@1e0zj/dsh-plugin-mall 0.4.2 → 0.4.3

package/src/index.js

@@ -14,6 +14,7 @@
 // services, `Config` validates the row's config, `name` is the plugin name.
 
 import z from "@deepseek-ai/schemastery";
+import { valid as validExactVersion, maxSatisfying } from "semver";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import { existsSync, readFileSync, realpathSync, mkdirSync, mkdtempSync, writeFileSync, rmSync, openSync, closeSync, writeSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
@@ -25,7 +26,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
 import { resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
-import { repoInfo, searchPlugins, verifyPlugins, cachedRepoManifest, fetchRawFile, preferNpmSpec, npmPackageInfo, compareVersions, assertSafeToInstall, mapLimit, NETWORK_CONCURRENCY } from "./github.js";
+import { repoInfo, searchPlugins, verifyPlugins, cachedRepoManifest, fetchRawFile, preferNpmSpec, npmPackageInfo, npmPackageVersions, npmNameOf, compareVersions, assertSafeToInstall, mapLimit, NETWORK_CONCURRENCY } from "./github.js";
 import { ensureProfile, listInstalled, normalizeSpec, runInstall, runRemove, assertSafeSpec, resolveRegistry, serializeCanonicalProof, persistPluginDisabled } from "./installer.js";
 import { preflightInstall, inspectRemoteCandidate, recoverProfile, describeRollbackRebuild, isAbortError } from "./guard.js";
 import { createRestartHelperReadyMessage, RESTART_HELPER_READY_TYPE, RESTART_RESPONSE_DRAIN_MS, superviseRestartHelper } from "./restart-protocol.js";
@@ -336,9 +337,20 @@ function invalidatePreflightFor(profileDir) {
  * never caches warning consent.
  */
 function pinPreflight(profileDir, spec) {
+  // pin 只给核得住的引用：不可变（精确版本/钉死的 sha）或可再校验的
+  // （npm tag/range，读取路径会重新核）。file:/link:/URL/未钉 sha 的
+  // github 拿不到可信身份，pin 了也只是把一条注定要丢弃的缓存钉在
+  // 那里——读取路径对它们一律重跑，这里就别给「已核过」的假象。
+  if (specIdentityKind(spec) === null) return;
   const key = preflightCacheKey(profileDir, spec);
   const cached = preflightCache.get(key);
   if (cached === undefined) return;
+  // blocked 一律不 pin（ok === true 的只有 safe/warning）。探装失败的
+  // blocker 最要命：网络抖一下就是一份 ok:false 的 blocked，而 spec 若是
+  // 精确版本这类不可变形态，身份再校验也不会拦——钉住等于把一次临时失败
+  // 固化 10 分钟，网络恢复也不再重试。真正的冲突 blocker 也没有「用户
+  // 读完再继续」的后继流程，pin 本就没有服务对象。
+  if (cached.report?.ok !== true) return;
   const currentFingerprint = computeProfileFingerprint(profileDir);
   if (cached.fingerprint !== currentFingerprint) {
     preflightCache.delete(key);
@@ -358,10 +370,90 @@ function pinPreflight(profileDir, spec) {
  * a `blocked` report, that fabricated verdict would have been cached for the
  * whole TTL and every later install of this spec refused with it.)
  */
-async function runPreflight({ profile, spec, force = false, onOutput, signal }) {
+
+/**
+ * The "owner/repo" part of a github: spec, or null. Anchored end-to-end: an
+ * earlier version let the lazy repo group stop early (`github:owner/repo`
+ * came out as `owner/r`) because the `.git` alternative was optional and
+ * nothing forced the match to run to the end — every identity lookup then
+ * keyed on a repo that does not exist and quietly failed open.
+ */
+export function githubSpecRepo(raw) {
+  const match = /^github:([^/\s]+\/[^/\s]+?)(?:\.git)?(?:#.+)?$/i.exec(String(raw ?? ""));
+  return match === null ? null : match[1];
+}
+
+/**
+ * What a cache-reuse staleness check can rely on for this spec shape.
+ *
+ *   "immutable"  exact npm version (npm forbids overwriting a published
+ *                version) or github:...#<full 40-hex sha>. Nothing can
+ *                drift; reuse unconditionally.
+ *   "npm-tag"    bare name / @latest / @* — resolves to whatever `latest`
+ *                is now; verifiable against the install registry.
+ *   "npm-range"  pkg@^1.2.0 — an in-range release changes what pnpm picks;
+ *                verifiable via the packument.
+ *   null         UNVERIFIABLE, not immutable: file:/link:/URL tarballs (the
+ *                content can change in place), github without a pinned sha
+ *                (same version can point at different code — comparing
+ *                name/version proves nothing), owner/repo, anything else.
+ *                No trusted identity is obtainable cheaply, so the cache is
+ *                never reused for these — see runPreflight.
+ */
+export function specIdentityKind(raw) {
+  const spec = String(raw ?? "");
+  if (/^(?:file:|link:|https?:\/\/)/i.test(spec)) return null;
+  if (/^github:/i.test(spec)) {
+    const pinned = /^github:[^/\s]+\/[^/\s]+?(?:\.git)?#([0-9a-f]{40})$/i.exec(spec);
+    return pinned !== null ? "immutable" : null;
+  }
+  if (!/^@/.test(spec) && spec.includes("/")) return null; // owner/repo：不可核验
+  const name = npmNameOf(spec);
+  if (name === null) return null;
+  // 注意 scoped 裸名（@scope/name）没有 range：判定依据是「名字之后还有没有
+  // 东西」，不是字符串里有没有 @——scope 前缀本身就带 @。
+  const range = spec.length > name.length ? spec.slice(name.length + 1) : undefined;
+  if (range === undefined || range === "latest" || range === "*") return "npm-tag";
+  return validExactVersion(range) === null ? "npm-range" : "immutable";
+}
+
+/**
+ * What this spec resolves to RIGHT NOW ({name, version}), for the verifiable
+ * shapes — the cheap half of "reuse equals rerun". The expensive half is the
+ * probe itself; this is one registry read per cache hit.
+ *
+ * `fresh` is the point: the registry helpers cache for minutes, and a cached
+ * "current version" is exactly the staleness this check exists to detect —
+ * the candidate published 2.0.0 five minutes into the cache TTL would sail
+ * through as "still 1.0.0". Queries here bypass the read cache (they still
+ * populate it). The registry is the one pnpm will install from (mirrors
+ * included), so whatever lag it has applies to the install equally —
+ * verifying against npmjs while installing from npmmirror would be the
+ * wrong kind of fresh.
+ *
+ * Returns undefined when the resolution is unreachable — the caller treats
+ * that as "could not verify", which invalidates, never as "verified".
+ */
+async function resolveSpecIdentity({ spec, registry, sources, signal }) {
+  const kind = specIdentityKind(spec);
+  if (kind !== "npm-tag" && kind !== "npm-range") return undefined;
+  const name = npmNameOf(String(spec));
+  if (name === null) return undefined;
+  if (kind === "npm-tag") {
+    const info = await npmPackageInfo(name, { registry, signal, fresh: true });
+    return info === null || typeof info.latest !== "string" ? undefined : { name, version: info.latest };
+  }
+  const range = String(spec).slice(name.length + 1);
+  const versions = await npmPackageVersions(name, { registry, signal, fresh: true });
+  if (versions === null || versions.length === 0) return undefined;
+  const best = maxSatisfying(versions, range);
+  return best === null ? undefined : { name, version: best };
+}
+
+async function runPreflight({ profile, spec, force = false, onOutput, signal, registry, sources, _profileDir, _resolveSpecIdentity = resolveSpecIdentity, _preflightInstall = preflightInstall }) {
   let profileDir;
   try {
-    profileDir = resolveProfileDir(profile);
+    profileDir = _profileDir ?? resolveProfileDir(profile);
   } catch (error) {
     throw new Error(`invalid profile: ${error.message}`);
   }
@@ -381,10 +473,41 @@ async function runPreflight({ profile, spec, force = false, onOutput, signal })
     && (isPinned(validCached) || Date.now() - validCached.at < PREFLIGHT_TTL);
 
