dsh-ris-yds 1.0.0 → 1.1.0

package/lib/ide-proxy.js

@@ -21,9 +21,12 @@ import { execFileSync } from 'node:child_process'
 import { yoncodeCandidates } from './yoncode.js'
 import { pathToFileURL } from 'node:url'
 import { spawn } from 'node:child_process'
+import { acquireLease, dropDeadLease, engineStatus, forgetLease, getView, probeRisd, putRules, readLease, releaseLease, rememberLease, startEngine } from './risd-peer.js'
+import { YDS_RULE_SOURCE, mergeYdsRules, programKeyOf, withdrawnBetween } from './rules.js'
 
 /** Marker `source` used for every rule this plugin owns. */
-export const YDS_RULE_SOURCE = 'yds'
+// `YDS_RULE_SOURCE` now lives in ./rules.js (shared with risd-peer).
+export { YDS_RULE_SOURCE, programKeyOf } from './rules.js'
 
 /** Where a dsh-ris-ide checkout/install may keep its proxy engine. */
 export function ideProxyCandidates(cfg) {
@@ -203,22 +206,22 @@ export function yoncodeProcesses(options = {}) {
         // turn into a ProcessName that matches programs we never meant to intercept.
         if (/^jdk/i.test(entry.name) !== true) continue
         if (existingFile(join(devkit, entry.name, 'bin', 'java.exe')) === false) continue
-        // Wildcard the version directory: YonCode upgrades its JDK in place and the
-        // rule must survive that.
-        // `jdk*\bin\*.exe` covers java.exe/javaw.exe and survives a JDK upgrade.
-        out.java = toProcessPattern(join(devkit, 'jdk*', 'bin', '*.exe'))
+        // The rule names the IMAGE (java.exe), not a pinned file: YonCode upgrades its
+        // JDK in place, and other java.exe processes on the box need the same tunnel.
+        out.java = 'java.exe'
         out.home = home
         break
       }
     }
     if (out.git === '' && existingFile(join(devkit, 'git', 'bin', 'git.exe')) === true) {
-      out.git = toProcessPattern(join(devkit, 'git', 'bin', 'git.exe'))
+      out.git = 'git.exe'
     }
   }
   if (out.git === '') {
     for (const candidate of Array.isArray(options.gitPaths) === true ? options.gitPaths : []) {
       if (typeof candidate !== 'string' || candidate === '' || existingFile(candidate) !== true) continue
-      out.git = toProcessPattern(candidate)
+      // Same idea as java: one git.exe row covers the devkit copy and every other install.
+      out.git = 'git.exe'
       break
     }
   }
@@ -271,7 +274,6 @@ export function yoncodeRules(cfg, options = {}) {
     homes: options.homes ?? yoncodeHomes(cfg),
     gitPaths: options.gitPaths ?? candidateGitPaths(options),
   })
-  const workspace = options.workspace ?? cfg?.workspace ?? ''
   const gitHost = options.gitHost ?? ''
   const rules = []
   if (withJava && found.java !== '' && hosts.length > 0) {
@@ -279,12 +281,14 @@ export function yoncodeRules(cfg, options = {}) {
       id: 'yds-yoncode-java',
       label: 'YonCode java',
       program: found.java,
+      // YonCode's own JDK/git are Windows executables: they belong to the Windows side
+      // even when this process runs inside WSL.
+      side: 'windows',
       hosts: hosts.join(','),
       ports: '*',
       enabled: true,
       shadow: false,
       source: YDS_RULE_SOURCE,
-      workspace,
     })
   }
   if (found.git !== '' && gitHost !== '') {
@@ -292,12 +296,12 @@ export function yoncodeRules(cfg, options = {}) {
       id: 'yds-yoncode-git',
       label: 'YonCode git',
       program: found.git,
+      side: 'windows',
       hosts: gitHost,
       ports: '*',
       enabled: true,
       shadow: false,
       source: YDS_RULE_SOURCE,
-      workspace,
     })
   }
   return rules
@@ -328,6 +332,7 @@ export function shadowTargetsFromTargets(targets) {
   return out
 }
 
+
 /**
  * Rules this project contributes to the machine-wide table.
