dsh-ris-yds 1.0.0 → 1.1.0

package/README.md

@@ -21,7 +21,7 @@ YonBIP YDS 客开后端的本地运行时，做成 **DSH 插件 + CLI** 双形
 
 - **本地运行**：构建、启动、停止、查看状态与实时日志；启动失败自动回收，不留下半启动的进程。
 - **平台配置**：从平台拉取配置并适配到本地运行时；支持离线缓存，网络不可达时也能启动。
-- **内网访问**：数据库 / 缓存 / 内网服务可经代理或直连访问；本机其它客户端也能共用同一条隧道
+- **内网访问**：数据库 / 缓存 / 内网服务可经代理或直连访问；本机其它客户端也能共用同一条隧道。dsh-ris-ide 的代理 daemon（risd）在跑时自动共用它的引擎，`yds stop` 只撤自己的规则、不打断别人
   （需要系统权限的可选能力）。
 - **平台凭据**：生成调用平台 API 的 YYCToken，新环境无需额外安装。
 - **前端调试**：让远端页面加载本地前端资源，三种接入方式（浏览器扩展规则 / 请求改路 / URL 参数）。
@@ -94,6 +94,25 @@ yds stop
 | 本地运行时配置 | 改写成 `127.0.0.1` 映射地址 | 平台地址原样保留 |
 | git 代理 | 自动按克隆地址主机写入 | 不写 |
 
+### 隧道从哪来（自动选择，无需配置）
+
+1. **dsh-ris-ide 的 risd daemon 在跑**：规则、租约与系统层拦截交给它（写规则 + 登记租约），
+   daemon 的引擎不另起；但 YMS 配置被改写成 `127.0.0.1:<dbForwardPort>/<redisForwardPort>`，
+   而 daemon 引擎的 127.0.0.1 映射只做同端口映射，覆盖不到这两个端口，所以**内置 SOCKS 转发器
+   仍会作为兜底 127.0.0.1 映射同时启动**（代理模式下是两个进程：daemon 引擎 + 内置转发器；
+   直连模式下都不起）；
+2. 装了 dsh-ris-ide 但 daemon 没跑：借用它已有的代理引擎（127.0.0.1 映射由它按规则提供）；
+3. 都没有：用本插件内置的 SOCKS 转发器（零依赖，不需要 dsh-ris-ide）。
+
+规则表是**全局一张表**（面板/文件只有一份，保存即整表覆盖，不区分 workspace）。yds 每次启动注入自己
+那一段时是「保留非 yds 行 + 用本次的 yds 行整体替换旧的 yds 行」，所以 `yds stop` 会把表里**全部** yds 行
+撤掉（同一台机器上的多个项目共用这张表，没有交叉配置）；非 yds 行（你自己加的规则、其它工具注入的）不受影响。
+非 Windows（含 WSL）除了 `java.exe`/`git.exe` 还会注入本地侧 `java`/`git` 两条规则（`side` 标明侧别），
+WSL 里的 JVM/git 才会被拦截。`yds stop` **不会主动停掉机器级引擎**（IDE 可能还在用）。
+输出里的「已从共享规则表移除 N 条规则/M 个 host」是本次真正减掉的部分，减掉 0 时会明确说没改动规则表。
+注意 `yds stop` 释放的是本项目的租约：如果 daemon 的生命周期配置是「无租约即拆除代理」，而 yds 恰好是
+最后一个租约持有者，daemon 会在约 300ms 后自己关闭隧道（这不是 yds 去停它，进程日志里会打出来）。
+
 同一台机器可以混合：dsh 走代理、外部 IDE 直连（`.env` 里设 `ide.launch=direct`）：
 
 ```bash

package/lib/cli.js

@@ -12,7 +12,9 @@ import { startForwarder, stopForwarder, runForwarder, isForwarderUp, probeSocksC
 import {
   ensureBorrowedProxy, syncBorrowedRules, stopBorrowedProxy, borrowedProxyStatus, applyGitProxy, loadIdeProxy,
   loadIdeRedirector, syncRedirectorProfile, startBorrowedRedirector, stopBorrowedSideEffects,
+  holdBorrowedLease, releaseBorrowedLease, dropBorrowedLease,
 } from './ide-proxy.js'
+import { probeRisd } from './risd-peer.js'
 import { buildYmsHome, ymsHomeIsBuilt, ensureMavenSettings, findBootstrapDir } from './build.js'
 import { startDetached, startForeground, stopYms, readRunning, status, rdbgaValue, tailFile } from './yms.js'
 import { classifyRdbgaCookies, describeRdbgaCookies, hostVariants, isPlausibleRdbga, probeDevtoolsPorts, rdbgaFromRunningJvm, readRdbgaCookies, repairRdbgaCookie, workbenchTargets, DEVTOOLS_PORTS } from './browser.js'
@@ -252,6 +254,7 @@ export async function run(argv, { cwd = process.cwd() } = {}) {
         + `yms-home: ${ymsHomeIsBuilt(cfg) ? '已构建' : '未构建'}\n`
         + `${describeYoncode(detectYoncode(cfg))}\n`
