@1e0zj/dsh-plugin-mall 0.4.0 → 0.4.2

package/README.md

@@ -16,7 +16,7 @@ Curated lists only show what has been reviewed and merged. This marketplace is o
 - **npm-first installs** — registry tarballs are smaller than whole-repo GitHub downloads and come with integrity checks. Lookups follow the registry pnpm actually installs from (profile `.npmrc` → `pnpm config get registry` → npmjs), so a mirror user keeps npm-first instead of silently falling back to whole-repo clones.
 - **Update management** — installed plugins are compared against the registry `latest`; one-click update per plugin.
 - **Conflict guard** — every install runs an isolated preflight first: the candidate is installed with scripts disabled into a throwaway directory and scanned against the live profile for loader-id collisions, double mounts, host-module shadowing and version/OS/peer ranges. A patch layer is not read entry by entry but composed the way the loader applies it — the profile is assembled with and without the candidate's layer, in the position dsh would apply it, and the two trees are diffed. That composition is checked against the loader's own `applyEntryPatches` on every test run, over fixed shapes and 300 generated patch combinations, so "what dsh would boot" is not a guess. What gets reported is what would actually change: disabling, re-enabling or replacing the config of someone else's rows warns and names them, past ten such rows the candidate is a rival composition rather than an addition and is blocked, and a bundle that is itself another front door (own `bin`, terminal peers, no browser half) is blocked once it switches rows on or off or rewrites a protection row — the fingerprint corroborates, it never blocks on its own. A hard conflict is blocked, warnings require explicit confirmation. The profile's load-bearing files are snapshotted before `pnpm` touches them and restored on failure. A pending install is resolved on the next start, however you start it: this plugin runs recovery as it loads, which only happens because dsh booted far enough to compose the profile. Starting through `guard launch` adds a grace window on top, so a plugin that boots and then crashes seconds later is rolled back and restarted once (see [Startup protection](#startup-protection-guard-cli)).
-- **Resilience** — rate-limit circuit breaker, GitHub's 1000-result search window handled gracefully, `corepack enable pnpm` self-heal when pnpm is missing, one-click dsh restart (loopback-only, `allowRestart: false` to disable). The successor waits for the outgoing host to be gone before it binds — starting into an occupied port would read as "the pending plugin crashed dsh" and roll back an install that was fine. It leaves no stray console behind and does not re-open the browser, because the page that asked for the restart is still there and reconnects on its own; whatever the restart prints lands in `<home>/guard/restart-<profile>.log`.
+- **Resilience** — rate-limit circuit breaker, GitHub's 1000-result search window handled gracefully, `corepack enable pnpm` self-heal when pnpm is missing, one-click dsh restart (loopback-only, `allowRestart: false` to disable). The outgoing Host exits only after the on-disk helper explicitly acknowledges the current handoff protocol and stays alive through a stability window; a missing, stale or incompatible helper leaves the existing Web service running. The successor then waits for the outgoing host to be gone before it binds — starting into an occupied port would read as "the pending plugin crashed dsh" and roll back an install that was fine. It leaves no stray console behind and does not re-open the browser, because the page that asked for the restart is still there and reconnects on its own; whatever the restart prints lands in `<home>/guard/restart-<profile>.log`.
 
