dsh-conversation-recycle-bin 0.3.2 → 0.3.3

package/CHANGELOG.md

@@ -3,6 +3,36 @@
 All notable changes to `dsh-conversation-recycle-bin` are documented here.
 The format follows Keep a Changelog; the project uses Semantic Versioning.
 
+## [0.3.3] — 2026-10-19
+
+本次修复对应 `AUDIT-2026-10-19-review.md` 的 S1–S3、P1–P5、R1–R4 与 M 项；每条均带回归测试。
+
+### Security
+
+- **S1：`Host` 头不带端口时同源端口比较被恒真绕过**：`requestPort === ''` 时旧表达式退化为 `originPort === originPort`，任意端口的 Origin 都通过。现在缺失端口按 Origin 自身 scheme 的默认端口归一（http→80、https→443），`Host: 127.0.0.1` + `Origin: http://127.0.0.1:9999` 被拒为 `403 E_FORBIDDEN_ORIGIN`，而 `http://127.0.0.1`（无端口）仍放行。
+
+### Fixed
+
+- **S2：未知 GET 路由误报 405**：路径不存在时 GET/POST 统一返回 `404 E_NOT_FOUND`，405 只保留给「路径存在但方法错误」。
+- **S3：损坏/缺失 manifest 的回收站目录永久隐身**：新增 `trash.scanUnreadable()`（missing / corrupt / unreadable 三类），`/trash` 把它们列为 `status: 'unreadable'` 的 incomplete 项；`discard` 对目录存在但清单不可读的条目走 `performDiscard` 的磁盘检查——空目录可强制清理，仍持有 `session/` 日志或记忆文件则拒绝（`409 E_TRASH_CONFLICT`），不再只能手动删盘。
+- **P1：live drain 轮询每轮全量重建会话列表**：`inspectRunning` 先走新增的 `gateway.isRunning(sessionId)` 内存存活表探针（`running/active/busy` 布尔），探针答不出才回退全量 `inspect()`，批量删除多个 live 会话时不再线性放大 `controller.list()` 与工作区扫描。
+- **P2：`/trash` 每次全量读盘解析 manifest**：加 1.5s TTL 缓存，delete/restore/purge/discard 成功后主动失效。
+- **P3：`/audit` 全量读 5MB 再解析**：`tail()` 只读尾部 256KB 块、丢弃首条残行，malformed 只统计窗口内。
+- **P4：跨进程锁等待 30s 短于批量最坏耗时**：`/delete` 锁预算按 `min(900s, 15s + 16s×批量数 + 每 live 会话的 drain 窗口)` 估算，大批量不再被第二个 Host 误判 `E_LOCK_BUSY`。
+- **P5：全部 blocked 时仍做全量记忆计数**：`blocked.length > 0` 时跳过 `countForSessions`，返回 `{total:0, skipped:true}` 形状。
+- **R1：请求体超限后继续读完整个 body**：超限立即 `finish(413)`，慢速超大请求不再占着连接。
+- **R2：反馈投递失败也扣每小时额度**：`takeSlot` 返回 `release()`，传输失败 catch 里先退还槽位再抛 `E_FEEDBACK_TRANSPORT`；成功投递才计数，SMTP/HTTP 临时故障不会把用户锁一小时。
+- **R3：批量列表按 soft 固定裁决，与 `defaultMode` 脱节**：`/sessions` 每行裁决改用 `config.defaultMode`；`stopLiveSessions:false` + hard 默认时，不可删的 live 行直接标 `deletable:false`。
+- **R4：失败的删除项也占每分钟额度**：`limiter.take(1)` 改为带 `release()` 的预留，单条失败在 catch 里退还槽位，只有真正成功的删除计入窗口；首个 item 预算不足直接抛 429 的既有契约不变。
+
+### Changed / Maintenance
+
+- **M2：会话 ID 正则去重**：抽出 `lib/core/ids.js` 的 `SESSION_ID_PATTERN`，`api.js` / `gateway.js` 共享，删除两处本地副本。
+- **M4：`/state` 不再外泄记忆适配器绝对路径**：只输出 `{id,label,available,reason}`，`storePath` 不离开 Host。
+- **M1：删除无引用的死 CSS `.dc-mode-preferred`**。
+- **M3：`npm run check` 改为 `scripts/check-syntax.mjs` 遍历 `lib/**/*.js` + `client.js` 逐个 `node --check`**（原链式清单只覆盖 3 个文件，新增/改名模块不会再漏检）。
+- 回归测试：`feedback` 17 → 18、`core` 13 → 14、`api` 34 → 38；新增覆盖 S1 无端口 Host、S2 未知路由 404、S3 损坏清单列出/清理/冲突、R2 失败退额度、R3 默认模式裁决、R4 失败退额度。
+
 ## [0.3.2] — 2026-10-18
 
