dsh-config-manager 0.1.71 → 0.1.73

package/lib/schema/versions.js

@@ -10,6 +10,7 @@
  *     唯一来源是 `section-registry.ts` 各分区条目的 `dataVersion`，
  *     历史上有 11 处 `data.version !== 1` 字面量，现已收敛到此处两个函数。
  */
+import { schemaMsg } from './messages.js';
 import { SECTION_REGISTRY } from './section-registry.js';
 /** 当前 Export Schema 版本（v1 起点；未来随迁移链演进） */
 export const CURRENT_SCHEMA_VERSION = 1;
@@ -47,12 +48,12 @@ export function canImport(v) {
 /** 版本的可读描述（报告/日志用） */
 export function describeVersion(v) {
     if (isTooNew(v))
-        return `schema v${v}（高于当前 ${CURRENT_SCHEMA_VERSION}，需升级插件）`;
+        return schemaMsg('schema.versionTooNew', { version: v, current: CURRENT_SCHEMA_VERSION });
     if (needsMigration(v))
-        return `schema v${v}（旧版，将迁移到 v${CURRENT_SCHEMA_VERSION}）`;
+        return schemaMsg('schema.versionNeedsMigration', { version: v, current: CURRENT_SCHEMA_VERSION });
     if (isCurrent(v))
-        return `schema v${v}（当前版本）`;
-    return `schema v${v}（低于最低支持 ${MIN_SUPPORTED_SCHEMA_VERSION}，不受支持）`;
+        return schemaMsg('schema.versionCurrent', { version: v });
+    return schemaMsg('schema.versionBelowMinimum', { version: v, minimum: MIN_SUPPORTED_SCHEMA_VERSION });
 }
 /* ---------------------------------------------------------------- 分区载荷版本（第二条版本轴） */
 /** 某分区的载荷版本（唯一来源：注册表 `dataVersion`） */
@@ -71,6 +72,6 @@ export function isSupportedSectionDataVersion(sectionId, version) {
 export function sectionDataVersionIssue(sectionId, version) {
     if (isSupportedSectionDataVersion(sectionId, version))
         return null;
-    return `分区 ${sectionId} 的 version 必须为 ${SECTION_REGISTRY[sectionId].dataVersion}（收到 ${String(version)}）`;
+    return schemaMsg('schema.sectionDataVersionMismatch', { section: sectionId, expected: SECTION_REGISTRY[sectionId].dataVersion, actual: String(version) });
 }
 //# sourceMappingURL=versions.js.map

