@1e0zj/dsh-plugin-mall 0.4.12 → 0.4.15

package/README.md

@@ -128,6 +128,44 @@ pnpm --dir <profile> add "github:omdsh-dev/dsh-at-file" --ignore-scripts
 > `dsh-plugin-guard recover` does repair this.
 
 
+## Update stuck at the install-script approval card? (updates *to* 0.4.15)
+
+Symptom: updating the marketplace itself pauses at "安装期代码需要确认", and
+clicking 允许 fails with `allowBuildScripts cannot be specified on initial
+install`. Clicking again does not help.
+
+Who hits it: only profiles that have **never approved a dependency with install
+scripts** (in practice `node-pty`, pulled in transitively). If your profile's
+`pnpm-workspace.yaml` already carries `allowBuilds: {node-pty: true}` — most
+profiles that have installed anything do — the approval card never appears and
+the update just works.
+
+Cause: pnpm installs the new marketplace package before the approval gate, which
+swaps the running plugin on disk; dsh replays the assembly tree and the whole
+marketplace UI remounts, losing the browser session the approval token was
+issued to. The token is then unrecoverable, so the retry arrives without it.
+
+Recovery — restart dsh (startup recovery rolls the paused install back), then
+either update from the CLI:
+
+```bash
+# <profile> = web, guard-test, ...
+dsh plugin --profile <profile> add @1e0zj/dsh-plugin-mall@0.4.15
+```
+
+or pre-approve the build scripts once and update from the page as usual:
+
+```yaml
+# <profile>/pnpm-workspace.yaml
+allowBuilds:
+  'node-pty@1.1.0': true
+```
+
+> Fixed from 0.4.15 onward — the session identity now survives a remount. The
+> fix cannot rescue the hop *to* 0.4.15 itself: during that update both the
+> page's pre-swap code and the running dsh process are still the old version.
+
+
 ## Agent tools
 
 | Tool | What it does |
@@ -282,6 +320,40 @@ pnpm --dir <profile> add "github:omdsh-dev/dsh-at-file" --ignore-scripts
 > `dsh-plugin-guard recover` 确实能修这个故障。
 
 
+## 更新卡在批准卡上？（更新**到** 0.4.15 时可能遇到）
+
+症状：更新市场自己，停在「安装期代码需要确认」，点「允许」报
+`allowBuildScripts cannot be specified on initial install`，再点还是这样。
+
+谁会遇到：只有**从未批准过带安装脚本的依赖**的 profile（实际就是传递依赖
+`node-pty`）。如果你的 `pnpm-workspace.yaml` 里已经有
+`allowBuilds: {node-pty: true}`——装过东西的 profile 基本都有——批准卡根本
+不会出现，更新一次过。
+
+原因：pnpm 在批准闸之前就把新版市场装进了 node_modules，正在运行的插件实体
+被替换，dsh 随之重放装配树、整个市场 UI 重挂载，签发审批 token 时的那个浏览器
+session 一起没了。token 从此取不回来，重试自然是「没带 token」。
+
+出路——重启 dsh（启动恢复会把暂停的安装撤回），然后二选一。命令行更新：
+
+```bash
+# <profile> = web、guard-test……
+dsh plugin --profile <profile> add @1e0zj/dsh-plugin-mall@0.4.15
+```
+
+或者先把构建脚本批准一次，再照常从页面更新：
+
+```yaml
+# <profile>/pnpm-workspace.yaml
+allowBuilds:
+  'node-pty@1.1.0': true
+```
+
+> 0.4.15 起已修复——session 身份现在扛得住重挂载。但这个修复救不了「更新到
+> 0.4.15」这一跳本身：那次更新时，页面上 swap 之前的代码和正在跑的 dsh 进程
+> 都还是旧版。
+
+
 ## 工作原理
 
 - 双面包（dual-face）插件：`dsh.bundle` 半边挂在 **host 平面**（profile bundle 层），

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1e0zj/dsh-plugin-mall",
-  "version": "0.4.12",
+  "version": "0.4.15",
   "description": "dsh 插件市场：搜索 GitHub dsh-plugin 话题下的插件仓库，一键安装到本地 dsh profile（agent 工具 + 设置页插件市场 tab）",
   "type": "module",
   "main": "src/index.js",

