dsh-conversation-recycle-bin 0.2.0 → 0.2.2

package/lib/host/catalog.js

@@ -65,10 +65,17 @@ export function createSessionLogOps({ gateway, paths, config, now = Date.now, de
    * Before moving a log this process believes is cold, re-check the newest
    * write after a short grace window: a log that keeps growing is refused
    * instead of being moved out from under the other writer.
+   *
+   * Live sessions are NOT exempt: `quiesce` (which runs before this step in
+   * the cascade) only stops THIS process's Agent. A conversation open in a
+   * second Host is exactly the writer this check must catch, and it is also
+   * the one this process sees as `live`, so the recheck runs for every mode.
+   * The grace window is normally already satisfied at that point, which makes
+   * the extra cost one mtime scan.
    */
   async function assertNoForeignWriter(session, directory) {
     const grace = Number.isFinite(config?.foreignWriterGraceMs) ? config.foreignWriterGraceMs : 0
-    if (grace <= 0 || session.live === true) return
+    if (grace <= 0) return
     const first = await latestWriteMs(directory)
     if (first === null) return
     const age = now() - first
@@ -135,6 +142,45 @@ export function createCatalogOps({ ctx, now = Date.now }) {
     return registry().get(snapshot.workspaceId) ?? null
   }
 
+  function isArchived(service, sessionId) {
+    try {
+      return Array.isArray(service.archivedSessionIds) && service.archivedSessionIds.includes(sessionId)
+    } catch {
+      return false
+    }
+  }
+
+  function isPinned(service, sessionId) {
+    try {
+      return Array.isArray(service.pinnedSessionIds) && service.pinnedSessionIds.includes(sessionId)
+    } catch {
+      return false
+    }
+  }
+
+  /**
+   * Put a session back at the position its snapshot recorded.
+   *
+   * `insertSessionBefore` requires the session to be accounted (the real Host
+   * throws `WorkspaceMoveInvalidError` otherwise), so this helper attaches
+   * first and only then moves it. Position is cosmetic: a failed move leaves
+   * the session attached, which is still correct.
+   */
+  async function restorePosition(workspace, sessionId, nextSessionId) {
+    if (workspace === null) return
+    if (!workspace.sessionIds.includes(sessionId)) await workspace.attachSession(sessionId)
+    try {
+      if (nextSessionId === null || nextSessionId === undefined) {
+        await workspace.insertSessionBefore(sessionId, undefined)
+      } else if (workspace.sessionIds.includes(nextSessionId)) {
+        await workspace.insertSessionBefore(sessionId, nextSessionId)
+      }
+    } catch {
+      // The anchor disappeared or the workspace refused the move; the session
+      // is still attached, so only the ordering is lost.
+    }
+  }
+
   return {
     /** Capture the exact catalog state before any mutation. */
     async capture(session) {
@@ -177,25 +223,26 @@ export function createCatalogOps({ ctx, now = Date.now }) {
       }
 
       // Hard mode performs several mutations. Each one pushes its own inverse
-      // as it commits, so a failure halfway (e.g. unarchive succeeds but detach
-      // is refused) can put back exactly what this call changed instead of
-      // leaving the conversation visibly unarchived/unpinned after a rolled
-      // back deletion.
+      // as it commits, so a failure halfway can put back exactly what this call
+      // changed instead of leaving the conversation visibly unarchived,
+      // unpinned or moved after a rolled back deletion.
+      const wasArchived = isArchived(service, session.id)
+      const wasPinned = isPinned(service, session.id)
       const undone = []
       const undoAll = async () => {
         for (const step of [...undone].reverse()) await step()
       }
       try {
-        // Unarchive to drop any archive marker (including the one quiesce adds
-        // for a live session) — EXCEPT for a live Agent: its pending inbox may
+        // Drop an existing archive marker (including the one quiesce adds for
+        // a live session) — EXCEPT for a live Agent: its pending inbox may
         // still wake after this deletion. Keeping the archive gate as a
         // tombstone makes that wake a blocked pre-step instead of a writer that
         // recreates the moved log. Restore clears the tombstone.
-        if (session.live !== true) {
+        if (session.live !== true && wasArchived) {
           await service.unarchiveSession(session.id)
-          if (snapshot.archived) undone.push(async () => { await service.archiveSession(session.id, { stopActivity: true }) })
+          undone.push(async () => { await service.archiveSession(session.id, { stopActivity: true }) })
         }
-        if (snapshot.pinned) {
+        if (wasPinned) {
           await service.unpinSession(session.id)
           undone.push(async () => { await service.pinSession(session.id) })
         }
@@ -205,11 +252,7 @@ export function createCatalogOps({ ctx, now = Date.now }) {
           undone.push(async () => {
             const current = workspaceOf(snapshot)
             if (current === null) return
-            try {
-              await current.insertSessionBefore(session.id, snapshot.nextSessionId ?? undefined)
-            } catch {
-              await current.attachSession(session.id)
-            }
+            await restorePosition(current, session.id, snapshot.nextSessionId ?? null)
           })
         }
       } catch (error) {
@@ -221,39 +264,61 @@ export function createCatalogOps({ ctx, now = Date.now }) {
 
