@1e0zj/dsh-plugin-mall 0.3.4 → 0.3.5

package/README.md

@@ -47,6 +47,13 @@ Restart dsh after installing.
 > spec (recipe in the 安装 section below). Do not hand-overwrite files under
 > `node_modules`: they are hard-linked into pnpm's global store, and any later
 > `pnpm add/remove` rebuilds the tree and restores them anyway.
+>
+> Re-packing and running `add` again does **nothing**: the `file:` spec and the
+> version are unchanged, so pnpm calls it already installed and never compares
+> the tarball's bytes. The command succeeds, `package.json` looks right, and
+> `node_modules` still holds the previous build. Always `remove` before `add`,
+> or give the test build its own version. Then restart dsh completely — the
+> install ran inside the host process still executing the old code.
 
 ## Startup protection (guard CLI)
 
@@ -183,7 +190,16 @@ dsh plugin --profile web add link:C:\path\to\dsh-plugin-mall
 > ```
 >
 > 这样 pnpm 的规范副本本身就是新代码，后续任何 `pnpm add/remove` 重建依赖树都不会
-> 把它换掉；顺带还验证了 `files` 字段没漏文件。改完代码重新 `npm pack` + 重装即可。
+> 把它换掉；顺带还验证了 `files` 字段没漏文件。
+>
+> **`remove` 那一步不能省。** 改完代码重新 `npm pack` 之后只跑 `add`，pnpm 会
+> **什么都不做**：spec（`file:` 路径）和版本号都没变，它就判定「已经装好了」而
+> 跳过，根本不去比对 tarball 的字节。表现是命令成功返回、`package.json` 看着也
+> 对，但 `node_modules` 里还是上一版代码——排查时极难想到这一层。要么每次都
+> `remove` + `add`，要么给测试包换一个版本号（如 `0.3.5-test.1`）。
+>
+> 同理，**装完必须完整重启 dsh**（不是刷新页面）：卸载/安装是由**正在运行的那个
+> 宿主进程**执行的，它内存里跑的还是旧代码。新装的代码要下一次启动才生效。
 >
 > **不要用直接覆盖 `node_modules` 里文件的办法。** 它有两个坑：
 > 一是 pnpm 装出来的文件是**硬链接**（与全局 store 共享 inode），直接 `cp` 覆盖会

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1e0zj/dsh-plugin-mall",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "dsh 插件市场：搜索 GitHub dsh-plugin 话题下的插件仓库，一键安装到本地 dsh profile（agent 工具 + 设置页插件市场 tab）",
   "type": "module",
   "main": "src/index.js",

package/src/installer.js

@@ -16,7 +16,7 @@ import { createHash } from "node:crypto";
 import { dump, load } from "js-yaml";
 import { DEFAULT_PROFILE_BUNDLES, PROFILE_TEMPLATES, initProfile, resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
 import { describeBuildScripts, npmNameOf } from "./github.js";
-import { clearPendingApprovalPause, commitPendingSnapshot, createProfileSnapshot, markPendingApprovalPause, markPendingSnapshot, pausedCandidateBeforeState, pendingApprovalPaused, pnpmGuardEnv, pnpmSpawnPlan, readValidatedPendingSnapshot, rollbackPendingSnapshot } from "./guard.js";
+import { clearPendingApprovalPause, commitPendingSnapshot, createProfileSnapshot, describeRollbackRebuild, markPendingApprovalPause, markPendingSnapshot, pausedCandidateBeforeState, pendingApprovalPaused, pnpmGuardEnv, pnpmSpawnPlan, readValidatedPendingSnapshot, rollbackPendingSnapshot, validateInstalledProfile, validateRemoveCompletion } from "./guard.js";
 
 // ── spec normalization ──────────────────────────────────────────────────────
 
@@ -93,12 +93,34 @@ function writeJsonChecked(filePath, nextContent, label) {
 function writePatchChecked(filePath, nextContent) {
   return writeChecked(filePath, nextContent, (text) => {
     const doc = load(text);
-    if (doc !== null && doc !== undefined && !Array.isArray(doc)) {
-      throw new Error("expected a top-level array of patch entries");
+    // null/undefined 曾被放行——那是一个只剩注释的文档，我们的校验说它没问题，
+    // 而 dsh 的 parsePatchList 明确 `if (!Array.isArray(parsed)) throw ... must
+    // be a top-level YAML array`，于是 profile 写完就起不来。写后回读校验的全部
+    // 意义是「写出去的东西消费方能吃」，判据必须和消费方一致，不能更宽松。
+    if (!Array.isArray(doc)) {
+      throw new Error("expected a top-level array of patch entries (dsh refuses to boot on anything else, including a comments-only file)");
     }
   }, "cordis.patch.yml");
 }
 
+/**
+ * Serialize a patch file back after rows were spliced out.
+ *
+ * A file that keeps its header comments but loses every entry parses as `null`,
+ * not `[]` — and dsh refuses to boot on it. So the empty result has to carry an
+ * explicit `[]`, exactly like the stock template does.
+ *
+ * @param lines - the remaining lines after splicing.
+ * @returns the text to write.
+ */
+function serializePatchLines(lines) {
+  const next = lines.join("\n").replace(/\n{3,}/g, "\n\n").trim();
+  if (next.length === 0) return "[]\n";
+  // 还有条目就原样保留；一条不剩（只余注释）必须补回空数组。
+  const hasEntries = next.split("\n").some((line) => /^\s*-\s/.test(line));
+  return hasEntries ? `${next}\n` : `${next}\n[]\n`;
+}
+
 // ── profile management ──────────────────────────────────────────────────────
 
 /** Resolve and initialize (on first use) the target profile directory. */
@@ -131,6 +153,23 @@ function isBundlePackage(packageName, profileDir) {
   return classifyPackage(packageName, profileDir) === "bundle";
 }
 
+/**
+ * The version of `packageName` as it exists in the profile right now, or
+ * undefined when it is absent or its manifest is unreadable. Transitive
+ * packages count: the build gate is about what is on disk, not about what the
+ * profile declares.
+ */
+export function installedVersionOf(packageName, profileDir) {
+  const path = packageJsonPathOf(packageName, profileDir);
+  if (path === undefined) return undefined;
+  try {
+    const version = JSON.parse(readFileSync(path, "utf8"))?.version;
+    return typeof version === "string" && version.length > 0 ? version : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * Classify an installed package by its `dsh` declaration:
  * `bundle` (a profile patch layer), `client` (a browser-side UI plugin),
@@ -382,11 +421,74 @@ export function removeClientRow(profileDir, packageName) {
     break;
   }
   if (!removed) return { removed: false };
-  const next = lines.join("\n").replace(/\n{3,}/g, "\n\n").trim();
-  writePatchChecked(patchPath, next.length === 0 ? "[]\n" : `${next}\n`);
+  writePatchChecked(patchPath, serializePatchLines(lines));
   return { removed: true, rowId };
 }
 
