dsh-unlag 1.9.0 → 1.9.2

package/README.md

@@ -52,6 +52,10 @@ dsh plugin install dsh-unlag
 - 独立进程和进程级的东西：宠物窗口自己的配置、DSH 自身升级、原生依赖变化。
 - 万一新页面还是起不来：App 会进入错误恢复（退出，或请你停用第三方插件）。本插件不替你选，也不会自己重启或退出 App。
 
+## 与官方约定的差异
+
+官方的插件资源路由对未知修订返回 404。本插件对旧页面记着的旧修订返回当前内容：桌面版在窗口启动时固定了启动清单，页面按旧修订请求脚本是常态，返回 404 会让新页面起不来、App 直接退出。这是本插件的兼容措施，不是官方行为；不需要时可以整个关掉（设置里两行都关）。
+
 ## 排错
 
 - 日志：`~/.dsh/unlag-reload.log`，换代码／跳过／被拦各一行，含原因。

package/client.js

@@ -6,8 +6,8 @@ window.__ModuleLoader__.load({
 
     const zh = /^zh/i.test(navigator.language || '');
     const COPY = zh
-      ? { label: '解除卡顿', hint: '卡顿时用：换掉插件代码并重建界面；运行中的任务、排队的消息保留', blocked: '暂时无法重建界面，稍后再试', unsaved: '有未保存的改动，先保存再重试', dialog: '先关闭打开的窗口再重载', queued: '更新已排队，稍后再按一次', applying: '还在应用这次更新，稍后再按一次', restart: '这次改动要重新打开应用才会生效', failed: '插件更新没完成，稍后再按一次' } // ui-copy-ignore
-      : { label: 'Unlag', hint: 'For a sluggish interface: replaces plugin code and rebuilds the page; running turns and queued messages are kept', blocked: 'Cannot rebuild the page right now; try again', unsaved: 'Unsaved changes; save them, then retry', dialog: 'Close the open window first', queued: 'Update queued; press again shortly', applying: 'Still applying this update; press again shortly', restart: 'This change needs the app reopened before it can apply', failed: 'The plugin update did not finish; press again later' };
+      ? { label: '解除卡顿', hint: '卡顿时用：换掉插件代码并重建界面；运行中的任务、排队的消息保留', blocked: '暂时无法重建界面，稍后再试', unsaved: '有未保存的改动，先保存再重试', dialog: '先关闭打开的窗口再重载', queued: '更新已排队，稍后再按一次', applying: '还在应用这次更新，稍后再按一次', off: '两个开关都关着，先在设置里打开一个', replaced: '插件代码已更新，页面保持不动', done: '插件代码已是最新', restart: '这次改动要重新打开应用才会生效', failed: '插件更新没完成，稍后再按一次' } // ui-copy-ignore
+      : { label: 'Unlag', hint: 'For a sluggish interface: replaces plugin code and rebuilds the page; running turns and queued messages are kept', blocked: 'Cannot rebuild the page right now; try again', unsaved: 'Unsaved changes; save them, then retry', dialog: 'Close the open window first', queued: 'Update queued; press again shortly', applying: 'Still applying this update; press again shortly', off: 'Both switches are off; turn one on in settings', replaced: 'Plugin code updated; the page stayed as it is', done: 'Plugin code is already up to date', restart: 'This change needs the app reopened before it can apply', failed: 'The plugin update did not finish; press again later' };
 
     /**
      * Why the interface was left as it is, in words a person can act on. The checks below record
@@ -27,11 +27,20 @@ window.__ModuleLoader__.load({
       return false;
     }
 
-    /** The notice for one copy key, naming the reason when a readiness check stopped the press. */
-    function noticeFor(key) {
+    /**
+     * The notice for one copy key, naming the reason when a readiness check stopped the press.
+     * A press that already replaced the plugins did its work even when the page was left alone, and
+     * is said so: the update is live either way, and only the new document was skipped.
+     */
+    function noticeFor(key, applied = false) {
+      // The plugin half already went live; whatever held the page is said on top of that.
+      if (applied && key !== 'blocked') {
+        return zh ? `插件已更新，页面未重开：${COPY[key]}。` : `Plugins updated; the page stayed: ${COPY[key]}.`;
+      }
       if (key !== 'blocked' || holdReason === null) return COPY[key];
       const why = REASONS[holdReason] ?? REASONS.list;
-      return zh ? `暂时无法重建：${why}。稍后再点一次。` : `Cannot rebuild yet: ${why}. Press again shortly.`;
+      if (applied) return zh ? `插件已更新，页面未重开：${why}。` : `Plugins updated; the page stayed: ${why}.`;
+      return zh ? `暂时无法重建：${why}。` : `Cannot rebuild yet: ${why}.`;
     }
 
     // Desktop shell only: the macOS and Windows desktop build owns the page and the running
@@ -46,8 +55,43 @@ window.__ModuleLoader__.load({
      */
     const PREPARE_EVENT = 'dsh-unlag:before';
 
-    /** Set while a rebuild is pending, so a repeated click cannot start a second one. */
+    /** What this document remembers about its last press, so two presses cannot overlap. */
     const STAMP_KEY = 'dsh-unlag:at'; // ui-copy-ignore
+    let pressInFlight = false;
+
+    /**
+     * Session storage is denied in some profiles and full in others. A press must not be lost to
+     * that: the stamp only paces repeated presses, so an unreadable stamp reads as "no press yet".
+     */
+    function stampRead() {
+      try {
+        const at = Number(window.sessionStorage.getItem(STAMP_KEY) ?? 0);
+        return Number.isFinite(at) ? at : 0;
+      } catch {
+        return 0;
+      }
+    }
+
+    function stampWrite() {
+      try {
+        window.sessionStorage.setItem(STAMP_KEY, String(Date.now()));
+      } catch {
+        // Pacing is the only thing this stamp feeds; a denied store costs nothing else.
+      }
+    }
+
+    /**
+     * One bound for every call a press makes: a stalled answer ends the press with a notice
+     * instead of holding the button until the page is reloaded by hand.
+     */
+    const HOST_TIMEOUT_MS = 12000; // ui-copy-ignore
+    function withTimeout(promise, ms = HOST_TIMEOUT_MS) {
+      let id = null;
+      const timer = new Promise((_resolve, reject) => {
+        id = setTimeout(() => reject(new Error('timeout')), ms); // ui-copy-ignore
+      });
+      return Promise.race([promise, timer]).finally(() => clearTimeout(id));
+    }
 
