mcp-read-file-server 1.9.1 → 1.9.3

package/README.md

@@ -10,6 +10,10 @@
 
 **v1.9.1 边界修复**：目录复制/移动拒绝双向祖先重叠，避免覆盖未读取的源文件；回滚失败和部分删源正确保留 `changed` / `partial`；行分页无法容纳首行时明确报错，到达请求结束行即停止解析，避免被范围外长行影响。Hono 间接依赖更新至 4.13.5。
 
+**v1.9.2 并发与异常修复**：目录与子路径操作跨实例互斥，无关路径仍可并行；提交及锁清理错误单独记录为 `cleanupErrors`，保留真实修改状态与恢复路径；递归删除逐项记录部分结果；字面量替换在可终止工作线程中一次拼接，并在预览或提交前检查时间预算。
+
+**v1.9.3 补充修复**：工作根保护同时识别配置别名和真实路径，并拒绝操作包含受保护根的祖先；移动失败时计入已经删除的源目录；策略探测参与父目录锁；目录操作失败保留之前子项的清理诊断；glob去重、累计限额并分批让出主线程，避免过滤条件绕过超时或阻塞心跳。
+
 ## 适用场景
 
 电脑安装了文件加密软件（如天锐绿盾、IP-Guard、亿赛通、深信服等），磁盘上的文件是密文。AI Agent（Claude Code、Cursor、Windsurf、Cline 等）是独立进程，内置文件工具不在白名单内，只能读到密文。而 Node.js 进程在白名单内，通过 MCP Server 提供的替代工具可以正常读写明文。
@@ -40,9 +44,10 @@ AI Agent  --(MCP/stdio)-->  Node.js MCP Server(index.js)  --(lib/ 模块)-->  fs
 - `index.js` 仅负责 stdio 启动与正则 worker 回收
 - `lib/encryption.js` 目录级加密探测、写入策略决策、safeWrite 组合与独立指纹校验
 - `lib/files.js` 路径边界、跨实例锁、可回滚提交（暂存→备份→rename→终验）、目录逐文件复制/移动
+- `lib/locks.js` 登记路径及子树占用；`lib/cleanup.js` 保留主操作结果并收集清理错误
 - `lib/text.js` 严格 UTF-8 增量解码与流式分页
 - `lib/patterns.js` 无回溯 glob 与保留原索引的字符串替换
-- `lib/regex.js` / `lib/regex-worker.js` 用户正则在可终止 worker 中执行（默认 1 秒预算）
+- `lib/regex.js` / `lib/regex-worker.js` 用户正则与字面量编辑在可终止 worker 中执行（单次计算默认最多 1 秒，并受请求总预算约束）
 - `lib/server.js` 注册全部 18 个 MCP 工具，统一 structuredContent 与超时/只读包装
 
 ## 环境自适应（v1.7.0+）
@@ -115,9 +120,14 @@ write_file / edit_file / copy_path / move_path 均支持 `writePolicy` 参数：
 
 - **完整载荷**：追加模式先在内存合成「原内容+新增」完整内容再走事务，纠正/重写不会丢原文与 BOM
 - **safeWrite 失败即中止**：不再回退直写破坏原文（SAFE_WRITE_FAILED，changed=false）
-- **跨实例锁**：同一路径的并发写入经 `.mcp-file-locks/` 互斥（等待 5 秒超时 FILE_BUSY）；`expectedHash` 可检测其他编辑器造成的版本变化（CONFLICT）
+- **跨实例锁**：使用同一 `MCP_PROFILE_DIR` 的实例经 `.mcp-file-locks/` 登记整组路径，同路径及祖先/后代相互排斥，无关路径可并行（等待 5 秒超时 FILE_BUSY）；`expectedHash` 可检测其他编辑器造成的版本变化（CONFLICT）。升级到 1.9.2 时应重启全部 MCP 实例，避免旧版进程继续使用不同的锁协议
+- **清理状态**：提交或锁清理失败会附带 `cleanupErrors`；主操作已成功时保留成功结果和真实 `changed`，错误时保留原错误及 `recoveryPath`。不要因清理告警重复追加内容
+- **递归删除**：逐项执行，失败时返回 `changed`、`partial`（最多100项）、`removedCount`、`partialTruncated`、`failedPath`；受一万项和128层预算限制，不是整树事务
 - **断电/强杀残留**：两次 rename 之间的极端崩溃可能留下 `.mcp-backup-*` 与 `.mcp-stage-*`，先核对内容与时间再人工恢复，禁止直接批量清理
 - **复制/移动目录**：逐文件执行相同策略；移动先复制并二次比对指纹后再删除已验证的源文件；失败返回 `partial` 与 `sourceRetained`，不静默回退；符号链接明确拒绝；源和最终目标存在任一方向的祖先关系时拒绝，相同路径保持不变。回滚失败时 `changed=true`，`partial` 包含当前失败目标，原备份通过 `recoveryPath` 返回
+- **移动失败的源变化**：`sourceRetained` 表示本次是否尚未删除任何源文件或源目录；`removedSourceCount`、`removedSourcePaths`（最多100项）、`removedSourcePathsTruncated` 报告已经删除的源项。失败仍保留已完成子项的 `cleanupErrors`
+- **策略探测互斥**：`inspect_write_strategy` 持有目标父目录锁，创建和清理探测样本完成后才允许该目录被复制、移动或删除
+- **glob总预算**：生产搜索与查找使用异步匹配，合并重复模式和分支；一次请求的展开后累计长度最多10万，编译和全部路径匹配共用5000万工作单元预算。约每16384工作单元让出事件循环，检查取消与截止时间；超过限额返回 `GLOB_LIMIT`，超时返回 `TIMEOUT`
 - **diskState 三态**：`plaintext`（独立进程验证磁盘明文）、`preserved`（保持加密直写）、`unknown`（内容已校验但无独立读取器证明磁盘状态——不能当作「已证明明文」）
 