+/**
+ * Drop the enable/disable override rows this profile holds for `packageName`.
+ *
+ * Uninstall has cleaned up the *insert* row it writes for browser plugins since
+ * it existed (v0.1.17). The enable/disable feature arrived three days later
+ * (v0.3.0) and introduced a second kind of row — an id-targeted override —
+ * which nothing ever removed. Uninstalling a plugin you had toggled therefore
+ * left a row pointing at an entry that no longer exists, and dsh warns about it
+ * on every boot: `patch: entry "x" not found`.
+ *
+ * The warning is the mild half. The row also **comes back to life on reinstall**
+ * — a plugin uninstalled while disabled returns disabled, looking installed and
+ * doing nothing, with no visible reason.
+ *
+ * Only rows in exactly the shape {@link setPatchRowDisabled} writes are removed:
+ * an id, our `name` guard, and a literal boolean `disabled`. Anything else is
+ * the user's own content and stays, warning and all —
+ *
+ *   - `disabled: !!js …` is a condition they wrote (see setPatchRowDisabled,
+ *     which refuses to overwrite it for the same reason). The package is gone,
+ *     but the expression is still theirs.
+ *   - a row carrying `config:` or other keys means more than a toggle.
+ *
+ * A leftover warning costs a line of console noise. Deleting user configuration
+ * silently costs something we cannot give back.
+ *
+ * @param profileDir - the profile whose patch layer to edit.
+ * @param packageName - the module name in the rows' `name:` guard.
+ * @returns the entry ids whose rows were removed.
+ */
+export function removeToggleRows(profileDir, packageName) {
+  const patchPath = join(profileDir, PROFILE_PATCH_FILENAME);
+  if (!existsSync(patchPath)) return { removed: [] };
+  const content = readFileSync(patchPath, "utf8");
+  // 文件坏了就整个不碰——和 mergeAllowBuilds 同样的态度：只会越弄越糟。
+  try {
+    load(content);
+  } catch {
+    return { removed: [] };
+  }
+  const lines = content.split("\n");
+  const quoted = `'${packageName}'`;
+  const removed = [];
+  // 从后往前删，前面的下标才不会被影响。
+  for (let index = lines.length - 3; index >= 0; index--) {
+    const idMatch = /^-\s+id:\s*(\S+)\s*$/.exec(lines[index]);
+    if (idMatch === null) continue;
+    const nameMatch = /^\s{2}name:\s*(\S+)\s*$/.exec(lines[index + 1]);
+    if (nameMatch === null) continue;
+    if (nameMatch[1] !== quoted && nameMatch[1] !== packageName) continue;
+    // 第三行必须是字面量布尔的 disabled，且第四行不能还属于这一条——
+    // 多一个键就说明这行不只是个开关，留给用户。
+    if (!/^\s{2}disabled:\s*(?:true|false)\s*$/.test(lines[index + 2])) continue;
+    // 这一条不能还有别的内容。额外键必然是缩进的（`  config:`），而顶格的
+    // 注释或下一条 `- ` 不属于它——把注释当成额外键会让这行永远删不掉。
+    if (/^\s+\S/.test(lines[index + 3] ?? "")) continue;
+    lines.splice(index, 3);
+    removed.unshift(idMatch[1]);
+  }
+  if (removed.length === 0) return { removed: [] };
+  writePatchChecked(patchPath, serializePatchLines(lines));
+  return { removed };
+}
+
 // ── enable / disable persistence ────────────────────────────────────────────
 //
 // Toggling a plugin is three layers, and only the middle one lives here:
@@ -641,12 +743,51 @@ export function mergeAllowBuilds(content, names) {
 }
 
 /**
- * Neutralize allowBuilds in pnpm-workspace.yaml so that all lifecycle scripts
- * are strictly blocked by pnpm on the initial install.
+ * Split an allowBuilds key into its package name and the spec pnpm matched it
+ * by, if the key carries one. `node-pty` → name only; `node-pty@1.1.0` and
+ * `pkg@file:../pkg` → name plus spec. Mirrors the selector parsing in
+ * {@link parseIgnoredBuilds}, because these two have to agree on what a key
+ * refers to or an approval will be preserved against the wrong package.
+ */
+function splitBuildSelector(key) {
+  const text = String(key ?? "");
+  const suffix = /@(?:([\w.+-]+)|https?:\/\/\S+|file:\S+|link:\S+|github:\S+)$/.exec(text);
+  if (suffix === null) return NPM_NAME_RE.test(text) ? { name: text } : undefined;
+  const name = text.slice(0, suffix.index);
+  return NPM_NAME_RE.test(name) ? { name, spec: text.slice(suffix.index + 1) } : undefined;
+}
+
+/**
+ * Neutralize allowBuilds in pnpm-workspace.yaml so that pnpm strictly blocks
+ * the lifecycle scripts of everything this transaction introduces.
+ *
+ * The property being defended is narrow: a package that is NEW to this install
+ * must not run scripts on the strength of an approval the user gave to some
+ * earlier package. Wiping the whole allow-list enforced that — and also
+ * re-blocked packages that were already installed and already approved, which
+ * had nothing to do with the install in flight. Installing an unrelated plugin
+ * then re-asked about, say, `node-pty` pulled in months ago by a different
+ * plugin, with the disclosure card correctly but uselessly reporting it as "a
+ * transitive dependency — NOT the package you asked for".
+ *
+ * That is worse than noise. An approval prompt that fires on every install for
+ * a package the user never chose is the fastest way to train people to approve
+ * without reading, which is the entire value of the gate.
+ *
+ * So preserve exactly the approvals that cannot cover anything new: a package
+ * already on disk, still at the version it was approved at. Bare-name keys are
+ * pinned to the installed version on the way in (`node-pty` →
+ * `node-pty@1.1.0`), so the same transaction pulling a DIFFERENT version of an
+ * approved package still meets a closed gate. Anything whose installed version
+ * cannot be established is dropped — fail closed, the user is asked again.
+ *
  * @param content - current pnpm-workspace.yaml contents.
+ * @param resolveInstalledVersion - `(name) => version | undefined` for what is
+ *   on disk right now; omitted (tests, callers without a profile) drops every
+ *   approval, which is the old all-or-nothing behaviour.
  * @returns the neutralized workspace yaml.
  */
-export function neutralizeWorkspaceContent(content) {
+export function neutralizeWorkspaceContent(content, resolveInstalledVersion) {
   const source = typeof content === "string" ? content : DEFAULT_WORKSPACE_YAML;
   let parsed;
   try {
@@ -658,12 +799,46 @@ export function neutralizeWorkspaceContent(content) {
   if (typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error("pnpm-workspace.yaml root must be a mapping");
   }
-  parsed.allowBuilds = {};
+  parsed.allowBuilds = preserveInstalledApprovals(parsed.allowBuilds, resolveInstalledVersion);
   parsed.onlyBuiltDependencies = [];
   parsed.dangerouslyAllowAllBuilds = false;
   return dump(parsed, { lineWidth: -1, noRefs: true, sortKeys: false });
 }
 