package/src/cli.js

@@ -61,6 +61,7 @@ import {
   resolveDshHome,
   rollbackPendingSnapshot,
   validateInstalledProfile,
+  validatePendingProfile,
   validateRemoveCompletion,
 } from "./guard.js";
 // github.js imports node builtins only — the host-independence of this CLI is
@@ -502,7 +503,7 @@ async function cmdAdd({ spec, profile, home, acceptWarnings }) {
   //    rolled back immediately; otherwise the marker stays pending and the next
   //    dsh startup (or `guard recover`) commits it once the plugin actually
   //    loads.
-  const validation = validateInstalledProfile(profileDir);
+  const validation = validatePendingProfile(profileDir);
   if (result.exitCode === 0 && validation.ok) {
     console.log(`[guard] installed ${spec} into profile "${profile}".`);
     console.log("Restart dsh to load it. On the next startup — or via `node src/cli.js guard recover` — the pending snapshot is committed once the profile proves loadable; if dsh fails to boot, the same command rolls it back.");
@@ -596,7 +597,7 @@ async function cmdRemove({
 
   let validation;
   try {
-    validation = validateInstalledProfile(profileDir);
+    validation = validatePendingProfile(profileDir);
   } catch (error) {
     rollbackAndThrow(`remove completed but static profile validation threw: ${error.message}`);
   }
@@ -1327,7 +1328,7 @@ async function cmdLaunch({
     }
     let validation;
     try {
-      validation = validateInstalledProfile(profileDir);
+      validation = validatePendingProfile(profileDir, marker);
     } catch (error) {
       throw new Error(`static validation of profile "${profile}" failed — refusing to launch: ${error.message}`);
     }

package/src/client.js

@@ -157,6 +157,36 @@ window.__ModuleLoader__.load({
       throw new Error("Secure browser randomness is unavailable; plugin marketplace actions are disabled");
     }
 
+    // 与 src/index.js 的 BROWSER_SESSION_RE 保持一致：window 上的值同样是
+    // 不可信输入（别的脚本能写），读出来必须重新过格式校验。
+    var BROWSER_SESSION_RE = /^sess_(?:[0-9a-f]{32}|[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})$/i;
+    var SESSION_NONCE_PROP = "__dshPluginMallSession";
+    // nonce 挂在 window 上（进程内，不落任何存储）。
+    //
+    // 要解决的：更新插件市场自身会替换正在运行的市场包，组装树随之重放、
+    // 整个市场 UI 重挂载——useRef 里的 nonce 归零，而审批 token 只发给签发
+    // 时的同一个 session，于是 needsApproval 暂停的任务在重挂载后永远拿不回
+    // token，用户点「允许」必报 initial install。重挂载是 React 层的（页面
+    // 没有重新加载），window 对象自始至终是同一个，进程内值正好覆盖它。
+    //
+    // 不用 sessionStorage：它在 window.open(同源) 和浏览器「复制标签页」时
+    // 会被复制给新标签页。jobs 镜像里本就带着 approvalToken，nonce 再一起
+    // 复制过去，新标签页就同时拿到了 token 和它的归属身份——后端会认成同一
+    // 个 session，跨 tab 隔离（47db0c4）就此失效。window 上的值不随标签页
+    // 复制，新标签页天然是新身份。
+    //
+    // 代价：页面刷新（F5）后 nonce 重新生成，刷新前签发的 token 作废。这是
+    // 对的边界——刷新是用户主动重来，暂停的任务重启 dsh 即可撤回；而重挂载
+    // 是用户没做任何事的情况下被系统掀了桌子，那才是必须兜住的。
+    function readOrCreateBrowserSession(host) {
+      var scope = host || window;
+      var current = scope[SESSION_NONCE_PROP];
+      if (typeof current === "string" && BROWSER_SESSION_RE.test(current)) return current;
+      var nonce = generateSessionNonce();
+      scope[SESSION_NONCE_PROP] = nonce;
+      return nonce;
+    }
+
     // ── job polling ─────────────────────────────────────────────────────────
     // onPreflightSettled：预检 job（kind=dsh-plugin-preflight）落定时回调，
     // 携带 (spec, report)。safe 由调用方直接续装；有风险由调用方出内联卡片。
@@ -443,7 +473,7 @@ window.__ModuleLoader__.load({
         meta: clip(props.spec || "", 50),
         actions: actions,
       },
-        props.detail ? h("div", { className: "mkt_desc" }, props.detail) : null,
+        h("div", { className: "mkt_desc" }, "pnpm 已拦截下列安装脚本，尚未执行任何插件代码。允许后会先复核制品再运行；暂不允许时，重启 dsh 会自动撤回这次安装。"),
         pkgs.map(function (p, index) {
           var facts = [];
           if (typeof p.weeklyDownloads === "number") facts.push("周下载 " + p.weeklyDownloads.toLocaleString());
@@ -609,7 +639,6 @@ window.__ModuleLoader__.load({
             job.needsApproval && job.needsApproval.length > 0
               ? h(ApprovalRequest, {
                 spec: job.spec,
-                detail: job.detail,
                 needsApproval: job.needsApproval,
                 busy: props.approving === job.spec,
                 onApprove: function (names) {
@@ -790,7 +819,7 @@ window.__ModuleLoader__.load({
       // Opaque one-shot approval tokens issued from needsApproval outcomes (spec -> token).
       // Cleared on success, unrelated failure, cancel, modal close, or spec change.
       // No boolean warning-consent map is kept.
-      var sessionNonce = useRef(generateSessionNonce()).current;
+      var sessionNonce = useRef(readOrCreateBrowserSession()).current;
       var approvalTokensRef = useRef({});
       var restartControlRef = useRef({ mounted: true, ping: null });
       var clearRestartPing = useCallback(function () {
@@ -1046,9 +1075,7 @@ window.__ModuleLoader__.load({
           // 响应语义是「已调度交接」而不是「重启成功」：新宿主何时接管
           // 由下面的轮询判断。这里只把输出会出现在哪里告诉用户。
           scheduledLogPath = value && value.logPath ? String(value.logPath) : null;
-          setRestartNote(value && value.mode === "visible"
-            ? "重启已调度——dsh 正在新的控制台窗口中启动，窗口里 Ctrl+C 可停止；输出同时写入 " + scheduledLogPath
-            : "重启已调度，输出与日志：" + (scheduledLogPath || "<home>/guard/ 下"));
+          setRestartNote("重启中，输出与日志：" + (scheduledLogPath || "<home>/guard/ 下"));
           var tries = 0;
           var ping = setInterval(function () {
             if (restartControlRef.current.mounted !== true) {

