dsh-config-manager 0.1.71 → 0.1.72

package/src/security/messages.ts

@@ -0,0 +1,87 @@
+/**
+ * security 层的领域消息目录（zh 源 / en 镜像）—— 经 engineMsg 取「调用期」语言文案。
+ *
+ * 为什么是本域独立目录：src/security/** 的写作用域不含 src/core/messages.ts（既有键有冻结指纹），
+ * 所以本域的键用 registerMessageCatalog 在**模块加载时**注册进引擎目录，查找顺序见
+ * src/core/engine-locale.ts（基础目录 → 注册目录 → 键名）。
+ *
+ * 纪律（与 src/core/messages.ts 同口径）：
+ *  - zh 值 = 迁移前的既有中文文案**逐字不变**（既有测试断言依赖）；
+ *  - en 类型为 Record<keyof typeof zh, string> —— 缺键/多键即编译错误；
+ *  - {param} 插值与缺参保留由 engineMsg 负责；
+ *  - **凭据 / 密码值永不进消息**：这里只换文案，脱敏口径与拼接顺序逐字不变（转写前长什么样，
+ *    转写后还是什么样），绝不新增任何值参数。
+ */
+import { engineMsg, registerMessageCatalog } from '../core/engine-locale.ts';
+import type { MsgParams } from '../core/msg-types.ts';
+
+export const zh = {
+  // ---------- 加密容器（encryption.ts） ----------
+  'security.encryptionPasswordEmpty': '加密密码不能为空',
+  'security.secretsBlobTooSmall': 'secrets.enc 体积过小（截断或损坏）',
+  'security.unknownFileMagic': '未知文件格式 magic "{magic}"，不是本插件产物',
+  'security.unsupportedSecretsVersion': '不支持的 secrets.enc 版本 {version}',
+  'security.invalidEncryptionParams': 'manifest 加密参数非法或不受支持',
+  'security.encryptionParamsMismatch': 'secrets.enc 与 manifest 加密参数不一致（可能被篡改）',
+  'security.keyDerivationFailed': '密钥派生失败: {reason}',
+  'security.decryptAuthFailed': '解密认证失败：密码错误或密文被篡改',
+  'security.archiveBlobTooSmall': '加密备份容器体积过小（截断或损坏）',
+  'security.unsupportedArchiveVersion': '不支持的加密备份版本 {version}',
+  'security.archiveParamsMismatch': '加密备份参数不一致（可能被篡改）',
+
+  // ---------- 完整性校验表（integrity.ts） ----------
+  'security.checksumsMustBeJsonObject': 'checksums.json 必须是 JSON 对象',
+  'security.checksumsTooManyEntries': 'checksums.json 条目数 {count} 超过上限 {max}',
+  'security.checksumsDangerousKey': 'checksums.json 含危险键 "{path}"，已拒绝',
+  'security.checksumsIllegalPath': 'checksums.json 含非法相对路径 "{path}"',
+  'security.checksumsNotSha256': 'checksums.json["{path}"] 不是合法的 SHA-256 hex',
+  'security.checksumMismatch': '"{path}" (hash 不符)',
+  'security.checksumMissing': '"{path}" (缺失)',
+
+  // ---------- 秘密扫描（secret-scanner.ts） ----------
+  'security.scanDepthExceeded': '扫描深度 {depth} 超过上限 {max}',
+  'security.circularReference': '检测到循环引用，无法扫描（路径 {path}）',
+
+  // ---------- vault / ZIP 安全（vault.ts / zip-security.ts） ----------
+  'security.vaultUnsafePath': 'vault: 非法敏感文件路径 "{path}"',
+  'security.zipTargetOutOfBounds': '解压目标越界: {name}',
+  'security.zipExecutableEntry': '条目 "{name}" 是潜在可执行文件，本插件不会执行它',
+  'security.zipEntryNotRegularFile': '解压产物不是普通文件: {rel}',
+} as const;
+
+export const en: Record<keyof typeof zh, string> = {
+  'security.encryptionPasswordEmpty': 'Encryption password must not be empty',
+  'security.secretsBlobTooSmall': 'secrets.enc is too small (truncated or corrupted)',
+  'security.unknownFileMagic': 'Unknown file format magic "{magic}"; not a product of this plugin',
+  'security.unsupportedSecretsVersion': 'Unsupported secrets.enc version {version}',
+  'security.invalidEncryptionParams': 'Invalid or unsupported manifest encryption parameters',
+  'security.encryptionParamsMismatch': 'secrets.enc encryption parameters do not match the manifest (possibly tampered with)',
+  'security.keyDerivationFailed': 'Key derivation failed: {reason}',
+  'security.decryptAuthFailed': 'Decryption authentication failed: wrong password or tampered ciphertext',
+  'security.archiveBlobTooSmall': 'Encrypted backup container is too small (truncated or corrupted)',
+  'security.unsupportedArchiveVersion': 'Unsupported encrypted backup version {version}',
+  'security.archiveParamsMismatch': 'Encrypted backup parameters do not match (possibly tampered with)',
+
+  'security.checksumsMustBeJsonObject': 'checksums.json must be a JSON object',
+  'security.checksumsTooManyEntries': 'checksums.json has {count} entries, exceeding the limit of {max}',
+  'security.checksumsDangerousKey': 'checksums.json contains a dangerous key "{path}", rejected',
+  'security.checksumsIllegalPath': 'checksums.json contains an illegal relative path "{path}"',
+  'security.checksumsNotSha256': 'checksums.json["{path}"] is not a valid SHA-256 hex string',
+  'security.checksumMismatch': '"{path}" (hash mismatch)',
+  'security.checksumMissing': '"{path}" (missing)',
+
+  'security.scanDepthExceeded': 'Scan depth {depth} exceeds the limit of {max}',
+  'security.circularReference': 'Circular reference detected, cannot scan (path {path})',
+
+  'security.vaultUnsafePath': 'vault: illegal sensitive file path "{path}"',
+  'security.zipTargetOutOfBounds': 'Extraction target escapes the destination: {name}',
+  'security.zipExecutableEntry': 'Entry "{name}" is a potential executable; this plugin will not execute it',
+  'security.zipEntryNotRegularFile': 'Extracted entry is not a regular file: {rel}',
+};
+
+registerMessageCatalog({ id: 'security', zh, en });
+
+/** 本域翻译器：key 受目录约束（拼错键 = 编译错误），语言按 engineMsg 的活语言解析。 */
+export function securityMsg(key: keyof typeof zh, params?: MsgParams): string {
+  return engineMsg(key, params);
+}

