dsh-instruction-memory 1.4.6 → 1.4.8

package/lib/index.js

@@ -25,12 +25,12 @@
  * user-chosen backup directory (F18).
  */
 
-import { copyFile, mkdir, readdir, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises'
-import { readFileSync, watch } from 'node:fs'
+import { chmod, copyFile, mkdir, readdir, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises'
+import { readFileSync, realpathSync, statSync, watch } from 'node:fs'
 import { randomUUID } from 'node:crypto'
 import { isIP } from 'node:net'
 import { homedir, hostname } from 'node:os'
-import { basename, dirname, isAbsolute, join, resolve, sep } from 'node:path'
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import {
   FEEDBACK_ENV,
@@ -148,6 +148,35 @@ const BACKUP_FILE_SUFFIX = '.bak'
  */
 const SECTION_ORDER = 950
 const API_PREFIX = '/instruction-memory/api'
+/**
+ * Extra hostnames this route accepts, comma separated (F19).
+ *
+ * A loopback bind normally only answers to `127.0.0.1`/`localhost`, which is
+ * what makes the DNS-rebinding guard meaningful — but it also made the route
+ * unusable behind a reverse proxy that forwards the public `Host` (nginx's
+ * default `proxy_set_header Host $host`). Listing the published hostname here
+ * re-opens exactly that one name and nothing else: the loopback rule still
+ * applies to everything else, and `Origin`/`Sec-Fetch-Site` are still enforced.
+ */
+const TRUSTED_HOSTS_ENV = 'DSH_INSTRUCTION_MEMORY_TRUSTED_HOSTS'
+/**
+ * Escape hatch for F18 backups outside `$DSH_HOME` (F19). The default refuses
+ * them: an unauthenticated route that can create directories anywhere the host
+ * process can write is a disk-fill primitive. Setting this to `1` restores the
+ * old permissive behaviour for operators who really keep backups on another
+ * volume.
+ */
+const ALLOW_EXTERNAL_BACKUP_ENV = 'DSH_INSTRUCTION_MEMORY_ALLOW_EXTERNAL_BACKUP'
+/**
+ * How often the store file is stat-ed as a fallback for `fs.watch` (F19).
+ *
+ * Inotify/FSEvents/ReadDirectoryChangesW are reliable on a native filesystem
+ * and silently dead on DrvFs (`/mnt/c`, `/mnt/d`), SMB and some container
+ * overlays — there the watcher installs without error and then never fires, so
+ * an external edit to memory.json was simply invisible until a restart. A
+ * 5 s stat of one path costs nothing and turns that silence into a reload.
+ */
+const WATCH_POLL_MS = 5000
 /**
  * Feedback mail: the optional config file next to the store. Kept OUT of
  * the repository on purpose — the operator's SMTP credentials must never be
@@ -175,13 +204,19 @@ const PLUGIN_VERSION = (() => {
 })()
 
 /**
- * Resolve this plugin's data file under the harness home.
+ * The harness home: the directory this plugin's data lives under.
  *
  * Precedence mirrors `@deepseek-ai/dsh-home-paths`: an explicit `$DSH_HOME`,
  * then `~/.dsh`. A blank override counts as unset and must never resolve to the
  * current working directory. Exported so tests can pin it.
+ *
+ * Resolved here rather than derived from the store path. `dirname(dirname(
+ * storePath))` happens to equal this today, but it is a guess about the layout:
+ * one extra directory level (or a store moved up a level) would quietly widen
+ * the "may I write outside the harness home" fence to the harness home's
+ * PARENT. A guard that guesses its own root is not a guard.
  */
-export function resolveStorePath(env = process.env, home = homedir()) {
+export function resolveDshRoot(env = process.env, home = homedir()) {
   const configured = typeof env.DSH_HOME === 'string' ? env.DSH_HOME.trim() : ''
   // A relative override (`DSH_HOME=./data`) is resolved ONCE against the
   // process cwd. Without this the store path stayed relative for the whole
@@ -190,8 +225,12 @@ export function resolveStorePath(env = process.env, home = homedir()) {
   // how the path was spelled. Resolving does not make a relative override
   // cwd-independent — it cannot be — but it pins one absolute location for
   // this process and keeps every displayed path absolute.
-  const root = configured !== '' ? resolve(configured) : join(home, '.dsh')
-  return join(root, STORE_DIR_NAME, STORE_FILE_NAME)
+  return configured !== '' ? resolve(configured) : join(home, '.dsh')
+}
+
+/** Resolve this plugin's data file under the harness home. */
+export function resolveStorePath(env = process.env, home = homedir()) {
+  return join(resolveDshRoot(env, home), STORE_DIR_NAME, STORE_FILE_NAME)
 }
 
