dsh-recall-plugin 2.5.2 → 2.6.0

package/CHANGELOG.md

@@ -4,6 +4,36 @@
 
 ## [Unreleased]
 
+## [2.6.0] - 2026-10-30
+
+### 新增
+
+- **任务队列按工作区隔离**：快照/preview/回退/删除/gc 原先共用一条全局串行链，一个工作区的慢快照会把**所有会话**的撤回按钮一起堵住。现在同一工作区仍然串行（都在写同一个 git index），不同工作区并行；跨工作区的批量删除与全局 gc 用「等这些工作区的链尾全部落地」保证互斥。win32 下路径大小写归一，避免同一仓库拿到两把锁。
+- **单次快照时限可配置（`snapshotBudgetMs`，默认 3 分钟）**：整条快照脚本（扫描 + `add` + 写索引/打 tag）的兜底超时从硬编码 600 秒改为配置项，设置卡片按秒展示；`0` 表示不限制。
+
+### 修复
+
+- **Linux/macOS 上快照管理、批量删除/全部删除与「立即 gc」全部不可用**（[issue #30](https://github.com/limbo947/dsh-recall-plugin/issues/30)，POSIX dump 脚本的两个缺陷）：① 建仓后还没拍过快照的**空仓**没有 `index.json`/`lineage.json`，裸 `cat` 在 `set -e` 下让整条 dump 退出 1，磁盘上的仓一个都枚举不到；② 这两个文件落盘时没有尾换行，`cat` 后紧跟的段尾标记被粘到内容行尾，解析器按整行匹配永远收不到段尾——**即使文件齐全，每个仓也被解析成「无索引」**（报告者的临时处置只修了 ①，树依然是空的）。现在两处改为「缺席放行 + 内容后补一个换行」，逐仓隔离语义不变，存量数据无需迁移。
+- **设置页 exclude 编辑器可能回显垃圾字节**（同一类行边界缺陷）：`exclude.txt` 字节数为 3 的倍数时 base64 没有 `=` padding，粘在尾部的段尾标记会被一起解码；回显后再保存即污染文件。
+- **dump 脚本的测试从「字符串断言」升级为「真跑一遍」**：新增 [tests/unit/stores-dump-script.test.js](tests/unit/stores-dump-script.test.js)，在 bash 里执行生成的脚本并校验解析结果（CI 的 ubuntu 必然执行，win32 认 Git Bash）。此前只断言脚本文本与解析器行为，这两个只在执行期暴露的缺陷因此全绿漏过。
+
+### 文档
+
+- 新增 [plan-stores-dump-posix.md](docs/plans/completed/plan-stores-dump-posix.md)：issue #30 的双缺陷分析、实测矩阵与防回归设计；含「不采纳 warmup 落 `index.json = []`」「不采纳脚本保持 fail-fast」的依据，以及两条遗留（dump 失败对用户不可见、空仓无法回收）。
+- 新增 [plan-queue-and-budget.md](docs/plans/completed/plan-queue-and-budget.md)：含 web 新会话 cwd 的官方归属核查（`startSession` 取 `workspaceId ?? 当前 ?? 最近`、全链不传 cwd、无配置项/钩子可改写）——该项为官方行为，插件不改代码，只在 README 使用注意与 AGENTS 已知坑里写明。
+
+## [2.5.3] - 2026-10-30
+
+### 修复
+
+- **大工作区护栏静默失效（issue #29）**：快照前的预算扫描以 `git ls-files` 为准，此前它非零退出会被当作「没超限」——`$HOME` 级工作区（523 GB / 233 万条目）上实测每条消息先写约 10 GB 对象、600 秒后被杀，prune 回收后下一条消息再重复一遍。现在统计失败一律 **fail-closed**：脚本在 `add` 之前输出 `SNAP_SCAN_FAIL` / `SNAP_SCAN_ERR` 并跳过本次快照，原因（git 的 stderr 首行）进「最近错误」，该工作区暂停快照 10 分钟（改配置或 TTL 到期自动重试），不再重付一次全量扫描。
+- **超过 `maxFileBytes` 的文件不再先写对象再移出索引（issue #29）**：此前 `add -A` 会先为超大文件写入 blob，之后才由剔除逻辑移出 index——「小文件少 + 大文件多」的工作区能在预算通过后仍写满磁盘。改为先扫出大文件清单，`add` 带 `--pathspec-from-file` 的 exclude 清单执行（大文件既不进索引也不写对象），add 后仍按清单兜底剔除一次；不支持该选项的旧 git 自动退回裸 `add`（行为同旧版）。
+- **分钟级失败不再免费重试两次（issue #29）**：失败耗时 ≥60 秒视为「昂贵失败」，直接进入退避（5 分钟起、指数递增），不再按「连续 3 次失败」让用户先付三轮分钟级 + GB 级写入。
+
+### 变更
+
+- **快照 / 预览 / 回退三处 `add` 前统一切 cwd 到工作区根**：`--pathspec-from-file` 的隐含全集会被 cwd 前缀裁切（`:(top)` 救不回来，实测），脚本原先的 cwd 是宿主工作目录，可能正在工作区子目录里。
+
 ## [2.5.2] - 2026-10-28
 
 ### 修复

package/README.en.md

@@ -155,9 +155,10 @@ All options can be edited visually in the "**Settings → Plugin Config → Reca
 | --- | --- | --- |
 | `gcSnaps` | 50 | Run `git gc` after this many snapshots accumulate (env `DSH_RECALL_GC_SNAPS` force-overrides) |
 | `gcHours` | 24 | Run gc when this many hours have passed since the last one (whichever trigger fires first; env `DSH_RECALL_GC_HOURS`) |
-| `maxFileBytes` | 8388608 (8MB) | Files larger than this are neither snapshotted nor touched by recalls |
+| `maxFileBytes` | 8388608 (8MB) | Files larger than this are neither snapshotted nor touched by recalls; they are filtered out *before* `git add` from a path list, so no objects are written (older git falls back to add-then-remove) |
 | `maxWorkspaceBytes` | 268435456 (256MB) | Total snapshot-eligible file size per workspace, measured exactly as `git add` sees it (`.gitignore`, `.git/info/exclude` and the global excludesFile all apply). Exceeding it **disables snapshots for that workspace** (no truncation — a truncated snapshot would make rollback delete the skipped files) and shows a notice on recent messages; raise the limit or add exclusions to recover automatically. 0 = unlimited |
 | `scanBudgetMs` | 10000 (10s) | Time budget for measuring the snapshot-eligible total. Exceeding it skips the snapshot with a notice (guards against pathological directories stalling startup). 0 = unlimited |
+| `snapshotBudgetMs` | 180000 (3 min) | Total time for one snapshot from scan to write; exceeding it aborts the snapshot and records it under "Recent errors". 0 = unlimited |
 | `maxSnapshotsPerWorkspace` | 500 | Maximum snapshots kept per workspace; oldest pruned beyond the cap. 0 = unlimited |
 | `retentionDays` | 0 | Keep snapshots for this many days; older ones are deleted. 0 = disabled (works independently of the cap) |
 | `baseExcludes` | `.git`, `node_modules/`, `.dsh-recall-snapshots/`, `dsh-recall-snapshots/`, `target/`, `dist/`, `build/`, `out/`, `coverage/`, `.next/`, `.nuxt/`, `.output/`, `.cache/`, `.gradle/`, `*.exe`, `*.dll`, `*.pdb`, `*.so`, `*.dylib`, `*.msi`, `*.zip`, `*.7z`, `*.rar`, `*.tar`, `*.tar.gz`, `*.iso` | Base exclusion list (gitignore syntax, lower priority than exclude.txt); excluded large directories are skipped as whole subtrees during snapshot scans. Directory-form entries (e.g. `target/`) mean one more thing: **when a path segment of the workspace root itself matches, snapshots are disabled for that workspace** — patterns are relative to the root, so they can never exclude the root itself (i.e. a session opened inside a build-output directory), and such directories have no rollback value anyway; remove the entry to re-enable |
@@ -198,7 +199,7 @@ The plugin manages disk usage automatically — no manual housekeeping needed:
 
 The most common questions and their troubleshooting paths; for the full set of design boundaries see "Known Limitations" above, and environment-class failures (git missing / disk full / permission denied / …) are explained in the settings card's "Recent errors".
 
-**No "↶ Recall" button next to a message?** Check in order of likelihood: (1) the DSH process wasn't restarted after installing — restart it and hard-refresh (Ctrl+Shift+R); (2) git CLI isn't on PATH — a notice shows at the top of the page; (3) the message predates the plugin — snapshots are only created when a message is sent; (4) snapshots are disabled for that workspace — it sits under a directory-form exclusion (e.g. opened inside `dist/`) or exceeded the `maxWorkspaceBytes` / `scanBudgetMs` guardrails, in which case recent messages carry a recovery notice (raise the limit or extend the exclusion list and it recovers automatically).
+**No "↶ Recall" button next to a message?** Check in order of likelihood: (1) the DSH process wasn't restarted after installing — restart it and hard-refresh (Ctrl+Shift+R); (2) git CLI isn't on PATH — a notice shows at the top of the page; (3) the message predates the plugin — snapshots are only created when a message is sent; (4) snapshots are disabled for that workspace — it sits under a directory-form exclusion (e.g. opened inside `dist/`), exceeded the `maxWorkspaceBytes` / `scanBudgetMs` guardrails, or the pre-snapshot size scan itself failed (`git ls-files` error; the reason is in "Recent errors" and it retries after 10 minutes) — recent messages carry a recovery notice (raise the limit or extend the exclusion list and it recovers automatically).
 