 ## Install
 
@@ -154,7 +154,7 @@ pnpm --dir <profile> add "github:omdsh-dev/dsh-at-file" --ignore-scripts
 - **npm 优先安装**：registry tarball 比整仓库下载更小且带完整性校验；查询用的 registry 跟随 pnpm 实际安装源（profile `.npmrc` → `pnpm config get registry` → npmjs），换了镜像也不会退化成整仓库克隆
 - **更新管理**：已装插件与 registry `latest` 比对，逐个一键更新
 - **冲突防护**：每次安装先跑隔离预检——候选包在一次性目录里以禁用脚本的方式装好后，对照 live profile 扫描 loader-id 冲突、重复挂载、宿主模块遮蔽和版本/OS/peer 范围。补丁不是逐条读，而是**按 loader 的方式组装**——把候选包的层放进 dsh 会放的位置，装前装后各组装一棵树再逐行比对。这套组装每次跑测试都会和 loader 自己的 `applyEntryPatches` 对拍（固定形状 + 300 组随机生成的补丁组合），所以「dsh 会装出什么树」不是猜的。报出来的是真正会变的东西：停用、重新启用、或替换别人整块 config，都点名是哪几条 id 并警告；超过十条就不是叠加而是另一套组合，直接拦截；候选包本身就是另一套门面（自带 bin、依赖终端栈、没有浏览器半边）时，只要它停用/启用了行、或改了沙箱审批这类保护行，就直接拦截——指纹只做佐证，单凭它不拦。硬冲突直接拦截，警告需显式确认。安装前给 profile 的承重文件拍快照、失败即回滚；pending 安装在下次启动时自动了结，**不挑启动方式**：本插件加载时就跑恢复，而能加载本身就证明 dsh 已经组装好 profile、活到了这一步。经 `guard launch` 启动则多一层观察期——插件启动几秒后才崩的情况也能回滚并原样重启一次（见下方「启动保护」）。
-- **工程韧性**：限流熔断、GitHub 5xx/超时退避重试（504 瞬时故障不再直达用户）、GitHub 1000 条搜索上限优雅处理、pnpm 缺失时 `corepack` 自愈、一键重启 dsh（仅 loopback，可 `allowRestart: false` 关闭）。重启会**等旧进程真正退出**再绑端口——抢在端口没释放时启动，会被判成「新装的插件把 dsh 搞崩了」，把一次本来正常的安装回滚掉。重启后不留控制台窗口、也不再重开浏览器：发起重启的那个页面还在，会自己重连；重启过程的输出写进 `<home>/guard/restart-<profile>.log`（想停 dsh 用任务管理器结束 node 进程）
+- **工程韧性**：限流熔断、GitHub 5xx/超时退避重试（504 瞬时故障不再直达用户）、GitHub 1000 条搜索上限优雅处理、pnpm 缺失时 `corepack` 自愈、一键重启 dsh（仅 loopback，可 `allowRestart: false` 关闭）。旧 Host 只有在磁盘上的 helper 明确回报当前交接协议、并活过稳定窗口后才退出；helper 缺失、过旧或协议不兼容时，现有 Web 服务继续运行。之后 successor 会**等旧进程真正退出**再绑端口——抢在端口没释放时启动，会被判成「新装的插件把 dsh 搞崩了」，把一次本来正常的安装回滚掉。重启后不留控制台窗口、也不再重开浏览器：发起重启的那个页面还在，会自己重连；重启过程的输出写进 `<home>/guard/restart-<profile>.log`（想停 dsh 用任务管理器结束 node 进程）
 
 ## 安装
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1e0zj/dsh-plugin-mall",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "dsh 插件市场：搜索 GitHub dsh-plugin 话题下的插件仓库，一键安装到本地 dsh profile（agent 工具 + 设置页插件市场 tab）",
   "type": "module",
   "main": "src/index.js",

package/src/cli.js

@@ -62,6 +62,7 @@ import {
 // github.js imports node builtins only — the host-independence of this CLI is
 // preserved (it must keep working when the dsh host itself is broken).
 import { npmPackageInfo } from "./github.js";
+import { createRestartHelperReadyMessage } from "./restart-protocol.js";
 
 /**
  * Pin a bare package name to name@latest: pnpm's minimumReleaseAge policy
@@ -79,6 +80,24 @@ export async function pinSpecToLatest(spec, npmInfo = npmPackageInfo) {
   return spec;
 }
 
+/**
+ * Tell the outgoing Web Host that this exact CLI understands its handoff
+ * protocol and has finished parsing --await-exit. A normal terminal launch has
+ * no IPC channel and simply skips the announcement.
+ */
+export async function announceRestartHelperReady(awaitExitPid, send = process.send?.bind(process)) {
+  if (awaitExitPid === undefined || typeof send !== "function") return false;
+  const message = createRestartHelperReadyMessage(awaitExitPid);
+  await new Promise((resolvePromise, rejectPromise) => {
+    try {
+      send(message, (error) => error ? rejectPromise(error) : resolvePromise());
+    } catch (error) {
+      rejectPromise(error);
+    }
+  });
+  return true;
+}
+
 // ── small helpers ────────────────────────────────────────────────────────────
 
