fix(ccswitch-import): recover from malformed leftover journal

Importing from cc-switch failed with
"query failed: attempt to write a readonly database" when cc-switch had been
killed mid-write, leaving a malformed cc-switch.db-journal (truncated/corrupt
rollback journal). SQLite must discard a malformed journal to open the DB — a
write the read-only connection (readOnly:true) refused → SQLITE_READONLY.

Root cause locked deterministically: a *valid* hot journal is skipped cleanly
under readOnly (node:sqlite handles it); only a malformed one trips recovery.
So the trigger is a torn/partial journal from an unclean crash, not a clean one.

Fix in server/lib/ccswitch-import.js: keep the default read-only open (no
SQLITE_BUSY contention with a running cc-switch), but on SQLITE_READONLY escalate
once to a read-write open guarded by PRAGMA query_only = ON (lets SQLite recover
and discard the corrupt journal, blocks our own writes), then retry — mirroring
what cc-switch itself does on its next normal launch. SQLITE_BUSY on the
escalation path surfaces a clear "db is locked; retry shortly" message; other
errors still surface their real cause (query failed: …, e.g. file is not a database).

Test: new test/ccswitch-import.test.js cases plant a garbage -journal next to a
valid DB and assert recovery reads providers + cleans the journal, with a
follow-up plain read-only read proving the DB is left clean.

Build OK; ccswitch-import 30/30 + api-ccswitch-import 7/7; no new failures vs
clean-main baseline.

Author: souloss

history.md

@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- fix(ccswitch-import): **malformed leftover journal → `attempt to write a readonly database`** — importing from cc-switch failed with `导入失败（未检测到 cc-switch 或读取出错）: query failed: attempt to write a readonly database` when cc-switch had been killed mid-write and left a **malformed** `cc-switch.db-journal` (truncated/corrupt rollback journal) behind. SQLite must discard a malformed journal to open the DB, which is a write; the read-only connection (`readOnly:true`) refused it → `SQLITE_READONLY`. Root cause locked deterministically: a *valid* hot journal is skipped cleanly under `readOnly` (node:sqlite handles it), only a malformed one trips recovery — so the trigger is a torn/partial journal, not a clean crash. Fix in `server/lib/ccswitch-import.js`: keep the default read-only open (no `SQLITE_BUSY` contention with a running cc-switch), but on `SQLITE_READONLY` escalate **once** to a read-write open guarded by `PRAGMA query_only = ON` (lets SQLite recover/discard the corrupt journal, blocks our own writes), then retry — mirroring what cc-switch itself does on its next normal launch. `SQLITE_BUSY` on the escalation path surfaces a clear "db is locked; retry shortly" message; all other errors still surface their real cause (`query failed: …`, e.g. "file is not a database"). New `test/ccswitch-import.test.js` cases plant a garbage `-journal` next to a valid DB and assert recovery reads providers + cleans the journal, with a follow-up plain read-only read proving the DB is left clean. Build OK; ccswitch-import 30/30 + api-ccswitch-import 7/7; no new failures vs the clean-main baseline.
+
 ## 1.7.5 (2026-07-18)
 
 - ui(proxy): **fuse retry config and stats into a unified split-page** — `RetryConfigForm` extracted from RetryConfigModal as inline component; `UnifiedProxyRetryPage` with left config / right stats panels (independent scroll); recent records table filtered to errors only. Shared `isProxyMode()` utility eliminates duplicated proxy-detection logic. Proxy stats toolbar/sidebar buttons removed; unified page now reachable via hamburger menu. P1–P2 code-review fixes applied.

