@1e0zj/dsh-plugin-mall 0.2.1 → 0.3.1

package/README.md

@@ -234,6 +234,16 @@ node <profile>/node_modules/@1e0zj/dsh-plugin-mall/src/cli.js guard launch --pro
   （这行会出现在任务日志里）。更新检查读的是 registry 的 `/latest` 端点，
   不经过该策略，所以两边看到的「最新版本」本就可能不同。
   首次安装（卡片按钮）不带版本，沿用 pnpm 的策略默认值即可。
+- **启用 / 停用，不必卸载**：已装面板每行一个开关，关掉即刻卸载该插件的
+  fiber，重新打开时它、以及因依赖它而挂起的插件都会回来。三层落地：内存用
+  `entry.update({disabled})`；持久化改写 profile 的 `cordis.patch.yml`（保留
+  注释），由 dsh 自己的 `watchUserPatches` 事务性重放，所以重启后状态保持；
+  写入前自动备份到 `<profile>/backups/`（留最近 20 份）。
+  市场插件自身不给开关——停用了就没有界面再打开它。用户手写的
+  `disabled: !!js …` 条件表达式会被**拒绝接管**并提示手改：那是条件逻辑，
+  两态开关覆盖它等于把条件永久压成固定值。
+  （界面类插件的变化需要刷新页面才反映：浏览器那半边靠页面加载时注入的
+  启动清单，后端的开关立即生效，已加载的模块不会自行卸载。）
 - **一次点击一个任务，日志从第一毫秒开始流**：预检本身就是一个任务，点安装
   的瞬间就出现在面板里，隔离探针的 pnpm 输出实时写入——而不是让按钮干等几秒
   再冒出结果。预检通过后由安装任务接管同一条日志、撤掉预检条目，所以面板上

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1e0zj/dsh-plugin-mall",
-  "version": "0.2.1",
+  "version": "0.3.1",
   "description": "dsh 插件市场：搜索 GitHub dsh-plugin 话题下的插件仓库，一键安装到本地 dsh profile（agent 工具 + 设置页插件市场 tab）",
   "type": "module",
   "main": "src/index.js",

package/src/client.js

@@ -66,6 +66,12 @@ window.__ModuleLoader__.load({
       ".mkt_approveCmd{max-height:none;margin:0}",
       ".mkt_jobDone{display:flex;align-items:center;gap:8px;flex-wrap:wrap;margin-top:2px}",
       ".mkt_logBlock{display:flex;flex-direction:column;gap:4px;align-items:flex-start}",
+      ".mkt_depOff{opacity:.5;text-decoration:line-through}",
+      ".mkt_switch{position:relative;width:34px;height:18px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-secondary,#e5e7eb);cursor:pointer;padding:0;transition:background .15s,border-color .15s}",
+      ".mkt_switch:disabled{opacity:.55;cursor:default}",
+      ".mkt_switchOn{background:var(--dsw-alias-state-business-primary,#2b6cb0);border-color:transparent}",
+      ".mkt_switchKnob{position:absolute;top:1px;left:1px;width:14px;height:14px;border-radius:50%;background:#fff;transition:transform .15s;box-shadow:0 1px 2px rgba(0,0,0,.25)}",
+      ".mkt_switchOn .mkt_switchKnob{transform:translateX(16px)}",
       ".mkt_issueList{list-style:none;display:flex;flex-direction:column;gap:8px;margin:0;padding:0}",
       ".mkt_issue{border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:8px 10px;background:var(--dsw-alias-bg-secondary,#fff)}",
       ".mkt_issueBlock{border-color:var(--dsw-alias-state-error-primary)}",
@@ -176,6 +182,9 @@ window.__ModuleLoader__.load({
       // carryFromId：把上一阶段（预检）的日志接过来并撤掉它的条目。一次点击
       // 只应该在面板里留下一个任务，日志连续——而不是 market-1 预检、
       // market-2 安装两条并排，让人以为自己点了两次。
+      // 重试同理：同一 spec 上一轮失败/完成的终态条目一并撤掉——用户没点
+      // 「清空」就重试时，面板照样只留新一轮一条。旧失败日志不拼进新任务
+      // （两轮 pnpm 输出混在一起没法读）；running 的不动，那是真并发任务。
       var track = useCallback(function (id, spec, carryFromId) {
         var next = Object.assign({}, jobsRef.current);
         var carried = "";
@@ -183,6 +192,11 @@ window.__ModuleLoader__.load({
           carried = next[carryFromId].output || "";
           delete next[carryFromId];
         }
+        for (var key in next) {
+          if (key !== id && next[key] && next[key].spec === spec && next[key].status !== "running") {
+            delete next[key];
+          }
+        }
         next[id] = { status: "running", spec: spec, output: carried };
         jobsRef.current = next;
         setJobs(Object.assign({}, next));
@@ -338,6 +352,8 @@ window.__ModuleLoader__.load({
       );
     }
 