  *
@@ -376,7 +381,12 @@ export function privateSegmentsOf(targets, extraHosts = []) {
 // (the YMS JVM gets -DsocksProxyHost from `yds yoncode patch`, and WinDivert resets the
 // Oracle TNS handshake). Both entry points must agree, or a direct helper call silently
 // turns java interception back on.
-export function proxyRulesFromTargets(targets, workspace = '', { gitHost = '', java = false, extraHosts = [] } = {}) {
+//
+// Two SIDES, not two workspaces: ProxyBridge matches `java.exe`/`git.exe` on Windows and
+// `java`/`git` on WSL/Linux. Both rule sets are generated in one go, so the panel's
+// global table shows the WSL-side rows that used to be missing (the WSL JVM was never
+// intercepted). On Windows only the `.exe` rows make sense and are generated.
+export function proxyRulesFromTargets(targets, { gitHost = '', java = false, extraHosts = [], platform = process.platform } = {}) {
   const rules = []
   const segments = new Set()
   for (const target of Array.isArray(targets) ? targets : []) {
@@ -393,33 +403,47 @@ export function proxyRulesFromTargets(targets, workspace = '', { gitHost = '', j
     if (isPrivateIpv4(value) !== true) continue
     segments.add(value.split('.').slice(0, 3).join('.'))
   }
-  // One rule per internal segment and ANY port: the backend also talks to hosts the
-  // bootstrap never lists (license, ES, kafka), so a port list would go stale.
-  for (const segment of java ? Array.from(segments).sort() : []) {
-    rules.push({
-      id: `yds-java-${segment.replace(/[^a-zA-Z0-9]+/g, '-').replace(/^-+|-+$/g, '')}`,
-      program: 'java',
-      hosts: `${segment}.*`,
-      ports: '*',
-      enabled: true,
-      shadow: false,
-      source: YDS_RULE_SOURCE,
-      workspace,
-    })
-  }
-  // git reaches its remote through the same tunnel; `git config http.<host>.proxy`
-  // stays as the belt for terminals that do not go through ProxyBridge.
-  if (gitHost !== '') {
-    rules.push({
-      id: 'yds-git',
-      program: 'git',
-      hosts: gitHost,
-      ports: '*',
-      enabled: true,
-      shadow: false,
-      source: YDS_RULE_SOURCE,
-      workspace,
-    })
+  // ONE java rule per side for every internal segment, hosts comma-separated: the
+  // backend also talks to hosts the bootstrap never lists (license, ES, kafka), so a
+  // port list would go stale — and one row per /24 only made the table longer.
+  const javaHosts = java ? Array.from(segments).sort().map((segment) => `${segment}.*`) : []
+  const sides = platform === 'win32'
+    ? [{ side: 'windows', java: 'java.exe', git: 'git.exe' }]
+    : [
+        { side: 'windows', java: 'java.exe', git: 'git.exe' },
+        { side: 'local', java: 'java', git: 'git' },
+      ]
+  for (const entry of sides) {
+    const local = entry.side === 'local'
+    if (javaHosts.length > 0) {
+      rules.push({
+        id: local ? 'yds-java-local' : 'yds-java',
+        // The IMAGE name, not a file path: one row covers every java.exe on the box
+        // (YonCode's bundled JDK, the IDE's own, a terminal's), and a JDK upgrade
+        // never invalidates it. The local side matches the WSL/Linux process name.
+        program: entry.java,
+        side: entry.side,
+        hosts: javaHosts.join(','),
+        ports: '*',
+        enabled: true,
+        shadow: false,
+        source: YDS_RULE_SOURCE,
+      })
+    }
+    // git reaches its remote through the same tunnel; `git config http.<host>.proxy`
+    // stays as the belt for terminals that do not go through ProxyBridge.
+    if (gitHost !== '') {
+      rules.push({
+        id: local ? 'yds-git-local' : 'yds-git',
+        program: entry.git,
+        side: entry.side,
+        hosts: gitHost,
+        ports: '*',
+        enabled: true,
+        shadow: false,
+        source: YDS_RULE_SOURCE,
+      })
+    }
   }
   return rules
 }
@@ -435,41 +459,53 @@ export function gitHostOf(cfg) {
  * Merge the YDS-owned rules into the IDE's proxy config and write it back.
