dsh-config-manager 0.1.72 → 0.1.76

package/src/schema/section-registry.ts

@@ -169,7 +169,7 @@ export interface SectionMeta {
   readonly configSnapshot: boolean;
 }
 
-/** 分区载荷版本：当前 15 个分区统一为 1（唯一字面量；分区可独立升级时只改对应条目的引用） */
+/** 分区载荷版本：当前 17 个分区统一为 1（唯一字面量；分区可独立升级时只改对应条目的引用） */
 export const SECTION_DATA_VERSION = 1 as const;
 
 /**
@@ -324,7 +324,7 @@ export const SECTION_REGISTRY: Record<SectionId, SectionMeta> = {
   },
   pluginFiles: {
     id: 'pluginFiles',
-    displayName: 'Plugin Files',
+    displayName: "Other Plugins' Loose Files",
     group: 'extensions',
     payload: { kind: 'files', filePrefix: 'plugin-files/' },
     dataVersion: SECTION_DATA_VERSION,
@@ -377,7 +377,7 @@ export const SECTION_REGISTRY: Record<SectionId, SectionMeta> = {
   },
   self: {
     id: 'self',
-    displayName: 'Plugin Self Config',
+    displayName: "This Plugin's Own Config",
     group: 'extensions',
     payload: { kind: 'files', filePrefix: 'self/' },
     dataVersion: SECTION_DATA_VERSION,
@@ -388,6 +388,35 @@ export const SECTION_REGISTRY: Record<SectionId, SectionMeta> = {
     defaultIncluded: true,
     configSnapshot: true,
   },
+  pluginData: {
+    id: 'pluginData',
+    displayName: "Other Plugins' Data",
+    group: 'extensions',
+    payload: { kind: 'files', filePrefix: 'plugin-data/' },
+    dataVersion: SECTION_DATA_VERSION,
+    applyOrder: 16,
+    riskTier: 'high',
+    // 第三方插件的数据目录不在 DSH 的三个核心存储里：路径是「机器的 home 布局」而非配置内容，
+    // 换机后可能整个目录不存在（未安装该插件）→ deviceSpecific + 不参与自动同步。
+    portability: 'deviceSpecific',
+    syncOptIn: 'off',
+    defaultIncluded: false,
+    // 体量由用户数据主导（可能几百 MB），与 sessions 同理不进「配置状态」采集口径
+    configSnapshot: false,
+  },
+  pluginAssets: {
+    id: 'pluginAssets',
+    displayName: "Other Plugins' Large Files",
+    group: 'extensions',
+    payload: { kind: 'files', filePrefix: 'plugin-assets/' },
+    dataVersion: SECTION_DATA_VERSION,
+    applyOrder: 17,
+    riskTier: 'high',
+    portability: 'deviceSpecific',
+    syncOptIn: 'off',
+    defaultIncluded: false,
+    configSnapshot: false,
+  },
 };
 
 /** 分区 id（按 applyOrder 升序）——历史上与 SECTION_IDS 数组逐项一致 */

package/src/schema/types.ts

@@ -18,7 +18,8 @@ export type Platform =
 export type SectionId =
   | 'settings' | 'ui' | 'providers' | 'plugins' | 'mcp' | 'prompts'
   | 'skills' | 'agentPresets' | 'agentInstructions' | 'workspaces' | 'pluginFiles'
-  | 'credentialsStatus' | 'secrets' | 'sessions' | 'self';
+  | 'credentialsStatus' | 'secrets' | 'sessions' | 'self'
+  | 'pluginData' | 'pluginAssets';
 
 /** 加密备份的算法参数（非秘密：salt/iv/authTag 仅用于解密与完整性校验） */
 export interface EncryptionInfo {

package/src/sync/messages.ts

@@ -85,6 +85,8 @@ export const zh = {
   'sync.backupHistoryDone': '{trigger}完成：{zip}',
   'sync.backupHistorySkipped': '{trigger}跳过：{reason}',
   'sync.backupHistoryFailed': '{trigger}失败',
+  // ---------- 推送前只读预览（issue #91） ----------
+  'sync.pushPreviewUnpackedLocalSources': '本地源插件（link:/file:）需打包才能精确比对变更，分区 {sections} 本次按「有变化」展示',
 } as const;
 
 export const en: Record<keyof typeof zh, string> = {
@@ -145,6 +147,7 @@ export const en: Record<keyof typeof zh, string> = {
   'sync.backupHistoryDone': '{trigger} finished: {zip}',
   'sync.backupHistorySkipped': '{trigger} skipped: {reason}',
   'sync.backupHistoryFailed': '{trigger} failed',
+  'sync.pushPreviewUnpackedLocalSources': 'Local-source plugins (link:/file:) must be packed to compare changes exactly; section(s) {sections} are shown as changed',
 };
 
