@1e0zj/dsh-plugin-mall 0.4.12 → 0.4.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1e0zj/dsh-plugin-mall",
-  "version": "0.4.12",
+  "version": "0.4.14",
   "description": "dsh 插件市场：搜索 GitHub dsh-plugin 话题下的插件仓库，一键安装到本地 dsh profile（agent 工具 + 设置页插件市场 tab）",
   "type": "module",
   "main": "src/index.js",

package/src/cli.js

@@ -61,6 +61,7 @@ import {
   resolveDshHome,
   rollbackPendingSnapshot,
   validateInstalledProfile,
+  validatePendingProfile,
   validateRemoveCompletion,
 } from "./guard.js";
 // github.js imports node builtins only — the host-independence of this CLI is
@@ -502,7 +503,7 @@ async function cmdAdd({ spec, profile, home, acceptWarnings }) {
   //    rolled back immediately; otherwise the marker stays pending and the next
   //    dsh startup (or `guard recover`) commits it once the plugin actually
   //    loads.
-  const validation = validateInstalledProfile(profileDir);
+  const validation = validatePendingProfile(profileDir);
   if (result.exitCode === 0 && validation.ok) {
     console.log(`[guard] installed ${spec} into profile "${profile}".`);
     console.log("Restart dsh to load it. On the next startup — or via `node src/cli.js guard recover` — the pending snapshot is committed once the profile proves loadable; if dsh fails to boot, the same command rolls it back.");
@@ -596,7 +597,7 @@ async function cmdRemove({
 
   let validation;
   try {
-    validation = validateInstalledProfile(profileDir);
+    validation = validatePendingProfile(profileDir);
   } catch (error) {
     rollbackAndThrow(`remove completed but static profile validation threw: ${error.message}`);
   }
@@ -1327,7 +1328,7 @@ async function cmdLaunch({
     }
     let validation;
     try {
-      validation = validateInstalledProfile(profileDir);
+      validation = validatePendingProfile(profileDir, marker);
     } catch (error) {
       throw new Error(`static validation of profile "${profile}" failed — refusing to launch: ${error.message}`);
     }

package/src/client.js

@@ -443,7 +443,7 @@ window.__ModuleLoader__.load({
         meta: clip(props.spec || "", 50),
         actions: actions,
       },
-        props.detail ? h("div", { className: "mkt_desc" }, props.detail) : null,
+        h("div", { className: "mkt_desc" }, "pnpm 已拦截下列安装脚本，尚未执行任何插件代码。允许后会先复核制品再运行；暂不允许时，重启 dsh 会自动撤回这次安装。"),
         pkgs.map(function (p, index) {
           var facts = [];
           if (typeof p.weeklyDownloads === "number") facts.push("周下载 " + p.weeklyDownloads.toLocaleString());
@@ -609,7 +609,6 @@ window.__ModuleLoader__.load({
             job.needsApproval && job.needsApproval.length > 0
               ? h(ApprovalRequest, {
                 spec: job.spec,
-                detail: job.detail,
                 needsApproval: job.needsApproval,
                 busy: props.approving === job.spec,
                 onApprove: function (names) {

package/src/guard.js

@@ -24,8 +24,10 @@ import {
 import { homedir, tmpdir } from "node:os";
 import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { createRequire } from "node:module";
+import { createHash } from "node:crypto";
 import { JSON_SCHEMA, Type, load } from "js-yaml";
 import { satisfies, validRange } from "semver";
+import { stripTerminalControlSequences } from "./terminal.js";
 
 // Official patches (e.g. @deepseek-ai/dsh-base, dsh-web-app) mark raw JS
 // expressions with the scalar tag `!!js`. Construct the loader's own marker —
@@ -1450,6 +1452,84 @@ export function validateInstalledProfile(profileDir) {
   };
 }
 