         + (st !== null ? `YMS: ${st.process ? `pid ${st.process.pid}` : '未运行'}${st.ready !== null ? `, /_yms/ready=${st.ready}` : ''}\n` : '')
+        + ((st === null || !st.process) ? '提示: 运行 yds start 可拉起本地运行时（YMS）；yds start 会写代理规则与转发器\n' : '')
         + (problems.length > 0 ? `\n问题:\n- ${problems.join('\n- ')}` : '\n无配置问题'))
     }
     case 'config': {
@@ -319,6 +322,10 @@ export async function run(argv, { cwd = process.cwd() } = {}) {
       // dsh-ris-ide run-with-log.sh capture, so mvn/progress is trackable
       // via ris_dev_logs.
       const log = (t) => process.stdout.write(`[yds] ${t}\n`)
+      // Hold a lease BEFORE the tunnel comes up: prepareStart may start the shared
+      // risd engine, and a 3 s lease sweep would tear it down in the window before
+      // the YMS pid exists (review D-P1-2). The CLI pid stands in until then.
+      const earlyLease = await holdBorrowedLease(cfg, { ownerPid: process.pid, log })
       const prep = await prepareStart(cfg, { log })
       if (prep !== true) {
         if (foreground) process.stderr.write(`[yds] 启动中止: ${prep}\n`)
@@ -332,6 +339,8 @@ export async function run(argv, { cwd = process.cwd() } = {}) {
         log(`前台启动 YMS（Liberty，日志同时输出到这里）`)
         log(`rdbga 回调: ${cfg.module},${cfg.context}@${cfg.serverBindAddress}:${cfg.serverPort} (base64 ${rdbgaValue(cfg)})`)
         log(browserCookieHint(cfg, rdbgaValue(cfg)))
+        // Foreground CLI lives exactly as long as the JVM: it is the lease owner.
+        await holdBorrowedLease(cfg, { ownerPid: process.pid, log })
         const child = startForeground(cfg, { jvmArgs })
         return new Promise((resolve_, reject_) => {
           child.once('error', reject_)
@@ -345,6 +354,23 @@ export async function run(argv, { cwd = process.cwd() } = {}) {
         await rollbackForwarder(cfg)
         throw e
       }
+      if (result.unknown === true) {
+        // Do NOT start a second YMS and do NOT kill blindly: the pidfile owner could
+        // not be identified (PowerShell/EPERM/timeout), which used to be conflated with
+        // "not our process" (review D-P1-6).
+        await rollbackForwarder(cfg)
+        if (earlyLease.ok === true) await dropBorrowedLease(earlyLease.id, { log })
+        return fail(`无法确认 YMS 是否在运行：pidfile 指向 pid ${result.pid}，但${result.reason}。`
+          + `\n为避免重复启动或误杀，已中止；请手动确认该进程后删除 ${join(cfg.stateDir, 'yms.pid')}`)
+      }
+      // The YMS process outlives this CLI, so it owns the risd lease: the engine
+      // (and its 127.0.0.1 shadows) must stay up while YMS runs.
+      if (typeof result.pid === 'number' && result.pid > 0) {
+        await holdBorrowedLease(cfg, { ownerPid: result.pid, log })
+        // The YMS pid now owns the lease; the CLI's stand-in would otherwise keep
+        // the engine alive for a process that has exited.
