dsh-conversation-recycle-bin 0.3.4 → 0.3.6

package/CHANGELOG.md

@@ -3,6 +3,51 @@
 All notable changes to `dsh-conversation-recycle-bin` are documented here.
 The format follows Keep a Changelog; the project uses Semantic Versioning.
 
+## [0.3.6] — 2026-10-24
+
+对应 `AUDIT-2026-10-24-desktop-web-rc3.md` §7 的四条「建议动作」（A2 / A3 / A5 / A6）。同一节的 A1、A4、A7、A8 复核后判定为产品取舍（不申报未直接消费的 client 依赖、不导出 `Config` 以免设置页脱离非表单语义、归档读保留双源缓存、`missingSessionPaths` 保持成员判定），本版不改。
+
+### Fixed
+
+- **A3 `sessionController` 缺失时抛出的不是插件错误**：`lib/host/lifecycle.js` 新增 `peek()`，把 `ctx.get?.(name) ?? ctx[name]` 的整条退化读取留在 `try` 内。`??` 右侧的属性读会命中 cordis 的 Proxy trap（`cannot get property "sessionController" without inject`），异常类型不是 `DeleteError`，会绕过统一错误映射并让删除在归档前失败。现在 `sessionController` 明确视为可选服务：缺失时跳过 `cancel`，归档与 drain 检查照常执行。新增用例以抛异常的 getter 模拟裁剪组合，断言归档仍然发生。
+- **A6 运行中判定永远落到 `inspect()`**：`lib/host/gateway.js` 的 `probeRunning()` 改为主探 `agents.get(id)?.status === 'running'`（与宿主 `dsh-api-session-controller` 列表行的判据一致），旧的 `Session.running/active/busy` 字段探测降为兜底。删除前置的「是否运行中」现在真正走廉价的实时探测，不必为每次判定重读会话。
+- **A2 事件数列恒为 `—`**：`stat()` 从不返回 `eventCount`，旧代码读的正是这个不存在的字段。活跃会话改用 `Session.seq`（会话存储将其定义为日志长度，精确、纯数值读，不触发已废弃的 `snapshotEvents()`）；已落盘的非活跃会话没有便宜的精确来源，继续返回 `null`、由 UI 显示 `—`，不拿投影游标冒充精确值。新增两个用例（活跃 = 精确值、非活跃 = `null`），并把测试夹具的 `stat()` 改成 0.2.1 的真实形状（去掉 `eventCount`），避免此前的假绿。
+
+### Added
+
+- **A5 `engines.dsh`**：`package.json` 声明 `"dsh": ">=0.2.1-rc.2"`（本插件的实测下限）。该键在安装/声明时由版本闸门读取，运行时不强制；不设上界，因为更晚的版本尚未验证。
+
+### Maintenance
+
+- 测试 138 → **141**（api 41 → 44：活跃/非活跃事件数、无 `sessionController` 的裁剪组合、agents 三态运行判定）。
+- `lib/version.js` 与 `package.json` 同步到 0.3.6（`manifest` 用例守门）。
+
+## [0.3.5] — 2026-10-22
+
+对应 `AUDIT-2026-10-22-desktop-web-compat.md`：把 0.3.4 之后一直只存在于工作树的修复正式发布，并落地该报告 §9 的全部建议。
+
+### Fixed
+
+- **C-01 前缀部署下所有 API 丢失路径前缀**：`client.js` 新增 `apiUrl()`，用 `new URL('.', document.baseURI)` 归一化 base 并去掉 `API_PREFIX` 的前导斜杠，改为文档相对解析。`dsh web --public-url https://host/ui/` 下不再 404；桌面 `dsh-app://app/` 行为不变。0.3.4 的 tarball 仍带此缺陷（`new URL('/conversation-recycle-bin/api…', base)` 会替换整个 base 路径）。新增回归用例断言三种 base（根、`…/ui/`、`…/ui/index.html`、`dsh-app://app/`）解析结果。
+- **C-02 回收站写操作超时短于宿主排队**：客户端 `TRASH_MUTATION_TIMEOUT_MS = 195s`，宿主 `TRASH_LOCK_BUDGET_MS = 180s`（此前 15s / 30s）。批量删除进行中再点恢复/彻底删除，不再出现"界面报错但宿主已执行"。
+- **C-08 锁预算用例一直是红的**：该用例用软删除条目测 `discard`，而软删除按设计保留会话日志，`performDiscard` 必然返回 `E_TRASH_CONFLICT`（409）。改为 seed 一个从未提交的 `pending` 条目（无 `session/`、无 `memory/`），api 用例数 40 → 41 全绿。此前 0.3.4 的 `npm test` 因该用例无法通过而不能作为发布门禁。
+
+### Added
+
+- **C-03 `allowedHosts`**：反代部署的精确 authority 白名单（`host`、`host:port`、`[v6]:port`）。裸主机放行任意端口，带端口的条目只放行该端口；带 scheme/路径/userinfo/通配符的条目会被丢弃并写入 warnings。默认 `[]` = 仅回环，与 0.3.4 行为一致。这样不必为了让反代可用而整体打开 `allowNonLoopback`。`config.schema.json`、`cordis.patch.yml`、README §4.2 同步。
+
+### Changed / Performance
+
+- **P-01 `/trash` 双扫描合并**：`trash.scanAll()` 一次 `readdir` 产出 `{entries, unreadable}`，每条目只读一次 manifest，读取用 8 并发（此前 `listAll` + `scanUnreadable` 各扫一遍，合计 2 次 readdir + 2N 次读，且 `listAll` 串行）。0/50/200/500 条实测 1.2/17.2/63.3/156.3 ms → **1/4.9/14.4/38.1 ms**。
+- **P-02 `/preview` 记忆索引只解析一次**：适配器按 `mtimeMs:size` 缓存已解析快照，`probe()` 与 `countSessions()` 共用；本适配器每次写索引后主动失效，其他进程改写由 stat key 识别。21000 节点（1.9 MB）单条预览 39.2 → **28.9 ms**（剩余部分是单次读盘 + 解析的固有成本）。
+- **P-05 设置页按 tab 懒加载**：挂载/切换只拉当前 tab 需要的接口（回收站 `/trash`、批量 `/sessions`、审计 `/audit`），`/state` 仅在挂载与变更后取；刷新期间面板不再卸载，改为顶部细条指示，滚动位置与输入焦点不再丢失。对应把每次刷新 4 个请求（≈31 KB）降为 1–2 个。
+- **P-04 宽限等待可见化**：彻底删除模式下对话框说明"刚使用过的对话可能多等约 1.5 秒"；提交超过 1.2s 后显示"仍在执行：正在确认没有其他 DSH 实例写入该对话"。等待本身（`foreignWriterGraceMs`）是安全设计，未取消。
+
+### Maintenance
+
+- 测试 131 → **138**（api 41、client 22、core 15、memory 13、cascade 15、feedback 19、manifest 9、trash-audit 4）。
+- README 状态 0.2.2 → 0.3.5，用例计数与设置页/反代说明同步。
+
 ## [0.3.4] — 2026-10-20
 
 对应 `AUDIT-2026-10-20-last3-versions.md` 的四条非阻塞隐患 N1–N4，以及测试驱动下新发现的 P3 回归 N5。

package/README.md

@@ -2,7 +2,7 @@
 
 给 DeepSeek Harness (DSH) Web 增加「删除对话」：会话列表的「…」菜单与会话详情页头部各有一个删除入口；确认框内可勾选「同时删除关联记忆」（默认不勾选），并实时显示将被影响的记忆条数。删除默认进入插件回收站，可恢复；每次操作写入审计日志；批量删除有上限与限流，批量软删除需输入数量，彻底删除一键执行；事务任一步失败即回滚。
 
-> 状态：`0.2.2`，Host + Web Client 双半，零构建（plain JS ESM），只依赖宿主已发布的公开扩展点。
+> 状态：`0.3.5`，Host + Web Client 双半，零构建（plain JS ESM），只依赖宿主已发布的公开扩展点。
 > 包名：`dsh-conversation-recycle-bin`（原 `dsh-delete-conversation` 因 npm 被他人占用而改名，见 CHANGELOG 0.2.0）。
 > 本 README 同时是设计说明与验收依据；安装/回滚步骤见 [INSTALL.md](INSTALL.md)；变更见 [CHANGELOG.md](CHANGELOG.md)。
 
@@ -74,7 +74,7 @@ memory  →  messages  →  session/catalog
 |---|---|---|
 | 会话列表「…」 | `sidebar.workspaces.session.menu.item`（order 500） | 点击后关闭菜单，打开全局确认框 |
 | 会话详情页头部 | `conversation.session.header.actions`（order 100） | 图标按钮打开同一确认框 |
-| 设置页 | `settings.section`（order 1300） | 「回收站 / 批量删除 / 审计留痕」三个标签页 |
+| 设置页 | `settings.section`（order 1300） | 「回收站 / 批量删除 / 审计留痕」三个标签页；按 tab 懒加载，刷新时保留旧数据 |
 | 全局确认框 | `shell.overlay` | 唯一删除发起处；挂在根级，不会随菜单卸载 |
 
 确认框内容：
@@ -111,7 +111,7 @@ memory  →  messages  →  session/catalog
 |---|---|
