dsh-recency-guard 0.11.0 → 0.11.2

package/README.md

@@ -65,6 +65,48 @@
 
 当某个插件把 DSH 拖垮时，本插件会在崩溃的那一刻记录下"谁最可疑"，并在**下一次启动时、在崩溃插件的代码被加载之前**把它挡在门外。反复崩溃时，关闭的插件会逐个增加（第 1 次关最近更新的 1 个，仍崩溃则关最近更新的 2 个）。稳定之后，除首要嫌疑外，其余被关闭的配置会自动恢复。
 
+## v0.11.2 紧急修复（恢复诚实性 + 启动恢复时序）
+
+- **恢复结果白盒化（P0 假绿修复）**：`reenable` 此前**无条件**返回
+  `reenabled: true` 并从 `autoDisabled` 移除 —— 实测管理器返回
+  `application: 'failed'`（HMR 嵌套事务）时，state 仍记「已恢复」，面板/工具
+  显示成功而插件实际仍关闭。现在只有**真的 applied** 才算成功；失败者保留在
+  自动关闭名单待下轮重试，journal/note 如实列出「未启用（管理器拒绝）」。
+- **启动恢复延后到 HMR 事务之外**：boot 阶段 Loader 自身可能正处在事务中，
+  恢复调用会报 `HMR transactions cannot be nested`。自动恢复改为 boot 后
+  1.5s 执行（定时器 unref，不拖住宿主退出），失败由诚实结果兜底。
+- 回归：host 工具测试新增「管理器拒绝 ⇒ reenable 报失败」断言；14/14 全绿。
+
+## v0.11.1 紧急修复（宿主兼容 + 启动崩溃 · 2026-11-08）
+
+**事故背景**：桌面端 DSH 自动升级到 `dsh 0.2.2-rc.1` 后连续崩溃（5 次/3 分钟），
+守护插件被兼容闸门移出 profile、不再保护；重新挂载后又因遗留写锁把宿主拖进
+`fatal load failure`。本版本修复三处，全部是「守护不能拖垮宿主」的底线问题。
+
+- **宿主预发布版本兼容（P0）**：`engines.dsh` 与全部 `@deepseek-ai/dsh-*`
+  peer 范围改为显式预发布分支
+  `>=0.2.1-rc.5 <0.2.2-0 || >=0.2.2-rc.1 <0.2.3-0 || >=0.2.3-rc.1 <0.3.0-0`。
+  原因：node-semver 只放行「与范围中某个比较符 **major.minor.patch 元组相同**
+  且自身带预发布标签」的预发布版本 —— 旧范围 `>=0.2.1-rc.5 <0.3.0-0` 会
+  静默排除 `0.2.2-rc.1`，插件被兼容闸门判为不兼容并从 profile 移除。
+  已在 `dsh 0.2.2-rc.1` 干净沙箱（sb-rg-v0111）实测安装 + 启动 + 守护激活通过。
+- **启动绝不抛出（P0）**：`boot()` 失败改为**降级留痕**（步骤记失败 + 警告
+  日志），不再 rethrow。此前一个可恢复的写锁超时会把宿主变成
+  `dsh: fatal load failure`（退出码 1）—— 观测/恢复设施不能拖垮主流程。
+- **失效写锁自愈（P0）**：新增 `cleanStaleLocks`（Store.init 启动时清理 +
+  `updateState` 超时后清理重试一次）。判据：锁内容为空/非正整数 PID（不完整
+  记录，atomic-write 永远无法接管）/ PID 对应进程已死，且文件年龄 > 5s
+  （避开锁创建与写 PID 之间的零字节窗口，绝不抢活锁）。
+  真机事故：崩溃恰好发生在锁创建与写 PID 之间，遗留 0 字节
+  `state.json.lock`，此后每次启动都等满超时并致命。
+- **连续崩溃兜底升级（P0）**：`assessConfidence` 新增安全网 —— 累计崩溃
+  `crashSeq ≥ 3` 时即使概率计数未达 `confirmRounds` 也强制行动；同时
+  `readCrashHistory` 跳过启动时的「无嫌疑 crash-detected」记录。实测该记录
+  每轮打断连续计数，导致 crashSeq 涨到 3 仍停在「观察中 1/2 轮」，崩溃循环
+  永远无法自愈。
+- 测试：新增 `tests/unit/store-lock.test.ts`（锁自愈 11 断言）与契约层
+  预发布范围守卫；14/14 全绿（Core 7 / Host 2 / Client 4 / Contract 1）。
+
 ## v0.11 新增（数据面安全 + 图谱图例一致性 + 马尔可夫去向可见 + 市场准备）
 