     /**
      * What a press does is decided by the plugin's settings row, read from the running app, so
@@ -58,9 +102,9 @@ window.__ModuleLoader__.load({
 
     async function readSettings() {
       try {
-        const response = await fetch(`${HOST_BASE}/state`, { cache: 'no-store', credentials: 'same-origin' });
+        const response = await withTimeout(fetch(`${HOST_BASE}/state`, { cache: 'no-store', credentials: 'same-origin' }));
         if (!response.ok) return null;
-        const data = await response.json();
+        const data = await withTimeout(response.json());
         if (data === null || typeof data !== 'object') return null;
         return { plugins: data.plugins !== false, page: data.page !== false };
       } catch {
@@ -88,14 +132,14 @@ window.__ModuleLoader__.load({
     /** Ask the running app to replace changed plugins now; a running turn is reported, never cut. */
     async function replacePlugins() {
       try {
-        const response = await fetch(`${HOST_BASE}/reload`, {
+        const response = await withTimeout(fetch(`${HOST_BASE}/reload`, {
           method: 'POST', // ui-copy-ignore
           credentials: 'same-origin',
           headers: { 'content-type': 'application/json', 'x-dsh-unlag': '1' }, // ui-copy-ignore
           body: '{}', // ui-copy-ignore
-        });
+        }));
         if (!response.ok) return 'failed';
-        const data = await response.json();
+        const data = await withTimeout(response.json());
         return reloadVerdict(data);
       } catch {
         return 'failed';
@@ -124,25 +168,36 @@ window.__ModuleLoader__.load({
     function bundledIds(url) {
       const match = /\?\?([^&]+)/.exec(url);
       if (match === null) return [];
-      return match[1].split(',').map((part) => decodeURIComponent(part).replace(/\/client\.js.*$/u, '')).filter((id) => id !== '');
+      const ids = [];
+      for (const part of match[1].split(',')) {
+        let decoded = part;
+        try {
+          decoded = decodeURIComponent(part);
+        } catch {
+          decoded = part;
+        }
+        decoded = decoded.replace(/\/client\.js.*$/u, '');
+        if (decoded !== '') ids.push(decoded);
+      }
+      return ids;
     }
 
     /**
-     * Ask the host half whether the scripts the next document would run can start it. The page has no
+     * Ask the running app whether the scripts the next document would run can start it. The page has no
      * parser that agrees with a script tag, and compiling a candidate body here would execute the
-     * plugin inside the page that carries the turn, so the verdict is the host's real parse bound to
+     * plugin inside the page that carries the turn, so the verdict is the app's real parse bound to
      * the bytes it read.
      * @returns 'ok' | 'blocked'
      */
     async function hostVerifyStartup(scripts) {
       let response;
       try {
-        response = await fetch(`${HOST_BASE}/verify`, {
+        response = await withTimeout(fetch(`${HOST_BASE}/verify`, {
           method: 'POST', // ui-copy-ignore
           credentials: 'same-origin',
           headers: { 'content-type': 'application/json', 'x-dsh-unlag': '1' }, // ui-copy-ignore
           body: JSON.stringify({ rows: scripts }), // ui-copy-ignore
-        });
+        }));
       } catch {
         held('verify');
         return 'blocked';
@@ -153,7 +208,7 @@ window.__ModuleLoader__.load({
       }
       let data = null;
       try {
-        data = await response.json();
+        data = await withTimeout(response.json());
       } catch {
         data = null;
       }
@@ -166,15 +221,15 @@ window.__ModuleLoader__.load({
       return 'blocked';
     }
 
-    // What the host's refusal means to the person pressing: the same gates the checks above use.
+    // What the app's refusal means to the person pressing: the same gates the checks above use.
     const VERIFY_GATES = {
-      empty: 'empty',
-      missing: 'script',
-      network: 'script',
-      parse: 'parse',
-      register: 'plugin',
+      empty: 'empty', // ui-copy-ignore
+      missing: 'script', // ui-copy-ignore
+      network: 'script', // ui-copy-ignore
+      parse: 'parse', // ui-copy-ignore
+      register: 'plugin', // ui-copy-ignore
       dependencies: 'covers',
-      list: 'list',
+      list: 'list', // ui-copy-ignore
     };
 