 **Some files weren't restored by a recall?** They weren't in the snapshot: larger than `maxFileBytes` (8MB by default), matched by the exclusion list, or inside a nested git repository / a win32 reparse point (see "Known Limitations"). The confirmation panel's file list before a recall is the exact rollback scope — trust it.
 

package/README.md

@@ -152,9 +152,10 @@ peerDependencies 按 minor 版本线开窗，与 `dsh.compatibility.dshReleases`
 | --- | --- | --- |
 | `gcSnaps` | 50 | 每积累多少条快照触发一次 `git gc`（env `DSH_RECALL_GC_SNAPS` 可强制覆盖） |
 | `gcHours` | 24 | 距上次 gc 超过多少小时触发（与条数先到先触发；env `DSH_RECALL_GC_HOURS`） |
-| `maxFileBytes` | 8388608（8MB） | 超过该大小的文件不进快照、不被回退触碰 |
+| `maxFileBytes` | 8388608（8MB） | 超过该大小的文件不进快照、不被回退触碰；在 `git add` 之前就按清单剔除，不写对象（旧 git 退回「先加后剔」） |
 | `maxWorkspaceBytes` | 268435456（256MB） | 单工作区可纳入快照的文件总量上限，口径与 `git add` 一致（`.gitignore`、`.git/info/exclude`、全局 excludesFile 都算数）。超过时**停用该工作区快照**（不截断——截断快照回退时会误删未纳入的文件），并在最近消息上提示；调大该值或补充排除表后自动恢复；0 = 不限制 |
 | `scanBudgetMs` | 10000（10 秒） | 快照前统计纳入总量的时间预算。超过时停用本次快照并提示（防病态大目录拖死启动）；0 = 不限制 |
+| `snapshotBudgetMs` | 180000（3 分钟） | 单次快照从扫描到写入的总时限，超时即中止本次快照并记入「最近错误」；0 = 不限制 |
 | `maxSnapshotsPerWorkspace` | 500 | 每个工作区保留的最大快照数，超限自动删除最旧的；0 = 不限制 |
 | `retentionDays` | 0 | 按天数保留快照，超期自动删除；0 = 不启用（与条数上限各自独立生效） |
 | `baseExcludes` | `.git`、`node_modules/`、`.dsh-recall-snapshots/`、`dsh-recall-snapshots/`、`target/`、`dist/`、`build/`、`out/`、`coverage/`、`.next/`、`.nuxt/`、`.output/`、`.cache/`、`.gradle/`、`*.exe`、`*.dll`、`*.pdb`、`*.so`、`*.dylib`、`*.msi`、`*.zip`、`*.7z`、`*.rar`、`*.tar`、`*.tar.gz`、`*.iso` | 基础排除表（gitignore 语法，优先级低于 exclude.txt）；被排除的大目录整棵子树不进快照扫描。其中「目录形态」项（如 `target/`）另有一层含义：**工作区根自身的路径段命中时，该工作区不启用快照**——在构建产物目录里开会话时排除表本来就管不到它自己（模式是相对该 root 的），这类目录也没有回退价值；删掉对应项即恢复 |
@@ -195,7 +196,7 @@ peerDependencies 按 minor 版本线开窗，与 `dsh.compatibility.dshReleases`
 
 使用中最常遇到的几类问题与排查路径；更完整的设计边界见上文「已知限制」，环境类失败（git 缺失 / 磁盘满 / 无权限等）的原因在设置卡片「最近错误」里可查。
 
-**消息旁没有「↶ 撤回」按钮？** 按概率排查：① 装完没重启 DSH 进程——重启后硬刷新页面（Ctrl+Shift+R）；② git CLI 不在 PATH——页面顶部会有安装提示；③ 该消息发送于插件启用之前——快照只在消息发送时创建，历史消息无快照；④ 该工作区被停用快照——工作区开在 `dist/`、`target/` 这类命中基础排除表目录形态的位置，或超出 `maxWorkspaceBytes` / `scanBudgetMs` 护栏，最近消息上会给出恢复提示（调大上限或补充排除表后自动恢复）。
+**消息旁没有「↶ 撤回」按钮？** 按概率排查：① 装完没重启 DSH 进程——重启后硬刷新页面（Ctrl+Shift+R）；② git CLI 不在 PATH——页面顶部会有安装提示；③ 该消息发送于插件启用之前——快照只在消息发送时创建，历史消息无快照；④ 该工作区被停用快照——工作区开在 `dist/`、`target/` 这类命中基础排除表目录形态的位置，或超出 `maxWorkspaceBytes` / `scanBudgetMs` 护栏，或快照前的范围统计本身失败（`git ls-files` 报错，原因见「最近错误」，10 分钟后自动重试）；最近消息上会给出恢复提示（调大上限或补充排除表后自动恢复）。
 