+/**
+ * The subset of `current` that provably cannot authorize anything new, keyed by
+ * the selector pnpm will match. See {@link neutralizeWorkspaceContent}.
+ */
+function preserveInstalledApprovals(current, resolveInstalledVersion) {
+  if (typeof resolveInstalledVersion !== "function") return {};
+  const approvedKeys = Array.isArray(current)
+    ? current.map((entry) => String(entry))
+    : current !== null && typeof current === "object"
+      ? Object.entries(current).filter(([, value]) => value === true).map(([key]) => key)
+      : [];
+  const preserved = {};
+  for (const key of approvedKeys) {
+    const parsedKey = splitBuildSelector(key);
+    if (parsedKey === undefined) continue;
+    let installed;
+    try {
+      installed = resolveInstalledVersion(parsedKey.name);
+    } catch {
+      continue; // 读不出来就当没批准过——失败方向朝「再问一次」
+    }
+    if (typeof installed !== "string" || installed.length === 0) continue;
+    if (parsedKey.spec === undefined) {
+      // 裸名：钉到当前已装版本，别让同一次事务换上来的新版本蹭到。
+      preserved[`${parsedKey.name}@${installed}`] = true;
+    } else if (parsedKey.spec === installed) {
+      preserved[key] = true;
+    }
+    // 非 registry 的 selector（file:/link:/github:）对不上已装版本号，
+    // 无法证明它只覆盖眼下这一份，一律丢弃重问。
+  }
+  return preserved;
+}
+
 /** Enable exactly the selectors pnpm itself reported while every broad build
  * policy switch stays disabled. The caller restores these temporary bytes as
  * soon as the rebuild process closes. */
@@ -1516,10 +1691,17 @@ function runInstallInner({ profile, spec, allowBuildScripts, approvedProof, pref
   }
 
   // Neutralize existing allowBuilds before every first pnpm add so strict-dep-builds
-  // always blocks candidate lifecycle scripts regardless of pre-existing workspace policy.
+  // blocks the lifecycle scripts of everything this transaction introduces,
+  // regardless of pre-existing workspace policy. Approvals for packages already
+  // on disk are pinned to their installed version and kept — they cannot cover
+  // anything new, and re-asking about them on every unrelated install is how a
+  // consent gate gets trained into a reflex. See neutralizeWorkspaceContent.
   try {
     if (originalWorkspaceBytes !== undefined) {
-      const neutralized = neutralizeWorkspaceContent(originalWorkspaceBytes.toString("utf8"));
+      const neutralized = neutralizeWorkspaceContent(
+        originalWorkspaceBytes.toString("utf8"),
+        (name) => installedVersionOf(name, profileDir),
+      );
       writeYamlChecked(workspacePath, neutralized, "pnpm-workspace.yaml");
     } else {
       writeYamlChecked(workspacePath, DEFAULT_WORKSPACE_YAML, "pnpm-workspace.yaml");
@@ -1725,7 +1907,24 @@ function runInstallInner({ profile, spec, allowBuildScripts, approvedProof, pref
     return { status: "failed", detail: `pnpm add ${spec} still failed after allowing build scripts (exit code ${retryOutcome.exitCode}). See job output.` };
   };
 
-  const first = spawnAdd();
+  // spawn 也可能**同步**抛（无效参数、平台细节）。此刻 marker 已写下，且
+  // pnpm-workspace.yaml 正停在被中和的状态——异常若绕过下面的 .catch 冒出去，
+  // restoreOriginalWorkspace() 永远不会执行。那不只是遗留一个 marker：启动
+  // 恢复看到 profile 校验通过就会 commit 并删掉快照，用户的 allowBuilds 批准
+  // 就此永久丢失。所以这里必须自己接住并走完整的收尾。
+  let first;
+  try {
+    first = spawnAdd();
+  } catch (error) {
+    restoreOriginalWorkspace();
+    const detail = `could not start pnpm: ${error?.message ?? String(error)}`;
+    try {
+      rollbackPendingSnapshot(profileDir);
+      return { cancel: () => {}, done: Promise.resolve({ status: "failed", detail: `${detail}; the profile was restored to its pre-install state` }), readOutput: () => deltaQueue.splice(0).join("") };
+    } catch (rollbackError) {
+      return { cancel: () => {}, done: Promise.resolve({ status: "failed", detail: `${detail}; rollback also failed and the pending marker was kept for recovery: ${rollbackError.message}` }), readOutput: () => deltaQueue.splice(0).join("") };
+    }
+  }
   current = first;
   const done = first.done
     .then((outcome) => settle(outcome))
@@ -1862,14 +2061,69 @@ function runRemoveInner({ profile, packageName, _profileDir, _spawn }, selfHeale
   };
   let current = undefined;
 
