[bug] .tmp files left behind by a crash between temp write and link are never cleaned up (plaintext session data leak)

[JZQiang]

Summary

writeSyncedTempFile creates <logPath>.<hex>.tmp with open(tmp,'wx') + fsync; materializePosix only rm(tmp)s after link(tmp, finalPath) succeeds (and swallows rm errors). If the process crashes (or power fails) between temp creation and link, the temp file persists forever — there is no startup sweep, and listSessionDirs/listArtifacts don't recognize .tmp files. These temps contain the complete session content (plaintext or zstd) — disk accumulation plus a session-content leak.

Evidence

packages/session/session-persistence-jsonl/src/index.ts:543-568 (materializePosix), 606-616 (writeSyncedTempFile). Both POSIX and Win32 materialize paths share the issue.

Trigger

Crash between temp write and link (small window, but every new session materialization passes through it once).

Suggested fix

Sweep *.tmp files in session directories at backend startup (validate owner + random-suffix format before deleting), or replace link semantics with rename-based publish and fsync the directory after cleanup.

Verified at master 47f9438.

[xiaoshenming]

官方加载器拒读之后，磁盘上的 session.jsonl.zstd 不会自己好。我做了一个只修会话文件的插件：

https://github.com/xiaoshenming/dsh-session-surgeon

默认 dry-run；--apply 会先写 .bak.<utc>，不会发明缺失的 seq。中间帧损坏 / 文件头坏了会直接 refuse。

git clone https://github.com/xiaoshenming/dsh-session-surgeon.git
cd dsh-session-surgeon
dsh plugin --profile web add link:"$(pwd)"

重启 dsh web 后，左侧「会话医生」可以扫描、看对话、复制会话 ID、预览修复。欢迎把 scan / inspect 输出贴过来（不要上传整份 ~/.dsh/sessions）。