 ### Fixed

package/client.js

@@ -127,6 +127,7 @@ window.__ModuleLoader__.load({
         'trash.status.restoring': 'restoring',
         'trash.status.purging': 'purging',
         'trash.status.restored': 'restored',
+        'trash.status.unreadable': 'unreadable manifest',
         'batch.title': 'Batch deletion',
         'batch.hint': 'Each conversation is its own transaction; a failure rolls only that conversation back.',
         'batch.selected': '{count} selected',
@@ -280,6 +281,7 @@ window.__ModuleLoader__.load({
         'trash.status.restoring': '恢复中断',
         'trash.status.purging': '清理中断',
         'trash.status.restored': '已恢复',
+        'trash.status.unreadable': '清单不可读',
         'batch.title': '批量删除',
         'batch.hint': '每个对话独立事务；失败时仅回滚该对话。',
         'batch.selected': '已选 {count} 个',
@@ -1447,9 +1449,10 @@ window.__ModuleLoader__.load({
         h('p', { className: 'dc-hint' }, t('trash.incompleteHint')),
         ...entries.map((entry) => h('div', { key: entry.trashId, className: 'dc-row' },
           h('div', { className: 'dc-row-main' },
-            h('div', { className: 'dc-row-title' }, entry.title || entry.sessionId),
-            h('div', { className: 'dc-hint' },
-              `${t(`trash.status.${entry.status}`)} · ${formatTime(entry.updatedAt ?? entry.deletedAt)} · ${t('trash.items', { sessions: 1, memories: entry.memory ?? 0 })}`)),
+            h('div', { className: 'dc-row-title' }, entry.title || entry.sessionId || entry.trashId),
+            h('div', { className: 'dc-hint' }, entry.status === 'unreadable' && entry.error?.message
+              ? `${t('trash.status.unreadable')} · ${entry.error.message}`
+              : `${t(`trash.status.${entry.status}`)} · ${formatTime(entry.updatedAt ?? entry.deletedAt)} · ${t('trash.items', { sessions: 1, memories: entry.memory ?? 0 })}`)),
           h('div', { className: 'dc-row-actions' },
             entry.hasSessionLog === true && typeof onRestore === 'function'
               ? h(Button, {
@@ -1819,7 +1822,6 @@ window.__ModuleLoader__.load({
 .dc-meta{font-size:12px;color:var(--dsw-alias-label-secondary,#646a73);margin-bottom:10px}
 .dc-modes{display:flex;flex-direction:column;gap:8px;margin-bottom:12px}
 .dc-mode{display:flex;gap:9px;align-items:flex-start;padding:9px 10px;border:1px solid var(--dsw-alias-border-l1,#e5e6eb);border-radius:9px;cursor:pointer;background:var(--dsw-alias-bg-layer-1,#f7f8fa)}
-.dc-mode-preferred{border-color:var(--dsw-alias-brand-primary,#4d6bfe)}
 .dc-live-warning{margin-top:10px;padding:8px 10px;border-radius:8px;font-size:12px;line-height:1.5;color:var(--dsw-alias-state-warn-label,#b26a00);background:var(--dsw-alias-state-warn-tertiary,#fff7e6)}
 .dc-mode input{margin-top:3px}
 .dc-mode-title{display:block;font-size:13px;font-weight:600}

package/lib/core/audit.js

@@ -75,16 +75,40 @@ export function createAuditLog({ filePath, maxBytes = 5 * 1024 * 1024, retention
       })
     },
 
-    /** Read the most recent `limit` records; malformed lines are counted, not thrown. */
+    /**
+     * Read the most recent `limit` records; malformed lines are counted, not
+     * thrown. Only the tail window (≤256KB) is read and parsed: the settings
+     * page asks for the last N rows on every open, and a full up-to-5MB parse
+     * on each request scaled with the whole trail, not with `limit`. Malformed
+     * lines outside the window are not counted (the metric describes the
+     * displayed window).
+     */
     async tail(limit = 50) {
-      let content = ''
+      const maxRecords = Math.max(1, Math.floor(limit))
+      const CHUNK = 256 * 1024
+      let size = 0
+      try {
+        size = (await fsApi.stat(filePath)).size
+      } catch (error) {
+        if (error?.code === 'ENOENT') return { records: [], malformed: 0 }
+        throw error
+      }
+      const start = Math.max(0, size - CHUNK)
+      let buffer
       try {
-        content = await fsApi.readFile(filePath, 'utf8')
+        buffer = start > 0
+          ? await fsApi.readFile(filePath, { start, end: size })
+          : await fsApi.readFile(filePath, 'utf8')
       } catch (error) {
         if (error?.code === 'ENOENT') return { records: [], malformed: 0 }
         throw error
       }
-      const lines = content.split('\n').filter((line) => line.trim() !== '')
+      const text = Buffer.isBuffer(buffer) ? buffer.toString('utf8') : String(buffer)
+      const rawLines = text.split('\n')
+      // A chunk starts mid-line; drop the partial first line instead of
+      // parsing a torn fragment as malformed.
+      const lines = (start > 0 ? rawLines.slice(1) : rawLines)
+        .filter((line) => line.trim() !== '')
       const records = []
       let malformed = 0
       for (const line of lines) {
@@ -94,7 +118,7 @@ export function createAuditLog({ filePath, maxBytes = 5 * 1024 * 1024, retention
           malformed += 1
         }
       }
-      return { records: records.slice(-limit), malformed }
+      return { records: records.slice(-maxRecords), malformed }
     },
   }
 }

