dsh-remote-plugin 0.6.24 → 0.6.26

package/gateway-stats.cjs

@@ -22,6 +22,17 @@ const path = require('node:path')
 const os = require('node:os')
 const { spawn } = require('node:child_process')
 const readline = require('node:readline')
+const zlib = require('node:zlib')
+
+function logGeneration(file) {
+  const match = /^session(?:\.v([1-9]\d*))?\.jsonl(?:\.zstd)?$/.exec(path.basename(file))
+  return match && Number.isSafeInteger(Number(match[1] || 0)) ? Number(match[1] || 0) : null
+}
+
+// V3 preserves message IDs, times and usage while renumbering durable seqs.
+function usageIdentity(event) {
+  return JSON.stringify([event.data?.message?.id || '', event.time, normalizeUsage(event)])
+}
 
 // ---------- 固定价格表(v1 硬编码; v2 将改为配置文件/环境变量) ----------
 // 时段判定: 工作日北京时间 9:00-12:00 与 14:00-18:00 为高峰(含起点不含终点)，周末全天谷时
@@ -238,9 +249,9 @@ class StatsStore {
     return null
   }
 
-  _setCursor(sessionId, lastSeq) {
+  _setCursor(sessionId, lastSeq, generation) {
     const c = this._loadCursors()
-    c[sessionId] = { lastSeq, updatedAt: Date.now() }
+    c[sessionId] = { ...c[sessionId], lastSeq, updatedAt: Date.now(), ...(generation == null ? {} : { generation }) }
     this._saveCursors()
   }
 
@@ -296,102 +307,111 @@ class StatsStore {
     return this._enqueue(() => this._scanFile(file, onProgress))
   }
 
-  _scanFile(file, onProgress) {
-    return new Promise((resolvePromise) => {
-      const sessionId = path.basename(path.dirname(file))
-      const cur = this._cursor(sessionId)
-      let lastSeq = cur ? cur.lastSeq : -1
-      let processed = 0
-      let currentModel = ''
-      let headerParsed = false
-      let lineCount = 0
-      let yielding = false
-      const dirtyDays = new Map()
-      let scanError = ''
-      const flush = () => {
-        for (const day of dirtyDays.values()) this._saveDay(day)
-        dirtyDays.clear()
-        if (lastSeq >= 0) this._setCursor(sessionId, lastSeq)
-      }
-
-      const zstd = this.spawn('zstd', ['-dc', file], { windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] })
-      const rl = readline.createInterface({ input: zstd.stdout })
-
-      zstd.on('error', (err) => {
-        if (err.code === 'ENOENT') {
-          console.warn(`[stats] 未找到 zstd 命令, 跳过历史回填: ${file}`)
-        } else {
-          console.warn(`[stats] zstd 解压失败 ${file}: ${err.message}`)
-        }
-        scanError = err.code || err.message
-        rl.close()
+  async _readLog(file, visit) {
+    let input, source, child, childResult
+    if (!file.endsWith('.zstd')) input = fs.createReadStream(file)
+    else if (this.spawn === spawn && typeof zlib.createZstdDecompress === 'function') {
+      source = fs.createReadStream(file)
+      input = zlib.createZstdDecompress()
+      source.on('error', error => input.destroy(error))
+      source.pipe(input)
+    } else {
+      child = this.spawn('zstd', ['-dc', file], { windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] })
+      input = child.stdout
+      childResult = new Promise(resolve => {
+        child.once('close', code => resolve({ code }))
+        child.once('error', error => resolve({ error }))
       })
+      child.on('error', error => input.destroy(error))
+    }
+    const rl = readline.createInterface({ input })
+    let lines = 0
+    try {
+      for await (const line of rl) {
+        if (!line.trim()) continue
+        const event = JSON.parse(line)
+        if (Number.isSafeInteger(event.seq)) visit(event)
+        if (++lines % 500 === 0) await new Promise(resolve => setImmediate(resolve))
+      }
+      if (childResult) {
+        const result = await childResult
+        if (result.error) throw result.error
+        if (result.code !== 0) throw new Error('zstd-decompression-failed')
+      }
+    } finally {
+      rl.close()
+      input.destroy()
+      source?.destroy()
+      child?.kill?.()
+    }
+  }
 
