dsh-conversation-recycle-bin 0.3.3 → 0.3.5

package/CHANGELOG.md

@@ -3,6 +3,48 @@
 All notable changes to `dsh-conversation-recycle-bin` are documented here.
 The format follows Keep a Changelog; the project uses Semantic Versioning.
 
+## [0.3.5] — 2026-10-22
+
+对应 `AUDIT-2026-10-22-desktop-web-compat.md`：把 0.3.4 之后一直只存在于工作树的修复正式发布，并落地该报告 §9 的全部建议。
+
+### Fixed
+
+- **C-01 前缀部署下所有 API 丢失路径前缀**：`client.js` 新增 `apiUrl()`，用 `new URL('.', document.baseURI)` 归一化 base 并去掉 `API_PREFIX` 的前导斜杠，改为文档相对解析。`dsh web --public-url https://host/ui/` 下不再 404；桌面 `dsh-app://app/` 行为不变。0.3.4 的 tarball 仍带此缺陷（`new URL('/conversation-recycle-bin/api…', base)` 会替换整个 base 路径）。新增回归用例断言三种 base（根、`…/ui/`、`…/ui/index.html`、`dsh-app://app/`）解析结果。
+- **C-02 回收站写操作超时短于宿主排队**：客户端 `TRASH_MUTATION_TIMEOUT_MS = 195s`，宿主 `TRASH_LOCK_BUDGET_MS = 180s`（此前 15s / 30s）。批量删除进行中再点恢复/彻底删除，不再出现"界面报错但宿主已执行"。
+- **C-08 锁预算用例一直是红的**：该用例用软删除条目测 `discard`，而软删除按设计保留会话日志，`performDiscard` 必然返回 `E_TRASH_CONFLICT`（409）。改为 seed 一个从未提交的 `pending` 条目（无 `session/`、无 `memory/`），api 用例数 40 → 41 全绿。此前 0.3.4 的 `npm test` 因该用例无法通过而不能作为发布门禁。
+
+### Added
+
+- **C-03 `allowedHosts`**：反代部署的精确 authority 白名单（`host`、`host:port`、`[v6]:port`）。裸主机放行任意端口，带端口的条目只放行该端口；带 scheme/路径/userinfo/通配符的条目会被丢弃并写入 warnings。默认 `[]` = 仅回环，与 0.3.4 行为一致。这样不必为了让反代可用而整体打开 `allowNonLoopback`。`config.schema.json`、`cordis.patch.yml`、README §4.2 同步。
+
+### Changed / Performance
+
+- **P-01 `/trash` 双扫描合并**：`trash.scanAll()` 一次 `readdir` 产出 `{entries, unreadable}`，每条目只读一次 manifest，读取用 8 并发（此前 `listAll` + `scanUnreadable` 各扫一遍，合计 2 次 readdir + 2N 次读，且 `listAll` 串行）。0/50/200/500 条实测 1.2/17.2/63.3/156.3 ms → **1/4.9/14.4/38.1 ms**。
+- **P-02 `/preview` 记忆索引只解析一次**：适配器按 `mtimeMs:size` 缓存已解析快照，`probe()` 与 `countSessions()` 共用；本适配器每次写索引后主动失效，其他进程改写由 stat key 识别。21000 节点（1.9 MB）单条预览 39.2 → **28.9 ms**（剩余部分是单次读盘 + 解析的固有成本）。
+- **P-05 设置页按 tab 懒加载**：挂载/切换只拉当前 tab 需要的接口（回收站 `/trash`、批量 `/sessions`、审计 `/audit`），`/state` 仅在挂载与变更后取；刷新期间面板不再卸载，改为顶部细条指示，滚动位置与输入焦点不再丢失。对应把每次刷新 4 个请求（≈31 KB）降为 1–2 个。
+- **P-04 宽限等待可见化**：彻底删除模式下对话框说明"刚使用过的对话可能多等约 1.5 秒"；提交超过 1.2s 后显示"仍在执行：正在确认没有其他 DSH 实例写入该对话"。等待本身（`foreignWriterGraceMs`）是安全设计，未取消。
+
+### Maintenance
+
+- 测试 131 → **138**（api 41、client 22、core 15、memory 13、cascade 15、feedback 19、manifest 9、trash-audit 4）。
+- README 状态 0.2.2 → 0.3.5，用例计数与设置页/反代说明同步。
+
+## [0.3.4] — 2026-10-20
+
+对应 `AUDIT-2026-10-20-last3-versions.md` 的四条非阻塞隐患 N1–N4，以及测试驱动下新发现的 P3 回归 N5。
+
+### Fixed
+
+- **N1：批量删除中途限流会静默丢尾项**：`deletePlan` 循环里 `!reservation.ok` 分支的 `break` 改为 `continue`。0.3.3 之前当第二 Host 在 preflight 与 take 之间抢走额度、或 `sessions.length > limiter.remaining`（跨进程 / 时间窗滑动）时，第一条被拒之后的所有 session 既不进 `results` 也不进 `failures`——一次 50 项批量 + 20/min 上限下，第 22–50 项从 UI 反馈里凭空消失。`continue` 让每一项各得一条 `E_RATE_LIMITED` 记录；首个项目预算不足直接抛 429 的既有契约不变。新增 `test/api.test.mjs` 用例：monkey-patch limiter 让 take 从第二次起即失败，断言 3 项批量 → 1 结果 + 2 失败。
+- **N2：审计 `tail()` 字节窗口对齐到 `\n` 时丢一条完整记录**：`start > 0` 分支不再无条件 `rawLines.slice(1)`——先读 `start-1` 一字节，`\n` 意味着窗口从行首开始，`rawLines[0]` 是完整 JSON 保留；否则才丢。同时 `CHUNK` 抽为 `createAuditLog({ tailWindowBytes })` 便于回归。新增 `test/trash-audit.test.mjs` 用例：对齐窗口断言三条完整记录全在，偏移 1 字节窗口断言撕裂片段被正确丢弃。
+- **N5（连带发现）：`tail()` 从未真正做窗口读**：Node `fs.readFile(path, {encoding,flag,signal})` 不接受 `start/end`，0.3.3 P3「只读尾部 256KB」的实现其实每次仍全量读盘。改用 `fsApi.open(filePath, 'r')` + `FileHandle.read(buffer, offset, length, position)` 的位置化读，`stat` 也走 handle；`fsApi` 类型签名加 `open`。修复后 5MB 审计文件 tail 只吃 256KB 内存，与 P3 原意一致。
+- **N3：HTTP 反馈通道对自定义鉴权头也强加 `Bearer ` 前缀**：`deliverHttp` 现只在 `authHeader === 'Authorization'` 时前缀 `Bearer `（RFC 7235 语法的合法要求），其它如 `X-Api-Key` / `x-goog-api-key` 直接发送裸 token——多数非 `Authorization` 中转拒绝 Bearer 前缀，此前配任何自定义头都会 401。默认 `Authorization` 通道逐字节不变。新增 `test/feedback.test.mjs` 双 case 用例（Bearer vs 裸 token）。
+- **N4：`visitorAsFrom: true` 的 UI 提示未说明与常见发信方冲突**：`feedback.emailHintAsFrom` 词条中英各扩写为完整句子，说明「QQ / 163 / Gmail 一类要求 From 与登录账号一致会拒收，仅允许任意 From 的中继才生效」。行为不变、配置不变。
+
+### Changed / Maintenance
+
+- 回归测试：`api` 38 → 39、`feedback` 18 → 19、`trash-audit` 3 → 4；总 128 → **131 全绿**。
+
 ## [0.3.3] — 2026-10-19
 
 本次修复对应 `AUDIT-2026-10-19-review.md` 的 S1–S3、P1–P5、R1–R4 与 M 项；每条均带回归测试。

package/README.md

@@ -2,7 +2,7 @@
 
 给 DeepSeek Harness (DSH) Web 增加「删除对话」：会话列表的「…」菜单与会话详情页头部各有一个删除入口；确认框内可勾选「同时删除关联记忆」（默认不勾选），并实时显示将被影响的记忆条数。删除默认进入插件回收站，可恢复；每次操作写入审计日志；批量删除有上限与限流，批量软删除需输入数量，彻底删除一键执行；事务任一步失败即回滚。
 
