dsh-plugin-compat-check 0.1.4 → 0.1.5

package/kernel/lib/upgrade-input.mjs

@@ -0,0 +1,309 @@
+/** Private bounded static snapshots. Target files are data, never modules. */
+import fs from "node:fs";
+import os from "node:os";
+import { runWorkerTask } from "./worker-analysis.mjs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+
+export const sha256 = (bytes) =>
+  createHash("sha256").update(bytes).digest("hex");
+export const UPGRADE_CAPTURE_LIMITS = Object.freeze({
+  bytes: 256 * 1024 * 1024,
+  fileBytes: 8 * 1024 * 1024,
+  entries: 50000,
+  depth: 32,
+  timeMs: 10000,
+});
+const stamp = (s) => [s.dev, s.ino, s.size, s.mtimeMs, s.ctimeMs];
+const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+const inside = (root, file) =>
+  file === root || file.startsWith(root + path.sep);
+const fail = (message) => new Error(`升级预检输入无法稳定捕获：${message}`);
+
+/** Worker-only capture into the root already owned by its supervisor. */
+export function captureUpgradeInputOwned(nm, overrides = {}, root) {
+  const limits = { ...UPGRADE_CAPTURE_LIMITS, ...overrides };
+  for (const [key, value] of Object.entries(limits))
+    if (
+      !Object.hasOwn(UPGRADE_CAPTURE_LIMITS, key) ||
+      !Number.isSafeInteger(value) ||
+      value <= 0 ||
+      value > UPGRADE_CAPTURE_LIMITS[key]
+    )
+      throw fail("无效捕获预算 " + key);
+  if (typeof nm !== "string" || !nm) throw fail("node_modules 路径缺失");
+  const snapshotNm = path.join(root, "node_modules"),
+    started = Date.now();
+  const observe = (copy) => {
+    let bytes = 0,
+      entries = 0;
+    const records = [],
+      packages = [],
+      inventory = [];
+    const check = () => {
+      if (
+        bytes > limits.bytes ||
+        entries > limits.entries ||
+        Date.now() - started > limits.timeMs
+      )
+        throw fail("捕获预算超限，不发布部分输入");
+    };
+    const list = (dir) => {
+      const before = fs.lstatSync(dir);
+      if (!before.isDirectory() || fs.realpathSync(dir) !== dir)
+        throw fail("目录身份变化");
+      const names = fs.readdirSync(dir).sort();
+      entries += names.length;
+      check();
+      records.push(["directory", dir, stamp(before), names]);
+      return { names, before };
+    };
+    const verifyDir = (dir, { names, before }) => {
+      if (
+        !same(stamp(before), stamp(fs.lstatSync(dir))) ||
+        !same(names, fs.readdirSync(dir).sort()) ||
+        fs.realpathSync(dir) !== dir
+      )
+        throw fail("目录在读取时变化");
+    };
+    const read = (file) => {
+      let fd;
+      try {
+        const before = fs.lstatSync(file);
+        if (!before.isFile() || fs.realpathSync(file) !== file)
+          throw fail("文件包含链接或不是普通文件");
+        bytes += before.size;
+        check();
+        if (before.size > limits.fileBytes) throw fail("单文件预算超限");
+        fd = fs.openSync(
+          file,
+          fs.constants.O_RDONLY |
+            fs.constants.O_NOFOLLOW |
+            fs.constants.O_NONBLOCK,
+        );
+        const opened = fs.fstatSync(fd);
+        if (!opened.isFile() || !same(stamp(before), stamp(opened)))
+          throw fail("文件身份变化");
+        const buffer = Buffer.alloc(before.size + 1);
+        let length = 0,
+          n;
+        while (
+          length < buffer.length &&
+          (n = fs.readSync(fd, buffer, length, buffer.length - length, null))
+        )
+          length += n;
+        if (
+          length !== before.size ||
+          !same(stamp(before), stamp(fs.fstatSync(fd))) ||
+          !same(stamp(before), stamp(fs.lstatSync(file))) ||
+          fs.realpathSync(file) !== file
+        )
+          throw fail("文件在读取时变化");