     /**
      * Rebuild the catalog state captured by `capture` (used by trash restore).
+     *
+     * The undo only reverts mutations THIS call made. A soft-deleted session is
+     * still attached to its workspace; an unconditional detach in the undo used
+     * to remove it from the workspace when a later (memory) step failed.
+     *
      * @returns {Promise<() => Promise<void>>} undo
      */
     async restore(snapshot) {
       const service = registry()
+      const sessionId = snapshot.sessionId
+      const workspace = workspaceOf(snapshot)
+      const wasAttached = workspace !== null && workspace.sessionIds.includes(sessionId)
+      const wasArchived = isArchived(service, sessionId)
+      const wasPinned = isPinned(service, sessionId)
+      const changed = new Set()
       try {
-        const workspace = workspaceOf(snapshot)
-        if (workspace !== null && !workspace.sessionIds.includes(snapshot.sessionId)) {
-          try {
-            await workspace.insertSessionBefore(snapshot.sessionId, snapshot.nextSessionId ?? undefined)
-          } catch {
-            await workspace.attachSession(snapshot.sessionId)
-          }
+        if (workspace !== null && !wasAttached) {
+          await workspace.attachSession(sessionId)
+          changed.add('attached')
         }
-        if (snapshot.pinned) await service.pinSession(snapshot.sessionId)
-        if (snapshot.archived) {
-          await service.archiveSession(snapshot.sessionId, { stopActivity: true })
-        } else {
+        if (workspace !== null) await restorePosition(workspace, sessionId, snapshot.nextSessionId ?? null)
+        if (snapshot.pinned === true && !wasPinned) {
+          await service.pinSession(sessionId)
+          changed.add('pinned')
+        }
+        if (snapshot.archived === true) {
+          if (!wasArchived) {
+            await service.archiveSession(sessionId, { stopActivity: true })
+            changed.add('archived')
+          }
+        } else if (wasArchived) {
           // A soft delete archived the session; restoring an entry whose
-          // pre-delete state was NOT archived must undo that archive. The call
-          // is idempotent, so a hard-delete entry (never archived here) is a
-          // no-op.
-          await service.unarchiveSession(snapshot.sessionId)
+          // pre-delete state was NOT archived must undo that archive.
+          await service.unarchiveSession(sessionId)
+          changed.add('unarchived')
         }
         return async () => {
-          const current = workspaceOf(snapshot)
-          if (current !== null && current.sessionIds.includes(snapshot.sessionId)) {
-            await current.detachSession(snapshot.sessionId)
+          if (changed.has('unarchived')) {
+            await service.archiveSession(sessionId, { stopActivity: true }).catch(() => {})
+          }
+          if (changed.has('archived')) {
+            await service.unarchiveSession(sessionId).catch(() => {})
+          }
+          if (changed.has('pinned')) {
+            await service.unpinSession(sessionId).catch(() => {})
+          }
+          if (changed.has('attached')) {
+            const current = workspaceOf(snapshot)
+            if (current !== null && current.sessionIds.includes(sessionId)) {
+              await current.detachSession(sessionId).catch(() => {})
+            }
           }
-          if (snapshot.pinned) await service.unpinSession(snapshot.sessionId)
-          if (snapshot.archived) await service.unarchiveSession(snapshot.sessionId)
         }
       } catch (error) {
-        throw wrapCatalogError(error, 'restore', snapshot.sessionId)
+        throw wrapCatalogError(error, 'restore', sessionId)
       }
     },
   }