+    var MARKET_PACKAGE = "@1e0zj/dsh-plugin-mall";
+
     function jobKindLabel(kind) {
       if (kind === "dsh-plugin-preflight") return "预检 ";
       if (kind === "dsh-plugin-uninstall") return "卸载 ";
@@ -462,10 +478,23 @@ window.__ModuleLoader__.load({
             : h("div", { className: "mkt_depList" }, (installed.deps || []).map(function (dep) {
               var busy = (props.removing || {})[dep.name] === true;
               var upd = (props.updates || {})[dep.name];
+              var entry = (props.entries || {})[dep.name];
+              // 没在装配树里的依赖（普通依赖、或声明了 client 但没挂载的）
+              // 没有可切换的东西，不给开关。
+              var togglable = entry !== undefined && dep.name !== MARKET_PACKAGE;
+              var enabled = entry === undefined ? true : entry.enabled !== false;
+              var toggling = (props.toggling || {})[dep.name] === true;
               return h("div", { key: dep.name, className: "mkt_depRow" },
-                h("span", { className: "mkt_desc" }, dep.name + "@" + dep.version),
+                h("span", { className: "mkt_desc" + (enabled ? "" : " mkt_depOff") }, dep.name + "@" + dep.version),
                 h("span", { className: "mkt_depActions" },
-                  h("span", { className: "mkt_badge" }, kindLabel(dep.kind)),
+                  h("span", { className: "mkt_badge" }, enabled ? kindLabel(dep.kind) : "已停用"),
+                  togglable ? h("button", {
+                    className: "mkt_switch" + (enabled ? " mkt_switchOn" : ""),
+                    disabled: toggling,
+                    title: enabled ? "停用（立即生效，不卸载）" : "启用（立即生效）",
+                    "aria-pressed": enabled ? "true" : "false",
+                    onClick: function () { props.onToggle(dep.name, !enabled); },
+                  }, h("span", { className: "mkt_switchKnob" })) : null,
                   upd && upd.hasUpdate ? h("button", {
                     className: "mkt_btn mkt_btnSm",
                     onClick: function () { props.onInstallSpec(dep.name + "@" + upd.latest); },
@@ -506,6 +535,9 @@ window.__ModuleLoader__.load({
       var _removing = useState({});
       var removing = _removing[0];
       var setRemoving = _removing[1];
+      var _toggling = useState({});
+      var toggling = _toggling[0];
+      var setToggling = _toggling[1];
       var _page = useState(1);
       var page = _page[0];
       var setPage = _page[1];
@@ -631,6 +663,26 @@ window.__ModuleLoader__.load({
         return function () { observer.disconnect(); };
       }, [loadMore]);
 
+      // 启用/停用：热生效，不重启也不重装——所以成功后只刷新已装列表，
+      // 不提示重启，也不动任务面板（它不是一个需要看日志的长任务）。
+      var doToggle = useCallback(function (packageName, enabled) {
+        setToggling(function (prev) { return Object.assign({}, prev, { [packageName]: true }); });
+        setError(null);
+        call("togglePlugin", { package: packageName, enabled: enabled }).then(function (value) {
+          setInstalled(function (prev) {
+            return prev && !prev.error ? Object.assign({}, prev, { entries: value.entries }) : prev;
+          });
+        }).catch(function (e) {
+          setError(errorText(e));
+        }).finally(function () {
+          setToggling(function (prev) {
+            var next = Object.assign({}, prev);
+            delete next[packageName];
+            return next;
+          });
+        });
+      }, [call]);
+
       var refreshInstalled = useCallback(function () {
         call("installed", {}).then(function (value) {
           setInstalled(value);
@@ -828,7 +880,16 @@ window.__ModuleLoader__.load({
             "只看已验证插件")
         ),
         error ? h("div", { className: "mkt_error" }, error) : null,
-        h(InstalledPanel, { installed: installed, removing: removing, updates: updates, onUninstall: doUninstall, onInstallSpec: preflightAndInstall }),
+        h(InstalledPanel, {
+          installed: installed,
+          removing: removing,
+          updates: updates,
+          entries: installed && !installed.error ? installed.entries : undefined,
+          toggling: toggling,
+          onToggle: doToggle,
+          onUninstall: doUninstall,
+          onInstallSpec: preflightAndInstall,
+        }),
         h(JobsPanel, {
           jobs: jobs,
           onClear: function () {

package/src/guard.js

@@ -583,9 +583,9 @@ export function inspectRemoteCandidate({ profileDir, manifest, patchText, spec }
 }
 
 /** Locate a binary on PATH by explicit extension (no shell, no PATHEXT guessing). */
-function findOnPath(binary, extensions) {
-  const separator = process.platform === "win32" ? ";" : ":";
-  for (const dir of String(process.env.PATH ?? "").split(separator)) {
+function findOnPath(binary, { platform, pathEnv, extensions }) {
+  const separator = platform === "win32" ? ";" : ":";
+  for (const dir of String(pathEnv ?? "").split(separator)) {
     if (dir.length === 0) continue;
     for (const ext of extensions) {
       const candidate = join(dir, `${binary}${ext}`);
@@ -596,16 +596,32 @@ function findOnPath(binary, extensions) {
 }
 
 /**
- * pnpm spawn plan, mirroring installer.js pnpmSpawnPlan: a real .exe spawns
- * without a shell; only the .cmd shim forces a cmd wrapper on Windows
- * (shell:true, and Node's DEP0190 warning with it).
+ * How to spawn pnpm on this platform. installer.js consumes this too, so the
+ * plan lives here exactly once instead of as two drifting copies (the mirror
+ * copies had already diverged once; that is how the quoting bug below stayed
+ * invisible on both sides).
+ * @returns {{ command: string, shell: boolean, treeKill: boolean }}
+ *   treeKill marks the shell-wrapped case: cancel must taskkill /T the tree.
  */
-function pnpmSpawnPlan() {
-  if (process.platform !== "win32") return { command: "pnpm", shell: false };
-  const exe = findOnPath("pnpm", [".exe"]);
-  if (exe !== undefined) return { command: exe, shell: false };
-  const cmd = findOnPath("pnpm", [".cmd"]);
-  return { command: cmd ?? "pnpm", shell: true };
+export function pnpmSpawnPlan({ platform = process.platform, pathEnv = process.env.PATH } = {}) {
+  if (platform !== "win32") return { command: "pnpm", shell: false, treeKill: false };
+  // A real .exe spawns without a shell — cancel then kills pnpm itself.
+  const exe = findOnPath("pnpm", { platform, pathEnv, extensions: [".exe"] });
+  if (exe !== undefined) return { command: exe, shell: false, treeKill: false };
+  // Only the .cmd shim: Node refuses batch files with shell:false (EINVAL
+  // since the batch-file argument-injection fix), so a cmd wrapper is
+  // unavoidable — flag it so cancel kills the whole tree, not the wrapper.
+  const cmd = findOnPath("pnpm", { platform, pathEnv, extensions: [".cmd"] });
+  if (cmd === undefined) return { command: "pnpm", shell: true, treeKill: true };
+  // The shim usually sits in a directory with a space (`D:\Program Files\nodejs`
+  // is Node's default install layout). Under shell:true Node joins command and
+  // args with spaces WITHOUT quoting per argument — the same fact the
+  // UNSAFE_SPEC_RE comment below argues from — so an unquoted path is cut at
+  // the first space and cmd answers `'D:\Program' is not recognized`, killing
+  // every preflight and install on such machines. Quote the command ourselves;
+  // the args joined after it are fixed flags plus an assertSafeSpec-validated
+  // spec, none of which carry spaces.
+  return { command: `"${cmd}"`, shell: true, treeKill: true };
 }
 
