dsh-disk-cleaner 1.6.6 → 1.6.8

package/README.md

@@ -5,7 +5,7 @@
 <!-- badges -->
 | | |
 | --- | --- |
-| **version** | `1.6.6` |
+| **version** | `1.6.8` |
 | **DSH** | `0.2.1-rc.5`（开发与实测版本；用到 `plugins.bundle.config`、`settings.section`） |
 | **license** | [MIT](LICENSE) |
 | **Node** | `>= 22`（仅运行冒烟测试需要） |
@@ -166,16 +166,16 @@ These are enforced in `lib/catalog.js` and must not be relaxed:
 
 Listed in the curated [awesome-dsh-plugin](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin) catalog, which powers **dshmarket → Discover** ([PR #12970](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/12970), merged): search **dsh-disk-cleaner** there and install it in one click. The direct installs below do the same thing by hand.
 
-Published on npm as [`dsh-disk-cleaner`](https://www.npmjs.com/package/dsh-disk-cleaner) — latest `1.6.6`:
+Published on npm as [`dsh-disk-cleaner`](https://www.npmjs.com/package/dsh-disk-cleaner) — latest `1.6.8`:
 
 ```bash
 npm i dsh-disk-cleaner
 ```
 
-A prebuilt tarball is attached to the [v1.6.6 Release](https://github.com/stallenlu/dsh-disk-cleaner/releases/tag/v1.6.6); installing from it skips DSH's build-approval step:
+A prebuilt tarball is attached to the [v1.6.8 Release](https://github.com/stallenlu/dsh-disk-cleaner/releases/tag/v1.6.8); installing from it skips DSH's build-approval step:
 
 ```bash
-dsh plugin --profile <profile> add https://github.com/stallenlu/dsh-disk-cleaner/releases/download/v1.6.6/dsh-disk-cleaner-1.6.6.tgz
+dsh plugin --profile <profile> add https://github.com/stallenlu/dsh-disk-cleaner/releases/download/v1.6.8/dsh-disk-cleaner-1.6.8.tgz
 ```
 
 Then enable it in the profile — in `$DSH_PROFILE_DIR/package.json`:
@@ -183,7 +183,7 @@ Then enable it in the profile — in `$DSH_PROFILE_DIR/package.json`:
 ```json
 {
   "dependencies": {
-    "dsh-disk-cleaner": "^1.6.6"
+    "dsh-disk-cleaner": "^1.6.8"
   },
   "dsh": {
     "profile": {
@@ -258,10 +258,11 @@ What the smoke test deliberately does **not** cover: anything that walks a real
 ```
 ├─ package.json           dsh.bundle.patch + dsh.client { platform: "web" }
 ├─ cordis.patch.yml       - insert:  id: dsh-disk-cleaner
-├─ lib/index.js    (482)  Host: HTTP route + disk_cleaner tool, same run() for both; reveal
-├─ lib/catalog.js  (1222)  The 32 targets, measurePath / purgePath / resolveTargets / drives
+├─ lib/index.js    (506)  Host: HTTP route + disk_cleaner tool, same run() for both; reveal
+├─ lib/catalog.js  (1242)  The 32 targets, measurePath / purgePath / resolveTargets / drives
 ├─ lib/audit.js    (365)  Read-only assessment, 10-minute cache, areaPaths, exposes no deletion
 ├─ lib/plan.js     (150)  Pure: measurements → ordered steps
+├─ lib/history.js   (71)  Append-only run log in $DSH_HOME/dsh-disk-cleaner; never throws
 ├─ lib/client.js  (1808)  Client half: slots, panel, preferences, zh/en dictionaries, CSS
 ├─ locale/{en,zh}.json    Display metadata (meta.title / meta.description)
 ├─ icon.svg               Plugin icon
@@ -274,7 +275,9 @@ Client-half slots: `sidebar.panellist` (order 50, disposed in settings-only mode
 