 **撤回后个别文件没有恢复？** 该文件不在快照里：超过 `maxFileBytes`（默认 8MB）、命中排除表，或位于嵌套 git 仓库 / win32 目录重解析点内（见「已知限制」）。撤回前确认面板的清单就是实际回退范围，以它为准。
 

package/lib/client.js

@@ -592,6 +592,9 @@
     "config.scanBudgetMs.label": "\u626B\u63CF\u65F6\u95F4\u9884\u7B97",
     "config.scanBudgetMs.hint": "\u5FEB\u7167\u524D\u7EDF\u8BA1\u7EB3\u5165\u603B\u91CF\u8D85\u8FC7\u8BE5\u65F6\u957F\u5373\u505C\u7528\u672C\u6B21\u5FEB\u7167\uFF1B0 \u8868\u793A\u4E0D\u9650\u5236",
     "config.scanBudgetMs.suffix": "\u79D2",
+    "config.snapshotBudgetMs.label": "\u5355\u6B21\u5FEB\u7167\u65F6\u9650",
+    "config.snapshotBudgetMs.hint": "\u5355\u6B21\u5FEB\u7167\u4ECE\u626B\u63CF\u5230\u5199\u5165\u7684\u603B\u65F6\u9650\uFF0C\u8D85\u65F6\u5373\u4E2D\u6B62\u672C\u6B21\u5FEB\u7167\u5E76\u8BB0\u5165\u6700\u8FD1\u9519\u8BEF\uFF1B0 \u8868\u793A\u4E0D\u9650\u5236",
+    "config.snapshotBudgetMs.suffix": "\u79D2",
     "config.maxSnapshotsPerWorkspace.label": "\u5FEB\u7167\u603B\u91CF\u4E0A\u9650",
     "config.maxSnapshotsPerWorkspace.hint": "\u6BCF\u5DE5\u4F5C\u533A\u4FDD\u7559\u7684\u6700\u5927\u5FEB\u7167\u6570\uFF0C\u8D85\u9650\u5220\u9664\u6700\u65E7\u7684\uFF1B0 \u8868\u793A\u4E0D\u9650\u5236",
     "config.maxSnapshotsPerWorkspace.suffix": "\u6761",
@@ -624,6 +627,7 @@
     "config.err.maxFileBytes": "\u6587\u4EF6\u5927\u5C0F\u4E0A\u9650\u81F3\u5C11 0.01 MB",
     "config.err.maxWorkspaceBytes": "\u5DE5\u4F5C\u533A\u603B\u91CF\u4E0A\u9650\u5FC5\u987B\u662F >= 0 \u7684\u6570\u5B57\uFF080 \u8868\u793A\u4E0D\u9650\u5236\uFF09",
     "config.err.scanBudgetMs": "\u626B\u63CF\u65F6\u95F4\u9884\u7B97\u5FC5\u987B\u662F >= 0 \u7684\u6570\u5B57\uFF080 \u8868\u793A\u4E0D\u9650\u5236\uFF09",
+    "config.err.snapshotBudgetMs": "\u5355\u6B21\u5FEB\u7167\u65F6\u9650\u5FC5\u987B\u662F >= 0 \u7684\u6570\u5B57\uFF080 \u8868\u793A\u4E0D\u9650\u5236\uFF09",
     "config.err.maxSnapshots": "\u5FEB\u7167\u603B\u91CF\u4E0A\u9650\u5FC5\u987B\u662F >= 0 \u7684\u6574\u6570\uFF080 \u8868\u793A\u4E0D\u9650\u5236\uFF09",
     "config.err.retentionDays": "\u4FDD\u7559\u5929\u6570\u5FC5\u987B\u662F >= 0 \u7684\u6574\u6570\uFF080 \u8868\u793A\u4E0D\u542F\u7528\uFF09",
     "config.err.locale": "\u754C\u9762\u8BED\u8A00\u5FC5\u987B\u662F auto / zh / en \u4E4B\u4E00",
@@ -846,6 +850,9 @@
     "config.scanBudgetMs.label": "Scan time budget",
     "config.scanBudgetMs.hint": "Skip this snapshot when measuring the snapshot-eligible total exceeds this duration; 0 means unlimited",
     "config.scanBudgetMs.suffix": "s",
+    "config.snapshotBudgetMs.label": "Snapshot time limit",
+    "config.snapshotBudgetMs.hint": "Total time for one snapshot from scan to write; exceeding it aborts the snapshot and records it under recent errors; 0 means unlimited",
+    "config.snapshotBudgetMs.suffix": "s",
     "config.maxSnapshotsPerWorkspace.label": "Snapshot count limit",
     "config.maxSnapshotsPerWorkspace.hint": "Maximum snapshots kept per workspace; the oldest are deleted beyond it; 0 means unlimited",
     "config.maxSnapshotsPerWorkspace.suffix": "snapshots",
@@ -878,6 +885,7 @@
     "config.err.maxFileBytes": "The file size limit must be at least 0.01 MB",
     "config.err.maxWorkspaceBytes": "The workspace total limit must be a number >= 0 (0 means unlimited)",
     "config.err.scanBudgetMs": "The scan time budget must be a number >= 0 (0 means unlimited)",
+    "config.err.snapshotBudgetMs": "The snapshot time limit must be a number >= 0 (0 means unlimited)",
     "config.err.maxSnapshots": "The snapshot count limit must be an integer >= 0 (0 means unlimited)",
     "config.err.retentionDays": "Retention days must be an integer >= 0 (0 disables it)",
     "config.err.locale": "Language must be one of auto / zh / en",
@@ -2762,6 +2770,8 @@
               maxWorkspaceBytes: bytesToMb2(v.maxWorkspaceBytes),
               // 扫描预算持久化为毫秒、展示为秒（整数）；0 表示不限制，原样显示 0
               scanBudgetMs: String(v.scanBudgetMs == null ? "" : Math.round(Number(v.scanBudgetMs) / 1e3)),
+              // issue #29：单次快照总时限，同样按秒展示
+              snapshotBudgetMs: String(v.snapshotBudgetMs == null ? "" : Math.round(Number(v.snapshotBudgetMs) / 1e3)),
               maxSnapshotsPerWorkspace: String(v.maxSnapshotsPerWorkspace == null ? "" : v.maxSnapshotsPerWorkspace),
               baseExcludes: Array.isArray(v.baseExcludes) ? v.baseExcludes.join("\n") : "",
               refillDraft: v.refillDraft !== false,
@@ -2793,7 +2803,7 @@
       function save() {
         if (state.busy || !draft || !baseline) return;
         const patch = {};
-        for (const key of ["gcSnaps", "gcHours", "maxFileBytes", "maxWorkspaceBytes", "scanBudgetMs", "maxSnapshotsPerWorkspace", "baseExcludes", "refillDraft", "snapshotEnabled", "archiveOriginal", "editSubmitsImmediately", "retentionDays", "locale"]) {
+        for (const key of ["gcSnaps", "gcHours", "maxFileBytes", "maxWorkspaceBytes", "scanBudgetMs", "snapshotBudgetMs", "maxSnapshotsPerWorkspace", "baseExcludes", "refillDraft", "snapshotEnabled", "archiveOriginal", "editSubmitsImmediately", "retentionDays", "locale"]) {
           const value = draft[key];
           if (value !== void 0 && value !== baseline[key]) patch[key] = value;
         }
@@ -2842,6 +2852,14 @@
           }
           clean.scanBudgetMs = Math.round(s * 1e3);
         }
+        if (patch.snapshotBudgetMs !== void 0) {
+          const s = Number(patch.snapshotBudgetMs);
+          if (!Number.isFinite(s) || s < 0) {
+            setState({ busy: false, message: t("config.err.snapshotBudgetMs"), error: true });
+            return;
+          }
+          clean.snapshotBudgetMs = Math.round(s * 1e3);
+        }
         if (patch.maxSnapshotsPerWorkspace !== void 0) {
           const n = parseInt(String(patch.maxSnapshotsPerWorkspace), 10);
           if (!Number.isFinite(n) || n < 0) {
@@ -3021,6 +3039,8 @@
           // issue #24 护栏：单文件上限之外的两道闸（总量 + 扫描耗时），0 = 不限制
           numRow("maxWorkspaceBytes", t("config.maxWorkspaceBytes.label"), t("config.maxWorkspaceBytes.hint"), { suffixKey: "config.maxWorkspaceBytes.suffix", min: 0, step: 16 }),
           numRow("scanBudgetMs", t("config.scanBudgetMs.label"), t("config.scanBudgetMs.hint"), { suffixKey: "config.scanBudgetMs.suffix", min: 0, step: 1 }),
+          // issue #29：扫描阶段之外还有 add/写索引——单次快照的总时限兜底
+          numRow("snapshotBudgetMs", t("config.snapshotBudgetMs.label"), t("config.snapshotBudgetMs.hint"), { suffixKey: "config.snapshotBudgetMs.suffix", min: 0, step: 30 }),
           numRow("maxSnapshotsPerWorkspace", t("config.maxSnapshotsPerWorkspace.label"), t("config.maxSnapshotsPerWorkspace.hint"), { suffixKey: "config.maxSnapshotsPerWorkspace.suffix", min: 0, step: 1 }),
           numRow("retentionDays", t("config.retentionDays.label"), t("config.retentionDays.hint"), { suffixKey: "config.retentionDays.suffix", min: 0, step: 1 }),
           React.createElement("div", { className: "dsh-recall-cfg-group" }, t("config.group.ui")),

package/lib/config.js

@@ -40,6 +40,9 @@ const Config = Schema.object({
   // 截断快照回退时，未纳入的文件会命中回退脚本的「当前有、目标无」删除侧。
   maxWorkspaceBytes: withVolatile(Schema.number().default(268435456).description("\u5355\u5DE5\u4F5C\u533A\u53EF\u7EB3\u5165\u5FEB\u7167\u7684\u6587\u4EF6\u603B\u91CF\u4E0A\u9650\uFF0C\u53E3\u5F84\u4E0E git add \u4E00\u81F4\uFF08\u542B .gitignore\uFF09\uFF0C\u8D85\u8FC7\u5373\u505C\u7528\u8BE5\u5DE5\u4F5C\u533A\u5FEB\u7167\uFF1B0 \u8868\u793A\u4E0D\u9650\u5236")),
   scanBudgetMs: withVolatile(Schema.number().default(1e4).description("\u5FEB\u7167\u524D\u7EDF\u8BA1\u7EB3\u5165\u603B\u91CF\u7684\u65F6\u95F4\u9884\u7B97\uFF0C\u8D85\u65F6\u5373\u505C\u7528\u672C\u6B21\u5FEB\u7167\uFF1B0 \u8868\u793A\u4E0D\u9650\u5236")),
+  // issue #29：scanBudgetMs 只约束「统计阶段」，真正的耗时与写盘在 add。
+  // 这条是整条快照脚本的兜底时限——慢盘或病态工作区上它才是把队列拖住的一段。
+  snapshotBudgetMs: withVolatile(Schema.number().default(18e4).description("\u5355\u6B21\u5FEB\u7167\u7684\u603B\u65F6\u9650\uFF08\u6BEB\u79D2\uFF0C\u542B\u626B\u63CF\u4E0E\u5199\u5165\uFF09\uFF0C\u8D85\u65F6\u5373\u4E2D\u6B62\u672C\u6B21\u5FEB\u7167\u5E76\u8BB0\u5F55\uFF1B0 \u8868\u793A\u4E0D\u9650\u5236")),
   maxSnapshotsPerWorkspace: withVolatile(Schema.number().default(500).description("\u6BCF\u4E2A\u5DE5\u4F5C\u533A\u4FDD\u7559\u7684\u6700\u5927\u5FEB\u7167\u6570\uFF0C\u8D85\u9650\u5220\u9664\u6700\u65E7\u7684")),
   baseExcludes: withVolatile(Schema.array(Schema.string()).default(BASE_EXCLUDES).description("\u57FA\u7840\u6392\u9664\u8868\uFF08gitignore \u8BED\u6CD5\uFF0C\u4F18\u5148\u7EA7\u4F4E\u4E8E exclude.txt\uFF09")),
   refillDraft: withVolatile(Schema.boolean().default(true).description("\u64A4\u56DE\u540E\u628A\u88AB\u64A4\u56DE\u7684\u6D88\u606F\uFF08\u6587\u672C\u4E0E\u9644\u4EF6\uFF09\u56DE\u586B\u5230\u8F93\u5165\u6846")),
@@ -129,6 +132,7 @@ const DEFAULTS = {
   maxFileBytes: 8388608,
   maxWorkspaceBytes: 268435456,
   scanBudgetMs: 1e4,
+  snapshotBudgetMs: 18e4,
   maxSnapshotsPerWorkspace: 500,
   baseExcludes: BASE_EXCLUDES,
   refillDraft: true,
@@ -150,6 +154,7 @@ function createConfig(raw) {
   const maxFileBytes = pickNumber(cfg.maxFileBytes, 8388608, 1024);
   const maxWorkspaceBytes = pickNumber(cfg.maxWorkspaceBytes, 268435456, 0);
   const scanBudgetMs = pickNumber(cfg.scanBudgetMs, 1e4, 0);
+  const snapshotBudgetMs = pickNumber(cfg.snapshotBudgetMs, 18e4, 0);
   const rawMax = typeof cfg.maxSnapshotsPerWorkspace === "number" ? cfg.maxSnapshotsPerWorkspace : parseInt(String(cfg.maxSnapshotsPerWorkspace == null ? "" : cfg.maxSnapshotsPerWorkspace), 10);
   const maxSnapshotsPerWorkspace = Number.isFinite(rawMax) ? Math.max(0, rawMax) : 500;
   const baseExcludes = Array.isArray(cfg.baseExcludes) && cfg.baseExcludes.length ? cfg.baseExcludes.filter((p) => typeof p === "string" && p.trim()) : BASE_EXCLUDES;
@@ -160,7 +165,7 @@ function createConfig(raw) {
   const rawDays = typeof cfg.retentionDays === "number" ? cfg.retentionDays : parseInt(String(cfg.retentionDays == null ? "" : cfg.retentionDays), 10);
   const retentionDays = Number.isFinite(rawDays) ? Math.max(0, rawDays) : 0;
   const locale = cfg.locale === "zh" || cfg.locale === "en" ? cfg.locale : "auto";
-  return { gcSnaps, gcHours, maxFileBytes, maxWorkspaceBytes, scanBudgetMs, maxSnapshotsPerWorkspace, baseExcludes, refillDraft, snapshotEnabled, archiveOriginal, editSubmitsImmediately, retentionDays, locale };
+  return { gcSnaps, gcHours, maxFileBytes, maxWorkspaceBytes, scanBudgetMs, snapshotBudgetMs, maxSnapshotsPerWorkspace, baseExcludes, refillDraft, snapshotEnabled, archiveOriginal, editSubmitsImmediately, retentionDays, locale };
 }
 export {
   Config,