 function spawnCapture(command, args, options, onOutput) {
@@ -641,7 +657,9 @@ function spawnCapture(command, args, options, onOutput) {
 // not only by the agent/browser callers that happen to check first: anything
 // carrying shell metacharacters, or a Windows `file:`/`link:` path with spaces,
 // is refused before a single byte of filesystem work and before pnpm is spawned.
-const UNSAFE_SPEC_RE = /[;&|`$()<>^"!*\n\r]/;
+// `%` is on the list like everywhere else: cmd performs `%VAR%` expansion, and
+// the expanded value (often full of spaces and semicolons) reshapes the argv.
+const UNSAFE_SPEC_RE = /[;&|`$()<>^%!"*\n\r]/;
 
 function assertSafeSpec(spec) {
   const value = String(spec ?? "");
@@ -1888,6 +1906,12 @@ async function selfTest() {
       if (rep.verdict !== "blocked" || !rep.issues.some((entry) => entry.code === "unsafe-spec")) {
         throw new Error("preflightInstall should reject a spec with shell metacharacters before spawning");
       }
+      // `%` 单独成案：它不是 POSIX 元字符，但 cmd 会做 %VAR% 展开，展开值
+      // 里的分号/空格足以重塑 argv——黑名单曾漏掉它，与 cli.js 漂移过。
+      const repPct = await preflightInstall({ profileDir: p, spec: "evil-pkg%PATH%" });
+      if (repPct.verdict !== "blocked" || !repPct.issues.some((entry) => entry.code === "unsafe-spec")) {
+        throw new Error("preflightInstall should reject a spec carrying cmd %VAR% expansion");
+      }
       if (process.platform === "win32") {
         const repWin = await preflightInstall({ profileDir: p, spec: "file:C:\\some dir\\pkg" });
         if (repWin.verdict !== "blocked" || !repWin.issues.some((entry) => entry.code === "unsafe-spec")) {
@@ -1906,6 +1930,36 @@ async function selfTest() {
       if (!args.includes("--ignore-scripts")) throw new Error("probe args must keep install scripts disabled");
     }
 
+    // pnpmSpawnPlan (pure, plus a real spawn on Windows): the .cmd shim path
+    // must carry its own quotes. Node's shell:true joins command and args
+    // without per-argument quoting, so `D:\Program Files\nodejs\pnpm.CMD`
+    // would be cut at the first space and cmd would answer
+    // `'D:\Program' is not recognized` — that exact failure blocked every
+    // preflight on a real machine (Node's default install layout has a space).
+    {
+      const shimRoot = join(root, "path with space");
+      mkdirSync(shimRoot, { recursive: true });
+      writeFileSync(join(shimRoot, "pnpm.cmd"), "@echo probe-ok\r\n");
+      const plan = pnpmSpawnPlan({ platform: "win32", pathEnv: shimRoot });
+      if (plan.shell !== true || plan.treeKill !== true || plan.command !== `"${join(shimRoot, "pnpm.cmd")}"`) {
+        throw new Error(`quoted .cmd plan expected, got ${JSON.stringify(plan)}`);
+      }
+      if (pnpmSpawnPlan({ platform: "linux", pathEnv: shimRoot }).command !== "pnpm") {
+        throw new Error("posix plan should spawn pnpm directly");
+      }
+      const noShim = pnpmSpawnPlan({ platform: "win32", pathEnv: join(root, "no-shim-here") });
+      if (noShim.command !== "pnpm" || noShim.shell !== true || noShim.treeKill !== true) {
+        throw new Error(`missing-shim fallback expected, got ${JSON.stringify(noShim)}`);
+      }
+      // 引用不是摆设：Windows 真机端到端 spawn 一轮（CI 是 Linux，只跑静态断言）。
+      if (process.platform === "win32") {
+        const probe = spawnSync(plan.command, ["--version"], { shell: plan.shell, encoding: "utf8", timeout: 15000 });
+        if (probe.status !== 0 || !/probe-ok/.test(probe.stdout ?? "")) {
+          throw new Error(`quoted shim must actually run: status=${probe.status} stdout=${JSON.stringify(probe.stdout)} stderr=${JSON.stringify(probe.stderr)}`);
+        }
+      }
+    }
+
     // Rollback reconcile args/env (pure): scripts off, the restored lockfile
     // authoritative, peer auto-install off, strictly offline — there is no
     // online retry path or args at all, and nothing user-controlled anywhere

package/src/index.js

@@ -24,11 +24,16 @@ import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
 import { resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
 import { repoInfo, searchPlugins, verifyPlugins, cachedRepoManifest, fetchRawFile, preferNpmSpec, npmPackageInfo, compareVersions, assertSafeToInstall, mapLimit, NETWORK_CONCURRENCY } from "./github.js";
-import { ensureProfile, listInstalled, normalizeSpec, runInstall, runRemove, assertSafeSpec, resolveRegistry, serializeCanonicalProof } from "./installer.js";
+import { ensureProfile, listInstalled, normalizeSpec, runInstall, runRemove, assertSafeSpec, resolveRegistry, serializeCanonicalProof, persistPluginDisabled } from "./installer.js";
 import { preflightInstall, inspectRemoteCandidate, recoverProfile } from "./guard.js";
 
 export const name = "@1e0zj/dsh-plugin-mall";
-export const inject = ["tools", "jobs", "systemPrompt"];
+// `loader` 用来读装配树、并对单个 entry 做热开关（entry.update）。读法照抄
+// 官方的 @deepseek-ai/dsh-host-plugin-inventory —— 它是只读投影
+// （"Read-only Remote projection of current Cordis Loader plugin state"），
+// 写入侧留白，正是这里补的位置。持久化不走 loader（见 togglePlugin 的说明）。
+// loader 必然存在——没有它我们根本加载不了。
+export const inject = ["tools", "jobs", "systemPrompt", "loader"];
 
 export const Config = z.object({
   defaultProfile: z.string().default("web"),
@@ -973,6 +978,53 @@ export function createJobTracker({ producerFactory } = {}) {
   };
 }
 
