dsh-webdav-sync 1.0.4 → 1.0.5

package/lib/engine.js

@@ -164,6 +164,11 @@ async function syncOnce(engine, state, force) {
         state.blind = undefined;
     }
     const snapshot = await take(paths, config, engine.credentials);
+    if (snapshot.keysProblems.length === 0 && state.local?.keys !== undefined) {
+        // Older state files predate the explicit marker; an existing keys hash is
+        // already a trustworthy baseline, even before this run measures it again.
+        state.keysBaseline = true;
+    }
     let remote = await openRemote(engine, state, read);
     const first = state.local === undefined;
     // A directory could not be read this run: its part stands in for the server's
@@ -175,7 +180,11 @@ async function syncOnce(engine, state, force) {
         && sameHashes(hashesOf(partsOf(snapshot, remote.part('dirs'))), state.local)
         && !force) {
         // Neither side moved: the last sync is still the state of the world.
-        return { here: [], there: [], pushed: false, reloadNeeded: false, ...(await pendings(engine, snapshot.parts.plugins)) };
+        return {
+            here: [], there: [], pushed: false, reloadNeeded: false,
+            ...keyProblems(snapshot.keysProblems),
+            ...(await pendings(engine, snapshot.parts.plugins)),
+        };
     }
     if (remote.notModified) {
         // The server said the file is the one last read, which was worth knowing for
@@ -185,6 +194,10 @@ async function syncOnce(engine, state, force) {
     }
     const carried = remote.part('dirs');
     const localParts = partsOf(snapshot, carried);
+    // A failed credential read is unknown, not a deletion or a partial replacement.
+    // Defer this part while the other parts sync, carrying the server's copy below.
+    if (snapshot.keysProblems.length > 0)
+        delete localParts.keys;
     const local = hashesOf(localParts);
     // The server holds no file of ours. This computer's setup becomes the first
     // version, which is what joining an empty folder means.
@@ -206,10 +219,10 @@ async function syncOnce(engine, state, force) {
     for (const part of PARTS) {
         const remoteHas = remote.hashes[part] !== undefined;
         const remotePart = () => remote.part(part);
-        if (!syncsPart(config, part)) {
-            // Not carried with this configuration. The server's copy is carried through
-            // the upload untouched — turning a part off must never delete it for the
-            // computers that still sync it — and nothing is written here from it.
+        if (!syncsPart(config, part) || (part === 'keys' && snapshot.keysProblems.length > 0)) {
+            // Disabled or unreadable: carry the server's copy untouched. In particular,
+            // a missing/locked credential service must not look like local key deletion
+            // and erase the keys already uploaded by a successful manual sync.
             if (remoteHas)
                 merged[part] = remotePart();
             continue;
@@ -218,7 +231,8 @@ async function syncOnce(engine, state, force) {
         // the last sync — not merely when its presence changed. Comparing presence
         // would read an edit made only on the other computer as "unchanged" and
         // quietly keep this computer's older copy.
-        const changedHere = !first && local[part] !== state.local?.[part];
+        const missingKeyBaseline = !first && state.keysBaseline !== true && part === 'keys';
+        const changedHere = !first && !missingKeyBaseline && local[part] !== state.local?.[part];
         const changedThere = first || remote.hashes[part] !== state.remote?.[part];
         // A part the other computer took away is taken away here too — but never the
         // plugin list, which is what loads the shell, and never on a first sync,
@@ -327,11 +341,12 @@ async function syncOnce(engine, state, force) {
     const pushNeeded = force || remote.rebuilt === true || !sameHashes(mergedHashes, remote.hashes);
     if (!pushNeeded) {
         const written = await applyMerged(engine, snapshot, applied);
-        state.remote = remote.hashes;
         // Read back rather than assume: a directory whose file was just written — or
         // removed — has to be hashed as it now is, or the next sync would see an edit
-        // that this one made itself and call it a conflict.
-        state.local = hashesOf(partsOf(await take(paths, config, engine.credentials), undefined));
+        // that this one made itself and call it a conflict. Keep the key baselines if
+        // this read could not measure them, so recovery still sees pending edits.
+        const after = await take(paths, config, engine.credentials);
+        recordHashes(state, hashesOf(partsOf(after, undefined)), remote.hashes, snapshot.keysProblems.length === 0 && after.keysProblems.length === 0);
         // A part can come in without the file needing to be written: when only the
         // server moved, the merge agrees with it. The person still has to be told
         // what changed here, so the notice is recorded on this path too — clearing
@@ -351,7 +366,7 @@ async function syncOnce(engine, state, force) {
             ...(saved === undefined ? {} : { saved }),
             pushed: false,
             reloadNeeded: written.reloadNeeded,
-            ...keyProblems(written.keysProblems),
+            ...keyProblems([...snapshot.keysProblems, ...written.keysProblems]),
             ...(await pendings(engine, applied.plugins)),
         };
     }
@@ -556,11 +571,11 @@ async function push(engine, state, snapshot, merged) {
     // failed upload never leaves this computer holding another computer's setup
     // with nothing to say where its own went.
     const applied = await applyMerged(engine, snapshot, merged.applied);
-    const now = hashesOf(partsOf(await take(paths, config, engine.credentials), undefined));
+    const after = await take(paths, config, engine.credentials);
+    const now = hashesOf(partsOf(after, undefined));
     state.server = written;
     state.sum = sum(sealed);
-    state.remote = hashesOf(bundle);
-    state.local = now;
+    recordHashes(state, now, hashesOf(bundle), snapshot.keysProblems.length === 0 && after.keysProblems.length === 0);
     state.blind = written.etag === undefined || written.etag === '' ? { ...before } : undefined;
     state.undo = undefined;
     const notice = merged.here.length > 0 || merged.there.length > 0
@@ -579,7 +594,7 @@ async function push(engine, state, snapshot, merged) {
         ...(merged.saved === undefined ? {} : { saved: merged.saved }),
         pushed: true,
         reloadNeeded: applied.reloadNeeded,
-        ...keyProblems(applied.keysProblems),
+        ...keyProblems([...snapshot.keysProblems, ...applied.keysProblems]),
         ...(await pendings(engine, merged.merged.plugins)),
     };
 }
@@ -664,6 +679,29 @@ async function applyMerged(engine, snapshot, applied) {
     }
     return { reloadNeeded, keysProblems };
 }
+/** Record measured parts without turning an unreadable key store into a baseline. */
+function recordHashes(state, local, remote, keysReadable) {
+    if (keysReadable)
+        state.keysBaseline = true;
+    if (!keysReadable) {
+        // Keep both comparison points: when the service returns, local and remote
+        // key edits still need to be merged rather than accepted as already applied.
+        if (state.local?.keys === undefined)
+            delete local.keys;
+        else
+            local.keys = state.local.keys;
+        remote = { ...remote };
+        if (state.remote?.keys === undefined)
+            delete remote.keys;
+        else
+            remote.keys = state.remote.keys;
+        // The server may have changed keys during this attempt. A conditional 304
+        // would hide its body on recovery even though those keys are still pending.
+        state.server = undefined;
+    }
+    state.local = local;
+    state.remote = remote;
+}
 /**
  * The `keysProblems` field of a result, present only when there is one.
  *
@@ -838,7 +876,7 @@ export async function restore(engine) {
             ...(kept === undefined ? {} : { saved: keptDir(paths) }),
             pushed: false,
             reloadNeeded: written.reloadNeeded,
-            ...keyProblems(written.keysProblems),
+            ...keyProblems([...snapshot.keysProblems, ...written.keysProblems]),
             ...(await pendings(engine, applied.plugins)),
         };
     });
@@ -939,7 +977,7 @@ export async function undo(engine) {
             there: [],
             pushed: false,
             reloadNeeded: written.reloadNeeded,
-            ...keyProblems(written.keysProblems),
+            ...keyProblems([...snapshot.keysProblems, ...written.keysProblems]),
             ...(await pendings(engine, merged.plugins)),
         };
     });

