dsh-conversation-recycle-bin 0.3.15 → 0.3.16

package/CHANGELOG.md

@@ -3,6 +3,33 @@
 All notable changes to `dsh-conversation-recycle-bin` are documented here.
 The format follows Keep a Changelog; the project uses Semantic Versioning.
 
+## [0.3.16] — 2026-11-03
+
+一次针对源码本身的复查（逐模块读 Host 半边 + 记忆适配器、`client.js` 相关路径）。两条真缺陷、三处健壮性改进、两处文档不一致。
+
+### Fixed
+
+- **记忆节点的 `nodeId` 能决定文件落点（路径穿越，已复现）**：`nodeId` 是外部记忆库 JSON 的 key（md_cg 的 `_index.json`，或 `memory.generic.indexFile` 指向的任何 JSON），插件此前直接拼成 `${nodeId}.content` 当作回收站里的文件名。一个 `../../../../escaped-node` 的 key 会把内容文件移出 `trash/<id>/memory/<adapter>/files/`，落到磁盘任意可写目录（文件名后缀固定 `.content`）。现在普通 id 保持历史命名（旧 bundle 仍可恢复），任何不是「纯文件名字符集」的 id 改用 `sha256(id)` 前 32 位命名；恢复时 `entry.storedFile` 还必须满足 `basename(x) === x`，否则抛 `E_TRASH_CONFLICT`。
+- **无 overlay 座位时「反馈」仍是死按钮**：0.3.15 的内联确认框把 `kind: 'feedback'` 排除了，而反馈横幅就在同一个设置面板里，于是在 dsh-go 原生界面上点「反馈」什么都不发生。现在内联渲染按 `kind` 分派 `FeedbackDialog` / `DeleteDialog`，两类对话框共用同一条降级路径。
+
+### Changed
+
+- **晚挂载的 overlay 不再导致两个对话框并存**：`useOverlaySeatPresent()` 从「500ms 后查一次」改成「250ms 轮询、最长 10s」，overlay 一旦挂载就让位给真正的宿主。
+- **跨盘移动不再可能留下半个目标**：`moveDirectory()` 的 EXDEV 退路改为「先 `cp` 到目标旁的 `.partial-<pid>-<ts>`，再 `rename` 就位，最后删源」，崩溃时不会出现一个半写目录被后续恢复当成完整日志。
+- **两处读取路径的头部预算统一**：纯文本日志首行从 64 KB 提到与 zstd 路径一致的 256 KB，且「填满预算还没换行」直接判为不可读，不再把一个截断行交给 `JSON.parse`。
+- `writeJsonAtomic()` 改为模块顶部引入 `writeFile`（原来每次调用都 `await import`），rename 失败时清理临时文件。
+
+### Docs
+
+- `README.md` 的状态行从 `0.3.14` 更正到 `0.3.16`（0.3.15 发布时漏改，且已随 npm 包外发）。
+- `cordis.patch.yml` 的默认层补上 `requireConnection: true`：该键此前只存在于 `config.schema.json` 与 `lib/core/config.js` 的 `DEFAULTS`，使「默认层 21 项 / schema 22 项」对不上。
+
+### Tests
+
+- `test/memory.test.mjs`（13 → 15）：恶意 `nodeId` 不能把内容文件搬出 bundle、且事后该文件确实在 `files/` 内；旧式 `<nodeId>.content` bundle 仍可恢复，而 `../../etc/passwd` 形式的 `storedFile` 被拒。
+- `test/client-module.test.mjs`（28 → 29）：无 overlay 座位时反馈对话框走内联路径（挂的是 `FeedbackDialog`，不是 `DeleteDialog`）。
+- 合计 192 → **195**。
+
 ## [0.3.15] — 2026-10-31
 
 dsh-go（Android）适配性审计后的修复。审计结论：Host 半边开箱可用（手机里跑的是真 Node 24 + 原版 DSH 引擎），问题全在**前端座位**与**移动端输入**上。

package/README.md

@@ -2,7 +2,7 @@
 
 给 DeepSeek Harness (DSH) Web 增加「删除对话」：会话列表的「…」菜单与会话详情页头部各有一个删除入口；确认框内可勾选「同时删除关联记忆」（默认不勾选），并实时显示将被影响的记忆条数。删除默认进入插件回收站，可恢复；每次操作写入审计日志；批量删除有上限与限流，批量软删除需输入数量，彻底删除一键执行；事务任一步失败即回滚。
 