+/**
+ * Group the loader's mounted entries by the package that provides them, so a
+ * profile dependency can be shown (and toggled) as one row.
+ *
+ * One package can insert several rows, so `enabled` means EVERY row of that
+ * package is live — a half-disabled package is reported as disabled, and
+ * toggling acts on the whole set. Group rows are skipped, mirroring the
+ * official read-only projection in @deepseek-ai/dsh-host-plugin-inventory.
+ */
+export function loaderEntriesByPackage(ctx) {
+  const byPackage = {};
+  try {
+    for (const entry of ctx.loader.entries()) {
+      if (entry.options?.group) continue;
+      const moduleName = entry.options?.name;
+      if (typeof moduleName !== "string" || moduleName.length === 0) continue;
+      const bucket = byPackage[moduleName] ??= { entryIds: [], entries: [], enabled: true };
+      // 两个 id 必须分清：
+      //   entry.id        运行时全路径，父链拼出来的（`include:dsh-at-file`）
+      //   entry.options.id 配置文件里写的那个（`dsh-at-file`）
+      // patch 层的 id 定向覆盖按后者匹配（applyEntryPatches 从组装数据建
+      // entryMap，键是各 patch 声明的 id）。拿前者去写 patch，那条覆盖行
+      // 永远匹配不到目标，dsh 只会 warn 一句然后忽略——停用看着成功了，
+      // 重启后插件照常回来。
+      const configId = entry.options?.id;
+      bucket.entryIds.push(entry.id);
+      bucket.entries.push({ id: entry.id, configId, entry });
+      if (entry.disabled) bucket.enabled = false;
+    }
+  } catch {
+    /* loader 读不到就不给开关，安装/卸载照常可用 */
+  }
+  return byPackage;
+}
+
+/**
+ * The serializable half of loaderEntriesByPackage — live `entry` objects must
+ * never reach the RPC envelope (they carry the whole fiber graph).
+ */
+function serializableEntries(byPackage) {
+  const out = {};
+  for (const [moduleName, bucket] of Object.entries(byPackage)) {
+    out[moduleName] = { entryIds: bucket.entryIds, enabled: bucket.enabled };
+  }
+  return out;
+}
+
 /** Render one preflight issue as a compact line for model/error output. */
 function renderPreflightIssue(entry) {
   const badge = entry.severity === "block" ? "BLOCK" : "WARN";
@@ -1193,7 +1245,60 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
       } catch (error) {
         return rpcFail(new Error(`invalid profile: ${error.message}`));
       }
-      return rpcOk(listInstalled(profile));
+      // 带上每个依赖在装配树里的启用状态，浏览器据此渲染开关。
+      return rpcOk({ ...listInstalled(profile), entries: serializableEntries(loaderEntriesByPackage(ctx)) });
+    }
+    case "togglePlugin": {
+      // 启用/停用，三层（同 cynch18/plugin-switch 的做法）：
+      //   1. 内存 —— entry.update({disabled}) 立即 dispose/start 对应 fiber
+      //   2. 持久化 —— 文本改写用户的 cordis.patch.yml，由 dsh 自己的
+      //      watchUserPatches 事务性重放（启动时若无 HMR 会当场创建一个，
+      //      见 @deepseek-ai/dsh 的 profile-boot：ctx.loader.create(hmr) →
+      //      watchUserPatches(profile patch) + watchUserPatches(home patch)）
+      //   3. 保险 —— 写前备份到 <profile>/backups/，留最近 20 份
+      // 刻意不用 ctx.loader.update()：它的 tree.write() 写的是 cordis.yml，
+      // 那是组装产物；用户的选择该留在自己的 patch 层。
+      const profile = String(payload?.profile ?? defaultProfile).trim();
+      const packageName = String(payload?.package ?? "").trim();
+      const enabled = payload?.enabled === true;
+      if (packageName.length === 0) return rpcFail(new Error("togglePlugin: package name is required"));
+      if (packageName === name) {
+        // 停用市场自己 = 关掉正在操作的这个界面，之后只能手改配置文件才能回来。
+        return rpcFail(new Error("refusing to disable the marketplace itself — you would lose the UI needed to re-enable it"));
+      }
+      let profileDir;
+      try {
+        profileDir = resolveProfileDir(profile);
+      } catch (error) {
+        return rpcFail(new Error(`invalid profile: ${error.message}`));
+      }
+      const targets = loaderEntriesByPackage(ctx)[packageName]?.entries ?? [];
+      if (targets.length === 0) {
+        return rpcFail(new Error(`no loader entry found for ${packageName} — it may not be mounted in this profile`));
+      }
+      // 先持久化：patch 层写不了（!!js 表达式等）就整个放弃，不留下
+      // 「内存里关了、重启又回来」的错位状态。
+      const backups = [];
+      try {
+        for (const target of targets) {
+          // 用 options.id（配置文件里的 id），不是 entry.id（运行时全路径）。
+          if (typeof target.configId !== "string" || target.configId.length === 0) {
+            throw new Error(`${packageName} has a loader entry without a configured id — it cannot be targeted from the patch layer`);
+          }
+          const result = persistPluginDisabled(profileDir, target.configId, !enabled, packageName);
+          if (result.backup !== undefined) backups.push(result.backup);
+        }
+      } catch (error) {
+        return rpcFail(error);
+      }
+      try {
+        for (const target of targets) {
+          await target.entry.update({ disabled: enabled ? undefined : true });
+        }
+      } catch (error) {
+        return rpcFail(new Error(`${packageName} was written to the patch layer but the live toggle failed: ${error.message} — restart dsh to apply it`));
+      }
+      return rpcOk({ package: packageName, enabled, backups, entries: serializableEntries(loaderEntriesByPackage(ctx)) });
     }
     case "preflight": {
       // 预检本身做成 job：点击安装的瞬间任务就出现在面板里，探针的 pnpm
@@ -2235,6 +2340,39 @@ export async function runSelfTests() {
       "tracker rejection fixture 使用注入 producer，不触碰真实 profile",
       producerCalls === 1 && trackerSnapshot.status === "failed" && settledOutcome?.status === "failed",
     );
+
+    // ── 8. 启用/停用：装配树条目按包分组 ─────────────────────────────────
+    // 一个包可以插入多行，所以分组、以及「有一行停用就算整体停用」是这块最
+    // 容易写错的地方；group 行必须跳过（照 dsh-host-plugin-inventory 的读法）。
+    const fakeLoaderCtx = (entries) => ({ loader: { entries: () => entries } });
+    const grouped = loaderEntriesByPackage(fakeLoaderCtx([
+      { id: "e1", options: { name: "dsh-at-file" }, disabled: false },
+      { id: "e2", options: { name: "multi-row" }, disabled: false },
+      { id: "e3", options: { name: "multi-row" }, disabled: true },
+      { id: "g1", options: { name: "some-group", group: true }, disabled: false },
+      { id: "e4", options: {}, disabled: false },
+    ]));
+    check("单行包：分组并标记启用", grouped["dsh-at-file"]?.entryIds.length === 1 && grouped["dsh-at-file"].enabled === true);
+    check("多行包：合并为一项", grouped["multi-row"]?.entryIds.length === 2);
+    check("多行包有一行停用 → 整体判为停用", grouped["multi-row"]?.enabled === false);
+    check("group 行被跳过", grouped["some-group"] === undefined);
+    check("无名条目被跳过", Object.keys(grouped).length === 2);
+    check("loader 抛错时降级为空表，不拖垮已装列表", Object.keys(loaderEntriesByPackage({
+      loader: { entries: () => { throw new Error("loader unavailable"); } },
+    })).length === 0);
+
+    // entry.id 是运行时全路径（父链拼接，`include:dsh-at-file`），
+    // entry.options.id 才是配置文件里的 id（`dsh-at-file`）。patch 层的
+    // id 定向覆盖按后者匹配——用错了那条覆盖行永远命中不了目标，
+    // 停用看着成功、重启后插件照常回来（真实环境踩过）。
+    const prefixed = loaderEntriesByPackage(fakeLoaderCtx([
+      { id: "include:dsh-at-file", options: { id: "dsh-at-file", name: "dsh-at-file" }, disabled: false },
+    ]));
+    check("运行时 id 与配置 id 分别保留", prefixed["dsh-at-file"]?.entries[0].id === "include:dsh-at-file"
+      && prefixed["dsh-at-file"]?.entries[0].configId === "dsh-at-file");
+    check("configId 缺失时可被识别（调用方据此拒绝写 patch）", loaderEntriesByPackage(fakeLoaderCtx([
+      { id: "anon-1", options: { name: "no-id-pkg" }, disabled: false },
+    ]))["no-id-pkg"]?.entries[0].configId === undefined);
   } finally {
     rmSync(root, { recursive: true, force: true });
   }

