@1e0zj/dsh-plugin-mall 0.4.1 → 0.4.3

package/src/index.js

@@ -14,6 +14,7 @@
 // services, `Config` validates the row's config, `name` is the plugin name.
 
 import z from "@deepseek-ai/schemastery";
+import { valid as validExactVersion, maxSatisfying } from "semver";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import { existsSync, readFileSync, realpathSync, mkdirSync, mkdtempSync, writeFileSync, rmSync, openSync, closeSync, writeSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
@@ -25,9 +26,9 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
 import { resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
-import { repoInfo, searchPlugins, verifyPlugins, cachedRepoManifest, fetchRawFile, preferNpmSpec, npmPackageInfo, compareVersions, assertSafeToInstall, mapLimit, NETWORK_CONCURRENCY } from "./github.js";
+import { repoInfo, searchPlugins, verifyPlugins, cachedRepoManifest, fetchRawFile, preferNpmSpec, npmPackageInfo, npmPackageVersions, npmNameOf, compareVersions, assertSafeToInstall, mapLimit, NETWORK_CONCURRENCY } from "./github.js";
 import { ensureProfile, listInstalled, normalizeSpec, runInstall, runRemove, assertSafeSpec, resolveRegistry, serializeCanonicalProof, persistPluginDisabled } from "./installer.js";
-import { preflightInstall, inspectRemoteCandidate, recoverProfile, describeRollbackRebuild } from "./guard.js";
+import { preflightInstall, inspectRemoteCandidate, recoverProfile, describeRollbackRebuild, isAbortError } from "./guard.js";
 import { createRestartHelperReadyMessage, RESTART_HELPER_READY_TYPE, RESTART_RESPONSE_DRAIN_MS, superviseRestartHelper } from "./restart-protocol.js";
 
 export const name = "@1e0zj/dsh-plugin-mall";
@@ -336,9 +337,20 @@ function invalidatePreflightFor(profileDir) {
  * never caches warning consent.
  */
 function pinPreflight(profileDir, spec) {
+  // pin 只给核得住的引用：不可变（精确版本/钉死的 sha）或可再校验的
+  // （npm tag/range，读取路径会重新核）。file:/link:/URL/未钉 sha 的
+  // github 拿不到可信身份，pin 了也只是把一条注定要丢弃的缓存钉在
+  // 那里——读取路径对它们一律重跑，这里就别给「已核过」的假象。
+  if (specIdentityKind(spec) === null) return;
   const key = preflightCacheKey(profileDir, spec);
   const cached = preflightCache.get(key);
   if (cached === undefined) return;
+  // blocked 一律不 pin（ok === true 的只有 safe/warning）。探装失败的
+  // blocker 最要命：网络抖一下就是一份 ok:false 的 blocked，而 spec 若是
+  // 精确版本这类不可变形态，身份再校验也不会拦——钉住等于把一次临时失败
+  // 固化 10 分钟，网络恢复也不再重试。真正的冲突 blocker 也没有「用户
+  // 读完再继续」的后继流程，pin 本就没有服务对象。
+  if (cached.report?.ok !== true) return;
   const currentFingerprint = computeProfileFingerprint(profileDir);
   if (cached.fingerprint !== currentFingerprint) {
     preflightCache.delete(key);
@@ -350,11 +362,98 @@ function pinPreflight(profileDir, spec) {
 /**
  * Run the isolated preflight for a resolved install spec, reusing a fresh
  * cache entry ONLY if the profile fingerprint matches.
+ *
+ * `signal` cancels the probe. Nothing extra is needed to protect the cache:
+ * preflightInstall THROWS an AbortError on cancellation instead of returning a
+ * report, so control never reaches preflightCache.set() below and a cancelled
+ * run leaves the cache exactly as it found it. (Had cancellation come back as
+ * a `blocked` report, that fabricated verdict would have been cached for the
+ * whole TTL and every later install of this spec refused with it.)
+ */
+
+/**
+ * The "owner/repo" part of a github: spec, or null. Anchored end-to-end: an
+ * earlier version let the lazy repo group stop early (`github:owner/repo`
+ * came out as `owner/r`) because the `.git` alternative was optional and
+ * nothing forced the match to run to the end — every identity lookup then
+ * keyed on a repo that does not exist and quietly failed open.
+ */
+export function githubSpecRepo(raw) {
+  const match = /^github:([^/\s]+\/[^/\s]+?)(?:\.git)?(?:#.+)?$/i.exec(String(raw ?? ""));
+  return match === null ? null : match[1];
+}
+
+/**
+ * What a cache-reuse staleness check can rely on for this spec shape.
+ *
+ *   "immutable"  exact npm version (npm forbids overwriting a published
+ *                version) or github:...#<full 40-hex sha>. Nothing can
+ *                drift; reuse unconditionally.
+ *   "npm-tag"    bare name / @latest / @* — resolves to whatever `latest`
+ *                is now; verifiable against the install registry.
+ *   "npm-range"  pkg@^1.2.0 — an in-range release changes what pnpm picks;
+ *                verifiable via the packument.
+ *   null         UNVERIFIABLE, not immutable: file:/link:/URL tarballs (the
+ *                content can change in place), github without a pinned sha
+ *                (same version can point at different code — comparing
+ *                name/version proves nothing), owner/repo, anything else.
+ *                No trusted identity is obtainable cheaply, so the cache is
+ *                never reused for these — see runPreflight.
  */
-async function runPreflight({ profile, spec, force = false, onOutput }) {
+export function specIdentityKind(raw) {
+  const spec = String(raw ?? "");
+  if (/^(?:file:|link:|https?:\/\/)/i.test(spec)) return null;
+  if (/^github:/i.test(spec)) {
+    const pinned = /^github:[^/\s]+\/[^/\s]+?(?:\.git)?#([0-9a-f]{40})$/i.exec(spec);
+    return pinned !== null ? "immutable" : null;
+  }
+  if (!/^@/.test(spec) && spec.includes("/")) return null; // owner/repo：不可核验
+  const name = npmNameOf(spec);
+  if (name === null) return null;
+  // 注意 scoped 裸名（@scope/name）没有 range：判定依据是「名字之后还有没有
+  // 东西」，不是字符串里有没有 @——scope 前缀本身就带 @。
+  const range = spec.length > name.length ? spec.slice(name.length + 1) : undefined;
+  if (range === undefined || range === "latest" || range === "*") return "npm-tag";
+  return validExactVersion(range) === null ? "npm-range" : "immutable";
+}
+
+/**
+ * What this spec resolves to RIGHT NOW ({name, version}), for the verifiable
+ * shapes — the cheap half of "reuse equals rerun". The expensive half is the
+ * probe itself; this is one registry read per cache hit.
+ *
+ * `fresh` is the point: the registry helpers cache for minutes, and a cached
+ * "current version" is exactly the staleness this check exists to detect —
+ * the candidate published 2.0.0 five minutes into the cache TTL would sail
+ * through as "still 1.0.0". Queries here bypass the read cache (they still
+ * populate it). The registry is the one pnpm will install from (mirrors
+ * included), so whatever lag it has applies to the install equally —
+ * verifying against npmjs while installing from npmmirror would be the
+ * wrong kind of fresh.
+ *
+ * Returns undefined when the resolution is unreachable — the caller treats
+ * that as "could not verify", which invalidates, never as "verified".
+ */
+async function resolveSpecIdentity({ spec, registry, sources, signal }) {
+  const kind = specIdentityKind(spec);
+  if (kind !== "npm-tag" && kind !== "npm-range") return undefined;
+  const name = npmNameOf(String(spec));
+  if (name === null) return undefined;
+  if (kind === "npm-tag") {
+    const info = await npmPackageInfo(name, { registry, signal, fresh: true });
+    return info === null || typeof info.latest !== "string" ? undefined : { name, version: info.latest };
+  }
+  const range = String(spec).slice(name.length + 1);
+  const versions = await npmPackageVersions(name, { registry, signal, fresh: true });
+  if (versions === null || versions.length === 0) return undefined;
+  const best = maxSatisfying(versions, range);
+  return best === null ? undefined : { name, version: best };
+}
+
+async function runPreflight({ profile, spec, force = false, onOutput, signal, registry, sources, _profileDir, _resolveSpecIdentity = resolveSpecIdentity, _preflightInstall = preflightInstall }) {
   let profileDir;
   try {
-    profileDir = resolveProfileDir(profile);
+    profileDir = _profileDir ?? resolveProfileDir(profile);
   } catch (error) {
     throw new Error(`invalid profile: ${error.message}`);
   }
@@ -374,10 +473,41 @@ async function runPreflight({ profile, spec, force = false, onOutput }) {
     && (isPinned(validCached) || Date.now() - validCached.at < PREFLIGHT_TTL);
 
   if (!force && fresh) {
-    return { report: validCached.report, profileDir, fingerprint: currentFingerprint };
+    // 缓存复用的前提是「重跑必然得到同一份结论」，缺一側都不算数：
+    //   profile 一侧 —— 指纹一致（上面已查）；
+    //   候选一侧 —— spec 是不可变引用（精确版本/钉死的 sha），或者能重新
+    //               解析出与缓存报告一致的身份。
+    // 除此之外一律丢弃重跑：file:/link:/URL 的内容能原地变；未钉 sha 的
+    // github 同版本能换代码，name/version 比对证明不了任何事；registry
+    // 查不到「当前值」同样是没核住。以前这里 fail-open（核不上就沿用旧
+    // 报告），等于给所有核不住的形态开了永久通道。
+    const candidate = validCached.report?.candidate;
+    const kind = specIdentityKind(spec);
+    if (kind === "immutable") {
+      return { report: validCached.report, profileDir, fingerprint: currentFingerprint };
+    }
+    let verified = false;
+    if ((kind === "npm-tag" || kind === "npm-range")
+      && typeof candidate?.name === "string" && typeof candidate?.version === "string") {
+      let current;
+      try {
+        current = await _resolveSpecIdentity({ spec, registry, sources, signal });
+      } catch (error) {
+        if (isAbortError(error)) throw error; // 取消不是「核不上」，照旧上抛
+        current = undefined;
+      }
+      verified = current !== undefined
+        && typeof current.version === "string"
+        && current.name === candidate.name
+        && current.version === candidate.version;
+    }
+    if (verified) {
+      return { report: validCached.report, profileDir, fingerprint: currentFingerprint };
+    }
+    preflightCache.delete(key); // 核不住或对不上：作废，下面重跑探装
   }
 
-  const report = await preflightInstall({ profileDir, spec, onOutput });
+  const report = await _preflightInstall({ profileDir, spec, onOutput, signal });
   preflightCache.set(key, {
     report,
     fingerprint: currentFingerprint,
@@ -549,6 +679,16 @@ export function consumeApprovalToken({
     return { valid: false, reason: "invalid or already consumed approval token" };
   }
 
+  // 归属校验先于销毁。token 一旦泄漏（哪怕只泄漏给另一个 session），任何
+  // 拿到它的人都不该能靠「试一下」把别人的批准流程烧掉——错误归属的尝试
+  // 原样退回，token 留给真正的 owner。其余校验维持「一试即焚」的一次性。
+  if (record.surface !== surface) {
+    return { valid: false, reason: "approval token surface mismatch (cannot reuse between browser and agent)" };
+  }
+  if (record.owner !== (owner ?? "")) {
+    return { valid: false, reason: `approval token ${surface === "browser" ? "session" : "owner"} mismatch` };
+  }
+
   // Atomically delete token on validation to guarantee one-shot
   approvalTokens.delete(cleanToken);
 