-      rl.on('line', (line) => {
-        lineCount++
-        let event
-        try {
-          event = JSON.parse(line)
-        } catch {
-          return
-        }
-        // 首行是 session header, 没有 seq
-        if (!headerParsed) {
-          headerParsed = true
-          return
-        }
-        if (typeof event.seq !== 'number') return
-        if (event.seq <= lastSeq) return
-        if (event.seq > lastSeq + 1) {
-          // 日志理论上是连续 seq; 出现空洞时以文件为准继续顺序推进(seq 游标按文件顺序)
-        }
-        // 跟踪当前模型配置: request/header 与 request/context 都可能带模型
-        try {
-          if (event.type === 'request/header' && event.data?.config?.model) currentModel = event.data.config.model
-          if (event.type === 'request/context' && event.data?.model) currentModel = event.data.model
-        } catch {}
-        if (event.type === 'assistant/message') {
-          const usage = normalizeUsage(event)
-          if (usage) {
-            const model = eventModel(event) || currentModel || 'unknown'
-            const { date, hour, period } = eventKey(event.time)
-            if (date >= PRICING_START_DATE) {
-              const day = dirtyDays.get(date) || this._loadDay(date)
-              dirtyDays.set(date, day)
-              const hourBucket = day.hours[hour] || (day.hours[hour] = {})
-              const modelBucket = hourBucket[model] || (hourBucket[model] = emptyBucket())
-              addUsage(modelBucket, model, period, usage)
-              processed++
-            }
+  async _scanFile(file, onProgress) {
+    const sessionId = path.basename(path.dirname(file))
+    const cur = this._cursor(sessionId)
+    const generation = logGeneration(file) ?? 0
+    const migrated = cur && generation !== (cur.generation ?? 0)
+    let lastSeq = migrated ? -1 : (cur?.lastSeq ?? -1)
+    let processed = 0
+    let currentModel = ''
+    const dirtyDays = new Map()
+    const counted = new Map()
+    try {
+      if (migrated) {
+        // Read the preserved predecessor before advancing to a renumbered log.
+        // Missing predecessor is an explicit error, never a blind double count.
+        const names = await fs.promises.readdir(path.dirname(file))
+        const previous = names.find(name => logGeneration(name) === (cur.generation ?? 0))
+        if (!previous) throw new Error('stats-migration-source-missing')
+        await this._readLog(path.join(path.dirname(file), previous), event => {
+          if (event.seq <= cur.lastSeq && event.type === 'assistant/message' && normalizeUsage(event)) {
+            const key = usageIdentity(event)
+            counted.set(key, (counted.get(key) || 0) + 1)
           }
-        }
+        })
+      }
+      await this._readLog(file, event => {
+        if (event.type === 'request/header' && event.data?.config?.model) currentModel = event.data.config.model
+        if (event.type === 'request/context' && event.data?.model) currentModel = event.data.model
+        if (event.seq <= lastSeq) return
         lastSeq = event.seq
-        // 大历史文件按批次让出事件循环，避免回填长期占住实时 HTTP/WS 处理。
-        if (lineCount % 500 === 0 && !yielding) {
-          yielding = true
-          rl.pause()
-          setImmediate(() => { yielding = false; rl.resume() })
-        }
+        if (event.type !== 'assistant/message') return
+        const usage = normalizeUsage(event)
+        if (!usage) return
+        const key = usageIdentity(event)
+        if (counted.get(key)) { counted.set(key, counted.get(key) - 1); return }
+        const model = eventModel(event) || currentModel || 'unknown'
+        const { date, hour, period } = eventKey(event.time)
+        if (date < PRICING_START_DATE) return
+        // Stage detached buckets: a failed read must not mutate cached totals.
+        const day = dirtyDays.get(date) || JSON.parse(JSON.stringify(this._loadDay(date)))
+        dirtyDays.set(date, day)
+        const hourBucket = day.hours[hour] || (day.hours[hour] = {})
+        addUsage(hourBucket[model] || (hourBucket[model] = emptyBucket()), model, period, usage)
+        processed++
       })
-
-      rl.on('close', () => {
-        flush()
-        if (onProgress) onProgress({ sessionId, processed })
-        resolvePromise({ sessionId, processed, ...(scanError ? { error: scanError } : {}) })
-      })
-    })
+      if ([...counted.values()].some(count => count > 0)) throw new Error('stats-migration-usage-mismatch')
+      for (const day of dirtyDays.values()) this._saveDay(day)
+      if (lastSeq >= 0) this._setCursor(sessionId, lastSeq, generation)
+      if (onProgress) onProgress({ sessionId, processed })
+      return { sessionId, processed }
+    } catch (error) {
+      return { sessionId, processed: 0, error: error.code || error.message }
+    }
   }
 