 /**
@@ -1163,7 +1202,51 @@ export function isWildcardBindHost(value) {
  * `Host: attacker.example` plus `Origin: attacker.example`. Wildcard binds keep
  * the old comparison, because the address the client used is unknowable then.
  */
-export function requestOriginVerdict(headers, guarded, expectedHostname = '') {
+/**
+ * Parse the trusted-host list into canonical hostnames.
+ *
+ * Accepts what an operator actually types: a bare `app.example`, a full
+ * origin (`https://app.example:8443`), bracketed IPv6, comma or whitespace
+ * separated. Everything is folded to the same lowercase, bracket-free,
+ * port-free form `hostnameOf()`/`normalizeHostname()` produce, so a trusted
+ * entry compares equal to a parsed `Host` or `Origin` without further work.
+ *
+ * @param {string|string[]} value raw environment value or an array.
+ * @returns {string[]} canonical hostnames, deduplicated, order preserved.
+ */
+export function normalizeTrustedHosts(value) {
+  const raw = Array.isArray(value) ? value.join(',') : typeof value === 'string' ? value : ''
+  const out = []
+  for (const piece of raw.split(',')) {
+    let text = piece.trim()
+    if (text === '') continue
+    // A full origin is common in copy-pasted docs; keep only its host.
+    const scheme = text.indexOf('://')
+    if (scheme !== -1) {
+      try {
+        text = new URL(text).hostname
+      } catch {
+        text = text.slice(scheme + 3)
+      }
+    }
+    text = text.replace(/^\/+/, '')
+    const slash = text.indexOf('/')
+    if (slash !== -1) text = text.slice(0, slash)
+    // hostnameOf() already drops a port and the IPv6 brackets.
+    const name = hostnameOf(text)
+    if (name === '') continue
+    if (!out.includes(name)) out.push(name)
+  }
+  return out
+}
+
+/** Is this canonical hostname one the operator explicitly trusted? */
+function isTrustedHostName(name, trusted) {
+  return name !== '' && Array.isArray(trusted) && trusted.includes(name)
+}
+
+export function requestOriginVerdict(headers, guarded, expectedHostname = '', trustedHosts = []) {
+  const trusted = Array.isArray(trustedHosts) ? trustedHosts : []
   const read = (name) => {
     if (headers === null || typeof headers !== 'object') return ''
     const value = headers[name]
@@ -1172,7 +1255,7 @@ export function requestOriginVerdict(headers, guarded, expectedHostname = '') {
   const requestHost = read('host').trim().toLowerCase()
   const requestHostname = hostnameOf(requestHost)
 
-  if (guarded && !isLoopbackName(requestHostname)) {
+  if (guarded && !isLoopbackName(requestHostname) && !isTrustedHostName(requestHostname, trusted)) {
     return { ok: false, reason: 'Host 头不是回环地址（可能是 DNS 重绑定攻击）：' + (requestHost === '' ? '(缺失)' : requestHost) }
   }
 
@@ -1213,7 +1296,7 @@ export function requestOriginVerdict(headers, guarded, expectedHostname = '') {
     // is what keeps those spellings working (the mapped/hex forms canonicalise).
     const expected = !guarded && typeof expectedHostname === 'string' ? expectedHostname : ''
     const authority = expected !== '' ? expected : requestHostname
-    if (originHostname === '' || !sameHostname(originHostname, authority)) {
+    if (originHostname === '' || (!sameHostname(originHostname, authority) && !isTrustedHostName(originHostname, trusted))) {
       return {
         ok: false,
         reason: expected !== ''
@@ -1688,6 +1771,13 @@ export function apply(ctx) {
    * temporal-dead-zone hazard (F12 publishes it as `security.hostGuarded`).
    */
   let guardHost = true
+  /**
+   * F19: hostnames the operator explicitly allowed (see TRUSTED_HOSTS_ENV).
+   * Read once at mount from the environment; a restart is required to change it,
+   * which keeps the allowlist out of the settings page (a route that can widen
+   * its own trust boundary is not a boundary).
+   */
+  const trustedHosts = normalizeTrustedHosts(process.env[TRUSTED_HOSTS_ENV])
   /**
    * The authority a browser had to use to reach this route, when the bind
    * address is concrete (`192.168.1.5`, `[::1]`). Empty for a wildcard/unknown
@@ -1747,6 +1837,13 @@ export function apply(ctx) {
     let text = describeError(err)
     const storeDir = dirname(storePath)
     if (storeDir !== '' && storeDir !== '.') text = text.split(storeDir).join('<记忆目录>')
+    // F19: a custom backup location is just as revealing (it is usually a
+    // cloud-sync path with an account name in it) and used to survive the fold
+    // whenever it was not under the home directory.
+    const configuredBackup = typeof state.data.backupDir === 'string' ? state.data.backupDir.trim() : ''
+    if (configuredBackup !== '' && configuredBackup !== storeDir) {
+      text = text.split(configuredBackup).join('<备份目录>')
+    }
     try {
       const home = homedir()
       // Same token as `displayPath` so a folded path looks identical wherever
@@ -1802,6 +1899,41 @@ export function apply(ctx) {
     else console.error('[instruction-memory] ' + message)
   }
 