+  // Snapshot + pending marker, exactly as an install does.
+  //
+  // `pnpm remove` was treated as atomic here, and it is not: a real removal
+  // deleted node_modules/<pkg>, then failed writing pnpm-lock.yaml (EPERM on
+  // Windows — the rename target was held by another process) and exited
+  // nonzero. This function reported "failed" and returned, leaving a profile
+  // whose package.json still declared the package as a bundle layer while its
+  // directory was gone. dsh then refused to boot at all: resolveBundleDir
+  // throws while composing the profile, which happens BEFORE any plugin — so
+  // the startup recovery inside apply() could never have run either, and no
+  // marker existed for it to act on regardless.
+  //
+  // The install path has carried this protection from the start, and so has
+  // `guard remove` in the CLI. Only this one, the path the marketplace UI and
+  // the agent tool both use, was left outside it.
+  let snapshot;
+  try {
+    snapshot = createProfileSnapshot(profileDir, { operation: "remove", packageName });
+  } catch (error) {
+    return failedNow(`cannot snapshot profile "${profile}" before removing ${packageName}: ${error.message} — refusing to touch the profile`);
+  }
+  try {
+    markPendingSnapshot(snapshot, { operation: "remove", candidate: { name: packageName } });
+  } catch (error) {
+    rmSync(snapshot.dir, { recursive: true, force: true });
+    return failedNow(`cannot register the remove pending marker for ${packageName}: ${error.message} — refusing to touch the profile`);
+  }
+
+  /** Restore the pre-remove bytes and settle the marker; never throws. */
+  const rollbackRemove = (reason) => {
+    try {
+      const rolled = rollbackPendingSnapshot(profileDir);
+      if (rolled === undefined) {
+        // marker 不见了（外部删除、或本轮压根没登记成功）——没有还原目标，
+        // 就绝不能声称已还原。说实话比说好听重要：用户据此决定要不要手工检查。
+        return { status: "failed", detail: `${reason}; no pending marker was found, so the profile could NOT be restored automatically — check it before the next start (\`dsh-plugin-guard guard validate --profile ${profile}\`)` };
+      }
+      const rebuild = describeRollbackRebuild(rolled.rebuild);
+      return { status: "failed", detail: `${reason}; the profile was restored to its pre-remove state${rebuild === undefined ? "" : ` (node_modules rebuild — ${rebuild})`}` };
+    } catch (rollbackError) {
+      // 回滚失败时**保留 marker**：磁盘状态未知，交给启动恢复/`guard recover`，
+      // 绝不能声称已还原。
+      return { status: "failed", detail: `${reason}; rollback also failed and the pending marker was kept for recovery: ${rollbackError.message}` };
+    }
+  };
+
   const plan = _spawn === undefined ? pnpmSpawnPlan() : { command: "pnpm", shell: false, treeKill: false };
-  const proc = (_spawn ?? spawn)(plan.command, ["remove", packageName, "--reporter=append-only"], {
-    cwd: profileDir,
-    env: process.env,
-    shell: plan.shell,
-    stdio: ["ignore", "pipe", "pipe"],
-    windowsHide: true,
-  });
+  // spawn 也可能**同步**抛（无效参数、平台细节），而 marker 此刻已经写下了。
+  // 不接住的话异常会绕过 rollbackRemove 直接冒到 serializedProducer，marker
+  // 留在盘上挡住这个 profile 后续所有安装和卸载，直到下次启动恢复收拾它。
+  let proc;
+  try {
+    proc = (_spawn ?? spawn)(plan.command, ["remove", packageName, "--reporter=append-only"], {
+      cwd: profileDir,
+      env: process.env,
+      shell: plan.shell,
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true,
+    });
+  } catch (error) {
+    const settled = rollbackRemove(`could not start pnpm: ${error?.message ?? String(error)}`);
+    return { cancel: () => {}, done: Promise.resolve(settled), readOutput: () => deltaQueue.splice(0).join("") };
+  }
   current = { proc, treeKill: plan.treeKill };
   const done = new Promise((resolve) => {
     proc.on("error", (error) => resolve({ spawnError: error }));
@@ -1881,31 +2135,58 @@ function runRemoveInner({ profile, packageName, _profileDir, _spawn }, selfHeale
       // outcome，返回 producer 本体会让 tracker 把成功任务记成 failed）。
       if (outcome.spawnError.code === "ENOENT" && selfHealed !== true) {
         const healed = await enablePnpmViaCorepack(push);
-        if (healed) return await runRemoveInner({ profile, packageName, _profileDir, _spawn }, true).done;
+        // 重试前先把本轮的事务状态收掉——否则重试那一轮会被自己的 marker 挡住。
+        // 收不掉就不许重试：递归只会撞上自己的 marker 并返回笼统的「有未了结
+        // 事务」，把真正的回滚错因盖掉，而那正是用户需要看到的东西。
+        if (healed) {
+          try {
+            rollbackPendingSnapshot(profileDir);
+          } catch (rollbackError) {
+            return { status: "failed", detail: `pnpm was missing and corepack enabled it, but clearing this remove's pending marker failed, so the retry was not attempted: ${rollbackError.message}. The marker was kept for recovery (restart dsh, or run \`dsh-plugin-guard guard recover\`).` };
+          }
+          return await runRemoveInner({ profile, packageName, _profileDir, _spawn }, true).done;
+        }
       }
       const hint = outcome.spawnError.code === "ENOENT"
         ? "pnpm not found on PATH — install pnpm (e.g. `corepack enable pnpm`) to manage profile plugins"
         : `could not start pnpm: ${outcome.spawnError.message}`;
-      return { status: "failed", detail: hint };
+      return rollbackRemove(hint);
     }
     if (outcome.exitCode === null) {
-      return { status: "killed", detail: outcome.signal ? `signal: ${outcome.signal}` : "killed before exit" };
+      // 取消也要还原：pnpm 可能已经删掉了 node_modules 里的目录。
+      const killed = rollbackRemove(outcome.signal ? `signal: ${outcome.signal}` : "killed before exit");
+      return { ...killed, status: "killed" };
     }
     if (outcome.exitCode !== 0) {
-      return { status: "failed", detail: `pnpm remove ${packageName} failed (exit code ${outcome.exitCode}). See job output.` };
+      return rollbackRemove(`pnpm remove ${packageName} failed (exit code ${outcome.exitCode}). See job output.`);
     }
     // 卸完后的对账（bundle 列表、client 行）抛错也必须落成 terminal failed，
     // 不能让 done 拒绝。
     try {
       const bundles = reconcileBundles(profileDir, beforeDeps);
       const clientRow = removeClientRow(profileDir, packageName);
+      // 启用/停用留下的覆盖行也要一起带走——否则它会在重装时复活。
+      const toggleRows = removeToggleRows(profileDir, packageName);
+      // 退出码 0 不等于卸干净了。落盘校验用的是启动恢复同一套判据：
+      // profile 整体仍然自洽，且这个包确实从清单和装配层里消失了。任何一条
+      // 不过就还原——一个「装着但坏」的 profile 比一个没卸掉的插件糟得多。
+      const profileCheck = validateInstalledProfile(profileDir);
+      const removeCheck = validateRemoveCompletion(profileDir, packageName);
+      if (!profileCheck.ok || !removeCheck.ok) {
+        const blockers = [...profileCheck.issues, ...removeCheck.issues]
+          .filter((entry) => entry.severity === "block")
+          .map((entry) => entry.title);
+        return rollbackRemove(`pnpm remove ${packageName} exited 0 but the profile did not validate afterwards${blockers.length > 0 ? `: ${blockers.join("; ")}` : ""}`);
+      }
+      commitPendingSnapshot(profileDir);
       const notes = [`bundle layer(s) now: ${bundles.join(", ") || "none (template only)"}`];
       if (clientRow.removed) notes.push(`removed client loader row "${clientRow.rowId}" from cordis.patch.yml`);
+      if (toggleRows.removed.length > 0) notes.push(`removed enable/disable row(s) ${toggleRows.removed.map((id) => `"${id}"`).join(", ")} from cordis.patch.yml`);
       return { status: "completed", detail: `removed ${packageName} from profile "${profile}" — ${notes.join("; ")}. Restart dsh for the change to take effect.` };
     } catch (error) {
-      return { status: "failed", detail: `pnpm removed ${packageName} but post-remove reconciliation failed: ${error?.message ?? String(error)}` };
+      return rollbackRemove(`pnpm removed ${packageName} but post-remove reconciliation failed: ${error?.message ?? String(error)}`);
     }
-  }).catch((error) => ({ status: "failed", detail: `remove of ${packageName} hit an internal error: ${error?.message ?? String(error)}` }));
+  }).catch((error) => rollbackRemove(`remove of ${packageName} hit an internal error: ${error?.message ?? String(error)}`));
   proc.stdout?.on("data", (data) => push(data.toString()));
   proc.stderr?.on("data", (data) => push(data.toString()));
 