 ## 文件结构
@@ -524,7 +534,7 @@ v1.9.0 起 safeWrite 失败**不再回退直写**（保护原文件，返回 `ch
 
 ### 写工具返回 FILE_BUSY / CONFLICT
 
-- `FILE_BUSY`：另一个 MCP 实例正在写同一路径（锁位于 `~/.mcp-file-locks/`）。确认对方进程结束后重试；仅当确认锁属主进程已退出时才可人工删除残留锁文件
+- `FILE_BUSY`：另一个 MCP 实例正在操作同一路径、父目录或子路径（锁位于 `~/.mcp-file-locks/`）。确认对方进程结束后重试；异常退出时仅在核对记录中的 PID 后处理残留 `.lock` 或 `.registry-guard`。`LOCK_CLEANUP_FAILED` 和 `cleanupErrors` 会给出未清理路径，不应直接清空整个锁目录
 - `CONFLICT`：传入的 `expectedHash` 与文件当前指纹不一致——文件在您读取后被其他进程改过。重新 read_file 后再编辑
 
 ### 回滚失败返回 recoveryPath

package/SKILL.md

@@ -20,7 +20,7 @@ description: 在Node.js为加密软件白名单进程的环境中，使用文件
 ## 必须理解的结果
 
 1. 优先读取structuredContent的ok、code、changed、data和warnings，不能只看人类文本。
-2. isError=true时可能存在目录操作部分目标；查看partial/sourceRetained。单文件回滚失败时查看recoveryPath并保留备份。
+2. isError=true时可能存在目录操作部分目标；查看changed/partial/sourceRetained。递归删除还需查看removedCount/partialTruncated/failedPath。单文件回滚失败时查看recoveryPath并保留备份。cleanupErrors只是清理诊断，成功修改后不得因清理告警重复追加。
 3. contentVerified表示Node可见内容一致；diskVerified才表示独立读取器的完整磁盘指纹一致。unknown不能声称已落盘明文。
 4. check_status基础调用不探测环境。文件可读取也不能直接推断解密正常，可信expectedHash匹配才提供明确内容对照。
 5. 文本工具只支持有效UTF8；UTF16、GBK、非法字节或NUL被拒绝时，必须先明确转换编码，不能强制按UTF8写回。

package/lib/cleanup.js

@@ -0,0 +1,34 @@
+/** 清理只收集自身错误，不覆盖主操作结果或恢复信息。 */
+const fs = require('node:fs/promises');
+const { READ_LIMIT, safeEnd } = require('./text');
+
+/** 尝试删除全部指定临时文件，并返回有界的清理诊断。 */
+async function cleanupFiles(paths) {
+  const errors = [];
+  for (const file of paths) {
+    try { await fs.rm(file, { force: true }); }
+    catch (error) { errors.push({ path: file, code: error.code || 'CLEANUP_FAILED', message: error.message }); }
+  }
+  return errors;
+}
+
+/** 失败保留主异常，成功则附加清理告警；兼容文件结果与MCP响应。 */
+function finishCleanup(value, failure, errors) {
+  if (failure) {
+    if (errors.length) failure.cleanupErrors = [...(failure.cleanupErrors || []), ...errors].slice(0, 100);
+    throw failure;
+  }
+  if (!errors.length) return value;
+  const response = value.structuredContent;
+  const data = response ? response.data : value;
+  data.cleanupErrors = [...(data.cleanupErrors || []), ...errors].slice(0, 100);
+  const warning = '操作已完成，但有临时文件或锁未能清理；请查看cleanupErrors，不要重复提交已完成的修改';
+  if (response) {
+    response.warnings = [...response.warnings, warning];
+    const body = value.content.find(item => item.type === 'text');
+    if (body) body.text = body.text.slice(0, safeEnd(body.text, READ_LIMIT)) + '\n注意：' + warning;
+  } else value.warnings = [...(value.warnings || []), warning];
+  return value;
+}
+
+module.exports = { cleanupFiles, finishCleanup };

package/lib/files.js

@@ -4,18 +4,9 @@ const nativeFs = require('node:fs');
 const path = require('node:path');
 const crypto = require('node:crypto');
 const { pipeline } = require('node:stream/promises');
-const { setTimeout: delay } = require('node:timers/promises');
-const { performance } = require('node:perf_hooks');
 const { fault, fingerprint, payloadFingerprint, checkBudget } = require('./text');
-
-/** 对 Windows 文件路径统一大小写，用于同一路径和锁键比较。 */
-function pathKey(file) { return process.platform === 'win32' ? path.resolve(file).toLowerCase() : path.resolve(file); }
-
-/** 判定 candidate 是否等于 base 或位于其子树，避免字符串前缀误判。 */
-function inside(base, candidate) {
-  const rel = path.relative(pathKey(base), pathKey(candidate));
-  return rel === '' || (!rel.startsWith('..' + path.sep) && rel !== '..' && !path.isAbsolute(rel));
-}
+const { createLocker, pathKey, inside } = require('./locks');
+const { cleanupFiles, finishCleanup } = require('./cleanup');
 
 /** 从最近存在的祖先解析真实路径，识别目录符号链接和 junction 越界。 */
 async function canonical(file) {
@@ -41,6 +32,8 @@ function createFiles(encryption, options = {}) {
   const configuredRoots = options.allowedRoots ?? (process.env.MCP_ALLOWED_ROOTS ? JSON.parse(process.env.MCP_ALLOWED_ROOTS) : []);
   if (!Array.isArray(configuredRoots) || !configuredRoots.every(x => typeof x === 'string' && path.isAbsolute(x))) throw fault('INVALID_CONFIG', 'MCP_ALLOWED_ROOTS 必须是绝对路径 JSON 数组');
   const rootsPromise = Promise.all(configuredRoots.map(canonical));
+  const locked = createLocker(encryption.stateDir);
+  let realBasePromise;
 