-> 状态：`0.2.2`，Host + Web Client 双半，零构建（plain JS ESM），只依赖宿主已发布的公开扩展点。
+> 状态：`0.3.5`，Host + Web Client 双半，零构建（plain JS ESM），只依赖宿主已发布的公开扩展点。
 > 包名：`dsh-conversation-recycle-bin`（原 `dsh-delete-conversation` 因 npm 被他人占用而改名，见 CHANGELOG 0.2.0）。
 > 本 README 同时是设计说明与验收依据；安装/回滚步骤见 [INSTALL.md](INSTALL.md)；变更见 [CHANGELOG.md](CHANGELOG.md)。
 
@@ -74,7 +74,7 @@ memory  →  messages  →  session/catalog
 |---|---|---|
 | 会话列表「…」 | `sidebar.workspaces.session.menu.item`（order 500） | 点击后关闭菜单，打开全局确认框 |
 | 会话详情页头部 | `conversation.session.header.actions`（order 100） | 图标按钮打开同一确认框 |
-| 设置页 | `settings.section`（order 1300） | 「回收站 / 批量删除 / 审计留痕」三个标签页 |
+| 设置页 | `settings.section`（order 1300） | 「回收站 / 批量删除 / 审计留痕」三个标签页；按 tab 懒加载，刷新时保留旧数据 |
 | 全局确认框 | `shell.overlay` | 唯一删除发起处；挂在根级，不会随菜单卸载 |
 
 确认框内容：
@@ -111,7 +111,7 @@ memory  →  messages  →  session/catalog
 |---|---|
 | 误删 | 默认软删除；记忆复选框默认关；回收站；彻底删除一键但仍写回收站可恢复；批量软删除需输入数量 |
 | 批量误操作 | `maxBatchSessions`（实际上限还会被本分钟剩余额度收紧，避免"合法批量必然 429"）；批量需输入数量；每个会话独立事务 |
-| 暴力/脚本调用 | 同源校验（完整 authority：主机名+有效端口）+ `x-conversation-recycle-bin: 1` 私有 header + DSH `connection` 层（`requestRejection` + `connection/request` 瀑布流）+ 限流；默认仅接受 loopback 绑定，`allowNonLoopback=false` |
+| 暴力/脚本调用 | 同源校验（完整 authority：主机名+有效端口）+ `x-conversation-recycle-bin: 1` 私有 header + DSH `connection` 层（`requestRejection` + `connection/request` 瀑布流）+ 限流；默认仅接受 loopback 绑定；反代部署用 `allowedHosts` 精确放行（不要为此整体打开 `allowNonLoopback`） |
 | 两个 Host 并发写同一回收站 | mutation 串行 + `<dataDir>/mutation.lock` 跨进程文件锁，抢不到锁返回 `E_LOCK_BUSY`（而非写坏 manifest） |
 | 越权/越界 | 不在工作区登记的会话默认拒绝；可配置允许根目录白名单；受保护 id 列表；子代理会话默认拒绝 |
 | 活跃会话被写坏 | hard 模式对 live 会话先走 `quiesce`：取消当前轮次 → `archiveSession({stopActivity:true})` → 在 `liveDrainMs` 内等待 `running=false`，之后才移动日志；仍停不下来则整笔回滚并报 `E_POLICY_LIVE`。`stopLiveSessions:false` 可恢复为直接拒绝 |
@@ -120,6 +120,17 @@ memory  →  messages  →  session/catalog
 | 不可追溯 | `<DSH_HOME>/delete-conversation/audit.jsonl` 追加成功/失败/回滚/拒绝/恢复/清理记录；设置页可查看 |
 | 外部记忆存储损坏 | 灵枢适配器持有其 `_index.json.lock`，先写 restore bundle 再原子改写索引；任何一步失败先还原正文与索引；详情见 §5.3 |
 
+反代部署（`dsh web --public-url https://host/ui/`）时，代理会把外部主机名放进 `Host`，插件的回环校验会以 `E_FORBIDDEN_HOST` 拒绝。用 `allowedHosts` 精确放行，而不是把 `allowNonLoopback` 整体打开：
+
+| 配置 | 匹配 | 说明 |
+|---|---|---|
+| `allowedHosts: ["app.example"]` | 该主机的任意端口 | 端口在代理侧固定时更宽松 |
+| `allowedHosts: ["app.example:8443"]` | 仅该端口 | 推荐；端口不匹配仍拒绝 |
+| `allowedHosts: []`（默认） | 仅回环 | 与 0.3.4 行为一致 |
+
+条目必须是裸 authority（`host`、`host:port`、`[v6]:port`）；带 scheme、路径、userinfo 或通配符的条目会被丢弃并在 `/state` 的 warnings 里报告。**代理读超时仍需单独调整**：nginx `proxy_read_timeout` 默认 60s、Cloudflare 到源站默认 100s，而大批量删除的宿主预算是 `min(900s, 15s + 16s×批量 + drain)`，超时后代理会先断而宿主仍在执行。
+
+
 ### 4.3 回收站布局
 
 存储目录沿用旧插件的 `delete-conversation`（不是新包名），这样 0.2.0 改名后已有的回收站条目和审计日志仍然可见。
@@ -190,7 +201,7 @@ dsh-conversation-recycle-bin/
 │     ├─ memory.js               # 适配器装配
 │     ├─ feedback.js             # 反馈校验/渲染/投递（http 或 smtp，凭证只读环境变量）
 │     └─ api.js                 # 同源 HTTP API、确认 token、限流
-└─ test/                        # 122 个用例，覆盖用户要求的 5 类场景 + live 删除 + 记忆锁 + 原地刷新 + 部分失败/跨进程/未完成条目 + 反馈通道 + Client 半渲染冒烟
+└─ test/                        # 138 个用例，覆盖用户要求的 5 类场景 + live 删除 + 记忆锁 + 原地刷新 + 部分失败/跨进程/未完成条目 + 反馈通道 + Client 半渲染冒烟
 ```
 
 ---
@@ -199,7 +210,7 @@ dsh-conversation-recycle-bin/
 
 ```powershell
 cd D:\Users\34332\AI\dsh-conversation-recycle-bin
-npm test        # = manifest && client-module && core && cascade && memory && trash-audit && feedback && api（122 个用例）
+npm test        # = manifest && client-module && core && cascade && memory && trash-audit && feedback && api（138 个用例）
 npm run check   # 语法 + manifest
 ```
 
@@ -258,8 +269,8 @@ npm run check   # 语法 + manifest
 | `DSH_CRB_FEEDBACK_TO` | 收件人（优先于 `feedback.to`） |
 | `DSH_CRB_FEEDBACK_FROM` | 发件人（优先于 `feedback.from`） |
 | `DSH_CRB_MAIL_API_URL` | 邮件 HTTP API 地址（Resend 兼容形状，也可指向自建转发网关） |
-| `DSH_CRB_MAIL_API_TOKEN` | 该 API 的 Bearer token |
-| `DSH_CRB_MAIL_API_AUTH_HEADER` | 可选，鉴权头名，默认 `authorization`，值为 `Bearer <token>` |
+| `DSH_CRB_MAIL_API_TOKEN` | 该 API 的鉴权 token |
+| `DSH_CRB_MAIL_API_AUTH_HEADER` | 可选，鉴权头名，默认 `authorization`；`authorization` 时值形如 `Bearer <token>`（RFC 7235），其它自定义头（如 `x-api-key`）直接发送裸 token |
 | `DSH_CRB_SMTP_URL` | SMTP 连接串，如 `smtps://user:pass@smtp.example.com:465` |
 
 HTTP 通道发出的 JSON 固定为 `{from, to: [收件人], subject, text, reply_to}`，`text` 是纯文本（不生成 HTML）；`reply_to` 取自表单里访客填写的邮箱（留空则不填）。SMTP 通道按需 `import('nodemailer')`：它已声明为 `optionalDependencies`（`^10.1.2`），正常安装会随包就位；以 `link:` 方式开发安装时插件从自身真实目录解析，需在**本仓库**跑一次 `npm install`。仍未安装时返回 `E_FEEDBACK_TRANSPORT` + `reason: nodemailer-missing`。
@@ -287,8 +298,8 @@ node -e "console.log('b64:' + Buffer.from('your-feedback@example.com','utf8').to
 ```powershell
 cd D:\Users\34332\AI\dsh-conversation-recycle-bin
 npm run check                      # 语法 + manifest（含 feedback.js）
-node test/feedback.test.mjs        # 17 个反馈用例
-npm test                           # 全量 122 个用例
+node test/feedback.test.mjs        # 19 个反馈用例
+npm test                           # 全量 138 个用例
 