package/lib/index.js

@@ -9,6 +9,7 @@ import { createRoutesCore } from "./routes-core.js";
 import { createRoutesManage } from "./routes-manage.js";
 import { createIntentJournal } from "./intent-journal.js";
 import { createEnsureRootReady } from "./root-ready.js";
+import { createQueues } from "./queues.js";
 import * as dshSettings from "@deepseek-ai/dsh-settings";
 import * as E from "./errors.js";
 const name = "dsh-recall-plugin";
@@ -55,12 +56,7 @@ function apply(ctx, config) {
     if (text === E.RECALL_BODY_TOO_LARGE) return { ok: false, code: E.RECALL_BODY_TOO_LARGE, message: "\u8BF7\u6C42\u4F53\u8D85\u8FC7 1MB \u4E0A\u9650" };
     return { ok: false, code: E.RECALL_ERROR, message: text };
   }
-  function enqueue(task) {
-    const run = state.queue.then(task);
-    state.queue = run.catch(() => {
-    });
-    return run;
-  }
+  const queues = createQueues(process.platform === "win32");
   async function runLimited(tasks, concurrency) {
     const limit = concurrency > 0 ? concurrency : 4;
     let index = 0;
@@ -246,7 +242,8 @@ function apply(ctx, config) {
     state,
     cfg,
     supported,
-    enqueue,
+    enqueueFor: queues.enqueueFor,
+    enqueueMany: queues.enqueueMany,
     agentBusy,
     runLimited,
     ensureRootReady,
@@ -314,9 +311,14 @@ function apply(ctx, config) {
     if (session && session.header && session.header.origin === "subagent") return;
     const messageId = data.id;
     const time = event.time;
-    state.queue = state.queue.then(() => cfg.snapshotEnabled ? snaps.captureSnapshot(session.id, messageId, time) : null).then(() => maint.maybeMaintain(session.id)).then(() => {
+    void (async () => {
+      const root = await rt.resolveRoot(session.id);
+      await queues.enqueueFor(root, async () => {
+        if (cfg.snapshotEnabled) await snaps.captureSnapshot(session.id, messageId, time);
+      });
+      await queues.enqueueFor(root, () => maint.maybeMaintain(session.id));
       listCache.stale = true;
-    }).catch((error) => rt.recordError("recall snapshot error: " + String(error)));
+    })().catch((error) => rt.recordError("recall snapshot error: " + String(error)));
   });
   (async () => {
     let shellReady = false;

package/lib/queues.js

@@ -0,0 +1,30 @@
+function createQueues(isWin) {
+  const tails = /* @__PURE__ */ new Map();
+  const keyOf = (root) => {
+    const k = String(root == null ? "" : root);
+    return k !== "" && isWin ? k.toLowerCase() : k;
+  };
+  function tailFor(key) {
+    return tails.get(key) || Promise.resolve();
+  }
+  function enqueueFor(root, task) {
+    const key = keyOf(root);
+    const run = tailFor(key).then(task);
+    tails.set(key, run.catch(() => {
+    }));
+    return run;
+  }
+  function enqueueMany(roots, task) {
+    const keys = Array.from(new Set(roots.map(keyOf)));
+    if (keys.length === 0) keys.push("");
+    const run = Promise.all(keys.map(tailFor)).then(task);
+    const tail = run.catch(() => {
+    });
+    for (const key of keys) tails.set(key, tail);
+    return run;
+  }
+  return { enqueueFor, enqueueMany };
+}
+export {
+  createQueues
+};

package/lib/routes-core.js

@@ -4,7 +4,7 @@ import { buildArtifactRootSegment, buildRootNotice } from "./exclude-patterns.js
 const RECALL_EVENT_COMPLETE_HOST = "dsh-recall/complete";
 const RECALL_EVENT_FAILED_HOST = "dsh-recall/failed";
 function createRoutesCore(deps) {
-  const { rt, snaps, state, cfg, supported, enqueue, agentBusy, rescueRollback, intentJournal, ensureRootReady, emitEvent, E } = deps;
+  const { rt, snaps, state, cfg, supported, enqueueFor, agentBusy, rescueRollback, intentJournal, ensureRootReady, emitEvent, E } = deps;
   return {
     "init": async (args) => {
       if (!supported) {
@@ -48,7 +48,7 @@ function createRoutesCore(deps) {
       const sessionId = args && args.sessionId ? String(args.sessionId) : null;
       const snap = state.snapshots.get(id);
       if (agentBusy(sessionId, snap ? snap.root : null)) return { ok: false, code: E.RECALL_AGENT_BUSY, message: "Agent \u6B63\u5728\u8FD0\u884C\u4E2D\uFF0C\u8BF7\u5148\u505C\u6B62\u540E\u518D\u64A4\u56DE" };
-      const result = await enqueue(() => snaps.diffFor(id));
+      const result = await enqueueFor(snap ? snap.root : null, () => snaps.diffFor(id));
       if (result === null) return { ok: false, code: E.RECALL_NO_SNAPSHOT, message: "\u8BE5\u6D88\u606F\u6CA1\u6709\u53EF\u7528\u7684\u9879\u76EE\u5FEB\u7167" };
       const snap2 = state.snapshots.get(id);
       const cutSeq = await snaps.resolveCutSeq(sessionId, id);
@@ -66,7 +66,8 @@ function createRoutesCore(deps) {
         const staleQueueItemIds2 = await snaps.resolveStaleQueueItemIds(sessionId, cutSeq2);
         return { ok: true, count: 0, cutSeq: cutSeq2, staleQueueItemIds: staleQueueItemIds2 };
       }
-      const result = await enqueue(async () => {
+      const initialSnap = state.snapshots.get(id);
+      const result = await enqueueFor(initialSnap ? initialSnap.root : null, async () => {
         const snap = state.snapshots.get(id);
         if (!snap) return { ok: false, code: E.RECALL_NO_SNAPSHOT, message: "\u8BE5\u6D88\u606F\u6CA1\u6709\u53EF\u7528\u7684\u9879\u76EE\u5FEB\u7167" };
         const store = state.stores.get(snap.root);

package/lib/routes-manage.js

@@ -10,7 +10,8 @@ function createRoutesManage(deps) {
     state,
     cfg,
     supported,
-    enqueue,
+    enqueueFor,
+    enqueueMany,
     runLimited,
     listExcludeFiles,
     dumpStores,
@@ -114,7 +115,7 @@ function createRoutesManage(deps) {
       else byRoot.set(rec.root, [rec.id]);
     }
     let deleted = 0;
-    await enqueue(async () => {
+    await enqueueMany(Array.from(byRoot.keys()), async () => {
       for (const [root, rootIds] of byRoot) {
         let store = state.stores.get(root) || null;
         if (!store) {
@@ -152,7 +153,7 @@ function createRoutesManage(deps) {
     return deleted;
   }
   async function deleteAllSnapshots() {
-    return enqueue(async () => {
+    return enqueueMany(Array.from(state.stores.keys()), async () => {
       const stores = /* @__PURE__ */ new Map();
       for (const [root, store] of state.stores.entries()) {
         if (store && store.dir) stores.set(store.dir, { store, root });
@@ -282,6 +283,8 @@ function createRoutesManage(deps) {
           maxFileBytes: cfg.maxFileBytes,
           maxWorkspaceBytes: cfg.maxWorkspaceBytes,
           scanBudgetMs: cfg.scanBudgetMs,
+          // issue #29：单次快照总时限（设置卡片的「单次快照时限」）
+          snapshotBudgetMs: cfg.snapshotBudgetMs,
           maxSnapshotsPerWorkspace: cfg.maxSnapshotsPerWorkspace,
           baseExcludes: cfg.baseExcludes.slice(),
           refillDraft: cfg.refillDraft,
@@ -526,7 +529,7 @@ function createRoutesManage(deps) {
         }
         const finalStore = store;
         const finalRoot = snapRoot;
-        await enqueue(async () => {
+        await enqueueFor(finalRoot, async () => {
           if (state.gitExe) {
             await rt.runShell(rt.scripts.purgeTagsScript(finalStore, state.gitExe, ["snap-" + id]), { timeoutMs: 12e4, stdoutMaxBytes: 4096 });
           }
@@ -556,7 +559,7 @@ function createRoutesManage(deps) {
         return { ok: true, deleted: result.deleted, stores: result.stores };
       }
       if (op === "gc") {
-        const done = sessionId ? await enqueue(() => maint.runGc(sessionId, true)) : await enqueue(() => maint.runGcAll());
+        const done = sessionId ? await enqueueFor(await rt.resolveRoot(sessionId), () => maint.runGc(sessionId, true)) : await enqueueMany(Array.from(state.stores.keys()), () => maint.runGcAll());
         usageCache.payload = null;
         return { ok: true, gc: Boolean(done) };
       }

