@1e0zj/dsh-plugin-mall 0.1.10 → 0.1.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1e0zj/dsh-plugin-mall",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "description": "dsh 插件市场：搜索 GitHub dsh-plugin 话题下的插件仓库，一键安装到本地 dsh profile（agent 工具 + 设置页插件市场 tab）",
   "type": "module",
   "main": "src/index.js",

package/src/client.js

@@ -43,10 +43,13 @@ window.__ModuleLoader__.load({
       ".mkt_cardActions{display:flex;gap:8px;align-items:center;flex-wrap:wrap;margin-top:auto;padding-top:4px}",
       ".mkt_cardActions .mkt_btn{text-decoration:none}",
       ".mkt_panelTitle{font-size:13px;font-weight:600;color:var(--dsw-alias-label-primary);margin:0}",
+      ".mkt_panelRow{display:flex;align-items:center;gap:8px}",
+      ".mkt_panelRow .mkt_link{margin-left:auto}",
       ".mkt_pre{font-family:Consolas,Monaco,monospace;font-size:11.5px;line-height:16px;color:var(--dsw-alias-label-secondary);background:var(--dsw-alias-bg-secondary,#f6f7f8);border-radius:6px;padding:8px;max-height:220px;overflow:auto;white-space:pre-wrap;word-break:break-all}",
       ".mkt_ok{color:var(--dsw-alias-state-success-primary,#2f855a)}",
       ".mkt_badge{display:inline-block;border-radius:999px;padding:1px 8px;font-size:11px;border:1px solid var(--dsw-alias-border-l2);color:var(--dsw-alias-label-tertiary)}",
       ".mkt_badgeOk{border-color:var(--dsw-alias-state-success-primary,#2f855a);color:var(--dsw-alias-state-success-primary,#2f855a)}",
+      ".mkt_badgeBad{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary)}",
       ".mkt_check{display:flex;align-items:center;gap:4px;font-size:12.5px;color:var(--dsw-alias-label-secondary);cursor:pointer;white-space:nowrap}",
       ".mkt_link{color:var(--dsw-alias-state-business-primary);font-size:12px;text-decoration:none;cursor:pointer}",
       ".mkt_installedHead{display:flex;align-items:center;gap:8px;width:100%;background:none;border:0;padding:0;margin:0;cursor:pointer;font:inherit;text-align:left}",
@@ -127,7 +130,11 @@ window.__ModuleLoader__.load({
         jobsRef.current = Object.assign({}, jobsRef.current, { [id]: { status: "running", spec: spec, output: "" } });
         setJobs(Object.assign({}, jobsRef.current));
       }, []);
-      return { jobs: jobs, track: track };
+      var clear = useCallback(function () {
+        jobsRef.current = {};
+        setJobs({});
+      }, []);
+      return { jobs: jobs, track: track, clear: clear };
     }
 