@@ -571,12 +711,6 @@ export function consumeApprovalToken({
       return { valid: false, reason: "approval token profile directory mismatch" };
     }
   }
-  if (record.surface !== surface) {
-    return { valid: false, reason: "approval token surface mismatch (cannot reuse between browser and agent)" };
-  }
-  if (record.owner !== (owner ?? "")) {
-    return { valid: false, reason: `approval token ${surface === "browser" ? "session" : "owner"} mismatch` };
-  }
   if (
     createHash("sha256").update(record.disclosureSerialized).digest("hex") !== record.disclosureDigest
     || createHash("sha256").update(record.proofSerialized).digest("hex") !== record.proofDigest
@@ -967,11 +1101,6 @@ export function createJobTracker({ producerFactory } = {}) {
       profile,
       spec,
       verb = "add",
-      allowBuildScripts,
-      approvedProof,
-      preflight,
-      profileDir,
-      acceptWarningsActive = false,
       surface = "browser",
       session,
       onSettled,
@@ -980,11 +1109,15 @@ export function createJobTracker({ producerFactory } = {}) {
       const id = `market-${++trackerCounter}`;
       const kind = verb === "remove" ? "dsh-plugin-uninstall" : "dsh-plugin-install";
       const factory = startProducerFactory ?? producerFactory;
+      // install 必须带 producerFactory：createInstallJobProducer 是整条链
+      // （含审批 token 签发）的唯一所有者，tracker 不再自己拼 runInstall——
+      // 那条老路没有预检、没有 token 语义，只是历史上预检跑在 RPC 里时的
+      // 残余。remove 仍可直接起 runRemove。
       const producer = typeof factory === "function"
-        ? factory({ profile, spec, verb, allowBuildScripts, approvedProof, preflight, profileDir })
+        ? factory({ profile, spec, verb })
         : verb === "remove"
           ? runRemove({ profile, packageName: spec })
-          : runInstall({ profile, spec, allowBuildScripts, approvedProof, preflight });
+          : (() => { throw new Error("install jobs require a producerFactory — the preflight chain owns the producer, not the tracker"); })();
 
       const record = {
         id,
@@ -1019,25 +1152,13 @@ export function createJobTracker({ producerFactory } = {}) {
           record.staleOnRestart = outcome?.staleOnRestart === true;
           record.finishedAt = Date.now();
 
-          if (status === "completed") {
-            if (profileDir) invalidatePreflightFor(profileDir);
-            clearApprovalTokensFor(profile, spec);
-          } else if (outcome?.needsApproval && outcome.needsApproval.length > 0) {
-            clearApprovalTokensFor(profile, spec, { surface: record.surface, owner: record.session });
-            const token = issueApprovalToken({
-              profile,
-              profileDir,
-              spec,
-              preflightReport: preflight,
-              needsApproval: outcome.needsApproval,
-              proof: outcome.proof,
-              surface: record.surface,
-              owner: record.session,
-              acceptWarningsActive,
-            });
-            record.approvalToken = token;
-          } else {
-            clearApprovalTokensFor(profile, spec, { surface: record.surface, owner: record.session });
+          // 审批 token 由 producer 签发（createInstallJobProducer 是唯一签发
+          // 者：它手里才有预检报告与 profileDir，也才能把签发失败写进 detail
+          // 而不是顶掉结论）。tracker 只把 outcome 里带出来的 token 摘到
+          // record 上，供同 session 的快照下发——不签发、不清理，避免同一份
+          // 职责在两条路径上各写一份、再各自漂移。
+          if (typeof outcome?.approvalToken === "string" && outcome.approvalToken.length > 0) {
+            record.approvalToken = outcome.approvalToken;
           }
 
           try {
@@ -1275,20 +1396,281 @@ function renderPreflightIssue(entry) {
 }
 
 /**
- * Enforce a preflight verdict for an install. Throws when a blocker exists, or
- * when there are only warnings and acceptWarnings is not true.
+ * The verdict plus every issue verbatim, as job-log text.
+ *
+ * The browser used to log only the verdict and hand the reasons to the risk
+ * card through `extras`. Closing that card — or clicking "install anyway" —
+ * took the reasons with it, and nothing else on the page ever had them. The
+ * job log is the part that survives, so the evidence belongs here; the card
+ * stays what it should be, the place to make the decision. The agent path
+ * has carried the individual BLOCK/WARN lines in its job detail all along.
  */
-function enforcePreflight(report, acceptWarnings, label) {
+function preflightVerdictLog(report) {
+  const lines = [`[dsh-plugin-mall] 预检结论：${report?.verdict}\n`];
+  for (const entry of report?.issues ?? []) lines.push(`${renderPreflightIssue(entry)}\n`);
+  return lines.join("");
+}
+
+/**
+ * Why this install must not proceed — or undefined when it may.
+ *
+ * Both surfaces (agent tool and browser RPC) decide INSIDE the job, so the
+ * verdict travels as text on a `failed` outcome — a producer's `done` must
+ * never reject, and "the preflight refused this candidate" is not an internal
+ * error but the job's legitimate ending. It used to have an exception-shaped
+ * twin (enforcePreflight) for the browser, back when the browser decided
+ * before any job existed; that path is gone and so is the twin.
+ */
+/**
+ * The identity of ONE preflight verdict: which candidate, which profile state,
+ * which issues. Consent to install despite warnings binds to this — a boolean
+ * `acceptWarnings: true` carries no such identity, so the report changing
+ * between the user's confirmation and the retry used to slip different
+ * warnings through under an old yes (profile edits force a re-probe; the new
+ * report can carry entirely different warnings).
+ *
+ * Candidate name+version come from the probe's own manifest, so a re-probe of
+ * a drifted mutable spec produces a different digest even when the issue list
+ * happens to read the same. 16 hex chars — this detects change, it is not a
+ * security boundary.
+ */
+export function preflightConsentDigest(report, fingerprint) {
+  const canonical = JSON.stringify({
+    verdict: report?.verdict ?? null,
+    candidateName: report?.candidate?.name ?? null,
+    candidateVersion: report?.candidate?.version ?? null,
+    fingerprint: fingerprint ?? null,
+    issues: (report?.issues ?? []).map((entry) => [entry.severity ?? null, entry.title ?? null, entry.detail ?? null]),
+  });
+  return createHash("sha256").update(canonical).digest("hex").slice(0, 16);
+}
+
+function preflightRefusal(report, acceptWarnings, label, { digestProvided, fingerprint, consentBoundByToken = false } = {}) {
   if (report.verdict === "blocked") {
-    const error = new Error(`${label}: ${report.summary}\n${report.issues.filter((entry) => entry.severity === "block").map(renderPreflightIssue).join("\n")}`);
-    error.preflight = report;
-    throw error;
+    return `${label}: ${report.summary}\n${report.issues.filter((entry) => entry.severity === "block").map(renderPreflightIssue).join("\n")}`;
   }
-  if (report.verdict === "warning" && acceptWarnings !== true) {
-    const error = new Error(`${label}: ${report.summary}\n${report.issues.filter((entry) => entry.severity === "warn").map(renderPreflightIssue).join("\n")}\n\nTo continue, show these warnings to the user and, after their explicit confirmation, call again with acceptWarnings: true.`);
-    error.preflight = report;
-    throw error;
+  if (report.verdict === "warning") {
+    const digest = preflightConsentDigest(report, fingerprint);
+    const warnLines = report.issues.filter((entry) => entry.severity === "warn").map(renderPreflightIssue).join("\n");
+    // 审批 token 自带报告摘要比对（consumeApprovalToken），它给出的同意已经
+    // 绑定了报告；只有裸布尔 acceptWarnings 这条道需要在这里比对 digest。
+    const consentMatches = acceptWarnings === true
+      && (consentBoundByToken === true || digestProvided === digest);
+    if (!consentMatches) {
+      const why = acceptWarnings === true
+        ? "the preflight report changed since the warnings were confirmed (or no report digest was supplied), so the earlier yes cannot carry over. Current warnings:"
+        : `${report.summary}`;
+      return `${label}: ${why}\n${warnLines}\n\nCurrent report digest: ${digest}. To continue, show these warnings to the user and, after their explicit confirmation, call again with acceptWarnings: true and reportDigest: ${digest}.`;
+    }
   }
+  return undefined;
+}
+
+/**
+ * The whole install — registry lookup, spec resolution, host-shadow check,
+ * isolated preflight, approval-token consumption, verdict, and pnpm — as ONE
+ * job producer, for BOTH surfaces (agent tool and browser RPC).
+ *
+ * Why it all lives in here (issue #8): `ctx.jobs.start()` treats `run()` as a
+ * synchronous start boundary, so anything awaited before that call happens
+ * outside the task runtime. The old market_install awaited the registry query,
+ * the anti-squatting resolve and the isolated probe install first — tens of
+ * seconds during which the tool call had not returned, no job id existed, the
+ * work appeared in no job log, and `job_kill` had nothing to kill. The tool's
+ * own description promised the opposite ("ALWAYS runs as a background job:
+ * the call returns a job id immediately"). Moving the chain in here makes that
+ * promise true and, as a side effect, gives the slow phases a kill handle.
+ *
+ * One phase is deliberately NOT cancellable: the registry lookup. `resolveRegistry`
+ * caches a PROMISE per profile, so threading the signal into it would leave a
+ * permanently rejected promise in that cache after one cancel — every later
+ * registry query for the profile would fail, and unlike the npmPackageInfo cache
+ * it never expires. That is the same cache-poisoning bug this change set exists
+ * to remove, traded for at most the few seconds `pnpm config get registry` takes
+ * on a cold profile. So cancellation there lands on the throwIfAborted() right
+ * after it instead.
+ *
+ * Two invariants this shape has to keep:
+ *  - `done` NEVER rejects. It is the single settlement path the jobs runtime
+ *    consumes, so a refusal, a cancellation and an internal error all come
+ *    back as ordinary outcome objects.
+ *  - `cancel()` is synchronous and idempotent. It aborts the preflight phase
+ *    through the AbortController and, once pnpm owns the profile, hands over
+ *    to the installer's own cancel (which tree-kills and waits for 'close'
+ *    before rolling back).
+ *
+ * The `_`-prefixed parameters are test seams only; production passes none.
+ */
+function createInstallJobProducer({
+  profile,
+  spec: requestedSpec,
+  acceptWarnings: acceptWarningsRequested = false,
+  reportDigest,
+  allowBuildScripts,
+  approvalToken,
+  // 审批 token 的归属：agent 工具传 { surface: "agent", owner: <agent 标量
+  // id> }，浏览器 RPC 传 { surface: "browser", owner: <session> }。签发、
+  // 消费、清理都从这里走——producer 是审批 token 的唯一签发者，tracker 只
+  // 复制 outcome.approvalToken，不再自己签。
+  surface = "agent",
+  owner,
+  npmRegistry = "",
+  rawSources = [],
+  profileExisted = true,
+  profileDir: requestedProfileDir,
+  _registryFor = registryFor,
+  _preferNpmSpec = preferNpmSpec,
+  _assertSafeToInstall = assertSafeToInstall,
+  _runPreflight = runPreflight,
+  _runInstall = runInstall,
+}) {
+  const controller = new AbortController();
+  const { signal } = controller;
+  let inner; // the runInstall producer — only exists once pnpm is about to run
+  let cancelled = false;
+
+  // 预检阶段没有 inner 可以问，它的输出先攒在这里。
+  const preflightChunks = [];
+  const pushPreflight = (text) => { preflightChunks.push(String(text ?? "")); };
+
+  const cancel = () => {
+    if (cancelled) return; // 幂等：job_kill 可能被按多次，abort 也只该发生一次
+    cancelled = true;
+    controller.abort(); // 预检阶段：掐断 registry 请求与探针 pnpm
+    inner?.cancel(); // 安装阶段：交给 installer 的 tree-kill + 回滚
+  };
+
+  const done = (async () => {
+    const registry = await _registryFor(profile, npmRegistry);
+    signal.throwIfAborted();
+    // 防抢注解析可能把 owner/repo 换成 npm 包名，后面每一步（预检、token
+    // 比对、pnpm）都必须用这个解析后的 spec，否则重试时 token 的 spec 对不上。
+    const spec = await _preferNpmSpec({ spec: requestedSpec, registry, sources: rawSources, signal });
+    signal.throwIfAborted();
+    await _assertSafeToInstall({ spec, registry, sources: rawSources, signal });
+    signal.throwIfAborted();
+
+    pushPreflight(`[dsh-plugin-mall] 预检 ${spec}：隔离目录探装（脚本禁用）\n`);
+    const preflight = await _runPreflight({ profile, spec, onOutput: pushPreflight, signal, registry, sources: rawSources });
+    signal.throwIfAborted(); // 命中缓存时预检不会自己抛，这里补一次取消检查
+    pushPreflight(`[dsh-plugin-mall] 预检结论：${preflight.report.verdict}\n`);
+
+    let acceptWarnings = false;
+    let acceptWarningsActive = false;
+    let approvedProof;
+    if (approvalToken !== undefined) {
+      const consumeResult = consumeApprovalToken({
+        token: approvalToken,
+        profile,
+        profileDir: preflight.profileDir,
+        spec,
+        preflightReport: preflight.report,
+        allowBuildScripts,
+        surface,
+        owner,
+      });
+      if (!consumeResult.valid) {
+        return { status: "failed", detail: `invalid approval token: ${consumeResult.reason}` };
+      }
+      acceptWarnings = consumeResult.warningConsent;
+      acceptWarningsActive = consumeResult.warningConsent;
+      approvedProof = consumeResult.proof;
+    } else {
+      acceptWarnings = acceptWarningsRequested === true;
+      acceptWarningsActive = acceptWarnings;
+    }
+
+    const refusal = preflightRefusal(preflight.report, acceptWarnings, `market_install ${spec}`, {
+      digestProvided: reportDigest,
+      fingerprint: preflight.fingerprint,
+      consentBoundByToken: approvalToken !== undefined, // consume 已带报告摘要比对
+    });
+    if (refusal !== undefined) {
+      // 拒绝是这个 job 的正常结局，不是异常：作为 failed 的 detail 回去，
+      // 模型从 job_output 就能读到逐条 BLOCK/WARN。
+      return { status: "failed", detail: refusal };
+    }
+
+    pinPreflight(preflight.profileDir, spec);
+    signal.throwIfAborted(); // 从这行往后，取消归 installer 管
+    inner = _runInstall({ profile, spec, allowBuildScripts, approvedProof, preflight: preflight.report });
+    if (signal.aborted) inner.cancel(); // 上一行之前就取消过的话，补一次转交
+    const outcome = await inner.done; // installer 的 done 同样永不 reject
+
+    const status = outcome?.status ?? "failed";
+    if (status === "completed") {
+      invalidatePreflightFor(preflight.profileDir);
+      clearApprovalTokensFor(profile, spec);
+    } else if (outcome?.needsApproval && outcome.needsApproval.length > 0) {
+      clearApprovalTokensFor(profile, spec, { surface, owner });
+      try {
+        const token = issueApprovalToken({
+          profile,
+          profileDir: preflight.profileDir,
+          spec,
+          preflightReport: preflight.report,
+          needsApproval: outcome.needsApproval,
+          proof: outcome.proof,
+          surface,
+          owner,
+          acceptWarningsActive,
+        });
+        outcome.approvalToken = token;
+        // token 只写进 agent 的 detail：agent 的 job_output 由宿主按 owner
+        // 隔离，模型重试时要从这里读到 token。浏览器的 detail 是任务面板
+        // 明文展示的字段，tracker.get/list 又无条件下发它（只有独立的
+        // approvalToken 字段做 session 隔离）——拼进去等于把 token 发给
+        // 所有 session。浏览器侧 token 只走 outcome.approvalToken →
+        // record.approvalToken → 同 session 的快照字段。
+        if (surface === "agent") {
+          outcome.detail = `${outcome.detail ?? ""}\n\nApproval token (pass to approvalToken on retry): ${token}`;
+        }
+      } catch (error) {
+        // 签发会因为凭证不完整（proof 缺失/不匹配）抛错。以前这段跑在 `.then`
+        // 里，抛出去就把 done 变成 rejected —— 官方明说 done 必须不 reject，
+        // 而且那样一来「pnpm 拦下了安装脚本」这条真正的结论会被一条内部错误
+        // 顶掉。改成写进 detail：结论照常送达，同时明说这次没法重试。
+        outcome.detail = `${outcome.detail ?? ""}\n\nNOTE: no approval token could be issued (${error?.message ?? String(error)}), so allowBuildScripts cannot be used to retry this run — start a fresh install instead.`;
+      }
+    } else {
+      clearApprovalTokensFor(profile, spec, { surface, owner });
+    }
+    return outcome;
+  })().catch((error) => {
+    if (isAbortError(error)) {
+      // 取消时探装全在临时目录里，正式 profile 没被装进任何东西。唯一的例外
+      // 是 profile 本来就不存在——预检会先 ensureProfile() 把它建出来
+      // （package.json / cordis.patch.yml / pnpm-workspace.yaml 真的落盘）。
+      //
+      // 「本来不存在」不等于「我们建了」：ensureProfile() 在 runPreflight 里，
+      // 而取消可能发生在更早的 registry 查询、防抢注解析或宿主遮蔽检查阶段，
+      // 那时磁盘上一个字节都还没写。所以这里查磁盘的当前事实，而不是拿开工前
+      // 的快照去推断——推断会随着链路上再加一步就悄悄失真，实地检查不会。
+      const profileCreatedHere = profileExisted === false
+        && requestedProfileDir !== undefined
+        && existsSync(join(requestedProfileDir, "package.json"));
+      return {
+        status: "killed",
+        detail: profileCreatedHere
+          ? `install of ${requestedSpec} was cancelled during preflight — no packages were installed, but the profile did not exist and was initialized before the probe started`
+          : `install of ${requestedSpec} was cancelled during preflight — the profile was never modified`,
+      };
+    }
+    return { status: "failed", detail: `install of ${requestedSpec} hit an error: ${error?.message ?? String(error)}` };
+  });
+
+  return {
+    cancel,
+    done,
+    // 顺序依赖：预检阶段与安装阶段严格先后，上面的 async 体在 _runInstall
+    // 之前不会再往 preflightChunks 里写。所以「先排空缓冲、再问 inner」得到的
+    // 就是真实时间顺序；两个阶段若哪天并行了，这里必须改成带时间戳的合并。
+    readOutput: () => {
+      const buffered = preflightChunks.length === 0 ? "" : preflightChunks.splice(0).join("");
+      const live = typeof inner?.readOutput === "function" ? inner.readOutput() : "";
+      return buffered + live;
+    },
+  };
 }
 
