dsh-instruction-memory 1.0.15 → 1.0.16

package/CHANGELOG.md

@@ -7,6 +7,59 @@
 > 1.0.13 起由 CI 经 OIDC Trusted Publishing 发布（首个带 provenance 的版本）。
 > 这些历史 tag **不应回填**——npm 上的版本号已被占用。
 
+## [1.0.16] — 2026-10-05
+
+一次定向缺陷修复 + 宿主范围扩展。每项修复都有对应回归断言（`npm test` 五套件全绿：
+lint、host-range、smoke、contract、verify）。
+
+### 安全
+
+- **修复 IPv6 回环被错误 403 的缺陷**：经 `http://[::1]:端口` 打开设置页时，保存 /
+  删除 / 导入 / SSE 实时刷新此前全部不可用。两个成因：① `hostnameOf('::1')`
+  把裸 IPv6 字面量按最后一个冒号截断成 `:`，永远匹配不上回环名单（名单里的
+  `::1` 是死条目）；② WHATWG URL 解析器给出的 `Origin` 主机名**保留方括号**
+  （`[::1]`），而 `Host` 解析去掉方括号（`::1`），同源比较永不相等。现新增
+  IP 规范化比较（8 段零填充展开），同时覆盖 IPv4-mapped 地址的两种拼写
+  （`::ffff:127.0.0.1` 与 URL 规范化后的 `::ffff:7f00:1` 视为同一地址）；
+  DNS 重绑定等真正的跨站请求在 IPv6 上同样被拒。默认 `--host 127.0.0.1` 不受
+  此问题影响。
+- 绑定侧的回环判定同步走规范化比较：宿主绑定到 `::ffff:127.0.0.1` 这类等价
+  地址时，Host 防护不再被错误关闭。
+
+### 缺陷修复
+
+- **跨进程写锁补上持有者令牌（TOCTOU）**：锁文件 `memory.json.lock` 现在写入
+  本次写入的随机令牌，释放时仅当文件仍属自己才删除。此前一个超时 2 秒、"无锁
+  照写"的慢持有者，其 `finally` 可能把新持有者刚接管的锁删掉，静默放跑第三个
+  写者。过期死锁（超 10 秒）的接管策略不变。
+- **SSE 首帧等待 boot 完成**：在宿主首次磁盘读取尚未结束时打开的设置页，不再
+  先收到一帧空存储、再收到真实快照（一次"没有任何指令"的闪烁）。
+- **SSE 写出异常的连接现在完整清理**：广播时 `res.write` 抛错（对端已消失）会
+  注销并结束该响应，而不是只从广播集合删除、留下半注册的流；其他健康流不受
+  影响。
+- **编辑注入字数上限时不再被实时推送打断**：输入框聚焦期间，其他窗口/进程的
+  SSE 快照不再覆盖正在输入的数字；失焦后恢复与已提交值同步。
+- **删除不存在的 id 不再产生空写盘**：不再 bump `rev`、不写文件、不推送回声帧
+  （删除一个已被另一窗口删掉的条目时不再制造无意义的写入）。
+
+### 样式
+
+- 修复错误状态红点的 CSS 变量名笔误：`--dsh-alias-state-error-primary` →
+  `--dsw-alias-state-error-primary`（此前该点不跟随宿主主题，恒取兜底色）；
+  verify 套件新增全文件变量前缀扫描，杜绝同类笔误再发布。
+
+### 兼容性
+
+- **声明范围扩展到 `0.2.1-alpha.1`（2026-10-03 发布）**：新增
+  `>=0.2.1-alpha.0 <0.3.0-0` 枚举段。该版本此前在**宿主门禁**（includePrerelease）
+  与市场判定下可通过、但在 npm/pnpm 的默认 peer 解析下会报 ERESOLVE；现两种
+  模式一致放行。三处声明（peerDependencies / dsh.engines / dsh.compatibility）
+  仍由 host-range 测试钉死逐字节一致。对 npm 上全部 30 个已发布版本穷举：
+  范围内 15 个、两模式零分歧；契约矩阵对最近 10 个版本 12/12 通过。
+  **0.2.1-alpha.1 仅有源码契约层证据，未做真机启动实测。**
+- README 兼容性统计按当前 registry 更新（28/13 → 30/15），cordis 已发布版本
+  数 6 → 7（新增 `4.0.5-alpha.1`，已核验含 `ctx.inject`/`ctx.effect`）。
+
 ## [1.0.15] — 2026-10-03
 
 本轮为一次系统性缺陷清查后的批量修复，每一项都有对应的回归测试（`npm test` 五套件全绿：

package/README.md

@@ -259,24 +259,28 @@ GUI 与路由本就同主机不同端口），`none`（用户直接导航）放
 同一串范围（三处逐字节一致，由测试锁定）：
 
 ```
->=0.1.3-alpha.2 <0.1.4 || >=0.1.4-0 <0.1.5-0 || >=0.1.5-alpha.1 <0.1.6-0 || >=0.1.6-alpha.0 <0.1.7-0 || >=0.1.7-alpha.0 <0.2.0-0 || >=0.2.0-0
+>=0.1.3-alpha.2 <0.1.4 || >=0.1.4-0 <0.1.5-0 || >=0.1.5-alpha.1 <0.1.6-0 || >=0.1.6-alpha.0 <0.1.7-0 || >=0.1.7-alpha.0 <0.2.0-0 || >=0.2.1-alpha.0 <0.3.0-0 || >=0.2.0-0
 ```
 