+  /**
+   * Create (or repair) a directory this plugin owns and make sure it is 0700.
+   *
+   * `mkdir(..., {mode: 0o700})` only sets the mode on a directory it actually
+   * creates: a store first written by 1.4.7 stays 0755 forever, because every
+   * later start just resolves the path that already exists. The snapshots in
+   * `history/` were therefore still listable by other local users after the
+   * mode fix shipped, which the review called out as a real (if minor) gap.
+   * The chmod is deliberately best effort: a directory owned by someone else,
+   * or a filesystem without POSIX modes (Windows, some network mounts), must
+   * not turn a save or a boot into a failure.
+   */
+  const repairDirMode = async (dir) => {
+    if (process.platform === 'win32') return
+    try {
+      const info = await stat(dir)
+      if ((info.mode & 0o777) === 0o700) return
+      await chmod(dir, 0o700)
+      logInfo('tightened ' + displayPath(dir) + ' to 0700 (was ' + (info.mode & 0o777).toString(8) + ')')
+    } catch {
+      // Not our directory, or no POSIX modes here: the write itself matters more.
+    }
+  }
+
+  /**
+   * Create the directory if needed and make sure it ends up 0700. Boot-time
+   * repair deliberately uses `repairDirMode` alone: a first run must not create
+   * the store directory just to look at it (pinned by the "booting does not
+   * even create the store directory" contract).
+   */
+  const hardenDir = async (dir) => {
+    await mkdir(dir, { recursive: true, mode: 0o700 })
+    await repairDirMode(dir)
+  }
+
   const logDebug = (message) => {
     if (logger !== null) {
       if (typeof logger.debug === 'function') logger.debug(message)
@@ -1849,7 +1981,14 @@ export function apply(ctx) {
    */
   const assembledSectionText = () => {
     sectionPulls += 1
-    logDebug('section pulled into a prompt (pull #' + sectionPulls + ')')
+    // The host calls this while assembling the prompt and does NOT wrap it in
+    // try/catch, so a throwing logger would abort the whole turn. Counting the
+    // pull is diagnostics; it must never be the reason a prompt fails.
+    try {
+      logDebug('section pulled into a prompt (pull #' + sectionPulls + ')')
+    } catch {
+      // Diagnostics only.
+    }
     return sectionText()
   }
 
@@ -1889,6 +2028,29 @@ export function apply(ctx) {
    * when something must be injected, absent otherwise. An empty memory must
    * leave the prompt byte-identical to a deployment without this plugin.
    */
+  /**
+   * Where the host wants this section to sit, asked of the host itself.
+   *
+   * `950` is the documented gap between FILE_REFERENCE (900) and TOOL_BASH
+   * (1000) in `dsh-system-prompt`'s central `SECTION_ORDERS` table. Hardcoding
+   * it works until that table grows an entry at 950 — then the placement is a
+   * silent tie, decided by dictionary order, and nothing reports it. The
+   * service exposes `getSectionOrder(name)`, so take the midpoint of the two
+   * neighbours we actually anchor against and fall back to 950 if the method
+   * is gone or answers something unusable.
+   */
+  const resolveSectionOrder = () => {
+    try {
+      if (systemPrompt === null || typeof systemPrompt.getSectionOrder !== 'function') return SECTION_ORDER
+      const lo = systemPrompt.getSectionOrder('FILE_REFERENCE')
+      const hi = systemPrompt.getSectionOrder('TOOL_BASH')
+      if (!Number.isFinite(lo) || !Number.isFinite(hi) || hi <= lo) return SECTION_ORDER
+      return lo + (hi - lo) / 2
+    } catch {
+      return SECTION_ORDER
+    }
+  }
+
   const syncSection = () => {
     if (disposed) return
     const wanted = sectionText() !== ''
@@ -1902,15 +2064,16 @@ export function apply(ctx) {
         // template or any `{{…}}` pair — so the default would abort the whole
         // agent turn at renderPrompt(). This section is literal text and never
         // references a host variable, so opt out explicitly.
+        const order = resolveSectionOrder()
         sectionDispose = systemPrompt.section({
           name: SECTION_NAME,
-          order: SECTION_ORDER,
+          order,
           text: assembledSectionText,
           interpolate: false,
         })
         state.sectionRegistered = true
         state.sectionError = null
-        logDebug('prompt section registered: order=' + SECTION_ORDER + ' chars=' + sectionText().length)
+        logDebug('prompt section registered: order=' + order + ' chars=' + sectionText().length)
       } catch (err) {
         sectionDispose = null
         state.sectionRegistered = false
@@ -1968,6 +2131,13 @@ export function apply(ctx) {
   const sseStreams = new Map()
   let storeWatcher = null
   let watchDebounce = null
+  /**
+   * Fallback poller for filesystems where `fs.watch` installs but never fires
+   * (DrvFs `/mnt/*`, SMB/NFS, some overlays). Null when not running.
+   */
+  let storePoll = null
+  /** Last `size:mtime:ino` signature the poller saw, so it only reacts to a change. */
+  let storeSignature = ''
 