   /** 在操作前解析路径并执行服务端权限范围检查，删除链接时只解析其父目录。 */
   async function resolve(value, { write = false, leaf = false, destructive = false } = {}) {
@@ -50,40 +43,16 @@ function createFiles(encryption, options = {}) {
     const real = leaf ? path.join(await canonical(path.dirname(absolute)), path.basename(absolute)) : await canonical(absolute);
     const roots = await rootsPromise;
     if (roots.length && !roots.some(root => inside(root, real))) throw fault('PATH_OUTSIDE_ROOTS', '路径不在允许的根目录内');
-    if (destructive && (pathKey(real) === pathKey(path.parse(real).root) || pathKey(real) === pathKey(baseDir) || roots.some(root => pathKey(root) === pathKey(real)))) {
-      throw fault('PROTECTED_ROOT', '不能删除或移动盘符根、工作目录或配置根目录本身');
+    if (destructive) {
+      // 同时保护配置别名和真实工作根；其他链接仍按leaf语义只删除链接本身。
+      const realBase = await (realBasePromise ||= canonical(baseDir));
+      if ([path.parse(real).root, baseDir, realBase, ...roots].some(root => inside(real, root))) {
+        throw fault('PROTECTED_ROOT', '不能删除或移动盘符根、工作目录、配置根目录或包含这些根的祖先目录');
+      }
     }
     return real;
   }
 
-  /** 为多个路径按稳定顺序获取独占锁，避免多实例覆盖和死锁。 */
-  async function locked(files, action, context = {}) {
-    const dir = path.join(encryption.stateDir, '.mcp-file-locks');
-    await fs.mkdir(dir, { recursive: true });
-    const held = [];
-    const deadline = Math.min(context.deadline ?? Infinity, performance.now() + 5000);
-    try {
-      for (const file of [...new Set(files.map(pathKey))].sort()) {
-        const lock = path.join(dir, crypto.createHash('sha256').update(file).digest('hex') + '.lock');
-        while (true) {
-          checkBudget(context.signal, context.deadline);
-          try {
-            const handle = await fs.open(lock, 'wx', 0o600);
-            held.push(lock);
-            try { await handle.writeFile(JSON.stringify({ pid: process.pid, file, createdAt: new Date().toISOString() })); }
-            finally { await handle.close(); }
-            break;
-          } catch (error) {
-            if (error.code !== 'EEXIST') throw error;
-            if (performance.now() > deadline) throw fault('FILE_BUSY', '文件正被其他操作占用；若进程异常退出，请核对锁文件: ' + lock);
-            await delay(30);
-          }
-        }
-      }
-      return await action();
-    } finally { for (const lock of held.reverse()) await fs.rm(lock, { force: true }); }
-  }
-
   /** 取得文件修改前指纹，不把目录或特殊设备当作普通文件写入。 */
   async function previous(file, context) {
     const stat = await statMaybe(file);
@@ -118,6 +87,8 @@ function createFiles(encryption, options = {}) {
     let backedUp = false;
     let installed = false;
     let retainBackup = false;
+    let outcome;
+    let failure;
     try {
       const prepared = await encryption.prepare(stage, writer, expected, decision, options);
       // Windows FlushFileBuffers需要可写句柄，刷盘后再恢复原权限。
@@ -131,7 +102,7 @@ function createFiles(encryption, options = {}) {
       installed = true;
       const verified = await encryption.verify(file, expected, prepared.via ? 'plaintext' : decision.mode, options);
       if (backedUp) { await fs.rm(backup); backedUp = false; }
-      return { changed: true, hash: expected.hash, size: expected.size, ...verified, strategy: decision, ...(prepared.via ? { via: prepared.via } : {}), warnings: verified.diskState === 'unknown' ? ['内容已校验，但没有独立读取器证明磁盘为明文'] : [] };
+      outcome = { changed: true, hash: expected.hash, size: expected.size, ...verified, strategy: decision, ...(prepared.via ? { via: prepared.via } : {}), warnings: verified.diskState === 'unknown' ? ['内容已校验，但没有独立读取器证明磁盘为明文'] : [] };
     } catch (error) {
       // 回滚不受已取消的请求预算影响，优先恢复原始文件。
       try {
@@ -145,11 +116,10 @@ function createFiles(encryption, options = {}) {
         error.recoveryPath = backedUp ? backup : null;
         error.rollbackError = rollbackError.message;
       }
-      throw error;
-    } finally {
-      await fs.rm(stage, { force: true });
-      if (!retainBackup && backedUp) await fs.rm(backup, { force: true });
+      failure = error;
     }
+    const cleanupErrors = await cleanupFiles([stage, ...(!retainBackup && backedUp ? [backup] : [])]);
+    return finishCleanup(outcome, failure, cleanupErrors);
   }
 
   /** 提交文本载荷，写入者使用独占创建防止临时名冲突。 */
@@ -185,6 +155,12 @@ function createFiles(encryption, options = {}) {
       const createdDirectories = [];
       const sourceDirectories = [];
       let removedSources = 0;
+      const removedSourcePaths = [];
+      /** 文件和目录仅在真实删除成功后计数，保留有界的源变化清单。 */
+      function recordSourceRemoval(file) {
+        removedSources++;
+        if (removedSourcePaths.length < 100) removedSourcePaths.push(file);
+      }
       /** 逐项遍历，不跟随符号链接，避免跨根和意外递归。 */
       async function visit(src, dst) {
         checkBudget(settings.signal, settings.deadline);
@@ -223,30 +199,73 @@ function createFiles(encryption, options = {}) {
           for (const item of completed) {
             if ((await fingerprint(item.source, settings)).hash !== item.sourceHash) throw fault('CONFLICT', '源文件在删源前被修改，已保留');
             await fs.unlink(item.source);
-            removedSources++;
+            recordSourceRemoval(item.source);
+          }
+          for (const dir of sourceDirectories.reverse()) {
+            checkBudget(settings.signal, settings.deadline);
+            await fs.rmdir(dir);
+            recordSourceRemoval(dir);
           }
-          for (const dir of sourceDirectories.reverse()) await fs.rmdir(dir);
         }
-        return { changed: move || completed.some(x => x.changed) || createdDirectories.length > 0, source, destination, files: completed.length, moved: move, warnings: completed.flatMap(x => x.warnings || []).slice(0, 10) };
+        const cleanupErrors = completed.flatMap(x => x.cleanupErrors || []).slice(0, 100);
+        return { changed: move || completed.some(x => x.changed) || createdDirectories.length > 0, source, destination, files: completed.length, moved: move, ...(cleanupErrors.length ? { cleanupErrors } : {}), warnings: completed.flatMap(x => x.warnings || []).slice(0, 10) };
       } catch (error) {
         error.changed = !!error.changed || removedSources > 0 || completed.some(x => x.changed) || createdDirectories.length > 0;
         error.partial = [...new Set([...(error.partial || []), ...completed.map(x => x.destination)])].slice(0, 100);
         error.sourceRetained = removedSources === 0;
+        if (move) {
+          error.removedSourceCount = removedSources;
+          error.removedSourcePaths = removedSourcePaths;
+          error.removedSourcePathsTruncated = removedSources > removedSourcePaths.length;
+        }
+        const cleanupErrors = [...completed.flatMap(x => x.cleanupErrors || []), ...(error.cleanupErrors || [])].slice(0, 100);
+        if (cleanupErrors.length) error.cleanupErrors = cleanupErrors;
         throw error;
       }
     }, settings);
   }
 
