dsh-instruction-memory 1.4.2 → 1.4.4

package/lib/index.js

@@ -30,7 +30,7 @@ import { readFileSync, watch } from 'node:fs'
 import { randomUUID } from 'node:crypto'
 import { isIP } from 'node:net'
 import { homedir, hostname } from 'node:os'
-import { basename, dirname, isAbsolute, join, resolve } from 'node:path'
+import { basename, dirname, isAbsolute, join, resolve, sep } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import {
   FEEDBACK_ENV,
@@ -108,6 +108,15 @@ const MAX_HISTORY_BYTES = 32 * 1024 * 1024
  * overflows Node's timer range.
  */
 const MAX_MUTE_MS = 7 * 24 * 60 * 60 * 1000
+/**
+ * The most event streams one host will hold open at once.
+ *
+ * Each open stream keeps a Map entry, a socket and listeners until the client
+ * disconnects; the panel opens one per window and browsers retry on their own,
+ * so a handful is normal. The ceiling exists so a misbehaving client (or a
+ * duplicated tab left open for weeks) cannot grow the set without bound.
+ */
+const MAX_SSE_STREAMS = 32
 const HISTORY_DIR_NAME = 'history'
 /** Name of the JSON Schema shipped with the package and copied next to the store. */
 const SCHEMA_FILE_NAME = 'memory.schema.json'
@@ -185,6 +194,32 @@ export function resolveStorePath(env = process.env, home = homedir()) {
   return join(root, STORE_DIR_NAME, STORE_FILE_NAME)
 }
 
+/**
+ * Fold the user's home directory to `~` for every path published in the
+ * snapshot. The settings page only needs to show WHICH file is in use; the
+ * absolute path adds nothing there but does put the account name on screen
+ * (and into any screenshot or support paste). The real paths stay untouched
+ * everywhere else — writes, backups and the watcher all use the absolute form.
+ */
+export function displayPath(value, home = homedir()) {
+  if (typeof value !== 'string' || value === '') return value
+  const base = home.endsWith(sep) ? home.slice(0, -sep.length) : home
+  if (base === '') return value
+  if (value === base) return '~'
+  if (value.startsWith(base + sep)) return '~' + value.slice(base.length)
+  return value
+}
+
+/**
+ * Error code for "the store file exists but holds nothing usable".
+ *
+ * It is a distinct code (not a SyntaxError) because the recovery path needs to
+ * tell the three states apart: file missing (first run), file present but
+ * unparsable, file present and EMPTY. Only the last two are recoverable from
+ * .bak — and only the last two may never be treated as "no memory yet".
+ */
+const EMPTY_STORE_CODE = 'EEMPTYSTORE'
+
 const DEFAULT_BUDGET = 4000
 const MIN_BUDGET = 800
 const MAX_BUDGET = 40000
@@ -201,12 +236,19 @@ const MAX_TAG_LENGTH = 24
  * preferences, personality, goals) used to tilt how answers are framed. They
  * are NOT roles the model is asked to play, and they are injected ahead of the
  * instruction block under a header that demotes them to "tilt only, never
- * override correctness or the question itself". They do not take part in the
- * per-entry budget trimming: an identity must never be silently dropped.
+ * override correctness or the question itself".
+ *
+ * They are deliberately kept OUT of the per-entry priority trimming — an
+ * identity must never be silently dropped for a low-priority instruction — but
+ * they are NOT exempt from the injection ceiling: MAX_PROFILE_INJECT_CHARS caps
+ * the whole persona section (and planInjection gives it at most the remaining
+ * share of budgetChars), so the number the panel calls 注入字数上限 applies to
+ * everything that reaches the prompt.
  */
 const MAX_PROFILES = 50
 const MAX_PROFILE_NAME = 40
 const MAX_PROFILE_CONTENT = 4000
+const MAX_PROFILE_INJECT_CHARS = 4000
 
 /**
  * The batch operations the `batch` route accepts. Kept here so the command and
@@ -278,10 +320,32 @@ function clampBudget(value) {
   return n
 }
 
+/**
+ * Cut a string to `max` UTF-16 units without ever ending on half a surrogate
+ * pair.
+ *
+ * `String.prototype.slice` counts UTF-16 units, so cutting at `max` can land
+ * between the high and low half of an emoji or a CJK ext-B character. The
+ * orphaned high surrogate is then written to memory.json verbatim (JSON
+ * escapes it as \ud83d), renders as U+FFFD in the panel, and is injected into
+ * every later prompt. The injection path already backed off one unit; this is
+ * the same rule, in ONE place, for every other caller (storage sanitising,
+ * single-line titles, history keys).
+ */
+export function cutText(value, max) {
+  if (typeof value !== 'string') return ''
+  if (!Number.isFinite(max) || max <= 0) return ''
+  if (value.length <= max) return value
+  let head = value.slice(0, max)
+  const last = head.charCodeAt(head.length - 1)
+  if (last >= 0xd800 && last <= 0xdbff) head = head.slice(0, -1)
+  return head
+}
+
 function cleanText(value, max) {
   if (typeof value !== 'string') return ''
   const trimmed = value.split('\r\n').join('\n').split('\r').join('\n').trim()
-  return trimmed.length > max ? trimmed.slice(0, max) : trimmed
+  return cutText(trimmed, max)
 }
 
 /**
@@ -907,14 +971,20 @@ export function hostnameOf(value) {
   if (typeof value !== 'string') return ''
   const trimmed = value.trim().toLowerCase()
   if (trimmed === '') return ''
+  // A single trailing dot is the FQDN spelling of the SAME name (`localhost.`,
+  // `127.0.0.1.`). Browsers and some proxies emit it, and leaving it in made
+  // the loopback check fail closed — the panel 403'd against its own host. The
+  // dot is not a bypass either way (the guard is an allowlist), so normalising
+  // it is strictly a compatibility fix.
+  const stripTrailingDot = (name) => (name.endsWith('.') ? name.slice(0, -1) : name)
   if (trimmed.startsWith('[')) {
     const end = trimmed.indexOf(']')
-    return end === -1 ? trimmed.slice(1) : trimmed.slice(1, end)
+    return stripTrailingDot(end === -1 ? trimmed.slice(1) : trimmed.slice(1, end))
   }
   // Unbracketed IPv6 literal: the colons are part of the address, not a port.
-  if (trimmed.indexOf(':') !== trimmed.lastIndexOf(':')) return trimmed
+  if (trimmed.indexOf(':') !== trimmed.lastIndexOf(':')) return stripTrailingDot(trimmed)
   const colon = trimmed.lastIndexOf(':')
-  return colon === -1 ? trimmed : trimmed.slice(0, colon)
+  return stripTrailingDot(colon === -1 ? trimmed : trimmed.slice(0, colon))
 }
 