 /** Clip long strings for compact model-facing output. */
@@ -1575,9 +1957,28 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
           session,
           run: async (push) => {
             push(`[dsh-plugin-mall] 预检 ${resolved}：隔离目录探装（脚本禁用）\n`);
-            const { report } = await runPreflight({ profile, spec: resolved, onOutput: (text) => push(text) });
-            push(`[dsh-plugin-mall] 预检结论：${report.verdict}\n`);
-            return { status: "completed", detail: `预检完成：${report.verdict}`, extras: report };
+            const { report, profileDir: probedDir, fingerprint: probedFingerprint } = await runPreflight({ profile, spec: resolved, onOutput: (text) => push(text), registry, sources: rawSources });
+            // 结论 + 逐条原因都进日志。extras 只喂给风险卡片，卡片一关就什么
+            // 都不剩了；日志是留得住的那一份。
+            push(preflightVerdictLog(report));
+            // 钉住这份结论，别让用户的思考时间把它作废。
+            //
+            // PREFLIGHT_TTL 只有 30 秒，而有警告时下一步正是让用户读完风险卡片
+            // 再决定——读两条「无法验证宿主依赖」基本必然超过 30 秒，于是点下
+            // 「继续安装」时缓存已过期，隔离探装整个重跑一遍：用户看到的是确认
+            // 之后又干等几十秒，而那几十秒里没有任何反馈。
+            //
+            // pin 不会让判断变陈旧：pinPreflight 先比对 profile 指纹，profile
+            // 有任何改动这条缓存就立刻作废而不是被钉住。钉的是「同一个 profile
+            // 状态下的同一次结论」，10 分钟内复用与重跑完全等价。
+            pinPreflight(probedDir, resolved);
+            // extras 额外带 consentDigest：风险卡片确认时原样回传，装的时候
+            // 与当前报告比对——同意绑定的是「这份报告」，不是一次布尔值。
+            return {
+              status: "completed",
+              detail: `预检完成：${report.verdict}`,
+              extras: { ...report, consentDigest: preflightConsentDigest(report, probedFingerprint) },
+            };
           },
         });
         return rpcOk({ jobId, profile, spec: resolved });
@@ -1600,12 +2001,17 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
       } catch (error) {
         return rpcFail(error);
       }
-      const registry = await registryFor(profile, npmRegistry);
-      spec = await preferNpmSpec({ spec, registry, sources: rawSources });
+      // profile 名非法当场报错，与 market_uninstall / agent 工具一致——不是
+      // 一个注定失败的后台 job。顺带取「动手之前」的磁盘状态：producer 的
+      // 取消文案要靠它区分「profile 从未被动过」和「预检把不存在的 profile
+      // 建出来了」。
+      let installProfileDir;
+      let profileExisted = true;
       try {
-        await assertSafeToInstall({ spec, registry, sources: rawSources });
+        installProfileDir = resolveProfileDir(profile);
+        profileExisted = existsSync(join(installProfileDir, "package.json"));
       } catch (error) {
-        return rpcFail(error);
+        return rpcFail(new Error(`invalid profile: ${error.message}`));
       }
       const allowBuildScripts = Array.isArray(payload?.allowBuildScripts)
         ? payload.allowBuildScripts.map((name) => String(name))
@@ -1620,58 +2026,35 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
         return rpcFail(error);
       }
 
