dsh-config-manager 0.1.71 → 0.1.72

package/src/core/messages.ts

@@ -10,9 +10,12 @@
  *  - zh 值 = 既有中文文案原样（缺省行为/测试断言不变）；
  *  - en 值类型为 Record<keyof typeof zh, string> —— 缺键/多键即编译错误；
  *  - 消息以 {param} 插值，缺失参数原样保留，便于排查；
- *  - 未知键回退 zh，再回退键名本身（绝不抛错）。
+ *  - 未知键回退 zh，再回退键名本身（绝不抛错）；
+ *  - 目录是**追加式**的：新增键只追加，既有键的 zh/en 取值逐字不变（既有 372 键的指纹冻结在
+ *    src/core/engine-locale.test.ts）；registerMessageCatalog 注册的追加目录只在既有目录未命中时生效。
  */
-import type { MsgFunc, MsgParams } from './msg-types.ts';
+import type { MsgFunc } from './msg-types.ts';
+import { interpolate, registerBaseMessageCatalog, registeredMessage } from './engine-locale.ts';
 
 export type { MsgFunc, MsgParams } from './msg-types.ts';
 
@@ -132,6 +135,7 @@ export const zh = {
   'restore.hostSkipEscape': '宿主文件路径越界，跳过: {path}',
   'restore.hostSkipEscapeDetail': '快照登记路径越界，拒绝恢复',
   'restore.hostNoBlobInfo': '宿主文件 {path} 缺少 blob 副本，跳过',
+  'restore.hostUnreadable': '宿主文件 {path} 在拍快照时存在但读不出来（占用/权限），本次不动它；请手动核对',
   'restore.hostBlobMissing': '宿主文件 {path} 的 blob 缺失，跳过',
   'restore.hostRestore': '整文件还原 {path}',
   'restore.backupBeforeWrite': '还原前将备份当前文件到 pre-restore/',
@@ -200,6 +204,14 @@ export const zh = {
   'host.fsPathEscape': '路径越界: {path}',
   'host.activationRowFailed': '插件 {pkg} 已安装，但激活行写入 profile 补丁失败：{reason}（重启后该插件可能未激活；修复后重试安装即可幂等补行）',
   'host.syncTokenWriteFailed': 'token 写入 DSH credentials 失败：{reason}（请在 DSH 凭据管理里配置 {ref} 后重试）',
+  'host.syncWebdavPasswordWriteFailed': 'WebDAV 口令写入 DSH credentials 失败：{reason}（请在 DSH 凭据管理里配置 {ref} 后重试）',
+  'host.syncCredentialWriteFailed': '{kind} 写入 DSH credentials 失败：{reason}（请在 DSH 凭据管理里配置 {ref} 后重试）',
+  'host.syncKindS3Secret': 'S3 密钥',
+  'host.sessionFormatPathSeparator': '、',
+  'host.sessionFormatPathsTruncated': '{paths} 等',
+  'host.snapshotPruneSummary': '自动保留清理删除 {count} 个旧快照',
+  'host.autosyncSummary': '自动同步 {direction}{transportSuffix}',
+  'host.autosyncTransportSuffix': '（{transport}）',
   'host.githubMissingClientId': '未配置 GitHub OAuth client_id：请在插件配置中设置 githubClientId（GitHub → Settings → Developer settings → OAuth Apps 注册应用获取）',
   'host.githubFlowGone': 'GitHub 登录流程不存在或已过期，请重新开始',
   'host.restoreBlobEscape': 'blob 路径越界: {blob}',
@@ -221,6 +233,9 @@ export const zh = {
   'adapter.linksFollowed': '{type} 分区：已跟随 {count} 个链接目录收集内容（导入时按普通目录还原，链接结构不会重建）',
   'adapter.linksSkipped': '{type} 分区：{count} 个链接被跳过，其内容**未进备份** —— {detail}',
   'adapter.dirsUnreadable': '{type} 分区：{count} 个目录读取失败（权限/竞态），其内容**未进备份** —— {detail}',
+  'adapter.depsDirsSkipped': '{type} 分区：{count} 个运行时依赖目录（node_modules）未进备份（可由包内 package.json / lock 重建，目标机需重新安装依赖）—— {detail}',
+  'adapter.depsDirFiles': '{count} 个文件',
+  'adapter.depsDirFilesUnknown': '文件数未统计（超过计数上限）',
   'adapter.fileSectionByteLimit': '{type} 分区累计体积达到单分区上限 {limit}（实际保留 {kept}）：{count} 个单元整块未进备份（单元不可拆分，宁可少带不可半带）—— {detail}',
   'adapter.linkReason.loop': '自引用/重复链接',
   'adapter.linkReason.outsideHome': '目标在 DSH home 之外',
@@ -373,6 +388,15 @@ export const zh = {
   'sync.git.repoUnreachable': '仓库不可达或认证失败: {url}',
   'sync.git.workDirNotRepo': 'workDir 不是 git 仓库（缺少 .git）且目录非空，无法 clone: {dir}',
   'sync.git.pullFailed': 'git pull 失败: {err}',
+  // issue #79：主机密钥与「换仓库地址」两类失败此前只透出 git 原始 stderr，用户无从下手
