dsh-instruction-memory 1.3.0 → 1.3.2

package/CHANGELOG.md

@@ -7,6 +7,61 @@
 > 1.0.13 起由 CI 经 OIDC Trusted Publishing 发布（首个带 provenance 的版本）。
 > 这些历史 tag **不应回填**——npm 上的版本号已被占用。
 
+## [1.3.2] — 2026-10-16
+
+1.3.1 发布后的两轮全量体检产出：CI 测试基建根治、client/demo 边界修复与宿主生命周期加固。
+
+### 修复
+
+- **CI 测试基建：路由等待按墙钟计时**：contract/ui 的 rawRoute 原以固定迭代数轮询
+  （约 2s 上限），高负载 runner 上真实磁盘写路径（锁、双备份、rename、历史快照）可能偶发
+  超限，导致整套测试崩溃（`route never responded`），且崩溃无断言痕迹。CI 偶发红
+  （1.2.0 时代即有先例）的根因即此。现改为墙钟 15s 上限，并给每个套件装崩溃钩子
+  （失败时输出 GitHub `::error::` 注解，含断言与堆栈），verify 的固定 60ms boot 等待改为
+  轮询到条件成立。仅测试基建，不影响已发布包内容。
+- **CI 假绿窗口收口**：套件尾部 `process.exit(failures===0?0:1)` 会覆盖崩溃钩子设置的
+  exitCode——最后一次校验之后的浮游 rejection 可能被吞成「ALL PASS + exit 0」。现在退出码
+  尊重钩子状态；ui-test 的 scratch 清理移到退出码捕获之前；fetch 包装器在路由超时抛出时
+  递减 inFlight（否则后续每次 settle 都烧满等待窗口）。
+- **测试 scratch 目录自清理**：contract/verify/ui 现在都注册按 PID 的退出钩子，任何退出路径
+  （崩溃、抛错、失败）都删掉本进程的家目录；此前每次跑测试都会在仓库里留下
+  `.test-dsh-home-*` 目录（实测累积到 39 个）。仅测试基建。
+- **verify 三条恒真断言修正**：F17 相关性分词的三个 check 把比较器写在了 detail 位、
+  ok 位是恒真值，实际从未断言（c74bfcc 引入的既有问题，本轮审阅发现）；改为真布尔断言。
+- **demo 桩 `sets.total` 计数错误**：scoped 数组覆盖克隆后才读计数，「全部配置集合计」显示的是
+  当前集合数而非全库数；改为覆盖前从原库统计。
+- **client：`data:null` 快照穿透 normalizer**：absorb 读取 `data.budgetChars` 抛错，初始加载
+  会永久卡在加载态且无错误提示（当前宿主不产生该形状，防御性收口，verify 钉住）。
+- **client：重进源码模式不再静默丢弃未保存草稿**：源码草稿与最近一次读/存的基线比对，有改动
+  走标准弃用确认（基线随读取与保存推进）。
+- **client：F17 本地预演不再给已停用条目标注命中**（它们永远不会被注入，此前会误导）。
+- **host 生命周期三处加固**：初始 `state.data` 字面量补齐 `disabledUntil` 键（watcher 自写
+  检测在新进程首次保存时因键形状不一致必然失配，产生一次多余重载与冗余 SSE 帧，探针实证）；
+  卸载栅栏（in-flight 操作完成后不再重注册注入段/重启 watcher/推送快照）；`state` 路由的
+  首次物化纳入磁盘队列（与 readSource 一致）。
+
+### 变更
+
+- **暂停倒计时改用渲染时时钟**：剩余时间在渲染时直接取 `Date.now()` 计算，1 秒 interval
+  仅作重渲染触发器。此前 nowTick 在两次暂停之间可能陈旧任意久（如隔天再暂停），首帧
+  剩余时间会虚大；原描述「最多偏大 1 秒」低估了陈旧量。仅展示层。
+
+## [1.3.1] — 2026-10-15
+
+1.3.0 发布当天的评审跟进：一个披露计数回归与三个展示层小修正。
+
+### 修复
+
+- **ui-test 去竞态**：F7 真实定时器冒烟中「暂停后立刻断言注入已静音」与 50ms 定时器存在调度竞态
+  （高负载 runner 上定时器可能已过期），改为确定性地断言到期时刻已写入存储文件，并把到期等待
+  从 300ms 放宽到 1s。仅测试基建，不影响已发布的包内容。
+- **导入回退去重后的计数披露**：「新增指令 N 条 / 新增用户形象 N 个」按实际落库数（staged）
+  统计，不再包含被回退去重跳过的项；截断披露同样只统计实际落库项。a2b885b 引入的口径回归，
+  contract-test 新增断言钉住「2 通过 − 1 回退重复 = 新增指令 1 条」。
+- **暂停倒计时与复制路径的三个小修正**：新起暂停时先取当前时刻再起秒表（否则长开面板的
+  首帧剩余时间可能偏大最多 1 秒，下一秒自愈）；他窗发起暂停时复位暂停菜单展开态；
+  剪贴板 execCommand 抛错路径也移除游离的辅助 textarea。均为 1.3.0 评审发现，仅展示层。
+
 ## [1.3.0] — 2026-10-15
 