   const pushSnapshot = () => {
     if (disposed || sseStreams.size === 0) return
@@ -2042,11 +2212,51 @@ export function apply(ctx) {
     }, WATCH_DEBOUNCE_MS)
   }
 
+  /** The stat signature a poller compares, or '' when the file is absent. */
+  const currentStoreSignature = () => {
+    try {
+      const info = statSync(storePath)
+      return String(info.size) + ':' + String(info.mtimeMs) + ':' + String(info.ino)
+    } catch {
+      return ''
+    }
+  }
+
+  /**
+   * Start the fallback poller (idempotent).
+   *
+   * It is ALWAYS started alongside the watcher, not only after a failure: an
+   * `fs.watch` that never fires cannot be distinguished from a quiet store, so
+   * there is no event to trigger a downgrade. On a native filesystem the poller
+   * finds the same signature the watcher just acted on and does nothing —
+   * `onStoreFileEvent` already drops no-op reloads by comparing content.
+   */
+  const startPolling = () => {
+    if (disposed || storePoll !== null) return
+    storeSignature = currentStoreSignature()
+    storePoll = setInterval(() => {
+      if (disposed) return
+      const signature = currentStoreSignature()
+      if (signature === storeSignature) return
+      storeSignature = signature
+      // A vanished file is not an edit; the next save recreates it.
+      if (signature === '') return
+      onStoreFileEvent()
+    }, WATCH_POLL_MS)
+    // A background timer must never be a reason for the host process to stay
+    // alive after the plugin is unmounted.
+    if (typeof storePoll.unref === 'function') storePoll.unref()
+  }
+
   const stopWatching = () => {
     if (watchDebounce !== null) {
       clearTimeout(watchDebounce)
       watchDebounce = null
     }
+    if (storePoll !== null) {
+      clearInterval(storePoll)
+      storePoll = null
+    }
     if (storeWatcher !== null) {
       const watcher = storeWatcher
       storeWatcher = null
@@ -2075,10 +2285,20 @@ export function apply(ctx) {
         if (typeof filename === 'string' && filename !== basename(storePath)) return
         onStoreFileEvent()
       })
-      storeWatcher.on('error', () => stopWatching())
+      storeWatcher.on('error', (err) => {
+        // Losing the OS watcher is survivable (the poller below still notices
+        // an external edit) but it must not happen silently: the downgrade is
+        // invisible otherwise.
+        logInfo('store watcher failed, falling back to the 5s poller: ' + describeError(err))
+        stopWatching()
+      })
     } catch {
       storeWatcher = null
     }
+    // Started whether or not the watcher attached: on a filesystem where the
+    // watch handle exists but never fires this is the ONLY reload signal, and
+    // on a healthy one it is a cheap no-op.
+    startPolling()
   }
 
   const disposeStreams = () => {
@@ -2117,6 +2337,64 @@ export function apply(ctx) {
   /* ---------------- backup location + history snapshots (F14 / F18) ---------------- */
 
