dsh-plugin-notify-sounds 1.6.9 → 1.8.0

package/lib/index.js

@@ -28,7 +28,7 @@ import z from "@deepseek-ai/schemastery";
 import { spawn } from "node:child_process";
 import { createHash, timingSafeEqual } from "node:crypto";
 import { createRequire } from "node:module";
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { gunzipSync } from "node:zlib";
@@ -188,13 +188,22 @@ let nativeRaise;
  * @param handle - the window to read.
  * @returns the title text.
  */
-function windowTitle(native, handle) {
+export function windowTitle(native, handle) {
 	try {
 		const length = native.GetWindowTextLengthW(handle);
 		if (length <= 0) return "";
 		const buffer = new Uint16Array(length + 2);
-		native.GetWindowTextW(handle, buffer, buffer.length);
-		return Buffer.from(buffer.buffer, 0, length * 2).toString("utf16le");
+		const copied = native.GetWindowTextW(handle, buffer, buffer.length);
+		// The two calls are not atomic: between them the page can rewrite its
+		// title (switching sessions is exactly when it does), and this call
+		// then copies fewer characters than the first one counted. Slicing by
+		// the OLD count would hand back a string with NULs on the end — which
+		// no real title ever contains, and which silently stops `endsWith`
+		// matching, i.e. one click that does nothing at all. Slice by what was
+		// actually copied, and treat a nonsense return as "read the old count"
+		// rather than trusting it.
+		const written = Number.isFinite(copied) && copied >= 0 ? Math.min(copied, length) : length;
+		return Buffer.from(buffer.buffer, 0, written * 2).toString("utf16le");
 	} catch {
 		return "";
 	}
@@ -545,11 +554,47 @@ export function compareVersions(a, b) {
 	for (let i = 0; i < 3; i++) {
 		if (left[i] !== right[i]) return left[i] - right[i];
 	}
-	// Same core: a prerelease sorts before its own release (1.5.0-rc.1 < 1.5.0).
-	if (left[3] !== right[3]) {
-		if (left[3] === "") return 1;
-		if (right[3] === "") return -1;
-		return left[3] < right[3] ? -1 : 1;
+	return comparePrerelease(left[3], right[3]);
+}
+
+/**
+ * Compare two prerelease fields the way semver defines it, not as strings.
+ *
+ * Plain string order gets the common case wrong: `rc.10` sorts BEFORE `rc.9`
+ * ("1" < "9"), so a registry whose `latest` points at a later release candidate
+ * would look older than the one already installed and the update would never be
+ * offered. The rules are: identifiers are compared field by field; a numeric
+ * field compares numerically and ranks below an alphanumeric one; an
+ * alphanumeric field compares in ASCII order; and when every shared field is
+ * equal, the one with MORE fields wins (`1.0.0-rc.1` < `1.0.0-rc.1.1`).
+ *
+ * @param left - the prerelease field of the first version, "" for a release.
+ * @param right - the prerelease field of the second version.
+ * @returns negative, 0, or positive.
+ */
+function comparePrerelease(left, right) {
+	if (left === right) return 0;
+	// A release outranks any of its own prereleases (1.5.0 > 1.5.0-rc.1).
+	if (left === "") return 1;
+	if (right === "") return -1;
+	const a = left.split(".");
+	const b = right.split(".");
+	for (let i = 0; i < Math.max(a.length, b.length); i++) {
+		const x = a[i];
+		const y = b[i];
+		if (x === undefined) return -1;
+		if (y === undefined) return 1;
+		const numericX = /^\d+$/.test(x);
+		const numericY = /^\d+$/.test(y);
+		if (numericX && numericY) {
+			const dx = Number(x);
+			const dy = Number(y);
+			if (dx !== dy) return dx < dy ? -1 : 1;
+			continue;
+		}
+		// A numeric identifier always ranks below an alphanumeric one.
+		if (numericX !== numericY) return numericX ? -1 : 1;
+		if (x !== y) return x < y ? -1 : 1;
 	}
 	return 0;
 }
@@ -638,6 +683,41 @@ async function readCappedBytes(response, cap) {
  * @returns `{ ok, current, latest, updateAvailable, checkedAt }`, or
  *   `{ ok: false, current, error }` when no registry answered.
  */
+/**
+ * How the running package relates to what the profile's package manager
+ * recorded for it.
+ *
+ * This plugin no longer installs its own releases (as of 1.8.0): a release
+ * reaches a profile through the package manager, which also owns the
+ * lockfile. A tree that arrived by any other route looks identical on disk
+ * while the lockfile still pins an older version — and the next
+ * `pnpm install` in that profile silently restores the old one. Reading the
+ * version the lockfile would restore lets the Settings row say so instead of
+ * leaving the user to discover it after the next plugin operation.
+ *
+ * Every part is optional: no profile directory, no lockfile or an unreadable
+ * one simply reports nothing, and the row keeps its normal wording.
+ *
+ * @param current - the version actually on disk.
+ * @returns the fields the check payload mirrors to the row.
+ */
+function installationProvenance(current) {
+	try {
+		const profileDir = process.env.DSH_PROFILE_DIR;
+		if (profileDir === undefined) return {};
+		const lock = readFileSync(join(profileDir, "pnpm-lock.yaml"), "utf8");
+		const recorded = new RegExp(`${UPDATE_PACKAGE}@([0-9][^:\\s"']*)`).exec(lock)?.[1];
+		return {
+			recorded,
+			unregistered: current !== undefined && recorded !== undefined && recorded !== current,
+			profile: process.env.DSH_PROFILE,
+		};
+	} catch {
+		return {};
+	}
+}
+export { installationProvenance };
+
 export async function checkForUpdate(options = {}) {
 	const now = Date.now();
 	if (options.force !== true && updateCheck.result !== undefined && now - updateCheck.checkedAt < UPDATE_CHECK_TTL_MS) {
@@ -659,7 +739,7 @@ export async function checkForUpdate(options = {}) {
 		const current = readOwnVersion(options.root);
 		const answer = await fetchRegistryAnswer();
 		if (answer === undefined) {
-			const result = { ok: false, current, error: "no registry answered", applied: updateCheck.applied };
+			const result = { ok: false, current, error: "no registry answered", applied: updateCheck.applied, ...installationProvenance(current) };
 			updateCheck.checkedAt = now;
 			updateCheck.result = result;
 			return result;
@@ -672,6 +752,7 @@ export async function checkForUpdate(options = {}) {
 			updateAvailable: Number.isFinite(ordering) && ordering < 0,
 			checkedAt: now,
 			applied: updateCheck.applied,
+			...installationProvenance(current),
 		};
 		updateCheck.checkedAt = now;
 		updateCheck.result = result;
@@ -725,7 +806,11 @@ async function fetchRegistryAnswer() {
 