package/lib/host/gateway.js

@@ -15,6 +15,7 @@
  */
 import { findSessionDir, readJsonFile } from './paths.js'
 import { join } from 'node:path'
+import { isPathInside } from '../core/policy.js'
 
 const LIST_TTL_MS = 1_500
 const STATE_TTL_MS = 1_500
@@ -126,10 +127,21 @@ export function createSessionGateway({ ctx, paths, now = Date.now }) {
         if (!workspaceBySession.has(sessionId)) workspaceBySession.set(sessionId, { workspace, index })
       })
     }
+    // Ownership is also decided by cwd containment, exactly like `inspect`'s
+    // `workspaceFor` fallback: a session whose directory moved out of every
+    // registered workspace is an orphan, and `/sessions` must say so per row.
+    // Without this, `evaluateSessionPolicy` saw `workspace: undefined` on every
+    // list row and marked the whole batch picker non-deletable.
+    const workspaceByCwd = (cwd) => {
+      if (typeof cwd !== 'string' || cwd === '') return null
+      return workspaces.find((workspace) => isPathInside(workspace.path, cwd)) ?? null
+    }
     const titles = await readTitles()
     const state = await readWorkspaceState()
     listCache = items.map((item) => {
-      const owned = workspaceBySession.get(item.sessionId) ?? null
+      const member = workspaceBySession.get(item.sessionId) ?? null
+      const byCwd = member === null ? workspaceByCwd(item.cwd) : null
+      const owned = member ?? (byCwd === null ? null : { workspace: byCwd, index: -1 })
       const cached = titles.get(item.sessionId) ?? { title: '', blank: item.blank === true }
       return {
         id: String(item.sessionId),
@@ -145,7 +157,9 @@ export function createSessionGateway({ ctx, paths, now = Date.now }) {
         updatedAt: item.updatedAt ?? null,
         events: null,
         sizeBytes: null,
+        workspace: owned === null ? null : { id: owned.workspace.id, title: owned.workspace.title, path: owned.workspace.path, index: owned.index },
         workspaceId: owned?.workspace?.id ?? null,
+        workspacePath: owned?.workspace?.path ?? null,
         workspaceIndex: owned?.index ?? -1,
       }
     })
@@ -169,9 +183,9 @@ export function createSessionGateway({ ctx, paths, now = Date.now }) {
     if (byId !== undefined) return byId
     const byCwd = workspaces.find((workspace) => {
       if (typeof workspace.path !== 'string' || typeof session.cwd !== 'string') return false
-      const root = workspace.path.replace(/\\/g, '/').replace(/\/+$/g, '').toLowerCase()
-      const cwd = session.cwd.replace(/\\/g, '/').replace(/\/+$/g, '').toLowerCase()
-      return cwd === root || cwd.startsWith(`${root}/`)
+      // Shared path semantics: drive-letter paths compare case-insensitively,
+      // POSIX paths stay case-sensitive, and UNC roots are handled like Windows.
+      return isPathInside(workspace.path, session.cwd)
     })
     return byCwd ?? null
   }
@@ -182,7 +196,7 @@ export function createSessionGateway({ ctx, paths, now = Date.now }) {
 
     /** Normalize one session; throws E_NOT_FOUND-shaped data as `null`. */
     async inspect(sessionId) {
-      if (typeof sessionId !== 'string' || !/^[A-Za-z0-9_-]{6,80}$/.test(sessionId)) return null
+      if (typeof sessionId !== 'string' || !/^[A-Za-z0-9._-]{6,80}$/.test(sessionId)) return null
       const persistence = service('sessionPersistence')
       let snapshot
       if (persistence !== undefined && typeof persistence.stat === 'function') {

package/lib/host/paths.js

@@ -12,11 +12,22 @@
  */
 import { cp, mkdir, readdir, readFile, rename, rm, stat } from 'node:fs/promises'
 import { homedir } from 'node:os'
-import { dirname, join } from 'node:path'
+import { dirname, join, resolve } from 'node:path'
 
