dsh-conversation-recycle-bin 0.3.13 → 0.3.14

package/CHANGELOG.md

@@ -3,6 +3,30 @@
 All notable changes to `dsh-conversation-recycle-bin` are documented here.
 The format follows Keep a Changelog; the project uses Semantic Versioning.
 
+## [0.3.14] — 2026-10-30
+
+第二轮独立审计（架构 / 安全 / 验收各跑 186 条、并做了变异测试与真实探针）之后的修复：一条会**删掉唯一副本**的读盘失败被当成「空目录」，一条会把用户**刚恢复的对话**再删一次，还有一类条目**三条出路全拒**却仍在 UI 上提供「恢复」按钮。
+
+### Fixed
+
+- **`hasFiles()` 不再把「读不到」当成「没有文件」**（`lib/host/api.js`）：`catch { return false }` 让 Windows 的 EPERM/EBUSY 读失败等价于「空目录」，`canDiscard` 因此为 true，丢弃该条目会连同唯一的 `memory/` bundle 一起删除。现在只有 `ENOENT`/`ENOTDIR` 才算空，其它错误抛出；`entryDisk()` 捕获后按 **「可能有文件」** 上报，`performDiscard()` 的 `hasFiles` 失败同样按「有文件」拒绝。
+- **保留期清扫不再删除用户刚恢复的会话**（`lib/core/cascade.js`、`lib/host/api.js`）：`performPurge` 的 soft 分支只看 `session.live`，不看 `archived`；用户 unarchive 之后，1.5s 的 gateway 缓存窗口内执行清扫会 quiesce 并硬删这个**正在使用的**会话。现在 purge 先判 `archived === false` 并抛 `E_SESSION_ALIVE`（409，新增码），清扫在拿锁后先 `gateway.invalidate()` 再 inspect，被跳过的条目按 6 小时退避，不再每轮刷一次失败。
+- **purge 的状态写入挪到判定之后**：`inspect()` 曾放在 `trash.update(status:'purging')` 之后且不在 try 内，一次 inspect 异常就把条目永久留在 `purging`（既不可恢复也不再被保留期清扫）。
+- **头不可读的日志条目现在有出路**：日志在盘上但读不出 `cwd`（截断、编码不对、缺少 header）时，条目永远到不了终态，而「恢复」会答"没有可恢复的内容"、"丢弃"又说"还持有日志"、purge 因状态不可达 —— 三条路全拒，磁盘空间占着。现在：`entryCapabilities()` 接受 `payloadRecoverable: false`，`canRestore` 为 false、`canDiscard` 为 true；`performRestore` 明确报「日志读不出，请丢弃」；`performDiscard` 在重建路径失败时允许删除（仍要求输入确认短语）。
+- **`ops.hasFiles` 的 `readdir` 结果只在目录存在时解释**，未捕获的非 ENOENT 错误不再被静默吞掉。
+
+### Changed
+
+- **`engines.node` 从 `>=20` 提高到 `>=22.15`**：代码用到 22.x 的 `readdir(..., { recursive: true })` 与 `AbortSignal` 行为，而 `>=20` 让 DSH 在 Node 20 上安装本插件后必然崩。
+- 测试夹具 `makeTempHome()` 先 `mkdir test/.tmp`：干净检出上 `mkdtemp` 会 ENOENT，之前能过只是因为某个套件恰好先跑并顺手建了目录（干净树实测 160 pass / 26 fail）。
+
+### Tests
+
+- 新增 `session log stage: the mapping is persisted before the directory moves`（真实 `moveToTrash` + 真实文件系统，断言 `beforeMove` 时源目录仍在、目标尚不存在）。把 `catalog.js` 里 `moveDirectory` 与 `beforeMove` 调换后该用例失败——此前这处变异**全套 186 条仍绿**。
+- 新增 `unrecoverable log: not restorable, and discard is the way out`（真实目录 + 头不可读 → `canRestore:false`、`canDiscard:true`、restore 报错文案、discard 成功）。
+- `trash: a corrupt manifest is surfaced as unreadable and discardable once empty` 更新为符合新语义，并补一条「manifest 损坏但 `memory/` 有文件 → 仍拒绝丢弃」。
+- 测试 186 → **188**；干净树（先删 `test/.tmp`）`node --test test/*.test.mjs` 全绿，不再依赖套件执行顺序。
+
 ## [0.3.13] — 2026-10-29
 