package/src/security/redaction.test.ts

@@ -18,7 +18,7 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 
-import { REDACTION_VALUE_PATTERNS, REDACTED, redact } from './redaction.ts';
+import { REDACTION_VALUE_PATTERNS, REDACTED, createRedactor, redact } from './redaction.ts';
 import { SECRET_VALUE_PATTERNS, matchSecretValuePattern } from './secret-scanner.ts';
 
 /** 真实凭据形态语料（scanner 必须命中；redact 必须掩掉原文） */
@@ -147,3 +147,19 @@ test('t78-f（**t83 后范围收窄**）：显示层「更宽」只对未加形
   assert.equal(matchSecretValuePattern('Bearer example-token-here'), null, 'scanner 侧放行（示例形态）');
   assert.ok(redact('Bearer example-token-here').includes(REDACTED), 'redact 侧仍掩（显示层更宽，未变）');
 });
+
+/* ---------------- URL 内嵌凭据（userinfo 形态）必须掩码 ---------------- */
+
+test('redact：scheme://user:password@host 的密码段被掩码（用户名保留），且幂等', () => {
+  const out = redact('clone https://oauth2:GLPAT-SECRETVALUE@gitlab.example.com/u/r.git now');
+  assert.equal(out.includes('GLPAT-SECRETVALUE'), false, 'URL 内嵌凭据不得明文保留');
+  assert.ok(out.includes('oauth2'), '用户名保留可读（与 URL_QUERY_RE 同一取舍）');
+  assert.ok(out.includes('gitlab.example.com'), '主机名不受影响');
+  assert.equal(redact(out), out, '幂等：重复脱敏结果不变');
+  // query 形态的既有行为不变
+  assert.equal(redact('https://h/p?token=abc123456').includes('abc123456'), false, 'query token 仍被掩码');
+  // 没有 userinfo 的普通 URL 一字不改
+  assert.equal(redact('https://gitlab.example.com/u/r.git'), 'https://gitlab.example.com/u/r.git');
+  // createRedactor 与 redact 同源（同一份规则）
+  assert.equal(createRedactor()('https://u:p4ssword@h/x').includes('p4ssword'), false);
+});

