dsh-config-manager 0.1.72 → 0.1.76

package/src/client/recovery/recovery-locales.ts

@@ -326,6 +326,21 @@ export const zh = {
   'rollback.badge.incomplete': '两态不全',
   'rollback.badge.protected': '受保护（只进不出）',
   'rollback.apiMissing': '当前宿主没有回滚点能力（插件版本过旧）：界面不假装可用',
+  /* —— issue #88 / #89：总开关（缺省关闭）+ 台账占用与清理 —— */
+  'rollback.switch.label': '启用回合自动留点',
+  'rollback.switch.hint': '关闭后不再订阅会话事件、不再写台账，聊天里的「↺ 回退」入口一并收起；已有回滚点仍可查看、回退与清理。',
+  'rollback.switch.unknown': '正在读取开关状态（还没读到之前不显示成「已关闭」）。',
+  'rollback.switch.diverged': '磁盘上的偏好是「开启」，但本进程没有启用留点（通常是被另一个 DSH 实例改过）。重新打开一次开关即可让本进程生效。',
+  'rollback.ledger.summary': '台账 {records} 个点 · {size}',
+  'rollback.ledger.budget': '字节预算 {budget}，已按预算淘汰 {evicted} 个最旧自动点',
+  'rollback.ledger.overBudget': '台账已到 {size}，超过 {budget} 的字节预算，但已经没有可自动淘汰的点了（通常是单个回滚点本身大于预算）—— 再增长请手动清理。',
+  'rollback.cleanup': '清理台账',
+  'rollback.cleanup.confirmTitle': '清理回滚点台账',
+  'rollback.cleanup.confirmMessage': '删除全部自动回滚点（救援点与受保护点按下面的勾选处置），并回收它们的内容副本。工作区文件与会话日志不会被改动。',
+  'rollback.cleanup.includeGuards': '同时删除救援点（回退前的自动救援点，删了不可撤销）',
+  'rollback.cleanup.done': '已删除 {records} 个回滚点，释放 {size}',
+  'rollback.cleanup.none': '没有可删除的回滚点（自动点为空）',
+  'rollback.switch.saveFailed': '开关保存失败，仍按原状态运行：',
   'rollback.retention.hint': '自动点：每会话最多 {perSession} 个、全局最多 {total} 个，超出只淘汰最旧的自动点。回退前的救援点不占这两个额度、也不被它们淘汰，但用户删不掉，所以另有自己的两道上限：每会话最多 {guardsPerSession} 个、全局最多 {guards} 个（无论按哪道算，超出都淘汰最旧的救援点）。',
   'rollback.autopoint.hint': '回滚点由每个回合结束时自动留：工作区快照 + 会话游标（没有「手动拍点」入口）。',
   'rollback.state.workspace': '工作区',
@@ -373,6 +388,7 @@ export const zh = {
   // t7 定点修正（captain 授权；既有键措辞修正，不是新增键）：该码现在有两种用法 ——
   // ① preview.session.reasonCode（仅供参考）；② 结果码：运行中的对话带文件段的回退被硬拒（工作区零改动）。
   'rollback.code.session-active': '这条对话正在运行（会话日志刚被写过）：此时带文件段的回退会被拒绝、工作区一个字节都不动；只回溯消息不受影响（回退只 fork 子会话，不改写原日志）',
+  'rollback.code.subagent-session': '这是子代理会话（origin=subagent），插件不为它自动留回滚点：它的工作区与父对话相同，留点只会挤占你自己对话的台账空间。',
   // t8（只追加，不动上面那条既有键）：对话**正在运行**时 —— 默认只回溯消息，带工作区段的回退在路由层被拒
   'rollback.preview.sessionActive': '这条对话正在运行：本轮结束前只回溯消息（不改动工作区），避免与正在写盘的工具抢文件。等本轮结束后重新打开本弹窗，即可连文件一起回退。',
   'rollback.sessionActive.denied': '这条对话正在运行：本次一个文件都没有改动。请等本轮结束，或改成「只回溯消息」再试。',
@@ -380,7 +396,7 @@ export const zh = {
   'rollback.code.fork-failed': 'fork 子会话失败，会话段未回退',
   'rollback.code.capture-failed': '该态留点失败',
   'rollback.code.capture-truncated': '该态留点到达上限被截断（已如实标注）',
-  'rollback.code.capture-degraded': '该态留点不完整（有链接或读不到的内容被跳过，已逐条留痕）',
+  'rollback.code.capture-degraded': '该态留点不完整（有读不到或期间被改写的内容，已逐条留痕）',
   'rollback.code.no-chunks': '没有给出工作区路径分块',
   'rollback.code.chunk-not-absolute': '工作区分块必须是绝对路径',
   'rollback.code.chunk-not-found': '工作区分块不存在或不可用',
@@ -399,7 +415,7 @@ export const zh = {
   'rollback.warn.trackDegraded': '有一态留得不完整（回退可能不完整）',
   'rollback.warn.protected': '该回滚点受保护（只进不出）：不可回退、不可删除',
   'rollback.warn.guardFailed': '回退前的救援点没留成（已记告警后继续）',
-  'rollback.warn.createdRefused': '本次不删除任何「留点后新建」的路径：捕获时的证明名单不完整（有整目录被忽略 / 路径索引缺失 / 目录读不出），无法证明哪些是新建的',
+  'rollback.warn.createdRefused': '本次不删除任何「留点后新建」的路径：捕获时的证明名单不完整（有整目录被忽略 / 路径索引缺失 / 目录读不出 / 留点被时间预算中断），无法证明哪些是新建的',
   'rollback.warn.unknown': '未识别的告警（技术细节见下方）',
   'rollback.preview': '预览回退',
   /* 2026-10-10 用户第三条：预览对话框改简洁版，标题就叫「回退预览」（不再带副标题）。
@@ -450,7 +466,6 @@ export const zh = {
   'rollback.diff.after': '回退后',
   'rollback.diff.identical': '该文件与回退点内容一致，回退不会改动它',
   'rollback.diff.degraded': '差异规模较大，已按整块替换展示（仍是完整结果，只是不是最小的编辑脚本）',
-  'rollback.diff.truncated': '只画了前 {shown} 行（共 {total} 行），数据本身是完整的',
   'rollback.diff.reason.missingBlob': '这份内容副本读不出来，无法逐行对照（回退仍会尝试写回它）',
   'rollback.diff.reason.binary': '不是文本文件，没有逐行差异可看',
   'rollback.diff.reason.tooLarge': '文件超过展示上限，没有逐行差异可看（回退仍会照常覆盖它）',
@@ -895,6 +910,21 @@ export const en: Record<keyof typeof zh, string> = {
   'rollback.badge.incomplete': 'One of two states missing',
   'rollback.badge.protected': 'Protected (kept forever)',
   'rollback.apiMissing': 'This host has no rollback-point support (plugin too old): the UI does not pretend otherwise',
+  /* —— issues #88 / #89: master switch (off by default) + ledger footprint and cleanup —— */
+  'rollback.switch.label': 'Enable automatic per-turn rollback points',
+  'rollback.switch.hint': 'When off, the plugin no longer subscribes to session events or writes the ledger, and the rewind entry is removed from chat. Existing points can still be viewed, rewound and cleaned up.',
+  'rollback.switch.unknown': 'Reading the switch state (it is not shown as "off" until it has been read).',
+  'rollback.switch.diverged': 'The stored preference says "on", but this process has rollback points disabled (usually because another DSH instance changed it). Toggle the switch once to apply it here.',
+  'rollback.ledger.summary': 'Ledger: {records} points · {size}',
+  'rollback.ledger.budget': 'Byte budget {budget}; {evicted} oldest automatic point(s) already evicted by the budget',
+  'rollback.ledger.overBudget': 'The ledger is at {size}, over the {budget} byte budget, and no automatic point is left to evict (usually a single point is larger than the budget) — clean up manually to shrink it.',
+  'rollback.cleanup': 'Clean up ledger',
+  'rollback.cleanup.confirmTitle': 'Clean up the rollback-point ledger',
+  'rollback.cleanup.confirmMessage': 'Delete every automatic rollback point (rescue and protected points follow the checkbox below) and reclaim their content copies. Workspace files and session logs are not touched.',
