dsh-retrace 0.4.26 → 0.4.27

package/README.md

@@ -298,13 +298,60 @@ Read it before filing an issue.
 - Stale peer declarations with no remaining import site removed
   (`@deepseek-ai/dsh-home-paths`, `@deepseek-ai/dsh-client-runtime`).
 
+### Host-side breaking changes that `0.4.27` adapts to — *not caused by this plugin*
+
+1. **`@deepseek-ai/dsh-session` removed the `Session.events` member** (in `0.1.5-rc.1`).
+   The class has no `events` field and no `events` getter at all any more; the supported
+   readers are `snapshotEvents(fromSeq, toSeqExclusive)` (frozen, sequence-indexed),
+   `eventAt(seq)`, `ownEvents()` and `isOwnSeq(seq)`. `0.4.27` reaches the log through a
+   compatibility accessor that prefers the new API and falls back to the old array, so it
+   runs on both host generations.
+   **Symptom before the fix:** recall and edit did nothing and surfaced the raw error
+   `TypeError: Cannot read properties of undefined (reading 'length')` — both operations
+   start by locating the target message id, and that lookup read the removed member.
+2. **The client-side session store has no `keys()`** (`ctx.sessions`). A plugin that
+   enumerates sessions with `keys()` silently sees **zero** of them: no crash, no error,
+   just safety warnings that never fire. `0.4.27` prefers the official `list()` and falls
+   back to `keys()`; it deliberately does **not** fall back to enumerating service fields,
+   because guessing produces a silent empty result as well.
+3. **The client session controller has no title accessor** — `getTitle` does not exist
+   anywhere in `@deepseek-ai/dsh-api-session-controller`, and its `getSnapshot()` carries
+   no `title`. See the plugin-side item below: this one used to *overwrite your titles*.
+
+### Plugin-side fixes in `0.4.27` (these are ours)
+
+- **The edit / recall affordances never appeared at all.** The client half read chat
+  nodes from `snapshot.chat.nodes`, a path this host build does not have — nodes live in
+  the `useChat` store (`snapshot.nodes`). Every message-level component threw while
+  rendering and was swallowed by the error boundary, so the buttons were missing, while
+  the settings entry (which reads no nodes) rendered fine. Fixed: the client half now
+  takes `useChat` from the slot contract.
+- **"Jump to message" in the version and fork views did nothing.** It resolved the target
+  anchor through `store.getSnapshot()?.chat?.nodes`, which is permanently `undefined`
+  here. It now resolves through the `useChat` snapshot injected by the view and pages
+  with the official `store.loadThrough(seq)`; when the jump cannot complete it reports a
+  **diagnosable reason** (renderer warning + host-log line) instead of failing silently.
+- **Assigning a short code could overwrite your session title.** The client composed
+  `[CODE] <current title>` locally but had no way to read the current title, so the base
+  degraded to the session-id prefix (`[XXXXXX] 668f9166-648c-4c`). Title tagging now goes
+  through the host route only (`setBadgeTitle`), which reads the current title from the
+  session log. Manual renames are unaffected.
+- **Host-side operation failures are logged again** (code + message + stack). They used to
+  return the message to the UI without a log line, which is why this whole class of bug
+  was hard to diagnose from outside.
+
 ### Upgrading
 
 ```bash
-dsh plugin --profile desktop add dsh-retrace@0.4.26
+dsh plugin --profile desktop add dsh-retrace@0.4.27
 # then restart DSH — plugins are not hot-reloaded
 ```
 
+**`0.4.27` needs no data migration.** The session format is unchanged (v3), no session is
+re-written, and nothing has to be re-indexed: upgrade, restart, and the two symptoms above
+are gone. If you are on a host that still provides the old members, the compatibility
+accessors keep those paths working — this build does not drop older hosts.
+
 If the app **fails to boot after an upgrade**, a single failing plugin can take the
 whole tree down, so recover first and diagnose second:
 

package/lib/adapter/dsh-writer.js

@@ -39,6 +39,8 @@ import { editorError, editorId, lastModelSource } from '../host-core.js'
 import { assertContract, assertSpanShape, assertMarkerShape, assertAuditShape, runtimeSurfaceOpShape, contractViolation } from './contract.js'
 // 载体形状/文案的唯一真相(纯模块零 import;生成动态件时与 contract 一同 inline)。
 import { AUDIT_EVENT_TYPE, CARRIER_EVENT_TYPE, CARRIER_SOURCE_KIND, TRACE_TEXT } from '../marker-carrier.js'
+// Host event-view compatibility (new host: snapshotEvents/eventAt; old host: events array).
+import { sessionEvents, eventAt, nextAppendSeq } from '../host-compat.js'
 
