dsh-instruction-memory 1.3.1 → 1.3.3

package/CHANGELOG.md

@@ -7,6 +7,55 @@
 > 1.0.13 起由 CI 经 OIDC Trusted Publishing 发布（首个带 provenance 的版本）。
 > 这些历史 tag **不应回填**——npm 上的版本号已被占用。
 
+## [1.3.3] — 2026-10-16
+
+一处注释整理，无代码与行为变更。
+
+### 变更
+
+- **合并 `lib/index.js` 中重复的一段注释**：`case 'state'` 首次物化处的说明被整段写了两遍
+  （1.3.1 追加「经同一磁盘队列、不会与在途写入交错」这句时保留了原段），现合并为一段并保留该句。
+  纯注释：`git diff` 仅 3 行删除，不改变任何代码路径或行为。
+
+## [1.3.2] — 2026-10-16
+
+1.3.1 发布后的两轮全量体检产出：CI 测试基建根治、client/demo 边界修复与宿主生命周期加固。
+
+### 修复
+
+- **CI 测试基建：路由等待按墙钟计时**：contract/ui 的 rawRoute 原以固定迭代数轮询
+  （约 2s 上限），高负载 runner 上真实磁盘写路径（锁、双备份、rename、历史快照）可能偶发
+  超限，导致整套测试崩溃（`route never responded`），且崩溃无断言痕迹。CI 偶发红
+  （1.2.0 时代即有先例）的根因即此。现改为墙钟 15s 上限，并给每个套件装崩溃钩子
+  （失败时输出 GitHub `::error::` 注解，含断言与堆栈），verify 的固定 60ms boot 等待改为
+  轮询到条件成立。仅测试基建，不影响已发布包内容。
+- **CI 假绿窗口收口**：套件尾部 `process.exit(failures===0?0:1)` 会覆盖崩溃钩子设置的
+  exitCode——最后一次校验之后的浮游 rejection 可能被吞成「ALL PASS + exit 0」。现在退出码
+  尊重钩子状态；ui-test 的 scratch 清理移到退出码捕获之前；fetch 包装器在路由超时抛出时
+  递减 inFlight（否则后续每次 settle 都烧满等待窗口）。
+- **测试 scratch 目录自清理**：contract/verify/ui 现在都注册按 PID 的退出钩子，任何退出路径
+  （崩溃、抛错、失败）都删掉本进程的家目录；此前每次跑测试都会在仓库里留下
+  `.test-dsh-home-*` 目录（实测累积到 39 个）。仅测试基建。
+- **verify 三条恒真断言修正**：F17 相关性分词的三个 check 把比较器写在了 detail 位、
+  ok 位是恒真值，实际从未断言（c74bfcc 引入的既有问题，本轮审阅发现）；改为真布尔断言。
+- **demo 桩 `sets.total` 计数错误**：scoped 数组覆盖克隆后才读计数，「全部配置集合计」显示的是
+  当前集合数而非全库数；改为覆盖前从原库统计。
+- **client：`data:null` 快照穿透 normalizer**：absorb 读取 `data.budgetChars` 抛错，初始加载
+  会永久卡在加载态且无错误提示（当前宿主不产生该形状，防御性收口，verify 钉住）。
+- **client：重进源码模式不再静默丢弃未保存草稿**：源码草稿与最近一次读/存的基线比对，有改动
+  走标准弃用确认（基线随读取与保存推进）。
+- **client：F17 本地预演不再给已停用条目标注命中**（它们永远不会被注入，此前会误导）。
+- **host 生命周期三处加固**：初始 `state.data` 字面量补齐 `disabledUntil` 键（watcher 自写
+  检测在新进程首次保存时因键形状不一致必然失配，产生一次多余重载与冗余 SSE 帧，探针实证）；
+  卸载栅栏（in-flight 操作完成后不再重注册注入段/重启 watcher/推送快照）；`state` 路由的
+  首次物化纳入磁盘队列（与 readSource 一致）。
+
+### 变更
+
+- **暂停倒计时改用渲染时时钟**：剩余时间在渲染时直接取 `Date.now()` 计算，1 秒 interval
+  仅作重渲染触发器。此前 nowTick 在两次暂停之间可能陈旧任意久（如隔天再暂停），首帧
+  剩余时间会虚大；原描述「最多偏大 1 秒」低估了陈旧量。仅展示层。
+
 ## [1.3.1] — 2026-10-15
 
