({ label: 'program recovery point', command: 'detectInstalledDshVersion', reason: message });
+                            io.error(`✘ ${message}`);
+                            // 不执行任何步骤（避免在无 recovery point 下 uninstall）
+                            return;
+                        }
+                        try {
+                            const opId = journalCtx?.operationId ?? 'cli-reinstall';
+                            await writeReinstallRecoveryPoint(cliDataDir, {
+                                operationId: opId,
+                                environmentFingerprint: recovery.recoveryEnvFingerprint,
+                                previousInstalledVersion: prev,
+                                requestedTargetSpec: plan.version,
+                                createdAt: new Date().toISOString(),
+                                recoveryHint: `如需手动恢复此版本：npm install -g @deepseek-ai/dsh@${prev}`,
+                            });
+                        }
+                        catch (rpErr) {
+                            const message = `recovery point 写入失败，拒绝执行 program 步（fail-closed）：${rpErr instanceof Error ? rpErr.message : String(rpErr)}`;
+                            failed.push({ label: 'program recovery point', command: 'writeReinstallRecoveryPoint', reason: message });
+                            io.error(`✘ ${message}`);
+                            return;
+                        }
+                    }
+                    for (const step of plan.steps) {
+                        if (step.dangerous) {
+                            io.log(`⚠ 危险步骤 / dangerous step: ${step.label}`);
+                        }
+                        try {
+                            await exec(step.command);
+                            io.log(`✔ ${step.label}`);
+                        }
+                        catch (err) {
+                            const reason = err instanceof Error ? err.message : String(err);
+                            failed.push({ label: step.label, command: step.command, reason });
+                            io.error(`✘ ${step.label} — ${reason}`);
+                        }
+                    }
+                };
+                if (lockCtx !== null) {
+                    await recovery.runExternalIntent({ operationType: 'cli-reinstall', lockCtx, intent: { adapter: 'dsh', ref: 'program', kind: 'Reinstall' }, fn: runReinstall });
+                }
+                else {
+                    await runReinstall();
+                }
+            });
+        }
+        catch (err) {
+            if (err instanceof EnvironmentLockUnavailableError) {
+                io.error(`拒绝执行：${err.message}`);
+                return 1;
             }
+            throw err;
         }
         io.log(failed.length === 0 ? '重装完成 / reinstall done' : `重装完成但有 ${failed.length} 步失败 / done with ${failed.length} failed step(s)`);
         for (const f of failed) {
@@ -382,7 +503,31 @@ export async function runCli(argv, io = defaultIo, env = process.env, deps = {})
     if (options.command === 'reinstall') {
         return runReinstall(options, io, env, deps);
     }
-    const dataDir = resolveDataDir(options.dataDir, env);
+    const lockDataDir = resolveDataDir(options.dataDir, env);
+    const lockHome = resolveDshHome(env);
+    // recover-stale-lock：独立显式 recovery（只 inspect + prove stale + 原子回收；不自动、无 --force）。
+    if (options.command === 'recover-stale-lock') {
+        const lock = new EnvironmentLockManager({
+            locksDir: path.join(lockHome, 'dsh-config-manager', 'locks'),
+            op: 'recover-stale-lock',
+            target: lockDataDir,
+            lockVersion: '0.1.0',
+        });
+        const insp = await lock.inspectLockState();
+        if (insp.state !== 'STALE_LOCK_DETECTED' && !(insp.state === 'UNKNOWN_STATE' && insp.detail?.includes('无有效 owner'))) {
+            // 非 stale 或无法证明 → 拒绝 recovery（owner healthy 的活锁绝不删）
+            io.error(`环境锁未判定为 stale（state=${insp.state}），拒绝 recovery。不会触碰活锁。/ lock not stale, recovery refused`);
+            return 1;
+        }
+        const result = await lock.recoverStaleLock();
+        if (result.ok && result.removed) {
+            io.log(`已回收 stale 环境锁 / stale lock recovered: ${result.detail ?? ''}`);
+            return 0;
+        }
+        io.error(`recovery 失败：${result.detail ?? '未知原因'}（可能二次验证失败，已保留 quarantine 文件供诊断）`);
+        return 1;
+    }
+    const dataDir = lockDataDir;
     if (options.command === 'snapshots') {
         const metas = await listSnapshots(dataDir);
         printSnapshots(metas, io);
@@ -411,14 +556,47 @@ export async function runCli(argv, io = defaultIo, env = process.env, deps = {})
         homeDir: resolveDshHome(env),
         profile: options.profile,
         settingsPath: options.settings,
+        // Phase 4 统一恢复校验（与 Host/ModelTools 同强度：存在/READY/manifest/blob-hash/symlink/provenance）
+        snapshotsRoot: dataDir,
     };
     if (options.dryRun) {
         printPlan(await planRestore(restoreOptions), io);
         return 0;
     }
-    const report = await restore(restoreOptions);
-    printReport(report, io);
-    return report.failed.length > 0 ? 1 : 0;
+    // Phase 3 SAFE MODE：存在未恢复 transaction → 拒绝 destructive（CLI 不旁路 SAFE MODE）。
+    const safeMsg2 = checkSafeModeBlocked(resolveDshHome(env));
+    if (safeMsg2 !== null) {
+        io.error(`拒绝执行：${safeMsg2}`);
+        return 1;
+    }
+    // Phase 2 锁：真实 restore 是 destructive（覆盖/删除 $DSH_HOME + 卸载插件），必须成功获取
+    // GLOBAL 环境锁；被另一 DSH 任务持有 → 明确报错退出（无 --force 旁路）。无锁目录 → 用默认 dataDir。
+    const lock = new EnvironmentLockManager({
+        locksDir: path.join(dataDir, '..', 'locks'),
+        op: 'cli-restore',
+        target: id,
+        lockVersion: '0.1.0',
+    });
+    try {
+        // Phase 3 P0-A：CLI restore 也创建 durable journal（关闭 bypass）。
+        const recovery = new Phase3Recovery({ dataDir: path.dirname(dataDir), packageVersion: '0.1.0', fingerprintDataDir: path.dirname(dataDir) });
+        await recovery.initFingerprint().catch(() => undefined);
+        const report = await runWithMutationLock(lock, { op: 'cli-restore', target: id }, async (lockCtx) => {
+            if (lockCtx !== null) {
+                return (await recovery.runJournaled({ operationType: 'cli-restore', lockCtx, fn: () => restore(restoreOptions) })).result;
+            }
+            return restore(restoreOptions);
+        });
+        printReport(report, io);
+        return report.failed.length > 0 ? 1 : 0;
+    }
+    catch (err) {
+        if (err instanceof EnvironmentLockUnavailableError) {
+            io.error(`拒绝执行：${err.message}`);
+            return 1;
+        }
+        throw err;
+    }
 }
 /* 直接运行（bin / node src/cli/index.ts）时进入主流程；被 import（测试）时不自动执行 */
 const isDirectRun = process.argv[1] !== undefined