dsh-locator 0.9.0 → 0.10.1

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## 0.10.1 — 2026-11-12
+
+Watcher hotfix for 0.10.0.
+
+* Transient `ENOENT`/`ENOTDIR` during the native watcher's directory walk (pnpm `_tmp`, editor swap files, build outputs disappearing between readdir and lstat) no longer marks the watcher degraded and starts a 30-minute refresh fallback. Those entries are treated as normal churn; only persistent permission/limit failures degrade coverage.
+* The engine status route and `locator_status` now expose `watchDegraded`, `watchReason`, `watchRoots` and `refreshFallback`, and the panel shows `watcher degraded; periodic refresh active` instead of silently claiming native watching.
+* Six engine binaries rebuilt as 0.10.1 (darwin remains the local kqueue dev fallback; release/CI builds the cgo/FSEvents artifact).
+
+## 0.10.0 — 2026-11-12
+
+Full-plugin hardening pass from a 20-agent audit. This release focuses on stability, release integrity, security boundaries, client correctness and performance rather than new search features.
+
+**Stability / performance**
+* Whole-word content search now has a hard scan budget (rows, bytes, time) and stops with a bounded count + `scan-capped` warning instead of scanning an unbounded corpus.
+* A content worker timeout no longer falls back to the same query on the host event loop; it returns `content-search-timeout` (or a worker error) and discards the stuck worker. This removes the multi-second DSH freeze.
+* Content queries are bounded to 256 characters / 32 terms / 3 characters per term; shorter or over-long queries return explicit errors instead of a full-table LIKE/GLOB scan. NUL/control characters are rejected. emoji are counted by code point.
+* Content refresh reuses a successful parse before replacing a session; a read/decompression failure keeps the old messages and retries next refresh. `maxFiles` no longer deletes tail documents after a transient read failure. Corrupt/zero-byte/old-schema content databases are quarantined and rebuilt.
+* Engine: generation only advances on real changes; snapshot save is dirty-debounced (60 s quiet / 5 min max) and shutdown skips an unchanged snapshot; `sort=path` no longer builds a path map for every hit; dump supports `since`/`mtimeFrom`; watcher reports degraded/fallback state and `--refresh 0` disables periodic rebuilds; Windows roots/handles stay paired.
+* Six engine binaries are rebuilt at 0.10.0; the release workflow rebuilds Linux/Windows on Ubuntu and darwin with cgo/FSEvents on macOS, verifies versions, and refuses to publish from a red CI commit.
+
+**Security / boundaries**
+* HTTP panel routes now require the DSH `connection` service (fail-closed), enforce POST + JSON content-type, same-origin Fetch metadata, 64 KiB body limit and proper 400/405/413/415/503 responses.
+* `/reveal` and `/open` resolve real paths and reject symlink escapes from the indexed roots; `/open` rejects executable/script extensions. `locator_export` defaults to the plugin state directory, validates ownership before overwrite and writes atomically; `locator_rebuild` only accepts configured roots/excludes subsets.
+* `locator_find` now exposes `matchMode`, `caseSensitive`, `wholeWord`, `sessionId`, `count`, `countLimit`, `pathPrefix` and defaults to **workspace scope** (caller session for session hits, caller cwd for file hits); `scope: 'all'` is explicit cross-workspace access. The tool description, count/warnings and session/message references are rendered for the agent.
+
+**Client**
+* Panel result rows keep focus, so Esc/arrow/F3/Enter work after clicking a hit; a document-level Escape fallback closes the panel; Ctrl+Shift+F ignores host modals, editors/terminals, key repeat and AltGr.
+* Unified visible-text projection for the find bar and jump: soft newlines/`<br>` collapse to a space outside `<pre>`, CJK soft-wrapped phrases match, KaTeX/sr-only/aria-live/status text is excluded; the projection uses segment maps instead of one object per character.
+* Assistant steps rendered as two rows with the same node key now prefer the response row; anchored hits no longer fall back to an unrelated phrase in the loaded window, and older pages are loaded until the anchor exists.
+* Regular expressions prefer the Unicode `u` flag (so `\p{L}`/`\p{Script=Han}` work) and never fall back to a main-thread regex when the worker is blocked or times out; the find bar reports the timeout/unavailable state.
+* The panel renders content warnings, scan caps, budget truncation and query errors as information instead of a retryable failure; footer/group counts use the exact/bounded count consistently; content queries need 3 characters (shorter searches use Ctrl+F).
+* One-shot toast/insert/reveal timers are tracked and cleared; plugin disposal resets overlay state.
+
+**Upgrade notes**
+* No content schema change. 0.10.0 runs on schema v3; the engine binary version changes to 0.10.0.
+* Content search minimum length is 3 characters; use the in-conversation find bar (`Ctrl+F`) for 1–2 character searches.
+* `locator_find` is workspace-scoped by default; pass `scope: 'all'` for cross-workspace session/file content.
+* Panel routes require the stock web `connection` service; custom compositions without it will not mount them (intentional fail-closed).
+* `locator_export` writes under the plugin state directory by default; pass `allowOutsideStateDir: true` only for a deliberate external export. Importing an existing arbitrary file is refused.
+
+**Tests**: 122 tests across content, combined, HTTP, tools, find, plugin, runtime, export, reveal and lag suites; CI runs Node 22/24 on Linux/Windows/macOS with rebuilt engines and fail-on-skip gates.
+
 ## 0.9.0 — 2026-11-12
 