package/lib/scripts.posix.js

@@ -36,14 +36,34 @@ function dirPruneArgsBlock() {
     "if [ ${#oversize_args[@]} -gt 0 ]; then oversize_prune=('(' -type d '(' \"${oversize_args[@]}\" ')' ')' -prune -o); fi"
   ].join("\n");
 }
-function oversizeBlock(maxBytes) {
+function oversizeRemoveBlock() {
+  return 'xargs -0 "$git" --literal-pathspecs --git-dir="$g" --work-tree="$root" update-index --force-remove -- < "$oversize_r" 2>/dev/null || true';
+}
+function oversizeListBlock(maxBytes) {
   return [
     dirPruneArgsBlock(),
+    'oversize_p="$g/oversize-pathspec.$$"',
+    'oversize_r="$g/oversize-rel.$$"',
+    ': > "$oversize_p"',
+    ': > "$oversize_r"',
     'find "$root" "${oversize_prune[@]}" -type f -size +' + String(maxBytes || MAX_FILE_BYTES) + "c -print0 2>/dev/null | while IFS= read -r -d '' f; do",
-    `  printf '%s\\0' "\${f#"$root"/}"`,
-    // --work-tree 不可省：bare 影子仓库下裸 update-index fatal（被 || true 吞掉
-    // 后大文件会静默留在 index 里），maxFileBytes 的承诺会形同虚设
-    'done | xargs -0 "$git" --literal-pathspecs --git-dir="$g" --work-tree="$root" update-index --force-remove -- 2>/dev/null || true'
+    '  oversize_rel="${f#"$root"/}"',
+    `  printf '%s\\0' ":(top,exclude,literal)$oversize_rel" >> "$oversize_p"`,
+    `  printf '%s\\0' "$oversize_rel" >> "$oversize_r"`,
+    "done",
+    oversizeRemoveBlock()
+  ].join("\n");
+}
+function oversizeAddPrepBlock() {
+  return [
+    "pa_args=()",
+    'if [ -s "$oversize_p" ]; then',
+    `  if [ -f "$g/pathspec-from-file.ok" ] || "$git" add -h 2>&1 | grep -q -- '--pathspec-from-file'; then`,
+    `    printf '1\\n' > "$g/pathspec-from-file.ok" 2>/dev/null || true`,
+    '    pa_args=(--pathspec-from-file="$oversize_p" --pathspec-file-nul)',
+    "  fi",
+    "fi",
+    'cd "$root"'
   ].join("\n");
 }
 function limitScanBlock(maxBytes, fileMaxBytes, budgetMs) {
@@ -53,13 +73,22 @@ function limitScanBlock(maxBytes, fileMaxBytes, budgetMs) {
   return [
     "limit_start=$(date +%s)",
     'limit_tmp="$g/limit-scan.$$"',
-    "limit_scan_ok=0",
-    // set -e：条件位置豁免，ls-files 失败不终止脚本——fail-open 只放行不判定
-    'if "$git" -c core.quotePath=false --git-dir="$g" --work-tree="$root" ls-files -z -co --exclude-standard > "$limit_tmp" 2>/dev/null; then',
-    "  limit_scan_ok=1",
+    'limit_err="$g/limit-scan-err.$$"',
+    // set -e：条件位置豁免，失败由 else 分支显式处理（不许穿透到 add）
+    'if "$git" -c core.quotePath=false --git-dir="$g" --work-tree="$root" ls-files -z -co --exclude-standard > "$limit_tmp" 2> "$limit_err"; then',
+    "  :",
+    "else",
+    "  limit_rc=$?",
+    // 压平成单行才能随哨兵回传；截 300 字符防一条巨长 stderr 撑爆错误环
+    '  limit_msg=$(head -c 300 "$limit_err" 2>/dev/null | tr "\\n\\r" "  ")',
+    '  rm -f "$limit_tmp" "$limit_err"',
+    `  printf 'SNAP_SCAN_FAIL %s\\n' "$limit_rc"`,
+    `  printf 'SNAP_SCAN_ERR %s\\n' "$limit_msg"`,
+    "  exit 0",
     "fi",
+    'rm -f "$limit_err"',
     'limit_sizes=""',
-    'if [ "$limit_scan_ok" = 1 ] && [ -s "$limit_tmp" ]; then',
+    'if [ -s "$limit_tmp" ]; then',
     // ls-files 输出相对 root 的路径，而脚本 cwd 是宿主工作目录：必须 cd 进去再 stat
     `  if find "$root" -maxdepth 0 -printf '' >/dev/null 2>&1; then`,
     `    limit_sizes=$(cd "$root" && xargs -0 stat -c '%s %F' -- < "$limit_tmp" 2>/dev/null || true)`,
@@ -70,7 +99,7 @@ function limitScanBlock(maxBytes, fileMaxBytes, budgetMs) {
     'rm -f "$limit_tmp"',
     // 目录条目（嵌套仓库在 ls-files 里输出 `dir/`）不计入：add 侧同样不纳入它
     // 的内容（gitlink 被剔除 / 无提交时 unable to index）；越过单文件上限的也
-    // 不计入——oversizeBlock 随后会把它移出 index
+    // 不计入——oversizeListBlock 随后会把它移出 index
     `limit_total=$(printf '%s\\n' "$limit_sizes" | awk -v lim=` + limit + " -v flim=" + fileLimit + ` '{ if (tolower($0) ~ /directory/) next; if ($1 <= flim) { s += $1; if (lim > 0 && s > lim) { print "OVER " s; exit } } } END { if (lim <= 0 || s <= lim) print s }')`,
     "limit_elapsed=$(( $(date +%s) - limit_start ))",
     'case "$limit_total" in',
@@ -205,14 +234,17 @@ function snapshotScript(root, store, gitExe, messageId, base) {
     excludeSyncBlock(store.excludeFile, base),
     // issue #24：总量/预算护栏先于 add——超限时连 add 都不跑
     limitScanBlock(store.maxWorkspaceBytes, store.maxFileBytes, store.scanBudgetMs),
+    // issue #29：大文件清单先于 add——add 带 exclude 后不再为它们写对象
+    oversizeListBlock(store.maxFileBytes),
     attrsMigrateBlock(),
+    oversizeAddPrepBlock(),
     // fail-open add（issue #7 加固，语义见 pwsh 版同款注释）：--ignore-errors
     // 下「无法索引的路径」以退出码 1 结束但索引已落盘；≥2 才是真 fatal，
     // 显式退出让 runShell 抛错（set -e 对 add 非零本会终止，但 || rc=$?
     // 捕获后必须自检，否则 tolerated/fatal 无法区分）。stderr 合并进变量
     // 供 fatal 时带回诊断与 SNAP_SKIP 提取。
     "addrc=0",
-    'add_log=$("$git" --git-dir="$g" --work-tree="$root" add -A --ignore-errors 2>&1) || addrc=$?',
+    'add_log=$("$git" --git-dir="$g" --work-tree="$root" add -A --ignore-errors "${pa_args[@]}" 2>&1) || addrc=$?',
     `if [ "$addrc" -ge 2 ]; then printf '%s\\n' "$add_log" >&2; exit "$addrc"; fi`,
     `printf '%s\\n' "$add_log" | sed -n "s/^error: unable to index file '\\(.*\\)'$/\\1/p" | sort -u | while IFS= read -r sk; do`,
     // 循环体用 if/fi 而非 && 列表：&& 列表条件为假时整条管道退出码为 1，
@@ -220,7 +252,9 @@ function snapshotScript(root, store, gitExe, messageId, base) {
     `  if [ -n "$sk" ]; then printf 'SNAP_SKIP %s\\n' "$sk"; fi`,
     "done",
     dropGitlinksBlock(),
-    oversizeBlock(store.maxFileBytes),
+    // 兜底：旧 git 走裸 add 时大文件仍会被重新索引，这里按清单再清一次
+    oversizeRemoveBlock(),
+    'rm -f "$oversize_p" "$oversize_r"',
     'tree=$("$git" --git-dir="$g" --work-tree="$root" write-tree)',
     'commit=$("$git" --git-dir="$g" -c user.name=dsh-recall -c user.email=recall@dsh.local commit-tree "$tree" -m ' + psq("snapshot " + messageId) + ")",
     '"$git" --git-dir="$g" tag -f ' + psq("snap-" + messageId) + ' "$commit" >/dev/null',
@@ -237,14 +271,18 @@ function collectListsBlock(store, gitExe, root, tag, base) {
     "root=" + psq(root),
     dropGitlinksBlock(),
     excludeSyncBlock(store.excludeFile, base),
+    // issue #29：与 snapshotScript 同形——大文件不进 add（否则 preview 一次
+    // 也要为它们写对象），清单随 add 后的兜底剔除一起收口
+    oversizeListBlock(store.maxFileBytes),
+    oversizeAddPrepBlock(),
     // fail-open add（语义见 snapshotScript 同款注释）：diff/rollback 的当前
     // 清单来自这次 add 后的索引——被跳过的路径不进清单，diff 不显示、
     // rollback 删除清单也不会误删它们；≥2 显式退出防「旧索引假成功」
     "addrc=0",
-    '"$git" --git-dir="$g" --work-tree="$root" add -A --ignore-errors || addrc=$?',
+    '"$git" --git-dir="$g" --work-tree="$root" add -A --ignore-errors "${pa_args[@]}" || addrc=$?',
     '[ "$addrc" -le 1 ] || exit "$addrc"',
     dropGitlinksBlock(),
-    oversizeBlock(store.maxFileBytes),
+    oversizeRemoveBlock(),
     "tmpc=" + psq(store.dir + "/diff-cur.$$"),
     "tmpt=" + psq(store.dir + "/diff-tgt.$$"),
     `"$git" -c core.quotePath=false --git-dir="$g" --work-tree="$root" ls-files --stage | grep -v '^160000 ' > "$tmpc" || true`,
@@ -255,7 +293,7 @@ function diffScript(root, store, gitExe, tag, base) {
   return [
     "set -e -o pipefail",
     collectListsBlock(store, gitExe, root, tag, base),
-    `trap 'rm -f "$tmpc" "$tmpt"' EXIT`,
+    `trap 'rm -f "$tmpc" "$tmpt" "$oversize_p" "$oversize_r"' EXIT`,
     "awk -F'\\t' -v OFS='\\t' '",
     "  FNR==1 { fidx++ }",
     '  fidx==1 { split($1, a, " "); cur[$2]=a[2]; next }',
@@ -278,7 +316,7 @@ function rollbackScript(root, store, gitExe, tag, base) {
     "set -e -o pipefail",
     collectListsBlock(store, gitExe, root, tag, base),
     "tmpr=" + psq(store.dir + "/diff-restore.$$"),
-    `trap 'rm -f "$tmpc" "$tmpt" "$tmpr"' EXIT`,
+    `trap 'rm -f "$tmpc" "$tmpt" "$tmpr" "$oversize_p" "$oversize_r"' EXIT`,
     // 恢复集 = 目标有、当前无或 sha 不同（awk 结构与 diffScript 同款：
     // cur 侧 "mode sha stage<TAB>path" 取 a[2]，target 侧 "mode type sha<TAB>path" 取 a[3]）
     "awk -F'\\t' '",
@@ -314,7 +352,7 @@ function rollbackScript(root, store, gitExe, tag, base) {
     "  fi",
     "fi",
     "tmpd=" + psq(store.dir + "/diff-del.$$"),
-    `trap 'rm -f "$tmpc" "$tmpt" "$tmpr" "$tmpd"' EXIT`,
+    `trap 'rm -f "$tmpc" "$tmpt" "$tmpr" "$tmpd" "$oversize_p" "$oversize_r"' EXIT`,
     "awk -F'\\t' '",
     "  FNR==1 { fidx++ }",
     "  fidx==1 { cur[$2]=1; next }",
@@ -457,6 +495,10 @@ function excludeDumpScript(files) {
     lines.push(
       "printf 'EXCLBEGIN %s\\n' " + q,
       "if [ -f " + q + " ]; then base64 " + q + " 2>/dev/null | tr -d '\\n'; fi",
+      // issue #30 同族：tr -d '\n' 之后内容没有行尾，直接 echo 会把 EXCLEND 粘在
+      // base64 尾上；payload 字节数为 3 的倍数（无 '=' padding）时这截尾巴会被一起
+      // 解码成垃圾字节，回显到设置页再写回就污染 exclude.txt。
+      'printf "\\n"',
       "echo 'EXCLEND'"
     );
   }
@@ -499,10 +541,16 @@ function storesDumpScript(container, extraDirs) {
     '    echo "ROOT "',
     "  fi",
     "  echo INDEXBEGIN",
-    '  cat "$d/index.json" 2>/dev/null',
+    // issue #30：这两个 json 是可选文件（刚建仓没拍过快照就没有），缺席必须放行——
+    // set -e 下裸 cat 会把「无文件」升级成整条 dump 失败。另外落盘内容无尾换行
+    // （writeTextViaShell = cat > file），cat 后紧接 echo 会把段尾标记粘到内容行尾，
+    // JS 侧按整行匹配 INDEXEND 就永远收不到段尾，所以内容后显式补一个换行。
+    '  cat "$d/index.json" 2>/dev/null || true',
+    '  printf "\\n"',
     "  echo INDEXEND",
     "  echo LINEAGEBEGIN",
-    '  cat "$d/lineage.json" 2>/dev/null',
+    '  cat "$d/lineage.json" 2>/dev/null || true',
+    '  printf "\\n"',
     "  echo LINEAGEEND",
     "done",
     "exit 0"

