dsh-conversation-recycle-bin 0.3.21 → 0.3.22

package/CHANGELOG.md

@@ -3,6 +3,32 @@
 All notable changes to `dsh-conversation-recycle-bin` are documented here.
 The format follows Keep a Changelog; the project uses Semantic Versioning.
 
+## [0.3.22] — 2026-11-12
+
+对**当前最新宿���**（`@deepseek-ai/dsh-desktop-runtime` **0.2.2-rc.1**，桌面端与 `dsh web` 共用）的三方只读评审（架构 / 安全 / 验收）之后的修复。评审结论是「宿主契约没有硬断裂，但有一处安装门禁错误、一处标题优先级倒置、一处脱敏缺口」；本版把这四项 P0 与两项 P1 全部闭合，并给出一条可复核的运行态探针。
+
+### Fixed
+
+- **`engines.dsh` 匹配不了当前宿主**（评审 H1）：按 semver 预发布规则，区间 `>=0.2.1-rc.2 <0.3.0-0` 的比较器元组是 0.2.1 与 0.3.0，而候选是 `0.2.2-rc.1` —— **没有任何 `0.2.2` 元组带预发布**，因此不满足，全新的 `npm i` 会被引擎门禁拒绝（本机只因 `link:` 安装而照跑）。range 现补上 `|| >=0.2.2-0 <0.3.0-0`。
+- **标题来源优先级倒置**（评审 H2）：旧整表 `storages/session_projcache.json`（实测 `unit.version: 3`，宿主早已停写）被无条件当作标题源，权威 per-record 检查点只在「标题为空」时兜底。后果是**迁移之后改过名的会话永远显示迁移时的旧标题**。现在 per-record 是唯一权威（对每行都读），旧整表只填空缺，且受 `unit.version === 3` 版本钉约束（未知版本跳过并记诊断）。
+- **`version !== 7` 的一刀切被换成能力探测**（评审 R1/T1）：宿主把投影版本从 7 提到 8、但字段形状不变时，旧逻辑让**每一行都丢掉标题**，而 `test/contract.test.mjs` 把「v8 → 空标题」断言成了期望行为，于是真漂移也不会红。现在按实际字段（`rows.title.val` / `rows.sessionListMetadata.val`）探测：形状对就照读并计入 `diagnostics.projection.foreignVersion`，形状不对才降级并计入 `malformed`。
+- **`/state` 把 adapter 原始异常原样回传**（评审 S1）：`reason` 直接来自 `error.message`（ENOENT/EPERM 会带绝对路径），而 `/state` 是**成功响应**、从未过 `redactDetails`，且在没有 `connection` 服务时经 `isStateProbe` **免鉴权**返回 —— 与插件自述「路径不跨 HTTP 边界」直接冲突。现在整个 `/state` 载荷在出口过 `redactDetails`。
+- **`verify-host-contract.mjs` 会假通过**（评审 M4）：判据是 HTML 里出现包名字符串，而包名本来就是 profile 依赖键；默认端口还写死 3082。现在判据改为 `state.version` + `state.limits` 形状，端口取自参数或 `$DSH_WEB_URL`，并新增一条投影格式诊断断言。
+
+### Added
+
+- **`requireOwnerPeer`（默认 false）**：`requestRejection` 只回答「认证与否」，而当前宿主还能认证**非 owner peer**（远程访问授权）。一旦为反向代理/隧道配置了 `allowedHosts`，这种 peer 就能删会话、purge 回收站。开启后插件向 connection 层索取 principal，非 owner 一律 403 `E_FORBIDDEN_PRINCIPAL`，拿不到 principal 也拒绝（`E_PEER_UNKNOWN`，fail-closed）；关闭时行为与 0.3.21 完全一致。
+- **`/state.diagnostics`**：`{ projection: { total, foreignVersion, malformed, unreadable }, legacyTitles }`，让「标题为什么没了」变成可观测数据，而不是空白行。
+
+### Docs
+
+- README 安全声明补三条红线：`allowedHosts` 只用于**已知**代理且建议同时开 `requireOwnerPeer`；桌面端壳会替 renderer 注入 cookie 并转发任意路径，故 UI 内任意脚本（含第三方插件）与面板同权；`dsh-app://app` origin 豁免在当前宿主已不可达（桌面壳改用 `http://127.0.0.1:port`），保留分支纯属纵深防御。
+- 评审记录：本版未因评审而改变的两个设计取舍 —— hard 模式批量删除不需要短语（既有文档化行为，soft 批量才需要）、`/sessions` 仍返回 `cwd`（Client 用于显示；仅在对外暴露时才有意义）。
+
+### Tests
+
+- 用例 221 → **229**：新增 v8-字段不变仍出标题、字段改名降级且计数、旧整表未知版本跳过、per-record 压过旧标题、旧表仍能为「无检查点」的行兜底、`/state` 路径脱敏 + diagnostics、`requireOwnerPeer` 四态（非 owner 403 / owner 200 / 无 principal 503 / 默认关不改变行为）。
+
 ## [0.3.21] — 2026-11-09
 
 CI 第一次真正跑起来就抓到一条**只在中文机器上通过**的用例。0.3.20 发布后推送仓库，四个矩阵任务（ubuntu/windows × Node 22.15/24）全部在 `npm test` 阶段失败，失败点相同。

package/README.md

@@ -2,7 +2,7 @@
 
 给 DeepSeek Harness (DSH) Web 增加「删除对话」：会话列表的「…」菜单与会话详情页头部各有一个删除入口；确认框内可勾选「同时删除关联记忆」（默认不勾选），并实时显示将被影响的记忆条数。删除默认进入插件回收站，可恢复；每次操作写入审计日志；批量删除有上限与限流，批量软删除需输入数量，彻底删除一键执行；事务任一步失败即回滚。
 