 /**
@@ -1029,11 +1099,18 @@ const isLoopbackName = (name) => {
  * and pre-2020 browsers, which is exactly why it can only ADD rejections, never
  * replace the checks above): a modern browser stamps every request with it, so
  * a page at evil.com talking to this route — even through tricks that drop the
- * `Origin` header — still says `cross-site`. Only `cross-site` is refused;
- * `same-site` must pass because schemeful same-site ignores ports (the GUI and
- * the route live on the same host but different ports), and local non-browser
- * clients never send the header at all, so they are governed by the Host and
- * content-type checks alone.
+ * `Origin` header — still says `cross-site`.
+ *
+ * `same-site` is refused too, but ONLY on a guarded (loopback-bound) server.
+ * Schemeful same-site ignores the port, so `same-site` is also what a page at
+ * 127.0.0.1:5555 — any other local app, or a rebinding page that landed on a
+ * different port — sends when it talks to this route. The hostname comparison
+ * below cannot see that difference (it deliberately ignores ports), so
+ * `same-site` used to sail straight through and let any local origin rewrite
+ * long-lived instructions. On loopback the GUI and the route are always the
+ * same origin, so nothing legitimate is lost. On a non-loopback bind the server
+ * may sit behind a proxy that legitimately rewrites ports, so the same-site
+ * rule is left off there and the README documents the trade-off.
  */
 export function requestOriginVerdict(headers, guarded) {
   const read = (name) => {
@@ -1052,15 +1129,21 @@ export function requestOriginVerdict(headers, guarded) {
   if (fetchSite === 'cross-site') {
     return { ok: false, reason: '请求被浏览器标记为跨站（Sec-Fetch-Site: cross-site）' }
   }
+  if (guarded && fetchSite === 'same-site') {
+    return { ok: false, reason: '请求来自同一站点但不同源（Sec-Fetch-Site: same-site），回环服务只接受同源请求' }
+  }
 
   const origin = read('origin').trim()
   if (origin !== '') {
     let originHostname = ''
+    let originPort = null
     try {
       // URL.hostname keeps the brackets on an IPv6 literal; normalizeHostname
       // takes them off so it can meet the bracket-free Host parsing on equal
       // terms.
-      originHostname = normalizeHostname(new URL(origin).hostname.toLowerCase())
+      const parsed = new URL(origin)
+      originHostname = normalizeHostname(parsed.hostname.toLowerCase())
+      originPort = parsed.port
     } catch {
       originHostname = ''
     }
@@ -1072,11 +1155,63 @@ export function requestOriginVerdict(headers, guarded) {
     if (originHostname === '' || !sameHostname(originHostname, requestHostname)) {
       return { ok: false, reason: 'Origin 与 Host 不同源：' + origin }
     }
+    // On loopback the port IS part of the origin, and a different local port is
+    // a different application: refuse it when both sides state one. Skipped on
+    // a non-loopback bind, where a proxy may legitimately translate the port,
+    // and skipped when the Host states none — an absent port is unknown, not
+    // port 80, and refusing on that guess would break a loopback proxy that
+    // strips it. Default ports compare equal to no port (URL.port omits them).
+    const originPortValue = originPort === '80' || originPort === '443' ? '' : originPort
+    const hostPortValue = requestPortOf(requestHost)
+    if (guarded && originPortValue !== null && originPortValue !== ''
+      && hostPortValue !== '' && originPortValue !== hostPortValue) {
+      return { ok: false, reason: 'Origin 端口与 Host 端口不一致：' + origin }
+    }
   }
 
   return { ok: true, reason: null }
 }
 
+/**
+ * The media type of a Content-Type header, lowercased, without parameters.
+ *
+ * `text/plain; note=application/json` has media type `text/plain`; a substring
+ * test would have called it JSON.
+ *
+ * Node joins repeated headers with `, `, so a gateway that forwards its own
+ * `Content-Type` alongside the client's produces
+ * `application/json, text/plain`. The first value is the effective one, and
+ * taking it keeps a duplicated header from being refused as a wrong type.
+ */
+function mediaTypeOf(headerValue) {
+  if (typeof headerValue !== 'string') return ''
+  const first = headerValue.indexOf(',')
+  const withoutList = first === -1 ? headerValue : headerValue.slice(0, first)
+  const semicolon = withoutList.indexOf(';')
+  const mediaType = semicolon === -1 ? withoutList : withoutList.slice(0, semicolon)
+  return mediaType.trim().toLowerCase()
+}
+
+/**
+ * The port stated by a `Host` header, or '' when none is (which is also what
+ * URL.port reports for a default port, so the two compare equal).
+ */
+function requestPortOf(hostHeader) {
+  const value = typeof hostHeader === 'string' ? hostHeader.trim() : ''
+  const closing = value.lastIndexOf(']')
+  const rest = closing === -1 ? value : value.slice(closing + 1)
+  // A bare IPv6 literal (`::1`) carries no brackets and several colons: its
+  // last colon belongs to the address, not to a port. RFC 7230 requires the
+  // brackets, but this tolerant reader must not invent port "1" out of `::1`
+  // and then refuse an Origin that states no port at all.
+  if (closing === -1 && (rest.match(/:/g) || []).length > 1) return ''
+  const index = rest.lastIndexOf(':')
+  const port = index === -1 ? '' : rest.slice(index + 1).trim()
+  // URL.port is '' for a scheme's default port, so `Host: x:80` must compare
+  // equal to `Origin: http://x`.
+  return port === '80' || port === '443' ? '' : port
+}
+
 function formatEntry(entry, tag) {
   const lines = ['[' + tag + '｜优先级 ' + priorityLabel(entry.priority) + '] ' + entry.title]
   if (entry.mode === 'auto' && entry.when !== '') lines.push('适用场景：' + entry.when)
@@ -1131,26 +1266,86 @@ const PERSONA_HEADER = [
  * no timestamps, no counts, identical profiles in produce byte-identical
  * text. An empty/disabled set renders to '' so callers can join unconditionally.
  */
-function buildProfilesBlock(profiles) {
+function buildProfilesBlock(profiles, budget) {
   const active = (Array.isArray(profiles) ? profiles : [])
     .filter((profile) => profile !== null && typeof profile === 'object'
       && profile.enabled === true
       && typeof profile.content === 'string' && profile.content !== '')
   if (active.length === 0) return { text: '', profiles: [], chars: 0 }
+  /**
+   * The persona section is BOUNDED, and it is bounded by the same number the
+   * panel calls 注入字数上限.
+   *
+   * It used to be unbounded: `content` is sanitised at 4000 chars per profile
+   * but nothing capped how many profiles, or their total, could reach the
+   * prompt. A dozen filled profiles therefore injected ~50k chars before the
+   * entry budget was even consulted — the one number the user was told to tune
+   * did not apply to the largest part of the block. `budget` is what is LEFT
+   * after the persona section in planInjection, so the two together never
+   * exceed the configured ceiling.
+   */
+  const cap = Math.min(
+    MAX_PROFILE_INJECT_CHARS,
+    Number.isFinite(budget) && budget > 0 ? Math.floor(budget) : MAX_PROFILE_INJECT_CHARS,
+  )
+  const footerFor = (count) => (count === 0
+    ? ''
+    : '\n\n（另有 ' + count + ' 个形象因注入字数上限未包含，可在「设置 → 指令记忆」中精简其内容。）')
   const blocks = []
   const items = []
+  let used = PERSONA_HEADER.length + 1
+  let omitted = 0
   for (const profile of active) {
     const name = typeof profile.name === 'string' && profile.name !== ''
       ? profile.name
       : singleLine(profile.content, 20)
+    const id = typeof profile.id === 'string' ? profile.id : ''
     const block = '### ' + name + '\n' + profile.content
-    blocks.push(block)
-    items.push({ id: typeof profile.id === 'string' ? profile.id : '', name, chars: block.length })
+    const sep = blocks.length === 0 ? 0 : 2
+    // Reserve the omission footer up front: the disclosure must never be the
+    // thing squeezed out by the profiles that caused it. Reserve the WORST
+    // CASE (every profile omitted), not `omitted + 1`: the footer grows with
+    // the omitted count, so reserving one-more-than-now under-reserves by one
+    // character per extra digit and the finished section can exceed `cap`.
+    const reserve = footerFor(active.length).length
+    const room = cap - used - sep - reserve
+    if (block.length <= room) {
+      blocks.push(block)
+      items.push({ id, name, chars: block.length })
+      used += sep + block.length
+      continue
+    }
+    // Too big for the room left: keep a truncated head (never splitting a
+    // surrogate pair) and drop the rest, so the section stays informative
+    // instead of silently vanishing.
+    const note = '\n…（此形象因注入字数上限被截断）'
+    const fit = room - note.length
+    if (fit > 40) {
+      const head = cutText(block, fit)
+      blocks.push(head + note)
+      items.push({ id, name, chars: head.length + note.length, truncated: true })
+      used += sep + head.length + note.length
+    }
+    omitted = active.length - blocks.length
+    break
   }
-  const text = PERSONA_HEADER + '\n' + blocks.join('\n\n')
+  const text = PERSONA_HEADER + '\n' + blocks.join('\n\n') + footerFor(Math.max(0, active.length - blocks.length))
   return { text, profiles: items, chars: text.length }
 }
 