package/lib/core/file-lock.js

@@ -77,9 +77,11 @@ export function createFileLock({
 
   /**
    * Acquire the lock.
+   * @param {{ timeoutMs?: number }} [options] per-call wait budget override;
+   *   defaults to the lock's configured timeoutMs
    * @returns {Promise<() => Promise<void>>} release
    */
-  async function acquire() {
+  async function acquire({ timeoutMs: waitBudget = timeoutMs } = {}) {
     const nonce = randomBytes(8).toString('hex')
     const started = now()
     let handle = null
@@ -108,7 +110,7 @@ export function createFileLock({
           await fsApi.rm(lockPath, { force: true }).catch(() => {})
           continue
         }
-        if (now() - started >= timeoutMs) {
+        if (now() - started >= waitBudget) {
           const busy = new Error(`The lock ${lockPath} is held by another process.`)
           busy.code = 'E_LOCK_BUSY'
           throw busy

package/lib/core/ids.js

@@ -0,0 +1,7 @@
+/**
+ * Shared identifier shapes used by the HTTP layer and the session gateway.
+ * Kept in one place so the route and the preflight cannot drift apart.
+ */
+
+/** DSH session ids: letters, digits and `.`, `_`, `-`; 6–80 characters. */
+export const SESSION_ID_PATTERN = /^[A-Za-z0-9._-]{6,80}$/

package/lib/core/rate-limit.js

@@ -24,8 +24,10 @@ export function createSlidingWindowLimiter({ limit, windowMs, now = Date.now })
 
   return {
     /**
-     * Try to reserve `cost` deletions.
-     * @returns {{ ok: true, remaining: number } | { ok: false, retryAfterMs: number, limit: number }}
+     * Try to reserve `cost` deletions. A reservation that later fails to
+     * delete (rollback, writer busy, …) calls `release()` so the failed
+     * attempt does not spend the minute quota it never used.
+     * @returns {{ ok: true, remaining: number, release: () => void } | { ok: false, retryAfterMs: number, limit: number }}
      */
     take(cost = 1) {
       const current = now()
@@ -36,7 +38,19 @@ export function createSlidingWindowLimiter({ limit, windowMs, now = Date.now })
         return { ok: false, retryAfterMs, limit }
       }
       for (let index = 0; index < cost; index += 1) accepted.push(current)
-      return { ok: true, remaining: limit - accepted.length }
+      return {
+        ok: true,
+        remaining: limit - accepted.length,
+        release() {
+          // Drop only the reservation we just made: remove `cost` stamps equal
+          // to this instant; other concurrent reservations at the same instant
+          // stay in place.
+          for (let index = 0; index < cost; index += 1) {
+            const position = accepted.lastIndexOf(current)
+            if (position !== -1) accepted.splice(position, 1)
+          }
+        },
+      }
     },
 
     /** Current budget without consuming it (used by the preview response). */

package/lib/core/trash.js

@@ -122,6 +122,45 @@ export function createTrashStore({ rootDir, now = Date.now, newId, fsApi = { mkd
       return entries.filter((entry) => entry.status === 'trashed')
     },
 
+    /**
+     * Trash directories whose manifest cannot be read at all: missing
+     * (crashed between allocate and write), corrupt, or unparseable. These
+     * are invisible to restore/purge but must still be listable and
+     * discardable, otherwise a single bad manifest strands the directory on
+     * disk forever.
+     * @returns {Array<{ trashId: string, reason: 'missing-manifest'|'corrupt-manifest'|'unreadable-manifest' }>}
+     */
+    async scanUnreadable() {
+      await ensureRoot()
+      const out = []
+      let dirents = []
+      try {
+        dirents = await fsApi.readdir(rootDir, { withFileTypes: true })
+      } catch {
+        return out
+      }
+      for (const dirent of dirents) {
+        if (!dirent.isDirectory() || !isTrashId(dirent.name)) continue
+        let raw
+        let reason = 'missing-manifest'
+        try {
+          raw = await fsApi.readFile(join(rootDir, dirent.name, MANIFEST), 'utf8')
+        } catch (error) {
+          if (error?.code !== 'ENOENT') reason = 'unreadable-manifest'
+          out.push({ trashId: dirent.name, reason })
+          continue
+        }
+        try {
+          const parsed = JSON.parse(raw)
+          const readable = parsed !== null && typeof parsed === 'object' && parsed.format === 1 && TRASH_STATUS.includes(parsed.status)
+          if (!readable) out.push({ trashId: dirent.name, reason: 'corrupt-manifest' })
+        } catch {
+          out.push({ trashId: dirent.name, reason: 'corrupt-manifest' })
+        }
+      }
+      return out
+    },
+
     async remove(trashId) {
       await fsApi.rm(entryDir(trashId), { recursive: true, force: true })
     },

package/lib/host/api.js

@@ -55,13 +55,11 @@ import { createSessionGateway } from './gateway.js'
 import { createMemoryAdapters } from './memory.js'
 import { createFeedbackService } from './feedback.js'
 import { PLUGIN_VERSION } from '../version.js'
+import { SESSION_ID_PATTERN } from '../core/ids.js'
 