+/** Stable identity for one installed-profile blocker across a transaction. */
+function staticBlockerFingerprint(entry) {
+  const canonical = (value) => {
+    if (Array.isArray(value)) return value.map(canonical);
+    if (value !== null && typeof value === "object") {
+      return Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonical(value[key])]));
+    }
+    return value;
+  };
+  return createHash("sha256").update(JSON.stringify(canonical(entry))).digest("hex");
+}
+
+function staticBlockerFingerprints(validation) {
+  return validation.issues
+    .filter((entry) => entry.severity === "block")
+    .map(staticBlockerFingerprint);
+}
+
+/**
+ * Validate the live profile relative to the state captured before a pending
+ * transaction. An unchanged blocker that was already present did not come
+ * from this install/remove and must not make the transaction roll back. New
+ * markers carry the baseline; old markers do not, and deliberately retain the
+ * old fail-closed behaviour.
+ */
+export function validatePendingProfile(profileDir, pending = readValidatedPendingSnapshot(profileDir)) {
+  const validation = validateInstalledProfile(profileDir);
+  if (!Array.isArray(pending?.baselineBlockers)) {
+    return { ...validation, allIssues: validation.issues, preexistingIssues: [] };
+  }
+
+  const candidateName = pending.preflight?.candidate?.name ?? pending.candidate?.name;
+  const remaining = new Map();
+  for (const fingerprint of pending.baselineBlockers) {
+    remaining.set(fingerprint, (remaining.get(fingerprint) ?? 0) + 1);
+  }
+  const issues = [];
+  const preexistingIssues = [];
+  for (const entry of validation.issues) {
+    if (entry.severity !== "block") {
+      issues.push(entry);
+      continue;
+    }
+    // Updating the package that owns (or participates in) an old blocker must
+    // prove that blocker was actually fixed. Only unrelated historical issues
+    // receive baseline treatment.
+    const candidateRelated = entry.package === candidateName
+      || (Array.isArray(entry.conflictsWith) && entry.conflictsWith.includes(candidateName));
+    if (candidateRelated) {
+      issues.push(entry);
+      continue;
+    }
+    const fingerprint = staticBlockerFingerprint(entry);
+    const count = remaining.get(fingerprint) ?? 0;
+    if (count > 0) {
+      preexistingIssues.push(entry);
+      remaining.set(fingerprint, count - 1);
+    } else {
+      issues.push(entry);
+    }
+  }
+  const blockers = issues.filter((entry) => entry.severity === "block");
+  const warnings = issues.filter((entry) => entry.severity === "warn");
+  const verdict = blockers.length > 0 ? "blocked" : warnings.length > 0 ? "warning" : "safe";
+  return {
+    ok: blockers.length === 0,
+    verdict,
+    issues,
+    allIssues: validation.issues,
+    preexistingIssues,
+    summary: blockers.length > 0
+      ? `发现 ${blockers.length} 个本次新增阻断问题、${preexistingIssues.length} 个既有阻断问题、${warnings.length} 个警告`
+      : preexistingIssues.length > 0
+        ? `本次变更未新增阻断问题（保留 ${preexistingIssues.length} 个既有阻断问题）`
+        : validation.summary,
+  };
+}
+
 /**
  * Remove leftover `node_modules` entries for packages that are no longer part
  * of the profile's declared dependencies. pnpm hoists each direct dependency
@@ -1723,7 +1803,7 @@ function spawnCapture(command, args, options, onOutput, { signal, treeKill = fal
     let child;
     const chunks = [];
     const push = (value) => {
-      const text = value.toString();
+      const text = stripTerminalControlSequences(value);
       chunks.push(text);
       onOutput?.(text);
     };
@@ -1831,7 +1911,7 @@ export async function preflightInstall({ profileDir, spec, onOutput, signal }) {
     const result = await spawnCapture(
       plan.command,
       probeAddArgs(spec),
-      { cwd: probeDir, env: process.env, shell: plan.shell },
+      { cwd: probeDir, env: pnpmGuardEnv(process.env), shell: plan.shell },
       onOutput,
       { signal, treeKill: plan.treeKill },
     );
@@ -1998,6 +2078,9 @@ function assertStoredTransactionMatches(pending) {
   if (pending.operation === "remove" && stored.metadata.packageName !== pending.metadata.packageName) {
     throw new Error("pending remove packageName does not match snapshot.json — refusing to act on it (left untouched for manual inspection)");
   }
+  if (JSON.stringify(stored.baselineBlockers) !== JSON.stringify(pending.baselineBlockers)) {
+    throw new Error("pending marker baseline blockers do not match snapshot.json — refusing to act on it (left untouched for manual inspection)");
+  }
 }
 
