dsh-config-manager 0.2.0 → 0.2.2

package/lib/core/messages.d.ts

@@ -409,6 +409,7 @@ export declare const zh: {
     readonly 'sync.git.cmdFailed': 'git {args} 失败 (exit {code}): {err}';
     readonly 'sync.git.pushTokenRequired': '推送需要访问令牌：远端是 http(s) 仓库，但本机没有可用的令牌（拉取公开仓库可以匿名完成，推送必须认证）。请在「同步 → 通道配置」里登录 GitHub 或填入访问令牌后重试。';
     readonly 'sync.git.pushAuthFailed': '推送认证失败：{err}。请确认令牌有效且对该仓库有写权限（账号密码推送已被远端禁用）；拉取成功不代表令牌可用 —— 公开仓库匿名即可拉取。可在「同步 → 通道配置」里重新登录或更换令牌。';
+    readonly 'sync.git.credentialHelperBlocked': 'git 在本机无法执行 credential helper（它需要 shell，而当前平台不允许从应用目录执行脚本/二进制），改用 HTTP 认证头重试也没成功。请确认 git 版本不低于 2.31（环境变量注入配置需要），或把仓库地址换成 ssh。原始错误：{err}';
     readonly 'sync.git.repoUrlInvalid': '无法解析 repoUrl（http(s) 仓库必须为合法 URL）: {url}';
     readonly 'sync.git.invalidSnapshotId': '非法快照 id: {id}（仅允许字母数字开头，字符限 . _ -）';
     readonly 'sync.webdav.baseUrlRequired': 'baseUrl 必须是非空字符串';

package/lib/core/messages.js

@@ -408,6 +408,9 @@ export const zh = {
     // 推送认证（真机：公开仓库拉取可匿名成功、推送必失败，git 原文只说「Invalid username or token」）
     'sync.git.pushTokenRequired': '推送需要访问令牌：远端是 http(s) 仓库，但本机没有可用的令牌（拉取公开仓库可以匿名完成，推送必须认证）。请在「同步 → 通道配置」里登录 GitHub 或填入访问令牌后重试。',
     'sync.git.pushAuthFailed': '推送认证失败：{err}。请确认令牌有效且对该仓库有写权限（账号密码推送已被远端禁用）；拉取成功不代表令牌可用 —— 公开仓库匿名即可拉取。可在「同步 → 通道配置」里重新登录或更换令牌。',
+    // issue #120：credential helper 必须经 shell 执行，Android 上 git 的 shell 路径不存在（askpass 又要 exec
+    // 权限，Android 10+ 禁执行应用目录文件）→ 已改用 HTTP 认证头重试；仍失败只能点名平台原因，别引向「令牌坏了」。
+    'sync.git.credentialHelperBlocked': 'git 在本机无法执行 credential helper（它需要 shell，而当前平台不允许从应用目录执行脚本/二进制），改用 HTTP 认证头重试也没成功。请确认 git 版本不低于 2.31（环境变量注入配置需要），或把仓库地址换成 ssh。原始错误：{err}',
     'sync.git.repoUrlInvalid': '无法解析 repoUrl（http(s) 仓库必须为合法 URL）: {url}',
     'sync.git.invalidSnapshotId': '非法快照 id: {id}（仅允许字母数字开头，字符限 . _ -）',
     'sync.webdav.baseUrlRequired': 'baseUrl 必须是非空字符串',
@@ -896,6 +899,7 @@ export const en = {
     'sync.git.cmdFailed': 'git {args} failed (exit {code}): {err}',
     'sync.git.pushTokenRequired': 'Push requires an access token, but none is available on this machine (public repositories can be fetched anonymously; pushing always needs authentication). Sign in to GitHub or paste an access token under Sync → Channel configuration, then retry.',
     'sync.git.pushAuthFailed': 'Push authentication failed: {err}. Check that the token is valid and has write access to this repository (password authentication is disabled by the remote); a successful pull does not prove the token works — public repositories can be fetched anonymously. Sign in again or replace the token under Sync → Channel configuration.',
+    'sync.git.credentialHelperBlocked': 'git cannot run the credential helper on this machine (it needs a shell, and this platform does not allow executing scripts/binaries from the app directory), and retrying with an HTTP authorization header did not work either. Make sure git is 2.31 or newer (injecting config through environment variables needs it) or switch the repository address to ssh. Original error: {err}',
     'sync.git.repoUrlInvalid': 'Cannot parse repoUrl (http(s) repositories must be valid URLs): {url}',
     'sync.git.invalidSnapshotId': 'Invalid snapshot id: {id} (must start with an alphanumeric; only . _ - allowed)',
     'sync.webdav.baseUrlRequired': 'baseUrl must be a non-empty string',

package/lib/index.d.ts

@@ -77,7 +77,7 @@ export declare const name = "config-manager";
 /** Services required before the engine can mount (present in every profile). */
 export declare const inject: string[];
 /** Plugin version, kept in sync with package.json ("version"). */
-export declare const PLUGIN_VERSION = "0.2.0";
+export declare const PLUGIN_VERSION = "0.2.2";
 /**
  * Star 引导弹窗指向的 GitHub 仓库（用户引导点 Star 的目标）。
  * 与 package.json 的 repository 字段保持一致；界面不可改（硬编码，参照

package/lib/index.js

@@ -136,7 +136,7 @@ export const name = 'config-manager';
 /** Services required before the engine can mount (present in every profile). */
 export const inject = ['settings', 'credentials'];
 /** Plugin version, kept in sync with package.json ("version"). */
-export const PLUGIN_VERSION = '0.2.0';
+export const PLUGIN_VERSION = '0.2.2';
 /** Plugin own package name — excluded from its own exported plugins list. */
 const PLUGIN_NAME = 'dsh-config-manager';
 /**