-> 状态：`0.3.14`，Host + Web Client 双半，零构建（plain JS ESM），只依赖宿主已发布的公开扩展点。
+> 状态：`0.3.16`，Host + Web Client 双半，零构建（plain JS ESM），只依赖宿主已发布的公开扩展点。
 > 运行要求：**Node.js ≥ 22.15**（Host 侧用到 `readdir(..., { recursive: true })`、`AbortSignal` 等 22.x 行为），DSH ≥ `0.2.1-rc.2`（`package.json` 的 `engines` 已如实声明，DSH 安装校验会据此拒绝更低版本）。
 > 包名：`dsh-conversation-recycle-bin`（原 `dsh-delete-conversation` 因 npm 被他人占用而改名，见 CHANGELOG 0.2.0）。
 > 本 README 同时是设计说明与验收依据；安装/回滚步骤见 [INSTALL.md](INSTALL.md)；变更见 [CHANGELOG.md](CHANGELOG.md)。

package/client.js

@@ -705,11 +705,27 @@ window.__ModuleLoader__.load({
     function useOverlaySeatPresent() {
       const [present, setPresent] = useState(overlaySeatMounted === true)
       useEffect(() => {
-        // The overlay host mounts after the slot service resolves; a single
-        // frame of grace avoids flashing the inline copy on hosts that do have
-        // a seat.
-        const timer = setTimeout(() => setPresent(overlaySeatMounted === true), 500)
-        return () => clearTimeout(timer)
+        if (overlaySeatMounted === true) {
+          setPresent(true)
+          return undefined
+        }
+        // The overlay host mounts with the shell, but nothing guarantees it is
+        // already there when this panel first renders: poll briefly so a late
+        // mount still wins over the inline copy instead of rendering both.
+        let timer = null
+        const tick = () => {
+          if (overlaySeatMounted !== true) return
+          if (timer !== null) clearInterval(timer)
+          setPresent(true)
+        }
+        timer = setInterval(tick, 250)
+        const stop = setTimeout(() => {
+          if (timer !== null) clearInterval(timer)
+        }, 10_000)
+        return () => {
+          if (timer !== null) clearInterval(timer)
+          clearTimeout(stop)
+        }
       }, [])
       return present
     }
@@ -718,8 +734,10 @@ window.__ModuleLoader__.load({
       const payload = useDialogState()
       const overlayPresent = useOverlaySeatPresent()
       if (overlayPresent || payload === null) return null
-      // Feedback has no delete semantics and lives in its own tab.
-      return payload.kind === 'feedback' ? null : payload
+      // Every dialog this plugin opens has to travel through here, not only the
+      // delete one: the feedback form is opened from this very panel, so
+      // excluding it left a second dead button on hosts without an overlay seat.
+      return payload
     }
 
     /**
@@ -2140,7 +2158,9 @@ window.__ModuleLoader__.load({
         // The panel keeps its own seat, so it renders the same dialog inline.
         inlineDialog === null ? null : h('div', { className: 'dc-inline-dialog' },
           h('p', { className: 'dc-hint' }, t('dialog.inlineHint')),
-          h(DeleteDialog, { payload: inlineDialog, key: `inline:${inlineDialog.key ?? ''}` })))
+          inlineDialog.kind === 'feedback'
+            ? h(FeedbackDialog, { payload: inlineDialog, key: `inline:${inlineDialog.key ?? 'feedback'}` })
+            : h(DeleteDialog, { payload: inlineDialog, key: `inline:${inlineDialog.key ?? ''}` })))
     }
 
     /* ------------------------------------------------------------------ *

package/cordis.patch.yml

@@ -21,6 +21,12 @@
         # Refuse every request when the Web server is bound beyond loopback,
         # unless the operator opts in explicitly below.
         requireSameOrigin: true
+        # Refuse every request when the Host exposes no `connection` service:
+        # the loopback/origin fence cannot tell two local processes apart, so
+        # without it any local process could delete a conversation. Listed here
+        # (and not only in config.schema.json) so the shipped default layer shows
+        # every key the contract has.
+        requireConnection: true
         allowNonLoopback: false
         # Reverse-proxy deployments: list the exact authorities the proxy puts
         # in `Host` (host, host:port). A bare host admits any port. Listing them

package/lib/core/memory/json-index-adapter.js

@@ -40,7 +40,7 @@
  */
 import * as defaultFs from 'node:fs/promises'
 import { createHash, randomBytes } from 'node:crypto'
-import { dirname, isAbsolute, join, resolve, sep } from 'node:path'
+import { basename, dirname, isAbsolute, join, resolve, sep } from 'node:path'
 import { resolveJsonPointer } from '../config.js'
 import { DeleteError } from '../errors.js'
 import { createFileLock } from '../file-lock.js'
@@ -78,6 +78,30 @@ function validateRelativeContentPath(rootDir, relative) {
 
