dsh-instruction-memory 1.0.4 → 1.0.5

package/README.md

@@ -57,7 +57,9 @@ DSH 就会得到第二份空记忆，看起来像"记忆消失"。
 > 1.0.0 之前的构建曾把数据写在宿主进程 cwd 下（`.dsh-instruction-memory.json`）。
 > 首次启动新版本时会自动迁移到上述位置，并把原文件改名为 `*.migrated` 保留。
 
-该文件可手工编辑，改完点设置页的「重新载入」即可读回。
+该文件可手工编辑，改完点设置页的「重新载入」即可读回。每次保存先写临时文件再原子替换，
+进程崩溃不会留下损坏的半截 `memory.json`。若手工编辑后的文件有条目为空或超过 200 条上限，
+设置页会明确提示哪些条目未能载入（它们将在下次保存时从文件中移除），不会静默丢弃。
 
 ## 兼容性
 

package/lib/client.js

@@ -57,6 +57,7 @@ window.__ModuleLoader__.load({
   border:1px dashed var(--dsw-alias-border-l2,rgba(0,0,0,.18)); color:var(--dsw-alias-label-secondary,#8a9099); }
 .im-err { font-size:12px; color:var(--dsw-alias-state-error-primary,#d94838); }
 .im-ok { font-size:12px; color:var(--dsw-alias-state-success-primary,#18a058); }
+.im-warn { font-size:12px; color:var(--dsw-alias-state-warn-primary,#d97706); }
 .im-meta { font-size:11.5px; color:var(--dsw-alias-label-secondary,#8a9099); word-break:break-all; }
 .im-pre { margin:0; padding:12px 14px; border-radius:8px; font-size:11.5px; line-height:1.65;
   background:var(--dsw-alias-bg-layer-2,rgba(0,0,0,.04)); color:var(--dsw-alias-label-secondary,#4b5563);
@@ -107,13 +108,25 @@ window.__ModuleLoader__.load({
     }
 
     async function callHost(method, args) {
-      const response = await fetch(API, {
-        method: 'POST',
-        headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ method, args: args === undefined ? null : args }),
-      })
-      if (!response.ok) throw new Error('宿主返回 HTTP ' + response.status)
-      return await response.json()
+      // A hung host used to pin the panel on 保存中… forever; fail visibly
+      // after a generous timeout instead.
+      const controller = typeof AbortController === 'function' ? new AbortController() : null
+      const timer = controller !== null ? setTimeout(() => controller.abort(), 15000) : null
+      try {
+        const response = await fetch(API, {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({ method, args: args === undefined ? null : args }),
+          signal: controller !== null ? controller.signal : undefined,
+        })
+        if (!response.ok) throw new Error('宿主返回 HTTP ' + response.status)
+        return await response.json()
+      } catch (err) {
+        if (controller !== null && controller.signal.aborted) throw new Error('请求宿主超时（15 秒无响应）')
+        throw err
+      } finally {
+        if (timer !== null) clearTimeout(timer)
+      }
     }
 
     function EntryEditor(props) {
@@ -126,6 +139,7 @@ window.__ModuleLoader__.load({
           h('input', {
             className: 'im-input',
             value: draft.title,
+            maxLength: 120,
             placeholder: '例如：回答语言',
             onChange: (ev) => set({ title: ev.target.value }),
           })),
@@ -134,6 +148,7 @@ window.__ModuleLoader__.load({
           h('textarea', {
             className: 'im-textarea',
             value: draft.content,
+            maxLength: 6000,
             placeholder: '例如：所有回答使用简体中文；不确定需求时先提问再动手。',
             onChange: (ev) => set({ content: ev.target.value }),
           })),
@@ -164,6 +179,7 @@ window.__ModuleLoader__.load({
           h('input', {
             className: 'im-input',
             value: draft.when,
+            maxLength: 200,
             placeholder: '例如：编写或修改代码时',
             onChange: (ev) => set({ when: ev.target.value }),
           })))
@@ -253,7 +269,10 @@ window.__ModuleLoader__.load({
       }
 