     // ── plugin verification badge ───────────────────────────────────────────
@@ -135,6 +142,9 @@ window.__ModuleLoader__.load({
     // dsh.bundle/dsh.client 声明，进程内缓存）。unknown 不显示徽章。
     function verifyBadge(verified) {
       if (verified === undefined || verified === null) return null;
+      if (verified.hostDeps !== undefined && verified.hostDeps.length > 0) {
+        return h("span", { className: "mkt_badge mkt_badgeBad", title: verified.hostDeps.join(", ") }, "宿主依赖风险");
+      }
       if (verified.kind === "bundle") return h("span", { className: "mkt_badge mkt_badgeOk" }, "宿主插件");
       if (verified.kind === "client") return h("span", { className: "mkt_badge mkt_badgeOk" }, "UI插件");
       if (verified.kind === "plain") return h("span", { className: "mkt_badge" }, "未声明");
@@ -181,7 +191,10 @@ window.__ModuleLoader__.load({
       var ids = Object.keys(props.jobs);
       if (ids.length === 0) return null;
       return h("div", { className: "mkt_card" },
-        h("p", { className: "mkt_panelTitle" }, "任务"),
+        h("div", { className: "mkt_panelRow" },
+          h("p", { className: "mkt_panelTitle" }, "任务"),
+          props.onClear ? h("span", { className: "mkt_link", onClick: props.onClear }, "清空") : null
+        ),
         ids.map(function (id) {
           var job = props.jobs[id];
           var done = job.status === "completed" || job.status === "failed" || job.status === "killed";
@@ -338,11 +351,16 @@ window.__ModuleLoader__.load({
       // 无限滚动：哨兵进入视口时拉下一页并追加。GitHub topic 的翻页间数据
       // 可能移动造成重复，按 fullName 去重；已显示数追上 total 即到底。
       var canLoadMore = results !== null && results.items.length < results.total && !reachedLimit;
+      var loadMoreLock = useRef(false);
       var loadMore = useCallback(function () {
         if (!canLoadMore || loading || loadingMore) return;
+        // 同一 tick 内 observer 可能连续触发两次，state 更新不阻塞闭包读值，
+        // 用 ref 做重入闸。
+        if (loadMoreLock.current) return;
         // 限流熔断：失败后 60s 内不再自动请求（哨兵重渲染会反复触发
         // IntersectionObserver，不熔断会连环 500 直到限流窗口过去）。
         if (Date.now() < retryAt) return;
+        loadMoreLock.current = true;
         setLoadingMore(true);
         call("search", { query: query, sort: sort, perPage: 20, page: page + 1 }).then(function (value) {
           if (value.truncated === true) { setReachedLimit(true); return; }
@@ -363,6 +381,7 @@ window.__ModuleLoader__.load({
           setError(errorText(e));
           setRetryAt(Date.now() + 60000);
         }).finally(function () {
+          loadMoreLock.current = false;
           setLoadingMore(false);
         });
       }, [call, canLoadMore, loading, loadingMore, page, query, sort, retryAt]);
@@ -393,6 +412,7 @@ window.__ModuleLoader__.load({
       var polling = useJobPolling(call, refreshInstalled);
       var track = polling.track;
       var jobs = polling.jobs;
+      var clearJobs = polling.clear;
 
       useEffect(function () {
         doSearch();
@@ -437,7 +457,12 @@ window.__ModuleLoader__.load({
           var tries = 0;
           var ping = setInterval(function () {
             tries++;
-            if (tries > 40) { clearInterval(ping); return; }
+            if (tries > 40) {
+              clearInterval(ping);
+              setRestarting(false);
+              setError("2 分钟内未检测到 dsh 重启完成，请手动检查 dsh 状态后刷新页面。");
+              return;
+            }
             rpc.call("/market", "installed", {}).then(function () {
               clearInterval(ping);
               window.location.reload();
@@ -472,16 +497,15 @@ window.__ModuleLoader__.load({
         refreshInstalled();
       }, [refreshInstalled]);
 
-      // 活动任务置顶（紧跟已装面板，点安装立刻看到进度）；全部静止后归档到底部当日志。
-      var jobsActive = false;
-      for (var jid in jobs) { if (jobs[jid] && jobs[jid].status === "running") { jobsActive = true; break; } }
-
+      // 任务面板位置固定（已装面板之后）：不随任务状态在顶部/底部之间
+      // 跳——npm 安装几秒即完成，"完成即落底"曾让结果凭空消失。
       // "只看已验证"开关下的可见项：verify 判定 bundle/client 的才算插件。
       // verifyPending：当前加载的仓库里还有未验证完的（verified map 尚未覆盖）。
       var visibleItems = results === null ? [] : results.items.filter(function (it) {
         if (verifiedOnly !== true) return true;
         var v = verified[it.fullName];
-        return v !== undefined && (v.kind === "bundle" || v.kind === "client");
+        return v !== undefined && (v.kind === "bundle" || v.kind === "client")
+          && !(v.hostDeps !== undefined && v.hostDeps.length > 0);
       });
       var verifyPending = results !== null && results.items.some(function (it) { return verified[it.fullName] === undefined; });
 