 | 误删 | 默认软删除；记忆复选框默认关；回收站；彻底删除一键但仍写回收站可恢复；批量软删除需输入数量 |
 | 批量误操作 | `maxBatchSessions`（实际上限还会被本分钟剩余额度收紧，避免"合法批量必然 429"）；批量需输入数量；每个会话独立事务 |
-| 暴力/脚本调用 | 同源校验（完整 authority：主机名+有效端口）+ `x-conversation-recycle-bin: 1` 私有 header + DSH `connection` 层（`requestRejection` + `connection/request` 瀑布流）+ 限流；默认仅接受 loopback 绑定，`allowNonLoopback=false` |
+| 暴力/脚本调用 | 同源校验（完整 authority：主机名+有效端口）+ `x-conversation-recycle-bin: 1` 私有 header + DSH `connection` 层（`requestRejection` + `connection/request` 瀑布流）+ 限流；默认仅接受 loopback 绑定；反代部署用 `allowedHosts` 精确放行（不要为此整体打开 `allowNonLoopback`） |
 | 两个 Host 并发写同一回收站 | mutation 串行 + `<dataDir>/mutation.lock` 跨进程文件锁，抢不到锁返回 `E_LOCK_BUSY`（而非写坏 manifest） |
 | 越权/越界 | 不在工作区登记的会话默认拒绝；可配置允许根目录白名单；受保护 id 列表；子代理会话默认拒绝 |
 | 活跃会话被写坏 | hard 模式对 live 会话先走 `quiesce`：取消当前轮次 → `archiveSession({stopActivity:true})` → 在 `liveDrainMs` 内等待 `running=false`，之后才移动日志；仍停不下来则整笔回滚并报 `E_POLICY_LIVE`。`stopLiveSessions:false` 可恢复为直接拒绝 |
@@ -120,6 +120,17 @@ memory  →  messages  →  session/catalog
 | 不可追溯 | `<DSH_HOME>/delete-conversation/audit.jsonl` 追加成功/失败/回滚/拒绝/恢复/清理记录；设置页可查看 |
 | 外部记忆存储损坏 | 灵枢适配器持有其 `_index.json.lock`，先写 restore bundle 再原子改写索引；任何一步失败先还原正文与索引；详情见 §5.3 |
 
+反代部署（`dsh web --public-url https://host/ui/`）时，代理会把外部主机名放进 `Host`，插件的回环校验会以 `E_FORBIDDEN_HOST` 拒绝。用 `allowedHosts` 精确放行，而不是把 `allowNonLoopback` 整体打开：
+
+| 配置 | 匹配 | 说明 |
+|---|---|---|
+| `allowedHosts: ["app.example"]` | 该主机的任意端口 | 端口在代理侧固定时更宽松 |
+| `allowedHosts: ["app.example:8443"]` | 仅该端口 | 推荐；端口不匹配仍拒绝 |
+| `allowedHosts: []`（默认） | 仅回环 | 与 0.3.4 行为一致 |
+
+条目必须是裸 authority（`host`、`host:port`、`[v6]:port`）；带 scheme、路径、userinfo 或通配符的条目会被丢弃并在 `/state` 的 warnings 里报告。**代理读超时仍需单独调整**：nginx `proxy_read_timeout` 默认 60s、Cloudflare 到源站默认 100s，而大批量删除的宿主预算是 `min(900s, 15s + 16s×批量 + drain)`，超时后代理会先断而宿主仍在执行。
+
+
 ### 4.3 回收站布局
 
 存储目录沿用旧插件的 `delete-conversation`（不是新包名），这样 0.2.0 改名后已有的回收站条目和审计日志仍然可见。
@@ -190,7 +201,7 @@ dsh-conversation-recycle-bin/
 │     ├─ memory.js               # 适配器装配
 │     ├─ feedback.js             # 反馈校验/渲染/投递（http 或 smtp，凭证只读环境变量）
 │     └─ api.js                 # 同源 HTTP API、确认 token、限流
-└─ test/                        # 131 个用例，覆盖用户要求的 5 类场景 + live 删除 + 记忆锁 + 原地刷新 + 部分失败/跨进程/未完成条目 + 反馈通道 + Client 半渲染冒烟
+└─ test/                        # 138 个用例，覆盖用户要求的 5 类场景 + live 删除 + 记忆锁 + 原地刷新 + 部分失败/跨进程/未完成条目 + 反馈通道 + Client 半渲染冒烟
 ```
 
 ---
@@ -199,7 +210,7 @@ dsh-conversation-recycle-bin/
 
 ```powershell
 cd D:\Users\34332\AI\dsh-conversation-recycle-bin
-npm test        # = manifest && client-module && core && cascade && memory && trash-audit && feedback && api（131 个用例）
+npm test        # = manifest && client-module && core && cascade && memory && trash-audit && feedback && api（138 个用例）
 npm run check   # 语法 + manifest
 ```
 
@@ -288,7 +299,7 @@ node -e "console.log('b64:' + Buffer.from('your-feedback@example.com','utf8').to
 cd D:\Users\34332\AI\dsh-conversation-recycle-bin
 npm run check                      # 语法 + manifest（含 feedback.js）
 node test/feedback.test.mjs        # 19 个反馈用例
-npm test                           # 全量 131 个用例
+npm test                           # 全量 138 个用例
 
 # 端到端：用本机收件桩观察真实投递路径，不外发邮件
 $env:DSH_CRB_MAIL_API_URL   = 'http://127.0.0.1:9099/emails'

package/client.js

@@ -101,6 +101,8 @@ window.__ModuleLoader__.load({
         'dialog.phraseLabel': 'Confirmation',
         'dialog.delete': 'Delete',
         'dialog.working': 'Deleting…',
+        'dialog.stillWorking': 'Still working — confirming no other DSH instance is writing this conversation.',
+        'dialog.hardGraceHint': 'Permanent deletion re-checks the log for a second writer first, so a conversation used moments ago can take about 1.5s longer.',
         'dialog.loading': 'Reading the plan…',
         'dialog.done': 'Deleted {count} conversation(s); {memory} memory entries moved to the recycle bin.',
         'dialog.partial': 'Deleted {done}, failed {failed}.',
@@ -255,6 +257,8 @@ window.__ModuleLoader__.load({
         'dialog.phraseLabel': '确认',
         'dialog.delete': '删除',
         'dialog.working': '正在删除…',
+        'dialog.stillWorking': '仍在执行：正在确认没有其他 DSH 实例写入该对话。',
+        'dialog.hardGraceHint': '彻底删除会先复查日志是否还有第二个写入方；刚使用过的对话可能多等约 1.5 秒。',
         'dialog.loading': '正在读取删除计划…',
         'dialog.done': '已删除 {count} 个对话；移入回收站的记忆条目 {memory} 条。',
         'dialog.partial': '成功 {done} 个，失败 {failed} 个。',
@@ -472,6 +476,23 @@ window.__ModuleLoader__.load({
     const API_PREFIX = '/conversation-recycle-bin/api'
     const REQUEST_TIMEOUT_MS = 15_000
     const MUTATION_TIMEOUT_MS = 180_000
+    /**
+     * Recycle-bin writes wait for the Host's cross-process lock, and that wait
+     * is unbounded in wall-clock terms: the request queues behind whatever
+     * mutation is already running (`serialize()` chains in-process first). A
+     * 15s budget therefore aborted restore / purge / discard while the Host was
+     * still working, so the UI reported a failure for a change that did happen.