package/lib/market/git-file-writer.js

@@ -28,6 +28,7 @@ import { quoteGitValue } from '../utils/git-quote.js';
 import { withWorkdirLock, WorkdirLockError } from '../utils/workdir-lock.js';
 import { fastForwardFetchArgs, fastForwardMergeArgs, isMissingRemoteRefError, parseCurrentBranch } from '../utils/git-fast-forward.js';
 import { marketMsg } from './messages-market.js';
+import { clearDirContents, credentialHeaderEnv, isEmptyDir, isCredentialExecFailure } from '../sync/git/credential-auth.js';
 const execFileAsync = promisify(execFile);
 const DEFAULT_TIMEOUT_MS = 60_000;
 const DEFAULT_AUTHOR = { name: 'DSH Config Manager', email: 'publish@dsh.local' };
@@ -46,6 +47,8 @@ const defaultExec = async (cmd, args, opts) => {
             maxBuffer: 16 * 1024 * 1024,
             windowsHide: true,
             encoding: 'utf8',
+            // issue #120：credential helper 走不了 shell 时改用 env 注入认证头重试（追加在继承的 process.env 上）
+            env: opts.env === undefined ? undefined : { ...process.env, ...opts.env },
         });
         return { stdout: String(stdout), stderr: String(stderr), code: 0 };
     }
@@ -169,7 +172,7 @@ export class GitFileWriterClient {
         const pushArgs = branch !== ''
             ? ['push', '-u', 'origin', branch, ...(call.force === true ? ['--force-with-lease'] : [])]
             : ['push', '-u', 'origin', 'HEAD'];
-        const push = await this.runGit(pushArgs, { cwd: call.workDir, withCredential: true, token, mask });
+        const push = await this.runGit(pushArgs, { cwd: call.workDir, withCredential: true, token, mask, repoUrl: call.repoUrl });
         if (push.code !== 0) {
             throw new GitFileWriterError(mask(marketMsg('market.gitWriter.pushFailed', { stderr: push.stderr })));
         }
@@ -189,8 +192,21 @@ export class GitFileWriterClient {
             extra = cred.extraArgs;
             cleanup = cred.cleanup;
         }
+        // issue #120：只有「命令开跑前目录是空的」才敢在重试前清空 —— 绝不删用户文件。
+        const cloneTargetWasEmpty = args[0] === 'clone' ? await isEmptyDir(cwd) : false;
         try {
-            const result = await this.exec(this.gitBin, [...extra, ...args], { cwd, timeoutMs: this.timeoutMs });
+            let result = await this.exec(this.gitBin, [...extra, ...args], { cwd, timeoutMs: this.timeoutMs });
+            // issue #120：同 GitTransport —— credential helper 必须经 shell 执行，Android 上 git 的 shell 路径
+            // 不存在（askpass 又要 exec 权限）→ 改用 env 注入 HTTP 认证头重试一次（不需要 shell）。
+            if (result.code !== 0 && opts.withCredential === true && opts.token !== ''
+                && isCredentialExecFailure(result.stderr + ' ' + result.stdout)) {
+                const headerEnv = credentialHeaderEnv(opts.repoUrl ?? '', this.credentialUsername, opts.token);
+                if (Object.keys(headerEnv).length > 0 && (args[0] !== 'clone' || cloneTargetWasEmpty)) {
+                    if (args[0] === 'clone')
+                        await clearDirContents(cwd);
+                    result = await this.exec(this.gitBin, args, { cwd, timeoutMs: this.timeoutMs, env: headerEnv });
+                }
+            }
             if (result.code !== 0 && !opts.allowNonZero) {
                 throw new GitFileWriterError(opts.mask(marketMsg('market.gitWriter.commandFailed', { args: args.join(' '), stderr: result.stderr })));
             }
@@ -241,7 +257,7 @@ export class GitFileWriterClient {
             if (entries.length > 0) {
                 throw new GitFileWriterError(marketMsg('market.gitWriter.workDirNotEmpty', { workDir }));
             }
-            const clone = await this.runGit(['clone', repoUrl, '.'], { cwd: workDir, withCredential: true, token, mask });
+            const clone = await this.runGit(['clone', repoUrl, '.'], { cwd: workDir, withCredential: true, token, mask, repoUrl });
             if (clone.code !== 0) {
                 throw new GitFileWriterError(mask(marketMsg('market.gitWriter.cloneFailed', { stderr: clone.stderr })));
             }
@@ -265,7 +281,7 @@ export class GitFileWriterClient {
             return;
         // 不再用 git pull --ff-only：并发下 FETCH_HEAD 会被写成多行 for-merge、pull 自己 fatal；
         // 显式 refspec fetch + 显式远端跟踪分支 merge 完全不读 FETCH_HEAD（参数见 utils/git-fast-forward.ts）。
-        const fetched = await this.runGit(fastForwardFetchArgs(branch), { cwd: workDir, withCredential: true, allowNonZero: true, token, mask });
+        const fetched = await this.runGit(fastForwardFetchArgs(branch), { cwd: workDir, withCredential: true, allowNonZero: true, token, mask, repoUrl });
         if (fetched.code !== 0) {
             const combined = fetched.stderr + ' ' + fetched.stdout;
             // 无 upstream / 远端还没有这个分支 → 静默跳过（内容可能已是最新）

package/lib/sync/git/credential-auth.d.ts

@@ -0,0 +1,14 @@
+/** 这条 git 失败是不是「credential helper 根本没能执行」（→ 值得改用 HTTP 认证头重试）。 */
+export declare function isCredentialExecFailure(text: string): boolean;
+/** 目录是否为空（读不到 = 非空：拿不准时绝不删东西，见 runGit 的 clone 重试）。 */
+export declare function isEmptyDir(dir: string): Promise<boolean>;
+/** 清空目录内容但保留目录本身（只用于「命令开跑前确认为空」的 clone 重试路径）。 */
+export declare function clearDirContents(dir: string): Promise<void>;
+/**
+ * 构造「用 HTTP 认证头代替 credential helper」的子进程环境变量。
+ *
+ * - 顺带把 `credential.helper` 置空：否则全局 `.gitconfig` 里配的 helper 仍会被调用并再次 cannot exec。
+ * - 明文 http 常被远端重定向到 https，而 git 是按**每条请求的 URL** 匹配配置的 → 两个前缀都挂一份。
+ * - 返回空对象 = 注入不了（repoUrl 不是合法 URL，或令牌为空），调用方保持原有失败路径。
+ */
+export declare function credentialHeaderEnv(repoUrl: string, username: string, token: string): Record<string, string>;

