dsh-recency-guard 0.11.0 → 0.11.1

package/README.md

@@ -65,6 +65,36 @@
 
 当某个插件把 DSH 拖垮时，本插件会在崩溃的那一刻记录下"谁最可疑"，并在**下一次启动时、在崩溃插件的代码被加载之前**把它挡在门外。反复崩溃时，关闭的插件会逐个增加（第 1 次关最近更新的 1 个，仍崩溃则关最近更新的 2 个）。稳定之后，除首要嫌疑外，其余被关闭的配置会自动恢复。
 
+## v0.11.1 紧急修复（宿主兼容 + 启动崩溃 · 2026-11-08）
+
+**事故背景**：桌面端 DSH 自动升级到 `dsh 0.2.2-rc.1` 后连续崩溃（5 次/3 分钟），
+守护插件被兼容闸门移出 profile、不再保护；重新挂载后又因遗留写锁把宿主拖进
+`fatal load failure`。本版本修复三处，全部是「守护不能拖垮宿主」的底线问题。
+
+- **宿主预发布版本兼容（P0）**：`engines.dsh` 与全部 `@deepseek-ai/dsh-*`
+  peer 范围改为显式预发布分支
+  `>=0.2.1-rc.5 <0.2.2-0 || >=0.2.2-rc.1 <0.2.3-0 || >=0.2.3-rc.1 <0.3.0-0`。
+  原因：node-semver 只放行「与范围中某个比较符 **major.minor.patch 元组相同**
+  且自身带预发布标签」的预发布版本 —— 旧范围 `>=0.2.1-rc.5 <0.3.0-0` 会
+  静默排除 `0.2.2-rc.1`，插件被兼容闸门判为不兼容并从 profile 移除。
+  已在 `dsh 0.2.2-rc.1` 干净沙箱（sb-rg-v0111）实测安装 + 启动 + 守护激活通过。
+- **启动绝不抛出（P0）**：`boot()` 失败改为**降级留痕**（步骤记失败 + 警告
+  日志），不再 rethrow。此前一个可恢复的写锁超时会把宿主变成
+  `dsh: fatal load failure`（退出码 1）—— 观测/恢复设施不能拖垮主流程。
+- **失效写锁自愈（P0）**：新增 `cleanStaleLocks`（Store.init 启动时清理 +
+  `updateState` 超时后清理重试一次）。判据：锁内容为空/非正整数 PID（不完整
+  记录，atomic-write 永远无法接管）/ PID 对应进程已死，且文件年龄 > 5s
+  （避开锁创建与写 PID 之间的零字节窗口，绝不抢活锁）。
+  真机事故：崩溃恰好发生在锁创建与写 PID 之间，遗留 0 字节
+  `state.json.lock`，此后每次启动都等满超时并致命。
+- **连续崩溃兜底升级（P0）**：`assessConfidence` 新增安全网 —— 累计崩溃
+  `crashSeq ≥ 3` 时即使概率计数未达 `confirmRounds` 也强制行动；同时
+  `readCrashHistory` 跳过启动时的「无嫌疑 crash-detected」记录。实测该记录
+  每轮打断连续计数，导致 crashSeq 涨到 3 仍停在「观察中 1/2 轮」，崩溃循环
+  永远无法自愈。
+- 测试：新增 `tests/unit/store-lock.test.ts`（锁自愈 11 断言）与契约层
+  预发布范围守卫；14/14 全绿（Core 7 / Host 2 / Client 4 / Contract 1）。
+
 ## v0.11 新增（数据面安全 + 图谱图例一致性 + 马尔可夫去向可见 + 市场准备）
 