 /**
@@ -2037,6 +2120,12 @@ function sanitizeSnapshot(marker, home) {
   if (!Array.isArray(marker.dependencies) || marker.dependencies.some((name) => typeof name !== "string" || !NPM_PACKAGE_NAME_RE.test(name))) {
     throw new Error("pending marker has missing or corrupt dependency metadata — refusing to act on it (left untouched for manual inspection)");
   }
+  if (marker.baselineBlockers !== undefined && (
+    !Array.isArray(marker.baselineBlockers)
+    || marker.baselineBlockers.some((fingerprint) => typeof fingerprint !== "string" || !/^[a-f0-9]{64}$/.test(fingerprint))
+  )) {
+    throw new Error("pending marker has corrupt baseline blocker metadata — refusing to act on it (left untouched for manual inspection)");
+  }
   validatePendingTransaction(marker);
   const profileDir = resolve(String(marker.profileDir ?? ""));
   const profilesRoot = resolve(join(home, "profiles"));
@@ -2090,7 +2179,12 @@ export function createProfileSnapshot(profileDir, metadata = {}) {
   } catch {
     /* manifest unreadable — the rest of the snapshot still captures the bytes */
   }
-  const snapshot = { version: SNAPSHOT_VERSION, id, dir, profileDir, createdAt: Date.now(), files, dependencies, operation: normalizedMetadata.operation, metadata: normalizedMetadata };
+  // Static validation after an install must judge what THIS transaction
+  // changed. Without this baseline, an unrelated legacy plugin that already
+  // shadowed host modules made every later update look guilty and forced the
+  // marketplace itself back to its old version on restart.
+  const baselineBlockers = staticBlockerFingerprints(validateInstalledProfile(profileDir));
+  const snapshot = { version: SNAPSHOT_VERSION, id, dir, profileDir, createdAt: Date.now(), files, dependencies, baselineBlockers, operation: normalizedMetadata.operation, metadata: normalizedMetadata };
   writeFileSync(join(dir, "snapshot.json"), JSON.stringify(snapshot, undefined, 2) + "\n");
   return snapshot;
 }
@@ -2127,7 +2221,7 @@ export function markPendingSnapshot(snapshot, record = {}) {
   if (existsSync(markerPath)) {
     throw new Error(`profile already has a pending install marker at ${markerPath} — run \`dsh-plugin-guard guard recover\` (or let dsh startup recovery consume it) before installing again`);
   }
-  const pending = { ...snapshot, ...record, pendingAt: Date.now() };
+  const pending = { ...snapshot, ...record, baselineBlockers: snapshot.baselineBlockers, pendingAt: Date.now() };
   // Reject producer bugs before persisting them. The read/recovery boundary
   // repeats this validation because the marker is attacker-controllable.
   validatePendingTransaction(pending);
@@ -2212,6 +2306,13 @@ function addedDependencyNames(pending, originalDependencies = pending?.dependenc
 export function pnpmGuardEnv(base = process.env) {
   return {
     ...base,
+    // Browser jobs render plain text rather than a terminal. Prevent pnpm from
+    // emitting colours at the source; output capture also strips CSI controls
+    // defensively in case a child ignores these conventional switches.
+    NO_COLOR: "1",
+    FORCE_COLOR: "0",
+    npm_config_color: "false",
+    NPM_CONFIG_COLOR: "false",
     npm_config_auto_install_peers: "false",
     NPM_CONFIG_AUTO_INSTALL_PEERS: "false",
   };
@@ -2855,7 +2956,7 @@ export function recoverProfile(profileDir) {
       rebuild: rolled?.rebuild,
     };
   }
-  const validation = validateInstalledProfile(profileDir);
+  const validation = validatePendingProfile(profileDir, pending);
   const candidateName = pending.preflight?.candidate?.name ?? pending.candidate?.name;
   const removeValidation = isRemove
     ? validateRemoveCompletion(pending.profileDir, candidateName)
@@ -3958,6 +4059,58 @@ async function selfTest() {
       if (existsSync(snap.dir)) throw new Error("recoverProfile commit should delete the snapshot dir");
     }
 