-      let preflight;
-      let acceptWarnings = false;
-      let acceptWarningsActive = false;
-      let approvedProof = undefined;
-      try {
-        preflight = await runPreflight({ profile, spec });
-        if (approvalToken !== undefined) {
-          const consumeResult = consumeApprovalToken({
-            token: approvalToken,
-            profile,
-            profileDir: preflight.profileDir,
-            spec,
-            preflightReport: preflight.report,
-            allowBuildScripts,
-            surface: "browser",
-            owner: session,
-          });
-          if (!consumeResult.valid) {
-            return rpcFail(new Error(`invalid approval token: ${consumeResult.reason}`));
-          }
-          acceptWarnings = consumeResult.warningConsent;
-          acceptWarningsActive = consumeResult.warningConsent;
-          approvedProof = consumeResult.proof;
-        } else {
-          acceptWarnings = payload?.acceptWarnings === true;
-          acceptWarningsActive = acceptWarnings;
-        }
-        enforcePreflight(preflight.report, acceptWarnings, `install ${spec}`);
-      } catch (error) {
-        return rpcFail(error);
-      }
-
-      pinPreflight(preflight.profileDir, spec);
-      try {
-        const jobId = tracker.start({
+      // 到这里为止只做本地、同步、必须在返回 job id 之前失败的检查——与
+      // market_install 的 execute() 同构。registry 解析、防抢注、宿主遮蔽
+      // 检查、预检（缓存/身份再校验）、token 消费、警告关卡与 pnpm 全部在
+      // producer 里跑：旧行为把整段 await 在 tracker.start 之前，用户点
+      // 「继续安装」后风险框立刻消失而任务条目几十秒不动，预检 TTL 一过还
+      // 会把隔离探装整个重跑一遍（那个洞已由结算即 pin 堵上，这里是根治）。
+      // 结论形态随之对齐 agent 路径：blocker/未确认警告不再让 RPC 报错，
+      // 而是作为 job 的 failed outcome 送达，日志里看得到原文。
+      const jobId = tracker.start({
+        profile,
+        spec,
+        surface: "browser",
+        session,
+        producerFactory: () => createInstallJobProducer({
           profile,
           spec,
+          acceptWarnings: payload?.acceptWarnings === true,
+          reportDigest: typeof payload?.acceptedReportDigest === "string" ? payload.acceptedReportDigest.trim() : undefined,
           allowBuildScripts,
-          approvedProof,
-          preflight: preflight.report,
-          profileDir: preflight.profileDir,
-          acceptWarningsActive,
+          approvalToken,
           surface: "browser",
-          session,
-          onSettled: (outcome) => {
-            if (outcome?.status === "completed") invalidatePreflightFor(preflight.profileDir);
-          },
-        });
-        return rpcOk({ jobId, profile, spec, preflight: { verdict: preflight.report.verdict, summary: preflight.report.summary } });
-      } catch (error) {
-        return rpcFail(error);
-      }
+          owner: session,
+          npmRegistry,
+          rawSources,
+          profileExisted,
+          profileDir: installProfileDir,
+        }),
+      });
+      return rpcOk({ jobId, profile, spec });
     }
     case "uninstall": {
       const profile = String(payload?.profile ?? defaultProfile).trim();
@@ -1702,7 +2085,6 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
           profile,
           spec: packageName,
           verb: "remove",
-          profileDir,
           surface: "browser",
           session,
           onSettled: (outcome) => {
@@ -1873,7 +2255,7 @@ export function apply(ctx, config = {}) {
   ctx.systemPrompt.section({
     name: "tool:market",
     order: 120,
-    text: "The dsh plugin marketplace tools are available: market_search discovers plugins on the GitHub dsh-plugin topic, market_info inspects one repository, market_install installs a plugin into a dsh profile as a background job (poll with job_output), market_uninstall removes an installed plugin from a dsh profile as a background job, and market_installed lists a profile's plugins. A successful market_install or market_uninstall only takes effect after the dsh process restarts — remind the user to restart. Prefer plugins with meaningful stars and a dsh.bundle declaration (market_info shows both). market_install runs an isolated preflight before installing (the candidate is probed with install scripts disabled and scanned for conflicts); a blocker refuses the install and warnings require acceptWarnings: true after the user confirms them — never set it on the user's behalf. If market_install stops for install-script approval, that decision is also the user's: show them the reported package names and commands and wait for an answer — never approve on their behalf.",
+    text: "The dsh plugin marketplace tools are available: market_search discovers plugins on the GitHub dsh-plugin topic, market_info inspects one repository, market_install installs a plugin into a dsh profile as a background job (poll with job_output), market_uninstall removes an installed plugin from a dsh profile as a background job, and market_installed lists a profile's plugins. A successful market_install or market_uninstall only takes effect after the dsh process restarts — remind the user to restart. Prefer plugins with meaningful stars and a dsh.bundle declaration (market_info shows both). market_install runs an isolated preflight before installing (the candidate is probed with install scripts disabled and scanned for conflicts); that preflight runs inside the background job, so its verdict — including a refusal — arrives through job_output rather than as an immediate error from the call. A blocker refuses the install and warnings require acceptWarnings: true together with the reportDigest from the failed job after the user confirms them — never set either on the user's behalf. If market_install stops for install-script approval, that decision is also the user's: show them the reported package names and commands and wait for an answer — never approve on their behalf.",
   });
 
   ctx.tools.register(defineTool({
@@ -1951,7 +2333,7 @@ export function apply(ctx, config = {}) {
 
   ctx.tools.register(defineTool({
     name: "market_install",
-    description: "Install a plugin into a local dsh profile by running `pnpm add` in that profile's directory, reconciling the profile's bundle layer list, and — for browser-side UI plugins (`dsh.client`) — registering a loader row in the profile's cordis.patch.yml. Same flow as `dsh plugin --profile <name> add <spec>`. ALWAYS runs as a background job: the call returns a job id immediately; poll with job_output and cancel with job_kill. The install is gated by an isolated preflight (the candidate is installed with scripts disabled into a throwaway directory and scanned for manifest/patch conflicts, host-module shadowing, and version/OS incompatibilities). A blocker refuses the install outright; a warning requires the USER's explicit consent via `acceptWarnings: true` — show the reported warnings verbatim and get their answer first, never consent on their behalf. If pnpm blocks a dependency's install scripts, the job STOPS and reports which packages want to run install-time code, what those commands are, whether each is the plugin itself or a transitive dependency, and issues a one-shot approval token. Relay that list to the user verbatim, and only call again with `allowBuildScripts` naming the packages they approved along with `approvalToken`. A successful install only takes effect after the dsh process restarts.",
+    description: "Install a plugin into a local dsh profile by running `pnpm add` in that profile's directory, reconciling the profile's bundle layer list, and — for browser-side UI plugins (`dsh.client`) — registering a loader row in the profile's cordis.patch.yml. Same flow as `dsh plugin --profile <name> add <spec>`. ALWAYS runs as a background job, and the call itself does almost nothing: it validates the profile name, the spec and the approval arguments, then returns a job id. Everything slow happens INSIDE the job — resolving the spec against the npm registry, the host-module shadowing check, the isolated preflight (the candidate is installed with scripts disabled into a throwaway directory and scanned for manifest/patch conflicts and version/OS incompatibilities), and pnpm itself. Poll with job_output; cancel with job_kill (a cancel during the preflight leaves the profile untouched). Because the preflight runs inside the job, ITS VERDICT ARRIVES AS THE JOB'S OUTCOME, not as an error from this call: a blocker, or a warning the user has not confirmed, ends the job as `failed` with the individual issues in its detail — read them there and relay them verbatim. A warning is cleared by calling again with `acceptWarnings: true` AND `reportDigest` set to the \"Current report digest\" printed in that failed job's detail — the consent is bound to that exact report, so if the candidate or the profile changed in between, the retry fails again with the NEW warnings; never consent on the user's behalf. If pnpm blocks a dependency's install scripts, the job STOPS and reports which packages want to run install-time code, what those commands are, whether each is the plugin itself or a transitive dependency, and issues a one-shot approval token. Relay that list to the user verbatim, and only call again with `allowBuildScripts` naming the packages they approved along with `approvalToken`. A successful install only takes effect after the dsh process restarts.",
     parameters: {
       spec: {
         type: "string",
@@ -1966,6 +2348,10 @@ export function apply(ctx, config = {}) {
         type: "boolean",
         description: "Set true only after the USER has explicitly confirmed they accept the preflight warnings the previous call reported. Without it, an install whose preflight found only warnings is refused. Never set this on your own initiative.",
       },
+      reportDigest: {
+        type: "string",
+        description: "The \"Current report digest\" printed by the failed job you are retrying. The warning consent is bound to that exact report: if the candidate package or the profile changed in between, the digest no longer matches and the job fails again with the NEW warnings — show those to the user and confirm anew. Required whenever acceptWarnings is true.",
+      },
       approvalToken: {
         type: "string",
         description: "Opaque one-shot approval token issued when a previous install paused for install script approval. Required on retry if the install had accepted preflight warnings.",
@@ -1984,16 +2370,30 @@ export function apply(ctx, config = {}) {
       },
       render: (args, value) => [{
         type: "text",
-        text: `started background job ${value.jobId} (${args.spec} → profile "${args.profile ?? defaultProfile}"); poll with job_output, cancel with job_kill. Restart dsh after a successful install.`,
+        text: `started background job ${value.jobId} (${args.spec} → profile "${args.profile ?? defaultProfile}"); the preflight runs inside it, so poll job_output for the verdict and cancel with job_kill. Restart dsh after a successful install.`,
       }],
     },
+    // 只做本地、同步、必须在返回 job id 之前失败的检查。任何需要 await 的
+    // 步骤都在 createInstallJobProducer 里（见那里的注释）：在这里 await，
+    // 等于让工具在没有 job id、没有日志、job_kill 够不着的状态下干几十秒活。
     async execute(args, exec) {
       const profile = String(args.profile ?? defaultProfile).trim();
-      const normalized = normalizeSpec(args.spec);
-      assertSafeSpec(normalized);
-      const registry = await registryFor(profile, npmRegistry);
-      const spec = await preferNpmSpec({ spec: normalized, registry, sources: rawSources });
-      await assertSafeToInstall({ spec, registry, sources: rawSources });
+      // profile 名非法要当场报错，而不是变成一个注定失败的后台 job——
+      // 与 market_uninstall 一致。
+      let installProfileDir;
+      let profileExisted;
+      try {
+        // 顺便记下 profile 本来存不存在：预检会给尚未初始化的 profile 调
+        // ensureProfile()（真的落盘 package.json 等文件），所以取消时那句
+        // 「profile 从未被修改」对新建的 profile 并不成立。这里是唯一还能
+        // 看到「动手之前」状态的位置。
+        installProfileDir = resolveProfileDir(profile);
+        profileExisted = existsSync(join(installProfileDir, "package.json"));
+      } catch (error) {
+        throw new Error(`market_install: invalid profile: ${error.message}`);
+      }
+      const spec = normalizeSpec(args.spec);
+      assertSafeSpec(spec);
       const allowBuildScripts = Array.isArray(args.allowBuildScripts)
         ? args.allowBuildScripts.map((name) => String(name))
         : undefined;
@@ -2001,77 +2401,31 @@ export function apply(ctx, config = {}) {
         ? args.approvalToken.trim()
         : undefined;
       assertValidApprovalInvocation(allowBuildScripts, approvalToken);
-
-      const preflight = await runPreflight({ profile, spec });
-      let acceptWarnings = false;
-      let acceptWarningsActive = false;
-      let approvedProof = undefined;
+      // 审批归属必须在这里取：exec 是本次调用的门面，producer 里已经拿不到。
       const agentOwner = requireAgentApprovalOwner(exec);
-      if (approvalToken !== undefined) {
-        const consumeResult = consumeApprovalToken({
-          token: approvalToken,
-          profile,
-          profileDir: preflight.profileDir,
-          spec,
-          preflightReport: preflight.report,
-          allowBuildScripts,
-          surface: "agent",
-          owner: agentOwner,
-        });
-        if (!consumeResult.valid) {
-          throw new Error(`market_install: invalid approval token: ${consumeResult.reason}`);
-        }
-        acceptWarnings = consumeResult.warningConsent;
-        acceptWarningsActive = consumeResult.warningConsent;
-        approvedProof = consumeResult.proof;
-      } else {
-        acceptWarnings = args.acceptWarnings === true;
-        acceptWarningsActive = acceptWarnings;
-      }
-
-      enforcePreflight(preflight.report, acceptWarnings, `market_install ${spec}`);
-      pinPreflight(preflight.profileDir, spec);
-
-      const runProducer = () => {
-        const producer = runInstall({ profile, spec, allowBuildScripts, approvedProof, preflight: preflight.report });
-        const done = Promise.resolve(producer.done)
-          .catch((error) => ({
-            status: "failed",
-            detail: `install of ${spec} hit an internal error: ${error?.message ?? String(error)}`,
-          }))
-          .then((outcome) => {
-            const status = outcome?.status ?? "failed";
-            if (status === "completed") {
-              invalidatePreflightFor(preflight.profileDir);
-              clearApprovalTokensFor(profile, spec);
-            } else if (outcome?.needsApproval && outcome.needsApproval.length > 0) {
-              clearApprovalTokensFor(profile, spec, { surface: "agent", owner: agentOwner });
-              const token = issueApprovalToken({
-                profile,
-                profileDir: preflight.profileDir,
-                spec,
-                preflightReport: preflight.report,
-                needsApproval: outcome.needsApproval,
-                proof: outcome.proof,
-                surface: "agent",
-                owner: agentOwner,
-                acceptWarningsActive,
-              });
-              outcome.approvalToken = token;
-              outcome.detail = `${outcome.detail ?? ""}\n\nApproval token (pass to approvalToken on retry): ${token}`;
-            } else {
-              clearApprovalTokensFor(profile, spec, { surface: "agent", owner: agentOwner });
-            }
-            return outcome;
-          });
-        return { cancel: producer.cancel, done, readOutput: producer.readOutput };
-      };
 