@@ -516,7 +540,7 @@ window.__ModuleLoader__.load({
         ),
         error ? h("div", { className: "mkt_error" }, error) : null,
         h(InstalledPanel, { installed: installed, removing: removing, updates: updates, onUninstall: doUninstall, onInstallSpec: doInstallSpec }),
-        jobsActive ? h(JobsPanel, { jobs: jobs }) : null,
+        h(JobsPanel, { jobs: jobs, onClear: clearJobs }),
         h("div", { className: "mkt_list" },
           results == null
             ? h("div", { className: "mkt_meta mkt_listHead" }, loading ? "正在加载最热插件…" : "—")
@@ -552,8 +576,7 @@ window.__ModuleLoader__.load({
                   ? h("div", { className: "mkt_loadMore", ref: sentinelRef }, loadingMore ? "加载中…" : Date.now() < retryAt ? "GitHub 限流中，稍后再下滑加载" : "下滑加载更多")
                   : h("div", { className: "mkt_loadMore" }, reachedLimit ? "已达 GitHub 搜索上限（前 1000 个结果）" : "已显示全部 " + results.items.length + " 个")
               )
-        ),
-        jobsActive ? null : h(JobsPanel, { jobs: jobs })
+        )
       );
     }
 

package/src/github.js

@@ -1,6 +1,8 @@
 // GitHub API helpers for the dsh plugin marketplace.
 // Pure functions with no harness imports, so this module is unit-testable
 // standalone (node src/github.js --self-test).
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
 
 const SEARCH_TOPIC = "topic:dsh-plugin";
 /** GitHub search never serves past the first 1000 results. */
@@ -116,34 +118,41 @@ export async function searchPlugins({ query, sort = "stars", perPage = 10, page
 // to the explicit github: spec).
 
 const NPM_REGISTRY = "https://registry.npmjs.org";
-const npmCache = new Map(); // name -> {latest, repositoryUrl} | null (unknown/not found)
+const npmCache = new Map(); // name -> {info, at} — null misses expire after 5 min
 
 /**
- * Look up a package on the npm registry (abbreviated metadata). Cached for
- * the process lifetime; null means "not on npm / unreachable".
+ * Look up a package on the npm registry (abbreviated metadata). Successful
+ * lookups cache for the process lifetime; "not found / unreachable" (null)
+ * expires after 5 minutes so a transient registry failure self-heals.
  */
 export async function npmPackageInfo(name) {
   const clean = String(name ?? "").trim();
   if (clean.length === 0 || !/^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/i.test(clean)) return null;
-  if (npmCache.has(clean)) return npmCache.get(clean);
+  const cached = npmCache.get(clean);
+  if (cached !== undefined && (cached.info !== null || Date.now() - cached.at < 300000)) return cached.info;
   let info = null;
   try {
-    const response = await fetch(`${NPM_REGISTRY}/${clean.replace("/", "%2F")}`, {
-      headers: { "User-Agent": "dsh-plugin-mall", Accept: "application/vnd.npm.install-v1+json" },
+    // 单版本端点返回 latest 的完整 manifest（dependencies + repository 都在）。
+    // abbreviated packument 不含 repository，防抢注比对会永远落空。
+    const response = await fetch(`${NPM_REGISTRY}/${clean.replace("/", "%2F")}/latest`, {
+      headers: { "User-Agent": "dsh-plugin-mall", Accept: "application/json" },
     });
     if (response.ok) {
       const body = await response.json();
-      const latest = body?.["dist-tags"]?.latest;
-      if (typeof latest === "string") {
-        const rawRepository = body?.repository;
+      if (typeof body?.version === "string") {
+        const rawRepository = body.repository;
         const repositoryUrl = typeof rawRepository === "string" ? rawRepository : rawRepository?.url;
-        info = { latest, repositoryUrl: typeof repositoryUrl === "string" ? repositoryUrl : undefined };
+        info = {
+          latest: body.version,
+          repositoryUrl: typeof repositoryUrl === "string" ? repositoryUrl : undefined,
+          hostDeps: hostShadowDependencies(body),
+        };
       }
     }
   } catch {
     info = null; // registry unreachable — caller falls back
   }
-  npmCache.set(clean, info);
+  npmCache.set(clean, { info, at: Date.now() });
   return info;
 }
 
@@ -166,7 +175,64 @@ export async function preferNpmSpec({ spec }) {
   return pointsBack ? declaredName : raw;
 }
 