+    // A blocker that predates the transaction is still a real profile problem,
+    // but it is not evidence that this update broke the profile. This is the
+    // reported marketplace self-update failure: an unrelated legacy plugin
+    // shadows host modules, so the new mall version used to be rolled back.
+    {
+      const p = join(root, "profiles", "preexisting-blocker");
+      mkdirSync(join(p, "node_modules", "legacy"), { recursive: true });
+      mkdirSync(join(p, "node_modules", "good"), { recursive: true });
+      writeFileSync(join(p, "package.json"), JSON.stringify({ dependencies: { legacy: "1.0.0", good: "1.0.0" } }));
+      writeFileSync(join(p, "cordis.patch.yml"), "[]\n");
+      writeFileSync(join(p, "node_modules", "legacy", "package.json"), JSON.stringify({
+        name: "legacy", version: "1.0.0", dependencies: { "@deepseek-ai/dsh-llm": "*" },
+      }));
+      writeFileSync(join(p, "node_modules", "good", "package.json"), JSON.stringify({ name: "good", version: "1.0.0" }));
+      if (validateInstalledProfile(p).issues.filter((entry) => entry.code === "host-module-shadow").length !== 1) {
+        throw new Error("pre-existing blocker fixture prerequisite failed");
+      }
+      const snap = createProfileSnapshot(p, { fixture: true });
+      markPendingSnapshot(snap, { spec: "good@2.0.0", preflight: { candidate: { name: "good", version: "2.0.0", kind: "plain" } } });
+      writeFileSync(join(p, "package.json"), JSON.stringify({ dependencies: { legacy: "1.0.0", good: "2.0.0" } }));
+      writeFileSync(join(p, "node_modules", "good", "package.json"), JSON.stringify({ name: "good", version: "2.0.0" }));
+      const relative = validatePendingProfile(p);
+      if (!relative.ok || relative.preexistingIssues.length !== 1 || relative.issues.some((entry) => entry.severity === "block")) {
+        throw new Error(`unchanged pre-existing blocker must not condemn this update: ${JSON.stringify(relative)}`);
+      }
+      const rec = recoverProfile(p);
+      if (rec.action !== "committed") throw new Error(`unchanged pre-existing blocker should commit this update, got ${rec.action}`);
+      if (readJson(join(p, "node_modules", "good", "package.json")).version !== "2.0.0") {
+        throw new Error("committing past a pre-existing blocker must keep the updated candidate");
+      }
+      console.log("PASS pending 基线：既有宿主模块 blocker 不再回滚无关更新");
+
+      const candidateProfile = join(root, "profiles", "candidate-own-blocker");
+      mkdirSync(join(candidateProfile, "node_modules", "legacy"), { recursive: true });
+      writeFileSync(join(candidateProfile, "package.json"), JSON.stringify({ dependencies: { legacy: "1.0.0" } }));
+      writeFileSync(join(candidateProfile, "cordis.patch.yml"), "[]\n");
+      writeFileSync(join(candidateProfile, "node_modules", "legacy", "package.json"), JSON.stringify({
+        name: "legacy", version: "1.0.0", dependencies: { "@deepseek-ai/dsh-llm": "*" },
+      }));
+      const ownSnap = createProfileSnapshot(candidateProfile, { fixture: true });
+      markPendingSnapshot(ownSnap, { spec: "legacy@2.0.0", preflight: { candidate: { name: "legacy", version: "2.0.0", kind: "plain" } } });
+      writeFileSync(join(candidateProfile, "node_modules", "legacy", "package.json"), JSON.stringify({
+        name: "legacy", version: "2.0.0", dependencies: { "@deepseek-ai/dsh-llm": "*" },
+      }));
+      const own = validatePendingProfile(candidateProfile);
+      if (own.ok || !own.issues.some((entry) => entry.code === "host-module-shadow")) {
+        throw new Error("an updated candidate must not inherit an exemption for its own old blocker");
+      }
+      commitPendingSnapshot(candidateProfile);
+      console.log("PASS pending 基线：候选自身的既有 blocker 必须在更新中修复");
+    }
+
     // Approval-pause mark, part 1: a paused marker must NEVER commit on
     // recovery — not even when the static validation would pass (the version
     // sits there with its build scripts never approved; committing would drop
@@ -4602,6 +4755,21 @@ async function selfTest() {
       if (env.npm_config_auto_install_peers !== "false" || env.NPM_CONFIG_AUTO_INSTALL_PEERS !== "false") {
         throw new Error("pnpmGuardEnv must disable peer auto-install");
       }
+      if (env.NO_COLOR !== "1" || env.FORCE_COLOR !== "0"
+        || env.npm_config_color !== "false" || env.NPM_CONFIG_COLOR !== "false") {
+        throw new Error("pnpmGuardEnv must disable terminal colours for browser job logs");
+      }
+
+      let streamed = "";
+      const coloured = await spawnCapture(
+        process.execPath,
+        ["-e", "process.stdout.write('\\u001b[96mprobe ok\\u001b[39m\\n')"],
+        { env: process.env, shell: false },
+        (text) => { streamed += text; },
+      );
+      if (coloured.exitCode !== 0 || coloured.output !== "probe ok\n" || streamed !== "probe ok\n") {
+        throw new Error(`spawnCapture must strip terminal controls from captured and streamed logs: ${JSON.stringify({ coloured, streamed })}`);
+      }
     }
 