     /** Read every bundle the next boot would load and prove each listed plugin is inside. */
@@ -191,8 +246,14 @@ window.__ModuleLoader__.load({
         const listed = Array.isArray(batch.entries) && batch.entries.every((id) => typeof id === 'string') ? batch.entries : [];
         const ids = listed.length > 0 ? listed : bundledIds(url);
         if (ids.length === 0) return held('row');
+        let resolved = null;
+        try {
+          resolved = new URL(url, location.href);
+        } catch {
+          return held('row');
+        }
         for (const id of ids) covered.add(id);
-        sources.push({ url: new URL(url, location.href), ids });
+        sources.push({ url: resolved, ids });
       }
       if (sources.length === 0) return held('graph');
       for (const entry of entries) {
@@ -200,7 +261,7 @@ window.__ModuleLoader__.load({
         if (typeof id !== 'string' || !covered.has(id)) return held('covers');
       }
       // Reading these bodies here would need a parser the page does not have and would not prove
-      // what the new document registers; the host half compiles the same bytes with the real parser.
+      // what the new document registers; the app compiles the same bytes with the real parser.
       const verdict = await hostVerifyStartup(sources.map((source) => source.url.toString()));
       if (verdict !== 'ok') return false;
       holdReason = null;
@@ -226,7 +287,7 @@ window.__ModuleLoader__.load({
       const bridge = window.dshDesktopBoot;
       if (bridge === undefined || bridge === null || typeof bridge.ready !== 'function') return null;
       try {
-        const payload = await bridge.ready();
+        const payload = await withTimeout(bridge.ready(), 8000);
         const rows = Array.isArray(payload?.injections) ? payload.injections : [];
         return rows.length === 0 ? null : rows;
       } catch {
@@ -337,9 +398,9 @@ window.__ModuleLoader__.load({
      */
     async function hostBootGraph() {
       try {
-        const response = await fetch(`${HOST_BASE}/graph`, { cache: 'no-store', credentials: 'same-origin' });
+        const response = await withTimeout(fetch(`${HOST_BASE}/graph`, { cache: 'no-store', credentials: 'same-origin' }));
         if (!response.ok) return null;
-        const data = await response.json();
+        const data = await withTimeout(response.json());
         const graph = data?.graph;
         return graph !== null && typeof graph === 'object' ? graph : null;
       } catch {
@@ -351,9 +412,9 @@ window.__ModuleLoader__.load({
       const fromHost = await hostBootGraph();
       if (fromHost !== null) return fromHost;
       try {
-        const response = await fetch(location.href, { cache: 'no-store', credentials: 'same-origin' });
+        const response = await withTimeout(fetch(location.href, { cache: 'no-store', credentials: 'same-origin' }));
         if (!response.ok) return null;
-        return graphFromHtml(await response.text());
+        return graphFromHtml(await withTimeout(response.text()));
       } catch {
         return null;
       }
@@ -421,7 +482,22 @@ window.__ModuleLoader__.load({
     async function commitFocusedField() {
       const active = document.activeElement;
       if (active !== null && typeof active.blur === 'function') active.blur();
-      await new Promise((resolve) => requestAnimationFrame(() => resolve()));
+      // One frame lets the field write what it holds. A page that is not painting (a background
+      // window, a dropped frame) never answers a frame request, so the wait is also bounded.
+      await new Promise((resolve) => {
+        let done = false;
+        const finish = () => {
+          if (done) return;
+          done = true;
+          resolve();
+        };
+        try {
+          requestAnimationFrame(finish);
+        } catch {
+          finish();
+        }
+        setTimeout(finish, 250); // ui-copy-ignore
+      });
     }
 
     /** Re-enter the interface on a fresh document, keeping the current view in the address. */
@@ -447,7 +523,7 @@ window.__ModuleLoader__.load({
     function stillHeldBack() {
       const probe = new Event('beforeunload', { cancelable: true }); // ui-copy-ignore
       window.dispatchEvent(probe);
-      return probe.defaultPrevented === true;
+      return probe.defaultPrevented === true || probe.returnValue === false;
     }
 
     /**
@@ -512,57 +588,77 @@ window.__ModuleLoader__.load({
           : BUTTON_STYLE;
 
       const onClick = async () => {
-        if (pending) return;
-        const previous = Number(window.sessionStorage.getItem(STAMP_KEY) ?? 0);
-        if (Number.isFinite(previous) && Date.now() - previous < 3000) return; // ui-copy-ignore
+        if (pending || pressInFlight) return;
+        // A press the page already answered is not answered twice. Saying so beats a dead button.
+        if (Date.now() - stampRead() < 3000) { // ui-copy-ignore
+          setNotice(COPY.applying);
+          return;
+        }
+        pressInFlight = true;
         setPending(true);
         setNotice(null);
-        const stop = (key) => {
+        let navigated = false;
+        const stop = (key, applied = false) => {
           setPending(false);
-          setNotice(noticeFor(key));
+          setNotice(noticeFor(key, applied));
         };
-        const settings = await readSettings();
-        const replace = settings === null ? false : settings.plugins;
-        const rebuild = settings === null ? true : settings.page;
-        // Both switches off: a press does nothing at all.
-        if (!replace && !rebuild) {
-          setPending(false);
-          return;
-        }
-        // Replace first: a plugin that only changed the interface is then covered by the rebuild.
-        // A replacement that did not finish stops the press here: rebuilding the page anyway would
-        // start a document against a plugin set the app has not finished applying.
-        if (replace) {
-          const status = await replacePlugins();
-          if (status !== 'done' && status !== 'off') {
-            const key =
-              status === 'queued'
-                ? 'queued'
-                : status === 'applying'
-                  ? 'applying'
-                  : status === 'restart'
-                    ? 'restart'
-                    : status === 'unavailable'
-                      ? 'blocked'
-                      : 'failed';
-            report('plugin-held', key);
-            return stop(key);
+        try {
+          const settings = await readSettings();
+          const replace = settings === null ? false : settings.plugins;
+          const rebuild = settings === null ? true : settings.page;
+          let replaced = false;
+          // Nothing is switched on: the press says so instead of looking broken.
+          if (!replace && !rebuild) {
+            report('off');
+            return stop('off');
           }
+          // Replace first: a plugin that only changed the interface is then covered by the rebuild.
+          // A replacement that did not finish stops the press here: rebuilding the page anyway would
+          // start a document against a plugin set the app has not finished applying.
+          if (replace) {
+            const status = await withTimeout(replacePlugins()).catch(() => 'failed');
+            if (status !== 'done' && status !== 'off') {
+              const key =
+                status === 'queued'
+                  ? 'queued'
+                  : status === 'applying'
+                    ? 'applying'
+                    : status === 'restart'
+                      ? 'restart'
+                      : status === 'unavailable'
+                        ? 'blocked'
+                        : 'failed';
+              report('plugin-held', key);
+              return stop(key);
+            }
+            replaced = status === 'done';
+          }
+          if (!rebuild) {
+            // The plugin half is on and the page half is off: what the press did is worth saying.
+            report('replaced');
+            return stop(replaced ? 'replaced' : 'done');
+          }
+          stampWrite();
+          const reason = await prepareInterface();
+          if (reason !== null) {
+            // The log keeps the exact check that refused, so a held press can be explained later.
+            const gate = reason === 'blocked' && holdReason !== null ? `blocked:${holdReason}` : reason;
+            report('held', replaced ? `applied:${gate}` : gate);
+            return stop(reason, replaced);
+          }
+          report('rebuild');
+          navigated = true;
+          reloadFreshPage();
+          return undefined;
+        } catch (error) {
+          report('failed', 'press');
+          stop('failed');
+          return undefined;
+        } finally {
+          pressInFlight = false;
+          // The document goes away on a rebuild, so the button only needs re-enabling when it does not.
+          if (!navigated) setPending(false);
         }
-        if (!rebuild) {
-          setPending(false);
-          return;
-        }
-        window.sessionStorage.setItem(STAMP_KEY, String(Date.now()));
-        const reason = await prepareInterface();
-        if (reason !== null) {
-          // The log keeps the exact check that refused, so a held press can be explained later.
-          report('held', reason === 'blocked' && holdReason !== null ? `blocked:${holdReason}` : reason);
-          return stop(reason);
-        }
-        report('rebuild');
-        reloadFreshPage();
-        setTimeout(() => setPending(false), 4000); // ui-copy-ignore
       };
 