-  /** 删除单个文件、链接或目录；空目录非递归删除使用 rmdir。 */
+  /** 逐项删除并记录实际完成项，部分失败不再报告为未修改。 */
   async function remove(value, settings = {}) {
     if (!allowDelete) throw fault('DELETE_DISABLED', '服务已禁用删除工具');
     const file = await resolve(value, { write: !settings.dryRun, leaf: true, destructive: true });
     return locked([file], async () => {
       const st = await fs.lstat(file);
       if (settings.dryRun) return { changed: false, dryRun: true, path: file, type: st.isDirectory() ? 'directory' : st.isSymbolicLink() ? 'symlink' : 'file' };
-      if (st.isDirectory() && settings.recursive === false) await fs.rmdir(file);
-      else await fs.rm(file, { recursive: st.isDirectory(), force: false });
-      return { changed: true, path: file };
+      const removed = [];
+      let removedCount = 0;
+      let visited = 0;
+      let failedPath = file;
+      /** 不跟随链接，逐层检查预算；只在系统删除成功后计数。 */
+      async function erase(target, depth = 0) {
+        failedPath = target;
+        checkBudget(settings.signal, settings.deadline);
+        if (++visited > 10000) throw fault('ITEM_LIMIT', '删除超过一万项预算');
+        if (depth > 128) throw fault('DEPTH_LIMIT', '删除目录深度超过128层');
+        await resolve(target, { write: true, leaf: true, destructive: true });
+        const current = await fs.lstat(target);
+        if (current.isDirectory()) {
+          if (settings.recursive !== false) {
+            const handle = await fs.opendir(target);
+            for await (const entry of handle) await erase(path.join(target, entry.name), depth + 1);
+          }
+          failedPath = target;
+          checkBudget(settings.signal, settings.deadline);
+          await fs.rmdir(target);
+        } else await fs.unlink(target);
+        removedCount++;
+        if (removed.length < 100) removed.push(target);
+      }
+      try { await erase(file); }
+      catch (error) {
+        error.changed = removedCount > 0;
+        error.partial = removed;
+        error.removedCount = removedCount;
+        error.partialTruncated = removedCount > removed.length;
+        error.failedPath = failedPath;
+        throw error;
+      }
+      return { changed: true, path: file, removedCount };
     }, settings);
   }
 

package/lib/locks.js

@@ -0,0 +1,88 @@
+/** 跨进程登记路径占用；祖先与后代互斥，无关路径可并行。 */
+const fs = require('node:fs/promises');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { setTimeout: delay } = require('node:timers/promises');
+const { performance } = require('node:perf_hooks');
+const { fault, checkBudget } = require('./text');
+const { cleanupFiles, finishCleanup } = require('./cleanup');
+
+/** 对Windows路径统一大小写，供路径关系和占用记录比较。 */
+function pathKey(file) { return process.platform === 'win32' ? path.resolve(file).toLowerCase() : path.resolve(file); }
+
+/** 按路径段判断同路径或后代，避免相似前缀误判。 */
+function inside(base, candidate) {
+  const rel = path.relative(pathKey(base), pathKey(candidate));
+  return rel === '' || (!rel.startsWith('..' + path.sep) && rel !== '..' && !path.isAbsolute(rel));
+}
+
+/** 创建使用同一状态目录的跨实例锁管理器。 */
+function createLocker(stateDir) {
+  const dir = path.join(stateDir, '.mcp-file-locks');
+  const guard = path.join(dir, '.registry-guard');
+
+  /** 在短临界区内检查并原子登记整组路径，等待期间不持有其他路径锁。 */
+  async function locked(files, action, context = {}) {
+    await fs.mkdir(dir, { recursive: true });
+    const wanted = [...new Set(files.map(pathKey))].sort();
+    const deadline = Math.min(context.deadline ?? Infinity, performance.now() + 5000);
+    let lease = null;
+    let value;
+    let failure;
+    try {
+      while (!lease) {
+        checkBudget(context.signal, context.deadline);
+        if (performance.now() > deadline) throw fault('FILE_BUSY', '路径或其子树正被其他操作占用；异常退出后请核对锁目录: ' + dir);
+        let guarding = false;
+        let attemptError;
+        try {
+          const handle = await fs.open(guard, 'wx', 0o600);
+          guarding = true;
+          try { await handle.writeFile(JSON.stringify({ pid: process.pid, createdAt: new Date().toISOString() })); }
+          finally { await handle.close(); }
+          let conflict = false;
+          for (const entry of await fs.readdir(dir)) {
+            checkBudget(context.signal, context.deadline);
+            if (!entry.endsWith('.lock')) continue;
+            let record;
+            try { record = JSON.parse(await fs.readFile(path.join(dir, entry), 'utf8')); }
+            catch (error) {
+              // 持有者可在临界区外释放记录；已删除的记录不再冲突。
+              if (error.code === 'ENOENT') continue;
+              throw fault('FILE_BUSY', '锁记录不可读取，请核对后处理: ' + path.join(dir, entry));
+            }
+            const occupied = record?.files || (record?.file ? [record.file] : null);
+            if (!Array.isArray(occupied) || !occupied.length || !occupied.every(x => typeof x === 'string' && path.isAbsolute(x))) throw fault('FILE_BUSY', '锁记录无效，请核对: ' + path.join(dir, entry));
+            if (wanted.some(a => occupied.some(b => inside(a, b) || inside(b, a)))) { conflict = true; break; }
+          }
+          if (!conflict) {
+            const candidate = path.join(dir, crypto.randomUUID() + '.lock');
+            const handle = await fs.open(candidate, 'wx', 0o600);
+            lease = candidate;
+            try { await handle.writeFile(JSON.stringify({ pid: process.pid, files: wanted, createdAt: new Date().toISOString() })); }
+            finally { await handle.close(); }
+          }
+        } catch (error) {
+          if (guarding || error.code !== 'EEXIST') attemptError = error;
+        } finally {
+          if (guarding) {
+            try { await fs.rm(guard, { force: true }); }
+            catch (error) {
+              const diagnostic = { path: guard, code: error.code, message: error.message };
+              if (!attemptError) attemptError = fault('LOCK_CLEANUP_FAILED', '锁登记临界区无法释放，请核对: ' + guard);
+              attemptError.cleanupErrors = [...(attemptError.cleanupErrors || []), diagnostic];
+            }
+          }
+        }
+        if (attemptError) throw attemptError;
+        if (!lease) await delay(30);
+      }
+      checkBudget(context.signal, context.deadline);
+      value = await action();
+    } catch (error) { failure = error; }
+    return finishCleanup(value, failure, await cleanupFiles(lease ? [lease] : []));
+  }
+  return locked;
+}
+
+module.exports = { createLocker, pathKey, inside };