   /** 扫描 ~/.dsh/sessions 下全部 session.jsonl.zstd。 */
   async scanAll(sessionsRoot, onProgress) {
-    const root = sessionsRoot || path.join(os.homedir(), '.dsh', 'sessions')
+    const root = sessionsRoot || path.join(process.env.DSH_HOME || path.join(os.homedir(), '.dsh'), 'sessions')
     let files = []
     try {
       const walk = async (dir) => {
         const entries = await fs.promises.readdir(dir, { withFileTypes: true })
+        const logs = entries.filter(ent => ent.isFile() && logGeneration(ent.name) !== null)
+          .sort((a, b) => logGeneration(b.name) - logGeneration(a.name) || a.name.localeCompare(b.name))
+        if (logs.length) files.push(path.join(dir, logs[0].name))
         for (const ent of entries) {
           if (ent.isDirectory()) await walk(path.join(dir, ent.name))
-          else if (ent.name === 'session.jsonl.zstd') files.push(path.join(dir, ent.name))
         }
       }
       await walk(root)
@@ -400,12 +420,14 @@ class StatsStore {
       return { files: 0, processed: 0 }
     }
     let processed = 0
+    const errors = []
     // 串行扫描, 避免大量并发 zstd 子进程
     for (const file of files) {
       const out = await this.scanFile(file, onProgress)
       processed += out.processed || 0
+      if (out.error) errors.push({ sessionId: out.sessionId, error: out.error })
     }
-    return { files: files.length, processed }
+    return { files: files.length, processed, ...(errors.length ? { errors } : {}) }
   }
 
   summary(days) {

package/gateway.cjs

@@ -72,6 +72,8 @@ const WS_IDLE_MS = durationEnv('GATEWAY_WS_IDLE_MS', 180000, 0, 24 * 60 * 60 * 1
 const WS_UPGRADE_TIMEOUT_MS = durationEnv('GATEWAY_WS_UPGRADE_TIMEOUT_MS', 15000, 1000, 5 * 60 * 1000)
 const UPSTREAM_REQUEST_TIMEOUT_MS = durationEnv('GATEWAY_UPSTREAM_TIMEOUT_MS', 30000, 1000, 10 * 60 * 1000)
 const UPSTREAM = new URL(process.env.DSH_UPSTREAM || 'http://127.0.0.1:3080')
+// URL 中 IPv6 带方括号，http.request 的 hostname 则要求裸地址。
+const UPSTREAM_HOSTNAME = UPSTREAM.hostname.replace(/^\[|\]$/g, '')
 const UPSTREAM_TRANSPORT = UPSTREAM.protocol === 'https:' ? https : http
 const UPSTREAM_PORT = Number(UPSTREAM.port) || (UPSTREAM.protocol === 'https:' ? 443 : 80)
 const UPSTREAM_AUTHORITY = `${UPSTREAM.hostname}${UPSTREAM.port ? ':' + UPSTREAM.port : ''}`
@@ -208,7 +210,7 @@ const MIME = {
 