package/src/installer.js

@@ -16,7 +16,7 @@ import { createHash } from "node:crypto";
 import { dump, load } from "js-yaml";
 import { DEFAULT_PROFILE_BUNDLES, PROFILE_TEMPLATES, initProfile, resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
 import { describeBuildScripts, npmNameOf } from "./github.js";
-import { commitPendingSnapshot, createProfileSnapshot, markPendingSnapshot, pnpmGuardEnv, rollbackPendingSnapshot } from "./guard.js";
+import { commitPendingSnapshot, createProfileSnapshot, markPendingSnapshot, pnpmGuardEnv, pnpmSpawnPlan, rollbackPendingSnapshot } from "./guard.js";
 
 // ── spec normalization ──────────────────────────────────────────────────────
 
@@ -368,6 +368,134 @@ export function removeClientRow(profileDir, packageName) {
   return { removed: true, rowId };
 }
 
+// ── enable / disable persistence ────────────────────────────────────────────
+//
+// Toggling a plugin is three layers, and only the middle one lives here:
+//   1. memory — `entry.update({disabled})` disposes/starts the fiber (index.js)
+//   2. persistence — rewrite the profile's cordis.patch.yml, replayed
+//      transactionally by dsh's own `watchUserPatches` (this file)
+//   3. safety — back the file up before every edit so a bad write is undoable
+//
+// Persistence deliberately does NOT go through `loader.update()` even though
+// that would write for us: its `tree.write()` targets `cordis.yml`, the
+// composed artifact. A user's choice belongs in the patch layer they own, not
+// baked into the thing composition regenerates. Same conclusion as
+// cynch18/plugin-switch, which spells it out in its header comment.
+
+/** A patch row's `disabled:` line, when it is a plain literal we may rewrite. */
+const DISABLED_LINE_RE = /^(\s*)disabled\s*:\s*(.*?)\s*$/;
+
+/**
+ * Text-level edit of one entry's `disabled` in a patch file, preserving every
+ * other byte (comments included — users hand-write this file).
+ *
+ * A profile's patch layer normally starts EMPTY (`[]`): plugins are mounted by
+ * the bundle layers, not by the user's file. So "no row for this id" is the
+ * common case, not an error — we append an id-targeted override row, which is
+ * exactly what the patch layer is for (dsh-app-boot's applyEntryPatches treats
+ * a non-insert row as "override these keys on the entry with this id", and
+ * warns on a `name` mismatch, so we pass `name` as a guard).
+ *
+ * @param content - current cordis.patch.yml text.
+ * @param entryId - the loader entry id whose row to edit.
+ * @param disabled - desired state.
+ * @param moduleName - the entry's module name, written alongside a NEW row so
+ *   dsh can detect a stale patch if the id is ever reused.
+ * @returns the new text, or undefined when it already reads that way.
+ * @throws when the row's `disabled` is a `!!js` expression.
+ */
+export function setPatchRowDisabled(content, entryId, disabled, moduleName) {
+  const lines = String(content ?? "").split("\n");
+  // 行尾允许跟注释：`- id: at-file   # 我的备注` 是用户会写的形状。
+  const idPattern = new RegExp(`^(\\s*)-?\\s*id\\s*:\\s*['"]?${entryId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}['"]?\\s*(?:#.*)?$`);
+  const rowIndex = lines.findIndex((line) => idPattern.test(line));
+  if (rowIndex === -1) {
+    // patch 层里还没有这一条——这是常态（profile 的 patch 层默认是空的 `[]`，
+    // 插件由 bundle 层挂载）。追加一条 id 定向覆盖行。
+    if (!disabled) return undefined; // 没有覆盖行 = 本来就是启用状态
+    const block = moduleName === undefined
+      ? `- id: ${entryId}\n  disabled: true\n`
+      : `- id: ${entryId}\n  name: '${moduleName}'\n  disabled: true\n`;
+    const trimmed = String(content ?? "").trim();
+    // 模板是注释 + `[]`，整体替换掉那个空数组；否则在末尾追加。
+    if (trimmed.endsWith("[]")) {
+      return `${trimmed.slice(0, trimmed.lastIndexOf("[]")).trimEnd()}\n${block}`.replace(/^\n/, "");
+    }
+    return `${trimmed.length === 0 ? "" : `${trimmed}\n`}${block}`;