 **验证范围与证据等级**——三者不可混为一谈，下面每一行都标了它到底证明了什么：
 
 | 等级 | 证明什么 | 覆盖 |
 | --- | --- | --- |
-| ① **真实启动** | 在该宿主版本上真的把 DSH 跑起来：插件装载、注入真的进入**组装后的提示**、插件 HTTP 路由可应答、客户端设置页模块被下发（Windows / Node 22） | `0.1.3-alpha.2` · `0.1.5-alpha.1` · `0.1.5-alpha.2` · `0.1.5-rc.1` · `0.1.5-rc.2` · **`0.2.0-rc.1`** ⁽*⁾ |
-| ② **契约核验** | 抓该版本**真实发布的源码**，逐个核验本插件实际用到的每个符号：`systemPrompt.section()`、`assemble()` 是否求值**函数型** `text`、`FILE_REFERENCE=900` / `TOOL_BASH=1000` 仍在（决定 order 950 是否空档）、重名注册是否抛错、`webServer.register()` / `get host()`、`ctx.inject()` / `ctx.effect()`、`dsh.client.inject` 两包在该版本是否存在且声明了 `dsh.client` | 声明范围接住的**全部 13 个已发布版本**（`0.1.3-alpha.2` → `0.2.0-rc.1`） |
+| ① **真实启动** | 在该宿主版本上真的把 DSH 跑起来：插件装载、注入真的进入**组装后的提示**、插件 HTTP 路由可应答、客户端设置页模块被下发（Windows / Node 22） | `0.1.3-alpha.2` · `0.1.5-alpha.1` · `0.1.5-alpha.2` · `0.1.5-rc.1` · `0.1.5-rc.2` · **`0.2.0-rc.1`** ⁽*⁾ · **`0.2.0-rc.2`** ⁽**⁾ |
+| ② **契约核验** | 抓该版本**真实发布的源码**，逐个核验本插件实际用到的每个符号：`systemPrompt.section()`、`assemble()` 是否求值**函数型** `text`、`FILE_REFERENCE=900` / `TOOL_BASH=1000` 仍在（决定 order 950 是否空档）、重名注册是否抛错、`webServer.register()` / `get host()`、`ctx.inject()` / `ctx.effect()`、`dsh.client.inject` 两包在该版本是否存在且声明了 `dsh.client` | 声明范围接住的**全部 15 个已发布版本**（`0.1.3-alpha.2` → `0.2.1-alpha.1`） |
 | ③ **真实执行** | 把插件**真的挂载**进该版本的 `@deepseek-ai/cordis`，跑装载 / 路由注册 / 卸载共 9 项断言 | cordis `4.0.2` 与 `4.0.4`（各 9/9） |
 
 ⁽*⁾ **`0.2.0-rc.1` 的①档有一条要说明**：插件装载、注入进入组装后的提示、HTTP 路由可应答三项**均已实测**（路由 `HTTP 200`；`injection.registered=true`、`chars=437`、**`pulls=38`**——即 0.2.0-rc.1 的 agent loop 真的求值了 38 次函数型 `text`）。第四项"客户端模块被下发"**没有直接抓取**：首页需要鉴权（`/` 返回 `401`），我无法取到 `window.__DSH_BOOT__`。这一项的支撑是间接但强的两条：① `dsh-client-modules` 在合成阶段对 `dsh.client` 声明做硬校验，不合格会抛 `ClientPackageCompositionError` 直接导致启动失败——宿主正常启动即说明声明通过了 0.2.0-rc.1 的校验；② 本插件用到的三个客户端契约包（`-slots` / `-renderer` / `-settings`）相对升级前真正在跑的 `0.1.7-rc.2` **逐字节未变**。**未做人工视觉确认**（没有打开设置页看）。
 
-此外 `host-range-test.mjs` 的固定矩阵覆盖 `0.1.6-alpha.2`、`0.1.7-rc.2` 与 `0.2.0-rc.1`，并会**读取本机实际安装的宿主版本**做实时断言。
+⁽**⁾ **`0.2.0-rc.2` 的①档**：桌面版 `0.2.0-rc.2`（私有发行版 `dsh-desktop-runtime`，见仓库 `dsh-memory-verification/DSH-VERSION-COMPAT.md` §12）上完成过路由 200 + `registered=true` + 注入段落真实出现在会话提示中的活体实测；网页版宿主 `0.2.0-rc.2` 上对本插件路由的 `state` 探测同样返回 200。同样**未做设置页人工视觉确认**。
 