 Advanced find and a two-surface search model, informed by Notepad++/Notepad--/VS Code and a live-DB benchmark.

package/README-es.md

@@ -401,6 +401,15 @@ DeepSeek Harness
 
 El motor es un único proceso Go y respeta las variables estándar `GOMEMLIMIT` y `GOGC` (o `memoryLimitMB` en la configuración). Un índice de 1,2–1,5 M de entradas alcanza varios cientos de MB de RSS con el GC por defecto; usa `GOMEMLIMIT=600MiB` (límite blando, el runtime cambia CPU por memoria) o `GOGC=50` cuando el host vaya justo de RAM. Ninguno cambia el formato de la instantánea. En la instalación en vivo usada para las cifras anteriores, el proceso anfitrión de DSH (incluida la caché de páginas de la base de contenido) rondaba los 700 MB de RSS con el índice construido, y la latencia del host en reposo se mantenía en p50 2 ms.
 
+## Notas de actualización 0.10.0
+
+- La búsqueda de contenido requiere al menos **3 caracteres**; usa `Ctrl+F` para 1–2. Se rechazan consultas de más de 256 caracteres o 32 términos.
+- `locator_find` usa **ámbito workspace** por defecto (sesión del llamador y su cwd); para cruzar workspaces pasa `scope: "all"`. Nuevos parámetros: `matchMode`, `caseSensitive`, `wholeWord`, `sessionId`, `count`, `countLimit`, `pathPrefix`.
+- Las rutas HTTP del panel exigen el servicio `connection` de DSH (fail-closed) y POST + JSON + mismo origen; el perfil web estándar no cambia.
+- `locator_export` escribe por defecto en el stateDir del plugin y valida la propiedad antes de sobrescribir; `locator_rebuild` solo acepta subconjuntos de roots/excludes configurados.
+- Los binarios del motor son 0.10.0: guardado de snapshot con debounce, memoria de `sort=path` acotada, watcher con estado degradado/fallback; en macOS el release debe compilarse con cgo/FSEvents (el fallback kqueue de depuración no es publicable).
+- Cliente: clic en resultados conserva teclado/Esc; búsqueda con saltos suaves/`<br>`/CJK corregida; filas gemelas del asistente prefieren la respuesta; regex usa `u` y no cae al hilo principal; avisos/límites/truncado visibles.
+
 ## Seguridad y privacidad
 
 - El índice es local: sin llamadas de red, sin telemetría, sin subidas. El plugin nunca modifica, mueve ni borra archivos indexados.