  * @returns {{config: object, rules: object[]}} the merged config.
  */
-export function syncProxyConfig(cfg, targets, { log, mapping = true, java = cfg?.proxyJavaRules === true } = {}) {
-  const loaded = cfg.__ideProxy
-  if (loaded === undefined || loaded === null || loaded.available !== true) throw new Error('代理引擎未加载')
-  const mod = loaded.mod
-  const rules = [
-    ...proxyRulesFromTargets(targets, cfg.workspace ?? '', { gitHost: gitHostOf(cfg), java, extraHosts: extraHostsOf(cfg) }),
-    // YonCode runs its own JDK/git from outside the project; without these rows the
-    // IDE's java would only be covered by the generic `java` pattern.
+/** The rules this project owns, in one deterministic order (generic rows first). */
+export function ydsRulesFor(cfg, targets, { java = cfg?.proxyJavaRules === true, platform = process.platform, log } = {}) {
+  return mergeYdsRules([], [
+    ...proxyRulesFromTargets(targets, { gitHost: gitHostOf(cfg), java, extraHosts: extraHostsOf(cfg), platform }),
+    // YonCode runs its own JDK/git from outside the project. These rows are kept as a
+    // fallback for invocations where the generic rows above are absent; when they are
+    // present the side+program key is already taken and the duplicate is merged.
     ...yoncodeRules(cfg, {
       gitHost: gitHostOf(cfg),
-      workspace: cfg.workspace ?? '',
       java,
       hosts: privateSegmentsOf(targets, extraHostsOf(cfg)),
     }),
-  ]
+  ], { log })
+}
+
+export function syncProxyConfig(cfg, targets, { log, mapping = true, java = cfg?.proxyJavaRules === true, platform = process.platform } = {}) {
+  const loaded = cfg.__ideProxy
+  if (loaded === undefined || loaded === null || loaded.available !== true) throw new Error('代理引擎未加载')
+  const mod = loaded.mod
+  // One read, one write: reading the shared table twice around the merge opened a
+  // lost-update window between them (review D-P2).
+  const stored = mod.readProxyConfig(cfg.workspace)
+  // The table is machine-wide AND global, and the daemon saves it wholesale
+  // (`POST /v1/proxy` is a whole-table PUT). So the complete table is built here:
+  // every non-yds row kept, every yds row replaced by this run's set.
+  const fresh = ydsRulesFor(cfg, targets, { java, platform, log })
+  const rules = mergeYdsRules(stored?.rules, fresh, { log })
   // Bound only while the system layer is unavailable; in interception mode this is
   // empty, so nothing is bound on loopback at all.
   const shadows = mapping === false ? [] : shadowTargetsFromTargets(targets)
-  const stored = mod.readProxyConfig(cfg.workspace)
   const upstream = cfg.socks ?? null
+  // The borrowed tier goes through `mergeConfigs` with `replaceAllRules`: the IDE
+  // keeps owning socks/listenPort/shadows, while the rules are replaced wholesale by
+  // the complete table above. `replaceRulesFrom` (the old per-source patch) is retired.
   const merged = mod.mergeConfigs(stored, {
     socks: upstream === null ? { host: '', port: 0 } : { host: upstream.host, port: upstream.port },
-    listenPort: cfg.proxyListenPort ?? stored.listenPort,
-    // Replacing wholesale is the whole point: rules this plugin wrote last run
-    // must disappear when the endpoint list shrinks, while user rows survive.
-    replaceRulesFrom: YDS_RULE_SOURCE,
+    listenPort: cfg.proxyListenPort ?? stored?.listenPort,
     shadows,
-    // The config file is machine-wide now: only this workspace's yds rows are
-    // replaced, other workspaces keep theirs.