 // Same shell-metacharacter blocklist as installer.assertSafeSpec. The install
@@ -884,7 +903,15 @@ function markerLooksValid(marker, profileDir, home) {
  * A corrupt or legacy (pre-v2) marker, or a failed static-recovery step, fails
  * closed: the command is NOT launched and no unvalidated path is deleted.
  */
-async function cmdLaunch({ profile, home, graceMs, commandArgv, awaitExitPid, _waitForExit = waitForProcessExit }) {
+async function cmdLaunch({
+  profile,
+  home,
+  graceMs,
+  commandArgv,
+  awaitExitPid,
+  _waitForExit = waitForProcessExit,
+  _onAwaitExit = announceRestartHelperReady,
+}) {
   const profileDir = profileDirOf(home, profile);
   const grace = graceMs ?? DEFAULT_GRACE_MS;
   const [command, ...args] = commandArgv;
@@ -899,6 +926,10 @@ async function cmdLaunch({ profile, home, graceMs, commandArgv, awaitExitPid, _w
   // the outcome that costs the user their install; not starting leaves the old
   // host running and the marker pending, which the next launch resolves.
   if (awaitExitPid !== undefined) {
+    // This is the exact handoff boundary: arguments and profile are valid, and
+    // the helper is about to block on the outgoing Host. The Web parent waits
+    // for this IPC acknowledgement before it allows itself to exit.
+    await _onAwaitExit(awaitExitPid);
     if (!await _waitForExit(awaitExitPid, AWAIT_EXIT_TIMEOUT_MS)) {
       throw new Error(`process ${awaitExitPid} was still running after ${AWAIT_EXIT_TIMEOUT_MS}ms — refusing to start a second host that would collide with it on the listening port (the old one is still up; nothing was changed)`);
     }
@@ -1184,6 +1215,18 @@ async function selfTest() {
       // A pid after `--` belongs to the wrapped command, not to us.
       const p6 = parseArgs(["launch", "--profile", "web", "--", "dsh", "--await-exit", "7"]);
       if (p6.awaitExit !== undefined || p6.commandArgv.join(" ") !== "dsh --await-exit 7") throw new Error("--await-exit after `--` must stay with the wrapped command");
+
+      let announced;
+      const didAnnounce = await announceRestartHelperReady(4321, (message, callback) => {
+        announced = message;
+        callback();
+      });
+      if (!didAnnounce || announced?.awaitExitPid !== 4321 || announced?.protocol !== 1) {
+        throw new Error("restart helper must announce the parsed pid and protocol over IPC");
+      }
+      if (await announceRestartHelperReady(undefined, () => { throw new Error("must not send"); }) !== false) {
+        throw new Error("a normal launch without --await-exit must not announce a restart handoff");
+      }
     }
 
     // `--await-exit`: the successor must not start while the outgoing host is
@@ -1199,6 +1242,7 @@ async function selfTest() {
 
       let launched = false;
       const neverExits = async () => false;
+      let announcedPid;
       let refused = false;
       try {
         await cmdLaunch({
@@ -1207,11 +1251,13 @@ async function selfTest() {
           commandArgv: [process.execPath, "-e", "launched=1"],
           awaitExitPid: 999999,
           _waitForExit: neverExits,
+          _onAwaitExit: async (pid) => { announcedPid = pid; },
         });
       } catch (error) {
         refused = /still running after/.test(error.message);
       }
       if (!refused) throw new Error("a pid that outlives the timeout must refuse the launch, not race it");
+      if (announcedPid !== 999999) throw new Error("launch must announce readiness immediately before waiting for the outgoing pid");
 
       // …and a pid that does go away lets the command through.
       const exitsPromptly = async () => true;

package/src/client.js

@@ -661,6 +661,25 @@ window.__ModuleLoader__.load({
       // No boolean warning-consent map is kept.
       var sessionNonce = useRef(generateSessionNonce()).current;
       var approvalTokensRef = useRef({});
+      var restartControlRef = useRef({ mounted: true, ping: null });
+      var clearRestartPing = useCallback(function () {
+        var control = restartControlRef.current;
+        if (control.ping !== null) {
+          clearInterval(control.ping);
+          control.ping = null;
+        }
+      }, []);
+      useEffect(function () {
+        var control = restartControlRef.current;
+        control.mounted = true;
+        return function () {
+          control.mounted = false;
+          if (control.ping !== null) {
+            clearInterval(control.ping);
+            control.ping = null;
+          }
+        };
+      }, []);
 