+      // 刻意不把 exec.signal 接进 producer：它是这一次工具调用的取消信号，
+      // 而这个调用马上就返回了。接上去等于 job 刚起就被 abort。后台任务的
+      // 取消句柄是 job_kill → producer.cancel()。
       const jobId = ctx.jobs.start({
         kind: "dsh-plugin-install",
+        // label 用归一后的 spec：防抢注解析要联网，属于 job 内部的事。
         label: `dsh plugin --profile ${profile} add ${spec}`,
         ...exec.agent ? { owner: exec.agent } : {},
-        run: runProducer,
+        run: () => createInstallJobProducer({
+          profile,
+          spec,
+          acceptWarnings: args.acceptWarnings === true,
+          reportDigest: typeof args.reportDigest === "string" ? args.reportDigest.trim() : undefined,
+          allowBuildScripts,
+          approvalToken,
+          surface: "agent",
+          owner: agentOwner,
+          npmRegistry,
+          rawSources,
+          profileExisted,
+          profileDir: installProfileDir,
+        }),
       });
       return { kind: "background", jobId };
     },
@@ -2512,7 +2866,21 @@ export async function runSelfTests() {
       surface: "browser",
       owner: "session-beta",
     });
-    check("跨浏览器 session 消费审批 token 被拒绝且销毁", !crossSessionRes.valid && /session mismatch/.test(crossSessionRes.reason));
+    // 归属不符的尝试**不许销毁** token：一旦 token 经由任何渠道泄漏，拿到
+    // 它的人也不能靠「试一下」烧掉别人的批准流程。归属校验先于一次性销毁。
+    check("跨浏览器 session 消费审批 token 被拒绝且不销毁", !crossSessionRes.valid && /session mismatch/.test(crossSessionRes.reason));
+    const rightfulSessionRes = consumeApprovalToken({
+      token: browserTok,
+      profile: "web",
+      profileDir,
+      spec: "browser-pkg",
+      preflightReport: cleanPreflightReport,
+      allowBuildScripts: ["browser-pkg"],
+      surface: "browser",
+      owner: "session-alpha",
+    });
+    check("被异 session 碰过的 token 仍归正主消费",
+      rightfulSessionRes.valid === true, `reason=${rightfulSessionRes.reason}`);
 
     // 跨 surface (browser vs agent)
     const agentProof = proofFor("agent-pkg");
@@ -2536,14 +2904,40 @@ export async function runSelfTests() {
       surface: "browser",
       owner: "browser-sess",
     });
-    check("跨 surface (agent vs browser) 消费审批 token 失败且被销毁", !crossSurfaceRes.valid && /surface mismatch/.test(crossSurfaceRes.reason));
+    check("跨 surface (agent vs browser) 消费审批 token 失败且不被销毁",
+      !crossSurfaceRes.valid && /surface mismatch/.test(crossSurfaceRes.reason));
+    const rightfulAgentRes = consumeApprovalToken({
+      token: agentTok,
+      profile: "web",
+      profileDir,
+      spec: "agent-pkg",
+      preflightReport: cleanPreflightReport,
+      allowBuildScripts: ["agent-pkg"],
+      surface: "agent",
+      owner: "agent-1",
+    });
+    check("被跨 surface 碰过的 token 仍归正主消费", rightfulAgentRes.valid === true, `reason=${rightfulAgentRes.reason}`);
 
-    // Tracker 隔离与 session 校验
+    // Tracker 隔离与 session 校验。
+    // 审批 token 由 producer 签发（createInstallJobProducer 是唯一签发者），
+    // tracker 只把 outcome.approvalToken 摘到 record 上——这里的假 producer
+    // 照真实流程先签好、挂在 outcome 里带出来。
     const trackerProof = proofFor("foo-script");
+    const trackerTok = issueApprovalToken({
+      profile: "web",
+      profileDir,
+      spec: "foo-script",
+      preflightReport: cleanPreflightReport,
+      needsApproval: disclosureFor(trackerProof),
+      proof: trackerProof,
+      surface: "browser",
+      owner: "session-alpha",
+    });
     let needsApprovalOutcome = {
       status: "needsApproval",
       needsApproval: disclosureFor(trackerProof),
       proof: trackerProof,
+      approvalToken: trackerTok,
     };
     const approvalProducer = {
       cancel: () => {},
@@ -2556,7 +2950,6 @@ export async function runSelfTests() {
     const sessionJobId = sessionTracker.start({
       profile: "web",
       spec: "foo-script",
-      profileDir,
       surface: "browser",
       session: "session-alpha",
     });
@@ -2564,9 +2957,15 @@ export async function runSelfTests() {
 
     const snapDiffSession = sessionTracker.get(sessionJobId, "session-beta").snapshot;
     check("不同 session 查询 job 时不会暴露 approvalToken", snapDiffSession.approvalToken === undefined);
+    // 整个序列化结果都不含 token——不只看 approvalToken 字段：detail、日志、
+    // 任何嵌套位置藏一份都算泄漏。
+    check("不同 session 的 get/list 序列化结果整体不含 token",
+      !JSON.stringify(sessionTracker.get(sessionJobId, "session-beta")).includes(trackerTok)
+      && !JSON.stringify(sessionTracker.list("session-beta")).includes(trackerTok));
 
     const snapSameSession = sessionTracker.get(sessionJobId, "session-alpha").snapshot;
-    check("相同 session 查询 job 时可获取 approvalToken", typeof snapSameSession.approvalToken === "string");
+    check("tracker 复制 producer 签发的 approvalToken（同 session 可见）",
+      snapSameSession.approvalToken === trackerTok);
 