 - **动作路由方法守卫（P0 安全修复）**：`/action/archive|reenable|restore|recover`

package/dist/index.js

@@ -62,7 +62,7 @@ function readHostVersion() {
 
 // src/store.ts
 import { mkdir, readFile, readdir, stat, unlink } from "node:fs/promises";
-import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { isAbsolute, join, resolve } from "node:path";
 import { writeFileAtomic, withFileLock } from "@deepseek-ai/dsh-atomic-write";
 var STATE_DIRNAME = ".recency-guard";
@@ -70,6 +70,55 @@ var JOURNAL_MAX_LINES = 1e3;
 function emptyState() {
   return { bootMarker: null, crashSeq: 0, autoDisabled: [], stabilized: false, restored: [] };
 }
+var STALE_LOCK_MIN_AGE_MS = 5e3;
+function processAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+function cleanStaleLocks(dir, now = Date.now()) {
+  const report = { removed: [], kept: [] };
+  let entries;
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return report;
+  }
+  for (const name2 of entries) {
+    if (!name2.endsWith(".lock")) continue;
+    const path = join(dir, name2);
+    try {
+      if (now - statSync(path).mtimeMs < STALE_LOCK_MIN_AGE_MS) {
+        report.kept.push(name2);
+        continue;
+      }
+      let text = "";
+      try {
+        text = readFileSync(path, "utf8").trim();
+      } catch {
+        report.kept.push(name2);
+        continue;
+      }
+      const pid = Number(text);
+      const incomplete = text === "" || !Number.isInteger(pid) || pid <= 0;
+      if (!incomplete && processAlive(pid)) {
+        report.kept.push(name2);
+        continue;
+      }
+      rmSync(path, { force: true });
+      report.removed.push(name2);
+    } catch {
+      report.kept.push(name2);
+    }
+  }
+  return report;
+}
+function isLockTimeout(error) {
+  return error instanceof Error && error.message.includes("timed out waiting for the writer lock");
+}
 var Store = class {
   /** profile 根目录下的守护目录（分区索引与归档都在这里）。 */
   rootDir;
@@ -105,6 +154,10 @@ var Store = class {
   }
   async init() {
     await mkdir(this.backupsDir, { recursive: true });
+    try {
+      cleanStaleLocks(this.dir);
+    } catch {
+    }
   }
   /** 本分区的绝对路径（供面板与日志引用）。 */
   get partitionPath() {
@@ -246,12 +299,23 @@ var Store = class {
   }
   /** Serialized read-modify-write across processes. */
   async updateState(mutate) {
-    return withFileLock(this.statePath, async () => {
-      const cur = await this.readState();
-      const mutated = await mutate(cur);
-      await this.writeState(mutated);
-      return mutated;
-    }, { waitMs: 3e3 });
+    const run = () => withFileLock(
+      this.statePath,
+      async () => {
+        const cur = await this.readState();
+        const mutated = await mutate(cur);
+        await this.writeState(mutated);
+        return mutated;
+      },
+      { waitMs: 3e3 }
+    );
+    try {
+      return await run();
+    } catch (error) {
+      if (!isLockTimeout(error)) throw error;
+      cleanStaleLocks(this.dir);
+      return run();
+    }
   }
   /**
    * Re-arm the crash marker synchronously.
@@ -2391,16 +2455,19 @@ function assessConfidence(history, currentSuspects, options = {}) {
   let streak = 1;
   for (let i = history.length - 1; i >= 0; i -= 1) {
     const entry = history[i];
+    if (entry.suspects.length === 0) continue;
     if ((entry.suspects[0] ?? "") !== head) break;
     streak += 1;
   }
-  const act = streak >= confirmRounds;
+  const hardEscalateAfter = Math.max(1, options.hardEscalateAfter ?? 3);
+  const escalated = options.crashSeq !== void 0 && options.crashSeq >= hardEscalateAfter;
+  const act = streak >= confirmRounds || escalated;
   return {
     act,
     evidence: "probabilistic",
     rounds: streak,
     required: confirmRounds,
-    label: act ? `\u5934\u53F7\u5ACC\u7591 ${head} \u8FDE\u7EED ${streak} \u8F6E\u590D\u73B0\uFF08\u2265 ${confirmRounds}\uFF09\uFF1A\u8FBE\u5230\u884C\u52A8\u9608\u503C` : `\u5934\u53F7\u5ACC\u7591 ${head} \u590D\u73B0 ${streak}/${confirmRounds} \u8F6E\uFF1A\u89C2\u5BDF\u4E2D\uFF0C\u672C\u8F6E\u53EA\u8BB0\u5F55\u4E0D\u5173\u95ED`
+    label: act ? streak >= confirmRounds ? `\u5934\u53F7\u5ACC\u7591 ${head} \u8FDE\u7EED ${streak} \u8F6E\u590D\u73B0\uFF08\u2265 ${confirmRounds}\uFF09\uFF1A\u8FBE\u5230\u884C\u52A8\u9608\u503C` : `\u8FDE\u7EED ${options.crashSeq} \u6B21\u5D29\u6E83\u4ECD\u672A\u6062\u590D\uFF1A\u515C\u5E95\u5347\u7EA7\u4E3A\u884C\u52A8\uFF08\u5B89\u5168\u7F51\uFF09` : `\u5934\u53F7\u5ACC\u7591 ${head} \u590D\u73B0 ${streak}/${confirmRounds} \u8F6E\uFF1A\u89C2\u5BDF\u4E2D\uFF0C\u672C\u8F6E\u53EA\u8BB0\u5F55\u4E0D\u5173\u95ED`
   };
 }
 function environmentChanged(lastEntry, currentRuntime, currentSuspects) {
@@ -3599,7 +3666,7 @@ async function buildPartitionSnapshot(input, key) {
 }
 