 export const ROUTE_PREFIX = '/conversation-recycle-bin/api'
 export const REQUIRED_HEADER = 'x-conversation-recycle-bin'
 const MAX_BODY_BYTES = 256 * 1024
-// DSH's `encodeSegment` allows `.`, `_`, `-`; forked/custom ids can contain a
-// dot, so refusing one made those conversations undeletable.
-const SESSION_ID_PATTERN = /^[A-Za-z0-9._-]{6,80}$/
 
 function isLoopbackHostname(hostname) {
   const value = String(hostname ?? '').trim().toLowerCase().replace(/^\[|\]$/g, '')
@@ -155,9 +153,16 @@ export function requestOriginVerdict(headers, { requireSameOrigin, allowNonLoopb
       const trustedAppShell = parsed !== null && parsed.protocol === 'dsh-app:' && parsed.hostname === 'app'
       if (trustedAppShell !== true) {
         const requestPort = portOf(read('host'))
-        const originPort = parsed === null ? '' : (parsed.port === '' ? defaultPortFor(parsed.protocol) : parsed.port)
-        const hostnameMatches = parsed !== null && parsed.hostname !== '' && sameHostname(parsed.hostname, requestHostname)
-        const portMatches = originPort !== '' && originPort === (requestPort === '' ? originPort : requestPort)
+        let hostnameMatches = false
+        let portMatches = false
+        if (parsed !== null) {
+          hostnameMatches = parsed.hostname !== '' && sameHostname(parsed.hostname, requestHostname)
+          // A missing request port falls back to the Origin's scheme default
+          // (80/443) instead of matching every Origin port.
+          const effectiveRequestPort = requestPort === '' ? defaultPortFor(parsed.protocol) : requestPort
+          const originPort = parsed.port === '' ? defaultPortFor(parsed.protocol) : parsed.port
+          portMatches = originPort !== '' && originPort === effectiveRequestPort
+        }
         if (!hostnameMatches || !portMatches) {
           return { ok: false, error: new DeleteError('E_FORBIDDEN_ORIGIN', 'The request origin does not match this Host.', { origin }) }
         }
@@ -232,6 +237,9 @@ function readJsonBody(req) {
       if (bytes > MAX_BODY_BYTES) {
         overflow = true
         chunks.length = 0
+        // Respond at once instead of draining the whole oversized body; the
+        // settled flag keeps the later `end` handler from double-settling.
+        finish(new DeleteError('E_BAD_REQUEST', 'Request body exceeds the size limit.', { limit: MAX_BODY_BYTES }, { httpStatus: 413 }))
         return
       }
       chunks.push(chunk)
@@ -355,20 +363,30 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
   const confirmations = new Map()
   let mutationChain = Promise.resolve()
   let requestCounter = 0
+  // `/trash` reads and parses every manifest on disk; a short TTL cache keeps
+  // the settings page responsive while every mutation invalidates it, so the
+  // user never sees a stale list after their own action.
+  const TRASH_CACHE_TTL_MS = 1_500
+  let trashCache = null
+  let trashCachedAt = 0
+  function invalidateTrashCache() {
+    trashCache = null
+    trashCachedAt = 0
+  }
 
   /**
    * Serialize one mutation: in-process first (so two HTTP requests never
    * interleave their transactions), then across processes (so a second Host
    * sharing this DSH_HOME cannot write the same manifest concurrently).
    */
-  function serialize(operation) {
+  function serialize(operation, { lockTimeoutMs } = {}) {
     const next = mutationChain.then(async () => {
       // The lock lives in the data dir, which a fresh install has not created
       // yet (the trash store and audit log mkdir their own targets lazily).
       await mkdir(paths.dataDir, { recursive: true }).catch(() => {})
       let release
       try {
-        release = await mutationLockInstance.acquire()
+        release = await mutationLockInstance.acquire(lockTimeoutMs === undefined ? {} : { timeoutMs: lockTimeoutMs })
       } catch (error) {
         if (error?.code === 'E_LOCK_BUSY') {
           throw new DeleteError('E_LOCK_BUSY', 'Another DSH instance is using this recycle bin; retry in a moment.', {})
@@ -502,9 +520,14 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
       if (!policy.ok) blocked.push({ sessionId: id, policy: item.policy })
     }
 
-    const memory = config.memory.enabled
-      ? await memoryService.countForSessions(sessionIds)
-      : { total: 0, bySession: Object.fromEntries(sessionIds.map((id) => [id, 0])), protected: 0, adapters: [], disabled: true }
+    // When every session is blocked there is no plan to execute, so the memory
+    // count (index reads + parsing) is skipped rather than computed for nothing.
+    const emptyMemory = { total: 0, bySession: Object.fromEntries(sessionIds.map((id) => [id, 0])), protected: 0, adapters: [] }
+    const memory = !config.memory.enabled
+      ? { ...emptyMemory, disabled: true }
+      : blocked.length === 0
+        ? await memoryService.countForSessions(sessionIds)
+        : { ...emptyMemory, skipped: true }
     const adapterStates = await memoryService.status()
     const confirmation = blocked.length === 0 ? issueConfirmation({ sessionIds, includeMemory, mode }) : null
 