+        const data = buffer.subarray(0, length);
+        records.push(["file", file, stamp(before), sha256(data)]);
+        return data;
+      } finally {
+        if (fd !== undefined) fs.closeSync(fd);
+      }
+    };
+    const write = (dest, data) => {
+      if (!copy) return;
+      fs.mkdirSync(path.dirname(dest), { recursive: true, mode: 0o700 });
+      fs.writeFileSync(dest, data, { flag: "wx", mode: 0o400 });
+    };
+    const walk = (
+      source,
+      dest,
+      packageRoot,
+      packageDest,
+      rows,
+      relative = "",
+      depth = 0,
+    ) => {
+      if (depth > limits.depth) throw fail("目录深度预算超限");
+      check();
+      const stat = fs.lstatSync(source);
+      if (stat.isSymbolicLink()) {
+        const target = fs.readlinkSync(source);
+        let real = null;
+        try {
+          real = fs.realpathSync(source);
+        } catch (e) {
+          if (!["ENOENT", "ELOOP"].includes(e.code)) throw e;
+        }
+        records.push(["link", source, stamp(stat), target, real]);
+        rows.push([relative, "symlink", target]);
+        if (copy) {
+          // Escaped/broken links stay visibly unresolved inside the owned tree.
+          const newTarget =
+            real && inside(packageRoot, real)
+              ? path.join(packageDest, path.relative(packageRoot, real))
+              : path.join(root, "unresolved-links", sha256(relative));
+          fs.symlinkSync(path.relative(path.dirname(dest), newTarget), dest);
+        }
+      } else if (stat.isDirectory()) {
+        const observed = list(source);
+        rows.push([relative, "directory"]);
+        if (copy) fs.mkdirSync(dest, { recursive: true, mode: 0o700 });
+        for (const name of observed.names)
+          walk(
+            path.join(source, name),
+            path.join(dest, name),
+            packageRoot,
+            packageDest,
+            rows,
+            relative ? relative + "/" + name : name,
+            depth + 1,
+          );
+        verifyDir(source, observed);
+      } else if (stat.isFile()) {
+        const data = read(source);
+        rows.push([relative, data.length, sha256(data)]);
+        write(dest, data);
+      } else throw fail("不支持设备、管道等输入类型");
+    };
+    const canonical = fs.realpathSync(nm),
+      nmLink = fs.lstatSync(nm);
+    records.push(["node_modules", nm, stamp(nmLink), canonical]);
+    const observed = list(canonical);
+    if (copy) fs.mkdirSync(snapshotNm, { mode: 0o700 });
+    for (const entry of observed.names) {
+      let bases = [entry],
+        scopeObservation;
+      if (entry.startsWith("@")) {
+        scopeObservation = list(path.join(canonical, entry));
+        bases = scopeObservation.names.map((name) => path.join(entry, name));
+      }
+      for (const base of bases) {
+        const source = path.join(canonical, base);
+        let packageRoot;
+        try {
+          packageRoot = fs.realpathSync(source);
+        } catch (e) {
+          if (e.code === "ENOENT") {
+            records.push(["missing", source]);
+            continue;
+          }
+          throw e;
+        }
+        const packageStat = fs.lstatSync(source);
+        records.push(["package-root", source, stamp(packageStat), packageRoot]);
+        if (!fs.lstatSync(packageRoot).isDirectory()) continue;
+        const manifest = path.join(packageRoot, "package.json");
+        let data;
+        try {
+          data = read(manifest);
+        } catch (e) {
+          if (["ENOENT", "ENOTDIR"].includes(e.code)) {
+            records.push(["no-manifest", source]);
+            continue;
+          }
+          throw e;
+        }