+  }
+  const indent = (idPattern.exec(lines[rowIndex])[1] ?? "").length;
+  // 同一条目的后续行：缩进更深，或与 `- id:` 的内容对齐。遇到下一个条目/顶格即止。
+  let existing = -1;
+  for (let index = rowIndex + 1; index < lines.length; index++) {
+    const line = lines[index];
+    if (line.trim().length === 0) continue;
+    const lead = line.length - line.trimStart().length;
+    if (lead <= indent && /^\s*-\s/.test(line)) break; // 下一个条目
+    if (lead < indent) break;                          // 退出该块
+    const match = DISABLED_LINE_RE.exec(line);
+    if (match !== null) { existing = index; break; }
+  }
+  if (existing !== -1) {
+    const value = DISABLED_LINE_RE.exec(lines[existing])[2];
+    // 用户写的是条件逻辑（如「只在 Windows 上停用」）。我们的开关只有两态，
+    // 覆盖它等于把条件永久压成固定值，而且用户不会察觉——拒绝接管，让人手改。
+    if (value.startsWith("!!js")) {
+      throw new Error(`cannot toggle ${entryId}: its "disabled" is a !!js expression — edit cordis.patch.yml by hand`);
+    }
+    if ((value === "true") === disabled) return undefined; // 已是目标状态
+    lines[existing] = lines[existing].replace(DISABLED_LINE_RE, `$1disabled: ${disabled}`);
+    return lines.join("\n");
+  }
+  if (!disabled) return undefined; // 没有 disabled 行本就是启用状态
+  // 插在 id 行之后，缩进与 id 的内容列对齐。
+  lines.splice(rowIndex + 1, 0, `${" ".repeat(indent + 2)}disabled: true`);
+  return lines.join("\n");
+}
+
+/** Keep the most recent N backups of a profile file, oldest pruned first. */
+const PATCH_BACKUP_KEEP = 20;
+
+/**
+ * Snapshot cordis.patch.yml before editing it. The file is hand-editable and
+ * carries the user's own rows; a bad automated write must be undoable without
+ * reaching for git.
+ * @returns the backup path, or undefined when there was nothing to back up.
+ */
+export function backupProfilePatch(profileDir) {
+  const patchPath = join(profileDir, PROFILE_PATCH_FILENAME);
+  if (!existsSync(patchPath)) return undefined;
+  const dir = join(profileDir, "backups");
+  mkdirSync(dir, { recursive: true });
+  const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+  const target = join(dir, `cordis.patch.${stamp}.yml`);
+  writeFileSync(target, readFileSync(patchPath, "utf8"));
+  try {
+    const kept = readdirSync(dir).filter((entry) => /^cordis\.patch\..*\.yml$/.test(entry)).sort();
+    for (const stale of kept.slice(0, Math.max(0, kept.length - PATCH_BACKUP_KEEP))) {
+      rmSync(join(dir, stale), { force: true });
+    }
+  } catch {
+    /* 清理失败不该让切换失败 */
+  }
+  return target;
+}
+
+/**
+ * Persist a toggle into the profile's patch layer: back up, edit, write through
+ * the checked writer. dsh's own `watchUserPatches` replays the file
+ * transactionally, so this is also what makes the change survive a restart.
+ * @returns `{changed, backup?}`; `changed:false` means it already read that way.
+ */
+export function persistPluginDisabled(profileDir, entryId, disabled, moduleName) {
+  const patchPath = join(profileDir, PROFILE_PATCH_FILENAME);
+  const content = existsSync(patchPath) ? readFileSync(patchPath, "utf8") : "[]\n";
+  const next = setPatchRowDisabled(content, entryId, disabled, moduleName);
+  if (next === undefined) return { changed: false };
+  const backup = backupProfilePatch(profileDir);
+  writePatchChecked(patchPath, next);
+  return { changed: true, backup };
+}
+
 // ── build-script allow-listing ──────────────────────────────────────────────
 
 /** Extract package names from pnpm's "Ignored build scripts: ..." output. */
@@ -1004,8 +1132,10 @@ export function createJobTracker() {
 
 // Windows spawn 走 shell，spec 会被拼进 cmd 行；agent 传入的参数不可信。
 // 合法的 npm 名 / github:owner\/repo / git·file·link·URL spec 都不含这些
-// shell 元字符——出现即拒绝，宁可误杀不放开命令注入面。
-const UNSAFE_SPEC_RE = /[;&|`$()<>^"!*\n\r]/;
+// shell 元字符——出现即拒绝，宁可误杀不放开命令注入面。`%` 在列：cmd 会
+// 做 `%VAR%` 环境变量展开，展开结果常含分号/空格，足以改变参数切分。
+// （cli.js 的同款黑名单一直含 %，此前三处已经漂移。）
+const UNSAFE_SPEC_RE = /[;&|`$()<>^%!"*\n\r]/;
 