package/lib/scripts.pwsh.js

@@ -56,9 +56,20 @@ function reparseDirsBlock() {
     "$reparseRel.Sort()"
   ].join("\n");
 }
-function oversizeBlock(maxBytes) {
+function oversizeRemoveBlock() {
+  return [
+    "for ($i = 0; $i -lt $oversizeRel.Count; $i += 100) {",
+    "  $batch = $oversizeRel.GetRange($i, [Math]::Min(100, $oversizeRel.Count - $i))",
+    // --work-tree 不可省：bare 影子仓库下裸 update-index 会 fatal，pwsh 不抛
+    // → 大文件静默留在 index 里，maxFileBytes 的承诺形同虚设
+    "  & $git --literal-pathspecs --git-dir=$g --work-tree=$root update-index --force-remove -- $batch",
+    "}"
+  ].join("\n");
+}
+function oversizeListBlock(maxBytes) {
   return [
     dirSkipSetBlock("oversizeSkip"),
+    '$oversizeP = Join-Path $g ("oversize-pathspec." + $PID)',
     "$oversizeStack = [System.Collections.Generic.Stack[string]]::new()",
     "$oversizeStack.Push($root)",
     "$oversizeRel = [System.Collections.Generic.List[string]]::new()",
@@ -78,14 +89,44 @@ function oversizeBlock(maxBytes) {
     "    }",
     "  } catch {}",
     "}",
-    "for ($i = 0; $i -lt $oversizeRel.Count; $i += 100) {",
-    "  $batch = $oversizeRel.GetRange($i, [Math]::Min(100, $oversizeRel.Count - $i))",
-    // --work-tree 不可省：bare 影子仓库下裸 update-index 会 fatal，pwsh 不抛
-    // → 大文件静默留在 index 里，maxFileBytes 的承诺形同虚设
-    "  & $git --literal-pathspecs --git-dir=$g --work-tree=$root update-index --force-remove -- $batch",
-    "}"
+    // 清单必须存在（--pathspec-from-file 指错会让 add fatal）：无大文件时写空文件，
+    // 后续按长度 0 判定「不传该参数」
+    "if ($oversizeRel.Count -gt 0) {",
+    "  $oversizeSb = [System.Text.StringBuilder]::new()",
+    '  foreach ($r in $oversizeRel) { [void]$oversizeSb.Append(":(top,exclude,literal)").Append($r).Append([char]0) }',
+    "  [System.IO.File]::WriteAllText($oversizeP, $oversizeSb.ToString(), (New-Object System.Text.UTF8Encoding($false)))",
+    "} else {",
+    '  Set-Content -LiteralPath $oversizeP -Value "" -NoNewline -Encoding ascii -ErrorAction SilentlyContinue',
+    "}",
+    oversizeRemoveBlock()
+  ].join("\n");
+}
+function oversizeAddPrepBlock() {
+  return [
+    "$paArgs = @()",
+    "if ((Test-Path -LiteralPath $oversizeP) -and ((Get-Item -LiteralPath $oversizeP).Length -gt 0)) {",
+    "  $paOk = Join-Path $g 'pathspec-from-file.ok'",
+    "  $paDetect = Test-Path -LiteralPath $paOk",
+    "  if (-not $paDetect) {",
+    "    $paHit = @()",
+    "    $paEap = $ErrorActionPreference",
+    "    $ErrorActionPreference = 'Continue'",
+    "    try {",
+    "      $paHit = @(& $git add -h 2>&1 | Select-String -SimpleMatch '--pathspec-from-file')",
+    "    } finally { $ErrorActionPreference = $paEap }",
+    "    if ($paHit.Count -gt 0) {",
+    "      Set-Content -LiteralPath $paOk -Value 1 -Encoding ascii -ErrorAction SilentlyContinue",
+    "      $paDetect = $true",
+    "    }",
+    "  }",
+    '  if ($paDetect) { $paArgs = @(("--pathspec-from-file=" + $oversizeP), "--pathspec-file-nul") }',
+    "}",
+    "Set-Location -LiteralPath $root"
   ].join("\n");
 }
+function oversizeCleanupBlock() {
+  return "Remove-Item -LiteralPath $oversizeP -ErrorAction SilentlyContinue";
+}
 function limitScanBlock(maxBytes, fileMaxBytes, budgetMs) {
   const limit = maxBytes > 0 ? String(maxBytes) : "0";
   const fileLimit = String(fileMaxBytes || MAX_FILE_BYTES);
@@ -96,27 +137,43 @@ function limitScanBlock(maxBytes, fileMaxBytes, budgetMs) {
     "$limitHit = ''",
     "$limitRc = 0",
     "$limitFiles = @()",
+    // 临时文件名带 $PID：脚本每次都是新进程，避免同一 store 上的残留互相覆盖
+    '$limitErrFile = Join-Path $g ("limit-scan-err." + $PID)',
     // PS 5.1：native stderr 在 EAP=Stop 下会被包成 ErrorRecord 直接抛（pwsh 7
     // 不抛），一条 warning 就能让整条快照挂掉——与下方 add 段同款临时降级
     "$limitEap = $ErrorActionPreference",
     "$ErrorActionPreference = 'Continue'",
     "try {",
-    // -z：路径含换行也不分裂（实测 PS 5.1/7 的 @() 都保留 NUL）
-    "  $limitFiles = @(((& $git -c core.quotePath=false --git-dir=$g --work-tree=$root ls-files -z -co --exclude-standard 2>$null) -join '').Split([char]0))",
+    // -z：路径含换行也不分裂（实测 PS 5.1/7 的 @() 都保留 NUL）；stderr 落文件
+    // 而不是 $null——失败原因是 issue #29 的第一诉求，不能再吞掉
+    "  $limitFiles = @(((& $git -c core.quotePath=false --git-dir=$g --work-tree=$root ls-files -z -co --exclude-standard 2>$limitErrFile) -join '').Split([char]0))",
     "  $limitRc = $LASTEXITCODE",
     "} finally { $ErrorActionPreference = $limitEap }",
-    "if ($limitRc -eq 0) {",
-    "  foreach ($limitRel in $limitFiles) {",
+    "if ($limitRc -ne 0) {",
+    "  $limitMsg = ''",
+    // 只取首个非空行：PS 5.1 把 native stderr 写成 ErrorRecord（后续行是
+    // 调用点/脚本路径上下文），整段压平会把噪声塞进「最近错误」
+    "  try {",
+    "    $limitLines = @(Get-Content -LiteralPath $limitErrFile -Encoding UTF8 -ErrorAction SilentlyContinue | Where-Object { $_.Trim() })",
+    "    if ($limitLines.Count -gt 0) { $limitMsg = ($limitLines[0] -replace '\\s+', ' ').Trim() }",
+    "  } catch {}",
+    "  Remove-Item -LiteralPath $limitErrFile -ErrorAction SilentlyContinue",
+    "  if ($limitMsg.Length -gt 300) { $limitMsg = $limitMsg.Substring(0, 300) }",
+    "  Write-Output ('SNAP_SCAN_FAIL ' + $limitRc)",
+    "  Write-Output ('SNAP_SCAN_ERR ' + $limitMsg)",
+    "  exit 0",
+    "}",
+    "Remove-Item -LiteralPath $limitErrFile -ErrorAction SilentlyContinue",
+    "foreach ($limitRel in $limitFiles) {",
     // 两道守卫吸收两类异常条目：5.1 的 Split 会留尾部空串；目录条目（嵌套仓库
     // 输出 `dir/`）的 Length 为空或抛——两者都不该计入（add 侧同样不纳入）
-    "    if (-not $limitRel) { continue }",