-    workspace: cfg.workspace ?? '',
+    replaceAllRules: true,
     rules,
   })
-  mod.writeProxyConfig(cfg.workspace, merged)
-  log?.(`代理规则已同步：${rules.length} 条（source=${YDS_RULE_SOURCE}）`)
-  return { config: merged, rules }
+  // Pin the table we computed even if an older dsh-ris-ide build ignores the flag: a
+  // stale yds row left behind here would resurface as an intercepted process.
+  const saved = mod.writeProxyConfig(cfg.workspace, { ...merged, rules })
+  const config = saved
+  log?.(`代理规则已同步：${fresh.length} 条 yds 规则（共享表共 ${rules.length} 条）`)
+  return { config: saved, rules, withdrawn: withdrawnBetween(stored?.rules, rules) }
 }
 
 /** Run one `git config --global` mutation; a missing git is a reported no-op. */
@@ -590,14 +626,36 @@ export async function startBorrowedRedirector(cfg, { log, sides } = {}) {
  * @param {{log?: Function, keepGit?: boolean}} [options] - logger / skip git undo.
  * @returns {Promise<{redirector: object, git: object}>} per-layer outcome.
  */
-export async function stopBorrowedSideEffects(cfg, { log, keepGit = false } = {}) {
-  const loaded = await loadIdeRedirector(cfg)
+export async function stopBorrowedSideEffects(cfg, { log, keepGit = false, daemonReload = null } = {}) {
   let redirector = { stopped: false, reason: '未找到 dsh-ris-ide 的 ProxyBridge 适配器' }
-  if (loaded.available === true && typeof loaded.mod.stopRedirector === 'function') {
-    redirector = await loaded.mod.stopRedirector()
-    if (redirector.stopped === true) log?.(`系统层拦截已停止（pid ${redirector.pid ?? '?'}）`)
-    else if (typeof redirector.reason === 'string' && redirector.reason !== '' && redirector.reason !== '未在运行') {
-      log?.(`系统层拦截未停止：${redirector.reason}`)
+  if (daemonReload !== null) {
+    // risd tier: POST /v1/proxy already reloaded (or reported why it could not
+    // reload) the machine bridge. Reloading it here too would be a second writer
+    // that is not serialised with the daemon (review D-P2-10), so render its note.
+    redirector = {
+      stopped: false,
+      viaDaemon: true,
+      reason: daemonReload === ''
+        ? '由 risd daemon 管理（规则已保存；daemon 未要求重启桥接）'
+        : `由 risd daemon 管理：${daemonReload}`,
+    }
+    log?.(`系统层拦截：${redirector.reason}`)
+  } else {
+    const loaded = await loadIdeRedirector(cfg)
+    // The bridge is machine-wide: an IDE window may still need it. Reload it with the
+    // profile that no longer contains our rules instead of stopping it; stopping is
+    // what used to kill the IDE's interception on `yds stop`.
+    if (loaded.available === true && typeof loaded.mod.reloadRedirectorsWithProfile === 'function') {
+      const status = typeof loaded.mod.redirectorStatus === 'function' ? loaded.mod.redirectorStatus() : { running: false }
+      if (status.running !== true) redirector = { stopped: false, reason: '未在运行' }
+      else {
+        const reload = await loaded.mod.reloadRedirectorsWithProfile(cfg.workspace, { sides: ['windows', 'local'] })
+        const reloaded = Array.isArray(reload.reloaded) ? reload.reloaded.length : 0
+        redirector = reloaded > 0
+          ? { stopped: false, reloaded: true, reason: '已按剩余规则重载（引擎与拦截保留）' }
+          : { stopped: false, reason: '未能重载，系统层拦截仍按旧规则运行（需手动重启桥接）' }
+        log?.(`系统层拦截：${redirector.reason}`)
+      }
     }
   }
   let git = { ok: true, key: '' }
@@ -616,11 +674,47 @@ export async function stopBorrowedSideEffects(cfg, { log, keepGit = false } = {}
  * @returns {Promise<{mode: string, rules?: object[]}>} sync outcome.
  */
 export async function syncBorrowedRules(cfg, targets, { log } = {}) {
+  // Preferred tier: a running risd owns the table, the engine and the bridge.