@@ -608,19 +631,25 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
       })
     }
 
-    const budget = limiter.take(sessions.length)
-    if (!budget.ok) {
-      throw new DeleteError('E_RATE_LIMITED', `Too many deletions; retry in ${Math.ceil(budget.retryAfterMs / 1000)}s.`, {
-        retryAfterMs: budget.retryAfterMs,
-        limit: budget.limit,
-      })
-    }
-    markConfirmationUsed(validated)
-
+    // Budget is consumed per actually-attempted deletion: a failed item must
+    // not silently spend the minute quota it never used. The very first item
+    // still refuses outright with 429 (the existing contract); once a plan
+    // has started, later exhausted items are recorded as failures instead.
     const request = requestId()
     const results = []
     const failures = []
     for (const session of sessions) {
+      const reservation = limiter.take(1)
+      if (!reservation.ok) {
+        const rateError = new DeleteError('E_RATE_LIMITED', `Too many deletions; retry in ${Math.ceil(reservation.retryAfterMs / 1000)}s.`, {
+          retryAfterMs: reservation.retryAfterMs,
+          limit: reservation.limit,
+        })
+        if (results.length === 0 && failures.length === 0) throw rateError
+        failures.push({ sessionId: session.id, error: rateError.toJSON() })
+        break
+      }
+      if (!validated.record.used) markConfirmationUsed(validated)
       try {
         const outcome = await performSessionDelete({
           session,
@@ -644,12 +673,16 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
           durationMs: outcome.durationMs,
         })
       } catch (error) {
+        // The deletion never happened: refund the slot so a failed item does
+        // not consume the per-minute quota of a successful one.
+        reservation.release()
         const normalized = asDeleteError(error)
         failures.push({ sessionId: session.id, error: normalized.toJSON() })
         logger.error?.(`[conversation-recycle-bin] delete failed for ${session.id}: ${normalized.message}`)
       }
     }
     gateway.invalidate()
+    invalidateTrashCache()
 
     if (results.length === 0 && failures.length > 0) {
       const first = failures[0].error
@@ -664,6 +697,7 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     if (entry === null) throw new DeleteError('E_TRASH_NOT_FOUND', 'The recycle-bin entry was not found.', { trashId })
     const result = await performRestore({ entry, ops, trash, audit, now, actor: 'local-user', source: auditSource, requestId: requestId() })
     gateway.invalidate()
+    invalidateTrashCache()
     return result
   }
 
@@ -679,6 +713,7 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     // cannot be stopped within liveDrainMs, the purge fails and rolls back.
     const result = await performPurge({ entry, ops, trash, audit, now, actor: 'local-user', source: auditSource, requestId: requestId() })
     gateway.invalidate()
+    invalidateTrashCache()
     return result
   }
 
@@ -692,13 +727,40 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     if (typeof confirmPhrase !== 'string' || confirmPhrase.trim() !== 'DELETE') {
       throw new DeleteError('E_CONFIRM_PHRASE', 'Type “DELETE” to discard this incomplete entry.', { expected: 'DELETE' })
     }
-    const entry = await trash.read(trashId)
-    if (entry === null) throw new DeleteError('E_TRASH_NOT_FOUND', 'The recycle-bin entry was not found.', { trashId })
-    return performDiscard({ entry, ops, trash, audit, now, actor: 'local-user', source: auditSource, requestId: requestId() })
+    let entry = await trash.read(trashId)
+    if (entry === null) {
+      // Missing/corrupt manifest: the directory itself may still be on disk.
+      // Verify it exists, then discard against the actual payload; the disk
+      // checks inside performDiscard still refuse a folder holding a log or
+      // memory files, so a stranded directory can be cleaned without ever
+      // trusting the unreadable manifest.
+      const dir = join(paths.trashDir, trashId)
+      if (!(await ops.pathExists(dir))) {
+        throw new DeleteError('E_TRASH_NOT_FOUND', 'The recycle-bin entry was not found.', { trashId })
+      }
+      entry = {
+        trashId,
+        sessionId: null,
+        title: null,
+        mode: null,
+        includeMemory: false,
+        deletedAt: 0,
+        updatedAt: 0,
+        status: 'unreadable',
+        memory: { adapters: [], total: 0 },
+        sessionLog: null,
+        catalog: null,
+      }
+    }
+    const result = await performDiscard({ entry, ops, trash, audit, now, actor: 'local-user', source: auditSource, requestId: requestId() })
+    invalidateTrashCache()
+    return result
   }
 