   const backupDirOf = () => (typeof state.data.backupDir === 'string' ? state.data.backupDir : '')
+  /** The harness home this plugin's data lives under (`$DSH_HOME` or `~/.dsh`). */
+  const dshRootPath = () => resolveDshRoot()
+  /**
+   * F19: are we allowed to write outside `$DSH_HOME`?
+   *
+   * The settings route can be reached without a login on profiles with no
+   * `connection` service, and `backupDir` used to accept ANY absolute path (it
+   * was probe-written on set and then created on every save). That is a
+   * disk-fill primitive, so the default is now "inside the harness home only";
+   * an operator who really keeps backups on another volume opts in explicitly.
+   */
+  const allowExternalBackup = () => {
+    const raw = process.env[ALLOW_EXTERNAL_BACKUP_ENV]
+    return typeof raw === 'string' && raw.trim() === '1'
+  }
+  /** `path`'s real location, or null when it (or a parent) is unavailable. */
+  const realPathOrNull = (path) => {
+    try {
+      return realpathSync(path)
+    } catch {
+      return null
+    }
+  }
+  /** Is `inner` the same as `root` or below it? */
+  const containsPath = (root, inner) => {
+    const rel = relative(root, inner)
+    return rel === '' || (!rel.startsWith('..' + sep) && rel !== '..' && !isAbsolute(rel))
+  }
+  /**
+   * Is `target` inside `$DSH_HOME` (equal to it counts)?
+   *
+   * Spelling alone is not containment. A junction or symlink INSIDE the
+   * harness home can point anywhere — on Windows a junction needs no privilege
+   * at all — so the lexical check answers "does this text start with the root"
+   * while the write lands in another volume. Both ends are therefore compared
+   * by real path; a target that does not exist yet is judged by the real path
+   * of its deepest existing ancestor plus the part still to be created.
+   */
+  const isInsideDshRoot = (target) => {
+    if (typeof target !== 'string' || target === '') return false
+    const root = dshRootPath()
+    const absolute = resolve(target)
+    if (!containsPath(root, absolute)) return false
+    const realRoot = realPathOrNull(root)
+    if (realRoot === null) return true
+    let existing = absolute
+    for (let depth = 0; depth < 64; depth += 1) {
+      const realExisting = realPathOrNull(existing)
+      if (realExisting !== null) {
+        const rest = absolute.slice(existing.length)
+        return containsPath(realRoot, rest === '' ? realExisting : join(realExisting, rest))
+      }
+      const parent = dirname(existing)
+      if (parent === existing) return false
+      existing = parent
+    }
+    return false
+  }
   /** Where the rolling pre-write copy lives: ALWAYS next to the store (crash recovery). */
   const localBackupPath = () => storePath + BACKUP_FILE_SUFFIX
   /** The user-facing copy under a custom backup location, or null (F18). */
@@ -2339,7 +2617,7 @@ export function apply(ctx) {
     if (typeof text !== 'string' || text === '' || identity === lastHistoryKey) return
     try {
       const dir = historyDirPath()
-      await mkdir(dir, { recursive: true })
+      await hardenDir(dir)
       const epoch = Date.now()
       let written = false
       // `wx` never overwrites: same-millisecond saves (two rapid bulk actions)
@@ -2413,7 +2691,7 @@ export function apply(ctx) {
     let lock = null
     let previousRev = null
     try {
-      await mkdir(dirname(storePath), { recursive: true })
+      await hardenDir(dirname(storePath))
       lock = await acquireStoreLock()
       if (lock === null) {
         // The lock could not be taken within the wait. That is either a stale
@@ -2845,6 +3123,11 @@ export function apply(ctx) {
     })
     .then(async () => {
       bootSettled = true
+      // Upgrade path: directories created by an older version keep their old
+      // mode because `mkdir` never re-applies it to an existing path. Repair
+      // them on every start; a failure here is a warning, never a boot error.
+      await repairDirMode(dirname(storePath))
+      await repairDirMode(historyDirPath())
       syncSection()
       await refreshHistoryCount()
       // The one always-on line: it answers "is memory mounted, where does it
@@ -2932,6 +3215,14 @@ export function apply(ctx) {
           profiles: state.data.profiles.filter((profile) => belongsTo(profile, set.id)).length,
         })),
       },
+      /**
+       * The running plugin version. The panel renders it in the mount-failure
+       * notice, which is the one place a user reads a number off the screen
+       * when the settings page never appears — reading it from the store would
+       * be wrong (the store survives upgrades) and the client cannot import
+       * package.json.
+       */
+      pluginVersion: PLUGIN_VERSION,
       /**
        * F12: the one security signal the panel was missing. `hostGuarded` is
        * the SAME flag the route enforces on every request — false means the
@@ -2943,6 +3234,15 @@ export function apply(ctx) {
       security: {
         hostGuarded: guardHost === true,
         boundHost: state.boundHost,
+        /**
+         * F19 follow-up: whether the harness authentication fence is attached
+         * RIGHT NOW. `hostGuarded === false` on its own reads as "no
+         * authentication at all", which is only true when this is false too:
+         * with the fence attached the route still requires a logged-in browser
+         * session (`connection.requestRejection`), and the panel must be able
+         * to say which of the two situations it is looking at.
+         */
+        authFence: connectionGate !== null,
       },
       /**
        * F12: load-side diagnostics that used to be log-only. `loadedFrom` says
@@ -3280,6 +3580,18 @@ export function apply(ctx) {
             snapshot: snapshot(),
           }
         }
+        // F19: an unauthenticated caller must not be able to create
+        // directories outside the harness home. Checked BEFORE the probe, so a
+        // refused path is never touched at all.
+        if (!allowExternalBackup() && !isInsideDshRoot(wanted)) {
+          return {
+            ok: false,
+            saved: false,
+            message: '备份位置必须位于 DSH 主目录内（' + dshRootPath() + '）；要使用其他磁盘请设置环境变量 '
+              + ALLOW_EXTERNAL_BACKUP_ENV + '=1 后重启宿主',
+            snapshot: snapshot(),
+          }
+        }
         const problem = await probeBackupDir(wanted)
         if (problem !== null) {
           return { ok: false, saved: false, message: '备份位置不可用（' + problem + '）：' + wanted, snapshot: snapshot() }
@@ -3868,6 +4180,11 @@ export function apply(ctx) {
     snapshot: snapshot(),
   }))
 