 // ---------- /fs 文件传输 ----------
 // 允许访问的根目录: DSH_REMOTE_FS_ROOT 使用系统路径分隔符分隔多个根,
-// POSIX 为 ':'、Windows 为 ';'；默认仅 ~。
+// POSIX 为 ':'、Windows 为 ';'；Windows 默认用户目录及 C 盘以外的可用盘符。
 // 所有 /fs/* 路径 resolve 后都必须位于某个根内, 已存在的路径还会用 realpath
 // 复核一次, 防止 ../ 穿越与符号链接逃逸。
 const FS_DEFAULT_ROOT = path.resolve(os.homedir())
@@ -218,10 +220,20 @@ function fsConfiguredRoot(value) {
   if (/^~[\\/]/.test(raw)) return path.resolve(FS_DEFAULT_ROOT, raw.slice(2))
   return path.resolve(raw)
 }
-const FS_ROOTS = (process.env.DSH_REMOTE_FS_ROOT || FS_DEFAULT_ROOT)
-  .split(path.delimiter)
-  .map(fsConfiguredRoot)
-  .filter(Boolean)
+function fsDefaultRoots(platform, home, isDirectory) {
+  const roots = [home]
+  if (platform === 'win32') {
+    for (const letter of 'ABDEFGHIJKLMNOPQRSTUVWXYZ') {
+      const root = `${letter}:\\`
+      try { if (isDirectory(root)) roots.push(root) } catch {}
+    }
+  }
+  return roots
+}
+const FS_ROOTS = process.env.DSH_REMOTE_FS_ROOT
+  ? process.env.DSH_REMOTE_FS_ROOT.split(path.delimiter).map(fsConfiguredRoot).filter(Boolean)
+  : fsDefaultRoots(process.platform, FS_DEFAULT_ROOT, root => fs.statSync(root).isDirectory())
+const FS_WINDOWS_DEFAULT = process.platform === 'win32' && !process.env.DSH_REMOTE_FS_ROOT
 const FS_WORKSPACE_CACHE_MS = durationEnv('DSH_REMOTE_FS_WORKSPACE_CACHE_MS', 15_000, 1000, 10 * 60_000)
 const FS_MAX_UPLOAD = Number(process.env.DSH_REMOTE_FS_MAX_UPLOAD) || 2 * 1024 * 1024 * 1024
 const FS_UPLOAD_TTL_MS = durationEnv('DSH_REMOTE_FS_UPLOAD_TTL_MS', 24 * 60 * 60 * 1000, 60_000, 7 * 24 * 60 * 60 * 1000)
@@ -235,6 +247,8 @@ function fsRootReals() {
   return FS_ROOT_REALS
 }
 function fsInsideReal(real) {
+  // 默认 Windows 授权不能被已登记工作区或盘符的 junction / SUBST 目标扩大。
+  if (FS_WINDOWS_DEFAULT) return FS_ROOTS.some(root => fsInsideRoot(real, root))
   for (const root of [...fsRootReals(), ...fsWorkspaceRootsCache.reals]) {
     if (fsInsideRoot(real, root)) return true
   }
@@ -1401,6 +1415,7 @@ const modernState = {
   sessionCursors: new Map(),
   workspaces: { items: [], archivedSessionIds: [] },
   pendingEvents: new Map(),
+  assistantStreams: new Map(),
 }
 
 async function callUpstreamRemote(endpoint, args, rpcId = crypto.randomUUID()) {
@@ -1536,7 +1551,7 @@ async function translateModernRpc(method, payload, rpcId) {
       ...(payload.beforeSeq === undefined ? {} : { beforeSeq: payload.beforeSeq }),
       ...(payload.maxMessages === undefined ? {} : { maxMessages: payload.maxMessages }),
     } }
-    transform = value => legacyHistoryValue(value, summary)
+    transform = value => ({ ...legacyHistoryValue(value, summary), ...modernReasoningValue(payload.sessionId) })
   } else if (method === 'session.models') {
     endpoint = 'session/modelCatalog'
     args = {}
@@ -1670,6 +1685,7 @@ function rememberCollectorReplay(kind, full, raw) {
   const replay = collectorReplay[kind]
   let key = ''
   if (payload.type === 'session/subscribed' && payload.sessionId) key = `session:${payload.sessionId}`
+  else if (payload.type === 'session/reasoning' && payload.sessionId) key = `reasoning:${payload.sessionId}`
   else if (payload.type === 'approval/requested' && payload.approvalId) key = `approval:${payload.approvalId}`
   else if (payload.type === 'question/requested' && full.rpcId) key = `question:${full.rpcId}`
   else if (payload.type === 'approval/resolved' && payload.approvalId) replay.delete(`approval:${payload.approvalId}`)
@@ -1940,7 +1956,7 @@ function openModernSessionStream(ws, sessionId) {
   const streamId = 'session:' + sessionId
   ws.send(JSON.stringify({
     type: 'open', streamId, endpoint: 'session/follow',
-    payload: { args: { request: { address: { kind: 'session', sessionId } } } },
+    payload: { args: { request: { address: { kind: 'session', sessionId }, assistantStream: true } } },
   }))
 }
 