 ### What's new
 
-- **1.6.6** — The results the plugin already computed are now shown. A **Dry run** button next to *Clean* asks the exact same question without `confirm`, so you see what a delete would free before anything goes; the result banner then survives the rescan that follows it (it used to be erased a line later). Plan steps name targets in words instead of printing `npm-cache, chrome-cache, pip-cache`, an empty plan says "nothing worth doing" instead of rendering a hole, and route errors arrive as a stable `code` the panel translates, so a Chinese user never reads `origin rejected` or `unknown target: x`. Every real clean now appends one line to `$DSH_HOME/dsh-disk-cleaner/history.jsonl`, and a **Clean history** panel reads it back with a *Copy as CSV* button. Under the hood: scan walks four targets at a time instead of all 32 at once, `SystemRoot` decides where the Windows targets live instead of a hardcoded `C:`, a request without an `Origin` header is refused, and a refused directory removal is counted separately from a legitimately full one.
+- **1.6.8** — Fixes the other half of the 1.6.7 story: the panel still answered "origin rejected" when the desktop window sent `Origin: http://localhost:<port>` while the request itself arrived at `127.0.0.1`, because the check compared those strings literally. The gate now decides on the **peer address** of the connection — something a remote page cannot influence — and only then looks at `Origin`: the app's own scheme, no `Origin` at all, or any loopback host name is accepted, everything else is still refused. An `https://evil.example` origin is rejected even from a loopback socket. The three assessment error paths (evaluate, reveal, run-a-plan-step) now go through the same translated-code path as the rest of the panel, so a Chinese user sees "请求来源不被接受" rather than the raw `origin rejected` string.
+- **1.6.7** — Fixes a regression 1.6.6 shipped: refusing every request without an `Origin` header locked the plugin's own panel out of its API ("请求来源不被接受"), because the desktop window posts from `dsh-app://app`, not from `http://127.0.0.1:<port>`. The check now accepts the desktop scheme and a header the desktop forwarder stripped, but only when the request already arrived on a loopback address; a plain web page still cannot reach a loopback port without sending an `Origin`, so the door stays shut. No other behaviour changed.
+- **1.6.6** — The results the plugin already computed are now shown. A **Dry run** button next to *Clean* asks the exact same question without `confirm`, so you see what a delete would free before anything goes; the result banner then survives the rescan that follows it (it used to be erased a line later). Plan steps name targets in words instead of printing `npm-cache, chrome-cache, pip-cache`, an empty plan says "nothing worth doing" instead of rendering a hole, and route errors arrive as a stable `code` the panel translates, so a Chinese user never reads `origin rejected` or `unknown target: x`. Every real clean now appends one line to `$DSH_HOME/dsh-disk-cleaner/history.jsonl`, and a **Clean history** panel reads it back with a *Copy as CSV* button. Under the hood: scan walks four targets at a time instead of all 32 at once, `SystemRoot` decides where the Windows targets live instead of a hardcoded `C:`, a request without an `Origin` header is refused unless it arrived on loopback (see 1.6.7), and a refused directory removal is counted separately from a legitimately full one.
 - **1.6.5** — Documentation only: the install section now points at the Release it names (the prebuilt-tarball link is labelled v1.6.5 and resolves to the v1.6.5 tag), and the catalog paragraph says the awesome-dsh-plugin entry is merged rather than pending review. No code change.
 - **1.6.4** — The panel now paints itself with [dsh-design-baseline](https://github.com/stallenlu/dsh-design-baseline): the stylesheet is inlined into the client bundle, the panel root carries `dsb-root`, and every colour resolves through a `--dsb-*` token instead of a host `--dsw-alias-*` name. That means it follows the host's light and dark themes (including `color-scheme`, so native `<select>` menus and scrollbars match), and colour is spent only on data that has state — the primary button and the active chip are now inverted neutrals rather than brand blue. No behaviour changes.
 - **1.6.3** — Safety and honesty rather than new features. The Recycle Bin is no longer filed under `safe`: emptying it cannot be undone, so it is never preselected, never picked by "select all", and carries its own `irreversible` note instead of the generic "rebuilt; next start is slower". The confirm dialog now names each target and the total instead of asking a generic "delete these?". A target that names no environment root is bounded by the volume it sits on rather than skipping the boundary check. `measure` and `purge` now count entries in the same unit, and a walk that hits the 2,000,000-entry cap says so (`truncated`) instead of claiming exact totals. A directory removal refused for a reason other than "not empty" is counted as `blocked` instead of being swallowed, and a clean that left files behind reports a warning rather than a green success. The orphan target is named for what it actually measures (the QQGuild folder).
@@ -438,16 +441,16 @@ Client-half slots: `sidebar.panellist` (order 50, disposed in settings-only mode
 