   if (!force && fresh) {
-    return { report: validCached.report, profileDir, fingerprint: currentFingerprint };
+    // 缓存复用的前提是「重跑必然得到同一份结论」，缺一側都不算数：
+    //   profile 一侧 —— 指纹一致（上面已查）；
+    //   候选一侧 —— spec 是不可变引用（精确版本/钉死的 sha），或者能重新
+    //               解析出与缓存报告一致的身份。
+    // 除此之外一律丢弃重跑：file:/link:/URL 的内容能原地变；未钉 sha 的
+    // github 同版本能换代码，name/version 比对证明不了任何事；registry
+    // 查不到「当前值」同样是没核住。以前这里 fail-open（核不上就沿用旧
+    // 报告），等于给所有核不住的形态开了永久通道。
+    const candidate = validCached.report?.candidate;
+    const kind = specIdentityKind(spec);
+    if (kind === "immutable") {
+      return { report: validCached.report, profileDir, fingerprint: currentFingerprint };
+    }
+    let verified = false;
+    if ((kind === "npm-tag" || kind === "npm-range")
+      && typeof candidate?.name === "string" && typeof candidate?.version === "string") {
+      let current;
+      try {
+        current = await _resolveSpecIdentity({ spec, registry, sources, signal });
+      } catch (error) {
+        if (isAbortError(error)) throw error; // 取消不是「核不上」，照旧上抛
+        current = undefined;
+      }
+      verified = current !== undefined
+        && typeof current.version === "string"
+        && current.name === candidate.name
+        && current.version === candidate.version;
+    }
+    if (verified) {
+      return { report: validCached.report, profileDir, fingerprint: currentFingerprint };
+    }
+    preflightCache.delete(key); // 核不住或对不上：作废，下面重跑探装
   }
 
-  const report = await preflightInstall({ profileDir, spec, onOutput, signal });
+  const report = await _preflightInstall({ profileDir, spec, onOutput, signal });
   preflightCache.set(key, {
     report,
     fingerprint: currentFingerprint,
@@ -556,6 +679,16 @@ export function consumeApprovalToken({
     return { valid: false, reason: "invalid or already consumed approval token" };
   }
 
+  // 归属校验先于销毁。token 一旦泄漏（哪怕只泄漏给另一个 session），任何
+  // 拿到它的人都不该能靠「试一下」把别人的批准流程烧掉——错误归属的尝试
+  // 原样退回，token 留给真正的 owner。其余校验维持「一试即焚」的一次性。
+  if (record.surface !== surface) {
+    return { valid: false, reason: "approval token surface mismatch (cannot reuse between browser and agent)" };
+  }
+  if (record.owner !== (owner ?? "")) {
+    return { valid: false, reason: `approval token ${surface === "browser" ? "session" : "owner"} mismatch` };
+  }
+
   // Atomically delete token on validation to guarantee one-shot
   approvalTokens.delete(cleanToken);
 