     // candidateRestoredCompatible: version vs the restored dependency spec.
@@ -5279,4 +5447,4 @@ if (process.argv[1]?.endsWith("guard.js") && process.argv.includes("--self-test"
     console.error(`FAIL ${error.stack ?? error.message}`);
     process.exitCode = 1;
   });
-}
+}

package/src/index.js

@@ -1026,13 +1026,12 @@ export function resolveRestartLaunchPlan({ profile, config = {}, isWindows }) {
 
   const nodePath = process.execPath;
   const originalDshArgs = process.argv.slice(2);
-  // A restart is always requested from a page that is open and that reconnects
-  // to the successor on its own, so dsh's start-up browser handoff would only
-  // add a second window onto the one already showing the result. Suppressing it
-  // is safe HERE and nowhere else: this route is gated on a live browser
-  // session. If the flag is already in the original argv, leave it alone.
-  const suppressOpen = !originalDshArgs.includes("--no-open");
-  const dshArgs = suppressOpen ? [...originalDshArgs, "--no-open"] : [...originalDshArgs];
+  // Restart the exact command the user started. `--no-open` belongs to newer
+  // Web profiles, not to the stable dsh launcher contract; adding it here made
+  // older hosts reject the successor with "unknown option '--no-open'" after
+  // the outgoing process had already exited. A duplicate browser tab is less
+  // harmful than inventing an argv capability the running host never proved.
+  const dshArgs = [...originalDshArgs];
   // The outgoing host names itself so `guard launch` can wait for it to be
   // gone before binding the port — see --await-exit in cli.js.
   const args = [cliPath, "guard", "launch", "--profile", name, "--await-exit", String(process.pid), "--", nodePath, dshEntry, ...dshArgs];
@@ -1045,7 +1044,6 @@ export function resolveRestartLaunchPlan({ profile, config = {}, isWindows }) {
     dshEntry,
     dshArgs,
     profile: name,
-    suppressedBrowserOpen: suppressOpen,
     awaitExitPid: process.pid,
   };
 }
@@ -3350,15 +3348,15 @@ export async function runSelfTests() {
           const dshArgs = plan.args.slice(dashDash + 3); // -- node <dshEntry> …
           check("重启带 --await-exit 且是本进程 pid", plan.args[plan.args.indexOf("--await-exit") + 1] === String(process.pid) && plan.awaitExitPid === process.pid);
           check("--await-exit 排在 `--` 之前（是 guard 的参数，不是 dsh 的）", plan.args.indexOf("--await-exit") < dashDash);
-          check("重启给 dsh 补 --no-open", dshArgs.includes("--no-open") && plan.suppressedBrowserOpen === true);
-          check("原始 dsh 参数原样保留", dshArgs.slice(0, 2).join(" ") === "--profile web");
+          check("重启不注入宿主版本相关参数", dshArgs.join(" ") === "--profile web" && !dshArgs.includes("--no-open"));
+          check("原始 dsh 参数原样保留", dshArgs.join(" ") === "--profile web");
           check("plan 附带可见模式所需的 dshArgs", plan.dshArgs.join(" ") === dshArgs.join(" "));
 