   async function state() {
-    const adapters = await memoryService.status()
+    // Only wire fields the Client renders; adapter `storePath` is an absolute
+    // filesystem handle and must not leave the Host.
+    const adapters = (await memoryService.status()).map(({ id, label, available, reason }) => ({ id, label, available, reason }))
     return {
       enabled: config.enabled,
       version: PLUGIN_VERSION,
@@ -727,10 +789,12 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     // Every row carries its own policy verdict: "select all" used to include
     // subagent/orphan/out-of-root conversations that `/preview` then refuses
     // as a whole batch, leaving the user with a disabled button and no hint
-    // which row to uncheck. Soft mode is the widest verdict (hard adds only
-    // the live-session stop), so a row marked deletable here stays deletable.
+    // which row to uncheck. Judge with the configured default mode (the mode
+    // the dialog opens in): with `stopLiveSessions: false`, hard is stricter
+    // than soft for live sessions, so a fixed soft verdict would mark those
+    // rows deletable only for the server to refuse later.
     return sessions.map((session) => {
-      const verdict = evaluateSessionPolicy({ session, workspace: session.workspace, live: session.live, mode: 'soft', config })
+      const verdict = evaluateSessionPolicy({ session, workspace: session.workspace, live: session.live, mode: config.defaultMode, config })
       return {
         id: session.id,
         title: session.title,
@@ -769,14 +833,39 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
   }
 
   async function trashList() {
-    // Every manifest is returned: `trashed` entries are the usable recycle bin,
-    // while failed/pending/restoring/purging entries used to be invisible and
-    // impossible to clean up at all. The Client renders them separately.
-    const all = await trash.listAll()
-    return {
+    if (trashCache !== null && now() - trashCachedAt < TRASH_CACHE_TTL_MS) return trashCache
+    // Every readable manifest is returned: `trashed` entries are the usable
+    // recycle bin, while failed/pending/restoring/purging entries used to be
+    // invisible and impossible to clean up at all. Directories whose manifest
+    // is missing/corrupt are surfaced as `unreadable` so they are not stranded
+    // on disk; the Client renders both groups separately.
+    const [all, unreadable] = await Promise.all([trash.listAll(), trash.scanUnreadable()])
+    const result = {
       entries: all.filter((entry) => entry.status === 'trashed').map(serializeEntry),
-      incomplete: all.filter((entry) => entry.status !== 'trashed').map(serializeEntry),
+      incomplete: [
+        ...all.filter((entry) => entry.status !== 'trashed').map(serializeEntry),
+        ...unreadable.map((item) => ({
+          trashId: item.trashId,
+          sessionId: null,
+          title: null,
+          mode: null,
+          includeMemory: false,
+          deletedAt: 0,
+          updatedAt: 0,
+          memory: 0,
+          memoryAdapters: [],
+          hasSessionLog: false,
+          status: 'unreadable',
+          error: {
+            code: item.reason,
+            message: 'The manifest could not be read; discard this folder only after confirming it holds no log or memory files.',
+          },
+        })),
+      ],
     }
+    trashCache = result
+    trashCachedAt = now()
+    return result
   }
 
   async function auditTail(limit) {
@@ -823,72 +912,88 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     }
 
     try {
-        if (method === 'GET' && (path === '' || path === '/state')) {
-          sendJson(res, 200, { ok: true, state: await state() })
-          return
-        }
-        if (method === 'GET' && path === '/sessions') {
-          sendJson(res, 200, { ok: true, sessions: await sessionsForUi() })
-          return
-        }
-        if (method === 'GET' && path === '/trash') {
-          sendJson(res, 200, { ok: true, ...(await trashList()) })
-          return
-        }
-        if (method === 'GET' && path === '/audit') {
-          sendJson(res, 200, { ok: true, ...(await auditTail(url.searchParams.get('limit'))) })
-          return
-        }
-        if (method !== 'POST') {
-          throw new DeleteError('E_BAD_REQUEST', 'This endpoint accepts POST requests only.', {}, { httpStatus: 405 })
-        }
-        const header = req.headers?.[REQUIRED_HEADER]
-        if (header !== '1') {
-          throw new DeleteError('E_FORBIDDEN_ORIGIN', 'Missing the plugin request header.', {})
-        }
-        if (!config.enabled && path !== '/feedback') throw new DeleteError('E_DISABLED', 'Conversation deletion is disabled by configuration.', {})
-        const body = await readJsonBody(req)
-
-        // Feedback is available even when deletion is switched off: the two
-        // switches answer different questions, and a broken mail transport
-        // must not be reported as "deletion disabled".
-        if (path === '/feedback') {
-          const result = await feedbackService.submit(body)
-          sendJson(res, 200, { ok: true, ...result })
-          return
-        }
+      if (method === 'GET' && (path === '' || path === '/state')) {
+        sendJson(res, 200, { ok: true, state: await state() })
+        return
+      }
+      if (method === 'GET' && path === '/sessions') {
+        sendJson(res, 200, { ok: true, sessions: await sessionsForUi() })
+        return
+      }
+      if (method === 'GET' && path === '/trash') {
+        sendJson(res, 200, { ok: true, ...(await trashList()) })
+        return
+      }
+      if (method === 'GET' && path === '/audit') {
+        sendJson(res, 200, { ok: true, ...(await auditTail(url.searchParams.get('limit'))) })
+        return
+      }
+      // A GET that matched no route is an unknown endpoint (404), not a 405:
+      // 405 is reserved for non-POST verbs on a mounted prefix.
+      if (method === 'GET') {
+        throw new DeleteError('E_NOT_FOUND', 'Unknown endpoint.', { path: path.slice(0, 120) })
+      }
+      if (method !== 'POST') {
+        throw new DeleteError('E_BAD_REQUEST', 'This endpoint accepts POST requests only.', {}, { httpStatus: 405 })
+      }
+      const header = req.headers?.[REQUIRED_HEADER]
+      if (header !== '1') {
+        throw new DeleteError('E_FORBIDDEN_ORIGIN', 'Missing the plugin request header.', {})
+      }
+      if (!config.enabled && path !== '/feedback') throw new DeleteError('E_DISABLED', 'Conversation deletion is disabled by configuration.', {})
+      const body = await readJsonBody(req)
 