@@ -578,12 +711,6 @@ export function consumeApprovalToken({
       return { valid: false, reason: "approval token profile directory mismatch" };
     }
   }
-  if (record.surface !== surface) {
-    return { valid: false, reason: "approval token surface mismatch (cannot reuse between browser and agent)" };
-  }
-  if (record.owner !== (owner ?? "")) {
-    return { valid: false, reason: `approval token ${surface === "browser" ? "session" : "owner"} mismatch` };
-  }
   if (
     createHash("sha256").update(record.disclosureSerialized).digest("hex") !== record.disclosureDigest
     || createHash("sha256").update(record.proofSerialized).digest("hex") !== record.proofDigest
@@ -974,11 +1101,6 @@ export function createJobTracker({ producerFactory } = {}) {
       profile,
       spec,
       verb = "add",
-      allowBuildScripts,
-      approvedProof,
-      preflight,
-      profileDir,
-      acceptWarningsActive = false,
       surface = "browser",
       session,
       onSettled,
@@ -987,11 +1109,15 @@ export function createJobTracker({ producerFactory } = {}) {
       const id = `market-${++trackerCounter}`;
       const kind = verb === "remove" ? "dsh-plugin-uninstall" : "dsh-plugin-install";
       const factory = startProducerFactory ?? producerFactory;
+      // install 必须带 producerFactory：createInstallJobProducer 是整条链
+      // （含审批 token 签发）的唯一所有者，tracker 不再自己拼 runInstall——
+      // 那条老路没有预检、没有 token 语义，只是历史上预检跑在 RPC 里时的
+      // 残余。remove 仍可直接起 runRemove。
       const producer = typeof factory === "function"
-        ? factory({ profile, spec, verb, allowBuildScripts, approvedProof, preflight, profileDir })
+        ? factory({ profile, spec, verb })
         : verb === "remove"
           ? runRemove({ profile, packageName: spec })
-          : runInstall({ profile, spec, allowBuildScripts, approvedProof, preflight });
+          : (() => { throw new Error("install jobs require a producerFactory — the preflight chain owns the producer, not the tracker"); })();
 
       const record = {
         id,
@@ -1026,25 +1152,13 @@ export function createJobTracker({ producerFactory } = {}) {
           record.staleOnRestart = outcome?.staleOnRestart === true;
           record.finishedAt = Date.now();
 
-          if (status === "completed") {
-            if (profileDir) invalidatePreflightFor(profileDir);
-            clearApprovalTokensFor(profile, spec);
-          } else if (outcome?.needsApproval && outcome.needsApproval.length > 0) {
-            clearApprovalTokensFor(profile, spec, { surface: record.surface, owner: record.session });
-            const token = issueApprovalToken({
-              profile,
-              profileDir,
-              spec,
-              preflightReport: preflight,
-              needsApproval: outcome.needsApproval,
-              proof: outcome.proof,
-              surface: record.surface,
-              owner: record.session,
-              acceptWarningsActive,
-            });
-            record.approvalToken = token;
-          } else {
-            clearApprovalTokensFor(profile, spec, { surface: record.surface, owner: record.session });
+          // 审批 token 由 producer 签发（createInstallJobProducer 是唯一签发
+          // 者：它手里才有预检报告与 profileDir，也才能把签发失败写进 detail
+          // 而不是顶掉结论）。tracker 只把 outcome 里带出来的 token 摘到
+          // record 上，供同 session 的快照下发——不签发、不清理，避免同一份
+          // 职责在两条路径上各写一份、再各自漂移。
+          if (typeof outcome?.approvalToken === "string" && outcome.approvalToken.length > 0) {
+            record.approvalToken = outcome.approvalToken;
           }
 
           try {
@@ -1281,44 +1395,81 @@ function renderPreflightIssue(entry) {
   return `  [${badge}] ${entry.title}: ${entry.detail}`;
 }
 
+/**
+ * The verdict plus every issue verbatim, as job-log text.
+ *
+ * The browser used to log only the verdict and hand the reasons to the risk
+ * card through `extras`. Closing that card — or clicking "install anyway" —
+ * took the reasons with it, and nothing else on the page ever had them. The
+ * job log is the part that survives, so the evidence belongs here; the card
+ * stays what it should be, the place to make the decision. The agent path
+ * has carried the individual BLOCK/WARN lines in its job detail all along.
+ */
+function preflightVerdictLog(report) {
+  const lines = [`[dsh-plugin-mall] 预检结论：${report?.verdict}\n`];
+  for (const entry of report?.issues ?? []) lines.push(`${renderPreflightIssue(entry)}\n`);
+  return lines.join("");
+}
+
 /**
  * Why this install must not proceed — or undefined when it may.
  *
- * Split out of enforcePreflight() because the two call sites need the verdict
- * in two different shapes. The browser RPC decides BEFORE any job exists, so
- * an exception is the right carrier: it aborts the request and becomes an
- * rpcFail. The agent tool now decides INSIDE the job, where an exception is
- * exactly the wrong carrier — a producer's `done` must never reject, and "the
- * preflight refused this candidate" is not an internal error but the job's
- * legitimate outcome, so it has to travel as text on a `failed` outcome.
+ * Both surfaces (agent tool and browser RPC) decide INSIDE the job, so the
+ * verdict travels as text on a `failed` outcome — a producer's `done` must
+ * never reject, and "the preflight refused this candidate" is not an internal
+ * error but the job's legitimate ending. It used to have an exception-shaped
+ * twin (enforcePreflight) for the browser, back when the browser decided
+ * before any job existed; that path is gone and so is the twin.
+ */
+/**
+ * The identity of ONE preflight verdict: which candidate, which profile state,
+ * which issues. Consent to install despite warnings binds to this — a boolean
+ * `acceptWarnings: true` carries no such identity, so the report changing
+ * between the user's confirmation and the retry used to slip different
+ * warnings through under an old yes (profile edits force a re-probe; the new
+ * report can carry entirely different warnings).
+ *
+ * Candidate name+version come from the probe's own manifest, so a re-probe of
+ * a drifted mutable spec produces a different digest even when the issue list
+ * happens to read the same. 16 hex chars — this detects change, it is not a
+ * security boundary.
  */
-function preflightRefusal(report, acceptWarnings, label) {
+export function preflightConsentDigest(report, fingerprint) {
+  const canonical = JSON.stringify({
+    verdict: report?.verdict ?? null,
+    candidateName: report?.candidate?.name ?? null,
+    candidateVersion: report?.candidate?.version ?? null,
+    fingerprint: fingerprint ?? null,
+    issues: (report?.issues ?? []).map((entry) => [entry.severity ?? null, entry.title ?? null, entry.detail ?? null]),
+  });
+  return createHash("sha256").update(canonical).digest("hex").slice(0, 16);
+}
+
+function preflightRefusal(report, acceptWarnings, label, { digestProvided, fingerprint, consentBoundByToken = false } = {}) {
   if (report.verdict === "blocked") {
     return `${label}: ${report.summary}\n${report.issues.filter((entry) => entry.severity === "block").map(renderPreflightIssue).join("\n")}`;
   }
-  if (report.verdict === "warning" && acceptWarnings !== true) {
-    return `${label}: ${report.summary}\n${report.issues.filter((entry) => entry.severity === "warn").map(renderPreflightIssue).join("\n")}\n\nTo continue, show these warnings to the user and, after their explicit confirmation, call again with acceptWarnings: true.`;
+  if (report.verdict === "warning") {
+    const digest = preflightConsentDigest(report, fingerprint);
+    const warnLines = report.issues.filter((entry) => entry.severity === "warn").map(renderPreflightIssue).join("\n");
+    // 审批 token 自带报告摘要比对（consumeApprovalToken），它给出的同意已经
+    // 绑定了报告；只有裸布尔 acceptWarnings 这条道需要在这里比对 digest。
+    const consentMatches = acceptWarnings === true
+      && (consentBoundByToken === true || digestProvided === digest);
+    if (!consentMatches) {
+      const why = acceptWarnings === true
+        ? "the preflight report changed since the warnings were confirmed (or no report digest was supplied), so the earlier yes cannot carry over. Current warnings:"
+        : `${report.summary}`;
+      return `${label}: ${why}\n${warnLines}\n\nCurrent report digest: ${digest}. To continue, show these warnings to the user and, after their explicit confirmation, call again with acceptWarnings: true and reportDigest: ${digest}.`;
+    }
   }
   return undefined;
 }
 