-**关于 1.0.10 新增的 `ctx.inject`。** 这是新版唯一的硬依赖增量：`inject` 去掉了 `webServer`，设置页路由改为非阻塞的 `ctx.inject(['webServer'], …)` 子 fiber（原因见上）。为此逐个核验了 **cordis 全部 6 个已发布版本**（`4.0.1-rc.1` → `4.0.4`）——**每一个都具备 `ctx.inject`**，因此声明范围内不存在因它而失效的宿主版本。
+此外 `host-range-test.mjs` 的固定矩阵覆盖 `0.1.6-alpha.2`、`0.1.7-rc.2`、`0.2.0-rc.1`、`0.2.0-rc.2` 与 `0.2.1-alpha.1`，并会**读取本机实际安装的宿主版本**做实时断言。
 
-**关于声明范围是否"超范围承诺"。** 已对全部 **28 个**已发布宿主版本穷举核验：范围内 **13 个**版本的 API 面**全部齐备，超范围承诺 0 项**。范围外的 15 个版本（`0.0.1-rc.1` → `0.1.2-rc.1`）API 面**同样齐备**，但它们**从未真实启动验证过**，所以下限维持不动、不向外放宽——不把没验证过的东西写进声明。
+**关于 1.0.10 新增的 `ctx.inject`。** 这是新版唯一的硬依赖增量：`inject` 去掉了 `webServer`，设置页路由改为非阻塞的 `ctx.inject(['webServer'], …)` 子 fiber（原因见上）。为此逐个核验了 **cordis 全部 7 个已发布版本**（`4.0.1-rc.1` → `4.0.5-alpha.1`）——**每一个都具备 `ctx.inject`**（其中 4.0.2 / 4.0.4 另做了真实挂载执行，4.0.5-alpha.1 为源码符号核验），因此声明范围内不存在因它而失效的宿主版本。
+
+**关于声明范围是否"超范围承诺"。** 已对全部 **30 个**已发布宿主版本穷举核验（2026-10-05，npm 官方 registry）：范围内 **15 个**版本的 API 面**全部齐备，超范围承诺 0 项**，且默认与 `includePrerelease` 两种语义在这 15 个版本上零分歧。范围外的 15 个版本（`0.0.1-rc.1` → `0.1.2-rc.1`）API 面**同样齐备**，但它们**从未真实启动验证过**，所以下限维持不动、不向外放宽——不把没验证过的东西写进声明。
+
+**关于 `0.2.1-alpha.1`（2026-10-03 发布，1.0.16 起覆盖）。** 它是前述"未来 minor 预发布版本在默认语义下接不住"的**第一个真实发生案例**：1.0.15 的范围在宿主门禁与市场判定（均用 `includePrerelease`）下放行它，但在 npm/pnpm 默认 peer 解析下拒绝（ERESOLVE）；其耦合面（9 个契约点）经最近 10 版本矩阵核验全部齐备，cordis 为 `4.0.5-alpha.1`。1.0.16 新增 `>=0.2.1-alpha.0 <0.3.0-0` 枚举段后两种语义一致放行。**该版本仅有契约层证据，未做真机启动实测。**
 
 **`0.2.0-rc.1` 的核验口径**（2026-09-29 增补）：基准取 npm 上**真实发布的 `0.1.7-rc.2`**（升级前本机真正在跑的版本），逐文件 SHA256 与 `0.2.0-rc.1` 比对。本插件的 6 个耦合点里 **6 个逐字节未变**（`dsh-system-prompt` 4/4、`dsh-client-ui-slots` 4/4、`-renderer` 12/12、`-settings` 11/11、`dsh-host-webserver` 3/3、`dsh-client-modules` 10/10）；变动的只有 `dsh-agent-loop`（注入通路 `preStep` / `assemble` 逐行等同）与 `dsh-app-boot`（兼容门禁函数逐字节等同）。方法带**阴性对照**：同法比对 `0.1.6-alpha.2` 得到的哈希**不同**，证明这套比对确实能检出变化，而不是恒真。
 
@@ -295,6 +299,10 @@ major.minor.patch 且自身带预发布标签的比较符"。这条规则是**
 ⚠️ **一个必须知道的上限（注意它是"模式相关"的，别当成普适结论）：未声明的未来 minor 的预发布版本，在 npm 的默认语义下无法被任何范围覆盖。**
 `0.1.8-rc.1` 这类版本 tuple 与所有比较符都不同，在 **npm 默认语义**下**永远匹配不到**——与
 `^0.1.0` 无法匹配 `0.1.8-rc.1` 是同一个限制。正式版（`0.1.8`、`0.2.0`、`1.0.0` 等）不受影响。
+这个限制不再只是假设：**`0.2.1-alpha.1`（2026-10-03 发布）就是第一个真实撞上它的版本**，
+1.0.16 已通过新增 `0.2.1` 枚举段闭合；下一个未声明 tuple（如 `0.2.2-rc.1`、`0.3.0-rc.1`）
+仍会重演同一现象，需要发一版加一行——host-range 的实时守卫会在本机升级到该宿主时
+直接让测试失败并给出可直接套用的修复行。
 