 # 端到端：用本机收件桩观察真实投递路径，不外发邮件
 $env:DSH_CRB_MAIL_API_URL   = 'http://127.0.0.1:9099/emails'

package/client.js

@@ -101,6 +101,8 @@ window.__ModuleLoader__.load({
         'dialog.phraseLabel': 'Confirmation',
         'dialog.delete': 'Delete',
         'dialog.working': 'Deleting…',
+        'dialog.stillWorking': 'Still working — confirming no other DSH instance is writing this conversation.',
+        'dialog.hardGraceHint': 'Permanent deletion re-checks the log for a second writer first, so a conversation used moments ago can take about 1.5s longer.',
         'dialog.loading': 'Reading the plan…',
         'dialog.done': 'Deleted {count} conversation(s); {memory} memory entries moved to the recycle bin.',
         'dialog.partial': 'Deleted {done}, failed {failed}.',
@@ -165,7 +167,7 @@ window.__ModuleLoader__.load({
         'feedback.emailLabel': 'Your email (optional)',
         'feedback.emailPlaceholder': 'you@example.com',
         'feedback.emailHint': 'Used as Reply-To so the maintainer can answer you. Leave it empty to stay anonymous.',
-        'feedback.emailHintAsFrom': 'Shown as the sender (From) of the mail.',
+        'feedback.emailHintAsFrom': 'Sent as the mail\'s From address. Most relays (QQ, 163, Gmail) reject this unless the mailbox matches the login account — enable only when the relay accepts arbitrary From.',
         'feedback.contextLabel': 'Attached automatically',
         'feedback.contextHint': 'Plugin version, platform and language. Conversation content is never attached.',
         'feedback.contextVersion': 'Plugin version',
@@ -255,6 +257,8 @@ window.__ModuleLoader__.load({
         'dialog.phraseLabel': '确认',
         'dialog.delete': '删除',
         'dialog.working': '正在删除…',
+        'dialog.stillWorking': '仍在执行：正在确认没有其他 DSH 实例写入该对话。',
+        'dialog.hardGraceHint': '彻底删除会先复查日志是否还有第二个写入方；刚使用过的对话可能多等约 1.5 秒。',
         'dialog.loading': '正在读取删除计划…',
         'dialog.done': '已删除 {count} 个对话；移入回收站的记忆条目 {memory} 条。',
         'dialog.partial': '成功 {done} 个，失败 {failed} 个。',
@@ -319,7 +323,7 @@ window.__ModuleLoader__.load({
         'feedback.emailLabel': '你的邮箱（选填）',
         'feedback.emailPlaceholder': 'you@example.com',
         'feedback.emailHint': '作为 Reply-To，便于维护者直接回复你；留空即匿名。',
-        'feedback.emailHintAsFrom': '会直接作为这封邮件的发件人。',
+        'feedback.emailHintAsFrom': '会直接作为这封邮件的发件人（From）。QQ / 163 / Gmail 一类会拒收非登录账号的 From，只有允许任意 From 的中继才生效。',
         'feedback.contextLabel': '自动附带',
         'feedback.contextHint': '插件版本、平台与语言；不会附带任何对话内容。',
         'feedback.contextVersion': '插件版本',
@@ -472,6 +476,23 @@ window.__ModuleLoader__.load({
     const API_PREFIX = '/conversation-recycle-bin/api'
     const REQUEST_TIMEOUT_MS = 15_000
     const MUTATION_TIMEOUT_MS = 180_000
+    /**
+     * Recycle-bin writes wait for the Host's cross-process lock, and that wait
+     * is unbounded in wall-clock terms: the request queues behind whatever
+     * mutation is already running (`serialize()` chains in-process first). A
+     * 15s budget therefore aborted restore / purge / discard while the Host was
+     * still working, so the UI reported a failure for a change that did happen.
+     * The Host caps its own lock wait at TRASH_LOCK_BUDGET_MS (180s); this sits
+     * just above it so the Host's own answer always wins the race.
+     */
+    const TRASH_MUTATION_TIMEOUT_MS = 195_000
+    /**
+     * How long a delete may run before the dialog says what it is waiting for.
+     * A hard delete of a conversation written moments ago spends
+     * `foreignWriterGraceMs` (1.5s) re-checking the log for a second writer;
+     * without a hint the danger button looked stuck.
+     */
+    const SLOW_SUBMIT_HINT_MS = 1_200
 
     /**
      * A batch is one HTTP request that can stop several live sessions (each up
@@ -493,14 +514,39 @@ window.__ModuleLoader__.load({
     ApiError.prototype = Object.create(Error.prototype)
     ApiError.prototype.constructor = ApiError
 
+    /**
+     * Resolve a plugin route against the PAGE, not against the origin.
+     *
+     * `dsh web` can be mounted under a path prefix (`--public-url
+     * https://host/ui/`, stripped by a front proxy). DSH's own client stays
+     * document-relative for exactly this reason: `dsh-client-connection` builds
+     * its requests with `` `${channel}/${endpoint}`.slice(1) `` and resolves
+     * them against `document.baseURI`. An absolute `/conversation-recycle-bin/…`
+     * would replace the whole base path, drop the prefix, and 404 every call.
+     * Keeping the same rule means one code path works for `http://127.0.0.1:<p>/`,
+     * `https://host/<prefix>/` and the desktop shell's `dsh-app://app/`.
+     */
+    function apiUrl(path) {
+      let base = 'http://127.0.0.1/'
+      if (typeof document !== 'undefined' && typeof document.baseURI === 'string' && document.baseURI !== '') {
+        try {
+          // Normalise to the containing directory so a base without a trailing
+          // slash (`…/index.html`) does not swallow the last segment.
+          base = new URL('.', document.baseURI).href
+        } catch {
+          base = 'http://127.0.0.1/'
+        }
+      }
+      return new URL(`${API_PREFIX.replace(/^\//, '')}${path}`, base)
+    }
+
     async function api(path, options = {}) {
       const method = options.method ?? 'GET'
       const timeoutMs = Number.isFinite(options.timeoutMs) ? options.timeoutMs : REQUEST_TIMEOUT_MS
       const controller = new AbortController()
       const timer = setTimeout(() => controller.abort(), timeoutMs)
       try {
-        const base = typeof document !== 'undefined' && typeof document.baseURI === 'string' ? document.baseURI : 'http://127.0.0.1/'
-        const url = new URL(`${API_PREFIX}${path}`, base)
+        const url = apiUrl(path)
         const headers = { 'x-conversation-recycle-bin': '1' }
         if (options.body !== undefined) headers['content-type'] = 'application/json'
         const response = await fetch(url, {
@@ -938,6 +984,9 @@ window.__ModuleLoader__.load({
       const [error, setError] = useState(null)
       const [phrase, setPhrase] = useState('')
       const [done, setDone] = useState(null)
+      // Set when a submission outlives SLOW_SUBMIT_HINT_MS, so the dialog can
+      // explain the wait instead of showing a frozen danger button.
+      const [slow, setSlow] = useState(false)
 
       // Dismissing the result must also complete a reload the Host armed
       // because it cannot close the deleted conversation in place; otherwise
@@ -986,6 +1035,15 @@ window.__ModuleLoader__.load({
         return () => window.removeEventListener('keydown', onKey)
       }, [busy])
 
+      useEffect(() => {
+        if (busy !== true) {
+          setSlow(false)
+          return undefined
+        }
+        const timer = setTimeout(() => setSlow(true), SLOW_SUBMIT_HINT_MS)
+        return () => clearTimeout(timer)
+      }, [busy])
+
       const firstSession = preview?.sessions?.[0] ?? null
       const title = count === 1
         ? (firstSession?.title || fallbackTitle || sessionIds[0])
@@ -1120,6 +1178,11 @@ window.__ModuleLoader__.load({
             ? h('div', { className: 'dc-live-warning', role: 'status' }, t('dialog.liveStopHint'))
             : null,
 
+          // Permanent deletion waits out `foreignWriterGraceMs` when the log was
+          // written moments ago (measured: ~1.5s once per batch). Say so before
+          // the click, not after the user thinks the button is stuck.
+          mode === 'hard' ? h('p', { className: 'dc-hint' }, t('dialog.hardGraceHint')) : null,
+
           h('div', { className: 'dc-memory' },
             h(Checkbox, {
               checked: includeMemory,
@@ -1162,6 +1225,10 @@ window.__ModuleLoader__.load({
               }))
             : null,
 