-> 状态：`0.3.21`，Host + Web Client 双半，零构建（plain JS ESM），只依赖宿主已发布的公开扩展点。
+> 状态：`0.3.22`，Host + Web Client 双半，零构建（plain JS ESM），只依赖宿主已发布的公开扩展点。
 > 运行要求：**Node.js ≥ 22.15**（Host 侧用到 `readdir(..., { recursive: true })`、`AbortSignal` 等 22.x 行为），DSH `>=0.2.1-rc.2 <0.3.0-0`（`package.json` 的 `engines.dsh` 已如实声明，DSH 安装校验会据此拒绝范围外版本；上界是刻意的：0.2.2 与 0.3.x 之间没有承诺兼容）。
 > 包名：`dsh-conversation-recycle-bin`（原 `dsh-delete-conversation` 因 npm 被他人占用而改名，见 CHANGELOG 0.2.0）。
 > 本 README 同时是设计说明与验收依据；安装/回滚步骤见 [INSTALL.md](INSTALL.md)；变更见 [CHANGELOG.md](CHANGELOG.md)。
@@ -126,6 +126,10 @@ memory  →  messages  →  session/catalog
 
 反代部署（`dsh web --public-url https://host/ui/`）时，代理会把外部主机名放进 `Host`，插件的回环校验会以 `E_FORBIDDEN_HOST` 拒绝。用 `allowedHosts` 精确放行，而不是把 `allowNonLoopback` 整体打开：
 
+> **红线（0.3.22 起）**：`allowedHosts` 只用于**已知**的反向代理。当前宿主会认证**非 owner peer**（远程访问授权），而 `requestRejection` 只回答「认证与否」；一旦把本路由经代理/隧道暴露出去，这种 peer 也能删除会话。对外暴露时**同时打开 `requireOwnerPeer: true`**（插件会向 connection 层索取 principal，非 owner 与「取不到 principal」一律拒绝）。
+>
+> 另两条边界：桌面端壳会把宿主 cookie 注入 renderer 并向本路由转发任意路径，因此**UI 内的任意脚本（含第三方 UI 插件）与面板同权**；`dsh-app://app` 的 origin 豁免在当前宿主已不可达（桌面壳改用 `http://127.0.0.1:<port>` 开窗），保留该分支只是纵深防御。
+
 | 配置 | 匹配 | 说明 |
 |---|---|---|
 | `allowedHosts: ["app.example"]` | 该主机的任意端口 | 端口在代理侧固定时更宽松 |
@@ -162,6 +166,7 @@ memory  →  messages  →  session/catalog
 | `requireConnection` | `true` | 必须拿到宿主的 `connection.requestRejection` 才接受路由，否则一律 401 `E_UNAUTHORIZED`。见 §4.2 最后一行。 |
 | `requireSameOrigin` | `true` | 校验 `Origin`/`Sec-Fetch-Site`。 |
 | `allowNonLoopback` | `false` | 跳过 Host 回环校验。**打开它会让 `allowedHosts` 失效**，只在完全信任本机所有进程时使用。 |
+| `requireOwnerPeer` | `false` | 仅宿主所有者可执行破坏性路由。需要对外暴露（代理/隧道）时打开；开启后非 owner 与「取不到 principal」都会被拒绝（fail-closed）。 |
 | `allowedHosts` | `[]` | 反代/自定义主机名白名单（`host` 或 `host:port`，最多 32 条）。暴露到 loopback 之外应只配置这一项。 |
 | `allowOrphanSessions` | `false` | 允许删除未登记到任何工作区的会话（默认按 `E_POLICY_ORPHAN` 拒绝）。 |
 | `allowSubagentSessions` | `false` | 允许删除子代理会话（默认按 `E_POLICY_SUBAGENT` 拒绝，避免拆掉正在工作的子会话）。 |

package/client.js

@@ -222,12 +222,13 @@ window.__ModuleLoader__.load({
         'error.E_TRASH_CONFLICT': 'The entry is still in use (for example it still holds a conversation log) or its state does not allow this action.',
         'error.E_CONFIRM_REQUIRED': 'Reload the dialog and confirm again.',
         'error.E_FORBIDDEN_HOST': 'The Host only accepts deletion requests from loopback; set allowNonLoopback for remote access.',
-        'error.E_FORBIDDEN_ORIGIN': 'The Host rejected this page as an untrusted origin.',
-        'error.E_POLICY_FOREIGN_WRITER': 'Another DSH instance is still writing this conversation; close it there and retry.',
+        'error.E_FORBIDDEN_ORIGIN': 'The Host rejected this page as an untrusted origin.',        'error.E_POLICY_FOREIGN_WRITER': 'Another DSH instance is still writing this conversation; close it there and retry.',
         'error.E_LOCK_BUSY': 'Another DSH instance is using this recycle bin; retry in a moment.',
         'error.E_QUEUE_TIMEOUT': 'The Host was still busy with another change, so this request was not applied. Retry in a moment.',
         'error.E_ABANDONED': 'The page gave up waiting before the Host started; nothing was changed. Retry.',
         'error.E_UNAUTHORIZED': 'This request is not authenticated with the Host.',
+        'error.E_FORBIDDEN_PRINCIPAL': 'Only the Host owner may delete conversations on this deployment.',
+        'error.E_PEER_UNKNOWN': 'This Host cannot report who is asking, so owner-only mode refused the request.',
         'dialog.inlineHint': 'This window has no overlay slot (dsh-go native UI), so the confirmation is shown here instead of in a popup.',
         'adapter.lingshu': 'Lingshu cognitive graph (md_cg)',
         'adapter.generic-json': 'Generic JSON memory store',
@@ -400,6 +401,8 @@ window.__ModuleLoader__.load({
         'error.E_QUEUE_TIMEOUT': '宿主还在处理另一个变更，这次请求没有执行，请稍后重试。',
         'error.E_ABANDONED': '页面在宿主开始处理前就放弃了等待，本次没有做任何改动，请重试。',
         'error.E_UNAUTHORIZED': '该请求未通过宿主的鉴权。',
+        'error.E_FORBIDDEN_PRINCIPAL': '该部署只允许宿主所有者删除对话。',
+        'error.E_PEER_UNKNOWN': '宿主无法报告请求方身份，仅所有者模式拒绝了该请求。',
         'dialog.inlineHint': '当前窗口没有 overlay 槽位（dsh-go 原生界面），确认框直接显示在这里。',
         'adapter.lingshu': '灵枢认知图 (md_cg)',
         'adapter.generic-json': '通用 JSON 记忆存储',

