dsh-instruction-memory 1.4.7 → 1.5.0

package/lib/client.js

@@ -20,7 +20,40 @@ window.__ModuleLoader__.load({
     const React = require('react')
     const h = React.createElement
 
-    const API = '/instruction-memory/api'
+    /**
+     * F19: the route path RESOLVED against the page, not assumed to be at root.
+     *
+     * `/instruction-memory/api` is correct only when the GUI is served from `/`.
+     * Behind a reverse proxy that mounts the app under a prefix (`/ui/`) the
+     * browser posts to the proxy root instead, and every request 404s even
+     * though the panel rendered. The harness itself resolves its own client
+     * paths the same way (`new URL(path.slice(1), document.baseURI)`), so this
+     * follows the page wherever it is served from.
+     *
+     * Computed per call, not once at load: a test harness (or a page that
+     * rewrites `<base>`) can establish the base after this module evaluates.
+     *
+     * @param {string} [suffix] query string to append, e.g. `?lite=1`.
+     * @returns {string} absolute or root-relative URL for the route.
+     */
+    const apiEndpoint = (suffix) => {
+      const tail = typeof suffix === 'string' ? suffix : ''
+      const path = 'instruction-memory/api'
+      if (typeof document === 'undefined' || typeof document.baseURI !== 'string' || document.baseURI === '') {
+        return '/' + path + tail
+      }
+      try {
+        const base = new URL(document.baseURI)
+        // A base of `https://host/ui` (no trailing slash) would otherwise
+        // resolve against `/` — `ui` is the mount point itself, so treat it as
+        // the directory the app lives in.
+        if (!base.pathname.endsWith('/')) base.pathname += '/'
+        const url = new URL(path, base)
+        return url.pathname + url.search + tail
+      } catch {
+        return '/' + path + tail
+      }
+    }
 