+  'sync.git.hostKeyUnverified': 'SSH 主机密钥校验失败：本机 known_hosts 里没有 {host} 的密钥（或密钥已变更），git 因此拒绝连接。请先核对主机指纹，再在本机执行 ssh-keyscan -p <端口> {host} >> ~/.ssh/known_hosts（或直接 ssh {host} 按提示确认）后重试 —— 插件不会自动信任任何主机。',
+  'sync.git.hostKeyUnverifiedNoHost': 'SSH 主机密钥校验失败：本机 known_hosts 里没有该主机的密钥（或密钥已变更），git 因此拒绝连接。请先核对主机指纹，再在本机用 ssh-keyscan 把该主机写入 ~/.ssh/known_hosts（或直接 ssh 该主机按提示确认）后重试 —— 插件不会自动信任任何主机。',
+  'sync.git.historyDiverged': '本地工作副本 {dir} 与远端不是同一条历史（远端换了仓库，或远端历史被重写）：已拒绝合并。请把仓库地址改回原仓库，或在「同步 → 通道配置」里重建工作副本。',
+  'sync.workdirModeInvalid': '重建工作副本的模式非法: {mode}（只允许 relink（重指向地址）或 reclone（重新克隆））',
+  'sync.workdirRecloneNeedsConfirm': '重新克隆工作副本会丢弃工作副本里尚未推送的本地提交，必须显式确认后再执行（confirm: true）。',
+  'sync.workdirNotConfigured': '尚未配置 git 仓库地址，无法重建工作副本。',
+  'sync.workdirRelinked': '工作副本的 origin 已重指向当前仓库地址（工作树与本地提交未改动）。',
+  'sync.workdirRecloned': '工作副本已重新克隆（原有本地提交已丢弃，远端快照已同步回本地副本）。',
   'sync.git.cmdFailed': 'git {args} 失败 (exit {code}): {err}',
   // 推送认证（真机：公开仓库拉取可匿名成功、推送必失败，git 原文只说「Invalid username or token」）
   'sync.git.pushTokenRequired': '推送需要访问令牌：远端是 http(s) 仓库，但本机没有可用的令牌（拉取公开仓库可以匿名完成，推送必须认证）。请在「同步 → 通道配置」里登录 GitHub 或填入访问令牌后重试。',
@@ -410,6 +434,37 @@ export const zh = {
   'market.zipTooLarge': 'config.zip 体积 {size} 超过上限 {limit} 字节',
   'market.invalid': '条目 {id} 校验未通过: {errors}',
   // ---------- 会话归位（issue #45：跨机恢复后按 cwd 归位到正确 projectKey） ----------
+  // ---------- 宿主斜杠命令 /rollback（command-rollback.ts；用户可见文案单一事实源） ----------
+  'command.rollback.commandDesc': '列出本会话的回退点；带 id 则回退到该点',
+  'command.rollback.commandDescAlias': '/rollback 的别名（等同）',
+  'command.rollback.commandInputHint': '[<回退点 id>]',
+  'command.rollback.usageInvalid': '用法：/rollback 列出本会话的回退点；/rollback <回退点 id> 回退到该点。（{detail}）',
+  'command.rollback.serviceUnavailable': '命令服务不可用，/rollback 未注册（{detail}）',
+  'command.rollback.registerFailed': '注册命令 /{name} 失败（{detail}）',
+  'command.rollback.sessionUnavailable': '拿不到当前会话，无法回退（{detail}）',
+  'command.rollback.storageUnavailable': '回滚点存储不可用：{detail}',
+  'command.rollback.listFailed': '读取回退点失败：{detail}',
+  'command.rollback.empty': '本会话还没有回退点：每回合结束会自动留点，先完成一个回合再试。',
+  'command.rollback.listTitle': '本会话的回退点：',
+  'command.rollback.listRow': '{index}. {id}  回合 {turn}  {createdAt}  {kind}  {state}  可回退性：{restorable}',
+  'command.rollback.listSeparator': '；',
+  'command.rollback.kindAuto': '自动留点',
+  'command.rollback.kindGuard': '救援点',
+  'command.rollback.stateNormal': '正常',
+  'command.rollback.stateProtected': '已保护（不可回退/不可删除）',
+  'command.rollback.stateIncomplete': '不完整（缺态，回退会拒绝）',
+  'command.rollback.turnUnknown': '未知',
+  'command.rollback.segmentWorkspace': '工作区',
+  'command.rollback.segmentSession': '会话',
+  'command.rollback.segmentLabel': '{state}（{label}）',
+  'command.rollback.restorableYes': '可回退',
+  'command.rollback.restorableNo': '不可回退',
+  'command.rollback.restorableSummary': '{parts} ⇒ {verdict}',
+  'command.rollback.rewindRestored': '已回退到 {id}。{detail}',
+  'command.rollback.rewindPartial': '回退只完成了一部分（会话段已 fork，工作区段见下）——{id}：{segments}。{detail}',
+  'command.rollback.segmentFacts': '段：{facts}',
+  'command.rollback.rewindFailed': '回退失败（{code}）：{id}。{detail}',
+  'command.rollback.mutationLocked': '当前不能写（{reason}），回退未执行：{id}。请先解除 SAFE MODE 或等其它任务结束。',
 } as const;
 