package/config.schema.json

@@ -10,6 +10,7 @@
     "requireSameOrigin": { "type": "boolean", "default": true, "description": "Reject requests whose Origin does not match the request's full authority (hostname AND effective port; a missing port defaults by the Origin's own scheme). The desktop shell source dsh-app://app is trusted, matching DSH's own fence." },
     "requireConnection": { "type": "boolean", "default": true, "description": "Refuse requests when the Host exposes no `connection` service. The loopback/origin fence cannot tell two local processes apart, so without a connection layer any process on this machine could delete a conversation. Set false only for a trusted composition that has no connection service." },
     "allowNonLoopback": { "type": "boolean", "default": false, "description": "Allow requests from any authority, not just loopback. Prefer allowedHosts when a reverse proxy presents a known hostname." },
+    "requireOwnerPeer": { "type": "boolean", "default": false, "description": "Owner-only mode for destructive routes. `requestRejection` only answers authenticated-or-not; a Host that authenticates non-owner peers (remote-access grants) would otherwise let them delete conversations once this route is exposed through a proxy (allowedHosts). When true, the plugin asks the connection layer for the requesting principal and refuses anything that is not the owner — including an unknown principal (fail-closed). Leave false on a loopback-only deployment." },
     "allowedHosts": {
       "type": "array", "items": { "type": "string" }, "maxItems": 32, "default": [],
       "description": "Authorities a prefix-stripping reverse proxy may present in Host (host, host:port, or [v6]:port). A bare host admits any port; an entry with a port admits only that port. Entries with a scheme, path, userinfo or wildcard are dropped. Empty = loopback only."

package/cordis.patch.yml

@@ -28,6 +28,13 @@
         # every key the contract has.
         requireConnection: true
         allowNonLoopback: false
+        # Owner-only mode. `requestRejection` answers authenticated-or-not only;
+        # a Host that authenticates non-owner peers (remote-access grants) would
+        # otherwise let them delete conversations once this route is exposed
+        # through a proxy. When true the plugin asks the connection layer for the
+        # principal and refuses anything that is not the owner — including an
+        # unknown principal (fail-closed). Keep false on loopback-only setups.
+        requireOwnerPeer: false
         # Reverse-proxy deployments: list the exact authorities the proxy puts
         # in `Host` (host, host:port). A bare host admits any port. Listing them
         # is narrower than turning allowNonLoopback on for every hostname.

package/lib/core/config.js

@@ -19,6 +19,9 @@ export const DEFAULTS = deepFreeze({
   // connection service and is trusted end to end.
   requireConnection: true,
   allowNonLoopback: false,
+  // Only the Host owner may run destructive routes. Opt-in because the peer
+  // principal shape is host-version specific; when on, "cannot tell" refuses.
+  requireOwnerPeer: false,
   // Exact authorities a prefix-stripping reverse proxy may present in `Host`
   // (`app.example`, `app.example:8443`, `[::1]:8443`). Empty = loopback only.
   // This exists so an operator behind a proxy does not have to switch
@@ -276,6 +279,7 @@ export function normalizeConfig(raw) {
     requireSameOrigin: readBool(source.requireSameOrigin, DEFAULTS.requireSameOrigin, 'requireSameOrigin', warnings),
     requireConnection: readBool(source.requireConnection, DEFAULTS.requireConnection, 'requireConnection', warnings),
     allowNonLoopback: readBool(source.allowNonLoopback, DEFAULTS.allowNonLoopback, 'allowNonLoopback', warnings),
+    requireOwnerPeer: readBool(source.requireOwnerPeer, DEFAULTS.requireOwnerPeer, 'requireOwnerPeer', warnings),
     allowedHosts: readHostList(source.allowedHosts, 'allowedHosts', warnings),
     allowOrphanSessions: readBool(source.allowOrphanSessions, DEFAULTS.allowOrphanSessions, 'allowOrphanSessions', warnings),
     allowSubagentSessions: readBool(source.allowSubagentSessions, DEFAULTS.allowSubagentSessions, 'allowSubagentSessions', warnings),

package/lib/core/errors.js

@@ -12,6 +12,10 @@ export const ERROR_STATUS = Object.freeze({
   E_DISABLED: 503,
   E_FORBIDDEN_ORIGIN: 403,
   E_FORBIDDEN_HOST: 403,
+  // Owner-only mode (`requireOwnerPeer`): an authenticated peer that is not the
+  // Host owner, and a peer whose principal the Host cannot report.
+  E_FORBIDDEN_PRINCIPAL: 403,
+  E_PEER_UNKNOWN: 503,
   E_UNAUTHORIZED: 401,
   E_BAD_REQUEST: 400,
   E_NOT_FOUND: 404,

package/lib/core/redact.js

@@ -60,7 +60,11 @@ export function redactDetails(value) {
       result[key] = typeof item === 'string' ? redactText(item) : redactDetails(item)
       continue
     }
-    result[key] = typeof item === 'string' ? item : redactDetails(item)
+    // Every other string is redacted too. Only path-like substrings change, so
+    // this cannot alter a code, an id or a count — and it is what makes a
+    // diagnostic field like `reason` (the adapter's raw error text) safe
+    // without every caller having to know the redactor's key list.
+    result[key] = typeof item === 'string' ? redactText(item) : redactDetails(item)
   }
   return result
 }