 /**
- * Enforce a preflight verdict for an install. Throws when a blocker exists, or
- * when there are only warnings and acceptWarnings is not true.
- */
-function enforcePreflight(report, acceptWarnings, label) {
-  const refusal = preflightRefusal(report, acceptWarnings, label);
-  if (refusal !== undefined) {
-    const error = new Error(refusal);
-    error.preflight = report;
-    throw error;
-  }
-}
-
-/**
- * The whole agent-side install — registry lookup, spec resolution, host-shadow
- * check, isolated preflight, approval-token consumption, verdict, and pnpm —
- * as ONE job producer.
+ * The whole install — registry lookup, spec resolution, host-shadow check,
+ * isolated preflight, approval-token consumption, verdict, and pnpm — as ONE
+ * job producer, for BOTH surfaces (agent tool and browser RPC).
  *
  * Why it all lives in here (issue #8): `ctx.jobs.start()` treats `run()` as a
  * synchronous start boundary, so anything awaited before that call happens
@@ -1354,9 +1505,15 @@ function createInstallJobProducer({
   profile,
   spec: requestedSpec,
   acceptWarnings: acceptWarningsRequested = false,
+  reportDigest,
   allowBuildScripts,
   approvalToken,
-  agentOwner,
+  // 审批 token 的归属：agent 工具传 { surface: "agent", owner: <agent 标量
+  // id> }，浏览器 RPC 传 { surface: "browser", owner: <session> }。签发、
+  // 消费、清理都从这里走——producer 是审批 token 的唯一签发者，tracker 只
+  // 复制 outcome.approvalToken，不再自己签。
+  surface = "agent",
+  owner,
   npmRegistry = "",
   rawSources = [],
   profileExisted = true,
@@ -1394,7 +1551,7 @@ function createInstallJobProducer({
     signal.throwIfAborted();
 
     pushPreflight(`[dsh-plugin-mall] 预检 ${spec}：隔离目录探装（脚本禁用）\n`);
-    const preflight = await _runPreflight({ profile, spec, onOutput: pushPreflight, signal });
+    const preflight = await _runPreflight({ profile, spec, onOutput: pushPreflight, signal, registry, sources: rawSources });
     signal.throwIfAborted(); // 命中缓存时预检不会自己抛，这里补一次取消检查
     pushPreflight(`[dsh-plugin-mall] 预检结论：${preflight.report.verdict}\n`);
 
@@ -1409,11 +1566,11 @@ function createInstallJobProducer({
         spec,
         preflightReport: preflight.report,
         allowBuildScripts,
-        surface: "agent",
-        owner: agentOwner,
+        surface,
+        owner,
       });
       if (!consumeResult.valid) {
-        return { status: "failed", detail: `market_install: invalid approval token: ${consumeResult.reason}` };
+        return { status: "failed", detail: `invalid approval token: ${consumeResult.reason}` };
       }
       acceptWarnings = consumeResult.warningConsent;
       acceptWarningsActive = consumeResult.warningConsent;
@@ -1423,7 +1580,11 @@ function createInstallJobProducer({
       acceptWarningsActive = acceptWarnings;
     }
 