       var call = useCallback(function (endpoint, payload) {
         var body = Object.assign({ session: sessionNonce }, payload || {});
@@ -887,28 +906,49 @@ window.__ModuleLoader__.load({
         if (typeof window !== "undefined" && typeof window.confirm === "function") {
           if (window.confirm("重启 dsh？正在进行的任务会中断。") !== true) return;
         }
+        clearRestartPing();
         setRestarting(true);
         setError(null);
+        var requestedAt = Date.now();
+        var previousHostStartedAt = Number(hostStartedAt);
         call("restart", {}).then(function () {
+          if (restartControlRef.current.mounted !== true) return;
           var tries = 0;
           var ping = setInterval(function () {
+            if (restartControlRef.current.mounted !== true) {
+              clearRestartPing();
+              return;
+            }
             tries++;
             if (tries > 40) {
-              clearInterval(ping);
+              clearRestartPing();
               setRestarting(false);
               setError("2 分钟内未检测到 dsh 重启完成，请手动检查 dsh 状态后刷新页面。");
               return;
             }
-            rpc.call("/market", "installed", {}).then(function () {
-              clearInterval(ping);
+            // Prefer identity change over wall-clock ordering: NTP may move the
+            // successor's timeOrigin backwards. If initial restore did not
+            // provide an identity, retain the stricter requestedAt fallback.
+            call("jobs", {}).then(function (value) {
+              if (restartControlRef.current.mounted !== true) return;
+              var observedHostStartedAt = Number(value.hostStartedAt);
+              if (!Number.isFinite(observedHostStartedAt) || observedHostStartedAt <= 0) return;
+              var hadPreviousIdentity = Number.isFinite(previousHostStartedAt) && previousHostStartedAt > 0;
+              if (hadPreviousIdentity
+                ? observedHostStartedAt === previousHostStartedAt
+                : observedHostStartedAt <= requestedAt) return;
+              clearRestartPing();
               window.location.reload();
             }).catch(function () { /* host restarting */ });
           }, 3000);
+          restartControlRef.current.ping = ping;
         }).catch(function (e) {
+          if (restartControlRef.current.mounted !== true) return;
+          clearRestartPing();
           setRestarting(false);
           setError(errorText(e));
         });
-      }, [call, rpc]);
+      }, [call, clearRestartPing, hostStartedAt]);
 
       var doUninstall = useCallback(function (name) {
         delete approvalTokensRef.current[name];

package/src/github.js

@@ -172,9 +172,11 @@ function normalizeRegistry(registry) {
  * Look up a package's `latest` manifest on an npm registry.
  * @param name - the npm package name.
  * @param options - `registry` defaults to npmjs; pass what pnpm installs from.
+ *   `signal` cancels the request (and, critically, keeps the cancellation out
+ *   of the cache — see below).
  * @returns `{latest, repositoryUrl, hostDeps}`, or null when unknown/unreachable.
  */
-export async function npmPackageInfo(name, { registry } = {}) {
+export async function npmPackageInfo(name, { registry, signal } = {}) {
   const clean = String(name ?? "").trim();
   if (clean.length === 0 || !/^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/i.test(clean)) return null;
   const base = normalizeRegistry(registry);
@@ -188,6 +190,7 @@ export async function npmPackageInfo(name, { registry } = {}) {
     // 镜像（npmmirror 等）的同名端点响应格式一致，两个字段都保留。
     const response = await fetch(`${base}/${clean.replace("/", "%2F")}/latest`, {
       headers: { "User-Agent": "dsh-plugin-mall", Accept: "application/json" },
+      signal,
     });
     if (response.ok) {
       const body = await response.json();
@@ -201,7 +204,11 @@ export async function npmPackageInfo(name, { registry } = {}) {
         };
       }
     }
-  } catch {
+  } catch (error) {
+    // 取消不是「查不到」。若把 AbortError 也吞成 null，下面的 npmCache.set 会把
+    // 这个空答案钉住整个 TTL——用户取消一次，接下来 5 分钟里防抢注永远不匹配、
+    // 宿主影子检查看不到清单，而且完全无声。取消一律上抛，不进缓存。
+    if (error?.name === "AbortError") throw error;
     info = null; // registry unreachable — caller falls back
   }
   npmCache.set(key, { info, at: Date.now() });
@@ -213,7 +220,7 @@ export async function npmPackageInfo(name, { registry } = {}) {
  * that package exists on npm AND its repository URL points back at the repo
  * (anti-squatting). Anything else passes through untouched.
  */
-export async function preferNpmSpec({ spec, registry, sources }) {
+export async function preferNpmSpec({ spec, registry, sources, signal }) {
   const raw = String(spec ?? "");
   // A scoped npm name ("@scope/name", "@scope/name@1.2.3") is shaped exactly
   // like owner/repo and matches the regex below, sending every such install
@@ -223,10 +230,10 @@ export async function preferNpmSpec({ spec, registry, sources }) {
   const githubMatch = /^(?:github:)?([^/\s]+\/[^/\s]+?)(?:\.git)?$/i.exec(raw);
   if (githubMatch === null) return raw;
   const repo = githubMatch[1];
-  const { results } = await verifyPlugins({ repos: [repo], sources }); // cache hit after first verify
+  const { results } = await verifyPlugins({ repos: [repo], sources, signal }); // cache hit after first verify
   const declaredName = results[repo]?.name;
   if (typeof declaredName !== "string") return raw;
-  const info = await npmPackageInfo(declaredName, { registry });
+  const info = await npmPackageInfo(declaredName, { registry, signal });
   if (info === null || info.repositoryUrl === undefined) return raw;
   const pointsBack = new RegExp(`github\\.com[/:]${repo.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(/|\\.git|$)`, "i").test(info.repositoryUrl);
   return pointsBack ? declaredName : raw;
@@ -254,7 +261,7 @@ export function npmNameOf(raw) {
   return match === null ? null : match[1];
 }
 