+          slow === true
+            ? h('div', { className: 'dc-live-warning', role: 'status' }, t('dialog.stillWorking'))
+            : null,
+
           h('div', { className: 'dc-actions' },
             h(Button, { onClick: () => { void load(mode, includeMemory) }, disabled: busy || loading, title: t('action.refresh') },
               h(GlyphRefresh, { size: 13 }), ' ', t('action.refresh')),
@@ -1518,7 +1585,10 @@ window.__ModuleLoader__.load({
       const [trash, setTrash] = useState([])
       const [incomplete, setIncomplete] = useState([])
       const [audit, setAudit] = useState([])
-      const [loading, setLoading] = useState(true)
+      // Which tab is fetching right now. `null` means idle: the panels stay
+      // mounted while a refresh runs, so the user keeps scroll position and
+      // never sees the whole section blink on every restore/purge.
+      const [tabBusy, setTabBusy] = useState(null)
       const [error, setError] = useState(null)
       const [selected, setSelected] = useState(() => new Set())
       const [purgeTarget, setPurgeTarget] = useState(null)
@@ -1532,54 +1602,100 @@ window.__ModuleLoader__.load({
       // Two refreshes can overlap (mount, mutation broadcast, and the refresh a
       // purge triggers), and the older response must not overwrite the newer.
       const refreshSerial = useRef(0)
+      // The mutation version each tab's data was fetched at. `-1` = never.
+      const loadedRef = useRef({ trash: -1, batch: -1, audit: -1 })
 
-      const refresh = useCallback(async () => {
+      const refreshState = useCallback(async () => {
+        const response = await api('/state')
+        setState(response.state)
+      }, [])
+
+      /**
+       * Fetch only what the visible tab renders. The section used to pull
+       * `/state`, `/sessions`, `/trash` and `/audit` on every mount and every
+       * mutation (~31 KB, 4 round trips) even when the user was looking at one
+       * tab. `/sessions` is the expensive one (one projection read per row),
+       * so opening the recycle bin must not pay for it.
+       */
+      const loadTab = useCallback(async (which, { force = false } = {}) => {
+        if (!force && loadedRef.current[which] === mutationVersion) return
         const serial = refreshSerial.current + 1
         refreshSerial.current = serial
         const stale = () => serial !== refreshSerial.current
-        setLoading(true)
+        setTabBusy(which)
         setError(null)
         try {
-          const [stateResponse, sessionsResponse, trashResponse, auditResponse] = await Promise.all([
-            api('/state'),
-            api('/sessions'),
-            api('/trash'),
-            api('/audit?limit=50'),
-          ])
-          if (stale()) return
-          const nextSessions = Array.isArray(sessionsResponse.sessions) ? sessionsResponse.sessions : []
-          setState(stateResponse.state)
-          setSessions(nextSessions)
-          setTrash(Array.isArray(trashResponse.entries) ? trashResponse.entries : [])
-          setIncomplete(Array.isArray(trashResponse.incomplete) ? trashResponse.incomplete : [])
-          setAudit(Array.isArray(auditResponse.records) ? auditResponse.records : [])
-          // Drop selections whose conversation no longer exists.
-          setSelected((current) => {
-            const alive = new Set(nextSessions.map((session) => session.id))
-            const next = new Set([...current].filter((id) => alive.has(id)))
-            return next.size === current.size ? current : next
-          })
+          if (which === 'trash') {
+            const response = await api('/trash')
+            if (stale()) return
+            setTrash(Array.isArray(response.entries) ? response.entries : [])
+            setIncomplete(Array.isArray(response.incomplete) ? response.incomplete : [])
+          } else if (which === 'batch') {
+            const response = await api('/sessions')
+            if (stale()) return
+            const nextSessions = Array.isArray(response.sessions) ? response.sessions : []
+            setSessions(nextSessions)
+            // Drop selections whose conversation no longer exists.
+            setSelected((current) => {
+              const alive = new Set(nextSessions.map((session) => session.id))
+              const next = new Set([...current].filter((id) => alive.has(id)))
+              return next.size === current.size ? current : next
+            })
+          } else {
+            const response = await api('/audit?limit=50')
+            if (stale()) return
+            setAudit(Array.isArray(response.records) ? response.records : [])
+          }
+          loadedRef.current[which] = mutationVersion
         } catch (caught) {
           if (!stale()) setError(caught)
         } finally {
-          if (!stale()) setLoading(false)
+          if (!stale()) setTabBusy(null)
         }
-      }, [])
+      }, [mutationVersion])
 
-      useEffect(() => { void refresh() }, [refresh])
+      // `/state` drives the capability block and the limits; refetch it on
+      // mount and whenever a mutation happened, not on every tab switch.
+      useEffect(() => {
+        refreshState().catch((caught) => setError(caught))
+      }, [mutationVersion, refreshState])
 
-      // A deletion or restore performed from the dialog must also update this
-      // section's own session/trash copies.
+      // The active tab's own slice, on mount, on tab switch, and after a
+      // mutation (which changes `loadTab`'s identity through the version).
       useEffect(() => {
-        if (mutationVersion > 0) void refresh()
-      }, [mutationVersion, refresh])
+        void loadTab(tab)
+      }, [tab, loadTab])
+
+      /** Header "refresh" button: re-read state and the visible tab. */
+      const refresh = useCallback(async () => {
+        await Promise.all([
+          refreshState().catch((caught) => setError(caught)),
+          loadTab(tab, { force: true }),
+        ])
+      }, [tab, refreshState, loadTab])
+
+      /**
+       * Mark a slice stale without fetching it. Recycle-bin actions call
+       * `refreshAfterMutation({ notify: false })`, so no version bump happens:
+       * the visible tab is re-read by `refresh()`, and any other tab must be
+       * re-read the next time the user opens it instead of showing rows that
+       * were deleted a moment ago.
+       */
+      const markStale = useCallback((...which) => {
+        for (const name of which) loadedRef.current[name] = -1
+      }, [])
 
       async function restore(trashId) {
         setError(null)
         const entry = trash.find((item) => item.trashId === trashId)
         try {
-          await api('/trash/restore', { method: 'POST', body: { trashId } })
+          await api('/trash/restore', {
+            method: 'POST',
+            body: { trashId },
+            timeoutMs: TRASH_MUTATION_TIMEOUT_MS,
+          })
           flashStore.show(t('trash.restored'))
+          markStale('trash', 'batch')
           await refresh()
           await refreshAfterMutation({
             sessionIds: typeof entry?.sessionId === 'string' ? [entry.sessionId] : [],
@@ -1601,8 +1717,13 @@ window.__ModuleLoader__.load({
         setError(null)
         setRestoreBusyId(trashId)
         try {
-          await api('/trash/restore', { method: 'POST', body: { trashId } })
+          await api('/trash/restore', {
+            method: 'POST',
+            body: { trashId },
+            timeoutMs: TRASH_MUTATION_TIMEOUT_MS,
+          })
           flashStore.show(t('trash.restored'))
+          markStale('trash', 'batch')
           await refresh()
           await refreshAfterMutation({
             sessionIds: incomplete.find((item) => item.trashId === trashId)?.sessionId
@@ -1624,10 +1745,15 @@ window.__ModuleLoader__.load({
         setError(null)
         const entry = trash.find((item) => item.trashId === trashId)
         try {
-          await api('/trash/purge', { method: 'POST', body: { trashId, confirmPhrase: phrase } })
+          await api('/trash/purge', {
+            method: 'POST',
+            body: { trashId, confirmPhrase: phrase },
+            timeoutMs: TRASH_MUTATION_TIMEOUT_MS,
+          })
           flashStore.show(t('trash.purged'))
           setPurgeTarget(null)
           setPurgePhrase('')
+          markStale('trash', 'batch')
           await refresh()
           // Purging a soft entry detaches the session from its workspace.
           await refreshAfterMutation({
@@ -1647,10 +1773,15 @@ window.__ModuleLoader__.load({
         setDiscardBusyId(trashId)
         setError(null)
         try {
-          await api('/trash/discard', { method: 'POST', body: { trashId, confirmPhrase: phrase } })
+          await api('/trash/discard', {
+            method: 'POST',
+            body: { trashId, confirmPhrase: phrase },
+            timeoutMs: TRASH_MUTATION_TIMEOUT_MS,
+          })
           flashStore.show(t('trash.discarded'))
           setDiscardTarget(null)
           setDiscardPhrase('')
+          markStale('trash')
           await refresh()
         } catch (caught) {
           setError(caught)
@@ -1700,7 +1831,7 @@ window.__ModuleLoader__.load({
             h('h1', { className: 'dc-title' }, t('section.title')),
             h('p', { className: 'dc-hint' }, t('section.subtitle'))),
           h('div', { className: 'dc-header-actions' },
-            h(Button, { onClick: () => { void refresh() }, disabled: loading, title: t('action.refresh') },
+            h(Button, { onClick: () => { void refresh() }, disabled: tabBusy !== null, title: t('action.refresh') },
               h(GlyphRefresh, { size: 13 }), ' ', t('action.refresh')))),
 