package/lib/security/encryption.js

@@ -19,6 +19,7 @@
  */
 import crypto from 'node:crypto';
 import { promisify } from 'node:util';
+import { securityMsg } from './messages.js';
 const scryptAsync = promisify(crypto.scrypt);
 export const SCHEMA_MAGIC = 'DSC1';
 export const SCHEMA_VERSION = 1;
@@ -63,7 +64,7 @@ export async function deriveKey(password, salt, params = SCRYPT_PARAMS) {
 /** 加密 .credentials.yaml 原文 → { blob, info }（info 直接进 manifest.security.encryption） */
 export async function encryptCredentials(plaintext, password) {
     if (password === '')
-        throw new SecurityError('BAD_PASSWORD', '加密密码不能为空');
+        throw new SecurityError('BAD_PASSWORD', securityMsg('security.encryptionPasswordEmpty'));
     // 产品决策（2026-09-13）：加密**不做任何密码强度校验**——用户提供的任何密码都必须可用。
     // 请勿在此重新加入强度闸门；用户自定的密码策略不由本插件约束。
     const salt = crypto.randomBytes(SALT_LENGTH);
@@ -92,18 +93,18 @@ export async function encryptCredentials(plaintext, password) {
 /** 解密 secrets.enc（authTag 校验失败抛 BAD_PASSWORD；元数据不一致抛 TAMPERED） */
 export async function decryptCredentials(blob, info, password) {
     if (blob.length < HEADER_LENGTH) {
-        throw new SecurityError('TAMPERED', 'secrets.enc 体积过小（截断或损坏）');
+        throw new SecurityError('TAMPERED', securityMsg('security.secretsBlobTooSmall'));
     }
     const magic = Buffer.from(blob.subarray(0, 4)).toString('ascii');
     if (magic !== SCHEMA_MAGIC) {
-        throw new SecurityError('UNSUPPORTED_FORMAT', `未知文件格式 magic "${magic}"，不是本插件产物`);
+        throw new SecurityError('UNSUPPORTED_FORMAT', securityMsg('security.unknownFileMagic', { magic }));
     }
     const version = blob[4];
     if (version !== SCHEMA_VERSION) {
-        throw new SecurityError('UNSUPPORTED_FORMAT', `不支持的 secrets.enc 版本 ${version}`);
+        throw new SecurityError('UNSUPPORTED_FORMAT', securityMsg('security.unsupportedSecretsVersion', { version }));
     }
     if (info.algorithm !== 'aes-256-gcm' || info.kdf !== 'scrypt' || !validateKdfParams(info.kdfParams)) {
-        throw new SecurityError('UNSUPPORTED_FORMAT', 'manifest 加密参数非法或不受支持');
+        throw new SecurityError('UNSUPPORTED_FORMAT', securityMsg('security.invalidEncryptionParams'));
     }
     const blobSalt = blob.subarray(5, 5 + SALT_LENGTH);
     const blobIv = blob.subarray(5 + SALT_LENGTH, 5 + SALT_LENGTH + IV_LENGTH);
@@ -111,14 +112,14 @@ export async function decryptCredentials(blob, info, password) {
     if (info.salt !== Buffer.from(blobSalt).toString('base64') ||
         info.iv !== Buffer.from(blobIv).toString('base64') ||
         info.authTag !== Buffer.from(blobTag).toString('base64')) {
-        throw new SecurityError('TAMPERED', 'secrets.enc 与 manifest 加密参数不一致（可能被篡改）');
+        throw new SecurityError('TAMPERED', securityMsg('security.encryptionParamsMismatch'));
     }
     let key;
     try {
         key = await deriveKey(password, blobSalt, info.kdfParams);
     }
     catch (err) {
-        throw new SecurityError('BAD_PASSWORD', `密钥派生失败: ${err instanceof Error ? err.message : String(err)}`);
+        throw new SecurityError('BAD_PASSWORD', securityMsg('security.keyDerivationFailed', { reason: err instanceof Error ? err.message : String(err) }));
     }
     const decipher = crypto.createDecipheriv('aes-256-gcm', key, blobIv);
     decipher.setAuthTag(blobTag);
@@ -130,7 +131,7 @@ export async function decryptCredentials(blob, info, password) {
         return decrypted.toString('utf8');
     }
     catch {
-        throw new SecurityError('BAD_PASSWORD', '解密认证失败：密码错误或密文被篡改');
+        throw new SecurityError('BAD_PASSWORD', securityMsg('security.decryptAuthFailed'));
     }
 }
 /**
@@ -160,7 +161,7 @@ export function createEncryptionProvider(password) {
  */
 export async function encryptArchive(plainZip, password) {
     if (password === '')
-        throw new SecurityError('BAD_PASSWORD', '加密密码不能为空');
+        throw new SecurityError('BAD_PASSWORD', securityMsg('security.encryptionPasswordEmpty'));
     // 产品决策（2026-09-13）：加密**不做任何密码强度校验**——用户提供的任何密码都必须可用。
     // 请勿在此重新加入强度闸门；用户自定的密码策略不由本插件约束。
     const salt = crypto.randomBytes(SALT_LENGTH);
@@ -189,15 +190,15 @@ export async function encryptArchive(plainZip, password) {
 /** 容器版解密：用「先验真实参数」校验密码并解密（—— 调用方必须先用 verifyEncryptedBlob 拿到 info/kdf） */
 export async function decryptArchive(blob, info, kdfParam, password) {
     if (blob.length < HEADER_LENGTH) {
-        throw new SecurityError('TAMPERED', '加密备份容器体积过小（截断或损坏）');
+        throw new SecurityError('TAMPERED', securityMsg('security.archiveBlobTooSmall'));
     }
     const magic = Buffer.from(blob.subarray(0, 4)).toString('ascii');
     if (magic !== ARCHIVE_MAGIC) {
-        throw new SecurityError('UNSUPPORTED_FORMAT', `未知文件格式 magic "${magic}"，不是本插件产物`);
+        throw new SecurityError('UNSUPPORTED_FORMAT', securityMsg('security.unknownFileMagic', { magic }));
     }
     const version = blob[4];
     if (version !== ARCHIVE_VERSION) {
-        throw new SecurityError('UNSUPPORTED_FORMAT', `不支持的加密备份版本 ${version}`);
+        throw new SecurityError('UNSUPPORTED_FORMAT', securityMsg('security.unsupportedArchiveVersion', { version }));
     }
     const blobSalt = Buffer.from(blob.subarray(5, 5 + SALT_LENGTH));
     const blobIv = Buffer.from(blob.subarray(5 + SALT_LENGTH, 5 + SALT_LENGTH + IV_LENGTH));
@@ -207,14 +208,14 @@ export async function decryptArchive(blob, info, kdfParam, password) {
     // 与此时真实的随机参数对齐（参数来自 verify 阶段读取，防调用方换参数）
     if (!blobSalt.equals(paramSalt) ||
         !blobIv.equals(paramIv)) {
-        throw new SecurityError('TAMPERED', '加密备份参数不一致（可能被篡改）');
+        throw new SecurityError('TAMPERED', securityMsg('security.archiveParamsMismatch'));
     }
     let key;
     try {
         key = await deriveKey(password, blobSalt, info.kdfParams);
     }
     catch (err) {
-        throw new SecurityError('BAD_PASSWORD', `密钥派生失败: ${err instanceof Error ? err.message : String(err)}`);
+        throw new SecurityError('BAD_PASSWORD', securityMsg('security.keyDerivationFailed', { reason: err instanceof Error ? err.message : String(err) }));
     }
     const decipher = crypto.createDecipheriv('aes-256-gcm', key, blobIv);
     decipher.setAuthTag(blobTag);
@@ -225,7 +226,7 @@ export async function decryptArchive(blob, info, kdfParam, password) {
         ]);
     }
     catch {
-        throw new SecurityError('BAD_PASSWORD', '解密认证失败：密码错误或密文被篡改');
+        throw new SecurityError('BAD_PASSWORD', securityMsg('security.decryptAuthFailed'));
     }
 }
 /**