+  /** F19: timestamp of the last export-to-dir, for the frequency guard. */
+  let lastExportAt = 0
+  /** F19: minimum spacing between export-to-dir writes. */
+  const EXPORT_COOLDOWN_MS = 2000
+
   /**
    * Write an export straight into the backup directory (F18) — the "land the
    * backup in my cloud-synced folder" button. The default directory is the
@@ -3875,9 +4192,34 @@ export function apply(ctx) {
    */
   const exportToDir = () => enqueue(async () => {
     const dir = backupDirOf() !== '' ? backupDirOf() : dirname(storePath)
-    const target = join(dir, exportFileName(Date.now()))
+    // F19: the same subtree rule the setting enforces, re-checked at write
+    // time — a store hand-edited to point elsewhere must not become a way to
+    // create arbitrary directories through this route either.
+    if (!allowExternalBackup() && !isInsideDshRoot(dir)) {
+      return {
+        ok: false,
+        saved: false,
+        message: '导出目录必须位于 DSH 主目录内（' + dshRootPath() + '）；要写入其他磁盘请设置环境变量 '
+          + ALLOW_EXTERNAL_BACKUP_ENV + '=1 后重启宿主',
+        snapshot: snapshot(),
+      }
+    }
+    // Each export writes a fixed-name JSON file of the whole store. Refusing a
+    // second export inside the cooldown keeps a script from using the button
+    // as a disk-fill loop.
+    const now = Date.now()
+    if (now - lastExportAt < EXPORT_COOLDOWN_MS) {
+      return {
+        ok: false,
+        saved: false,
+        message: '导出过于频繁，请 ' + Math.ceil((EXPORT_COOLDOWN_MS - (now - lastExportAt)) / 1000) + ' 秒后重试',
+        snapshot: snapshot(),
+      }
+    }
+    lastExportAt = now
+    const target = join(dir, exportFileName(now))
     try {
-      await mkdir(dir, { recursive: true })
+      await hardenDir(dir)
       await writeFile(target, JSON.stringify(exportEnvelope(), null, 2) + '\n', { encoding: 'utf8', mode: 0o600 })
     } catch (err) {
       return { ok: false, saved: false, message: '写入备份目录失败：' + describeErrorSafe(err), snapshot: snapshot() }
@@ -4287,6 +4629,16 @@ export function apply(ctx) {
       if (err !== null && typeof err === 'object' && err.code === 'ENOENT') return null
       throw new Error('无法读取反馈配置文件 ' + path + '：' + describeErrorSafe(err))
     }
+    // This file can hold SMTP credentials. The plugin does not create it (the
+    // operator does), so it cannot set its mode — it can only say something
+    // when the mode is wrong, which is the part that used to be silent.
+    if (process.platform !== 'win32') {
+      const info = await stat(path).catch(() => null)
+      if (info !== null && (info.mode & 0o077) !== 0) {
+        logInfo('feedback config ' + displayPath(path) + ' is readable by group/others (mode '
+          + (info.mode & 0o777).toString(8) + '); it may hold SMTP credentials')
+      }
+    }
     try {
       return JSON.parse(text)
     } catch (err) {
@@ -4504,6 +4856,21 @@ export function apply(ctx) {
   // `security.hostGuarded`); only `routeDispose` lives here.
 