server/lib/ccswitch-import.js

@@ -11,7 +11,9 @@
 // is delegated to the caller (preferences.js POST /api/ccswitch-import).
 //
 // Design notes:
-// - Open SQLite read-only (readOnly:true) to avoid SQLITE_BUSY locks while cc-switch is running
+// - Open SQLite read-only by default (readOnly:true) to avoid SQLITE_BUSY locks while cc-switch is running;
+//   escalate once to a read-write + query_only connection only when a malformed leftover journal forces
+//   SQLITE_READONLY recovery (see readCcSwitchProviders)
 // - Multi-path probing: each platform tries the standard Tauri dir first, then falls back to ~/.cc-switch/
 // - settings_config parsing is fully fault-tolerant: null / non-JSON / missing env are all skipped, never throws
 // - Profile ids get a ccs_ prefix to distinguish from user-created proxy_ prefixed ones; updates are idempotent (re-imports update, never duplicate)
@@ -155,18 +157,23 @@ export async function readCcSwitchProviders(dbPath) {
     // localized message off it (ui.proxy.ccswitchNodeUnsupported).
     return { profiles: [], error: 'node:sqlite unavailable on this runtime (requires Node >= 22.5 with --experimental-sqlite, or >= 23.4)' };
   }
-  let db = null;
-  try {
-    // Read-only: cc-switch stays unaffected by our reads (no SQLITE_BUSY)
-    db = new DatabaseSync(dbPath, { readOnly: true });
-  } catch (err) {
-    return { profiles: [], error: `cannot open db: ${err && err.message}` };
-  }
-  try {
+
+  // Open the db. Default: read-only (no SQLITE_BUSY contention with a running cc-switch).
+  // But a leftover MALFORMED cc-switch.db-journal (cc-switch killed mid-write, leaving a
+  // truncated/corrupt rollback journal) forces SQLite to discard it on the first page access
+  // — a write — which a read-only connection refuses with SQLITE_READONLY
+  // ("attempt to write a readonly database"). A *valid* hot journal is skipped cleanly under
+  // readOnly; only a malformed one trips this. On that specific error we escalate once to a
+  // read-write open guarded by PRAGMA query_only=ON (lets SQLite recover, blocks our writes),
+  // then retry. This mirrors what cc-switch itself does on its next normal launch.
+  const isReadonlyErr = (e) => /readonly/i.test(e && (e.errstr || e.message || ''));
+  const isBusyErr = (e) => /locked|busy/i.test(e && (e.errstr || e.message || ''));
+
+  // Run the providers read against a given connection; returns the result object or throws.
+  const readProviders = (db) => {
     // providers table existence check. A query that throws here means the file is
     // unreadable as a SQLite db (corrupt / non-SQLite / truncated) — the real cause
-    // must surface, not be masked as "table not found". Let it propagate to the
-    // outer catch, which formats it as `query failed: <message>`.
+    // must surface, not be masked as "table not found".
     const r = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='providers'").get();
     if (!r) return { profiles: [], error: `providers table not found in ${dbPath}` };
 
@@ -184,6 +191,41 @@ export async function readCcSwitchProviders(dbPath) {
       }
     }
     return { profiles, currentId, error: null };
+  };
+
+  // Open read-only and attempt the read. On SQLITE_READONLY (malformed journal), escalate
+  // to a read-write + query_only connection and retry once. Other errors propagate to the
+  // outer catch (formatted as `query failed: <message>`), preserving real-cause surfacing.
+  let db = null;
+  try {
+    try {
+      db = new DatabaseSync(dbPath, { readOnly: true });
+    } catch (err) {
+      // Open itself can fail SQLITE_READONLY if the malformed journal is detected at open.
+      if (!isReadonlyErr(err)) return { profiles: [], error: `cannot open db: ${err && err.message}` };
+      db = new DatabaseSync(dbPath); // read-write to let SQLite discard the corrupt journal
+      db.exec('PRAGMA query_only = ON');
+    }
+    try {
+      return readProviders(db);
+    } catch (err) {
+      if (!isReadonlyErr(err)) throw err; // surface the real cause (e.g. "file is not a database")
+      // Escalate: reopen read-write, recover, lock to query-only, retry once.
+      try { db.close(); } catch { /* best effort */ }
+      try {
+        db = new DatabaseSync(dbPath);
+      } catch (openErr) {
+        if (isBusyErr(openErr)) return { profiles: [], error: 'cc-switch db is locked (cc-switch may be running); retry shortly' };
+        throw openErr;
+      }
+      db.exec('PRAGMA query_only = ON');
+      try {
+        return readProviders(db);
+      } catch (retryErr) {
+        if (isBusyErr(retryErr)) return { profiles: [], error: 'cc-switch db is locked (cc-switch may be running); retry shortly' };
+        throw retryErr;
+      }
+    }
   } catch (err) {
     return { profiles: [], error: `query failed: ${err && err.message}` };
   } finally {