 //#endregion
 
-//#region update apply
+//#region update apply — UNREACHABLE since 1.8.0: no route calls it any more.
+// The Settings row sends the user to the plugin manager / package manager
+// instead, so this plugin never writes its own files. The code below stays
+// only until its tests retire with a later release; nothing in apply() can
+// reach it.
 
 /** Route the browser half asks for an update to be applied through. */
 export const UPDATE_APPLY_PATH = "/notify-sounds/update/apply";
@@ -734,14 +819,41 @@ export const UPDATE_APPLY_PATH = "/notify-sounds/update/apply";
 const UPDATE_MAX_TARBALL_BYTES = 8 * 1024 * 1024;
 
 /**
- * The only files an update may replace, as package-relative paths.
+ * Largest expansion accepted after gunzip.
  *
- * An update is a file swap, not an install: it replaces exactly what the
- * package publishes and touches nothing else. The profile's own configuration
- * lives outside this directory and is not on this list — no update can reach
- * it, whatever an archive contains.
+ * The download cap alone does not bound memory: a few-hundred-KB gzip stream
+ * can expand to gigabytes, and that allocation happens inside this process.
+ * `gunzipSync` is given this as `maxOutputLength` so the limit is enforced
+ * while inflating rather than after.
  */
-const UPDATE_FILES = ["package.json", "cordis.patch.yml", "README.md", "README.zh.md", "LICENSE", "lib/client.js", "lib/index.js"];
+const UPDATE_MAX_UNPACKED_BYTES = UPDATE_MAX_TARBALL_BYTES * 8;
+
+/** Most files one release of this package may carry. It is a handful of text files. */
+const UPDATE_MAX_FILES = 256;
+
+/**
+ * Path segments an update may never contain, however an archive spells them.
+ *
+ * `.update-backup` is this updater's own working directory: an archive that
+ * carried a file with that name could leave the previous version's bytes
+ * exactly where a rollback looks for them. `node_modules` and `.git` are never
+ * published in a tarball, so an archive containing them describes a different
+ * tree than the one this installation came from.
+ */
+const UPDATE_RESERVED_SEGMENTS = new Set(["node_modules", ".git", ".update-backup"]);
+
+/**
+ * Records which files this updater installed, so the next update can prune.
+ *
+ * It lives in the installed package directory and is written by the updater at
+ * runtime — it is NEVER part of the published tarball, which is why adding it
+ * cannot break an older installation's update (those check the archive's file
+ * names, not what the directory happens to contain).
+ */
+const UPDATE_MANIFEST = ".update-manifest.json";
+
+/** Package-root names a package manager reads as configuration, and the updater's own bookkeeping; never delivered by an update. */
+const UPDATE_RESERVED_ROOT_FILES = new Set([".npmrc", ".pnpmfile.cjs", UPDATE_MANIFEST]);
 