+        if (earlyLease.ok === true) await dropBorrowedLease(earlyLease.id, { log })
+      }
       if (result.alreadyRunning === true) {
         const healed = await healBrowserCookie(cfg, { log })
         const healNote = healed.ok === true ? `浏览器 rdbga 已校准（清理 ${healed.removed} 个）` : `浏览器 rdbga 未校准：${healed.reason}`
@@ -360,22 +386,45 @@ export async function run(argv, { cwd = process.cwd() } = {}) {
         + browserCookieHint(cfg, rdbgaValue(cfg)))
     }
     case 'stop': {
+      const log = (line) => process.stdout.write(`[yds] ${line}\n`)
+      const force = flags['--force'] === true
       const yms = await stopYms(cfg)
-      let fwd
-      let side = { redirector: { stopped: false }, git: { ok: true, key: '' } }
-      if (flags['--keep-socks'] === true) {
-        fwd = { stopped: false, reason: '保留' }
-      } else {
-        // Both engines are stopped unconditionally: whichever one is running is
-        // ours (prepareStart starts exactly one), and leaving the other behind
-        // would keep 127.0.0.1:1521 bound.
-        const borrowed = await stopBorrowedProxy(cfg)
-        const own = await stopForwarder(cfg)
-        const stopped = [borrowed, own].filter((r) => r && r.stopped === true)
-        fwd = { stopped: stopped.length > 0, pid: stopped.map((r) => r.pid).filter(Boolean).join(','), reason: stopped.length > 0 ? '' : '未运行' }
-        // Machine-scoped layers that went up with the tunnel come down with it.
-        side = await stopBorrowedSideEffects(cfg, { log })
-      }
+      // A stop must not pull the tunnel out from under a YMS that is still running:
+      // when the pidfile proves a process exists but it could not be stopped (or its
+      // identity is `unknown`), abort BEFORE touching rules/forwarder/layers
+      // (review D-P1-2). `--force` is the explicit override.
+      const abort = stopAbortReason(yms, { force })
+      if (abort !== '') return fail(abort)
+      if (yms.stopped !== true && force) log('--force：未能确认 YMS 已停止，仍继续撤掉隧道规则')
+      // `--keep-socks` keeps only the bundled forwarder. It cannot keep the engine:
+      // the YMS pid that owned the risd lease is already gone, so the daemon's 3 s
+      // sweep would reap the lease and settle the tunnel anyway (review D-P2-7).
+      // Rules are withdrawn and the machine layers settle in every case.
+      const keepSocks = flags['--keep-socks'] === true
+      // Release our daemon lease before withdrawing the rules: with the lease still
+      // held the daemon would keep the engine for a dead YMS pid.
+      await releaseBorrowedLease(cfg, { log })
+      const borrowed = await stopBorrowedProxy(cfg, { log })
+      const own = keepSocks ? { stopped: false, reason: '保留（--keep-socks）' } : await stopForwarder(cfg)
+      const stopped = [borrowed, own].filter((r) => r && r.stopped === true)
+      // Two tunnels can exist (a daemon engine the daemon keeps, plus our own
+      // forwarder): report them separately instead of letting the engine line hide
+      // whether the forwarder was kept or stopped (review D-P2-7).
+      const engineNote = borrowed.engine === 'kept'
+        ? `引擎保留（机器共享；${withdrawnText(borrowed.withdrawn)}；daemon 若配置「无租约即拆除代理」会随后关闭）`
+        : (stopped.length > 0 ? `已停止 pid=${stopped.map((r) => r.pid).filter(Boolean).join(',')}` : '未运行')
+      const forwarderNote = own.stopped === true
+        ? `内置 socks 转发器已停止（pid ${own.pid}）`
+        : (keepSocks ? '内置 socks 转发器：保留（--keep-socks）' : `内置 socks 转发器：${own.reason ?? '未运行'}`)
+      const fwd = { stopped: false, engine: borrowed.engine, reason: `${engineNote}；${forwarderNote}` }
+      // Machine-scoped layers that went up with the tunnel come down with it. In the
+      // risd tier the daemon already reloaded the bridge while saving the table, so
+      // pass its note instead of reloading the bridge locally a second time
+      // (review D-P2-10).