 - **动作路由方法守卫（P0 安全修复）**：`/action/archive|reenable|restore|recover`

package/dist/index.js

@@ -62,7 +62,7 @@ function readHostVersion() {
 
 // src/store.ts
 import { mkdir, readFile, readdir, stat, unlink } from "node:fs/promises";
-import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { isAbsolute, join, resolve } from "node:path";
 import { writeFileAtomic, withFileLock } from "@deepseek-ai/dsh-atomic-write";
 var STATE_DIRNAME = ".recency-guard";
@@ -70,6 +70,55 @@ var JOURNAL_MAX_LINES = 1e3;
 function emptyState() {
   return { bootMarker: null, crashSeq: 0, autoDisabled: [], stabilized: false, restored: [] };
 }
+var STALE_LOCK_MIN_AGE_MS = 5e3;
+function processAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+function cleanStaleLocks(dir, now = Date.now()) {
+  const report = { removed: [], kept: [] };
+  let entries;
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return report;
+  }
+  for (const name2 of entries) {
+    if (!name2.endsWith(".lock")) continue;
+    const path = join(dir, name2);
+    try {
+      if (now - statSync(path).mtimeMs < STALE_LOCK_MIN_AGE_MS) {
+        report.kept.push(name2);
+        continue;
+      }
+      let text = "";
+      try {
+        text = readFileSync(path, "utf8").trim();
+      } catch {
+        report.kept.push(name2);
+        continue;
+      }
+      const pid = Number(text);
+      const incomplete = text === "" || !Number.isInteger(pid) || pid <= 0;
+      if (!incomplete && processAlive(pid)) {
+        report.kept.push(name2);
+        continue;
+      }
+      rmSync(path, { force: true });
+      report.removed.push(name2);
+    } catch {
+      report.kept.push(name2);
+    }
+  }
+  return report;
+}
+function isLockTimeout(error) {
+  return error instanceof Error && error.message.includes("timed out waiting for the writer lock");
+}
 var Store = class {
   /** profile 根目录下的守护目录（分区索引与归档都在这里）。 */
   rootDir;
@@ -105,6 +154,10 @@ var Store = class {
   }
   async init() {
     await mkdir(this.backupsDir, { recursive: true });
+    try {
+      cleanStaleLocks(this.dir);
+    } catch {
+    }
   }
   /** 本分区的绝对路径（供面板与日志引用）。 */
   get partitionPath() {
@@ -246,12 +299,23 @@ var Store = class {
   }
   /** Serialized read-modify-write across processes. */
   async updateState(mutate) {
-    return withFileLock(this.statePath, async () => {
-      const cur = await this.readState();
-      const mutated = await mutate(cur);
-      await this.writeState(mutated);
-      return mutated;
-    }, { waitMs: 3e3 });
+    const run = () => withFileLock(
+      this.statePath,
+      async () => {
+        const cur = await this.readState();
+        const mutated = await mutate(cur);
+        await this.writeState(mutated);
+        return mutated;
+      },
+      { waitMs: 3e3 }
+    );
+    try {
+      return await run();
+    } catch (error) {
+      if (!isLockTimeout(error)) throw error;
+      cleanStaleLocks(this.dir);
+      return run();
+    }
   }
   /**
    * Re-arm the crash marker synchronously.
@@ -2391,16 +2455,19 @@ function assessConfidence(history, currentSuspects, options = {}) {
   let streak = 1;
   for (let i = history.length - 1; i >= 0; i -= 1) {
     const entry = history[i];
+    if (entry.suspects.length === 0) continue;
     if ((entry.suspects[0] ?? "") !== head) break;
     streak += 1;
   }
-  const act = streak >= confirmRounds;
+  const hardEscalateAfter = Math.max(1, options.hardEscalateAfter ?? 3);
+  const escalated = options.crashSeq !== void 0 && options.crashSeq >= hardEscalateAfter;
+  const act = streak >= confirmRounds || escalated;
   return {
     act,
     evidence: "probabilistic",
     rounds: streak,
     required: confirmRounds,
-    label: act ? `\u5934\u53F7\u5ACC\u7591 ${head} \u8FDE\u7EED ${streak} \u8F6E\u590D\u73B0\uFF08\u2265 ${confirmRounds}\uFF09\uFF1A\u8FBE\u5230\u884C\u52A8\u9608\u503C` : `\u5934\u53F7\u5ACC\u7591 ${head} \u590D\u73B0 ${streak}/${confirmRounds} \u8F6E\uFF1A\u89C2\u5BDF\u4E2D\uFF0C\u672C\u8F6E\u53EA\u8BB0\u5F55\u4E0D\u5173\u95ED`
+    label: act ? streak >= confirmRounds ? `\u5934\u53F7\u5ACC\u7591 ${head} \u8FDE\u7EED ${streak} \u8F6E\u590D\u73B0\uFF08\u2265 ${confirmRounds}\uFF09\uFF1A\u8FBE\u5230\u884C\u52A8\u9608\u503C` : `\u8FDE\u7EED ${options.crashSeq} \u6B21\u5D29\u6E83\u4ECD\u672A\u6062\u590D\uFF1A\u515C\u5E95\u5347\u7EA7\u4E3A\u884C\u52A8\uFF08\u5B89\u5168\u7F51\uFF09` : `\u5934\u53F7\u5ACC\u7591 ${head} \u590D\u73B0 ${streak}/${confirmRounds} \u8F6E\uFF1A\u89C2\u5BDF\u4E2D\uFF0C\u672C\u8F6E\u53EA\u8BB0\u5F55\u4E0D\u5173\u95ED`
   };
 }
 function environmentChanged(lastEntry, currentRuntime, currentSuspects) {
@@ -3599,7 +3666,7 @@ async function buildPartitionSnapshot(input, key) {
 }
 