+/**
+ * The disclosure line for entries the budget left out. Shared by the entry
+ * plan and by `planInjection`, because a persona section can consume the whole
+ * budget and leave the entries with nothing: in that case the entry plan's own
+ * text is empty, so its footer would never reach the prompt and the model would
+ * silently lose the user's instructions while the persona block still rendered.
+ */
+export function entryOmittedFooter(count) {
+  return count === 0
+    ? ''
+    : '\n\n（另有 ' + count + ' 条指令因注入字数上限未包含，可在「设置 → 指令记忆」中提高上限或调低其优先级。）'
+}
+
 /**
  * The entry half of the plan: the existing instruction block with its budget
  * trimming. Kept as the inner function so planInjection can prepend the
@@ -1183,10 +1378,7 @@ function planEntries(data, budget) {
     ].join('\n'),
     '## 用户长期指令记忆\n',
   ]
-  const footerFor = (count) =>
-    count === 0
-      ? ''
-      : '\n\n（另有 ' + count + ' 条指令因注入字数上限未包含，可在「设置 → 指令记忆」中提高上限或调低其优先级。）'
+  const footerFor = entryOmittedFooter
 
   const MIN_ROOM = 80
   let header = HEADERS[HEADERS.length - 1]
@@ -1206,8 +1398,8 @@ function planEntries(data, budget) {
   const consider = (entry, tag) => {
     const block = formatEntry(entry, tag)
     // Reserve the footer up front so a disclosure can never be squeezed out by
-    // the very entries that caused it.
-    const reserve = footerFor(omitted + 1).length
+    // the very entries that caused it. Worst case again: every entry omitted.
+    const reserve = footerFor(active.length).length
     if (used + block.length + 2 + reserve <= budget) {
       used += block.length + 2
       blocks.push(block)
@@ -1220,12 +1412,10 @@ function planEntries(data, budget) {
       const room = budget - used - 2 - reserve
       const note = '\n…（本条因注入字数上限被截断）'
       if (room > note.length + 20) {
-        // Cut in UTF-16 units but back off one char when that lands between a
+        // cutText backs off one UTF-16 unit when the cut would land between a
         // surrogate pair, so the truncation point can never end on the broken
         // half of an emoji or CJK ext-B character.
-        let head = block.slice(0, room - note.length)
-        const last = head.charCodeAt(head.length - 1)
-        if (last >= 0xd800 && last <= 0xdbff) head = head.slice(0, -1)
+        const head = cutText(block, room - note.length)
         const body = head + note
         blocks.push(body)
         used += body.length + 2
@@ -1320,11 +1510,25 @@ export function planInjection(data, now = Date.now()) {
     entries: (Array.isArray(data.entries) ? data.entries : []).filter((entry) => inScope(entry, scope)),
     profiles: (Array.isArray(data.profiles) ? data.profiles : []).filter((profile) => inScope(profile, scope)),
   }
-  const persona = buildProfilesBlock(scoped.profiles)
-  const entryPlan = planEntries(scoped, budget)
+  /**
+   * Persona first, then entries with whatever budget is LEFT. The persona
+   * section used to be prepended outside the budget entirely, so the rendered
+   * block could exceed 注入字数上限 by the size of the whole persona section.
+   * Giving it the first claim and the entries the remainder keeps the total
+   * honest: text.length <= budget for every store shape.
+   */
+  // Worst-case entry disclosure, plus the 2-char separator the two halves are
+  // joined with: if the persona section took the whole budget, every entry
+  // would be dropped and its footer still has to fit.
+  const JOIN = '\n\n'.length
+  const activeEntryCount = (scoped.entries || []).filter((entry) => entry && entry.enabled === true && entry.content !== '').length
+  const entryReserve = activeEntryCount > 0 ? entryOmittedFooter(activeEntryCount).length + JOIN : 0
+  const persona = buildProfilesBlock(scoped.profiles, Math.max(0, budget - entryReserve))
+  const entryPlan = planEntries(scoped, Math.max(0, budget - persona.chars))
   const parts = []
   if (persona.text !== '') parts.push(persona.text)
   if (entryPlan.text !== '') parts.push(entryPlan.text)
+  else if (parts.length > 0 && entryPlan.omitted.length > 0) parts.push(entryOmittedFooter(entryPlan.omitted.length))
   return {
     text: parts.join('\n\n'),
     budget,
@@ -1458,6 +1662,28 @@ export function apply(ctx) {
     return String(err)
   }
 
+  /**
+   * describeError for text that LEAVES the process (HTTP responses).
+   *
+   * A raw fs message names the absolute path it failed on (ENOENT, EACCES,
+   * ENOTDIR), which hands any caller the user's home directory and store
+   * location for free. The full text still reaches the log; the response gets
+   * the same sentence with the home folded to `~` and the store directory to a
+   * stable placeholder.
+   */
+  const describeErrorSafe = (err) => {
+    let text = describeError(err)
+    const storeDir = dirname(storePath)
+    if (storeDir !== '' && storeDir !== '.') text = text.split(storeDir).join('<记忆目录>')
+    try {
+      const home = homedir()
+      if (typeof home === 'string' && home !== '') text = text.split(home).join('~')
+    } catch {
+      // No home to redact: keep the text as it is.
+    }
+    return text
+  }
+
   /* ---------------- diagnostics ---------------- */
 