 /** Where this package is installed: the only tree an update may write to. */
 function packageRoot() {
@@ -765,24 +877,43 @@ function readTarOctal(header, offset, length) {
 }
 
 /**
- * Map an archive path to the package-relative file it may replace.
+ * Map an archive path to the package-relative file it may write.
  *
  * Everything about a tar path is hostile until shown otherwise: only the
- * `package/` prefix the registry publishes under, only the whitelisted names,
- * and never a path that climbs, escapes, or arrives by another separator.
+ * `package/` prefix the registry publishes under, never a path that climbs,
+ * escapes, or arrives by another separator, never a reserved name, and never
+ * one that an NTFS alternate data stream could hide behind.
+ *
+ * What is deliberately NOT checked is the file's NAME. An exact list of seven
+ * names was the previous design and it was a trap: the updater that runs during
+ * an update is the one already installed, so its list decides what the NEXT
+ * release may contain. A release that added a file became uninstallable by
+ * every older installation — permanently, and with no way to fix it after the
+ * fact, because the old code is already on those machines. The rules below are
+ * the ones that never need to change (path safety, not a file inventory), so
+ * they can remain the whole gate while the file set moves forward.
  */
 export function archivePathToRelative(path) {
 	const normalized = path.replaceAll("\\", "/");
-	if (normalized.startsWith("/") || normalized.split("/").includes("..")) throw new Error(`refusing tar path: ${path}`);
+	const segments = normalized.split("/");
+	if (normalized.startsWith("/") || segments.includes("..")) throw new Error(`refusing tar path: ${path}`);
 	const prefix = "package/";
 	if (!normalized.startsWith(prefix)) throw new Error(`refusing tar path: ${path}`);
 	const relative = normalized.slice(prefix.length);
-	if (relative === "" || !UPDATE_FILES.includes(relative)) throw new Error(`refusing tar path: ${path}`);
+	if (relative === "" || relative.endsWith("/")) throw new Error(`refusing tar path: ${path}`);
+	for (const segment of relative.split("/")) {
+		// A `.` segment would let one file be named twice in one archive, and it
+		// slips past the case check below, which compares names rather than
+		// resolved paths.
+		if (segment === "" || segment === "." || segment.includes(":")) throw new Error(`refusing tar path: ${path}`);
+		if (UPDATE_RESERVED_SEGMENTS.has(segment) || segment.endsWith(".update-tmp")) throw new Error(`refusing tar path: ${path}`);
+	}
+	if (UPDATE_RESERVED_ROOT_FILES.has(relative)) throw new Error(`refusing tar path: ${path}`);
 	return relative;
 }
 