 1.3.0 发布当天的评审跟进：一个披露计数回归与三个展示层小修正。
@@ -17,7 +66,7 @@
   （高负载 runner 上定时器可能已过期），改为确定性地断言到期时刻已写入存储文件，并把到期等待
   从 300ms 放宽到 1s。仅测试基建，不影响已发布的包内容。
 - **导入回退去重后的计数披露**：「新增指令 N 条 / 新增用户形象 N 个」按实际落库数（staged）
-  统计，不再包含被回退去重跳过的项；截断披露同样只统计实际落库项。80f94f5 引入的口径回归，
+  统计，不再包含被回退去重跳过的项；截断披露同样只统计实际落库项。a2b885b 引入的口径回归，
   contract-test 新增断言钉住「2 通过 − 1 回退重复 = 新增指令 1 条」。
 - **暂停倒计时与复制路径的三个小修正**：新起暂停时先取当前时刻再起秒表（否则长开面板的
   首帧剩余时间可能偏大最多 1 秒，下一秒自愈）；他窗发起暂停时复位暂停菜单展开态；

package/lib/client.js

@@ -924,7 +924,9 @@ window.__ModuleLoader__.load({
     function normalizeResult(result) {
       if (result === null || typeof result !== 'object') return null
       const snapshot = result.snapshot !== undefined && result.snapshot !== null ? result.snapshot : result
-      if (snapshot === null || typeof snapshot !== 'object' || snapshot.data === undefined) return null
+      // data === null passes a typeof check but poisons every consumer that
+      // reads data.budgetChars; it is exactly as unusable as a missing data.
+      if (snapshot === null || typeof snapshot !== 'object' || snapshot.data === undefined || snapshot.data === null) return null
       return {
         snapshot,
         ok: result.ok !== false,
@@ -1530,6 +1532,10 @@ window.__ModuleLoader__.load({
       // The body ceiling for the live check, mirrored into a ref so the
       // debounced effect never has to depend on the snapshot object.
       const sourceCeilingRef = React.useRef(0)
+      // The source text as of the last read/save: openSource compares the
+      // live draft against this to decide whether re-entering source mode
+      // needs a discard confirmation.
+      const sourceBaselineRef = React.useRef('')
       // F17: the local relevance preview.
       const [simOpen, setSimOpen] = React.useState(false)
       const [simQuery, setSimQuery] = React.useState('')
@@ -1595,7 +1601,9 @@ window.__ModuleLoader__.load({
       // clears it the moment the snapshot says otherwise. This effect sits
       // BEFORE the early returns (a hook skipped by a conditional return would
       // desync the hook order); it reads the snapshot through `view` because
-      // the derived `injection` does not exist yet up here.
+      // the derived `injection` does not exist yet up here. The tick value
+      // itself is only a re-render trigger; the rendered remaining time is
+      // computed from Date.now() at render time (see below).
       const mutedNow = view !== null && view.injection !== null && typeof view.injection === 'object'
         && view.injection.muted === true
       React.useEffect(() => {
@@ -1603,10 +1611,6 @@ window.__ModuleLoader__.load({
         // A pause started from ANOTHER window replaces the menu row; the open
         // flag must not resurface when the row returns after expiry.
         setPauseMenuOpen(false)
-        // Snapshot the clock the moment the pause lands: nowTick may be up to
-        // a second stale from a PREVIOUS pause, which would render the first
-        // frame with an inflated remaining time.
-        setNowTick(Date.now())
         const tick = setInterval(() => setNowTick(Date.now()), 1000)
         return () => clearInterval(tick)
       }, [mutedNow])
@@ -1881,6 +1885,12 @@ window.__ModuleLoader__.load({
           setError(t('source.editorOpen'))
           return
         }
+        // Re-entering source mode must not silently discard an unsaved source
+        // draft: sourceText survives 退出源码模式 and reloadSource, and the
+        // button stays reachable while source mode is open. The baseline is
+        // the text as of the last read/save, so an untouched draft reopens
+        // without friction.
+        if (sourceText !== sourceBaselineRef.current && !confirmDiscard()) return
         try {
           const result = await callHost('read-source', null)
           if (result === null || typeof result !== 'object' || typeof result.source !== 'string') {
@@ -1893,6 +1903,7 @@ window.__ModuleLoader__.load({
             return
           }
           setSourceText(result.source)
+          sourceBaselineRef.current = result.source
           setSourceBaseRev(revOfFrom(result.snapshot))
           setSourceVerdict(null)
           setSourceMode(true)
@@ -1918,6 +1929,7 @@ window.__ModuleLoader__.load({
           // on must move with it — otherwise the very next save would be
           // refused as a conflict against our own write.
           setSourceBaseRev(revOfFrom(result.snapshot))
+          sourceBaselineRef.current = sourceText
           void loadHistory()
         })
       }
@@ -2214,7 +2226,9 @@ window.__ModuleLoader__.load({
         : data.entries.length
       const activeSetName = (setsList.find((set) => set.id === setsActiveId) || {}).name || ''
       // F17: the local preview scores the ACTIVE set's on-demand entries.
-      const autoEntries = data.entries.filter((entry) => entry.mode === 'auto')
+      // Disabled entries can never be injected, so scoring them as 预演 hits
+      // would mislead — they are excluded from the preview entirely.
+      const autoEntries = data.entries.filter((entry) => entry.mode === 'auto' && entry.enabled !== false)
       const sim = relevancePreview(autoEntries, simQuery)
       const simById = new Map(sim.results.map((hit) => [hit.id, hit]))
       const omittedById = new Map()
@@ -2271,14 +2285,16 @@ window.__ModuleLoader__.load({
         ? view.diagnostics.rev
         : (data.rev || 0)
       // F7: the pause decision itself belongs to the host (injection.muted);
-      // the countdown below is display-only. At zero the bar yields back to
-      // the normal control (the host's own timer is delivering a fresh
-      // snapshot at that moment in any case).
+      // the countdown below is display-only. The remaining time is computed
+      // from the clock AT RENDER TIME — a stale tick value could be days old
+      // (the interval only runs while a pause is live), which would inflate
+      // the first frame of a later pause. The 1s interval exists purely to
+      // trigger re-renders; at zero the bar yields back to the normal control.
       const muted = injection.muted === true
       const disabledUntil = typeof data.disabledUntil === 'number' && Number.isFinite(data.disabledUntil)
         ? data.disabledUntil
         : 0
-      const muteRemainingMs = muted ? Math.max(0, disabledUntil - nowTick) : 0
+      const muteRemainingMs = muted ? Math.max(0, disabledUntil - Date.now()) : 0
       const muteRemainingText = (ms) => {
         const totalSec = Math.max(0, Math.round(ms / 1000))
         const hh = Math.floor(totalSec / 3600)