 /**
  * 第 2 段的 content(留痕 + 可解释载体)。
@@ -99,12 +101,13 @@ function resolveMeter(meter) {
  */
 function priceByNode({ service, deriveMessage, session, seqs }) {
   if (typeof deriveMessage !== 'function' || typeof service.estimateMessage !== 'function') return null
-  const events = Array.isArray(session?.events) ? session.events : null
-  if (!events) return null
+  // 无事件视图(既无 snapshotEvents 也无 events 数组)→ 该来源不可用(null,不再是静默空)。
+  const hasEventView = typeof session?.snapshotEvents === 'function' || Array.isArray(session?.events)
+  if (!hasEventView) return null
   let tokens = 0
   const missing = []
   for (const seq of seqs) {
-    const event = Number.isSafeInteger(seq) ? events[seq] : undefined
+    const event = Number.isSafeInteger(seq) ? eventAt(session, seq) : undefined
     let price = null
     if (event !== undefined && event !== null) {
       try {
@@ -251,14 +254,24 @@ export function createDshMarkerWriter({ validateMarker, log = () => {}, meter, d
         ? { op: 'replace', startSeq: span.start, endSeq: span.end }
         : { op: 'replace', start: span.start, end: span.end }
       const shadowed = Array.isArray(span.shadowedSeqs) ? span.shadowedSeqs.slice() : []
-      // ── 写前断言(在任何 append 之前;seq 是唯一无法提前得知的字段)──
-      // ② 第 2 段:先按「被遮蔽段」预演一次(审计 seq 未定);第 1 段落盘后再用
-      //    **真实**审计 seq 复核一次(见 assertMarkerShape 的 auditSeq 选项)。
-      const preview = { seq: 0, type: CARRIER_EVENT_TYPE, data, surfaceOp, sourceEventSeqs: shadowed.slice() }
-      assertMarkerShape(preview, 'dshAdapter.writeMarker.marker(preview)', { runtimeShape: opShape })
-      // 写前校验钩子**两阶段**(见 prewrite-guard):
-      // 阶段 pre = 落盘前只跑业务闸(回档幅度等,不依赖 seq)⇒ 拒绝时**零写入**;
-      // 阶段 post = 第 1 段已落盘、第 2 段未落盘,跑完整契约校验(审计 seq 真实存在)。
+      // ── 写前断言/校验(全部在任何 append 之前)──
+      // 两段结构**成对**(判据 = lib/marker-carrier.js:15 形状 / :23 sourceEventSeqs
+      // 首元素 = 第 1 段 seq / :32 同一读法)。任何在第 1 段落盘**之后**才失败的校验
+      // 都会留下孤儿审计行(2026-09-14 真机:seq 26032/26033 —— 官方 shadow-price
+      // claim 无人消费 ⇒ contextPressure.surfaceTokens 漂移)。
+      // 故把完整契约校验**前移**:审计段按它将被写入的位置合成进事件表,与载体一起校验。
+      // seq 是唯一无法提前得知的字段:交给 validateMarker 的信封**不带 seq**
+      // ——`createPreWriter.validateAppend` 只在 `candidate.seq === undefined` 时按
+      // nextSeq 赋值;带伪造 seq(历史硬编码 0)会被判 E2/S6/S8(见 marker-append-seq 测试)。
+      // `assertMarkerShape` 仍用 `seq: 0` 的**形状副本**(只要求 seq 是非负安全整数)。
+      const carrierEnvelope = (seqs) => ({ type: CARRIER_EVENT_TYPE, data, surfaceOp, sourceEventSeqs: seqs })
+      const withShapeSeq = (envelope) => ({ seq: 0, ...envelope })
+      const preview = carrierEnvelope(shadowed.slice())
+      assertMarkerShape(withShapeSeq(preview), 'dshAdapter.writeMarker.marker(preview)', { runtimeShape: opShape })
+      // 写前校验钩子三态(见 prewrite-guard):
+      //   pre  = 落盘前只跑业务闸(回档幅度等,不依赖 seq)⇒ 拒绝时**零写入**;
+      //   pair = **计划中的两段**(审计 + 载体)整体跑完整契约校验 ⇒ 拒绝时**零写入**;
+      //   post = 兼容旧调用方的"第 1 段已落盘"形态(本 writer 已不使用)。
       // 业务闸先于「取令牌价」:业务拒绝的错误码不该被定价路径的内部错误盖掉。
       if (typeof validateMarker === 'function') {
         await validateMarker(session, preview, { phase: 'pre' })
@@ -283,35 +296,48 @@ export function createDshMarkerWriter({ validateMarker, log = () => {}, meter, d
       // ① 第 1 段:官方词表把 `compaction/prune` 的 data 定为精确三成员
       //    (无 optional/opaque)⇒ 形状不合规一律在写盘前拦下。
       assertAuditShape({ seq: 0, type: AUDIT_EVENT_TYPE, data: auditData }, 'dshAdapter.writeMarker.audit(preview)')
-      // 第 1 段先写:两段都须引用更早 seq,且关联方向只能是「第 2 段 → 第 1 段」。
-      let auditSeq = appendAudit(session, auditData)
-      // 第 2 段:首元素 = 审计 seq,其后是**全部**被遮蔽节点(官方 provenance 硬要求
-      // 「须列全被遮蔽的面节点」)。
-      let envelope = { seq: 0, type: CARRIER_EVENT_TYPE, data, surfaceOp, sourceEventSeqs: [auditSeq, ...shadowed] }