+     * The Host caps its own lock wait at TRASH_LOCK_BUDGET_MS (180s); this sits
+     * just above it so the Host's own answer always wins the race.
+     */
+    const TRASH_MUTATION_TIMEOUT_MS = 195_000
+    /**
+     * How long a delete may run before the dialog says what it is waiting for.
+     * A hard delete of a conversation written moments ago spends
+     * `foreignWriterGraceMs` (1.5s) re-checking the log for a second writer;
+     * without a hint the danger button looked stuck.
+     */
+    const SLOW_SUBMIT_HINT_MS = 1_200
 
     /**
      * A batch is one HTTP request that can stop several live sessions (each up
@@ -493,14 +514,39 @@ window.__ModuleLoader__.load({
     ApiError.prototype = Object.create(Error.prototype)
     ApiError.prototype.constructor = ApiError
 
+    /**
+     * Resolve a plugin route against the PAGE, not against the origin.
+     *
+     * `dsh web` can be mounted under a path prefix (`--public-url
+     * https://host/ui/`, stripped by a front proxy). DSH's own client stays
+     * document-relative for exactly this reason: `dsh-client-connection` builds
+     * its requests with `` `${channel}/${endpoint}`.slice(1) `` and resolves
+     * them against `document.baseURI`. An absolute `/conversation-recycle-bin/…`
+     * would replace the whole base path, drop the prefix, and 404 every call.
+     * Keeping the same rule means one code path works for `http://127.0.0.1:<p>/`,
+     * `https://host/<prefix>/` and the desktop shell's `dsh-app://app/`.
+     */
+    function apiUrl(path) {
+      let base = 'http://127.0.0.1/'
+      if (typeof document !== 'undefined' && typeof document.baseURI === 'string' && document.baseURI !== '') {
+        try {
+          // Normalise to the containing directory so a base without a trailing
+          // slash (`…/index.html`) does not swallow the last segment.
+          base = new URL('.', document.baseURI).href
+        } catch {
+          base = 'http://127.0.0.1/'
+        }
+      }
+      return new URL(`${API_PREFIX.replace(/^\//, '')}${path}`, base)
+    }
+
     async function api(path, options = {}) {
       const method = options.method ?? 'GET'
       const timeoutMs = Number.isFinite(options.timeoutMs) ? options.timeoutMs : REQUEST_TIMEOUT_MS
       const controller = new AbortController()
       const timer = setTimeout(() => controller.abort(), timeoutMs)
       try {
-        const base = typeof document !== 'undefined' && typeof document.baseURI === 'string' ? document.baseURI : 'http://127.0.0.1/'
-        const url = new URL(`${API_PREFIX}${path}`, base)
+        const url = apiUrl(path)
         const headers = { 'x-conversation-recycle-bin': '1' }
         if (options.body !== undefined) headers['content-type'] = 'application/json'
         const response = await fetch(url, {
@@ -938,6 +984,9 @@ window.__ModuleLoader__.load({
       const [error, setError] = useState(null)
       const [phrase, setPhrase] = useState('')
       const [done, setDone] = useState(null)
+      // Set when a submission outlives SLOW_SUBMIT_HINT_MS, so the dialog can
+      // explain the wait instead of showing a frozen danger button.
+      const [slow, setSlow] = useState(false)
 
       // Dismissing the result must also complete a reload the Host armed
       // because it cannot close the deleted conversation in place; otherwise
@@ -986,6 +1035,15 @@ window.__ModuleLoader__.load({
         return () => window.removeEventListener('keydown', onKey)
       }, [busy])
 
+      useEffect(() => {
+        if (busy !== true) {
+          setSlow(false)
+          return undefined
+        }
+        const timer = setTimeout(() => setSlow(true), SLOW_SUBMIT_HINT_MS)
+        return () => clearTimeout(timer)
+      }, [busy])
+
       const firstSession = preview?.sessions?.[0] ?? null
       const title = count === 1
         ? (firstSession?.title || fallbackTitle || sessionIds[0])
@@ -1120,6 +1178,11 @@ window.__ModuleLoader__.load({
             ? h('div', { className: 'dc-live-warning', role: 'status' }, t('dialog.liveStopHint'))
             : null,
 
+          // Permanent deletion waits out `foreignWriterGraceMs` when the log was
+          // written moments ago (measured: ~1.5s once per batch). Say so before
+          // the click, not after the user thinks the button is stuck.
+          mode === 'hard' ? h('p', { className: 'dc-hint' }, t('dialog.hardGraceHint')) : null,
+
           h('div', { className: 'dc-memory' },
             h(Checkbox, {
               checked: includeMemory,
@@ -1162,6 +1225,10 @@ window.__ModuleLoader__.load({
               }))
             : null,
 
+          slow === true
+            ? h('div', { className: 'dc-live-warning', role: 'status' }, t('dialog.stillWorking'))
+            : null,
+
           h('div', { className: 'dc-actions' },
             h(Button, { onClick: () => { void load(mode, includeMemory) }, disabled: busy || loading, title: t('action.refresh') },
               h(GlyphRefresh, { size: 13 }), ' ', t('action.refresh')),
@@ -1518,7 +1585,10 @@ window.__ModuleLoader__.load({
       const [trash, setTrash] = useState([])
       const [incomplete, setIncomplete] = useState([])
       const [audit, setAudit] = useState([])
-      const [loading, setLoading] = useState(true)
+      // Which tab is fetching right now. `null` means idle: the panels stay
+      // mounted while a refresh runs, so the user keeps scroll position and
+      // never sees the whole section blink on every restore/purge.
+      const [tabBusy, setTabBusy] = useState(null)
       const [error, setError] = useState(null)
       const [selected, setSelected] = useState(() => new Set())
       const [purgeTarget, setPurgeTarget] = useState(null)
@@ -1532,54 +1602,100 @@ window.__ModuleLoader__.load({
       // Two refreshes can overlap (mount, mutation broadcast, and the refresh a
       // purge triggers), and the older response must not overwrite the newer.
       const refreshSerial = useRef(0)
+      // The mutation version each tab's data was fetched at. `-1` = never.