-export async function assertSafeToInstall({ spec, registry, sources }) {
+export async function assertSafeToInstall({ spec, registry, sources, signal }) {
   const raw = String(spec ?? "");
   let hostDeps;
   if (/^(?:file:|link:)/i.test(raw)) {
@@ -268,7 +275,7 @@ export async function assertSafeToInstall({ spec, registry, sources }) {
     }
   } else if (/^github:([^/\s]+\/[^/\s]+?)(?:\.git)?(?:#.+)?$/i.test(raw)) {
     const repo = /^github:([^/\s]+\/[^/\s]+?)(?:\.git)?(?:#.+)?$/i.exec(raw)[1];
-    const { results } = await verifyPlugins({ repos: [repo], sources });
+    const { results } = await verifyPlugins({ repos: [repo], sources, signal });
     hostDeps = results[repo]?.hostDeps;
   } else if (/^https?:\/\//i.test(raw)) {
     return; // 远程 tarball 下载前无法廉价检查；罕见路径，放行
@@ -279,7 +286,7 @@ export async function assertSafeToInstall({ spec, registry, sources }) {
       // 无法识别形状的 spec 一律拒绝，而不是静默跳过检查。
       throw new Error(`cannot analyze install spec ${JSON.stringify(raw)} for host-shadow dependencies — refusing to install`);
     }
-    const info = await npmPackageInfo(name, { registry });
+    const info = await npmPackageInfo(name, { registry, signal });
     hostDeps = info?.hostDeps;
   }
   if (hostDeps !== undefined && hostDeps !== null && hostDeps.length > 0) {

package/src/guard.js

@@ -1460,8 +1460,49 @@ export function pnpmSpawnPlan({ platform = process.platform, pathEnv = process.e
   return { command: `"${cmd}"`, shell: true, treeKill: true };
 }
 