 **但在 `includePrerelease: true` 下这条上限不成立。** 实测同一串范围：`0.1.8-rc.1` 在默认语义下 `false`、
 在 `includePrerelease: true` 下 **`true`**（已用 DSH 自带的 semver 7.8.5 验证）。而这个区别是**有后果**的，

package/lib/client.js

@@ -75,7 +75,7 @@ window.__ModuleLoader__.load({
 .im-dot { width:7px; height:7px; border-radius:50%; flex:none; background:var(--dsw-alias-label-secondary,#8a9099); }
 .im-dot-on { background:var(--dsw-alias-state-success-primary,#18a058); }
 .im-dot-off { background:var(--dsw-alias-state-warn-primary,#d97706); }
-.im-dot-err { background:var(--dsh-alias-state-error-primary,#d94838); }
+.im-dot-err { background:var(--dsw-alias-state-error-primary,#d94838); }
 .im-body-open { max-height:none; }
 .im-more { margin-top:4px; font-size:11.5px; color:var(--dsw-alias-brand-primary,#3b6cff); cursor:pointer; user-select:none; }
 .im-search-meta { margin-top:5px; }
@@ -485,6 +485,18 @@ window.__ModuleLoader__.load({
       }
     }
 
+    /**
+     * What the budget input should show after a snapshot arrives.
+     *
+     * A push from another window used to reset budgetText unconditionally
+     * inside absorb(), so editing the injection-size field while any other
+     * panel saved wiped the half-typed number. While the input is focused the
+     * user's draft wins; the committed value re-syncs on blur.
+     */
+    function nextBudgetText(currentText, incoming, focused) {
+      return focused ? currentText : String(incoming)
+    }
+
     async function callHost(method, args) {
       // A hung host used to pin the panel on 保存中… forever; fail visibly
       // after a generous timeout instead.
@@ -613,10 +625,18 @@ window.__ModuleLoader__.load({
       const [busy, setBusy] = React.useState(false)
       const [draft, setDraft] = React.useState(null)
       const [budgetText, setBudgetText] = React.useState('')
+      // Latest live value of the draft, because the SSE onmessage closure below
+      // is created once and must not read a stale first-render budgetText.
+      const budgetTextRef = React.useRef('')
+      budgetTextRef.current = budgetText
       const [showPreview, setShowPreview] = React.useState(false)
       const [query, setQuery] = React.useState('')
       const [undo, setUndo] = React.useState(null)
       const importInputRef = React.useRef(null)
+      // Whether the budget input is being edited right now. A live SSE push
+      // from another window must not replace the number under the cursor;
+      // the ref (not state) is read inside absorb so no re-render is needed.
+      const budgetFocusedRef = React.useRef(false)
       // The latest snapshot this panel has absorbed. The SSE effect runs once
       // (empty deps), so it cannot read the `view` state of a later render —
       // the ref is how its frames are compared against what is on screen.
@@ -668,7 +688,11 @@ window.__ModuleLoader__.load({
         }
         setView(normalized.snapshot)
         viewRef.current = normalized.snapshot
-        setBudgetText(String(normalized.snapshot.data.budgetChars))
+        // Keep the user's in-progress budget edit when a push arrives while
+        // the input is focused; re-sync only once editing is not active. The
+        // ref is the live draft — absorb may run from the SSE closure created
+        // on the first render.
+        setBudgetText(nextBudgetText(budgetTextRef.current, normalized.snapshot.data.budgetChars, budgetFocusedRef.current))
         if (!normalized.ok && normalized.message) {
           setError(normalized.message)
           setNotice('')
@@ -858,8 +882,11 @@ window.__ModuleLoader__.load({
               value: budgetText,
               disabled: busy,
               title: t('budget.unitHint'),
+              onFocus: () => { budgetFocusedRef.current = true },
               onChange: (ev) => setBudgetText(ev.target.value),
               onBlur: () => {
+                // Editing is over: later pushes may sync the field again.
+                budgetFocusedRef.current = false
                 const parsed = Number(budgetText)
                 if (!Number.isFinite(parsed) || parsed < limits.minBudget || parsed > limits.maxBudget) {
                   setBudgetText(String(data.budgetChars))
@@ -1108,6 +1135,7 @@ window.__ModuleLoader__.load({
     exports.__sameSnapshot = sameSnapshot
     exports.__confirmDiscard = confirmDiscard
     exports.__importSizeVerdict = importSizeVerdict
+    exports.__nextBudgetText = nextBudgetText
     exports.__strings = STRINGS
     exports.__ns = NS
     exports.__dictionaryT = dictionaryT

package/lib/index.js

@@ -10,8 +10,10 @@
  * plugin's fiber, so unmounting the row removes all of them.
  */
 
-import { copyFile, mkdir, open, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises'
+import { copyFile, mkdir, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises'
 import { watch } from 'node:fs'
+import { randomUUID } from 'node:crypto'
+import { isIP } from 'node:net'
 import { homedir } from 'node:os'
 import { basename, dirname, join } from 'node:path'
 