 已收录进精选目录 [awesome-dsh-plugin](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin)，它是 **dshmarket → 发现** 的数据源（[PR #12970](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/12970)，已合并）：在 dshmarket 里搜索 **dsh-disk-cleaner** 即可一键安装。下面的直接安装方式就是手动做同一件事。
 
-已发布到 npm：[`dsh-disk-cleaner`](https://www.npmjs.com/package/dsh-disk-cleaner)，最新版 `1.6.6`。
+已发布到 npm：[`dsh-disk-cleaner`](https://www.npmjs.com/package/dsh-disk-cleaner)，最新版 `1.6.8`。
 
 ```bash
 npm i dsh-disk-cleaner
 ```
 
-[v1.6.6 Release](https://github.com/stallenlu/dsh-disk-cleaner/releases/tag/v1.6.6) 还附带一个预构建 tarball，从它安装可跳过 DSH 的构建授权步骤：
+[v1.6.8 Release](https://github.com/stallenlu/dsh-disk-cleaner/releases/tag/v1.6.8) 还附带一个预构建 tarball，从它安装可跳过 DSH 的构建授权步骤：
 
 ```bash
-dsh plugin --profile <profile> add https://github.com/stallenlu/dsh-disk-cleaner/releases/download/v1.6.6/dsh-disk-cleaner-1.6.6.tgz
+dsh plugin --profile <profile> add https://github.com/stallenlu/dsh-disk-cleaner/releases/download/v1.6.8/dsh-disk-cleaner-1.6.8.tgz
 ```
 
 然后在 profile 里启用 —— 在 `$DSH_PROFILE_DIR/package.json`：
@@ -455,7 +458,7 @@ dsh plugin --profile <profile> add https://github.com/stallenlu/dsh-disk-cleaner
 ```json
 {
   "dependencies": {
-    "dsh-disk-cleaner": "^1.6.6"
+    "dsh-disk-cleaner": "^1.6.8"
   },
   "dsh": {
     "profile": {
@@ -530,10 +533,11 @@ node --check lib/client.js           # 以及 lib/index.js、lib/catalog.js、li
 ```
 ├─ package.json           dsh.bundle.patch + dsh.client { platform: "web" }
 ├─ cordis.patch.yml       - insert:  id: dsh-disk-cleaner
-├─ lib/index.js    (482)  Host：HTTP 路由 + disk_cleaner 工具，共用同一个 run()，含 reveal
-├─ lib/catalog.js  (1222)  32 个目标，measurePath / purgePath / resolveTargets / drives
+├─ lib/index.js    (506)  Host：HTTP 路由 + disk_cleaner 工具，共用同一个 run()，含 reveal
+├─ lib/catalog.js  (1242)  32 个目标，measurePath / purgePath / resolveTargets / drives
 ├─ lib/audit.js    (365)  只读评估，10 分钟缓存，带 areaPaths，不暴露任何删除
 ├─ lib/plan.js     (150)  纯函数：测量结果 → 有序步骤
+├─ lib/history.js   (71)  只追加的运行日志，落在 $DSH_HOME/dsh-disk-cleaner；永不抛错
 ├─ lib/client.js  (1808)  Client 半面：slot、面板、偏好、zh/en 字典、CSS
 ├─ locale/{en,zh}.json    展示元数据（meta.title / meta.description）
 ├─ icon.svg               插件图标
@@ -546,7 +550,9 @@ Client 半面注册的 slot：`sidebar.panellist`（order 50，仅设置页模
 