     let cancelRefused = false;
     try {
@@ -2859,7 +3258,6 @@ export async function runSelfTests() {
     const jobId = tracker.start({
       profile: "fixture-profile",
       spec: "fail-pkg",
-      profileDir,
       onSettled: (outcome) => { settledOutcome = outcome; },
     });
     await new Promise((resolvePromise) => setImmediate(resolvePromise));
@@ -3042,6 +3440,695 @@ export async function runSelfTests() {
     const rolledLog = quietLog();
     runStartupRecovery("profile-a", { recover: () => ({ action: "rolled-back", reason: "静态校验未通过" }), log: rolledLog });
     check("回滚路径播报原因", rolledLog.lines.some((line) => line.includes("rolled back") && line.includes("静态校验未通过")));
+
+    // ── 12a. 预检 job 结算即 pin：用户的思考时间不该让结论作废 ──────────────
+    //
+    // 有警告时下一步是让用户读风险卡片再决定，而 PREFLIGHT_TTL 只有 30 秒。
+    // 读两条警告基本必然超时，于是点「继续安装」时缓存已过期、隔离探装整个
+    // 重跑一遍——用户看到的就是确认之后又干等几十秒。
+    {
+      const pinSpec = "pin-me";
+      const pinKey = preflightCacheKey(profileDir, pinSpec);
+      preflightCache.set(pinKey, {
+        report: { ok: true, verdict: "warning", summary: "", issues: [] },
+        fingerprint: computeProfileFingerprint(profileDir),
+        at: Date.now(),
+        pinnedAt: undefined,
+      });
+      pinPreflight(profileDir, pinSpec);
+      check("预检结算后 pin 生效（warning 是可行动结论）", isPinned(preflightCache.get(pinKey)) === true);
+
+      // 把落库时间推到 TTL 之外——没有 pin 的话这条已经该重跑了。
+      preflightCache.get(pinKey).at = Date.now() - (PREFLIGHT_TTL + 5000);
+      const stale = preflightCache.get(pinKey);
+      check("超过 30 秒 TTL 后，pin 仍让它有效（不必重跑探装）",
+        isPinned(stale) === true && Date.now() - stale.at > PREFLIGHT_TTL);
+
+      // 但 pin 绝不能护住一个已经对不上 profile 的结论：指纹一变就丢弃。
+      // 这是 pin 可以放心提前打的全部理由。
+      const patchPath = join(profileDir, "cordis.patch.yml");
+      const patchBefore = readFileSync(patchPath, "utf8");
+      writeFileSync(patchPath, `${patchBefore}\n- name: pin-test-drift\n`);
+      pinPreflight(profileDir, pinSpec);
+      check("profile 一变 → pin 拒绝钉住并丢弃缓存", preflightCache.get(pinKey) === undefined);
+      writeFileSync(patchPath, patchBefore);
+
+      // blocked 不 pin。探装失败（网络抖动）产出的是 ok:false 的 blocked，
+      // 而 immutable spec 的身份再校验不设防——钉住等于把一次临时失败固化
+      // 10 分钟，网络恢复也不会再试。真冲突的 blocked 同样没有「用户读完
+      // 再继续」的后继流程。落库时间推到 TTL 外之后必须重跑探装。
+      const failSpec = "immutable-fail@1.0.0";
+      const failKey = preflightCacheKey(profileDir, failSpec);
+      const failReport = {
+        ok: false,
+        verdict: "blocked",
+        candidate: { name: undefined, version: undefined, kind: "unknown", rows: [] },
+        issues: [{ severity: "block", title: "预检执行失败", detail: "network unreachable" }],
+        summary: "预检执行失败，正式 profile 未被修改",
+      };
+      preflightCache.set(failKey, {
+        report: failReport,
+        fingerprint: computeProfileFingerprint(profileDir),
+        at: Date.now(),
+        pinnedAt: undefined,
+      });
+      pinPreflight(profileDir, failSpec);
+      check("blocked（探装失败）不被 pin", isPinned(preflightCache.get(failKey)) === false);
+      preflightCache.get(failKey).at = Date.now() - (PREFLIGHT_TTL + 5000); // 落库时间推出 TTL
+      let failProbes = 0;
+      const failOutcome = await runPreflight({
+        profile: "unused-by-fixture",
+        spec: failSpec,
+        _profileDir: profileDir,
+        _preflightInstall: async () => { failProbes++; return { ok: true, verdict: "safe", summary: "", issues: [], candidate: { name: "immutable-fail", version: "1.0.0", kind: "bundle", rows: [] } }; },
+      });
+      check("blocked 超过 TTL → 重新探装（临时失败不会被钉 10 分钟）",
+        failProbes === 1 && failOutcome.report.verdict === "safe",
+        `probes=${failProbes} verdict=${failOutcome.report.verdict}`);
+    }
+
+    // ── 12b1. spec 形态判定：不可变可复用 / 可核验须再核 / 其余不可复用 ──────
+    {
+      const cases = [
+        ["pkg", "npm-tag"],
+        ["pkg@latest", "npm-tag"],
+        ["pkg@*", "npm-tag"],
+        ["@scope/pkg", "npm-tag"], // scoped 裸名没有 range——判定看名字后有没有东西，不看 @
+        ["pkg@^1.2.0", "npm-range"],
+        ["@scope/pkg@~2.0.0", "npm-range"],
+        ["pkg@1.2.3", "immutable"], // 精确版本：npm 禁止覆盖已发布版本
+        ["pkg@1.2.3-beta.1", "immutable"],
+        ["github:owner/repo", null], // 未钉 sha：同版本能换代码，name/version 证明不了任何事
+        ["github:owner/repo#main", null], // 分支名不是身份
+        ["github:owner/repo.git", null],
+        ["github:owner/repo#a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2", "immutable"], // 40 位 sha 钉死
+        ["file:../local.tgz", null], // 内容能原地变
+        ["link:../pkg", null],
+        ["https://example.com/pkg.tgz", null],
+        ["owner/repo", null],
+      ];
+      let kindOk = true;
+      for (const [spec, expected] of cases) {
+        if (specIdentityKind(spec) !== expected) { kindOk = false; console.error(`  specIdentityKind(${JSON.stringify(spec)}) = ${JSON.stringify(specIdentityKind(spec))}，预期 ${JSON.stringify(expected)}`); }
+      }
+      check("spec 形态判定表（immutable/npm-tag/npm-range/不可核验）", kindOk);
+
+      // github repo 提取的正则回归：懒匹配 + 可选后缀曾把 owner/repo 截成
+      // owner/r，身份查询全部打在不存在的仓库上、无声 fail-open。
+      const repoCases = [
+        ["github:owner/repo", "owner/repo"],
+        ["github:owner/repo.git", "owner/repo"],
+        ["github:owner/repo#main", "owner/repo"],
+        ["github:owner/repo#a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2", "owner/repo"],
+        ["github:owner-with-dash/repo.with.dots", "owner-with-dash/repo.with.dots"],
+        ["owner/repo", null],
+        ["github:owner", null],
+      ];
+      let repoOk = true;
+      for (const [spec, expected] of repoCases) {
+        if (githubSpecRepo(spec) !== expected) { repoOk = false; console.error(`  githubSpecRepo(${JSON.stringify(spec)}) = ${JSON.stringify(githubSpecRepo(spec))}，预期 ${JSON.stringify(expected)}`); }
+      }
+      check("github spec 的 repo 提取不截断", repoOk);
+    }
+
+    // ── 12b2. 缓存复用的候选身份再校验：fail-closed ─────────────────────────
+    //
+    // 复用必须同时核住两侧：profile 指纹 + 候选身份。核不住的形态
+    // （file:/link:/URL、未钉 sha 的 github）没有可信身份可言，registry
+    // 查不到「当前值」同样算没核住——一律丢弃缓存重跑。这里曾把「核不上
+    // 就沿用旧报告」当正确答案（fail-open），等于给所有核不住的形态开了
+    // 永久通道；fixture 一并翻转。
+    {
+      const idSpec = "mutable-pkg";
+      const idKey = preflightCacheKey(profileDir, idSpec);
+      const probeCalls = { count: 0 };
+      const probeReport = (name, version) => ({
+        verdict: "safe", summary: "", issues: [],
+        candidate: { name, version, kind: "bundle", rows: [] },
+      });
+      const seedCache = (spec, name, version) => {
+        preflightCache.set(preflightCacheKey(profileDir, spec), {
+          report: probeReport(name, version),
+          fingerprint: computeProfileFingerprint(profileDir),
+          at: Date.now(),
+          pinnedAt: Date.now(),
+        });
+      };
+      let resolveCalls = 0;
+      const run = (spec, resolve) => runPreflight({
+        profile: "unused-by-fixture",
+        spec,
+        _profileDir: profileDir,
+        registry: "https://registry.npmjs.org",
+        sources: [],
+        _resolveSpecIdentity: typeof resolve === "function" ? async (args) => { resolveCalls++; return resolve(args); } : undefined,
+        _preflightInstall: async () => { probeCalls.count++; return probeReport("mutable-pkg", "2.0.0"); },
+      });
+      const probesBefore = () => probeCalls.count;
+
+      // a) 可核验形态 + 身份一致 → 复用缓存，探装不跑。
+      seedCache(idSpec, "mutable-pkg", "1.0.0");
+      const probesBeforeA = probeCalls.count;
+      const same = await run(idSpec, async () => ({ name: "mutable-pkg", version: "1.0.0" }));
+      check("身份一致 → 复用缓存不重跑探装",
+        same.report.candidate.version === "1.0.0" && probeCalls.count === probesBeforeA,
+        `version=${same.report.candidate.version} probes=${probeCalls.count}`);
+
+      // b) latest 漂了 → 缓存作废、重跑、新报告落缓存。重跑装的正是新版，
+      //    新报告的 digest 随之变化——同意绑定由此接上。
+      const drifted = await run(idSpec, async () => ({ name: "mutable-pkg", version: "2.0.0" }));
+      check("候选漂移 → 丢弃缓存重跑探装",
+        drifted.report.candidate.version === "2.0.0" && probeCalls.count === 1,
+        `version=${drifted.report.candidate.version} probes=${probeCalls.count}`);
+      check("漂移重跑后缓存里存的是新报告",
+        preflightCache.get(idKey)?.report?.candidate?.version === "2.0.0");
+
+      // c) 核不上（registry 不可达）→ 丢弃缓存重跑，不再沿用旧报告。
+      seedCache(idSpec, "mutable-pkg", "1.0.0");
+      const unreachable = await run(idSpec, async () => undefined);
+      check("身份核不上 → 丢弃缓存重跑（fail-closed）",
+        unreachable.report.candidate.version === "2.0.0" && probeCalls.count === 2,
+        `version=${unreachable.report.candidate.version} probes=${probeCalls.count}`);
+
+      // d) 解析结果没有 version → 同样没核住，丢弃重跑。
+      seedCache(idSpec, "mutable-pkg", "1.0.0");
+      const noVersion = await run(idSpec, async () => ({ name: "mutable-pkg", version: null }));
+      check("解析结果没有 version → 丢弃缓存重跑",
+        noVersion.report.candidate.version === "2.0.0" && probeCalls.count === 3);
+
+      // e) 不可核验形态（未钉 sha 的 github）→ 身份查询根本不发起，直接重跑。
+      const ghSpec = "github:owner/repo";
+      seedCache(ghSpec, "some-pkg", "1.0.0");
+      const resolvesBefore = resolveCalls;
+      const ghRun = await run(ghSpec, async () => ({ name: "some-pkg", version: "1.0.0" }));
+      check("未钉 sha 的 github → 不发起身份查询，直接丢弃重跑",
+        resolveCalls === resolvesBefore && ghRun.report.candidate.version === "2.0.0" && probeCalls.count === 4,
+        `resolves=${resolveCalls - resolvesBefore} probes=${probeCalls.count}`);
+      const fileRun = await run("file:../local.tgz", async () => ({ name: "x", version: "1.0.0" }));
+      check("file: 路径 → 同样不可核验，直接重跑",
+        fileRun.report.candidate.version === "2.0.0" && probeCalls.count === 5);
+
+      // f) 不可变形态（精确版本）→ 不发起查询，无条件复用。
+      const exactSpec = "fixed-pkg@1.2.3";
+      seedCache(exactSpec, "fixed-pkg", "1.2.3");
+      const resolvesBeforeExact = resolveCalls;
+      const exactRun = await run(exactSpec, async () => { throw new Error("不可变形态不该发起身份查询"); });
+      check("精确版本 → 不发起身份查询，复用缓存",
+        resolveCalls === resolvesBeforeExact && exactRun.report.candidate.version === "1.2.3",
+        `resolves=${resolveCalls - resolvesBeforeExact}`);
+
+      // g) 取消上抛，且缓存保持原样——取消不是「核不上」，不许走丢弃分支。
+      seedCache(idSpec, "mutable-pkg", "1.0.0");
+      let aborted = false;
+      try {
+        await run(idSpec, async () => { const error = new Error("cancelled"); error.name = "AbortError"; throw error; });
+      } catch (error) { aborted = error?.name === "AbortError"; }
+      check("身份再校验中取消 → 上抛 AbortError 且缓存原样",
+        aborted && preflightCache.get(idKey)?.report?.candidate?.version === "1.0.0" && probeCalls.count === 5);
+
+      // h) 不可核验的形态不 pin——pin 了也只是把注定要丢弃的缓存钉在原地。
+      seedCache("github:owner/pin-test", "some-pkg", "1.0.0");
+      const pinGuardKey = preflightCacheKey(profileDir, "github:owner/pin-test");
+      preflightCache.get(pinGuardKey).pinnedAt = undefined; // 种子不带 pin
+      pinPreflight(profileDir, "github:owner/pin-test");
+      check("不可核验形态 → pinPreflight 拒绝钉住", isPinned(preflightCache.get(pinGuardKey)) === false);
+    }
+
+    // ── 12b. 预检的告警原文必须留在 job 日志里 ──────────────────────────────
+    //
+    // 此前浏览器侧只 push 了一行 verdict，逐条原因走 extras 进风险卡片。卡片
+    // 一关（或点了「继续安装」）那些原因就再也找不回来了，而用户回头想弄清
+    // 「刚才到底警告了什么」只有日志可查。
+    {
+      const log = preflightVerdictLog({