-      assertMarkerShape(envelope, 'dshAdapter.writeMarker.marker', { runtimeShape: opShape, auditSeq })
-      if (typeof validateMarker === 'function') {
-        await validateMarker(session, envelope, { phase: 'post', auditSeq })
+      // ── pair 校验:两段作为整体,在任何 append 之前 ──────────────────────────
+      // 计划中的审计 seq = 当前追加位;校验后**同步复核**(到 appendAudit 之间无 await),
+      // 并发 append 使预言过期时重跑校验;连续漂移则零写入报错(不留孤儿)。
+      let plannedAuditSeq = nextAppendSeq(session)
+      let pairValidated = typeof validateMarker !== 'function'
+      for (let attempt = 0; attempt < 3 && !pairValidated; attempt++) {
+        const pairEnvelope = carrierEnvelope([plannedAuditSeq, ...shadowed])
+        assertMarkerShape(withShapeSeq(pairEnvelope), 'dshAdapter.writeMarker.marker(pair)', { runtimeShape: opShape, auditSeq: plannedAuditSeq })
+        await validateMarker(session, pairEnvelope, { phase: 'pair', audit: auditData, auditSeq: plannedAuditSeq })
+        const live = nextAppendSeq(session)
+        if (live === plannedAuditSeq) pairValidated = true
+        else plannedAuditSeq = live
+      }
+      if (!pairValidated) {
+        throw editorError(
+          'marker-pair-race',
+          'Concurrent appends kept moving the log tail while validating the two-segment marker; nothing was written. Retry.',
+        )
       }
+      // ── 同步段:审计 + 载体,中间没有任何 await ────────────────────────────
       // 官方 shadow-price 协议要求 claim 与 replace **紧邻**(surface-projection:
       // "producers append the metering event and the replacement synchronously
-      // adjacent, so a surviving claim always prices the very next event")。上面两次
-      // `await` 之间可能有并发 append 落盘 ⇒ claim 被顶掉 ⇒ 官方 fold 以 **0 增量**
-      // 折叠(不抛、静默)。在同步段复核相邻性,被顶掉就重挂一条审计段
-      // (旧段留在日志里:log-only,不遮蔽任何节点)。
+      // adjacent, so a surviving claim always prices the very next event")。旧流程在
+      // 两段之间有一次 post 校验 await ⇒ 并发 append 可能顶掉 claim;现在校验全部前移,
+      // 两段在同一同步段内落盘,相邻性由结构成立(rearmClaim 仅作兜底)。
+      const auditSeq = appendAudit(session, auditData)
+      if (auditSeq !== plannedAuditSeq) {
+        throw editorError(
+          'marker-pair-race',
+          `Audit segment landed at seq ${auditSeq} but the two-segment marker was validated at ${plannedAuditSeq}; nothing further was written. Retry.`,
+        )
+      }
       const reArmed = rearmClaim(session, span, auditSeq, shadowedTokenCount, log)
-      if (reArmed !== auditSeq) {
-        auditSeq = reArmed
-        envelope = { seq: 0, type: CARRIER_EVENT_TYPE, data, surfaceOp, sourceEventSeqs: [auditSeq, ...shadowed] }
-        assertMarkerShape(envelope, 'dshAdapter.writeMarker.marker', { runtimeShape: opShape, auditSeq })
-        // 重挂之后**不再 await**:任何 await 都会重新打开刚被顶掉的窗口,相邻性靠
-        // "同步段内无并发落盘"成立。post 校验已针对重挂前那条同形状、同价、seq 更小的
-        // 审计段跑过 ⇒ 这里只记一行说明(不再重跑,以免再次被顶掉)。
-        log(`retrace: 已重挂审计段 seq ${auditSeq}(post 校验针对重挂前的审计段跑过:同形状、同价、seq 更小)`)
+      const finalAuditSeq = reArmed === auditSeq ? auditSeq : reArmed
+      if (finalAuditSeq !== auditSeq) {
+        log(`retrace: 已重挂审计段 seq ${finalAuditSeq}(并发顶掉;旧段留在日志里,log-only,不遮蔽任何节点)`)
       }
-      // 第 2 段落盘。契约边界:可抛断言已全部完成(审计段是合法的 log-only 事件,
-      // 即便此后极端失败也不影响会话可构造性——见负控制实测:只写第 1 段不遮蔽任何
-      // 节点,官方链也照常接受)。
-      return session.append(CARRIER_EVENT_TYPE, data, { surfaceOp, sourceEventSeqs: [auditSeq, ...shadowed] })
+      // 第 2 段落盘(首元素 = 审计 seq,其后是全部被遮蔽节点)。
+      const carrier = session.append(CARRIER_EVENT_TYPE, data, { surfaceOp, sourceEventSeqs: [finalAuditSeq, ...shadowed] })
+      // ── 写后对账:两段成对(判据见 lib/marker-carrier.js:23/:32)──
+      assertPairing(session, finalAuditSeq, carrier)
+      return carrier
     },
   }
 }
@@ -328,7 +354,7 @@ function appendAudit(session, auditData) {
 