       return h('span', { style: WRAP_STYLE },

package/index.js

@@ -1,6 +1,6 @@
 import { AsyncLocalStorage } from 'node:async_hooks'
 import { createHash } from 'node:crypto'
-import { appendFileSync, existsSync, readFileSync, readdirSync, statSync, watch } from 'node:fs'
+import { appendFileSync, existsSync, readFileSync, readdirSync, statSync, watch, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { join, resolve } from 'node:path'
 import { Script } from 'node:vm'
@@ -34,6 +34,9 @@ const RELOAD_TIMEOUT_MS = 20_000
 
 
 const LOG_PATH = join(homedir(), '.dsh', 'unlag-reload.log')
+/** Past this many bytes the log starts over: it records recent presses, not an archive. */
+const LOG_MAX_BYTES = 1_000_000 // ui-copy-ignore
+let logWrites = 0
 /** Tests point this at a scratch file, so a test run leaves the live log readable. */
 const logTarget = () => process.env.DSH_UNLAG_LOG ?? LOG_PATH
 /** Survives a module replacement, so a reload cannot leave a second watcher behind. */
@@ -48,6 +51,8 @@ const BUTTON_HEADER = 'x-dsh-unlag'
 const CODE_EXTENSIONS = new Set(['.js', '.mjs', '.cjs'])
 /** Build output and dependency trees change without the source a developer edits changing. */
 const IGNORED_PATH = /(^|\/)(node_modules|\.git|\.cache|dist|build|coverage)([./]|$)/u
+/** The same trees by directory name, so they are not walked at all instead of walked and skipped. */
+const IGNORED_DIR = /^(node_modules|\.git|\.cache|dist|build|coverage|\.next|\.turbo)$/u
 /**
  * A test edit does not change what a running plugin does, so it is not a reason to restart the
  * plugin set. A development session runs its tests far more often than it changes source.
@@ -63,6 +68,8 @@ const BUNDLE_ROUTE = '/plugins'
 const SHIM_MARK = Symbol.for('dsh-unlag.bundle-shim')
 /** Holds the wrapper across a module replacement, so a reload can put the route back. */
 const SHIM_KEY = Symbol.for('dsh-unlag.shim')
+/** The instance that currently owns the routes and the shim; a late dispose checks it first. */
+const INSTANCE_KEY = Symbol.for('dsh-unlag.instance')
 
 /**
  * The three rows this plugin shows in Settings, in the schema dialect the settings form reads.
@@ -124,7 +131,18 @@ function settingsOf(config) {
 
 function log(line) {
   try {
-    appendFileSync(logTarget(), `${new Date().toISOString()} ${line}\n`)
+    const target = logTarget()
+    // A file that only grows eventually costs the app its own memory budget: every 200 lines the
+    // size is checked once, and a log past the cap starts over instead of growing without end.
+    logWrites += 1
+    if (logWrites % 200 === 1) {
+      try {
+        if (statSync(target).size > LOG_MAX_BYTES) writeFileSync(target, '')
+      } catch {
+        /* a missing or unreadable log is created by the append below */
+      }
+    }
+    appendFileSync(target, `${new Date().toISOString()} ${line}\n`)
   } catch {}
 }
 
@@ -155,6 +173,9 @@ function fingerprintOf(roots) {
     for (const item of names) {
       const path = join(dir, item.name)
       if (item.isDirectory()) {
+        // A dependency or build tree can hold tens of thousands of files, and stat-ing them on
+        // every watch event blocks the event loop every running turn needs.
+        if (IGNORED_DIR.test(item.name)) continue
         walk(path, depth + 1)
         continue
       }
@@ -240,7 +261,7 @@ function pluginReloader(ctx, config) {
   let running = false
   /**
    * The queue request this plugin is still waiting on, so a timeout is not reported as a cancel.
-   * It lives on the host instead of in this closure: replacing this plugin builds a new closure, and
+   * It lives outside this closure: replacing this plugin builds a new closure, and
    * a press landing after that must still join the update the first press started rather than queue
    * a second one beside it.
    */
@@ -398,7 +419,7 @@ function pluginReloader(ctx, config) {
             running = false
             if (again) {
               again = false
-              if (timer === null) timer = setTimeout(() => void flush(), debounce)
+              if (timer === null) timer = unrefTimer(setTimeout(() => void flush(), debounce))
             }
           }
           workState.current.then(release, release)
@@ -409,18 +430,25 @@ function pluginReloader(ctx, config) {
     } finally {
       if (again) {
         again = false
-        if (timer === null) timer = setTimeout(() => void flush(), debounce)
+        if (timer === null) timer = unrefTimer(setTimeout(() => void flush(), debounce))
       }
     }
   }
 
+  /** A timer here must not keep the app alive on its own once this plugin is done. */
+  const unrefTimer = (handle) => {
+    handle?.unref?.()
+    return handle
+  }
+
   const schedule = (filename) => {
     try {
+      if (stopped) return
       if (!worthReloading(filename)) return
       fromWatch = true
       lastChange = String(filename).split('/').pop() ?? ''
       if (timer !== null) clearTimeout(timer)
-      timer = setTimeout(() => void flush(), settle)
+      timer = unrefTimer(setTimeout(() => void flush(), settle))
     } catch (error) {
       log(`ignored a watch event: ${error?.message ?? error}`)
     }
@@ -432,23 +460,26 @@ function pluginReloader(ctx, config) {
    */
   const WAIT_MAX_MS = Number.isFinite(config?.busyWaitMs) ? Math.max(0, config.busyWaitMs) : 60_000
   let queued = null
+  let stopped = false
   const queueReload = () => {
+    if (stopped) return 'unavailable'
     if (queued !== null) return 'queued'
     const started = Date.now()
     const tick = () => {
       queued = null
+      if (stopped) return
       if (running) {
-        queued = setTimeout(tick, 500)
+        queued = unrefTimer(setTimeout(tick, 500))
         return
       }
       if (busy() && Date.now() - started < WAIT_MAX_MS) {
-        queued = setTimeout(tick, 1000)
+        queued = unrefTimer(setTimeout(tick, 1000))
         return
       }
       if (busy()) log('reloading while turns are still running; they keep running')
-      void reloadNow(true)
+      void reloadNow(true).catch(() => {})
     }
-    queued = setTimeout(tick, 1000)
+    queued = unrefTimer(setTimeout(tick, 1000))
     return 'queued'
   }
 