 /**
- * Read a tar archive into the few files an update may touch.
+ * Read a tar archive into the files an update may write.
  *
  * The archive arrived from the network and is treated accordingly:
  *
@@ -790,13 +921,19 @@ export function archivePathToRelative(path) {
  *     anywhere, so any other entry type is refused outright;
  *   - pax/gnu extension headers are skipped, not interpreted;
  *   - every name must survive `archivePathToRelative`, so nothing outside
- *     this package is ever named;
- *   - a header claiming more than the archive holds is an error, not a read.
+ *     this package is ever named and nothing reserved is ever written;
+ *   - two entries may not differ only in case: on Windows and macOS the second
+ *     would silently overwrite the first;
+ *   - a header claiming more than the archive holds is an error, not a read;
+ *   - the total size and the file count are capped, so an archive cannot turn
+ *     a bounded download into unbounded disk usage.
  *
  * @returns a Map of package-relative path → contents.
  */
 export function unpackTar(bytes) {
 	const files = new Map();
+	const seen = new Map();
+	let total = 0;
 	let offset = 0;
 	while (offset + 512 <= bytes.length) {
 		const header = bytes.subarray(offset, offset + 512);
@@ -812,12 +949,79 @@ export function unpackTar(bytes) {
 		offset = contentStart + Math.ceil(size / 512) * 512;
 		if (typeflag === "x" || typeflag === "g" || typeflag === "L") continue;
 		if (typeflag !== "0" && typeflag !== "") throw new Error(`refusing non-file tar entry (${typeflag})`);
-		files.set(archivePathToRelative(prefix === "" ? name : `${prefix}/${name}`), content);
+		const relative = archivePathToRelative(prefix === "" ? name : `${prefix}/${name}`);
+		const folded = relative.toLowerCase();
+		const collidesWith = seen.get(folded);
+		if (collidesWith !== undefined && collidesWith !== relative) {
+			throw new Error(`refusing two entries that differ only in case: ${collidesWith} / ${relative}`);
+		}
+		seen.set(folded, relative);
+		total += content.length;
+		if (total > UPDATE_MAX_UNPACKED_BYTES) throw new Error("the archive expands beyond its limit");
+		if (files.size >= UPDATE_MAX_FILES) throw new Error("the archive carries more files than this package can have");
+		files.set(relative, content);
 	}
 	if (files.size === 0) throw new Error("the archive carried no usable files");
 	return files;
 }
 
+/**
+ * Check that the archive really is this package, at the version the registry named.
+ *
+ * With the file inventory gone, this is what still ties the bytes to an
+ * identity. The registry answer was validated before anything was downloaded,
+ * and the digest binds the bytes to that answer's `dist` — but the archive's
+ * own manifest is the only thing that says WHICH package and version those
+ * bytes are, and the next check trusts the manifest this update leaves on
+ * disk. A manifest that is missing, unreadable, or about something else would
+ * otherwise be installed silently and make "an update landed" a lie the check
+ * cannot see through.
+ *
+ * @param files - the unpacked archive, package-relative path → contents.
+ * @param version - the version the registry announced.
+ * @returns the parsed manifest.
+ */
+export function verifyManifest(files, version) {
+	const manifest = files.get("package.json");
+	if (manifest === undefined) throw new Error("the archive carries no package.json");
+	let parsed;
+	try {
+		parsed = JSON.parse(new TextDecoder().decode(manifest));
+	} catch {
+		throw new Error("the archive's package.json is not readable JSON");
+	}
+	if (parsed?.name !== UPDATE_PACKAGE) throw new Error(`the archive is not ${UPDATE_PACKAGE}`);
+	if (parsed?.version !== version) {
+		throw new Error(`the archive says version ${String(parsed?.version)} where the registry said ${version}`);
+	}
+	// A file whose name differs from a path this manifest declares only by case
+	// would replace that file on Windows and macOS and be a dead file on Linux:
+	// one archive, two different installations. The set is derived from the
+	// archive's OWN manifest (`package.json` itself, `main`, and every `exports`
+	// target) — never from a list held here — so a release stays free to move
+	// or rename its own files, which is the whole point of this design.
+	const declared = new Map([["package.json", "package.json"]]);
+	const declare = (value) => {
+		if (typeof value !== "string" || value === "") return;
+		const relative = value.startsWith("./") ? value.slice(2) : value;
+		declared.set(relative.toLowerCase(), relative);
+	};
+	const declareAll = (value) => {
+		if (typeof value === "string") declare(value);
+		else if (Array.isArray(value)) value.forEach(declareAll);
+		else if (value !== null && typeof value === "object") Object.values(value).forEach(declareAll);
+	};
+	declare(parsed.main);
+	declareAll(parsed.exports);
+	for (const relative of files.keys()) {
+		const target = declared.get(relative.toLowerCase());
+		if (target !== undefined && target !== relative) {
+			throw new Error(`refusing a file that differs only in case from ${target}: ${relative}`);
+		}
+	}
+	return parsed;
+}
+
 /**
  * Check downloaded bytes against the digest the registry published.
  *
@@ -873,6 +1077,48 @@ async function downloadTarball(url) {
 	throw new Error(`download refused: more than ${UPDATE_MAX_REDIRECTS} redirects`);
 }
 
