dsh-rewind-plugin 0.9.1 → 0.10.0-alpha.2

package/README.en.md

@@ -1,7 +1,7 @@
 # dsh-rewind
 
 > [!WARNING]
-> **Planning to use DSH `0.1.3`? Upgrade to the latest plugin (`>= 0.9.0`) as soon as possible and run `/dsh-rewind-fix` to update old rewind markers** ([update guide](docs/rewind-fix.md)).
+> **Planning to use DSH `0.1.3`? Install a `v0.9.x` release as soon as possible and run `/dsh-rewind-fix` to update old rewind markers** ([update guide](docs/rewind-fix.md)).
 
 Conversation rewind for DeepSeek Harness: **rewind the conversation to any earlier user message in one click, in the same window** — no new branch, no window switch, with optional workspace-file restore (full Claude Code `/rewind` semantics).
 
@@ -106,7 +106,7 @@ The whole design rests on two principles, simple but deliberate: **the conversat
 
 The file half follows Claude Code's checkpoint semantics — **partial tracking + before-write backup, plus a re-scan of tracked files at each message**, not a whole-tree snapshot. This trade-off saves space, and it's actually more complete:
 
-- **Before-write backup**: tracks only the write-class tools (`write`, `edit`, `str_replace_editor`) — backs up the original content before a write and records/tracks the files it touches; it never backs up the whole workspace, so it's lightweight.
+- **Before-write backup**: tracks only the write-class tools (`write`, `edit`) — backs up the original content before a write and records/tracks the files it touches; it never backs up the whole workspace, so it's lightweight.
 - **External changes count too**: at every user-message boundary the plugin re-checks all tracked files — external changes such as a command run or a manual edit are recorded as well and restored by a later rewind. "Lightweight" but not "incomplete".
 - **Unchanged-not-recorded, identical-content-as-link**: an entry is written only when something changed — at the message-boundary re-check, an unchanged file is never backed up (no record); at before-write time, when the new content matches the path's prior record, only a **link to it** (`ref`) is stored instead of a copy. Repeated writes cost almost nothing, and a link is materialized before its group is evicted — never left dangling.
 - **Reconcile against the real disk before restoring**: restore takes each path's **earliest** record, then reads the live file and compares — **only files that actually differ are touched**: modified files are written back to the earliest backup, files created after the target are deleted, already-matching files are skipped. Repeated rewinds are therefore **idempotent with zero side effects** and never produce "ghost impact".

package/README.md

@@ -1,7 +1,7 @@
 # dsh-rewind
 
 > [!WARNING]
-> **计划使用 DSH `0.1.3` 的用户：请尽早升级到最新插件（`>= 0.9.0`），并运行 `/dsh-rewind-fix` 更新旧回退标记**（[更新指南](docs/rewind-fix.zh.md)）。
+> **计划使用 DSH `0.1.3` 的用户：请尽早安装 `v0.9.x` 版本，并运行 `/dsh-rewind-fix` 更新旧回退标记**（[更新指南](docs/rewind-fix.zh.md)）。
 
 DeepSeek Harness 插件：**一键就地回退对话到任意更早的用户消息**——同窗口内完成，不新建分支、不换窗口，可一并还原工作区文件（完整 Claude Code `/rewind` 语义）。
 