@@ -469,7 +500,7 @@ function pluginReloader(ctx, config) {
    * press did not replace anything instead of looking broken.
    * @returns {{status: string, warnings: string[], pending: string[], restartReason: string|null}}
    */
-  const reloadNow = async (force = false) => {
+  const runNow = async (force = false) => {
     const hmr = hmrService()
     if (hmr === null) return { status: 'unavailable', warnings: [], pending: [], restartReason: null, failedEntries: [] }
     log('manual reload: the refresh button was pressed')
@@ -495,18 +526,18 @@ function pluginReloader(ctx, config) {
         // The app accepted the update but has not finished starting the new plugin set. Rebuilding
         // the page now would start a document against a set that is still settling.
         return {
-          status: 'failed',
-          warnings: outcome.warnings,
-          pending: outcome.pending,
+          status: 'failed', // ui-copy-ignore
+          warnings: outcome.warnings, // ui-copy-ignore
+          pending: outcome.pending, // ui-copy-ignore
           restartReason: outcome.restartReason,
           failedEntries: outcome.failedEntries,
         }
       }
       if (outcome.failedEntries.length > 0) {
         return {
-          status: 'failed',
-          warnings: outcome.warnings,
-          pending: [],
+          status: 'failed', // ui-copy-ignore
+          warnings: outcome.warnings, // ui-copy-ignore
+          pending: [], // ui-copy-ignore
           restartReason: null,
           failedEntries: outcome.failedEntries,
         }
@@ -529,7 +560,7 @@ function pluginReloader(ctx, config) {
           running = false
           if (again) {
             again = false
-            if (timer === null) timer = setTimeout(() => void flush(), debounce)
+            if (timer === null) timer = unrefTimer(setTimeout(() => void flush(), debounce))
           }
         }
         workState.current.then(release, release)
@@ -537,6 +568,19 @@ function pluginReloader(ctx, config) {
     }
   }
 
+  /**
+   * The press path never rejects: a rejection here would be unhandled and end the app, and the page
+   * would wait for an answer that never comes.
+   */
+  const reloadNow = async (force = false) => {
+    try {
+      return await runNow(force)
+    } catch (error) {
+      log(`a press could not be answered: ${error?.message ?? error}`)
+      return { status: 'failed', warnings: [], pending: [], restartReason: null, failedEntries: [] }
+    }
+  }
+
   /** Watch the development roots; a missing or unreadable root is logged, never fatal. */
   const startWatching = () => {
     const hmr = hmrService()
@@ -567,8 +611,11 @@ function pluginReloader(ctx, config) {
   }
 
   const stop = () => {
+    stopped = true
     if (queued !== null) clearTimeout(queued)
     queued = null
+    if (timer !== null) clearTimeout(timer)
+    timer = null
   }
 
   return { reloadNow, startWatching, available, stop }
@@ -578,37 +625,123 @@ function pluginReloader(ctx, config) {
 function sendJson(res, status, payload) {
   try {
     if (res.writableEnded === true || res.destroyed === true) return
-    const body = JSON.stringify(payload)
+    let body = ''
+    try {
+      body = JSON.stringify(payload)
+    } catch {
+      body = '{"status":"error","detail":"unserializable"}' // ui-copy-ignore
+    }
+    /**
+     * A live graph can hold cycles and a socket can already carry a status: neither may leave the
+     * response open, because the page waits on this request and a press would never finish.
+     */
+    if (res.headersSent === true) {
+      res.end()
+      return
+    }
     res.writeHead(status, {
       'content-type': 'application/json; charset=utf-8',
       'cache-control': 'no-store',
       'content-length': Buffer.byteLength(body),
     })
     res.end(body)
-  } catch {}
+  } catch {
+    try {
+      if (res.writableEnded !== true && res.destroyed !== true) res.end()
+    } catch {
+      /* the socket is already gone */
+    }
+  }
+}
+
+/**
+ * A page this machine may have opened: loopback, a private network address, or a `.local` name.
+ * A public name that resolves here is the rebinding case, where another site becomes
+ * same-origin by pointing at this machine.
+ */
+const LOCAL_ADDRESS = /^(127\.\d+\.\d+\.\d+|localhost|\[::1\]|10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+|172\.(1[6-9]|2\d|3[01])\.\d+\.\d+|169\.254\.\d+\.\d+|[a-z0-9-]+\.local)(:\d+)?$/u
+
+/**
+ * Whether one request may act for the button. The page sets a header a cross-site form cannot set,
+ * a browser sends it only after a preflight this server never allows, and the address check covers
+ * the case that bypasses preflight: a page on a public name that resolves to this machine.
+ */
+function buttonAllowed(req) {
+  try {
+    const header = req?.headers?.[BUTTON_HEADER]
+    if (typeof header !== 'string' || header === '') return false
+    const site = typeof req?.headers?.host === 'string' ? req.headers.host.trim().toLowerCase() : '' // ui-copy-ignore
+    // No address at all is not a browser request; nothing about it can be checked, so the header is
+    // the whole gate, exactly as it was for earlier versions.
+    if (site !== '' && LOCAL_ADDRESS.test(site) === false) {
+      log(`refused a press from ${site}`)
+      return false
+    }
+    const origin = typeof req?.headers?.origin === 'string' ? req.headers.origin.trim().toLowerCase() : ''
+    if (origin === 'null') return false
+    if (origin !== '') {
+      let originHost = ''
+      try {
+        originSite = new URL(origin).host.toLowerCase() // ui-copy-ignore
+      } catch {
+        return false
+      }
+      if (originSite !== site) {
+        log(`refused a press from ${origin}`)
+        return false
+      }
+    }
+    return true
+  } catch {
+    return false
+  }
 }
 