       const data = view.data
-      const storage = view.storage
+      // Older hosts can hand over snapshots without storage/limits; fall back
+      // instead of throwing mid-render.
+      const storage = view.storage || {}
+      const limits = view.limits || { minBudget: 800, maxBudget: 40000, maxEntries: 200 }
       const injection = view.injection || { registered: false, chars: 0, error: null }
       const entries = data.entries.slice().sort((a, b) => (b.priority - a.priority) || (b.updatedAt - a.updatedAt))
       const activeCount = entries.filter((e) => e.enabled && e.content !== '').length
@@ -289,17 +308,17 @@ window.__ModuleLoader__.load({
             h('input', {
               className: 'im-input',
               type: 'number',
-              min: view.limits.minBudget,
-              max: view.limits.maxBudget,
+              min: limits.minBudget,
+              max: limits.maxBudget,
               step: 100,
               value: budgetText,
               disabled: busy,
               onChange: (ev) => setBudgetText(ev.target.value),
               onBlur: () => {
                 const parsed = Number(budgetText)
-                if (!Number.isFinite(parsed) || parsed < view.limits.minBudget || parsed > view.limits.maxBudget) {
+                if (!Number.isFinite(parsed) || parsed < limits.minBudget || parsed > limits.maxBudget) {
                   setBudgetText(String(data.budgetChars))
-                  setError('上限需在 ' + view.limits.minBudget + ' ~ ' + view.limits.maxBudget + ' 之间')
+                  setError('上限需在 ' + limits.minBudget + ' ~ ' + limits.maxBudget + ' 之间')
                   return
                 }
                 send('set-options', { budgetChars: parsed })
@@ -330,6 +349,7 @@ window.__ModuleLoader__.load({
         storage.migratedFrom
           ? h('div', { className: 'im-ok' }, '已从旧位置迁移：' + storage.migratedFrom + '（原文件保留为 *.migrated）')
           : null,
+        storage.warning ? h('div', { className: 'im-warn' }, storage.warning) : null,
         error !== '' ? h('div', { className: 'im-err' }, error) : null,
         error === '' && notice !== '' ? h('div', { className: 'im-ok' }, notice) : null,
         error === '' && notice === '' && storage.error ? h('div', { className: 'im-err' }, storage.error) : null,
@@ -374,7 +394,13 @@ window.__ModuleLoader__.load({
             h('button', {
               className: 'im-btn im-btn-danger',
               disabled: busy,
-              onClick: () => send('delete-entry', { id: entry.id }),
+              onClick: () => {
+                // confirm() is standard DOM, guarded anyway: if the embedded
+                // shell omits it, deletion proceeds rather than breaking.
+                if (typeof window.confirm === 'function'
+                  && !window.confirm('确定删除「' + (entry.title !== '' ? entry.title : '未命名指令') + '」？删除后无法恢复。')) return
+                send('delete-entry', { id: entry.id })
+              },
             }, '删除')),
           h('div', { className: 'im-body' }, entry.content),
           entry.mode === 'auto' && entry.when !== ''

package/lib/index.js

@@ -10,7 +10,7 @@
  * plugin's fiber, so unmounting the row removes all of them.
  */
 
-import { mkdir, readFile, rename, writeFile } from 'node:fs/promises'
+import { mkdir, readFile, rename, unlink, writeFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { dirname, join } from 'node:path'
 
@@ -38,6 +38,8 @@ const LEGACY_FILE_NAME = '.dsh-instruction-memory.json'
 const SECTION_NAME = 'instruction-memory'
 const SECTION_ORDER = 900
 const API_PREFIX = '/instruction-memory/api'
+/** Request body ceiling for the settings-page route; anything larger is rejected. */
+const MAX_BODY_CHARS = 1_000_000
 
 /**
  * Resolve this plugin's data file under the harness home.
@@ -120,24 +122,43 @@ export function sanitizeEntry(raw) {
   }
 }
 
+/**
+ * Load a parsed memory file. Returns the sanitized data plus how many array
+ * items were discarded (blank entries, or valid ones past the cap). The count
+ * is surfaced rather than swallowed because the next save rewrites the file
+ * without those items — silently destroying user data is exactly what this
+ * plugin must never do.
+ */
 function normalizeData(raw) {
-  const out = { version: 1, enabled: true, budgetChars: DEFAULT_BUDGET, entries: [] }
-  if (raw === null || typeof raw !== 'object') return out
-  if (typeof raw.enabled === 'boolean') out.enabled = raw.enabled
-  out.budgetChars = clampBudget(raw.budgetChars)
+  const data = { version: 1, enabled: true, budgetChars: DEFAULT_BUDGET, entries: [] }
+  if (raw === null || typeof raw !== 'object') return { data, dropped: 0 }
+  if (typeof raw.enabled === 'boolean') data.enabled = raw.enabled
+  data.budgetChars = clampBudget(raw.budgetChars)
   const list = Array.isArray(raw.entries) ? raw.entries : []
   const seen = new Set()
+  let dropped = 0
   for (const candidate of list) {
-    if (out.entries.length >= MAX_ENTRIES) break
     const entry = sanitizeEntry(candidate)
-    if (entry === null) continue
+    if (entry === null) {
+      dropped += 1
+      continue
+    }
+    if (data.entries.length >= MAX_ENTRIES) {
+      dropped += 1
+      continue
+    }
     if (seen.has(entry.id)) entry.id = makeId()
     seen.add(entry.id)
-    out.entries.push(entry)
+    data.entries.push(entry)
   }
-  return out
+  return { data, dropped }
 }
 