package/src/guard.js

@@ -24,8 +24,10 @@ import {
 import { homedir, tmpdir } from "node:os";
 import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { createRequire } from "node:module";
+import { createHash } from "node:crypto";
 import { JSON_SCHEMA, Type, load } from "js-yaml";
 import { satisfies, validRange } from "semver";
+import { stripTerminalControlSequences } from "./terminal.js";
 
 // Official patches (e.g. @deepseek-ai/dsh-base, dsh-web-app) mark raw JS
 // expressions with the scalar tag `!!js`. Construct the loader's own marker —
@@ -1450,6 +1452,84 @@ export function validateInstalledProfile(profileDir) {
   };
 }
 
+/** Stable identity for one installed-profile blocker across a transaction. */
+function staticBlockerFingerprint(entry) {
+  const canonical = (value) => {
+    if (Array.isArray(value)) return value.map(canonical);
+    if (value !== null && typeof value === "object") {
+      return Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonical(value[key])]));
+    }
+    return value;
+  };
+  return createHash("sha256").update(JSON.stringify(canonical(entry))).digest("hex");
+}
+
+function staticBlockerFingerprints(validation) {
+  return validation.issues
+    .filter((entry) => entry.severity === "block")
+    .map(staticBlockerFingerprint);
+}
+
+/**
+ * Validate the live profile relative to the state captured before a pending
+ * transaction. An unchanged blocker that was already present did not come
+ * from this install/remove and must not make the transaction roll back. New
+ * markers carry the baseline; old markers do not, and deliberately retain the
+ * old fail-closed behaviour.
+ */
+export function validatePendingProfile(profileDir, pending = readValidatedPendingSnapshot(profileDir)) {
+  const validation = validateInstalledProfile(profileDir);
+  if (!Array.isArray(pending?.baselineBlockers)) {
+    return { ...validation, allIssues: validation.issues, preexistingIssues: [] };
+  }
+
+  const candidateName = pending.preflight?.candidate?.name ?? pending.candidate?.name;
+  const remaining = new Map();
+  for (const fingerprint of pending.baselineBlockers) {
+    remaining.set(fingerprint, (remaining.get(fingerprint) ?? 0) + 1);
+  }
+  const issues = [];
+  const preexistingIssues = [];
+  for (const entry of validation.issues) {
+    if (entry.severity !== "block") {
+      issues.push(entry);
+      continue;
+    }
+    // Updating the package that owns (or participates in) an old blocker must
+    // prove that blocker was actually fixed. Only unrelated historical issues
+    // receive baseline treatment.
+    const candidateRelated = entry.package === candidateName
+      || (Array.isArray(entry.conflictsWith) && entry.conflictsWith.includes(candidateName));
+    if (candidateRelated) {
+      issues.push(entry);
+      continue;
+    }
+    const fingerprint = staticBlockerFingerprint(entry);
+    const count = remaining.get(fingerprint) ?? 0;
+    if (count > 0) {
+      preexistingIssues.push(entry);
+      remaining.set(fingerprint, count - 1);
+    } else {
+      issues.push(entry);
+    }
+  }
+  const blockers = issues.filter((entry) => entry.severity === "block");
+  const warnings = issues.filter((entry) => entry.severity === "warn");
+  const verdict = blockers.length > 0 ? "blocked" : warnings.length > 0 ? "warning" : "safe";
+  return {
+    ok: blockers.length === 0,
+    verdict,
+    issues,
+    allIssues: validation.issues,
+    preexistingIssues,
+    summary: blockers.length > 0
+      ? `发现 ${blockers.length} 个本次新增阻断问题、${preexistingIssues.length} 个既有阻断问题、${warnings.length} 个警告`
+      : preexistingIssues.length > 0
+        ? `本次变更未新增阻断问题（保留 ${preexistingIssues.length} 个既有阻断问题）`
+        : validation.summary,
+  };
+}
+
 /**
  * Remove leftover `node_modules` entries for packages that are no longer part
  * of the profile's declared dependencies. pnpm hoists each direct dependency
@@ -1723,7 +1803,7 @@ function spawnCapture(command, args, options, onOutput, { signal, treeKill = fal
     let child;
     const chunks = [];
     const push = (value) => {
-      const text = value.toString();
+      const text = stripTerminalControlSequences(value);
       chunks.push(text);
       onOutput?.(text);
     };
@@ -1831,7 +1911,7 @@ export async function preflightInstall({ profileDir, spec, onOutput, signal }) {
     const result = await spawnCapture(
       plan.command,
       probeAddArgs(spec),
-      { cwd: probeDir, env: process.env, shell: plan.shell },
+      { cwd: probeDir, env: pnpmGuardEnv(process.env), shell: plan.shell },
       onOutput,
       { signal, treeKill: plan.treeKill },
     );
@@ -1998,6 +2078,9 @@ function assertStoredTransactionMatches(pending) {
   if (pending.operation === "remove" && stored.metadata.packageName !== pending.metadata.packageName) {
     throw new Error("pending remove packageName does not match snapshot.json — refusing to act on it (left untouched for manual inspection)");
   }
+  if (JSON.stringify(stored.baselineBlockers) !== JSON.stringify(pending.baselineBlockers)) {
+    throw new Error("pending marker baseline blockers do not match snapshot.json — refusing to act on it (left untouched for manual inspection)");
+  }
 }
 