-    const refusal = preflightRefusal(preflight.report, acceptWarnings, `market_install ${spec}`);
+    const refusal = preflightRefusal(preflight.report, acceptWarnings, `market_install ${spec}`, {
+      digestProvided: reportDigest,
+      fingerprint: preflight.fingerprint,
+      consentBoundByToken: approvalToken !== undefined, // consume 已带报告摘要比对
+    });
     if (refusal !== undefined) {
       // 拒绝是这个 job 的正常结局，不是异常：作为 failed 的 detail 回去，
       // 模型从 job_output 就能读到逐条 BLOCK/WARN。
@@ -1441,7 +1602,7 @@ function createInstallJobProducer({
       invalidatePreflightFor(preflight.profileDir);
       clearApprovalTokensFor(profile, spec);
     } else if (outcome?.needsApproval && outcome.needsApproval.length > 0) {
-      clearApprovalTokensFor(profile, spec, { surface: "agent", owner: agentOwner });
+      clearApprovalTokensFor(profile, spec, { surface, owner });
       try {
         const token = issueApprovalToken({
           profile,
@@ -1450,21 +1611,29 @@ function createInstallJobProducer({
           preflightReport: preflight.report,
           needsApproval: outcome.needsApproval,
           proof: outcome.proof,
-          surface: "agent",
-          owner: agentOwner,
+          surface,
+          owner,
           acceptWarningsActive,
         });
         outcome.approvalToken = token;
-        outcome.detail = `${outcome.detail ?? ""}\n\nApproval token (pass to approvalToken on retry): ${token}`;
+        // token 只写进 agent 的 detail：agent 的 job_output 由宿主按 owner
+        // 隔离，模型重试时要从这里读到 token。浏览器的 detail 是任务面板
+        // 明文展示的字段，tracker.get/list 又无条件下发它（只有独立的
+        // approvalToken 字段做 session 隔离）——拼进去等于把 token 发给
+        // 所有 session。浏览器侧 token 只走 outcome.approvalToken →
+        // record.approvalToken → 同 session 的快照字段。
+        if (surface === "agent") {
+          outcome.detail = `${outcome.detail ?? ""}\n\nApproval token (pass to approvalToken on retry): ${token}`;
+        }
       } catch (error) {
         // 签发会因为凭证不完整（proof 缺失/不匹配）抛错。以前这段跑在 `.then`
         // 里，抛出去就把 done 变成 rejected —— 官方明说 done 必须不 reject，
         // 而且那样一来「pnpm 拦下了安装脚本」这条真正的结论会被一条内部错误
         // 顶掉。改成写进 detail：结论照常送达，同时明说这次没法重试。
-        outcome.detail = `${outcome.detail ?? ""}\n\nNOTE: no approval token could be issued (${error?.message ?? String(error)}), so allowBuildScripts cannot be used to retry this run — start a fresh market_install instead.`;
+        outcome.detail = `${outcome.detail ?? ""}\n\nNOTE: no approval token could be issued (${error?.message ?? String(error)}), so allowBuildScripts cannot be used to retry this run — start a fresh install instead.`;
       }
     } else {
-      clearApprovalTokensFor(profile, spec, { surface: "agent", owner: agentOwner });
+      clearApprovalTokensFor(profile, spec, { surface, owner });
     }
     return outcome;
   })().catch((error) => {
@@ -1788,9 +1957,28 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
           session,
           run: async (push) => {
             push(`[dsh-plugin-mall] 预检 ${resolved}：隔离目录探装（脚本禁用）\n`);
-            const { report } = await runPreflight({ profile, spec: resolved, onOutput: (text) => push(text) });
-            push(`[dsh-plugin-mall] 预检结论：${report.verdict}\n`);
-            return { status: "completed", detail: `预检完成：${report.verdict}`, extras: report };
+            const { report, profileDir: probedDir, fingerprint: probedFingerprint } = await runPreflight({ profile, spec: resolved, onOutput: (text) => push(text), registry, sources: rawSources });
+            // 结论 + 逐条原因都进日志。extras 只喂给风险卡片，卡片一关就什么
+            // 都不剩了；日志是留得住的那一份。
+            push(preflightVerdictLog(report));
+            // 钉住这份结论，别让用户的思考时间把它作废。
+            //
+            // PREFLIGHT_TTL 只有 30 秒，而有警告时下一步正是让用户读完风险卡片
+            // 再决定——读两条「无法验证宿主依赖」基本必然超过 30 秒，于是点下
+            // 「继续安装」时缓存已过期，隔离探装整个重跑一遍：用户看到的是确认
+            // 之后又干等几十秒，而那几十秒里没有任何反馈。
+            //
+            // pin 不会让判断变陈旧：pinPreflight 先比对 profile 指纹，profile
+            // 有任何改动这条缓存就立刻作废而不是被钉住。钉的是「同一个 profile
+            // 状态下的同一次结论」，10 分钟内复用与重跑完全等价。
+            pinPreflight(probedDir, resolved);
+            // extras 额外带 consentDigest：风险卡片确认时原样回传，装的时候
+            // 与当前报告比对——同意绑定的是「这份报告」，不是一次布尔值。
+            return {
+              status: "completed",
+              detail: `预检完成：${report.verdict}`,
+              extras: { ...report, consentDigest: preflightConsentDigest(report, probedFingerprint) },
+            };
           },
         });
         return rpcOk({ jobId, profile, spec: resolved });
@@ -1813,12 +2001,17 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
       } catch (error) {
         return rpcFail(error);
       }
-      const registry = await registryFor(profile, npmRegistry);
-      spec = await preferNpmSpec({ spec, registry, sources: rawSources });
+      // profile 名非法当场报错，与 market_uninstall / agent 工具一致——不是
+      // 一个注定失败的后台 job。顺带取「动手之前」的磁盘状态：producer 的
+      // 取消文案要靠它区分「profile 从未被动过」和「预检把不存在的 profile
+      // 建出来了」。
+      let installProfileDir;
+      let profileExisted = true;
       try {
-        await assertSafeToInstall({ spec, registry, sources: rawSources });
+        installProfileDir = resolveProfileDir(profile);
+        profileExisted = existsSync(join(installProfileDir, "package.json"));
       } catch (error) {
-        return rpcFail(error);
+        return rpcFail(new Error(`invalid profile: ${error.message}`));
       }
       const allowBuildScripts = Array.isArray(payload?.allowBuildScripts)
         ? payload.allowBuildScripts.map((name) => String(name))
@@ -1833,58 +2026,35 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
         return rpcFail(error);
       }
 