+      const loadedRef = useRef({ trash: -1, batch: -1, audit: -1 })
 
-      const refresh = useCallback(async () => {
+      const refreshState = useCallback(async () => {
+        const response = await api('/state')
+        setState(response.state)
+      }, [])
+
+      /**
+       * Fetch only what the visible tab renders. The section used to pull
+       * `/state`, `/sessions`, `/trash` and `/audit` on every mount and every
+       * mutation (~31 KB, 4 round trips) even when the user was looking at one
+       * tab. `/sessions` is the expensive one (one projection read per row),
+       * so opening the recycle bin must not pay for it.
+       */
+      const loadTab = useCallback(async (which, { force = false } = {}) => {
+        if (!force && loadedRef.current[which] === mutationVersion) return
         const serial = refreshSerial.current + 1
         refreshSerial.current = serial
         const stale = () => serial !== refreshSerial.current
-        setLoading(true)
+        setTabBusy(which)
         setError(null)
         try {
-          const [stateResponse, sessionsResponse, trashResponse, auditResponse] = await Promise.all([
-            api('/state'),
-            api('/sessions'),
-            api('/trash'),
-            api('/audit?limit=50'),
-          ])
-          if (stale()) return
-          const nextSessions = Array.isArray(sessionsResponse.sessions) ? sessionsResponse.sessions : []
-          setState(stateResponse.state)
-          setSessions(nextSessions)
-          setTrash(Array.isArray(trashResponse.entries) ? trashResponse.entries : [])
-          setIncomplete(Array.isArray(trashResponse.incomplete) ? trashResponse.incomplete : [])
-          setAudit(Array.isArray(auditResponse.records) ? auditResponse.records : [])
-          // Drop selections whose conversation no longer exists.
-          setSelected((current) => {
-            const alive = new Set(nextSessions.map((session) => session.id))
-            const next = new Set([...current].filter((id) => alive.has(id)))
-            return next.size === current.size ? current : next
-          })
+          if (which === 'trash') {
+            const response = await api('/trash')
+            if (stale()) return
+            setTrash(Array.isArray(response.entries) ? response.entries : [])
+            setIncomplete(Array.isArray(response.incomplete) ? response.incomplete : [])
+          } else if (which === 'batch') {
+            const response = await api('/sessions')
+            if (stale()) return
+            const nextSessions = Array.isArray(response.sessions) ? response.sessions : []
+            setSessions(nextSessions)
+            // Drop selections whose conversation no longer exists.
+            setSelected((current) => {
+              const alive = new Set(nextSessions.map((session) => session.id))
+              const next = new Set([...current].filter((id) => alive.has(id)))
+              return next.size === current.size ? current : next
+            })
+          } else {
+            const response = await api('/audit?limit=50')
+            if (stale()) return
+            setAudit(Array.isArray(response.records) ? response.records : [])
+          }
+          loadedRef.current[which] = mutationVersion
         } catch (caught) {
           if (!stale()) setError(caught)
         } finally {
-          if (!stale()) setLoading(false)
+          if (!stale()) setTabBusy(null)
         }
-      }, [])
+      }, [mutationVersion])
 
-      useEffect(() => { void refresh() }, [refresh])
+      // `/state` drives the capability block and the limits; refetch it on
+      // mount and whenever a mutation happened, not on every tab switch.
+      useEffect(() => {
+        refreshState().catch((caught) => setError(caught))
+      }, [mutationVersion, refreshState])
 
-      // A deletion or restore performed from the dialog must also update this
-      // section's own session/trash copies.
+      // The active tab's own slice, on mount, on tab switch, and after a
+      // mutation (which changes `loadTab`'s identity through the version).
       useEffect(() => {
-        if (mutationVersion > 0) void refresh()
-      }, [mutationVersion, refresh])
+        void loadTab(tab)
+      }, [tab, loadTab])
+
+      /** Header "refresh" button: re-read state and the visible tab. */
+      const refresh = useCallback(async () => {
+        await Promise.all([
+          refreshState().catch((caught) => setError(caught)),
+          loadTab(tab, { force: true }),
+        ])
+      }, [tab, refreshState, loadTab])
+
+      /**
+       * Mark a slice stale without fetching it. Recycle-bin actions call
+       * `refreshAfterMutation({ notify: false })`, so no version bump happens:
+       * the visible tab is re-read by `refresh()`, and any other tab must be
+       * re-read the next time the user opens it instead of showing rows that
+       * were deleted a moment ago.
+       */
+      const markStale = useCallback((...which) => {
+        for (const name of which) loadedRef.current[name] = -1
+      }, [])
 
       async function restore(trashId) {
         setError(null)
         const entry = trash.find((item) => item.trashId === trashId)
         try {
-          await api('/trash/restore', { method: 'POST', body: { trashId } })
+          await api('/trash/restore', {
+            method: 'POST',
+            body: { trashId },
+            timeoutMs: TRASH_MUTATION_TIMEOUT_MS,
+          })
           flashStore.show(t('trash.restored'))
+          markStale('trash', 'batch')
           await refresh()
           await refreshAfterMutation({
             sessionIds: typeof entry?.sessionId === 'string' ? [entry.sessionId] : [],
@@ -1601,8 +1717,13 @@ window.__ModuleLoader__.load({
         setError(null)
         setRestoreBusyId(trashId)
         try {
-          await api('/trash/restore', { method: 'POST', body: { trashId } })
+          await api('/trash/restore', {
+            method: 'POST',
+            body: { trashId },
+            timeoutMs: TRASH_MUTATION_TIMEOUT_MS,
+          })
           flashStore.show(t('trash.restored'))
+          markStale('trash', 'batch')
           await refresh()
           await refreshAfterMutation({
             sessionIds: incomplete.find((item) => item.trashId === trashId)?.sessionId
@@ -1624,10 +1745,15 @@ window.__ModuleLoader__.load({
         setError(null)
         const entry = trash.find((item) => item.trashId === trashId)
         try {
-          await api('/trash/purge', { method: 'POST', body: { trashId, confirmPhrase: phrase } })
+          await api('/trash/purge', {
+            method: 'POST',
+            body: { trashId, confirmPhrase: phrase },
+            timeoutMs: TRASH_MUTATION_TIMEOUT_MS,
+          })
           flashStore.show(t('trash.purged'))
           setPurgeTarget(null)
           setPurgePhrase('')
+          markStale('trash', 'batch')
           await refresh()
           // Purging a soft entry detaches the session from its workspace.
           await refreshAfterMutation({
@@ -1647,10 +1773,15 @@ window.__ModuleLoader__.load({
         setDiscardBusyId(trashId)
         setError(null)
         try {
-          await api('/trash/discard', { method: 'POST', body: { trashId, confirmPhrase: phrase } })
+          await api('/trash/discard', {
+            method: 'POST',
+            body: { trashId, confirmPhrase: phrase },
+            timeoutMs: TRASH_MUTATION_TIMEOUT_MS,
+          })
           flashStore.show(t('trash.discarded'))
           setDiscardTarget(null)
           setDiscardPhrase('')
+          markStale('trash')
           await refresh()
         } catch (caught) {
           setError(caught)
@@ -1700,7 +1831,7 @@ window.__ModuleLoader__.load({
             h('h1', { className: 'dc-title' }, t('section.title')),
             h('p', { className: 'dc-hint' }, t('section.subtitle'))),
           h('div', { className: 'dc-header-actions' },
-            h(Button, { onClick: () => { void refresh() }, disabled: loading, title: t('action.refresh') },
+            h(Button, { onClick: () => { void refresh() }, disabled: tabBusy !== null, title: t('action.refresh') },
               h(GlyphRefresh, { size: 13 }), ' ', t('action.refresh')))),
 
         h(ErrorBanner, { error }),
@@ -1729,9 +1860,14 @@ window.__ModuleLoader__.load({
           h('button', { id: 'dc-tab-batch', type: 'button', role: 'tab', 'aria-selected': tab === 'batch', 'aria-controls': 'dc-panel-batch', className: `dc-tab${tab === 'batch' ? ' dc-tab-active' : ''}`, onClick: () => setTab('batch') }, t('batch.title')),
           h('button', { id: 'dc-tab-audit', type: 'button', role: 'tab', 'aria-selected': tab === 'audit', 'aria-controls': 'dc-panel-audit', className: `dc-tab${tab === 'audit' ? ' dc-tab-active' : ''}`, onClick: () => setTab('audit') }, t('audit.title'))),
 
-        loading ? h(Spinner, { label: t('dialog.loading') }) : null,
+        // First paint only: once anything has been rendered, a refresh keeps the
+        // panels mounted and shows the inline indicator below instead.