-    "    if (" + budget + " -gt 0 -and $limitSw.ElapsedMilliseconds -gt " + budget + ") { $limitHit = 'time'; break }",
-    "    try { $limitLen = [System.IO.FileInfo]::new($root + '/' + $limitRel).Length } catch { $limitLen = [long]0 }",
-    // 口径 = 实际会进快照的字节：超过单文件上限的文件随后被 oversizeBlock
+    "  if (-not $limitRel) { continue }",
+    "  if (" + budget + " -gt 0 -and $limitSw.ElapsedMilliseconds -gt " + budget + ") { $limitHit = 'time'; break }",
+    "  try { $limitLen = [System.IO.FileInfo]::new($root + '/' + $limitRel).Length } catch { $limitLen = [long]0 }",
+    // 口径 = 实际会进快照的字节：超过单文件上限的文件随后被 oversizeListBlock
     // 移出 index，不该计入总量（否则一个 300MB 视频就能把干净项目误判超限）
-    "    if ($limitLen -gt 0 -and $limitLen -le " + fileLimit + ") { $limitBytes += $limitLen }",
-    "    if (" + limit + " -gt 0 -and $limitBytes -gt " + limit + ") { $limitHit = 'bytes'; break }",
-    "  }",
+    "  if ($limitLen -gt 0 -and $limitLen -le " + fileLimit + ") { $limitBytes += $limitLen }",
+    "  if (" + limit + " -gt 0 -and $limitBytes -gt " + limit + ") { $limitHit = 'bytes'; break }",
     "}",
     "if ($limitHit -eq 'bytes') { Write-Output ('SNAP_LIMIT bytes ' + $limitBytes + ' ' + " + limit + "); exit 0 }",
     "if ($limitHit -eq 'time') { Write-Output ('SNAP_LIMIT time ' + $limitSw.ElapsedMilliseconds + ' ' + " + budget + "); exit 0 }"
@@ -246,7 +303,10 @@ function snapshotScript(root, store, gitExe, messageId, base) {
     excludeSyncBlock(store.excludeFile, base),
     // issue #24：总量/预算护栏先于 add——超限时连 add 都不跑
     limitScanBlock(store.maxWorkspaceBytes, store.maxFileBytes, store.scanBudgetMs),
+    // issue #29：大文件清单先于 add——add 带 exclude 后不再为它们写对象
+    oversizeListBlock(store.maxFileBytes),
     attrsMigrateBlock(),
+    oversizeAddPrepBlock(),
     // fail-open add（issue #7 加固）：--ignore-errors 让「个别路径无法索引」
     // （无提交的嵌入式仓库、不可读文件等）以退出码 1 结束但索引照常落盘，
     // 快照缺个别路径可接受，好过整条快照 fatal。退出码 ≥2 才是真 fatal
@@ -260,13 +320,16 @@ function snapshotScript(root, store, gitExe, messageId, base) {
     // 后按 "unable to index file 'X'" 提取被跳过的路径，以 SNAP_SKIP 行
     // 回传 JS 侧做用户可见提示。
     "$ErrorActionPreference = 'Continue'",
-    '$addLog = (@(& $git --git-dir=$g --work-tree=$root add -A --ignore-errors 2>&1) | ForEach-Object { [string]$_ }) -join "`n"',
+    '$addLog = (@(& $git --git-dir=$g --work-tree=$root add -A --ignore-errors @paArgs 2>&1) | ForEach-Object { [string]$_ }) -join "`n"',
     "$addRc = $LASTEXITCODE",
     "$ErrorActionPreference = 'Stop'",
     'if ($addRc -ge 2) { throw ("git add fatal (exit " + $addRc + "): " + $addLog) }',
     `foreach ($m in [regex]::Matches($addLog, "unable to index file '([^']+)'") ) { Write-Output ('SNAP_SKIP ' + $m.Groups[1].Value) }`,
     dropGitlinksBlock(),
-    oversizeBlock(store.maxFileBytes),
+    // 兜底：旧 git 走裸 add 时大文件仍会被重新索引，这里按清单再清一次；
+    // pathspec 生效时它是空操作（清单条目本就不在 index）
+    oversizeRemoveBlock(),
+    oversizeCleanupBlock(),
     "$tree = (& $git --git-dir=$g --work-tree=$root write-tree).Trim()",
     "$commit = (& $git --git-dir=$g -c user.name=dsh-recall -c user.email=recall@dsh.local commit-tree $tree -m ('snapshot ' + " + psq(messageId) + ")).Trim()",
     "& $git --git-dir=$g tag -f " + psq("snap-" + messageId) + " $commit | Out-Null",
@@ -286,14 +349,19 @@ function diffScript(root, store, gitExe, tag, base, maxChanges) {
     "$root = " + psq(root),
     dropGitlinksBlock(),
     excludeSyncBlock(store.excludeFile, base),
+    // issue #29：与 snapshotScript 同形——大文件不进 add（否则 preview 一次
+    // 也要为它们写对象），清单随 add 后的兜底剔除一起收口
+    oversizeListBlock(store.maxFileBytes),
+    oversizeAddPrepBlock(),
     // fail-open add：语义同 snapshotScript（--ignore-errors 跳过无法索引的
     // 路径、≥2 显式 throw 防「旧索引假成功」）；此处不提取 SNAP_SKIP——
     // 被跳过的路径不进索引，diff 天然不显示、rollback 的删除清单来自当前
     // 索引也天然不会误删它们
-    "& $git --git-dir=$g --work-tree=$root add -A --ignore-errors",
+    "& $git --git-dir=$g --work-tree=$root add -A --ignore-errors @paArgs",
     'if ($LASTEXITCODE -ge 2) { throw ("git add fatal (exit " + $LASTEXITCODE + ")") }',
     dropGitlinksBlock(),
-    oversizeBlock(store.maxFileBytes),
+    oversizeRemoveBlock(),
+    oversizeCleanupBlock(),
     "$curOut = & $git -c core.quotePath=false --git-dir=$g --work-tree=$root ls-files --stage",
     // 旧 tag 的树里可能仍有 gitlink（修复前留下的），从目标侧一并剔除，
     // 否则 diff 会报出“恢复 dsh-recall-plugin”这类幻影条目
@@ -335,11 +403,15 @@ function rollbackScript(root, store, gitExe, tag, base) {
     "$root = " + psq(root),
     dropGitlinksBlock(),
     excludeSyncBlock(store.excludeFile, base),
+    // issue #29：同 snapshotScript（回退前的当前清单同样不该为大文件写对象）
+    oversizeListBlock(store.maxFileBytes),
+    oversizeAddPrepBlock(),
     // fail-open add：语义同 snapshotScript 同款注释（diff/rollback 复用）
-    "& $git --git-dir=$g --work-tree=$root add -A --ignore-errors",
+    "& $git --git-dir=$g --work-tree=$root add -A --ignore-errors @paArgs",
     'if ($LASTEXITCODE -ge 2) { throw ("git add fatal (exit " + $LASTEXITCODE + ")") }',
     dropGitlinksBlock(),
-    oversizeBlock(store.maxFileBytes),
+    oversizeRemoveBlock(),
+    oversizeCleanupBlock(),
     // 同 diffScript：-z 的 NUL 输出会被 PowerShell 捕获丢弃，改为逐行 + quotePath=false
     "$curOut = & $git -c core.quotePath=false --git-dir=$g --work-tree=$root ls-files --stage",
     "$targetOut = @(& $git -c core.quotePath=false --git-dir=$g ls-tree -r " + psq(tag) + " | Where-Object { -not $_.StartsWith('160000') })",