+  'rollback.cleanup.includeGuards': 'Also delete rescue points (pre-rewind rescue points; deletion is irreversible)',
+  'rollback.cleanup.done': 'Deleted {records} rollback point(s), reclaimed {size}',
+  'rollback.cleanup.none': 'Nothing to delete (no automatic points)',
+  'rollback.switch.saveFailed': 'Saving the switch failed; the previous state is still in effect:',
   'rollback.retention.hint': 'Automatic points: at most {perSession} per session and {total} in total; eviction only drops the oldest automatic points. Pre-rewind rescue points do not count against those two budgets, and those budgets do not evict them; but you cannot delete them, so they have their own two limits: at most {guardsPerSession} per session and {guards} in total (whichever limit is passed, the oldest rescue point is evicted).',
   'rollback.autopoint.hint': 'Rollback points are kept automatically at the end of each turn: workspace snapshot plus session cursor (there is no manual capture entry).',
   'rollback.state.workspace': 'Workspace',
@@ -938,6 +968,7 @@ export const en: Record<keyof typeof zh, string> = {
   // t7 targeted wording fix (captain-authorized; existing key, not a new one): the code now has two uses —
   // (1) preview.session.reasonCode (informational); (2) a *result* code: a files-including rewind is refused while the conversation runs.
   'rollback.code.session-active': 'This conversation is running (its session log was written recently): a rewind that includes files is refused and the workspace stays untouched; rewinding the conversation only is unaffected (the rewind forks a child session and never rewrites the log)',
+  'rollback.code.subagent-session': 'This is a subagent session (origin=subagent), so no automatic rollback point is kept for it: it shares the workspace with its parent, and points here would only crowd out the ledger space of your own conversation.',
   // t8 (append-only; the key above keeps its own wording): the conversation is running
   'rollback.preview.sessionActive': 'This conversation is running: until the current turn finishes you can rewind the conversation only (no workspace changes), so nothing races with the tool that is writing files. Reopen this dialog after the turn to rewind files as well.',
   'rollback.sessionActive.denied': 'This conversation is running: no files were changed. Wait for the current turn to finish, or rewind the conversation only.',
@@ -945,7 +976,7 @@ export const en: Record<keyof typeof zh, string> = {
   'rollback.code.fork-failed': 'Forking the child session failed; the session segment was not rolled back',
   'rollback.code.capture-failed': 'Failed to capture this state',
   'rollback.code.capture-truncated': 'This state hit the capture limit and was truncated (recorded honestly)',
-  'rollback.code.capture-degraded': 'This state was captured incompletely (skipped links or unreadable entries are recorded)',
+  'rollback.code.capture-degraded': 'This state was captured incompletely (unreadable entries, or files rewritten while capturing, are recorded)',
   'rollback.code.no-chunks': 'No workspace path chunks were provided',
   'rollback.code.chunk-not-absolute': 'Workspace chunks must be absolute paths',
   'rollback.code.chunk-not-found': 'Workspace chunk is missing or unusable',
@@ -964,7 +995,7 @@ export const en: Record<keyof typeof zh, string> = {
   'rollback.warn.trackDegraded': 'A state was captured incompletely (the rewind may be incomplete)',
   'rollback.warn.protected': 'This rollback point is protected (kept forever): no rewind, no delete',
   'rollback.warn.guardFailed': 'The pre-rewind rescue point failed (continued with a warning)',
-  'rollback.warn.createdRefused': 'Nothing created after this point was deleted: the capture-time proof list is incomplete (a whole directory was ignored / the path index is missing / a directory was unreadable), so newly created paths cannot be proven',
+  'rollback.warn.createdRefused': 'Nothing created after this point was deleted: the capture-time proof list is incomplete (a whole directory was ignored / the path index is missing / a directory was unreadable / the capture was cut short by its time budget), so newly created paths cannot be proven',
   'rollback.warn.unknown': 'Unrecognized warning (technical detail below)',
   'rollback.preview': 'Preview rewind',
   'rollback.preview.title': 'Rewind preview',
@@ -1000,7 +1031,6 @@ export const en: Record<keyof typeof zh, string> = {
   'rollback.diff.after': 'After rewind',
   'rollback.diff.identical': 'This file already matches the rollback point, so the rewind will not change it',
   'rollback.diff.degraded': 'The diff is large, so it is shown as a whole-block replacement (still complete, just not a minimal edit script)',
-  'rollback.diff.truncated': 'Only the first {shown} of {total} rows are drawn (the data itself is complete)',
   'rollback.diff.reason.missingBlob': 'The stored content copy cannot be read, so no line-by-line comparison is possible (the rewind will still try to write it back)',
   'rollback.diff.reason.binary': 'Not a text file, so there is no line-by-line diff to show',
   'rollback.diff.reason.tooLarge': 'The file exceeds the display limit, so there is no line-by-line diff (the rewind will still overwrite it)',