+/**
+ * The file list a previous update recorded, as a Set.
+ *
+ * A missing, unreadable, or malformed manifest reads as "nothing recorded",
+ * which prunes nothing: the failure mode of a damaged manifest has to be
+ * "leaves a file behind", never "deletes something".
+ *
+ * @param root - the package directory.
+ * @returns the recorded package-relative paths.
+ */
+function readUpdateManifest(root) {
+	try {
+		const parsed = JSON.parse(readFileSync(join(root, UPDATE_MANIFEST), "utf8"));
+		if (!Array.isArray(parsed?.files)) return new Set();
+		return new Set(parsed.files.filter((name) => typeof name === "string"));
+	} catch {
+		return new Set();
+	}
+}
+
+/**
+ * Which recorded files this release no longer carries.
+ *
+ * Only paths the PREVIOUS update wrote are candidates, so a file the user put
+ * in the package directory themselves is never named here and never removed.
+ * This is what makes an update add and remove files while the file-list rule
+ * stays out of the way — the alternative, shipping deletions inside the
+ * archive, is not something a tar can express.
+ *
+ * @param previous - paths recorded by the last update.
+ * @param files - the incoming archive's package-relative paths.
+ * @returns the paths to delete, sorted.
+ */
+export function filesToPrune(previous, files) {
+	const gone = [];
+	for (const relative of previous) {
+		if (relative === UPDATE_MANIFEST) continue;
+		if (!files.has(relative)) gone.push(relative);
+	}
+	return gone.sort();
+}
+
 /**
  * Swap the package's files for the update's, keeping the previous ones.
  *
@@ -880,41 +1126,127 @@ async function downloadTarball(url) {
  * failure cannot leave a half-written file under a real name. Everything the
  * update is about to replace is copied aside first, and any failure puts it
  * all back: a failed update is not a half-updated plugin.
+ *
+ * The files are whatever the archive carried, not a list held here. An earlier
+ * design iterated a fixed set of seven names, which meant a release could only
+ * ever touch those seven; that list is gone on purpose (see
+ * `archivePathToRelative`), and this function is the second half of the same
+ * decision — unpacking a new file and then never writing it would look exactly
+ * like a successful update that quietly did nothing.
  */
 export function installUpdate(root, files) {
 	const rootPrefix = resolve(root);
 	const backup = join(root, ".update-backup");
 	const tempName = (relative) => `${resolve(root, relative)}.update-tmp`;
 	rmSync(backup, { recursive: true, force: true });
+	// The manifest goes last, and that order is load-bearing. If this process
+	// dies mid-swap — a power cut or a kill, not a thrown error, which rolls
+	// back — the installation is left with the OLD version number over part of
+	// the new code, so the next check still reports an update and the user can
+	// retry. The opposite order would leave a NEW version number over the old
+	// code: the check would call that "up to date" and there would be nothing
+	// left to prompt anyone with.
+	const relatives = [...files.keys()].sort((a, b) => (a === "package.json" ? 1 : 0) - (b === "package.json" ? 1 : 0));
+	/** Directories this update creates, outermost first, so a rollback can take them back. */
+	const created = [];
 	const written = [];
+	/** Files this update deletes, kept aside first so a rollback can bring them back. */
+	const pruned = [];
+	/** The previous update's record, read before anything is written over it. */
+	const previous = readUpdateManifest(root);
+	const manifestPath = join(root, UPDATE_MANIFEST);
+	/** Copy the current bytes aside before they are replaced or removed. */
+	const backUp = (relative, target) => {
+		const aside = join(backup, relative);
+		mkdirSync(dirname(aside), { recursive: true });
+		writeFileSync(aside, readFileSync(target));
+	};
 	try {
-		for (const relative of UPDATE_FILES) {
+		for (const relative of relatives) {
 			const source = files.get(relative);
 			if (source === undefined) continue;
 			const target = resolve(root, relative);
 			if (target !== rootPrefix && !target.startsWith(rootPrefix)) throw new Error(`refusing to write outside the package: ${relative}`);
-			if (existsSync(target)) {
-				const aside = join(backup, relative);
-				mkdirSync(dirname(aside), { recursive: true });
-				writeFileSync(aside, readFileSync(target));
+			let parent = rootPrefix;
+			for (const segment of relative.split("/").slice(0, -1)) {
+				parent = join(parent, segment);
+				if (!existsSync(parent)) created.push(parent);
 			}
+			mkdirSync(dirname(target), { recursive: true });
+			if (existsSync(target)) backUp(relative, target);
 			const temp = tempName(relative);
 			writeFileSync(temp, source);
 			renameSync(temp, target);
 			written.push(relative);
 		}
+		// A release can also DROP a file, and an archive cannot say so: it is a
+		// list of what exists, not of what should be deleted. The previous
+		// update's record is what makes the difference computable, and it is
+		// deliberately limited to files an update wrote — anything else in this
+		// directory (a user's own notes, a tool's leftovers) is never named in
+		// the record and therefore never deleted.
+		for (const relative of filesToPrune(previous, files)) {
+			const target = resolve(root, relative);
+			if (target !== rootPrefix && !target.startsWith(rootPrefix)) continue;
+			// Files only. A path that is now a directory is left alone rather
+			// than failing the whole update, and never removed recursively.
+			try {
+				if (!statSync(target).isFile()) continue;
+			} catch {