-function spawnCapture(command, args, options, onOutput) {
+/** Build the cancellation error every caller here recognises by `name`. */
+function abortError(message) {
+  const error = new Error(message);
+  error.name = "AbortError";
+  return error;
+}
+
+/**
+ * Whether an error is a cancellation rather than a failure. fetch/AbortSignal
+ * throw a DOMException named "AbortError"; abortError() above matches it. The
+ * distinction is load-bearing: a cancellation must never be reported as a
+ * verdict, cached, or turned into a failed install.
+ */
+export function isAbortError(error) {
+  return error?.name === "AbortError";
+}
+
+/**
+ * Spawn, stream, and capture — with an optional cancellation seam.
+ *
+ * `options.signal`/`options.treeKill` (5th argument) make the child killable:
+ * an already-aborted signal spawns nothing at all, and an abort mid-run
+ * terminates the child. `treeKill` mirrors installer.js killProcessTree — on
+ * Windows a shell-wrapped pnpm is a GRANDCHILD of cmd.exe, so killing the
+ * wrapper leaves the real pnpm running and still writing; taskkill /T /F takes
+ * the whole tree. Either way the promise still settles on 'close', never on
+ * the abort itself: the caller must not get control back (and start deleting
+ * the probe directory) while a pnpm process is still writing into it.
+ *
+ * 'close' bounds the WRITING, not the operating system's bookkeeping. It
+ * arrives the instant taskkill signals the wrapper, while Windows still holds
+ * the probe directory — it is the killed pnpm's cwd — for a moment longer, so
+ * an rmSync right here still hits EPERM. That last stretch belongs to
+ * cleanupProbeDir's retries, not to this promise.
+ */
+function spawnCapture(command, args, options, onOutput, { signal, treeKill = false } = {}) {
   return new Promise((resolvePromise) => {
+    if (signal?.aborted === true) {
+      // 已经取消了就一个字节都别做：spawn 之后再杀，probe 目录里会留下半棵
+      // 依赖树，pnpm store 也已经被写过。
+      resolvePromise({ exitCode: 1, output: "", aborted: true });
+      return;
+    }
     let child;
     const chunks = [];
     const push = (value) => {
@@ -1480,13 +1521,31 @@ function spawnCapture(command, args, options, onOutput) {
       resolvePromise({ exitCode: 1, output: "", error });
       return;
     }
+    let aborted = false;
+    const onAbort = () => {
+      aborted = true;
+      if (treeKill === true && process.platform === "win32" && typeof child.pid === "number") {
+        try {
+          spawnSync("taskkill", ["/pid", String(child.pid), "/T", "/F"], { stdio: "ignore", windowsHide: true, timeout: 10000 });
+        } catch { /* taskkill 不在 PATH 上——退回下面的普通 kill */ }
+      }
+      try { child.kill(); } catch { /* already gone */ }
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    const settle = (result) => {
+      signal?.removeEventListener("abort", onAbort);
+      resolvePromise({ ...result, aborted });
+    };
     child.stdout?.on("data", push);
     child.stderr?.on("data", push);
-    child.on("error", (error) => resolvePromise({ exitCode: 1, output: chunks.join(""), error }));
-    child.on("close", (exitCode) => resolvePromise({ exitCode: exitCode ?? 1, output: chunks.join("") }));
+    child.on("error", (error) => settle({ exitCode: 1, output: chunks.join(""), error }));
+    child.on("close", (exitCode) => settle({ exitCode: exitCode ?? 1, output: chunks.join("") }));
   });
 }
 