-/** Loose semver-ish comparison: "0.2.10" vs "0.2.9" → 1. Non-numeric parts read as 0. */
+/**
+ * Refuse to install a package whose `dependencies` shadow host framework
+ * packages. Host copies inside a profile split module identities and crash
+ * all tool scheduling — the dsh contract is peerDependencies, but the host
+ * enforces nothing, so the marketplace is the last line of defense.
+ * Sources: registry abbreviated metadata for npm names, the verify cache
+ * (raw package.json) for github: specs.
+ */
+/**
+ * Extract the bare npm package name: "name", "name@version", "@s/n@version"
+ * → "name"/"@s/n". Returns null for anything that is not an npm name shape.
+ */
+function npmNameOf(raw) {
+  if (typeof raw !== "string" || raw.length === 0) return null;
+  if (raw.startsWith("@")) {
+    const match = /^(@[^/@\s]+\/[^/@\s]+?)(?:@[^/\s]+)?$/.exec(raw);
+    return match === null ? null : match[1];
+  }
+  const match = /^([^@\s]+?)(?:@[^/\s]+)?$/.exec(raw);
+  return match === null ? null : match[1];
+}
+
+export async function assertSafeToInstall({ spec }) {
+  const raw = String(spec ?? "");
+  let hostDeps;
+  if (/^(?:file:|link:)/i.test(raw)) {
+    // 本地路径直通：直接读它的 package.json 查 dependencies。
+    const dir = raw.replace(/^(?:file:|link:)/i, "").replace(/[\\/]+$/, "");
+    try {
+      const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+      hostDeps = hostShadowDependencies(pkg);
+    } catch {
+      return; // 读不到清单——pnpm 会给出真实错误，这里放行
+    }
+  } else if (/^github:([^/\s]+\/[^/\s]+?)(?:\.git)?(?:#.+)?$/i.test(raw)) {
+    const repo = /^github:([^/\s]+\/[^/\s]+?)(?:\.git)?(?:#.+)?$/i.exec(raw)[1];
+    const { results } = await verifyPlugins({ repos: [repo] });
+    hostDeps = results[repo]?.hostDeps;
+  } else if (/^https?:\/\//i.test(raw)) {
+    return; // 远程 tarball 下载前无法廉价检查；罕见路径，放行
+  } else {
+    // npm 名（含带版本形式）：剥掉 @version 再查。
+    const name = npmNameOf(raw);
+    if (name === null || name.length === 0) {
+      // 无法识别形状的 spec 一律拒绝，而不是静默跳过检查。
+      throw new Error(`cannot analyze install spec ${JSON.stringify(raw)} for host-shadow dependencies — refusing to install`);
+    }
+    const info = await npmPackageInfo(name);
+    hostDeps = info?.hostDeps;
+  }
+  if (hostDeps !== undefined && hostDeps !== null && hostDeps.length > 0) {
+    throw new Error(`${raw} declares ${hostDeps.length} host framework package(s) as dependencies (${hostDeps.slice(0, 3).join(", ")}${hostDeps.length > 3 ? ", …" : ""}) — installing it would duplicate host modules and crash dsh tool scheduling. Ask the plugin author to move @deepseek-ai/* to peerDependencies.`);
+  }
+}
+
+/** Loose semver-ish comparison: "0.2.10" vs "0.2.9" → 1. Non-numeric parts
+ *  read as 0; numerically equal versions where one carries a pre-release
+ *  segment ("-rc.1") sort below the plain release ("2.0.0-beta" < "2.0.0"). */
 export function compareVersions(a, b) {
   const pa = String(a ?? "").split(".");
   const pb = String(b ?? "").split(".");
@@ -175,6 +241,9 @@ export function compareVersions(a, b) {
     const nb = Number(pb[index]) || 0;
     if (na !== nb) return na < nb ? -1 : 1;
   }
+  const preA = String(a ?? "").includes("-");
+  const preB = String(b ?? "").includes("-");
+  if (preA !== preB) return preA ? -1 : 1;
   return 0;
 }
 // ── plugin verification (raw CDN, no API quota) ─────────────────────────────
@@ -222,15 +291,37 @@ async function fetchRawPackageJson(repo, signal) {
   throw lastError ?? new Error("no raw source reachable");
 }
 