+      const side = await stopBorrowedSideEffects(cfg, {
+        log,
+        daemonReload: borrowed.mode === 'risd' ? (borrowed.reloadNote ?? '') : null,
+      })
       const bridgeLine = side.redirector.stopped === true
         ? `已停止 pid=${side.redirector.pid}`
         : (side.redirector.reason ?? '未运行')
@@ -431,11 +480,21 @@ export async function run(argv, { cwd = process.cwd() } = {}) {
       let fwd = '不适用'
       if (cfg.socks !== null) {
         const borrowed = await borrowedProxyStatus(cfg)
-        fwd = borrowed.available === true
-          ? (borrowed.running ? `运行中（dsh-ris-ide 引擎 pid ${borrowed.pid}）` : '未运行（dsh-ris-ide 引擎可用）')
-          : ((await isForwarderUp(cfg)) ? '运行中（内置转发器）' : `未运行（${borrowed.error}）`)
+        // The engine has an owner, and the label must say which one: a risd daemon
+        // engine is not the borrowed dsh-ris-ide engine (review D-P2-14).
+        const owner = borrowed.mode === 'risd' ? 'risd daemon 引擎' : '借用 dsh-ris-ide 引擎'
+        if (borrowed.available === true) {
+          fwd = borrowed.running
+            ? `运行中（${owner} pid ${borrowed.pid ?? '?'}）`
+            : `未运行（${owner}可用，yds start 会拉起）`
+        } else {
+          fwd = (await isForwarderUp(cfg)) ? '运行中（内置转发器）' : `未运行（${borrowed.error ?? '代理引擎不可用'}）`
+        }
       }
-      return text(`YMS 进程: ${st.process ? `pid ${st.process.pid}` : '未运行'}\n端口 ${cfg.ymsPort}: ${st.port ? '监听中' : '未监听'}\n/_yms/ready: ${st.ready ?? '不可达'}\nyms-home: ${st.ymsHomeBuilt ? '已构建' : '未构建'}\nconfig: ${st.configPresent ? '已就绪' : '缺失'}\nsocks 转发器: ${fwd}`)
+      const processLine = st.process
+        ? `pid ${st.process.pid}${st.processUnknown === true ? `（身份未确认：${st.process.reason ?? '探测失败'}）` : ''}`
+        : '未运行'
+      return text(`YMS 进程: ${processLine}\n端口 ${cfg.ymsPort}: ${st.port ? '监听中' : '未监听'}\n/_yms/ready: ${st.ready ?? '不可达'}\nyms-home: ${st.ymsHomeBuilt ? '已构建' : '未构建'}\nconfig: ${st.configPresent ? '已就绪' : '缺失'}\nsocks 转发器: ${fwd}` + (st.process ? '' : '\n提示: 运行 yds start 可拉起本地运行时（YMS）；未构建时先 yds build'))
     }
     case 'logs': {
       const lines = Number(flags['--lines'] ?? 80) || 80
@@ -552,14 +611,17 @@ export async function run(argv, { cwd = process.cwd() } = {}) {
       if (proxyArgProblem !== '') return fail(`${proxyArgProblem}\n${proxyUsage}`)
       const loaded = await loadIdeProxy(cfg)
       cfg.__ideProxy = loaded
+      // Tiers: a running risd daemon is enough (it owns the engine even when this
+      // process cannot locate the dsh-ris-ide module), then the borrowed engine of
+      // an installed dsh-ris-ide, then the bundled SOCKS forwarder as last resort.
+      const risd = await probeRisd()
       // dsh-ris-ide is optional: without it the bundled SOCKS forwarder is the
       // tunnel (the same fallback `yds start` uses in prepareStart). Only the
-      // actions that genuinely need the borrowed engine (its rules, the panel)
-      // report the absence as an error.
-      const engineMissing = loaded.available !== true
+      // actions that genuinely need an engine (rules, the panel) report absence.
+      const engineMissing = loaded.available !== true && risd.usable !== true
       const engineNote = engineMissing
         ? `代理引擎不可用：${loaded.error}\n（未安装 dsh-ris-ide 时 yds 使用内置 socks 转发器；也可用 .env 的 proxy.engine=self 强制）`
-        : ''
+        : (risd.usable === true ? `代理引擎：risd daemon（pid ${risd.state?.pid ?? '?'}，端口 ${risd.state?.port ?? '?'}）` : '')
       if (engineMissing && action === 'status') {
         const targets = cfg.socks === null ? [] : forwarderTargets(cfg)
         const up = cfg.socks !== null && await isForwarderUp(cfg)
@@ -570,7 +632,10 @@ export async function run(argv, { cwd = process.cwd() } = {}) {
       if (action === 'status') {
         const st = await borrowedProxyStatus(cfg)
         const own = st.rules.filter((rule) => rule.source === 'yds')
-        return text(`引擎: ${loaded.path}\n运行: ${st.running ? `是（pid ${st.pid}）` : '否'}\n监听端口: ${st.listenPort ?? '(未知)'}\n`
+        // `loaded.path` is empty when this process cannot load dsh-ris-ide, which is
+        // exactly the risd-only case where the engine still has a name: risd:<port>
+        // (review D-P2-1).