 2026-10-29 桌面端 / 网页端 bug 复核报告（`AUDIT-2026-10-29-desktop-web.md`）中的 4 条功能缺陷与 1 条文档偏差，本版全部修掉。

package/README.md

@@ -2,7 +2,8 @@
 
 给 DeepSeek Harness (DSH) Web 增加「删除对话」：会话列表的「…」菜单与会话详情页头部各有一个删除入口；确认框内可勾选「同时删除关联记忆」（默认不勾选），并实时显示将被影响的记忆条数。删除默认进入插件回收站，可恢复；每次操作写入审计日志；批量删除有上限与限流，批量软删除需输入数量，彻底删除一键执行；事务任一步失败即回滚。
 
-> 状态：`0.3.13`，Host + Web Client 双半，零构建（plain JS ESM），只依赖宿主已发布的公开扩展点。
+> 状态：`0.3.14`，Host + Web Client 双半，零构建（plain JS ESM），只依赖宿主已发布的公开扩展点。
+> 运行要求：**Node.js ≥ 22.15**（Host 侧用到 `readdir(..., { recursive: true })`、`AbortSignal` 等 22.x 行为），DSH ≥ `0.2.1-rc.2`（`package.json` 的 `engines` 已如实声明，DSH 安装校验会据此拒绝更低版本）。
 > 包名：`dsh-conversation-recycle-bin`（原 `dsh-delete-conversation` 因 npm 被他人占用而改名，见 CHANGELOG 0.2.0）。
 > 本 README 同时是设计说明与验收依据；安装/回滚步骤见 [INSTALL.md](INSTALL.md)；变更见 [CHANGELOG.md](CHANGELOG.md)。
 