+/** Exported only so the self-test can drive the cancel path with a real child. */
+export const _spawnCaptureForTests = spawnCapture;
+
 // The install spec is eventually handed to `pnpm add` — through a cmd shell on
 // Windows, where Node joins the args with spaces and does not per-argument
 // quote. It must therefore be validated at the exported preflight boundary too,
@@ -1521,8 +1580,14 @@ function probeAddArgs(spec) {
 /**
  * Install a candidate into a disposable directory with every lifecycle script
  * disabled, then inspect its actual package manifest and patch files.
+ *
+ * `signal` cancels the probe. Cancellation is reported by THROWING an
+ * AbortError, never as a report: a report is a verdict about the candidate,
+ * and the caller caches and acts on it. "The user pressed cancel" is not a
+ * verdict — folding it into a blocked report would pin a fabricated blocker
+ * into the preflight cache for the rest of its TTL.
  */
-export async function preflightInstall({ profileDir, spec, onOutput }) {
+export async function preflightInstall({ profileDir, spec, onOutput, signal }) {
   try {
     assertSafeSpec(spec);
   } catch (error) {
@@ -1536,6 +1601,7 @@ export async function preflightInstall({ profileDir, spec, onOutput }) {
   }
   const probeDir = mkdtempSync(join(tmpdir(), "dsh-plugin-guard-"));
   try {
+    if (signal?.aborted === true) throw abortError(`preflight of ${spec} was cancelled before it started`);
     writeFileSync(join(probeDir, "package.json"), JSON.stringify({ name: "dsh-plugin-guard-probe", private: true }, undefined, 2) + "\n");
     writeFileSync(join(probeDir, "pnpm-workspace.yaml"), "packages:\n  - .\n\nnodeLinker: hoisted\n");
     // Reuse the profile's registry/auth settings for the probe. The file may
@@ -1545,7 +1611,18 @@ export async function preflightInstall({ profileDir, spec, onOutput }) {
     if (existsSync(profileNpmrc)) copyFileSync(profileNpmrc, join(probeDir, ".npmrc"));
     onOutput?.(`[dsh-plugin-guard] probing ${spec} with install scripts disabled\n`);
     const plan = pnpmSpawnPlan();
-    const result = await spawnCapture(plan.command, probeAddArgs(spec), { cwd: probeDir, env: process.env, shell: plan.shell }, onOutput);
+    const result = await spawnCapture(
+      plan.command,
+      probeAddArgs(spec),
+      { cwd: probeDir, env: process.env, shell: plan.shell },
+      onOutput,
+      { signal, treeKill: plan.treeKill },
+    );
+    // 取消先判：被杀掉的 pnpm 退出码非 0，不先分流就会被报成
+    // "无法在隔离环境解析插件" —— 一条纯属捏造的阻断结论。
+    if (result.aborted === true || signal?.aborted === true) {
+      throw abortError(`preflight of ${spec} was cancelled`);
+    }
     if (result.exitCode !== 0) {
       return {
         ok: false,
@@ -1570,6 +1647,10 @@ export async function preflightInstall({ profileDir, spec, onOutput }) {
     if (candidatePath === undefined) throw new Error(`installed package ${names[0]} has no resolvable package.json`);
     return inspectCandidate({ profileDir, candidateManifestPath: candidatePath, spec });
   } catch (error) {
+    // 取消必须先于这个兜底放行。兜底存在的意义是「任何意外都变成一份可读的
+    // 阻断报告」，而取消不是意外，是用户的指令；混进来就成了一条会被缓存、
+    // 会被当成候选包问题展示的假结论。
+    if (isAbortError(error)) throw error;
     return {
       ok: false,
       verdict: "blocked",
@@ -1580,7 +1661,41 @@ export async function preflightInstall({ profileDir, spec, onOutput }) {
   } finally {
     // probeDir is created by mkdtemp directly under the system temp folder;
     // it never contains user-authored files.
-    rmSync(probeDir, { recursive: true, force: true });
+    cleanupProbeDir(probeDir, onOutput);
+  }
+}
+
+/**
+ * Delete the throwaway probe directory — WITHOUT ever changing the outcome of
+ * the preflight that created it.
+ *
+ * Two things bite here, and they compound:
+ *
+ *  1. On Windows `'close'` arrives the instant taskkill /T /F signals the
+ *     wrapper, but the killed pnpm and its children release their file
+ *     handles a moment later. rmSync straight after a cancel therefore hits
+ *     EPERM on a directory that is about to become deletable. `maxRetries`
+ *     (Node retries exactly EBUSY/EMFILE/ENFILE/ENOTEMPTY/EPERM) rides that
+ *     out; the delay backs off linearly, so 10 × 100ms is ~5s worst case.
+ *
+ *  2. This runs in a `finally`, and an exception thrown from `finally`
+ *     REPLACES the one already propagating. So a failed cleanup used to
+ *     swallow the AbortError of a cancelled preflight and surface as
+ *     `failed: EPERM \\?\C:\...\dsh-plugin-guard-XXXX` — the user pressed
+ *     cancel and got an unreadable path error about a temp directory they
+ *     never knew existed. Leaking a temp dir the OS will reap anyway is far
+ *     cheaper than misreporting why the job ended, so the throw stops here.
+ *
+ * `remove` is a test seam. The real EPERM comes from an OS race — the probe
+ * directory is the killed pnpm's cwd, and Windows keeps it locked until that
+ * process is truly gone — which cannot be reproduced reliably in a fixture.
+ * The fixture therefore pins OUR error handling, not the kernel's timing.
+ */
+function cleanupProbeDir(probeDir, onOutput, remove = rmSync) {
+  try {
+    remove(probeDir, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+  } catch (error) {
+    onOutput?.(`[dsh-plugin-guard] could not remove probe directory ${probeDir} (${error?.code ?? error?.message}) — leaving it for the OS to reclaim\n`);
   }
 }
 