 export const en: Record<keyof typeof zh, string> = {
@@ -528,6 +583,7 @@ export const en: Record<keyof typeof zh, string> = {
   'restore.hostSkipEscape': 'Host file path outside home directory, skipped: {path}',
   'restore.hostSkipEscapeDetail': 'Snapshot-recorded path escapes the home root; restore refused',
   'restore.hostNoBlobInfo': 'Host file {path} has no blob copy, skipped',
+  'restore.hostUnreadable': 'Host file {path} existed when the snapshot was taken but could not be read (in use / permissions) — left untouched, please verify by hand',
   'restore.hostBlobMissing': 'Blob for host file {path} is missing, skipped',
   'restore.hostRestore': 'Restore whole file {path}',
   'restore.backupBeforeWrite': 'The current file will be backed up to pre-restore/ first',
@@ -596,6 +652,14 @@ export const en: Record<keyof typeof zh, string> = {
   'host.fsPathEscape': 'Path outside home directory: {path}',
   'host.activationRowFailed': 'Plugin {pkg} is installed, but writing the activation row into the profile patch failed: {reason} (the plugin may be inactive until restart; retrying the install after fixing is idempotent)',
   'host.syncTokenWriteFailed': 'Failed to write the token into DSH credentials: {reason} (configure {ref} in DSH credential management, then retry)',
+  'host.syncWebdavPasswordWriteFailed': 'Failed to write the WebDAV password into DSH credentials: {reason} (configure {ref} in DSH credential management, then retry)',
+  'host.syncCredentialWriteFailed': 'Failed to write {kind} into DSH credentials: {reason} (configure {ref} in DSH credential management, then retry)',
+  'host.syncKindS3Secret': 'the S3 secret',
+  'host.sessionFormatPathSeparator': ', ',
+  'host.sessionFormatPathsTruncated': '{paths}, among others',
+  'host.snapshotPruneSummary': 'Automatic retention cleanup removed {count} old snapshot(s)',
+  'host.autosyncSummary': 'Autosync {direction}{transportSuffix}',
+  'host.autosyncTransportSuffix': ' ({transport})',
   'host.githubMissingClientId': 'GitHub OAuth client_id is not configured: set githubClientId in the plugin config (GitHub → Settings → Developer settings → OAuth Apps → register an app)',
   'host.githubFlowGone': 'The GitHub sign-in flow does not exist or has expired; please start over',
   'host.restoreBlobEscape': 'Blob path outside snapshot directory: {blob}',
@@ -617,6 +681,9 @@ export const en: Record<keyof typeof zh, string> = {
   'adapter.linksFollowed': '{type}: followed {count} linked directories (restored as plain directories on import; link structure is not recreated)',
   'adapter.linksSkipped': '{type}: {count} links skipped and their content is NOT in this backup — {detail}',
   'adapter.dirsUnreadable': '{type}: {count} director(ies) could not be read (permissions/race) and their content is NOT in this backup — {detail}',
+  'adapter.depsDirsSkipped': '{type}: {count} runtime dependency director(ies) (node_modules) NOT in this backup (rebuildable from the bundled package.json / lock; reinstall on the target) — {detail}',
+  'adapter.depsDirFiles': '{count} file(s)',
+  'adapter.depsDirFilesUnknown': 'file count not measured (over the counting budget)',
   'adapter.fileSectionByteLimit': '{type} section reached the per-section byte limit {limit} ({kept} kept): {count} unit(s) skipped whole and NOT in this backup (units are never split) — {detail}',
   'adapter.linkReason.loop': 'self-referencing/duplicate link',
   'adapter.linkReason.outsideHome': 'target outside the DSH home',
@@ -769,6 +836,15 @@ export const en: Record<keyof typeof zh, string> = {
   'sync.git.repoUnreachable': 'Repository unreachable or authentication failed: {url}',
   'sync.git.workDirNotRepo': 'workDir is not a git repository (no .git) and the directory is not empty; cannot clone: {dir}',
   'sync.git.pullFailed': 'git pull failed: {err}',
+  // issue #79: host-key and "repository address changed" failures previously leaked raw git stderr
+  'sync.git.hostKeyUnverified': 'SSH host key verification failed: this machine has no key for {host} in known_hosts (or the key changed), so git refused to connect. Verify the host fingerprint first, then run ssh-keyscan -p <port> {host} >> ~/.ssh/known_hosts on this machine (or just ssh {host} and confirm the prompt), then retry — the plugin never trusts a host automatically.',
+  'sync.git.hostKeyUnverifiedNoHost': 'SSH host key verification failed: this machine has no key for that host in known_hosts (or the key changed), so git refused to connect. Verify the host fingerprint first, then add the host to ~/.ssh/known_hosts with ssh-keyscan (or just ssh the host and confirm the prompt), then retry — the plugin never trusts a host automatically.',
+  'sync.git.historyDiverged': 'The local working copy {dir} and the remote are not the same history (the remote repository was swapped, or its history was rewritten): merging was refused. Point the repository address back to the original repository, or rebuild the working copy in Sync → Channel configuration.',
+  'sync.workdirModeInvalid': 'Invalid working-copy rebuild mode: {mode} (only relink (re-point the address) or reclone (clone again) are allowed).',
+  'sync.workdirRecloneNeedsConfirm': 'Re-cloning the working copy discards local commits that were never pushed; it requires explicit confirmation (confirm: true).',
+  'sync.workdirNotConfigured': 'No git repository address is configured, so the working copy cannot be rebuilt.',
+  'sync.workdirRelinked': 'The working copy origin now points at the configured repository address (working tree and local commits untouched).',
+  'sync.workdirRecloned': 'The working copy was cloned again (local commits were discarded; remote snapshots are back in the local copy).',
   'sync.git.cmdFailed': 'git {args} failed (exit {code}): {err}',
   'sync.git.pushTokenRequired': 'Push requires an access token, but none is available on this machine (public repositories can be fetched anonymously; pushing always needs authentication). Sign in to GitHub or paste an access token under Sync → Channel configuration, then retry.',
   'sync.git.pushAuthFailed': 'Push authentication failed: {err}. Check that the token is valid and has write access to this repository (password authentication is disabled by the remote); a successful pull does not prove the token works — public repositories can be fetched anonymously. Sign in again or replace the token under Sync → Channel configuration.',
@@ -805,25 +881,52 @@ export const en: Record<keyof typeof zh, string> = {
   'market.zipTooLarge': 'config.zip size {size} exceeds the limit {limit} bytes',
   'market.invalid': 'Item {id} failed verification: {errors}',
   // ---------- session grouping (issue #45: relocate restored sessions by cwd) ----------
+  // ---------- host slash command /rollback (command-rollback.ts; single source of user-visible text) ----------
+  'command.rollback.commandDesc': 'List this session rollback points; with an id, rewind to that point',
+  'command.rollback.commandDescAlias': 'Alias for /rollback (identical)',
+  'command.rollback.commandInputHint': '[<rollback point id>]',
+  'command.rollback.usageInvalid': 'Usage: /rollback lists this session rollback points; /rollback <rollback point id> rewinds to that point. ({detail})',
+  'command.rollback.serviceUnavailable': 'Command service unavailable; /rollback was not registered ({detail})',
+  'command.rollback.registerFailed': 'Failed to register command /{name} ({detail})',
+  'command.rollback.sessionUnavailable': 'Cannot determine the current session; rewind is unavailable ({detail})',
+  'command.rollback.storageUnavailable': 'Rollback point storage is unavailable: {detail}',
+  'command.rollback.listFailed': 'Failed to read rollback points: {detail}',
+  'command.rollback.empty': 'This session has no rollback point yet: one is captured automatically when a turn ends, so finish a turn first.',
+  'command.rollback.listTitle': 'Rollback points of this session:',
+  'command.rollback.listRow': '{index}. {id}  turn {turn}  {createdAt}  {kind}  {state}  restorable: {restorable}',
+  'command.rollback.listSeparator': '; ',
+  'command.rollback.kindAuto': 'auto',
+  'command.rollback.kindGuard': 'rescue guard',
+  'command.rollback.stateNormal': 'normal',
+  'command.rollback.stateProtected': 'protected (not restorable / not deletable)',
+  'command.rollback.stateIncomplete': 'incomplete (missing state; rewind refuses)',
+  'command.rollback.turnUnknown': 'unknown',
+  'command.rollback.segmentWorkspace': 'workspace',
+  'command.rollback.segmentSession': 'session',
+  'command.rollback.segmentLabel': '{state} ({label})',
+  'command.rollback.restorableYes': 'restorable',
+  'command.rollback.restorableNo': 'not restorable',
+  'command.rollback.restorableSummary': '{parts} => {verdict}',
+  'command.rollback.rewindRestored': 'Rewound to {id}. {detail}',
+  'command.rollback.rewindPartial': 'The rewind only completed partially (session segment forked; see workspace segment below) - {id}: {segments}. {detail}',
+  'command.rollback.segmentFacts': 'segments: {facts}',
+  'command.rollback.rewindFailed': 'Rewind failed ({code}): {id}. {detail}',
+  'command.rollback.mutationLocked': 'Writing is currently blocked ({reason}); the rewind did not run: {id}. Clear SAFE MODE or wait for the running task to finish.',
 };
 