 /** Reject install/remove specs carrying shell metacharacters. */
 export function assertSafeSpec(spec) {
@@ -1130,36 +1260,11 @@ function serializedProducer(lockKey, start) {
 // (a .cmd shim cannot be spawned with shell:false on modern Node), cancel
 // terminates the whole process tree and the done chain waits for the
 // wrapper's 'close' before any rollback runs.
-
-/** First `binary<ext>` found on PATH, or undefined. */
-function findOnPath(binary, { platform, pathEnv, extensions }) {
-  const separator = platform === "win32" ? ";" : ":";
-  for (const dir of String(pathEnv ?? "").split(separator)) {
-    if (dir.length === 0) continue;
-    for (const ext of extensions) {
-      const candidate = join(dir, `${binary}${ext}`);
-      if (existsSync(candidate)) return candidate;
-    }
-  }
-  return undefined;
-}
-
-/**
- * How to spawn pnpm on this platform.
- * @returns {{ command: string, shell: boolean, treeKill: boolean }}
- *   treeKill marks the shell-wrapped case: cancel must taskkill /T the tree.
- */
-function pnpmSpawnPlan({ platform = process.platform, pathEnv = process.env.PATH } = {}) {
-  if (platform !== "win32") return { command: "pnpm", shell: false, treeKill: false };
-  // A real .exe spawns without a shell — cancel then kills pnpm itself.
-  const exe = findOnPath("pnpm", { platform, pathEnv, extensions: [".exe"] });
-  if (exe !== undefined) return { command: exe, shell: false, treeKill: false };
-  // Only the .cmd shim: Node refuses batch files with shell:false (EINVAL
-  // since the batch-file argument-injection fix), so a cmd wrapper is
-  // unavoidable — flag it so cancel kills the whole tree, not the wrapper.
-  const cmd = findOnPath("pnpm", { platform, pathEnv, extensions: [".cmd"] });
-  return { command: cmd ?? "pnpm", shell: true, treeKill: true };
-}
+//
+// The plan itself is pnpmSpawnPlan in guard.js (imported above) — one
+// implementation, not a local mirror. It quotes the .cmd path: Node's
+// shell:true joins without per-argument quoting, and `D:\Program Files\…`
+// would be cut at the first space (`'D:\Program' is not recognized`).
 
 /**
  * Terminate a shell-wrapped process tree (Windows): taskkill /T /F kills the
@@ -1923,6 +2028,17 @@ async function runTransactionFixtures() {
   const tick = () => new Promise((resolve) => setTimeout(resolve, 1));
   const flush = async (rounds = 5) => { for (let index = 0; index < rounds; index++) await tick(); };
 
+  // 纯函数前置：spec 黑名单。`%` 必须在内——cmd 的 %VAR% 展开元字符，
+  // 展开值里的分号/空格足以重塑 argv；三处黑名单曾漂移（cli.js 一直有，
+  // installer/guard 漏过）。
+  {
+    const rejects = (value) => {
+      try { assertSafeSpec(value); return false; } catch { return true; }
+    };
+    check("assertSafeSpec：cmd 的 %VAR% 展开元字符被拒绝", rejects("evil-pkg%PATH%"));
+    check("assertSafeSpec：正常 spec 不受影响", !rejects("some-plugin@1.0.0") && !rejects("github:owner/repo"));
+  }
+
   // 0. hashPackageTree 确定性与符号链接越界防御
   {
     const tempDir = mkdtempSync(join(tmpdir(), "dsh-mall-selftest-hash-"));
@@ -2439,7 +2555,9 @@ async function runTransactionFixtures() {
   }
 
   // 4a. spawn 计划（纯函数）：非 Windows 无 shell；Windows 有 .exe 则
-  // shell:false，仅 .cmd 则 shell:true + treeKill，全找不到回退 "pnpm"。
+  // shell:false，仅 .cmd 则 shell:true + treeKill 且 command 自带引号
+  // （.cmd 常在 `D:\Program Files\nodejs` 这类带空格的目录里，shell:true 下
+  // Node 只拼空格不逐参数引用，不引用就从空格截断），全找不到回退 "pnpm"。
   {
     const shimDir = mkdtempSync(join(tmpdir(), "dsh-mall-selftest-path-"));
     try {
@@ -2449,15 +2567,36 @@ async function runTransactionFixtures() {
       const missingOk = planMissing.command === "pnpm" && planMissing.shell === true && planMissing.treeKill === true;
       writeFileSync(join(shimDir, "pnpm.cmd"), "@echo off\r\n");
       const planCmd = pnpmSpawnPlan({ platform: "win32", pathEnv: shimDir });
-      const cmdOk = planCmd.command === join(shimDir, "pnpm.cmd") && planCmd.shell === true && planCmd.treeKill === true;
+      const cmdOk = planCmd.command === `"${join(shimDir, "pnpm.cmd")}"` && planCmd.shell === true && planCmd.treeKill === true;
       writeFileSync(join(shimDir, "pnpm.exe"), "MZ");
       const planExe = pnpmSpawnPlan({ platform: "win32", pathEnv: shimDir });
       const exeOk = planExe.command === join(shimDir, "pnpm.exe") && planExe.shell === false && planExe.treeKill === false;
       check(
-        "pnpmSpawnPlan：posix 直起 / win32 优先 .exe 无 shell / 仅 .cmd 则 treeKill",
+        "pnpmSpawnPlan：posix 直起 / win32 优先 .exe 无 shell / 仅 .cmd 则带引号 + treeKill",
         posixOk && missingOk && cmdOk && exeOk,
         JSON.stringify({ planPosix, planMissing, planCmd, planExe }),
       );
+      // 空格目录不是假想敌：Node 默认装进 Program Files，真实机器上命令从
+      // 空格截断曾让「'D:\Program' 不是内部或外部命令」拦下所有预检。
+      const spaceDir = join(shimDir, "dir with space");
+      mkdirSync(spaceDir, { recursive: true });
+      writeFileSync(join(spaceDir, "pnpm.cmd"), "@echo probe-ok\r\n");
+      const planSpace = pnpmSpawnPlan({ platform: "win32", pathEnv: spaceDir });
+      check(
+        "pnpmSpawnPlan：带空格的 .cmd 路径 → command 自带引号",
+        planSpace.shell === true && planSpace.command === `"${join(spaceDir, "pnpm.cmd")}"`,
+        JSON.stringify(planSpace),
+      );
+      // 引用必须真的可跑：Windows 真机端到端 spawn 一轮假 shim（CI 是 Linux，
+      // 只跑静态断言；Windows 上这一条覆盖完整链路）。
+      if (process.platform === "win32") {
+        const probe = spawnSync(planSpace.command, ["--version"], { shell: planSpace.shell, encoding: "utf8", timeout: 15000 });
+        check(
+          "pnpmSpawnPlan：带引号 command 真实 spawn 不再被空格截断",
+          probe.status === 0 && /probe-ok/.test(probe.stdout ?? ""),
+          `status=${probe.status} stdout=${JSON.stringify((probe.stdout ?? "").slice(0, 80))} stderr=${JSON.stringify((probe.stderr ?? "").slice(0, 80))}`,
+        );
+      }
     } finally {
       rmSync(shimDir, { recursive: true, force: true });
     }
@@ -2492,9 +2631,76 @@ async function runTransactionFixtures() {
   return failed;
 }
 