         h(ErrorBanner, { error }),
@@ -1729,9 +1860,14 @@ window.__ModuleLoader__.load({
           h('button', { id: 'dc-tab-batch', type: 'button', role: 'tab', 'aria-selected': tab === 'batch', 'aria-controls': 'dc-panel-batch', className: `dc-tab${tab === 'batch' ? ' dc-tab-active' : ''}`, onClick: () => setTab('batch') }, t('batch.title')),
           h('button', { id: 'dc-tab-audit', type: 'button', role: 'tab', 'aria-selected': tab === 'audit', 'aria-controls': 'dc-panel-audit', className: `dc-tab${tab === 'audit' ? ' dc-tab-active' : ''}`, onClick: () => setTab('audit') }, t('audit.title'))),
 
-        loading ? h(Spinner, { label: t('dialog.loading') }) : null,
+        // First paint only: once anything has been rendered, a refresh keeps the
+        // panels mounted and shows the inline indicator below instead.
+        state === null && tabBusy !== null ? h(Spinner, { label: t('dialog.loading') }) : null,
+        state !== null && tabBusy !== null
+          ? h('div', { className: 'dc-loading' }, h('span', { className: 'dc-spinner' }), ' ', t('dialog.loading'))
+          : null,
 
-        tab === 'trash' && !loading ? h('div', { id: 'dc-panel-trash', role: 'tabpanel', 'aria-labelledby': 'dc-tab-trash', className: 'dc-panel' },
+        tab === 'trash' ? h('div', { id: 'dc-panel-trash', role: 'tabpanel', 'aria-labelledby': 'dc-tab-trash', className: 'dc-panel' },
           trash.length === 0 ? h('div', { className: 'dc-empty' }, t('trash.empty')) : null,
           ...trash.map((entry) => h('div', { key: entry.trashId, className: 'dc-row' },
             h('div', { className: 'dc-row-main' },
@@ -1754,7 +1890,7 @@ window.__ModuleLoader__.load({
                   h(Button, { disabled: purgeBusy === true, onClick: () => { setPurgeTarget(null); setPurgePhrase('') } }, t('action.cancel')))
                 : h(Button, { variant: 'danger', onClick: () => { setPurgeTarget(entry.trashId); setPurgePhrase('') } }, t('action.purge')))))) : null,
 
-        tab === 'trash' && !loading && incomplete.length > 0 ? h(IncompleteEntries, {
+        tab === 'trash' && incomplete.length > 0 ? h(IncompleteEntries, {
           entries: incomplete,
           discardTarget,
           discardPhrase,
@@ -1767,7 +1903,7 @@ window.__ModuleLoader__.load({
           discardBusyId,
         }) : null,
 
-        tab === 'batch' && !loading ? h('div', { id: 'dc-panel-batch', role: 'tabpanel', 'aria-labelledby': 'dc-tab-batch', className: 'dc-panel' },
+        tab === 'batch' ? h('div', { id: 'dc-panel-batch', role: 'tabpanel', 'aria-labelledby': 'dc-tab-batch', className: 'dc-panel' },
           h('div', { className: 'dc-batch-bar' },
             h('span', { className: 'dc-hint' }, t('batch.selected', { count: selectedIds.length })),
             // "Select all" only marks deletable rows: a batch containing one
@@ -1793,7 +1929,7 @@ window.__ModuleLoader__.load({
             onToggle: toggle,
           }))) : null,
 
-        tab === 'audit' && !loading ? h('div', { id: 'dc-panel-audit', role: 'tabpanel', 'aria-labelledby': 'dc-tab-audit', className: 'dc-panel' },
+        tab === 'audit' ? h('div', { id: 'dc-panel-audit', role: 'tabpanel', 'aria-labelledby': 'dc-tab-audit', className: 'dc-panel' },
           audit.length === 0 ? h('div', { className: 'dc-empty' }, t('audit.empty')) : null,
           ...audit.map((record) => h('div', { key: record.id, className: 'dc-row' },
             h('div', { className: 'dc-row-main' },
@@ -1974,6 +2110,15 @@ window.__ModuleLoader__.load({
     exports.__store = { dialogStore, flashStore, mutationStore, uiFlagsStore }
     exports.__refreshAfterMutation = refreshAfterMutation
     exports.__mutationTimeoutMs = mutationTimeoutMs
+    // Exposed so the harness can assert the client budget stays ABOVE the
+    // Host's own TRASH_LOCK_BUDGET_MS: whichever side gives up first decides
+    // whether the user sees "failed" for work that actually completed.
+    exports.__requestBudgets = {
+      request: REQUEST_TIMEOUT_MS,
+      mutation: MUTATION_TIMEOUT_MS,
+      trashMutation: TRASH_MUTATION_TIMEOUT_MS,
+    }
+    exports.__apiUrl = apiUrl
     exports.__api = api
     // Direct component handles keep the hook-level behavior testable without a
     // DOM renderer (the registered wrapper alone only builds an element).

package/config.schema.json

@@ -8,7 +8,11 @@
   "properties": {
     "enabled": { "type": "boolean", "default": true, "description": "Master switch. When false the route answers 503 and the UI hides its entries." },
     "requireSameOrigin": { "type": "boolean", "default": true, "description": "Reject requests whose Origin does not match the request's full authority (hostname AND effective port; a missing port defaults by the Origin's own scheme). The desktop shell source dsh-app://app is trusted, matching DSH's own fence." },
-    "allowNonLoopback": { "type": "boolean", "default": false, "description": "Allow requests when the Web server is bound beyond loopback." },
+    "allowNonLoopback": { "type": "boolean", "default": false, "description": "Allow requests from any authority, not just loopback. Prefer allowedHosts when a reverse proxy presents a known hostname." },
+    "allowedHosts": {
+      "type": "array", "items": { "type": "string" }, "maxItems": 32, "default": [],
+      "description": "Authorities a prefix-stripping reverse proxy may present in Host (host, host:port, or [v6]:port). A bare host admits any port; an entry with a port admits only that port. Entries with a scheme, path, userinfo or wildcard are dropped. Empty = loopback only."
+    },
     "allowOrphanSessions": { "type": "boolean", "default": false, "description": "Allow deleting sessions that no registered workspace owns." },
     "allowSubagentSessions": { "type": "boolean", "default": false, "description": "Allow deleting sessions whose header origin is 'subagent'." },
     "stopLiveSessions": { "type": "boolean", "default": true, "description": "Hard deletion first stops a live session (cancel turn + archive stopActivity + bounded drain). Set false to refuse live sessions instead." },

package/cordis.patch.yml

@@ -22,6 +22,10 @@
         # unless the operator opts in explicitly below.
         requireSameOrigin: true
         allowNonLoopback: false
+        # Reverse-proxy deployments: list the exact authorities the proxy puts
+        # in `Host` (host, host:port). A bare host admits any port. Listing them
+        # is narrower than turning allowNonLoopback on for every hostname.
+        allowedHosts: []
         # Session ownership policy.
         allowOrphanSessions: false      # sessions with no registered workspace
         allowSubagentSessions: false    # sessions created by subagents

package/lib/core/audit.js

@@ -11,7 +11,7 @@
  * actor (the local Web UI), session ids, mode, the memory checkbox, per-adapter
  * counts, and whether a failed transaction was rolled back.
  */
-import { appendFile, mkdir, readFile, rename, stat, writeFile } from 'node:fs/promises'
+import { appendFile, mkdir, open, readFile, rename, stat, writeFile } from 'node:fs/promises'
 import { dirname } from 'node:path'
 