     // The Host bounds one delivery at 60 s (lib/mailer.js SMTP_TOTAL_TIMEOUT_MS).
     // Waiting longer than the generic 15 s keeps the panel honest: aborting while
@@ -227,6 +260,7 @@ window.__ModuleLoader__.load({
         'panel.title': '指令记忆',
         'panel.subtitle': '保存后自动写入系统提示词，对此后所有对话、问答与任务执行生效。',
         'panel.loading': '正在读取指令记忆…',
+        'panel.retry': '重新载入',
         'panel.masterSwitch': '总开关',
         'status.mounted': '已挂载到系统提示词——后续每轮对话自动生效（{chars} 字符）',
         'status.notMountedEmpty': '未挂载：当前没有启用中的指令',
@@ -258,6 +292,7 @@ window.__ModuleLoader__.load({
         'editor.cancel': '取消',
         'editor.hint': '保存后对下一轮对话立即生效',
         'editor.needTitleOrContent': '请至少填写标题或指令内容',
+        'editor.conflictOverwrite': '这条记忆刚被其他窗口或进程修改过。继续保存会用你当前的编辑内容覆盖对方的修改，确定要继续吗？',
         'editor.confirmDiscard': '当前编辑内容尚未保存，确定放弃这些修改吗？',
         'confirm.unavailable': '当前环境无法弹出确认对话框，操作已取消，未做任何改动。',
         'body.expand': '展开全部',
@@ -383,6 +418,7 @@ window.__ModuleLoader__.load({
         'diag.copied': '诊断信息已复制到剪贴板',
         'diag.copyManual': '自动复制不可用；请手动全选复制下方文本。',
         'diag.hostWarn': '安全提示：设置路由当前绑定在非回环地址（{host}），同一网络内的设备可以无鉴权访问此页面，请勿在不可信网络暴露；如需对外发布，请阅读 README 的「经反向代理对外发布」。',
+        'diag.hostWarnFence': '安全提示：设置路由当前绑定在非回环地址（{host}），但宿主鉴权门已挂载——访问仍需登录 DSH 后的浏览器会话，未登录请求会被 401/403 拒绝；仍建议只在可信网络暴露。',
         'diag.groupStorage': '存储',
         'diag.groupInjection': '注入',
         'diag.groupBackup': '备份与历史',
@@ -459,7 +495,7 @@ window.__ModuleLoader__.load({
         'history.itemMetaLite': '{size} KB（文件较大，未统计条目数）',
         'history.foreign': '来自其他设备（{device}）',
         'history.restore': '回滚到此版本',
-        'history.restoreConfirm': '确定把当前记忆整体回滚到 {time} 的快照（rev {rev}）？当前内容仍保留在 memory.json.bak 中，且回滚本身会生成一份新快照，可以再回滚回来。',
+        'history.restoreConfirm': '确定把当前记忆整体回滚到 {time} 的快照（rev {rev}，文件 {name}）？当前内容仍保留在 memory.json.bak 中，且回滚本身会生成一份新快照，可以再回滚回来。',
         'history.delete': '删除',
         'history.deleteConfirm': '确定删除这份历史快照？删除后无法恢复。',
         'history.dir': '快照目录：{dir}',
@@ -511,6 +547,7 @@ window.__ModuleLoader__.load({
         'panel.title': 'Instruction Memory',
         'panel.subtitle': 'Saved instructions are written into the system prompt and apply to every conversation, answer, and task that follows.',
         'panel.loading': 'Loading instruction memory…',
+        'panel.retry': 'Reload',
         'panel.masterSwitch': 'Master switch',
         'status.mounted': 'Mounted into the system prompt — effective for every turn that follows ({chars} chars)',
         'status.notMountedEmpty': 'Not mounted: no enabled instructions',
@@ -542,6 +579,7 @@ window.__ModuleLoader__.load({
         'editor.cancel': 'Cancel',
         'editor.hint': 'Takes effect for the next conversation turn once saved',
         'editor.needTitleOrContent': 'Fill in at least a title or the instruction content',
+        'editor.conflictOverwrite': 'Another window or process just changed this entry. Saving now replaces their edit with yours. Continue?',
         'editor.confirmDiscard': 'The draft has unsaved changes. Discard them?',
         'confirm.unavailable': 'This shell cannot show a confirmation dialog, so the action was cancelled and nothing changed.',
         'body.expand': 'Show all',
@@ -667,6 +705,7 @@ window.__ModuleLoader__.load({
         'diag.copied': 'Diagnostics copied to the clipboard',
         'diag.copyManual': 'Automatic copy is unavailable; select and copy the text below manually.',
         'diag.hostWarn': 'Security notice: the settings route is bound to a non-loopback address ({host}); other devices on the same network can reach this page without authentication. Do not expose it on an untrusted network — for public deployments read “Publishing behind a reverse proxy” in the README.',
+        'diag.hostWarnFence': 'Security notice: the settings route is bound to a non-loopback address ({host}), but the host authentication fence is attached — access still requires a signed-in DSH browser session, and unauthenticated requests are refused with 401/403. Keep it on a trusted network anyway.',
         'diag.groupStorage': 'Storage',
         'diag.groupInjection': 'Injection',
         'diag.groupBackup': 'Backup & history',
@@ -743,7 +782,7 @@ window.__ModuleLoader__.load({
         'history.itemMetaLite': '{size} KB (file too large to count items)',
         'history.foreign': 'From another device ({device})',
         'history.restore': 'Roll back to this',
-        'history.restoreConfirm': 'Roll the whole memory back to the snapshot from {time} (rev {rev})? The current content stays in memory.json.bak, and the rollback itself creates a new snapshot, so you can roll forward again.',
+        'history.restoreConfirm': 'Roll the whole memory back to the snapshot from {time} (rev {rev}, file {name})? The current content stays in memory.json.bak, and the rollback itself creates a new snapshot, so you can roll forward again.',
         'history.delete': 'Delete',
         'history.deleteConfirm': 'Delete this snapshot? This cannot be undone.',
         'history.dir': 'Snapshot folder: {dir}',
@@ -1130,10 +1169,16 @@ window.__ModuleLoader__.load({
      */
     function normalizeResult(result) {
       if (result === null || typeof result !== 'object') return null
-      const snapshot = result.snapshot !== undefined && result.snapshot !== null ? result.snapshot : result
+      const hasEnvelope = result.snapshot !== undefined && result.snapshot !== null
+      const snapshot = hasEnvelope ? result.snapshot : result
       // data === null passes a typeof check but poisons every consumer that
       // reads data.budgetChars; it is exactly as unusable as a missing data.
-      if (snapshot === null || typeof snapshot !== 'object' || snapshot.data === undefined || snapshot.data === null) return null
+      if (snapshot === null || typeof snapshot !== 'object' || Array.isArray(snapshot)) return null
+      const data = snapshot.data
+      if (data === undefined || data === null || typeof data !== 'object' || Array.isArray(data)) return null
+      // Every consumer reads data.entries and sortEntries() calls .slice() on
+      // it; a non-array threw mid-render instead of surfacing a readable error.
+      if (!Array.isArray(data.entries)) return null
       return {
         snapshot,
         ok: result.ok !== false,
@@ -1469,7 +1514,7 @@ window.__ModuleLoader__.load({
       const controller = typeof AbortController === 'function' ? new AbortController() : null
       const timer = controller !== null ? setTimeout(() => controller.abort(), timeoutMs) : null
       try {
-        const response = await fetch(API, {
+        const response = await fetch(apiEndpoint(), {
           method: 'POST',
           headers: { 'content-type': 'application/json' },
           body: JSON.stringify({ method, args: args === undefined ? null : args }),
@@ -1951,6 +1996,14 @@ window.__ModuleLoader__.load({
           setError(t('err.unrecognized'))
           return
         }
+        // Out-of-order responses: an older request can resolve after a newer one
+        // (an SSE-triggered refresh racing a POST reply) and would restore a
+        // stale snapshot over fresher data. rev only ever increases, so a
+        // snapshot older than the one already rendered is dropped. Equal revs
+        // are still absorbed — they are the same state.
+        const nextRev = revOfFrom(normalized.snapshot)
+        const currentRev = revOf()
+        if (typeof nextRev === 'number' && typeof currentRev === 'number' && nextRev < currentRev) return
         setView(normalized.snapshot)
         viewRef.current = normalized.snapshot
         // Keep the user's in-progress budget edit when a push arrives while
@@ -1972,17 +2025,29 @@ window.__ModuleLoader__.load({
         }
       }
 