+/**
+ * Framework packages the host provides via the profiles/node_modules fallback.
+ * A plugin declaring any of these as `dependencies` (instead of
+ * peerDependencies) installs real copies into the profile — the loader then
+ * holds two module instances, symbol identities split, and every tool call
+ * crashes with an undiagnosable "reading 'prepare'". See installer docs.
+ */
+const HOST_PACKAGES = /^(@deepseek-ai\/|cosmokit$|schemastery$)/;
+
+/** The @deepseek-ai/* (and cordis runtime) entries inside `dependencies`. */
+function hostShadowDependencies(pkg) {
+  if (pkg === undefined || typeof pkg !== "object") return undefined;
+  const deps = Object.keys(pkg.dependencies ?? {});
+  const host = deps.filter((name) => HOST_PACKAGES.test(name));
+  return host.length > 0 ? host : undefined;
+}
+
 /**
  * Verify repositories as real dsh plugins by their package.json declaration.
  * @param {{repos: string[], signal?: AbortSignal}} options - "owner/name" list.
- * @returns the {results} map: fullName -> {kind: "bundle"|"client"|"plain"|"no-manifest"|"unknown", name?, version?}.
+ * @returns the {results} map: fullName -> {kind: "bundle"|"client"|"plain"|"no-manifest"|"unknown", name?, version?, hostDeps?}.
  */
 export async function verifyPlugins({ repos, signal }) {
   const wanted = [...new Set((Array.isArray(repos) ? repos : []).map(String)
     .filter((repo) => /^[^/\s]+\/[^/\s]+$/.test(repo) && !repo.includes("..")))];
-  const pending = wanted.filter((repo) => !verifyCache.has(repo));
+  // "unknown"（网络失败）60s 后过期重试；成功结果进程内永久缓存。
+  const pending = wanted.filter((repo) => {
+    const cached = verifyCache.get(repo);
+    if (cached === undefined) return true;
+    return cached.kind === "unknown" && Date.now() - (cached.ts ?? 0) > 60000;
+  });
   let cursor = 0;
   const worker = async () => {
     while (cursor < pending.length) {
@@ -241,16 +332,21 @@ export async function verifyPlugins({ repos, signal }) {
           : typeof pkg.dsh?.bundle?.patch === "string" ? "bundle"
             : pkg.dsh?.client !== undefined ? "client"
               : "plain";
-        verifyCache.set(repo, { kind, name: pkg?.name, version: pkg?.version });
+        verifyCache.set(repo, { kind, name: pkg?.name, version: pkg?.version, hostDeps: hostShadowDependencies(pkg) });
       } catch (error) {
         if (error?.name === "AbortError") throw error;
-        verifyCache.set(repo, { kind: "unknown" });
+        verifyCache.set(repo, { kind: "unknown", ts: Date.now() });
       }
     }
   };
   await Promise.all(Array.from({ length: Math.min(VERIFY_CONCURRENCY, pending.length) }, worker));
   const results = {};
-  for (const repo of wanted) results[repo] = verifyCache.get(repo) ?? { kind: "unknown" };
+  for (const repo of wanted) {
+    const cached = verifyCache.get(repo);
+    results[repo] = cached === undefined || cached.ts !== undefined
+      ? { kind: cached?.kind ?? "unknown", name: cached?.name, version: cached?.version, hostDeps: cached?.hostDeps }
+      : cached;
+  }
   return { results };
 }
 

package/src/index.js

@@ -19,8 +19,8 @@ import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { spawn } from "node:child_process";
 import { resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
-import { repoInfo, searchPlugins, verifyPlugins, preferNpmSpec, npmPackageInfo, compareVersions } from "./github.js";
-import { ensureProfile, listInstalled, normalizeSpec, runInstall, runRemove, createJobTracker } from "./installer.js";
+import { repoInfo, searchPlugins, verifyPlugins, preferNpmSpec, npmPackageInfo, compareVersions, assertSafeToInstall } from "./github.js";
+import { ensureProfile, listInstalled, normalizeSpec, runInstall, runRemove, createJobTracker, assertSafeSpec } from "./installer.js";
 