+        return text(`引擎: ${st.path || loaded.path || '(未知)'}\n运行: ${st.running ? `是（pid ${st.pid ?? '?'}）` : '否'}\n监听端口: ${st.listenPort ?? '(未知)'}${Array.isArray(st.listenPorts) && st.listenPorts.length > 0 ? `（引擎监听 ${st.listenPorts.join(', ')}）` : ''}\n`
           + `yds 规则: ${own.length === 0 ? '(尚未生成，yds start 时自动写)' : own.map((rule) => `${rule.hosts}:${rule.ports}${rule.shadow ? ' [127.0.0.1 映射]' : ''}`).join(', ')}\n`
           + `其它规则: ${st.rules.length - own.length} 条（用户/IDE 自己的）`)
       }
@@ -609,12 +674,33 @@ export async function run(argv, { cwd = process.cwd() } = {}) {
           const applied = applyLaunchConfig(cfg)
           launchNote = `\nlaunch.json: ${applied.action}${applied.changed ? '（已写入 java 代理参数，YonCode/VS Code F5 启动的 java 也会走 SOCKS）' : ''}`
         }
-        return text(`代理引擎已就绪（pid ${result.pid ?? '?'}）：${(result.shadowPorts ?? []).length} 个 127.0.0.1 映射${launchNote}`)
+        // What the engine binds is not the same thing as the 127.0.0.1 mappings YMS
+        // needs: the daemon's shadows are same-port, while the adapted config points at
+        // dbForwardPort/redisForwardPort and is served by the bundled forwarder. So the
+        // message names the engine's listeners, and `proxy start` brings that forwarder
+        // up exactly like `yds start` does (review D-P2-4).
+        const listenPorts = Array.isArray(result.listenPorts) ? result.listenPorts : (result.shadowPorts ?? [])
+        const notes = [`代理引擎已就绪（pid ${result.pid ?? '?'}）：引擎监听 ${listenPorts.length} 个端口${listenPorts.length > 0 ? `（${listenPorts.join(', ')}）` : ''}`]
+        if (result.mode === 'risd' && cfg.socks !== null) {
+          if (await isForwarderUp(cfg)) {
+            notes.push('内置 socks 转发器已在运行（127.0.0.1 兜底映射）')
+          } else {
+            try {
+              const started = await startForwarder(cfg, targets)
+              notes.push(started.started === true
+                ? `内置 socks 转发器已启动（pid ${started.pid}）：${started.targets.join(', ')}`
+                : `内置 socks 转发器未启动：${started.reason ?? '(未知原因)'}`)
+            } catch (e) {
+              notes.push(`内置 socks 转发器未启动：${e.message}`)
+            }
+          }
+        }
+        return text(`${notes.join('\n')}${launchNote}`)
       }
       if (action === 'stop') {
         const r = engineMissing
           ? { ok: false, error: loaded.error }
-          : await stopBorrowedProxy(cfg)
+          : await stopBorrowedProxy(cfg, { log: (line) => process.stdout.write(`[yds] ${line}\n`) })
         // The bundled forwarder is a tunnel too: stopping the proxy has to take
         // it down whether or not dsh-ris-ide is installed.