-/** 插值：{param} → 形参值；缺参原样保留（便于排查）。 */
-function interpolate(template: string, params?: MsgParams): string {
-  if (params === undefined) return template;
-  return template.replace(/\{(\w+)\}/g, (match, key: string) => {
-    const value = params[key];
-    return value === undefined ? match : String(value);
-  });
-}
-
-/** 构造 MsgFunc：en → en 目录（缺键回退 zh）；其余 → zh。 */
+/**
+ * 构造 MsgFunc：en → en 目录（缺键回退 zh）；其余 → zh。
+ *
+ * 查找顺序（自 t2 起）：既有目录 → en 语言下回退既有 zh → 注册目录（registerMessageCatalog；
+ * **只在既有目录未命中时生效**）→ 键名。既有 372 键的取值逐字不变（engine-locale.test.ts 有冻结指纹）。
+ * 插值实现已移入 engine-locale.ts（与 engineMsg 共用同一份，避免两份实现漂移）。
+ */
 export function makeMsg(lang: 'zh' | 'en' | string | undefined): MsgFunc {
-  const langKey = lang === 'en' ? 'en' : 'zh'
-  const dict = langKey === 'en' ? en : zh
-  const fallback = langKey === 'en' ? zh : undefined
+  const langKey: 'zh' | 'en' = lang === 'en' ? 'en' : 'zh'
+  const dict = (langKey === 'en' ? en : zh) as Readonly<Record<string, string>>
+  const fallback = langKey === 'en' ? (zh as Readonly<Record<string, string>>) : undefined
   return (key, params) => {
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const template = (dict as any)[key] ?? (fallback as any)?.[key] ?? key
+    const template = dict[key] ?? fallback?.[key] ?? registeredMessage(langKey, key) ?? key
     return interpolate(template, params)
   }
 }
@@ -831,6 +934,9 @@ export function makeMsg(lang: 'zh' | 'en' | string | undefined): MsgFunc {
 /** 缺省目录（zh）：未注入 msg 的引擎/测试路径使用，行为与改造前完全一致。 */
 export const zhMsg: MsgFunc = makeMsg('zh');
 