package/lib/host/api.js

@@ -1077,8 +1077,17 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
   async function state() {
     // Only wire fields the Client renders; adapter `storePath` is an absolute
     // filesystem handle and must not leave the Host.
+    //
+    // `reason` is the adapter's own diagnostic text and it is the one field
+    // here that can carry a path: an unreadable index surfaces as
+    // `ENOENT … C:\Users\<name>\.dsh\…`, or as EPERM/EBUSY with the file in
+    // the message. `/state` is a SUCCESS response, so it never passed through
+    // `redactDetails` — the plugin's own contract ("Host paths are redacted
+    // before crossing HTTP") was violated exactly on the route that is readable
+    // without a connection fence. Redact the whole payload at the boundary.
     const adapters = (await memoryService.status()).map(({ id, label, available, reason }) => ({ id, label, available, reason }))
-    return {
+    const diagnostics = gateway.diagnostics()
+    return redactDetails({
       enabled: config.enabled,
       version: PLUGIN_VERSION,
       // The Client cannot tell a broken deployment from a broken permission
@@ -1102,9 +1111,13 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
         // instead of using its generic request timeout.
         queueTimeoutMs: queueBudgetFor(TRASH_LOCK_BUDGET_MS),
       },
+      // Why a title may be missing, without exposing a path: the counts and the
+      // legacy-table verdict let the Client say "the Host's projection format
+      // changed" instead of silently showing blank rows.
+      diagnostics,
       ui: config.ui,
       feedback: feedbackService.status(),
-    }
+    })
   }
 
   async function sessionsForUi() {
@@ -1458,6 +1471,51 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     return connection !== undefined && typeof connection.requestRejection === 'function'
   }
 
+  /**
+   * Owner-only gate for destructive routes (`requireOwnerPeer: true`).
+   *
+   * `requestRejection` answers authenticated-or-not; it says nothing about
+   * WHICH peer authenticated. Current Hosts can authenticate non-owner peers
+   * (remote-access grants), so a deployment that exposes this route through a
+   * reverse proxy (`allowedHosts`) would let such a peer delete conversations.
+   *
+   * The principal shape is host-version specific and could not be verified on
+   * a live proxied deployment, so this gate is opt-in and fails CLOSED when it
+   * is on: "I cannot tell who you are" is a refusal for a delete, not a pass.
+   * With the flag off (the default) behaviour is exactly as before.
+   * @returns {Promise<{ ok: true } | { ok: false, status: number, code: string, message: string }>}
+   */
+  async function ownerPeerVerdict(connection, req) {
+    const admit = connection?.admit
+    if (typeof admit !== 'function') {
+      return {
+        ok: false,
+        status: 503,
+        code: 'E_PEER_UNKNOWN',
+        message: 'This Host does not report the requesting principal; owner-only mode refuses the request.',
+      }
+    }
+    let peer
+    try {
+      peer = await admit.call(connection, req)
+    } catch (error) {
+      logger.error?.('[conversation-recycle-bin] principal check failed:', error)
+      return { ok: false, status: 503, code: 'E_PEER_UNKNOWN', message: 'The Host could not report the requesting principal.' }
+    }
+    const principal = peer?.principal ?? peer
+    const kind = typeof principal?.kind === 'string' ? principal.kind : typeof principal?.type === 'string' ? principal.type : null
+    if (kind === null) {
+      return { ok: false, status: 503, code: 'E_PEER_UNKNOWN', message: 'The Host returned no principal kind for this request.' }
+    }
+    if (kind === 'owner') return { ok: true }
+    return {
+      ok: false,
+      status: 403,
+      code: 'E_FORBIDDEN_PRINCIPAL',
+      message: 'Only the Host owner may delete conversations on this deployment.',
+    }
+  }
+
   /** `/state` (or the bare prefix) as a GET — the only route readable without a connection fence. */
   function isStateProbe(req) {
     if (String(req.method ?? 'GET').toUpperCase() !== 'GET') return false
@@ -1657,6 +1715,18 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
           sendJson(res, 503, toWireError(new DeleteError('E_INTERNAL', 'The Host could not verify this request.', { verdict: rejection })))
           return
         }
+        // `requestRejection` only answers "authenticated or not". Current Hosts
+        // also authenticate non-owner peers (remote-access grants), which is
+        // enough for a proxy exposing this route through `allowedHosts` to let
+        // such a peer delete conversations. Opt-in, and fail-closed when on.
+        if (config.requireOwnerPeer === true) {
+          const principal = await ownerPeerVerdict(connection, req)
+          if (!principal.ok) {
+            logger.warn?.(`[conversation-recycle-bin] owner-only mode refused ${principal.code}`)
+            sendJson(res, principal.status, toWireError(new DeleteError(principal.code, principal.message, {})))
+            return
+          }
+        }
       }
       const run = () => handleRequest(req, res)
       if (typeof ctx.waterfall === 'function') {

package/lib/host/gateway.js

@@ -20,6 +20,10 @@ import { SESSION_ID_PATTERN } from '../core/ids.js'
 
 const LIST_TTL_MS = 1_500
 const STATE_TTL_MS = 1_500
+/** The per-record projection format this plugin was written against. */
+const PROJECTION_VERSION = 7
+/** `unit.version` of the legacy bulk title table that `readTitles` trusts. */
+const LEGACY_TITLES_VERSION = 3
 
 export function createSessionGateway({ ctx, paths, now = Date.now, logger = console }) {
   let listCache = null
@@ -33,6 +37,14 @@ export function createSessionGateway({ ctx, paths, now = Date.now, logger = cons
   let listGeneration = 0
   let stateCache = null
   let stateCachedAt = -Infinity
+  /**
+   * Why a row has no title must be visible, not silent: the previous
+   * `version !== 7 → null` rule turned a Host format bump into "every
+   * conversation is untitled" with no signal anywhere. These counters are
+   * reset per list build and published through `diagnostics()`.
+   */
+  let projectionStats = { total: 0, foreignVersion: 0, malformed: 0, unreadable: 0 }
+  let legacyTitles = 'unknown'
 
   const service = (name) => {
     try {
@@ -60,54 +72,101 @@ export function createSessionGateway({ ctx, paths, now = Date.now, logger = cons
   }
 