package/lib/sync/git/credential-auth.js

@@ -0,0 +1,84 @@
+import { readdir, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+/**
+ * issue #120：**不依赖 shell、不依赖可执行文件**的 git 认证兜底。
+ *
+ * 真机现场（Android，App 内嵌 `dsh web`）：git 二进制编译期把 GIT_SHELL_PATH 钉成
+ * Termux 的 `/data/data/com.termux/files/usr/bin/sh`，该路径在 App 沙箱里不存在，而 git 执行
+ * credential helper 的方式是把 helper 值拼成 `sh -c 'git <helper> ...'` —— **没有**「值里不含空格
+ * 就不经 shell」这种写法（本机 git trace 实测：`run_command: 'git credential-store get'` 之后紧接
+ * `start_command: '<git>/usr/bin/sh.exe' -c 'git credential-store get'`；裸 `credential.helper=store`
+ * 也一样）。于是 helper 恒定失败：
+ * `fatal: cannot exec 'git credential-store --file=... credential get': No such file or directory`
+ * → 无 tty 时退化成 `fatal: could not read Password for 'https://oauth2@github.com': terminal prompts disabled`。
+ *
+ * 换成 `core.askpass` 躲不开：askpass 是一个**要被 exec 的脚本**，而 Android 10 起 targetSdk ≥ 29
+ * 的应用不允许执行自己数据目录里的文件（SELinux untrusted_app_29+ 对 app_data_file 无 execute 权限）。
+ *
+ * 唯一不需要 exec 的通道是 git 自己从环境变量读配置（git ≥ 2.31 的 GIT_CONFIG_COUNT 协议）：
+ * 把 `http.<scope>.extraheader = AUTHORIZATION: basic <base64(user:token)>` 挂进 git 子进程的 env，
+ * 凭据既不进 argv、也不落临时文件、更不需要 sh —— token 只出现在 git 子进程的环境里
+ * （Android 上 /proc/<pid>/environ 也只有同 uid 可读，比临时凭据文件更窄）。
+ *
+ * 用法：helper 路线先跑；失败且命中 isCredentialExecFailure() 时换这份 env 重试一次。
+ */
+/**
+ * credential helper 无法被执行时的 git 原文特征：
+ * - `cannot exec ...: No such file or directory`：shell 或 helper 二进制不存在；
+ * - `could not read Password ...` / `terminal prompts disabled`：helper 没跑成，退化成读终端口令。
+ */
+const CREDENTIAL_EXEC_FAILURE_RE = /cannot exec|could not read Password|terminal prompts disabled/i;
+/** 这条 git 失败是不是「credential helper 根本没能执行」（→ 值得改用 HTTP 认证头重试）。 */
+export function isCredentialExecFailure(text) {
+    return CREDENTIAL_EXEC_FAILURE_RE.test(text);
+}
+/** 目录是否为空（读不到 = 非空：拿不准时绝不删东西，见 runGit 的 clone 重试）。 */
+export async function isEmptyDir(dir) {
+    try {
+        return (await readdir(dir)).length === 0;
+    }
+    catch {
+        return false;
+    }
+}
+/** 清空目录内容但保留目录本身（只用于「命令开跑前确认为空」的 clone 重试路径）。 */
+export async function clearDirContents(dir) {
+    const entries = await readdir(dir).catch(() => []);
+    for (const entry of entries) {
+        await rm(join(dir, entry), { recursive: true, force: true });
+    }
+}
+/**
+ * 构造「用 HTTP 认证头代替 credential helper」的子进程环境变量。
+ *
+ * - 顺带把 `credential.helper` 置空：否则全局 `.gitconfig` 里配的 helper 仍会被调用并再次 cannot exec。
+ * - 明文 http 常被远端重定向到 https，而 git 是按**每条请求的 URL** 匹配配置的 → 两个前缀都挂一份。
+ * - 返回空对象 = 注入不了（repoUrl 不是合法 URL，或令牌为空），调用方保持原有失败路径。
+ */
+export function credentialHeaderEnv(repoUrl, username, token) {
+    if (token === '')
+        return {};
+    let origin;
+    try {
+        const u = new URL(repoUrl);
+        // 只取 scheme://host[:port]/ 作作用域：路径无关（同主机全部仓库都用这份令牌）
+        origin = `${u.protocol}//${u.host}/`;
+    }
+    catch {
+        return {};
+    }
+    const scopes = [origin];
+    if (origin.startsWith('http://'))
+        scopes.push(`https://${origin.slice('http://'.length)}`);
+    const authorization = `AUTHORIZATION: basic ${Buffer.from(`${username}:${token}`, 'utf8').toString('base64')}`;
+    const pairs = [['credential.helper', '']];
+    for (const scope of scopes)
+        pairs.push([`http.${scope}.extraheader`, authorization]);
+    const env = { GIT_CONFIG_COUNT: String(pairs.length) };
+    pairs.forEach(([key, value], index) => {
+        env[`GIT_CONFIG_KEY_${String(index)}`] = key;
+        env[`GIT_CONFIG_VALUE_${String(index)}`] = value;
+    });
+    return env;
+}
+//# sourceMappingURL=credential-auth.js.map

package/lib/sync/git/git-transport.d.ts

@@ -11,6 +11,7 @@ export interface GitExecResult {
 export type GitExecFn = (cmd: string, args: string[], opts: {
     cwd?: string;
     timeoutMs?: number;
+    env?: Record<string, string>;
 }) => Promise<GitExecResult>;
 /** 工作副本自检事实（issue #79）：origin 是否已跟随配置地址、有无未上行的本地提交。 */
 export interface GitWorkDirFacts {