+/** 把基础目录交给引擎语言运行时（engineMsg 用；本模块不反向被 import，避免循环依赖）。 */
+registerBaseMessageCatalog({ zh, en });
+
 /** 从「可能携带 msg 的对象」取翻译器；缺省 zh。 */
 export function msgOf(ctx: { msg?: MsgFunc } | undefined): MsgFunc {
   return ctx?.msg ?? zhMsg;

package/src/core/migration-consult.ts

@@ -20,6 +20,7 @@
  * 复用现有：computeCompatibility（扩展而非重写）、validateManifest、scanAndRedact、
  * integrity/zip-security、import-wizard 分析管线（宿主填充 migratability）。
  */
+import { engineMsg } from './messages-core.ts';
 import { computeCompatibility } from './validator.ts';
 import type { CompatibilityScore } from './types.ts';
 import type { Manifest, SectionId } from '../schema/types.ts';
@@ -212,7 +213,7 @@ export function scoreCompatibility(
   if (data.manifest === null) {
     compat = 'unsupported';
     score = 0;
-    issues.push({ severity: 'error', code: 'compatibility.noManifest', message: '无法评估兼容性：manifest 缺失' });
+    issues.push({ severity: 'error', code: 'compatibility.noManifest', message: engineMsg('core.consult.compatNoManifest') });
   } else {
     compat = computeCompatibility({
       sourceDsh: data.sourceDsh,
@@ -227,11 +228,11 @@ export function scoreCompatibility(
       case 'good': score = 90; break;
       case 'partial':
         score = 60;
-        issues.push({ severity: 'warning', code: 'compatibility.partial', message: '部分兼容：跨平台 / 分区缺失 / 版本超前，需人工确认' });
+        issues.push({ severity: 'warning', code: 'compatibility.partial', message: engineMsg('core.consult.compatPartial') });
         break;
       case 'unsupported':
         score = 0;
-        issues.push({ severity: 'error', code: 'compatibility.unsupported', message: '不受支持：schema 超出本插件支持范围' });
+        issues.push({ severity: 'error', code: 'compatibility.unsupported', message: engineMsg('core.consult.compatUnsupported') });
         break;
     }
   }
@@ -244,30 +245,30 @@ export function scoreIntegrity(data: ConsultSourceData): HealthDimension {
   let score = 100;
   if (data.manifest === null) {
     score = 0;
-    issues.push({ severity: 'error', code: 'integrity.noManifest', message: 'manifest 缺失，无法校验结构完整性' });
+    issues.push({ severity: 'error', code: 'integrity.noManifest', message: engineMsg('core.consult.integrityNoManifest') });
   } else {
     for (const issue of data.manifestIssues) {
       if (issue.severity === 'error') {
         score -= 30;
-        issues.push({ severity: 'error', code: 'integrity.manifestInvalid', message: `manifest 无效：${issue.message}`, evidence: issue.path });
+        issues.push({ severity: 'error', code: 'integrity.manifestInvalid', message: engineMsg('core.consult.manifestInvalid', { message: issue.message }), evidence: issue.path });
       } else {
         score -= 10;
-        issues.push({ severity: 'warning', code: 'integrity.manifestWarning', message: `manifest 警告：${issue.message}`, evidence: issue.path });
+        issues.push({ severity: 'warning', code: 'integrity.manifestWarning', message: engineMsg('core.consult.manifestWarning', { message: issue.message }), evidence: issue.path });
       }
     }
   }
   for (const c of data.checksumIssues) {
     score -= 30;
-    issues.push({ severity: 'error', code: 'integrity.checksumMismatch', message: `完整性校验失败：${c}` });
+    issues.push({ severity: 'error', code: 'integrity.checksumMismatch', message: engineMsg('core.consult.checksumMismatch', { reason: c }) });
   }
   // 源无 checksum 表（manifest 存在但 checksums 缺失）→ warning（轻度完整性顾虑）
   if (data.manifest !== null && data.checksums === null) {
     score -= 10;
-    issues.push({ severity: 'warning', code: 'integrity.noChecksums', message: '源缺少 checksum 表，无法校验条目完整性' });
+    issues.push({ severity: 'warning', code: 'integrity.noChecksums', message: engineMsg('core.consult.noChecksums') });
   }
   for (const z of data.zipSlipIssues) {
     score -= 30;
-    issues.push({ severity: 'error', code: 'integrity.zipSlip', message: `ZIP 路径越界：${z}` });
+    issues.push({ severity: 'error', code: 'integrity.zipSlip', message: engineMsg('core.consult.zipSlip', { path: z }) });
   }
   return { id: 'integrity', score: clampScore(score), verdict: dimensionVerdict(issues), issues };
 }
@@ -278,7 +279,7 @@ export function scoreSections(data: ConsultSourceData): HealthDimension {
   let score = 100;
   for (const sid of data.missingSections) {
     score -= 20;