package/README-hi.md

@@ -402,6 +402,15 @@ DeepSeek Harness
 
 इंजन एक Go प्रोसेस है और मानक `GOMEMLIMIT` और `GOGC` (या कॉन्फ़िग में `memoryLimitMB`) मानता है। 1.2–1.5 M एंट्री का इंडेक्स डिफ़ॉल्ट GC के साथ कई सौ MB RSS तक जाता है; होस्ट पर RAM कम हो तो `GOMEMLIMIT=600MiB` (सॉफ़्ट सीमा, रनटाइम CPU देकर मेमोरी बचाता है) या `GOGC=50` रखें। इनसे स्नैपशॉट फ़ॉर्मेट नहीं बदलता। ऊपर के आँकड़ों वाले लाइव सेटअप में DSH होस्ट प्रोसेस (कंटेंट डेटाबेस पेज कैश सहित) इंडेक्स बने रहने पर लगभग 700 MB RSS पर था, और खाली बैठे होस्ट की देरी p50 2ms रही।
 
+## 0.10.0 अपग्रेड नोट्स
+
+- सामग्री खोज के लिए कम से कम **3 अक्षर** चाहिए; 1–2 अक्षर के लिए `Ctrl+F` उपयोग करें। 256 अक्षर/32 शब्द से बड़ी क्वेरी अस्वीकार होती है।
+- `locator_find` डिफ़ॉल्ट **workspace स्कोप** (कॉलर सत्र और cwd) में चलता है; दूसरे workspace के लिए `scope: "all"` दें। नए पैरामीटर: `matchMode`, `caseSensitive`, `wholeWord`, `sessionId`, `count`, `countLimit`, `pathPrefix`.
+- पैनल HTTP रूट अब DSH `connection` सेवा अनिवार्य करते हैं (fail-closed) और POST + JSON + same-origin जाँचते हैं; stock web profile प्रभावित नहीं।
+- `locator_export` डिफ़ॉल्ट रूप से plugin stateDir में लिखता है और overwrite से पहले ownership जाँचता है; `locator_rebuild` केवल configured roots/excludes के subset लेता है।
+- engine बाइनरी 0.10.0 हैं: snapshot dirty-debounce, `sort=path` सीमित मेमोरी, watcher degraded/fallback; macOS रिलीज़ cgo/FSEvents से बनना चाहिए (debug kqueue fallback प्रकाशन योग्य नहीं)।
+- क्लाइंट: परिणाम-पंक्ति क्लिक के बाद भी कुंजी/Esc काम करते हैं; soft newline/`<br>`/CJK खोज ठीक; assistant twin rows में response प्राथमिक; regex Unicode `u` और worker विफलता पर main-thread fallback नहीं; सामग्री चेतावनी/सीमा/truncation दिखती है।
+
 ## सुरक्षा और गोपनीयता
 
 - इंडेक्स पूरी तरह स्थानीय है: कोई नेटवर्क कॉल नहीं, कोई टेलीमेट्री नहीं, कोई अपलोड नहीं। प्लगइन इंडेक्स की गई फ़ाइलों को कभी बदलता, हटाता या स्थानांतरित नहीं करता।

package/README-pt.md

@@ -402,6 +402,15 @@ DeepSeek Harness
 
 O motor é um único processo Go e respeita as variáveis padrão `GOMEMLIMIT` e `GOGC` (ou `memoryLimitMB` na configuração). Um índice de 1,2–1,5 M de entradas chega a várias centenas de MB de RSS com o GC padrão; use `GOMEMLIMIT=600MiB` (limite suave, o runtime troca CPU por memória) ou `GOGC=50` quando o host estiver apertado de RAM. Nenhum altera o formato do snapshot. Na instalação ao vivo usada para os números acima, o processo anfitrião do DSH (incluindo o cache de páginas do banco de conteúdo) ficava por volta de 700 MB de RSS com o índice construído, e a latência do host ocioso permanecia em p50 2 ms.
 
+## Notas de atualização 0.10.0
+
+- A busca de conteúdo exige pelo menos **3 caracteres**; use `Ctrl+F` para 1–2. Consultas com mais de 256 caracteres ou 32 termos são rejeitadas.
+- `locator_find` usa **escopo workspace** por padrão (sessão do chamador e seu cwd); para cruzar workspaces passe `scope: "all"`. Novos parâmetros: `matchMode`, `caseSensitive`, `wholeWord`, `sessionId`, `count`, `countLimit`, `pathPrefix`.
+- As rotas HTTP do painel exigem o serviço `connection` do DSH (fail-closed) e POST + JSON + mesma origem; o perfil web padrão não muda.
+- `locator_export` grava por padrão no stateDir do plugin e valida a propriedade antes de sobrescrever; `locator_rebuild` aceita apenas subconjuntos dos roots/excludes configurados.
+- Os binários do engine são 0.10.0: snapshot com debounce, memória de `sort=path` limitada, watcher com estado degradado/fallback; no macOS o release precisa ser compilado com cgo/FSEvents (o fallback kqueue de depuração não é publicável).
+- Cliente: clique nos resultados mantém teclado/Esc; busca com quebras suaves/`<br>`/CJK corrigida; linhas gêmeas do assistente preferem a resposta; regex usa `u` e não cai na thread principal; avisos/limites/truncamento visíveis.
+
 ## Segurança e privacidade
 