 /** Read one small JSON request body; anything unreadable answers null instead of hanging. */
 function readJsonBody(req, limit = 64 * 1024) {
+
   return new Promise((resolve) => {
     let size = 0
+    let done = false
     const parts = []
+    const finish = (value) => {
+      if (done === true) return
+      done = true
+      clearTimeout(timer)
+      resolve(value)
+    }
+    // A request that opens a body and never finishes it would hold this handler forever.
+    const timer = setTimeout(() => {
+      finish(null)
+      try {
+        req.destroy?.()
+      } catch {
+        /* the request is already gone */
+      }
+    }, 10000) // ui-copy-ignore
+    // A body that never ends must not keep the process alive on its own.
+    timer.unref?.()
     try {
       req.on('data', (chunk) => {
         size += chunk.length
-        if (size <= limit) parts.push(chunk)
+        if (size > limit) {
+          finish(null)
+          return
+        }
+        parts.push(chunk)
       })
       req.on('end', () => {
-        if (size > limit) return resolve(null)
+        if (done === true) return
         try {
-          resolve(JSON.parse(Buffer.concat(parts).toString('utf8')))
+          finish(JSON.parse(Buffer.concat(parts).toString('utf8')))
         } catch {
-          resolve(null)
+          finish(null)
         }
       })
-      req.on('error', () => resolve(null))
+      req.on('error', () => finish(null))
+      req.on('aborted', () => finish(null))
     } catch {
-      resolve(null)
+      finish(null)
     }
   })
 }
@@ -761,11 +894,14 @@ async function regroupedBundleAnswer(clientModules, graph, request) {
   /**
    * Each entry body is a script of its own and need not end where another can begin: an entry
    * that ends in `})` followed by one that starts with an identifier is a syntax error, and a
-   * document would run neither. A line holding just `;` between them keeps every body its own
+   * document runs neither. A line holding only `;` between them keeps every body its own
    * statement whatever the two sides end and start with, and leaves each body itself untouched.
    */
   const body = Buffer.concat(parts.flatMap((part, index) => (index === parts.length - 1 ? [part] : [part, Buffer.from('\n;\n')])))
-  if (!request.ids.every((id) => body.includes(id))) return null
+  // A substring proves nothing: an id like "ui" is inside a body registering "ui-conversation".
+  // Only ids the assembled script really registers through the loader count as an answer.
+  const text = body.toString('utf8')
+  if (!request.ids.every((id) => bodyNamesId(text, id))) return null
   return { body, contentType: 'text/javascript; charset=utf-8', ids: request.ids }
 }
 
@@ -787,7 +923,12 @@ async function currentBundleAnswer(clientModules, method, url) {
       if (response.status !== 200) continue
       const body = Buffer.from(await response.arrayBuffer())
       if (body.length === 0) continue
-      if (!request.sourceMap && !request.ids.every((id) => body.includes(id))) continue
+      if (!request.sourceMap) {
+        // Every plugin the request names has to appear in the body as a whole id, not as part of
+        // a longer one.
+        const text = body.toString('utf8')
+        if (!request.ids.every((id) => bodyNamesId(text, id))) continue
+      }
       return {
         body,
         contentType: String(response.headers.get('content-type') ?? 'text/javascript; charset=utf-8'),
@@ -889,7 +1030,11 @@ function serveBundlesAtCurrentRevision(ctx) {
   if (server?.prefixes?.get === undefined) return null
   if (typeof clientModules?.fetchBundle !== 'function' || typeof clientModules?.graph !== 'function') return null
   const route = server.prefixes.get(BUNDLE_ROUTE)
-  if (route === null || route === undefined || route[SHIM_MARK] === true) return null
+  if (route === null || route === undefined) return null
+  // The mark names the wrapper it belongs to: a route copied from a wrapped one carries a stale
+  // mark, and only a mark pointing at the function installed right now means "already wrapped".
+  const installed = typeof route.resource === 'function' ? route.resource : route.handler
+  if (route[SHIM_MARK] === installed && installed !== undefined) return null
   if (typeof route.resource === 'function') {
     const original = route.resource
     const wrapped = async (request) => {
@@ -925,8 +1070,8 @@ function serveBundlesAtCurrentRevision(ctx) {
       }
       return answer
     }
-    route[SHIM_MARK] = true
     route.resource = wrapped
+    route[SHIM_MARK] = wrapped
     log('bundles asked for under an older revision are answered at the current one')
     return { route, slot: 'resource', original, wrapped }
   }
@@ -1002,15 +1147,25 @@ function serveBundlesAtCurrentRevision(ctx) {
     }
     if (served === true) return undefined
     try {
+      // A body that already wrote a status cannot take another one; ending is what the document
+      // needs, and leaving the socket open is what hangs it.
+      if (res.headersSent === true) {
+        if (res.writableEnded !== true && res.destroyed !== true) realEnd.call(res, outcome.body)
+        return undefined
+      }
       realWriteHead.call(res, outcome.held.status, outcome.held.headers)
       realEnd.call(res, outcome.body)
     } catch {
-      /* the response is gone; nothing left to answer */
+      try {
+        if (res.writableEnded !== true && res.destroyed !== true) realEnd.call(res)
+      } catch {
+        /* the response is gone; nothing left to answer */
+      }
     }
     return undefined
   }
-  route[SHIM_MARK] = true
   route.handler = wrapped
+  route[SHIM_MARK] = wrapped
   log('bundles asked for under an older revision are answered at the current one')
   return { route, slot: 'handler', original, wrapped }
 }
@@ -1019,10 +1174,18 @@ function serveBundlesAtCurrentRevision(ctx) {
 function releaseBundleShim(shim) {
   try {
     if (shim === null || shim === undefined) return
-    if (shim.slot === 'resource') {
-      if (shim.route.resource === shim.wrapped) shim.route.resource = shim.original
-    } else if (shim.route.handler === shim.wrapped) shim.route.handler = shim.original
-    if (shim.route[SHIM_MARK] === true) delete shim.route[SHIM_MARK]
+    /**
+     * Only the wrapper this record installed may be removed. Without the identity check a dispose
+     * that lands after the next apply would put the original back over a newer wrapper, or strip the
+     * mark off one it does not own and let the route be wrapped twice around one response.
+     */
+    const current = shim.slot === 'resource' ? shim.route.resource : shim.route.handler
+    if (current === shim.wrapped) {
+      if (shim.slot === 'resource') shim.route.resource = shim.original
+      else shim.route.handler = shim.original
+    }
+    // The mark belongs to this wrapper only; a mark left by a newer one stays on the route.
+    if (shim.route[SHIM_MARK] === shim.wrapped) delete shim.route[SHIM_MARK]
   } catch {}
 }
 