 // src/archive.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync6, readdirSync, readFileSync as readFileSync7, renameSync as renameSync4, statSync as statSync2, writeFileSync as writeFileSync7 } from "node:fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync6, readdirSync as readdirSync2, readFileSync as readFileSync7, renameSync as renameSync4, statSync as statSync2, writeFileSync as writeFileSync7 } from "node:fs";
 import { join as join7 } from "node:path";
 function classify(name2) {
   if (name2 === "journal.jsonl") return "journal";
@@ -3632,7 +3699,7 @@ function archiveAndReset(partitionDir2, workspace, reason, now = /* @__PURE__ */
   }
   if (existsSync7(stateDir)) {
     mkdirSync6(archiveDir, { recursive: true });
-    for (const name2 of readdirSync(stateDir)) {
+    for (const name2 of readdirSync2(stateDir)) {
       if (name2 === "archive") continue;
       const source = join7(stateDir, name2);
       const target = join7(archiveDir, name2);
@@ -3677,7 +3744,7 @@ function directoryBytes(dir) {
   let total = 0;
   let names;
   try {
-    names = readdirSync(dir);
+    names = readdirSync2(dir);
   } catch {
     return 0;
   }
@@ -3696,7 +3763,7 @@ function listArchives(partitionDir2) {
   const archiveRoot = join7(partitionDir2, "archive");
   if (!existsSync7(archiveRoot)) return [];
   const out = [];
-  for (const name2 of readdirSync(archiveRoot)) {
+  for (const name2 of readdirSync2(archiveRoot)) {
     const dir = join7(archiveRoot, name2);
     try {
       const manifest = JSON.parse(readFileSync7(join7(dir, "manifest.json"), "utf8"));
@@ -4577,6 +4644,7 @@ var Guard = class {
     for (const e of events) {
       if (e.kind !== "crash-detected") continue;
       const suspects = Array.isArray(e.suspects) ? e.suspects.filter((s) => typeof s === "string") : [];
+      if (suspects.length === 0) continue;
       out.push({
         at: e.t,
         exitCode: typeof e.exitCode === "number" ? e.exitCode : -1,
@@ -4752,7 +4820,10 @@ var Guard = class {
       const targets = pickSuspects(ranked, n);
       const history = this.readCrashHistory();
       const envChanged = environmentChanged(history[history.length - 1], safeVersion(), ranked);
-      const verdict = assessConfidence(envChanged ? [] : history, ranked, { confirmRounds: this.config.confirmRounds });
+      const verdict = assessConfidence(envChanged ? [] : history, ranked, {
+        confirmRounds: this.config.confirmRounds,
+        crashSeq: seq
+      });
       this.store.appendSync({
         kind: "note",
         detail: `\u6062\u590D\u5224\u5B9A\uFF1A${verdict.label}`
@@ -4846,7 +4917,10 @@ ${error?.stack ?? ""}
       this.endStep("boot", true, "\u542F\u52A8\u6D41\u7A0B\u5B8C\u6210");
     } catch (error) {
       this.endStep("boot", false, describeError(error));
-      throw error;
+      try {
+        this.ctx.logger?.warn?.(`[recency-guard] \u5B88\u62A4\u542F\u52A8\u964D\u7EA7\uFF08\u5BBF\u4E3B\u7EE7\u7EED\u542F\u52A8\uFF09\uFF1A${describeError(error)}`);
+      } catch {
+      }
     }
   }
   /** Boot 的实现体（外层负责步骤计时与失败原因留痕）。 */
@@ -4902,11 +4976,15 @@ ${error?.stack ?? ""}