@@ -96,7 +96,7 @@ dsh plugin --profile web add dsh-rewind-plugin
 
 文件部分对齐 Claude Code 的检查点语义——**局部追踪、写前备份 + 每条消息重扫已跟踪文件**，而不是整树快照。这项取舍既省空间，又更完整：
 
-- **写前备份**：只追踪写类工具（`write`、`edit`、`str_replace_editor`），写前**备份原内容**，并**记录、追踪**被处理的文件——从不备份整个工作区，因此轻量。
+- **写前备份**：只追踪写类工具（`write`、`edit`），写前**备份原内容**，并**记录、追踪**被处理的文件——从不备份整个工作区，因此轻量。
 - **外部变更也追**：每条用户消息边界，插件重新检查所有已跟踪文件——命令执行、手动修改等外部变更同样被记录，回退时一并还原。这让「轻量」却不「残缺」。
 - **不变不存、同内容存链接**：记录只在有变化时发生——消息边界重扫时无变更的不备份（不留记录）；写前备份时若与前一条记录一致，只存**指向它的链接**（`ref`）而非复制内容。重复写入几乎不占空间，链接也先落地、绝不悬空。
 - **还原时对照真实磁盘**：先取每条路径的**最早**记录，再实时读取文件当前内容与之比对——**只操作真正不一致的文件**：改过的写回最早期内容、目标之后新建的删除、已经一致的跳过。重复回退因此**零副作用、幂等**，不会出现「幽灵影响」。

package/docs/architecture.md

@@ -17,12 +17,9 @@ credentials access.
 
 ```
 src/
-├── index.ts          host plugin: /rewind, /undo, /snapshot-auto-cleanup,
-│                     /dsh-rewind-fix commands + checkpoint pipeline
+├── index.ts          host plugin: /rewind, /undo, /snapshot-auto-cleanup
+│                     commands + checkpoint pipeline
 ├── rewind.ts         pure planning: target parsing, surface-range plan, candidate listing
-├── rewind-fix.ts     /dsh-rewind-fix orchestration (repair pipeline, locks, rollback)
-├── rewind-marker-repair.ts  pure legacy-marker transform (A/B → C)
-├── session-log-io.ts session-log zstd codec + lossless re-encoder (rewind-fix write-back)
 ├── snapshot.ts       checkpoint store: disk before-backups, journaled restore,
 │                     reconcile / continue / rollback, bounded prune
 ├── snapshot-cleanup.ts  cleanup policy + dsh-settings persistence + auto-sweep throttle
@@ -33,6 +30,11 @@ src/
                      pending interaction, locales, styles
 ```
 
+The old marker-update repair line (`/dsh-rewind-fix` and its `rewind-fix.ts` /
+`rewind-marker-repair.ts` / `session-log-io.ts` modules) was a **temporary
+migration tool** for the DSH `0.1.2-rc.1` → `0.1.3` transition: it shipped
+through the `0.9.x` line and is **removed in the `0.10.x` line**.
+
 Two dependency rules keep the design testable:
 
 1. **`rewind.ts` is pure** — no I/O, no `Session` dependency; everything
@@ -53,7 +55,7 @@ machine channels (see [Compatibility strategy](#compatibility-strategy)).
     user/message currently on the surface)
   → agent.cancel({ keepInbox: true }) if running; waitForAgentIdle
   → dropPendingSteering (next-step inbox only; queued messages untouched)
-  → append the rewind marker = an empty user/message with surfaceOp
+  → append the rewind marker = a user/message with surfaceOp
     { op: 'replace', start, end } over every surface node after the
     target (+ sourceEventSeqs = shadowed seqs)          [a single event]
   → if mode 'both': store.restoreAfter(targetSeq) + syncRestoreObservations
@@ -66,11 +68,14 @@ Key invariants:
 
 - **The log is append-only.** The marker is the *only* mutation: it cuts the
   model-visible surface, never the raw history (search/export still see it).
-- **The marker is empty** (`content: []`) and carries the dsh-rewind plugin
-  source. It is a `user/message`, the only surface type that can cite the
-  shadowed seqs (`sourceEventSeqs`) — `assistant/message` can no longer carry
-  them (v2). It derives to itself, so it stays as a present-but-empty user
-  turn at the surface tail rather than entering model context as content.
+- **The marker content is a constant `(empty message)` placeholder.** It carries
+  the dsh-rewind plugin source and is a `user/message`, the only surface type
+  that can cite the shadowed seqs (`sourceEventSeqs`) — `assistant/message` can
+  no longer carry them (v2). It derives to itself, so it stays as a present
+  user turn at the surface tail. The content is provider-independent and never
+  empty: the session log is immutable but the model serving a session may
+  change later, and a strict OpenAI-compatible gateway rejects an empty user
+  message (HTTP 400, Issue #21).
 - **No ghost step frame is needed**: the token-meter step machine ignores
   `user/message`, and the session invariant imposes no open-turn requirement
   on it, so the marker is appended while idle, outside any turn, as one event.
@@ -80,8 +85,9 @@ Key invariants:
 