 const sleepDefault = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
 
+/**
+ * File name a node's content gets inside the restore bundle.
+ *
+ * The node id is a KEY FROM AN EXTERNAL JSON FILE (md_cg's index, or whatever
+ * `memory.generic.indexFile` points at), so it is data, not a path: an id like
+ * `../../..` used to move the content file out of the bundle and into any
+ * directory the Host can write. Ordinary ids keep their historical name, so
+ * bundles written before this change still restore; anything that is not a
+ * plain name is replaced by a hash (`bundle.entries[].nodeId` still carries the
+ * real id, which is all a restore needs).
+ */
+function contentFileName(nodeId) {
+  const raw = String(nodeId)
+  if (raw !== '.' && raw !== '..' && /^[A-Za-z0-9._-]{1,120}$/.test(raw)) return `${raw}.content`
+  return `${createHash('sha256').update(raw).digest('hex').slice(0, 32)}.content`
+}
+
+/** A stored file name must stay a name: no separators, no traversal. */
+function isPlainFileName(value) {
+  return typeof value === 'string' && value !== '' && value !== '.' && value !== '..' && basename(value) === value
+}
+
+
+
 /**
  * @param {object} options
  * @param {string} options.id stable adapter id
@@ -362,7 +386,7 @@ export function createJsonIndexMemoryAdapter(options) {
             if (rootDir !== null && typeof relative === 'string') {
               const source = validateRelativeContentPath(rootDir, relative)
               if (source !== null) {
-                const storedName = `${nodeId}.content`
+                const storedName = contentFileName(nodeId)
                 try {
                   await fsApi.rename(source, join(filesDir, storedName))
                   movedFiles.push({ from: source, to: join(filesDir, storedName) })
@@ -488,6 +512,12 @@ export function createJsonIndexMemoryAdapter(options) {
             if (entry.storedFile !== null && entry.originalPath !== null && rootDir !== null) {
               const destination = validateRelativeContentPath(rootDir, entry.originalPath)
               if (destination === null) throw new DeleteError('E_TRASH_CONFLICT', 'Memory content path is invalid; restore aborted.', { nodeId: entry.nodeId })
+              if (!isPlainFileName(entry.storedFile)) {
+                throw new DeleteError('E_TRASH_CONFLICT', 'The restore bundle names a content file outside its own directory; restore aborted.', {
+                  adapter: id,
+                  nodeId: entry.nodeId,
+                })
+              }
               const stored = join(bundle.bundlePath ? dirname(bundle.bundlePath) : '', 'files', entry.storedFile)
               await fsApi.mkdir(dirname(destination), { recursive: true })
               await fsApi.rename(stored, destination)