@@ -1997,8 +2013,59 @@ function applyModernWorkspaceFrame(value) {
   }
 }
 
+// 0.1.5 streams are process-local and have no durable seq. Keep a bounded,
+// replaceable reasoning baseline for HTTP history, polling and late WS clients.
+function modernReasoningValue(sessionId) {
+  const stream = modernState.assistantStreams.get(sessionId)
+  return stream ? { partialReasoning: [...stream.blocks.values()] } : {}
+}
+
+function applyModernAssistantStream(sessionId, value, baseline = false) {
+  let stream = modernState.assistantStreams.get(sessionId)
+  const publish = () => legacyPush('mux', { type: 'session/reasoning', sessionId, ...modernReasoningValue(sessionId) })
+  const fold = chunk => {
+    if (!chunk || !Number.isSafeInteger(chunk.index) || chunk.index < 0 || chunk.index >= 64) return false
+    const item = stream.blocks.get(chunk.index) || { turn: stream.turn, step: stream.step, index: chunk.index, text: '' }
+    if (chunk.type === 'reasoning-delta') item.text = (item.text + String(chunk.text || '')).slice(0, 12000)
+    else if (chunk.type === 'block-start' && chunk.blockType === 'reasoning') item.text = ''
+    else if (chunk.type === 'block-end' && chunk.block?.type === 'reasoning') item.text = String(chunk.block.text || '').slice(0, 12000)
+    else return false
+    stream.blocks.set(chunk.index, item)
+    return true
+  }
+  if (baseline || value?.type === 'start') {
+    const attempt = baseline ? value?.activeAttempt : value
+    stream = { revision: value?.revision || 0, attemptId: attempt?.attemptId, turn: attempt?.turn, step: attempt?.step, nextIndex: attempt?.nextIndex || 0, blocks: new Map() }
+    modernState.assistantStreams.set(sessionId, stream)
+    for (const record of attempt?.stream || []) {
+      if (record.type === 'chunk') fold(record.chunk)
+      else if (record.type === 'reasoning-chunks') fold({ type: 'reasoning-delta', index: record.index, text: (record.texts || []).join('') })
+    }
+    publish()
+    return
+  }
+  if (!stream || value?.revision <= stream.revision) return
+  if (value?.revision !== stream.revision + 1 || value.attemptId !== stream.attemptId || value.index !== stream.nextIndex) {
+    stream.blocks.clear()
+    stream.attemptId = undefined
+    stream.revision = value?.revision || stream.revision
+    publish()
+    return
+  }
+  stream.revision = value.revision
+  if (value.type === 'end') {
+    stream.blocks.clear()
+    stream.attemptId = undefined
+    publish()
+  } else if (value.type === 'chunk') {
+    stream.nextIndex++
+    if (fold(value.chunk)) publish()
+  }
+}
+
 function applyModernSessionFrame(sessionId, value) {
   if (value?.type === 'snapshot') {
+    if (value.assistantStream) applyModernAssistantStream(sessionId, value.assistantStream, true)
     modernState.sessionCursors.set(sessionId, value.cursor)
     legacyPush('mux', { type: 'session/subscribed', sessionId, lastSeq: value.cursor })
     for (const record of value.records || []) {
@@ -2012,6 +2079,8 @@ function applyModernSessionFrame(sessionId, value) {
   if (value?.type === 'event' && value.event) {
     modernState.sessionCursors.set(sessionId, value.event.seq)
     legacyPush('mux', { type: 'session/event', sessionId, event: value.event })
+  } else if (value?.type === 'assistant-stream') {
+    applyModernAssistantStream(sessionId, value.frame)
   }
 }
 