 registerMessageCatalog({ id: 'sync-domain', zh, en });

package/src/sync/sync-credentials.test.ts

@@ -409,3 +409,122 @@ test('散文件布局不承载凭据载荷（issue #38 防御：绝不静默丢
     await fs.rm(tmp, { recursive: true, force: true });
   }
 });
+
+/* ---------------- issue #38 补充：本机值已与快照一致 → 不再列为待写入 ---------------- */
+
+/** 目标机 + 本机已有 `.credentials.yaml`（「值是否已经相同」比对的唯一数据源，与 push 侧同文件） */
+async function makeTargetWithLocalCredentials(yaml: string): Promise<Ctx> {
+  const ctx = makeTarget();
+  await ctx.fs.writeFile('.credentials.yaml', Buffer.from(yaml, 'utf8'));
+  return ctx;
+}
+
+/** 与源机同一份凭据快照（加密 + 导出密钥） */
+async function pushCredentialSnapshot(transport: MemSyncTransport, tmp: string, id: string): Promise<void> {
+  const srcCtx = makeContext('win32', 'C:\\Users\\alice');
+  await makeSource(srcCtx);
+  await makeEngine(srcCtx, transport, tmp).push({ snapshotId: id, encrypt: true, password: PASSWORD, includeSecrets: true });
+}
+
+test('本机值与快照逐字节相同 → Skip(info)，不进待确认/补录清单（真机：本机一条不缺却全标「缺密钥」）', async () => {
+  const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'dsh-sync-cred-same-'));
+  try {
+    const transport = new MemSyncTransport();
+    await pushCredentialSnapshot(transport, tmp, 'cred-remote');
+
+    const dstCtx = await makeTargetWithLocalCredentials(CRED_YAML);
+    const engine = makeEngine(dstCtx, transport, tmp);
+
+    const pull = await engine.pull({ password: PASSWORD });
+    assert.deepEqual(
+      pull.changes.filter((c) => c.id.startsWith('secret:')).map((c) => [c.id, c.kind, c.severity]),
+      [['secret:DEEPSEEK_API_KEY', 'Skip', 'info'], ['secret:GITHUB_TOKEN', 'Skip', 'info']],
+      '值一致 → Skip(info)：写回是 no-op，不该要求人工确认',
+    );
+    assert.equal(pull.needsReview, false, '无任何待决策项');
+    assert.ok(!JSON.stringify(pull).includes('sk-real-cred-0001'), '报告不得含凭据值');
+
+    const preview = await engine.preview({ password: PASSWORD });
+    assert.deepEqual(preview.plan!.missingSecrets, [], '值一致不得计入 missingSecrets');
+    const item = preview.plan!.items.find((i) => i.id === 'secret:DEEPSEEK_API_KEY');
+    assert.equal(item?.kind, 'Skip');
+    assert.equal(item?.severity, 'info');
+    assert.ok(!JSON.stringify(preview.plan).includes('sk-real-cred-0001'), '计划不得含凭据值');
+  } finally {
+    await fs.rm(tmp, { recursive: true, force: true });
+  }
+});
+
+test('本机值不同 / 本机缺该 ref → 一律 MissingSecret 并写回（「导出密钥」语义不放宽）', async () => {
+  const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'dsh-sync-cred-diff-'));
+  try {
+    const transport = new MemSyncTransport();
+    await pushCredentialSnapshot(transport, tmp, 'cred-remote');
+
+    // 本机只有 GITHUB_TOKEN 且是旧值；DEEPSEEK_API_KEY 本机没有
+    const dstCtx = await makeTargetWithLocalCredentials('GITHUB_TOKEN: ghp_local_old\n');
+    const engine = makeEngine(dstCtx, transport, tmp);
+
+    const preview = await engine.preview({ password: PASSWORD });
+    assert.deepEqual(
+      preview.plan!.items.filter((i) => i.id.startsWith('secret:')).map((i) => [i.id, i.kind, i.severity]),
+      [['secret:DEEPSEEK_API_KEY', 'MissingSecret', 'warning'], ['secret:GITHUB_TOKEN', 'MissingSecret', 'warning']],
+      '值不同或本机没有 → 仍须人工确认后写回',
+    );
+    assert.deepEqual(
+      preview.plan!.missingSecrets.map((s) => s.ref),
+      ['DEEPSEEK_API_KEY', 'GITHUB_TOKEN'],
+      'missingSecrets 与 items 同源',
+    );
+
+    const plan = {
+      ...preview.plan!,
+      items: preview.plan!.items.filter((i) => i.id.startsWith('secret:')),
+    };
+    const report = await engine.applyItems(preview.zipPath, plan, { credentials: preview.credentials });
+    assert.deepEqual(report.failed, []);
+    assert.equal(dstCtx.credentials.values.get('GITHUB_TOKEN'), 'ghp_realcred0002', '值不同 → 写回快照里的值');
+    assert.equal(dstCtx.credentials.values.get('DEEPSEEK_API_KEY'), 'sk-real-cred-0001');
+    assert.ok(!JSON.stringify(report).includes('sk-real-cred-0001'), '执行报告不得含凭据值');
+  } finally {
+    await fs.rm(tmp, { recursive: true, force: true });
+  }
+});
+
+test('本机凭据文件读不到 → 无法比较：保守按待确认处理，绝不静默跳过', async () => {
+  const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'dsh-sync-cred-nolocal-'));
+  try {
+    const transport = new MemSyncTransport();
+    await pushCredentialSnapshot(transport, tmp, 'cred-remote');
+
+    const dstCtx = makeTarget(); // 本机没有 .credentials.yaml
+    const preview = await makeEngine(dstCtx, transport, tmp).preview({ password: PASSWORD });
+    assert.deepEqual(
+      preview.plan!.items.filter((i) => i.id.startsWith('secret:')).map((i) => [i.id, i.kind]),
+      [['secret:DEEPSEEK_API_KEY', 'MissingSecret'], ['secret:GITHUB_TOKEN', 'MissingSecret']],
+      '读不到 = 未知 → 照旧要求确认（跳过就等于密钥没同步过来）',
+    );
+  } finally {
+    await fs.rm(tmp, { recursive: true, force: true });
+  }
+});
+
+test('本机凭据文件是 DSH v1 布局（refs: 块）→ 同样识别「值已一致」', async () => {
+  const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'dsh-sync-cred-v1-'));
+  try {
+    const transport = new MemSyncTransport();
+    await pushCredentialSnapshot(transport, tmp, 'cred-remote');
+
+    const localV1 = 'version: 1\nrefs:\n  DEEPSEEK_API_KEY: sk-real-cred-0001\n  GITHUB_TOKEN: ghp_realcred0002\n';
+    const dstCtx = await makeTargetWithLocalCredentials(localV1);
+    const preview = await makeEngine(dstCtx, transport, tmp).preview({ password: PASSWORD });
+    assert.deepEqual(
+      preview.plan!.items.filter((i) => i.id.startsWith('secret:')).map((i) => [i.id, i.kind]),
+      [['secret:DEEPSEEK_API_KEY', 'Skip'], ['secret:GITHUB_TOKEN', 'Skip']],
+      'v1 refs 块与扁平布局读出的值相同 → 一律 Skip',
+    );
+    assert.deepEqual(preview.plan!.missingSecrets, []);
+  } finally {
+    await fs.rm(tmp, { recursive: true, force: true });
+  }
+});

