dsh-conversation-recycle-bin 0.3.14 → 0.3.15

package/CHANGELOG.md

@@ -3,6 +3,28 @@
 All notable changes to `dsh-conversation-recycle-bin` are documented here.
 The format follows Keep a Changelog; the project uses Semantic Versioning.
 
+## [0.3.15] — 2026-10-31
+
+dsh-go（Android）适配性审计后的修复。审计结论：Host 半边开箱可用（手机里跑的是真 Node 24 + 原版 DSH 引擎），问题全在**前端座位**与**移动端输入**上。
+
+### Fixed
+
+- **原生界面里删除按钮全都没有反应**（dsh-go 侧 `shell.overlay` 是 opt-in 座位，确认框宿主不挂载）：新增 `useInlineDialogState()`，检测到 overlay 宿主没有挂载时，把**同一个确认框内联**渲染在设置页「批量删除」标签页里。桌面端/网页端有座位时行为不变（`overlaySeatMounted` 标记 + 500ms 宽限，避免闪一下内联副本）。
+- **`DELETE` 短语在手机上永远对不上**：Android 输入法会把首字母大写，`purgePhrase.trim() !== 'DELETE'` 于是让按钮永久灰掉、没有任何提示。现在 Client 的 `phraseMatches()` 与 Host 的 `deletePlan`/`purgeEntry`/`discardEntry` 三处比对都**忽略大小写并去空格**；三个输入框补 `autoCapitalize`/`autoCorrect`/`spellCheck`（计数短语用 `inputMode: 'numeric'`）。
+- **非 JSON 拒绝被报成「无法解析的响应」**：dsh-go 的 `route-guard.diff` 在插件路由之前返回 `text/plain` 401/503。新增 `httpFallbackError(response)`，按状态码映射成 `E_UNAUTHORIZED`/`E_DISABLED`/`E_BAD_RESPONSE`，并在响应头带 `x-dsh-go-guard: reject` 时把原因写进文案（"dsh-go route guard"）。
+- **`E_LOCK_BUSY` 是死胡同**：错误信息补上锁文件路径与"持续出现就删掉它"的指引，`details.lockPath` 一并返回（手机被杀进程后残留锁最长阻塞 20 分钟，用户此前没有任何自救手段）。
+
+### Changed
+
+- 回收站横幅文案补充「清理只在 Host 运行时发生」：App 关闭期间清扫不执行，下次启动补扫。
+- README 新增 §8.1「dsh-go（Android）适配」：网页模式/原生界面的差异、opt-in 座位导致的降级路径、市场默认隐藏 web-only 插件需点「显示网页版插件」、DSH Remote 无网页版。
+
+### Tests
+
+- `test/client-module.test.mjs`（25 → 28）：短语忽略大小写与空期望值；非 JSON 拒绝按状态码映射（含 `x-dsh-go-guard` 分支）；**没有 overlay 座位时设置页把同一个确认框内联渲染**（无 payload 时不渲染空壳，有 payload 时挂上真正的 `DeleteDialog` 并给出原因提示）。
+- `test/api.test.mjs`（63 → 64）：`DELETE` 短语大小写不敏感（`Delete me` 仍 400 `E_CONFIRM_PHRASE`，`delete` 通过）。
+- 合计 188 → **192**（干净树 `rm -rf test/.tmp` 后全绿）。
+
 ## [0.3.14] — 2026-10-30
 
 第二轮独立审计（架构 / 安全 / 验收各跑 186 条、并做了变异测试与真实探针）之后的修复：一条会**删掉唯一副本**的读盘失败被当成「空目录」，一条会把用户**刚恢复的对话**再删一次，还有一类条目**三条出路全拒**却仍在 UI 上提供「恢复」按钮。