-    issues.push({ severity: 'warning', code: 'sections.missing', message: `声明包含但数据缺失：${sid}`, evidence: sid });
+    issues.push({ severity: 'warning', code: 'sections.missing', message: engineMsg('core.consult.sectionDataMissing', { section: sid }), evidence: sid });
   }
   // 分区数据不可解析（manifest 声明但 sections 中无对应数据且非 missingSections 覆盖）
   if (data.manifest !== null) {
@@ -287,7 +288,7 @@ export function scoreSections(data: ConsultSourceData): HealthDimension {
       if (data.missingSections.includes(sid)) continue;
       if (!data.sections.has(sid)) {
         score -= 30;
-        issues.push({ severity: 'error', code: 'sections.unparseable', message: `分区数据不可解析：${sid}`, evidence: sid });
+        issues.push({ severity: 'error', code: 'sections.unparseable', message: engineMsg('core.consult.sectionUnparseable', { section: sid }), evidence: sid });
       }
     }
   }
@@ -369,12 +370,12 @@ export function scoreConsistency(data: ConsultSourceData): HealthDimension {
   const dangling = [...referenced].filter((ref) => !declared.has(ref));
   if (dangling.length > 0) {
     score -= Math.min(dangling.length * 15, 45);
-    const shown = dangling.slice(0, 5).join('、');
-    const more = dangling.length > 5 ? ` 等 ${dangling.length} 个` : '';
+    const shown = dangling.slice(0, 5).join(engineMsg('core.consult.listSeparator'));
+    const more = dangling.length > 5 ? engineMsg('core.consult.andMore', { count: dangling.length }) : '';
     issues.push({
       severity: 'warning',
       code: 'consistency.danglingCredentialRef',
-      message: `备份引用了 ${dangling.length} 个未在凭据分区声明的凭据（导入后本机若缺值需补录）：${shown}${more}`,
+      message: engineMsg('core.consult.danglingCredentialRef', { count: dangling.length, shown, more }),
       evidence: dangling.join(', '),
     });
   }
@@ -387,7 +388,7 @@ export function scoreSensitive(data: ConsultSourceData): HealthDimension {
   let score = 100;
   if (data.containsSecrets && !data.encrypted) {
     score -= 40;
-    issues.push({ severity: 'error', code: 'sensitive.unencryptedSecrets', message: '快照含未加密秘密（凭据值明文暴露）' });
+    issues.push({ severity: 'error', code: 'sensitive.unencryptedSecrets', message: engineMsg('core.consult.unencryptedSecrets') });
   }
   const hitCount = data.sensitiveHits.length;
   if (hitCount > 0) {
@@ -396,7 +397,7 @@ export function scoreSensitive(data: ConsultSourceData): HealthDimension {
     issues.push({
       severity: 'warning',
       code: 'sensitive.hits',
-      message: `检测到 ${hitCount} 处敏感字段暴露（已脱敏）`,
+      message: engineMsg('core.consult.sensitiveHits', { count: hitCount }),
     });
   }
   return { id: 'sensitive', score: clampScore(score), verdict: dimensionVerdict(issues), issues };
@@ -410,10 +411,10 @@ export function scoreMigratability(data: ConsultSourceData): HealthDimension {
   if (m === null) {
     // 未评估可迁移性 = warning 级 → needs-attention（60），与 warning 标签一致（不落到 critical）
     score = 60;
-    issues.push({ severity: 'warning', code: 'migratability.notEvaluated', message: '未评估可迁移性（dry-run 未执行）' });
+    issues.push({ severity: 'warning', code: 'migratability.notEvaluated', message: engineMsg('core.consult.migratabilityNotEvaluated') });
   } else if (!m.ok) {
     score = 0;
-    issues.push({ severity: 'error', code: 'migratability.failed', message: '可迁移性检查失败：dry-run 无法通过' });
+    issues.push({ severity: 'error', code: 'migratability.failed', message: engineMsg('core.consult.migratabilityFailed') });
     for (const e of m.errors) {
       issues.push({ severity: 'error', code: 'migratability.error', message: e });
     }
@@ -429,7 +430,7 @@ export function scoreMigratability(data: ConsultSourceData): HealthDimension {
       issues.push({
         severity: 'warning',
         code: 'migratability.conflicts',
-        message: `有 ${m.fatalConflicts} 处冲突需要你决定保留哪一边（下一步可逐个选择；默认不覆盖本机）`,
+        message: engineMsg('core.consult.conflicts', { count: m.fatalConflicts }),
       });
     }
     if (m.warnings > 0) {
@@ -437,7 +438,7 @@ export function scoreMigratability(data: ConsultSourceData): HealthDimension {
       issues.push({
         severity: 'warning',
         code: 'migratability.warning',
-        message: `另有 ${m.warnings} 项需要留意（不影响导入能否成功）`,
+        message: engineMsg('core.consult.warnings', { count: m.warnings }),
       });
     }
   }