package/lib/snapshots.js

@@ -21,11 +21,27 @@ function parseSnapshotLimit(out) {
   }
   return null;
 }
+function parseScanFail(out) {
+  let rc = null;
+  let message = "";
+  for (const line of String(out || "").split(/\r?\n/)) {
+    if (line.indexOf("SNAP_SCAN_FAIL ") === 0) {
+      const n = parseInt(line.slice(15).trim(), 10);
+      if (Number.isFinite(n)) rc = n;
+    } else if (line.indexOf("SNAP_SCAN_ERR ") === 0) {
+      message = line.slice(14).trim();
+    }
+  }
+  return rc === null ? null : { rc, message };
+}
 function bytesText(bytes) {
   if (bytes >= 1048576) return Math.round(bytes / 1048576) + " MB";
   return Math.max(1, Math.round(bytes / 1024)) + " KB";
 }
 function buildSnapshotLimitNotice(limit) {
+  if (limit.kind === "scan") {
+    return "\u65E0\u6CD5\u7EDF\u8BA1\u8BE5\u5DE5\u4F5C\u533A\u7684\u5FEB\u7167\u8303\u56F4\uFF08git \u9000\u51FA\u7801 " + limit.value + "\uFF09\uFF0C\u672C\u6B21\u5FEB\u7167\u5DF2\u8DF3\u8FC7\uFF1B\u8BE5\u5DE5\u4F5C\u533A\u6682\u505C\u5FEB\u7167\u7EA6 10 \u5206\u949F\uFF0C\u4FEE\u590D\u540E\u81EA\u52A8\u6062\u590D\uFF0C\u8BE6\u60C5\u89C1\u300C\u6700\u8FD1\u9519\u8BEF\u300D";
+  }
   if (limit.kind === "bytes") {
     return "\u8BE5\u5DE5\u4F5C\u533A\u53EF\u7EB3\u5165\u5FEB\u7167\u7684\u6587\u4EF6\u603B\u91CF\u8D85\u8FC7\u4E0A\u9650\uFF08\u7EA6 " + bytesText(limit.value) + " / " + bytesText(limit.limit) + "\uFF0C\u5DF2\u6309 .gitignore \u4E0E\u6392\u9664\u8868\u8FC7\u6EE4\uFF09\uFF0C\u5DF2\u505C\u7528\u5FEB\u7167\uFF1B\u53EF\u8C03\u5927\u300C\u5DE5\u4F5C\u533A\u603B\u91CF\u4E0A\u9650\u300D\u6216\u8865\u5145\u6392\u9664\u8868\u540E\u81EA\u52A8\u6062\u590D";
   }
@@ -185,10 +201,20 @@ function createSnapshots(ctx, rt, config) {
   const FUSE_AFTER = 3;
   const FUSE_BACKOFF_BASE_MS = 5 * 60 * 1e3;
   const FUSE_BACKOFF_CAP_MS = 60 * 60 * 1e3;
+  const EXPENSIVE_FAIL_MS = 60 * 1e3;
   const snapFailures = /* @__PURE__ */ new Map();
   const SNAP_LIMIT_RETRY_MS = 10 * 60 * 1e3;
   const snapLimits = /* @__PURE__ */ new Map();
   const limitBlockedAt = /* @__PURE__ */ new Map();
+  function markSnapshotLimited(root, limit) {
+    snapLimits.set(root, { ...limit, at: Date.now(), maxWorkspaceBytes: config.maxWorkspaceBytes, scanBudgetMs: config.scanBudgetMs });
+  }
+  function noteSnapshotBlocked(root, detail) {
+    const last = limitBlockedAt.get(root) || 0;
+    if (Date.now() - last < 5 * 60 * 1e3) return;
+    limitBlockedAt.set(root, Date.now());
+    rt.recordError(detail);
+  }
   const SUPPORTED_FORMAT = 1;
   const FORMAT_OK_TTL_MS = 3e4;
   const formatOkAt = /* @__PURE__ */ new Map();
@@ -413,20 +439,27 @@ function createSnapshots(ctx, rt, config) {
       return;
     }
     await loadIndex(root, sessionId);
+    const captureStartedAt = Date.now();
     try {
-      const out = await rt.runShell(S.snapshotScript(root, store, state.gitExe || "", messageId, BASE()), { timeoutMs: 6e5, stdoutMaxBytes: 65536 });
+      const budget = config.snapshotBudgetMs > 0 ? config.snapshotBudgetMs : 864e5;
+      const out = await rt.runShell(S.snapshotScript(root, store, state.gitExe || "", messageId, BASE()), { timeoutMs: budget, stdoutMaxBytes: 65536 });
       const limit = parseSnapshotLimit(out);
       if (limit) {
-        snapLimits.set(root, { ...limit, at: Date.now(), maxWorkspaceBytes: config.maxWorkspaceBytes, scanBudgetMs: config.scanBudgetMs });
+        markSnapshotLimited(root, limit);
         const notice = buildSnapshotLimitNotice(limit);
-        const last = limitBlockedAt.get(root) || 0;
-        if (Date.now() - last >= 5 * 60 * 1e3) {
-          limitBlockedAt.set(root, Date.now());
-          rt.recordError("recall snapshot disabled for " + root + ": " + notice);
-        }
+        noteSnapshotBlocked(root, "recall snapshot disabled for " + root + ": " + notice);
         setFeedback(messageId, { failed: true, kind: "workspaceLimit", error: notice });
         return;
       }
+      const scanFail = parseScanFail(out);
+      if (scanFail) {
+        const pseudo = { kind: "scan", value: scanFail.rc, limit: 0 };
+        markSnapshotLimited(root, pseudo);
+        const notice = buildSnapshotLimitNotice(pseudo);
+        noteSnapshotBlocked(root, "recall snapshot scan failed for " + root + ": rc=" + scanFail.rc + " " + scanFail.message);
+        setFeedback(messageId, { failed: true, kind: "scanFail", error: notice });
+        return;
+      }
       snapFailures.delete(root);
       state.snapshots.set(String(messageId), { root, time: time || Date.now(), sessionId });
       await saveIndex(root, sessionId);
@@ -434,7 +467,7 @@ function createSnapshots(ctx, rt, config) {
     } catch (error) {
       rt.recordError("recall snapshot failed: " + String(error));
       setFeedback(messageId, { failed: true, ...buildFeedbackError(String(error)) });
-      await handleSnapshotFailure(root, store);
+      await handleSnapshotFailure(root, store, Date.now() - captureStartedAt);
     }
   }
   function setFeedback(messageId, rec) {
@@ -460,7 +493,7 @@ function createSnapshots(ctx, rt, config) {
     }
     return {};
   }
-  async function handleSnapshotFailure(root, store) {
+  async function handleSnapshotFailure(root, store, elapsedMs = 0) {
     if (store && state.gitExe) {
       try {
         await rt.runShell(S.pruneScript(store, state.gitExe), { timeoutMs: 6e5, stdoutMaxBytes: 4096 });
@@ -470,11 +503,15 @@ function createSnapshots(ctx, rt, config) {
     }
     const f = snapFailures.get(root) || { count: 0, skipUntil: 0 };
     f.count++;
+    const expensive = elapsedMs >= EXPENSIVE_FAIL_MS;
+    if (expensive && f.count < FUSE_AFTER) f.count = FUSE_AFTER;
     if (f.count >= FUSE_AFTER) {
       const backoff = Math.min(FUSE_BACKOFF_BASE_MS * 2 ** (f.count - FUSE_AFTER), FUSE_BACKOFF_CAP_MS);
       const wasFused = Date.now() < f.skipUntil;
       f.skipUntil = Date.now() + backoff;
-      if (!wasFused) rt.recordError("recall snapshot fused after " + f.count + " consecutive failures, backoff " + Math.round(backoff / 6e4) + "min for: " + root);
+      if (!wasFused) {
+        rt.recordError("recall snapshot fused after " + f.count + " consecutive failures, backoff " + Math.round(backoff / 6e4) + "min for: " + root + (expensive ? " (last failure took " + Math.round(elapsedMs / 1e3) + "s)" : ""));
+      }
     }
     snapFailures.set(root, f);
   }
@@ -579,6 +616,7 @@ export {
   judgeStoreFormat,
   parseChanges,
   parseDiffOutput,
+  parseScanFail,
   parseSkipped,
   parseSnapshotLimit,
   parseTagsWithTime,

package/lib/store.js

@@ -149,7 +149,6 @@ function createRuntime(ctx, config, deps) {
     roots: /* @__PURE__ */ new Map(),
     stores: /* @__PURE__ */ new Map(),
     snapshots: /* @__PURE__ */ new Map(),
-    queue: Promise.resolve(),
     indexLoaded: /* @__PURE__ */ new Set(),
     // PF-5 索引终态三/四档标记（rebuildOrphans 守卫的数据源）：
     // - indexHealthy：磁盘索引解析成功且在场（loadIndex 正常载入分支）——

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-recall-plugin",
-  "version": "2.5.2",
+  "version": "2.6.0",
   "description": "在 DSH 中撤回自己发过的消息：工作区文件与对话历史一起回到那条消息发出之前，消息的文本与附件自动放回输入框，改完即可重发。文件走独立影子 git 快照（不碰项目自身的 git），对话走官方 sessions.fork，原会话归档可找回。",
   "icon": "assets/icon.svg",
   "type": "module",