+  const risd = await probeRisd()
+  if (risd.usable === true) {
+    const rules = ydsRulesFor(cfg, targets)
+    // No `shadows` argument on purpose: the daemon's write contract only takes
+    // socks/listenPort/rules (incoming.shadows is dropped), so passing `[]` here
+    // would look like "clear the mappings" while doing nothing (review D-P2-3).
+    // 127.0.0.1 mappings of the risd engine are owned by the daemon / IDE side.
+    const saved = await putRules(cfg.workspace ?? '', rules, { gitHost: gitHostOf(cfg), log })
+    if (saved.ok !== true) throw new Error(`代理规则写入 risd 失败：${saved.error}`)
+    log?.(`代理规则已写入 risd（${rules.length} 条，source=${YDS_RULE_SOURCE}）`)
+    return { mode: 'risd', rules, reloadNote: saved.reloadNote ?? '' }
+  }
   const loaded = await loadIdeProxy(cfg)
   cfg.__ideProxy = loaded
   if (!loaded.available) return { mode: 'unavailable' }
   const { rules } = syncProxyConfig(cfg, targets, { log, mapping: false })
   log?.('代理规则已写入（系统层拦截模式，无 127.0.0.1 映射）')
+  // A running bridge parsed its profile once at start, so rewriting the table is not
+  // enough: restart it with the new rules — or, if that fails, stop it. Leaving the
+  // old profile running is exactly the "old proxy cannot be cancelled" failure.
+  const redirector = await loadIdeRedirector(cfg)
+  if (redirector.available === true && typeof redirector.mod.reloadRedirectorsWithProfile === 'function') {
+    const status = typeof redirector.mod.redirectorStatus === 'function' ? redirector.mod.redirectorStatus() : { running: false }
+    if (status.running === true) {
+      const reload = await redirector.mod.reloadRedirectorsWithProfile(cfg.workspace, { sides: ['windows', 'local'] })
+      const reloaded = Array.isArray(reload.reloaded) ? reload.reloaded.length : 0
+      if (reloaded > 0) {
+        log?.('系统层拦截已按新规则重启')
+        return { mode: 'ide', rules, reloadNote: '系统层拦截已按新规则自动重启' }
+      }
+      const stopped = typeof redirector.mod.stopRedirector === 'function'
+        ? await redirector.mod.stopRedirector()
+        : { stopped: false }
+      const note = stopped.stopped === true
+        ? '系统层拦截未能重载，已停止（避免继续按旧规则代理）'
+        : '系统层拦截未能重载，旧规则可能仍在生效（请重启桥接）'
+      log?.(note)
+      return { mode: 'ide', rules, reloadNote: note }
+    }
+  }
   return { mode: 'ide', rules }
 }
 
@@ -633,6 +727,21 @@ export async function ensureBorrowedProxy(cfg, targets, { log, mapping = true }
     return { mode: 'none' }
   }
   if (cfg.proxyEngine === 'self') { log?.('代理引擎：按 .env 配置使用内置转发器（proxy.engine=self）'); return { mode: 'unavailable', error: 'disabled by proxy.engine=self' } }
+  // Preferred tier: the daemon owns the engine, so yds writes rules + a lease and
+  // never starts a second engine (two owners would fight for the same shadows).
+  const risd = await probeRisd()
+  if (risd.usable === true) {
+    const rules = ydsRulesFor(cfg, targets)
+    const saved = await putRules(cfg.workspace ?? '', rules, { gitHost: gitHostOf(cfg), log })
+    if (saved.ok !== true) return { mode: 'risd', ok: false, error: `代理规则写入 risd 失败：${saved.error}` }
+    const started = await startEngine(cfg.workspace ?? '')
+    if (started.ok !== true) return { mode: 'risd', ok: false, error: `risd 启动引擎失败：${started.error}` }
+    const status = await engineStatus(cfg.workspace ?? '')
+    const pid = status.engine?.pid ?? started.result?.pid ?? null
+    const ports = Array.isArray(status.engine?.listen) ? status.engine.listen.map((item) => item.port).filter((port) => Number.isInteger(port)) : []
+    log?.(`代理引擎：risd daemon 运行中（pid ${pid ?? '?'}）${ports.length > 0 ? `，监听 ${ports.join(', ')}` : ''}`)
+    return { mode: 'risd', ok: true, pid, rules, shadowPorts: ports, listenPorts: ports }
+  }
   const loaded = await loadIdeProxy(cfg)
   cfg.__ideProxy = loaded
   if (!loaded.available) {
@@ -646,7 +755,12 @@ export async function ensureBorrowedProxy(cfg, targets, { log, mapping = true }
   const before = mod.readProxyConfig(cfg.workspace)
   const { config, rules } = syncProxyConfig(cfg, targets, { log, mapping })
   const running = mod.proxyPid(cfg.workspace) !== null
-  // A running engine holds the OLD rules; only a restart applies the new ones.