   /**
-   * Legacy bulk title table (`storages/session_projcache.json`). Host 0.2.2+
-   * no longer writes it — the per-session files are authoritative — so this is
-   * a compatibility read for older layouts only and an empty map is the normal
-   * outcome. Missing titles are filled from the per-session projection in
-   * `loadList`.
+   * Legacy bulk title table (`storages/session_projcache.json`).
+   *
+   * Host 0.2.2+ stopped writing it when per-record checkpoints arrived, so the
+   * per-session files are authoritative and this table is a compatibility read
+   * for older layouts. Two rules keep it from becoming a source of stale data:
+   *
+   *   - it is VERSION-PINNED (`unit.version`), because the row semantics are
+   *     what that number describes. The observed file is `unit.version: 3`;
+   *     anything else is skipped with a diagnostic instead of trusted;
+   *   - it never outranks a per-record checkpoint — `buildList` asks for the
+   *     bulk table only to fill rows the authoritative read could not resolve.
+   *
+   * Reading it unconditionally (pre-0.3.22) meant a conversation renamed after
+   * the migration kept showing its migration-era title forever.
    */
   async function readTitles() {
     try {
       const document = await readJsonFile(paths.projectionCacheFile)
+      const version = document?.unit?.version
+      if (version !== LEGACY_TITLES_VERSION) {
+        legacyTitles = version === undefined ? 'no-version' : `v${String(version)}`
+        return new Map()
+      }
       const sessions = document?.tables?.sessions
-      if (sessions === null || typeof sessions !== 'object') return new Map()
+      if (sessions === null || typeof sessions !== 'object') {
+        legacyTitles = 'v3'
+        return new Map()
+      }
       const map = new Map()
       for (const [sessionId, record] of Object.entries(sessions)) {
         const title = record?.rows?.title?.val
         const blank = record?.rows?.sessionListMetadata?.val?.blank
-        map.set(sessionId, { title: typeof title === 'string' ? title : '', blank: blank === true })
+        map.set(sessionId, {
+          title: typeof title === 'string' ? title : '',
+          blank: blank === true,
+          createdAt: typeof record?.identity?.createdAt === 'number' ? record.identity.createdAt : null,
+        })
       }
+      legacyTitles = 'v3'
       return map
-    } catch {
+    } catch (error) {
+      legacyTitles = error?.code === 'ENOENT' ? 'absent' : 'unreadable'
       return new Map()
     }
   }
 
   /**
    * The authoritative projection checkpoint is the per-session file
-   * (`storages/session_projcache/sessions/<id>.json`, format version 7); the
-   * root `session_projcache.json` is a legacy domain dump and is intentionally
-   * only a bulk fallback.
+   * (`storages/session_projcache/sessions/<id>.json`).
+   *
+   * 0.3.22 replaced the `version === 7` equality with a capability check. The
+   * old gate had two failure modes, both silent: a Host that bumped the format
+   * while keeping these fields cost every row its title, and the test suite had
+   * baked that degradation in as the EXPECTED result (so CI stayed green). The
+   * fields the plugin actually reads are self-describing (`rows.title.val`,
+   * `rows.sessionListMetadata.val`), so they are checked directly; an
+   * unexpected version that STILL satisfies the shape is read and counted in
+   * the diagnostics, while a shape mismatch degrades to "no projection".
    */
   async function readSessionProjection(sessionId) {
     const file = join(paths.storagesDir, 'session_projcache', 'sessions', `${sessionId}.json`)
+    let document
     try {
-      const document = await readJsonFile(file)
-      // Pin the format. A Host that bumps the projection version usually keeps
-      // field names that LOOK compatible while meaning something else, and a
-      // silent misread surfaces as a wrong title or blank flag in the UI.
-      // Unknown versions degrade to "no projection" instead of trusting shape.
-      if (document?.version !== 7) return null
-      const rows = document?.record?.rows
-      if (rows === null || typeof rows !== 'object') return null
-      return {
-        title: typeof rows.title?.val === 'string' ? rows.title.val : '',
-        blank: rows.sessionListMetadata?.val?.blank === true,
-        createdAt: document?.record?.identity?.createdAt ?? null,
-      }
-    } catch {
+      document = await readJsonFile(file)
+    } catch (error) {
+      if (error?.code !== 'ENOENT') projectionStats.unreadable += 1
+      return null
+    }
+    const rows = document?.record?.rows
+    if (rows === null || typeof rows !== 'object') {
+      projectionStats.malformed += 1
+      return null
+    }
+    const titleRow = rows.title
+    const blankRow = rows.sessionListMetadata
+    // At least one of the two rows this build reads must be present: a `rows`
+    // object made only of unknown keys is a different layout, not an empty one.
+    if (titleRow === undefined && blankRow === undefined) {
+      projectionStats.malformed += 1
+      return null
+    }
+    const titleShaped = titleRow === undefined || (titleRow !== null && typeof titleRow === 'object' && 'val' in titleRow)
+    const blankShaped = blankRow === undefined || (blankRow !== null && typeof blankRow === 'object' && 'val' in blankRow)
+    if (!titleShaped || !blankShaped) {
+      projectionStats.malformed += 1
       return null
     }
+    const version = document?.version
+    if (version !== PROJECTION_VERSION) projectionStats.foreignVersion += 1
+    return {
+      title: typeof titleRow?.val === 'string' ? titleRow.val : '',
+      blank: blankRow?.val?.blank === true,
+      createdAt: document?.record?.identity?.createdAt ?? null,
+      version,
+    }
   }
 