 /** 日志末尾事件的 seq(会话对象无 events 视图时 null ⇒ 跳过相邻性复核)。 */
 function tailSeqOf(session) {
-  const events = session?.events
+  const events = sessionEvents(session)
   if (!Array.isArray(events) || events.length === 0) return null
   const last = events[events.length - 1]
   return Number.isSafeInteger(last?.seq) ? last.seq : null
@@ -348,3 +374,30 @@ function rearmClaim(session, span, auditSeq, shadowedTokenCount, log) {
     shadowedTokenCount,
   })
 }
+
+/**
+ * 写后对账:第 2 段与第 1 段**成对**。
+ *
+ * 判据取自契约本身(`lib/marker-carrier.js`):
+ *   - `:15` 形状 = 第 1 段先写、第 2 段后写,两者都引用更早 seq;
+ *   - `:23` 第 2 段 `sourceEventSeqs = [<第 1 段 seq>, …全部被遮蔽节点]`;
+ *   - `:32` 关联读法(判据):第 2 段 `sourceEventSeqs` **首元素 = 第 1 段 seq**。
+ * 不满足 ⇒ 显式失败(marker-pair-unpaired),不静默返回半写结果。
+ * @param {object} session
+ * @param {number} auditSeq - 第 1 段(审计)seq
+ * @param {object} carrier - 第 2 段(载体)事件
+ */
+function assertPairing(session, auditSeq, carrier) {
+  const auditEvent = eventAt(session, auditSeq)
+  const first = Array.isArray(carrier?.sourceEventSeqs) ? carrier.sourceEventSeqs[0] : undefined
+  const paired = first === auditSeq
+    && Number.isSafeInteger(carrier?.seq)
+    && carrier.seq === auditSeq + 1
+    && auditEvent?.type === AUDIT_EVENT_TYPE
+  if (!paired) {
+    throw editorError(
+      'marker-pair-unpaired',
+      `Marker segments are not paired: carrier.seq=${String(carrier?.seq)} sourceEventSeqs[0]=${String(first)} audit seq=${auditSeq} (event type=${String(auditEvent?.type ?? 'missing')}). An orphan audit segment may remain in the log () — do not ignore.`,
+    )
+  }
+}