+  // The engine watches `proxy.json` and reloads it (dsh-ris-ide/lib/proxy.js:
+  // watchFile -> reload -> applyShadows), so an edited table reaches a running engine
+  // within about a second. The restart below is belt-and-braces: it guarantees the
+  // new shadow listeners are bound BEFORE the process we are about to launch dials
+  // 127.0.0.1; it is not needed because "a running engine holds the old rules" — that
+  // model is obsolete (review D-P2-9).
   const changed = JSON.stringify(before.rules) !== JSON.stringify(config.rules)
   let restarted = false
   if (running && changed) {
@@ -666,17 +780,127 @@ export async function ensureBorrowedProxy(cfg, targets, { log, mapping = true }
   return { mode: 'ide', ok: true, path: loaded.path, pid: started.pid ?? null, rules, shadowPorts, restarted }
 }
 
-/** Stop the borrowed engine (no-op when dsh-ris-ide is not installed). */
-export async function stopBorrowedProxy(cfg) {
+/**
+ * Take a daemon lease owned by a long-lived pid (the YMS process, or the
+ * foreground CLI) so the engine outlives this short `yds` process.
+ */
+export async function holdBorrowedLease(cfg, { ownerPid = process.pid, log } = {}) {
+  const risd = await probeRisd()
+  if (risd.usable !== true) return { ok: false, reason: risd.reason }
+  // A previous YMS that was killed with -9 leaves a record whose pid is gone; the
+  // daemon only reaps by pid, so drop our stale record before taking a fresh one
+  // (review D-P2-6).
+  if (dropDeadLease(cfg.workspace ?? '') === true) log?.('已清理该 workspace 的死租约记录')
+  const lease = await acquireLease({ cwd: cfg.workspace ?? '', state: risd.state, ownerPid })
+  if (lease.ok !== true) {
+    log?.(`risd 租约未登记：${lease.error}`)
+    return { ok: false, error: lease.error }
+  }
+  rememberLease(cfg.workspace ?? '', { id: lease.id, ownerPid, port: risd.state.port })
+  log?.(`risd 租约已登记（owner pid ${ownerPid}）`)
+  return { ok: true, id: lease.id }
+}
+
+/** Drop one specific daemon lease (the owner pid changed, e.g. CLI → YMS). */
+export async function dropBorrowedLease(id, { log } = {}) {
+  if (typeof id !== 'string' || id === '') return { ok: true, released: false }
+  const risd = await probeRisd()
+  if (risd.usable !== true) return { ok: false, reason: risd.reason }
+  const released = await releaseLease(id, { state: risd.state })
+  if (released.ok === true) log?.('risd 租约已移交（旧 owner 释放）')
+  return released
+}
+
+/** Release the lease recorded for this workspace; idempotent when none exists. */
+export async function releaseBorrowedLease(cfg, { log } = {}) {
+  const entry = readLease(cfg.workspace ?? '')
+  if (entry === null) return { ok: true, released: false }
+  const risd = await probeRisd()
+  if (risd.usable !== true) {
+    // No daemon: nothing holds the lease any more, so the local record is stale.
+    forgetLease(cfg.workspace ?? '')
+    return { ok: true, released: false, reason: 'risd 未运行' }
+  }
+  const released = await releaseLease(entry.id, { state: risd.state })
+  if (released.ok !== true) {
+    // Keep the record so a retry (`yds stop` again) can release it instead of
+    // waiting for the daemon's 3 s sweep to notice the dead owner (review D-P2-6).