 两个审查修复与两项体验增强（F12 / F7）。

package/lib/client.js

@@ -924,7 +924,9 @@ window.__ModuleLoader__.load({
     function normalizeResult(result) {
       if (result === null || typeof result !== 'object') return null
       const snapshot = result.snapshot !== undefined && result.snapshot !== null ? result.snapshot : result
-      if (snapshot === null || typeof snapshot !== 'object' || snapshot.data === undefined) return null
+      // data === null passes a typeof check but poisons every consumer that
+      // reads data.budgetChars; it is exactly as unusable as a missing data.
+      if (snapshot === null || typeof snapshot !== 'object' || snapshot.data === undefined || snapshot.data === null) return null
       return {
         snapshot,
         ok: result.ok !== false,
@@ -1530,6 +1532,10 @@ window.__ModuleLoader__.load({
       // The body ceiling for the live check, mirrored into a ref so the
       // debounced effect never has to depend on the snapshot object.
       const sourceCeilingRef = React.useRef(0)
+      // The source text as of the last read/save: openSource compares the
+      // live draft against this to decide whether re-entering source mode
+      // needs a discard confirmation.
+      const sourceBaselineRef = React.useRef('')
       // F17: the local relevance preview.
       const [simOpen, setSimOpen] = React.useState(false)
       const [simQuery, setSimQuery] = React.useState('')
@@ -1595,11 +1601,16 @@ window.__ModuleLoader__.load({
       // clears it the moment the snapshot says otherwise. This effect sits
       // BEFORE the early returns (a hook skipped by a conditional return would
       // desync the hook order); it reads the snapshot through `view` because
-      // the derived `injection` does not exist yet up here.
+      // the derived `injection` does not exist yet up here. The tick value
+      // itself is only a re-render trigger; the rendered remaining time is
+      // computed from Date.now() at render time (see below).
       const mutedNow = view !== null && view.injection !== null && typeof view.injection === 'object'
         && view.injection.muted === true
       React.useEffect(() => {
         if (!mutedNow) return undefined
+        // A pause started from ANOTHER window replaces the menu row; the open
+        // flag must not resurface when the row returns after expiry.
+        setPauseMenuOpen(false)
         const tick = setInterval(() => setNowTick(Date.now()), 1000)
         return () => clearInterval(tick)
       }, [mutedNow])
@@ -1874,6 +1885,12 @@ window.__ModuleLoader__.load({
           setError(t('source.editorOpen'))
           return
         }
+        // Re-entering source mode must not silently discard an unsaved source
+        // draft: sourceText survives 退出源码模式 and reloadSource, and the
+        // button stays reachable while source mode is open. The baseline is
+        // the text as of the last read/save, so an untouched draft reopens
+        // without friction.
+        if (sourceText !== sourceBaselineRef.current && !confirmDiscard()) return
         try {
           const result = await callHost('read-source', null)
           if (result === null || typeof result !== 'object' || typeof result.source !== 'string') {
@@ -1886,6 +1903,7 @@ window.__ModuleLoader__.load({
             return
           }
           setSourceText(result.source)
+          sourceBaselineRef.current = result.source
           setSourceBaseRev(revOfFrom(result.snapshot))