package/lib/core/policy.js

@@ -1,126 +1,126 @@
-/**
- * Authorization and data-ownership policy.
- *
- * The Host is a local single-user application, so "who is the operator" is
- * answered by the transport (same-origin loopback route, user-only UI) and not
- * by a user database. What remains is *data ownership*: a session must exist,
- * must belong to a registered workspace (unless the operator opted into orphan
- * deletion), must not be a delegated subagent's private session, and must not
- * be listed as protected. Hard deletion of a live session is allowed by
- * default because the cascade quiesces it first (cancel the turn, archive with
- * `stopActivity`, then drain); `stopLiveSessions: false` restores a strict
- * refusal for operators who do not want the plugin to touch running work.
- *
- * Every check returns a `DeleteError` so route and tests share one wording.
- */
-import { DeleteError } from './errors.js'
-
-/** Normalize a Windows/Unix path for containment checks (no filesystem access). */
-export function normalizePathForCompare(input) {
-  if (typeof input !== 'string' || input === '') return ''
-  let value = input.replace(/\\/g, '/').replace(/\/+$/g, '')
-  // Windows paths compare case-insensitively: drive-lettered paths and UNC
-  // roots (`\\server\share`, `\\?\C:\...`). POSIX paths stay case-sensitive so
-  // a root check cannot become broader than the filesystem's own identity rules.
-  if (/^[A-Za-z]:\//.test(value) || value.startsWith('//')) value = value.toLowerCase()
-  return value
-}
-
-/** True when `candidate` equals `root` or lies below it. */
-export function isPathInside(root, candidate) {
-  const normalizedRoot = normalizePathForCompare(root)
-  const normalizedCandidate = normalizePathForCompare(candidate)
-  if (normalizedRoot === '' || normalizedCandidate === '') return false
-  return normalizedCandidate === normalizedRoot || normalizedCandidate.startsWith(`${normalizedRoot}/`)
-}
-
-/**
- * Evaluate the policy for ONE session.
- *
- * @param {object} input
- * @param {{ id: string, title?: string, cwd?: string, origin?: string, blank?: boolean }} input.session
- * @param {{ id: string, path: string, title?: string } | null} input.workspace owning workspace, if any
- * @param {boolean} input.live whether the Host still knows the session at all; used
- *   only as a fallback when `session.running` is unknown
- * @param {'soft'|'hard'} input.mode requested deletion mode
- * @param {ReturnType<import('./config.js').normalizeConfig>['value']} input.config
- * @returns {{ ok: true, warnings: string[] } | { ok: false, error: DeleteError }}
- */
-export function evaluateSessionPolicy({ session, workspace, live, mode, config }) {
-  const warnings = []
-  const id = String(session?.id ?? '')
-  // "Exists" is not "busy". `live` says the Host still knows the session, which
-  // is true for every idle conversation too; gating a hard delete on it made
-  // `stopLiveSessions: false` refuse to delete conversations nobody was using.
-  // When the Host does not report a status at all we keep the old, stricter
-  // reading: unknown counts as running.
-  const running = session?.running === true || (session?.running === undefined && live === true)
-
-  if (config.protectedSessionIds.includes(id)) {
-    return {
-      ok: false,
-      error: new DeleteError('E_POLICY_PROTECTED', 'This conversation is protected by configuration and cannot be deleted.', {
-        sessionId: id,
-      }),
-    }
-  }
-
-  if (session?.origin === 'subagent' && !config.allowSubagentSessions) {
-    return {
-      ok: false,
-      error: new DeleteError('E_POLICY_SUBAGENT', 'Subagent sessions cannot be deleted unless explicitly allowed.', {
-        sessionId: id,
-      }),
-    }
-  }
-
-  if (workspace === null || workspace === undefined) {
-    if (!config.allowOrphanSessions) {
-      return {
-        ok: false,
-        error: new DeleteError('E_POLICY_ORPHAN', 'This conversation is not owned by a registered workspace.', {
-          sessionId: id,
-          cwd: session?.cwd ?? null,
-        }),
-      }
-    }
-    warnings.push('The conversation has no owning workspace; orphan deletion is enabled.')
-  }
-
-  if (config.allowedWorkspaceRoots.length > 0) {
-    const cwd = session?.cwd ?? workspace?.path
-    const allowed = config.allowedWorkspaceRoots.some((root) => isPathInside(root, cwd ?? ''))
-    if (!allowed) {
-      return {
-        ok: false,
-        error: new DeleteError('E_POLICY_ROOT', 'This conversation is outside the allowed workspace roots.', {
-          sessionId: id,
-          cwd: cwd ?? null,
-        }),
-      }
-    }
-  }
-
-  if (mode === 'hard' && running) {
-    if (!config.stopLiveSessions) {
-      return {
-        ok: false,
-        error: new DeleteError('E_POLICY_LIVE', 'This conversation is still open in a live agent, and stopLiveSessions is disabled.', {
-          sessionId: id,
-        }),
-      }
-    }
-    warnings.push('The conversation is open in a live agent; it will be stopped before its log is removed.')
-  }
-
-  // A soft delete also quiesces the session (`archiveSession(id, { stopActivity:
-  // true })`), so it interrupts a running turn exactly like a hard delete does.
-  // Say so before the click instead of after the round died.
-  if (mode === 'soft' && running) {
-    warnings.push('The conversation is running right now; a soft delete stops the current turn before moving it to the recycle bin.')
-  }
-
-  if (session?.blank === true) warnings.push('This is an empty conversation.')
-