 /**
@@ -2037,6 +2120,12 @@ function sanitizeSnapshot(marker, home) {
   if (!Array.isArray(marker.dependencies) || marker.dependencies.some((name) => typeof name !== "string" || !NPM_PACKAGE_NAME_RE.test(name))) {
     throw new Error("pending marker has missing or corrupt dependency metadata — refusing to act on it (left untouched for manual inspection)");
   }
+  if (marker.baselineBlockers !== undefined && (
+    !Array.isArray(marker.baselineBlockers)
+    || marker.baselineBlockers.some((fingerprint) => typeof fingerprint !== "string" || !/^[a-f0-9]{64}$/.test(fingerprint))
+  )) {
+    throw new Error("pending marker has corrupt baseline blocker metadata — refusing to act on it (left untouched for manual inspection)");
+  }
   validatePendingTransaction(marker);
   const profileDir = resolve(String(marker.profileDir ?? ""));
   const profilesRoot = resolve(join(home, "profiles"));
@@ -2090,7 +2179,12 @@ export function createProfileSnapshot(profileDir, metadata = {}) {
   } catch {
     /* manifest unreadable — the rest of the snapshot still captures the bytes */
   }
-  const snapshot = { version: SNAPSHOT_VERSION, id, dir, profileDir, createdAt: Date.now(), files, dependencies, operation: normalizedMetadata.operation, metadata: normalizedMetadata };
+  // Static validation after an install must judge what THIS transaction
+  // changed. Without this baseline, an unrelated legacy plugin that already
+  // shadowed host modules made every later update look guilty and forced the
+  // marketplace itself back to its old version on restart.
+  const baselineBlockers = staticBlockerFingerprints(validateInstalledProfile(profileDir));
+  const snapshot = { version: SNAPSHOT_VERSION, id, dir, profileDir, createdAt: Date.now(), files, dependencies, baselineBlockers, operation: normalizedMetadata.operation, metadata: normalizedMetadata };
   writeFileSync(join(dir, "snapshot.json"), JSON.stringify(snapshot, undefined, 2) + "\n");
   return snapshot;
 }
@@ -2127,7 +2221,7 @@ export function markPendingSnapshot(snapshot, record = {}) {
   if (existsSync(markerPath)) {
     throw new Error(`profile already has a pending install marker at ${markerPath} — run \`dsh-plugin-guard guard recover\` (or let dsh startup recovery consume it) before installing again`);
   }
-  const pending = { ...snapshot, ...record, pendingAt: Date.now() };
+  const pending = { ...snapshot, ...record, baselineBlockers: snapshot.baselineBlockers, pendingAt: Date.now() };
   // Reject producer bugs before persisting them. The read/recovery boundary
   // repeats this validation because the marker is attacker-controllable.
   validatePendingTransaction(pending);
@@ -2212,6 +2306,13 @@ function addedDependencyNames(pending, originalDependencies = pending?.dependenc
 export function pnpmGuardEnv(base = process.env) {
   return {
     ...base,
+    // Browser jobs render plain text rather than a terminal. Prevent pnpm from
+    // emitting colours at the source; output capture also strips CSI controls
+    // defensively in case a child ignores these conventional switches.
+    NO_COLOR: "1",
+    FORCE_COLOR: "0",
+    npm_config_color: "false",
+    NPM_CONFIG_COLOR: "false",
     npm_config_auto_install_peers: "false",
     NPM_CONFIG_AUTO_INSTALL_PEERS: "false",
   };
@@ -2855,7 +2956,7 @@ export function recoverProfile(profileDir) {
       rebuild: rolled?.rebuild,
     };
   }
-  const validation = validateInstalledProfile(profileDir);
+  const validation = validatePendingProfile(profileDir, pending);
   const candidateName = pending.preflight?.candidate?.name ?? pending.candidate?.name;
   const removeValidation = isRemove
     ? validateRemoveCompletion(pending.profileDir, candidateName)
@@ -3958,6 +4059,58 @@ async function selfTest() {
       if (existsSync(snap.dir)) throw new Error("recoverProfile commit should delete the snapshot dir");
     }
 