package/src/core/migration-history.ts

@@ -30,6 +30,7 @@ import { atomicWriteFile } from '../utils/atomic-write.ts';
 import { maskHighEntropy, redact } from '../security/redaction.ts';
 import { scanAndRedact } from '../security/secret-scanner.ts';
 import { sha256Hex } from '../utils/hashing.ts';
+import { coreText, engineMsg } from './messages-core.ts';
 
 // ---------- 常量 ----------
 
@@ -335,7 +336,7 @@ export class MigrationStore {
       await this.io.mkdir(this.dir, { recursive: true });
       let guard = 0;
       while (await this.io.exists(target)) {
-        if (++guard > 8) return { ok: false, entry, error: 'history filename collision (retry 上限)' };
+        if (++guard > 8) return { ok: false, entry, error: engineMsg('core.migrationHistory.filenameCollision') };
         filename = makeHistoryFilename(new Date(at + guard), entry.kind);
         target = path.join(this.dir, filename);
       }
@@ -420,10 +421,23 @@ export function summarizeHistory(entries: StoredMigrationHistoryEntry[]): Migrat
 
 /** 导出报告（纯函数）。渲染文本统一过 redact() 兜底（安全不变量）。 */
 export function renderExport(entries: StoredMigrationHistoryEntry[], format: ExportFormat, locale: 'zh' | 'en' = 'zh'): string {
-  const L = locale === 'zh'
-    ? { title: 'DSH 配置迁移历史', total: '总数', empty: '暂无迁移记录', kind: '操作', time: '时间', result: '结果', sections: '分区', detail: '摘要' }
-    : { title: 'DSH Config Migration History', total: 'Total', empty: 'No migration records', kind: 'Operation', time: 'Time', result: 'Result', sections: 'Sections', detail: 'Summary' };
-  const resultLabel = (r: MigrationResult): string => r === 'success' ? (locale === 'zh' ? '成功' : 'success') : r === 'failed' ? (locale === 'zh' ? '失败' : 'failed') : (locale === 'zh' ? '跳过' : 'skipped');
+  // 显式 locale 形参（不是全局语言运行时）：从本域目录直接取对应语言的文案，语义与改造前逐字一致。
+  const T = (key: Parameters<typeof coreText>[1]): string => coreText(locale, key);
+  const L = {
+    title: T('core.migrationHistory.title'),
+    total: T('core.migrationHistory.total'),
+    empty: T('core.migrationHistory.empty'),
+    kind: T('core.migrationHistory.kind'),
+    time: T('core.migrationHistory.time'),
+    result: T('core.migrationHistory.result'),
+    sections: T('core.migrationHistory.sections'),
+    detail: T('core.migrationHistory.detail'),
+  };
+  const resultLabel = (r: MigrationResult): string => r === 'success'
+    ? T('core.migrationHistory.resultSuccess')
+    : r === 'failed'
+      ? T('core.migrationHistory.resultFailed')
+      : T('core.migrationHistory.resultSkipped');
 
   if (format === 'json') {
     const stats = summarizeHistory(entries);

package/src/core/model-tools.ts

@@ -20,6 +20,7 @@
  *   - config_sync_pull 零写入（只 analyze+plan 出差异）；落地需另走确认导入管道；
  *   - 分区/路径走既有白名单（SECTION_IDS 过滤；同步引擎 portable + FORBIDDEN_SECTIONS 双保险）。
  */
+import { engineMsg } from './messages-core.ts';
 import type { Context } from '@deepseek-ai/cordis'
 import { defineTool } from '@deepseek-ai/dsh-tools'
 import { randomBytes } from 'node:crypto'
@@ -68,7 +69,7 @@ export interface ModelToolsDeps {
 /** 快照 id 校验：拒绝路径分隔符与 `.`/`..`（防 join(snapshotsDir, id) 越界）。 */
 function assertValidSnapshotId(snapshotId: string): void {
   if (snapshotId === '' || snapshotId.includes('/') || snapshotId.includes('\\')) {
-    throw new Error(`非法快照 id：${JSON.stringify(snapshotId)}`)
+    throw new Error(engineMsg('core.modelTools.illegalSnapshotId', { id: JSON.stringify(snapshotId) }))
   }
 }
 
@@ -99,7 +100,7 @@ async function resolveEngine(
   const ch: SyncTransportType = channel ?? parseSyncChannel(full?.transport) ?? 'git'
   const cfg = await readSyncConfigFor(deps.syncDir, ch)
   if (cfg === null) {
-    throw new Error(`同步通道 ${ch} 尚未配置（sync-config.json 缺失或损坏）`)
+    throw new Error(engineMsg('core.modelTools.syncChannelNotConfigured', { channel: ch }))
   }
   return { engine: deps.makeSyncEngine(cfg), channel: ch }
 }
@@ -171,7 +172,7 @@ export function createModelTools(deps: ModelToolsDeps) {
       const { snapshotId, confirm } = input
       assertValidSnapshotId(snapshotId)
       if (!(await snapshotDirExists(deps, snapshotId))) {
-        throw new Error(`快照不存在：${snapshotId}（用 config_list_snapshots 查看可用快照）`)
+        throw new Error(engineMsg('core.modelTools.snapshotNotFound', { id: snapshotId }))
       }
       const snapshotDir = join(deps.snapshotsDir, snapshotId)
       // profile：host.profile 由宿主 resolveProfileName 保证非空（缺省 'web'，见 ConfigManagerHostContext），
@@ -315,7 +316,7 @@ type ModelTools = ReturnType<typeof createModelTools>
 export function registerModelTools(ctx: Context, deps: ModelToolsDeps): void {
   const toolsSvc = ctx.get('tools')
   if (toolsSvc === null || toolsSvc === undefined || typeof toolsSvc !== 'object') {
-    deps.host.log.warn?.('tools 服务不可用：跳过模型工具注册（引擎能力仍可用）')
+    deps.host.log.warn?.(engineMsg('core.modelTools.toolsServiceUnavailable'))
     return
   }
   const tools: ModelTools = createModelTools(deps)
@@ -329,22 +330,22 @@ export function registerModelTools(ctx: Context, deps: ModelToolsDeps): void {
 
   register(defineTool({
     name: 'config_backup',
-    description: '全量备份 DSH 配置到本地 exports 目录（默认不含 secret；可传 password 加密导出）。返回 ZIP 文件名/大小/分区清单/加密状态。',
+    description: engineMsg('core.modelTools.backupToolDesc'),
     parameters: {
       only: {
         type: 'array',
         items: { type: 'string', enum: [...SECTION_IDS] },
-        description: '仅导出的分区 id 白名单；缺省 = 全部推荐分区',
+        description: engineMsg('core.modelTools.backupOnlyParam'),
       },
       password: {
         type: 'string',
-        description: '可选：加密备份密码（仅内存，不落盘/不回显；提供即加密导出）',
+        description: engineMsg('core.modelTools.backupPasswordParam'),
       },
     },
     output: {
       schema: {
         type: 'json',
-        description: '备份结果（zip 文件名 / sizeBytes / 分区清单 / excluded / encrypted / containsSecrets / redactedHits / warnings）',
+        description: engineMsg('core.modelTools.backupOutputDesc'),
       },
       render: (_args, value) => [{ type: 'text', text: JSON.stringify(value, null, 2) }],
     },
@@ -355,12 +356,12 @@ export function registerModelTools(ctx: Context, deps: ModelToolsDeps): void {
 