package/src/security/redaction.ts

@@ -54,6 +54,17 @@ const VALUE_PATTERNS = REDACTION_VALUE_PATTERNS;
 /** URL query 中的敏感参数值（保留参数名，只替换值） */
 const URL_QUERY_RE = /([?&](?:token|api[_-]?key|key|secret|access[_-]?token|password|auth)=)([^&\s"']+)/gi;
 
+/**
+ * URL **内嵌凭据**（\`scheme://user:password@host\`，GitLab/Gitea 常见的 \`https://oauth2:<token>@…\`）。
+ *
+ * 为什么必须补这一条：URL_QUERY_RE 只认 query 参数，而 userinfo 形态的凭据此前在**三条通道**
+ * 都不被掩码 —— 日志、界面渲染、以及 sessionStorage 落盘（run-store 的 \`redactPersistedValue\`）。
+ * 宿主侧 sync-config 的 validateRepoUrl/validateWebDavUrl 本来就拒绝带 userinfo 的地址，
+ * 所以这里只影响「掩码」：不改任何合法输入的行为，只让非法规格里的凭据不再明文可见。
+ * 只替换密码段（用户名保留可读），与 URL_QUERY_RE 的取舍一致。
+ */
+const URL_USERINFO_RE = /(\/\/[^\/@\s:]+:)([^\/@\s]+)(@)/g;
+
 /* ---------------- 高熵长 token（journal / 迁移历史强脱敏共用） ---------------- */
 
 /** 高熵值形状（长 hex/base64/随机 id）：结构化 redact() 覆盖不了任意 secret，journal / 迁移
@@ -120,6 +131,7 @@ export function redact(text: string, blacklist: readonly string[] = []): string
     out = out.replace(re, REDACTED);
   }
   out = out.replace(URL_QUERY_RE, `$1${REDACTED}`);
+  out = out.replace(URL_USERINFO_RE, `$1${REDACTED}$3`);
   return out;
 }
 
@@ -147,6 +159,7 @@ export function createRedactor(blacklist: readonly string[] = []): (text: string
       out = out.replace(re, REDACTED);
     }
     out = out.replace(URL_QUERY_RE, `$1${REDACTED}`);
+    out = out.replace(URL_USERINFO_RE, `$1${REDACTED}$3`);
     return out;
   };
 }

package/src/security/secret-scanner.ts

@@ -22,10 +22,13 @@
  *  - 高熵 base64 默认关（误伤率高）。
  *
  * 实现不变量：返回 sanitized 为**全新对象**（不改原数据）；迭代式显式栈（防爆栈）+ 深度上限；
+ * 判环只看**当前路径的祖先链**（`ancestors`）——同一对象被两处引用（DAG）不是环，用全局 visited
+ * 会把共享引用误判成循环引用并让整次导出失败；
  * 命中记录只含路径与字段名，**值永不外泄**。
  */
 import { JsonDepthError } from '../utils/json.ts';
 import type { SecretScanner, SensitiveHit } from '../core/types.ts';
+import { securityMsg } from './messages.ts';
 