@@ -2074,6 +2143,8 @@ function applyModernRemoteEvent(ws, value) {
   } else if (value.event === 'api-session/removed') {
     modernState.sessions.delete(args[0])
     modernState.sessionCursors.delete(args[0])
+    modernState.assistantStreams.delete(args[0])
+    collectorReplay.mux.delete(`reasoning:${args[0]}`)
     try { ws.send(JSON.stringify({ type: 'cancel', streamId: 'session:' + args[0] })) } catch {}
     legacyPush('host', { type: 'host/session-removed', sessionId: args[0] })
   } else if (value.event === 'api-session/status') {
@@ -2229,6 +2300,7 @@ async function scanStatsOnce(delay) {
   try {
     const out = await statsStore.scanAll()
     if (out.files) console.log(`[stats] 历史回填扫描完成: ${out.processed} 个新事件 (${out.files} 个会话文件)`)
+    if (out.errors?.length) console.warn(`[stats] ${out.errors.length} 个会话回填失败，保留原统计游标: ${out.errors.map(item => item.error).join(', ')}`)
   } catch (err) {
     console.warn('[stats] 历史回填扫描失败: ' + (err?.message || err))
   } finally {
@@ -2696,7 +2768,7 @@ function serveStatic(req, res, url) {
 // ---------- 管理 API ----------
 function upstreamReachable(cb) {
   const req = UPSTREAM_TRANSPORT.request({
-    hostname: UPSTREAM.hostname,
+    hostname: UPSTREAM_HOSTNAME,
     port: UPSTREAM_PORT,
     method: 'GET',
     path: '/health',
@@ -3035,6 +3107,7 @@ async function fsResolve(input) {
   else if (path.isAbsolute(raw)) abs = path.resolve(raw)
   else abs = path.resolve(FS_ROOTS[0], raw) // 相对路径按默认根解析
   if (FS_ROOTS.some(root => fsInsideRoot(abs, root))) return { abs }
+  if (FS_WINDOWS_DEFAULT) return { error: 'forbidden' }
   let workspaces = await loadFsWorkspaceRoots(false)
   if (workspaces.roots.some(root => fsInsideRoot(abs, root))) return { abs }
   // 新建/刚加入的工作区可能还没进入 15s 缓存，未命中时强制刷新一次。
@@ -3276,7 +3349,8 @@ function sha256FileHex(file, cb) {
 const activeUploads = new Map()
 const uploadPartDirs = new Set()
 function fsActiveKey(dirReal, name, session) {
-  return dirReal + '\n' + name + '\n' + (session || '')
+  const key = fsPartPath(dirReal, name, session)
+  return process.platform === 'win32' ? key.toLowerCase() : key
 }
 
 function rememberUploadDir(dirReal) {
@@ -3284,8 +3358,8 @@ function rememberUploadDir(dirReal) {
 }
 
 function uploadDirHasActive(dirReal) {
-  const prefix = dirReal + '\n'
-  for (const key of activeUploads.keys()) if (key.startsWith(prefix)) return true
+  const dir = process.platform === 'win32' ? dirReal.toLowerCase() : dirReal
+  for (const key of activeUploads.keys()) if (path.dirname(key) === dir) return true
   return false
 }
 
@@ -3360,24 +3434,49 @@ function fsUploadPipe(res, url, dirLex, dirReal, name) {
   return up ? fsUploadPipeFromTarget(res, up) : null
 }
 