+/**
+ * Resolve the harness home exactly like `@deepseek-ai/dsh-home-paths`:
+ * explicit `$DSH_HOME` (with `~` expansion) wins over `~/.dsh`, and the result
+ * is absolute. A blank override counts as unset and must never resolve to the
+ * current working directory.
+ */
 export function resolveDshHome(env = process.env, home = homedir()) {
   const configured = typeof env.DSH_HOME === 'string' ? env.DSH_HOME.trim() : ''
-  return configured !== '' ? configured : join(home, '.dsh')
+  if (configured === '') return join(home, '.dsh')
+  if (configured === '~') return resolve(home)
+  if (configured.startsWith('~/') || configured.startsWith('~\\')) {
+    return resolve(join(home, configured.slice(2)))
+  }
+  return resolve(configured)
 }
 
 /**

package/lib/version.js

@@ -5,4 +5,4 @@
  * asserted against it by `test/manifest.test.mjs` so the two can never drift
  * (they did: the constant stayed at 0.1.0 while the package reached 0.1.4).
  */
-export const PLUGIN_VERSION = '0.2.0'
+export const PLUGIN_VERSION = '0.2.2'

package/package.json

@@ -1,7 +1,16 @@
 {
   "name": "dsh-conversation-recycle-bin",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "DSH conversation deletion with an optional, previewed cascade into conversation-associated memory: soft delete + recycle bin, audit trail, batch rate limits and per-session rollback. 删除对话（可选一并删除关联记忆）：软删除与回收站、审计留痕、批量限流、失败回滚。",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/HERO476/dsh-conversation-recycle-bin.git"
+  },
+  "homepage": "https://github.com/HERO476/dsh-conversation-recycle-bin#readme",
+  "bugs": {
+    "url": "https://github.com/HERO476/dsh-conversation-recycle-bin/issues"
+  },
+  "author": "HERO476",
   "type": "module",
   "main": "lib/index.js",
   "exports": {
@@ -9,7 +18,6 @@
     "./client": "./client.js",
     "./cordis.patch.yml": "./cordis.patch.yml",
     "./package.json": "./package.json",
-    "./locale/*.json": "./locale/*.json",
     "./icon": "./icon.svg"
   },
   "files": [
@@ -17,11 +25,11 @@
     "client.js",
     "cordis.patch.yml",
     "config.schema.json",
-    "locale/*.json",
     "icon.svg",
     "README.md",
     "INSTALL.md",
     "CHANGELOG.md",
+    "AUDIT-2026-10-17-desktop-web.md",
     "LICENSE"
   ],
   "engines": {

package/locale/en.json

@@ -1,63 +0,0 @@
-{
-  "meta": {
-    "title": "Delete Conversation",
-    "description": "Delete a conversation with an optional cascade into its associated memory. Soft delete and recycle bin, audit trail, batch rate limits, and per-session rollback."
-  },
-  "section": {
-    "label": "Conversation Deletion",
-    "title": "Conversation Deletion",
-    "subtitle": "Recycle bin, batch deletion and audit trail."
-  },
-  "action": {
-    "menuDelete": "Delete conversation…",
-    "headerDelete": "Delete…",
-    "delete": "Delete",
-    "cancel": "Cancel",
-    "close": "Close",
-    "restore": "Restore",
-    "purge": "Delete permanently",
-    "refresh": "Refresh",
-    "selectAll": "Select all"
-  },
-  "dialog": {
-    "titleOne": "Delete this conversation?",
-    "titleMany": "Delete {count} conversations?",
-    "bodyOne": "\u201c{title}\u201d will be removed from the session list.",
-    "bodyMany": "{count} conversations will be removed from the session list.",
-    "modeSoft": "Move to recycle bin (recommended)",
-    "modeSoftHint": "Files stay on disk and can be restored from the recycle bin.",
-    "modeHard": "Delete permanently",
-    "modeHardHint": "Moves the session log out of the live store. Recoverable until the recycle-bin entry is purged.",
-    "memoryLabel": "Also delete this conversation\u2019s associated memory",
-    "memoryHint": "Off by default. Memory entries are counted before you confirm.",
-    "memoryCount": "{count} associated memory entries will be moved to the recycle bin",
-    "memoryNone": "No associated memory entries were found",
-    "memoryUnsupported": "Memory store not available: {reason}",
-    "memoryProtected": "{count} protected entries are kept",
-    "messages": "{events} records · {size}",
-    "hardWarning": "Type DELETE to confirm permanent deletion.",
-    "batchWarning": "Type the number {count} to confirm this batch.",
-    "batchPhrase": "Batch size",
-    "working": "Deleting…",
-    "done": "Deleted {count} conversation(s).",
-    "partial": "Deleted {done}, failed {failed}.",
-    "memoryDeleted": "{count} memory entries moved to the recycle bin.",
-    "error": "Deletion failed: {message}"
-  },
-  "trash": {
-    "title": "Recycle bin",
-    "empty": "The recycle bin is empty.",
-    "deletedAt": "Deleted {time}",
-    "items": "{sessions} conversations, {memories} memory entries",
-    "restoreDone": "Restored.",
-    "purgeDone": "Permanently deleted.",
-    "confirmPurge": "Permanently delete this entry? This cannot be undone.",
-    "auditTitle": "Audit trail",
-    "auditEmpty": "No deletion has been recorded yet."
-  },
-  "batch": {
-    "title": "Batch deletion",
-    "hint": "Select conversations to delete. Deletion is per-conversation atomic; a failure rolls that conversation back.",
-    "selected": "{count} selected"
-  }
-}