   /**
@@ -1612,7 +1838,7 @@ export function apply(ctx) {
       } catch (err) {
         sectionDispose = null
         state.sectionRegistered = false
-        state.sectionError = '注入注册失败：' + describeError(err)
+        state.sectionError = '注入注册失败：' + describeErrorSafe(err)
         console.error('[instruction-memory] section registration failed:', err)
       }
     } else if (!wanted) {
@@ -1720,8 +1946,21 @@ export function apply(ctx) {
           await readFromDisk()
           syncSection()
           pushSnapshot()
-        } catch {
+        } catch (err) {
           // Transient: the next event, or the panel's 重新载入, catches up.
+          // An EMPTY file is the one exception — a save in progress looks like
+          // that for a moment, but a file that stays empty is data loss waiting
+          // to happen, so route it through the recovery path that knows about
+          // .bak instead of silently serving stale memory forever.
+          if (err !== null && err !== undefined && err.code === EMPTY_STORE_CODE) {
+            try {
+              await readFromDisk()
+              syncSection()
+              pushSnapshot()
+            } catch {
+              // Still transient; the panel's 重新载入 remains available.
+            }
+          }
         }
       })
     }, WATCH_DEBOUNCE_MS)
@@ -1916,7 +2155,7 @@ export function apply(ctx) {
       await unlink(probe).catch(() => {})
       return null
     } catch (err) {
-      return '目录不可写：' + describeError(err)
+      return '目录不可写：' + describeErrorSafe(err)
     }
   }
 
@@ -1932,10 +2171,24 @@ export function apply(ctx) {
   })())
 
   /**
-   * The bytes of the most recent snapshot, so two writes that produce the same
-   * file (a no-op-ish save, a repeat restore) do not each mint a "version".
+   * Identity of the last snapshot's CONTENT, so two writes that produce the
+   * same store (a no-op-ish save, a repeat restore) do not each mint a
+   * "version".
+   *
+   * This used to compare the serialised file byte-for-byte, which never
+   * matched twice: `rev` is bumped on every save, so the "identical" comparison
+   * could not fire and every no-op save still appended a version. The key is
+   * the serialised store with `rev` normalised away — the field that exists
+   * only to differ.
+   */
+  let lastHistoryKey = null
+
+  /**
+   * Content identity of the store as last PERSISTED (rev normalised away), so a
+   * save that changes nothing is skipped instead of bumping rev and appending a
+   * version-history file.
    */
-  let lastHistoryText = null
+  let lastPersistedKey = null
 
   /**
    * Enforce the per-device retention policy: the count and byte ceilings from
@@ -1958,6 +2211,13 @@ export function apply(ctx) {
     }
     let removed = 0
     let kept = 0
+    // Survivors of the per-device plan, kept with their size so a GLOBAL byte
+    // ceiling can be enforced afterwards: the plan bounds each device on its
+    // own, so N devices multiply the budget (ten machines = ten × 32 MB). The
+    // total is capped below by deleting the oldest snapshots first, whichever
+    // device they came from — the fixed-width stamp makes name order
+    // chronological across devices too.
+    const survivors = []
     for (const bucket of byDevice.values()) {
       // Fixed-width UTC stamp first => lexicographic order is chronological.
       bucket.sort()
@@ -1971,7 +2231,22 @@ export function apply(ctx) {
         await unlink(join(dir, name)).catch(() => {})
         removed += 1
       }
+      const sizeOf = new Map(sized.map((item) => [item.name, item.size]))
       kept += plan.keep.length
+      // plan.keep holds NAMES (newest first), so re-attach the sizes here: the
+      // global ceiling below sums bytes, not file counts.
+      for (const name of plan.keep) survivors.push({ name, size: sizeOf.get(name) || 0 })
+    }
+    let total = survivors.reduce((sum, item) => sum + item.size, 0)
+    if (total > MAX_HISTORY_BYTES) {
+      survivors.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))
+      for (const item of survivors) {
+        if (total <= MAX_HISTORY_BYTES) break
+        await unlink(join(dir, item.name)).catch(() => {})
+        total -= item.size
+        removed += 1
+        kept -= 1
+      }
     }
     return { removed, kept }
   }
@@ -1983,8 +2258,9 @@ export function apply(ctx) {
    * really was committed; a failure here is disclosed and never fails the save,
    * because the store itself is already safely on disk.
    */
-  const writeHistorySnapshot = async (text) => {
-    if (typeof text !== 'string' || text === '' || text === lastHistoryText) return
+  const writeHistorySnapshot = async (text, key) => {
+    const identity = typeof key === 'string' && key !== '' ? key : text
+    if (typeof text !== 'string' || text === '' || identity === lastHistoryKey) return
     try {
       const dir = historyDirPath()
       await mkdir(dir, { recursive: true })
@@ -1994,19 +2270,19 @@ export function apply(ctx) {
       // bump the stamp by a millisecond instead of losing one of the two.
       for (let attempt = 0; attempt < 5 && !written; attempt += 1) {
         try {
-          await writeFile(join(dir, historyFileName(epoch + attempt, state.data.rev || 0, DEVICE)), text, { encoding: 'utf8', flag: 'wx' })
+          await writeFile(join(dir, historyFileName(epoch + attempt, state.data.rev || 0, DEVICE)), text, { encoding: 'utf8', flag: 'wx', mode: 0o600 })
           written = true
         } catch (err) {
           if (err.code !== 'EEXIST') throw err
         }
       }
       if (!written) throw new Error('快照文件名重复')
-      lastHistoryText = text
+      lastHistoryKey = identity
       const { kept } = await pruneHistory(dir)
       state.historyCount = kept
       state.historyError = null
     } catch (err) {
-      state.historyError = '版本历史快照未能写入（' + describeError(err) + '）；本次保存本身已完成'
+      state.historyError = '版本历史快照未能写入（' + describeErrorSafe(err) + '）；本次保存本身已完成'
     }
   }
 