package/lib/sync/git/git-transport.js

@@ -30,6 +30,7 @@ import { classifyNetworkErrorText, computeSnapshotMeta, DEFAULT_SYNC_TIMEOUT_MS,
 import { parseJsonSafe } from '../../utils/json.js';
 import { atomicWriteFile } from '../../utils/atomic-write.js';
 import { quoteGitValue } from '../../utils/git-quote.js';
+import { clearDirContents, credentialHeaderEnv, isEmptyDir, isCredentialExecFailure } from './credential-auth.js';
 import { SECTION_FILE_PREFIXES } from '../../schema/config.js';
 import { zhMsg } from '../../core/messages.js';
 import { withWorkdirLock, WorkdirLockError } from '../../utils/workdir-lock.js';
@@ -119,6 +120,9 @@ const defaultExec = async (cmd, args, opts) => {
             maxBuffer: 16 * 1024 * 1024,
             windowsHide: true,
             encoding: 'utf8',
+            // issue #120：credential helper 走 shell 且本机没有可用 shell 时，改用 env 注入认证头重试 ——
+            // 追加在继承的 process.env 上（env 缺省 = 完全继承，不改变既有行为）
+            env: opts.env === undefined ? undefined : { ...process.env, ...opts.env },
         });
         return { stdout: String(stdout), stderr: String(stderr), code: 0 };
     }
@@ -823,8 +827,24 @@ export class GitTransport {
                 await cleanup();
             throw new GitTransportError(this.msg('sync.git.pushTokenRequired'), { kind: 'auth', retryable: false });
         }
+        // issue #120：只有「命令开跑前目录是空的」才敢在重试前清空 —— clone 失败可能留下半成品，
+        // 而目录里原本就有别的内容时宁可放弃重试，也绝不删用户文件。
+        const cloneTargetWasEmpty = args[0] === 'clone' ? await isEmptyDir(cwd) : false;
         try {
-            const result = await this.o.exec(this.o.gitBin, [...extra, ...args], { cwd, timeoutMs: this.o.timeoutMs });
+            let result = await this.o.exec(this.o.gitBin, [...extra, ...args], { cwd, timeoutMs: this.o.timeoutMs });
+            // issue #120：credential helper 必须经 shell 执行（值里不含空格也一样，git 统一拼成
+            // `sh -c 'git <helper> ...'`），而 Android 上 git 二进制的 GIT_SHELL_PATH 指向 App 沙箱里
+            // 不存在的 Termux sh；`core.askpass` 又要 exec 权限（Android 10+ 对 targetSdk ≥ 29 禁执行应用
+            // 目录里的文件）。两条路都走不通时，改用 env 注入 HTTP 认证头重试一次（不需要 shell）。
+            if (result.code !== 0 && token !== null && token !== ''
+                && isCredentialExecFailure(result.stderr + ' ' + result.stdout)) {
+                const headerEnv = credentialHeaderEnv(this.o.repoUrl, this.o.credentialUsername, token);
+                if (Object.keys(headerEnv).length > 0 && (args[0] !== 'clone' || cloneTargetWasEmpty)) {
+                    if (args[0] === 'clone')
+                        await clearDirContents(cwd);
+                    result = await this.o.exec(this.o.gitBin, args, { cwd, timeoutMs: this.o.timeoutMs, env: headerEnv });
+                }
+            }
             if (result.code !== 0 && !opts.allowNonZero) {
                 const combined = result.stderr + ' ' + result.stdout;
                 // 统一分类（超时 / 网络 / 鉴权 / 5xx…）：上层可据 kind / retryable 分流，不必解析 message
@@ -836,12 +856,19 @@ export class GitTransport {
                 // 推送 + 鉴权失败：git 原文只说「认证失败」——换成能照做的说明（令牌失效 / 无写权限 / 远端禁用了密码推送）
                 // issue #115：clone 的鉴权失败原文（remote: Write access to repository not granted / 403）读不出「缺哪种权限」，
                 // 换成点名 Contents: Read and write 的说明 —— 否则用户只会以为令牌坏了（细粒度 PAT 常只勾了 Administration）
-                const message = opts.requirePushToken === true && classified.kind === 'auth'
-                    ? this.msg('sync.git.pushAuthFailed', { err: this.mask(result.stderr, token) })
-                    : args[0] === 'clone' && classified.kind === 'auth'
-                        ? this.msg('sync.git.cloneAuthFailed', { err: this.mask(result.stderr, token) })
-                        : this.msg('sync.git.cmdFailed', { args: args.join(' '), code: String(result.code), err: this.mask(result.stderr, token) });
-                throw new GitTransportError(message, classified);
+                // issue #120：helper 根本没能执行时，「请确认令牌有效」是错误指引（令牌可能是好的）——
+                // 这类失败必须点名平台原因，排在 push/clone 的鉴权文案之前。
+                const credentialBlocked = isCredentialExecFailure(combined);
+                const message = credentialBlocked
+                    ? this.msg('sync.git.credentialHelperBlocked', { err: this.mask(result.stderr, token) })
+                    : opts.requirePushToken === true && classified.kind === 'auth'
+                        ? this.msg('sync.git.pushAuthFailed', { err: this.mask(result.stderr, token) })
+                        : args[0] === 'clone' && classified.kind === 'auth'
+                            ? this.msg('sync.git.cloneAuthFailed', { err: this.mask(result.stderr, token) })
+                            : this.msg('sync.git.cmdFailed', { args: args.join(' '), code: String(result.code), err: this.mask(result.stderr, token) });
+                // 归类同样不能交给原文：`cannot exec ...: No such file or directory` 里的 ENOENT 会被判成
+                // notfound（「仓库不存在」），而真实原因是凭据通道不可用 → 钉成 auth（非瞬时、别重试）。
+                throw new GitTransportError(message, credentialBlocked ? { kind: 'auth', retryable: false } : classified);
             }
             return result;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-config-manager",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "license": "MIT",
   "description": "Backup, restore, export, import, migrate and sync your DeepSeek Harness (DSH) configuration: settings, plugins, MCP servers, skills, agent presets and workspaces. One-click migration to another machine. DSH 配置一键备份、恢复、导出、导入、迁移与同步插件。",
   "icon": "./icon.svg",