package/lib/security/integrity.js

@@ -13,6 +13,7 @@
  */
 import { parseJsonSafe } from '../utils/json.js';
 import { buildChecksums as coreBuildChecksums, verifyChecksums as coreVerifyChecksums, } from '../utils/hashing.js';
+import { securityMsg } from './messages.js';
 export const SHA256_HEX_RE = /^[0-9a-f]{64}$/i;
 /** 与 core ZIP 条目数上限一致的默认表大小上限 */
 export const DEFAULT_MAX_CHECKSUM_ENTRIES = 10_000;
@@ -33,22 +34,22 @@ export function parseChecksumsTable(raw, opts = {}) {
     const maxEntries = opts.maxEntries ?? DEFAULT_MAX_CHECKSUM_ENTRIES;
     const parsed = parseJsonSafe(raw);
     if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
-        throw new Error('checksums.json 必须是 JSON 对象');
+        throw new Error(securityMsg('security.checksumsMustBeJsonObject'));
     }
     const entries = Object.entries(parsed);
     if (entries.length > maxEntries) {
-        throw new Error(`checksums.json 条目数 ${entries.length} 超过上限 ${maxEntries}`);
+        throw new Error(securityMsg('security.checksumsTooManyEntries', { count: entries.length, max: maxEntries }));
     }
     const table = {};
     for (const [relPath, hash] of entries) {
         if (DANGEROUS_KEYS.has(relPath)) {
-            throw new Error(`checksums.json 含危险键 "${relPath}"，已拒绝`);
+            throw new Error(securityMsg('security.checksumsDangerousKey', { path: relPath }));
         }
         if (relPath === '' || relPath.includes('\\') || relPath.startsWith('/')) {
-            throw new Error(`checksums.json 含非法相对路径 "${relPath}"`);
+            throw new Error(securityMsg('security.checksumsIllegalPath', { path: relPath }));
         }
         if (typeof hash !== 'string' || !SHA256_HEX_RE.test(hash)) {
-            throw new Error(`checksums.json["${relPath}"] 不是合法的 SHA-256 hex`);
+            throw new Error(securityMsg('security.checksumsNotSha256', { path: relPath }));
         }
         table[relPath] = hash;
     }
@@ -69,8 +70,8 @@ export function verifyChecksumsJson(entries, raw, opts = {}) {
 /** 人类可读的不匹配摘要（给「Backup integrity check failed」错误消息用） */
 export function describeMismatches(result) {
     const parts = [
-        ...result.mismatches.map((m) => `"${m}" (hash 不符)`),
-        ...result.missing.map((m) => `"${m}" (缺失)`),
+        ...result.mismatches.map((m) => securityMsg('security.checksumMismatch', { path: m })),
+        ...result.missing.map((m) => securityMsg('security.checksumMissing', { path: m })),
     ];
     return parts.join(', ');
 }