 /** 剥离占位（与 core defaultSecretScanner 语义一致：空串 = 需补录提示） */
 export const REDACTED_PLACEHOLDER = '';
@@ -351,15 +354,17 @@ export function scanAndRedact(data: unknown, opts: SecretScannerOptions = {}): {
   if (data instanceof Uint8Array) return { sanitized: data, hits };
 
   const rootOut: unknown = Array.isArray(data) ? [] : {};
-  interface Frame { src: unknown; dst: unknown; path: string; depth: number }
-  const stack: Frame[] = [{ src: data, dst: rootOut, path: '', depth: 1 }];
-  const visited = new WeakSet<object>();
-  visited.add(data as object);
+  // 判环判据 = **当前路径的祖先链**，绝不是「本次扫描见过的对象集合」：settings 的 value/base 共享
+  // 未覆盖的嵌套分组、providers 的多 route 共享 raw 等 DAG 形态都是合法数据，全局 visited 会把它们
+  // 误判成「检测到循环引用」并让整次导出/同步失败（用户上报 2026-10-09：备份失败 → intent journal
+  // 记 NEEDS_ATTENTION + durable SAFE MODE）。祖先链只回答「它是不是它自己的祖先」。
+  interface Frame { src: unknown; dst: unknown; path: string; depth: number; ancestors: ReadonlySet<object> }
+  const stack: Frame[] = [{ src: data, dst: rootOut, path: '', depth: 1, ancestors: new Set<object>([data as object]) }];
 
   while (stack.length > 0) {
     const frame = stack.pop()!;
-    const { src, dst, path, depth } = frame;
-    if (depth > maxDepth) throw new JsonDepthError(`扫描深度 ${depth} 超过上限 ${maxDepth}`);
+    const { src, dst, path, depth, ancestors } = frame;
+    if (depth > maxDepth) throw new JsonDepthError(securityMsg('security.scanDepthExceeded', { depth, max: maxDepth }));
     if (src instanceof Uint8Array) continue;
 
     if (Array.isArray(src)) {
@@ -368,11 +373,12 @@ export function scanAndRedact(data: unknown, opts: SecretScannerOptions = {}): {
         const v = src[i];
         const childPath = `${path}[${i}]`;
         if (v !== null && typeof v === 'object' && !(v instanceof Uint8Array)) {
-          if (visited.has(v)) throw new Error(`检测到循环引用，无法扫描（路径 ${childPath}）`);
-          visited.add(v);
+          if (ancestors.has(v)) throw new Error(securityMsg('security.circularReference', { path: childPath }));
+          const childAncestors = new Set(ancestors);
+          childAncestors.add(v);
           const childOut: unknown = Array.isArray(v) ? [] : {};
           outArr.push(childOut);
-          stack.push({ src: v, dst: childOut, path: childPath, depth: depth + 1 });
+          stack.push({ src: v, dst: childOut, path: childPath, depth: depth + 1, ancestors: childAncestors });
         } else {
           outArr.push(v);
         }
@@ -393,11 +399,12 @@ export function scanAndRedact(data: unknown, opts: SecretScannerOptions = {}): {
         continue;
       }
       if (v !== null && typeof v === 'object' && !(v instanceof Uint8Array)) {
-        if (visited.has(v)) throw new Error(`检测到循环引用，无法扫描（路径 ${childPath}）`);
-        visited.add(v);
+        if (ancestors.has(v)) throw new Error(securityMsg('security.circularReference', { path: childPath }));
+        const childAncestors = new Set(ancestors);
+        childAncestors.add(v);
         const childOut: unknown = Array.isArray(v) ? [] : {};
         outObj[k] = childOut;
-        stack.push({ src: v, dst: childOut, path: childPath, depth: depth + 1 });
+        stack.push({ src: v, dst: childOut, path: childPath, depth: depth + 1, ancestors: childAncestors });
       } else {
         outObj[k] = v;
       }

package/src/security/security.test.ts

@@ -727,6 +727,53 @@ test('scanner: 深层嵌套上限（≤64 通过，超限抛错）与循环引
   assert.throws(() => scanAndRedact(cyclic), /循环引用/);
 });
 