@@ -326,6 +328,13 @@ const LOOPBACK_HOSTNAMES = new Set(['127.0.0.1', 'localhost', '::1', '::ffff:127
  *
  * `127.0.0.1:8080` -> `127.0.0.1`; `[::1]:8080` -> `::1`; `localhost` -> `localhost`.
  * Exported so the parsing itself can be pinned by tests.
+ *
+ * HTTP requires IPv6 literals in Host to wear brackets, so the bracketed
+ * form is the one real traffic uses; the bare form still has to parse instead
+ * of being chopped at the last colon (the old code turned a bare `::1` into
+ * `:`, which never matched the loopback set). A bare value carrying MORE than
+ * one colon is an IPv6 literal with no port — with at most one colon it is
+ * host:port.
  */
 export function hostnameOf(value) {
   if (typeof value !== 'string') return ''
@@ -333,12 +342,100 @@ export function hostnameOf(value) {
   if (trimmed === '') return ''
   if (trimmed.startsWith('[')) {
     const end = trimmed.indexOf(']')
-    return end === -1 ? trimmed : trimmed.slice(1, end)
+    return end === -1 ? trimmed.slice(1) : trimmed.slice(1, end)
   }
+  // Unbracketed IPv6 literal: the colons are part of the address, not a port.
+  if (trimmed.indexOf(':') !== trimmed.lastIndexOf(':')) return trimmed
   const colon = trimmed.lastIndexOf(':')
   return colon === -1 ? trimmed : trimmed.slice(0, colon)
 }
 
+/**
+ * Normalise a hostname the same way on BOTH sides of the Origin comparison.
+ *
+ * `new URL('http://[::1]:8080').hostname` keeps the brackets (`[::1]`), while
+ * `hostnameOf('[::1]:8080')` strips them (`::1`) — comparing the two raw forms
+ * rejected every same-origin request that reached the GUI over IPv6 loopback.
+ * Strip one surrounding pair of brackets here so both sides spell an IPv6
+ * literal identically.
+ */
+const normalizeHostname = (value) => (
+  typeof value === 'string' && value.startsWith('[') && value.endsWith(']') && value.length >= 2
+    ? value.slice(1, -1)
+    : value
+)
+
+/**
+ * Expand an IPv6 literal to eight lower-cased zero-padded groups, translating a
+ * trailing embedded IPv4 suffix to two hex groups. Returns null for anything
+ * that is not a valid literal.
+ *
+ * Needed because the two sides of the Origin check spell the SAME address
+ * differently: a browser sends Host `[::ffff:127.0.0.1]` while the URL parser
+ * canonicalises Origin to `[::ffff:7f00:1]` — text comparison says these are
+ * different; address comparison must say they are the same.
+ */
+export function canonicalIp(value) {
+  if (typeof value !== 'string') return null
+  let addr = normalizeHostname(value.trim().toLowerCase())
+  const percent = addr.indexOf('%')
+  if (percent !== -1) addr = addr.slice(0, percent)
+  if (isIP(addr) === 4) {
+    return 'v4:' + addr.split('.').map((part) => Number(part)).join('.')
+  }
+  if (isIP(addr) !== 6) return null
+
+  // Translate a trailing dotted-quad (e.g. ::ffff:127.0.0.1) into two groups.
+  const v4 = /(\d{1,3}(?:\.\d{1,3}){3})$/i.exec(addr)
+  if (v4 !== null) {
+    const octets = v4[1].split('.').map((part) => Number(part))
+    if (octets.some((octet) => octet > 255)) return null
+    const prefix = addr.slice(0, v4.index)
+    const hi = (octets[0] << 8 | octets[1]).toString(16)
+    const lo = (octets[2] << 8 | octets[3]).toString(16)
+    // Keep the trailing ':' of the prefix as the separator before the two
+    // translated groups; it may also be the second ':' of a '::' compression,
+    // which must survive (so do not strip a leading colon afterwards).
+    addr = (prefix.endsWith(':') ? prefix : prefix + ':') + hi + ':' + lo
+  }
+
+  const halves = addr.split('::')
+  if (halves.length > 2) return null
+  if (halves.length === 1) {
+    const groups = halves[0].split(':')
+    if (groups.length !== 8 || groups.some((group) => !/^[0-9a-f]{1,4}$/i.test(group))) return null
+    return groups.map((group) => parseInt(group, 16).toString(16).padStart(4, '0')).join(':')
+  }
+  const [leftRaw, rightRaw] = halves
+  const left = leftRaw === '' ? [] : leftRaw.split(':')
+  const right = rightRaw === '' ? [] : rightRaw.split(':')
+  const missing = 8 - left.length - right.length
+  if (missing < 0) return null
+  const groups = left.concat(Array(missing).fill('0'), right)
+  if (groups.length !== 8 || groups.some((group) => !/^[0-9a-f]{1,4}$/i.test(group))) return null
+  return groups.map((group) => parseInt(group, 16).toString(16).padStart(4, '0')).join(':')
+}
+
+/** Whether two hostnames are the same endpoint: exact text or same IP literal. */
+const sameHostname = (a, b) => {
+  if (a === b) return true
+  const ca = canonicalIp(a)
+  const cb = canonicalIp(b)
+  return ca !== null && cb !== null && ca === cb
+}
+
+/** Loopback by exact name or by equivalent IP spelling (mapped/hex forms). */
+const isLoopbackName = (name) => {
+  if (LOOPBACK_HOSTNAMES.has(name)) return true
+  const canonical = canonicalIp(name)
+  if (canonical === null) return false
+  for (const known of LOOPBACK_HOSTNAMES) {
+    const knownCanonical = canonicalIp(known)
+    if (knownCanonical !== null && knownCanonical === canonical) return true
+  }
+  return false
+}
+
 /**
  * Why the settings-page route checks `Host`, `Origin` and `Sec-Fetch-Site` at
  * all, when it already refuses any content-type that is not
@@ -380,7 +477,7 @@ export function requestOriginVerdict(headers, guarded) {
   const requestHost = read('host').trim().toLowerCase()
   const requestHostname = hostnameOf(requestHost)
 