@@ -2014,6 +2295,102 @@ function runAllowBuildsFixtures() {
     if (!ok && out !== undefined) console.log(`       产出:\n${out.split("\n").map((l) => `       | ${l}`).join("\n")}`);
     if (!ok && error !== undefined) console.log(`       抛错: ${error.message}`);
   }
+  failed += runNeutralizeFixtures();
+  return failed;
+}
+
+// ── neutralizeWorkspaceContent：保留哪些批准 ────────────────────────────────
+//
+// 实测确定的 pnpm 11 行为，这组用例建立在它之上：
+//   - allowBuilds 里 registry 包用裸名或 `name@version` 都能放行；
+//   - `file:`/`link:` 依赖只认 pnpm 自己的完整 selector，裸名无效；
+//   - allowBuilds 被清空后，pnpm 会重新报树里**任何**带脚本的包，
+//     哪怕这次安装跟它毫无关系 —— 这正是 node-pty 反复弹窗的来源。
+//
+// 所以这里钉的是范围：已装且版本未变的批准要留下（并钉上版本），
+// 其余一律丢弃。丢弃的方向是「再问一次」，永远不是「默默放行」。
+const NEUTRALIZE_FIXTURES = [
+  {
+    label: "已装且已批准（裸名）→ 保留，并钉到已装版本",
+    content: "packages:\n  - .\nallowBuilds:\n  node-pty: true\n",
+    installed: { "node-pty": "1.1.0" },
+    check: (d) => d.allowBuilds["node-pty@1.1.0"] === true && d.allowBuilds["node-pty"] === undefined,
+  },
+  {
+    label: "已装且已批准（带版本且一致）→ 原样保留",
+    content: "packages:\n  - .\nallowBuilds:\n  'node-pty@1.1.0': true\n",
+    installed: { "node-pty": "1.1.0" },
+    check: (d) => d.allowBuilds["node-pty@1.1.0"] === true,
+  },
+  {
+    label: "批准的版本与已装版本不符 → 丢弃（升级必须重新批准）",
+    content: "packages:\n  - .\nallowBuilds:\n  'node-pty@1.0.0': true\n",
+    installed: { "node-pty": "1.1.0" },
+    check: (d) => Object.keys(d.allowBuilds).length === 0,
+  },
+  {
+    label: "批准过但树里没有 → 丢弃（新引入的同名包不许蹭）",
+    content: "packages:\n  - .\nallowBuilds:\n  node-pty: true\n",
+    installed: {},
+    check: (d) => Object.keys(d.allowBuilds).length === 0,
+  },
+  {
+    label: "序列形态的 allowBuilds 同样按已装版本钉住",
+    content: "packages:\n  - .\nallowBuilds:\n  - 'node-pty'\n  - 'esbuild'\n",
+    installed: { "node-pty": "1.1.0" },
+    check: (d) => d.allowBuilds["node-pty@1.1.0"] === true && Object.keys(d.allowBuilds).length === 1,
+  },
+  {
+    label: "值不是 true 的未决占位符 → 不算批准",
+    content: "packages:\n  - .\nallowBuilds:\n  node-pty: set this to true or false\n",
+    installed: { "node-pty": "1.1.0" },
+    check: (d) => Object.keys(d.allowBuilds).length === 0,
+  },
+  {
+    label: "file: selector 无法与版本号对应 → 丢弃重问",
+    content: "packages:\n  - .\nallowBuilds:\n  'pkg@file:../pkg': true\n",
+    installed: { pkg: "1.0.0" },
+    check: (d) => Object.keys(d.allowBuilds).length === 0,
+  },
+  {
+    label: "不传解析器 → 退回全清（老行为，绝不放宽）",
+    content: "packages:\n  - .\nallowBuilds:\n  node-pty: true\n",
+    installed: undefined,
+    check: (d) => Object.keys(d.allowBuilds).length === 0,
+  },
+  {
+    label: "解析器抛错 → 当作没批准过",
+    content: "packages:\n  - .\nallowBuilds:\n  node-pty: true\n",
+    resolver: () => { throw new Error("node_modules unreadable"); },
+    check: (d) => Object.keys(d.allowBuilds).length === 0,
+  },
+  {
+    label: "两个广义开关始终关闭",
+    content: "packages:\n  - .\ndangerouslyAllowAllBuilds: true\nonlyBuiltDependencies:\n  - anything\n",
+    installed: { "node-pty": "1.1.0" },
+    check: (d) => d.dangerouslyAllowAllBuilds === false && Array.isArray(d.onlyBuiltDependencies) && d.onlyBuiltDependencies.length === 0,
+  },
+  {
+    label: "其余键原样保留（不碰用户的别的设置）",
+    content: "packages:\n  - .\nnodeLinker: hoisted\nminimumReleaseAgeExclude:\n  - 'a@1.0.0'\nallowBuilds:\n  node-pty: true\n",
+    installed: { "node-pty": "1.1.0" },
+    check: (d) => d.nodeLinker === "hoisted" && d.minimumReleaseAgeExclude[0] === "a@1.0.0",
+  },
+];
+
+function runNeutralizeFixtures() {
+  let failed = 0;
+  for (const fx of NEUTRALIZE_FIXTURES) {
+    const resolver = fx.resolver ?? (fx.installed === undefined ? undefined : (name) => fx.installed[name]);
+    let ok;
+    try {
+      ok = fx.check(load(neutralizeWorkspaceContent(fx.content, resolver))) === true;
+    } catch {
+      ok = false;
+    }
+    if (!ok) failed++;
+    console.log(`  ${ok ? "PASS" : "FAIL"} neutralize: ${fx.label}`);
+  }
   return failed;
 }
 
@@ -2443,47 +2820,124 @@ async function runTransactionFixtures() {
     }
   }
 
-  // 1d. 攻击防御：profile 预先存在的 allowBuilds: true 无法绕过首次审批警告
-  {
+  // 1d. 攻击防御：预先存在的 allowBuilds 不能替**新东西**盖章。
+  //
+  // 这条原本断言的是「任何预先存在的 allowBuilds 一律不认」。那个范围太宽：
+  // 它同时把「早已落盘、早已批准、这次根本没动」的包也重新拦下，于是装任何
+  // 不相干的插件都会为 node-pty 之类的传递依赖再弹一次审批卡。一个每次安装
+  // 都因为你没选的包而弹的同意框，训练出来的是无脑点同意——恰好摧毁这道闸
+  // 在它本职场景里的作用。
+  //
+  // 所以守的边界改成：**盖章只对「此刻就在盘上、且这次装完还是同一份」的包
+  // 有效**。下面两条钉住它拦得住的、一条钉住它该放行的；三条都同时验证两个
+  // 广义开关被强制关闭、事后恢复用户原本的 workspace 字节。
+  // 时序很要紧：neutralize 在 pnpm 跑之前决定放行名单，那一刻本次事务要装的
+  // 东西还没落盘。所以「新包」在决策点上就是「盘上没有」，这两条照这个时序
+  // 模拟——由 scriptedSpawn 的 beforeExit 扮演 pnpm 把包装上去。
+  const preexistingAllowCases = [
+    {
+      label: "本次新引入的包 → 预先盖的章无效，仍触发审批闸",
+      preinstalled: undefined,           // 决策点上盘里没有
+      reported: "evil-script-pkg@1.0.0", // pnpm 装完后报的
+      landed: "1.0.0",
+      expectPins: {},                    // 章被丢弃
+    },
+    {
+      label: "已批准的包被本次升级 → 旧章只钉住旧版本，新版本仍被拦",
+      preinstalled: "1.0.0",             // 决策点上是 1.0.0，章有效
+      reported: "evil-script-pkg@1.1.0", // 但装上来的是 1.1.0
+      landed: "1.1.0",
+      expectPins: { "evil-script-pkg@1.0.0": true },
+    },
+  ];
+  for (const testCase of preexistingAllowCases) {
     const { profileDir, cleanup } = makeTempProfile("bypass-preexisting-allow");
     try {
       const initialWs = "packages:\n  - .\n\nallowBuilds:\n  evil-script-pkg: true\nonlyBuiltDependencies:\n  - evil-script-pkg\ndangerouslyAllowAllBuilds: true\n\nnodeLinker: hoisted\n";
       writeFileSync(join(profileDir, "pnpm-workspace.yaml"), initialWs);
       materializeFakePackage(profileDir, "some-plugin", "1.0.0");
-      materializeFakePackage(profileDir, "evil-script-pkg", "1.0.0", { postinstall: "node evil.js" });
+      if (testCase.preinstalled !== undefined) {
+        materializeFakePackage(profileDir, "evil-script-pkg", testCase.preinstalled, { postinstall: "node evil.js" });
+      }
 