 - O índice é local: sem chamadas de rede, sem telemetria, sem uploads. O plugin nunca modifica, move ou apaga arquivos indexados.

package/README.en.md

@@ -170,7 +170,7 @@ Press `Ctrl+Shift+F` anywhere in the Web GUI, or click the magnifier at the side
 - **Counts**: group headers show the match count; exact when cheap, `≥ N` when capped. The header shows the selected position (`3/37`) and the footer summarises all groups. The content page path now runs rank-rowids → body-by-rowid → JS snippet/line, so common words dropped from about 2.7 s to under 300 ms.
 - **Find options**: the toolbar offers mode (Normal / Extended / Regex), `Aa` match case, whole word and a current-conversation scope. Mode/case/whole-word apply to file and folder names; content supports Normal/Extended/case/whole-word, while **regex pauses the content group** (names still allow regex) so a panel keystroke never scans the whole corpus.
 - **Current conversation scope**: only indexed messages of that session are searched (an active session is indexed after roughly two minutes), and file/folder scopes are disabled but keep their ticks. For live per-match navigation use the `Ctrl+F` find bar below.
-- Content queries need at least two characters; empty and one-character queries never start the content build. While it builds the content group shows progress and name results return immediately; scopes and find options are remembered.
+- Content queries need at least three characters; empty, one- and two-character queries never start the content build (use Ctrl+F for short searches). While it builds the content group shows progress and name results return immediately; scopes and find options are remembered.
 - Keyboard: `↑`/`↓`, `Home`/`End`, `PageUp`/`PageDown` move, `F3`/`Shift+F3` cycle result rows, `Enter` activates, `Esc` closes; the dialog traps focus and restores it on close. Panel text follows `navigator.language` (zh/en/es/pt/hi).
 
 ## Find in the conversation (Ctrl+F)
@@ -402,6 +402,15 @@ DeepSeek Harness
 
 The engine is a single Go process and honours the standard `GOMEMLIMIT` and `GOGC` environment variables (or `memoryLimitMB` in the config). A 1.2–1.5 M-entry index peaks around several hundred MB of RSS with the default GC; set `GOMEMLIMIT=600MiB` (soft limit, the runtime trades CPU for memory) or `GOGC=50` when the host is tight on RAM. Neither changes the snapshot format. In the live setup used for the numbers above, the DSH host process (including the content database page cache) sat around 700 MB RSS with the content index built, and idle host latency stayed at p50 2 ms.
 
+## 0.10.0 upgrade notes
+
+- Content search requires at least **3 characters**; use `Ctrl+F` for 1–2 character searches. Queries over 256 characters/32 terms are rejected.
+- `locator_find` defaults to **workspace scope** (session hits: the caller session; file hits: the caller cwd). Pass `scope: "all"` for explicit cross-workspace access. New parameters: `matchMode`, `caseSensitive`, `wholeWord`, `sessionId`, `count`, `countLimit`, `pathPrefix`.
+- Panel HTTP routes now require the DSH `connection` service (fail-closed) and enforce POST + JSON + same-origin Fetch metadata; the stock web profile is unaffected.
+- `locator_export` writes under the plugin state directory by default and validates ownership before overwrite; `locator_rebuild` accepts only configured roots/exclude subsets.
+- Engine binaries are 0.10.0. Snapshot saves are dirty-debounced, `sort=path` memory is bounded, watcher state reports degraded/refresh fallback; macOS release binaries must be built on macOS with cgo/FSEvents (the debug kqueue fallback is not releasable).
+- Client: result-row clicks keep keyboard/Esc working; soft newlines/`<br>`/CJK find fixed; assistant twin rows prefer the response row; regex prefers Unicode `u` and never falls back to the main thread; content warnings/caps/truncation are visible.
+
 ## Security and privacy
 