package/lib/security/messages.d.ts

@@ -0,0 +1,30 @@
+import type { MsgParams } from '../core/msg-types.ts';
+export declare const zh: {
+    readonly 'security.encryptionPasswordEmpty': '加密密码不能为空';
+    readonly 'security.secretsBlobTooSmall': 'secrets.enc 体积过小（截断或损坏）';
+    readonly 'security.unknownFileMagic': '未知文件格式 magic "{magic}"，不是本插件产物';
+    readonly 'security.unsupportedSecretsVersion': '不支持的 secrets.enc 版本 {version}';
+    readonly 'security.invalidEncryptionParams': 'manifest 加密参数非法或不受支持';
+    readonly 'security.encryptionParamsMismatch': 'secrets.enc 与 manifest 加密参数不一致（可能被篡改）';
+    readonly 'security.keyDerivationFailed': '密钥派生失败: {reason}';
+    readonly 'security.decryptAuthFailed': '解密认证失败：密码错误或密文被篡改';
+    readonly 'security.archiveBlobTooSmall': '加密备份容器体积过小（截断或损坏）';
+    readonly 'security.unsupportedArchiveVersion': '不支持的加密备份版本 {version}';
+    readonly 'security.archiveParamsMismatch': '加密备份参数不一致（可能被篡改）';
+    readonly 'security.checksumsMustBeJsonObject': 'checksums.json 必须是 JSON 对象';
+    readonly 'security.checksumsTooManyEntries': 'checksums.json 条目数 {count} 超过上限 {max}';
+    readonly 'security.checksumsDangerousKey': 'checksums.json 含危险键 "{path}"，已拒绝';
+    readonly 'security.checksumsIllegalPath': 'checksums.json 含非法相对路径 "{path}"';
+    readonly 'security.checksumsNotSha256': 'checksums.json["{path}"] 不是合法的 SHA-256 hex';
+    readonly 'security.checksumMismatch': '"{path}" (hash 不符)';
+    readonly 'security.checksumMissing': '"{path}" (缺失)';
+    readonly 'security.scanDepthExceeded': '扫描深度 {depth} 超过上限 {max}';
+    readonly 'security.circularReference': '检测到循环引用，无法扫描（路径 {path}）';
+    readonly 'security.vaultUnsafePath': 'vault: 非法敏感文件路径 "{path}"';
+    readonly 'security.zipTargetOutOfBounds': '解压目标越界: {name}';
+    readonly 'security.zipExecutableEntry': '条目 "{name}" 是潜在可执行文件，本插件不会执行它';
+    readonly 'security.zipEntryNotRegularFile': '解压产物不是普通文件: {rel}';
+};
+export declare const en: Record<keyof typeof zh, string>;
+/** 本域翻译器：key 受目录约束（拼错键 = 编译错误），语言按 engineMsg 的活语言解析。 */
+export declare function securityMsg(key: keyof typeof zh, params?: MsgParams): string;