 /**
@@ -19,10 +19,11 @@ import { dirname } from 'node:path'
  * @param {string} options.filePath absolute path of the JSONL file
  * @param {number} [options.maxBytes] compact threshold
  * @param {number} [options.retentionLines] lines kept after compaction
+ * @param {number} [options.tailWindowBytes] byte window tail() reads from the end (default 256KB)
  * @param {() => number} [options.now]
- * @param {Pick<typeof import('node:fs/promises'), 'readFile'|'writeFile'|'mkdir'|'appendFile'|'rename'|'stat'>} [options.fsApi]
+ * @param {Pick<typeof import('node:fs/promises'), 'readFile'|'writeFile'|'mkdir'|'appendFile'|'rename'|'stat'|'open'>} [options.fsApi]
  */
-export function createAuditLog({ filePath, maxBytes = 5 * 1024 * 1024, retentionLines = 5_000, now = Date.now, fsApi = { readFile, writeFile, mkdir, appendFile, rename, stat } }) {
+export function createAuditLog({ filePath, maxBytes = 5 * 1024 * 1024, retentionLines = 5_000, tailWindowBytes = 256 * 1024, now = Date.now, fsApi = { readFile, writeFile, mkdir, appendFile, rename, stat, open } }) {
   let pending = Promise.resolve()
 
   function serialize(operation) {
@@ -77,48 +78,59 @@ export function createAuditLog({ filePath, maxBytes = 5 * 1024 * 1024, retention
 
     /**
      * Read the most recent `limit` records; malformed lines are counted, not
-     * thrown. Only the tail window (≤256KB) is read and parsed: the settings
-     * page asks for the last N rows on every open, and a full up-to-5MB parse
-     * on each request scaled with the whole trail, not with `limit`. Malformed
-     * lines outside the window are not counted (the metric describes the
-     * displayed window).
+     * thrown. Only the tail window (default 256KB) is read and parsed: the
+     * settings page asks for the last N rows on every open, and a full
+     * up-to-5MB parse on each request scaled with the whole trail, not with
+     * `limit`. `fs.readFile` does not honour `{start,end}`, so this uses a
+     * positional `FileHandle.read`; earlier revisions silently read the whole
+     * file while appearing to window. Malformed lines outside the window are
+     * not counted (the metric describes the displayed window).
      */
     async tail(limit = 50) {
       const maxRecords = Math.max(1, Math.floor(limit))
-      const CHUNK = 256 * 1024
-      let size = 0
+      const CHUNK = Math.max(1, Math.floor(tailWindowBytes))
+      let handle
       try {
-        size = (await fsApi.stat(filePath)).size
+        handle = await fsApi.open(filePath, 'r')
       } catch (error) {
         if (error?.code === 'ENOENT') return { records: [], malformed: 0 }
         throw error
       }
-      const start = Math.max(0, size - CHUNK)
-      let buffer
       try {
-        buffer = start > 0
-          ? await fsApi.readFile(filePath, { start, end: size })
-          : await fsApi.readFile(filePath, 'utf8')
-      } catch (error) {
-        if (error?.code === 'ENOENT') return { records: [], malformed: 0 }
-        throw error
-      }
-      const text = Buffer.isBuffer(buffer) ? buffer.toString('utf8') : String(buffer)
-      const rawLines = text.split('\n')
-      // A chunk starts mid-line; drop the partial first line instead of
-      // parsing a torn fragment as malformed.
-      const lines = (start > 0 ? rawLines.slice(1) : rawLines)
-        .filter((line) => line.trim() !== '')
-      const records = []
-      let malformed = 0
-      for (const line of lines) {
-        try {
-          records.push(JSON.parse(line))
-        } catch {
-          malformed += 1
+        const statInfo = await handle.stat()
+        const size = statInfo.size
+        const start = Math.max(0, size - CHUNK)
+        const windowLength = size - start
+        const buffer = Buffer.alloc(windowLength)
+        const windowRead = await handle.read(buffer, 0, windowLength, start)
+        const text = buffer.subarray(0, windowRead.bytesRead).toString('utf8')
+        // `rawLines[0]` is only a torn fragment when the window starts
+        // *inside* a line. Read the byte at `start-1`: `\n` means the window
+        // begins on a line boundary and rawLines[0] is a complete record;
+        // unconditionally dropping it (pre-0.3.4) silently lost one valid
+        // record whenever the byte window happened to align with a newline.
+        let dropFirst = false
+        if (start > 0) {
+          const peek = Buffer.alloc(1)
+          const peekRead = await handle.read(peek, 0, 1, start - 1)
+          dropFirst = !(peekRead.bytesRead === 1 && peek[0] === 0x0a)
+        }
+        const rawLines = text.split('\n')
+        const lines = (dropFirst ? rawLines.slice(1) : rawLines)
+          .filter((line) => line.trim() !== '')
+        const records = []
+        let malformed = 0
+        for (const line of lines) {
+          try {
+            records.push(JSON.parse(line))
+          } catch {
+            malformed += 1
+          }
         }
+        return { records: records.slice(-maxRecords), malformed }
+      } finally {
+        await handle.close()
       }
-      return { records: records.slice(-maxRecords), malformed }
     },
   }
 }

package/lib/core/config.js

@@ -13,6 +13,11 @@ export const DEFAULTS = deepFreeze({
   enabled: true,
   requireSameOrigin: true,
   allowNonLoopback: false,
+  // Exact authorities a prefix-stripping reverse proxy may present in `Host`
+  // (`app.example`, `app.example:8443`, `[::1]:8443`). Empty = loopback only.
+  // This exists so an operator behind a proxy does not have to switch
+  // `allowNonLoopback` on for every hostname the machine can be reached by.
+  allowedHosts: [],
   allowOrphanSessions: false,
   allowSubagentSessions: false,
   // Hard deletion of a live session first stops it (cancel turn + archive
@@ -138,6 +143,45 @@ function readStringArray(raw, fallback, field, warnings) {
   return raw.map((item) => item.trim()).filter((item) => item !== '')
 }
 
+/** `host`, `host:port` or `[v6]:port` — the only shapes a `Host` header may take. */
+const HOST_AUTHORITY_PATTERN = /^(?:\[[0-9a-f:.]+\]|[a-z0-9._-]+)(?::\d{1,5})?$/i
+const MAX_ALLOWED_HOSTS = 32
+
+/**
+ * Normalize the reverse-proxy authority allowlist.
+ *
+ * Entries are compared case-insensitively as complete authorities. A bare host
+ * (`app.example`) matches any port, an entry with a port (`app.example:8443`)
+ * matches only that port. Anything that is not a bare authority — a scheme, a
+ * path, userinfo, a wildcard — is dropped with a warning: this list is a
+ * security boundary, so a typo must not silently widen it.
+ */
+function readHostList(raw, field, warnings) {
+  if (raw === undefined) return []
+  if (!Array.isArray(raw)) {
+    warnings.push(`${field}: expected an array of authorities, using the default`)
+    return []
+  }
+  const out = []
+  for (const item of raw) {
+    if (typeof item !== 'string') {
+      warnings.push(`${field}: dropped a non-string entry`)
+      continue
+    }
+    const value = item.trim().toLowerCase().replace(/\.$/, '')
+    if (value === '') continue
+    if (!HOST_AUTHORITY_PATTERN.test(value)) {
+      warnings.push(`${field}: dropped "${item}", expected host or host:port without a scheme or path`)
+      continue
+    }
+    if (!out.includes(value)) out.push(value)
+  }
+  if (out.length > MAX_ALLOWED_HOSTS) {
+    warnings.push(`${field}: only the first ${MAX_ALLOWED_HOSTS} entries are used`)
+  }
+  return out.slice(0, MAX_ALLOWED_HOSTS)
+}
+
 /**
  * Normalize one raw row config into the exact object the plugin reads.
  *
@@ -197,6 +241,7 @@ export function normalizeConfig(raw) {
     enabled: readBool(source.enabled, DEFAULTS.enabled, 'enabled', warnings),
     requireSameOrigin: readBool(source.requireSameOrigin, DEFAULTS.requireSameOrigin, 'requireSameOrigin', warnings),
     allowNonLoopback: readBool(source.allowNonLoopback, DEFAULTS.allowNonLoopback, 'allowNonLoopback', warnings),
+    allowedHosts: readHostList(source.allowedHosts, 'allowedHosts', warnings),
     allowOrphanSessions: readBool(source.allowOrphanSessions, DEFAULTS.allowOrphanSessions, 'allowOrphanSessions', warnings),
     allowSubagentSessions: readBool(source.allowSubagentSessions, DEFAULTS.allowSubagentSessions, 'allowSubagentSessions', warnings),
     stopLiveSessions: readBool(source.stopLiveSessions, DEFAULTS.stopLiveSessions, 'stopLiveSessions', warnings),

package/lib/core/memory/json-index-adapter.js

@@ -137,7 +137,27 @@ export function createJsonIndexMemoryAdapter(options) {
     })
   }
 