-      let preflight;
-      let acceptWarnings = false;
-      let acceptWarningsActive = false;
-      let approvedProof = undefined;
-      try {
-        preflight = await runPreflight({ profile, spec });
-        if (approvalToken !== undefined) {
-          const consumeResult = consumeApprovalToken({
-            token: approvalToken,
-            profile,
-            profileDir: preflight.profileDir,
-            spec,
-            preflightReport: preflight.report,
-            allowBuildScripts,
-            surface: "browser",
-            owner: session,
-          });
-          if (!consumeResult.valid) {
-            return rpcFail(new Error(`invalid approval token: ${consumeResult.reason}`));
-          }
-          acceptWarnings = consumeResult.warningConsent;
-          acceptWarningsActive = consumeResult.warningConsent;
-          approvedProof = consumeResult.proof;
-        } else {
-          acceptWarnings = payload?.acceptWarnings === true;
-          acceptWarningsActive = acceptWarnings;
-        }
-        enforcePreflight(preflight.report, acceptWarnings, `install ${spec}`);
-      } catch (error) {
-        return rpcFail(error);
-      }
-
-      pinPreflight(preflight.profileDir, spec);
-      try {
-        const jobId = tracker.start({
+      // 到这里为止只做本地、同步、必须在返回 job id 之前失败的检查——与
+      // market_install 的 execute() 同构。registry 解析、防抢注、宿主遮蔽
+      // 检查、预检（缓存/身份再校验）、token 消费、警告关卡与 pnpm 全部在
+      // producer 里跑：旧行为把整段 await 在 tracker.start 之前，用户点
+      // 「继续安装」后风险框立刻消失而任务条目几十秒不动，预检 TTL 一过还
+      // 会把隔离探装整个重跑一遍（那个洞已由结算即 pin 堵上，这里是根治）。
+      // 结论形态随之对齐 agent 路径：blocker/未确认警告不再让 RPC 报错，
+      // 而是作为 job 的 failed outcome 送达，日志里看得到原文。
+      const jobId = tracker.start({
+        profile,
+        spec,
+        surface: "browser",
+        session,
+        producerFactory: () => createInstallJobProducer({
           profile,
           spec,
+          acceptWarnings: payload?.acceptWarnings === true,
+          reportDigest: typeof payload?.acceptedReportDigest === "string" ? payload.acceptedReportDigest.trim() : undefined,
           allowBuildScripts,
-          approvedProof,
-          preflight: preflight.report,
-          profileDir: preflight.profileDir,
-          acceptWarningsActive,
+          approvalToken,
           surface: "browser",
-          session,
-          onSettled: (outcome) => {
-            if (outcome?.status === "completed") invalidatePreflightFor(preflight.profileDir);
-          },
-        });
-        return rpcOk({ jobId, profile, spec, preflight: { verdict: preflight.report.verdict, summary: preflight.report.summary } });
-      } catch (error) {
-        return rpcFail(error);
-      }
+          owner: session,
+          npmRegistry,
+          rawSources,
+          profileExisted,
+          profileDir: installProfileDir,
+        }),
+      });
+      return rpcOk({ jobId, profile, spec });
     }
     case "uninstall": {
       const profile = String(payload?.profile ?? defaultProfile).trim();
@@ -1915,7 +2085,6 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
           profile,
           spec: packageName,
           verb: "remove",
-          profileDir,
           surface: "browser",
           session,
           onSettled: (outcome) => {
@@ -2086,7 +2255,7 @@ export function apply(ctx, config = {}) {
   ctx.systemPrompt.section({
     name: "tool:market",
     order: 120,
-    text: "The dsh plugin marketplace tools are available: market_search discovers plugins on the GitHub dsh-plugin topic, market_info inspects one repository, market_install installs a plugin into a dsh profile as a background job (poll with job_output), market_uninstall removes an installed plugin from a dsh profile as a background job, and market_installed lists a profile's plugins. A successful market_install or market_uninstall only takes effect after the dsh process restarts — remind the user to restart. Prefer plugins with meaningful stars and a dsh.bundle declaration (market_info shows both). market_install runs an isolated preflight before installing (the candidate is probed with install scripts disabled and scanned for conflicts); that preflight runs inside the background job, so its verdict — including a refusal — arrives through job_output rather than as an immediate error from the call. A blocker refuses the install and warnings require acceptWarnings: true after the user confirms them — never set it on the user's behalf. If market_install stops for install-script approval, that decision is also the user's: show them the reported package names and commands and wait for an answer — never approve on their behalf.",
+    text: "The dsh plugin marketplace tools are available: market_search discovers plugins on the GitHub dsh-plugin topic, market_info inspects one repository, market_install installs a plugin into a dsh profile as a background job (poll with job_output), market_uninstall removes an installed plugin from a dsh profile as a background job, and market_installed lists a profile's plugins. A successful market_install or market_uninstall only takes effect after the dsh process restarts — remind the user to restart. Prefer plugins with meaningful stars and a dsh.bundle declaration (market_info shows both). market_install runs an isolated preflight before installing (the candidate is probed with install scripts disabled and scanned for conflicts); that preflight runs inside the background job, so its verdict — including a refusal — arrives through job_output rather than as an immediate error from the call. A blocker refuses the install and warnings require acceptWarnings: true together with the reportDigest from the failed job after the user confirms them — never set either on the user's behalf. If market_install stops for install-script approval, that decision is also the user's: show them the reported package names and commands and wait for an answer — never approve on their behalf.",
   });
 
   ctx.tools.register(defineTool({
@@ -2164,7 +2333,7 @@ export function apply(ctx, config = {}) {
 