+				continue;
+			}
+			backUp(relative, target);
+			rmSync(target, { force: true });
+			pruned.push(relative);
+		}
+		// The record is written LAST, through the same temporary-name swap as
+		// everything else, and it describes the state this update leaves behind:
+		// the incoming files plus itself, minus nothing.
+		if (existsSync(manifestPath)) backUp(UPDATE_MANIFEST, manifestPath);
+		const record = new TextEncoder().encode(JSON.stringify({ version: 1, files: [...files.keys(), UPDATE_MANIFEST].sort() }));
+		writeFileSync(`${manifestPath}.update-tmp`, record);
+		renameSync(`${manifestPath}.update-tmp`, manifestPath);
+		written.push(UPDATE_MANIFEST);
 	} catch (error) {
 		// Put everything back — including files the update ADDED, which have
-		// no backup to restore from and must simply go away again. A failed
-		// update has to leave nothing behind: no half-replaced file, no
-		// leftover temp, and no file that was not there before.
+		// no backup to restore from and must simply go away again, the files it
+		// DELETED, which come back from their copies, and the directories it
+		// created. A failed update has to leave nothing behind: no half-replaced
+		// file, no leftover temp, no file that was not there before, and no
+		// empty directory either.
 		for (const relative of written) {
 			const aside = join(backup, relative);
 			const target = resolve(root, relative);
 			if (existsSync(aside)) writeFileSync(target, readFileSync(aside));
 			else rmSync(target, { force: true });
 		}
-		for (const relative of UPDATE_FILES) rmSync(tempName(relative), { force: true });
+		for (const relative of pruned) {
+			const aside = join(backup, relative);
+			if (existsSync(aside)) writeFileSync(resolve(root, relative), readFileSync(aside));
+		}
+		for (const relative of relatives) rmSync(tempName(relative), { force: true });
+		// Guarded: a cleanup step must never replace the failure it is cleaning
+		// up after (this path can hold a directory, and `rmSync` refuses one
+		// without `recursive`).
+		try {
+			rmSync(`${manifestPath}.update-tmp`, { force: true });
+		} catch {}
+		// Deepest first, so a chain collapses one level at a time. `rmdirSync`
+		// refuses a directory that still holds something, which is the point:
+		// a failure here must never delete real content. (Not `rmSync` — that
+		// one needs `recursive` even for an empty directory on Windows and
+		// throws EISDIR, which would have left every created directory behind.)
+		for (const directory of created.reverse()) {
+			try {
+				rmdirSync(directory);
+			} catch {}
+		}
+		// The restore above is done, so the copies have no further use. If a
+		// restore threw, this is never reached and the backup stays on disk —
+		// which is the one case where keeping it is the safer outcome.
+		try {
+			rmSync(backup, { recursive: true, force: true });
+		} catch {}
 		throw error;
 	}
 	// The swap succeeded, so the backup has done its job. Leaving it would
@@ -930,8 +1262,10 @@ export function installUpdate(root, files) {
  * registry (the answer is validated as strictly as for a check); download the
  * tarball from the URL that answer named and nowhere else; verify its sha512
  * against the digest the registry published — a mismatch stops here, before a
- * byte is written; unpack it in memory, accepting only whitelisted regular
- * files; then back up what is there and swap the files, restoring on failure.
+ * byte is written; unpack it in memory, accepting only regular files that stay
+ * inside the package, and confirm its manifest is this package at the version
+ * the registry announced; then back up what is there and swap the files,
+ * restoring on failure.
  *
  * Nothing downloaded is ever executed here. The new code runs when DSH
  * restarts, which is the same trust model as the user updating by hand.
@@ -959,17 +1293,25 @@ async function runUpdate(options = {}) {
 	const root = options.root ?? packageRoot();
 	const current = readOwnVersion(root);
 	let stage = "check";
+	/** The version the registry announced, once there is one, for the failure report. */
+	let announced;
 	try {
 		const answer = await fetchRegistryAnswer();
 		if (answer === undefined) return { ok: false, stage, error: "no registry answered" };
 		const ordering = current === undefined ? NaN : compareVersions(current, answer.version);
 		if (Number.isFinite(ordering) && ordering >= 0) return { ok: true, upToDate: true, current };
+		announced = answer.version;
 		stage = "download";
 		const bytes = await downloadTarball(answer.tarball);
 		stage = "verify";
 		verifyIntegrity(bytes, answer.integrity);
 		stage = "unpack";
-		const files = unpackTar(gunzipSync(bytes));
+		// A gzip stream can expand far beyond the bytes it arrived in, so the
+		// decompressor is told where to stop instead of being trusted to be
+		// reasonable; the tarball cap above bounds the input, not the output.
+		const files = unpackTar(gunzipSync(bytes, { maxOutputLength: UPDATE_MAX_UNPACKED_BYTES }));
+		stage = "manifest";
+		verifyManifest(files, answer.version);
 		stage = "replace";
 		installUpdate(root, files);
 		// The answer that said "update available" is now a lie about this
@@ -986,7 +1328,7 @@ async function runUpdate(options = {}) {
 		return { ok: true, from: current, to: answer.version, requiresRestart: true };
 	} catch (error) {
 		warn(`update failed at ${stage}: ${error?.message ?? error}`);
-		return { ok: false, stage, error: error?.message ?? String(error) };
+		return { ok: false, stage, to: announced, error: error?.message ?? String(error) };
 	}
 }
 