 - The index is local: no network calls, no telemetry, no uploads. The plugin never modifies, moves or deletes indexed files.

package/README.md

@@ -169,7 +169,7 @@ Everything 风格的查询语法，返回路径、大小、修改时间、扩展
 - **计数**：组头显示命中数；可精确时显示数字，受上限保护时显示 `≥ N`；头部显示当前选中位置 `3/37`，底栏汇总三组。内容页面路径已改为“先取 rank rowid、再按 rowid 取正文、JS 生成片段/行号”，常见词从约 2.7 秒降到 300 毫秒以内。
 - **查找选项**：工具栏提供模式（普通 / 扩展 / 正则）、`Aa` 大小写、全词、当前会话范围。模式和大小写/全词对文件、目录名生效；内容支持普通/扩展/大小写/全词，**正则模式下内容组自动暂停**（文件/目录仍可正则），避免全库正则扫描。
 - **当前会话范围**：勾选后只查该会话已落定的索引消息（活跃会话约有 2 分钟索引延迟），文件/目录勾选会禁用但保留；实时逐处查找请用下文的 `Ctrl+F` 会话内查找条。
-- 内容查询至少需要 2 个字符；空查询和 1 个字符的查询不会启动内容索引构建。构建期间内容组显示进度，文件名/目录结果立即返回；勾选和查找选项会记住。
+- 内容查询至少需要 3 个字符；空查询和 1–2 个字符的查询不会启动内容索引构建。构建期间内容组显示进度，文件名/目录结果立即返回；勾选和查找选项会记住。
 - 键盘：`↑`/`↓`、`Home`/`End`、`PageUp`/`PageDown` 移动，`F3`/`Shift+F3` 在结果行间循环，`Enter` 激活，`Esc` 关闭；对话框有焦点陷阱并在关闭时还原。面板文案跟随 `navigator.language`（中/英/西/葡/印地语）。
 
 ## 在会话中查找（Ctrl+F）
@@ -364,6 +364,15 @@ Go 引擎在 `engine/` 下，测试用 `cd engine && go test ./...`。macOS 的
 - 当前会话范围只覆盖已落定索引的会话消息（活跃会话约 2 分钟延迟）；实时查找用 `Ctrl+F`。会话内查找条只覆盖已加载窗口，更早历史需手动加载。
 - 会话内高亮依赖 CSS Custom Highlight API；不支持它的旧浏览器会退化为整行描边。
 
+## 0.10.0 升级注意
+
+- 内容搜索最短 **3 个字符**；1–2 字符请用 `Ctrl+F` 会话内查找。查询超过 256 字符/32 个词会直接报错。
+- `locator_find` 默认 **workspace 范围**（会话只查调用者当前会话，文件正文只查调用者 cwd）；跨工作区需显式传 `scope: "all"`。新增 `matchMode`/`caseSensitive`/`wholeWord`/`sessionId`/`count`/`pathPrefix` 参数。
+- 面板 HTTP 路由现在**硬依赖 DSH `connection` 服务**（缺失则不挂载/503），并强制 POST + JSON + 同源校验；stock web profile 正常。
+- `locator_export` 默认只写插件 stateDir，覆盖前校验是否本工具生成的 SQLite；`locator_rebuild` 只接受配置 roots/excludes 的子集。
+- 引擎二进制版本为 0.10.0；快照保存改为脏数据 debounce、`sort=path` 内存修复、watcher 降级/refresh fallback；macOS 发布版必须由 macOS cgo/FSEvents 构建，debug kqueue fallback 不能发布。
+- 客户端：面板点击结果后键盘/Esc 保持；软换行/`<br>`/CJK 查找修复；assistant 同 nodeKey 双行优先回复行；正则优先 Unicode `u` 且 worker 失败不再回退主线程；内容错误/警告/截断在面板可见。
+
 ## 安全与隐私
 
 - 索引完全在本地：不联网、不上传、不埋点；插件不会修改、移动或删除被索引的文件。