-          // 用户自己已经写了 --no-open 时不重复追加。
+          // 用户自己传给宿主的参数仍逐字保留。
           process.argv = [process.execPath, "/x/bin.js", "--profile", "web", "--no-open"];
           const already = resolveRestartLaunchPlan({ profile: "web", config: { allowRestart: true } });
           const alreadyArgs = already.ok ? already.args.slice(already.args.indexOf("--") + 3) : [];
-          check("已有 --no-open 则不重复追加", already.ok && alreadyArgs.filter((a) => a === "--no-open").length === 1 && already.suppressedBrowserOpen === false);
+          check("用户原有 --no-open 原样保留", already.ok && alreadyArgs.filter((a) => a === "--no-open").length === 1);
         } else {
           // 裸检出里解析不到官方 dsh 入口，plan 只能 fail——说清楚，别假装验过。
           console.log(`  SKIP 重启 argv fixture（${plan.error}）`);
@@ -3546,7 +3544,7 @@ export async function runSelfTests() {
           readyFile: join(fileRoot, "r1.json"),
           cwd: "C:/w",
           command: "C:/node/node.exe",
-          args: ["C:/dsh/index.js", "web", "--no-open"],
+          args: ["C:/dsh/index.js", "web"],
         };
         check("plan payload 校验通过", validateRestartPlanPayload(basePlan).ok === true);
         for (const [override, needle] of [
@@ -3744,7 +3742,7 @@ export async function runSelfTests() {
           nodePath: process.execPath,
           cliPath: join(visibleRoot, "cli.js"),
           dshEntry: join(visibleRoot, "dsh-entry.js"),
-          dshArgs: ["--profile", "web", "--no-open"],
+          dshArgs: ["--profile", "web"],
           profile: "web",
           awaitExitPid: 4242,
         };

package/src/installer.js

@@ -16,7 +16,8 @@ import { createHash } from "node:crypto";
 import { dump, load } from "js-yaml";
 import { DEFAULT_PROFILE_BUNDLES, PROFILE_TEMPLATES, initProfile, resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
 import { describeBuildScripts, npmNameOf } from "./github.js";
-import { clearPendingApprovalPause, commitPendingSnapshot, createProfileSnapshot, describeRollbackRebuild, markPendingApprovalPause, markPendingSnapshot, mcpEntryAuditForInstall, pausedCandidateBeforeState, pendingApprovalPaused, pnpmGuardEnv, pnpmSpawnPlan, readValidatedPendingSnapshot, rollbackPendingSnapshot, validateInstalledProfile, validateRemoveCompletion } from "./guard.js";
+import { clearPendingApprovalPause, commitPendingSnapshot, createProfileSnapshot, describeRollbackRebuild, markPendingApprovalPause, markPendingSnapshot, mcpEntryAuditForInstall, pausedCandidateBeforeState, pendingApprovalPaused, pnpmGuardEnv, pnpmSpawnPlan, readValidatedPendingSnapshot, rollbackPendingSnapshot, validatePendingProfile, validateRemoveCompletion } from "./guard.js";
+import { stripTerminalControlSequences } from "./terminal.js";
 