@@ -2064,31 +2340,92 @@ export function apply(ctx) {
       await mkdir(dirname(storePath), { recursive: true })
       lock = await acquireStoreLock()
       if (lock === null) {
-        logDebug('store lock still held by another process; writing anyway (last write wins)')
+        // The lock could not be taken within the wait. That is either a stale
+        // lock left by a crashed process (the file on disk is still exactly
+        // what we loaded, so writing is safe) or a LIVE one, in which case the
+        // other process may have committed since we loaded and writing our
+        // whole-file snapshot would silently drop their change. Only the first
+        // case may proceed: compare the on-disk rev with the one we hold.
+        const diskRev = await readDiskRev()
+        if (diskRev > (state.data.rev || 0)) {
+          state.storageError = '另一个 DSH 进程刚刚保存了记忆（磁盘 rev ' + diskRev
+            + '，本进程 rev ' + (state.data.rev || 0) + '），本次未写入以免覆盖，请重试'
+          return false
+        }
+        logDebug('store lock held by a stale owner and the disk rev is unchanged; writing anyway')
+      }
+      // The lock is ours, but the DISK may have moved on since this process
+      // loaded it: another DSH window committed while our watcher had not yet
+      // refreshed. Bumping the rev from max(ours, disk) kept the NUMBER
+      // monotonic while the CONTENT of their save was dropped without an error
+      // — "rev 3" looked healthy and the entry was simply gone. Refuse instead,
+      // so the caller retries against the newer store.
+      const diskRevNow = await readDiskRev()
+      if (diskRevNow > (state.data.rev || 0)) {
+        state.storageError = '另一个 DSH 进程刚刚保存了记忆（磁盘 rev ' + diskRevNow
+          + '，本进程 rev ' + (state.data.rev || 0) + '），本次未写入以免覆盖，请重试'
+        return false
+      }
+      // A save that changes NOTHING must not bump the rev, rewrite the file or
+      // mint a history snapshot. The mutation still counts as committed (the
+      // in-memory state already matches), so callers keep their success path.
+      //
+      // The identity is the serialised store with `rev` normalised away,
+      // because rev is bumped on every save and would make the comparison
+      // always differ.
+      const contentKey = JSON.stringify({ ...persistableData(), rev: 0 })
+      if (state.storeExists && lastPersistedKey !== null && contentKey === lastPersistedKey) {
+        logDebug('save skipped: the store content did not change')
+        return true
       }
       // The rev is bumped before serialising so the file on disk and the state
       // in memory agree on it; a failed write restores the old value.
-      previousRev = state.data.rev || 0
+      //
+      // It is bumped from max(ours, the one on disk) so it stays monotonic
+      // ACROSS processes: two windows that loaded rev 5 would otherwise both
+      // write rev 6, and anything that watches the rev for change (the lite
+      // SSE stream) cannot tell the second save from a repeat of the first.
+      const diskRev = await readDiskRev()
+      previousRev = Math.max(state.data.rev || 0, diskRev)
       state.data.rev = previousRev + 1
       const text = serialize()
-      await writeFile(tmpPath, text, 'utf8')
+      // mode 0600: the store holds the user's private instructions and (with a
+      // user profile) personal notes, so on a multi-user POSIX host it must not
+      // land world-readable the way a bare writeFile (0666 & ~umask = 0644)
+      // would. Windows ignores the bit and inherits the directory ACL instead.
+      await writeFile(tmpPath, text, { encoding: 'utf8', mode: 0o600 })
       // Both rolling copies stand for the PREVIOUS good version, so both are
       // taken before the atomic replace, and neither may ever be renamed into
       // place (see the long note above).
+      //
+      // The copy is GUARDED against an UNUSABLE primary, not merely an empty
+      // one: the states the backup exists to survive are a 0-byte file, a
+      // whitespace stub, and a truncated or hand-mangled JSON — all of which
+      // parse to nothing, and only the first is zero bytes. Copying any of them
+      // over a good .bak destroys the only remaining copy at the exact moment
+      // the user needs it, so the test is "does this file read as a store?".
+      // An unusable primary therefore keeps the existing backup untouched and
+      // discloses it (the .bak may be stale, and the panel says so).
       let hadPrevious = true
       try {
+        await readStoreFile(storePath)
         await copyFile(storePath, localBackupPath())
         state.backupError = null
       } catch (err) {
-        // ENOENT is simply the very first save: there is no previous version
-        // to roll. Any other failure means the promised rolling backup did not
-        // happen — non-fatal for this save, because the primary is still intact
-        // and the replace below is the real gate, but it must be disclosed
-        // rather than swallowed.
-        hadPrevious = err.code !== 'ENOENT'
-        state.backupError = err.code === 'ENOENT'
-          ? null
-          : '上一版未能保留为 ' + localBackupPath() + '：' + describeError(err)
+        if (err !== null && err !== undefined && err.code === 'ENOENT') {
+          // The very first save: there is no previous version to roll, and
+          // writing a .bak here would leave a 0-byte copy that a later recovery
+          // would adopt as an "empty store" — the trap this guard exists for.
+          hadPrevious = false
+          state.backupError = null
+        } else {
+          hadPrevious = false
+          const previous = await stat(localBackupPath()).catch(() => null)
+          state.backupError = previous !== null && previous.size > 0
+            ? 'memory.json 当前不可用（' + describeErrorSafe(err) + '），已保留上一版备份 '
+              + localBackupPath() + ' 不被覆盖'
+            : 'memory.json 当前不可用，且没有可用的上一版备份（' + describeErrorSafe(err) + '）'
+        }
       }
       // The user-facing copy under a custom backup location (F18). The LOCAL
       // copy above stays the one crash recovery reads, so a failure here
@@ -2099,7 +2436,7 @@ export function apply(ctx) {
           await copyFile(storePath, customBak)
         } catch (err) {
           if (state.backupError === null) {
-            state.backupError = '备份位置未能保留上一版（' + customBak + '）：' + describeError(err)
+            state.backupError = '备份位置未能保留上一版（' + customBak + '）：' + describeErrorSafe(err)
           }
         }
       }
@@ -2123,7 +2460,8 @@ export function apply(ctx) {
       // Best-effort side files, each guarded inside itself: a failure in either
       // must never be mistaken for "the save failed" — the save already
       // committed, and the store is on disk whatever happens next.
-      await writeHistorySnapshot(text)
+      await writeHistorySnapshot(text, contentKey)
+      lastPersistedKey = contentKey
       await ensureSchemaFile()
       logDebug('store written: ' + storePath + ' bytes=' + text.length
         + ' entries=' + state.data.entries.length + ' rev=' + state.data.rev
@@ -2133,16 +2471,51 @@ export function apply(ctx) {
       return true
     } catch (err) {
       if (previousRev !== null) state.data.rev = previousRev
-      state.storageError = '保存失败：' + describeError(err)
+      state.storageError = '保存失败：' + describeErrorSafe(err)
       return false
     } finally {
       await releaseStoreLock(lock)
     }
   }
 
+  /**
+   * Read + parse one store file.
+   *
+   * An EMPTY file is NOT "no file". Returning null for it made the loader treat
+   * a 0-byte memory.json — a truncated write, an editor that saved blank, a
+   * quarantine stub — as a first run, so the plugin materialised an empty store
+   * and the very next save copied that empty file over memory.json.bak,
+   * destroying the last good copy. It now throws a tagged error, which sends it
+   * down the corrupt-file recovery path (the one that knows about .bak).
+   */
   const readStoreFile = async (path) => {
     const text = await readFile(path, 'utf8')
-    return text.trim() === '' ? null : JSON.parse(text)
+    if (text.trim() === '') {
+      const empty = new Error('store file is empty (0 bytes or whitespace only)')
+      empty.code = EMPTY_STORE_CODE
+      throw empty
+    }
+    return JSON.parse(text)
+  }
+
+  /**
+   * The `rev` currently on disk, or 0 when there is no readable store.
+   *
+   * writeToDisk needs this for two questions the in-memory copy cannot answer:
+   * (a) keeping the rev monotonic ACROSS processes — two DSH windows each doing
+   * their own `data.rev + 1` from the same loaded rev mint the SAME number, and
+   * a consumer that detects change by "the rev differs" (the lite SSE stream)
+   * then silently misses the second save; and (b) deciding whether a save made
+   * while another process holds the lock would clobber a newer store.
+   */
+  const readDiskRev = async () => {
+    try {
+      const parsed = await readStoreFile(storePath)
+      const rev = parsed !== null && typeof parsed === 'object' ? parsed.rev : null
+      return typeof rev === 'number' && Number.isFinite(rev) && rev > 0 ? Math.round(rev) : 0
+    } catch {
+      return 0
+    }
   }
 