+        state === null && tabBusy !== null ? h(Spinner, { label: t('dialog.loading') }) : null,
+        state !== null && tabBusy !== null
+          ? h('div', { className: 'dc-loading' }, h('span', { className: 'dc-spinner' }), ' ', t('dialog.loading'))
+          : null,
 
-        tab === 'trash' && !loading ? h('div', { id: 'dc-panel-trash', role: 'tabpanel', 'aria-labelledby': 'dc-tab-trash', className: 'dc-panel' },
+        tab === 'trash' ? h('div', { id: 'dc-panel-trash', role: 'tabpanel', 'aria-labelledby': 'dc-tab-trash', className: 'dc-panel' },
           trash.length === 0 ? h('div', { className: 'dc-empty' }, t('trash.empty')) : null,
           ...trash.map((entry) => h('div', { key: entry.trashId, className: 'dc-row' },
             h('div', { className: 'dc-row-main' },
@@ -1754,7 +1890,7 @@ window.__ModuleLoader__.load({
                   h(Button, { disabled: purgeBusy === true, onClick: () => { setPurgeTarget(null); setPurgePhrase('') } }, t('action.cancel')))
                 : h(Button, { variant: 'danger', onClick: () => { setPurgeTarget(entry.trashId); setPurgePhrase('') } }, t('action.purge')))))) : null,
 
-        tab === 'trash' && !loading && incomplete.length > 0 ? h(IncompleteEntries, {
+        tab === 'trash' && incomplete.length > 0 ? h(IncompleteEntries, {
           entries: incomplete,
           discardTarget,
           discardPhrase,
@@ -1767,7 +1903,7 @@ window.__ModuleLoader__.load({
           discardBusyId,
         }) : null,
 
-        tab === 'batch' && !loading ? h('div', { id: 'dc-panel-batch', role: 'tabpanel', 'aria-labelledby': 'dc-tab-batch', className: 'dc-panel' },
+        tab === 'batch' ? h('div', { id: 'dc-panel-batch', role: 'tabpanel', 'aria-labelledby': 'dc-tab-batch', className: 'dc-panel' },
           h('div', { className: 'dc-batch-bar' },
             h('span', { className: 'dc-hint' }, t('batch.selected', { count: selectedIds.length })),
             // "Select all" only marks deletable rows: a batch containing one
@@ -1793,7 +1929,7 @@ window.__ModuleLoader__.load({
             onToggle: toggle,
           }))) : null,
 
-        tab === 'audit' && !loading ? h('div', { id: 'dc-panel-audit', role: 'tabpanel', 'aria-labelledby': 'dc-tab-audit', className: 'dc-panel' },
+        tab === 'audit' ? h('div', { id: 'dc-panel-audit', role: 'tabpanel', 'aria-labelledby': 'dc-tab-audit', className: 'dc-panel' },
           audit.length === 0 ? h('div', { className: 'dc-empty' }, t('audit.empty')) : null,
           ...audit.map((record) => h('div', { key: record.id, className: 'dc-row' },
             h('div', { className: 'dc-row-main' },
@@ -1974,6 +2110,15 @@ window.__ModuleLoader__.load({
     exports.__store = { dialogStore, flashStore, mutationStore, uiFlagsStore }
     exports.__refreshAfterMutation = refreshAfterMutation
     exports.__mutationTimeoutMs = mutationTimeoutMs
+    // Exposed so the harness can assert the client budget stays ABOVE the
+    // Host's own TRASH_LOCK_BUDGET_MS: whichever side gives up first decides
+    // whether the user sees "failed" for work that actually completed.
+    exports.__requestBudgets = {
+      request: REQUEST_TIMEOUT_MS,
+      mutation: MUTATION_TIMEOUT_MS,
+      trashMutation: TRASH_MUTATION_TIMEOUT_MS,
+    }
+    exports.__apiUrl = apiUrl
     exports.__api = api
     // Direct component handles keep the hook-level behavior testable without a
     // DOM renderer (the registered wrapper alone only builds an element).

package/config.schema.json

@@ -8,7 +8,11 @@
   "properties": {
     "enabled": { "type": "boolean", "default": true, "description": "Master switch. When false the route answers 503 and the UI hides its entries." },
     "requireSameOrigin": { "type": "boolean", "default": true, "description": "Reject requests whose Origin does not match the request's full authority (hostname AND effective port; a missing port defaults by the Origin's own scheme). The desktop shell source dsh-app://app is trusted, matching DSH's own fence." },
-    "allowNonLoopback": { "type": "boolean", "default": false, "description": "Allow requests when the Web server is bound beyond loopback." },
+    "allowNonLoopback": { "type": "boolean", "default": false, "description": "Allow requests from any authority, not just loopback. Prefer allowedHosts when a reverse proxy presents a known hostname." },
+    "allowedHosts": {
+      "type": "array", "items": { "type": "string" }, "maxItems": 32, "default": [],
+      "description": "Authorities a prefix-stripping reverse proxy may present in Host (host, host:port, or [v6]:port). A bare host admits any port; an entry with a port admits only that port. Entries with a scheme, path, userinfo or wildcard are dropped. Empty = loopback only."
+    },
     "allowOrphanSessions": { "type": "boolean", "default": false, "description": "Allow deleting sessions that no registered workspace owns." },
     "allowSubagentSessions": { "type": "boolean", "default": false, "description": "Allow deleting sessions whose header origin is 'subagent'." },
     "stopLiveSessions": { "type": "boolean", "default": true, "description": "Hard deletion first stops a live session (cancel turn + archive stopActivity + bounded drain). Set false to refuse live sessions instead." },

package/cordis.patch.yml

@@ -22,6 +22,10 @@
         # unless the operator opts in explicitly below.
         requireSameOrigin: true
         allowNonLoopback: false
+        # Reverse-proxy deployments: list the exact authorities the proxy puts
+        # in `Host` (host, host:port). A bare host admits any port. Listing them
+        # is narrower than turning allowNonLoopback on for every hostname.
+        allowedHosts: []
         # Session ownership policy.
         allowOrphanSessions: false      # sessions with no registered workspace
         allowSubagentSessions: false    # sessions created by subagents

package/lib/core/config.js

@@ -13,6 +13,11 @@ export const DEFAULTS = deepFreeze({
   enabled: true,
   requireSameOrigin: true,
   allowNonLoopback: false,
+  // Exact authorities a prefix-stripping reverse proxy may present in `Host`
+  // (`app.example`, `app.example:8443`, `[::1]:8443`). Empty = loopback only.
+  // This exists so an operator behind a proxy does not have to switch
+  // `allowNonLoopback` on for every hostname the machine can be reached by.