   ctx.tools.register(defineTool({
     name: "market_install",
-    description: "Install a plugin into a local dsh profile by running `pnpm add` in that profile's directory, reconciling the profile's bundle layer list, and — for browser-side UI plugins (`dsh.client`) — registering a loader row in the profile's cordis.patch.yml. Same flow as `dsh plugin --profile <name> add <spec>`. ALWAYS runs as a background job, and the call itself does almost nothing: it validates the profile name, the spec and the approval arguments, then returns a job id. Everything slow happens INSIDE the job — resolving the spec against the npm registry, the host-module shadowing check, the isolated preflight (the candidate is installed with scripts disabled into a throwaway directory and scanned for manifest/patch conflicts and version/OS incompatibilities), and pnpm itself. Poll with job_output; cancel with job_kill (a cancel during the preflight leaves the profile untouched). Because the preflight runs inside the job, ITS VERDICT ARRIVES AS THE JOB'S OUTCOME, not as an error from this call: a blocker, or a warning the user has not confirmed, ends the job as `failed` with the individual issues in its detail — read them there and relay them verbatim. A warning is cleared by calling again with `acceptWarnings: true`, and only after the USER has explicitly confirmed it; never consent on their behalf. If pnpm blocks a dependency's install scripts, the job STOPS and reports which packages want to run install-time code, what those commands are, whether each is the plugin itself or a transitive dependency, and issues a one-shot approval token. Relay that list to the user verbatim, and only call again with `allowBuildScripts` naming the packages they approved along with `approvalToken`. A successful install only takes effect after the dsh process restarts.",
+    description: "Install a plugin into a local dsh profile by running `pnpm add` in that profile's directory, reconciling the profile's bundle layer list, and — for browser-side UI plugins (`dsh.client`) — registering a loader row in the profile's cordis.patch.yml. Same flow as `dsh plugin --profile <name> add <spec>`. ALWAYS runs as a background job, and the call itself does almost nothing: it validates the profile name, the spec and the approval arguments, then returns a job id. Everything slow happens INSIDE the job — resolving the spec against the npm registry, the host-module shadowing check, the isolated preflight (the candidate is installed with scripts disabled into a throwaway directory and scanned for manifest/patch conflicts and version/OS incompatibilities), and pnpm itself. Poll with job_output; cancel with job_kill (a cancel during the preflight leaves the profile untouched). Because the preflight runs inside the job, ITS VERDICT ARRIVES AS THE JOB'S OUTCOME, not as an error from this call: a blocker, or a warning the user has not confirmed, ends the job as `failed` with the individual issues in its detail — read them there and relay them verbatim. A warning is cleared by calling again with `acceptWarnings: true` AND `reportDigest` set to the \"Current report digest\" printed in that failed job's detail — the consent is bound to that exact report, so if the candidate or the profile changed in between, the retry fails again with the NEW warnings; never consent on the user's behalf. If pnpm blocks a dependency's install scripts, the job STOPS and reports which packages want to run install-time code, what those commands are, whether each is the plugin itself or a transitive dependency, and issues a one-shot approval token. Relay that list to the user verbatim, and only call again with `allowBuildScripts` naming the packages they approved along with `approvalToken`. A successful install only takes effect after the dsh process restarts.",
     parameters: {
       spec: {
         type: "string",
@@ -2179,6 +2348,10 @@ export function apply(ctx, config = {}) {
         type: "boolean",
         description: "Set true only after the USER has explicitly confirmed they accept the preflight warnings the previous call reported. Without it, an install whose preflight found only warnings is refused. Never set this on your own initiative.",
       },
+      reportDigest: {
+        type: "string",
+        description: "The \"Current report digest\" printed by the failed job you are retrying. The warning consent is bound to that exact report: if the candidate package or the profile changed in between, the digest no longer matches and the job fails again with the NEW warnings — show those to the user and confirm anew. Required whenever acceptWarnings is true.",
+      },
       approvalToken: {
         type: "string",
         description: "Opaque one-shot approval token issued when a previous install paused for install script approval. Required on retry if the install had accepted preflight warnings.",
@@ -2243,9 +2416,11 @@ export function apply(ctx, config = {}) {
           profile,
           spec,
           acceptWarnings: args.acceptWarnings === true,
+          reportDigest: typeof args.reportDigest === "string" ? args.reportDigest.trim() : undefined,
           allowBuildScripts,
           approvalToken,
-          agentOwner,
+          surface: "agent",
+          owner: agentOwner,
           npmRegistry,
           rawSources,
           profileExisted,
@@ -2691,7 +2866,21 @@ export async function runSelfTests() {
       surface: "browser",
       owner: "session-beta",
     });
-    check("跨浏览器 session 消费审批 token 被拒绝且销毁", !crossSessionRes.valid && /session mismatch/.test(crossSessionRes.reason));
+    // 归属不符的尝试**不许销毁** token：一旦 token 经由任何渠道泄漏，拿到
+    // 它的人也不能靠「试一下」烧掉别人的批准流程。归属校验先于一次性销毁。
+    check("跨浏览器 session 消费审批 token 被拒绝且不销毁", !crossSessionRes.valid && /session mismatch/.test(crossSessionRes.reason));
+    const rightfulSessionRes = consumeApprovalToken({
+      token: browserTok,
+      profile: "web",
+      profileDir,
+      spec: "browser-pkg",
+      preflightReport: cleanPreflightReport,
+      allowBuildScripts: ["browser-pkg"],
+      surface: "browser",
+      owner: "session-alpha",
+    });
+    check("被异 session 碰过的 token 仍归正主消费",
+      rightfulSessionRes.valid === true, `reason=${rightfulSessionRes.reason}`);
 
     // 跨 surface (browser vs agent)
     const agentProof = proofFor("agent-pkg");
@@ -2715,14 +2904,40 @@ export async function runSelfTests() {
       surface: "browser",
       owner: "browser-sess",
     });
-    check("跨 surface (agent vs browser) 消费审批 token 失败且被销毁", !crossSurfaceRes.valid && /surface mismatch/.test(crossSurfaceRes.reason));
+    check("跨 surface (agent vs browser) 消费审批 token 失败且不被销毁",
+      !crossSurfaceRes.valid && /surface mismatch/.test(crossSurfaceRes.reason));
+    const rightfulAgentRes = consumeApprovalToken({
+      token: agentTok,
+      profile: "web",
+      profileDir,
+      spec: "agent-pkg",
+      preflightReport: cleanPreflightReport,
+      allowBuildScripts: ["agent-pkg"],
+      surface: "agent",
+      owner: "agent-1",
+    });
+    check("被跨 surface 碰过的 token 仍归正主消费", rightfulAgentRes.valid === true, `reason=${rightfulAgentRes.reason}`);
 