package/src/sync/sync-engine.ts

@@ -23,6 +23,8 @@ import path from 'node:path';
 import { createAdapters } from '../adapters/index.ts';
 import { defaultSecretScanner } from '../core/exporter.ts';
 import { Importer } from '../core/importer.ts';
+// issue #91：只读预览与基线 hash 的口径判定（本地源插件在预览里不会被 npm pack）
+import { isLocalPluginSpec } from '../core/local-plugin-pack.ts';
 import type {
   ConfigAdapter, ExportSection, GlobalConflictStrategy, HostContext,
   ImportAnalysis, ImportPlan, ImportResult, PathMapping, PlanItem, PlanItemKind, RollbackReport, SecretScanner,
@@ -340,6 +342,24 @@ const FORBIDDEN_SECTIONS: readonly SectionId[] = ['credentialsStatus', 'secrets'
  */
 export const MAX_REMOTE_SNAPSHOTS = DEFAULT_RETENTION_POLICY.keepLast;
 
+/**
+ * issue #91：走只读 `preview()` 拿到的产物，能否直接与该分区**基线 hash**（push 时按 export() 产物记录）比对。
+ *
+ * 为什么需要这个判定：`plugins` 适配器的 `preview()` 走 `collect(…, pack=false)` —— 刻意**不做**
+ * 本地源（`link:` / `file:`）插件的 `npm pack`。于是当 profile 里存在本地源插件时，预览产物既没有
+ * `localTarballs`、插件 spec 也保持原样（export() 会改写成 `file:<tarball>`），与基线**不同口径**：
+ * 此时既不能断言「无变化」（本地插件源码改了体积/内容，预览看不见），也不该为了比对去打包
+ * （那正是本 issue 的缺陷本身）。
+ *
+ * 返回 true = 该分区本趟**不可比** ⇒ 调用方只能保守报「有变化」并如实说明原因。
+ * 其余分区的 preview() 产物与 export() 逐字节相同（文件类分区不走 preview()，见 previewPush）。
+ */
+function previewCaliberDiffersFromExport(sectionId: SectionId, data: SectionData): boolean {
+  if (sectionId !== 'plugins') return false;
+  const plugins = (data as { plugins?: { spec?: string }[] }).plugins;
+  return Array.isArray(plugins) && plugins.some((p) => isLocalPluginSpec(p?.spec));
+}
+
 export class SyncEngine {
   private readonly ctx: HostContext;
   private readonly transport: SyncTransport;
@@ -553,25 +573,47 @@ export class SyncEngine {
   }
 