+    return { ok: false, released: false, reason: released.error || '释放租约失败' }
+  }
+  forgetLease(cfg.workspace ?? '')
+  log?.(`risd 租约已释放（${entry.id}）`)
+  return { ok: true, released: true }
+}
+
+/**
+ * Withdraw this plugin's share of the tunnel — and leave the ENGINE running.
+ *
+ * The engine is machine-wide: an IDE window (or another dsh) may still be using it.
+ * So `yds stop` releases the risd lease, removes every yds rule from the global table
+ * and lets the machine-level layers settle; killing the engine here is what used to
+ * interrupt the IDE's tunnel (the old "yds stop kills the shared engine" defect).
+ */
+export async function stopBorrowedProxy(cfg, { log } = {}) {
+  const workspace = cfg.workspace ?? ''
+  const risd = await probeRisd()
+  if (risd.usable === true) {
+    await releaseBorrowedLease(cfg)
+    // `[]` removes EVERY yds row: the table is global and yds owns exactly the rows
+    // it injected, so a stop must not leave its rows behind — and there is no
+    // per-workspace share to preserve any more (global-table contract).
+    // The daemon reloads the bridge inside POST /v1/proxy; its note is what
+    // `yds stop` renders instead of reloading the bridge locally a second time
+    // (review D-P2-10).
+    const saved = await putRules(workspace, [], { gitHost: '', log })
+    return {
+      ok: saved.ok === true,
+      stopped: false,
+      engine: 'kept',
+      mode: 'risd',
+      withdrawn: saved.withdrawn ?? { rules: 0, hosts: 0 },
+      reloadNote: saved.reloadNote ?? '',
+      error: saved.ok === true ? '' : saved.error,
+    }
+  }
   const loaded = cfg.__ideProxy ?? await loadIdeProxy(cfg)
   if (loaded.available !== true) return { ok: false, error: loaded.error }
-  return loaded.mod.stopProxy(cfg.workspace)
+  // Borrowed-engine tier: remove every yds row and keep the engine (and the user's
+  // own rows) for the IDE. Same blast radius as the risd tier (review D-P1-3/P1-8).
+  const mod = loaded.mod
+  const stored = mod.readProxyConfig(workspace)
+  const rules = mergeYdsRules(stored?.rules, [], { log })
+  const merged = typeof mod.mergeConfigs === 'function'
+    ? mod.mergeConfigs(stored, { replaceAllRules: true, rules })
+    : stored
+  mod.writeProxyConfig(workspace, { ...(merged !== null && typeof merged === 'object' ? merged : {}), rules })
+  return { ok: true, stopped: false, engine: 'kept', mode: 'ide', withdrawn: withdrawnBetween(stored?.rules, rules) }
 }
 
-/** Engine status for `yds status` / `yds proxy status`. */
+/** Engine status for `yds status` / `yds proxy status`, whichever tier owns it. */
 export async function borrowedProxyStatus(cfg) {
+  const risd = await probeRisd()
+  if (risd.usable === true) {
+    const view = await getView(cfg.workspace ?? '', { state: risd.state })
+    const engine = await engineStatus(cfg.workspace ?? '', { state: risd.state })
+    const payload = view.view ?? {}
+    const info = engine.engine ?? {}
+    const listen = Array.isArray(info.listen) ? info.listen : []
+    const listenPorts = listen.map((item) => item.port).filter((port) => Number.isInteger(port))
+    return {
+      available: true,
+      mode: 'risd',
+      path: `risd:${risd.state.port}`,
+      // /v1/engine is the authoritative process view (running/pid/listen); the rule
+      // table's numbers describe what was SAVED and can lag the engine (review D-P2-5).