package/README.md

@@ -247,6 +247,28 @@ npm run check   # 语法 + manifest
 
 ---
 
+## 8.1 dsh-go（Android）适配
+
+[dsh-go](https://github.com/ccch1mneyyy/dsh-Go) 的 App 里跑的是**真正的 Node 24 + 原版 DSH 引擎**（PRoot 内 Ubuntu），所以 Host 半边零改动即可运行：`engines.node >= 22.15`、`engines.dsh >= 0.2.1-rc.2` 双向满足，`market/policy.json` 也不拦第三方包。差异全在**前端座位**上：
+
+| 界面 | 结果 |
+|---|---|
+| **网页模式**（App 内 DSH 网页版 / SSH 主机） | 完整可用，四个槽位都在 |
+| **原生界面** | 插件能装、设置页有整页岛（回收站可看、可恢复、可彻底清除）；会话行菜单与顶栏入口**没有座位**，因此删除走设置页「批量删除」标签页 |
+
+原生界面里 `shell.overlay` 是 opt-in 座位（`slot_catalog.dart` 的 `SeatPolicy.p2Overlay`），确认框的宿主因此不会挂载。0.3.15 起做了两件事：
+
+1. **降级渲染**：检测到 overlay 宿主没有挂载时，设置页把**同一个确认框内联**渲染在「批量删除」标签页里（`client.js` 的 `useInlineDialogState`），不再出现"点了删除没反应"。
+2. **移动端输入**：短语输入框加 `autoCapitalize/autoCorrect/spellCheck`，并且 Host 与 Client 的短语比对都改成**忽略大小写**（Android 输入法会把 `DELETE` 写成 `Delete`）。
+
+另外两件与手机有关的事，写在文档里而不是藏起来：
+
+- **市场默认隐藏 web-only 插件**：安装前要在插件市场点一次「显示网页版插件」。
+- **保留期清理只在 Host 运行时发生**：`trashRetentionDays`（默认 30 天）的清扫由宿主进程驱动，App 被杀掉期间不会执行，下次启动时补扫；`0` 关闭。
+- **DSH Remote（远程桥）没有网页版**，因此插件在那里没有 UI；SSH 主机可以用网页模式。
+
+---
+
 ## 9. 反馈通道（设置页「反馈」按钮）
 
 设置页**最上方**新增一条「反馈」横幅（主色按钮，位于标题之上）：把问题或建议写成一条消息，由**宿主进程**通过邮件发到维护者邮箱。凭证只在宿主侧读取，页面拿不到、也发不出任何邮件。

package/client.js

@@ -112,7 +112,7 @@ window.__ModuleLoader__.load({
         'trash.title': 'Recycle bin',
         'trash.empty': 'The recycle bin is empty.',
         'trash.deletedAt': 'Deleted {time}',
-        'trash.retention': 'Entries are purged automatically {days} days after deletion. Set trashRetentionDays to 0 to keep them until you purge them yourself.',
+        'trash.retention': 'Entries are purged automatically {days} days after deletion, but only while the Host is running (a phone with the app closed simply sweeps on the next launch). Set trashRetentionDays to 0 to keep them until you purge them yourself.',
         'trash.expiresIn': 'auto-purged in {days} d',
         'trash.expiresSoon': 'auto-purged on the next check',
         'trash.swept': 'The Host cleaned up {count} expired entries in the background.',
@@ -219,6 +219,7 @@ window.__ModuleLoader__.load({
         'error.E_QUEUE_TIMEOUT': 'The Host was still busy with another change, so this request was not applied. Retry in a moment.',
         'error.E_ABANDONED': 'The page gave up waiting before the Host started; nothing was changed. Retry.',
         'error.E_UNAUTHORIZED': 'This request is not authenticated with the Host.',
+        'dialog.inlineHint': 'This window has no overlay slot (dsh-go native UI), so the confirmation is shown here instead of in a popup.',
         'adapter.lingshu': 'Lingshu cognitive graph (md_cg)',
         'adapter.generic-json': 'Generic JSON memory store',
         'adapter.none': 'No memory store',
@@ -274,7 +275,7 @@ window.__ModuleLoader__.load({
         'trash.title': '回收站',
         'trash.empty': '回收站为空。',
         'trash.deletedAt': '删除于 {time}',
-        'trash.retention': '条目在删除 {days} 天后自动清理。把 trashRetentionDays 设为 0 可改为一直保留、由你自己彻底删除。',
+        'trash.retention': '条目在删除 {days} 天后自动清理，但清理只在 Host 运行时发生（手机 App 关闭期间不会执行，下次启动时补扫）。把 trashRetentionDays 设为 0 可改为一直保留、由你自己彻底删除。',
         'trash.expiresIn': '{days} 天后自动清理',
         'trash.expiresSoon': '下次检查时自动清理',
         'trash.swept': 'Host 已在后台自动清理 {count} 条过期条目。',
@@ -381,6 +382,7 @@ window.__ModuleLoader__.load({
         'error.E_QUEUE_TIMEOUT': '宿主还在处理另一个变更，这次请求没有执行，请稍后重试。',
         'error.E_ABANDONED': '页面在宿主开始处理前就放弃了等待，本次没有做任何改动，请重试。',
         'error.E_UNAUTHORIZED': '该请求未通过宿主的鉴权。',
+        'dialog.inlineHint': '当前窗口没有 overlay 槽位（dsh-go 原生界面），确认框直接显示在这里。',
         'adapter.lingshu': '灵枢认知图 (md_cg)',
         'adapter.generic-json': '通用 JSON 记忆存储',
         'adapter.none': '无记忆存储',
@@ -552,6 +554,48 @@ window.__ModuleLoader__.load({
       return new URL(`${API_PREFIX.replace(/^\//, '')}${path}`, base)
     }
 