       let firstProbeWorkspace;
       const { spawnFn, calls } = scriptedSpawn([
         {
           code: 0,
-          out: "Ignored build scripts: evil-script-pkg@1.0.0\n",
+          out: `Ignored build scripts: ${testCase.reported}\n`,
           beforeExit: () => {
             firstProbeWorkspace = load(readFileSync(join(profileDir, "pnpm-workspace.yaml"), "utf8"));
+            // pnpm 此刻把包落盘（新装或升级），披露据此计算。
+            materializeFakePackage(profileDir, "evil-script-pkg", testCase.landed, { postinstall: "node evil.js" });
           },
         },
       ]);
-      const producer = runInstall({
+      const outcome = await runInstall({
         profile: "p",
         spec: "some-plugin",
         preflight: preflightStub("some-plugin"),
         _profileDir: profileDir,
         _spawn: spawnFn,
         _describe: describeStub,
-      });
-      const outcome = await producer.done;
+      }).done;
       const finalWs = readFileSync(join(profileDir, "pnpm-workspace.yaml"), "utf8");
       check(
-        "攻击防御：预先存在的 allowBuilds 在首轮被中和 → 依然触发审批闸，且事后恢复用户原本的 workspace 字节",
+        `攻击防御：${testCase.label}（且两个广义开关强制关闭、事后恢复原字节）`,
         outcome.status === "failed"
           && Array.isArray(outcome.needsApproval)
           && outcome.needsApproval.some((e) => e.name === "evil-script-pkg")
           && calls.length === 1
-          && Object.keys(firstProbeWorkspace?.allowBuilds ?? {}).length === 0
+          && JSON.stringify(firstProbeWorkspace?.allowBuilds) === JSON.stringify(testCase.expectPins)
           && Array.isArray(firstProbeWorkspace?.onlyBuiltDependencies)
           && firstProbeWorkspace.onlyBuiltDependencies.length === 0
           && firstProbeWorkspace?.dangerouslyAllowAllBuilds === false
           && finalWs === initialWs,
-        `status=${outcome.status} calls=${calls.length} finalWs=${JSON.stringify(finalWs)}`,
+        `status=${outcome.status} calls=${calls.length} allowBuilds=${JSON.stringify(firstProbeWorkspace?.allowBuilds)} needsApproval=${JSON.stringify(outcome.needsApproval?.map((e) => `${e.name}@${e.version}`))} wsSame=${finalWs === initialWs}`,
+      );
+    } finally {
+      cleanup();
+    }
+  }
+
+  // 1d-b. 该放行的那一侧：已落盘、已批准、版本没变的包，装别的东西时不再重问。
+  // 交给 pnpm 的是钉了版本的 selector，所以同一次事务若换上另一个版本，
+  // 那个版本并不在放行名单里。
+  {
+    const { profileDir, cleanup } = makeTempProfile("preserve-installed-allow");
+    try {
+      const initialWs = "packages:\n  - .\n\nallowBuilds:\n  native-pkg: true\ndangerouslyAllowAllBuilds: true\n\nnodeLinker: hoisted\n";
+      writeFileSync(join(profileDir, "pnpm-workspace.yaml"), initialWs);
+      materializeFakePackage(profileDir, "some-plugin", "1.0.0");
+      materializeFakePackage(profileDir, "native-pkg", "1.1.0", { install: "node build.js" });
+
+      let firstProbeWorkspace;
+      const { spawnFn, calls } = scriptedSpawn([
+        {
+          code: 0,
+          out: "Done\n",
+          beforeExit: () => {
+            firstProbeWorkspace = load(readFileSync(join(profileDir, "pnpm-workspace.yaml"), "utf8"));
+          },
+        },
+      ]);
+      const outcome = await runInstall({
+        profile: "p",
+        spec: "some-plugin",
+        preflight: preflightStub("some-plugin"),
+        _profileDir: profileDir,
+        _spawn: spawnFn,
+        _describe: describeStub,
+      }).done;
+      const finalWs = readFileSync(join(profileDir, "pnpm-workspace.yaml"), "utf8");
+      check(
+        "已装且版本未变的批准被保留（钉到已装版本），装不相干的包不再重弹审批",
+        outcome.status === "completed"
+          && calls.length === 1
+          && firstProbeWorkspace?.allowBuilds?.["native-pkg@1.1.0"] === true
+          && firstProbeWorkspace?.allowBuilds?.["native-pkg"] === undefined
+          && firstProbeWorkspace?.dangerouslyAllowAllBuilds === false
+          && finalWs === initialWs,
+        `status=${outcome.status} detail=${outcome.detail} allowBuilds=${JSON.stringify(firstProbeWorkspace?.allowBuilds)}`,
       );
     } finally {
       cleanup();
@@ -2727,6 +3181,204 @@ async function runTransactionFixtures() {
     }
   }
 