+      running: info.running === true || (info.running === undefined && payload.running === true),
+      pid: info.pid ?? payload.pid ?? null,
+      listenPort: payload.listenPort ?? listenPorts[0] ?? null,
+      listenPorts,
+      rules: Array.isArray(payload.rules) ? payload.rules : [],
+    }
+  }
   const loaded = cfg.__ideProxy ?? await loadIdeProxy(cfg)
   if (loaded.available !== true) return { available: false, error: loaded.error }
   const status = await loaded.mod.proxyStatus(cfg.workspace)
-  return { available: true, path: loaded.path, running: status.running === true, pid: status.pid ?? null, listenPort: status.config?.listenPort ?? null, rules: status.config?.rules ?? [] }
+  return { available: true, mode: 'ide', path: loaded.path, running: status.running === true, pid: status.pid ?? null, listenPort: status.config?.listenPort ?? null, rules: status.config?.rules ?? [] }
 }

package/lib/ide.js

@@ -271,10 +271,17 @@ export function belongsToYdsProject(cfg, row) {
  * @param {object[]} programs - config rows.
  * @returns {{programs: object[], renamed: object[], skipped: object[]}} the outcome.
  */
+/** A log/pid name segment: the same alphabet ris-ide's discovery uses. */
+export function sanitizeLogName(value) {
+  const cleaned = String(value).replace(/[^A-Za-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 80)
+  return cleaned === '' ? 'program' : cleaned
+}
+
 export function repairFrontendNames(cfg, programs) {
   const renamed = []
   const skipped = []
-  if (!Array.isArray(programs)) return { programs, renamed, skipped }
+  const renamedLogs = []
+  if (!Array.isArray(programs)) return { programs, renamed, skipped, renamedLogs }
   const rows = programs.map((row) => (row === null || typeof row !== 'object' ? row : { ...row }))
   // Names of rows that will not be renamed stay reserved, so we never create a clash.
   const taken = new Set()
@@ -293,7 +300,25 @@ export function repairFrontendNames(cfg, programs) {
     row.name = name
     taken.add(name)
   }
-  return { programs: rows, renamed, skipped }
+  // A frontend row's logName is its own name (the panel used to derive "<project>-<name>",
+  // which collided with the backend row of the same yds module). Kept unique because
+  // logName keys the log file and the pidfile.
+  const usedLogs = new Set()
+  for (const row of rows) {
+    if (row === null || typeof row !== 'object') continue
+    const dir = typeof row.dir === 'string' && row.dir !== '' ? resolve(cfg.workspace, row.dir) : ''
+    const inProject = dir !== '' && ydsProjectRootOf(cfg.workspace, dir) !== ''
+    if (inProject !== true || row.kind !== 'frontend') {
+      if (typeof row.logName === 'string' && row.logName !== '') usedLogs.add(row.logName)
+      continue
+    }
+    let logName = sanitizeLogName(row.name)
+    for (let n = 2; usedLogs.has(logName); n += 1) logName = sanitizeLogName(`${row.name}-${n}`)
+    if (row.logName !== logName) renamedLogs.push({ name: row.name, from: row.logName, to: logName })
+    row.logName = logName
+    usedLogs.add(logName)
+  }
+  return { programs: rows, renamed, skipped, renamedLogs }
 }
 
 /**
@@ -312,7 +337,7 @@ export function repairFrontendNames(cfg, programs) {
  */
 export function repairYdsRows(cfg, programs) {
   const repaired = repairFrontendNames(cfg, programs)
-  const { renamed, skipped } = repaired
+  const { renamed, skipped, renamedLogs } = repaired
   const disabled = []
   const cleaned = []
   const rows = repaired.programs.map((row) => {
@@ -329,7 +354,7 @@ export function repairYdsRows(cfg, programs) {
     }
     return row
   })
-  return { programs: rows, renamed, skipped, disabled, cleaned }
+  return { programs: rows, renamed, skipped, renamedLogs, disabled, cleaned }
 }
 
 /**
@@ -382,7 +407,8 @@ export function applyIdeConfig(cfg) {
   const action = initialized.created ? 'created' : (idx >= 0 ? 'updated' : 'added')
   return {
     changed: true, action, initialized: initialized.created, path: current.path, entry,
-    renamed: repaired.renamed, skipped: repaired.skipped, disabled: repaired.disabled, cleaned: repaired.cleaned,
+    renamed: repaired.renamed, skipped: repaired.skipped, renamedLogs: repaired.renamedLogs,
+    disabled: repaired.disabled, cleaned: repaired.cleaned,
   }
 }