         `[recency-guard] \u4E0A\u6B21\u5D29\u6E83\u5DF2\u901A\u8FC7\u963B\u6B62\u52A0\u8F7D ${state.autoDisabled.map((d) => d.name).join(", ")} \u6062\u590D\u3002`
       );
       if (this.config.autoRestore) {
-        try {
-          await this.restore();
-        } catch (err) {
-          this.ctx.logger.warn(`[recency-guard] \u81EA\u52A8\u6062\u590D\u914D\u7F6E\u5931\u8D25\uFF1A${describeError(err)}`);
-        }
+        const timer = setTimeout(() => {
+          void this.restore().catch((err) => {
+            try {
+              this.ctx.logger.warn(`[recency-guard] \u81EA\u52A8\u6062\u590D\u914D\u7F6E\u5931\u8D25\uFF1A${describeError(err)}`);
+            } catch {
+            }
+          });
+        }, 1500);
+        timer.unref?.();
       }
     } else if (recovering) {
       this.ctx.logger.warn("[recency-guard] \u4E0A\u6B21\u5D29\u6E83\u540E\u542F\u52A8\uFF0C\u4FDD\u6301\u5ACC\u7591\u63D2\u4EF6\u5173\u95ED\u3002");
@@ -5029,31 +5107,37 @@ ${error?.stack ?? ""}
     const disabled = new Set(auto.map((d) => d.name));
     const reenabled = [];
     const keptDisabled = [];
+    const failed = [];
     for (const d of auto) {
       if (d.name === auto[auto.length - 1]?.name) {
         keptDisabled.push(d.name);
         continue;
       }
-      await this.reenable(d.name);
-      reenabled.push(d.name);
+      const result = await this.reenable(d.name);
+      if (result?.reenabled === true) reenabled.push(d.name);
+      else failed.push(d.name);
     }
     await this.store.updateState((s) => ({
       ...s,
-      autoDisabled: s.autoDisabled.filter((d) => keptDisabled.includes(d.name)),
+      // 失败者留在 autoDisabled（下轮启动重试）；成功者与首要嫌疑移出。
+      autoDisabled: s.autoDisabled.filter((d) => keptDisabled.includes(d.name) || failed.includes(d.name)),
       stabilized: true,
       restored: [...s.restored, ...reenabled]
     }));
     this.machine.transition("recovered", `\u5DF2\u6062\u590D ${reenabled.length} \u4E2A\u63D2\u4EF6`);
-    await this.store.append({ kind: "restore", detail: `\u91CD\u65B0\u542F\u7528 ${reenabled.join(", ") || "\u65E0"}` });
+    await this.store.append({
+      kind: "restore",
+      detail: `\u91CD\u65B0\u542F\u7528 ${reenabled.join(", ") || "\u65E0"}${failed.length > 0 ? `\uFF1B\u672A\u542F\u7528\uFF08\u7BA1\u7406\u5668\u62D2\u7EDD\uFF0C\u4FDD\u7559\u5F85\u91CD\u8BD5\uFF09 ${failed.join(", ")}` : ""}`
+    });
     await this.publishDecision(
       [...disabled].map((bundle) => ({ bundle, lastChangeAt: "", lastKind: "install" })),
-      keptDisabled,
-      keptDisabled.length ? "crash-recovery" : "none"
+      [...keptDisabled, ...failed],
+      keptDisabled.length || failed.length ? "crash-recovery" : "none"
     );
     return {
       reenabled,
-      keptDisabled,
-      note: keptDisabled.length ? `\u5DF2\u6062\u590D\u9700\u8981\u7684\u914D\u7F6E\uFF0C\u4EC5\u4FDD\u7559\u5ACC\u7591\u63D2\u4EF6 ${keptDisabled.join(", ")} \u5173\u95ED\u3002\u786E\u8BA4\u5B89\u5168\u540E\u53EF\u7528 reenable \u624B\u52A8\u5F00\u542F\u3002` : "\u5DF2\u6062\u590D\u5168\u90E8\u914D\u7F6E\u3002"
+      keptDisabled: [...keptDisabled, ...failed],