+  // 3b-2. 卸载中途失败必须留下可恢复的状态 —— 这条钉的是一次真实故障。
+  //
+  // `pnpm remove` 删掉了 node_modules/<pkg>，随后写 pnpm-lock.yaml 时 EPERM
+  // 失败并非零退出。当时 runRemove 没有任何事务保护，只是报了个 failed 就
+  // 返回，于是 package.json 仍把该包声明为 bundle 层、目录却没了。dsh 从此
+  // 拒绝启动：resolveBundleDir 在组装 profile 时抛错，那发生在任何插件加载
+  // 之前，所以 apply() 里的启动恢复根本执行不到——何况当时也没有 marker 可
+  // 供它接手。
+  //
+  // 现在的要求：中途失败之后，profile 要么被还原，要么留下 marker 让恢复路径
+  // 接手。**绝不允许「既没还原、也没 marker」这第三种结局。**
+  {
+    const { profileDir, cleanup } = makeTempProfile("remove-midway-failure", { "pkg-c": "1.0.0" });
+    try {
+      materializeFakePackage(profileDir, "pkg-c", "1.0.0");
+      const manifestBefore = readFileSync(join(profileDir, "package.json"), "utf8");
+      const { spawnFn } = scriptedSpawn([{
+        code: 1,
+        out: "removing pkg-c\nEPERM: operation not permitted, rename '...pnpm-lock.yaml.tmp' -> 'pnpm-lock.yaml'\n",
+        // pnpm 已经把目录删掉了才失败 —— 正是那次故障的形状。
+        beforeExit: () => rmSync(join(profileDir, "node_modules", "pkg-c"), { recursive: true, force: true }),
+      }]);
+      const outcome = await runRemove({ profile: "p", packageName: "pkg-c", _profileDir: profileDir, _spawn: spawnFn }).done;
+      const manifestAfter = readFileSync(join(profileDir, "package.json"), "utf8");
+      const declaresPkg = JSON.parse(manifestAfter).dependencies?.["pkg-c"] !== undefined;
+      const pkgOnDisk = existsSync(join(profileDir, "node_modules", "pkg-c"));
+      const markerLeft = existsSync(pendingMarkerPath(profileDir));
+      // 自洽 = 「声明了就得在盘上」。要么两者都在（已还原），要么 marker 还在
+      // （交给恢复路径）。声明着却不在盘上、且没有 marker，就是那次砖化的形状。
+      const consistent = declaresPkg === pkgOnDisk;
+      check(
+        "卸载中途失败（node_modules 已删）→ 要么还原、要么留 marker，绝不留下「声明了却不在盘上」且无人接手的 profile",
+        outcome.status === "failed"
+          && manifestAfter === manifestBefore
+          && (consistent || markerLeft),
+        `status=${outcome.status} declares=${declaresPkg} onDisk=${pkgOnDisk} marker=${markerLeft} detail=${JSON.stringify(outcome.detail)}`,
+      );
+    } finally {
+      cleanup();
+    }
+  }
+
+  // 3b-3. 早期失败（pnpm 还没动 node_modules）→ 干净回滚，marker 收掉，
+  // profile 与卸载前逐字节一致。
+  {
+    const { profileDir, cleanup } = makeTempProfile("remove-early-failure", { "pkg-d": "1.0.0" });
+    try {
+      materializeFakePackage(profileDir, "pkg-d", "1.0.0");
+      const manifestBefore = readFileSync(join(profileDir, "package.json"), "utf8");
+      const { spawnFn } = scriptedSpawn([{ code: 1, out: "ERR_PNPM_NO_MATCHING_VERSION\n" }]);
+      const outcome = await runRemove({ profile: "p", packageName: "pkg-d", _profileDir: profileDir, _spawn: spawnFn }).done;
+      check(
+        "卸载早期失败 → 回滚到卸载前字节、marker 收掉、包仍在盘上",
+        outcome.status === "failed"
+          && /restored to its pre-remove state/.test(outcome.detail ?? "")
+          && readFileSync(join(profileDir, "package.json"), "utf8") === manifestBefore
+          && existsSync(join(profileDir, "node_modules", "pkg-d"))
+          && !existsSync(pendingMarkerPath(profileDir)),
+        `status=${outcome.status} marker=${existsSync(pendingMarkerPath(profileDir))} detail=${JSON.stringify(outcome.detail)}`,
+      );
+    } finally {
+      cleanup();
+    }
+  }
+
+  // 3b-4. 退出码 0 不等于卸干净了：包还留在清单里就必须回滚，
+  // 不能把一个半卸的 profile 当成功提交。
+  {
+    const { profileDir, cleanup } = makeTempProfile("remove-exit0-incomplete", { "pkg-e": "1.0.0" });
+    try {
+      materializeFakePackage(profileDir, "pkg-e", "1.0.0");
+      // pnpm 声称成功，却没有改动清单（半完成）。
+      const { spawnFn } = scriptedSpawn([{ code: 0, out: "Done\n" }]);
+      const outcome = await runRemove({ profile: "p", packageName: "pkg-e", _profileDir: profileDir, _spawn: spawnFn }).done;
+      check(
+        "pnpm remove 退 0 但包仍在清单里 → 判为未完成并回滚，不提交",
+        outcome.status === "failed"
+          && /did not validate afterwards/.test(outcome.detail ?? ""),
+        `status=${outcome.status} detail=${JSON.stringify(outcome.detail)}`,
+      );
+    } finally {
+      cleanup();
+    }
+  }
+
+  // 3b-5. 卸载成功 → marker 与 snapshot 都必须被提交清理干净。
+  // 留下任何一个都会挡住这个 profile 后续所有安装和卸载，直到下次启动恢复。
+  {
+    const { profileDir, cleanup } = makeTempProfile("remove-success-cleanup", { "pkg-f": "1.0.0" });
+    try {
+      materializeFakePackage(profileDir, "pkg-f", "1.0.0");
+      const { spawnFn } = scriptedSpawn([{
+        code: 0,
+        out: "Done\n",
+        // pnpm 真正卸掉：清单与目录都拿走，落盘校验才会通过。
+        beforeExit: () => {
+          const manifest = JSON.parse(readFileSync(join(profileDir, "package.json"), "utf8"));
+          delete manifest.dependencies["pkg-f"];
+          writeFileSync(join(profileDir, "package.json"), JSON.stringify(manifest, undefined, 2) + "\n");
+          rmSync(join(profileDir, "node_modules", "pkg-f"), { recursive: true, force: true });
+        },
+      }]);
+      const outcome = await runRemove({ profile: "p", packageName: "pkg-f", _profileDir: profileDir, _spawn: spawnFn }).done;
+      const snapshotsLeft = existsSync(join(profileDir, ".dsh-plugin-guard"))
+        ? readdirSync(join(profileDir, ".dsh-plugin-guard")).filter((entry) => entry !== "pending.json")
+        : [];
+      check(
+        "卸载成功 → marker 与 snapshot 都被提交清理，不留残留",
+        outcome.status === "completed"
+          && !existsSync(pendingMarkerPath(profileDir))
+          && snapshotsLeft.length === 0,
+        `status=${outcome.status} marker=${existsSync(pendingMarkerPath(profileDir))} snapshots=${snapshotsLeft.join(",")} detail=${JSON.stringify(outcome.detail)}`,
+      );
+    } finally {
+      cleanup();
+    }
+  }
+
+  // 3b-6. 在途取消：必须等进程真正退出后才回滚，否则会与还在写盘的 pnpm 抢。
+  // 安装路径早有这条，卸载路径此前没有。
+  {
+    const { profileDir, cleanup } = makeTempProfile("remove-cancel-inflight", { "pkg-g": "1.0.0" });
+    try {
+      materializeFakePackage(profileDir, "pkg-g", "1.0.0");
+      const { spawnFn, procs } = blockingSpawn();
+      const producer = runRemove({ profile: "p", packageName: "pkg-g", _profileDir: profileDir, _spawn: spawnFn });
+      await flush();
+      // 与 install 的取消用例同规格：spawn 起来了、marker 已登记，取消之后
+      // 结局是 killed 且 marker 被收掉。回滚接在 'close' 的 promise 之后，
+      // 所以它必然晚于进程退出（FakeProc.kill 同步触发 close，时序无法在
+      // 用例里再细分，由代码结构保证）。
+      const spawnedAndMarked = procs.length === 1 && existsSync(pendingMarkerPath(profileDir));
+      producer.cancel();
+      const outcome = await producer.done;
+      check(
+        "取消在途 remove → killed + 回滚收 marker，包仍在盘上",
+        spawnedAndMarked
+          && outcome.status === "killed"
+          && !existsSync(pendingMarkerPath(profileDir))
+          && existsSync(join(profileDir, "node_modules", "pkg-g")),
+        `spawnedAndMarked=${spawnedAndMarked} status=${outcome.status} marker=${existsSync(pendingMarkerPath(profileDir))} detail=${JSON.stringify(outcome.detail)}`,
+      );
+    } finally {
+      cleanup();
+    }
+  }
+
+  // 3b-7. spawn 同步抛错：marker 已经写下了，异常绝不能绕过收尾。
+  // 安装侧后果更重——workspace 正停在被中和的状态，漏掉恢复就等于把用户的
+  // allowBuilds 批准弄丢（启动恢复会 commit 掉快照，此后再也拿不回来）。
+  {
+    const throwingSpawn = () => { throw new TypeError("spawn EINVAL (synthetic)"); };
+    {
+      const { profileDir, cleanup } = makeTempProfile("remove-spawn-throw", { "pkg-h": "1.0.0" });
+      try {
+        materializeFakePackage(profileDir, "pkg-h", "1.0.0");
+        const outcome = await runRemove({ profile: "p", packageName: "pkg-h", _profileDir: profileDir, _spawn: throwingSpawn }).done;
+        check(
+          "remove 的 spawn 同步抛错 → 走完收尾，不遗留 marker",
+          outcome.status === "failed"
+            && /could not start pnpm/.test(outcome.detail ?? "")
+            && !existsSync(pendingMarkerPath(profileDir)),
+          `status=${outcome.status} marker=${existsSync(pendingMarkerPath(profileDir))} detail=${JSON.stringify(outcome.detail)}`,
+        );
+      } finally {
+        cleanup();
+      }
+    }
+    {
+      const { profileDir, cleanup } = makeTempProfile("install-spawn-throw", { "pkg-i": "1.0.0" });
+      try {
+        const initialWs = "packages:\n  - .\n\nallowBuilds:\n  native-pkg: true\n\nnodeLinker: hoisted\n";
+        writeFileSync(join(profileDir, "pnpm-workspace.yaml"), initialWs);
+        // 清单里声明的直系依赖必须都在盘上，否则回滚的完整性校验会失败并
+        // 保留 marker——那是另一条正确行为，会盖住这条要测的东西。
+        materializeFakePackage(profileDir, "pkg-i", "1.0.0");
+        materializeFakePackage(profileDir, "native-pkg", "1.0.0", { install: "node build.js" });
+        const outcome = await runInstall({
+          profile: "p",
+          spec: "some-plugin",
+          preflight: preflightStub("some-plugin"),
+          _profileDir: profileDir,
+          _spawn: throwingSpawn,
+          _describe: describeStub,
+        }).done;
+        check(
+          "install 的 spawn 同步抛错 → 恢复 workspace 原字节且不遗留 marker（否则用户的 allowBuilds 会被永久中和）",
+          outcome.status === "failed"
+            && readFileSync(join(profileDir, "pnpm-workspace.yaml"), "utf8") === initialWs
+            && !existsSync(pendingMarkerPath(profileDir)),
+          `status=${outcome.status} marker=${existsSync(pendingMarkerPath(profileDir))} ws=${JSON.stringify(readFileSync(join(profileDir, "pnpm-workspace.yaml"), "utf8"))}`,
+        );
+      } finally {
+        cleanup();
+      }
+    }
+  }
+
   // 3c. 排队中被取消：killed 结局，pnpm 从未启动；锁随后正常释放。
   {
     const { profileDir, cleanup } = makeTempProfile("cancel-queued");
@@ -2888,6 +3540,90 @@ function runToggleFixtures() {
   check("多条目：不误伤相邻条目的 disabled", setPatchRowDisabled(multi, "a", true)?.includes("- id: z\n  name: pkg-z\n  disabled: true") === true);
 