 // ── spec normalization ──────────────────────────────────────────────────────
 
@@ -630,12 +631,20 @@ const NPM_NAME_RE = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/i;
  */
 function parseIgnoredBuilds(output) {
   const found = new Map();
+  // pnpm enables colours even though stdout/stderr are pipes on some Windows
+  // setups (observed with pnpm 11).  A reset code after the selector makes the
+  // anchored `@version` parser miss, so `node-pty@1.1.0\x1b[39m` used to be
+  // treated as an invalid package name and the approval pause became an
+  // ordinary failed install. Strip CSI terminal controls again here as a
+  // fail-closed parsing boundary; the stream capture already removes them from
+  // the plain-text job log shown to users.
+  const plainOutput = stripTerminalControlSequences(output);
   // Only pnpm's own notice line is a parsing source. "allowBuilds" also
   // appears in pnpm's advice/error text (never followed by a name list), and
   // matching it fed error echoes into the allow-list, corrupting the YAML.
   const pattern = /(?:Ignored build scripts|onlyBuiltDependencies)\s*:\s*([^\n]+)/gi;
   let match;
-  while ((match = pattern.exec(output)) !== null) {
+  while ((match = pattern.exec(plainOutput)) !== null) {
     for (const raw of match[1].split(",")) {
       const candidate = raw.trim();
       if (candidate.length === 0) continue;
@@ -1562,10 +1571,11 @@ function pendingMarkerPath(profileDir) {
 function renderApprovalNeeded(spec, disclosure) {
   const lines = [
     `installing ${spec} requires running install-time code — approval needed.`,
-    "No install script ran and no plugin code loaded. The profile was restored",
-    "to its pre-install state. On approval, pnpm resolves again with scripts",
-    "blocked; the materialized bytes and commands must match this disclosure",
-    "before the verified tree is rebuilt. Nothing is left behind if you cancel.",
+    "No install script ran and no plugin code loaded. The candidate is staged",
+    "with its scripts blocked, and the original profile snapshot is retained.",
+    "On approval, the materialized bytes and commands must match this disclosure",
+    "before the verified tree is rebuilt. If you do not approve, restart dsh or",
+    "run `dsh-plugin-guard guard recover` to roll the paused transaction back.",
     "",
   ];
   for (const entry of disclosure) {
@@ -1661,8 +1671,9 @@ function runInstallInner({ profile, spec, allowBuildScripts, approvedProof, pref
   const collected = [];
   const deltaQueue = [];
   const push = (text) => {
-    collected.push(text);
-    deltaQueue.push(text);
+    const plainText = stripTerminalControlSequences(text);
+    collected.push(plainText);
+    deltaQueue.push(plainText);
   };
 