package/lib/security/messages.js

@@ -0,0 +1,77 @@
+/**
+ * security 层的领域消息目录（zh 源 / en 镜像）—— 经 engineMsg 取「调用期」语言文案。
+ *
+ * 为什么是本域独立目录：src/security/** 的写作用域不含 src/core/messages.ts（既有键有冻结指纹），
+ * 所以本域的键用 registerMessageCatalog 在**模块加载时**注册进引擎目录，查找顺序见
+ * src/core/engine-locale.ts（基础目录 → 注册目录 → 键名）。
+ *
+ * 纪律（与 src/core/messages.ts 同口径）：
+ *  - zh 值 = 迁移前的既有中文文案**逐字不变**（既有测试断言依赖）；
+ *  - en 类型为 Record<keyof typeof zh, string> —— 缺键/多键即编译错误；
+ *  - {param} 插值与缺参保留由 engineMsg 负责；
+ *  - **凭据 / 密码值永不进消息**：这里只换文案，脱敏口径与拼接顺序逐字不变（转写前长什么样，
+ *    转写后还是什么样），绝不新增任何值参数。
+ */
+import { engineMsg, registerMessageCatalog } from '../core/engine-locale.js';
+export const zh = {
+    // ---------- 加密容器（encryption.ts） ----------
+    'security.encryptionPasswordEmpty': '加密密码不能为空',
+    'security.secretsBlobTooSmall': 'secrets.enc 体积过小（截断或损坏）',
+    'security.unknownFileMagic': '未知文件格式 magic "{magic}"，不是本插件产物',
+    'security.unsupportedSecretsVersion': '不支持的 secrets.enc 版本 {version}',
+    'security.invalidEncryptionParams': 'manifest 加密参数非法或不受支持',
+    'security.encryptionParamsMismatch': 'secrets.enc 与 manifest 加密参数不一致（可能被篡改）',
+    'security.keyDerivationFailed': '密钥派生失败: {reason}',
+    'security.decryptAuthFailed': '解密认证失败：密码错误或密文被篡改',
+    'security.archiveBlobTooSmall': '加密备份容器体积过小（截断或损坏）',
+    'security.unsupportedArchiveVersion': '不支持的加密备份版本 {version}',
+    'security.archiveParamsMismatch': '加密备份参数不一致（可能被篡改）',
+    // ---------- 完整性校验表（integrity.ts） ----------
+    'security.checksumsMustBeJsonObject': 'checksums.json 必须是 JSON 对象',
+    'security.checksumsTooManyEntries': 'checksums.json 条目数 {count} 超过上限 {max}',
+    'security.checksumsDangerousKey': 'checksums.json 含危险键 "{path}"，已拒绝',
+    'security.checksumsIllegalPath': 'checksums.json 含非法相对路径 "{path}"',
+    'security.checksumsNotSha256': 'checksums.json["{path}"] 不是合法的 SHA-256 hex',
+    'security.checksumMismatch': '"{path}" (hash 不符)',
+    'security.checksumMissing': '"{path}" (缺失)',
+    // ---------- 秘密扫描（secret-scanner.ts） ----------
+    'security.scanDepthExceeded': '扫描深度 {depth} 超过上限 {max}',
+    'security.circularReference': '检测到循环引用，无法扫描（路径 {path}）',
+    // ---------- vault / ZIP 安全（vault.ts / zip-security.ts） ----------
+    'security.vaultUnsafePath': 'vault: 非法敏感文件路径 "{path}"',
+    'security.zipTargetOutOfBounds': '解压目标越界: {name}',
+    'security.zipExecutableEntry': '条目 "{name}" 是潜在可执行文件，本插件不会执行它',
+    'security.zipEntryNotRegularFile': '解压产物不是普通文件: {rel}',
+};
+export const en = {
+    'security.encryptionPasswordEmpty': 'Encryption password must not be empty',
+    'security.secretsBlobTooSmall': 'secrets.enc is too small (truncated or corrupted)',
+    'security.unknownFileMagic': 'Unknown file format magic "{magic}"; not a product of this plugin',
+    'security.unsupportedSecretsVersion': 'Unsupported secrets.enc version {version}',
+    'security.invalidEncryptionParams': 'Invalid or unsupported manifest encryption parameters',
+    'security.encryptionParamsMismatch': 'secrets.enc encryption parameters do not match the manifest (possibly tampered with)',
+    'security.keyDerivationFailed': 'Key derivation failed: {reason}',
+    'security.decryptAuthFailed': 'Decryption authentication failed: wrong password or tampered ciphertext',
+    'security.archiveBlobTooSmall': 'Encrypted backup container is too small (truncated or corrupted)',
+    'security.unsupportedArchiveVersion': 'Unsupported encrypted backup version {version}',
+    'security.archiveParamsMismatch': 'Encrypted backup parameters do not match (possibly tampered with)',
+    'security.checksumsMustBeJsonObject': 'checksums.json must be a JSON object',
+    'security.checksumsTooManyEntries': 'checksums.json has {count} entries, exceeding the limit of {max}',
+    'security.checksumsDangerousKey': 'checksums.json contains a dangerous key "{path}", rejected',
+    'security.checksumsIllegalPath': 'checksums.json contains an illegal relative path "{path}"',
+    'security.checksumsNotSha256': 'checksums.json["{path}"] is not a valid SHA-256 hex string',
+    'security.checksumMismatch': '"{path}" (hash mismatch)',
+    'security.checksumMissing': '"{path}" (missing)',
+    'security.scanDepthExceeded': 'Scan depth {depth} exceeds the limit of {max}',
+    'security.circularReference': 'Circular reference detected, cannot scan (path {path})',
+    'security.vaultUnsafePath': 'vault: illegal sensitive file path "{path}"',
+    'security.zipTargetOutOfBounds': 'Extraction target escapes the destination: {name}',
+    'security.zipExecutableEntry': 'Entry "{name}" is a potential executable; this plugin will not execute it',
+    'security.zipEntryNotRegularFile': 'Extracted entry is not a regular file: {rel}',
+};
+registerMessageCatalog({ id: 'security', zh, en });
+/** 本域翻译器：key 受目录约束（拼错键 = 编译错误），语言按 engineMsg 的活语言解析。 */
+export function securityMsg(key, params) {
+    return engineMsg(key, params);
+}
+//# sourceMappingURL=messages.js.map