   async function workspaceEntities() {
@@ -183,18 +242,20 @@ export function createSessionGateway({ ctx, paths, now = Date.now, logger = cons
       const member = workspaceBySession.get(item.sessionId) ?? null
       const byCwd = member === null ? workspaceByCwd(item.cwd) : null
       const owned = member ?? (byCwd === null ? null : { workspace: byCwd, index: -1 })
-      const cached = titles.get(item.sessionId) ?? { title: '', blank: item.blank === true }
       return {
         id: String(item.sessionId),
-        title: cached.title,
+        // Left empty on purpose: the authoritative per-record projection below
+        // fills it, and the legacy bulk table is only a fallback. Seeding this
+        // from `titles` here is what made the stale value win.
+        title: '',
         cwd: item.cwd ?? null,
         origin: item.origin ?? null,
-        blank: item.blank === true || cached.blank === true,
+        blank: item.blank === true,
         running: item.running === true,
         live: isLive(item.sessionId),
         archived: state.archived.has(item.sessionId),
         pinned: state.pinned.has(item.sessionId),
-        createdAt: cached.createdAt ?? null,
+        createdAt: null,
         updatedAt: item.updatedAt ?? null,
         events: null,
         sizeBytes: null,
@@ -204,26 +265,33 @@ export function createSessionGateway({ ctx, paths, now = Date.now, logger = cons
         workspaceIndex: owned?.index ?? -1,
       }
     })
-    // Host 0.2.2+ removed the bulk `session_projcache.json`, so `readTitles()`
-    // above is usually empty and every row would render untitled. Fill the gaps
-    // from the authoritative per-session projection, in small batches so a long
-    // history does not open hundreds of descriptors at once.
-    //
-    // This is also the only place `createdAt` can come from: the legacy bulk
-    // table does not carry it. `enrichTitles()` used to run a second pass over
-    // exactly these rows (re-reading the same projection files) purely to fill
-    // that field, and was capped at the first 80 rows; doing it here makes the
-    // pass complete and removes the duplicate reads.
-    const untitled = rows.filter((row) => row.title === '')
-    for (let index = 0; index < untitled.length; index += 16) {
-      await Promise.all(untitled.slice(index, index + 16).map(async (row) => {
+    // The per-record checkpoint is the AUTHORITATIVE source, so it is read for
+    // every row, not just the rows the legacy table failed to title. Reading it
+    // only for untitled rows is what let a migration-era title outlive a rename
+    // (the legacy row still carried a non-empty title, so the fresh one was
+    // never consulted). Batched so a long history does not open hundreds of
+    // descriptors at once.
+    projectionStats = { total: rows.length, foreignVersion: 0, malformed: 0, unreadable: 0 }
+    const legacyTitlesMap = titles
+    for (let index = 0; index < rows.length; index += 16) {
+      await Promise.all(rows.slice(index, index + 16).map(async (row) => {
         const projection = await readSessionProjection(row.id)
         if (projection === null) return
         if (projection.title !== '') row.title = projection.title
         row.blank = row.blank || projection.blank
-        if (row.createdAt === null) row.createdAt = projection.createdAt ?? null
+        if (projection.createdAt !== null) row.createdAt = projection.createdAt
       }))
     }
+    // Compatibility fill for rows the authoritative read could not resolve
+    // (no checkpoint on disk at all, or a shape this build cannot read).
+    for (const row of rows) {
+      if (row.title !== '') continue
+      const cached = legacyTitlesMap.get(row.id)
+      if (cached === undefined) continue
+      if (cached.title !== '') row.title = cached.title
+      row.blank = row.blank || cached.blank === true
+      if (row.createdAt === null && cached.createdAt !== null) row.createdAt = cached.createdAt
+    }
     // A build that started before an `invalidate()` describes state the caller
     // deliberately discarded, so it must not install itself as the cache.
     if (generation === listGeneration) {
@@ -419,6 +487,20 @@ export function createSessionGateway({ ctx, paths, now = Date.now, logger = cons
      * inside the 1.5 s window), so its result must neither be installed nor be
      * what the next `inspect()` awaits.
      */
+    /**
+     * Host-contract health, published through `/state`.
+     *
+     * The point of this record is that a degraded title source must be
+     * OBSERVABLE. `foreignVersion` counts checkpoints that were readable but
+     * carried an unexpected format version; `malformed` counts shapes this
+     * build cannot read; `legacyTitles` says whether the bulk table was used
+     * (`v3`), absent, or skipped because its `unit.version` was not the one
+     * this build understands.
+     */
+    diagnostics() {
+      return { projection: { ...projectionStats }, legacyTitles }
+    },
+
     invalidate() {
       listGeneration += 1
       listInFlight = null

package/lib/version.js

@@ -5,4 +5,4 @@
  * asserted against it by `test/manifest.test.mjs` so the two can never drift
  * (they did: the constant stayed at 0.1.0 while the package reached 0.1.4).
  */
-export const PLUGIN_VERSION = '0.3.21'
+export const PLUGIN_VERSION = '0.3.22'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-conversation-recycle-bin",
-  "version": "0.3.21",
+  "version": "0.3.22",
   "description": "DSH conversation deletion with an optional, previewed cascade into conversation-associated memory: soft delete + recycle bin, audit trail, batch rate limits and per-session rollback. 删除对话（可选一并删除关联记忆）：软删除与回收站、审计留痕、批量限流、失败回滚。",
   "repository": {
     "type": "git",
@@ -36,7 +36,7 @@
   ],
   "engines": {
     "node": ">=22.15",
-    "dsh": ">=0.2.1-rc.2 <0.3.0-0"
+    "dsh": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-0 <0.3.0-0"
   },
   "optionalDependencies": {
     "nodemailer": "^10.1.2"