+        verdict: "warning",
+        issues: [
+          { severity: "warn", title: "无法验证宿主依赖", detail: "需要 @deepseek-ai/dsh-client-ui-slots@^0.1.0-rc.8，但预检无法解析宿主版本。" },
+          { severity: "block", title: "重复挂载", detail: "两行指向同一个模块" },
+        ],
+      });
+      check("预检日志带结论", /预检结论：warning/.test(log));
+      check("预检日志逐条带 WARN 原文（含 detail，不是只有标题）",
+        /\[WARN\] 无法验证宿主依赖: .*dsh-client-ui-slots@\^0\.1\.0-rc\.8/.test(log));
+      check("预检日志逐条带 BLOCK 原文", /\[BLOCK\] 重复挂载: 两行指向同一个模块/.test(log));
+      check("没有 issues 时不炸、仍带结论",
+        preflightVerdictLog({ verdict: "safe" }) === "[dsh-plugin-mall] 预检结论：safe\n");
+    }
+
+    // ── 12b3. 预检 job 全链路（startCustom → get）：日志行与 digest 真的
+    // 能走完 tracker 的整条路。只测 formatter 测不出「extras 序列化下发」
+    // 这一段——前端拿 digest 全靠它。
+    {
+      const integrationReport = {
+        verdict: "warning",
+        summary: "有需要确认的改动",
+        candidate: { name: "x", version: "1.0.0" },
+        issues: [{ severity: "warn", title: "替换整块 config", detail: "sandbox-policy" }],
+      };
+      const integrationTracker = createJobTracker();
+      const integrationId = integrationTracker.startCustom({
+        kind: "dsh-plugin-preflight",
+        label: "preflight x",
+        profile: "web",
+        spec: "x",
+        surface: "browser",
+        session: "sess-i",
+        run: async (push) => {
+          push("[dsh-plugin-mall] 预检 x：隔离目录探装（脚本禁用）\n");
+          push(preflightVerdictLog(integrationReport));
+          return {
+            status: "completed",
+            detail: `预检完成：${integrationReport.verdict}`,
+            extras: { ...integrationReport, consentDigest: preflightConsentDigest(integrationReport, "fp-i") },
+          };
+        },
+      });
+      await new Promise((resolvePromise) => setImmediate(resolvePromise));
+      const integrationDelta = integrationTracker.get(integrationId, "sess-i");
+      const integrationLog = integrationDelta.output ?? "";
+      check("预检 job 集成：结论与逐条 WARN 进快照输出",
+        /预检结论：warning/.test(integrationLog) && /\[WARN\] 替换整块 config: sandbox-policy/.test(integrationLog),
+        `output=${JSON.stringify(integrationLog)}`);
+      check("预检 job 集成：digest 随 extras 送达",
+        integrationDelta.snapshot?.extras?.consentDigest === preflightConsentDigest(integrationReport, "fp-i"),
+        `extras=${JSON.stringify(integrationDelta.snapshot?.extras)?.slice(0, 120)}`);
+    }
+
+    // ── 13. market_install：整条链跑在 job 里（issue #8）────────────────────
+    // 原来 registry 查询 → 防抢注解析 → 隔离预检全在 ctx.jobs.start() 之前 await，
+    // 于是几十秒里没有 job id、没有日志、job_kill 够不着，而工具描述写的是
+    // "returns a job id immediately"。这一组钉的是搬进 producer 之后的三条语义：
+    // 拒绝是 job 的结局（不是异常）、通过才跑 pnpm、进行中能真的取消。
+    // 注意：done 永不 reject 是硬约束，所以下面每条都直接 await done 拿结果。
+    {
+      // done 永不 reject 是这组的前提，所以每条都直接 await 它——可一旦回归让
+      // done 干脆不结算，await 就会永远挂住，而挂住的 Node 是「事件循环空了」
+      // 正常退出：退出码 0，`finished with N failures` 那行压根不打印，CI 全绿。
+      // 所以每个 await 都套上超时，把「没结算」变成一条会红的断言。
+      const settleWithin = async (promise, ms, label) => {
+        let timer;
+        const timeout = new Promise((resolveTimeout) => {
+          timer = setTimeout(() => resolveTimeout({ status: `<${label}：${ms}ms 内没有结算>` }), ms);
+        });
+        try {
+          return await Promise.race([promise, timeout]);
+        } finally {
+          clearTimeout(timer);
+        }
+      };
+      const cleanReport = { verdict: "clean", summary: "无冲突", issues: [] };
+      const seams = (overrides) => ({
+        _registryFor: async () => "https://registry.npmjs.org",
+        _preferNpmSpec: async ({ spec }) => spec,
+        _assertSafeToInstall: async () => {},
+        ...overrides,
+      });
+      const neverInstall = (counter) => () => {
+        counter.calls++;
+        return { cancel: () => {}, done: Promise.resolve({ status: "completed" }), readOutput: () => "" };
+      };
+
+      // 13a. 预检 blocker → failed 的 job，逐条 BLOCK 落在 detail 里，pnpm 不跑。
+      const blockedInstalls = { calls: 0 };
+      const blockedProducer = createInstallJobProducer({
+        profile: "web",
+        spec: "bad-pkg",
+        agentOwner: "agent-selftest",
+        ...seams({
+          _runPreflight: async ({ onOutput }) => {
+            onOutput?.("probe log line\n");
+            return {
+              report: {
+                verdict: "blocked",
+                summary: "候选包会改坏这个 profile",
+                issues: [{ severity: "block", title: "重复挂载", detail: "两行指向同一个模块" }],
+              },
+              profileDir,
+              fingerprint: "fp-blocked",
+            };
+          },
+          _runInstall: neverInstall(blockedInstalls),
+        }),
+      });
+      const blockedOutcome = await settleWithin(blockedProducer.done, 5000, "blocker job");
+      check("预检 blocker → job 结算为 failed（不是抛异常）", blockedOutcome?.status === "failed");
+      check("预检 blocker → detail 带上逐条 BLOCK", /\[BLOCK\] 重复挂载/.test(blockedOutcome?.detail ?? ""));
+      check("预检 blocker → pnpm 一次都不跑", blockedInstalls.calls === 0);
+      const blockedLog = blockedProducer.readOutput();
+      check("预检输出进入 job 日志（此前它根本不存在于任何 job）",
+        blockedLog.includes("probe log line") && blockedLog.includes("预检结论：blocked"));
+
+      // 13a2. warning 未获用户确认，等价于拒绝——并且指明补 acceptWarnings。
+      const warnInstalls = { calls: 0 };
+      const warnOutcome = await settleWithin(createInstallJobProducer({
+        profile: "web",
+        spec: "warn-pkg",
+        agentOwner: "agent-selftest",
+        ...seams({
+          _runPreflight: async () => ({
+            report: {
+              verdict: "warning",
+              summary: "有需要确认的改动",
+              issues: [{ severity: "warn", title: "替换整块 config", detail: "sandbox-policy" }],
+            },
+            profileDir,
+            fingerprint: "fp-warn",
+          }),
+          _runInstall: neverInstall(warnInstalls),
+        }),
+      }).done, 5000, "warning job");
+      check("预检 warning 未确认 → failed 且提示 acceptWarnings",
+        warnOutcome?.status === "failed" && /acceptWarnings: true/.test(warnOutcome?.detail ?? "") && warnInstalls.calls === 0);
+
+      // 13a2b. digest 的敏感性：报告的任何一个承重维度变了，digest 必须变。
+      // 「同意绑定的是这份报告」靠它成立——漏一个维度，那个维度上的漂移就
+      // 能从旧同意底下溜过去。
+      {
+        const consentReport = {
+          verdict: "warning",
+          candidate: { name: "warn-pkg", version: "1.0.0" },
+          issues: [{ severity: "warn", title: "替换整块 config", detail: "sandbox-policy" }],
+        };
+        const d0 = preflightConsentDigest(consentReport, "fp-consent");
+        check("digest 对同一输入稳定", d0 === preflightConsentDigest(consentReport, "fp-consent"));
+        check("issues 变化 → digest 变",
+          d0 !== preflightConsentDigest({ ...consentReport, issues: [{ severity: "warn", title: "替换整块 config", detail: "别的块" }] }, "fp-consent"));
+        check("候选版本变化 → digest 变",
+          d0 !== preflightConsentDigest({ ...consentReport, candidate: { name: "warn-pkg", version: "2.0.0" } }, "fp-consent"));
+        check("profile 指纹变化 → digest 变", d0 !== preflightConsentDigest(consentReport, "fp-other"));
+        check("verdict 变化 → digest 变", d0 !== preflightConsentDigest({ ...consentReport, verdict: "safe" }, "fp-consent"));
+      }
+
+      // 13a3. 同意绑定 digest：acceptWarnings:true 不再是无条件的通行证。
+      // 用户确认警告到重试之间，报告可能整个换过（profile 变了触发重跑、
+      // 候选发了新版）——布尔同意不得沿用，必须重新看新的警告。
+      {
+        const consentReport = {
+          verdict: "warning",
+          candidate: { name: "warn-pkg", version: "1.0.0" },
+          issues: [{ severity: "warn", title: "替换整块 config", detail: "sandbox-policy" }],
+        };
+        const consentFingerprint = "fp-consent";
+        const goodDigest = preflightConsentDigest(consentReport, consentFingerprint);
+
+        // a) digest 匹配 → 通过警告关卡，进入安装。
+        const matchInstalls = { calls: 0 };
+        const matchOutcome = await settleWithin(createInstallJobProducer({
+          profile: "web",
+          spec: "warn-pkg",
+          agentOwner: "agent-selftest",
+          acceptWarnings: true,
+          reportDigest: goodDigest,
+          ...seams({
+            _runPreflight: async () => ({ report: consentReport, profileDir, fingerprint: consentFingerprint }),
+            _runInstall: neverInstall(matchInstalls),
+          }),
+        }).done, 5000, "digest 匹配");
+        check("警告同意 digest 匹配 → 进入安装",
+          matchOutcome?.status === "completed" && matchInstalls.calls === 1,
+          `status=${matchOutcome?.status} calls=${matchInstalls.calls} detail=${matchOutcome?.detail}`);
+
+        // b) digest 过期：重跑后报告变了（多了一条警告、候选升了版本）。
+        //    拒绝，且 detail 给出**新** digest——模型照着新警告重新确认。
+        const driftedReport = {
+          verdict: "warning",
+          candidate: { name: "warn-pkg", version: "2.0.0" },
+          issues: [
+            { severity: "warn", title: "替换整块 config", detail: "sandbox-policy" },
+            { severity: "warn", title: "新版本的额外改动", detail: "loader-id 顶掉现有行" },
+          ],
+        };
+        const newDigest = preflightConsentDigest(driftedReport, consentFingerprint);
+        const driftInstalls = { calls: 0 };
+        const driftOutcome = await settleWithin(createInstallJobProducer({
+          profile: "web",
+          spec: "warn-pkg",
+          agentOwner: "agent-selftest",
+          acceptWarnings: true,
+          reportDigest: goodDigest, // 用户当初确认的是旧报告的 digest
+          ...seams({
+            _runPreflight: async () => ({ report: driftedReport, profileDir, fingerprint: consentFingerprint }),
+            _runInstall: neverInstall(driftInstalls),
+          }),
+        }).done, 5000, "digest 过期");
+        check("报告变了 → 旧 digest 拒绝安装",
+          driftOutcome?.status === "failed" && driftInstalls.calls === 0,
+          `status=${driftOutcome?.status} calls=${driftInstalls.calls}`);
+        check("报告变了 → 拒绝时展示新警告原文", /新版本的额外改动/.test(driftOutcome?.detail ?? ""));
+        check("报告变了 → 拒绝时给出新 digest 供重新确认",
+          driftOutcome?.detail?.includes(newDigest) === true && !driftOutcome.detail.includes(goodDigest));
+
+        // c) acceptWarnings:true 但压根没给 digest → 同样拒绝。
+        const bareInstalls = { calls: 0 };
+        const bareOutcome = await settleWithin(createInstallJobProducer({
+          profile: "web",
+          spec: "warn-pkg",
+          agentOwner: "agent-selftest",
+          acceptWarnings: true,
+          ...seams({
+            _runPreflight: async () => ({ report: consentReport, profileDir, fingerprint: consentFingerprint }),
+            _runInstall: neverInstall(bareInstalls),
+          }),
+        }).done, 5000, "无 digest");
+        check("acceptWarnings:true 无 digest → 拒绝并索要 digest",
+          bareOutcome?.status === "failed" && /reportDigest/.test(bareOutcome?.detail ?? "") && bareInstalls.calls === 0);
+
+        // d) 审批 token 路径不需要裸 digest：consumeApprovalToken 自己比对
+        //    报告摘要（那次真实事故「preflight report changed」就是它拦的），
+        //    再要求一份裸 digest 属于重复关卡。
+        check("审批 token 路径不受裸 digest 关卡影响",
+          preflightRefusal(consentReport, true, "lbl", { fingerprint: consentFingerprint, consentBoundByToken: true }) === undefined);
+      }
+
+      // 13a4. surface/owner 参数化：producer 是唯一签发者，浏览器 surface
+      // 签出的 token 必须归属那个 session——参数要是接错线（漏传、写死
+      // agent），token 会落在错误的归属域里，跨域消费的隔离就形同虚设。
+      {
+        const surfProof = proofFor("surf-pkg");