+test('scanner: DAG 共享引用不得被误判为循环（用户上报 2026-10-09：settings value/base 共享 → 备份整体失败）', () => {
+  // 同一对象被两处引用（彼此不是祖先关系）是合法数据：settings 的 value/base 共享未覆盖的嵌套分组、
+  // providers 的多 route 共享 raw 都长这样。判环只看祖先链 → 放行，且两个分支各自完成脱敏。
+  const dream = { enabled: true, idleMinutes: 180, apiKey: 'sk-live-abcdefgh12345' };
+  const data = {
+    namespaces: {
+      'meow-memory': {
+        value: { promptLang: 'zh', dream },
+        base: { promptLang: 'zh', dream },
+        revision: 3,
+        secrets: [],
+      },
+    },
+  };
+  const { sanitized, hits } = scanAndRedact(data);
+  const rec = (sanitized as {
+    namespaces: Record<string, { value: { dream: Record<string, unknown> }; base: { dream: Record<string, unknown> } }>;
+  }).namespaces['meow-memory']!;
+  assert.equal(rec.value.dream['apiKey'], REDACTED_PLACEHOLDER, 'value 分支必须脱敏');
+  assert.equal(rec.base.dream['apiKey'], REDACTED_PLACEHOLDER, 'base 分支必须脱敏');
+  assert.equal(rec.value.dream['idleMinutes'], 180, '非敏感字段保留');
+  assert.equal(rec.base.dream['idleMinutes'], 180);
+  assert.notStrictEqual(rec.value.dream, rec.base.dream, '输出必须是各自独立的副本');
+  assert.ok(hits.some((h) => h.path === 'namespaces.meow-memory.value.dream.apiKey'), '命中路径须点名 value 分支');
+  assert.ok(hits.some((h) => h.path === 'namespaces.meow-memory.base.dream.apiKey'), '命中路径须点名 base 分支');
+});
+
+test('scanner: 数组分支的共享引用放行，真环（对象环 / 数组环 / 深层回指）仍必须抛', () => {
+  const shared = { token: 'ghp_abcdefghijklmnopqrstuvwxyz012345' };
+  const { sanitized } = scanAndRedact({ a: { x: shared }, b: { y: shared }, c: { z: shared } });
+  const s = sanitized as { a: { x: { token: string } }; b: { y: { token: string } }; c: { z: { token: string } } };
+  assert.equal(s.a.x.token, REDACTED_PLACEHOLDER);
+  assert.equal(s.b.y.token, REDACTED_PLACEHOLDER);
+  assert.equal(s.c.z.token, REDACTED_PLACEHOLDER);
+  assert.notStrictEqual(s.a.x, s.b.y, '三处共享引用必须各写一份独立副本');
+
+  // 数组自环
+  const arrayCycle: unknown[] = [1];
+  arrayCycle.push(arrayCycle);
+  assert.throws(() => scanAndRedact({ x: arrayCycle }), /循环引用/);
+
+  // 同一对象既是自己的祖先（隔着若干层回指）→ 仍必须抛，不能因为「见过」就放行
+  const root: Record<string, unknown> = {};
+  root['deep'] = { mid: { back: root } };
+  assert.throws(() => scanAndRedact(root), /循环引用/);
+});
+
 test('scanner: Uint8Array 跳过、数组根、空字符串不报 hit、extra 名单扩展', () => {
   const bin = new Uint8Array([1, 2, 3]);
   const input = { data: bin, empty: '', clientSecret2: 'x', normal: 42 };

package/src/security/vault.ts

@@ -23,6 +23,7 @@
 import path from 'node:path';
 import type { FileSystemFacade } from '../core/types.ts';
 import { isPathSafe, normalizePath } from '../utils/paths.ts';
+import { securityMsg } from './messages.ts';
 
 /**
  * 默认敏感文件清单（相对 $DSH_HOME）：当前 DSH 唯一「整文件即秘密」的文件
@@ -68,7 +69,7 @@ export interface VaultEntry {
 
 /** rel 必须为安全相对路径（拒绝绝对路径 / .. / 盘符 / NUL），防路径穿越 */
 function assertSafeRel(rel: string): void {
-  if (!isPathSafe(rel)) throw new Error(`vault: 非法敏感文件路径 "${rel}"`);
+  if (!isPathSafe(rel)) throw new Error(securityMsg('security.vaultUnsafePath', { path: rel }));
 }
 
 /** 校验 + 归一化 rel 清单（统一 / 分隔，与 FileSystemFacade.listRecursive 产出对齐） */

package/src/security/zip-security.ts

@@ -21,6 +21,7 @@ import {
   ZipSafetyError,
   type ZipSafetyLimits,
 } from '../utils/zip.ts';
+import { securityMsg } from './messages.ts';
 
 export { isPathSafe } from '../utils/paths.ts';
 