-  if (guarded && !LOOPBACK_HOSTNAMES.has(requestHostname)) {
+  if (guarded && !isLoopbackName(requestHostname)) {
     return { ok: false, reason: 'Host 头不是回环地址（可能是 DNS 重绑定攻击）：' + (requestHost === '' ? '(缺失)' : requestHost) }
   }
 
@@ -393,14 +490,19 @@ export function requestOriginVerdict(headers, guarded) {
   if (origin !== '') {
     let originHostname = ''
     try {
-      originHostname = new URL(origin).hostname.toLowerCase()
+      // URL.hostname keeps the brackets on an IPv6 literal; normalizeHostname
+      // takes them off so it can meet the bracket-free Host parsing on equal
+      // terms.
+      originHostname = normalizeHostname(new URL(origin).hostname.toLowerCase())
     } catch {
       originHostname = ''
     }
     // Compare hostnames, not host:port: a proxy may rewrite the port, and the
     // hostname is the part rebinding actually attacks. `Origin: null`
     // (sandboxed iframe, file://) parses to no hostname and is refused.
-    if (originHostname === '' || originHostname !== requestHostname) {
+    // Canonical IP comparison covers the two spellings of one address:
+    // ::1 vs [::1], and ::ffff:127.0.0.1 vs ::ffff:7f00:1.
+    if (originHostname === '' || !sameHostname(originHostname, requestHostname)) {
       return { ok: false, reason: 'Origin 与 Host 不同源：' + origin }
     }
   }
@@ -692,23 +794,25 @@ export function apply(ctx) {
   /* ---------------- external-change watching (SSE) ---------------- */
 
   /**
-   * Live subscribers to the settings page's event stream. Each entry is the
-   * `send(payload)` writer for one open response.
+   * Live subscribers to the settings page's event stream. Each entry maps a
+   * stream's `send(payload)` writer to its own teardown, so a write that fails
+   * (the socket went away) can dispose THAT stream instead of just dropping
+   * it from the broadcast set while its response stays open.
    */
-  const sseClients = new Set()
-  /** Per-connection teardown, so unmounting the plugin can end every stream. */
-  const sseCleanups = new Set()
+  const sseStreams = new Map()
   let storeWatcher = null
   let watchDebounce = null
 
   const pushSnapshot = () => {
-    if (sseClients.size === 0) return
+    if (sseStreams.size === 0) return
     const payload = 'data: ' + JSON.stringify(snapshot()) + '\n\n'
-    for (const send of Array.from(sseClients)) {
+    for (const [send, cleanup] of Array.from(sseStreams)) {
       try {
         send(payload)
       } catch {
-        sseClients.delete(send)
+        // The response is dead: run its full teardown (end + unsubscribe),
+        // not just a set delete that leaves the stream half-registered.
+        cleanup()
       }
     }
   }
@@ -788,15 +892,14 @@ export function apply(ctx) {
   }
 
   const disposeStreams = () => {
-    for (const cleanup of Array.from(sseCleanups)) {
+    for (const cleanup of Array.from(sseStreams.values())) {
       try {
         cleanup()
       } catch {
         // The response is already gone.
       }
     }
-    sseCleanups.clear()
-    sseClients.clear()
+    sseStreams.clear()
   }
 
   /* ---------------- storage ---------------- */
@@ -807,7 +910,8 @@ export function apply(ctx) {
 