-        if (path === '/preview') {
-          const sessionIds = normalizeSessionIds(body)
-          const mode = normalizeMode(body, config)
-          const includeMemory = normalizeBoolean(body, 'includeMemory')
-          sendJson(res, 200, { ok: true, preview: await preview({ sessionIds, includeMemory, mode }) })
-          return
-        }
-        if (path === '/delete') {
-          const result = await serialize(() => deletePlan(body))
-          // `ok` means "the plan was executed", not "every item succeeded".
-          // A partial batch carries `results` + `failures`; marking the whole
-          // response as an error hid those results and made the Client show
-          // "The Host refused the request" while rows had already been deleted.
-          sendJson(res, 200, { ok: true, partial: result.failures.length > 0, ...result })
-          return
-        }
-        if (path === '/trash/restore') {
-          const result = await serialize(() => restoreEntry(body?.trashId))
-          sendJson(res, 200, { ok: true, ...result })
-          return
-        }
-        if (path === '/trash/purge') {
-          const result = await serialize(() => purgeEntry(body?.trashId, body?.confirmPhrase))
-          sendJson(res, 200, { ok: true, ...result })
-          return
-        }
-        if (path === '/trash/discard') {
-          const result = await serialize(() => discardEntry(body?.trashId, body?.confirmPhrase))
-          sendJson(res, 200, { ok: true, ...result })
-          return
-        }
+      // Feedback is available even when deletion is switched off: the two
+      // switches answer different questions, and a broken mail transport
+      // must not be reported as "deletion disabled".
+      if (path === '/feedback') {
+        const result = await feedbackService.submit(body)
+        sendJson(res, 200, { ok: true, ...result })
+        return
+      }
+
+      if (path === '/preview') {
+        const sessionIds = normalizeSessionIds(body)
+        const mode = normalizeMode(body, config)
+        const includeMemory = normalizeBoolean(body, 'includeMemory')
+        sendJson(res, 200, { ok: true, preview: await preview({ sessionIds, includeMemory, mode }) })
+        return
+      }
+      if (path === '/delete') {
+        // Upper-bound lock wait mirroring preview's planTimeoutMs: a 50-item
+        // batch legitimately outlives the default 30s, so a second Host waiting
+        // on the lock should not be told "busy" while the first is still
+        // working. Per-session export/restore plus a bounded live drain each.
+        const rawIds = Array.isArray(body?.sessionIds)
+          ? body.sessionIds
+          : typeof body?.sessionId === 'string'
+            ? [body.sessionId]
+            : []
+        const batchCount = Math.max(1, rawIds.length)
+        const lockBudget = Math.min(900_000, 15_000 + batchCount * 16_000 + batchCount * config.liveDrainMs)
+        const result = await serialize(() => deletePlan(body), { lockTimeoutMs: lockBudget })
+        // `ok` means "the plan was executed", not "every item succeeded".
+        // A partial batch carries `results` + `failures`; marking the whole
+        // response as an error hid those results and made the Client show
+        // "The Host refused the request" while rows had already been deleted.
+        sendJson(res, 200, { ok: true, partial: result.failures.length > 0, ...result })
+        return
+      }
+      if (path === '/trash/restore') {
+        const result = await serialize(() => restoreEntry(body?.trashId))
+        sendJson(res, 200, { ok: true, ...result })
+        return
+      }
+      if (path === '/trash/purge') {
+        const result = await serialize(() => purgeEntry(body?.trashId, body?.confirmPhrase))
+        sendJson(res, 200, { ok: true, ...result })
+        return
+      }
+      if (path === '/trash/discard') {
+        const result = await serialize(() => discardEntry(body?.trashId, body?.confirmPhrase))
+        sendJson(res, 200, { ok: true, ...result })
+        return
+      }
       throw new DeleteError('E_NOT_FOUND', 'Unknown endpoint.', { path: path.slice(0, 120) })
     } catch (error) {
       const normalized = asDeleteError(error)

package/lib/host/feedback.js

@@ -321,7 +321,16 @@ export function createFeedbackService({ config, env = process.env, now = Date.no
         retryAfterMs: Math.max(0, windowMs - (now() - deliveries[0])),
       })
     }
-    deliveries.push(now())
+    const stamp = now()
+    deliveries.push(stamp)
+    // A transport failure must not spend the hourly quota: the caller can
+    // release the slot instead of locking the visitor out for an hour.
+    return {
+      release() {
+        const at = deliveries.indexOf(stamp)
+        if (at !== -1) deliveries.splice(at, 1)
+      },
+    }
   }
 