@@ -83,13 +84,13 @@ export async function safeExtractHardened(
       if (meta.isDirectory) continue;
       const target = path.join(destDir, ...meta.name.split('/'));
       if (!isSameOrChild(target, destDir)) {
-        throw new ZipSafetyError(`解压目标越界: ${meta.name}`);
+        throw new ZipSafetyError(securityMsg('security.zipTargetOutOfBounds', { name: meta.name }));
       }
       await fs.mkdir(path.dirname(target), { recursive: true });
       await fs.writeFile(target, archive.readEntry(meta.name));
       extracted.push(meta.name);
       if (isExecutableName(meta.name)) {
-        warnings.push(`条目 "${meta.name}" 是潜在可执行文件，本插件不会执行它`);
+        warnings.push(securityMsg('security.zipExecutableEntry', { name: meta.name }));
       }
     }
     // 解压后复查：全部产物必须是普通文件（防 symlink 逃逸 / 非常规写入）
@@ -97,7 +98,7 @@ export async function safeExtractHardened(
       const p = path.join(destDir, ...rel.split('/'));
       const st = await fs.lstat(p);
       if (!st.isFile()) {
-        throw new ZipSafetyError(`解压产物不是普通文件: ${rel}`);
+        throw new ZipSafetyError(securityMsg('security.zipEntryNotRegularFile', { rel }));
       }
     }
     return { files: extracted, warnings };

package/src/sync/ancestor.ts

@@ -4,6 +4,7 @@
  * 纯逻辑 + 可注入 fs；不触碰真实 ~/.dsh。
  */
 import { createSnapshotFs, joinFs } from './fs.ts';
+import { engineMsg } from './messages.ts';
 import type { SnapshotFs } from './fs.ts';
 import { readSnapshotFromDir, writeSnapshotToDir } from './layout.ts';
 import { SNAPSHOT_MANIFEST_FILE } from './layout.ts';
@@ -19,7 +20,7 @@ export async function loadAncestor(
   fsx: SnapshotFs = createSnapshotFs(),
 ): Promise<SyncSnapshot> {
   if (typeof snapshotId !== 'string' || snapshotId === '') {
-    throw new Error('loadAncestor: snapshotId 不能为空');
+    throw new Error(engineMsg('sync.ancestorSnapshotIdRequired'));
   }
   const dir = joinFs(localSnapshotsDir, snapshotId);
   return await readSnapshotFromDir(dir, fsx);