package/lib/index.js

@@ -348,7 +348,7 @@ export function apply(ctx, config = {}) {
             send(res, 200, await installPlugins(current.paths));
         });
     });
-    startTimer(ctx, currentConfig);
+    startTimer(ctx, engine);
 }
 /** Make sure the state directory exists, so the first sync has somewhere to write. */
 async function saveStateIfUsable(engine) {
@@ -368,7 +368,7 @@ async function saveStateIfUsable(engine) {
  * A failure is recorded in the state by `sync` itself and changes nothing here:
  * the next tick tries again, which is the whole point of a timer.
  */
-function startTimer(ctx, currentConfig) {
+function startTimer(ctx, currentEngine) {
     let timer;
     let stopped = false;
     const tick = async () => {
@@ -376,11 +376,12 @@ function startTimer(ctx, currentConfig) {
             return;
         let wait = 0;
         try {
-            const paths = resolveFromEnv(readVolatile(currentConfig().profileDir));
-            const { config: stored } = await loadConfig(paths);
-            const minutes = stored.autoEvery;
-            if (usable(stored) && minutes > 0) {
-                await sync(engineFor(paths, stored)).catch(() => undefined);
+            // Use the same fresh engine as the routes: reading only sync.json would
+            // drop both the host credential service and a session-only WebDAV password.
+            const current = await currentEngine();
+            const minutes = current.config.autoEvery;
+            if (usable(current.config) && minutes > 0) {
+                await sync(current).catch(() => undefined);
                 wait = minutes * 60_000;
             }
         }

package/lib/wire.d.ts

@@ -292,6 +292,8 @@ export interface StoredState extends SyncRecord {
     key?: string | undefined;
     /** Last sync attempt, ISO-8601. */
     last?: string | undefined;
+    /** True once keys have a trustworthy local comparison baseline. */
+    keysBaseline?: boolean | undefined;
     /**
      * Last attempt that actually moved something, ISO-8601: a push, a part taken
      * from the server, or a restore. Absent until one has. This is the difference

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-webdav-sync",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "用 WebDAV 在多台电脑之间同步 DSH 的配置：模型供应商与模型、已安装插件、其余 profile 配置、附加目录与 API 密钥。整个备份在离开本机前用口令加密（AES-256-GCM + PBKDF2），以分片三方合并的方式在服务端保留一个加密文件。",
   "keywords": [
     "dsh",