 ### Marker format history
 
-The rewind marker is written as form C (an empty `user/message` with a
-`surfaceOp.replace` over the shadowed range and `sourceEventSeqs`). Earlier
+The rewind marker is written as form C (a `user/message` with a
+`surfaceOp.replace` over the shadowed range, `sourceEventSeqs`, and the
+constant `(empty message)` content). Earlier
 plugin versions wrote shapes a newer harness no longer accepts:
 
 - **form A** — a bare `assistant/message(turn=N, step=0)` with no frame.
@@ -89,13 +95,15 @@ plugin versions wrote shapes a newer harness no longer accepts:
   inside a closed turn.
 
 A/B became unreadable once v2 reserved surface `replace` to a node that cites
-`sourceEventSeqs` (`assistant/message` can no longer carry them). `/dsh-rewind-fix`
-rewrites form A/B in closed sessions to form C so a newer harness accepts the log.
+`sourceEventSeqs` (`assistant/message` can no longer carry them). The
+`/dsh-rewind-fix` command rewrote form A/B in closed sessions to form C so a
+newer harness accepts the log — it was a **temporary migration tool** (kept on
+the `0.9.x` line) and is **removed in the `0.10.x` line**.
 
 ## Checkpoint pipeline (Claude Code before-backup model)
 
 ```
-tools/execute        captureBefore: for write / edit / str_replace_editor
+tools/execute        captureBefore: for write / edit
                      (mutating commands only), read the file's BEFORE state;
                      subagent edits are NOT tracked (Claude Code alignment).
 tools/post-execute   commitEntry: anchor = latest user/message seq; skip

package/docs/compat/audit.md

@@ -50,7 +50,7 @@ legacy branch).
 
 ## Verified-compatible surfaces (probes pass)
 
-- **token-meter replay** (the empty `user/message` marker + multiple rewinds + interleaved real turns + compact stacking).
+- **token-meter replay** (the `user/message` marker + multiple rewinds + interleaved real turns + compact stacking).
 - **compaction transactions**: `toolPairingBalancedBefore/After` stays balanced after a marker cut; the real `/compact` command (`command-compact` + `compaction-basic`, stub summarizer) can land `compaction/start…end` on top of a rewind marker and stay replayable; `/compact` is a legal no-op on a small surface.
 - **resume replay**: `Session.create(id, events)` replays a rewind/compact-bearing log.
 - **session-stats**: the `user/message` marker adds no step (the step count stays at the real turns' steps), no phantom turn.
@@ -63,8 +63,9 @@ legacy branch).
 
 ## Known behavior boundaries (deterministic differences, non-crash, documented)
 
-- **session-stats / session-telemetry fold the full log**: post-rewind stats do **not** rewind — `turns`/`steps`/`llmMs` still include withdrawn content; the empty `user/message` marker is folded as a present-but-empty user turn (it adds no step). This is the intended "fold the full log" semantics, pinned by probe.
-- **token-meter usage anchor stays stable** (G3): the empty `user/message` marker carries no usage, but because it is not an `assistant/message`, the baseline anchor does not drop to a heuristic estimate — it stays `usage` across a rewind. Pinned by `compat-gaps` G3.
+- **session-stats / session-telemetry fold the full log**: post-rewind stats do **not** rewind — `turns`/`steps`/`llmMs` still include withdrawn content; the `user/message` marker is folded as a present user turn (it adds no step). This is the intended "fold the full log" semantics, pinned by probe.
+- **token-meter usage anchor stays stable** (G3): the `user/message` marker carries no usage, but because it is not an `assistant/message`, the baseline anchor does not drop to a heuristic estimate — it stays `usage` across a rewind. Pinned by `compat-gaps` G3.
+- **marker content is the constant `(empty message)` placeholder**: never empty, because the session log is immutable but the model serving a session may change later — a strict OpenAI-compatible gateway rejects an empty user message (HTTP 400, Issue #21). The marker is a small visible user turn in derived history. Pin: `verify-host` (`marker is a user/message with the dsh-rewind plugin source and the (empty message) placeholder`).
 - **Withdrawn content stays searchable/exportable**: session-query full-text and `/export` read the raw log; a rewind cuts only the surface, so withdrawn messages remain (declared in the README).
 - **Session title auto-regeneration**: the title derives from the surface, so an automatically-derived title may change after a rewind.
 - **Files written but uncommitted in a cancelled turn**: a `both` rewind cannot restore them (tool side-effect timing; same as Claude Code).

package/docs/format.md

@@ -158,8 +158,7 @@ Old-format data is never silently re-interpreted.
 The snapshot auto-cleanup policy (the `enabled` switch and the `maxAgeDays`
 idle cutoff) is no longer a file: it lives in the **dsh-settings document** under
 the `dsh-rewind-snapshot-cleanup` namespace (validated by a schemastery schema;
-defaults are the `base` layer). On first run after this change, a legacy
-`<dsh home>/snapshot-cleanup.json` is imported into the document **once** and
-then deleted (an absent file is a no-op; an invalid file imports the safe
-default and is dropped). The last-sweep clock stays in its own
+defaults are the `base` layer). The policy was previously persisted in a legacy
+`<dsh home>/snapshot-cleanup.json` file; that file store and its one-time
+startup migration have been removed. The last-sweep clock stays in its own
 `<dsh home>/snapshot-cleanup-last-sweep.json` state file, which is unchanged.

package/docs/harness-reference.md

@@ -49,12 +49,9 @@ the canonical source; this block only adds the finer-grained client-side files
 and packaging entries.
 