package/src/client/recovery/rollback-enabled.ts

@@ -0,0 +1,41 @@
+/**
+ * 聊天内「↺ 回退」入口的**可见性信号**（issue #88）。
+ *
+ * 为什么需要这个模块：入口注册（`conversation.chat.node` 的 user key 遮蔽）必须在挂载时就发生，
+ * 但「功能开着没有」要到拿到宿主状态才知道；而开关可以在不重载插件的前提下改变。
+ * 所以注册本身就是无常的，可见性由这个**进程内信号**驱动：读一次状态 → 写进信号 → 组件订阅重渲染。
+ *
+ * 约定：
+ *  · **缺省 = 关闭**（`false`）：与宿主侧「缺省不启用」同一条口径，绝不因为「还没读到」就把入口画出来；
+ *  · 读失败**不改信号**（保持上一次已知值）：一次网络抖动不该让入口闪没；
+ *  · 只存一个布尔，不落 storage（不涉及敏感值，也没有跨会话保留的必要）。
+ */
+
+let enabled = false
+const listeners = new Set<() => void>()
+
+export function isRollbackEntryEnabled(): boolean {
+  return enabled
+}
+
+/** 设置可见性并通知订阅者；值未变时不通知（避免无意义的重渲染）。 */
+export function setRollbackEntryEnabled(value: boolean): void {
+  const next = value === true
+  if (next === enabled) return
+  enabled = next
+  for (const listener of [...listeners]) {
+    try {
+      listener()
+    } catch {
+      /* 单个订阅者自己的问题不影响信号 */
+    }
+  }
+}
+
+/** 订阅可见性变化（React 组件用；返回解绑函数）。 */
+export function subscribeRollbackEntryEnabled(listener: () => void): () => void {
+  listeners.add(listener)
+  return () => {
+    listeners.delete(listener)
+  }
+}

package/src/client/recovery/rollback-file-changes.test.ts

@@ -17,6 +17,14 @@ const HERE = dirname(fileURLToPath(import.meta.url))
 const CHANGES = join(HERE, 'RollbackFileChanges.tsx')
 const CARD = join(HERE, 'RollbackCard.tsx')
 const DIALOG = join(HERE, '../chat/RollbackReviewDialog.tsx')
+const PANE = join(HERE, 'RollbackDiffPane.tsx')
+const TABLE = join(HERE, '../common/DiffTable.tsx')
+const TAB = join(HERE, '../chat/RollbackDiffTab.tsx')
+const CSS = join(HERE, '../config-manager.module.css')
+const PLAN = join(HERE, '../library/RestorePlanView.tsx')
+const RECOVERY_LOCALES = join(HERE, 'recovery-locales.ts')
+const CLIENT_LOCALES = join(HERE, '../locales.ts')
+const PROXY = join(HERE, '../index.ts')
 