   register(defineTool({
     name: 'config_list_snapshots',
-    description: '列出 DSH 配置的本地回滚快照（id / 创建时间 / 来源 / 状态 / 条目数），供后续 config_restore 使用。',
+    description: engineMsg('core.modelTools.listSnapshotsToolDesc'),
     parameters: {},
     output: {
       schema: {
         type: 'json',
-        description: '快照数组（id / createdAt / sourceZip / status / entryCount）',
+        description: engineMsg('core.modelTools.listSnapshotsOutputDesc'),
       },
       render: (_args, value) => [{ type: 'text', text: JSON.stringify(value, null, 2) }],
     },
@@ -372,20 +373,20 @@ export function registerModelTools(ctx: Context, deps: ModelToolsDeps): void {
   register(defineTool({
     name: 'config_restore',
     description:
-      '恢复到指定快照。默认只返回动作计划（零写入）；确认要真实执行时传 confirm:true（会覆盖/删除 $DSH_HOME 文件并卸载导入期间新增插件，属破坏性操作，务必先预览）。',
+      engineMsg('core.modelTools.restoreToolDesc'),
     parameters: {
       snapshotId: {
         type: 'string',
         required: true,
-        description: '要恢复的快照 id（用 config_list_snapshots 获取）',
+        description: engineMsg('core.modelTools.restoreSnapshotIdParam'),
       },
       confirm: {
         type: 'boolean',
-        description: 'true 才真实执行恢复；缺省 false 只预览计划（零写入）',
+        description: engineMsg('core.modelTools.restoreConfirmParam'),
       },
     },
     output: {
-      schema: { type: 'json', description: 'dryRun=true 时为恢复计划；dryRun=false 时为执行报告' },
+      schema: { type: 'json', description: engineMsg('core.modelTools.restoreOutputDesc') },
       render: (_args, value) => [{ type: 'text', text: JSON.stringify(value, null, 2) }],
     },
     async execute(args) {
@@ -396,33 +397,33 @@ export function registerModelTools(ctx: Context, deps: ModelToolsDeps): void {
   register(defineTool({
     name: 'config_sync_push',
     description:
-      '手动推送 DSH 配置同步到远端（Git/WebDAV），复用已持久化的通道配置。写远端属主动操作；加密/含凭据须传 password 且引擎强制 encrypt。',
+      engineMsg('core.modelTools.syncPushToolDesc'),
     parameters: {
       channel: {
         type: 'string',
         enum: [...SYNC_CHANNELS],
-        description: '同步通道；缺省 = 已配置的活动通道',
+        description: engineMsg('core.modelTools.channelParam'),
       },
       sections: {
         type: 'array',
         items: { type: 'string', enum: [...SECTION_IDS] },
-        description: '仅推送的分区；缺省 = 全部推荐 portable 分区（非 portable 自动跳过）',
+        description: engineMsg('core.modelTools.syncPushSectionsParam'),
       },
       encrypt: {
         type: 'boolean',
-        description: '加密快照；开启必须提供 password',
+        description: engineMsg('core.modelTools.syncPushEncryptParam'),
       },
       includeSecrets: {
         type: 'boolean',
-        description: '推送真实凭据值（必须同时 encrypt=true，否则引擎拒绝）',
+        description: engineMsg('core.modelTools.syncPushIncludeSecretsParam'),
       },
       password: {
         type: 'string',
-        description: '加密密码（仅内存，不落盘/不回显）',
+        description: engineMsg('core.modelTools.syncPushPasswordParam'),
       },
     },
     output: {
-      schema: { type: 'json', description: '推送报告（snapshotId / 实际同步分区 / 告警）' },
+      schema: { type: 'json', description: engineMsg('core.modelTools.syncPushOutputDesc') },
       render: (_args, value) => [{ type: 'text', text: JSON.stringify(value, null, 2) }],
     },
     async execute(args) {
@@ -433,29 +434,29 @@ export function registerModelTools(ctx: Context, deps: ModelToolsDeps): void {
   register(defineTool({
     name: 'config_sync_pull',
     description:
-      '拉取远端同步差异预览（Git/WebDAV，零写入：只下载 + 分析出差异报告，绝不直接写配置）。若要落地差异需另走确认导入管道。',
+      engineMsg('core.modelTools.syncPullToolDesc'),
     parameters: {
       channel: {
         type: 'string',
         enum: [...SYNC_CHANNELS],
-        description: '同步通道；缺省 = 已配置的活动通道',
+        description: engineMsg('core.modelTools.channelParam'),
       },
       snapshotId: {
         type: 'string',
-        description: '远端快照 id；缺省 = 最新',
+        description: engineMsg('core.modelTools.syncPullSnapshotIdParam'),
       },
       strategy: {
         type: 'string',
         enum: ['merge', 'replace', 'skipExisting'],
-        description: '冲突全局策略；缺省 merge（冲突保留待决策）',
+        description: engineMsg('core.modelTools.syncPullStrategyParam'),
       },
       password: {
         type: 'string',
-        description: '解密密码（加密快照需要；仅内存）',
+        description: engineMsg('core.modelTools.syncPullPasswordParam'),
       },
     },
     output: {
-      schema: { type: 'json', description: '差异报告（changes 列表 / needsReview）' },
+      schema: { type: 'json', description: engineMsg('core.modelTools.syncPullOutputDesc') },
       render: (_args, value) => [{ type: 'text', text: JSON.stringify(value, null, 2) }],
     },
     async execute(args) {