 export const name = "@1e0zj/dsh-plugin-mall";
 export const inject = ["tools", "jobs", "systemPrompt"];
@@ -206,12 +206,20 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
       let spec;
       try {
         spec = normalizeSpec(payload?.spec);
+        assertSafeSpec(spec);
       } catch (error) {
         return rpcFail(error);
       }
       // npm tarball 优先（小而快、带 integrity）；registry 条目不同源的包名
       // 视为抢注，回退 github: 全仓库 spec。
       spec = await preferNpmSpec({ spec });
+      // 宿主依赖硬拦：dependencies 里拖着 @deepseek-ai/* 的包装进 profile
+      // 就是双模块实例 + 全工具调度崩溃（宿主无任何护栏，市场是最后防线）。
+      try {
+        await assertSafeToInstall({ spec });
+      } catch (error) {
+        return rpcFail(error);
+      }
       try {
         const profileDir = resolveProfileDir(profile);
         if (!existsSync(join(profileDir, "package.json"))) ensureProfile(profile);
@@ -229,6 +237,11 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
       const profile = String(payload?.profile ?? defaultProfile).trim();
       const packageName = String(payload?.package ?? "").trim();
       if (packageName.length === 0) return rpcFail(new Error("uninstall: package name is required"));
+      try {
+        assertSafeSpec(packageName);
+      } catch (error) {
+        return rpcFail(error);
+      }
       try {
         const profileDir = resolveProfileDir(profile);
         if (!existsSync(join(profileDir, "package.json"))) {
@@ -267,7 +280,7 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
         : `sleep 2 && ${relaunch}`;
       const child = spawn(launcher, { shell: true, detached: true, stdio: "ignore", cwd: process.cwd(), windowsHide: true });
       child.unref();
-      setTimeout(() => process.exit(0), 800);
+      setTimeout(() => process.exit(0), 1500);
       return rpcOk({ restarting: true });
     }
     case "jobCancel": {
@@ -418,7 +431,10 @@ export function apply(ctx, config = {}) {
     },
     async execute(args, exec) {
       const profile = String(args.profile ?? defaultProfile).trim();
-      const spec = await preferNpmSpec({ spec: normalizeSpec(args.spec) });
+      const normalized = normalizeSpec(args.spec);
+      assertSafeSpec(normalized);
+      const spec = await preferNpmSpec({ spec: normalized });
+      await assertSafeToInstall({ spec });
       let profileDir;
       try {
         profileDir = resolveProfileDir(profile);
@@ -473,6 +489,7 @@ export function apply(ctx, config = {}) {
       const profile = String(args.profile ?? defaultProfile).trim();
       const packageName = String(args.package ?? "").trim();
       if (packageName.length === 0) throw new Error("market_uninstall: package name is required");
+      assertSafeSpec(packageName);
       try {
         resolveProfileDir(profile);
       } catch (error) {

package/src/installer.js

@@ -361,6 +361,20 @@ export function createJobTracker() {
   };
 }
 
+// ── spec shape guard ────────────────────────────────────────────────────────
+
+// Windows spawn 走 shell，spec 会被拼进 cmd 行；agent 传入的参数不可信。
+// 合法的 npm 名 / github:owner\/repo / git·file·link·URL spec 都不含这些
+// shell 元字符——出现即拒绝，宁可误杀不放开命令注入面。
+const UNSAFE_SPEC_RE = /[;&|`$()<>^"!*\n\r]/;
+
+/** Reject install/remove specs carrying shell metacharacters. */
+export function assertSafeSpec(spec) {
+  if (UNSAFE_SPEC_RE.test(String(spec ?? ""))) {
+    throw new Error(`spec contains characters that are not allowed in an install spec: ${JSON.stringify(String(spec))}`);
+  }
+}
+
 // ── pnpm self-heal (corepack) ───────────────────────────────────────────────
 
 /**
@@ -565,10 +579,12 @@ export function runRemove({ profile, packageName }, selfHealed = false) {
     proc.on("close", (exitCode) => resolve({ exitCode, signal: proc.signalCode }));
   }).then(async (outcome) => {
     if (outcome.spawnError !== undefined) {
-      // pnpm 缺失时先 corepack 自愈一次再重试（重试在新 producer 里跑）。
+      // pnpm 缺失时先 corepack 自愈一次再重试（重试在新 producer 里跑，
+      // 这里必须返回它的 done outcome——返回 producer 本体会让 tracker
+      // 把成功任务记成 failed）。
       if (outcome.spawnError.code === "ENOENT" && selfHealed !== true) {
-        const healed = await enablePnpmViaCorepack(() => {});
-        if (healed) return runRemove({ profile, packageName }, true);
+        const healed = await enablePnpmViaCorepack(push);
+        if (healed) return await runRemove({ profile, packageName }, true).done;
       }
       const hint = outcome.spawnError.code === "ENOENT"
         ? "pnpm not found on PATH — install pnpm (e.g. `corepack enable pnpm`) to manage profile plugins"