package/scripts/verify-host-contract.mjs

@@ -10,12 +10,17 @@
  *
  * Usage:
  *   node scripts/verify-host-contract.mjs [baseUrl] [--token=...]
- *   (baseUrl defaults to http://127.0.0.1:3082; --token defaults to $DSH_TOKEN)
+ *   (baseUrl defaults to $DSH_WEB_URL, then http://127.0.0.1:3082;
+ *    --token defaults to $DSH_TOKEN)
  *
  * Exit code: 0 = plugin mounted and answering, 1 = not mounted, 2 = probe error.
  */
 const args = process.argv.slice(2)
-let base = 'http://127.0.0.1:3082'
+// `dsh web` prints its own URL with a fresh port (11685 on this machine), and a
+// probe that keeps assuming 3082 reports "not mounted" for a perfectly healthy
+// host. Prefer the explicit argument, then the environment, then the old
+// default so existing instructions keep working.
+let base = process.env.DSH_WEB_URL ?? 'http://127.0.0.1:3082'
 let token = process.env.DSH_TOKEN ?? ''
 for (const arg of args) {
   if (arg.startsWith('--token=')) token = arg.slice('--token='.length)
@@ -58,8 +63,11 @@ async function main() {
 
   // 2. The plugin's client row must appear in the inline boot data. A mounted
   //    plugin always contributes its row; the 21:26 incident left this at 0.
+  //    NOTE: the package NAME alone is not proof — it is also the dependency
+  //    key in the profile's package.json, so it leaks into boot data that lists
+  //    installed bundles. Step 5 below is the assertion that actually decides.
   const rowPresent = html.includes('dsh-conversation-recycle-bin')
-  record('boot graph contains the plugin row', rowPresent, rowPresent ? 'found' : 'string absent from HTML')
+  record('package name present in boot data', rowPresent, rowPresent ? 'found' : 'string absent from HTML')
 
   // 3. A control prefix route proves the prefix mechanism itself works.
   const control = await fetch(`${base}/dsh-memes-api`, {
@@ -88,6 +96,35 @@ async function main() {
     `status ${state.status}, ${body.length} bytes${parsed === null ? ', not JSON' : ''}`,
   )
 
+  // 5. Mounted-for-real: the payload must carry the plugin's own shape. A 200
+  //    with `{}` (a proxy, a stale service worker, another plugin's catch-all
+  //    prefix) used to pass the check above.
+  const payload = parsed?.state
+  const shaped = payload !== null && typeof payload === 'object'
+    && typeof payload.version === 'string'
+    && typeof payload.limits === 'object'
+    && payload.limits !== null
+  record(
+    'state payload carries the plugin contract (version + limits)',
+    shaped,
+    shaped ? `v${payload.version}` : 'missing state.version / state.limits',
+  )
+
+  // 6. Contract drift that costs the UI its titles is reported here instead of
+  //    being discovered by a user staring at blank rows.
+  const diagnostics = payload?.diagnostics
+  if (diagnostics !== undefined && typeof diagnostics === 'object') {
+    const foreign = Number(diagnostics.projection?.foreignVersion ?? 0)
+    const malformed = Number(diagnostics.projection?.malformed ?? 0)
+    record(
+      'projection checkpoints are a format this build reads',
+      foreign === 0 && malformed === 0,
+      `foreignVersion ${foreign}, malformed ${malformed}, legacyTitles ${String(diagnostics.legacyTitles)}`,
+    )
+  } else {
+    record('state reports projection diagnostics', false, 'state.diagnostics missing (older plugin build?)')
+  }
+
   const failed = results.filter((item) => !item.ok)
   if (failed.length > 0) {
     console.log(`\n${failed.length} check(s) failed. If the Host was just restarted, confirm the`)

package/test/api.test.mjs

@@ -2084,3 +2084,79 @@ test('trash: stranded memory files offer, and accept, the forced discard', async
     await fixture.home.cleanup()
   }
 })
+
+test('state: adapter diagnostics are redacted before they cross HTTP', async () => {
+  // `/state` is a SUCCESS response, so it never went through `redactDetails`.
+  // An unreadable memory index surfaces the raw ENOENT message, which carries
+  // an absolute path — and `/state` is the one route that can be read without a
+  // connection fence, so that path was reachable unauthenticated.
+  const fixture = await makeFixture({
+    configOverrides: {
+      memory: {
+        enabled: true,
+        adapters: ['generic-json'],
+        generic: { indexFile: 'C:\\Users\\someone\\.dsh\\storages\\nodes.json', rootDir: 'C:\\Users\\someone\\.dsh\\storages' },
+      },
+    },
+  })
+  try {
+    const result = await call(fixture.api, '/state', { method: 'GET' })
+    assert.equal(result.status, 200)
+    const state = result.body.state ?? {}
+    const reason = String(state.memory?.adapters?.[0]?.reason ?? '')
+    // The username segment only survives if the raw ENOENT message reached the
+    // wire; redaction keeps the basename (`nodes.json`) and drops the rest.
+    assert.ok(!reason.includes('someone'), `adapter reason not redacted: ${reason}`)
+    assert.equal(typeof state.diagnostics, 'object', `state keys: ${Object.keys(state).join(',')}`)
+  } finally {
+    await fixture.home.cleanup()
+  }
+})
+
+test('security: requireOwnerPeer refuses a non-owner peer', async () => {
+  const nonOwner = { requestRejection: () => undefined, admit: () => ({ principal: { kind: 'guest' } }) }
+  const fixture = await makeFixture({ connection: nonOwner, configOverrides: { requireOwnerPeer: true } })
+  try {
+    const preview = await call(fixture.api, '/preview', { body: { sessionIds: [S1], includeMemory: false, mode: 'soft' } })
+    assert.equal(preview.status, 403)
+    assert.equal(preview.body.error.code, 'E_FORBIDDEN_PRINCIPAL')
+  } finally {
+    await fixture.home.cleanup()
+  }
+})
+
+test('security: requireOwnerPeer admits the owner', async () => {
+  const owner = { requestRejection: () => undefined, admit: async () => ({ principal: { kind: 'owner' } }) }
+  const fixture = await makeFixture({ connection: owner, configOverrides: { requireOwnerPeer: true } })
+  try {
+    const result = await call(fixture.api, '/state', { method: 'GET' })
+    assert.equal(result.status, 200)
+  } finally {
+    await fixture.home.cleanup()
+  }
+})
+
+test('security: requireOwnerPeer fails closed when the principal is unknown', async () => {
+  // A connection layer that cannot report a principal must refuse: "I cannot
+  // tell who you are" is not permission to delete.
+  const opaque = { requestRejection: () => undefined }
+  const fixture = await makeFixture({ connection: opaque, configOverrides: { requireOwnerPeer: true } })
+  try {
+    const result = await call(fixture.api, '/state', { method: 'GET' })
+    assert.equal(result.status, 503)
+    assert.equal(result.body.error.code, 'E_PEER_UNKNOWN')
+  } finally {
+    await fixture.home.cleanup()
+  }
+})
+
+test('security: requireOwnerPeer stays out of the way when it is off (default)', async () => {
+  const nonOwner = { requestRejection: () => undefined, admit: () => ({ principal: { kind: 'guest' } }) }
+  const fixture = await makeFixture({ connection: nonOwner })
+  try {
+    const preview = await call(fixture.api, '/preview', { body: { sessionIds: [S1], includeMemory: false, mode: 'soft' } })
+    assert.equal(preview.status, 200, 'default behaviour must not change')
+  } finally {
+    await fixture.home.cleanup()
+  }
+})