@@ -1035,7 +1198,7 @@ function ensureBundleShim(ctx) {
   const shim = globalThis[SHIM_KEY]
   if (shim !== null && shim !== undefined) {
     const route = ctx.get('webServer')?.prefixes?.get?.(BUNDLE_ROUTE)
-    if (route === shim.route && route[shim.slot] === shim.wrapped && route[SHIM_MARK] === true) return shim
+    if (route === shim.route && route[shim.slot] === shim.wrapped && route[SHIM_MARK] === shim.wrapped) return shim
     releaseBundleShim(shim)
     globalThis[SHIM_KEY] = null
   }
@@ -1052,12 +1215,26 @@ function bundleShimStatus(ctx) {
   return {
     route: route !== null && route !== undefined,
     kind: shape,
-    wrapped: route?.[SHIM_MARK] === true && typeof route?.[shape === 'none' ? 'handler' : shape] === 'function',
+    wrapped: route?.[SHIM_MARK] !== undefined && route?.[SHIM_MARK] === route?.[shape === 'none' ? 'handler' : shape],
     fetch: typeof clientModules?.fetchBundle === 'function',
     graph: typeof clientModules?.graph === 'function',
   }
 }
 
+/**
+ * Whether a served body names one plugin as a whole word. A bare substring is not enough: "ui" is
+ * inside "ui-conversation", and a body for the wrong generation would then be served as if sound.
+ */
+function bodyNamesId(body, id) {
+  let at = body.indexOf(id)
+  while (at >= 0) {
+    const next = body[at + id.length]
+    if (next === undefined || /[-\w$./@]/u.test(next) === false) return true
+    at = body.indexOf(id, at + 1)
+  }
+  return false
+}
+
 /** Ids a classic-script body registers through the module loader's public entry point. */
 function registeredIds(body) {
   const ids = new Set()
@@ -1074,7 +1251,7 @@ function requiredIds(body) {
 
 /**
  * Compile one body the way the document compiles it, and never run it: running a plugin body here
- * would execute its top level inside the host that owns every running turn.
+ * would execute its top level inside the app that owns every running turn.
  * @returns the parser's complaint, or null when the body compiles as a classic script.
  */
 function parseAsScript(body, name) {
@@ -1161,28 +1338,45 @@ export async function verifyStartupRows(graph, fetchBody, rows) {
   }
   if (absent.size > 0) {
     return {
-      status: 'blocked',
-      reason: 'dependencies',
+      status: 'blocked', // ui-copy-ignore
+      reason: 'dependencies', // ui-copy-ignore
       detail: `not registered by the startup list: ${[...absent].slice(0, 4).join(', ')}`,
     }
   }
   return {
-    status: 'ok',
-    reason: 'ok',
+    status: 'ok', // ui-copy-ignore
+    reason: 'ok', // ui-copy-ignore
     revision: typeof graph?.rev === 'string' ? graph.rev : null,
     scripts: bodies.map((body) => ({ url: body.url, digest: body.digest, ids: body.ids })),
   }
 }
 
+/**
+ * Read one startup script the way the document itself would get it.
+ *
+ * The route answers a script from an older generation at the revision that still holds it, so a
+ * document booting from the shell's frozen list comes up instead of 404. Reading the address
+ * directly would see that same 404 and refuse a rebuild the button can actually carry out, so the
+ * answer is taken through the same mapping and only falls back to the raw address when the mapping
+ * has nothing to say.
+ */
+export async function readStartupScript(clientModules, url) {
+  try {
+    const answer = await currentBundleAnswer(clientModules, 'GET', url)
+    if (answer !== null) return { status: 200, arrayBuffer: async () => answer.body }
+  } catch {}
+  return fetchBundleAt(clientModules, url, 'GET')
+}
+
 /** Ask the same question of the plugin table the plugin itself talks to. */
-async function verifyStartup(clientModules, rows) {
+export async function verifyStartup(clientModules, rows) {
   let graph = null
   try {
     graph = clientModules.graph()
   } catch (error) {
     return { status: 'blocked', reason: 'list', detail: String(error?.message ?? error) }
   }
-  return verifyStartupRows(graph, (url) => fetchBundleAt(clientModules, url, 'GET'), rows)
+  return verifyStartupRows(graph, (url) => readStartupScript(clientModules, url), rows)
 }
 