   check("带引号的 id 也能匹配", setPatchRowDisabled(`- id: '@scope/pkg'\n  name: x\n`, "@scope/pkg", true) !== undefined);
+
+  // ── 卸载时清理启用/停用覆盖行 ─────────────────────────────────────────────
+  //
+  // 这些行是 v0.3.0 的 toggle 功能引入的，而卸载的 patch 清理写于 v0.1.17，
+  // 只认 insert 行。于是「停用过再卸载」会留下一条指向不存在条目的覆盖行：
+  // 每次启动一条 `patch: entry "x" not found`，更要紧的是**重装时它会复活**，
+  // 插件带着停用状态回来、界面显示已装却不工作。
+  //
+  // 这组用例的重点全在「什么不许删」：patch 层是用户手写的文件，删错的代价
+  // 是无声丢配置，而留着的代价只是一行警告。
+  const toggleCleanup = (content, packageName = "dsh-at-file") => {
+    const dir = mkdtempSync(join(tmpdir(), "dsh-mall-toggle-clean-"));
+    try {
+      writeFileSync(join(dir, PROFILE_PATCH_FILENAME), content);
+      const result = removeToggleRows(dir, packageName);
+      return { result, text: readFileSync(join(dir, PROFILE_PATCH_FILENAME), "utf8") };
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  };
+
+  const ourShape = "- id: at-file\n  name: 'dsh-at-file'\n  disabled: false\n";
+  const cleaned = toggleCleanup(ourShape);
+  check("我们写的形状 → 删掉，文件回到空列表",
+    cleaned.result.removed.join(",") === "at-file" && cleaned.text.trim() === "[]",
+    JSON.stringify(cleaned.text));
+
+  // 删空一个**带头部注释**的文件时，剩下的只有注释——那解析成 null 而不是
+  // []，dsh 的 parsePatchList 会直接拒绝启动。真实 profile 的模板恰恰带着
+  // 这段注释，所以这是必经路径，不是边角。
+  const stockShaped = "# Your patch layer for this dsh profile\n# 第二行注释\n- id: at-file\n  name: 'dsh-at-file'\n  disabled: false\n";
+  const stockCleaned = toggleCleanup(stockShaped);
+  check("删光带注释文件的最后一行 → 补回 []，保持 dsh 能解析的形状",
+    Array.isArray(load(stockCleaned.text))
+      && stockCleaned.text.includes("# Your patch layer")
+      && stockCleaned.text.includes("[]"),
+    JSON.stringify(stockCleaned.text));
+
+  const jsExpr = "- id: at-file\n  name: 'dsh-at-file'\n  disabled: !!js process.platform === 'win32'\n";
+  check("disabled 是 !!js 表达式 → 留着（那是用户写的条件逻辑）",
+    toggleCleanup(jsExpr).text === jsExpr);
+
+  const withConfig = "- id: at-file\n  name: 'dsh-at-file'\n  disabled: false\n  config:\n    foo: 1\n";
+  check("行里还带 config: → 留着（不只是个开关）",
+    toggleCleanup(withConfig).text === withConfig);
+
+  const noNameGuard = "- id: at-file\n  disabled: false\n";
+  check("没有 name 守卫的行 → 留着（无法确认属于这个包）",
+    toggleCleanup(noNameGuard).text === noNameGuard);
+
+  const otherPkg = "- id: sidebar\n  name: 'dsh-better-sidebar'\n  disabled: true\n";
+  check("别的包的行 → 一个字节不动",
+    toggleCleanup(otherPkg).text === otherPkg && toggleCleanup(otherPkg).result.removed.length === 0);
+
+  // 一个包可以插入多行（loaderEntriesByPackage 就是为此存在的），要全删。
+  const multiRow = "- id: a1\n  name: 'dsh-at-file'\n  disabled: true\n- id: keep\n  name: 'other'\n  disabled: true\n- id: a2\n  name: 'dsh-at-file'\n  disabled: false\n";
+  const multiCleaned = toggleCleanup(multiRow);
+  check("同一个包的多条行 → 全部删除，且顺序保持",
+    multiCleaned.result.removed.join(",") === "a1,a2" && multiCleaned.text.includes("- id: keep"),
+    JSON.stringify(multiCleaned.text));
+  check("多行清理后不误伤相邻条目",
+    multiCleaned.text.includes("name: 'other'") && !multiCleaned.text.includes("dsh-at-file"));
+
+  const broken = "- id: at-file\n  name: 'dsh-at-file'\n disabled: [oops\n";
+  check("文件解析不过 → 整个不碰",
+    toggleCleanup(broken).text === broken);
+
+  const commentedRow = "# 我手写的说明\n- id: at-file\n  name: 'dsh-at-file'\n  disabled: false\n# 尾部注释\n";
+  const commentCleaned = toggleCleanup(commentedRow);
+  check("删除目标行时保留周围注释",
+    commentCleaned.text.includes("# 我手写的说明") && commentCleaned.text.includes("# 尾部注释")
+      && !commentCleaned.text.includes("dsh-at-file"),
+    JSON.stringify(commentCleaned.text));
+
+  check("patch 文件不存在 → 安静返回，不创建文件", (() => {
+    const dir = mkdtempSync(join(tmpdir(), "dsh-mall-toggle-none-"));
+    try {
+      const result = removeToggleRows(dir, "dsh-at-file");
+      return result.removed.length === 0 && !existsSync(join(dir, PROFILE_PATCH_FILENAME));
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  })());
+
   return failed;
 }