 test('清单结构：容器 + 两类行 + 图标 + 目录弱化 + 右对齐统计（源级）', () => {
   const src = readFileSync(CHANGES, 'utf8')
@@ -71,3 +79,72 @@ test('两处调用同一份渲染：聊天预览 + 设置页回滚卡预览（
   assert.match(card, /css\.planScroll/, '几百个文件的清单必须限高内滚')
   assert.doesNotMatch(card, /rollbackPreviewRows\(/, '预览弹窗不再画工作区/会话计数面板（与聊天预览同一屏）')
 })
+
+test('差异表全量渲染：渲染层不再有行数上限，也不再有「只画了前 N 行」话术（源级，2026-10-15）', () => {
+  const table = readFileSync(TABLE, 'utf8')
+  assert.doesNotMatch(table, /DIFF_ROW_CAP|rowCap|truncatedNotice/, '渲染层不得再留行数上限（用户 2026-10-15：我需要能完整的加载）')
+  assert.match(table, /group\.rows\.map\(/, '每个块的行必须全部画出来')
+  const pane = readFileSync(PANE, 'utf8')
+  assert.doesNotMatch(pane, /truncatedNotice/, '回滚预览不再传截断文案')
+  assert.match(pane, /rollback\.diff\.degraded/, '「整块替换」提示保留：那是算法保真度的事实，不是渲染截断')
+  const plan = readFileSync(PLAN, 'utf8')
+  assert.doesNotMatch(plan, /truncatedNotice/, '恢复计划不再传截断文案')
+  for (const file of [RECOVERY_LOCALES, CLIENT_LOCALES]) {
+    assert.doesNotMatch(readFileSync(file, 'utf8'), /diffTruncated|diff\.truncated/, '截断话术必须删除：没有上限就不该留这句话')
+  }
+})
+
+test('差异表文件头：只画路径文字，不画文件类型图标（源级，2026-10-14 用户第 2 次改口径）', () => {
+  const table = readFileSync(TABLE, 'utf8')
+  assert.doesNotMatch(table, /diffFileIcon/, '文件头不再有图标格子')
+  assert.doesNotMatch(table, /icon\?: ReactNode/, '共享原语不再收图标节点（那颗链整个撤掉）')
+  assert.match(table, /className=\{css\.diffFilePath \+ ' ' \+ css\.mono\}/, '路径文字仍是文件头的唯一内容')
+  const pane = readFileSync(PANE, 'utf8')
+  assert.doesNotMatch(pane, /RollbackFileIcon/, '差异面板不再引文件类型图标')
+  assert.doesNotMatch(pane, /renderFileIcon/, '差异面板不再收外部图标来源')
+})
+
+test('侧栏标签页吃满宿主高度：不再自带一道 vh/px 上限（源级）', () => {
+  const tab = readFileSync(TAB, 'utf8')
+  assert.match(tab, /title=\{target\.path\} fill \/>/, '侧栏标签页：撑满那一屏')
+  const dialog = readFileSync(DIALOG, 'utf8')
+  assert.match(dialog, /<RollbackDiffPane state=\{inlineDiff\.state\} rt=\{rt\} title=\{inlineDiff\.path\} \/>/, '弹窗内的降级通道照旧画差异')
+  assert.doesNotMatch(dialog, /RollbackDiffPane[^>]*\bfill\b/, '弹窗内的就地差异不给 fill（宿主面板高度不是它那一屏）')
+  const css = readFileSync(CSS, 'utf8')
+  assert.match(css, /\.diffPaneFill \{[\s\S]{0,120}?height: 100%/, 'fill 档必须 height:100% 才谈得上「= 侧栏大小」')
+  assert.match(css, /\.diffPaneFill \.diffScroll \{[\s\S]{0,200}?min-height: 0/, 'flex 链必须允许收缩，否则内容顶破父容器（min-height:auto 陷阱）')
+  // 撑满档整块取出来判定（块里现在还要容下 flex:auto 的依据注释，按字符窗口量距离会被注释挤爆）
+  const fillBlock = css.slice(css.indexOf('.diffPaneFill {'), css.indexOf('.diffPaneFill .diffScroll'))
+  assert.match(fillBlock, /\bmargin: 0/, '撑满档必须归零外边距：否则 100% 之外多出 10px，宿主面板自己冒一条滚动条')
+  // 行盒 = 12×1.5 + 上下 1px ⇒ 20px/行：845px 宽的侧栏里 24 行折成 35 个视觉行，22px 差一行就溢出
+  assert.match(css, /\.diffCell \{[\s\S]{0,80}?padding: 1px 6px/, '差异单元格上下内边距必须是 1px（20px 行高才装得进侧栏那一屏）')
+})
+test('侧栏标签页吃满宿主高度：整块高度跟侧栏走（源级，2026-10-15）', () => {
+  const css = readFileSync(CSS, 'utf8')
+  // ① 正文限高必须排在「列表量级」那条**之后**：两条特异性同为 (0,2,0)，顺序决定胜负；
+  //    写在前面时 min(80vh, 800px) 会盖掉它 —— 侧栏比它高时差异区就停在那儿，
+  //    正是用户 2026-10-15 报的「预览高度不跟侧栏走」。
+  const listCap = css.indexOf('.diffPane .diffScroll')
+  const fillCap = css.indexOf('.diffPaneFill .diffScroll')
+  assert.ok(listCap >= 0 && fillCap >= 0, '两条限高规则都必须存在')
+  assert.ok(fillCap > listCap, 'fill 档的限高必须排在 .diffPane .diffScroll 之后（顺序决定胜负）')
+  assert.doesNotMatch(css.slice(fillCap, fillCap + 400), /min\(80vh, 800px\)/, 'fill 档不得再吃列表量级的 min(80vh, 800px) 上限')
+  // ② 撑满档下**每个出口**都要套同一个整块容器：只让「就绪且有差异」撑满时，
+  //    加载 / 一致 / 看不了 / 读失败会缩成一行，一屏高度来回跳（同样是「高度不跟侧栏走」）。
+  const pane = readFileSync(PANE, 'utf8')
+  assert.equal([...pane.matchAll(/return shell\(/g)].length, 5, '加载 / 读失败 / 结构化拒绝 / 看不了 / 一致 五个出口都要经同一个撑满容器')
+  assert.match(pane, /fill === true \? <div className=\{css\.diffPane \+ ' ' \+ css\.diffPaneFill\}>/, '撑满容器必须是 .diffPane + .diffPaneFill 那一对类名')
+})
+
+test('标签页芯片：[文件类型图标][文件名]，只经 title 位注册（源级）', () => {
+  const tab = readFileSync(TAB, 'utf8')
+  assert.match(tab, /export function RollbackDiffTabTitle/, '芯片必须是独立组件（正文位与芯片位两份注册）')
+  assert.match(tab, /className=\{css\.rollbackTabIcon\} aria-hidden="true"/, "芯片图标必须有独立格子且是装饰性的（可访问名由文件名文字承担）")
+  assert.match(tab, /<RollbackFileIcon path=\{target\.path\} size=\{14\} render=\{fileIcon\} \/>/, '芯片图标走共享的文件类型图标（与 DSH 侧栏同一画法）')
+  assert.match(tab, /if \(target === null\) return/, '地址读不出来时退回宿主给的标题文字（不空着、也不自己编名字）')
+  const index = readFileSync(PROXY, 'utf8')
+  assert.match(index, /ROLLBACK_DIFF_TITLE_SLOT/, '装配点必须注册芯片位（宿主的 tab 定义没有 icon 字段）')
+  assert.match(index, /name: ROLLBACK_DIFF_TITLE_SLOT,[\s\S]{0,80}?key: ROLLBACK_DIFF_TAB_ID/, '芯片位必须按正文同一个实现 id 注册（同一个 tab 才认领得到）')
+  const css = readFileSync(CSS, 'utf8')
+  assert.match(css, /\.rollbackTabIcon \{[\s\S]{0,160}?margin-right: 6px/, '芯片图标与文件名之间要有间距（与 better-sidebar 的 chipIcon 同档）')
+})