           setSourceVerdict(null)
           setSourceMode(true)
@@ -1911,6 +1929,7 @@ window.__ModuleLoader__.load({
           // on must move with it — otherwise the very next save would be
           // refused as a conflict against our own write.
           setSourceBaseRev(revOfFrom(result.snapshot))
+          sourceBaselineRef.current = sourceText
           void loadHistory()
         })
       }
@@ -1984,8 +2003,14 @@ window.__ModuleLoader__.load({
           const host = document.body || document.head
           if (host && typeof host.appendChild === 'function') host.appendChild(area)
           if (typeof area.select === 'function') area.select()
-          const ok = typeof document.execCommand === 'function' && document.execCommand('copy') === true
-          if (host && typeof host.removeChild === 'function' && area.parentNode === host) host.removeChild(area)
+          // execCommand may THROW (not merely return false); the detached
+          // helper must leave the DOM on every path.
+          let ok = false
+          try {
+            ok = typeof document.execCommand === 'function' && document.execCommand('copy') === true
+          } finally {
+            if (host && typeof host.removeChild === 'function' && area.parentNode === host) host.removeChild(area)
+          }
           if (ok) {
             setNotice(t('diag.copied'))
             return
@@ -2201,7 +2226,9 @@ window.__ModuleLoader__.load({
         : data.entries.length
       const activeSetName = (setsList.find((set) => set.id === setsActiveId) || {}).name || ''
       // F17: the local preview scores the ACTIVE set's on-demand entries.
-      const autoEntries = data.entries.filter((entry) => entry.mode === 'auto')
+      // Disabled entries can never be injected, so scoring them as 预演 hits
+      // would mislead — they are excluded from the preview entirely.
+      const autoEntries = data.entries.filter((entry) => entry.mode === 'auto' && entry.enabled !== false)
       const sim = relevancePreview(autoEntries, simQuery)
       const simById = new Map(sim.results.map((hit) => [hit.id, hit]))
       const omittedById = new Map()
@@ -2258,14 +2285,16 @@ window.__ModuleLoader__.load({
         ? view.diagnostics.rev
         : (data.rev || 0)
       // F7: the pause decision itself belongs to the host (injection.muted);
-      // the countdown below is display-only. At zero the bar yields back to
-      // the normal control (the host's own timer is delivering a fresh
-      // snapshot at that moment in any case).
+      // the countdown below is display-only. The remaining time is computed
+      // from the clock AT RENDER TIME — a stale tick value could be days old
+      // (the interval only runs while a pause is live), which would inflate
+      // the first frame of a later pause. The 1s interval exists purely to
+      // trigger re-renders; at zero the bar yields back to the normal control.
       const muted = injection.muted === true
       const disabledUntil = typeof data.disabledUntil === 'number' && Number.isFinite(data.disabledUntil)
         ? data.disabledUntil
         : 0
-      const muteRemainingMs = muted ? Math.max(0, disabledUntil - nowTick) : 0
+      const muteRemainingMs = muted ? Math.max(0, disabledUntil - Date.now()) : 0
       const muteRemainingText = (ms) => {
         const totalSec = Math.max(0, Math.round(ms / 1000))
         const hh = Math.floor(totalSec / 3600)