+  allowedHosts: [],
   allowOrphanSessions: false,
   allowSubagentSessions: false,
   // Hard deletion of a live session first stops it (cancel turn + archive
@@ -138,6 +143,45 @@ function readStringArray(raw, fallback, field, warnings) {
   return raw.map((item) => item.trim()).filter((item) => item !== '')
 }
 
+/** `host`, `host:port` or `[v6]:port` — the only shapes a `Host` header may take. */
+const HOST_AUTHORITY_PATTERN = /^(?:\[[0-9a-f:.]+\]|[a-z0-9._-]+)(?::\d{1,5})?$/i
+const MAX_ALLOWED_HOSTS = 32
+
+/**
+ * Normalize the reverse-proxy authority allowlist.
+ *
+ * Entries are compared case-insensitively as complete authorities. A bare host
+ * (`app.example`) matches any port, an entry with a port (`app.example:8443`)
+ * matches only that port. Anything that is not a bare authority — a scheme, a
+ * path, userinfo, a wildcard — is dropped with a warning: this list is a
+ * security boundary, so a typo must not silently widen it.
+ */
+function readHostList(raw, field, warnings) {
+  if (raw === undefined) return []
+  if (!Array.isArray(raw)) {
+    warnings.push(`${field}: expected an array of authorities, using the default`)
+    return []
+  }
+  const out = []
+  for (const item of raw) {
+    if (typeof item !== 'string') {
+      warnings.push(`${field}: dropped a non-string entry`)
+      continue
+    }
+    const value = item.trim().toLowerCase().replace(/\.$/, '')
+    if (value === '') continue
+    if (!HOST_AUTHORITY_PATTERN.test(value)) {
+      warnings.push(`${field}: dropped "${item}", expected host or host:port without a scheme or path`)
+      continue
+    }
+    if (!out.includes(value)) out.push(value)
+  }
+  if (out.length > MAX_ALLOWED_HOSTS) {
+    warnings.push(`${field}: only the first ${MAX_ALLOWED_HOSTS} entries are used`)
+  }
+  return out.slice(0, MAX_ALLOWED_HOSTS)
+}
+
 /**
  * Normalize one raw row config into the exact object the plugin reads.
  *
@@ -197,6 +241,7 @@ export function normalizeConfig(raw) {
     enabled: readBool(source.enabled, DEFAULTS.enabled, 'enabled', warnings),
     requireSameOrigin: readBool(source.requireSameOrigin, DEFAULTS.requireSameOrigin, 'requireSameOrigin', warnings),
     allowNonLoopback: readBool(source.allowNonLoopback, DEFAULTS.allowNonLoopback, 'allowNonLoopback', warnings),
+    allowedHosts: readHostList(source.allowedHosts, 'allowedHosts', warnings),
     allowOrphanSessions: readBool(source.allowOrphanSessions, DEFAULTS.allowOrphanSessions, 'allowOrphanSessions', warnings),
     allowSubagentSessions: readBool(source.allowSubagentSessions, DEFAULTS.allowSubagentSessions, 'allowSubagentSessions', warnings),
     stopLiveSessions: readBool(source.stopLiveSessions, DEFAULTS.stopLiveSessions, 'stopLiveSessions', warnings),

package/lib/core/memory/json-index-adapter.js

@@ -137,7 +137,27 @@ export function createJsonIndexMemoryAdapter(options) {
     })
   }
 
+  /**
+   * Last parsed snapshot, keyed by the file's identity (mtime + size).
+   *
+   * A single `/preview` probes the adapter and then counts nodes, and both used
+   * to `readFile` + `JSON.parse` the whole index: 2 full reads of a 1.9 MB
+   * index cost ~39 ms. The stat key catches a concurrent md_cg write without a
+   * TTL, and every write this adapter performs clears the entry.
+   */
+  let snapshotCache = null
+
   async function readSnapshot() {
+    let key = null
+    if (typeof fsApi.stat === 'function') {
+      try {
+        const info = await fsApi.stat(indexFile)
+        key = `${info.mtimeMs}:${info.size}`
+      } catch {
+        // Fall through: readFile below reports the real error (ENOENT etc.).
+      }
+    }
+    if (key !== null && snapshotCache !== null && snapshotCache.key === key) return snapshotCache.snapshot
     const raw = await fsApi.readFile(indexFile, 'utf8')
     let index
     try {
@@ -158,7 +178,9 @@ export function createJsonIndexMemoryAdapter(options) {
     if (nodes === null || typeof nodes !== 'object') {
       throw new DeleteError('E_MEMORY_FAILED', `Memory index has no node map at ${nodesPointer}`, { indexFile, nodesPointer })
     }
-    return { index, nodes, sig: createHash('sha256').update(raw).digest('hex') }
+    const snapshot = { index, nodes, sig: createHash('sha256').update(raw).digest('hex') }
+    if (key !== null) snapshotCache = { key, snapshot }
+    return snapshot
   }
 
   async function readIndex() {
@@ -170,6 +192,9 @@ export function createJsonIndexMemoryAdapter(options) {
     const temporary = `${indexFile}.delete-conversation.tmp`
     await fsApi.writeFile(temporary, `${JSON.stringify(index)}\n`, 'utf8')
     await fsApi.rename(temporary, indexFile)
+    // The next reader must not see the pre-write snapshot, even if the rename
+    // happened within the filesystem's mtime granularity.
+    snapshotCache = null
   }
 
   async function newestLogMtimeMs() {

package/lib/core/trash.js

@@ -19,6 +19,29 @@ import { join } from 'node:path'
 
 const MANIFEST = 'manifest.json'
 const TRASH_ID_PATTERN = /^[0-9a-z]{2,40}-[0-9a-z]{2,20}$/
+/**
+ * Manifest reads in flight during one directory scan. The work is dominated by
+ * syscalls on many small files, so a small fixed pool removes the serial
+ * round-trip chain without flooding the FS with hundreds of concurrent opens.
+ */
+const SCAN_CONCURRENCY = 8
+
+/** Ordered `map` with at most `limit` promises in flight. */
+async function mapLimit(items, limit, fn) {
+  const out = new Array(items.length)
+  let next = 0
+  const workers = Array.from({ length: Math.min(Math.max(1, limit), items.length) }, async () => {
+    while (true) {
+      const index = next
+      next += 1
+      if (index >= items.length) return
+      out[index] = await fn(items[index], index)
+    }
+  })
+  await Promise.all(workers)
+  return out
+}
+
 
 /** Statuses a manifest may carry. `pending` and `failed` are never listed. */
 export const TRASH_STATUS = Object.freeze(['pending', 'trashed', 'failed', 'restoring', 'restored', 'purging'])
@@ -102,17 +125,64 @@ export function createTrashStore({ rootDir, now = Date.now, newId, fsApi = { mkd
       return parsed
     },
 
-    /** Every readable manifest, newest first, regardless of status. */
-    async listAll() {
+    /**
+     * One directory pass over the recycle bin.
+     *
+     * `listAll()` and `scanUnreadable()` used to be called together by `/trash`
+     * and each did its own `readdir` plus one `readFile` per entry, so every
+     * listing cost 2N manifest reads (measured at ~0.31 ms per entry, 156 ms at
+     * 500 entries). They now share this single pass: one `readdir`, one read per
+     * entry, bounded concurrency instead of a serial `for await`.
+     *
+     * A missing or unreadable root yields empty lists rather than throwing: the
+     * settings page must still render on a fresh install with no trash yet.