+/** 同目录提交：覆盖用原子 rename；禁止覆盖用排他 link，绝不先删旧文件。 */
+function fsCommitUpload(tmp, target, overwrite) {
+  if (overwrite) fs.renameSync(tmp, target)
+  else {
+    fs.linkSync(tmp, target)
+    // 目标已提交，临时名字清理失败不应把成功误报为失败。
+    try { fs.unlinkSync(tmp) } catch {}
+  }
+}
+
 function fsUploadPipeFromTarget(res, up) {
   let finished = false
+  let ending = false
+  let written = false
   const cleanup = () => {
     if (finished) return
     finished = true
     try { up.stream.destroy() } catch {}
-    try { fs.unlinkSync(up.tmp) } catch {}
+    up.stream.once('close', () => { try { fs.unlinkSync(up.tmp) } catch {} })
   }
   up.stream.on('error', () => {
     if (finished) return
     finished = true
-    try { fs.unlinkSync(up.tmp) } catch {}
+    up.stream.once('close', () => { try { fs.unlinkSync(up.tmp) } catch {} })
     if (!res.headersSent) fsJson(res, 500, { error: 'write-failed' })
     else try { res.destroy() } catch {}
   })
+  up.stream.once('finish', () => { written = true })
+  up.stream.once('close', () => {
+    if (finished || !written) return
+    finished = true
+    try {
+      fsCommitUpload(up.tmp, up.target, up.overwrite)
+    } catch (err) {
+      try { fs.unlinkSync(up.tmp) } catch {}
+      if (!res.headersSent) fsJson(res, err.code === 'EEXIST' ? 409 : 403, { error: err.code === 'EEXIST' ? 'conflict' : 'write-failed', detail: err.message })
+      return
+    }
+    fsJson(res, 201, { ok: true, path: up.displayPath, name: up.name, size: up.bytes })
+  })
   return {
     write(chunk) {
-      if (finished) return
+      if (finished || ending) return
       up.bytes += chunk.length
       if (up.bytes > FS_MAX_UPLOAD) {
         cleanup()
@@ -3388,19 +3487,9 @@ function fsUploadPipeFromTarget(res, up) {
       up.stream.write(chunk)
     },
     end() {
-      if (finished) return
-      finished = true
-      up.stream.end(() => {
-        try {
-          if (up.overwrite) fs.rmSync(up.target, { force: true })
-          fs.renameSync(up.tmp, up.target)
-        } catch (err) {
-          try { fs.unlinkSync(up.tmp) } catch {}
-          if (!res.headersSent) return fsJson(res, 403, { error: 'permission-denied', detail: err.message })
-          return
-        }
-        fsJson(res, 201, { ok: true, path: up.displayPath, name: up.name, size: up.bytes })
-      })
+      if (finished || ending) return
+      ending = true
+      up.stream.end()
     },
     abort(status, msg) {
       cleanup()
@@ -3588,6 +3677,8 @@ function fsUploadResumable(req, res, url, dirLex, dirReal) {
   if (!fsValidName(name)) return fsJson(res, 400, { error: 'bad-name', detail: '文件名不能为空且不能包含路径分隔符' })
   const session = url.searchParams.get('session') || ''
   if (!session) return fsJson(res, 400, { error: 'missing-session', detail: '断点续传需要 session 参数' })
+  const activeKey = fsActiveKey(dirReal, name, session)
+  if (activeUploads.has(activeKey)) return fsJson(res, 409, { error: 'upload-busy' })
   const queryOffsetRaw = url.searchParams.get('offset')
   const headerOffsetRaw = req.headers['upload-offset']
   const offsetRaw = queryOffsetRaw ?? headerOffsetRaw
@@ -3648,21 +3739,37 @@ function fsUploadResumable(req, res, url, dirLex, dirReal) {
   } catch (err) {
     return fsJson(res, 403, { error: 'permission-denied', detail: err.message })
   }
-  const activeKey = fsActiveKey(dirReal, name, session)
   activeUploads.set(activeKey, stream)
 
   let bytes = 0
   let finished = false
+  let written = false
+  let cancelled = false
+  const release = () => {
+    if (activeUploads.get(activeKey) === stream) activeUploads.delete(activeKey)
+  }
+  res.once('finish', () => { finished = true; if (!cancelled) release() })
   const abort = (status, msg, extra = {}) => {
     if (finished) return
     finished = true
-    activeUploads.delete(activeKey)
+    cancelled = true
+    const cleanup = () => {
+      if (status === 413 || status === 500 || msg === 'cancelled') { try { fs.unlinkSync(part) } catch {} }
+      release()
+    }
+    if (stream.closed) cleanup()
+    else stream.once('close', cleanup)
     try { stream.destroy() } catch {}
     // 网络中断时保留分片, 客户端 probe 后续传; 只有超限/写失败才删
-    if (status === 413 || status === 500) { try { fs.unlinkSync(part) } catch {} }
     if (!res.headersSent) fsJson(res, status, { error: msg, ...extra })
     else try { res.destroy() } catch {}
   }
+  stream.cancelUpload = () => {
+    const closed = stream.closed ? Promise.resolve() : new Promise(resolve => stream.once('close', resolve))
+    abort(409, 'cancelled')
+    return closed
+  }
+  res.once('close', () => { if (!finished) abort(400, 'client-aborted') })
 