   let routeDispose = null
+  /**
+   * F19: the composition's `connection` service, when the profile has one.
+   *
+   * It is the harness's single authentication fence: `requestRejection(req)`
+   * applies the Host/Origin trust check AND requires the browser login cookie
+   * (the same gate that makes `/api` answer 401 to an anonymous caller). This
+   * route used to rely on the Origin guesswork below alone, which left it as
+   * the only unauthenticated read/write endpoint on the instance — a stored
+   * prompt-injection primitive for any local process.
+   *
+   * Read through a NON-BLOCKING child fiber for the same reason `webServer` is
+   * (headless/tui profiles must still inject the prompt), and kept nullable:
+   * when the service is absent the loopback-only rule below still applies.
+   */
+  let connectionGate = null
 
   /**
    * Does this stream subscriber want lightweight frames?
@@ -4543,13 +4910,11 @@ export function apply(ctx) {
    * `?lite=1` gets `{ rev, lite: true }` frames instead (see pushSnapshot).
    */
   const handleEventStream = (req, res) => {
-    const verdict = requestOriginVerdict(req.headers, guardHost, expectedOriginHostname)
-    if (!verdict.ok) {
-      logInfo('route rejected a request: ' + verdict.reason)
-      res.writeHead(403, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
-      res.end(JSON.stringify({ ok: false, message: '请求来源被拒绝：' + verdict.reason }))
-      return
-    }
+    // Same fence as the POST path: an EventSource carries the login cookie, so
+    // an authenticated stream keeps working while an anonymous one is refused.
+    const fence = rejectUntrustedCaller(req, res)
+    if (fence === 'rejected') return
+    if (originVerdictRefuses(req, res, fence)) return
     // Every subscriber holds a Map entry, a `req.on('close')` listener and a
     // live socket until it disconnects. A tab that is duplicated, a client that
     // never closes, or a script that opens streams in a loop would otherwise
@@ -4609,7 +4974,94 @@ export function apply(ctx) {
     }
   }
 