+        let meta;
+        try {
+          meta = JSON.parse(data);
+        } catch {
+          /* Keep invalid metadata for inventory diagnostics. */
+        }
+        const plugin =
+          meta &&
+          typeof meta === "object" &&
+          !Array.isArray(meta) &&
+          "dsh" in meta &&
+          !String(meta.name ?? "").startsWith("@deepseek-ai/");
+        const dest = path.join(snapshotNm, base),
+          rows = [];
+        if (plugin) {
+          const name = typeof meta.name === "string" ? meta.name : base;
+          if (packages.some((item) => item.name === name))
+            throw fail("同名插件重复安装，无法按插件身份可靠比较：" + name);
+          walk(packageRoot, dest, packageRoot, dest, rows);
+          packages.push({
+            name: typeof meta.name === "string" ? meta.name : base,
+            version: typeof meta.version === "string" ? meta.version : null,
+            sha256: sha256(JSON.stringify(rows)),
+          });
+        } else write(path.join(dest, "package.json"), data);
+        inventory.push([
+          base,
+          sha256(data),
+          plugin ? sha256(JSON.stringify(rows)) : null,
+        ]);
+      }
+      if (scopeObservation)
+        verifyDir(path.join(canonical, entry), scopeObservation);
+    }
+    verifyDir(canonical, observed);
+    if (
+      fs.realpathSync(nm) !== canonical ||
+      !same(stamp(nmLink), stamp(fs.lstatSync(nm)))
+    )
+      throw fail("node_modules 身份变化");
+    return {
+      signature: sha256(JSON.stringify(records)),
+      artifact: { sha256: sha256(JSON.stringify(inventory)), packages },
+    };
+  };
+  const first = observe(true),
+    second = observe(false);
+  if (first.signature !== second.signature)
+    throw fail("两次观察的目录、文件字节或链接身份不一致");
+  const freeze = (dir) => {
+    for (const e of fs.readdirSync(dir, { withFileTypes: true }))
+      if (e.isDirectory()) freeze(path.join(dir, e.name));
+    fs.chmodSync(dir, 0o500);
+  };
+  freeze(root);
+  return { nm: snapshotNm, artifact: first.artifact };
+}
+
+/** Only this closure can request deletion of its freshly allocated private root. */
+export async function captureUpgradeInput(nm, overrides = {}, { signal } = {}) {
+  if (signal?.aborted) throw abortCapture();
+  const root = await fs.promises.mkdtemp(
+    path.join(os.tmpdir(), "dsc-upgrade-input-"),
+  );
+  const owned = await fs.promises.lstat(root);
+  let disposal;
+  const dispose = () =>
+    (disposal ||= runWorkerTask(
+      new URL("./upgrade-cleanup-worker.mjs", import.meta.url),
+      { root, identity: { dev: owned.dev, ino: owned.ino } },
+      { timeoutMs: UPGRADE_CAPTURE_LIMITS.timeMs },
+    ));
+  try {
+    const snapshot = await runWorkerTask(
+      new URL("./upgrade-capture-worker.mjs", import.meta.url),
+      { nm, limits: overrides, root },
+      {
+        timeoutMs: Math.min(
+          overrides.timeMs ?? UPGRADE_CAPTURE_LIMITS.timeMs,
+          UPGRADE_CAPTURE_LIMITS.timeMs,
+        ),
+        signal,
+      },
+    );
+    return { ...snapshot, dispose };
+  } catch (error) {
+    try {
+      await dispose();
+    } catch (cleanupError) {
+      throw upgradeCleanupError(error, cleanupError);
+    }
+    throw error;
+  }
+}
+export function upgradeCleanupError(primary, cleanup) {
+  const error = new Error(
+    `${primary ? String(primary.message || primary) + "；" : ""}私有输入清理未完成：${cleanup.message || cleanup}`,
+    primary ? { cause: primary } : undefined,
+  );
+  error.code = "DSC_UPGRADE_CLEANUP_FAILED";
+  return error;
+}
+function abortCapture() {
+  const error = new Error("升级预检已取消");
+  error.code = "DSC_WORKER_ABORTED";
+  return error;
+}