+      note: keptDisabled.length || failed.length ? `\u5DF2\u6062\u590D ${reenabled.length} \u4E2A\u914D\u7F6E\uFF1B${keptDisabled.length > 0 ? `\u4EC5\u4FDD\u7559\u5ACC\u7591\u63D2\u4EF6 ${keptDisabled.join(", ")} \u5173\u95ED` : ""}${failed.length > 0 ? `${keptDisabled.length > 0 ? "\uFF1B" : ""}${failed.join(", ")} \u7BA1\u7406\u5668\u62D2\u7EDD\u6062\u590D\uFF0C\u5DF2\u7559\u5728\u540D\u5355\u5F85\u4E0B\u8F6E\u91CD\u8BD5` : ""}\u3002\u786E\u8BA4\u5B89\u5168\u540E\u53EF\u7528 reenable \u624B\u52A8\u5F00\u542F\u3002` : "\u5DF2\u6062\u590D\u5168\u90E8\u914D\u7F6E\u3002"
     };
   }
   /** Manually re-enable one bundle, noting its backed-up config. */
@@ -5073,12 +5157,19 @@ ${error?.stack ?? ""}
       }
     }
     await this.store.append({ kind: "enable", bundle, result: safeJson(results) });
-    await this.store.updateState((s) => ({
-      ...s,
-      autoDisabled: s.autoDisabled.filter((d) => d.name !== bundle)
-    }));
+    const applied = results.some(
+      (r) => typeof r === "object" && r !== null && r.application === "applied"
+    );
+    if (applied) {
+      await this.store.updateState((s) => ({
+        ...s,
+        autoDisabled: s.autoDisabled.filter((d) => d.name !== bundle)
+      }));
+    } else {
+      this.ctx.logger.warn(`[recency-guard] ${bundle} \u672A\u80FD\u6062\u590D\uFF08\u7BA1\u7406\u5668\u672A applied\uFF09\uFF0C\u4FDD\u7559\u5728\u81EA\u52A8\u5173\u95ED\u540D\u5355\u5F85\u4E0B\u8F6E\u91CD\u8BD5`);
+    }
     const backup = await this.store.readBackup(bundle);
-    return { bundle, reenabled: true, hasConfigBackup: backup !== null };
+    return { bundle, reenabled: applied, hasConfigBackup: backup !== null };
   }
   /**
    * Clear the crash marker on teardown.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-recency-guard",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "description": "Crash-recovery guard for DeepSeek Harness: records third-party/experimental plugin install & update recency, backs up their config, and after a crash auto-disables the most-recently-updated plugin(s) so the profile boots again, then restores stable config.",
   "license": "MIT",
   "type": "module",
@@ -67,10 +67,10 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "~4.0.5",
-    "@deepseek-ai/dsh-app-boot": ">=0.2.1-rc.5 <0.3.0-0",
-    "@deepseek-ai/dsh-config-editor": ">=0.2.1-rc.5 <0.3.0-0",
-    "@deepseek-ai/dsh-plugin-manager": ">=0.2.1-rc.5 <0.3.0-0",
-    "@deepseek-ai/dsh-tools": ">=0.2.1-rc.5 <0.3.0-0",
+    "@deepseek-ai/dsh-app-boot": ">=0.2.1-rc.5 <0.2.2-0 || >=0.2.2-rc.1 <0.2.3-0 || >=0.2.3-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-config-editor": ">=0.2.1-rc.5 <0.2.2-0 || >=0.2.2-rc.1 <0.2.3-0 || >=0.2.3-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-plugin-manager": ">=0.2.1-rc.5 <0.2.2-0 || >=0.2.2-rc.1 <0.2.3-0 || >=0.2.3-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-tools": ">=0.2.1-rc.5 <0.2.2-0 || >=0.2.2-rc.1 <0.2.3-0 || >=0.2.3-rc.1 <0.3.0-0",
     "@deepseek-ai/schemastery": ">=3.18.0 <4.0.0-0"
   },
   "peerDependenciesMeta": {
@@ -122,6 +122,6 @@
     "typescript": "^5.9.0"
   },
   "engines": {
-    "dsh": ">=0.2.1-rc.5 <0.3.0-0"
+    "dsh": ">=0.2.1-rc.5 <0.2.2-0 || >=0.2.2-rc.1 <0.2.3-0 || >=0.2.3-rc.1 <0.3.0-0"
   }
 }