   stream.on('error', (err) => {
     abort(500, err.code === 'ENOENT' ? 'part-missing' : 'write-failed', { detail: err.message })
@@ -3680,9 +3787,11 @@ function fsUploadResumable(req, res, url, dirLex, dirReal) {
   })
   req.on('end', () => {
     if (finished) return
-    finished = true
-    stream.end(() => {
-      activeUploads.delete(activeKey)
+    stream.end()
+  })
+  stream.once('finish', () => { written = true })
+  stream.once('close', () => {
+      if (finished || !written) return
       const total = offset + bytes
       try {
         const st = fs.statSync(part)
@@ -3700,21 +3809,22 @@ function fsUploadResumable(req, res, url, dirLex, dirReal) {
           return
         }
         const commit = (actualSha256) => {
+          if (cancelled) return
           try {
             const ts = fsTargetState(target)
             if (ts.status) return fsJson(res, ts.status, { error: ts.error, detail: ts.detail })
             if (ts.exists && !overwrite) return fsJson(res, 409, { error: 'conflict', detail: '文件已存在, overwrite=1 可覆盖' })
-            if (ts.exists) fs.rmSync(target, { force: true })
-            fs.renameSync(part, target)
+            fsCommitUpload(part, target, overwrite)
             fsJson(res, 201, { ok: true, name, path: path.join(dirLex, name), size: total, resumed: offset > 0, session, uploadLength, ...(actualSha256 ? { sha256: actualSha256 } : {}) }, fsUploadHeaders(total, uploadLength))
           } catch (err) {
-            if (!res.headersSent) fsJson(res, 403, { error: 'write-failed', detail: err.message })
+            if (!res.headersSent) fsJson(res, err.code === 'EEXIST' ? 409 : 403, { error: err.code === 'EEXIST' ? 'conflict' : 'write-failed', detail: err.message })
             else try { res.destroy() } catch {}
           }
         }
         if (sha256Expected) {
           // 落盘前校验: 不匹配保留分片并返回 422, 客户端可重传或取消
           sha256FileHex(part, (err, actual) => {
+            if (cancelled) return
             if (err) return fsJson(res, 403, { error: 'checksum-failed', detail: err.message })
             if (actual !== sha256Expected) {
               return fsJson(res, 422, { error: 'checksum-mismatch', expected: sha256Expected, actual, partialSize: total, session }, fsUploadHeaders(total, uploadLength, Date.now() + FS_UPLOAD_TTL_MS))
@@ -3728,7 +3838,6 @@ function fsUploadResumable(req, res, url, dirLex, dirReal) {
         if (!res.headersSent) fsJson(res, 403, { error: 'write-failed', detail: err.message })
         else try { res.destroy() } catch {}
       }
-    })
   })
 }
 
@@ -3757,17 +3866,15 @@ async function fsUploadControl(req, res, url) {
   const part = fsPartPath(checked.abs, name, session)
   const active = activeUploads.get(fsActiveKey(checked.abs, name, session))
   if (active) {
-    try { active.destroy() } catch {}
-    activeUploads.delete(fsActiveKey(checked.abs, name, session))
+    await active.cancelUpload()
+    return fsJson(res, 200, { ok: true, cancelled: true, session })
   }
-  // 等写流关闭后再删, 防止 write 把分片重新创建出来
-  setTimeout(() => {
+  // 无活动写流时同步删除，不留下可被新上传插入的延时窗口。
     let removed = false
     try { fs.unlinkSync(part); removed = true } catch (err) {
       if (err.code !== 'ENOENT') return fsJson(res, 403, { error: 'permission-denied', detail: err.message })
     }
     fsJson(res, 200, { ok: true, cancelled: true, removed, session })
-  }, 80)
 }
 
 async function serveFs(req, res, url) {
@@ -4093,7 +4200,7 @@ async function proxyLegacyApi(req, res, url) {
 
   let responseDone = false
   const upstreamReq = UPSTREAM_TRANSPORT.request({
-    hostname: UPSTREAM.hostname,
+    hostname: UPSTREAM_HOSTNAME,
     port: UPSTREAM_PORT,
     method: req.method,
     path: url.pathname + url.search,
@@ -4481,7 +4588,7 @@ server.on('upgrade', (req, socket, head) => {
     handshakeTimer = null
   }
   const upstreamReq = UPSTREAM_TRANSPORT.request({
-    hostname: UPSTREAM.hostname,
+    hostname: UPSTREAM_HOSTNAME,
     port: UPSTREAM_PORT,
     method: req.method,
     path: url.pathname + url.search,