package/src/adapters/self.test.ts

@@ -284,4 +284,58 @@ test('self: 运行态改写不改变分区 hash（自动同步不再每轮误判
   await src.fs.writeFile(rel, Buffer.from(config({ lastRunAt: '2026-10-25T12:02:00.000Z' }, 'https://y/repo.git'), 'utf8'));
   const third = await adapter.export(src, { includeSecrets: false });
   assert.notEqual(hashSection(third.data), hashSection(second.data), '真实配置变化必须让分区 hash 变化');
+});
+
+/**
+ * issue #119 回归：跳过码翻转不得改变分区 hash。
+ *
+ * 现场（0.2.0 / macOS desktop / git 通道 + 自动同步 60s 远端轮询）：配置一字未改，远端仓库
+ * 每分钟多 1~2 个 commit，15 分钟 24 个。根因 = 调度器「跳过」轮写
+ * lastRunSkipReason='upToDate'（冲突轮写 'conflict' + lastRunSkipCount），而「真推」轮收尾
+ * 又把它们清空（toChannelPayload 空值不写）；两个字段不在剔除表里 → self 分区 hash 每轮翻新
+ * → hasLocalChanges() 恒真 → 每轮都真推一个新快照。
+ */
+test('self: 跳过码翻转不改变分区 hash（issue #119：自动同步不再每轮真推快照）', async () => {
+  const rel = 'dsh-config-manager/sync/sync-autosync.json';
+  const src = makeContext('win32', 'C:\\Users\\alice');
+  const adapter = new SelfAdapter();
+  const config = (runState: Record<string, unknown>, repoUrl = 'https://x/repo.git') => JSON.stringify({
+    schemaVersion: 2,
+    channels: {
+      git: { enabled: true, intervalMinutes: 30, realtime: true, remoteCheckMs: 60000, repoUrl, branch: 'main', ...runState },
+      webdav: { enabled: false },
+    },
+  }, null, 2);
+
+  // 轮次 A：跳过（无本地改动）
+  await src.fs.writeFile(rel, Buffer.from(config({ lastRunAt: '2026-10-29T09:00:00.000Z', lastRunStatus: 'success', lastRunSkipReason: 'upToDate', consecutiveFailures: 0 }), 'utf8'));
+  const skipRound = await adapter.export(src, { includeSecrets: false });
+
+  // 轮次 B：真推一次 —— 跳过码被清空，其余与 A 相同
+  await src.fs.writeFile(rel, Buffer.from(config({ lastRunAt: '2026-10-29T09:01:00.000Z', lastRunStatus: 'success', consecutiveFailures: 0 }), 'utf8'));
+  const pushRound = await adapter.export(src, { includeSecrets: false });
+
+  // 轮次 C：跳过（冲突，带待确认分区数）
+  await src.fs.writeFile(rel, Buffer.from(config({ lastRunAt: '2026-10-29T09:02:00.000Z', lastRunStatus: 'success', lastRunSkipReason: 'conflict', lastRunSkipCount: 3, consecutiveFailures: 0 }), 'utf8'));
+  const conflictRound = await adapter.export(src, { includeSecrets: false });
+
+  const base = hashSection(skipRound.data);
+  assert.equal(hashSection(pushRound.data), base, '跳过码被清空不得改变分区 hash（否则每轮都判「本地有改动」）');
+  assert.equal(hashSection(conflictRound.data), base, '跳过码换值 / 带分区数不得改变分区 hash');
+
+  const payload = Buffer.from(pushRound.data.files.find((f) => f.relativePath === 'sync/sync-autosync.json')!.data).toString('utf8');
+  assert.ok(!payload.includes('lastRunSkip'), '导出载荷不含跳过码：远端不该接收本机执行记录');
+  assert.ok(payload.includes('"repoUrl":"https://x/repo.git"'), '配置本体仍在载荷里');
+
+  // 同一份远端载荷回灌本机（本机多出跳过码）→ Skip，不是 Conflict
+  const dst = makeContext('linux', '/home/bob');
+  await dst.fs.writeFile(rel, Buffer.from(config({ lastRunAt: '2026-10-29T09:05:00.000Z', lastRunStatus: 'success', lastRunSkipReason: 'upToDate' }), 'utf8'));
+  const sections = new Map([['self', pushRound.data]]);
+  let items = await adapter.analyzeImport(pushRound.data, makeImportContext(dst, sections));
+  assert.equal(items[0]?.kind, 'Skip', '仅跳过码不同 → Skip（此前每轮判 Conflict 并重复推送）');
+
+  // 配置本体变化仍必须被识别（不能把剔除做成「什么都判不变」）
+  await dst.fs.writeFile(rel, Buffer.from(config({ lastRunSkipReason: 'upToDate' }, 'https://y/repo.git'), 'utf8'));
+  items = await adapter.analyzeImport(pushRound.data, makeImportContext(dst, sections));
+  assert.equal(items[0]?.kind, 'Conflict', '真实配置变化必须仍判 Conflict');
 });

package/src/adapters/self.ts

@@ -45,6 +45,8 @@
  * 且文件类分区不进 SecretScanner（与 pluginFiles/skills 同语义）。
  */
 import type { HostContext } from '../core/types.ts';
+import type { AutosyncConfig } from '../sync/autosync-config.ts';
+import type { BackupScheduleConfig } from '../sync/backup-schedule-config.ts';
 import type { RecursiveListing } from '../utils/recursive-walk.ts';
 import { sectionMeta } from '../schema/section-registry.ts';
 import { FileCollectionAdapter } from './file-collection.ts';
@@ -62,13 +64,48 @@ export const SELF_CONFIG_FILES: readonly string[] = [
   'exports/.backup-notes.json',
 ];
 