+    // A blocker that predates the transaction is still a real profile problem,
+    // but it is not evidence that this update broke the profile. This is the
+    // reported marketplace self-update failure: an unrelated legacy plugin
+    // shadows host modules, so the new mall version used to be rolled back.
+    {
+      const p = join(root, "profiles", "preexisting-blocker");
+      mkdirSync(join(p, "node_modules", "legacy"), { recursive: true });
+      mkdirSync(join(p, "node_modules", "good"), { recursive: true });
+      writeFileSync(join(p, "package.json"), JSON.stringify({ dependencies: { legacy: "1.0.0", good: "1.0.0" } }));
+      writeFileSync(join(p, "cordis.patch.yml"), "[]\n");
+      writeFileSync(join(p, "node_modules", "legacy", "package.json"), JSON.stringify({
+        name: "legacy", version: "1.0.0", dependencies: { "@deepseek-ai/dsh-llm": "*" },
+      }));
+      writeFileSync(join(p, "node_modules", "good", "package.json"), JSON.stringify({ name: "good", version: "1.0.0" }));
+      if (validateInstalledProfile(p).issues.filter((entry) => entry.code === "host-module-shadow").length !== 1) {
+        throw new Error("pre-existing blocker fixture prerequisite failed");
+      }
+      const snap = createProfileSnapshot(p, { fixture: true });
+      markPendingSnapshot(snap, { spec: "good@2.0.0", preflight: { candidate: { name: "good", version: "2.0.0", kind: "plain" } } });
+      writeFileSync(join(p, "package.json"), JSON.stringify({ dependencies: { legacy: "1.0.0", good: "2.0.0" } }));
+      writeFileSync(join(p, "node_modules", "good", "package.json"), JSON.stringify({ name: "good", version: "2.0.0" }));
+      const relative = validatePendingProfile(p);
+      if (!relative.ok || relative.preexistingIssues.length !== 1 || relative.issues.some((entry) => entry.severity === "block")) {
+        throw new Error(`unchanged pre-existing blocker must not condemn this update: ${JSON.stringify(relative)}`);
+      }
+      const rec = recoverProfile(p);
+      if (rec.action !== "committed") throw new Error(`unchanged pre-existing blocker should commit this update, got ${rec.action}`);
+      if (readJson(join(p, "node_modules", "good", "package.json")).version !== "2.0.0") {
+        throw new Error("committing past a pre-existing blocker must keep the updated candidate");
+      }
+      console.log("PASS pending 基线：既有宿主模块 blocker 不再回滚无关更新");
+
+      const candidateProfile = join(root, "profiles", "candidate-own-blocker");
+      mkdirSync(join(candidateProfile, "node_modules", "legacy"), { recursive: true });
+      writeFileSync(join(candidateProfile, "package.json"), JSON.stringify({ dependencies: { legacy: "1.0.0" } }));
+      writeFileSync(join(candidateProfile, "cordis.patch.yml"), "[]\n");
+      writeFileSync(join(candidateProfile, "node_modules", "legacy", "package.json"), JSON.stringify({
+        name: "legacy", version: "1.0.0", dependencies: { "@deepseek-ai/dsh-llm": "*" },
+      }));
+      const ownSnap = createProfileSnapshot(candidateProfile, { fixture: true });
+      markPendingSnapshot(ownSnap, { spec: "legacy@2.0.0", preflight: { candidate: { name: "legacy", version: "2.0.0", kind: "plain" } } });
+      writeFileSync(join(candidateProfile, "node_modules", "legacy", "package.json"), JSON.stringify({
+        name: "legacy", version: "2.0.0", dependencies: { "@deepseek-ai/dsh-llm": "*" },
+      }));
+      const own = validatePendingProfile(candidateProfile);
+      if (own.ok || !own.issues.some((entry) => entry.code === "host-module-shadow")) {
+        throw new Error("an updated candidate must not inherit an exemption for its own old blocker");