 ### 更新记录
 
-- **1.6.6** — 把插件本来就算出来的结果真正显示出来。*清理* 旁边多了 **预演** 按钮：发同一个请求但不带 `confirm`，删之前就能看到会释放多少；清理结果横幅不再被紧随其后的重新扫描抹掉（以前下一行就被清空）。计划步骤改用目标名称，不再直出 `npm-cache, chrome-cache, pip-cache`；没有可做的事时说明「现在没有值得动手的地方」，而不是留一片空白；接口错误改带稳定 `code`，由面板翻成中文，不会再出现 `origin rejected` 或 `unknown target: x`。每次真正清理都会往 `$DSH_HOME/dsh-disk-cleaner/history.jsonl` 追加一行，新增的 **清理记录** 面板可读回并按 *复制为 CSV* 导出。底层：扫描从「32 个目标同时跑」改为每次 4 个，Windows 目标路径改由 `SystemRoot` 决定而不再硬编码 `C:`，缺少 `Origin` 头的请求会被拒绝，目录删除被拒与非空目录被跳过分别计数。
+- **1.6.8** — 补上 1.6.7 的另一半：桌面窗口如果发的是 `Origin: http://localhost:<端口>`、而请求实际到达 `127.0.0.1`，1.6.7 仍然会报「origin rejected」——因为它逐字比较这两个字符串。现在判定改为看**连接的来源地址**（远端网页无法影响这个值），再看 `Origin`：桌面自有协议、压根没有 `Origin`、或任何 loopback 主机名都放行，其余照旧拒绝；即便是 loopback 连接，`https://evil.example` 也进不来。空间评估的三条错误路径（评估、打开位置、跑计划步骤）统一走面板已有的「稳定 code → 中文文案」通道，不会再直接显示原始英文串。
+- **1.6.7** — 修掉 1.6.6 带进来的一个回归：把「没有 Origin 头的请求」一律拒绝，连插件自己的面板都进不了接口（界面报「请求来源不被接受」）——桌面窗口发请求时 Origin 是 `dsh-app://app`，不是 `http://127.0.0.1:<端口>`。现在的判定接受桌面协议，也接受被桌面转发层剥掉的头，但前提是请求本身已经到达 loopback 地址；普通网页不发 Origin 就到不了 loopback 端口，所以门仍然是关的。其余行为没变。
+- **1.6.6** — 把插件本来就算出来的结果真正显示出来。*清理* 旁边多了 **预演** 按钮：发同一个请求但不带 `confirm`，删之前就能看到会释放多少；清理结果横幅不再被紧随其后的重新扫描抹掉（以前下一行就被清空）。计划步骤改用目标名称，不再直出 `npm-cache, chrome-cache, pip-cache`；没有可做的事时说明「现在没有值得动手的地方」，而不是留一片空白；接口错误改带稳定 `code`，由面板翻成中文，不会再出现 `origin rejected` 或 `unknown target: x`。每次真正清理都会往 `$DSH_HOME/dsh-disk-cleaner/history.jsonl` 追加一行，新增的 **清理记录** 面板可读回并按 *复制为 CSV* 导出。底层：扫描从「32 个目标同时跑」改为每次 4 个，Windows 目标路径改由 `SystemRoot` 决定而不再硬编码 `C:`，缺少 `Origin` 头的请求会被拒绝（这项判定在 1.6.7 收紧到只放行 loopback，见下），目录删除被拒与非空目录被跳过分别计数。
 - **1.6.5** — 仅文档修正：安装段现在指向它所写的那个 Release（预构建 tarball 的链接标为 v1.6.5，且指向 v1.6.5 的 tag）；目录段落也从「审核中」改为「已合并」。代码无变化。
 - **1.6.4** — 面板改用 [dsh-design-baseline](https://github.com/stallenlu/dsh-design-baseline) 上色：样式表内联进 client bundle，根节点带 `dsb-root`，所有颜色都走 `--dsb-*` 令牌而不是宿主的 `--dsw-alias-*` 名字。因此它跟随宿主的明暗主题（含 `color-scheme`，原生 `<select>` 弹层与滚动条也跟着变），并且颜色只花在有状态的数据上——主按钮与选中项改成中性反色，不再是品牌蓝。行为没有变化。
 - **1.6.3** — 改的是安全与诚实，不是新功能。回收站不再归入「安全」：清空不可恢复，所以它永不被预选、不被「全选」勾中，并单独带 `irreversible` 注意码，而不是笼统的「重建，下次启动慢一些」。确认框现在逐条列出目标名与合计字节，不再只问一句「删除选中缓存目录里的文件？」。没有声明根目录的目标，改为按所在卷做边界校验，而不是直接跳过检查。`measure` 与 `purge` 现在用同一单位计数，走查触到 200 万条上限时会如实标 `truncated`，不再声称精确总量。目录删除失败若原因不是「非空」会计入 `blocked`（此前被静默吞掉），清理后仍有残留的目标会报警告而不是绿色成功。orphan 目标按它实际测量的东西重新命名（QQ 频道目录）。