+    /**
+     * Does the typed phrase match what the Host asked for?
+     *
+     * Trimmed and case-insensitive on purpose: Android soft keyboards capitalise
+     * the first letter of a word, so `Delete` reached a check that only accepted
+     * `DELETE` and the confirm button stayed disabled with no explanation. The
+     * phrase exists to make the user think, not to test their keyboard.
+     */
+    function phraseMatches(input, expected) {
+      const want = String(expected ?? '').trim()
+      if (want === '') return true
+      return String(input ?? '').trim().toUpperCase() === want.toUpperCase()
+    }
+
+    /**
+     * Explain a refusal that never reached the plugin route.
+     *
+     * The dsh-go Host guard (and any reverse proxy in front of DSH) answers with
+     * `text/plain`, so `response.json()` threw and the panel showed "unreadable
+     * response" where the real answer was "not authenticated".
+     */
+    function httpFallbackError(response) {
+      const status = Number(response?.status)
+      let guarded = false
+      try {
+        guarded = response?.headers?.get?.('x-dsh-go-guard') === 'reject'
+      } catch {
+        guarded = false
+      }
+      if (status === 401 || status === 403) {
+        return new ApiError('E_UNAUTHORIZED', guarded
+          ? 'The Host rejected this request before the plugin saw it (dsh-go route guard): the page is not authenticated.'
+          : 'This request is not authenticated with the Host.', { status })
+      }
+      if (status === 503) {
+        return new ApiError('E_DISABLED', guarded
+          ? 'The Host route guard has no connection service yet; retry once the app has finished starting.'
+          : 'The plugin is disabled, or the Host is not ready yet.', { status })
+      }
+      return new ApiError('E_BAD_RESPONSE', `The Host answered ${Number.isFinite(status) ? status : 'an unexpected status'} without a JSON body.`, { status })
+    }
+
     async function api(path, options = {}) {
       const method = options.method ?? 'GET'
       const timeoutMs = Number.isFinite(options.timeoutMs) ? options.timeoutMs : REQUEST_TIMEOUT_MS
@@ -575,7 +619,9 @@ window.__ModuleLoader__.load({
           payload = null
         }
         if (payload === null || typeof payload !== 'object') {
-          throw new ApiError('E_BAD_RESPONSE', 'The Host returned an unreadable response.')
+          // A refusal that never reached the plugin route (Host route guard,
+          // reverse proxy, HTML error page) still has a status worth explaining.
+          throw httpFallbackError(response)
         }
         // A batch that partially succeeded is a RESULT, not a refusal: an older
         // Host marked it `ok:false` without an `error`, which made the Client
@@ -644,6 +690,38 @@ window.__ModuleLoader__.load({
       return state
     }
 