package/src/client/sync/PushPreviewCard.tsx

@@ -0,0 +1,57 @@
+/**
+ * t42 物理拆分（从 SyncPanel.tsx 抽出的渲染段；同领域目录平铺）。
+ *
+ * 为什么它值得单独一个文件：这张卡有**四条**并列提示带（只读说明 / 首次基线 / 加密 /
+ * 含凭据），issue #91 又补了第五条「引擎告警」——留在主文件里只会把
+ * `SyncSettingsView.test.ts` 的行数棘轮一节节往上抬（该棘轮的口径：新增行必须是
+ * 确实无法下沉的装配；能抽就抽，而不是调上限）。
+ *
+ * 约定（与 AutosyncCard / WorkDirCard 一致）：只接收「渲染所需的数据」；
+ * 渲染模型仍来自 `./sync-view.ts` 的 `pushPreviewView`（纯函数、node 单测覆盖），本文件零逻辑。
+ */
+import type { TranslateNS } from '../client-types.ts'
+import type { SyncPushPreview } from '../../sync/sync-engine.ts'
+import type { UiT } from '../../ui/i18n.ts'
+import type { SectionId } from '../../schema/types.ts'
+import { Banner, Card } from '../common/ui.tsx'
+import { pushPreviewView } from './sync-view.ts'
+import css from '../config-manager.module.css'
+
+/** P0-②：push 预览内容（绑 src/ui/i18n.ts 的 UiT 文案；纯展示，无敏感字段）。 */
+export function PushPreviewCard({ preview, t, uiT, sectionName }: {
+  preview: SyncPushPreview | null
+  t: TranslateNS<'config-manager-sync'>
+  uiT: UiT
+  sectionName: (id: SectionId) => string
+}) {
+  const view = pushPreviewView(preview, uiT)
+  if (view === null) return null
+  if (view.error !== null) return <Banner kind="error">{view.error}</Banner>
+  return (
+    <div>
+      <Banner kind="info">{view.headline}</Banner>
+      {view.previewHint !== '' && <div className={css.hint}>{view.previewHint}</div>}
+      {view.remoteSnapshotCount === 0 && (
+        <Banner kind="warn">{t('syncflow.pushFirstBaseline')}</Banner>
+      )}
+      {view.encryptedHint !== '' && <Banner kind="warn">{view.encryptedHint}</Banner>}
+      {view.credentialsHint !== '' && <Banner kind="warn">{view.credentialsHint}</Banner>}
+      {/* 引擎告警（分区导出失败已跳过 / 本地源插件未打包 ⇒ 该分区不做「无变化」断言，issue #91）：
+          如实上屏 —— 否则预览的分区数会静静地少，或者某个分区永远显示「有变化」而无解释 */}
+      {view.hint !== '' && <Banner kind="warn">{view.hint}</Banner>}
+      <Card className={css.card}>
+        <div className={css.groupLabel}>{t('syncflow.pushPreviewSections')}</div>
+        <div className={css.planScroll}>
+          <ul className={css.reportList}>
+            {view.rows.map((row) => (
+              <li key={row.section}>
+                <span className={css.kindTag}>{row.changed ? t('syncflow.pushChanged') : t('syncflow.pushUnchanged')}</span>
+                {' '}{sectionName(row.section)} · {row.count}
+              </li>
+            ))}
+          </ul>
+        </div>
+      </Card>
+    </div>
+  )
+}

