dsh-model-switch 0.4.34 → 0.4.36

package/CHANGELOG.md

@@ -1,3 +1,22 @@
+## v0.4.36
+
+「自动审查」不再在插件安装类重组后停在「完全权限」：Auto 选择改为**持续记录**，回放只消费真正恢复掉的会话。
+
+- **P0 root cause: the snapshot could be destroyed before it was written (`src/auto-review.ts`).** `persistAutoSnapshot()` read the live session list at release time and **deleted the file whenever that read came back empty**. Two release orderings make it come back empty: the official gate's teardown can flip the `auto` sessions to the fallback preset *before* our teardown effect runs (a plugin install / bundle edit recompose reorders the rows), and a row that is going away can lose access to the session service entirely (`rememberAuto()` swallowed the error and returned `[]`). Either way the record was removed — `$DSH_HOME/model-switch/` was observed empty afterwards — and the next `claim()` had nothing to replay. Session-log evidence: four recomposes flipped and restored the selection within ~60 ms, and the single recompose that added a plugin row (18:20:56Z) flipped it and never restored.
+- **Fix 1: a continuous record that survives reordering.** Every session's `permission/preset` feed is wired to the record as the session is seen; a change that arrives while this row has released the registration is the official teardown flip (not a user choice) and keeps its id recorded, anything else removes it. Release-time `persistAutoSnapshot()` now merges the live read **into** that record instead of replacing it, so an empty or failed read can no longer destroy the selection.
+- **Fix 2: a replay consumes only what it restored (`src/auto-sessions-state.ts`).** `planAutoSnapshotReplay()` splits the recorded ids into the ones a live session claims and the rest; the rest stay in the file with their **original** `savedAt` — an early claim cannot eat the selection of sessions that load later, and the 15-minute replay window is not restarted behind the user's back. `flushAutoSnapshot()` removes the file only once every recorded id has been replayed.
+- **Tests.** `tests/auto-sessions-state.spec.ts` adds the timestamp-preserving decode, the merge semantics that pin the out-of-order teardown case, the empty-list no-consume case, and a repeated-recompose pass that narrows the record to empty. `pnpm run check` green (56 test files / **504** tests + pack gate).
+- **Lab verification (official 0.2.1-rc.2, `DSH_HOME=~/.dsh-lab`, port 3082) — and one gap it exposed, now closed.** The build was installed in both lab profiles and driven against the released `0.4.35` as the A/B: with a session on「自动审查」the plugin was removed and re-added, a new plugin row was inserted through `cordis.patch.yml`, and a bundle-list change forced a recompose. The record half of the fix ran end to end there — a teardown wrote `auto-sessions.json` with the exact session id, the record survived the plugin being absent, and the next mount's replay consumed it. That replay is what the lab caught being incomplete: a claim runs before the web Host has lazily loaded the session, so ids could sit in the file forever with nobody to consume them. The replay now also runs whenever a session is observed, on tool-call activity, and from a bounded 10-second sweep while the record holds ids — the file observed still pending after a plugin swap was consumed by the next session load. The flip itself (`auto` → `danger-full-access`) does not reproduce in the lab — even a full plugin removal leaves the stored preset name untouched there — so that scenario stays covered by the desktop session-log forensics above and the out-of-order teardown tests.
+
+## v0.4.35
+
+「自动审查」不再在每次热重载后掉回「完全权限」：释放 Auto 注册之前先把当时选着 Auto 的会话落盘，重新认领后按 id 恢复。
+
+- **P0 root cause: every release moves the selection, and the in-memory guard dies with the row (`src/auto-review.ts`).** The official gate's teardown moves live `auto` sessions to the fallback preset (`danger-full-access`) by design. This row triggers that teardown on both of its release paths: the `yieldRegistration` seam the takeover runs before a recompose, and its own row disposal during a hot reload. `preserveAuto` could not cover either window — it remembers around an **in-process** action, but a reload loses the selection before anything of ours runs again, and the next mount's `rememberAuto()` returns `[]` because the sessions were already flipped. The user-visible symptom: the session kept reverting from「自动审查」to「完全权限」, reproducibly **at the moment `cordis.patch.yml` was edited** (any profile patch edit forces a recompose).
+- **Fix: durable snapshot + replay (`src/auto-sessions-state.ts`, `src/auto-review.ts`).** `persistAutoSnapshot()` writes the ids of the sessions currently on Auto to `$DSH_HOME/model-switch/auto-sessions.json` **before** each release — from the takeover's `yieldRegistration` seam and from the last-registered teardown effect (the first thing to run on disposal). `claim()` then calls `flushAutoSnapshot()` once the registration is held again, restoring exactly those sessions and consuming the file. A snapshot is rejected after 15 minutes (`AUTO_SESSION_STATE_MAX_AGE_MS`), so a later restart cannot resurrect a preset the user has since chosen; every malformed shape degrades to a no-op, and a read-only `DSH_HOME` never blocks the release.
+- **Tests.** New `tests/auto-sessions-state.spec.ts` pins the round trip, dedupe and dropping of non-string ids, the malformed-shape matrix (missing, empty, invalid JSON, wrong shape, non-numeric `savedAt`), and the 15-minute replay window. `pnpm run check` green (56 test files / **500** tests + pack gate).
+- **Live verification (before tagging).** The build was installed into the real desktop profile and the web UI was driven over CDP from this machine: the session was switched to「自动审查」, a `cordis.patch.yml` edit forced a recompose — the exact action that used to flip the preset — and the preset chip in the live page still read「自动审查」afterwards. The snapshot directory (`$DSH_HOME/model-switch/`) was created and consumed by the same recompose, so the persist → replay path ran end to end.
+
 ## v0.4.34
 
 The「停用失败：dsh: warning: 1 entry did not activate auto-review … permission: preset "auto" is already registered」toast is gone: every official-row activation now gets the registration yielded first, and this row releases the slot in the first synchronous step of its own teardown.