package/lib/patterns.js

@@ -1,5 +1,9 @@
 /** glob 解析及保持原始位置的字符串编辑。 */
-const { fault, normalizeEol, detectEol } = require('./text');
+const { setImmediate: yieldLoop } = require('node:timers/promises');
+const { fault, normalizeEol, detectEol, EDIT_BYTES, checkBudget } = require('./text');
+const GLOB_COMPILE_LIMIT = 100000;
+const GLOB_WORK_LIMIT = 50000000;
+const GLOB_YIELD_INTERVAL = 16384;
 
 /** 按顶层逗号分隔旧版模式列表，保留花括号内的逗号。 */
 function splitPatterns(value) {
@@ -65,6 +69,59 @@ function globMatcher(patterns) {
   return relative => !matchers.length || matchers.some(m => m.alternatives.some(tokens => matchTokens(tokens, m.basename ? relative.split('/').at(-1) : relative)));
 }
 
+/** 为一次完整扫描累计编译和匹配工作量，定期让出主线程处理心跳/取消。 */
+function globBudget(options) {
+  let work = 0;
+  let sinceYield = 0;
+  /** 先扣减总预算再执行对应计算，返回是否需要让出事件循环。 */
+  function spend(units) {
+    checkBudget(options.signal, options.deadline);
+    work += units;
+    sinceYield += units;
+    if (work > GLOB_WORK_LIMIT) throw fault('GLOB_LIMIT', '本次扫描的glob累计计算超过预算，请缩小模式或扫描范围');
+    return sinceYield >= GLOB_YIELD_INTERVAL;
+  }
+  /** 允许其他MCP请求及取消事件运行，恢复后再次检查绝对截止时间。 */
+  async function pause() {
+    await yieldLoop();
+    sinceYield = 0;
+    checkBudget(options.signal, options.deadline);
+  }
+  return { spend, pause };
+}
+
+/** 生产扫描使用异步glob；预算贯穿编译、全部分支及所有路径，不随文件重置。 */
+async function globMatcherAsync(patterns, options = {}) {
+  const budget = globBudget(options);
+  const matchers = [];
+  let compiled = 0;
+  budget.spend(0);
+  for (const pattern of new Set(splitPatterns(patterns))) {
+    if (pattern.length > 1024) throw fault('INVALID_GLOB', 'glob模式过长');
+    const normalized = pattern.replace(/\\/g, '/');
+    if (budget.spend(normalized.length)) await budget.pause();
+    const alternatives = [];
+    for (const expanded of new Set(expandBraces(normalized))) {
+      compiled += expanded.length;
+      if (compiled > GLOB_COMPILE_LIMIT) throw fault('GLOB_LIMIT', 'glob展开后的累计长度超过10万，请减少模式与分支');
+      if (budget.spend(expanded.length)) await budget.pause();
+      alternatives.push(tokenizeGlob(expanded));
+    }
+    matchers.push({ basename: !normalized.includes('/'), alternatives });
+  }
+  /** 每次匹配继续消耗同一扫描的预算，并保持已有basename/相对路径语义。 */
+  return async function matches(relative) {
+    budget.spend(0);
+    const basename = relative.split('/').at(-1);
+    for (const matcher of matchers) {
+      for (const tokens of matcher.alternatives) {
+        if (await matchTokensAsync(tokens, matcher.basename ? basename : relative, budget)) return true;
+      }
+    }
+    return !matchers.length;
+  };
+}
+
 /** 有上限地展开花括号；不将用户模式交给可能回溯的JS正则。 */
 function expandBraces(pattern, depth = 0) {
   if (depth > 8) throw fault('INVALID_GLOB', 'glob嵌套超过上限');
@@ -99,20 +156,35 @@ function tokenizeGlob(pattern) {
   return tokens;
 }
 