+      // A single boolean was cleared by whichever request finished first, which
+      // re-enabled every button while other requests were still in flight.
+      const pendingRef = React.useRef(0)
+      // The panel can be unmounted while a request is in flight; setState after
+      // unmount is a no-op in React 18 but it also loses the error the user
+      // needed to see. Track disposal so late responses are dropped.
+      const disposedRef = React.useRef(false)
+      React.useEffect(() => () => { disposedRef.current = true }, [])
+
       async function send(method, args) {
+        pendingRef.current += 1
         setBusy(true)
         try {
           const result = await callHost(method, args)
+          if (disposedRef.current) return null
           absorb(result)
           return result
         } catch (err) {
-          setError(String(err && err.message ? err.message : err))
+          if (!disposedRef.current) setError(String(err && err.message ? err.message : err))
           return null
         } finally {
-          setBusy(false)
+          pendingRef.current = Math.max(0, pendingRef.current - 1)
+          if (pendingRef.current === 0 && !disposedRef.current) setBusy(false)
         }
       }
 
@@ -2105,6 +2170,13 @@ window.__ModuleLoader__.load({
       /** Switch the active set. The one click that changes what is injected. */
       function switchSet(id) {
         if (busy || id === '') return
+        // A switch closes every open form. The entry editor has always asked
+        // before discarding; the persona editor did not, so a typed persona was
+        // silently discarded while the entry form next to it would have asked.
+        const openProfile = profileDraftRef.current
+        if (openProfile !== null
+          && profileIsDirty(openProfile, view !== null && Array.isArray(view.data.profiles) ? view.data.profiles : [])
+          && !confirmDiscard()) return
         void send('set-active-set', { id, baseRev: revOf() }).then((result) => {
           // A switch invalidates any list selection: the ids belong to the set
           // that is no longer displayed.
@@ -2191,8 +2263,17 @@ window.__ModuleLoader__.load({
 