+const droppedEntriesMessage = (count) =>
+  count > 0
+    ? '存储文件中有 ' + count + ' 条条目未能载入（内容为空或超过 ' + MAX_ENTRIES + ' 条上限）；下次保存时它们将从文件中移除'
+    : null
+
 function formatEntry(entry, tag) {
   const lines = ['[' + tag + '｜优先级 ' + priorityLabel(entry.priority) + '] ' + entry.title]
   if (entry.mode === 'auto' && entry.when !== '') lines.push('适用场景：' + entry.when)
@@ -212,7 +233,13 @@ export function buildBlock(data) {
       const room = budget - used - 2 - reserve
       const note = '\n…（本条因注入字数上限被截断）'
       if (room > note.length + 20) {
-        const body = block.slice(0, room - note.length) + note
+        // Cut in UTF-16 units but back off one char when that lands between a
+        // surrogate pair, so the truncation point can never end on the broken
+        // half of an emoji or CJK ext-B character.
+        let head = block.slice(0, room - note.length)
+        const last = head.charCodeAt(head.length - 1)
+        if (last >= 0xd800 && last <= 0xdbff) head = head.slice(0, -1)
+        const body = head + note
         blocks.push(body)
         used += body.length + 2
         return
@@ -241,6 +268,7 @@ export function apply(ctx) {
     storagePath: null,
     storageDisplay: null,
     storageError: null,
+    storageWarning: null,
     savedAt: null,
     migratedFrom: null,
     sectionRegistered: false,
@@ -318,9 +346,20 @@ export function apply(ctx) {
   const serialize = () => JSON.stringify(state.data, null, 2) + '\n'
 
   const writeToDisk = async () => {
+    // Atomic replace (write a sibling temp file, then rename): a crash
+    // mid-write must never leave a truncated memory.json behind, because the
+    // reader refuses to touch a file it cannot parse — half-written JSON
+    // would wedge every future boot until hand-repaired.
+    const tmpPath = storePath + '.tmp'
     try {
       await mkdir(dirname(storePath), { recursive: true })
-      await writeFile(storePath, serialize(), 'utf8')
+      await writeFile(tmpPath, serialize(), 'utf8')
+      try {
+        await rename(tmpPath, storePath)
+      } catch (err) {
+        await unlink(tmpPath).catch(() => {})
+        throw err
+      }
       state.storagePath = storePath
       state.storageDisplay = storePath
       state.storageError = null
@@ -340,11 +379,16 @@ export function apply(ctx) {
   const readFromDisk = async () => {
     state.storagePath = storePath
     state.storageDisplay = storePath
+    state.storageWarning = null
 
     // 1. The canonical location under the harness home.
     try {
       const parsed = await readStoreFile(storePath)
-      if (parsed !== null) state.data = normalizeData(parsed)
+      if (parsed !== null) {
+        const loaded = normalizeData(parsed)
+        state.data = loaded.data
+        state.storageWarning = droppedEntriesMessage(loaded.dropped)
+      }
       state.storageError = null
       return
     } catch (err) {
@@ -363,7 +407,9 @@ export function apply(ctx) {
     try {
       const parsed = await readStoreFile(legacyPath)
       if (parsed !== null) {
-        state.data = normalizeData(parsed)
+        const loaded = normalizeData(parsed)
+        state.data = loaded.data
+        state.storageWarning = droppedEntriesMessage(loaded.dropped)
         if (await writeToDisk()) {
           state.migratedFrom = legacyPath
           // Keep the original as evidence instead of deleting user data.
@@ -394,6 +440,21 @@ export function apply(ctx) {
       syncSection()
     })
 