test/ccswitch-import.test.js

@@ -428,3 +428,50 @@ describe('readCcSwitchProviders (error surfacing)', { skip: !hasSqlite }, () =>
     assert.ok(error.includes(dbPath), `error should name the resolved db path, got: ${error}`);
   });
 });
+
+// Regression: a malformed leftover rollback journal (cc-switch crashed mid-write, leaving a
+// truncated/corrupt cc-switch.db-journal) makes a read-only SQLite connection fail to open the
+// first query with SQLITE_READONLY ("attempt to write a readonly database"). SQLite needs to
+// discard the corrupt journal to open the DB, which is a write — refused under readOnly:true.
+// The fix escalates to a read-write open (query-only locked) on that specific error, lets SQLite
+// recover, then reads. Reproduced deterministically by planting a non-journal garbage file next
+// to an otherwise-valid DB. (A *valid* hot journal does NOT trigger this — node:sqlite skips it —
+// only a malformed one does, so the test plants garbage bytes.)
+describe('readCcSwitchProviders (malformed journal recovery)', { skip: !hasSqlite }, () => {
+  let tmpDir;
+  before(() => { tmpDir = mkdtempSync(join(tmpdir(), 'ccv-ccswitch-journal-')); });
+  after(() => { try { rmSync(tmpDir, { recursive: true, force: true }); } catch { /* best effort */ } });
+
+  it('残留的损坏 journal 不再以 readonly 报错，而是照常读出 providers', async () => {
+    const { DatabaseSync } = createRequire(import.meta.url)('node:sqlite');
+    const dbPath = join(tmpDir, 'cc-switch.db');
+    // Build a valid cc-switch-shaped DB with one claude provider committed.
+    const db = new DatabaseSync(dbPath);
+    db.exec('PRAGMA journal_mode=DELETE');
+    db.exec('CREATE TABLE providers(id INTEGER PRIMARY KEY, app_type TEXT, name TEXT, settings_config TEXT, is_current INTEGER, sort_index INTEGER)');
+    db.exec(`INSERT INTO providers(app_type,name,settings_config,is_current,sort_index) VALUES('claude','xfyun','{"env":{"ANTHROPIC_BASE_URL":"https://x","ANTHROPIC_AUTH_TOKEN":"tok"}}',1,0)`);
+    db.close();
+    // Plant the locked trigger: a stale -journal file whose bytes are NOT a valid rollback
+    // journal. This is what cc-switch leaves behind when it is killed mid-write (truncated /
+    // torn page, or a partially flushed journal that fails SQLite's header magic check).
+    writeFileSync(dbPath + '-journal', 'NOT A VALID ROLLBACK JOURNAL - GARBAGE BYTES');
+
+    const { profiles, error } = await readCcSwitchProviders(dbPath);
+    assert.equal(error, null, `expected recovery, got error: ${error}`);
+    assert.ok(Array.isArray(profiles) && profiles.length === 1, `expected 1 profile, got: ${JSON.stringify(profiles)}`);
+    assert.equal(profiles[0].name, 'xfyun');
+    assert.ok(profiles[0].apiKey, 'credential should map through');
+    // The malformed journal must be cleaned up as part of recovery (SQLite discards it on the
+    // read-write open), so a subsequent read-only open works without any escalation.
+    assert.ok(!existsSync(dbPath + '-journal'), 'malformed journal should be discarded after recovery');
+  });
+
+  it('recovery 之后用纯只读二次读取也能成功（journal 已清）', async () => {
+    // After the previous test recovered and removed the malformed journal, a plain read-only
+    // open must succeed on its own — proving the fix left the DB in a clean state.
+    const dbPath = join(tmpDir, 'cc-switch.db');
+    const { profiles, error } = await readCcSwitchProviders(dbPath);
+    assert.equal(error, null);
+    assert.ok(profiles.length === 1 && profiles[0].name === 'xfyun');
+  });
+});