+  /**
+   * Last parsed snapshot, keyed by the file's identity (mtime + size).
+   *
+   * A single `/preview` probes the adapter and then counts nodes, and both used
+   * to `readFile` + `JSON.parse` the whole index: 2 full reads of a 1.9 MB
+   * index cost ~39 ms. The stat key catches a concurrent md_cg write without a
+   * TTL, and every write this adapter performs clears the entry.
+   */
+  let snapshotCache = null
+
   async function readSnapshot() {
+    let key = null
+    if (typeof fsApi.stat === 'function') {
+      try {
+        const info = await fsApi.stat(indexFile)
+        key = `${info.mtimeMs}:${info.size}`
+      } catch {
+        // Fall through: readFile below reports the real error (ENOENT etc.).
+      }
+    }
+    if (key !== null && snapshotCache !== null && snapshotCache.key === key) return snapshotCache.snapshot
     const raw = await fsApi.readFile(indexFile, 'utf8')
     let index
     try {
@@ -158,7 +178,9 @@ export function createJsonIndexMemoryAdapter(options) {
     if (nodes === null || typeof nodes !== 'object') {
       throw new DeleteError('E_MEMORY_FAILED', `Memory index has no node map at ${nodesPointer}`, { indexFile, nodesPointer })
     }
-    return { index, nodes, sig: createHash('sha256').update(raw).digest('hex') }
+    const snapshot = { index, nodes, sig: createHash('sha256').update(raw).digest('hex') }
+    if (key !== null) snapshotCache = { key, snapshot }
+    return snapshot
   }
 
   async function readIndex() {
@@ -170,6 +192,9 @@ export function createJsonIndexMemoryAdapter(options) {
     const temporary = `${indexFile}.delete-conversation.tmp`
     await fsApi.writeFile(temporary, `${JSON.stringify(index)}\n`, 'utf8')
     await fsApi.rename(temporary, indexFile)
+    // The next reader must not see the pre-write snapshot, even if the rename
+    // happened within the filesystem's mtime granularity.
+    snapshotCache = null
   }
 
   async function newestLogMtimeMs() {

package/lib/core/trash.js

@@ -19,6 +19,29 @@ import { join } from 'node:path'
 
 const MANIFEST = 'manifest.json'
 const TRASH_ID_PATTERN = /^[0-9a-z]{2,40}-[0-9a-z]{2,20}$/
+/**
+ * Manifest reads in flight during one directory scan. The work is dominated by
+ * syscalls on many small files, so a small fixed pool removes the serial
+ * round-trip chain without flooding the FS with hundreds of concurrent opens.
+ */
+const SCAN_CONCURRENCY = 8
+
+/** Ordered `map` with at most `limit` promises in flight. */
+async function mapLimit(items, limit, fn) {
+  const out = new Array(items.length)
+  let next = 0
+  const workers = Array.from({ length: Math.min(Math.max(1, limit), items.length) }, async () => {
+    while (true) {
+      const index = next
+      next += 1
+      if (index >= items.length) return
+      out[index] = await fn(items[index], index)
+    }
+  })
+  await Promise.all(workers)
+  return out
+}
+
 
 /** Statuses a manifest may carry. `pending` and `failed` are never listed. */
 export const TRASH_STATUS = Object.freeze(['pending', 'trashed', 'failed', 'restoring', 'restored', 'purging'])
@@ -102,17 +125,64 @@ export function createTrashStore({ rootDir, now = Date.now, newId, fsApi = { mkd
       return parsed
     },
 
-    /** Every readable manifest, newest first, regardless of status. */
-    async listAll() {
+    /**
+     * One directory pass over the recycle bin.
+     *
+     * `listAll()` and `scanUnreadable()` used to be called together by `/trash`
+     * and each did its own `readdir` plus one `readFile` per entry, so every
+     * listing cost 2N manifest reads (measured at ~0.31 ms per entry, 156 ms at
+     * 500 entries). They now share this single pass: one `readdir`, one read per
+     * entry, bounded concurrency instead of a serial `for await`.
+     *
+     * A missing or unreadable root yields empty lists rather than throwing: the
+     * settings page must still render on a fresh install with no trash yet.
+     * @returns {Promise<{ entries: object[], unreadable: Array<{ trashId: string, reason: 'missing-manifest'|'corrupt-manifest'|'unreadable-manifest' }> }>}
+     */
+    async scanAll() {
       await ensureRoot()
-      const dirents = await fsApi.readdir(rootDir, { withFileTypes: true })
-      const entries = []
+      let dirents = []
+      try {
+        dirents = await fsApi.readdir(rootDir, { withFileTypes: true })
+      } catch {
+        return { entries: [], unreadable: [] }
+      }
+      const names = []
       for (const dirent of dirents) {
-        if (!dirent.isDirectory() || !isTrashId(dirent.name)) continue
-        const entry = await this.read(dirent.name)
-        if (entry !== null) entries.push(entry)
+        if (dirent.isDirectory() && isTrashId(dirent.name)) names.push(dirent.name)
+      }
+      const scanned = await mapLimit(names, SCAN_CONCURRENCY, async (trashId) => {
+        let raw
+        try {
+          raw = await fsApi.readFile(join(rootDir, trashId, MANIFEST), 'utf8')
+        } catch (error) {
+          return { trashId, reason: error?.code === 'ENOENT' ? 'missing-manifest' : 'unreadable-manifest' }
+        }
+        let parsed
+        try {
+          parsed = JSON.parse(raw)
+        } catch {
+          return { trashId, reason: 'corrupt-manifest' }
+        }
+        if (parsed === null || typeof parsed !== 'object' || parsed.format !== 1 || !TRASH_STATUS.includes(parsed.status)) {
+          return { trashId, reason: 'corrupt-manifest' }
+        }
+        return { entry: parsed }
+      })
+      const entries = []
+      const unreadable = []
+      for (const item of scanned) {
+        if (item.entry !== undefined) entries.push(item.entry)
+        else unreadable.push({ trashId: item.trashId, reason: item.reason })
       }
+      // Newest first. `Array.prototype.sort` is stable, so equal timestamps keep
+      // the directory order the scan produced.
       entries.sort((left, right) => (right.deletedAt ?? 0) - (left.deletedAt ?? 0))
+      return { entries, unreadable }
+    },
+
+    /** Every readable manifest, newest first, regardless of status. */
+    async listAll() {
+      const { entries } = await this.scanAll()
       return entries
     },
 
@@ -128,37 +198,11 @@ export function createTrashStore({ rootDir, now = Date.now, newId, fsApi = { mkd
      * are invisible to restore/purge but must still be listable and
      * discardable, otherwise a single bad manifest strands the directory on
      * disk forever.
-     * @returns {Array<{ trashId: string, reason: 'missing-manifest'|'corrupt-manifest'|'unreadable-manifest' }>}
+     * @returns {Promise<Array<{ trashId: string, reason: 'missing-manifest'|'corrupt-manifest'|'unreadable-manifest' }>>}
      */
     async scanUnreadable() {
-      await ensureRoot()
-      const out = []
-      let dirents = []
-      try {
-        dirents = await fsApi.readdir(rootDir, { withFileTypes: true })
-      } catch {
-        return out
-      }
-      for (const dirent of dirents) {
-        if (!dirent.isDirectory() || !isTrashId(dirent.name)) continue
-        let raw
-        let reason = 'missing-manifest'
-        try {
-          raw = await fsApi.readFile(join(rootDir, dirent.name, MANIFEST), 'utf8')
-        } catch (error) {
-          if (error?.code !== 'ENOENT') reason = 'unreadable-manifest'
-          out.push({ trashId: dirent.name, reason })
-          continue
-        }
-        try {
-          const parsed = JSON.parse(raw)
-          const readable = parsed !== null && typeof parsed === 'object' && parsed.format === 1 && TRASH_STATUS.includes(parsed.status)
-          if (!readable) out.push({ trashId: dirent.name, reason: 'corrupt-manifest' })
-        } catch {
-          out.push({ trashId: dirent.name, reason: 'corrupt-manifest' })
-        }
-      }
-      return out
+      const { unreadable } = await this.scanAll()
+      return unreadable
     },
 