   const workspacePath = join(profileDir, "pnpm-workspace.yaml");
@@ -2154,7 +2165,7 @@ function runRemoveInner({ profile, packageName, _profileDir, _spawn, _corepack =
   }
   const deltaQueue = [];
   const push = (text) => {
-    deltaQueue.push(text);
+    deltaQueue.push(stripTerminalControlSequences(text));
   };
   let current = undefined;
   let cancelRequested = false; // see endedByCancel: exit codes cannot tell us this on Windows
@@ -2221,7 +2232,7 @@ function runRemoveInner({ profile, packageName, _profileDir, _spawn, _corepack =
   try {
     proc = (_spawn ?? spawn)(plan.command, ["remove", packageName, "--reporter=append-only"], {
       cwd: profileDir,
-      env: process.env,
+      env: pnpmGuardEnv(process.env),
       shell: plan.shell,
       stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true,
@@ -2284,7 +2295,7 @@ function runRemoveInner({ profile, packageName, _profileDir, _spawn, _corepack =
       // 退出码 0 不等于卸干净了。落盘校验用的是启动恢复同一套判据：
       // profile 整体仍然自洽，且这个包确实从清单和装配层里消失了。任何一条
       // 不过就还原——一个「装着但坏」的 profile 比一个没卸掉的插件糟得多。
-      const profileCheck = validateInstalledProfile(profileDir);
+      const profileCheck = validatePendingProfile(profileDir);
       const removeCheck = validateRemoveCompletion(profileDir, packageName);
       if (!profileCheck.ok || !removeCheck.ok) {
         const blockers = [...profileCheck.issues, ...removeCheck.issues]
@@ -2703,7 +2714,10 @@ async function runTransactionFixtures() {
     try {
       materializeFakePackage(profileDir, "some-plugin", "1.0.0");
       materializeFakePackage(profileDir, "node-pty", "1.0.0", { install: "node install.js" });
-      const { spawnFn, calls } = scriptedSpawn([{ code: 0, out: "Packages are cloned\nIgnored build scripts: node-pty@1.0.0\nDone\n" }]);
+      // pnpm 11 on Windows may colour stderr even when it is captured through a
+      // pipe.  In particular, the reset code lands directly after the selector.
+      const colouredIgnoredBuilds = "Packages are cloned\n\u001b[31mIgnored build scripts: node-pty@1.0.0\u001b[39m\nDone\n";
+      const { spawnFn, calls } = scriptedSpawn([{ code: 0, out: colouredIgnoredBuilds }]);
       const producer = runInstall({
         profile: "p",
         spec: "some-plugin",
@@ -2725,7 +2739,7 @@ async function runTransactionFixtures() {
       const output = producer.readOutput();
       const markerBefore = pendingMarkerPath(profileDir);
       check(
-        "退出码 0 + Ignored build scripts（未批准）→ 停在批准闸，返回 proof，不 finalize，暂停保留 marker",
+        "退出码 0 + 彩色 Ignored build scripts（未批准）→ 停在批准闸，返回 proof，不 finalize，暂停保留 marker",
         outcome.status === "failed"
           && Array.isArray(outcome.needsApproval)
           && outcome.needsApproval.some((entry) => entry.name === "node-pty")
@@ -2740,7 +2754,11 @@ async function runTransactionFixtures() {
             && entry.weeklyDownloads === 123)
           && calls.length === 1
           && existsSync(markerBefore)
-          && /paused for build-script approval/.test(output),
+          && /candidate is staged/.test(outcome.detail ?? "")
+          && !/profile was restored/.test(outcome.detail ?? "")
+          && /paused for build-script approval/.test(output)
+          && /Ignored build scripts: node-pty@1\.0\.0/.test(output)
+          && !output.includes("\u001b["),
         `status=${outcome.status} calls=${calls.length} marker=${existsSync(markerBefore)}`,
       );
       check(
@@ -3413,7 +3431,7 @@ async function runTransactionFixtures() {
       let snapshotsWhileRunning = [];
       const { spawnFn } = scriptedSpawn([{
         code: 0,
-        out: "Done\n",
+        out: "\u001b[32mDone\u001b[39m\n",
         // pnpm 真正卸掉：清单与目录都拿走，落盘校验才会通过。
         beforeExit: () => {
           snapshotsWhileRunning = listSnapshots();
@@ -3423,14 +3441,17 @@ async function runTransactionFixtures() {
           rmSync(join(profileDir, "node_modules", "pkg-f"), { recursive: true, force: true });
         },
       }]);
-      const outcome = await runRemove({ profile: "p", packageName: "pkg-f", _profileDir: profileDir, _spawn: spawnFn }).done;
+      const producer = runRemove({ profile: "p", packageName: "pkg-f", _profileDir: profileDir, _spawn: spawnFn });
+      const outcome = await producer.done;
+      const output = producer.readOutput();
       const snapshotsLeft = listSnapshots();
       check(
-        "卸载成功 → marker 与 snapshot 都被提交清理（且快照确实创建过）",
+        "卸载成功 → 日志去色，marker 与 snapshot 都被提交清理（且快照确实创建过）",
         outcome.status === "completed"
           && snapshotsWhileRunning.length === 1
           && !existsSync(pendingMarkerPath(profileDir))
-          && snapshotsLeft.length === 0,
+          && snapshotsLeft.length === 0
+          && output === "Done\n",
         `status=${outcome.status} 运行中快照=${snapshotsWhileRunning.join(",")} marker=${existsSync(pendingMarkerPath(profileDir))} 残留快照=${snapshotsLeft.join(",")} detail=${JSON.stringify(outcome.detail)}`,
       );
     } finally {

package/src/terminal.js

@@ -0,0 +1,11 @@
+// Job logs are rendered as plain text in the browser. Child processes such as
+// pnpm may still emit terminal colour controls when their stdio is piped (for
+// example when FORCE_COLOR is inherited), which the browser shows as `[96m`.
+// Keep the sanitizer dependency-free and limited to CSI sequences: those cover
+// pnpm's colours/progress controls without deleting ordinary user text.
+
+const ANSI_CSI_RE = new RegExp("\\u001b\\[[0-?]*[ -/]*[@-~]", "g");
+
+export function stripTerminalControlSequences(value) {
+  return String(value ?? "").replace(ANSI_CSI_RE, "");
+}