@@ -206,7 +207,7 @@ dsh-conversation-recycle-bin/
 │     ├─ memory.js               # 适配器装配
 │     ├─ feedback.js             # 反馈校验/渲染/投递（http 或 smtp，凭证只读环境变量）
 │     └─ api.js                 # 同源 HTTP API、确认 token、限流
-└─ test/                        # 186 个用例，覆盖用户要求的 5 类场景 + live 删除 + 记忆锁 + 原地刷新 + 部分失败/跨进程/未完成条目 + 反馈通道 + Client 半渲染冒烟
+└─ test/                        # 188 个用例，覆盖用户要求的 5 类场景 + live 删除 + 记忆锁 + 原地刷新 + 部分失败/跨进程/未完成条目 + 反馈通道 + Client 半渲染冒烟
 ```
 
 ---

package/lib/core/cascade.js

@@ -288,15 +288,21 @@ const PURGEABLE_STATUSES = new Set(['trashed', 'restored'])
  * the caller, which is the only side that can stat the entry directory.
  *
  * @param {{ status?: unknown }} entry
- * @param {{ hasLogFiles?: boolean|null, hasMemoryFiles?: boolean|null, requirePayload?: boolean }} [disk]
+ * @param {{ hasLogFiles?: boolean|null, hasMemoryFiles?: boolean|null, payloadRecoverable?: boolean|null, requirePayload?: boolean }} [disk]
  *   `requirePayload` makes `canRestore` false for entry states that have no
  *   payload at all (nothing in the manifest and nothing on disk), which is the
  *   answer the list endpoint publishes to the Client.
+ *   `payloadRecoverable === false` means the log copy is on disk but its header
+ *   cannot be read: restore has no path to put it back to, so the only action
+ *   that can reclaim the space is discard.
  */
 export function entryCapabilities(entry, disk = {}) {
   const status = typeof entry?.status === 'string' && entry.status !== '' ? entry.status : 'unknown'
   const hasLogFiles = disk.hasLogFiles ?? null
   const hasMemoryFiles = disk.hasMemoryFiles ?? null
+  // Unreadable log ≠ restorable log. Offering restore here produced a button
+  // that always failed with "discard it", while discard itself refused.
+  const unrecoverable = disk.payloadRecoverable === false
   const hasSessionLog = entry?.sessionLog !== null && entry?.sessionLog !== undefined
   const hasCatalog = entry?.catalog !== null && entry?.catalog !== undefined
   const memoryTotal = typeof entry?.memory?.total === 'number' ? entry.memory.total : 0
@@ -307,12 +313,14 @@ export function entryCapabilities(entry, disk = {}) {
   const hasPayload = hasSessionLog || hasCatalog || memoryTotal > 0 || hasLogFiles === true || hasMemoryFiles === true
   return {
     status,
-    canRestore: RESTORABLE_STATUSES.has(status) && (disk.requirePayload !== true || hasPayload),
+    canRestore: RESTORABLE_STATUSES.has(status) && !unrecoverable && (disk.requirePayload !== true || hasPayload),
     canPurge: PURGEABLE_STATUSES.has(status),
     // Discard is the escape hatch for entries that never committed: it is
     // refused while a payload copy still exists, because deleting the folder
-    // would destroy the only copy of a log or a memory bundle.
-    canDiscard: status !== 'trashed' && hasLogFiles !== true && hasMemoryFiles !== true,
+    // would destroy the only copy of a log or a memory bundle. The one
+    // exception is a log whose header cannot be read — nothing can use it any
+    // more, so discarding is the only way to get the disk space back.
+    canDiscard: status !== 'trashed' && hasMemoryFiles !== true && (unrecoverable || hasLogFiles !== true),
   }
 }
 
@@ -349,6 +357,19 @@ export async function performRestore({ entry, ops, trash, audit, now = Date.now,
   if (sessionLog === null && typeof ops.recoverSessionLog === 'function') {
     sessionLog = await ops.recoverSessionLog(entry).catch(() => null)
   }
+  // If the log copy is on disk but its header cannot be read (truncated, wrong
+  // codec, missing `cwd`), there is no path to put it back to and no state it
+  // can ever reach. Say that plainly instead of "nothing left to restore",
+  // which sent the user to a discard that then refused to run.
+  if (sessionLog === null && typeof ops.pathExists === 'function' && typeof trash?.entryDir === 'function') {
+    const dir = trash.entryDir(entry.trashId)
+    if (typeof dir === 'string' && await ops.pathExists(join(dir, 'session')).catch(() => false)) {
+      throw new DeleteError('E_TRASH_CONFLICT', 'The conversation log in this recycle-bin entry cannot be read, so it cannot be restored. Discard the entry to reclaim the space.', {
+        trashId: entry.trashId,
+        reason: 'log-unreadable',
+      })
+    }
+  }
   const catalog = entry.catalog !== null && entry.catalog !== undefined && typeof entry.catalog === 'object' ? entry.catalog : null
   let memorySummary = entry.memory !== null && entry.memory !== undefined && typeof entry.memory === 'object' ? entry.memory : null
   let hasMemory = entry.includeMemory === true && memorySummary !== null && (memorySummary.total ?? 0) > 0
@@ -519,11 +540,35 @@ export async function performPurge({ entry, ops, trash, audit, now = Date.now, a
     throw new DeleteError('E_TRASH_CONFLICT', 'This recycle-bin entry cannot be purged in its current state.', { trashId: entry.trashId, status: entry.status })
   }
   const startedAt = now()
+  // Both checks happen BEFORE the status moves to `purging`: doing them after