package/kernel/lib/upgrade-preview.mjs

@@ -0,0 +1,256 @@
+/** Offline version prediction: no installation, runtime probe, cache or baseline. */
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { loadCatalog } from "./catalog.mjs";
+import { TOOL_VERSION } from "./version.mjs";
+import {
+  captureUpgradeInput,
+  sha256,
+  upgradeCleanupError,
+} from "./upgrade-input.mjs";
+import { runWorkerTask } from "./worker-analysis.mjs";
+import { assertReportBody } from "./contracts.mjs";
+import {
+  SUPPORTED_PREVIEW_VERSIONS,
+  assertUpgradePreview,
+  compareUpgradeFindings,
+  upgradeExitCode,
+  createUpgradeFailure as createContractUpgradeFailure,
+  UPGRADE_PREVIEW_LIMITATIONS,
+} from "./upgrade-contract.mjs";
+export { SUPPORTED_PREVIEW_VERSIONS } from "./upgrade-contract.mjs";
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const limitations = UPGRADE_PREVIEW_LIMITATIONS;
+/** Preserve the public API while the pure factory also works without a kernel. */
+export function createUpgradeFailure(error, options = {}) {
+  if (error && typeof error === "object" && !(error instanceof Error))
+    return createContractUpgradeFailure({
+      ...error,
+      toolVersion: TOOL_VERSION,
+    });
+  return createContractUpgradeFailure(error, {
+    ...options,
+    toolVersion: TOOL_VERSION,
+  });
+}
+
+/**
+ * Capture a caller-selected installed node_modules once and predict only exact
+ * catalogue versions. Budgets may only lower the production capture/worker caps.
+ */
+export async function runUpgradePreview(input = {}, options = {}) {
+  let snapshot, primaryError;
+  const { currentVersion, targetVersion } = input || {};
+  const failure = (error) =>
+    createUpgradeFailure(error, { currentVersion, targetVersion });
+  const privateMessage = (error) =>
+    String(error?.message || error)
+      .replaceAll(snapshot?.nm || "\u0000", "<private-input>")
+      .replace(/\/[^\s:'"]*dsc-upgrade-input-[^\s:'"]*/g, "<private-input>");
+  try {
+    if (
+      !input ||
+      typeof input !== "object" ||
+      Array.isArray(input) ||
+      Object.keys(input).some(
+        (k) => !["nm", "currentVersion", "targetVersion"].includes(k),
+      )
+    )
+      throw new Error(
+        "升级预检仅接受 nm、currentVersion、targetVersion；运行时、探针及覆盖参数不可混用",
+      );
+    if (
+      !SUPPORTED_PREVIEW_VERSIONS.includes(currentVersion) ||
+      !SUPPORTED_PREVIEW_VERSIONS.includes(targetVersion)
+    )
+      return createUpgradeFailure({
+        error:
+          "版本未认证：仅支持有明确API目录的精确版本 " +
+          SUPPORTED_PREVIEW_VERSIONS.join("、"),
+        currentVersion,
+        targetVersion,
+        status: "unsupported-version",
+      });
+    if (
+      !options ||
+      typeof options !== "object" ||
+      Array.isArray(options) ||
+      Object.keys(options).some(
+        (k) => !["timeoutMs", "captureLimits", "signal"].includes(k),
+      )
+    )
+      throw new Error("升级预检预算参数无效");
+    const { timeoutMs = 10000, captureLimits = {}, signal } = options;
+    if (
+      !Number.isSafeInteger(timeoutMs) ||
+      timeoutMs <= 0 ||
+      timeoutMs > 10000 ||
+      !captureLimits ||
+      typeof captureLimits !== "object" ||
+      Array.isArray(captureLimits)
+    )
+      throw new Error("升级预检 worker / 捕获预算无效");
+    const reviewedCatalogFor = (version) => {
+      const { file, catalog, evidence } = loadCatalog(ROOT, version);
+      if (
+        !catalog.host ||
+        !catalog.client ||
+        !catalog._source?.host ||
+        !catalog._source?.client
+      )
+        throw new Error("API目录来源不完整");
+      return {
+        version,
+        catalog,
+        evidence,
+        identity: {
+          version,
+          file: path.relative(ROOT, file).split(path.sep).join("/"),
+          sha256: evidence.sha256,
+          source: { ...catalog._source },
+        },
+      };
+    };
+    const current = reviewedCatalogFor(currentVersion),
+      target = reviewedCatalogFor(targetVersion);
+    const rulesFile = path.join(ROOT, "rules", "severity.json"),
+      rulesBytes = fs.readFileSync(rulesFile);
+    const rules = JSON.parse(rulesBytes);
+    if (typeof input.nm !== "string" || !input.nm)
+      throw new Error("升级预检需要 node_modules 或 profile 路径");
+    snapshot = await captureUpgradeInput(input.nm, captureLimits, { signal });
+    const reports = await runWorkerTask(
+      new URL("./upgrade-worker.mjs", import.meta.url),
+      {
+        nm: snapshot.nm,
