dsh-model-switch 0.4.34 → 0.4.35

package/CHANGELOG.md

@@ -1,3 +1,12 @@
+## v0.4.35
+
+「自动审查」不再在每次热重载后掉回「完全权限」：释放 Auto 注册之前先把当时选着 Auto 的会话落盘，重新认领后按 id 恢复。
+
+- **P0 root cause: every release moves the selection, and the in-memory guard dies with the row (`src/auto-review.ts`).** The official gate's teardown moves live `auto` sessions to the fallback preset (`danger-full-access`) by design. This row triggers that teardown on both of its release paths: the `yieldRegistration` seam the takeover runs before a recompose, and its own row disposal during a hot reload. `preserveAuto` could not cover either window — it remembers around an **in-process** action, but a reload loses the selection before anything of ours runs again, and the next mount's `rememberAuto()` returns `[]` because the sessions were already flipped. The user-visible symptom: the session kept reverting from「自动审查」to「完全权限」, reproducibly **at the moment `cordis.patch.yml` was edited** (any profile patch edit forces a recompose).
+- **Fix: durable snapshot + replay (`src/auto-sessions-state.ts`, `src/auto-review.ts`).** `persistAutoSnapshot()` writes the ids of the sessions currently on Auto to `$DSH_HOME/model-switch/auto-sessions.json` **before** each release — from the takeover's `yieldRegistration` seam and from the last-registered teardown effect (the first thing to run on disposal). `claim()` then calls `flushAutoSnapshot()` once the registration is held again, restoring exactly those sessions and consuming the file. A snapshot is rejected after 15 minutes (`AUTO_SESSION_STATE_MAX_AGE_MS`), so a later restart cannot resurrect a preset the user has since chosen; every malformed shape degrades to a no-op, and a read-only `DSH_HOME` never blocks the release.
+- **Tests.** New `tests/auto-sessions-state.spec.ts` pins the round trip, dedupe and dropping of non-string ids, the malformed-shape matrix (missing, empty, invalid JSON, wrong shape, non-numeric `savedAt`), and the 15-minute replay window. `pnpm run check` green (56 test files / **500** tests + pack gate).
+- **Live verification (before tagging).** The build was installed into the real desktop profile and the web UI was driven over CDP from this machine: the session was switched to「自动审查」, a `cordis.patch.yml` edit forced a recompose — the exact action that used to flip the preset — and the preset chip in the live page still read「自动审查」afterwards. The snapshot directory (`$DSH_HOME/model-switch/`) was created and consumed by the same recompose, so the persist → replay path ran end to end.
+
 ## v0.4.34
 
 The「停用失败：dsh: warning: 1 entry did not activate auto-review … permission: preset "auto" is already registered」toast is gone: every official-row activation now gets the registration yielded first, and this row releases the slot in the first synchronous step of its own teardown.