   /**
@@ -2205,6 +2578,11 @@ export function apply(ctx) {
         needsMaterialize = false
       }
       state.storageError = null
+      // The primary read cleanly, so a "memory.json 当前不可用" note from an
+      // earlier save describes a state that no longer exists. The panel reports
+      // current state, not a log; keeping the stale sentence would leave the
+      // user reading about a broken file they just fixed.
+      state.backupError = null
       return false
     } catch (err) {
       if (err === null || err === undefined || err.code !== 'ENOENT') {
@@ -2213,14 +2591,23 @@ export function apply(ctx) {
         // presenting an empty memory, but say so loudly. The corrupt file
         // itself stays untouched for hand repair; it gets overwritten on the
         // next save (the pre-existing and disclosed behaviour).
-        if (err instanceof SyntaxError) {
-          // The file was READ and only failed to PARSE, so a store file is
-          // physically present on disk. Saying onDisk=no here contradicted
-          // the branch's own story ("损坏文件已保留") and produced a mounted
-          // log line reading "from=memory.json.bak (main file corrupt)
-          // onDisk=no". (Other non-ENOENT errors stay no: ENOTDIR, say, means
-          // nothing exists at the store path at all.)
+        //
+        // "Corrupt" covers BOTH a file that was read but would not parse and a
+        // file that parsed to nothing at all (0 bytes / whitespace only). The
+        // empty case used to be silently treated as "no file yet", which is the
+        // exact shape that loses data: see readStoreFile.
+        const unreadable = err instanceof SyntaxError || err.code === EMPTY_STORE_CODE
+        if (unreadable) {
+          // The file was READ, so a store file is physically present on disk.
+          // Saying onDisk=no here contradicted the branch's own story ("损坏
+          // 文件已保留") and produced a mounted log line reading
+          // "from=memory.json.bak (main file corrupt) onDisk=no". (Other
+          // non-ENOENT errors stay no: ENOTDIR, say, means nothing exists at
+          // the store path at all.)
           state.storeExists = true
+          const reason = err.code === EMPTY_STORE_CODE
+            ? 'memory.json 为空（0 字节或只有空白）'
+            : 'memory.json 解析失败（' + describeErrorSafe(err) + '）'
           try {
             const backup = await readStoreFile(storePath + '.bak')
             if (backup !== null) {
@@ -2232,7 +2619,7 @@ export function apply(ctx) {
               state.data = loaded.data
               const warnings = loadWarnings(loaded)
               state.storageWarning = (warnings !== null ? warnings + '；' : '')
-                + 'memory.json 解析失败（' + describeError(err) + '），已临时回退到最近备份 memory.json.bak；损坏文件已保留，下次保存时会覆盖它'
+                + reason + '，已临时回退到最近备份 memory.json.bak；原文件已保留，下次保存时会覆盖它'
               state.loadedFrom = 'memory.json.bak (main file corrupt)'
               return false
             }
@@ -2241,9 +2628,11 @@ export function apply(ctx) {
           }
         }
         // A file we cannot understand must never be silently overwritten.
-        state.storageError = err instanceof SyntaxError
-          ? '配置文件解析失败（' + describeError(err) + '），原文件已保留；你下次保存时会覆盖它'
-          : '读取失败：' + describeError(err)
+        state.storageError = unreadable
+          ? (err.code === EMPTY_STORE_CODE
+            ? '配置文件为空（0 字节或只有空白），原文件已保留；你下次保存时会覆盖它'
+            : '配置文件解析失败（' + describeErrorSafe(err) + '），原文件已保留；你下次保存时会覆盖它')
+          : '读取失败：' + describeErrorSafe(err)
         return false
       }
     }
@@ -2302,7 +2691,7 @@ export function apply(ctx) {
       }
     } catch (err) {
       // A missing or unreadable legacy file must never block a fresh store.
-      if (err instanceof SyntaxError) state.storageError = '旧位置文件解析失败，已忽略：' + describeError(err)
+      if (err instanceof SyntaxError) state.storageError = '旧位置文件解析失败，已忽略：' + describeErrorSafe(err)
     }
 