+/**
+ * 调度配置里「运行态字段」的**命名口径**：调度器每轮收尾都会改写的字段名形状
+ * （`lastRun*` 一族 + `consecutiveFailures`）。剔除表必须覆盖两个调度配置的并集，
+ * 少一个都会让 self 分区的 hashSection 每轮翻新（issue #119）。
+ */
+type RunStateKeyOf<T> = {
+  [K in keyof T]-?: K extends 'consecutiveFailures' | `lastRun${string}` ? K : never;
+}[keyof T];
+
+type SchedulerRunStateKey = RunStateKeyOf<AutosyncConfig> | RunStateKeyOf<BackupScheduleConfig>;
+
 /**
  * 调度配置里的**运行态字段**：每次执行收尾都会被调度器改写，不属于「配置身份」。
  * 仅比对时剔除（见 comparableContent）；写盘仍写完整文件。
+ *
+ * 逐项列全而不是靠前缀过滤：前缀过滤会把**将来**新增的运行态字段静默吞掉（看不见的假 Skip），
+ * 漏列则让 hash 每轮翻新（issue #119）。所以列全 + 下面的穷尽断言，让编译器守住漂移。
  */
-const VOLATILE_RUN_STATE_KEYS: ReadonlySet<string> = new Set([
-  'lastRunAt', 'lastRunStatus', 'lastRunMessage', 'lastRunHistoryId', 'consecutiveFailures',
-]);
+const VOLATILE_RUN_STATE_KEY_LIST = [
+  'lastRunAt',
+  'lastRunStatus',
+  'lastRunMessage',
+  'lastRunHistoryId',
+  'consecutiveFailures',
+  // issue #119：跳过码每轮在「写入 / 清空」之间翻转，与 lastRunAt 同性质，漏剔即每轮真推快照
+  'lastRunSkipReason',
+  'lastRunSkipCount',
+] as const satisfies readonly SchedulerRunStateKey[];
+
+const VOLATILE_RUN_STATE_KEYS: ReadonlySet<string> = new Set(VOLATILE_RUN_STATE_KEY_LIST);
+
+/**
+ * 编译期穷尽断言（零运行时开销）：`AutosyncConfig` / `BackupScheduleConfig` 将来新增任何
+ * `lastRun*` 字段而没进上表时，`Exclude` 不再是 `never`，**这一行 typecheck 报错**。
+ * 只写 `satisfies keyof T` 挡不住「新增字段忘了加」——那正是 issue #119 的失效模式。
+ */
+type AssertExhaustive<T extends never> = T;
+
+/** 见 AssertExhaustive 的注释；导出只为让断言参与类型检查（无需被引用）。 */
+export type SchedulerRunStateKeysExhaustive = AssertExhaustive<
+  Exclude<SchedulerRunStateKey, (typeof VOLATILE_RUN_STATE_KEY_LIST)[number]>
+>;
 
 /** 含运行态字段的调度配置（相对 baseDir）。 */
 const SCHEDULER_CONFIG_RELS: ReadonlySet<string> = new Set([

package/src/core/messages.ts

@@ -439,6 +439,9 @@ export const zh = {
   // 推送认证（真机：公开仓库拉取可匿名成功、推送必失败，git 原文只说「Invalid username or token」）
   'sync.git.pushTokenRequired': '推送需要访问令牌：远端是 http(s) 仓库，但本机没有可用的令牌（拉取公开仓库可以匿名完成，推送必须认证）。请在「同步 → 通道配置」里登录 GitHub 或填入访问令牌后重试。',
   'sync.git.pushAuthFailed': '推送认证失败：{err}。请确认令牌有效且对该仓库有写权限（账号密码推送已被远端禁用）；拉取成功不代表令牌可用 —— 公开仓库匿名即可拉取。可在「同步 → 通道配置」里重新登录或更换令牌。',
+  // issue #120：credential helper 必须经 shell 执行，Android 上 git 的 shell 路径不存在（askpass 又要 exec
+  // 权限，Android 10+ 禁执行应用目录文件）→ 已改用 HTTP 认证头重试；仍失败只能点名平台原因，别引向「令牌坏了」。
+  'sync.git.credentialHelperBlocked': 'git 在本机无法执行 credential helper（它需要 shell，而当前平台不允许从应用目录执行脚本/二进制），改用 HTTP 认证头重试也没成功。请确认 git 版本不低于 2.31（环境变量注入配置需要），或把仓库地址换成 ssh。原始错误：{err}',
   'sync.git.repoUrlInvalid': '无法解析 repoUrl（http(s) 仓库必须为合法 URL）: {url}',
   'sync.git.invalidSnapshotId': '非法快照 id: {id}（仅允许字母数字开头，字符限 . _ -）',
   'sync.webdav.baseUrlRequired': 'baseUrl 必须是非空字符串',
@@ -940,6 +943,7 @@ export const en: Record<keyof typeof zh, string> = {
   'sync.git.cmdFailed': 'git {args} failed (exit {code}): {err}',
   'sync.git.pushTokenRequired': 'Push requires an access token, but none is available on this machine (public repositories can be fetched anonymously; pushing always needs authentication). Sign in to GitHub or paste an access token under Sync → Channel configuration, then retry.',
   'sync.git.pushAuthFailed': 'Push authentication failed: {err}. Check that the token is valid and has write access to this repository (password authentication is disabled by the remote); a successful pull does not prove the token works — public repositories can be fetched anonymously. Sign in again or replace the token under Sync → Channel configuration.',
+  'sync.git.credentialHelperBlocked': 'git cannot run the credential helper on this machine (it needs a shell, and this platform does not allow executing scripts/binaries from the app directory), and retrying with an HTTP authorization header did not work either. Make sure git is 2.31 or newer (injecting config through environment variables needs it) or switch the repository address to ssh. Original error: {err}',
   'sync.git.repoUrlInvalid': 'Cannot parse repoUrl (http(s) repositories must be valid URLs): {url}',
   'sync.git.invalidSnapshotId': 'Invalid snapshot id: {id} (must start with an alphanumeric; only . _ - allowed)',
   'sync.webdav.baseUrlRequired': 'baseUrl must be a non-empty string',

package/src/index.ts

@@ -180,7 +180,7 @@ export const name = 'config-manager'
 export const inject = ['settings', 'credentials']
 