package/src/client/sync/SyncPanel.tsx

@@ -43,7 +43,6 @@ import { useEffect, useRef, useState } from 'react'
 import type { ReactNode } from 'react'
 import type { TranslateNS } from '../client-types.ts'
 import type { SyncPullReport, SyncPushPreview, SyncPushReport } from '../../sync/sync-engine.ts'
-import type { UiT } from '../../ui/i18n.ts'
 import type { SectionId } from '../../schema/types.ts'
 import { Badge, Banner, Button, Card, SectionTitle, Spinner } from '../common/ui.tsx'
 import { ErrorBanner } from '../common/ErrorBanner.tsx'
@@ -61,7 +60,7 @@ import type {
 } from './sync-api.ts'
 import {
   channelMapOf, channelStateMap, computeGithubLoginView, computeSyncButtons, defaultChannelSyncState,
-  githubPollMessage, isClientChannel, kindLabel, pullReportView, pushPreviewView, pushReportView, readStoredChannel,
+  githubPollMessage, isClientChannel, kindLabel, pullReportView, pushReportView, readStoredChannel,
   gistSessionsRiskKey,
   initialSyncSections, normalizeSessionsLimit, severityLabel, syncSectionOptions, writeStoredChannel,
 } from './sync-view.ts'
@@ -92,6 +91,7 @@ import { WorkDirCard } from './WorkDirCard.tsx'
 import { Collapse } from '../common/Motion.tsx'
 import { SyncLogList } from './SyncLogList.tsx'
 import { UnreadableSnapshotsBanner } from './UnreadableSnapshotsBanner.tsx'
+import { PushPreviewCard } from './PushPreviewCard.tsx'
 import { SyncConfirmView } from './SyncConfirmView.tsx'
 import css from '../config-manager.module.css'
 
@@ -1544,40 +1544,5 @@ export function SyncPanel({ api, t, cmT }: SyncPanelProps) {
   )
 }
 
-/** P0-②：push 预览内容（绑 src/ui/i18n.ts 的 UiT 文案；纯展示，无敏感字段）。 */
-function PushPreviewCard({ preview, t, uiT, sectionName }: {
-  preview: SyncPushPreview | null
-  t: TranslateNS<'config-manager-sync'>
-  uiT: UiT
-  sectionName: (id: SectionId) => string
-}) {
-  const view = pushPreviewView(preview, uiT)
-  if (view === null) return null
-  if (view.error !== null) return <Banner kind="error">{view.error}</Banner>
-  return (
-    <div>
-      <Banner kind="info">{view.headline}</Banner>
-      {view.previewHint !== '' && <div className={css.hint}>{view.previewHint}</div>}
-      {view.remoteSnapshotCount === 0 && (
-        <Banner kind="warn">{t('syncflow.pushFirstBaseline')}</Banner>
-      )}
-      {view.encryptedHint !== '' && <Banner kind="warn">{view.encryptedHint}</Banner>}
-      {view.credentialsHint !== '' && <Banner kind="warn">{view.credentialsHint}</Banner>}
-      <Card className={css.card}>
-        <div className={css.groupLabel}>{t('syncflow.pushPreviewSections')}</div>
-        <div className={css.planScroll}>
-          <ul className={css.reportList}>
-            {view.rows.map((row) => (
-              <li key={row.section}>
-                <span className={css.kindTag}>{row.changed ? t('syncflow.pushChanged') : t('syncflow.pushUnchanged')}</span>
-                {' '}{sectionName(row.section)} · {row.count}
-              </li>
-            ))}
-          </ul>
-        </div>
-      </Card>
-    </div>
-  )
-}
 
 

package/src/client/sync/SyncSettingsView.test.ts

@@ -62,6 +62,9 @@ test('t42: 组件按职责物理拆分成独立文件（各自导出 + 主文件
     ['AutosyncCard', 'AutosyncCard.tsx'],
     // issue #79：工作副本卡（含确认弹窗 + 宿主调用 + 回执）自成文件，主文件只装配 —— 行数棘轮因此不必上调
     ['WorkDirCard', 'WorkDirCard.tsx'],
+    // issue #91：推送预览卡（五条并列提示带：只读 / 首次基线 / 加密 / 含凭据 / 引擎告警）自成文件，
+    // 主文件只装配 —— 同样以「抽出去」而不是「抬上限」满足棘轮
+    ['PushPreviewCard', 'PushPreviewCard.tsx'],
   ]
   for (const [name, file] of units) {
     // 主文件：必须 import 并渲染该单元

package/src/client/sync/sync-push-preview.test.ts

@@ -74,4 +74,18 @@ test('pushPreviewView: 含凭据推送 → 显式提示「本次含真实凭据
 
 test('pushPreviewView: null 预览 → null（无弹窗内容）', () => {
   assert.equal(pushPreviewView(null, t), null);
+});
+
+test('pushPreviewView: 引擎告警（分区导出失败已跳过 / 本地源插件未打包 ⇒ 不做「无变化」断言）如实上屏（issue #91）', () => {
+  const withHint = pushPreviewView(okPreview({ message: 'plugins 与基线不可比' }), t);
+  assert.ok(withHint !== null && withHint.ok);
+  assert.equal(withHint.hint, 'plugins 与基线不可比');
+
+  const noHint = pushPreviewView(okPreview(), t);
+  assert.ok(noHint !== null);
+  assert.equal(noHint.hint, '', '无告警时不占版面');
+
+  const failed = pushPreviewView({ ok: false, sections: [], remoteSnapshotCount: 0, encrypted: false, credentialsIncluded: false, message: 'boom' }, t);
+  assert.ok(failed !== null && !failed.ok);
+  assert.equal(failed.hint, '', '错误分支只用 error，不重复显示同一句');
 });

package/src/client/sync/sync-view.test.ts

@@ -197,7 +197,7 @@ test('sync-view: summarizePullChanges 空数组 → total 0 且不需决策', ()
 test('sync-view: kindLabel / severityLabel 覆盖关键类型', () => {
   assert.equal(kindLabel('Conflict', zhUiT), '冲突')
   assert.equal(kindLabel('Install', zhUiT), '安装')
-  assert.equal(kindLabel('MissingSecret', zhUiT), '缺密钥')
+  assert.equal(kindLabel('MissingSecret', zhUiT), '凭据迁移')
   assert.equal(severityLabel('error', zhUiT), '错误')
   assert.equal(severityLabel('warning', zhUiT), '警告')
   assert.equal(severityLabel('info', zhUiT), '信息')