   /**
-   * 把「随加密快照迁移的凭据」补进导入计划：每个解密出的 ref 生成一条 MissingSecret 项。
+   * 把「随加密快照迁移的凭据」补进导入计划：**需要写回**的 ref 生成 MissingSecret 项，
+   * 本机值已与快照逐字节相同的 ref 生成 Skip（info）——写回是 no-op，不该再让用户确认。
    * 执行阶段由 credentials adapter 经 ImportContext.decryptedCredentials（仅内存）
    * 调用 credentials.set(ref, value) 写回本机 —— 与手动补录走同一条已验证路径。
    *
-   * 判定与导入路径同规则（**值的有无优先于本机状态**）：
-   *  - 本函数只处理**有值**的 ref → 一律生成 MissingSecret（确认后写回）。
-   *    **不因本机已配置而跳过**：快照显式带了值（用户勾了「导出密钥」），跳过就等于
-   *    「密钥没同步过来」；要逐项放过用确认列表的批量按钮（sync-view 的 isBulkDecidable）。
+   * 判定与导入路径同规则（**值的有无优先于本机状态**），并多做一步「值是否已经相同」：
+   *  - 有值 + 本机不同 / 本机没有 → MissingSecret（确认后写回）。**不因本机已配置而跳过**：
+   *    快照显式带了值（用户勾了「导出密钥」），跳过就等于「密钥没同步过来」；
+   *    要逐项放过用确认列表的批量按钮（sync-view 的 isBulkDecidable）。
+   *  - 有值 + 本机逐字节相同 → Skip（info）。这是对上一轮「有值一律 MissingSecret」的**收窄**
+   *    （真机反馈：本机 refs 一条不缺，列表却全标「缺密钥」+ 黄色警告）：只有真的会改动本机的
+   *    ref 才需要人工确认。
+   *  - 本机凭据文件读不到 → 无法比较 → 保守按 MissingSecret 处理，绝不静默跳过。
    *  - 「只有 ref 名、没有值」的情形由 createImportPlan → buildCredentialPlanItems 处理
    *    （那里才做本机已配置 → Skip 的判定）。
-   *  - 同 id 已是 **Skip**（上面那条规则在「无值」时先判成了 Skip）→ **升级**为 MissingSecret：
-   *    否则有值也会被 Skip 挡住，值永远不会写回。
+   *  - 同 id 已是 **Skip**（上面那条规则在「无值」时先判成了 Skip）→ 值不同时**升级**为
+   *    MissingSecret：否则有值也会被 Skip 挡住，值永远不会写回；值相同时保持 Skip。
    */
-  private appendCredentialPlanItems(plan: ImportPlan, credentials: Map<string, string> | undefined): void {
+  private async appendCredentialPlanItems(plan: ImportPlan, credentials: Map<string, string> | undefined): Promise<void> {
     if (credentials === undefined || credentials.size === 0) return;
+    const local = await this.readLocalCredentials();
     const byId = new Map(plan.items.map((i) => [i.id, i] as const));
-    for (const ref of credentials.keys()) {
+    for (const [ref, value] of credentials) {
       const id = `secret:${ref}`;
       const prev = byId.get(id);
+      if (local?.get(ref) === value) {
+        const description = this.msg('sync.credentialsItemSame', { ref });
+        if (prev === undefined) {
+          const same: PlanItem = {
+            id, kind: 'Skip', adapter: 'credentialsStatus', description,
+            severity: 'info', target: { adapter: 'credentialsStatus', ref },
+          };
+          plan.items.push(same);
+          byId.set(id, same);
+        } else if (prev.kind === 'Skip' || prev.kind === 'MissingSecret') {
+          prev.kind = 'Skip';
+          prev.severity = 'info';
+          prev.description = description;
+        }
+        continue;
+      }
       if (prev !== undefined) {
         if (prev.kind !== 'Skip') continue; // 已有可执行项 → 不重复
         prev.kind = 'MissingSecret';
@@ -596,6 +638,24 @@ export class SyncEngine {
       .map((i) => ({ ref: i.id.replace(/^secret:/, ''), required: true }));
   }
 