   /**
    * Cross-process write lock: a `memory.json.lock` marker created exclusively
-   * (`wx`), held for the duration of one atomic replace, then removed.
+   * (`wx`) holding a random owner token, kept for the duration of one atomic
+   * replace, and removed afterwards ONLY BY ITS OWNER.
    *
    * The in-process diskQueue serialises this plugin's own writes, but two DSH
    * processes sharing a `$DSH_HOME` (e.g. `web` and `tui` profiles running at
@@ -821,19 +925,32 @@ export function apply(ctx) {
    * write proceeds anyway (disclosed in the debug log). A lock older than
    * LOCK_STALE_MS is treated as crashed-holder debris and stolen, so a killed
    * process cannot wedge every later save behind a stale marker.
+   *
+   * The token matters: stealing used to be a plain unlink, and the slow
+   * holder's `finally` then unlinked the lock the NEW owner had just created —
+   * a classic TOCTOU that silently unlocked the third writer. The marker
+   * carries this attempt's UUID, and release deletes it only when the file
+   * still carries that UUID, so a finished holder can never remove a lock it
+   * no longer owns.
+   *
+   * @returns `{ path, token }` while held, or `null` when the wait elapsed
+   * (the save proceeds unlocked by design).
    */
   const acquireStoreLock = async () => {
     const lockPath = storePath + '.lock'
+    const token = randomUUID()
     const deadline = Date.now() + LOCK_WAIT_MS
     for (;;) {
       try {
-        const handle = await open(lockPath, 'wx')
-        await handle.close()
-        return lockPath
+        await writeFile(lockPath, token, { flag: 'wx' })
+        return { path: lockPath, token }
       } catch (err) {
         if (err.code !== 'EEXIST') throw err
         const info = await stat(lockPath).catch(() => null)
         if (info !== null && Date.now() - info.mtimeMs > LOCK_STALE_MS) {
+          // Crashed-holder debris. It may be recreated by a live process
+          // between this unlink and the next wx attempt — that case simply
+          // loops and re-evaluates freshness instead of forcing its way in.
           await unlink(lockPath).catch(() => {})
           continue
         }
@@ -843,6 +960,21 @@ export function apply(ctx) {
     }
   }
 
+  /**
+   * Release a lock only when THIS attempt still owns it. Reading the marker
+   * back and comparing the token closes the window in which a finished slow
+   * holder deleted a lock the next owner had already taken over.
+   */
+  const releaseStoreLock = async (lock) => {
+    if (lock === null) return
+    try {
+      const owner = await readFile(lock.path, 'utf8').catch(() => null)
+      if (owner === lock.token) await unlink(lock.path).catch(() => {})
+    } catch {
+      // Cleanup must never throw into the save's finally.
+    }
+  }
+
   const writeToDisk = async () => {
     // Atomic replace (write a sibling temp file, then rename) with a rolling
     // one-version backup: a crash mid-write must never leave a truncated
@@ -859,12 +991,12 @@ export function apply(ctx) {
     // any step leaves the previous store readable at its own path.
     const tmpPath = storePath + '.tmp'
     const bakPath = storePath + '.bak'
-    let lockPath = null
+    let lock = null
     let previousRev = null
     try {
       await mkdir(dirname(storePath), { recursive: true })
-      lockPath = await acquireStoreLock()
-      if (lockPath === null) {
+      lock = await acquireStoreLock()
+      if (lock === null) {
         logDebug('store lock still held by another process; writing anyway (last write wins)')
       }
       // The rev is bumped before serialising so the file on disk and the state
@@ -912,7 +1044,7 @@ export function apply(ctx) {
       state.storageError = '保存失败：' + describeError(err)
       return false
     } finally {
-      if (lockPath !== null) await unlink(lockPath).catch(() => {})
+      await releaseStoreLock(lock)
     }
   }
 
@@ -1104,11 +1236,19 @@ export function apply(ctx) {
   // Load the store, then register the section if anything must be injected.
   // Every entry point awaits this, so a request that arrives before the disk
   // read settles can never overwrite the file with an empty in-memory state.
+  //
+  // `bootSettled` flips only after the read lands. The SSE connect frame is
+  // gated on it: a stream opened in the gap between apply() and the read
+  // finishing must wait, or its first frame would describe the EMPTY boot
+  // state and the panel would flash "no instructions" before the real
+  // snapshot arrived (POST /state already awaited boot; the stream did not).
+  let bootSettled = false
   const boot = readFromDisk()
     .catch((err) => {
       state.storageError = '读取失败：' + describeError(err)
     })
     .then(() => {
+      bootSettled = true
       syncSection()
       // The one always-on line: it answers "is memory mounted, where does it
       // live, and how much is being injected?" without any further digging.
@@ -1301,6 +1441,13 @@ export function apply(ctx) {
   const deleteEntry = (id, baseRev) => enqueue(async () => {
     if (state.versionRejected) return versionRefusal()
     if (isStaleBaseRev(baseRev)) return conflictResponse()
+    // Deleting an id that is not there changes nothing, so it must not touch
+    // disk, bump rev, or push an echo frame — otherwise two panels deleting
+    // the same entry one after another would manufacture a pointless write
+    // (and an external process watching the file would wake for nothing).
+    if (!state.data.entries.some((entry) => entry.id === id)) {
+      return { ok: true, saved: false, message: null, snapshot: snapshot() }
+    }
     const saved = await commit(() => {
       state.data.entries = state.data.entries.filter((entry) => entry.id !== id)
     })
@@ -1487,23 +1634,38 @@ export function apply(ctx) {
     // restarted) instead of hammering the route.
     res.write('retry: 5000\n\n')
     const send = (payload) => { res.write(payload) }
-    sseClients.add(send)
-    // A snapshot on connect, so a late subscriber synchronises immediately
-    // instead of waiting for the next change.
-    send('data: ' + JSON.stringify(snapshot()) + '\n\n')
+    let closed = false
     const cleanup = () => {
-      sseClients.delete(send)
-      sseCleanups.delete(cleanup)
+      closed = true
+      sseStreams.delete(send)
       try {
         res.end()
       } catch {
         // The response is already gone.
       }
     }
-    sseCleanups.add(cleanup)
+    sseStreams.set(send, cleanup)
     req.on('close', cleanup)
     req.on('error', cleanup)
     res.on('error', cleanup)
+    // A snapshot on connect, so a late subscriber synchronises immediately
+    // instead of waiting for the next change. It must wait for boot: a stream
+    // opened while the initial disk read is still in flight would otherwise be
+    // handed the empty boot state as its first frame, flashing "no
+    // instructions" before the loaded store arrives.
+    const sendConnectFrame = () => {
+      if (closed) return
+      try {
+        send('data: ' + JSON.stringify(snapshot()) + '\n\n')
+      } catch {
+        cleanup()
+      }
+    }
+    if (bootSettled) {
+      sendConnectFrame()
+    } else {
+      boot.then(sendConnectFrame, sendConnectFrame)
+    }
   }
 