+        const surfOutcome = await settleWithin(createInstallJobProducer({
+          profile: "web",
+          spec: "surf-pkg",
+          surface: "browser",
+          owner: "session-surf",
+          ...seams({
+            _runPreflight: async () => ({ report: cleanReport, profileDir, fingerprint: "fp-surf" }),
+            _runInstall: () => ({
+              cancel: () => {},
+              done: Promise.resolve({
+                status: "needsApproval",
+                detail: "approval needed",
+                needsApproval: disclosureFor(surfProof),
+                proof: surfProof,
+              }),
+              readOutput: () => "",
+            }),
+          }),
+        }).done, 5000, "surface job");
+        const surfToken = surfOutcome?.approvalToken;
+        const surfConsume = typeof surfToken === "string"
+          ? consumeApprovalToken({
+            token: surfToken,
+            profile: "web",
+            profileDir,
+            spec: "surf-pkg",
+            preflightReport: cleanReport,
+            allowBuildScripts: ["surf-pkg"],
+            surface: "browser",
+            owner: "session-surf",
+          })
+          : { valid: false, reason: "no token" };
+        check("browser surface 的 producer 签发归属该 session 的 token",
+          surfConsume.valid === true,
+          `token=${typeof surfToken} reason=${surfConsume.reason}`);
+        // token 绝不进 browser 的 detail：tracker.get/list 无条件下发 detail，
+        // 只有独立的 approvalToken 字段做 session 隔离——拼进去等于发给
+        // 所有 session。浏览器只走 outcome.approvalToken → 同 session 快照。
+        check("browser surface 的 detail 不含 token（防跨 session 泄漏）",
+          !String(surfOutcome?.detail ?? "").includes(String(surfToken)),
+          `detail=${String(surfOutcome?.detail ?? "").slice(0, 120)}`);
+
+        // agent 的 detail 必须仍然带 token：宿主按 owner 隔离 job_output，
+        // 模型重试全靠从 detail 里读到它。
+        const agentProof = proofFor("surf-agent-pkg");
+        const agentDetailOutcome = await settleWithin(createInstallJobProducer({
+          profile: "web",
+          spec: "surf-agent-pkg",
+          agentOwner: "agent-surf",
+          ...seams({
+            _runPreflight: async () => ({ report: cleanReport, profileDir, fingerprint: "fp-surf-agent" }),
+            _runInstall: () => ({
+              cancel: () => {},
+              done: Promise.resolve({
+                status: "needsApproval",
+                detail: "approval needed",
+                needsApproval: disclosureFor(agentProof),
+                proof: agentProof,
+              }),
+              readOutput: () => "",
+            }),
+          }),
+        }).done, 5000, "agent surface job");
+        check("agent surface 的 detail 仍带 token（模型重试要读它）",
+          /Approval token \(pass to approvalToken on retry\)/.test(String(agentDetailOutcome?.detail ?? "")));
+      }
+
+      // 13b. 预检通过 → 进入安装。同时钉两件事：pnpm 拿到的是防抢注解析后的
+      // spec（label 用的是归一 spec，两者可以不同），以及 readOutput 的顺序。
+      let preflightSpec;
+      let installedWith;
+      const cleanProducer = createInstallJobProducer({
+        profile: "web",
+        spec: "owner/repo",
+        agentOwner: "agent-selftest",
+        ...seams({
+          _preferNpmSpec: async () => "resolved-pkg",
+          _runPreflight: async ({ spec, onOutput }) => {
+            preflightSpec = spec;
+            onOutput?.("probe ok\n");
+            return { report: cleanReport, profileDir, fingerprint: "fp-clean" };
+          },
+          _runInstall: (options) => {
+            installedWith = options;
+            const chunks = ["pnpm add output\n"];
+            return {
+              cancel: () => {},
+              done: Promise.resolve({ status: "completed", detail: "installed" }),
+              readOutput: () => chunks.splice(0).join(""),
+            };
+          },
+        }),
+      });
+      const cleanOutcome = await settleWithin(cleanProducer.done, 5000, "clean job");
+      check("预检通过 → 进入安装并结算 completed", cleanOutcome?.status === "completed");
+      check("预检与 pnpm 都用防抢注解析后的 spec",
+        preflightSpec === "resolved-pkg" && installedWith?.spec === "resolved-pkg");
+      const cleanLog = cleanProducer.readOutput();
+      check("readOutput 先排空预检缓冲、再接 install 输出",
+        cleanLog.includes("pnpm add output")
+        && cleanLog.indexOf("probe ok") < cleanLog.indexOf("pnpm add output"));
+
+      // 13c. 进行中取消：预检还在跑就按 job_kill。预检必须收到 AbortSignal，
+      // 结算为 killed 且明说 profile 没被动过，pnpm 阶段一步都不许进。
+      const cancelInstalls = { calls: 0 };
+      let preflightSignal;
+      const cancelProducer = createInstallJobProducer({
+        profile: "web",
+        spec: "slow-pkg",
+        agentOwner: "agent-selftest",
+        ...seams({
+          _runPreflight: ({ signal }) => new Promise((_resolve, rejectPreflight) => {
+            preflightSignal = signal;
+            // 真实的 preflightInstall 在取消时抛 AbortError（guard.js），照抄。
+            signal.addEventListener("abort", () => {
+              const error = new Error("preflight cancelled");
+              error.name = "AbortError";
+              rejectPreflight(error);
+            }, { once: true });
+          }),
+          _runInstall: neverInstall(cancelInstalls),
+        }),
+      });
+      await new Promise((resolveTick) => setImmediate(resolveTick)); // 跑到预检那一步
+      cancelProducer.cancel();
+      cancelProducer.cancel(); // 幂等：面板/模型都可能连按两次
+      const cancelOutcome = await settleWithin(cancelProducer.done, 5000, "取消后的 job");
+      check("进行中取消 → 预检确实收到了 AbortSignal", preflightSignal?.aborted === true);
+      check("进行中取消 → 结算为 killed", cancelOutcome?.status === "killed");
+      check("进行中取消 → 明说 profile 未被改动", /never modified/.test(cancelOutcome?.detail ?? ""));
+      check("进行中取消 → 不进入 pnpm 阶段", cancelInstalls.calls === 0);
+
+      // 13c2. profile 本来就不存在的情况。runPreflight 会先 ensureProfile()，
+      // 那是真的落盘（package.json / cordis.patch.yml / pnpm-workspace.yaml），
+      // 所以「the profile was never modified」对它是假话——用户会照着这句
+      // 认定磁盘上什么都没多出来。
+      const freshInstalls = { calls: 0 };
+      const freshProducer = createInstallJobProducer({
+        profile: "web",
+        spec: "slow-pkg",
+        agentOwner: "agent-selftest",
+        profileExisted: false,
+        profileDir, // 预检已经把它 ensureProfile 出来了（这个目录有 package.json）
+        ...seams({
+          _runPreflight: ({ signal }) => new Promise((_resolve, rejectPreflight) => {
+            signal.addEventListener("abort", () => {
+              const error = new Error("preflight cancelled");
+              error.name = "AbortError";
+              rejectPreflight(error);
+            }, { once: true });
+          }),
+          _runInstall: neverInstall(freshInstalls),
+        }),
+      });
+      await new Promise((resolveTick) => setImmediate(resolveTick));
+      freshProducer.cancel();
+      const freshOutcome = await settleWithin(freshProducer.done, 5000, "未初始化 profile 的取消");
+      check("未初始化 profile 取消 → 仍结算为 killed", freshOutcome?.status === "killed");
+      check("未初始化 profile 取消 → 不谎称「从未修改」",
+        !/never modified/.test(freshOutcome?.detail ?? ""));
+      check("未初始化 profile 取消 → 如实说明 profile 已被初始化",
+        /was initialized before the probe started/.test(freshOutcome?.detail ?? ""));
+      check("未初始化 profile 取消 → 仍然不进入 pnpm 阶段", freshInstalls.calls === 0);
+
+      // 13c3. 取消发生在预检**之前**（registry 查询这一段）。ensureProfile()
+      // 在 runPreflight 里，这时磁盘上一个字节都还没写，所以即便 profile
+      // 本来不存在，也绝不能说「已经把它初始化了」——那会让用户去找一个
+      // 根本不存在的目录。判据必须是磁盘的当前事实，不是开工前的快照。
+      const earlyInstalls = { calls: 0 };
+      let earlyPreflightCalls = 0;
+      let releaseRegistry;
+      const registryGate = new Promise((resolveGate) => { releaseRegistry = resolveGate; });
+      const earlyProducer = createInstallJobProducer({
+        profile: "web",
+        spec: "slow-pkg",
+        agentOwner: "agent-selftest",
+        profileExisted: false,
+        profileDir: join(root, "profile-that-was-never-created"),
+        ...seams({
+          // 真实的 registryFor 不吃 signal（见 producer 注释），照此模拟：
+          // 它跑完之后才轮到 throwIfAborted 生效。
+          _registryFor: async () => { await registryGate; return "https://registry.npmjs.org"; },
+          _runPreflight: () => { earlyPreflightCalls++; throw new Error("不该走到预检"); },
+          _runInstall: neverInstall(earlyInstalls),
+        }),
+      });
+      await new Promise((resolveTick) => setImmediate(resolveTick));
+      earlyProducer.cancel(); // 还卡在 registry 查询里
+      releaseRegistry();
+      const earlyOutcome = await settleWithin(earlyProducer.done, 5000, "预检之前的取消");
+      check("预检前取消 → 结算为 killed", earlyOutcome?.status === "killed");
+      check("预检前取消 → 根本没进预检", earlyPreflightCalls === 0 && earlyInstalls.calls === 0);
+      check("预检前取消 → 不谎称已初始化 profile（磁盘上什么都没建）",
+        !/was initialized before the probe started/.test(earlyOutcome?.detail ?? "")
+        && /the profile was never modified/.test(earlyOutcome?.detail ?? ""));
+
+      // 13d. 审批 token 签发失败（这里用缺失的 proof 触发）。以前这段跑在
+      // .then 里，一抛就把 done 变成 rejected —— 违反「done 必须不 reject」，
+      // 而且会把「pnpm 拦下了安装脚本」这条真结论顶掉。
+      let approvalRejected = false;
+      const approvalOutcome = await settleWithin(createInstallJobProducer({
+        profile: "web",
+        spec: "scripty-pkg",
+        agentOwner: "agent-selftest",
+        ...seams({
+          _runPreflight: async () => ({ report: cleanReport, profileDir, fingerprint: "fp-scripty" }),
+          _runInstall: () => ({
+            cancel: () => {},
+            done: Promise.resolve({
+              status: "failed",
+              detail: "installing scripty-pkg requires running install-time code — approval needed.",
+              needsApproval: [{ name: "scripty-pkg", version: "1.0.0", scripts: { install: "node install.js" } }],
+              // proof 缺失 → issueApprovalToken 必抛
+            }),
+            readOutput: () => "",
+          }),
+        }),
+      }).done.catch(() => { approvalRejected = true; return undefined; }), 5000, "审批 token 签发失败的 job");
+      check("token 签发失败不会把 done 变成 rejected", !approvalRejected && approvalOutcome !== undefined);
+      check("token 签发失败 → 原结论保留", /requires running install-time code/.test(approvalOutcome?.detail ?? ""));
+      check("token 签发失败 → detail 明说这次没法用 allowBuildScripts 重试",
+        /no approval token could be issued/.test(approvalOutcome?.detail ?? ""));
+      check("token 签发失败 → 不对外交出 approvalToken", approvalOutcome?.approvalToken === undefined);
+    }
   } finally {
     rmSync(root, { recursive: true, force: true });
   }
@@ -3051,10 +4138,20 @@ export async function runSelfTests() {
 
 if (process.argv.includes("--self-test")) {
   console.log("index.js self-test:");
+  // 挂住的 suite 不会失败，会「成功」：await 一个永不结算的 promise 之后事件
+  // 循环就空了，Node 正常退出，退出码 0，而 `finished with N failures` 那行
+  // 根本没打印——CI 看到的是全绿。这个看门狗刻意不 unref（unref 掉就拦不住
+  // 那次正常退出了），跑完由下面 clearTimeout 收掉。
+  const watchdog = setTimeout(() => {
+    console.error("index.js self-test: 超时未跑完——有 fixture 挂住了（producer 的 done 从未结算？）");
+    process.exit(1);
+  }, 120000);
   runSelfTests().then((failed) => {
+    clearTimeout(watchdog);
     console.log(`index.js tests finished with ${failed} failures.`);
     process.exit(failed === 0 ? 0 : 1);
   }).catch((err) => {
+    clearTimeout(watchdog);
     console.error("Self-test threw:", err);
     process.exit(1);
   });