package/lib/security/redaction.js

@@ -46,6 +46,16 @@ export const REDACTION_VALUE_PATTERNS = [
 const VALUE_PATTERNS = REDACTION_VALUE_PATTERNS;
 /** URL query 中的敏感参数值（保留参数名，只替换值） */
 const URL_QUERY_RE = /([?&](?:token|api[_-]?key|key|secret|access[_-]?token|password|auth)=)([^&\s"']+)/gi;
+/**
+ * URL **内嵌凭据**（\`scheme://user:password@host\`，GitLab/Gitea 常见的 \`https://oauth2:<token>@…\`）。
+ *
+ * 为什么必须补这一条：URL_QUERY_RE 只认 query 参数，而 userinfo 形态的凭据此前在**三条通道**
+ * 都不被掩码 —— 日志、界面渲染、以及 sessionStorage 落盘（run-store 的 \`redactPersistedValue\`）。
+ * 宿主侧 sync-config 的 validateRepoUrl/validateWebDavUrl 本来就拒绝带 userinfo 的地址，
+ * 所以这里只影响「掩码」：不改任何合法输入的行为，只让非法规格里的凭据不再明文可见。
+ * 只替换密码段（用户名保留可读），与 URL_QUERY_RE 的取舍一致。
+ */
+const URL_USERINFO_RE = /(\/\/[^\/@\s:]+:)([^\/@\s]+)(@)/g;
 /* ---------------- 高熵长 token（journal / 迁移历史强脱敏共用） ---------------- */
 /** 高熵值形状（长 hex/base64/随机 id）：结构化 redact() 覆盖不了任意 secret，journal / 迁移
  *  历史级强脱敏补挡。
@@ -110,6 +120,7 @@ export function redact(text, blacklist = []) {
         out = out.replace(re, REDACTED);
     }
     out = out.replace(URL_QUERY_RE, `$1${REDACTED}`);
+    out = out.replace(URL_USERINFO_RE, `$1${REDACTED}$3`);
     return out;
 }
 /** 对象级掩码：字段名命中敏感名单 → 整值替换（返回新对象，不改原对象；结构与类型保留） */
@@ -138,6 +149,7 @@ export function createRedactor(blacklist = []) {
             out = out.replace(re, REDACTED);
         }
         out = out.replace(URL_QUERY_RE, `$1${REDACTED}`);
+        out = out.replace(URL_USERINFO_RE, `$1${REDACTED}$3`);
         return out;
     };
 }

package/lib/security/secret-scanner.js

@@ -22,9 +22,12 @@
  *  - 高熵 base64 默认关（误伤率高）。
  *
  * 实现不变量：返回 sanitized 为**全新对象**（不改原数据）；迭代式显式栈（防爆栈）+ 深度上限；
+ * 判环只看**当前路径的祖先链**（`ancestors`）——同一对象被两处引用（DAG）不是环，用全局 visited
+ * 会把共享引用误判成循环引用并让整次导出失败；
  * 命中记录只含路径与字段名，**值永不外泄**。
  */
 import { JsonDepthError } from '../utils/json.js';
+import { securityMsg } from './messages.js';
 /** 剥离占位（与 core defaultSecretScanner 语义一致：空串 = 需补录提示） */
 export const REDACTED_PLACEHOLDER = '';
 /**
@@ -322,14 +325,12 @@ export function scanAndRedact(data, opts = {}) {
     if (data instanceof Uint8Array)
         return { sanitized: data, hits };
     const rootOut = Array.isArray(data) ? [] : {};
-    const stack = [{ src: data, dst: rootOut, path: '', depth: 1 }];
-    const visited = new WeakSet();
-    visited.add(data);
+    const stack = [{ src: data, dst: rootOut, path: '', depth: 1, ancestors: new Set([data]) }];
     while (stack.length > 0) {
         const frame = stack.pop();
-        const { src, dst, path, depth } = frame;
+        const { src, dst, path, depth, ancestors } = frame;
         if (depth > maxDepth)
-            throw new JsonDepthError(`扫描深度 ${depth} 超过上限 ${maxDepth}`);
+            throw new JsonDepthError(securityMsg('security.scanDepthExceeded', { depth, max: maxDepth }));
         if (src instanceof Uint8Array)
             continue;
         if (Array.isArray(src)) {
@@ -338,12 +339,13 @@ export function scanAndRedact(data, opts = {}) {
                 const v = src[i];
                 const childPath = `${path}[${i}]`;
                 if (v !== null && typeof v === 'object' && !(v instanceof Uint8Array)) {
-                    if (visited.has(v))
-                        throw new Error(`检测到循环引用，无法扫描（路径 ${childPath}）`);
-                    visited.add(v);
+                    if (ancestors.has(v))
+                        throw new Error(securityMsg('security.circularReference', { path: childPath }));
+                    const childAncestors = new Set(ancestors);
+                    childAncestors.add(v);
                     const childOut = Array.isArray(v) ? [] : {};
                     outArr.push(childOut);
-                    stack.push({ src: v, dst: childOut, path: childPath, depth: depth + 1 });
+                    stack.push({ src: v, dst: childOut, path: childPath, depth: depth + 1, ancestors: childAncestors });
                 }
                 else {
                     outArr.push(v);
@@ -365,12 +367,13 @@ export function scanAndRedact(data, opts = {}) {
                 continue;
             }
             if (v !== null && typeof v === 'object' && !(v instanceof Uint8Array)) {
-                if (visited.has(v))
-                    throw new Error(`检测到循环引用，无法扫描（路径 ${childPath}）`);
-                visited.add(v);
+                if (ancestors.has(v))
+                    throw new Error(securityMsg('security.circularReference', { path: childPath }));
+                const childAncestors = new Set(ancestors);
+                childAncestors.add(v);
                 const childOut = Array.isArray(v) ? [] : {};
                 outObj[k] = childOut;
-                stack.push({ src: v, dst: childOut, path: childPath, depth: depth + 1 });
+                stack.push({ src: v, dst: childOut, path: childPath, depth: depth + 1, ancestors: childAncestors });
             }
             else {
                 outObj[k] = v;