     // 3. First run: there is no store anywhere. Deliberately write NOTHING.
@@ -2376,7 +2765,7 @@ export function apply(ctx) {
   let bootSettled = false
   const boot = readFromDisk()
     .catch((err) => {
-      state.storageError = '读取失败：' + describeError(err)
+      state.storageError = '读取失败：' + describeErrorSafe(err)
     })
     .then(async () => {
       bootSettled = true
@@ -2490,7 +2879,7 @@ export function apply(ctx) {
         rev: state.data.rev || 0,
       },
       storage: {
-        path: state.storageDisplay !== null ? state.storageDisplay : state.storagePath,
+        path: displayPath(state.storageDisplay !== null ? state.storageDisplay : state.storagePath),
         error: state.storageError,
         warning: state.storageWarning !== null ? state.storageWarning : state.backupError,
         savedAt: state.savedAt,
@@ -2498,19 +2887,22 @@ export function apply(ctx) {
         /** false until the store file has actually been written (see readFromDisk step 3). */
         onDisk: state.storeExists,
         /** Backup location (F18): '' means "next to the store file". */
-        backupDir: backupDirOf(),
+        backupDir: displayPath(backupDirOf()),
         isDefaultBackupDir: backupDirOf() === '',
         /** Where the rolling pre-write copy actually sits (diagnostics). */
-        backupPath: localBackupPath(),
+        backupPath: displayPath(localBackupPath()),
         /** Version history (F14). */
-        historyDir: historyDirPath(),
+        historyDir: displayPath(historyDirPath()),
         historyCount: state.historyCount,
         historyError: state.historyError,
-        schemaFile: join(dirname(storePath), SCHEMA_FILE_NAME),
+        schemaFile: displayPath(join(dirname(storePath), SCHEMA_FILE_NAME)),
       },
       injection: {
         registered: state.sectionRegistered,
-        available: true,
+        // `available` used to be hardcoded true, so a failed section()
+        // registration published "available" next to an `error` string and the
+        // panel had to guess. It now mirrors the real state.
+        available: state.sectionError === null,
         error: state.sectionError,
         /**
          * F7: the pause is decided by the HOST clock (isMuted on the live
@@ -2825,6 +3217,16 @@ export function apply(ctx) {
     // is a de-escalation, refusing it would be user-hostile.
     let muteTarget = null
     let muteClamped = false
+    // `disabledUntil: 0` (or any past instant) is "not paused", not a pause
+    // request. Treating it as one made `{ enabled: true, disabledUntil: 0 }` —
+    // the exact shape a caller sends to say "on, and make sure nothing is
+    // paused" — hit the ambiguity guard below and be refused, even though both
+    // halves agree.
+    let muteClear = false
+    // Whether the caller mentioned a pause at all, for the reply wording: a
+    // past instant and an explicit 0 both mean "resume", which is reported only
+    // when there was something to resume.
+    let muteRequested = false
     if (patch !== null && typeof patch === 'object' && 'disabledUntil' in patch) {
       const rawMute = patch.disabledUntil
       if (typeof rawMute !== 'number' || !Number.isFinite(rawMute) || rawMute < 0) {
@@ -2835,6 +3237,7 @@ export function apply(ctx) {
           snapshot: snapshot(),
         }
       }
+      muteRequested = true
       let wanted = Math.round(rawMute)
       if (wanted <= Date.now()) {
         wanted = 0
@@ -2842,7 +3245,21 @@ export function apply(ctx) {
         wanted = Date.now() + MAX_MUTE_MS
         muteClamped = true
       }
-      muteTarget = wanted
+      if (wanted > 0) muteTarget = wanted
+      else muteClear = true
+    }
+    // A patch carrying BOTH the master switch and a mute instant is ambiguous:
+    // the switch is documented to clear any pause, so the commit below silently
+    // dropped the pause the caller had just asked for and answered "saved".
+    // Refuse the combination instead of guessing which half to honour.
+    if (muteTarget !== null && patch !== null && typeof patch === 'object'
+      && typeof patch.enabled === 'boolean') {
+      return {
+        ok: false,
+        saved: false,
+        message: '同一请求里不能同时设置总开关与暂停时间：请分开提交（切换总开关会自动清除暂停状态）',
+        snapshot: snapshot(),
+      }
     }
     const muteWasActive = isMuted(state.data)
     const saved = await commit(() => {
@@ -2857,6 +3274,7 @@ export function apply(ctx) {
           state.data.budgetChars = clampBudget(patch.budgetChars)
         }
         if (typeof patch.backupDir === 'string') state.data.backupDir = patch.backupDir.trim()
+        if (muteClear) state.data.disabledUntil = 0
         if (muteTarget !== null && typeof patch.enabled !== 'boolean') {
           state.data.disabledUntil = muteTarget
         }
@@ -2871,8 +3289,8 @@ export function apply(ctx) {
         ? '已恢复默认备份位置（版本历史与导出与存储文件同目录）'
         : '备份位置已更新：' + wanted + '（版本历史与「导出到备份目录」随之改变；存储文件本身不移动）')
     }
-    if (muteTarget !== null && !(patch !== null && typeof patch === 'object' && typeof patch.enabled === 'boolean')) {
-      if (muteTarget === 0) {
+    if (muteRequested && !(patch !== null && typeof patch === 'object' && typeof patch.enabled === 'boolean')) {
+      if (muteTarget === null) {
         if (muteWasActive) notes.push('已恢复注入。')
       } else {
         notes.push('已暂停注入至 ' + new Date(muteTarget).toLocaleString()
@@ -3166,8 +3584,32 @@ export function apply(ctx) {
     if (state.data.sets.length >= MAX_SETS) {
       return { ok: false, saved: false, message: '最多 ' + MAX_SETS + ' 个配置集', snapshot: snapshot() }
     }
-    const wanted = singleLine(typeof name === 'string' ? name : '', MAX_SET_NAME)
-      || singleLine(source.name + ' 副本', MAX_SET_NAME)
+    // The derived name must not lose its " 副本" suffix to truncation: a
+    // MAX_SET_NAME-long source name used to be cut AFTER the suffix was
+    // appended, so the copy came back with the source's own name and the
+    // same-name check below refused it with "已存在同名配置集" — a copy that
+    // cannot be made and a message that does not explain why. Reserve the
+    // suffix's room first, then number the copies when that name is taken.
+    const derivedName = () => {
+      const plain = ' 副本'
+      const first = singleLine(source.name, MAX_SET_NAME - plain.length) + plain
+      if (!state.data.sets.some((set) => set.name === first)) return first
+      for (let index = 2; index <= 99; index += 1) {
+        const tag = ' 副本' + index
+        const candidate = singleLine(source.name, MAX_SET_NAME - tag.length) + tag
+        if (!state.data.sets.some((set) => set.name === candidate)) return candidate
+      }
+      return null
+    }
+    const wanted = singleLine(typeof name === 'string' ? name : '', MAX_SET_NAME) || derivedName()
+    if (wanted === null) {
+      return {
+        ok: false,
+        saved: false,
+        message: '无法为新配置集生成不重复的名称（同名「副本」已达 99 个）：请手动指定名称',
+        snapshot: snapshot(),
+      }
+    }
     if (state.data.sets.some((set) => set.name === wanted)) {
       return { ok: false, saved: false, message: '已存在同名配置集「' + wanted + '」', snapshot: snapshot() }
     }
@@ -3214,7 +3656,7 @@ export function apply(ctx) {
     } catch (err) {
       // A missing directory is not an error: nothing has been written yet.
       if (err === null || err === undefined || err.code !== 'ENOENT') {
-        return { ok: false, saved: false, message: '无法读取版本历史目录：' + describeError(err), snapshot: snapshot(), history: { dir, items: [] } }
+        return { ok: false, saved: false, message: '无法读取版本历史目录：' + describeErrorSafe(err), snapshot: snapshot(), history: { dir, items: [] } }
       }
     }
     const items = []
@@ -3271,7 +3713,7 @@ export function apply(ctx) {
     try {
       parsed = JSON.parse(await readFile(join(historyDirPath(), name), 'utf8'))
     } catch (err) {
-      return { ok: false, saved: false, message: '无法读取该历史快照：' + describeError(err), snapshot: snapshot() }
+      return { ok: false, saved: false, message: '无法读取该历史快照：' + describeErrorSafe(err), snapshot: snapshot() }
     }
     const adopted = adoptParsedStore(parsed)
     if (adopted.error !== undefined) {
@@ -3312,7 +3754,7 @@ export function apply(ctx) {
     try {
       await unlink(join(historyDirPath(), name))
     } catch (err) {
-      return { ok: false, saved: false, message: '删除历史快照失败：' + describeError(err), snapshot: snapshot() }
+      return { ok: false, saved: false, message: '删除历史快照失败：' + describeErrorSafe(err), snapshot: snapshot() }
     }
     await refreshHistoryCount()
     return { ok: true, saved: false, message: '已删除该历史快照', snapshot: snapshot() }
@@ -3360,9 +3802,9 @@ export function apply(ctx) {
     const target = join(dir, exportFileName(Date.now()))
     try {
       await mkdir(dir, { recursive: true })
-      await writeFile(target, JSON.stringify(exportEnvelope(), null, 2) + '\n', 'utf8')
+      await writeFile(target, JSON.stringify(exportEnvelope(), null, 2) + '\n', { encoding: 'utf8', mode: 0o600 })
     } catch (err) {
-      return { ok: false, saved: false, message: '写入备份目录失败：' + describeError(err), snapshot: snapshot() }
+      return { ok: false, saved: false, message: '写入备份目录失败：' + describeErrorSafe(err), snapshot: snapshot() }
     }
     return { ok: true, saved: false, message: '已写入 ' + target, snapshot: snapshot() }
   })
@@ -3450,7 +3892,7 @@ export function apply(ctx) {
     try {
       parsed = JSON.parse(text)
     } catch (err) {
-      return { ok: false, saved: false, message: '源码不是有效的 JSON：' + describeError(err), snapshot: snapshot() }
+      return { ok: false, saved: false, message: '源码不是有效的 JSON：' + describeErrorSafe(err), snapshot: snapshot() }
     }
     return commitAdoptedStore(parsed, '已按源码保存：')
   })
@@ -3767,12 +4209,12 @@ export function apply(ctx) {
       text = await readFile(path, 'utf8')
     } catch (err) {
       if (err !== null && typeof err === 'object' && err.code === 'ENOENT') return null
-      throw new Error('无法读取反馈配置文件 ' + path + '：' + describeError(err))
+      throw new Error('无法读取反馈配置文件 ' + path + '：' + describeErrorSafe(err))
     }
     try {
       return JSON.parse(text)
     } catch (err) {
-      throw new Error('反馈配置文件不是有效的 JSON（' + path + '）：' + describeError(err))
+      throw new Error('反馈配置文件不是有效的 JSON（' + path + '）：' + describeErrorSafe(err))
     }
   }
 