+     * @returns {Promise<{ entries: object[], unreadable: Array<{ trashId: string, reason: 'missing-manifest'|'corrupt-manifest'|'unreadable-manifest' }> }>}
+     */
+    async scanAll() {
       await ensureRoot()
-      const dirents = await fsApi.readdir(rootDir, { withFileTypes: true })
-      const entries = []
+      let dirents = []
+      try {
+        dirents = await fsApi.readdir(rootDir, { withFileTypes: true })
+      } catch {
+        return { entries: [], unreadable: [] }
+      }
+      const names = []
       for (const dirent of dirents) {
-        if (!dirent.isDirectory() || !isTrashId(dirent.name)) continue
-        const entry = await this.read(dirent.name)
-        if (entry !== null) entries.push(entry)
+        if (dirent.isDirectory() && isTrashId(dirent.name)) names.push(dirent.name)
+      }
+      const scanned = await mapLimit(names, SCAN_CONCURRENCY, async (trashId) => {
+        let raw
+        try {
+          raw = await fsApi.readFile(join(rootDir, trashId, MANIFEST), 'utf8')
+        } catch (error) {
+          return { trashId, reason: error?.code === 'ENOENT' ? 'missing-manifest' : 'unreadable-manifest' }
+        }
+        let parsed
+        try {
+          parsed = JSON.parse(raw)
+        } catch {
+          return { trashId, reason: 'corrupt-manifest' }
+        }
+        if (parsed === null || typeof parsed !== 'object' || parsed.format !== 1 || !TRASH_STATUS.includes(parsed.status)) {
+          return { trashId, reason: 'corrupt-manifest' }
+        }
+        return { entry: parsed }
+      })
+      const entries = []
+      const unreadable = []
+      for (const item of scanned) {
+        if (item.entry !== undefined) entries.push(item.entry)
+        else unreadable.push({ trashId: item.trashId, reason: item.reason })
       }
+      // Newest first. `Array.prototype.sort` is stable, so equal timestamps keep
+      // the directory order the scan produced.
       entries.sort((left, right) => (right.deletedAt ?? 0) - (left.deletedAt ?? 0))
+      return { entries, unreadable }
+    },
+
+    /** Every readable manifest, newest first, regardless of status. */
+    async listAll() {
+      const { entries } = await this.scanAll()
       return entries
     },
 
@@ -128,37 +198,11 @@ export function createTrashStore({ rootDir, now = Date.now, newId, fsApi = { mkd
      * are invisible to restore/purge but must still be listable and
      * discardable, otherwise a single bad manifest strands the directory on
      * disk forever.
-     * @returns {Array<{ trashId: string, reason: 'missing-manifest'|'corrupt-manifest'|'unreadable-manifest' }>}
+     * @returns {Promise<Array<{ trashId: string, reason: 'missing-manifest'|'corrupt-manifest'|'unreadable-manifest' }>>}
      */
     async scanUnreadable() {
-      await ensureRoot()
-      const out = []
-      let dirents = []
-      try {
-        dirents = await fsApi.readdir(rootDir, { withFileTypes: true })
-      } catch {
-        return out
-      }
-      for (const dirent of dirents) {
-        if (!dirent.isDirectory() || !isTrashId(dirent.name)) continue
-        let raw
-        let reason = 'missing-manifest'
-        try {
-          raw = await fsApi.readFile(join(rootDir, dirent.name, MANIFEST), 'utf8')
-        } catch (error) {
-          if (error?.code !== 'ENOENT') reason = 'unreadable-manifest'
-          out.push({ trashId: dirent.name, reason })
-          continue
-        }
-        try {
-          const parsed = JSON.parse(raw)
-          const readable = parsed !== null && typeof parsed === 'object' && parsed.format === 1 && TRASH_STATUS.includes(parsed.status)
-          if (!readable) out.push({ trashId: dirent.name, reason: 'corrupt-manifest' })
-        } catch {
-          out.push({ trashId: dirent.name, reason: 'corrupt-manifest' })
-        }
-      }
-      return out
+      const { unreadable } = await this.scanAll()
+      return unreadable
     },
 
     async remove(trashId) {

package/lib/host/api.js

@@ -60,6 +60,18 @@ import { SESSION_ID_PATTERN } from '../core/ids.js'
 export const ROUTE_PREFIX = '/conversation-recycle-bin/api'
 export const REQUIRED_HEADER = 'x-conversation-recycle-bin'
 const MAX_BODY_BYTES = 256 * 1024
+/**
+ * Lock wait budget for the single-entry trash mutations.
+ *
+ * `serialize()` chains every mutation in-process and then takes the
+ * cross-process file lock, so restore / purge / discard can sit behind a whole
+ * batch delete. They used to fall back to the generic 30s lock timeout, which
+ * is shorter than one batch's legitimate worst case: the Host answered
+ * E_LOCK_BUSY for a request that only needed to wait. The Client's own budget
+ * (TRASH_MUTATION_TIMEOUT_MS = 195s) is deliberately slightly larger, so this
+ * budget — not the browser's AbortController — decides the outcome.
+ */
+export const TRASH_LOCK_BUDGET_MS = 180_000
 
 function isLoopbackHostname(hostname) {
   const value = String(hostname ?? '').trim().toLowerCase().replace(/^\[|\]$/g, '')
@@ -99,6 +111,28 @@ function portOf(hostHeader) {
   return colon > 0 && /^\d+$/.test(value.slice(colon + 1)) ? value.slice(colon + 1) : ''
 }
 
+/**
+ * Whether a request authority matches the operator's `allowedHosts` list.
+ *
+ * A bare entry (`app.example`) admits any port on that host; an entry with a
+ * port admits only that port. Comparison is hostname-normalized (IPv6 brackets
+ * and `::ffff:` mapped addresses included) so `[::1]:8443` and `[::1]:8443`
+ * agree regardless of case.
+ */
+function authorityAllowed(hostHeader, allowedHosts) {
+  if (!Array.isArray(allowedHosts) || allowedHosts.length === 0) return false
+  const hostname = hostnameOf(hostHeader)
+  if (hostname === '') return false
+  const port = portOf(hostHeader)
+  for (const entry of allowedHosts) {
+    if (typeof entry !== 'string') continue
+    if (!sameHostname(hostnameOf(entry), hostname)) continue
+    const entryPort = portOf(entry)
+    if (entryPort === '' || entryPort === port) return true
+  }
+  return false
+}
+
 /** The port a URL implies when it omits one. */
 function defaultPortFor(protocol) {
   if (protocol === 'https:' || protocol === 'wss:') return '443'
@@ -116,7 +150,7 @@ function defaultPortFor(protocol) {
  * both mean 443).
  * @returns {{ ok: true } | { ok: false, error: DeleteError }}
  */
-export function requestOriginVerdict(headers, { requireSameOrigin, allowNonLoopback }) {
+export function requestOriginVerdict(headers, { requireSameOrigin, allowNonLoopback, allowedHosts = [] }) {
   const read = (name) => {
     if (headers === null || typeof headers !== 'object') return ''
     const value = headers[name]
@@ -124,11 +158,12 @@ export function requestOriginVerdict(headers, { requireSameOrigin, allowNonLoopb
   }
   const requestHostname = hostnameOf(read('host'))
 
-  if (!allowNonLoopback && !isLoopbackHostname(requestHostname)) {
+  if (!allowNonLoopback && !isLoopbackHostname(requestHostname) && !authorityAllowed(read('host'), allowedHosts)) {
     return {
       ok: false,
-      error: new DeleteError('E_FORBIDDEN_HOST', 'This route only accepts loopback requests unless allowNonLoopback is enabled.', {
+      error: new DeleteError('E_FORBIDDEN_HOST', 'This route only accepts loopback requests unless the authority is listed in allowedHosts (or allowNonLoopback is enabled).', {
         host: read('host') || null,
+        allowedHosts: Array.isArray(allowedHosts) ? allowedHosts : [],
       }),
     }
   }
@@ -845,7 +880,7 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     // invisible and impossible to clean up at all. Directories whose manifest
     // is missing/corrupt are surfaced as `unreadable` so they are not stranded
     // on disk; the Client renders both groups separately.