@@ -1032,6 +1374,8 @@ export const Config = z.object({
 	quietStart: z.string().pattern(TIME_OF_DAY).default("22:00").volatile(),
 	/** Quiet range end, "HH:MM" 24-hour. */
 	quietEnd: z.string().pattern(TIME_OF_DAY).default("08:00").volatile(),
+	/** In goal mode, stay silent on intermediate rounds and chime once when the goal ends. */
+	goalFinalOnly: z.boolean().default(false).volatile(),
 });
 
 /**
@@ -1134,37 +1478,5 @@ export function apply(ctx) {
 			},
 		}), "notify-sounds: update check route");
 
-		// The update apply route: same fence, same fixed target. It accepts no
-		// version and no URL from the caller — the update it performs is always
-		// the one a registry described for this package, verified against that
-		// registry's own digest before anything is written.
-		child.effect(() => child.webServer.register({
-			kind: "exact",
-			path: UPDATE_APPLY_PATH,
-			handler: async (req, res) => {
-				const rejection = child.connection.requestRejection(req);
-				if (rejection !== undefined) {
-					res.statusCode = rejection;
-					res.end();
-					return;
-				}
-				if (req.method !== "POST") {
-					res.statusCode = 405;
-					res.setHeader("allow", "POST");
-					res.end();
-					return;
-				}
-				try {
-					const result = await applyUpdate();
-					res.statusCode = 200;
-					res.setHeader("content-type", "application/json");
-					res.end(JSON.stringify(result));
-				} catch (error) {
-					warn(`update apply failed: ${error?.message ?? error}`);
-					res.statusCode = 500;
-					res.end();
-				}
-			},
-		}), "notify-sounds: update apply route");
 	});
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-notify-sounds",
-  "version": "1.6.9",
+  "version": "1.8.0",
   "description": "Notification sounds for DeepSeek Harness — a soft chime when the agent needs your decision or finishes a task, with a Settings section styled like DSH's own · 需要决策或任务完成时播放提示音，点击系统通知可回到窗口，设置面板可调音量与音效",
   "type": "module",
   "main": "lib/index.js",
@@ -18,8 +18,7 @@
     "lib/index.js",
     "lib/client.js",
     "cordis.patch.yml",
-    "README.zh.md",
-    "assets"
+    "README.zh.md"
   ],
   "license": "MIT",
   "repository": {
@@ -60,4 +59,4 @@
       "platform": "web"
     }
   }
-}
+}