+        artifact: snapshot.artifact,
+        current: {
+          version: currentVersion,
+          catalog: current.catalog,
+          evidence: current.evidence,
+        },
+        target: {
+          version: targetVersion,
+          catalog: target.catalog,
+          evidence: target.evidence,
+        },
+        rules,
+      },
+      { timeoutMs, signal },
+    );
+    // Supervision resolves only after worker termination; cleanup occurs in finally.
+    assertReportBody(reports.currentReport);
+    assertReportBody(reports.targetReport);
+    const changes = compareUpgradeFindings(
+      reports.currentReport,
+      reports.targetReport,
+    );
+    const limited = new Set(
+      [
+        ...Object.values(reports.currentReport.plugins),
+        ...Object.values(reports.targetReport.plugins),
+      ]
+        .filter((p) => p.coverage.status === "limited")
+        .map((p) => p.name),
+    );
+    const notes = [...limitations];
+    if (
+      !reports.currentReport.extraction.scanComplete ||
+      !reports.targetReport.extraction.scanComplete
+    )
+      notes.push(
+        "源码或插件清单覆盖不完整：保留已发现风险和诊断，未发现或已消失的发现不能证明修复或完整业务通过。",
+      );
+    return assertUpgradePreview({
+      schemaVersion: 1,
+      kind: "plugin-compat-check/upgrade-preview",
+      toolVersion: TOOL_VERSION,
+      mode: "static-version-comparison",
+      status: "compared",
+      ok: true,
+      error: null,
+      currentVersion,
+      targetVersion,
+      supportedVersions: [...SUPPORTED_PREVIEW_VERSIONS],
+      catalogs: { current: current.identity, target: target.identity },
+      artifact: snapshot.artifact,
+      rules: { file: "rules/severity.json", sha256: sha256(rulesBytes) },
+      ...reports,
+      changes,
+      summary: {
+        ...Object.fromEntries(
+          Object.entries(changes).map(([k, v]) => [k, v.length]),
+        ),
+        limitedPlugins: limited.size,
+      },
+      exitCode: upgradeExitCode(changes),
+      limitations: notes,
+      baseline: null,
+      cache: null,
+    });
+  } catch (error) {
+    primaryError = error;
+    return failure(privateMessage(error));
+  } finally {
+    try {
+      await snapshot?.dispose();
+    } catch (cleanupError) {
+      return failure(
+        privateMessage(upgradeCleanupError(primaryError, cleanupError)),
+      );
+    }
+  }
+}
+
+export function renderUpgradePreview(result) {
+  assertUpgradePreview(result);
+  const lines = [
+    `升级前兼容性预检（静态预测）：${result.currentVersion ?? "未知"} → ${result.targetVersion ?? "未知"}`,
+  ];
+  if (!result.ok)
+    return [
+      ...lines,
+      `无法判定：${result.error}`,
+      ...result.limitations.map((x) => `限制：${x}`),
+    ].join("\n");
+  lines.push(
+    `新增 ${result.summary.added}；变重 ${result.summary.worsened}；消失 ${result.summary.resolved}；减轻 ${result.summary.improved}；不变 ${result.summary.unchanged}`,
+  );
+  if (!result.summary.added && !result.summary.worsened)
+    lines.push("无新增或变重的静态风险；不代表未来业务通过。");
+  for (const [group, label] of [
+    ["added", "新增"],
+    ["worsened", "变重"],
+    ["resolved", "消失"],
+    ["improved", "减轻"],
+    ["unchanged", "不变"],
+  ])
+    for (const item of result.changes[group]) {
+      const f = item.finding || item.after;
+      lines.push(
+        `${label}：${item.plugin} ${f.category} ${[f.service, f.method].filter(Boolean).join(".")} ${f.severity}/${f.certainty}/${f.impactBasis}${f.location ? ` @${f.location.file}:${f.location.line}` : ""}`,
+      );
+    }
+  lines.push(`输入SHA-256：${result.artifact.sha256}`);
+  for (const item of result.artifact.packages)
+    lines.push(
+      `插件制品：${item.name}@${item.version ?? "未知"} ${item.sha256}`,
+    );
+  for (const side of ["current", "target"]) {
+    const item = result.catalogs[side];
+    lines.push(
+      `API目录：${item.version} ${item.file} SHA-256 ${item.sha256}；来源 ${item.source.host} / ${item.source.client}`,
+    );
+  }
+  lines.push(`规则：${result.rules.file} SHA-256 ${result.rules.sha256}`);
+  for (const side of ["currentReport", "targetReport"])
+    for (const p of Object.values(result[side].plugins)) {
+      lines.push(
+        `${result[side].dshVersion} ${p.name}：${p.verdict}；覆盖 ${p.coverage.status}；已验证调用 ${p.coverage.verifiedCalls}${p.vacuous ? "；无已验证调用" : ""}`,
+      );
+      for (const note of p.coverage.limitations)
+        lines.push(`  覆盖限制：${note}`);
+    }
+  return [...lines, ...result.limitations.map((x) => `限制：${x}`)].join("\n");
+}