+  // the write left a thrown refusal with the entry stuck in a state that
+  // neither restore nor the retention sweep will ever pick up again.
+  let softSession = null
+  if (entry.mode === 'soft' && typeof ops.session?.inspect === 'function') {
+    try {
+      softSession = await ops.session.inspect(entry.sessionId)
+    } catch (error) {
+      throw new DeleteError('E_INTERNAL', 'Could not tell whether the conversation is still visible, so the entry was not purged.', {
+        trashId: entry.trashId,
+        sessionId: entry.sessionId,
+        cause: error instanceof Error ? error.message : String(error),
+      }, { cause: error })
+    }
+    // A soft-deleted entry archived its session. If the user brought it back,
+    // the conversation is visible and usable again; purging would stop it and
+    // delete it a second time, which is the opposite of what restore promised.
+    if (softSession !== null && softSession.archived === false) {
+      throw new DeleteError('E_SESSION_ALIVE', 'This conversation is visible in the Host again, so it was not purged. Archive it first if you really want it gone.', {
+        trashId: entry.trashId,
+        sessionId: entry.sessionId,
+      })
+    }
+  }
   await trash.update(entry.trashId, { status: 'purging' })
   const steps = []
 
   if (entry.mode === 'soft') {
-    const session = await ops.session.inspect(entry.sessionId)
+    const session = softSession
     if (session !== null) {
       if (session.live === true) {
         steps.push({
@@ -644,16 +689,35 @@ export async function performDiscard({ entry, ops, trash, audit, now = Date.now,
   const holdsLog = typeof ops.pathExists === 'function'
     ? await ops.pathExists(join(entryDir, 'session'))
     : entry.sessionLog !== null && entry.sessionLog !== undefined
-  if (holdsLog) {
+  // A log with no recorded location is normally restorable (the header carries
+  // the cwd). When the header is unreadable there is no such path: the log can
+  // never go back, so discard is the only way to reclaim the folder — refusing
+  // it left the entry stuck in `pending` forever.
+  let logUnrecoverable = false
+  if (holdsLog === true && (entry.sessionLog === null || entry.sessionLog === undefined) && typeof ops.recoverSessionLog === 'function') {
+    logUnrecoverable = (await ops.recoverSessionLog(entry).catch(() => null)) === null
+  }
+  if (holdsLog === true && !logUnrecoverable) {
     throw new DeleteError('E_TRASH_CONFLICT', 'This incomplete entry still holds the conversation log; restore or purge it instead of discarding it.', {
       trashId: entry.trashId,
       status: entry.status,
     })
   }
-  const holdsMemory = typeof ops.hasFiles === 'function' ? await ops.hasFiles(join(entryDir, 'memory')) : false
+  // An unreadable memory folder must count as "holds files": the old `false`
+  // default let discard delete the only copy of a bundle it never looked at.
+  let holdsMemory = false
+  if (typeof ops.hasFiles === 'function') {
+    holdsMemory = await ops.hasFiles(join(entryDir, 'memory')).catch(() => true)
+  } else {
+    holdsMemory = entry.includeMemory === true && (entry.memory?.total ?? 0) > 0
+  }
   // The status half of the decision is shared with the UI; the two refusals
   // below stay separate because their advice differs (purge vs restore).
-  const capabilities = entryCapabilities(entry, { hasLogFiles: holdsLog, hasMemoryFiles: holdsMemory })
+  const capabilities = entryCapabilities(entry, {
+    hasLogFiles: holdsLog === true && !logUnrecoverable,
+    hasMemoryFiles: holdsMemory,
+    payloadRecoverable: logUnrecoverable ? false : null,
+  })
   if (holdsMemory || !capabilities.canDiscard) {
     const which = holdsMemory ? 'memory files' : 'payload'
     throw new DeleteError('E_TRASH_CONFLICT', `This incomplete entry still holds ${which}; restore or purge it instead of discarding it.`, {

package/lib/core/errors.js

@@ -37,6 +37,9 @@ export const ERROR_STATUS = Object.freeze({
   // know before it retries or refreshes.
   E_QUEUE_TIMEOUT: 503,
   E_ABANDONED: 409,
+  // A soft-deleted conversation the user brought back: purging it would delete
+  // a live conversation a second time.
+  E_SESSION_ALIVE: 409,
   // Feedback channel: its own codes, so the Client can distinguish "this Host
   // has no mail transport" from "the transport refused the message".
   E_FEEDBACK_DISABLED: 503,

package/lib/host/api.js

@@ -405,12 +405,23 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
         return false
       }
     },
+    /**
+     * Whether a directory holds anything at all. This used to swallow every
+     * error and answer `false`, which made "I cannot read it" indistinguishable
+     * from "it is empty": a Windows EPERM/EBUSY on the memory folder then read
+     * as "no memory here", and discarding that entry deleted the one remaining
+     * copy of the bundle. Callers now decide what an unreadable directory
+     * means; they all treat it as "may hold files".
+     */
     hasFiles: async (target) => {
       try {