@@ -4575,6 +4690,94 @@ async function selfTest() {
       }
     }
 
+    // ── 取消传播（spawnCapture / preflightInstall）─────────────────────────
+    //
+    // 预检是 market_install 里唯一真正耗时的一段（隔离目录探装）。它此前完全
+    // 不可取消：按下 job_kill 只是标记了记录，pnpm 照跑到底。这三条钉的是
+    // 取消语义本身——不 spawn、等 close、以及「取消不是一份阻断报告」。
+    {
+      const marker = join(root, "child-ran.txt");
+      const writeMarker = `require("node:fs").writeFileSync(${JSON.stringify(marker)}, "ran")`;
+
+      // 1) 已经取消 → 一个子进程都不该起。
+      const preAborted = await _spawnCaptureForTests(
+        process.execPath,
+        ["-e", writeMarker],
+        { env: process.env },
+        undefined,
+        { signal: AbortSignal.abort() },
+      );
+      if (preAborted.aborted !== true) throw new Error("已 abort 的 signal 必须标记 aborted");
+      if (existsSync(marker)) throw new Error("已 abort 的 signal 仍然 spawn 了子进程");
+      console.log("PASS 取消：已 abort 的 signal 不 spawn 子进程");
+
+      // 2) 飞行中取消 → 杀掉子进程，但仍然等到 'close' 才 resolve。
+      //    （resolve 早于进程退出，调用方就会在 pnpm 还在写的时候删 probe 目录。）
+      const controller = new AbortController();
+      const startedAt = Date.now();
+      let closedAt;
+      const running = _spawnCaptureForTests(
+        process.execPath,
+        ["-e", `process.on("exit", () => {}); setTimeout(() => { ${writeMarker} }, 30000)`],
+        { env: process.env },
+        undefined,
+        { signal: controller.signal, treeKill: false },
+      ).then((result) => { closedAt = Date.now(); return result; });
+      await new Promise((r) => setTimeout(r, 150));
+      controller.abort();
+      const killed = await running;
+      const elapsed = closedAt - startedAt;
+      if (killed.aborted !== true) throw new Error("飞行中取消必须标记 aborted");
+      if (elapsed > 20000) throw new Error(`取消后应立即终止子进程，实测等了 ${elapsed}ms`);
+      if (existsSync(marker)) throw new Error("取消后子进程仍然跑完了它的工作");
+      console.log(`PASS 取消：飞行中取消终止子进程并等到 close 才 resolve（${elapsed}ms）`);
+
+      // 3) preflightInstall 取消 → 抛 AbortError，而不是返回一份 blocked 报告。
+      //    兜底 catch 会把任何异常变成「预检执行失败」的阻断结论；那份结论会
+      //    被上层缓存、展示成候选包的问题，而用户只是按了取消。
+      let cancelOutcome = "<resolved>";
+      try {
+        const report = await preflightInstall({ profileDir, spec: "any-package", signal: AbortSignal.abort() });
+        cancelOutcome = `report:${report.verdict}`;
+      } catch (error) {
+        cancelOutcome = isAbortError(error) ? "abort" : `error:${error?.name}`;
+      }
+      if (cancelOutcome !== "abort") throw new Error(`preflightInstall 取消必须上抛 AbortError，实得 ${cancelOutcome}`);
+      console.log("PASS 取消：preflightInstall 上抛 AbortError（不伪造阻断报告）");
+
+      // 4) 探针目录删不掉时，清理不许改变结局。
+      //    实测踩到的：取消后 taskkill /T /F 一发，wrapper 的 'close' 立刻到，
+      //    但探针目录是那个被强杀的 pnpm 的 cwd，Windows 会一直锁着它，
+      //    finally 里的 rmSync 撞 EPERM —— 而 finally 抛出的异常会顶掉正在
+      //    上抛的 AbortError，于是「用户按了取消」在 job 里显示成一条看不懂的
+      //    EPERM 临时目录路径。
+      //    这里注入一个必抛的 remove：真实 EPERM 靠的是 OS 时序，fixture 复现
+      //    不稳定（Node 的 openSync 带 FILE_SHARE_DELETE，占着句柄照样能删），
+      //    而要钉住的本来就是我们的错误处理，不是内核的时机。
+      const cleanupDir = mkdtempSync(join(tmpdir(), "dsh-guard-cleanup-"));
+      let cleanupThrew;
+      let cleanupReport = "";
+      try {
+        cleanupProbeDir(cleanupDir, (text) => { cleanupReport += text; }, () => {
+          const error = new Error(`EPERM, Permission denied: ${cleanupDir}`);
+          error.code = "EPERM";
+          throw error;
+        });
+      } catch (error) {
+        cleanupThrew = error;
+      }
+      if (cleanupThrew !== undefined) {
+        throw new Error(`cleanupProbeDir 抛了 ${cleanupThrew?.code ?? cleanupThrew?.message}——它跑在 finally 里，会顶掉 AbortError`);
+      }
+      if (!cleanupReport.includes("could not remove probe directory")) {
+        throw new Error("清理失败必须被报告出来，而不是静默吞掉");
+      }
+      // 真能删的时候要真的删掉——上面那条别把清理本身测没了。
+      cleanupProbeDir(cleanupDir, undefined);
+      if (existsSync(cleanupDir)) throw new Error("cleanupProbeDir 未能删除可删除的目录");
+      console.log("PASS 取消：探针目录清理失败不改变结局（且可删时确实删掉）");
+    }
+
     console.log("PASS conflict scan and snapshot/pending/rollback fixtures");
   } finally {
     rmSync(root, { recursive: true, force: true });