package/locale/zh.json

@@ -1,63 +0,0 @@
-{
-  "meta": {
-    "title": "删除对话",
-    "description": "删除对话，并可选择一并删除该对话的关联记忆；支持软删除、回收站、审计留痕、批量限流与失败回滚。"
-  },
-  "section": {
-    "label": "对话删除",
-    "title": "对话删除",
-    "subtitle": "回收站、批量删除与审计留痕。"
-  },
-  "action": {
-    "menuDelete": "删除对话…",
-    "headerDelete": "删除…",
-    "delete": "删除",
-    "cancel": "取消",
-    "close": "关闭",
-    "restore": "恢复",
-    "purge": "彻底删除",
-    "refresh": "刷新",
-    "selectAll": "全选"
-  },
-  "dialog": {
-    "titleOne": "删除这个对话？",
-    "titleMany": "删除 {count} 个对话？",
-    "bodyOne": "「{title}」将从会话列表中移除。",
-    "bodyMany": "{count} 个对话将从会话列表中移除。",
-    "modeSoft": "移入回收站（推荐）",
-    "modeSoftHint": "文件仍保留在磁盘上，可从回收站恢复。",
-    "modeHard": "彻底删除",
-    "modeHardHint": "把会话日志移出活动存储；回收站条目被清理前仍可恢复。",
-    "memoryLabel": "同时删除该对话的关联记忆",
-    "memoryHint": "默认不勾选。确认前会实时统计受影响的记忆条数。",
-    "memoryCount": "将把 {count} 条关联记忆移入回收站",
-    "memoryNone": "未找到关联记忆",
-    "memoryUnsupported": "记忆存储不可用：{reason}",
-    "memoryProtected": "另有 {count} 条受保护记忆将保留",
-    "messages": "{events} 条记录 · {size}",
-    "hardWarning": "彻底删除需输入 DELETE 确认。",
-    "batchWarning": "批量删除需输入数字 {count} 确认。",
-    "batchPhrase": "批量数量",
-    "working": "正在删除…",
-    "done": "已删除 {count} 个对话。",
-    "partial": "成功 {done} 个，失败 {failed} 个。",
-    "memoryDeleted": "已移入回收站的记忆条目：{count} 条。",
-    "error": "删除失败：{message}"
-  },
-  "trash": {
-    "title": "回收站",
-    "empty": "回收站为空。",
-    "deletedAt": "删除于 {time}",
-    "items": "{sessions} 个对话、{memories} 条记忆",
-    "restoreDone": "已恢复。",
-    "purgeDone": "已彻底删除。",
-    "confirmPurge": "彻底删除该条目？此操作不可撤销。",
-    "auditTitle": "审计留痕",
-    "auditEmpty": "尚无删除记录。"
-  },
-  "batch": {
-    "title": "批量删除",
-    "hint": "勾选要删除的对话。每个对话独立事务，失败时仅回滚该对话。",
-    "selected": "已选 {count} 个"
-  }
-}