 ```
-src/index.ts            host plugin: /rewind|/undo|/snapshot-auto-cleanup|/dsh-rewind-fix
+src/index.ts            host plugin: /rewind|/undo|/snapshot-auto-cleanup
                         + checkpoint pipeline (tools/execute|post-execute)
 src/rewind.ts           pure planning: target resolution, surface range, candidate listing
-src/rewind-fix.ts       /dsh-rewind-fix orchestration (repair pipeline, locks, rollback)
-src/rewind-marker-repair.ts  pure legacy-marker transform (A/B → C)
-src/session-log-io.ts   session-log zstd codec + lossless re-encoder (rewind-fix write-back)
 src/snapshot.ts         checkpoint store (disk before-backups, restore/preview, bounded prune)
 src/snapshot-cleanup.ts cleanup policy + dsh-settings persistence + auto-sweep throttle
 src/session-cwd.ts      session-cwd resolution (fs-tools rule)

package/docs/release/release.md

@@ -91,6 +91,13 @@ appended) when DSH releases a new tuple.
 - **After DSH goes final**: final releases are not bound by the prerelease
   tuple rule, so the peers can converge to a single stable range (e.g.
   `^0.1.x`); this section can then be deleted.
+- **Declared minimum (`dsh.engines.dsh`)**: alongside the peer tuple, each
+  release declares the DSH runtime floor under `dsh.engines.dsh` (e.g.
+  `>=0.1.2-rc.1`), consumed by the plugin-manager update guard. Bump it in
+  the same release that raises the peer tuple; never leave code raised while
+  the declared floor stays behind. Only the `>=X.Y.Z[-pre]` form is
+  supported (`^`/`~`/multi-range are treated as "cannot verify" and
+  fail closed).
 