       function rollbackTo(item) {
         if (busy) return
+        // Restoring makes the Host read a whole file; a snapshot far larger
+        // than any real store is refused BEFORE the user confirms an operation
+        // that cannot succeed.
+        const sizeVerdict = importSizeVerdict(Number(item.bytes),
+          view !== null && view.limits !== null && typeof view.limits === 'object' ? view.limits.maxBodyChars : undefined)
+        if (!sizeVerdict.ok) {
+          setError(sizeVerdict.message)
+          return
+        }
         const when = new Date(item.epoch).toLocaleString()
-        const ask = askConfirm(t('history.restoreConfirm', { time: when, rev: item.rev }))
+        const ask = askConfirm(t('history.restoreConfirm', { time: when, rev: item.rev, name: item.name }))
         if (ask !== CONFIRM_YES) {
           if (ask === CONFIRM_UNAVAILABLE) setError(t('confirm.unavailable'))
           return
@@ -2342,11 +2423,16 @@ window.__ModuleLoader__.load({
       function saveSource() {
         if (busy) return
         void send('write-source', { text: sourceText, baseRev: sourceBaseRev }).then((result) => {
-          if (result === null || result.ok !== true) return
+          if (result === null) return
+          // A conflict response carries the FRESH snapshot. Keeping the old
+          // baseRev made every retry conflict again against a rev the Host had
+          // already told us about — an unwinnable loop with no way forward.
+          const freshRev = revOfFrom(result.snapshot)
+          if (typeof freshRev === 'number') setSourceBaseRev(freshRev)
+          if (result.ok !== true) return
           // The draft now matches the committed store, so the rev it is based
           // on must move with it — otherwise the very next save would be
           // refused as a conflict against our own write.
-          setSourceBaseRev(revOfFrom(result.snapshot))
           sourceBaselineRef.current = sourceText
           void loadHistory()
         })
@@ -2522,7 +2608,7 @@ window.__ModuleLoader__.load({
         // flag ignores the query string and keeps sending full frames — the
         // branch below still accepts those, so the negotiation is additive and
         // one-way: neither side has to know the other's version.
-        const source = new EventSource(API + '?lite=1')
+        const source = new EventSource(apiEndpoint('?lite=1'))
         let alive = true
         let refreshing = false
         let missed = false
@@ -2549,9 +2635,13 @@ window.__ModuleLoader__.load({
             const pushed = JSON.parse(ev.data)
             if (pushed !== null && typeof pushed === 'object' && pushed.lite === true) {
               const current = viewRef.current
-              // A null view means the initial POST `state` is still in flight;
-              // its response already carries the current rev.
-              if (current !== null && current.data !== null && current.data.rev !== pushed.rev) refresh()
+              // A null view used to be ignored here on the assumption that the
+              // initial POST `state` is always in flight. When that request
+              // failed, nothing ever refetched and the panel stayed on its
+              // loading text for the rest of the session. A lite frame proves
+              // the Host is alive, so it is a safe trigger to retry.
+              if (current === null) refresh()
+              else if (current.data !== null && current.data.rev !== pushed.rev) refresh()
               return
             }
             if (sameSnapshot(pushed, viewRef.current)) return
@@ -2565,7 +2655,11 @@ window.__ModuleLoader__.load({
 
       if (view === null) {
         return h('div', { className: 'im-root' },
-          h('div', { className: 'im-empty' }, error === '' ? t('panel.loading') : error))
+          h('div', { className: 'im-empty' }, error === '' ? t('panel.loading') : error),
+          error === ''
+            ? null
+            : h('div', { className: 'im-row im-row-end' },
+              h('button', { type: 'button', className: 'im-btn', onClick: () => { setError(''); send('state', null) } }, t('panel.retry'))))
       }
 