package/test/contract.test.mjs

@@ -81,12 +81,81 @@ test('gateway: the per-session projection (v7) supplies the title when the legac
   })
 })
 
-test('gateway: an unknown projection version degrades to no title instead of misreading fields', async () => {
+test('gateway: a bumped projection version with the same fields still supplies the title', async () => {
+  // 0.3.22 reversed the old `version !== 7 → give up` rule. A Host that bumps
+  // the format while keeping `rows.title.val` / `rows.sessionListMetadata.val`
+  // must NOT cost every row its title — the previous expectation baked that
+  // degradation in, so a real drift would have shipped green.
   await withFixture(8, async ({ paths, ctx }) => {
     const gateway = createSessionGateway({ ctx, paths, now: () => 1_700_000_000_200 })
     const rows = await gateway.list()
     assert.equal(rows.length, 1)
+    assert.equal(rows[0].title, 'Projection title')
+    // ...and the foreign version is reported instead of silently accepted.
+    assert.equal(gateway.diagnostics().projection.foreignVersion, 1)
+  })
+})
+
+test('gateway: an unreadable projection shape degrades to no title AND is reported', async () => {
+  await withFixture(8, async ({ paths, ctx }) => {
+    // Same version, different field names: the capability check must reject it.
+    await writeFile(join(paths.storagesDir, 'session_projcache', 'sessions', `${SESSION_ID}.json`),
+      JSON.stringify({ version: 8, record: { rows: { headline: { val: 'Renamed field' } } } }), 'utf8')
+    const gateway = createSessionGateway({ ctx, paths, now: () => 1_700_000_000_300 })
+    const rows = await gateway.list()
     assert.equal(rows[0].title, '')
+    assert.equal(gateway.diagnostics().projection.malformed, 1)
+  })
+})
+
+function legacyTable(version, title) {
+  return JSON.stringify({
+    unit: { name: 'session_projcache', version },
+    global: null,
+    tables: {
+      sessions: {
+        [SESSION_ID]: {
+          identity: { createdAt: 1_600_000_000_000, cwd: '/work/a' },
+          rows: { title: { val: title }, sessionListMetadata: { val: { blank: false } } },
+        },
+      },
+    },
+  })
+}
+
+test('gateway: a legacy bulk table whose unit.version is unknown is skipped, not trusted', async () => {
+  await withFixture(7, async ({ paths, ctx }) => {
+    // The legacy file is the FALLBACK, so remove the authoritative checkpoint
+    // to make the legacy read the only title source.
+    await rm(join(paths.storagesDir, 'session_projcache', 'sessions', `${SESSION_ID}.json`), { force: true })
+    await writeFile(join(paths.storagesDir, 'session_projcache.json'), legacyTable(99, 'Legacy title'), 'utf8')
+    const gateway = createSessionGateway({ ctx, paths, now: () => 1_700_000_000_500 })
+    const rows = await gateway.list()
+    assert.equal(rows[0].title, '')
+    assert.equal(gateway.diagnostics().legacyTitles, 'v99')
+  })
+})
+
+test('gateway: the per-record checkpoint outranks a stale legacy title', async () => {
+  await withFixture(7, async ({ paths, ctx }) => {
+    // The legacy dump is frozen at the migration moment; the conversation was
+    // renamed afterwards. The authoritative checkpoint must win.
+    await writeFile(join(paths.storagesDir, 'session_projcache.json'), legacyTable(3, 'Old name'), 'utf8')
+    const gateway = createSessionGateway({ ctx, paths, now: () => 1_700_000_000_600 })
+    const rows = await gateway.list()
+    assert.equal(rows[0].title, 'Projection title')
+    assert.equal(gateway.diagnostics().legacyTitles, 'v3')
+  })
+})
+
+test('gateway: the legacy bulk table still titles a row with no checkpoint on disk', async () => {
+  await withFixture(7, async ({ paths, ctx }) => {
+    await rm(join(paths.storagesDir, 'session_projcache', 'sessions', `${SESSION_ID}.json`), { force: true })
+    await writeFile(join(paths.storagesDir, 'session_projcache.json'), legacyTable(3, 'Legacy title'), 'utf8')
+    const gateway = createSessionGateway({ ctx, paths, now: () => 1_700_000_000_700 })
+    const rows = await gateway.list()
+    assert.equal(rows[0].title, 'Legacy title')
+    assert.equal(rows[0].createdAt, 1_600_000_000_000)
   })
 })