package/src/client/sync/sync-view.ts

@@ -614,6 +614,12 @@ export interface PushPreviewView {
   credentialsHint: string;
   /** 只读提示（预览不写远端） */
   previewHint: string;
+  /**
+   * 引擎随预览回传的告警（分区导出失败、本地源插件未打包导致该分区无法与基线比对等）；
+   * 为空串 = 无告警（不占版面）。ok 预览也需要显示它：否则「某分区导出失败已跳过」只存在于
+   * 响应体里，用户看到的分区数会静静变少。
+   */
+  hint: string;
   headline: string;
   error: string | null;
 }
@@ -624,7 +630,8 @@ export function pushPreviewView(preview: SyncPushPreview | null, t: UiT): PushPr
   if (!preview.ok) {
     return {
       ok: false, rows: [], changedCount: 0, remoteSnapshotCount: preview.remoteSnapshotCount,
-      encryptedHint: '', credentialsHint: '', previewHint: '', headline: '', error: preview.message ?? t('sync.pushFailed'),
+      encryptedHint: '', credentialsHint: '', previewHint: '', hint: '', headline: '',
+      error: preview.message ?? t('sync.pushFailed'),
     };
   }
   const rows = preview.sections.map((s) => ({ section: s.section, count: s.count, changed: s.changed }));
@@ -637,6 +644,7 @@ export function pushPreviewView(preview: SyncPushPreview | null, t: UiT): PushPr
     encryptedHint: preview.encrypted ? t('sync.pushPreviewEncrypted') : '',
     credentialsHint: preview.credentialsIncluded ? t('sync.pushPreviewCredentials') : '',
     previewHint: t('sync.pushPreviewHint'),
+    hint: preview.message ?? '',
     headline: t('sync.pushPreviewHeadline', {
       total: String(preview.sections.length),
       changed: String(changedCount),

package/src/core/analyzer.ts

@@ -26,7 +26,7 @@ import type { FilesSection, Manifest, SectionId } from '../schema/types.ts';
 import { loadTombstones, isTombstoned } from '../schema/tombstones.ts';
 import type { Tombstone, TombstoneKind } from '../schema/tombstones.ts';
 import { DEFAULT_SENSITIVE_RELS, restoreVaultFiles } from '../security/vault.ts';
-import { createSnapshot, planItemWritesTarget, resolveFileTarget, resolveFileTargetRel } from './backup.ts';
+import { createSnapshot, fsForSection, planItemWritesTarget, resolveFileTarget, resolveFileTargetRel } from './backup.ts';
 import { isCredentialConfigured } from './credential-status.ts';
 import { rollback } from './rollback.ts';
 import { compatibilityReasons, computeCompatibility } from './validator.ts';
@@ -37,7 +37,7 @@ import {
   ImportNotConfirmedError, ImportUserSkippedError, type ApplyResult, type ConfigAdapter,
   type ExecutedItem, type HostContext, type ImportAnalysis, type ImportContext,
   type ImportDecisions, type ImportPlan, type ImportResult, type PathIssue,
-  type PathMapping, type PlanItem, type SessionFormatProbeResult, type SkippedTombstone,
+  type FileSystemFacade, type PathMapping, type PlanItem, type SessionFormatProbeResult, type SkippedTombstone,
   type Snapshot, type SnapshotStore, type TransactionSnapshotContext,
 } from './types.ts';
 
@@ -953,7 +953,7 @@ export class Analyzer {
         let beforeFp: string | null = null;
         if (Analyzer.fileRelFor(item, importCtx.target.profile) !== null) {
           rel = Analyzer.fileRelFor(item, importCtx.target.profile) as string;
-          beforeFp = await this.fileFp(importCtx, rel);
+          beforeFp = await this.fileFp(importCtx, item);
         }
         beforeFpByItem.set(item.id, beforeFp);
         await sb.recordStep({
@@ -1055,7 +1055,7 @@ export class Analyzer {
           const rel = Analyzer.fileRelFor(item, importCtx.target.profile);
           let afterFp: string | null = null;
           if (rel !== null && outcome.executed.status === 'ok') {
-            afterFp = await this.fileFp(importCtx, rel);
+            afterFp = await this.fileFp(importCtx, item);
           }
           await sb.recordStep({
             id: item.id,
@@ -1382,7 +1382,7 @@ export class Analyzer {
     return planItemWritesTarget(item);
   }
 
-  /** 文件类且可指纹 → 返回 home-relative 目标路径（posix）；否则 null（不可指纹外部项）。
+  /** 文件类且可指纹 → 返回「根相对路径」（journal 的 ref 身份）；否则 null（不可指纹外部项）。
    *  profile 必须传入：plugins 分区的 pnpm-workspace.yaml / patch 文件位于
    *  `profiles/<profile>/` 下，缺了它算出的相对路径不存在 → 指纹恒 null（issue #35）。 */
   private static fileRelFor(item: PlanItem, profile?: string): string | null {
@@ -1392,11 +1392,33 @@ export class Analyzer {
     return resolveFileTargetRel(item.adapter, ref, profile);
   }
 