@@ -3830,8 +4272,8 @@ export function apply(ctx) {
       file = await readFeedbackConfigFile(configPath)
     } catch (err) {
       releaseReservation()
-      logInfo('feedback config unusable: ' + describeError(err))
-      return { ok: false, message: describeError(err) }
+      logInfo('feedback config unusable: ' + describeErrorSafe(err))
+      return { ok: false, message: describeErrorSafe(err) }
     }
     const readiness = feedbackConfigFrom({ env: process.env, file, configPath })
     if (!readiness.ok) {
@@ -3880,7 +4322,7 @@ export function apply(ctx) {
       // on; it never contains the password (see mailer.js), and the configured
       // mailboxes are masked, so logging it is safe and makes reports debuggable.
       releaseReservation()
-      const reason = maskAddresses(describeError(err))
+      const reason = maskAddresses(describeErrorSafe(err))
       logInfo('feedback send failed: ' + reason)
       return { ok: false, message: '反馈发送失败：' + reason + '（详细原因已写入宿主日志）' }
     }
@@ -4032,6 +4474,18 @@ export function apply(ctx) {
       res.end(JSON.stringify({ ok: false, message: '请求来源被拒绝：' + verdict.reason }))
       return
     }
+    // Every subscriber holds a Map entry, a `req.on('close')` listener and a
+    // live socket until it disconnects. A tab that is duplicated, a client that
+    // never closes, or a script that opens streams in a loop would otherwise
+    // grow that set without bound — the host process leaks memory and file
+    // handles for as long as it runs. Refuse politely past the ceiling instead
+    // of growing forever; the panel retries on its own schedule.
+    if (sseStreams.size >= MAX_SSE_STREAMS) {
+      logInfo('event stream refused: ' + sseStreams.size + ' streams already open')
+      res.writeHead(503, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
+      res.end(JSON.stringify({ ok: false, message: '事件流连接数已达上限（' + MAX_SSE_STREAMS + '），请稍后重试' }))
+      return
+    }
     res.writeHead(200, {
       'content-type': 'text/event-stream; charset=utf-8',
       'cache-control': 'no-store',
@@ -4102,6 +4556,23 @@ export function apply(ctx) {
       res.end(JSON.stringify({ ok: false, message: 'only POST is supported' }))
       return
     }
+    // A request carrying TWO Host headers has no unambiguous origin: Node
+    // exposes only the first in req.headers, while the proxy in front (or the
+    // attacker's own client) may consider a different one authoritative. There
+    // is no legitimate client of this route that sends two, so refuse rather
+    // than guess which one the guard should believe.
+    if (Array.isArray(req.rawHeaders)) {
+      let hostCount = 0
+      for (let index = 0; index < req.rawHeaders.length; index += 2) {
+        if (String(req.rawHeaders[index]).toLowerCase() === 'host') hostCount += 1
+      }
+      if (hostCount > 1) {
+        logInfo('route rejected a request with ' + hostCount + ' Host headers')
+        res.writeHead(400, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
+        res.end(JSON.stringify({ ok: false, message: '请求带有多个 Host 头，已拒绝' }))
+        return
+      }
+    }
     // Origin/Host guard, before anything else is read. See
     // requestOriginVerdict() for why the content-type rule below is not enough
     // on its own.
@@ -4116,10 +4587,15 @@ export function apply(ctx) {
     // the anti-CSRF coincidence (a plain HTML form cannot fabricate a JSON
     // body) into a hard rule: a cross-site or malformed post now gets a
     // readable 415 instead of a confusing parse failure.
+    //
+    // The match is on the MEDIA TYPE alone, exactly. A substring test let
+    // `text/plain; note=application/json` through — and `text/plain` is a CORS
+    // "simple" content type, so that one spelling bypasses the preflight that
+    // the whole rule exists to rely on.
     const contentType = String(
       (req.headers !== null && typeof req.headers === 'object') ? (req.headers['content-type'] || '') : '',
     )
-    if (contentType.indexOf('application/json') === -1) {
+    if (mediaTypeOf(contentType) !== 'application/json') {
       res.writeHead(415, { 'content-type': 'application/json; charset=utf-8' })
       res.end(JSON.stringify({ ok: false, message: 'content-type 必须是 application/json' }))
       return
@@ -4130,10 +4606,24 @@ export function apply(ctx) {
     // the whole host process down over one dead HTTP request.
     req.on('error', () => {})
     res.on('error', () => {})
-    let body = ''
+    // A declared length far over the ceiling is refused before a single chunk
+    // is buffered. The ceiling is counted in CHARACTERS, so a UTF-8 byte length
+    // above 4× it cannot fit; buffering first and checking later is exactly the
+    // memory cost this guard exists to avoid (~6 MB per concurrent request).
+    const declaredLength = Number.parseInt(String(
+      (req.headers !== null && typeof req.headers === 'object' ? req.headers['content-length'] : '') || '',
+    ), 10)
+    if (Number.isFinite(declaredLength) && declaredLength > MAX_BODY_CHARS * 4) {
+      res.writeHead(413, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store', connection: 'close' })
+      res.end(JSON.stringify({ ok: false, message: '请求体超过 ' + MAX_BODY_CHARS + ' 字符上限' }))
+      // Drain the rest so the client sees the 413 rather than a reset socket.
+      req.resume()
+      return
+    }
     // Over the ceiling we stop accumulating but keep draining, so the
     // response can go out as a clean 413 instead of a destroyed socket the
     // Client can only report as a generic network failure.
+    let body = ''
     let overflow = false
     req.setEncoding('utf8')
     req.on('data', (chunk) => {
@@ -4156,7 +4646,7 @@ export function apply(ctx) {
           const payload = body === '' ? {} : JSON.parse(body)
           result = await dispatch(payload.method, payload.args === undefined ? null : payload.args)
         } catch (err) {
-          result = { ok: false, saved: false, message: describeError(err), snapshot: snapshot() }
+          result = { ok: false, saved: false, message: describeErrorSafe(err), snapshot: snapshot() }
         }
         res.writeHead(200, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
         res.end(JSON.stringify(result))
@@ -4190,6 +4680,20 @@ export function apply(ctx) {
     // F12: the settings page can only warn about a non-loopback bind if the
     // snapshot carries what the route actually saw at registration time.
     state.boundHost = boundHost
+    // This callback runs again whenever the service is published anew (host
+    // restart, fiber remount). Registering on top of the previous registration
+    // would LEAK it: the old handler stays mounted and keeps answering from the
+    // state it closed over, while `routeDispose` only remembers the newest one.
+    // Drop the previous registration first — newest wins.
+    if (routeDispose !== null) {
+      const previous = routeDispose
+      routeDispose = null
+      try {
+        previous()
+      } catch (err) {
+        console.error('[instruction-memory] previous route dispose failed:', err)
+      }
+    }
     try {
       routeDispose = webServer.register({ kind: 'prefix', path: API_PREFIX, handler })
       logDebug('settings route registered at ' + API_PREFIX + ' (boundHost=' + boundHost + ', hostGuard=' + guardHost + ')')