package/lib/index.js

@@ -1255,6 +1255,11 @@ export function apply(ctx) {
       version: FORMAT_VERSION,
       rev: 0,
       enabled: true,
+      // Must match normalizeData's output shape KEY FOR KEY: the watcher's
+      // self-write detection compares JSON strings, and a missing key here
+      // made every fresh process's first save look like an external change
+      // (one redundant reload + frame).
+      disabledUntil: 0,
       budgetChars: DEFAULT_BUDGET,
       backupDir: '',
       activeSetId: DEFAULT_SET_ID,
@@ -1313,6 +1318,13 @@ export function apply(ctx) {
    * (from syncSection) and cleared in the effect cleanup.
    */
   let muteTimer = null
+  /**
+   * Set by the effect cleanup: after unmount, an in-flight queued op may
+   * still complete its disk write (the data must land), but it must not
+   * re-register the prompt section, restart the watcher, or push snapshots
+   * into a torn-down fiber.
+   */
+  let disposed = false
 
   /**
    * A first run deliberately writes NOTHING (see readFromDisk step 3). This flag
@@ -1471,6 +1483,7 @@ export function apply(ctx) {
    * leave the prompt byte-identical to a deployment without this plugin.
    */
   const syncSection = () => {
+    if (disposed) return
     const wanted = sectionText() !== ''
     if (wanted && sectionDispose === null) {
       try {
@@ -1504,6 +1517,7 @@ export function apply(ctx) {
   }
 
   ctx.effect(() => () => {
+    disposed = true
     if (sectionDispose !== null) {
       const dispose = sectionDispose
       sectionDispose = null
@@ -1534,7 +1548,7 @@ export function apply(ctx) {
   let watchDebounce = null
 
   const pushSnapshot = () => {
-    if (sseStreams.size === 0) return
+    if (disposed || sseStreams.size === 0) return
     const payload = 'data: ' + JSON.stringify(snapshot()) + '\n\n'
     for (const [send, cleanup] of Array.from(sseStreams)) {
       try {
@@ -1606,7 +1620,7 @@ export function apply(ctx) {
    * yet) throws and is retried by the first successful write.
    */
   const startWatching = () => {
-    if (storeWatcher !== null) return
+    if (disposed || storeWatcher !== null) return
     try {
       storeWatcher = watch(dirname(storePath), { persistent: false }, (event, filename) => {
         // Only events naming memory.json matter; the .tmp/.bak/.lock churn of
@@ -3372,8 +3386,6 @@ export function apply(ctx) {
     const seenIds = new Set(existing.map((entry) => entry.setId + '\u0000' + entry.id))
     const seenBodies = new Set(existing.map((entry) => bodyKey(entry.setId, entry.title, entry.content)))
     const accepted = []
-    const cutFields = new Set()
-    let truncatedCount = 0
     let skipped = 0
     for (const candidate of (rawEntries || [])) {
       const entry = sanitizeEntry(candidate)
@@ -3390,17 +3402,12 @@ export function apply(ctx) {
         skipped += 1
         continue
       }
+      // Truncation travels per item and is only REPORTED for items that are
+      // actually staged: an item later skipped as a fallback duplicate must
+      // not inflate the truncation disclosure (or the inserted-count).
       const cut = truncatedFields(candidate)
-      if (cut.length > 0) {
-        // sanitizeEntry enforces the limits silently, which is fine for the
-        // editor (its inputs carry the same maxLength) but wrong here: an
-        // imported 7,000-character instruction would come back as 6,000 with
-        // nothing said about the loss.
-        truncatedCount += 1
-        for (const field of cut) cutFields.add(field)
-      }
       entry.updatedAt = Date.now()
-      accepted.push({ entry, wanted })
+      accepted.push({ entry, wanted, cut })
       seenIds.add(wanted + '\u0000' + entry.id)
       seenBodies.add(bodyKey(wanted, entry.title, entry.content))
     }
@@ -3411,8 +3418,6 @@ export function apply(ctx) {
     const seenProfileIds = new Set(existingProfiles.map((profile) => profile.setId + '\u0000' + profile.id))
     const seenProfileBodies = new Set(existingProfiles.map((profile) => profile.setId + '\u0000' + profile.name + '\u0000' + profile.content))
     const acceptedProfiles = []
-    const cutProfileFields = new Set()
-    let truncatedProfileCount = 0
     let skippedProfiles = 0
     for (const candidate of (rawProfiles || [])) {
       const profile = sanitizeProfile(candidate)
@@ -3431,12 +3436,8 @@ export function apply(ctx) {
         continue
       }
       const cut = truncatedProfileFields(candidate)
-      if (cut.length > 0) {
-        truncatedProfileCount += 1
-        for (const field of cut) cutProfileFields.add(field)
-      }
       profile.updatedAt = Date.now()
-      acceptedProfiles.push({ profile, wanted })
+      acceptedProfiles.push({ profile, wanted, cut })
       seenProfileIds.add(wanted + '\u0000' + profile.id)
       seenProfileBodies.add(wanted + '\u0000' + profile.name + '\u0000' + profile.content)
     }
@@ -3499,7 +3500,7 @@ export function apply(ctx) {