-  /** 读目标文件算 sha256（home-relative；经 HostContext.fs 使测试 mock 可注入）。失败返回 null。 */
-  private async fileFp(ctx: ImportContext, rel: string): Promise<string | null> {
+  /**
+   * 文件类且可指纹 → 返回「该分区自己的门面 + 绝对路径」。
+   *
+   * 为什么不能只拿 home-relative 路径去读：`pluginData` / `pluginAssets` 的根是**系统 home**
+   * （见 `core/backup.ts` 的 `fsForSection`），用 `ctx.fs` 读会落到 $DSH_HOME 下的错误位置
+   * 或被越界守卫拦下 —— 指纹会静默变成「读不到」，reconcile 因此永远判不出是否已应用。
+   * 宿主未提供该门面 / 路径不可解析 → null（保守：不可证明）。
+   */
+  private static fileTargetFor(
+    ctx: ImportContext, item: PlanItem,
+  ): { fs: FileSystemFacade; abs: string } | null {
+    if (!isFileSection(item.adapter)) return null;
+    const ref = item.target?.ref;
+    if (ref === undefined || ref === '') return null;
+    try {
+      return { fs: fsForSection(ctx.target, item.adapter), abs: resolveFileTarget(ctx.target, item.adapter, ref) };
+    } catch {
+      return null;
+    }
+  }
+
+  /** 读目标文件算 sha256（经该分区自己的门面，测试 mock 可注入）。失败返回 null。 */
+  private async fileFp(ctx: ImportContext, item: PlanItem): Promise<string | null> {
+    const target = Analyzer.fileTargetFor(ctx, item);
+    if (target === null) return null;
     try {
-      const data = await ctx.target.fs.readFile(rel);
-      return sha256Hex(data);
+      return sha256Hex(await target.fs.readFile(target.abs));
     } catch {
       return null;
     }

package/src/core/backup-plan.test.ts

@@ -16,7 +16,8 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 
 import {
-  DEFAULT_BACKUP_SECTIONS, OFFLINE_BACKUP_SECTIONS, OFFLINE_UNAVAILABLE_SECTIONS, OPT_IN_BACKUP_SECTIONS,
+  DEFAULT_BACKUP_SECTIONS, OFFLINE_BACKUP_SECTIONS, OFFLINE_EXCLUDED_SECTIONS, OFFLINE_UNAVAILABLE_SECTIONS,
+  OPT_IN_BACKUP_SECTIONS,
   buildSectionFlags,
 } from './backup-plan.ts';
 import { APPLY_ORDER } from './analyzer.ts';
@@ -105,20 +106,34 @@ test('离线分区清单：注册表所有分区都必须显式归类（可收
   // 「明确不参与离线」：sessions 体量巨大且属用户数据（GUI 侧单独 opt-in）、secrets 无分区载荷
   // （凭据值走独立加密容器）。二者都不在 CLI 离线备份的目标集合内 —— 但必须**显式**列出，
   // 否则新增分区会被静默漏收/漏报。
-  const NOT_OFFLINE_APPLICABLE: readonly SectionId[] = ['sessions', 'secrets'];
+  // pluginData / pluginAssets 也在此列（第三方插件数据的收集依赖 adapter 的来源注册表；
+  // 见 backup-plan.ts 的 OFFLINE_EXCLUDED_SECTIONS —— 直接引用产品常量，避免测试与实现各抄一份）
+  const NOT_OFFLINE_APPLICABLE: readonly SectionId[] = [
+    'sessions', 'secrets', ...OFFLINE_EXCLUDED_SECTIONS,
+  ];
   const classified = new Set<string>([...OFFLINE_BACKUP_SECTIONS, ...OFFLINE_UNAVAILABLE_SECTIONS, ...NOT_OFFLINE_APPLICABLE]);
   assert.deepEqual([...classified].sort(), [...SECTION_IDS].sort(), '新增分区必须在 backup-plan 里显式归类');
 });
 
 /* ------------------------------------------------------------ FILE_BASES */
 
-test('resolveFileTarget：文件类分区都有明确基准目录（除两个 home 根分区外不得落 homeDir 根）', () => {
-  // 只有这两个分区的文件**本来就在** $DSH_HOME 根（AGENTS.md / 插件自有文件白名单）
+test('resolveFileTarget：文件类分区都有明确根（$DSH_HOME 内，或系统 home 根的那两个分区）', () => {
+  // 文件本来就在 $DSH_HOME 根的分区：AGENTS.md / 插件自有文件白名单
   const HOME_ROOT_SECTIONS: readonly SectionId[] = ['agentInstructions', 'pluginFiles'];
-  const ctx = { homeDir: path.join('C:', 'home', '.dsh'), profile: 'web' } as unknown as HostContext;
+  // **系统 home 为根**的分区（第三方插件数据）：$DSH_HOME 之外的第二个根，见 backup.ts 的 fsForSection
+  const OS_HOME_SECTIONS: readonly SectionId[] = ['pluginData', 'pluginAssets'];
+  const ctx = {
+    homeDir: path.join('C:', 'home', '.dsh'),
+    osHomeDir: path.join('C:', 'home'),
+    profile: 'web',
+  } as unknown as HostContext;
   const atHomeRoot = path.join(ctx.homeDir, 'probe.txt');
   for (const id of SECTION_IDS.filter((s) => isFileSection(s))) {
     const target = resolveFileTarget(ctx, id, 'probe.txt');
+    if (OS_HOME_SECTIONS.includes(id)) {
+      assert.equal(target, path.join(ctx.osHomeDir as string, 'probe.txt'), `${id} 的根必须是系统 home`);
+      continue;
+    }
     assert.ok(target.startsWith(ctx.homeDir), `${id} 的目标必须在 homeDir 下: ${target}`);
     if (HOME_ROOT_SECTIONS.includes(id)) {
       assert.equal(target, atHomeRoot, `${id} 是 home 根分区`);