+  /**
+   * 读本机 `$DSH_HOME/.credentials.yaml` → `Map<ref, value>`，**只用于**「值是否已经相同」比对。
+   * 与 push 侧 buildCredentialsPayload 读同一个文件、同一解析口径（credentialsMapFromYaml）；
+   * 不新增任何能力，也不回读凭据值到 UI。
+   * 读不到 / 解析失败 → undefined = **无法比较**：调用方必须按「未知」保守处理（照旧要求确认），
+   * 绝不因为读失败就静默跳过写回。
+   * 安全：值只在进程内存里比较 —— 不落盘、不进日志/报告/响应体。
+   */
+  private async readLocalCredentials(): Promise<Map<string, string> | undefined> {
+    try {
+      const file = path.join(this.ctx.homeDir, '.credentials.yaml');
+      const raw = Buffer.from(await this.ctx.fs.readFile(file)).toString('utf8');
+      return credentialsMapFromYaml(raw);
+    } catch {
+      return undefined;
+    }
+  }
+
   /**
    * sessions 分区的导出选项（opt-in 分区）：显式勾选清单优先于「最新 N 个」。
    *
@@ -754,14 +814,29 @@ export class SyncEngine {
     const targets = this.pushTargets(opts.sections, warnings);
     const plainSections: Partial<Record<SectionId, SectionData>> = {};
     const counts: Partial<Record<SectionId, number>> = {};
+    /** issue #91：本趟只读预览省掉了本地源打包 ⇒ 与基线不可比的分区（不可断言「无变化」） */
+    const unpackedSections = new Set<SectionId>();
     for (const adapter of targets) {
+      const exportOptions = {
+        includeSecrets,
+        // 与 push 同口径：显式勾选清单 > 「最新 N 个」上限
+        ...this.sessionExportOptions(adapter.id, opts.sessions),
+      };
       let section: ExportSection;
       try {
-        section = await adapter.export(this.ctx, {
-          includeSecrets,
-          // 与 push 同口径：显式勾选清单 > 「最新 N 个」上限
-          ...this.sessionExportOptions(adapter.id, opts.sessions),
-        });
+        // issue #91：**非文件类**分区优先走 adapter.preview()。只读预览必须零进程副作用，而
+        // plugins 的 export() 会对每个 `link:`/`file:` 插件真的跑一次 `npm pack`
+        // （真机 2 GB 本地源插件 = 297 s；这段时间全局写锁被该请求占满 ⇒ 界面上所有写操作静默 423）。
+        // 为什么文件类分区**不能**走 preview()：其预览产物是「无内容」形态（条目 data 为空、
+        // contentHash 为空串），既不能与基线 hash 比对，也不能进 assertNoForbiddenSections
+        // —— 那会让预览谎报「每个文件分区都变了」。
+        const summary = !isFileSection(adapter.id) && adapter.preview !== undefined
+          ? await adapter.preview(this.ctx, exportOptions)
+          : undefined;
+        section = summary?.section ?? await adapter.export(this.ctx, exportOptions);
+        if (summary !== undefined && previewCaliberDiffersFromExport(adapter.id, section.data as SectionData)) {
+          unpackedSections.add(adapter.id);
+        }
       } catch (err) {
         warnings.push(this.msg('sync.sectionFailed', { adapter: adapter.id, reason: err instanceof Error ? err.message : String(err) }));
         continue;
@@ -782,14 +857,27 @@ export class SyncEngine {
     if (!encrypted) {
       try {
         const state = await loadSyncState(this.stateDir, this.fsx, this.msg);
-        baselineHashes = state.sections as Record<string, string>;
+        // 基线条目是 SyncSectionState（{hash, updatedAt}），**不是**裸 hash 字符串。
+        // 这里曾把整个对象 as Record<string,string> 直接比对 ⇒ 对象 !== 字符串 恒真
+        // ⇒ 预览对**每一个**分区都报「有变化」，「N 个有变化」这句永远是「全都有变化」。
+        for (const [sid, rec] of Object.entries(state.sections)) {
+          if (rec !== undefined && typeof rec.hash === 'string') baselineHashes[sid] = rec.hash;
+        }
       } catch {
         baselineHashes = {};
       }
     }
+    if (unpackedSections.size > 0) {
+      // 如实说明：本次预览没有为本地源插件执行 npm pack，故这些分区的基线比对不可得
+      warnings.push(this.msg('sync.pushPreviewUnpackedLocalSources', { sections: [...unpackedSections].join(', ') }));
+    }
     const sections: SyncPushPreviewSection[] = Object.keys(plainSections).map((sid) => {
       const id = sid as SectionId;
-      const changed = encrypted || baselineHashes[id] === undefined || baselineHashes[id] !== hashSection(plainSections[id] as SectionData);
+      const changed = encrypted
+        // issue #91：只读预览省掉了本地源打包 ⇒ 产物与基线不同口径，**绝不**据此断言「无变化」
+        || unpackedSections.has(id)
+        || baselineHashes[id] === undefined
+        || baselineHashes[id] !== hashSection(plainSections[id] as SectionData);
       return { section: id, count: counts[id] ?? 0, changed };
     });
 