package/src/sync/autosync-config.ts

@@ -52,6 +52,17 @@ export interface AutosyncConfig {
   /** 最近一次自动同步执行状态 */
   lastRunStatus?: AutosyncRunStatus;
   lastRunMessage?: string;
+  /**
+   * 最近一次**跳过**的结构化原因码（issue #79）。
+   *
+   * 为什么是码而不是文案：语言在「取文案那一刻」解析（AGENTS.md i18n 铁律），状态行由界面
+   * 按码取自己的字典；存一句当时语言的中文，用户切到英文界面后会看到中英混排。
+   * 已知值见 `svc.autosyncSkip.*` 的字典键（'conflict'/'mutation-locked'/'upToDate'…），
+   * **未知码一律渲染兜底文案，绝不渲染裸枚举**。
+   */
+  lastRunSkipReason?: string;
+  /** 最近一次跳过涉及的分区数（当前仅 conflict：远端另有 N 个分区待确认） */
+  lastRunSkipCount?: number;
   /** 最近一次自动同步触发的同步历史条目 id */
   lastRunHistoryId?: string;
 }
@@ -85,6 +96,13 @@ function parseV1Channel(obj: Record<string, unknown>): AutosyncConfig {
     cfg.lastRunStatus = obj['lastRunStatus'];
   }
   if (typeof obj['lastRunMessage'] === 'string') cfg.lastRunMessage = obj['lastRunMessage'];
+  // issue #79：状态行的结构化跳过原因（旧文件没有这两个字段 → undefined，行为不变）
+  if (typeof obj['lastRunSkipReason'] === 'string' && obj['lastRunSkipReason'] !== '') {
+    cfg.lastRunSkipReason = obj['lastRunSkipReason'];
+  }
+  if (typeof obj['lastRunSkipCount'] === 'number' && Number.isFinite(obj['lastRunSkipCount']) && obj['lastRunSkipCount'] >= 0) {
+    cfg.lastRunSkipCount = obj['lastRunSkipCount'];
+  }
   if (typeof obj['lastRunHistoryId'] === 'string') cfg.lastRunHistoryId = obj['lastRunHistoryId'];
   return cfg;
 }
@@ -161,6 +179,9 @@ function toChannelPayload(cfg: AutosyncConfig): Record<string, unknown> {
   if (cfg.lastRunAt !== undefined && cfg.lastRunAt !== '') payload['lastRunAt'] = cfg.lastRunAt;
   if (cfg.lastRunStatus !== undefined) payload['lastRunStatus'] = cfg.lastRunStatus;
   if (cfg.lastRunMessage !== undefined && cfg.lastRunMessage !== '') payload['lastRunMessage'] = cfg.lastRunMessage;
+  // 空串/undefined 一律不写 → 本轮成功时，上一轮的跳过码/旧消息在文件里被真正清掉（issue #79）
+  if (cfg.lastRunSkipReason !== undefined && cfg.lastRunSkipReason !== '') payload['lastRunSkipReason'] = cfg.lastRunSkipReason;
+  if (cfg.lastRunSkipCount !== undefined) payload['lastRunSkipCount'] = cfg.lastRunSkipCount;
   if (cfg.lastRunHistoryId !== undefined && cfg.lastRunHistoryId !== '') payload['lastRunHistoryId'] = cfg.lastRunHistoryId;
   return payload;
 }

package/src/sync/autosync-scheduler.test.ts

@@ -283,8 +283,10 @@ test('runOnce: webdav 未配置（webdav.url 缺）→ skipped(unconfigured)，
   const result = await scheduler.runOnce('webdav');
   assert.equal(result.status, 'skipped');
   assert.equal(result.skipReason, 'unconfigured');
-  assert.equal(result.consecutiveFailures, 1, '未配置不计失败（保持 1）');
-  assert.equal(getConfig().consecutiveFailures, 1);
+  // issue #79：连续失败计数只统计「真的失败」——未配置属跳过，必须归零（此前保持 1，
+  // 面板于是长期显示「连续失败 N 次」，把用户引向网络排查）
+  assert.equal(result.consecutiveFailures, 0, '未配置不算失败 → 计数归零');
+  assert.equal(getConfig().consecutiveFailures, 0);
 });
 
 test('syncIsConfigured: git 看 git.repoUrl、webdav 看 webdav.url；null 未配置', () => {
@@ -306,19 +308,73 @@ test('runOnce: merge 抛错 → failed，连续失败计数 +1', async () => {
   assert.ok(getEntries().some((e) => e.status === 'failed'), '写入失败历史');
 });
 