 ## Versioned-line release model
 

package/docs/release/release.zh.md

@@ -79,6 +79,11 @@ DSH 仍在 rc 阶段，npm 的 prerelease 匹配规则要求 peer 范围与宿
   → devDependencies 同步升到最新 → `npm install` → `npm run check` → 发版。
 - **正式版后收敛**：DSH 发布 final 版本后，正式版不受 prerelease 元组规则
   限制，peer 可收敛为稳定的 `^0.1.x` 单范围，此节即可删除。
+- **声明的最低运行时（`dsh.engines.dsh`）**：与 peer 元组一起，每个发布在
+  `dsh.engines.dsh` 声明 DSH 运行时下限（如 `>=0.1.2-rc.1`），供插件管理器
+  更新守卫读取。**与 peer 元组持平的同一发布里一并 bump**；不可只升代码、
+  声明下限停留在旧值。仅支持 `>=X.Y.Z[-pre]` 形式（`^`/`~`/多范围会被视为
+  「无法校验」而 fail-closed）。
 
 ## 发布版本线模型
 

package/docs/rewind-fix.md

@@ -5,7 +5,7 @@
 ## Applies to
 
 - **DSH**: `0.1.2-rc.1`
-- **dsh-rewind**: `0.9.0-alpha.1`, `0.9.0-alpha.2`, `0.9.0`
+- **dsh-rewind**: `0.9.0-alpha.1`, `0.9.0-alpha.2`, `0.9.0`, `0.9.1`
 
 ## Background
 

package/docs/rewind-fix.zh.md

@@ -5,7 +5,7 @@
 ## 适配
 
 - **DSH**: `0.1.2-rc.1`
-- **dsh-rewind**: `0.9.0-alpha.1`, `0.9.0-alpha.2`, `0.9.0`
+- **dsh-rewind**: `0.9.0-alpha.1`, `0.9.0-alpha.2`, `0.9.0`, `0.9.1`
 
 ## 背景
 

package/lib/client.js

@@ -446,7 +446,12 @@ var STYLE = `
   line-height: 1.5;
   color: var(--dsw-alias-label-error);
 }
-/* Switch row: label left, role=switch button right, hint below (Subagent module). */
+/* Switch row: label left, role=switch button right, hint below (Subagent module).
+ * The track mirrors the harness ui-primitives Switch (0.1.3-alpha.2 line): the
+ * on/off appearance keys off aria-checked rather than a parallel class, so the
+ * visual state cannot disagree with the state assistive technology reads, and
+ * corner-shape: round opts the capsule track out of the global superellipse
+ * (which would square the capsule ends off against the round thumb inside). */
 .dsh-rewind-cleanup-toggle-row {
   display: flex;
   align-items: flex-start;
@@ -469,10 +474,11 @@ var STYLE = `
   padding: 2px;
   border: 0;
   border-radius: 10px;
+  corner-shape: round;
   background: var(--dsw-alias-border-l3);
   cursor: pointer;
 }
-.dsh-rewind-cleanup-switch-on {
+.dsh-rewind-cleanup-switch[aria-checked='true'] {
   background: var(--dsw-alias-brand-primary);
 }
 .dsh-rewind-cleanup-switch:disabled {
@@ -492,7 +498,7 @@ var STYLE = `
   background: var(--dsw-alias-label-primary-foreground);
   transition: transform 120ms ease;
 }
-.dsh-rewind-cleanup-switch-on .dsh-rewind-cleanup-thumb {
+.dsh-rewind-cleanup-switch[aria-checked='true'] .dsh-rewind-cleanup-thumb {
   transform: translateX(16px);
 }
 .dsh-rewind-cleanup-input {
@@ -1333,8 +1339,8 @@ function createRewindBridge(deps) {
 }
 
 // src/client/build-info.ts
-var PLUGIN_VERSION = true ? "0.9.1" : "dev";
-var BUILD_HASH = true ? "39613bb7" : "dev";
+var PLUGIN_VERSION = true ? "0.10.0-alpha.2" : "dev";
+var BUILD_HASH = true ? "cc039b5d" : "dev";
 
 // src/client/locales.ts
 var zh = {
@@ -1531,7 +1537,7 @@ function SettingsCleanupCard({ api, t }) {
             {
               type: "button",
               role: "switch",
-              className: `dsh-rewind-cleanup-switch${draft.enabled ? " dsh-rewind-cleanup-switch-on" : ""}`,
+              className: "dsh-rewind-cleanup-switch",
               "aria-checked": draft.enabled,
               "aria-labelledby": "dsh-rewind-cleanup-enabled-label",
               disabled,