+/**
+ * The patch-layer edit behind enable/disable. Text surgery on a file users
+ * hand-write, so every shape it can meet is pinned here.
+ */
+function runToggleFixtures() {
+  let failed = 0;
+  const check = (label, ok, extra = "") => {
+    if (!ok) failed++;
+    console.log(`  ${ok ? "PASS" : "FAIL"} ${label}${ok ? "" : `  ${extra}`}`);
+  };
+  // 真实环境里 patch 层默认就是这个样子——注释 + 空数组。插件由 bundle 层
+  // 挂载，用户文件里一条都没有。第一版只测了「行已存在」的情形，于是停用
+  // 被静默跳过、重启后插件又回来了。这组用例先钉死这个场景。
+  const stockTemplate = "# Your patch layer for this dsh profile\n[]\n";
+  const fresh = setPatchRowDisabled(stockTemplate, "at-file", true, "dsh-at-file");
+  check("空 patch 层（模板 []）→ 追加 id 定向覆盖行", /- id: at-file/.test(fresh ?? "") && /disabled: true/.test(fresh ?? ""), JSON.stringify(fresh));
+  check("空 patch 层：替换掉 [] 而不是留着", !/\[\]/.test(fresh ?? ""), JSON.stringify(fresh));
+  check("空 patch 层：保留原有注释", (fresh ?? "").includes("# Your patch layer"));
+  check("新建行带 name 便于 dsh 校验陈旧 patch", /name: 'dsh-at-file'/.test(fresh ?? ""));
+  check("空 patch 层 + 要启用 → 不改动", setPatchRowDisabled(stockTemplate, "at-file", false, "dsh-at-file") === undefined);
+  check("新建的行能被 YAML 解析且是数组", (() => {
+    try { return Array.isArray(load(fresh)); } catch { return false; }
+  })());
+  check("新建行的语义正确（id + disabled）", (() => {
+    try { const doc = load(fresh); return doc[0].id === "at-file" && doc[0].disabled === true; } catch { return false; }
+  })());
+
+  const base = "- id: at-file\n  name: dsh-at-file\n";
+
+  const off = setPatchRowDisabled(base, "at-file", true);
+  check("无 disabled 行 → 插入 disabled: true", /^\s{2}disabled: true$/m.test(off ?? ""), JSON.stringify(off));
+  check("插入后其余字节不变", (off ?? "").includes("name: dsh-at-file"));
+
+  const on = setPatchRowDisabled(`- id: at-file\n  name: dsh-at-file\n  disabled: true\n`, "at-file", false);
+  check("已停用 → 改回 false", /disabled: false/.test(on ?? ""), JSON.stringify(on));
+
+  check("已是目标状态 → 不改动", setPatchRowDisabled(`- id: at-file\n  disabled: true\n`, "at-file", true) === undefined);
+  check("本就启用且要启用 → 不改动", setPatchRowDisabled(base, "at-file", false) === undefined);
+  check("条目不在 patch 层 → 追加新行，原有条目不动", (() => {
+    const out = setPatchRowDisabled(base, "other-id", true, "pkg-other");
+    return /- id: other-id/.test(out ?? "") && (out ?? "").includes("- id: at-file");
+  })());
+
+  // 用户写的条件逻辑不能被两态开关压平——必须拒绝并让人手改。
+  let threw = false;
+  try { setPatchRowDisabled(`- id: at-file\n  disabled: !!js process.platform === 'win32'\n`, "at-file", false); }
+  catch (error) { threw = /!!js expression/.test(error.message); }
+  check("disabled 是 !!js 表达式 → 拒绝接管", threw);
+
+  // 注释是用户手写的，一个字节都不能动。
+  const commented = "# 我的覆盖\n- id: at-file   # 保留这个注释\n  name: dsh-at-file\n";
+  const kept = setPatchRowDisabled(commented, "at-file", true);
+  check("注释原样保留", (kept ?? "").includes("# 我的覆盖") && (kept ?? "").includes("# 保留这个注释"));
+
+  // 多条目：只动目标那条，相邻条目不受影响。
+  const multi = "- id: a\n  name: pkg-a\n- id: at-file\n  name: dsh-at-file\n- id: z\n  name: pkg-z\n  disabled: true\n";
+  const one = setPatchRowDisabled(multi, "at-file", true);
+  check("多条目：只动目标条目", (one ?? "").split("disabled: true").length - 1 === 2 && (one ?? "").includes("- id: z"));
+  check("多条目：不误伤相邻条目的 disabled", setPatchRowDisabled(multi, "a", true)?.includes("- id: z\n  name: pkg-z\n  disabled: true") === true);
+
+  check("带引号的 id 也能匹配", setPatchRowDisabled(`- id: '@scope/pkg'\n  name: x\n`, "@scope/pkg", true) !== undefined);
+  return failed;
+}
+
 if (process.argv[1]?.endsWith("installer.js") && process.argv.includes("--self-test")) {
+  console.log("启用/停用 patch 层 fixtures:");
+  const toggleFailed = runToggleFixtures();
+  console.log();
   console.log("allowBuilds 合并 fixtures:");
-  const failed = runAllowBuildsFixtures();
+  const failed = runAllowBuildsFixtures() + toggleFailed;
   console.log(`${ALLOW_BUILDS_FIXTURES.length - failed}/${ALLOW_BUILDS_FIXTURES.length} passed`);
   // 实装 pnpm add 的参数/环境（纯函数）：peer 自动安装必须关闭，否则
   // marketplace 安装会把 @deepseek-ai 宿主依赖栈拉进 profile；构建脚本必须