+      }
+      commitPendingSnapshot(candidateProfile);
+      console.log("PASS pending 基线：候选自身的既有 blocker 必须在更新中修复");
+    }
+
     // Approval-pause mark, part 1: a paused marker must NEVER commit on
     // recovery — not even when the static validation would pass (the version
     // sits there with its build scripts never approved; committing would drop
@@ -4602,6 +4755,21 @@ async function selfTest() {
       if (env.npm_config_auto_install_peers !== "false" || env.NPM_CONFIG_AUTO_INSTALL_PEERS !== "false") {
         throw new Error("pnpmGuardEnv must disable peer auto-install");
       }
+      if (env.NO_COLOR !== "1" || env.FORCE_COLOR !== "0"
+        || env.npm_config_color !== "false" || env.NPM_CONFIG_COLOR !== "false") {
+        throw new Error("pnpmGuardEnv must disable terminal colours for browser job logs");
+      }
+
+      let streamed = "";
+      const coloured = await spawnCapture(
+        process.execPath,
+        ["-e", "process.stdout.write('\\u001b[96mprobe ok\\u001b[39m\\n')"],
+        { env: process.env, shell: false },
+        (text) => { streamed += text; },
+      );
+      if (coloured.exitCode !== 0 || coloured.output !== "probe ok\n" || streamed !== "probe ok\n") {
+        throw new Error(`spawnCapture must strip terminal controls from captured and streamed logs: ${JSON.stringify({ coloured, streamed })}`);
+      }
     }
 
     // candidateRestoredCompatible: version vs the restored dependency spec.
@@ -5279,4 +5447,4 @@ if (process.argv[1]?.endsWith("guard.js") && process.argv.includes("--self-test"
     console.error(`FAIL ${error.stack ?? error.message}`);
     process.exitCode = 1;
   });
-}
+}

package/src/index.js

@@ -1026,13 +1026,12 @@ export function resolveRestartLaunchPlan({ profile, config = {}, isWindows }) {
 
   const nodePath = process.execPath;
   const originalDshArgs = process.argv.slice(2);
-  // A restart is always requested from a page that is open and that reconnects
-  // to the successor on its own, so dsh's start-up browser handoff would only
-  // add a second window onto the one already showing the result. Suppressing it
-  // is safe HERE and nowhere else: this route is gated on a live browser
-  // session. If the flag is already in the original argv, leave it alone.
-  const suppressOpen = !originalDshArgs.includes("--no-open");
-  const dshArgs = suppressOpen ? [...originalDshArgs, "--no-open"] : [...originalDshArgs];
+  // Restart the exact command the user started. `--no-open` belongs to newer
+  // Web profiles, not to the stable dsh launcher contract; adding it here made
+  // older hosts reject the successor with "unknown option '--no-open'" after
+  // the outgoing process had already exited. A duplicate browser tab is less
+  // harmful than inventing an argv capability the running host never proved.
+  const dshArgs = [...originalDshArgs];
   // The outgoing host names itself so `guard launch` can wait for it to be
   // gone before binding the port — see --await-exit in cli.js.
   const args = [cliPath, "guard", "launch", "--profile", name, "--await-exit", String(process.pid), "--", nodePath, dshEntry, ...dshArgs];
@@ -1045,7 +1044,6 @@ export function resolveRestartLaunchPlan({ profile, config = {}, isWindows }) {
     dshEntry,
     dshArgs,
     profile: name,
-    suppressedBrowserOpen: suppressOpen,
     awaitExitPid: process.pid,
   };
 }
@@ -3219,6 +3217,98 @@ export async function runSelfTests() {
     check("tracker 复制 producer 签发的 approvalToken（同 session 可见）",
       snapSameSession.approvalToken === trackerTok);
 