-/** 动态规划匹配glob，复杂度有明确上限，不存在灾难性回溯。 */
+/** 计算一个token的动态规划行，供同步对照和异步生产匹配共用。 */
+function advanceToken(previous, token, value) {
+  const current = new Uint8Array(value.length + 1);
+  let reachable = false;
+  for (let j = 0; j <= value.length; j++) {
+    if (token.type === 'star' || token.type === 'all') current[j] = previous[j] || (j > 0 && current[j - 1] && (token.type === 'all' || value[j - 1] !== '/')) ? 1 : 0;
+    else if (token.type === 'dirs') { current[j] = previous[j] || (j > 0 && value[j - 1] === '/' && reachable) ? 1 : 0; reachable ||= !!previous[j]; }
+    else if (j > 0) current[j] = previous[j - 1] && (token.type === 'one' ? value[j - 1] !== '/' : value[j - 1] === token.value) ? 1 : 0;
+  }
+  return current;
+}
+
+/** 同步匹配保留给兼容调用与语义对照，生产工具使用异步入口。 */
 function matchTokens(tokens, value) {
+  if (tokens.length * value.length > 1000000) throw fault('GLOB_LIMIT', 'glob匹配超过计算预算');
+  let previous = new Uint8Array(value.length + 1);
+  previous[0] = 1;
+  for (const token of tokens) previous = advanceToken(previous, token, value);
+  return !!previous[value.length];
+}
+
+/** 逐行计算并共享请求总预算；一次同步片段最多一行加一个让出间隔。 */
+async function matchTokensAsync(tokens, value, budget) {
   if (tokens.length * value.length > 1000000) throw fault('GLOB_LIMIT', 'glob匹配超过计算预算');
   let previous = new Uint8Array(value.length + 1);
   previous[0] = 1;
   for (const token of tokens) {
-    const current = new Uint8Array(value.length + 1);
-    let reachable = false;
-    for (let j = 0; j <= value.length; j++) {
-      if (token.type === 'star' || token.type === 'all') current[j] = previous[j] || (j > 0 && current[j - 1] && (token.type === 'all' || value[j - 1] !== '/')) ? 1 : 0;
-      else if (token.type === 'dirs') { current[j] = previous[j] || (j > 0 && value[j - 1] === '/' && reachable) ? 1 : 0; reachable ||= !!previous[j]; }
-      else if (j > 0) current[j] = previous[j - 1] && (token.type === 'one' ? value[j - 1] !== '/' : value[j - 1] === token.value) ? 1 : 0;
-    }
-    previous = current;
+    if (budget.spend(value.length + 1)) await budget.pause();
+    previous = advanceToken(previous, token, value);
   }
   return !!previous[value.length];
 }
@@ -163,13 +235,26 @@ function applyLiteral(original, edit, ignoreCase = false) {
   if (!matches.count) throw fault('NO_MATCH', '未找到匹配内容；请检查空格、缩进和原文版本');
   if (edit.expectedMatches !== undefined && matches.count !== edit.expectedMatches) throw fault('MATCH_COUNT_MISMATCH', '实际匹配数与 expectedMatches 不一致', { matched: matches.count });
   const chosen = matches.selected;
-  let updated = original;
-  for (const match of chosen.reverse()) {
+  const spans = [];
+  let bytes = Buffer.byteLength(original);
+  const replacementBytes = Buffer.byteLength(replacement);
+  for (const match of chosen) {
     const start = map ? map(match.index) : match.index;
     const end = map ? map(match.index + match[0].length) : match.index + match[0].length;
-    updated = updated.slice(0, start) + replacement + updated.slice(end);
+    bytes += replacementBytes - Buffer.byteLength(original.slice(start, end));
+    spans.push({ start, end });
+  }
+  if (bytes > EDIT_BYTES) throw fault('FILE_TOO_LARGE', '编辑结果超过16MB预算');
+  // 预先核对输出体量，再按原文位置一次拼接，避免逐匹配复制整个文件。
+  const parts = [];
+  let cursor = 0;
+  for (const { start, end } of spans) {
+    parts.push(original.slice(cursor, start), replacement);
+    cursor = end;
   }
+  parts.push(original.slice(cursor));
+  const updated = parts.join('');
   return { updated, matched: matches.count, replaced: chosen.length, eolAdapted: !!map };
 }
 
-module.exports = { splitPatterns, escapeRegex, globToRegex, globMatcher, applyLiteral };
+module.exports = { splitPatterns, escapeRegex, globToRegex, globMatcher, globMatcherAsync, applyLiteral };

package/lib/regex-worker.js

@@ -1,8 +1,10 @@
 /** 将用户正则隔离在可终止线程，主线程保持 MCP 心跳响应。 */
 const { parentPort } = require('node:worker_threads');
+const { applyLiteral } = require('./patterns');
 
 /** 执行有限输出的匹配或编辑，超时由父线程终止整个 worker。 */
 function execute(task) {
+  if (task.operation === 'literal_edit') return applyLiteral(task.text, task.edit, task.ignoreCase);
   const regex = new RegExp(task.pattern, 'gm' + (task.ignoreCase ? 'i' : ''));
   if (task.operation === 'edit') {
     let count = 0;
@@ -39,5 +41,5 @@ function execute(task) {
 
 parentPort.on('message', message => {
   try { parentPort.postMessage({ id: message.id, result: execute(message.task) }); }
-  catch (error) { parentPort.postMessage({ id: message.id, error: error.message }); }
+  catch (error) { parentPort.postMessage({ id: message.id, error: { code: error.code || (message.task.operation === 'literal_edit' ? 'EDIT_FAILED' : 'INVALID_REGEX'), message: error.message } }); }
 });

package/lib/regex.js

@@ -1,7 +1,8 @@
-/** 复用正则 worker；每个调用独立截止，超时后重建线程。 */
+/** 正则与字面量编辑共用有界计算线程；主线程负责取消和截止时间。 */
 const { Worker } = require('node:worker_threads');
 const path = require('node:path');
-const { fault } = require('./text');
+const { performance } = require('node:perf_hooks');
+const { fault, checkBudget } = require('./text');
 let worker = null;
 let serial = 0;
 const pending = new Map();
@@ -26,7 +27,8 @@ function ensureWorker() {
     pending.delete(message.id);
     clearTimeout(job.timer);
     job.cleanup();
-    if (message.error) job.reject(fault('INVALID_REGEX', message.error));
+    if (performance.now() > job.deadline) job.reject(fault('TIMEOUT', '计算结果到达时已超过操作预算'));
+    else if (message.error) job.reject(fault(message.error.code, message.error.message));
     else job.resolve(message.result);
     if (!pending.size) current.unref();
   });
@@ -35,21 +37,33 @@ function ensureWorker() {
   return current;
 }
 