       if (draft !== null) {
@@ -2583,13 +2677,26 @@ window.__ModuleLoader__.load({
               setDraft(null); setError('')
             },
             onSave: () => {
+              if (busy) return
               if (draft.title.trim() === '' && draft.content.trim() === '') {
                 setError(t('editor.needTitleOrContent'))
                 return
               }
-              send('save-entry', { entry: draft, baseRev: revOf() }).then((result) => {
-                if (result && result.ok === true) { setDraft(null); setError('') }
-              })
+              const commit = (baseRev, allowOverwrite) => {
+                void send('save-entry', { entry: draft, baseRev }).then((result) => {
+                  if (result === null) return
+                  if (result.ok === true) { setDraft(null); setError(''); return }
+                  // The Host refuses a write built on a stale rev and answers
+                  // with the fresh snapshot (already absorbed into the view).
+                  // Retrying on our own would replace the other window's edit
+                  // with this draft — a silent overwrite. Ask first, and only
+                  // then retry against the rev we just learned.
+                  if (result.conflict === true && !allowOverwrite) {
+                    if (askConfirm(t('editor.conflictOverwrite'), 'allow') === CONFIRM_YES) commit(revOf(), true)
+                  }
+                })
+              }
+              commit(revOf(), false)
             },
           }),
           // The editor is an early return, so it must render its OWN error
@@ -2875,9 +2982,15 @@ window.__ModuleLoader__.load({
         feedbackCard,
         // F12: the non-loopback warning stays high in the panel — directly
         // under the feedback entry — so it cannot be missed.
+        // Two different situations, two different texts: with the host fence
+        // attached the route is NOT open to the LAN (it needs a signed-in
+        // browser session), so claiming "no authentication" would be a false
+        // alarm. `authFence` is what the route itself checked on this request.
         security.hostGuarded === false
           ? h('div', { className: 'im-hostwarn', key: 'hostwarn' },
-            t('diag.hostWarn', { host: security.boundHost !== '' ? security.boundHost : '?' }))
+            security.authFence === true
+              ? t('diag.hostWarnFence', { host: security.boundHost !== '' ? security.boundHost : '?' })
+              : t('diag.hostWarn', { host: security.boundHost !== '' ? security.boundHost : '?' }))
           : null,
         h('div', { className: 'im-row' },
           h('div', null,
@@ -3666,7 +3779,18 @@ window.__ModuleLoader__.load({
       // published before or after this plugin activates.
       runtimeCtx = ctx
 
-      const resolveSlots = () => (ctx.slots !== undefined ? ctx.slots : ctx.get('slots'))
+      const resolveSlots = () => {
+        // ctx.get() can throw on a disposed context, and this call sits outside
+        // safeMount's try — an escaping throw here killed the retry timer with
+        // no message anywhere.
+        try {
+          return ctx.slots !== undefined ? ctx.slots : ctx.get('slots')
+        } catch (err) {
+          console.error('[instruction-memory] 读取 slots 服务失败：'
+            + (err !== null && err !== undefined && typeof err.message === 'string' ? err.message : String(err)))
+          return undefined
+        }
+      }
 
       // A retry can fire after the fiber was disposed (plugin disabled, host
       // shutting down); registering into a dead context throws, and an uncaught
@@ -3676,7 +3800,12 @@ window.__ModuleLoader__.load({
         try {
           mountPanel(ctx, target)
           return true
-        } catch {
+        } catch (err) {
+          // F19: this used to swallow the throw outright — the panel simply
+          // never appeared and nothing anywhere said so.
+          const detail = '注册设置页时抛出异常：' + (err !== null && err !== undefined && typeof err.message === 'string' ? err.message : String(err))
+          console.error('[instruction-memory] ' + detail)
+          showMountFailureNotice(detail)
           return false
         }
       }
@@ -3696,10 +3825,10 @@ window.__ModuleLoader__.load({
           return
         }
         if (attempt >= SLOT_RETRY_LIMIT) {
-          console.error(
-            '[instruction-memory] slots service unavailable after '
-            + (SLOT_RETRY_LIMIT * SLOT_RETRY_DELAY_MS) + 'ms of retries; settings page not registered',
-          )
+          const detail = '宿主没有发布 slots 服务（重试 '
+            + SLOT_RETRY_LIMIT + ' 次，约 ' + (SLOT_RETRY_LIMIT * SLOT_RETRY_DELAY_MS) + 'ms）'
+          console.error('[instruction-memory] ' + detail + '；settings page not registered')
+          showMountFailureNotice(detail)
           return
         }
         schedule(retry)
@@ -3707,6 +3836,120 @@ window.__ModuleLoader__.load({
       schedule(retry)
     }
 