package/lib/index.js

@@ -1255,6 +1255,11 @@ export function apply(ctx) {
       version: FORMAT_VERSION,
       rev: 0,
       enabled: true,
+      // Must match normalizeData's output shape KEY FOR KEY: the watcher's
+      // self-write detection compares JSON strings, and a missing key here
+      // made every fresh process's first save look like an external change
+      // (one redundant reload + frame).
+      disabledUntil: 0,
       budgetChars: DEFAULT_BUDGET,
       backupDir: '',
       activeSetId: DEFAULT_SET_ID,
@@ -1313,6 +1318,13 @@ export function apply(ctx) {
    * (from syncSection) and cleared in the effect cleanup.
    */
   let muteTimer = null
+  /**
+   * Set by the effect cleanup: after unmount, an in-flight queued op may
+   * still complete its disk write (the data must land), but it must not
+   * re-register the prompt section, restart the watcher, or push snapshots
+   * into a torn-down fiber.
+   */
+  let disposed = false
 
   /**
    * A first run deliberately writes NOTHING (see readFromDisk step 3). This flag
@@ -1471,6 +1483,7 @@ export function apply(ctx) {
    * leave the prompt byte-identical to a deployment without this plugin.
    */
   const syncSection = () => {
+    if (disposed) return
     const wanted = sectionText() !== ''
     if (wanted && sectionDispose === null) {
       try {
@@ -1504,6 +1517,7 @@ export function apply(ctx) {
   }
 
   ctx.effect(() => () => {
+    disposed = true
     if (sectionDispose !== null) {
       const dispose = sectionDispose
       sectionDispose = null
@@ -1534,7 +1548,7 @@ export function apply(ctx) {
   let watchDebounce = null
 
   const pushSnapshot = () => {
-    if (sseStreams.size === 0) return
+    if (disposed || sseStreams.size === 0) return
     const payload = 'data: ' + JSON.stringify(snapshot()) + '\n\n'
     for (const [send, cleanup] of Array.from(sseStreams)) {
       try {
@@ -1606,7 +1620,7 @@ export function apply(ctx) {
    * yet) throws and is retried by the first successful write.
    */
   const startWatching = () => {
-    if (storeWatcher !== null) return
+    if (disposed || storeWatcher !== null) return
     try {
       storeWatcher = watch(dirname(storePath), { persistent: false }, (event, filename) => {
         // Only events naming memory.json matter; the .tmp/.bak/.lock churn of
@@ -3584,8 +3598,10 @@ export function apply(ctx) {
         // it displays the absolute path, and the user may then hand-edit it.
         // A first run writes nothing at boot (readFromDisk step 3), so the
         // materialisation happens here, on a deliberate user action, instead of
-        // as a side effect of the host merely starting up.
-        const materialized = await ensureStoreMaterialized()
+        // as a side effect of the host merely starting up. It goes through the
+        // same disk queue as every other disk access, so it can never
+        // interleave with an in-flight write (readSource already did this).
+        const materialized = await enqueue(() => ensureStoreMaterialized())
         // Same envelope as every other method. One response shape means the
         // Client can never again be handed a payload it silently ignores.
         // `saved` is true only on the first run, when materialisation actually

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-instruction-memory",
-  "version": "1.3.1",
+  "version": "1.3.3",
   "description": "User-only instruction memory for DSH: long-term instructions maintained in the settings UI and auto-injected into every conversation — the model has no write access. 指令记忆：只由用户在设置页维护的长期指令，自动注入此后每轮对话；模型没有任何写入口。",
   "license": "MIT",
   "type": "module",