-  return { ok: true, warnings }
-}
+/**
+ * Authorization and data-ownership policy.
+ *
+ * The Host is a local single-user application, so "who is the operator" is
+ * answered by the transport (same-origin loopback route, user-only UI) and not
+ * by a user database. What remains is *data ownership*: a session must exist,
+ * must belong to a registered workspace (unless the operator opted into orphan
+ * deletion), must not be a delegated subagent's private session, and must not
+ * be listed as protected. Hard deletion of a live session is allowed by
+ * default because the cascade quiesces it first (cancel the turn, archive with
+ * `stopActivity`, then drain); `stopLiveSessions: false` restores a strict
+ * refusal for operators who do not want the plugin to touch running work.
+ *
+ * Every check returns a `DeleteError` so route and tests share one wording.
+ */
+import { DeleteError } from './errors.js'
+
+/** Normalize a Windows/Unix path for containment checks (no filesystem access). */
+export function normalizePathForCompare(input) {
+  if (typeof input !== 'string' || input === '') return ''
+  let value = input.replace(/\\/g, '/').replace(/\/+$/g, '')
+  // Windows paths compare case-insensitively: drive-lettered paths and UNC
+  // roots (`\\server\share`, `\\?\C:\...`). POSIX paths stay case-sensitive so
+  // a root check cannot become broader than the filesystem's own identity rules.
+  if (/^[A-Za-z]:\//.test(value) || value.startsWith('//')) value = value.toLowerCase()
+  return value
+}
+
+/** True when `candidate` equals `root` or lies below it. */
+export function isPathInside(root, candidate) {
+  const normalizedRoot = normalizePathForCompare(root)
+  const normalizedCandidate = normalizePathForCompare(candidate)
+  if (normalizedRoot === '' || normalizedCandidate === '') return false
+  return normalizedCandidate === normalizedRoot || normalizedCandidate.startsWith(`${normalizedRoot}/`)
+}
+
+/**
+ * Evaluate the policy for ONE session.
+ *
+ * @param {object} input
+ * @param {{ id: string, title?: string, cwd?: string, origin?: string, blank?: boolean }} input.session
+ * @param {{ id: string, path: string, title?: string } | null} input.workspace owning workspace, if any
+ * @param {boolean} input.live whether the Host still knows the session at all; used
+ *   only as a fallback when `session.running` is unknown
+ * @param {'soft'|'hard'} input.mode requested deletion mode
+ * @param {ReturnType<import('./config.js').normalizeConfig>['value']} input.config
+ * @returns {{ ok: true, warnings: string[] } | { ok: false, error: DeleteError }}
+ */
+export function evaluateSessionPolicy({ session, workspace, live, mode, config }) {
+  const warnings = []
+  const id = String(session?.id ?? '')
+  // "Exists" is not "busy". `live` says the Host still knows the session, which
+  // is true for every idle conversation too; gating a hard delete on it made
+  // `stopLiveSessions: false` refuse to delete conversations nobody was using.
+  // When the Host does not report a status at all we keep the old, stricter
+  // reading: unknown counts as running.
+  const running = session?.running === true || (session?.running === undefined && live === true)
+
+  if (config.protectedSessionIds.includes(id)) {
+    return {
+      ok: false,
+      error: new DeleteError('E_POLICY_PROTECTED', 'This conversation is protected by configuration and cannot be deleted.', {
+        sessionId: id,
+      }),
+    }
+  }
+
+  if (session?.origin === 'subagent' && !config.allowSubagentSessions) {
+    return {
+      ok: false,
+      error: new DeleteError('E_POLICY_SUBAGENT', 'Subagent sessions cannot be deleted unless explicitly allowed.', {
+        sessionId: id,
+      }),
+    }
+  }
+
+  if (workspace === null || workspace === undefined) {
+    if (!config.allowOrphanSessions) {
+      return {
+        ok: false,
+        error: new DeleteError('E_POLICY_ORPHAN', 'This conversation is not owned by a registered workspace.', {
+          sessionId: id,
+          cwd: session?.cwd ?? null,
+        }),
+      }
+    }
+    warnings.push('The conversation has no owning workspace; orphan deletion is enabled.')
+  }
+
+  if (config.allowedWorkspaceRoots.length > 0) {
+    const cwd = session?.cwd ?? workspace?.path
+    const allowed = config.allowedWorkspaceRoots.some((root) => isPathInside(root, cwd ?? ''))
+    if (!allowed) {
+      return {
+        ok: false,
+        error: new DeleteError('E_POLICY_ROOT', 'This conversation is outside the allowed workspace roots.', {
+          sessionId: id,
+          cwd: cwd ?? null,
+        }),
+      }
+    }
+  }
+
+  if (mode === 'hard' && running) {
+    if (!config.stopLiveSessions) {
+      return {
+        ok: false,
+        error: new DeleteError('E_POLICY_LIVE', 'This conversation is still open in a live agent, and stopLiveSessions is disabled.', {
+          sessionId: id,
+        }),
+      }
+    }
+    warnings.push('The conversation is open in a live agent; it will be stopped before its log is removed.')
+  }
+
+  // A soft delete also quiesces the session (`archiveSession(id, { stopActivity:
+  // true })`), so it interrupts a running turn exactly like a hard delete does.
+  // Say so before the click instead of after the round died.
+  if (mode === 'soft' && running) {
+    warnings.push('The conversation is running right now; a soft delete stops the current turn before moving it to the recycle bin.')
+  }
+
+  if (session?.blank === true) warnings.push('This is an empty conversation.')
+
+  return { ok: true, warnings }
+}