package/lib/security/vault.js

@@ -22,6 +22,7 @@
  */
 import path from 'node:path';
 import { isPathSafe, normalizePath } from '../utils/paths.js';
+import { securityMsg } from './messages.js';
 /**
  * 默认敏感文件清单（相对 $DSH_HOME）：当前 DSH 唯一「整文件即秘密」的文件
  * （.credentials.yaml = 凭据明文 token/password/密钥）。
@@ -37,7 +38,7 @@ export function vaultRootOf(dataDir) {
 /** rel 必须为安全相对路径（拒绝绝对路径 / .. / 盘符 / NUL），防路径穿越 */
 function assertSafeRel(rel) {
     if (!isPathSafe(rel))
-        throw new Error(`vault: 非法敏感文件路径 "${rel}"`);
+        throw new Error(securityMsg('security.vaultUnsafePath', { path: rel }));
 }
 /** 校验 + 归一化 rel 清单（统一 / 分隔，与 FileSystemFacade.listRecursive 产出对齐） */
 function normalizeRels(rels) {

package/lib/security/zip-security.js

@@ -16,6 +16,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { isSameOrChild } from '../utils/paths.js';
 import { parseZip, ZipArchive, ZipSafetyError, } from '../utils/zip.js';
+import { securityMsg } from './messages.js';
 export { isPathSafe } from '../utils/paths.js';
 /** 可执行文件扩展名黑名单（§19.6：只警告，本插件不执行任何脚本） */
 export const EXECUTABLE_EXTENSIONS = new Set([
@@ -57,13 +58,13 @@ export async function safeExtractHardened(zipPath, destDir, limits = {}) {
                 continue;
             const target = path.join(destDir, ...meta.name.split('/'));
             if (!isSameOrChild(target, destDir)) {
-                throw new ZipSafetyError(`解压目标越界: ${meta.name}`);
+                throw new ZipSafetyError(securityMsg('security.zipTargetOutOfBounds', { name: meta.name }));
             }
             await fs.mkdir(path.dirname(target), { recursive: true });
             await fs.writeFile(target, archive.readEntry(meta.name));
             extracted.push(meta.name);
             if (isExecutableName(meta.name)) {
-                warnings.push(`条目 "${meta.name}" 是潜在可执行文件，本插件不会执行它`);
+                warnings.push(securityMsg('security.zipExecutableEntry', { name: meta.name }));
             }
         }
         // 解压后复查：全部产物必须是普通文件（防 symlink 逃逸 / 非常规写入）
@@ -71,7 +72,7 @@ export async function safeExtractHardened(zipPath, destDir, limits = {}) {
             const p = path.join(destDir, ...rel.split('/'));
             const st = await fs.lstat(p);
             if (!st.isFile()) {
-                throw new ZipSafetyError(`解压产物不是普通文件: ${rel}`);
+                throw new ZipSafetyError(securityMsg('security.zipEntryNotRegularFile', { rel }));
             }
         }
         return { files: extracted, warnings };

package/lib/sync/ancestor.js

@@ -4,6 +4,7 @@
  * 纯逻辑 + 可注入 fs；不触碰真实 ~/.dsh。
  */
 import { createSnapshotFs, joinFs } from './fs.js';
+import { engineMsg } from './messages.js';
 import { readSnapshotFromDir, writeSnapshotToDir } from './layout.js';
 import { SNAPSHOT_MANIFEST_FILE } from './layout.js';
 /** 默认保留的祖先快照数量（最旧超出则被裁剪）。 */
@@ -11,7 +12,7 @@ export const DEFAULT_ANCESTOR_KEEP = 10;
 /** 按 snapshotId 读取祖先快照目录；不存在抛错，不静默降级。 */
 export async function loadAncestor(localSnapshotsDir, snapshotId, fsx = createSnapshotFs()) {
     if (typeof snapshotId !== 'string' || snapshotId === '') {
-        throw new Error('loadAncestor: snapshotId 不能为空');
+        throw new Error(engineMsg('sync.ancestorSnapshotIdRequired'));
     }
     const dir = joinFs(localSnapshotsDir, snapshotId);
     return await readSnapshotFromDir(dir, fsx);