+    /**
+     * R8: read the running plugin version for the mount-failure notice.
+     *
+     * The settings route does not depend on `slots`, so `state` normally
+     * answers even when the panel could not mount — which is exactly the
+     * moment someone copies a version number into a bug report. Best effort in
+     * every direction: no `fetch`, no route, a refusal by the host's auth
+     * gate, a timeout or a malformed body all resolve to null, and the notice
+     * simply omits the line.
+     */
+    function probePluginVersion() {
+      try {
+        if (typeof fetch !== 'function') return Promise.resolve(null)
+        const controller = typeof AbortController === 'function' ? new AbortController() : null
+        const options = {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({ method: 'state', args: null }),
+        }
+        if (controller !== null) {
+          options.signal = controller.signal
+          const timer = setTimeout(() => controller.abort(), 2000)
+          if (timer !== null && typeof timer === 'object' && typeof timer.unref === 'function') timer.unref()
+        }
+        return fetch(apiEndpoint(), options)
+          .then((response) => (response.ok === true ? response.json() : null))
+          .then((payload) => (payload !== null && payload !== undefined
+            && payload.ok === true
+            && payload.snapshot !== null && typeof payload.snapshot === 'object'
+            && typeof payload.snapshot.pluginVersion === 'string'
+            && payload.snapshot.pluginVersion !== ''
+            ? payload.snapshot.pluginVersion
+            : null))
+          .catch(() => null)
+      } catch {
+        return Promise.resolve(null)
+      }
+    }
+
+    /**
+     * F19: make a failed mount VISIBLE instead of console-only.
+     *
+     * The panel is how the user sees and edits their memory. When `slots` never
+     * resolves, the previous code wrote one console.error: the plugin looked
+     * installed, the settings page had no section, and nothing told the user
+     * why. A console line is not a user interface.
+     *
+     * The notice is deliberately dependency-free — plain DOM, inline styles,
+     * `textContent` only (never innerHTML) — because the very thing that failed
+     * is the service that would supply a styled component. It is non-modal and
+     * self-removing so it cannot become a permanent artefact of a transient
+     * race (a late `slots` publish still mounts the panel; the banner then
+     * only says the panel appeared late).
+     */
+    function showMountFailureNotice(detail) {
+      try {
+        if (typeof document === 'undefined' || document.body === null) return
+        const id = 'dsh-instruction-memory-mount-failure'
+        const existing = document.getElementById(id)
+        if (existing !== null) existing.remove()
+
+        const box = document.createElement('div')
+        box.id = id
+        box.setAttribute('role', 'status')
+        box.style.cssText = [
+          'position:fixed', 'right:16px', 'bottom:16px', 'z-index:2147483000',
+          'max-width:min(380px,calc(100vw - 32px))',
+          'background:#3a1d1d', 'color:#ffe8e8', 'border:1px solid #7a3a3a',
+          'border-radius:10px', 'padding:12px 14px',
+          'font:13px/1.5 system-ui,-apple-system,Segoe UI,sans-serif',
+          'box-shadow:0 8px 24px rgba(0,0,0,.45)',
+        ].join(';')
+
+        const title = document.createElement('div')
+        title.style.cssText = 'font-weight:600;margin-bottom:4px'
+        title.textContent = '指令记忆：设置页挂载失败'
+        box.appendChild(title)
+
+        const body = document.createElement('div')
+        body.textContent = detail
+        box.appendChild(body)
+
+        const hint = document.createElement('div')
+        hint.style.cssText = 'margin-top:6px;opacity:.75'
+        hint.textContent = '记忆注入本身仍在工作；请检查宿主版本与插件日志，或重装插件后刷新页面。'
+        box.appendChild(hint)
+
+        const close = document.createElement('button')
+        close.type = 'button'
+        close.textContent = '关闭'
+        close.style.cssText = 'margin-top:8px;background:transparent;color:#ffe8e8;border:1px solid #7a3a3a;border-radius:6px;padding:2px 10px;cursor:pointer;font:inherit'
+        close.addEventListener('click', () => box.remove())
+        box.appendChild(close)
+
+        document.body.appendChild(box)
+        // R8: name the running version. Appended after the banner exists so a
+        // slow or refused probe can never delay the warning itself.
+        probePluginVersion().then((version) => {
+          if (version === null) return
+          const meta = document.createElement('div')
+          meta.style.cssText = 'margin-top:6px;opacity:.75'
+          meta.textContent = '插件版本 ' + version
+          box.appendChild(meta)
+        }).catch(() => {})
+        // Non-modal and self-removing: a failure that persists past 30 s has
+        // already been reported once; leaving a banner on screen forever is
+        // worse than a dismissible one the user can re-trigger by reloading.
+        const timer = setTimeout(() => box.remove(), 30000)
+        if (timer !== null && typeof timer === 'object' && typeof timer.unref === 'function') timer.unref()
+      } catch {
+        // A banner is a courtesy: never let it be the reason the plugin throws.
+      }
+    }
+
     function schedule(fn) {
       const timer = setTimeout(fn, SLOT_RETRY_DELAY_MS)
       // Never hold a process open just to finish retrying.