   async function deliverHttp(message, submission) {
@@ -404,13 +413,16 @@ export function createFeedbackService({ config, env = process.env, now = Date.no
         reason: settings.reason,
       })
     }
-    takeSlot()
+    const slot = takeSlot()
     const message = renderFeedbackMessage(submission, { at: now() })
     const startedAt = now()
     try {
       if (settings.transport === 'http') await deliverHttp(message, submission)
       else await deliverSmtp(message, submission)
     } catch (error) {
+      // A failed delivery refunds the slot: a temporary provider outage must
+      // not consume the hourly cap and lock the visitor out for an hour.
+      slot.release()
       const normalized = error instanceof DeleteError
         ? error
         : new DeleteError('E_FEEDBACK_TRANSPORT', 'The feedback message could not be delivered.', {

package/lib/host/gateway.js

@@ -16,6 +16,7 @@
 import { findSessionDir, readJsonFile } from './paths.js'
 import { join } from 'node:path'
 import { isPathInside } from '../core/policy.js'
+import { SESSION_ID_PATTERN } from '../core/ids.js'
 
 const LIST_TTL_MS = 1_500
 const STATE_TTL_MS = 1_500
@@ -177,6 +178,30 @@ export function createSessionGateway({ ctx, paths, now = Date.now }) {
     }
   }
 
+  /**
+   * Lightweight running probe for the bounded drain: reads only the in-memory
+   * live-sessions table instead of rebuilding the whole session list on every
+   * poll. Returns `undefined` when the service is absent or the entry shape is
+   * unknown, so the caller falls back to a full `inspect()`.
+   * @returns {boolean|undefined}
+   */
+  function probeRunning(sessionId) {
+    const sessions = service('sessions')
+    if (sessions === undefined || typeof sessions.get !== 'function') return undefined
+    let current
+    try {
+      current = sessions.get(sessionId)
+    } catch {
+      return undefined
+    }
+    if (current === null || current === undefined) return false
+    if (typeof current !== 'object') return undefined
+    if (typeof current.running === 'boolean') return current.running
+    if (typeof current.active === 'boolean') return current.active
+    if (typeof current.busy === 'boolean') return current.busy
+    return undefined
+  }
+
   async function workspaceFor(session) {
     const workspaces = await workspaceEntities()
     const byId = workspaces.find((workspace) => workspace.id === session.workspaceId)
@@ -193,10 +218,11 @@ export function createSessionGateway({ ctx, paths, now = Date.now }) {
   return {
     workspaceState: readWorkspaceState,
     list: loadList,
+    isRunning: probeRunning,
 
     /** Normalize one session; throws E_NOT_FOUND-shaped data as `null`. */
     async inspect(sessionId) {
-      if (typeof sessionId !== 'string' || !/^[A-Za-z0-9._-]{6,80}$/.test(sessionId)) return null
+      if (typeof sessionId !== 'string' || !SESSION_ID_PATTERN.test(sessionId)) return null
       const persistence = service('sessionPersistence')
       let snapshot
       if (persistence !== undefined && typeof persistence.stat === 'function') {

package/lib/host/lifecycle.js

@@ -34,6 +34,12 @@ export function createLifecycleOps({ ctx, gateway, config, now = Date.now, delay
   }
 
   async function inspectRunning(sessionId) {
+    // Cheap path: read the in-memory live table without invalidating and
+    // rebuilding the whole session list on every poll. Only fall back to a
+    // full inspect when the probe cannot answer (absent service, unknown shape).
+    const raw = typeof gateway.isRunning === 'function' ? gateway.isRunning(sessionId) : undefined
+    const probe = raw instanceof Promise ? await raw : raw
+    if (probe !== undefined) return probe === true
     gateway.invalidate()
     const current = await gateway.inspect(sessionId)
     return current !== null && current.running === true

package/lib/version.js

@@ -5,4 +5,4 @@
  * asserted against it by `test/manifest.test.mjs` so the two can never drift
  * (they did: the constant stayed at 0.1.0 while the package reached 0.1.4).
  */
-export const PLUGIN_VERSION = '0.3.2'
+export const PLUGIN_VERSION = '0.3.3'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-conversation-recycle-bin",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "DSH conversation deletion with an optional, previewed cascade into conversation-associated memory: soft delete + recycle bin, audit trail, batch rate limits and per-session rollback. 删除对话（可选一并删除关联记忆）：软删除与回收站、审计留痕、批量限流、失败回滚。",
   "repository": {
     "type": "git",
@@ -57,7 +57,7 @@
   },
   "scripts": {
     "test": "node test/manifest.test.mjs && node test/client-module.test.mjs && node test/core.test.mjs && node test/cascade.test.mjs && node test/memory.test.mjs && node test/trash-audit.test.mjs && node test/feedback.test.mjs && node test/api.test.mjs",
-    "check": "node --check lib/index.js && node --check lib/host/feedback.js && node --check client.js && node test/manifest.test.mjs"
+    "check": "node scripts/check-syntax.mjs && node test/manifest.test.mjs"
   },
   "dsh": {
     "manifestVersion": 1,