package/lib/sync/autosync-config.d.ts

@@ -24,6 +24,17 @@ export interface AutosyncConfig {
     /** 最近一次自动同步执行状态 */
     lastRunStatus?: AutosyncRunStatus;
     lastRunMessage?: string;
+    /**
+     * 最近一次**跳过**的结构化原因码（issue #79）。
+     *
+     * 为什么是码而不是文案：语言在「取文案那一刻」解析（AGENTS.md i18n 铁律），状态行由界面
+     * 按码取自己的字典；存一句当时语言的中文，用户切到英文界面后会看到中英混排。
+     * 已知值见 `svc.autosyncSkip.*` 的字典键（'conflict'/'mutation-locked'/'upToDate'…），
+     * **未知码一律渲染兜底文案，绝不渲染裸枚举**。
+     */
+    lastRunSkipReason?: string;
+    /** 最近一次跳过涉及的分区数（当前仅 conflict：远端另有 N 个分区待确认） */
+    lastRunSkipCount?: number;
     /** 最近一次自动同步触发的同步历史条目 id */
     lastRunHistoryId?: string;
 }

package/lib/sync/autosync-config.js

@@ -54,6 +54,13 @@ function parseV1Channel(obj) {
     }
     if (typeof obj['lastRunMessage'] === 'string')
         cfg.lastRunMessage = obj['lastRunMessage'];
+    // issue #79：状态行的结构化跳过原因（旧文件没有这两个字段 → undefined，行为不变）
+    if (typeof obj['lastRunSkipReason'] === 'string' && obj['lastRunSkipReason'] !== '') {
+        cfg.lastRunSkipReason = obj['lastRunSkipReason'];
+    }
+    if (typeof obj['lastRunSkipCount'] === 'number' && Number.isFinite(obj['lastRunSkipCount']) && obj['lastRunSkipCount'] >= 0) {
+        cfg.lastRunSkipCount = obj['lastRunSkipCount'];
+    }
     if (typeof obj['lastRunHistoryId'] === 'string')
         cfg.lastRunHistoryId = obj['lastRunHistoryId'];
     return cfg;
@@ -132,6 +139,11 @@ function toChannelPayload(cfg) {
         payload['lastRunStatus'] = cfg.lastRunStatus;
     if (cfg.lastRunMessage !== undefined && cfg.lastRunMessage !== '')
         payload['lastRunMessage'] = cfg.lastRunMessage;
+    // 空串/undefined 一律不写 → 本轮成功时，上一轮的跳过码/旧消息在文件里被真正清掉（issue #79）
+    if (cfg.lastRunSkipReason !== undefined && cfg.lastRunSkipReason !== '')
+        payload['lastRunSkipReason'] = cfg.lastRunSkipReason;
+    if (cfg.lastRunSkipCount !== undefined)
+        payload['lastRunSkipCount'] = cfg.lastRunSkipCount;
     if (cfg.lastRunHistoryId !== undefined && cfg.lastRunHistoryId !== '')
         payload['lastRunHistoryId'] = cfg.lastRunHistoryId;
     return payload;

package/lib/sync/autosync-scheduler.d.ts

@@ -134,7 +134,17 @@ export declare class AutoSyncScheduler {
     runOnce(channel: SyncTransportType, opts?: {
         startup?: boolean;
     }): Promise<AutosyncRunResult>;
-    /** 收尾：写该通道 autosync-config（lastRunAt, lastRunStatus, consecutiveFailures, lastRunHistoryId）。 */
+    /**
+     * 收尾：写该通道 autosync-config（lastRunAt / lastRunStatus / consecutiveFailures /
+     * lastRunHistoryId / 本轮消息与跳过原因）。
+     *
+     * issue #79：**每一轮都必须覆盖上一轮的 lastRunMessage 与 lastRunSkipReason**。
+     * 此前只在 `result.error !== undefined` 时写 lastRunMessage → 真机现场连续 16 次 skipped 期间，
+     * 面板一直挂着几天前「旧地址连接超时」，用户据此去查网络；跳过原因则只进了 info 级日志
+     * （默认日志级别 warn），所以「为什么没同步」在界面与日志里都看不见。
+     * 现在：失败写错误原文；跳过写**结构化原因码**（界面按码取字典，语言在渲染那刻解析）；
+     * 成功清空两者（空串/undefined 不进文件，见 autosync-config.toChannelPayload）。
+     */
     private writeFinalConfig;
     /** 连续失败 ≥ 3 → 通知（host.log.warn）。 */
     private maybeNotify;