-/** 运行有硬超时和队列上限的正则任务。 */
-function runRegex(task, options = {}) {
-  if (task.pattern.length > 4096) return Promise.reject(fault('INVALID_REGEX', '正则超过 4096 字符'));
+/** 分派有硬超时和队列上限的计算任务，连同排队时间一起计入预算。 */
+function runTask(task, options = {}) {
   if (pending.size >= 16) return Promise.reject(fault('BUSY', '正则队列已满，请缩小搜索范围'));
   if (options.signal?.aborted) return Promise.reject(fault('CANCELLED', '操作已取消'));
   return new Promise((resolve, reject) => {
+    checkBudget(options.signal, options.deadline);
     const current = ensureWorker();
     current.ref();
     const id = ++serial;
     const abort = () => stop(fault('CANCELLED', '正则任务已取消'));
-    const timer = setTimeout(() => stop(fault('REGEX_TIMEOUT', '正则计算超过预算；请简化正则或使用字面量模式')), options.timeoutMs ?? 1000);
+    const deadline = Math.min(options.deadline ?? Infinity, performance.now() + (options.timeoutMs ?? 1000));
+    const timer = setTimeout(() => stop(task.operation === 'literal_edit' ? fault('TIMEOUT', '字面量编辑超过时间预算') : fault('REGEX_TIMEOUT', '正则计算超过预算；请简化正则或使用字面量模式')), Math.max(1, deadline - performance.now()));
     options.signal?.addEventListener('abort', abort, { once: true });
-    pending.set(id, { resolve, reject, timer, cleanup: () => options.signal?.removeEventListener('abort', abort) });
+    pending.set(id, { resolve, reject, timer, deadline, cleanup: () => options.signal?.removeEventListener('abort', abort) });
     current.postMessage({ id, task });
   });
 }
 
-module.exports = { runRegex, stop };
+/** 限制用户正则长度后交给工作线程执行。 */
+function runRegex(task, options = {}) {
+  if (task.pattern.length > 4096) return Promise.reject(fault('INVALID_REGEX', '正则超过 4096 字符'));
+  return runTask(task, options);
+}
+
+/** 字面量保留原始索引、换行和替换语义，同样具备线程取消能力。 */
+function runLiteral(text, edit, ignoreCase, options = {}) {
+  return runTask({ operation: 'literal_edit', text, edit, ignoreCase }, options);
+}
+
+module.exports = { runRegex, runLiteral, stop };