package/lib/client.js

@@ -1398,7 +1398,7 @@ window.__ModuleLoader__.load({
           const result = await call('audit', force === true ? { force: true } : {});
           setData(result);
         } catch (err) {
-          setError(`${t('auditError')}: ${err instanceof Error ? err.message : String(err)}`);
+          setError(`${t('auditError')}: ${describeError(t, err)}`);
         } finally {
           setBusy(false);
         }
@@ -1427,7 +1427,7 @@ window.__ModuleLoader__.load({
           const result = await call('reveal', payload);
           setOpened(result && result.revealed ? result.revealed : '');
         } catch (err) {
-          setError(`${t('auditError')}: ${err instanceof Error ? err.message : String(err)}`);
+          setError(`${t('auditError')}: ${describeError(t, err)}`);
         }
       };
 
@@ -1472,7 +1472,7 @@ window.__ModuleLoader__.load({
           const result = await call('audit');
           setData(result);
         } catch (err) {
-          setError(`${t('auditError')}: ${err instanceof Error ? err.message : String(err)}`);
+          setError(`${t('auditError')}: ${describeError(t, err)}`);
         } finally {
           setBusy(false);
         }

package/lib/index.js

@@ -41,18 +41,61 @@ const sendJson = (res, status, value) => {
   res.end(body);
 };
 