+    /**
+     * Whether the `shell.overlay` slot actually gave us a seat.
+     *
+     * On DSH for desktop/web it always does. On dsh-go's native UI the overlay
+     * seat is opt-in (`SeatPolicy.p2Overlay`, `optIn: true` in
+     * `slot_catalog.dart`), so the host component never mounts — and with it the
+     * only confirmation dialog the delete flow had. Settings still gets a page
+     * island, so the panel can render that same dialog inline instead of
+     * pretending the button did nothing.
+     */
+    let overlaySeatMounted = false
+
+    function useOverlaySeatPresent() {
+      const [present, setPresent] = useState(overlaySeatMounted === true)
+      useEffect(() => {
+        // The overlay host mounts after the slot service resolves; a single
+        // frame of grace avoids flashing the inline copy on hosts that do have
+        // a seat.
+        const timer = setTimeout(() => setPresent(overlaySeatMounted === true), 500)
+        return () => clearTimeout(timer)
+      }, [])
+      return present
+    }
+
+    function useInlineDialogState() {
+      const payload = useDialogState()
+      const overlayPresent = useOverlaySeatPresent()
+      if (overlayPresent || payload === null) return null
+      // Feedback has no delete semantics and lives in its own tab.
+      return payload.kind === 'feedback' ? null : payload
+    }
+
     /**
      * Notification channel for "a mutation changed the session list". The
      * dialog refreshes the shell, but the Settings section owns a second copy
@@ -1090,7 +1168,7 @@ window.__ModuleLoader__.load({
       const blocked = Array.isArray(preview?.blocked) ? preview.blocked : []
       const confirmation = preview?.confirmation ?? null
       const expectedPhrase = confirmation?.phrase ?? ''
-      const phraseOk = expectedPhrase === '' || phrase.trim() === expectedPhrase
+      const phraseOk = phraseMatches(phrase, expectedPhrase)
       const memory = preview?.memory ?? null
       const memorySupported = memory !== null && memory.enabled === true
         && Array.isArray(memory.adapters) && memory.adapters.some((adapter) => adapter.available === true)
@@ -1267,6 +1345,12 @@ window.__ModuleLoader__.load({
                 disabled: busy,
                 autoFocus: true,
                 className: 'dc-input',
+                // The phrase is a count on a phone: no autocorrect, no
+                // sentence capitalisation, digits where digits are expected.
+                inputMode: 'numeric',
+                autoCorrect: 'off',
+                autoCapitalize: 'off',
+                spellCheck: false,
               }))
             : null,
 