+    // 异 session 即使拿到 token 字符串也消费不掉，且归属失败的尝试不许把
+    // 正主的 token 烧掉（报 session mismatch，不是 already consumed）。
+    // jobs 镜像里带着 token，复制标签页能拿到那串字符——挡住它的正是归属。
+    const wrongOwnerConsume = consumeApprovalToken({
+      token: trackerTok,
+      profile: "web",
+      profileDir,
+      spec: "foo-script",
+      preflightReport: cleanPreflightReport,
+      surface: "browser",
+      owner: "session-beta",
+    });
+    check("异 session 即使拿到 token 字符串也消费失败（session mismatch）",
+      wrongOwnerConsume.valid === false && /session mismatch/.test(wrongOwnerConsume.reason),
+      `reason=${wrongOwnerConsume.reason}`);
+    check("归属失败的尝试没有烧掉 token（正主仍可取回）",
+      sessionTracker.get(sessionJobId, "session-alpha").snapshot.approvalToken === trackerTok);
+
+    // ── 前端 session 身份（client.js 的真实源码，跑在受控假环境里）────────
+    //
+    // 这段测的是浏览器那半边：nonce 怎么生成、什么时候复用、什么时候必须
+    // 换新。它从 src/client.js 里把函数定义原样抠出来执行——不是在这里重写
+    // 一份等价逻辑，否则改坏了 client.js 测试照样绿。
+    //
+    // 钉住的四件事，每一件都对应一个真实故障：
+    //   1. 重挂载复用 → 不复用就是 initial install 死锁（本次修的 bug）；
+    //   2. 新 window 必换新 → 换不了就是跨 tab 冒用别人的审批身份；
+    //   3. 非法值必换新 → 别的脚本写坏了不能就这么发给后端；
+    //   4. 全程不碰任何存储 → sessionStorage 会随「复制标签页」被复制，
+    //      而 jobs 镜像里就带着 token，一起复制过去等于连身份带凭证都送出。
+    {
+      const clientSource = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "client.js"), "utf8");
+      // 从 `function name(` 起按花括号配平截取，拿到完整定义。
+      const extractFunction = (name) => {
+        const start = clientSource.indexOf(`function ${name}(`);
+        if (start === -1) throw new Error(`client.js 里找不到 function ${name}`);
+        let depth = 0;
+        let seenBrace = false;
+        for (let i = start; i < clientSource.length; i++) {
+          const ch = clientSource[i];
+          if (ch === "{") { depth++; seenBrace = true; } else if (ch === "}") depth--;
+          if (seenBrace && depth === 0) return clientSource.slice(start, i + 1);
+        }
+        throw new Error(`function ${name} 的花括号不配平`);
+      };
+      const reLine = clientSource.split("\n").find((line) => line.includes("var BROWSER_SESSION_RE ="));
+      const propLine = clientSource.split("\n").find((line) => line.includes("var SESSION_NONCE_PROP ="));
+      if (reLine === undefined || propLine === undefined) throw new Error("client.js 里找不到 session 常量定义");
+      const snippet = [
+        reLine.trim(),
+        propLine.trim(),
+        extractFunction("generateSessionNonce"),
+        extractFunction("readOrCreateBrowserSession"),
+        "return { readOrCreateBrowserSession: readOrCreateBrowserSession, SESSION_NONCE_PROP: SESSION_NONCE_PROP, BROWSER_SESSION_RE: BROWSER_SESSION_RE };",
+      ].join("\n");
+      // window 传 undefined：函数只该碰传进来的 scope，碰全局 window 就 ReferenceError。
+      const front = new Function("window", snippet)(undefined);
+
+      // 假标签页：带一个会记账的 sessionStorage，用来证明它一次都没被碰过。
+      let storageTouches = 0;
+      const makeTab = () => ({
+        sessionStorage: {
+          getItem: () => { storageTouches++; return null; },
+          setItem: () => { storageTouches++; },
+        },
+      });
+
+      const tabA = makeTab();
+      const first = front.readOrCreateBrowserSession(tabA);
+      check("前端 session：首次挂载生成合法 nonce 并挂在 window 上",
+        front.BROWSER_SESSION_RE.test(first) && tabA[front.SESSION_NONCE_PROP] === first, `nonce=${first}`);
+
+      const remounted = front.readOrCreateBrowserSession(tabA);
+      check("前端 session：同一页面重挂载复用同一个 nonce（token 因此仍归本人）",
+        remounted === first);
+
+      const tabB = makeTab();
+      const otherTab = front.readOrCreateBrowserSession(tabB);
+      check("前端 session：新 window（新 tab / 复制标签页）拿到的是另一个 nonce",
+        front.BROWSER_SESSION_RE.test(otherTab) && otherTab !== first);
+
+      const tampered = makeTab();
+      tampered[front.SESSION_NONCE_PROP] = "sess_not-a-valid-nonce";
+      const replaced = front.readOrCreateBrowserSession(tampered);
+      check("前端 session：window 上的值格式非法 → 丢弃并重新生成",
+        front.BROWSER_SESSION_RE.test(replaced) && replaced !== "sess_not-a-valid-nonce"
+          && tampered[front.SESSION_NONCE_PROP] === replaced);
+
+      check("前端 session：全程不读写任何存储（sessionStorage 会随复制标签页一起复制，jobs 镜像里带着 token）",
+        storageTouches === 0, `touches=${storageTouches}`);
+    }
+
     let cancelRefused = false;
     try {
       sessionTracker.cancel(sessionJobId, "session-beta");
@@ -3350,15 +3440,15 @@ export async function runSelfTests() {
           const dshArgs = plan.args.slice(dashDash + 3); // -- node <dshEntry> …
           check("重启带 --await-exit 且是本进程 pid", plan.args[plan.args.indexOf("--await-exit") + 1] === String(process.pid) && plan.awaitExitPid === process.pid);
           check("--await-exit 排在 `--` 之前（是 guard 的参数，不是 dsh 的）", plan.args.indexOf("--await-exit") < dashDash);
-          check("重启给 dsh 补 --no-open", dshArgs.includes("--no-open") && plan.suppressedBrowserOpen === true);
-          check("原始 dsh 参数原样保留", dshArgs.slice(0, 2).join(" ") === "--profile web");
+          check("重启不注入宿主版本相关参数", dshArgs.join(" ") === "--profile web" && !dshArgs.includes("--no-open"));
+          check("原始 dsh 参数原样保留", dshArgs.join(" ") === "--profile web");
           check("plan 附带可见模式所需的 dshArgs", plan.dshArgs.join(" ") === dshArgs.join(" "));
 