@@ -944,7 +1032,7 @@ export class SyncEngine {
         pathMappings: opts.pathMappings ?? [],
       });
       // 凭据迁移项（ref 名进计划/报告，值绝不进）
-      this.appendCredentialPlanItems(plan, credentials);
+      await this.appendCredentialPlanItems(plan, credentials);
       const changes: PullChange[] = plan.items.map((i) => ({
         id: i.id,
         adapter: i.adapter,
@@ -1116,7 +1204,7 @@ export class SyncEngine {
       // issue #45：自动重定基 + 用户映射（与 pull 同口径；一键同步的 apply-items 复用本 plan）
       pathMappings: opts.pathMappings ?? [],
     });
-    this.appendCredentialPlanItems(plan, credentials);
+    await this.appendCredentialPlanItems(plan, credentials);
     return {
       ok: analysis.valid, zipPath, plan, analysis, snapshotId: targetId, credentials,
       message: tombstoned.length === 0

package/src/sync/sync-preview-push.test.ts

@@ -0,0 +1,158 @@
+/**
+ * issue #91 回归：**推送预览（previewPush）不得为本地源插件执行 `npm pack`**。
+ *
+ * 缺陷：`previewPush` 走的是 `adapter.export()`，而 `plugins` 适配器只有 `preview()`（PR #68）
+ * 才跳过打包 —— 于是「推送前只读预览」会真的对每个 `link:`/`file:` 插件 spawn 一次 `npm pack`
+ * （真机 2 GB 本地源插件 = 297 s），这段时间该请求占着全局写锁，界面所有写操作静默 423。
+ *
+ * 本文件钉死三件事：
+ *  ① 预览不打包（真推送仍然打包 —— 本地源插件换机可用不能被牺牲）；
+ *  ② 预览与基线口径不同时**绝不断言「无变化」**（保守报「有变化」+ 如实说明）；
+ *  ③ 文件类分区仍走 `export()`：其 `preview()` 产物是「无内容」形态，拿它比对 hash 会误报
+ *     「每个文件分区都变了」。
+ */
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import { SyncEngine } from './sync-engine.ts';
+import type { SyncSnapshot, SyncSnapshotMeta, SyncTransport } from './transport.ts';
+import { computeSnapshotMeta } from './transport.ts';
+import { createAdapters } from '../adapters/index.ts';
+import type { LocalPluginPackHook } from '../adapters/index.ts';
+import { makeContext, MemSnapshotStore } from '../adapters/test-helpers.ts';
+import { Importer } from '../core/importer.ts';
+
+const NS = ['general', 'theme'];
+
+/** 内存传输（与 sync-engine.test.ts 同款最小实现；本仓库各同步测试各自持有一份）。 */
+class MemSyncTransport implements SyncTransport {
+  readonly type = 'memory';
+  snapshots = new Map<string, SyncSnapshot>();
+  metas: SyncSnapshotMeta[] = [];
+  async list(): Promise<SyncSnapshotMeta[]> {
+    return [...this.metas].sort((a, b) => (a.createdAt < b.createdAt ? -1 : 1));
+  }
+  async upload(snapshot: SyncSnapshot): Promise<SyncSnapshotMeta> {
+    this.snapshots.set(snapshot.id, snapshot);
+    this.metas.push(computeSnapshotMeta(snapshot));
+    return computeSnapshotMeta(snapshot);
+  }
+  async download(id: string): Promise<SyncSnapshot> {
+    const s = this.snapshots.get(id);
+    if (!s) throw new Error('快照不存在: ' + id);
+    return s;
+  }
+  async delete(id: string): Promise<void> {
+    this.snapshots.delete(id);
+    this.metas = this.metas.filter((m) => m.id !== id);
+  }
+}
+
+/** 假打包钩子：记录被调用次数，并按需产出「本地源插件已打包」的结果。 */
+function makePackSpy(withLocal: boolean): { hook: LocalPluginPackHook; calls: () => number } {
+  let calls = 0;
+  const isLocal = (spec: string | undefined): boolean =>
+    typeof spec === 'string' && (spec.startsWith('file:') || spec.startsWith('link:'));
+  const hook: LocalPluginPackHook = async (plugins) => {
+    calls += 1;
+    if (!withLocal) return { packed: [], rewritten: {}, warnings: [] };
+    const locals = plugins.filter((p) => isLocal(p.spec));
+    return {
+      packed: locals.map((p) => ({
+        packageName: p.name,
+        version: p.version,
+        relativePath: 'local-plugins/' + p.name + '-1.0.0.tgz',
+        rewrittenSpec: 'file:local-plugins/' + p.name + '-1.0.0.tgz',
+        data: new Uint8Array([1, 2, 3, 4]),
+      })),
+      rewritten: Object.fromEntries(locals.map((p) => [p.name, 'file:local-plugins/' + p.name + '-1.0.0.tgz'])),
+      warnings: [],
+    };
+  };
+  return { hook, calls: () => calls };
+}
+