     async remove(trashId) {

package/lib/host/api.js

@@ -60,6 +60,18 @@ import { SESSION_ID_PATTERN } from '../core/ids.js'
 export const ROUTE_PREFIX = '/conversation-recycle-bin/api'
 export const REQUIRED_HEADER = 'x-conversation-recycle-bin'
 const MAX_BODY_BYTES = 256 * 1024
+/**
+ * Lock wait budget for the single-entry trash mutations.
+ *
+ * `serialize()` chains every mutation in-process and then takes the
+ * cross-process file lock, so restore / purge / discard can sit behind a whole
+ * batch delete. They used to fall back to the generic 30s lock timeout, which
+ * is shorter than one batch's legitimate worst case: the Host answered
+ * E_LOCK_BUSY for a request that only needed to wait. The Client's own budget
+ * (TRASH_MUTATION_TIMEOUT_MS = 195s) is deliberately slightly larger, so this
+ * budget — not the browser's AbortController — decides the outcome.
+ */
+export const TRASH_LOCK_BUDGET_MS = 180_000
 
 function isLoopbackHostname(hostname) {
   const value = String(hostname ?? '').trim().toLowerCase().replace(/^\[|\]$/g, '')
@@ -99,6 +111,28 @@ function portOf(hostHeader) {
   return colon > 0 && /^\d+$/.test(value.slice(colon + 1)) ? value.slice(colon + 1) : ''
 }
 
+/**
+ * Whether a request authority matches the operator's `allowedHosts` list.
+ *
+ * A bare entry (`app.example`) admits any port on that host; an entry with a
+ * port admits only that port. Comparison is hostname-normalized (IPv6 brackets
+ * and `::ffff:` mapped addresses included) so `[::1]:8443` and `[::1]:8443`
+ * agree regardless of case.
+ */
+function authorityAllowed(hostHeader, allowedHosts) {
+  if (!Array.isArray(allowedHosts) || allowedHosts.length === 0) return false
+  const hostname = hostnameOf(hostHeader)
+  if (hostname === '') return false
+  const port = portOf(hostHeader)
+  for (const entry of allowedHosts) {
+    if (typeof entry !== 'string') continue
+    if (!sameHostname(hostnameOf(entry), hostname)) continue
+    const entryPort = portOf(entry)
+    if (entryPort === '' || entryPort === port) return true
+  }
+  return false
+}
+
 /** The port a URL implies when it omits one. */
 function defaultPortFor(protocol) {
   if (protocol === 'https:' || protocol === 'wss:') return '443'
@@ -116,7 +150,7 @@ function defaultPortFor(protocol) {
  * both mean 443).
  * @returns {{ ok: true } | { ok: false, error: DeleteError }}
  */
-export function requestOriginVerdict(headers, { requireSameOrigin, allowNonLoopback }) {
+export function requestOriginVerdict(headers, { requireSameOrigin, allowNonLoopback, allowedHosts = [] }) {
   const read = (name) => {
     if (headers === null || typeof headers !== 'object') return ''
     const value = headers[name]
@@ -124,11 +158,12 @@ export function requestOriginVerdict(headers, { requireSameOrigin, allowNonLoopb
   }
   const requestHostname = hostnameOf(read('host'))
 
-  if (!allowNonLoopback && !isLoopbackHostname(requestHostname)) {
+  if (!allowNonLoopback && !isLoopbackHostname(requestHostname) && !authorityAllowed(read('host'), allowedHosts)) {
     return {
       ok: false,
-      error: new DeleteError('E_FORBIDDEN_HOST', 'This route only accepts loopback requests unless allowNonLoopback is enabled.', {
+      error: new DeleteError('E_FORBIDDEN_HOST', 'This route only accepts loopback requests unless the authority is listed in allowedHosts (or allowNonLoopback is enabled).', {
         host: read('host') || null,
+        allowedHosts: Array.isArray(allowedHosts) ? allowedHosts : [],
       }),
     }
   }
@@ -634,7 +669,13 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     // Budget is consumed per actually-attempted deletion: a failed item must
     // not silently spend the minute quota it never used. The very first item
     // still refuses outright with 429 (the existing contract); once a plan
-    // has started, later exhausted items are recorded as failures instead.
+    // has started, later exhausted items are recorded as failures.
+    //
+    // A refusal inside the loop uses `continue`, never `break`: `break` used
+    // to drop every session after the exhausted one from both `results` and
+    // `failures`, so a batch of 50 with a 20/min budget left items 22-50
+    // looking like the plan never mentioned them. Under the per-plan
+    // serialize this is still visible via `maxBatchSessions` > budget.
     const request = requestId()
     const results = []
     const failures = []
@@ -647,7 +688,7 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
         })
         if (results.length === 0 && failures.length === 0) throw rateError
         failures.push({ sessionId: session.id, error: rateError.toJSON() })
-        break
+        continue
       }
       if (!validated.record.used) markConfirmationUsed(validated)
       try {
@@ -839,7 +880,7 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     // invisible and impossible to clean up at all. Directories whose manifest
     // is missing/corrupt are surfaced as `unreadable` so they are not stranded
     // on disk; the Client renders both groups separately.
-    const [all, unreadable] = await Promise.all([trash.listAll(), trash.scanUnreadable()])
+    const { entries: all, unreadable } = await trash.scanAll()
     const result = {
       entries: all.filter((entry) => entry.status === 'trashed').map(serializeEntry),
       incomplete: [
@@ -980,17 +1021,17 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
         return
       }
       if (path === '/trash/restore') {
-        const result = await serialize(() => restoreEntry(body?.trashId))
+        const result = await serialize(() => restoreEntry(body?.trashId), { lockTimeoutMs: TRASH_LOCK_BUDGET_MS })
         sendJson(res, 200, { ok: true, ...result })
         return
       }
       if (path === '/trash/purge') {
-        const result = await serialize(() => purgeEntry(body?.trashId, body?.confirmPhrase))
+        const result = await serialize(() => purgeEntry(body?.trashId, body?.confirmPhrase), { lockTimeoutMs: TRASH_LOCK_BUDGET_MS })
         sendJson(res, 200, { ok: true, ...result })
         return
       }
       if (path === '/trash/discard') {
-        const result = await serialize(() => discardEntry(body?.trashId, body?.confirmPhrase))
+        const result = await serialize(() => discardEntry(body?.trashId, body?.confirmPhrase), { lockTimeoutMs: TRASH_LOCK_BUDGET_MS })
         sendJson(res, 200, { ok: true, ...result })
         return
       }

package/lib/host/feedback.js

@@ -338,7 +338,14 @@ export function createFeedbackService({ config, env = process.env, now = Date.no
       throw new DeleteError('E_FEEDBACK_TRANSPORT', 'This Host runtime provides no fetch() to deliver feedback.', { transport: 'http' })
     }
     const headers = { 'content-type': 'application/json' }
-    if (settings.apiToken !== '') headers[settings.authHeader.toLowerCase()] = `Bearer ${settings.apiToken}`
+    if (settings.apiToken !== '') {
+      // `Authorization` is the one header whose RFC 7235 grammar mandates an
+      // auth-scheme token; a custom header (X-Api-Key, x-goog-api-key, …)
+      // expects the bare secret. Prefixing `Bearer` unconditionally 401'd
+      // every non-Authorization relay the user pointed us at.
+      const scheme = settings.authHeader.toLowerCase() === 'authorization' ? `Bearer ${settings.apiToken}` : settings.apiToken
+      headers[settings.authHeader.toLowerCase()] = scheme
+    }
     const body = {
       from: (settings.visitorAsFrom === true && submission.email) ? submission.email : (settings.from === '' ? undefined : settings.from),
       to: [settings.to],

package/lib/version.js

@@ -5,4 +5,4 @@
  * asserted against it by `test/manifest.test.mjs` so the two can never drift
  * (they did: the constant stayed at 0.1.0 while the package reached 0.1.4).
  */
-export const PLUGIN_VERSION = '0.3.3'
+export const PLUGIN_VERSION = '0.3.5'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-conversation-recycle-bin",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "DSH conversation deletion with an optional, previewed cascade into conversation-associated memory: soft delete + recycle bin, audit trail, batch rate limits and per-session rollback. 删除对话（可选一并删除关联记忆）：软删除与回收站、审计留痕、批量限流、失败回滚。",
   "repository": {
     "type": "git",