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '[::1]', '::1', '::ffff:127.0.0.1']);
+
+/**
+ * The desktop app renders the panel under its own privileged protocol (`dsh-app://app`), so a
+ * fetch from inside that window carries an Origin no `http://` comparison can ever match.
+ */
+const APP_SCHEME = 'dsh-app://';
+
+/** `host` is `name` or `name:port`; the port is not ours to compare. */
+function hostName(host) {
+  if (host.startsWith('[')) {
+    const end = host.indexOf(']');
+    return end === -1 ? host : host.slice(0, end + 1);
+  }
+  const colon = host.lastIndexOf(':');
+  return colon === -1 ? host : host.slice(0, colon);
+}
+
+/**
+ * Whether the connection itself came in over loopback. This is the check that actually decides,
+ * because it is the one a remote page cannot influence: the kernel reports the peer address.
+ * Comparing Origin to `http://` + Host was the earlier approach and it broke the panel twice —
+ * the desktop window sends `dsh-app://app` (or no Origin at all), and when it does send an
+ * http origin the Host header may spell the address differently (`localhost` against
+ * `127.0.0.1`, or a rewritten host from the forwarder), which the string comparison rejects.
+ */
+function fromLoopback(req) {
+  const address = req.socket && typeof req.socket.remoteAddress === 'string' ? req.socket.remoteAddress : '';
+  if (address !== '' && LOOPBACK_HOSTS.has(address)) return true;
+  // No usable peer address (a test double, or a proxy that consumed the socket): fall back to
+  // the Host header, which at least keeps the old protection for callers that set it honestly.
+  const host = req.headers.host;
+  if (typeof host !== 'string' || host === '') return false;
+  return LOOPBACK_HOSTS.has(hostName(host));
+}
+
 /**
- * A same-origin page is the only caller that can reach a state-changing route.
+ * Only the panel may drive a state-changing route, and only from this machine.
  *
- * An absent Origin used to pass, which let any local process drive clean/set-key by simply
- * not sending the header. Browsers always send it on a cross-context POST, so requiring it
- * costs the panel nothing and shuts the door; a missing Host is treated the same way.
+ * The gate is the peer address, not the Origin string: a web page on another origin cannot reach
+ * a loopback socket, and one that reaches it through some other path still has to send an Origin
+ * that we then refuse unless it is the app's own scheme or a loopback name.
  */
 const sameOrigin = (req) => {
+  if (!fromLoopback(req)) return false;
   const origin = req.headers.origin;
-  const host = req.headers.host;
-  if (typeof origin !== 'string' || typeof host !== 'string') return false;
-  return origin === `http://${host}` || origin === `https://${host}`;
+  if (typeof origin !== 'string' || origin === '' || origin === 'null') return true;
+  if (origin.startsWith(APP_SCHEME)) return true;
+  let host = '';
+  try {
+    host = new URL(origin).hostname;
+  } catch {
+    return false;
+  }
+  return LOOPBACK_HOSTS.has(host) || LOOPBACK_HOSTS.has(`[${host}]`);
 };
 
 const readBody = (req) =>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-disk-cleaner",
-  "version": "1.6.6",
+  "version": "1.6.8",
   "type": "module",
   "description": "Disk Cleaner for DSH: scan known-safe cache locations, see what they occupy, and reclaim the space from a panel or from the agent.",
   "keywords": [

package/smoke.mjs

@@ -413,7 +413,7 @@ check(
     source.includes('QQ') ,
   'it only ever measures the QQGuild folder',
 );
-check('the version badge and package agree', pkg.version === '1.6.6');
+check('the version badge and package agree', pkg.version === '1.6.8');
 
 check(
   'a dry run is one click away and never sends confirm',
@@ -509,9 +509,15 @@ check(
 );
 
 check(
-  'a request without an Origin is refused',
-  /if \(typeof origin !== 'string' \|\| typeof host !== 'string'\) return false;/.test(index),
-  'any local process could otherwise drive a destructive route',
+  'a request without an Origin is refused unless it arrived on loopback',
+  /const LOOPBACK_HOSTS = new Set\(/.test(index) &&
+    /const APP_SCHEME = 'dsh-app:\/\/';/.test(index) &&
+    /function fromLoopback\(req\)/.test(index) &&
+    /req\.socket\.remoteAddress/.test(index) &&
+    /if \(!fromLoopback\(req\)\) return false;/.test(index) &&
+    /if \(origin\.startsWith\(APP_SCHEME\)\) return true;/.test(index) &&
+    !/return origin === `http:\/\/${host}` \|\| origin === `https:\/\/${host}`;/.test(index),
+  'the desktop shell posts from dsh-app://, and a stripped Origin can still be the panel itself',
 );
 
 check(