dsh-session-manager 0.7.1 → 0.7.3

package/lib/session-files.js

@@ -21,7 +21,7 @@ const MAX_HEADER_BYTES = 1024 * 1024;
 
 export function assertSessionId(id) {
   if (typeof id !== "string" || id.trim() === "" || id === "." || id === ".."
-    || /[\\/\x00-\x1f<>:"|?*]/.test(id) || /[. ]$/.test(id)) {
+    || /[\\/\x00-\x1f<>"|?*]/.test(id) || /[. ]$/.test(id)) {
     throw Object.assign(new Error("sessionId 必须是合法的会话标识，不能包含路径或特殊目录名"), { code: "bad-request" });
   }
   return id;
@@ -46,12 +46,56 @@ export function parseSessionGenerationFromFilename(filename) {
   return match[1] !== undefined ? Number(match[1]) : 0;
 }
 
-export function encodeSessionSegment(id) {
+/**
+ * Encode a session ID into its on-disk session directory name,
+ * matching DSH kernel's `encodeSegment` contract in
+ * packages/session/session-persistence-jsonl/src/format.ts:
+ * - "." -> "~002E"
+ * - ".." -> "~002E~002E"
+ * - Safe chars [A-Za-z0-9._-] (except "~") remain unchanged
+ * - Other characters (including ":", "~", non-ASCII) are escaped as ~XXXX (4-digit uppercase hex)
+ */
+export function encodeFsSessionSegment(raw) {
+  if (typeof raw !== "string" || raw.length === 0) {
+    throw new Error("cannot encode an empty path segment");
+  }
+  if (raw === ".") return "~002E";
+  if (raw === "..") return "~002E~002E";
+  let out = "";
+  for (let i = 0; i < raw.length; i++) {
+    const code = raw.charCodeAt(i);
+    const ch = String.fromCharCode(code);
+    if (ch !== "~" && /^[A-Za-z0-9._-]$/.test(ch)) {
+      out += ch;
+    } else {
+      out += "~" + code.toString(16).toUpperCase().padStart(4, "0");
+    }
+  }
+  return out;
+}
+
+/**
+ * Decode an on-disk session directory name back to raw session ID.
+ */
+export function decodeFsSessionSegment(encoded) {
+  if (typeof encoded !== "string" || encoded.length === 0) return encoded;
+  if (encoded === "~002E") return ".";
+  if (encoded === "~002E~002E") return "..";
+  return encoded.replace(/~([0-9A-Fa-f]{4})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)));
+}
+
+/**
+ * Encode a project directory path (cwd) into its on-disk project directory key,
+ * matching DSH kernel's `projectKey` contract:
+ * Wrapping "--...--" markers with path separators collapsed into "-".
+ */
+export function encodeProjectSegment(path) {
+  if (typeof path !== "string") return "--root--";
   let readable = "";
   let separatorRun = false;
-  for (let i = 0; i < id.length; i++) {
-    const ch = id[i];
-    const code = id.charCodeAt(i);
+  for (let i = 0; i < path.length; i++) {
+    const ch = path[i];
+    const code = path.charCodeAt(i);
     if (ch === "/" || ch === "\\" || ch === ":") {
       if (!separatorRun) readable += "-";
       separatorRun = true;
@@ -66,6 +110,28 @@ export function encodeSessionSegment(id) {
   return "--" + (readable.replace(/^-+/, "") || "root").slice(0, 251) + "--";
 }
 
+/**
+ * Legacy alias for `encodeProjectSegment`.
+ * @deprecated Use `encodeProjectSegment` for project cwd keys, or `encodeFsSessionSegment` for session directories.
+ */
+export const encodeSessionSegment = encodeProjectSegment;
+
+/**
+ * Return strictly verified candidate directory names for a given session ID.
+ * - Primary: DSH's true `encodeFsSessionSegment(id)` (e.g. "im~003Afeishu...")
+ * - Raw `id`: matches when raw ID equals encoded ID (common UUIDs), or if raw dir was used
+ * - Legacy projectKey format: transitional compatibility for `--id--` created by older plugin versions
+ */
+export function candidateSessionDirs(id) {
+  assertSessionId(id);
+  const primary = encodeFsSessionSegment(id);
+  const candidates = [primary];
+  if (id !== primary) candidates.push(id);
+  const legacyProject = encodeProjectSegment(id);
+  if (legacyProject !== primary && legacyProject !== id) candidates.push(legacyProject);
+  return candidates;
+}
+
 /** Only an actual <sessions>/<project>/<session> directory may be mutated.
  * The root itself may be configured through a symlink, but neither child may
  * be a symlink/junction. Check again immediately before destructive cleanup.
@@ -79,8 +145,9 @@ export async function assertSessionDirectory(root, directory, id, { allowMissing
   const target = resolve(directory);
   const rel = relative(base, target);
   const parts = rel.split(sep);
+  const validDirs = candidateSessionDirs(id);
   if (isAbsolute(rel) || parts.length !== 2 || parts.some(p => p === ".." || p === "." || p === "")
-    || ![id, encodeSessionSegment(id)].includes(parts[1])) {
+    || !validDirs.includes(parts[1])) {
     throw new Error("会话目录超出允许范围，已停止文件操作");
   }
   const canonicalRoot = await fs.realpath(base);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-session-manager",
-  "version": "0.7.1",
+  "version": "0.7.3",
   "description": "DeepSeek Harness session and workspace manager —— Workspaces: archive and visibility. Sessions: move, migrate presets, delete, favorite, review later, prioritize, tag, and annotate. Batch operations. | DSH 会话与工作区管理——工作区：归档与显示。会话：跨工作区移动、预设迁移、删除；收藏、待回看、优先级、标签、备注。批量操作。",
   "license": "MIT",
   "keywords": [