+  /**
+   * All state-mutating work (edits and 重新载入) runs through this chain, so a
+   * save that is still flushing to disk can never interleave with a reload
+   * reading the file back — the old lost-update window in which the panel
+   * briefly resurrected data the user had just replaced. Each operation
+   * returns its full response payload, computed in the same tick as the
+   * mutation, so a snapshot can never straddle the next queued operation.
+   */
+  let diskQueue = Promise.resolve()
+  const enqueue = (op) => {
+    const run = diskQueue.then(op, op)
+    diskQueue = run.then(() => undefined, () => undefined)
+    return run
+  }
+
   /* ---------------- snapshots ---------------- */
 
   const snapshot = () => {
@@ -408,6 +469,7 @@ export function apply(ctx) {
       storage: {
         path: state.storageDisplay !== null ? state.storageDisplay : state.storagePath,
         error: state.storageError,
+        warning: state.storageWarning,
         savedAt: state.savedAt,
         migratedFrom: state.migratedFrom,
       },
@@ -431,7 +493,7 @@ export function apply(ctx) {
 
   /* ---------------- commands (shared by route and callers) ---------------- */
 
-  const saveEntry = async (raw) => {
+  const saveEntry = (raw) => enqueue(async () => {
     const entry = sanitizeEntry(raw)
     if (entry === null) return { ok: false, saved: false, message: '标题与指令内容不能同时为空', snapshot: snapshot() }
     entry.updatedAt = Date.now()
@@ -445,16 +507,23 @@ export function apply(ctx) {
       list.push(entry)
     }
     syncSection()
-    return settle(null, await writeToDisk())
-  }
+    const saved = await writeToDisk()
+    // A successful save has rewritten the file to match memory, so a
+    // dropped-entries warning from load time ("they will be removed on the
+    // next save") has played out and must not keep showing.
+    if (saved) state.storageWarning = null
+    return settle(null, saved)
+  })
 
-  const deleteEntry = async (id) => {
+  const deleteEntry = (id) => enqueue(async () => {
     state.data.entries = state.data.entries.filter((entry) => entry.id !== id)
     syncSection()
-    return settle(null, await writeToDisk())
-  }
+    const saved = await writeToDisk()
+    if (saved) state.storageWarning = null
+    return settle(null, saved)
+  })
 
-  const setOptions = async (patch) => {
+  const setOptions = (patch) => enqueue(async () => {
     if (patch !== null && typeof patch === 'object') {
       if (typeof patch.enabled === 'boolean') state.data.enabled = patch.enabled
       if (typeof patch.budgetChars === 'number' && Number.isFinite(patch.budgetChars)) {
@@ -462,8 +531,16 @@ export function apply(ctx) {
       }
     }
     syncSection()
-    return settle(null, await writeToDisk())
-  }
+    const saved = await writeToDisk()
+    if (saved) state.storageWarning = null
+    return settle(null, saved)
+  })
+
+  const reload = () => enqueue(async () => {
+    await readFromDisk()
+    syncSection()
+    return { ok: state.storageError === null, saved: true, message: state.storageError, snapshot: snapshot() }
+  })
 
   const dispatch = async (method, args) => {
     await boot
@@ -479,9 +556,7 @@ export function apply(ctx) {
       case 'set-options':
         return setOptions(args)
       case 'reload':
-        await readFromDisk()
-        syncSection()
-        return { ok: state.storageError === null, saved: true, message: state.storageError, snapshot: snapshot() }
+        return reload()
       default:
         return { ok: false, saved: false, message: '未知方法：' + String(method), snapshot: snapshot() }
     }
@@ -497,14 +572,33 @@ export function apply(ctx) {
         res.end(JSON.stringify({ ok: false, message: 'only POST is supported' }))
         return
       }
+      // A call aborted mid-flight (settings page closed, tab navigated away)
+      // makes these streams emit 'error'. A server stream with no error
+      // listener turns that into an uncaught exception — i.e. it would take
+      // the whole host process down over one dead HTTP request.
+      req.on('error', () => {})
+      res.on('error', () => {})
       let body = ''
+      // Over the ceiling we stop accumulating but keep draining, so the
+      // response can go out as a clean 413 instead of a destroyed socket the
+      // Client can only report as a generic network failure.
+      let overflow = false
       req.setEncoding('utf8')
       req.on('data', (chunk) => {
+        if (overflow) return
         body += chunk
-        if (body.length > 1_000_000) req.destroy()
+        if (body.length > MAX_BODY_CHARS) {
+          overflow = true
+          body = ''
+        }
       })
       req.on('end', () => {
         void (async () => {
+          if (overflow) {
+            res.writeHead(413, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
+            res.end(JSON.stringify({ ok: false, message: '请求体超过 ' + MAX_BODY_CHARS + ' 字符上限' }))
+            return
+          }
           let result
           try {
             const payload = body === '' ? {} : JSON.parse(body)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-instruction-memory",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "DSH 指令记忆：在设置界面中维护可增删改的长期指令，并自动注入此后每一轮对话的系统提示词。",
   "license": "MIT",
   "type": "module",