@@ -1480,6 +1564,12 @@ window.__ModuleLoader__.load({
     function DialogHost() {
       const payload = useDialogState()
       const flash = useFlashMessage()
+      useEffect(() => {
+        overlaySeatMounted = true
+        return () => {
+          overlaySeatMounted = false
+        }
+      }, [])
       // `kind` is optional: every pre-0.2.2 caller opens a delete dialog, so a
       // payload without a kind keeps its old meaning.
       const dialog = payload === null
@@ -1595,10 +1685,16 @@ window.__ModuleLoader__.load({
                       placeholder: 'DELETE',
                       className: 'dc-input dc-input-small',
                       onChange: (event) => onPhrase(event.target.value),
+                      // Without this Android capitalises the first letter and
+                      // writes `Delete`; the guard above is case-insensitive now,
+                      // but the keyboard should stop guessing anyway.
+                      autoCapitalize: 'characters',
+                      autoCorrect: 'off',
+                      spellCheck: false,
                     }),
                     h(Button, {
                       variant: 'danger',
-                      disabled: discardBusyId === entry.trashId || discardPhrase.trim() !== 'DELETE',
+                      disabled: discardBusyId === entry.trashId || phraseMatches(discardPhrase, 'DELETE') !== true,
                       onClick: () => onDiscard(entry.trashId),
                     }, t('trash.discard')),
                     h(Button, { disabled: discardBusyId === entry.trashId, onClick: onCancel }, t('action.cancel')))
@@ -1640,6 +1736,7 @@ window.__ModuleLoader__.load({
     function SettingsSection() {
       useLocaleTick()
       const mutationVersion = useMutationVersion()
+      const inlineDialog = useInlineDialogState()
       const [tab, setTab] = useState('trash')
       const [state, setState] = useState(null)
       const [sessions, setSessions] = useState([])
@@ -1966,10 +2063,13 @@ window.__ModuleLoader__.load({
                   h('input', {
                     type: 'text', value: purgePhrase, placeholder: 'DELETE', className: 'dc-input dc-input-small',
                     onChange: (event) => setPurgePhrase(event.target.value),
+                    autoCapitalize: 'characters',
+                    autoCorrect: 'off',
+                    spellCheck: false,
                   }),
                   h(Button, {
                     variant: 'danger',
-                    disabled: purgeBusy === true || purgePhrase.trim() !== 'DELETE',
+                    disabled: purgeBusy === true || phraseMatches(purgePhrase, 'DELETE') !== true,
                     onClick: () => { void purge(entry.trashId, purgePhrase.trim()) },
                   }, t('action.purge')),
                   h(Button, { disabled: purgeBusy === true, onClick: () => { setPurgeTarget(null); setPurgePhrase('') } }, t('action.cancel')))
@@ -2033,7 +2133,14 @@ window.__ModuleLoader__.load({
                 // without the source the two are indistinguishable in the UI.
                 + (typeof record.source === 'string' && record.source !== 'web-ui' ? ` · ${record.source}` : '')
                 + (record.error?.message ? ` · ${record.error.message}` : ''))),
-            h('div', { className: 'dc-row-time' }, record.actor ?? '')))) : null)
+            h('div', { className: 'dc-row-time' }, record.actor ?? '')))) : null,
+
+        // dsh-go's native UI gives `shell.overlay` no seat by default, so the
+        // dialog host never mounts there and every delete button looked dead.
+        // The panel keeps its own seat, so it renders the same dialog inline.
+        inlineDialog === null ? null : h('div', { className: 'dc-inline-dialog' },
+          h('p', { className: 'dc-hint' }, t('dialog.inlineHint')),
+          h(DeleteDialog, { payload: inlineDialog, key: `inline:${inlineDialog.key ?? ''}` })))
     }
 
     /* ------------------------------------------------------------------ *
@@ -2044,6 +2151,11 @@ window.__ModuleLoader__.load({
 /* 1300 clears the settings modal (1000) and the host panels that also use
    1100, since this backlog shares document.body with them. */
 .dc-backdrop{position:fixed;inset:0;z-index:1300;display:flex;align-items:center;justify-content:center;background:rgba(0,0,0,.38);padding:16px}
+/* Inline copy for hosts without an overlay seat (dsh-go native UI): the
+   same dialog, in the page flow instead of on top of it. */
+.dc-inline-dialog{margin-top:14px;padding-top:12px;border-top:1px solid var(--dsw-alias-border-l1,#e5e6eb)}
+.dc-inline-dialog .dc-backdrop{position:static;inset:auto;z-index:auto;background:none;padding:0;display:block}
+.dc-inline-dialog .dc-dialog{width:100%;max-width:none;max-height:none;box-shadow:none;padding:14px}
 .dc-dialog{box-sizing:border-box;width:min(560px,94vw);max-height:88vh;overflow:auto;background:var(--dsw-alias-bg-overlay,#fff);color:var(--dsw-alias-label-primary,#1f2329);border:1px solid var(--dsw-alias-border-l1,#e5e6eb);border-radius:12px;box-shadow:0 18px 60px rgba(0,0,0,.28);padding:20px 20px 16px;font:inherit}
 .dc-dialog-title{margin:0 0 8px;font-size:16px;font-weight:600;line-height:1.4}
 .dc-dialog-body{margin:0 0 12px;font-size:13px;color:var(--dsw-alias-label-secondary,#646a73);line-height:1.6}
@@ -2232,6 +2344,12 @@ window.__ModuleLoader__.load({
     exports.__adapterLabel = adapterLabel
     exports.__adapterReason = adapterReason
     exports.__loadUiFlags = loadUiFlags
+    // Pure helpers the tests assert on directly: the phrase rule and the
+    // non-JSON fallback are exactly where a mobile keyboard or a route
+    // guard changes the outcome.
+    exports.__phraseMatches = phraseMatches
+    exports.__httpFallbackError = httpFallbackError
+    exports.__overlaySeatState = () => ({ mounted: overlaySeatMounted })
     return module.exports
   },
 })