+  /**
+   * F19: refuse a caller the harness has not authenticated.
+   *
+   * Order matters. The harness fence runs FIRST when it exists: it is the only
+   * check that knows about the browser login cookie, and it also owns the
+   * Host/Origin trust rules for every other route on the instance. The
+   * hand-rolled Origin verdict below stays as the second line of defence (it
+   * covers profiles that publish a web server without a `connection` service).
+   *
+   * When there is no fence at all, a NON-loopback bind fails closed: publishing
+   * an unauthenticated endpoint that can rewrite the instructions injected into
+   * every later turn is not a trade-off worth defaulting to. The loopback bind
+   * keeps working, which is the documented deployment (and what the Android
+   * build's route-guard patch assumes).
+   *
+   * @returns 'rejected' when this handler already answered the request (401,
+   *   403 or 503 and the response is complete), 'gate' when the harness fence
+   *   accepted it (so the Host/Origin question is already settled and the
+   *   plugin's own Origin verdict must NOT run again), 'open' when there is no
+   *   fence and the caller still has to pass the local Origin rules.
+   */
+  const rejectUntrustedCaller = (req, res) => {
+    if (connectionGate !== null) {
+      let rejection
+      try {
+        rejection = connectionGate.requestRejection(req)
+      } catch (err) {
+        // A throwing fence must not become an open door: treat it as 401.
+        logInfo('connection fence threw, refusing the request: ' + describeError(err))
+        rejection = 401
+      }
+      if (typeof rejection === 'number' && rejection >= 400) {
+        logInfo('route refused an unauthenticated request (' + rejection + ')')
+        res.writeHead(rejection, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
+        res.end(JSON.stringify({
+          ok: false,
+          message: rejection === 403
+            ? '请求未被宿主信任（Host/Origin 校验失败）'
+            : '需要登录 DSH 后的浏览器会话才能访问该路由',
+        }))
+        return 'rejected'
+      }
+      return 'gate'
+    }
+    if (!guardHost) {
+      logInfo('route refused a request: non-loopback bind without an authentication fence')
+      res.writeHead(503, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
+      res.end(JSON.stringify({
+        ok: false,
+        message: '该路由在非回环绑定下需要宿主的 connection 服务提供鉴权；当前 profile 没有该服务，已拒绝请求',
+      }))
+      return 'rejected'
+    }
+    return 'open'
+  }
+
+  /**
+   * Run the plugin's OWN Origin/Host verdict, but only when the harness fence
+   * did not already answer the same question (F19 follow-up).
+   *
+   * Order: the fence runs first. When it accepts a request it has already
+   * applied the host's Host / `Origin` / `Sec-Fetch-Site` rules AND verified
+   * the browser login cookie (`dsh-client-connection`: `isTrustedApiRequest`
+   * then `browserAuth`). It also knows the deployment's public name. This
+   * plugin knows only its bind address, so re-judging `Origin` here produced a
+   * false 403 for every legitimate reverse-proxy client: the proxy forwards
+   * `Host: dsh.example.com`, the listener binds `192.168.1.5`, and the Origin
+   * host could never equal the bind IP. The local verdict stays as the second
+   * line of defence for profiles that publish a web server WITHOUT a
+   * `connection` service — there it is the only fence there is.
+   *
+   * @returns true when the request was answered with 403 and must not continue.
+   */
+  const originVerdictRefuses = (req, res, fence) => {
+    if (fence === 'gate') return false
+    const verdict = requestOriginVerdict(req.headers, guardHost, expectedOriginHostname, trustedHosts)
+    if (verdict.ok) return false
+    logInfo('route rejected a request: ' + verdict.reason)
+    res.writeHead(403, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
+    res.end(JSON.stringify({ ok: false, message: '请求来源被拒绝：' + verdict.reason }))
+    return true
+  }
+
   const handler = (req, res) => {
+    // Authentication before anything else: not the method, not the body, not
+    // the size. A rejection must not leak which methods exist.
+    const fence = rejectUntrustedCaller(req, res)
+    if (fence === 'rejected') return
     if (req.method === 'GET') {
       const accept = String(
         (req.headers !== null && typeof req.headers === 'object') ? (req.headers.accept || '') : '',
@@ -4649,16 +5101,9 @@ export function apply(ctx) {
         return
       }
     }
-    // Origin/Host guard, before anything else is read. See
-    // requestOriginVerdict() for why the content-type rule below is not enough
-    // on its own.
-    const verdict = requestOriginVerdict(req.headers, guardHost, expectedOriginHostname)
-    if (!verdict.ok) {
-      logInfo('route rejected a request: ' + verdict.reason)
-      res.writeHead(403, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
-      res.end(JSON.stringify({ ok: false, message: '请求来源被拒绝：' + verdict.reason }))
-      return
-    }
+    // Origin/Host guard, before anything else is read. Skipped when the host
+    // fence already accepted this request — see originVerdictRefuses().
+    if (originVerdictRefuses(req, res, fence)) return
     // The settings page always posts application/json. Enforcing it turns
     // the anti-CSRF coincidence (a plain HTML form cannot fabricate a JSON
     // body) into a hard rule: a cross-site or malformed post now gets a
@@ -4736,6 +5181,30 @@ export function apply(ctx) {
   // losing the prompt injection along with the settings page. The callback also
   // fixes the original race properly — it runs whenever the service is
   // published, not only if it happened to beat this row to the mount.
+  // F19: take the harness authentication fence when the profile has one.
+  // Same non-blocking shape as the web server below — a profile without a
+  // browser never publishes `connection`, and the prompt injection must not
+  // wait for one.
+  ctx.inject(['connection'], (scope) => {
+    const service = scope.connection
+    if (service === undefined || service === null || typeof service.requestRejection !== 'function') {
+      logDebug('no connection service; the route falls back to the loopback-only rule')
+      return
+    }
+    connectionGate = service
+    logDebug('connection fence attached; the route now requires an authenticated browser session')
+    scope.effect(() => () => {
+      if (connectionGate !== service) return
+      connectionGate = null
+      // A host that republishes (or disposes) the service would otherwise let
+      // the route fall back to the loopback-only rule with nothing said about
+      // it. That is not an open door on a loopback bind, but it IS a silent
+      // authentication downgrade, and `snapshot.security.authFence` now shows
+      // it for as long as it lasts.
+      logInfo('connection fence detached while the plugin stayed mounted; the route falls back to the loopback-only rule until the service is published again')
+    })
+  })
+
   ctx.inject(['webServer'], (scope) => {
     const webServer = scope.webServer
     if (webServer === undefined || typeof webServer.register !== 'function') {