           finalSeenBodies.add(bodyKey(finalId, item.entry.title, item.entry.content))
         }
         item.entry.setId = finalId
-        stagedEntries.push(item.entry)
+        stagedEntries.push(item)
       }
       const finalSeenProfileIds = new Set(existingProfiles.map((profile) => profile.setId + '\u0000' + profile.id))
       const finalSeenProfileBodies = new Set(existingProfiles.map((profile) => profile.setId + '\u0000' + profile.name + '\u0000' + profile.content))
@@ -3522,7 +3523,7 @@ export function apply(ctx) {
           finalSeenProfileBodies.add(finalId + '\u0000' + item.profile.name + '\u0000' + item.profile.content)
         }
         item.profile.setId = finalId
-        stagedProfiles.push(item.profile)
+        stagedProfiles.push(item)
       }
     }
     if (stagedEntries.length === 0 && stagedProfiles.length === 0) {
@@ -3538,8 +3539,8 @@ export function apply(ctx) {
     }
     const saved = await commit(() => {
       state.data.sets.push(...createdSets)
-      for (const entry of stagedEntries) state.data.entries.push(entry)
-      for (const profile of stagedProfiles) state.data.profiles.push(profile)
+      for (const item of stagedEntries) state.data.entries.push(item.entry)
+      for (const item of stagedProfiles) state.data.profiles.push(item.profile)
     })
     const parts = []
     if (createdSets.length > 0) {
@@ -3551,19 +3552,38 @@ export function apply(ctx) {
     if (dedupedOnFallback > 0) {
       parts.push('另有 ' + dedupedOnFallback + ' 项因回退到当前配置集后与已有内容重复被跳过')
     }
-    if (accepted.length > 0) {
-      const truncated = truncatedCount > 0
-        ? '；其中 ' + truncatedCount + ' 条超过长度上限，' + [...cutFields].join('、') + '已被截断'
+    if (stagedEntries.length > 0) {
+      // Counts quote what actually LANDED: staged ⊆ accepted, and the gap is
+      // the fallback duplicates already disclosed on their own line — an
+      // accepted-based count would claim inserts that were skipped.
+      const stagedCut = new Set()
+      let stagedTruncated = 0
+      for (const item of stagedEntries) {
+        if (item.cut.length > 0) {
+          stagedTruncated += 1
+          for (const field of item.cut) stagedCut.add(field)
+        }
+      }
+      const truncated = stagedTruncated > 0
+        ? '；其中 ' + stagedTruncated + ' 条超过长度上限，' + [...stagedCut].join('、') + '已被截断'
         : ''
-      parts.push('新增指令 ' + accepted.length + ' 条，跳过 ' + skipped + ' 条' + truncated)
+      parts.push('新增指令 ' + stagedEntries.length + ' 条，跳过 ' + skipped + ' 条' + truncated)
     } else if (skipped > 0) {
       parts.push('指令跳过 ' + skipped + ' 条（已存在或无效）')
     }
-    if (acceptedProfiles.length > 0) {
-      const truncated = truncatedProfileCount > 0
-        ? '；其中 ' + truncatedProfileCount + ' 个超过长度上限，' + [...cutProfileFields].join('、') + '已被截断'
+    if (stagedProfiles.length > 0) {
+      const stagedCut = new Set()
+      let stagedTruncated = 0
+      for (const item of stagedProfiles) {
+        if (item.cut.length > 0) {
+          stagedTruncated += 1
+          for (const field of item.cut) stagedCut.add(field)
+        }
+      }
+      const truncated = stagedTruncated > 0
+        ? '；其中 ' + stagedTruncated + ' 个超过长度上限，' + [...stagedCut].join('、') + '已被截断'
         : ''
-      parts.push('新增用户形象 ' + acceptedProfiles.length + ' 个，跳过 ' + skippedProfiles + ' 个' + truncated)
+      parts.push('新增用户形象 ' + stagedProfiles.length + ' 个，跳过 ' + skippedProfiles + ' 个' + truncated)
     } else if (skippedProfiles > 0) {
       parts.push('用户形象跳过 ' + skippedProfiles + ' 个（已存在或无效）')
     }
@@ -3579,7 +3599,12 @@ export function apply(ctx) {
         // A first run writes nothing at boot (readFromDisk step 3), so the
         // materialisation happens here, on a deliberate user action, instead of
         // as a side effect of the host merely starting up.
-        const materialized = await ensureStoreMaterialized()
+        // A first run writes nothing at boot (readFromDisk step 3), so the
+        // materialisation happens here, on a deliberate user action, instead of
+        // as a side effect of the host merely starting up. It goes through the
+        // same disk queue as every other disk access, so it can never
+        // interleave with an in-flight write (readSource already did this).
+        const materialized = await enqueue(() => ensureStoreMaterialized())
         // Same envelope as every other method. One response shape means the
         // Client can never again be handed a payload it silently ignores.
         // `saved` is true only on the first run, when materialisation actually

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-instruction-memory",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "description": "User-only instruction memory for DSH: long-term instructions maintained in the settings UI and auto-injected into every conversation — the model has no write access. 指令记忆：只由用户在设置页维护的长期指令，自动注入此后每轮对话；模型没有任何写入口。",
   "license": "MIT",
   "type": "module",