package/kernel/lib/upgrade-worker.mjs

@@ -0,0 +1,50 @@
+import { parentPort, workerData } from "node:worker_threads";
+import { extractWithProvenance } from "./extract.mjs";
+import { buildVerdicts } from "./verdict.mjs";
+import { sealReportBody } from "./contracts.mjs";
+import { TOOL_VERSION } from "./version.mjs";
+
+try {
+  const { nm, current, target, rules, artifact } = workerData;
+  const catalog = {
+    host: { ...current.catalog.host, ...target.catalog.host },
+    client: { ...current.catalog.client, ...target.catalog.client },
+  };
+  // One extraction of the same copied bytes; catalogue union affects only
+  // recognition of weak bare/alias names. Each verdict uses its own catalogue.
+  const extracted = extractWithProvenance(nm, { catalog });
+  const reportFor = (item) =>
+    sealReportBody({
+      ...buildVerdicts({
+        report: extracted.report,
+        hostSurface: null,
+        entryStates: [],
+        rules,
+        catalog: item.catalog,
+        dshVersion: item.version,
+      }),
+      toolVersion: TOOL_VERSION,
+      catalog: item.evidence,
+      inputs: {
+        mode: "static-version-comparison",
+        artifactSha256: artifact.sha256,
+        hasRuntimeSurface: false,
+      },
+      extraction: {
+        scanComplete: extracted.report.scanComplete,
+        diagnostics: extracted.report.diagnostics,
+        manifests: extracted.report.manifests,
+      },
+      baseline: null,
+      cache: null,
+    });
+  parentPort.postMessage({
+    ok: true,
+    value: {
+      currentReport: reportFor(current),
+      targetReport: reportFor(target),
+    },
+  });
+} catch (error) {
+  parentPort.postMessage({ ok: false, error: error.message });
+}

package/kernel/lib/version.mjs

@@ -29,7 +29,7 @@
  */
 
 /** 语义化版本。改动它会同时影响三个入口的 `--version` 与报告 JSON 的 `toolVersion`。 */
-export const TOOL_VERSION = '0.1.4';
+export const TOOL_VERSION = '0.1.5';
 
 /** 人类可读的一行，给 `--version` 用 */
 export function versionLine() {

package/kernel/lib/worker-analysis.mjs

@@ -4,7 +4,7 @@ import { Worker } from "node:worker_threads";
 export function runWorkerTask(
   url,
   data,
-  { timeoutMs = 10000, resourceLimits = {} } = {},
+  { timeoutMs = 10000, resourceLimits = {}, signal } = {},
 ) {
   return new Promise((resolve, reject) => {
     const limits = {
@@ -13,6 +13,11 @@ export function runWorkerTask(
       ...resourceLimits,
     };
     if (
+      (signal !== undefined &&
+        (!signal ||
+          typeof signal.aborted !== "boolean" ||
+          typeof signal.addEventListener !== "function" ||
+          typeof signal.removeEventListener !== "function")) ||
       !Number.isInteger(timeoutMs) ||
       timeoutMs <= 0 ||
       timeoutMs > 2147483647 ||
@@ -27,6 +32,12 @@ export function runWorkerTask(
       )
     )
       return reject(new Error("Invalid worker resource budget / 预算"));
+    const aborted = () => {
+      const error = new Error("静态分析已取消，已终止工作线程");
+      error.code = "DSC_WORKER_ABORTED";
+      return error;
+    };
+    if (signal?.aborted) return reject(aborted());
     let worker;
     try {
       worker = new Worker(url, {
@@ -43,6 +54,7 @@ export function runWorkerTask(
       if (finishing) return;
       finishing = true;
       clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
       try {
         await worker.terminate();
       } catch (cleanupError) {
@@ -55,6 +67,9 @@ export function runWorkerTask(
       error.code = "DSC_WORKER_TIMEOUT";
       void finish(error);
     }, timeoutMs);
+    const onAbort = () => void finish(aborted());
+    signal?.addEventListener("abort", onAbort, { once: true });
+    if (signal?.aborted) onAbort();
     worker.once("message", (message) => {
       if (
         !message ||