-test('runOnce: 有冲突 → skipped(conflict)，不写本地，不计失败', async () => {
+test('issue #79：远端冲突只挡下行 —— 不写本地，但仍推送本机改动（partial，不谎报 success/failed）', async () => {
   const cfg: AutosyncConfig = { enabled: true, interval: '30m', startupMinIntervalMs: 300000, consecutiveFailures: 1 };
+  const applyCalls: string[] = [];
+  const pushCalls: string[] = [];
   const engine = {
+    hasNewRemoteSnapshot: async () => true,
+    hasLocalChanges: async () => true,
     merge: async (): Promise<MergePlan> => makeMergePlan([['settings', 'conflict']]),
+    applyMergePlan: async () => {
+      applyCalls.push('apply');
+      return { ok: true, applied: [] as never[], restoreId: 'r1', rolledBack: false, review: [], warnings: [] };
+    },
+    push: async () => { pushCalls.push('push'); return { ok: true, snapshotId: 'snap-up', sections: [] as never, warnings: [] }; },
   };
   const { scheduler, getConfig, getEntries } = makeScheduler({ cfg, engine, history: [] });
   const result = await scheduler.runOnce('git');
-  assert.equal(result.status, 'skipped');
+  assert.equal(result.status, 'partial', '上行成功 + 下行待确认 → partial');
   assert.equal(result.skipReason, 'conflict');
   assert.deepEqual(result.conflictedSections, ['settings']);
-  assert.equal(result.consecutiveFailures, 1, '冲突跳过不计失败');
-  assert.equal(getConfig().consecutiveFailures, 1);
-  assert.ok(getEntries().some((e) => e.skipReason === 'conflict'), '写入冲突跳过历史');
+  assert.equal(result.pushedSnapshotId, 'snap-up', '本机快照仍有上行出口（issue #79 主诉）');
+  assert.equal(applyCalls.length, 0, '冲突绝不写本机配置');
+  assert.equal(pushCalls.length, 1, '纯上行不被冲突连坐');
+  assert.equal(result.consecutiveFailures, 0, '冲突跳过不是失败 → 计数归零');
+  assert.equal(getConfig().lastRunSkipReason, 'conflict', '跳过原因落到状态（界面按码取字典）');
+  assert.equal(getConfig().lastRunSkipCount, 1);
+  assert.ok(getEntries().some((e) => e.status === 'partial' && e.skipReason === 'conflict'), '写入 partial 历史');
+  assert.ok(getEntries().some((e) => e.pushedSnapshotId === 'snap-up'), '历史带上行快照 id');
+});
+
+test('issue #79：冲突且本机无改动（非 startup）→ skipped(conflict) 且不带 push', async () => {
+  const cfg: AutosyncConfig = { enabled: true, interval: '30m', startupMinIntervalMs: 300000, consecutiveFailures: 0 };
+  const pushCalls: string[] = [];
+  const engine = {
+    hasNewRemoteSnapshot: async () => true,
+    hasLocalChanges: async () => false,
+    merge: async (): Promise<MergePlan> => makeMergePlan([['settings', 'conflict']]),
+    push: async () => { pushCalls.push('push'); return { ok: true, snapshotId: 'x', sections: [] as never, warnings: [] }; },
+  };
+  const { scheduler, getConfig } = makeScheduler({ cfg, engine, history: [] });
+  const result = await scheduler.runOnce('git');
+  assert.equal(result.status, 'skipped');
+  assert.equal(result.skipReason, 'conflict');
+  assert.equal(pushCalls.length, 0, '本地无改动不上传');
+  assert.equal(getConfig().lastRunMessage ?? '', '', '本轮跳过不得残留上一轮的错误文案');
+  assert.equal(getConfig().lastRunSkipReason, 'conflict');
+});
+
+test('issue #79：本轮成功必须清掉上一轮的错误文案与跳过码（陈旧信息不再挂面板）', async () => {
+  const cfg: AutosyncConfig = {
+    enabled: true, interval: '30m', startupMinIntervalMs: 300000, consecutiveFailures: 2,
+    lastRunMessage: 'git pull 失败: ssh: connect to host 192.168.10.x port 2222: Connection timed out',
+    lastRunSkipReason: 'mutation-locked',
+    lastRunSkipCount: 7,
+  };
+  const engine = {
+    hasNewRemoteSnapshot: async () => false,
+    hasLocalChanges: async () => true,
+    push: async () => ({ ok: true, snapshotId: 'snap-clean', sections: [] as never, warnings: [] }),
+  };
+  const { scheduler, getConfig } = makeScheduler({ cfg, engine, history: [] });
+  const result = await scheduler.runOnce('git');
+  assert.equal(result.status, 'success');
+  const saved = getConfig();
+  assert.equal(saved.lastRunMessage, '', '成功即清空旧错误文案');
+  assert.equal(saved.lastRunSkipReason, undefined, '成功即清空旧跳过码');
+  assert.equal(saved.lastRunSkipCount, undefined);
+  assert.equal(saved.consecutiveFailures, 0, '成功归零连续失败');
 });
 
 test('runOnce: 无冲突且无变化 → success(pull,unchanged)，不上传（本地也无改动）', async () => {