 /**
@@ -1208,59 +1402,81 @@ function serveButton(ctx, controller, config) {
     [
       `${BASE_PATH}/graph`,
       (_req, res) => {
-        ensureBundleShim(ctx)
-        sendJson(res, 200, { graph: liveBootGraph(ctx) })
+        // The page reads this before a rebuild; an answer that throws would leave the press with
+        // no verdict at all, so the whole body is bounded and answers either way.
+        try {
+          ensureBundleShim(ctx)
+          sendJson(res, 200, { graph: liveBootGraph(ctx) })
+        } catch (error) {
+          sendJson(res, 500, { status: 'error', detail: String(error?.message ?? error) })
+        }
       },
     ],
     [
       `${BASE_PATH}/verify`,
       async (req, res) => {
-        const method = String(req?.method ?? 'GET').toUpperCase()
-        if (method !== 'POST') return sendJson(res, 405, { status: 'method' })
-        const header = req?.headers?.[BUTTON_HEADER]
-        if (typeof header !== 'string' || header === '') return sendJson(res, 403, { status: 'forbidden' })
-        const clientModules = ctx.get('clientModules')
-        if (typeof clientModules?.fetchBundle !== 'function' || typeof clientModules?.graph !== 'function') {
-          return sendJson(res, 200, { status: 'blocked', reason: 'list', detail: 'the plugin table is not running' })
-        }
-        const body = await readJsonBody(req)
-        let verdict = null
+        // Nothing a request does may reject: an unhandled rejection ends the whole app, and with
+        // it every turn running in it.
         try {
-          verdict = await verifyStartup(clientModules, Array.isArray(body?.rows) ? body.rows : [])
+          const method = String(req?.method ?? 'GET').toUpperCase()
+          if (method !== 'POST') return sendJson(res, 405, { status: 'method' })
+          if (buttonAllowed(req) === false) return sendJson(res, 403, { status: 'forbidden' })
+          const clientModules = ctx.get('clientModules')
+          if (typeof clientModules?.fetchBundle !== 'function' || typeof clientModules?.graph !== 'function') {
+            return sendJson(res, 200, { status: 'blocked', reason: 'list', detail: 'the plugin table is not running' })
+          }
+          const body = await readJsonBody(req)
+          let verdict = null
+          try {
+            verdict = await verifyStartup(clientModules, Array.isArray(body?.rows) ? body.rows : [])
+          } catch (error) {
+            verdict = { status: 'blocked', reason: 'list', detail: String(error?.message ?? error) }
+          }
+          sendJson(res, 200, verdict)
         } catch (error) {
-          verdict = { status: 'blocked', reason: 'list', detail: String(error?.message ?? error) }
+          log(`cannot answer ${BASE_PATH}/verify: ${error?.message ?? error}`)
+          sendJson(res, 500, { status: 'error' })
         }
-        sendJson(res, 200, verdict)
       },
     ],
     [
       `${BASE_PATH}/report`,
       (req, res) => {
-        const method = String(req?.method ?? 'GET').toUpperCase()
-        if (method !== 'POST') return sendJson(res, 405, { status: 'method' })
-        let query = ''
         try {
-          query = new URL(String(req?.url ?? ''), 'http://x').searchParams.toString()
-        } catch {}
-        const params = new URLSearchParams(query)
-        const event = params.get('event') ?? ''
-        const gate = params.get('gate') ?? ''
-        if (event === 'mounted') log('interface rebuilt; the page runs the plugins as served now')
-        else if (event === 'rebuild') log('rebuild allowed: the page re-enters on the served modules')
-        else if (event === 'held') log(`rebuild held back: ${gate === '' ? 'unknown' : gate}`)
-        sendJson(res, 200, { status: 'done' })
+          const method = String(req?.method ?? 'GET').toUpperCase()
+          if (method !== 'POST') return sendJson(res, 405, { status: 'method' })
+          let query = ''
+          try {
+            query = new URL(String(req?.url ?? ''), 'http://x').searchParams.toString()
+          } catch {}
+          const params = new URLSearchParams(query)
+          const event = params.get('event') ?? ''
+          // A query comes from outside: one shaped gate keeps a forged line out of the log.
+          const gate = (params.get('gate') ?? '').replace(/[^a-z-]/gu, '').slice(0, 24)
+          if (event === 'mounted') log('interface rebuilt; the page runs the plugins as served now')
+          else if (event === 'rebuild') log('rebuild allowed: the page re-enters on the served modules')
+          else if (event === 'held') log(`rebuild held back: ${gate === '' ? 'unknown' : gate}`)
+          sendJson(res, 200, { status: 'done' })
+        } catch (error) {
+          log(`cannot record a press report: ${error?.message ?? error}`)
+          sendJson(res, 500, { status: 'error' })
+        }
       },
     ],
     [
       `${BASE_PATH}/reload`,
       async (req, res) => {
-        const method = String(req?.method ?? 'GET').toUpperCase()
-        if (method !== 'POST') return sendJson(res, 405, { status: 'method' })
-        const header = req?.headers?.[BUTTON_HEADER]
-        if (typeof header !== 'string' || header === '') return sendJson(res, 403, { status: 'forbidden' })
-        if (!settings.reloadPlugins) return sendJson(res, 200, { status: 'off' })
-        const outcome = await controller.reloadNow()
-        sendJson(res, 200, outcome)
+        try {
+          const method = String(req?.method ?? 'GET').toUpperCase()
+          if (method !== 'POST') return sendJson(res, 405, { status: 'method' })
+          if (buttonAllowed(req) === false) return sendJson(res, 403, { status: 'forbidden' })
+          if (!settings.reloadPlugins) return sendJson(res, 200, { status: 'off' })
+          const outcome = await controller.reloadNow()
+          sendJson(res, 200, outcome)
+        } catch (error) {
+          log(`cannot apply a plugin reload: ${error?.message ?? error}`)
+          sendJson(res, 500, { status: 'failed', detail: String(error?.message ?? error) })
+        }
       },
     ],
   ]
@@ -1280,6 +1496,7 @@ function serveButton(ctx, controller, config) {
 
 export function apply(ctx, config) {
   try {
+    const instance = {}
     closeAll(globalThis[WATCHER_KEY])
     closeAll(globalThis[ROUTES_KEY])
     releaseBundleShim(globalThis[SHIM_KEY])
@@ -1328,8 +1545,15 @@ export function apply(ctx, config) {
     }
     globalThis[ROUTES_KEY] = serveButton(ctx, controller, config ?? {})
     syncBundles()
+    globalThis[INSTANCE_KEY] = instance
 
     ctx.on('dispose', () => {
+      /**
+       * A dispose that lands after the next apply belongs to an instance that no longer owns
+       * anything; tearing the routes or the shim down here would break the newer one, and a page
+       * that then cannot read a startup script ends the app.
+       */
+      if (globalThis[INSTANCE_KEY] !== instance) return
       controller.stop()
       closeAll(globalThis[WATCHER_KEY])
       closeAll(globalThis[ROUTES_KEY])
@@ -1337,6 +1561,7 @@ export function apply(ctx, config) {
       globalThis[WATCHER_KEY] = null
       globalThis[ROUTES_KEY] = null
       globalThis[SHIM_KEY] = null
+      globalThis[INSTANCE_KEY] = null
     })
   } catch (error) {
     log(`plugin reload did not start: ${error?.message ?? error}`)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-unlag",
-  "version": "1.9.0",
+  "version": "1.9.2",
   "type": "module",
   "description": "A press applies plugin edits right away and brings a laggy interface back; automatic reloading stays off unless you turn it on, so the press is the only trigger, and nothing restarts.",
   "license": "MIT",