package/lib/server.js

@@ -6,8 +6,8 @@ const { McpServer } = require('@modelcontextprotocol/sdk/server/mcp.js');
 const { z } = require('zod');
 const pkg = require('../package.json');
 const text = require('./text');
-const { globMatcher, applyLiteral, escapeRegex } = require('./patterns');
-const { runRegex } = require('./regex');
+const { globMatcherAsync, escapeRegex } = require('./patterns');
+const { runRegex, runLiteral } = require('./regex');
 const { createEncryption } = require('./encryption');
 const { createFiles, statMaybe } = require('./files');
 const IGNORE = new Set(['node_modules', '.git', 'target', 'build', 'dist', '.idea', '.vscode', '.svn', 'bin', 'obj', 'out', 'vendor']);
@@ -52,9 +52,8 @@ function createServer(options = {}) {
         return await action(args, context);
       } catch (error) {
         return result('操作失败：' + error.message, { changed: !!error.changed,
-          ...(error.recoveryPath ? { recoveryPath: error.recoveryPath, rollbackError: error.rollbackError } : {}),
-          ...(error.partial ? { partial: error.partial, sourceRetained: error.sourceRetained } : {}),
-        }, { ok: false, code: error.code || 'INTERNAL_ERROR' });
+          ...Object.fromEntries(['recoveryPath', 'rollbackError', 'partial', 'sourceRetained', 'removedSourceCount', 'removedSourcePaths', 'removedSourcePathsTruncated', 'removedCount', 'partialTruncated', 'failedPath', 'cleanupErrors'].filter(key => error[key] !== undefined).map(key => [key, error[key]])),
+        }, { ok: false, code: error.code || 'INTERNAL_ERROR', warnings: error.cleanupErrors?.length ? ['部分临时文件未能清理，详见cleanupErrors'] : [] });
       }
     };
     handlers[name] = handler;
@@ -127,7 +126,9 @@ function createServer(options = {}) {
       let matched = 0;
       for (const item of args.edits || [args]) {
         text.checkBudget(context.signal, context.deadline);
-        const change = args.useRegex ? await runRegex({ operation: 'edit', text: updated, pattern: item.oldString, replacement: text.normalizeEol(item.newString, text.detectEol(updated)), replaceAll: item.replaceAll === true, ignoreCase: args.ignoreCase }, { ...context, timeoutMs: Math.max(1, Math.min(1000, context.deadline - performance.now())) }) : applyLiteral(updated, item, args.ignoreCase);
+        const computeBudget = { ...context, timeoutMs: Math.max(1, Math.min(1000, context.deadline - performance.now())) };
+        const change = args.useRegex ? await runRegex({ operation: 'edit', text: updated, pattern: item.oldString, replacement: text.normalizeEol(item.newString, text.detectEol(updated)), replaceAll: item.replaceAll === true, ignoreCase: args.ignoreCase }, computeBudget) : await runLiteral(updated, item, args.ignoreCase, computeBudget);
+        text.checkBudget(context.signal, context.deadline);
         if (!change.matched) throw text.fault('NO_MATCH', '未找到匹配内容，文件未修改');
         if (item.expectedMatches !== undefined && item.expectedMatches !== change.matched) throw text.fault('MATCH_COUNT_MISMATCH', '实际匹配数与expectedMatches不一致');
         updated = change.updated;
@@ -137,6 +138,7 @@ function createServer(options = {}) {
       }
       const payload = (original.hasBom ? '\uFEFF' : '') + updated;
       const details = { matched, replaced, originalHash: before.hash, proposedHash: text.payloadFingerprint(payload).hash, preview: preview(original.content, updated) };
+      text.checkBudget(context.signal, context.deadline);
       if (args.dryRun) return result('编辑预览完成，文件未修改', { changed: false, dryRun: true, ...details });
       const data = await files.write(file, payload, { ...context, expectedHash: before.hash, writePolicy: args.writePolicy });
       return result('编辑成功: ' + file + '\n实际替换 ' + replaced + ' 处，共匹配 ' + matched + ' 处', { ...data, ...details }, { warnings: data.warnings || [] });
@@ -176,7 +178,7 @@ function createServer(options = {}) {
     ...scanShape, pattern: z.string().max(4096), include: patternsSchema, ignoreCase: z.boolean().optional(), onlyMatching: z.boolean().optional(), mode: z.enum(['regex', 'literal']).optional(), contextLines: z.number().int().min(0).max(10).optional(),
   }, true, async (args, context) => {
     const root = await files.resolve(args.path);
-    const include = globMatcher(args.include);
+    const include = await globMatcherAsync(args.include, context);
     const errors = [];
     const skipped = { binary: 0, large: 0, unreadable: 0 };
     const results = [];
@@ -186,7 +188,7 @@ function createServer(options = {}) {
     let truncated = false;
     const exclude = Array.isArray(args.exclude) ? args.exclude : (args.exclude || '').split(',').filter(Boolean);
     for await (const entry of walk(root, { ...args, exclude }, errors, context)) {
-      if (entry.type !== 'file' || !include(entry.relative)) continue;
+      if (entry.type !== 'file' || !(await include(entry.relative))) continue;
       if (results.length >= limit || budget <= 0) { truncated = true; break; }
       let content;
       try {
@@ -211,23 +213,25 @@ function createServer(options = {}) {
       }
       if (found.truncated || truncated) { truncated = true; break; }
     }
+    text.checkBudget(context.signal, context.deadline);
     const warnings = errors.length ? ['部分文件/目录未能扫描，详见errors和skipped；无匹配不代表这些文件没有内容'] : [];
     return result('找到 ' + results.length + ' 处匹配（扫描 ' + scanned + ' 个文件）\n' + results.map(hit => hit.path + ':' + hit.line + ':' + hit.text).join('\n') + (truncated ? '\n结果已截断，请缩小范围' : ''), { results, scanned, skipped, errors, truncated }, { warnings, ok: scanned > 0 || !errors.length, code: scanned === 0 && errors.length ? 'SCAN_INCOMPLETE' : 'OK' });
   });
   register('find_files', '按glob递归查找，支持花括号、字面括号路径、隐藏项及默认忽略开关。', { ...scanShape, pattern: z.string().min(1).max(1024) }, true, async (args, context) => {
     const root = await files.resolve(args.path);
-    const matches = globMatcher([args.pattern]);
+    const matches = await globMatcherAsync([args.pattern], context);
     const entries = [];
     const errors = [];
     let truncated = false;
     let budget = text.READ_LIMIT;
     const exclude = Array.isArray(args.exclude) ? args.exclude : (args.exclude || '').split(',').filter(Boolean);
     for await (const entry of walk(root, { ...args, exclude }, errors, context)) {
-      if (!matches(entry.relative)) continue;
+      if (!(await matches(entry.relative))) continue;
       budget -= entry.file.length + entry.relative.length + 64;
       if (entries.length >= (args.maxResults ?? 500) || budget < 0) { truncated = true; break; }
       entries.push(entry);
     }
+    text.checkBudget(context.signal, context.deadline);
     return result(entries.map(entry => entry.type.toUpperCase() + ' ' + entry.file).join('\n') || '未找到匹配项', { entries, errors, truncated }, { warnings: errors.length ? ['部分目录未能扫描'] : [], ok: !!entries.length || !errors.length, code: !entries.length && errors.length ? 'SCAN_INCOMPLETE' : 'OK' });
   });
   register('list_directory', '列目录的文件/目录/链接类型与元数据，支持分页。', { path: pathSchema, showHidden: z.boolean().optional(), offset: z.number().int().min(0).max(1000000).optional(), maxResults: z.number().int().min(1).max(2000).optional() }, true, async (args, context) => {
@@ -257,11 +261,13 @@ function createServer(options = {}) {
     if (st.isFile() && args.calculateHash !== false) { const fp = await text.fingerprint(file, context); data.sizeReadable = fp.size; data.sizePlaintext = fp.size; data.hash = fp.hash; }
     return result(JSON.stringify(data, null, 2), data);
   });
-  register('create_directory', '递归创建目录，受只读模式与allowedRoots约束。', { path: pathSchema }, false, async args => {
+  register('create_directory', '递归创建目录，受只读模式与allowedRoots约束。', { path: pathSchema }, false, async (args, context) => {
     const dir = await files.resolve(args.path, { write: true });
-    const existed = !!(await statMaybe(dir));
-    await fs.mkdir(dir, { recursive: true });
-    return result('目录已创建: ' + dir, { path: dir, changed: !existed });
+    return files.locked([dir], async () => {
+      const existed = !!(await statMaybe(dir));
+      await fs.mkdir(dir, { recursive: true });
+      return result('目录已创建: ' + dir, { path: dir, changed: !existed });
+    }, context);
   });
   const transferShape = { source: pathSchema, destination: pathSchema, overwrite: z.boolean().optional(), writePolicy: policySchema, timeoutMs: timeoutSchema };
   register('copy_path', '逐文件复制和验证。目标已有目录时放入其下；失败返回部分目标并保留源，不自动跟随链接。', transferShape, false, async (args, context) => {
@@ -306,8 +312,10 @@ function createServer(options = {}) {
   });
   register('inspect_write_strategy', '检查有效写入策略；在已存在目标目录创建并清理随机探测样本，不修改目标文件。', { path: pathSchema, writePolicy: policySchema, timeoutMs: timeoutSchema }, false, async (args, context) => {
     const file = await files.resolve(args.path);
-    const data = await encryption.strategy(file, args.writePolicy, context);
-    return result(JSON.stringify(data, null, 2), data);
+    return files.locked([path.dirname(file)], async () => {
+      const data = await encryption.strategy(file, args.writePolicy, context);
+      return result(JSON.stringify(data, null, 2), data);
+    }, context);
   });
   return { server, handlers, encryption, files };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-read-file-server",
-  "version": "1.9.1",
+  "version": "1.9.3",
   "description": "加密环境文件操作 MCP 工具。当 Node.js 是加密软件白名单进程时，通过 fs 模块自动解密读写文件明文，替代 AI Agent 内置文件工具，适用于任何支持 MCP 协议的 Agent。",
   "type": "commonjs",
   "main": "index.js",
@@ -16,7 +16,7 @@
   ],
   "scripts": {
     "start": "node index.js",
-    "test": "node --test --test-reporter=tap --test-concurrency=1 test/regression.test.js test/protocol.test.js test/adapters.test.js test/review-fixes.test.js",
+    "test": "node --test --test-reporter=tap --test-concurrency=1 test/regression.test.js test/protocol.test.js test/adapters.test.js test/review-fixes.test.js test/resilience.test.js test/followup-fixes.test.js",
     "check": "node scripts/check.js"
   },
   "keywords": [