package/lib/core/file-lock.js

@@ -103,8 +103,13 @@ export function createFileLock({
     let breakFailures = 0
 
     const busyError = () => {
-      const busy = new Error(`The lock ${lockPath} is held by another process.`)
+      // The path is part of the message on purpose: a lock left behind by a
+      // killed Host (or a recycled pid that never heartbeats again) blocks every
+      // change for up to twenty minutes, and the only fix the user has is
+      // deleting that file. Without the path the refusal is a dead end.
+      const busy = new Error(`The lock ${lockPath} is held by another process. If this keeps happening, delete that file and retry.`)
       busy.code = 'E_LOCK_BUSY'
+      busy.details = { lockPath }
       return busy
     }
 

package/lib/host/api.js

@@ -770,7 +770,12 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     // temporary rate limit does not force the user to re-preview.
     const validated = validateConfirmation(body?.confirmToken, { sessionIds, includeMemory, mode })
     const phrase = typeof body?.confirmPhrase === 'string' ? body.confirmPhrase.trim() : ''
-    if (validated.record.phrase !== '' && phrase !== validated.record.phrase) {
+    // Compared case-insensitively: Android soft keyboards capitalise the first
+    // letter of a sentence, so "Delete" arrived where the Host expected
+    // "DELETE" and the only feedback was a refusal with no explanation. The
+    // phrase is a deliberate friction, not a spelling test.
+    const phraseMatches = validated.record.phrase === '' || phrase.toUpperCase() === validated.record.phrase.toUpperCase()
+    if (!phraseMatches) {
       throw new DeleteError('E_CONFIRM_PHRASE', `Type “${validated.record.phrase}” to confirm this deletion.`, {
         expected: validated.record.phrase,
         received: phrase.slice(0, 40),
@@ -901,7 +906,7 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
 
   async function purgeEntry(trashId, confirmPhrase) {
     if (typeof trashId !== 'string' || trashId === '') throw new DeleteError('E_BAD_REQUEST', 'A recycle-bin id is required.', {})
-    if (typeof confirmPhrase !== 'string' || confirmPhrase.trim() !== 'DELETE') {
+    if (typeof confirmPhrase !== 'string' || confirmPhrase.trim().toUpperCase() !== 'DELETE') {
       throw new DeleteError('E_CONFIRM_PHRASE', 'Type “DELETE” to permanently delete this entry.', { expected: 'DELETE' })
     }
     const entry = await trash.read(trashId)
@@ -927,7 +932,7 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     // still be on disk" branch below and turn this into an arbitrary-path
     // existence probe.
     if (!isTrashId(trashId)) throw new DeleteError('E_BAD_REQUEST', 'The recycle-bin id is malformed.', {})
-    if (typeof confirmPhrase !== 'string' || confirmPhrase.trim() !== 'DELETE') {
+    if (typeof confirmPhrase !== 'string' || confirmPhrase.trim().toUpperCase() !== 'DELETE') {
       throw new DeleteError('E_CONFIRM_PHRASE', 'Type “DELETE” to discard this incomplete entry.', { expected: 'DELETE' })
     }
     let entry = await trash.read(trashId)

package/lib/version.js

@@ -5,4 +5,4 @@
  * asserted against it by `test/manifest.test.mjs` so the two can never drift
  * (they did: the constant stayed at 0.1.0 while the package reached 0.1.4).
  */
-export const PLUGIN_VERSION = '0.3.14'
+export const PLUGIN_VERSION = '0.3.15'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-conversation-recycle-bin",
-  "version": "0.3.14",
+  "version": "0.3.15",
   "description": "DSH conversation deletion with an optional, previewed cascade into conversation-associated memory: soft delete + recycle bin, audit trail, batch rate limits and per-session rollback. 删除对话（可选一并删除关联记忆）：软删除与回收站、审计留痕、批量限流、失败回滚。",
   "repository": {
     "type": "git",