-    const [all, unreadable] = await Promise.all([trash.listAll(), trash.scanUnreadable()])
+    const { entries: all, unreadable } = await trash.scanAll()
     const result = {
       entries: all.filter((entry) => entry.status === 'trashed').map(serializeEntry),
       incomplete: [
@@ -986,17 +1021,17 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
         return
       }
       if (path === '/trash/restore') {
-        const result = await serialize(() => restoreEntry(body?.trashId))
+        const result = await serialize(() => restoreEntry(body?.trashId), { lockTimeoutMs: TRASH_LOCK_BUDGET_MS })
         sendJson(res, 200, { ok: true, ...result })
         return
       }
       if (path === '/trash/purge') {
-        const result = await serialize(() => purgeEntry(body?.trashId, body?.confirmPhrase))
+        const result = await serialize(() => purgeEntry(body?.trashId, body?.confirmPhrase), { lockTimeoutMs: TRASH_LOCK_BUDGET_MS })
         sendJson(res, 200, { ok: true, ...result })
         return
       }
       if (path === '/trash/discard') {
-        const result = await serialize(() => discardEntry(body?.trashId, body?.confirmPhrase))
+        const result = await serialize(() => discardEntry(body?.trashId, body?.confirmPhrase), { lockTimeoutMs: TRASH_LOCK_BUDGET_MS })
         sendJson(res, 200, { ok: true, ...result })
         return
       }

package/lib/host/gateway.js

@@ -186,6 +186,21 @@ export function createSessionGateway({ ctx, paths, now = Date.now }) {
    * @returns {boolean|undefined}
    */
   function probeRunning(sessionId) {
+    // Authoritative cheap probe first: the Host computes a list row's `running`
+    // flag from exactly this check (`api-session-controller`: `agents.get(id)
+    // ?.status === "running"`). The `Session` object handed out by `sessions.get`
+    // carries no `running`/`active`/`busy` field, so the legacy probe below can
+    // only ever answer `undefined` on current Hosts.
+    const agents = service('agents')
+    if (agents !== undefined && typeof agents.get === 'function') {
+      try {
+        const agent = agents.get(sessionId)
+        if (agent === undefined || agent === null) return false
+        if (typeof agent.status === 'string') return agent.status === 'running'
+      } catch {
+        // Fall through to the legacy field probe.
+      }
+    }
     const sessions = service('sessions')
     if (sessions === undefined || typeof sessions.get !== 'function') return undefined
     let current
@@ -202,6 +217,31 @@ export function createSessionGateway({ ctx, paths, now = Date.now }) {
     return undefined
   }
 
+  /**
+   * Event count when it is cheaply knowable, `null` otherwise.
+   *
+   * `sessionPersistence.stat()` reports `header`/`revision`/`sizeBytes` (and no
+   * `eventCount` on 0.2.1), so the old `snapshot.eventCount` read was dead. A
+   * live session does expose the count exactly: the session store defines `seq`
+   * as "always the log length" (`dsh-session` `get seq()`), and it is a plain
+   * number read, not a materialized `snapshotEvents()` (that API is deprecated).
+   * For a stored, non-live session there is no equivalent that avoids reading
+   * and parsing the whole log, so the field stays `null` instead of presenting
+   * a projection cursor as an exact count.
+   * @returns {number|null}
+   */
+  function eventCountFor(sessionId, snapshot) {
+    if (typeof snapshot?.eventCount === 'number') return snapshot.eventCount
+    const sessions = service('sessions')
+    if (sessions === undefined || typeof sessions.get !== 'function') return null
+    try {
+      const seq = sessions.get(sessionId)?.seq
+      return typeof seq === 'number' && Number.isFinite(seq) && seq >= 0 ? seq : null
+    } catch {
+      return null
+    }
+  }
+
   async function workspaceFor(session) {
     const workspaces = await workspaceEntities()
     const byId = workspaces.find((workspace) => workspace.id === session.workspaceId)
@@ -251,7 +291,7 @@ export function createSessionGateway({ ctx, paths, now = Date.now }) {
         pinned: fromList?.pinned ?? false,
         createdAt: snapshot?.header?.createdAt ?? null,
         updatedAt: fromList?.updatedAt ?? null,
-        events: typeof snapshot?.eventCount === 'number' ? snapshot.eventCount : null,
+        events: eventCountFor(sessionId, snapshot),
         sizeBytes: typeof snapshot?.sizeBytes === 'number' ? snapshot.sizeBytes : null,
         workspace: workspace === null ? null : { id: workspace.id, title: workspace.title, path: workspace.path, index: entity },
         workspaceId: workspace?.id ?? null,

package/lib/host/lifecycle.js

@@ -20,13 +20,26 @@ import { DeleteError } from '../core/errors.js'
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
 
 export function createLifecycleOps({ ctx, gateway, config, now = Date.now, delay = sleep }) {
-  function service(name) {
-    let value
+  /**
+   * Optional-service probe.
+   *
+   * The property read has to stay inside the `try`: `ctx[name]` goes through
+   * cordis' Proxy trap, which throws `cannot get property "x" without inject`
+   * for a service this composition never provided. `ctx.get?.(name)` alone
+   * resolves to `undefined` in that case, and the `??` fallback would then
+   * throw a foreign error type out of the delete cascade (why a failed `get`
+   * must not be repaired by reading the property outside the guard).
+   */
+  function peek(name) {
     try {
-      value = ctx.get?.(name) ?? ctx[name]
+      return ctx.get?.(name) ?? ctx[name]
     } catch {
-      value = undefined
+      return undefined
     }
+  }
+
+  function service(name) {
+    const value = peek(name)
     if (value === undefined) {
       throw new DeleteError('E_INTERNAL', `The ${name} service is unavailable.`, {})
     }
@@ -55,7 +68,11 @@ export function createLifecycleOps({ ctx, gateway, config, now = Date.now, delay
      */
     async quiesce(session) {
       const registry = service('workspaceRegistry')
-      const controller = ctx.get?.('sessionController') ?? ctx.sessionController
+      // Optional on purpose: a composition without the controller still deletes
+      // the log, it just cannot cancel an in-flight turn first (the archive gate
+      // and the drain check below still hold). `peek` keeps that path from
+      // throwing a cordis error instead of reaching the archive step.
+      const controller = peek('sessionController')
       const wasArchived = session.archived === true
       const drainMs = Math.max(0, Number(config.liveDrainMs) || 0)
 

package/lib/version.js

@@ -5,4 +5,4 @@
  * asserted against it by `test/manifest.test.mjs` so the two can never drift
  * (they did: the constant stayed at 0.1.0 while the package reached 0.1.4).
  */
-export const PLUGIN_VERSION = '0.3.4'
+export const PLUGIN_VERSION = '0.3.6'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-conversation-recycle-bin",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "description": "DSH conversation deletion with an optional, previewed cascade into conversation-associated memory: soft delete + recycle bin, audit trail, batch rate limits and per-session rollback. 删除对话（可选一并删除关联记忆）：软删除与回收站、审计留痕、批量限流、失败回滚。",
   "repository": {
     "type": "git",
@@ -33,7 +33,8 @@
     "LICENSE"
   ],
   "engines": {
-    "node": ">=20"
+    "node": ">=20",
+    "dsh": ">=0.2.1-rc.2"
   },
   "optionalDependencies": {
     "nodemailer": "^10.1.2"