   const handler = (req, res) => {
@@ -1613,7 +1775,7 @@ export function apply(ctx) {
     // disabled for all non-loopback binds and the trade-off is documented in
     // the README.
     const boundHost = typeof webServer.host === 'string' ? webServer.host.trim().toLowerCase() : ''
-    guardHost = boundHost === '' || LOOPBACK_HOSTNAMES.has(boundHost)
+    guardHost = boundHost === '' || isLoopbackName(boundHost)
     try {
       routeDispose = webServer.register({ kind: 'prefix', path: API_PREFIX, handler })
       logDebug('settings route registered at ' + API_PREFIX + ' (boundHost=' + boundHost + ', hostGuard=' + guardHost + ')')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-instruction-memory",
-  "version": "1.0.15",
+  "version": "1.0.16",
   "description": "User-only instruction memory for DSH: long-term instructions maintained in the settings UI and auto-injected into every conversation — the model has no write access. 指令记忆：只由用户在设置页维护的长期指令，自动注入此后每轮对话；模型没有任何写入口。",
   "license": "MIT",
   "type": "module",
@@ -49,7 +49,7 @@
     "node": ">=20"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh-system-prompt": ">=0.1.3-alpha.2 <0.1.4 || >=0.1.4-0 <0.1.5-0 || >=0.1.5-alpha.1 <0.1.6-0 || >=0.1.6-alpha.0 <0.1.7-0 || >=0.1.7-alpha.0 <0.2.0-0 || >=0.2.0-0"
+    "@deepseek-ai/dsh-system-prompt": ">=0.1.3-alpha.2 <0.1.4 || >=0.1.4-0 <0.1.5-0 || >=0.1.5-alpha.1 <0.1.6-0 || >=0.1.6-alpha.0 <0.1.7-0 || >=0.1.7-alpha.0 <0.2.0-0 || >=0.2.1-alpha.0 <0.3.0-0 || >=0.2.0-0"
   },
   "publishConfig": {
     "access": "public"
@@ -72,10 +72,10 @@
       "platform": "web"
     },
     "engines": {
-      "dsh": ">=0.1.3-alpha.2 <0.1.4 || >=0.1.4-0 <0.1.5-0 || >=0.1.5-alpha.1 <0.1.6-0 || >=0.1.6-alpha.0 <0.1.7-0 || >=0.1.7-alpha.0 <0.2.0-0 || >=0.2.0-0"
+      "dsh": ">=0.1.3-alpha.2 <0.1.4 || >=0.1.4-0 <0.1.5-0 || >=0.1.5-alpha.1 <0.1.6-0 || >=0.1.6-alpha.0 <0.1.7-0 || >=0.1.7-alpha.0 <0.2.0-0 || >=0.2.1-alpha.0 <0.3.0-0 || >=0.2.0-0"
     },
     "compatibility": {
-      "dsh": ">=0.1.3-alpha.2 <0.1.4 || >=0.1.4-0 <0.1.5-0 || >=0.1.5-alpha.1 <0.1.6-0 || >=0.1.6-alpha.0 <0.1.7-0 || >=0.1.7-alpha.0 <0.2.0-0 || >=0.2.0-0"
+      "dsh": ">=0.1.3-alpha.2 <0.1.4 || >=0.1.4-0 <0.1.5-0 || >=0.1.5-alpha.1 <0.1.6-0 || >=0.1.6-alpha.0 <0.1.7-0 || >=0.1.7-alpha.0 <0.2.0-0 || >=0.2.1-alpha.0 <0.3.0-0 || >=0.2.0-0"
     }
   }
 }