         const fwd = cfg.socks === null
@@ -626,9 +712,13 @@ export async function run(argv, { cwd = process.cwd() } = {}) {
         const stopNote = stripped.changed
           ? '\nlaunch.json: 已移除 java 代理参数（-DsocksProxyHost/-DsocksProxyPort）'
           : ''
-        const engineLine = r.ok === true || r.stopped === true
-          ? '代理引擎已停止'
-          : engineMissing ? `代理引擎未启用（${loaded.error}）` : `代理引擎未停止：${r.error ?? r.reason ?? '未运行'}`
+        const engineLine = r.engine === 'kept'
+          ? (r.mode === 'risd'
+            ? `risd: 已释放租约，${withdrawnText(r.withdrawn)}（引擎保留；若 daemon 生命周期配置为「无租约即拆除代理」，会在约 300ms 后关闭）`
+            : `代理引擎保留（机器共享，IDE 可继续用）；${withdrawnText(r.withdrawn)}`)
+          : r.ok === true || r.stopped === true
+            ? '代理引擎已停止'
+            : engineMissing ? `代理引擎未启用（${loaded.error}）` : `代理引擎未停止：${r.error ?? r.reason ?? '未运行'}`
         const fwdLine = fwd.stopped === true ? `\n内置转发器已停止（pid ${fwd.pid}）` : ''
         return text(engineLine + fwdLine + stopNote)
       }
@@ -773,7 +863,7 @@ function splitJvmArgs(raw) {
   return out
 }
 
-const BOOLEAN_FLAGS = new Set(['--foreground', '--offline', '--keep-socks', '--no-socks', '--dry-run'])
+const BOOLEAN_FLAGS = new Set(['--foreground', '--offline', '--keep-socks', '--no-socks', '--dry-run', '--force'])
 
 function asFlagValue(v) {
   if (v === 'true' || v === '1' || v === 'yes') return true
@@ -960,7 +1050,7 @@ function usage() {
     '  build                  maven 部署 yms-home（首次含 kernel 下载）+ 拉配置',
     '  start [--jvm-args "…"] 后台启动 YMS（SOCKS 自动转发; 幂等）',
     '  start --foreground     前台启动（dsh-ris-ide startCommand 用）',
-    '  stop [--keep-socks]    停 YMS（默认连转发器一起停）',
+    '  stop [--keep-socks] [--force]  停 YMS（默认连转发器一起停；--force 表示无法确认 YMS 已停也继续撤规则）',
     '  status                 进程/端口/ready/配置状态',
     '  logs [--lines N]       tail 控制台与应用日志',
     '  ide [apply|remove|check] 维护 .dsh-ris-ide/config.json 的 yds 程序条目（+ .vscode/launch.json）',
@@ -989,6 +1079,43 @@ function fail(value) {
   return { text: value, exitCode: 1 }
 }
 
+/**
+ * Why `yds stop` must abort after stopYms, or '' when it may continue. A YMS with a
+ * live pid that could not be stopped (or whose identity is `unknown`) must keep its
+ * tunnel: withdrawing rules/forwarder/layers under it is the D-P1-2 bug. Exported so
+ * the guard is unit-testable without spawning a real YMS.
+ * @param {{stopped?: boolean, pid?: number|string, reason?: string}} yms
+ * @param {{force?: boolean}} [options]
+ * @returns {string} '' to continue, otherwise the abort message body
+ */
+export function stopAbortReason(yms, { force = false } = {}) {
+  if (force === true) return ''
+  if (yms?.stopped === true) return ''
+  const pid = Number(yms?.pid)
+  if (!Number.isInteger(pid) || pid <= 0) return ''
+  return `YMS 可能仍在运行（pid ${pid}）：${yms?.reason ?? '未能确认已停止'}\n`
+    + '为避免把仍在运行的服务抽掉隧道，已中止：yds 规则、内置转发器、系统层拦截都未改动。\n'
+    + '请先确认该进程（ps / 任务管理器）或修复权限后重试；确需强行撤掉规则时加 --force。'
+}
+
+/**
+ * How much of the yds rule set a stop actually removed. `yds stop` used to print
+ * "已撤掉 yds 规则" unconditionally, which was a lie both when it removed nothing and
+ * when it silently deleted another workspace's hosts (review D-P0-1). The table is one
+ * global list and a stop removes every yds row, so the text reports exactly that.
+ */
+export function withdrawnText(withdrawn) {
+  const rules = Number(withdrawn?.rules ?? 0)
+  const hosts = Number(withdrawn?.hosts ?? 0)
+  if (!Number.isFinite(rules) || !Number.isFinite(hosts) || (rules <= 0 && hosts <= 0)) {
+    return '共享规则表里没有 yds 规则（未改动）'
+  }
+  const parts = []
+  if (rules > 0) parts.push(`${rules} 条规则`)
+  if (hosts > 0) parts.push(`${hosts} 个 host`)
+  return `已从共享规则表移除 yds 的 ${parts.join('、')}（全局一张表，不区分 workspace）`
+}
+
 /**
  * Reject stray positionals/options instead of silently ignoring them: `yds browser fixx`
  * used to run nothing and still report success.