         const entries = await readdir(target, { recursive: true })
         return entries.length > 0
-      } catch {
-        return false
+      } catch (error) {
+        // "Not there" really does mean "nothing to delete"; anything else means
+        // we could not look, and that must not be reported as empty.
+        if (error?.code === 'ENOENT' || error?.code === 'ENOTDIR') return false
+        throw error
       }
     },
     /**
@@ -1031,18 +1042,34 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
   }
 
   /** Disk payload of one entry, for the capability flags the Client renders. */
-  async function entryDisk(trashId) {
-    if (!isTrashId(trashId)) return { hasLogFiles: false, hasMemoryFiles: false }
+  async function entryDisk(trashId, entry = null) {
+    if (!isTrashId(trashId)) return { hasLogFiles: false, hasMemoryFiles: false, payloadRecoverable: null }
     let dir
     try {
       dir = trash.entryDir(trashId)
     } catch {
-      return { hasLogFiles: false, hasMemoryFiles: false }
+      return { hasLogFiles: false, hasMemoryFiles: false, payloadRecoverable: null }
     }
-    return {
-      hasLogFiles: await ops.pathExists(join(dir, 'session')),
-      hasMemoryFiles: await ops.hasFiles(join(dir, 'memory')),
+    const hasLogFiles = await ops.pathExists(join(dir, 'session'))
+    let hasMemoryFiles
+    try {
+      hasMemoryFiles = await ops.hasFiles(join(dir, 'memory'))
+    } catch (error) {
+      // Unreadable is not empty: report the folder as holding files so no
+      // capability flag offers an action that would delete them unseen.
+      logger.warn?.(`[conversation-recycle-bin] could not read the memory folder of ${trashId}: ${error?.message ?? error}`)
+      hasMemoryFiles = true
+    }
+    // A log that is on disk but whose header cannot be read is a dead end: not
+    // restorable (there is no path to put it back to) and not purgeable (the
+    // status never commits). Only "discard" can reclaim that space, so the flag
+    // must say so instead of advertising a restore that always fails.
+    let payloadRecoverable = null
+    if (hasLogFiles === true && entry !== null && (entry.sessionLog === null || entry.sessionLog === undefined)) {
+      const rebuilt = await ops.recoverSessionLog(entry).catch(() => null)
+      payloadRecoverable = rebuilt !== null
     }
+    return { hasLogFiles, hasMemoryFiles, payloadRecoverable }
   }
 
   async function serializeEntry(entry) {
@@ -1052,7 +1079,7 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     // countdown is therefore decided here, once, by the same predicate the sweep
     // uses (`daysUntilExpiry`), and `expiresAt` carries the absolute deadline.
     const daysLeft = daysUntilExpiry(entry, { retentionDays, now: now() })
-    const disk = await entryDisk(entry.trashId)
+    const disk = await entryDisk(entry.trashId, entry)
     return {
       trashId: entry.trashId,
       sessionId: entry.sessionId,
@@ -1172,6 +1199,10 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
       return serialize(async () => {
         const purged = []
         const failed = []
+        // The janitor must decide from freshly read state: the gateway caches
+        // `archived` for 1.5s, and a user who unarchives a conversation inside
+        // that window would be judged "still archived" and have it purged.
+        gateway.invalidate()
         for (const candidate of expired) {
           const entry = await trash.read(candidate.trashId)
           if (entry === null || !entryCapabilities(entry).canPurge) continue
@@ -1198,6 +1229,9 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
               const running = session.running === true || session.live === true || session.unreadable === true
               if (revived || running || session.archived !== true) {
                 failed.push({ trashId: candidate.trashId, code: 'E_SESSION_ALIVE' })
+                // Re-check in hours, not in the next five minutes: a revived
+                // conversation is a human decision, not a race to win.
+                retentionRetries.set(candidate.trashId, { failures: 1, nextAt: now() + RETENTION_RETRY_MAX_MS })
                 continue
               }
             }

package/lib/version.js

@@ -5,4 +5,4 @@
  * asserted against it by `test/manifest.test.mjs` so the two can never drift
  * (they did: the constant stayed at 0.1.0 while the package reached 0.1.4).
  */
-export const PLUGIN_VERSION = '0.3.13'
+export const PLUGIN_VERSION = '0.3.14'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-conversation-recycle-bin",
-  "version": "0.3.13",
+  "version": "0.3.14",
   "description": "DSH conversation deletion with an optional, previewed cascade into conversation-associated memory: soft delete + recycle bin, audit trail, batch rate limits and per-session rollback. 删除对话（可选一并删除关联记忆）：软删除与回收站、审计留痕、批量限流、失败回滚。",
   "repository": {
     "type": "git",
@@ -33,7 +33,7 @@
     "LICENSE"
   ],
   "engines": {
-    "node": ">=20",
+    "node": ">=22.15",
     "dsh": ">=0.2.1-rc.2"
   },
   "optionalDependencies": {