 /** Plugin version, kept in sync with package.json ("version"). */
-export const PLUGIN_VERSION = '0.2.0'
+export const PLUGIN_VERSION = '0.2.2'
 
 /** Plugin own package name — excluded from its own exported plugins list. */
 const PLUGIN_NAME = 'dsh-config-manager'

package/src/market/git-file-writer.test.ts

@@ -19,7 +19,7 @@ const TEST_TOKEN = 'gho_abcdefghijklmnopqrstuvwxyz123456';
 interface ExecCall {
   cmd: string;
   args: string[];
-  opts: { cwd?: string; timeoutMs?: number };
+  opts: { cwd?: string; timeoutMs?: number; env?: Record<string, string> };
 }
 
 /** 记录 exec 调用并按命令返回脚本化结果的 mock */
@@ -286,4 +286,78 @@ test('git-file-writer: 工作副本非空且非 git 仓库 → 拒绝', async (t
     GitFileWriterError,
   );
   assert.ok(!calls.some((c) => c.args[0] === 'clone'), '非空非仓库目录不得 clone');
-});
+});
+
+// issue #120：Android 上 credential helper 走 `sh -c`，helper 无法执行 ⇒ 换 env 注入认证头重试。
+test('git-file-writer: credential helper 无法执行 → 用 env 注入认证头重试 push 成功', async (t) => {
+  const workDir = await tempWorkDir(t);
+  const { exec, calls } = installExec((call) => {
+    if (gitCommandOf(call) === 'diff') return { stdout: '', stderr: '', code: 1 }; // 有变化 → commit + push
+    if (gitCommandOf(call) === 'push' && call.opts.env === undefined) {
+      return {
+        stdout: '',
+        stderr: "fatal: cannot exec 'git credential-store --file=/data/user/0/x/cache/tmp/dsh-git-cred-1/credential get': No such file or directory",
+        code: 128,
+      };
+    }
+    return { stdout: '', stderr: '', code: 0 };
+  });
+  const writer = createGitFileWriter({ credentials: { getToken: async () => TEST_TOKEN }, exec });
+
+  const result = await writer.writeFiles({
+    repoUrl: 'https://github.com/xiaojun/dsh-configs',
+    workDir,
+    entries: [{ path: 'a.txt', content: '1' }],
+    commitMessage: 'publish',
+  });
+
+  assert.equal(result.pushed, true);
+  const pushes = calls.filter((c) => gitCommandOf(c) === 'push');
+  assert.equal(pushes.length, 2, 'helper 失败后必须重试一次');
+  const retry = pushes[1]!;
+  assert.ok(!retry.args.some((a) => a.startsWith('credential.helper=store')), '重试不得再走 helper');
+  assert.equal(retry.opts.env?.['GIT_CONFIG_COUNT'], '2');
+  assert.equal(retry.opts.env?.['GIT_CONFIG_KEY_0'], 'credential.helper');
+  assert.equal(retry.opts.env?.['GIT_CONFIG_VALUE_0'], '');
+  assert.equal(retry.opts.env?.['GIT_CONFIG_KEY_1'], 'http.https://github.com/.extraheader');
+  assert.equal(
+    retry.opts.env?.['GIT_CONFIG_VALUE_1'],
+    'AUTHORIZATION: basic ' + Buffer.from('oauth2:' + TEST_TOKEN).toString('base64'),
+  );
+  assert.ok(!retry.args.join(' ').includes(TEST_TOKEN), 'token 不得进 argv');
+});
+
+test('git-file-writer: clone 遇 helper 无法执行 → 清掉半成品目录后重试', async (t) => {
+  const workDir = await tempWorkDir(t);
+  let cloneAttempts = 0;
+  const { exec } = installExec((call) => {
+    if (gitCommandOf(call) === 'clone') {
+      cloneAttempts += 1;
+      if (cloneAttempts === 1) {
+        return { stdout: '', stderr: "fatal: cannot exec 'git credential-store get': No such file or directory", code: 128 };
+      }
+    }
+    if (gitCommandOf(call) === 'diff') return { stdout: '', stderr: '', code: 0 };
+    return { stdout: '', stderr: '', code: 0 };
+  });
+  // 第一次 clone 前造一个半成品目录：真实 git 失败会留下 .git 残骸，重试前必须清空
+  const scriptedExec: GitExecFn = async (cmd, args, opts) => {
+    if (args.includes('clone') && cloneAttempts === 0) {
+      await fs.mkdir(path.join(workDir, '.git', 'partial'), { recursive: true });
+    }
+    return exec(cmd, args, opts);
+  };
+
+  const writer = createGitFileWriter({ credentials: { getToken: async () => TEST_TOKEN }, exec: scriptedExec });
+  const result = await writer.writeFiles({
+    repoUrl: 'https://github.com/xiaojun/dsh-configs',
+    workDir,
+    entries: [{ path: 'a.txt', content: '1' }],
+    commitMessage: 'noop',
+  });
+
+  assert.equal(cloneAttempts, 2, 'clone 失败后必须重试一次');
+  assert.equal(result.pushed, false);
+  // 第一轮留下的 .git 残骸必须被清掉，目录里只剩本轮写入的文件
+  assert.deepEqual(await fs.readdir(workDir), ['a.txt']);
+});

package/src/market/git-file-writer.ts

@@ -30,6 +30,7 @@ import { withWorkdirLock, WorkdirLockError } from '../utils/workdir-lock.ts';
 import { fastForwardFetchArgs, fastForwardMergeArgs, isMissingRemoteRefError, parseCurrentBranch } from '../utils/git-fast-forward.ts';
 import { marketMsg } from './messages-market.ts';
 import type { GitAuthor, GitCredentialProvider, GitExecFn, GitExecResult } from '../sync/git/git-transport.ts';
+import { clearDirContents, credentialHeaderEnv, isEmptyDir, isCredentialExecFailure } from '../sync/git/credential-auth.ts';
 
 const execFileAsync = promisify(execFile);
 
