dsh-model-switch 0.4.35 → 0.4.36

package/CHANGELOG.md

@@ -1,3 +1,13 @@
+## v0.4.36
+
+「自动审查」不再在插件安装类重组后停在「完全权限」：Auto 选择改为**持续记录**，回放只消费真正恢复掉的会话。
+
+- **P0 root cause: the snapshot could be destroyed before it was written (`src/auto-review.ts`).** `persistAutoSnapshot()` read the live session list at release time and **deleted the file whenever that read came back empty**. Two release orderings make it come back empty: the official gate's teardown can flip the `auto` sessions to the fallback preset *before* our teardown effect runs (a plugin install / bundle edit recompose reorders the rows), and a row that is going away can lose access to the session service entirely (`rememberAuto()` swallowed the error and returned `[]`). Either way the record was removed — `$DSH_HOME/model-switch/` was observed empty afterwards — and the next `claim()` had nothing to replay. Session-log evidence: four recomposes flipped and restored the selection within ~60 ms, and the single recompose that added a plugin row (18:20:56Z) flipped it and never restored.
+- **Fix 1: a continuous record that survives reordering.** Every session's `permission/preset` feed is wired to the record as the session is seen; a change that arrives while this row has released the registration is the official teardown flip (not a user choice) and keeps its id recorded, anything else removes it. Release-time `persistAutoSnapshot()` now merges the live read **into** that record instead of replacing it, so an empty or failed read can no longer destroy the selection.
+- **Fix 2: a replay consumes only what it restored (`src/auto-sessions-state.ts`).** `planAutoSnapshotReplay()` splits the recorded ids into the ones a live session claims and the rest; the rest stay in the file with their **original** `savedAt` — an early claim cannot eat the selection of sessions that load later, and the 15-minute replay window is not restarted behind the user's back. `flushAutoSnapshot()` removes the file only once every recorded id has been replayed.
+- **Tests.** `tests/auto-sessions-state.spec.ts` adds the timestamp-preserving decode, the merge semantics that pin the out-of-order teardown case, the empty-list no-consume case, and a repeated-recompose pass that narrows the record to empty. `pnpm run check` green (56 test files / **504** tests + pack gate).
+- **Lab verification (official 0.2.1-rc.2, `DSH_HOME=~/.dsh-lab`, port 3082) — and one gap it exposed, now closed.** The build was installed in both lab profiles and driven against the released `0.4.35` as the A/B: with a session on「自动审查」the plugin was removed and re-added, a new plugin row was inserted through `cordis.patch.yml`, and a bundle-list change forced a recompose. The record half of the fix ran end to end there — a teardown wrote `auto-sessions.json` with the exact session id, the record survived the plugin being absent, and the next mount's replay consumed it. That replay is what the lab caught being incomplete: a claim runs before the web Host has lazily loaded the session, so ids could sit in the file forever with nobody to consume them. The replay now also runs whenever a session is observed, on tool-call activity, and from a bounded 10-second sweep while the record holds ids — the file observed still pending after a plugin swap was consumed by the next session load. The flip itself (`auto` → `danger-full-access`) does not reproduce in the lab — even a full plugin removal leaves the stored preset name untouched there — so that scenario stays covered by the desktop session-log forensics above and the out-of-order teardown tests.
+
 ## v0.4.35
 
 「自动审查」不再在每次热重载后掉回「完全权限」：释放 Auto 注册之前先把当时选着 Auto 的会话落盘，重新认领后按 id 恢复。