+function makeEngine(ctx: ReturnType<typeof makeContext>, transport: SyncTransport, stateDir: string, adapters: ReturnType<typeof createAdapters>) {
+  return new SyncEngine({
+    ctx,
+    transport,
+    stateDir,
+    adapters,
+    importer: new Importer({ ctx, adapters, snapshotStore: new MemSnapshotStore() }),
+    now: () => new Date('2026-08-16T12:00:00.000Z'),
+  } as ConstructorParameters<typeof SyncEngine>[0]);
+}
+
+test('issue #91：推送预览不走 npm pack（真推送仍然打包）', async () => {
+  const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'dsh-sync-preview-local-'));
+  try {
+    const ctx = makeContext('win32', 'C:\\Users\\alice');
+    ctx.plugins.installed.set('local-thing', { name: 'local-thing', version: '1.0.0', enabled: true, spec: 'file:C:/tmp/local-thing' });
+    const spy = makePackSpy(true);
+    const adapters = createAdapters({ namespaces: NS, localPluginPack: spy.hook });
+    const transport = new MemSyncTransport();
+    const engine = makeEngine(ctx, transport, tmp, adapters);
+
+    // 真推送：必须打包（本地源插件否则换机即丢），同时建立「按 export() 产物」的基线
+    const pushed = await engine.push({ snapshotId: 'sync-local-1', sections: ['plugins'] });
+    assert.equal(pushed.ok, true);
+    assert.equal(spy.calls(), 1, '真推送必须打包本地源插件');
+
+    // 只读预览：修复前会再打一次包（真机 297 s，占满全局写锁）
+    const preview = await engine.previewPush({ sections: ['plugins'] });
+    assert.equal(spy.calls(), 1, '只读预览绝不能再执行 npm pack');
+    assert.equal(preview.ok, true);
+    const row = preview.sections.find((s) => s.section === 'plugins');
+    assert.ok(row !== undefined, 'plugins 出现在预览分区清单里');
+    assert.equal(row.changed, true, '预览产物与基线不同口径 ⇒ 保守报「有变化」，绝不断言「无变化」');
+    assert.ok((preview.message ?? '').length > 0, '并如实说明该分区为何不做基线比对');
+  } finally {
+    await fs.rm(tmp, { recursive: true, force: true });
+  }
+});
+
+test('issue #91：无本地源插件时预览与 export() 同口径 —— 仍能精确报「无变化」', async () => {
+  const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'dsh-sync-preview-plain-'));
+  try {
+    const ctx = makeContext('win32', 'C:\\Users\\alice');
+    ctx.plugins.installed.set('@deepseek-ai/dsh-ssh', { name: '@deepseek-ai/dsh-ssh', version: '1.0.0', enabled: true });
+    const spy = makePackSpy(true);
+    const adapters = createAdapters({ namespaces: NS, localPluginPack: spy.hook });
+    const transport = new MemSyncTransport();
+    const engine = makeEngine(ctx, transport, tmp, adapters);
+
+    await engine.push({ snapshotId: 'sync-plain-1', sections: ['plugins'] });
+    assert.equal(spy.calls(), 1);
+
+    const preview = await engine.previewPush({ sections: ['plugins'] });
+    assert.equal(spy.calls(), 1, '预览不打包');
+    const row = preview.sections.find((s) => s.section === 'plugins');
+    assert.ok(row !== undefined);
+    assert.equal(row.changed, false, '没有本地源 ⇒ 预览产物与基线逐字节可比，必须精确报「无变化」');
+    assert.equal(preview.message, undefined, '无可比性问题时不产生告警');
+  } finally {
+    await fs.rm(tmp, { recursive: true, force: true });
+  }
+});
+
+test('issue #91：文件类分区仍走 export()（内容形态），不因预览形态误报「有变化」', async () => {
+  const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'dsh-sync-preview-files-'));
+  try {
+    const ctx = makeContext('win32', 'C:\\Users\\alice');
+    await ctx.fs.writeFile('skills/coding.md', Buffer.from('# Coding\n', 'utf8'));
+    const adapters = createAdapters({ namespaces: NS });
+    const transport = new MemSyncTransport();
+    const engine = makeEngine(ctx, transport, tmp, adapters);
+
+    await engine.push({ snapshotId: 'sync-skills-1', sections: ['skills'] });
+    const preview = await engine.previewPush({ sections: ['skills'] });
+    const row = preview.sections.find((s) => s.section === 'skills');
+    assert.ok(row !== undefined);
+    assert.equal(row.changed, false, 'skills 的预览必须与基线同口径（内容形态），否则永远误报有变化');
+  } finally {
+    await fs.rm(tmp, { recursive: true, force: true });
+  }
+});