 // src/archive.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync6, readdirSync, readFileSync as readFileSync7, renameSync as renameSync4, statSync as statSync2, writeFileSync as writeFileSync7 } from "node:fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync6, readdirSync as readdirSync2, readFileSync as readFileSync7, renameSync as renameSync4, statSync as statSync2, writeFileSync as writeFileSync7 } from "node:fs";
 import { join as join7 } from "node:path";
 function classify(name2) {
   if (name2 === "journal.jsonl") return "journal";
@@ -3632,7 +3699,7 @@ function archiveAndReset(partitionDir2, workspace, reason, now = /* @__PURE__ */
   }
   if (existsSync7(stateDir)) {
     mkdirSync6(archiveDir, { recursive: true });
-    for (const name2 of readdirSync(stateDir)) {
+    for (const name2 of readdirSync2(stateDir)) {
       if (name2 === "archive") continue;
       const source = join7(stateDir, name2);
       const target = join7(archiveDir, name2);
@@ -3677,7 +3744,7 @@ function directoryBytes(dir) {
   let total = 0;
   let names;
   try {
-    names = readdirSync(dir);
+    names = readdirSync2(dir);
   } catch {
     return 0;
   }
@@ -3696,7 +3763,7 @@ function listArchives(partitionDir2) {
   const archiveRoot = join7(partitionDir2, "archive");
   if (!existsSync7(archiveRoot)) return [];
   const out = [];
-  for (const name2 of readdirSync(archiveRoot)) {
+  for (const name2 of readdirSync2(archiveRoot)) {
     const dir = join7(archiveRoot, name2);
     try {
       const manifest = JSON.parse(readFileSync7(join7(dir, "manifest.json"), "utf8"));
@@ -4577,6 +4644,7 @@ var Guard = class {
     for (const e of events) {
       if (e.kind !== "crash-detected") continue;
       const suspects = Array.isArray(e.suspects) ? e.suspects.filter((s) => typeof s === "string") : [];
+      if (suspects.length === 0) continue;
       out.push({
         at: e.t,
         exitCode: typeof e.exitCode === "number" ? e.exitCode : -1,
@@ -4752,7 +4820,10 @@ var Guard = class {
       const targets = pickSuspects(ranked, n);
       const history = this.readCrashHistory();
       const envChanged = environmentChanged(history[history.length - 1], safeVersion(), ranked);
-      const verdict = assessConfidence(envChanged ? [] : history, ranked, { confirmRounds: this.config.confirmRounds });
+      const verdict = assessConfidence(envChanged ? [] : history, ranked, {
+        confirmRounds: this.config.confirmRounds,
+        crashSeq: seq
+      });
       this.store.appendSync({
         kind: "note",
         detail: `\u6062\u590D\u5224\u5B9A\uFF1A${verdict.label}`
@@ -4846,7 +4917,10 @@ ${error?.stack ?? ""}
       this.endStep("boot", true, "\u542F\u52A8\u6D41\u7A0B\u5B8C\u6210");
     } catch (error) {
       this.endStep("boot", false, describeError(error));
-      throw error;
+      try {
+        this.ctx.logger?.warn?.(`[recency-guard] \u5B88\u62A4\u542F\u52A8\u964D\u7EA7\uFF08\u5BBF\u4E3B\u7EE7\u7EED\u542F\u52A8\uFF09\uFF1A${describeError(error)}`);
+      } catch {
+      }
     }
   }
   /** Boot 的实现体（外层负责步骤计时与失败原因留痕）。 */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-recency-guard",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "Crash-recovery guard for DeepSeek Harness: records third-party/experimental plugin install & update recency, backs up their config, and after a crash auto-disables the most-recently-updated plugin(s) so the profile boots again, then restores stable config.",
   "license": "MIT",
   "type": "module",
@@ -67,10 +67,10 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "~4.0.5",
-    "@deepseek-ai/dsh-app-boot": ">=0.2.1-rc.5 <0.3.0-0",
-    "@deepseek-ai/dsh-config-editor": ">=0.2.1-rc.5 <0.3.0-0",
-    "@deepseek-ai/dsh-plugin-manager": ">=0.2.1-rc.5 <0.3.0-0",
-    "@deepseek-ai/dsh-tools": ">=0.2.1-rc.5 <0.3.0-0",
+    "@deepseek-ai/dsh-app-boot": ">=0.2.1-rc.5 <0.2.2-0 || >=0.2.2-rc.1 <0.2.3-0 || >=0.2.3-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-config-editor": ">=0.2.1-rc.5 <0.2.2-0 || >=0.2.2-rc.1 <0.2.3-0 || >=0.2.3-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-plugin-manager": ">=0.2.1-rc.5 <0.2.2-0 || >=0.2.2-rc.1 <0.2.3-0 || >=0.2.3-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-tools": ">=0.2.1-rc.5 <0.2.2-0 || >=0.2.2-rc.1 <0.2.3-0 || >=0.2.3-rc.1 <0.3.0-0",
     "@deepseek-ai/schemastery": ">=3.18.0 <4.0.0-0"
   },
   "peerDependenciesMeta": {
@@ -122,6 +122,6 @@
     "typescript": "^5.9.0"
   },
   "engines": {
-    "dsh": ">=0.2.1-rc.5 <0.3.0-0"
+    "dsh": ">=0.2.1-rc.5 <0.2.2-0 || >=0.2.2-rc.1 <0.2.3-0 || >=0.2.3-rc.1 <0.3.0-0"
   }
 }