-          // 用户自己已经写了 --no-open 时不重复追加。
+          // 用户自己传给宿主的参数仍逐字保留。
           process.argv = [process.execPath, "/x/bin.js", "--profile", "web", "--no-open"];
           const already = resolveRestartLaunchPlan({ profile: "web", config: { allowRestart: true } });
           const alreadyArgs = already.ok ? already.args.slice(already.args.indexOf("--") + 3) : [];
-          check("已有 --no-open 则不重复追加", already.ok && alreadyArgs.filter((a) => a === "--no-open").length === 1 && already.suppressedBrowserOpen === false);
+          check("用户原有 --no-open 原样保留", already.ok && alreadyArgs.filter((a) => a === "--no-open").length === 1);
         } else {
           // 裸检出里解析不到官方 dsh 入口，plan 只能 fail——说清楚，别假装验过。
           console.log(`  SKIP 重启 argv fixture（${plan.error}）`);
@@ -3546,7 +3636,7 @@ export async function runSelfTests() {
           readyFile: join(fileRoot, "r1.json"),
           cwd: "C:/w",
           command: "C:/node/node.exe",
-          args: ["C:/dsh/index.js", "web", "--no-open"],
+          args: ["C:/dsh/index.js", "web"],
         };
         check("plan payload 校验通过", validateRestartPlanPayload(basePlan).ok === true);
         for (const [override, needle] of [
@@ -3744,7 +3834,7 @@ export async function runSelfTests() {
           nodePath: process.execPath,
           cliPath: join(visibleRoot, "cli.js"),
           dshEntry: join(visibleRoot, "dsh-entry.js"),
-          dshArgs: ["--profile", "web", "--no-open"],
+          dshArgs: ["--profile", "web"],
           profile: "web",
           awaitExitPid: 4242,
         };