package/src/sync/transport.test.ts

@@ -70,6 +70,7 @@ test('manifestSummaryFrom: 从导出 Manifest 提取摘要（只含启用分区
       settings: true, ui: true, providers: true, plugins: false, mcp: false,
       prompts: false, skills: true, agentPresets: false, agentInstructions: false, workspaces: false,
       pluginFiles: false, credentialsStatus: false, secrets: false, sessions: false, self: false,
+      pluginData: false, pluginAssets: false,
     },
     security: { containsSecrets: true, encrypted: false, encryption: null },
   };

package/src/sync/ui-prefs.test.ts

@@ -9,7 +9,7 @@ import os from 'node:os';
 import path from 'node:path';
 
 import {
-  defaultUiPrefs, readUiPrefs, writeUiPrefs, updateUiPrefs,
+  defaultUiPrefs, readUiPrefs, writeUiPrefs, updateUiPrefs, readRollbackEnabledSync,
   UI_PREFS_FILE, UI_PREFS_SCHEMA_VERSION,
 } from './ui-prefs.ts';
 
@@ -174,3 +174,46 @@ test('更新内容弹窗状态：写入字段 → 读回一致 + 原始文件校
   } finally { await fs.rm(dir, { recursive: true, force: true }); }
 });
 
+/**
+ * issue #88 / #89：回合自动留点开关（`rollbackEnabled`）。
+ *
+ * 钉住四条判据：① 缺省 = 关闭（fail-closed）；②「开」才落字段、「关」即字段消失；
+ * ③ 任何非法输入（非布尔 / 坏 JSON / 不支持 schema）一律回关闭 —— 绝不猜用户想开；
+ * ④ 本地与同步两个读法一致（宿主启动期必须能同步读到同一个判据）。
+ */
+test('issue #88：rollbackEnabled 往返 + 缺省与非法值一律关闭（fail-closed）', async () => {
+  const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'dsh-ui-prefs-rollback-'));
+  const file = path.join(dir, UI_PREFS_FILE);
+  try {
+    // ① 文件不存在 → 关闭
+    assert.equal(readRollbackEnabledSync(dir), false, '文件不存在 = 关闭');
+    assert.equal((await readUiPrefs(dir)).rollbackEnabled, undefined);
+
+    // ② 开 → 落字段 true；两个读法都认
+    await writeUiPrefs(dir, { schemaVersion: 1, rollbackEnabled: true });
+    assert.equal((await readUiPrefs(dir)).rollbackEnabled, true);
+    assert.equal(readRollbackEnabledSync(dir), true);
+    assert.equal(JSON.parse(await fs.readFile(file, 'utf8')).rollbackEnabled, true);
+
+    // ③ 关 → 字段消失（缺省即关），同步读法回 false
+    await writeUiPrefs(dir, { schemaVersion: 1, rollbackEnabled: false });
+    assert.equal('rollbackEnabled' in JSON.parse(await fs.readFile(file, 'utf8')), false, '关闭 = 字段消失');
+    assert.equal(readRollbackEnabledSync(dir), false);
+
+    // ④ 非法输入一律回关闭
+    for (const raw of ['{"schemaVersion":1,"rollbackEnabled":"yes"}', '{not-json', '{"schemaVersion":99,"rollbackEnabled":true}']) {
+      await fs.writeFile(file, raw, 'utf8');
+      assert.equal(readRollbackEnabledSync(dir), false, '非法输入必须回关闭：' + raw);
+      assert.equal((await readUiPrefs(dir)).rollbackEnabled, undefined, '非法输入必须回关闭：' + raw);
+    }
+
+    // ⑤ updateUiPrefs 局部合并：改开关不得冲掉其它字段（多端点共写同一文件）
+    await writeUiPrefs(dir, { schemaVersion: 1, lastSyncChannel: 'git' });
+    await updateUiPrefs(dir, { rollbackEnabled: true });
+    const merged = await readUiPrefs(dir);
+    assert.equal(merged.lastSyncChannel, 'git', '局部更新不得冲掉其它字段');
+    assert.equal(merged.rollbackEnabled, true);
+  } finally { await fs.rm(dir, { recursive: true, force: true }); }
+});
+
+