@@ -102,6 +103,8 @@ const defaultExec: GitExecFn = async (cmd, args, opts) => {
       maxBuffer: 16 * 1024 * 1024,
       windowsHide: true,
       encoding: 'utf8',
+      // issue #120：credential helper 走不了 shell 时改用 env 注入认证头重试（追加在继承的 process.env 上）
+      env: opts.env === undefined ? undefined : { ...process.env, ...opts.env },
     });
     return { stdout: String(stdout), stderr: String(stderr), code: 0 };
   } catch (err) {
@@ -231,7 +234,7 @@ export class GitFileWriterClient implements GitFileWriter {
     const pushArgs = branch !== ''
       ? ['push', '-u', 'origin', branch, ...(call.force === true ? ['--force-with-lease'] : [])]
       : ['push', '-u', 'origin', 'HEAD'];
-    const push = await this.runGit(pushArgs, { cwd: call.workDir, withCredential: true, token, mask });
+    const push = await this.runGit(pushArgs, { cwd: call.workDir, withCredential: true, token, mask, repoUrl: call.repoUrl });
     if (push.code !== 0) {
       throw new GitFileWriterError(mask(marketMsg('market.gitWriter.pushFailed', { stderr: push.stderr })));
     }
@@ -246,7 +249,10 @@ export class GitFileWriterClient implements GitFileWriter {
    */
   private async runGit(
     args: string[],
-    opts: { cwd?: string; withCredential?: boolean; allowNonZero?: boolean; token: string; mask: (text: string) => string },
+    opts: {
+      cwd?: string; withCredential?: boolean; allowNonZero?: boolean; token: string;
+      mask: (text: string) => string; repoUrl?: string;
+    },
   ): Promise<GitExecResult> {
     const cwd = opts.cwd ?? '';
     let extra: string[] = [];
@@ -256,8 +262,20 @@ export class GitFileWriterClient implements GitFileWriter {
       extra = cred.extraArgs;
       cleanup = cred.cleanup;
     }
+    // issue #120：只有「命令开跑前目录是空的」才敢在重试前清空 —— 绝不删用户文件。
+    const cloneTargetWasEmpty = args[0] === 'clone' ? await isEmptyDir(cwd) : false;
     try {
-      const result = await this.exec(this.gitBin, [...extra, ...args], { cwd, timeoutMs: this.timeoutMs });
+      let result = await this.exec(this.gitBin, [...extra, ...args], { cwd, timeoutMs: this.timeoutMs });
+      // issue #120：同 GitTransport —— credential helper 必须经 shell 执行，Android 上 git 的 shell 路径
+      // 不存在（askpass 又要 exec 权限）→ 改用 env 注入 HTTP 认证头重试一次（不需要 shell）。
+      if (result.code !== 0 && opts.withCredential === true && opts.token !== ''
+        && isCredentialExecFailure(result.stderr + ' ' + result.stdout)) {
+        const headerEnv = credentialHeaderEnv(opts.repoUrl ?? '', this.credentialUsername, opts.token);
+        if (Object.keys(headerEnv).length > 0 && (args[0] !== 'clone' || cloneTargetWasEmpty)) {
+          if (args[0] === 'clone') await clearDirContents(cwd);
+          result = await this.exec(this.gitBin, args, { cwd, timeoutMs: this.timeoutMs, env: headerEnv });
+        }
+      }
       if (result.code !== 0 && !opts.allowNonZero) {
         throw new GitFileWriterError(opts.mask(marketMsg('market.gitWriter.commandFailed', { args: args.join(' '), stderr: result.stderr })));
       }
@@ -309,7 +327,7 @@ export class GitFileWriterClient implements GitFileWriter {
       if (entries.length > 0) {
         throw new GitFileWriterError(marketMsg('market.gitWriter.workDirNotEmpty', { workDir }));
       }
-      const clone = await this.runGit(['clone', repoUrl, '.'], { cwd: workDir, withCredential: true, token, mask });
+      const clone = await this.runGit(['clone', repoUrl, '.'], { cwd: workDir, withCredential: true, token, mask, repoUrl });
       if (clone.code !== 0) {
         throw new GitFileWriterError(mask(marketMsg('market.gitWriter.cloneFailed', { stderr: clone.stderr })));
       }
@@ -331,7 +349,7 @@ export class GitFileWriterClient implements GitFileWriter {
     if (branch === '') return;
     // 不再用 git pull --ff-only：并发下 FETCH_HEAD 会被写成多行 for-merge、pull 自己 fatal；
     // 显式 refspec fetch + 显式远端跟踪分支 merge 完全不读 FETCH_HEAD（参数见 utils/git-fast-forward.ts）。
-    const fetched = await this.runGit(fastForwardFetchArgs(branch), { cwd: workDir, withCredential: true, allowNonZero: true, token, mask });
+    const fetched = await this.runGit(fastForwardFetchArgs(branch), { cwd: workDir, withCredential: true, allowNonZero: true, token, mask, repoUrl });
     if (fetched.code !== 0) {
       const combined = fetched.stderr + ' ' + fetched.stdout;
       // 无 upstream / 远端还没有这个分支 → 静默跳过（内容可能已是最新）