package/lib/adapter/dsh.js

@@ -4,7 +4,7 @@
  * DSH 平台适配器(2026-09-01)——实现 EventReader 接口。
  *
  * 职责:从 DSH 会话文件(session.jsonl.zstd)读全量事件——可靠事实,
- * 不依赖 host 内存视图(DSH 2.0.3 host 的 session.events 可能稀疏/窗口化)。
+ * 不依赖 host 内存视图(DSH 2.0.3 host 的事件视图可能稀疏/窗口化)。
  *
  * 换架构时:业务层(message-list.js/守卫)零改动,新平台实现自己的 EventReader
  * (读自己的日志格式 → 同样的通用事件结构)。
@@ -12,8 +12,7 @@
 // 会话文件定位($DSH_HOME/sessions → ~/dsh-v3/sessions → ~/.dsh/sessions;两种文件名
 // 都认、同目录并存取 mtime 新者)收敛到 lib/platform/session-paths.js 单一实现——
 // 此前本文件与 watchdog/archaeology-cli 各写一份硬编码,基座换代时口径必然分叉。
-import { homedir } from 'node:os'
-import { sessionFilePath, activeSessionsRoot, listSessionFiles } from '../platform/session-paths.js'
+import { sessionFilePath, activeSessionsRoot, listSessionFiles, workspaceAbbr } from '../platform/session-paths.js'
 // 官方 foldSurface:重放得与写入端完全一致的 surface nodes(replace 插 marker、
 // 遮蔽移除节点 → nodes 非 seq 单调;span 计算必须用它,否则 start/end indexOf
 // 会 not found/倒置 → S4/S8 拒 → 撤回死锁)。peerDep 提供。
@@ -215,7 +214,7 @@ export function computeSpan(events, target, mode = 'round') {
  * 文件侧「目标同一轮的前置 user 原文」——regenerate
  * 重发文本的唯一可靠来源。
  *
- * 为什么必须算在文件侧:host 内存 session.events 是窗口化/稀疏视图(带 undefined 洞),
+ * 为什么必须算在文件侧:host 内存事件视图是窗口化/稀疏视图(带 undefined 洞),
  * regenerate 在内存里「向前找最近的前置 user」会越过洞(洞里正是该轮 user)或越过被
  * 遮蔽区间,选到**更早轮**的 user → 重发错文本 + marker targetSeq 指向错轮。round span
  * 的起点在文件全量 events + 官方 foldSurface nodes 上就是目标同一轮的轮首 user
@@ -286,7 +285,7 @@ export const dshAdapter = {
   },
   /**
    * 从文件全量事件算某 turn 内的最大 step 号(情形② marker step 分配用)。
-   * 绕开 host 窗口化 session.events(稀疏内存视图可能看不到 turn 内全部 step,
+   * 绕开 host 窗口化事件视图(稀疏内存视图可能看不到 turn 内全部 step,
    * 算小 → 新 step 号与窗口外既有 step 冲突 = step key 冲突白屏)。
    * 失败返回 null(调用方 fallback 内存扫描)。
    * @param {string} [filePath] 可选:直接指定会话文件路径(测试注入)。
@@ -301,31 +300,9 @@ export const dshAdapter = {
 // ─────────────────────────────────────────────────────────────────────────────
 
 /**
- * 工作区目录名 → 2 位缩写。
- *
- * 会话目录名是**工作区绝对路径**把 `/` 换成 `-`、首尾再各加 `--`
- * （`/Users/<user>/proj` → `--Users-<user>-proj--`）。缩写口径：先剥掉
- * **机器相关前缀**（用户 home），再剥掉平台前缀（Users、home、Volumes 等），
- * 最后取剩下前两段的首字母；只有一段时取其前两个字符。
- *
- * ⚠️ 这里**不得**写死任何具体用户名 —— 旧实现硬编码了某一台机器的用户名，
- * 换台机器就会把工作区缩写算错（进而是错误的短码）。home 由 `os.homedir()`
- * 推出，因此本函数在任何机器上自洽。
+ * 工作区目录名 → 2 位缩写：实现见 `lib/platform/session-paths.js`（单一真相；
+ * 短码侧 `lib/identity/shortcode.js` 与本文件的推导器共用同一份，避免换机器分叉）。
  */
-function workspaceAbbr(workspace) {
-  const raw = String(workspace ?? '')
-  const encoded = raw.replace(/^--/, '').replace(/--$/, '')
-  let rest = encoded
-  const homeEnc = homedir().replace(/\//g, '-').replace(/^-+/, '').replace(/-+$/, '')
-  if (homeEnc && (rest === homeEnc || rest.startsWith(homeEnc + '-'))) {
-    rest = rest.slice(homeEnc.length).replace(/^-+/, '')
-  } else {
-    rest = rest.replace(/^-*(?:Users|home|Volumes|private|var|tmp)-/i, '')
-  }
-  const parts = rest.split('-').filter(Boolean)
-  if (parts.length >= 2) return (parts[0][0] + parts[1][0]).toLowerCase()
-  return (parts[0] ?? encoded).slice(0, 2).toLowerCase()
-}
 
 /** 派生短码表:扫活动基座各工作区会话 header,按 createdAt 排序编号,含父链。 */
 export async function deriveBadgeTable(opts = {}) {