-    // Tracker 隔离与 session 校验
+    // Tracker 隔离与 session 校验。
+    // 审批 token 由 producer 签发（createInstallJobProducer 是唯一签发者），
+    // tracker 只把 outcome.approvalToken 摘到 record 上——这里的假 producer
+    // 照真实流程先签好、挂在 outcome 里带出来。
     const trackerProof = proofFor("foo-script");
+    const trackerTok = issueApprovalToken({
+      profile: "web",
+      profileDir,
+      spec: "foo-script",
+      preflightReport: cleanPreflightReport,
+      needsApproval: disclosureFor(trackerProof),
+      proof: trackerProof,
+      surface: "browser",
+      owner: "session-alpha",
+    });
     let needsApprovalOutcome = {
       status: "needsApproval",
       needsApproval: disclosureFor(trackerProof),
       proof: trackerProof,
+      approvalToken: trackerTok,
     };
     const approvalProducer = {
       cancel: () => {},
@@ -2735,7 +2950,6 @@ export async function runSelfTests() {
     const sessionJobId = sessionTracker.start({
       profile: "web",
       spec: "foo-script",
-      profileDir,
       surface: "browser",
       session: "session-alpha",
     });
@@ -2743,9 +2957,15 @@ export async function runSelfTests() {
 
     const snapDiffSession = sessionTracker.get(sessionJobId, "session-beta").snapshot;
     check("不同 session 查询 job 时不会暴露 approvalToken", snapDiffSession.approvalToken === undefined);
+    // 整个序列化结果都不含 token——不只看 approvalToken 字段：detail、日志、
+    // 任何嵌套位置藏一份都算泄漏。
+    check("不同 session 的 get/list 序列化结果整体不含 token",
+      !JSON.stringify(sessionTracker.get(sessionJobId, "session-beta")).includes(trackerTok)
+      && !JSON.stringify(sessionTracker.list("session-beta")).includes(trackerTok));
 
     const snapSameSession = sessionTracker.get(sessionJobId, "session-alpha").snapshot;
-    check("相同 session 查询 job 时可获取 approvalToken", typeof snapSameSession.approvalToken === "string");
+    check("tracker 复制 producer 签发的 approvalToken（同 session 可见）",
+      snapSameSession.approvalToken === trackerTok);
 
     let cancelRefused = false;
     try {
@@ -3038,7 +3258,6 @@ export async function runSelfTests() {
     const jobId = tracker.start({
       profile: "fixture-profile",
       spec: "fail-pkg",
-      profileDir,
       onSettled: (outcome) => { settledOutcome = outcome; },
     });
     await new Promise((resolvePromise) => setImmediate(resolvePromise));
@@ -3222,6 +3441,279 @@ export async function runSelfTests() {
     runStartupRecovery("profile-a", { recover: () => ({ action: "rolled-back", reason: "静态校验未通过" }), log: rolledLog });
     check("回滚路径播报原因", rolledLog.lines.some((line) => line.includes("rolled back") && line.includes("静态校验未通过")));
 
+    // ── 12a. 预检 job 结算即 pin：用户的思考时间不该让结论作废 ──────────────
+    //
+    // 有警告时下一步是让用户读风险卡片再决定，而 PREFLIGHT_TTL 只有 30 秒。
+    // 读两条警告基本必然超时，于是点「继续安装」时缓存已过期、隔离探装整个
+    // 重跑一遍——用户看到的就是确认之后又干等几十秒。
+    {
+      const pinSpec = "pin-me";
+      const pinKey = preflightCacheKey(profileDir, pinSpec);
+      preflightCache.set(pinKey, {
+        report: { ok: true, verdict: "warning", summary: "", issues: [] },
+        fingerprint: computeProfileFingerprint(profileDir),
+        at: Date.now(),
+        pinnedAt: undefined,
+      });
+      pinPreflight(profileDir, pinSpec);
+      check("预检结算后 pin 生效（warning 是可行动结论）", isPinned(preflightCache.get(pinKey)) === true);
+
+      // 把落库时间推到 TTL 之外——没有 pin 的话这条已经该重跑了。
+      preflightCache.get(pinKey).at = Date.now() - (PREFLIGHT_TTL + 5000);
+      const stale = preflightCache.get(pinKey);
+      check("超过 30 秒 TTL 后，pin 仍让它有效（不必重跑探装）",
+        isPinned(stale) === true && Date.now() - stale.at > PREFLIGHT_TTL);
+
+      // 但 pin 绝不能护住一个已经对不上 profile 的结论：指纹一变就丢弃。
+      // 这是 pin 可以放心提前打的全部理由。
+      const patchPath = join(profileDir, "cordis.patch.yml");
+      const patchBefore = readFileSync(patchPath, "utf8");
+      writeFileSync(patchPath, `${patchBefore}\n- name: pin-test-drift\n`);
+      pinPreflight(profileDir, pinSpec);
+      check("profile 一变 → pin 拒绝钉住并丢弃缓存", preflightCache.get(pinKey) === undefined);
+      writeFileSync(patchPath, patchBefore);
+
+      // blocked 不 pin。探装失败（网络抖动）产出的是 ok:false 的 blocked，
+      // 而 immutable spec 的身份再校验不设防——钉住等于把一次临时失败固化
+      // 10 分钟，网络恢复也不会再试。真冲突的 blocked 同样没有「用户读完
+      // 再继续」的后继流程。落库时间推到 TTL 外之后必须重跑探装。
+      const failSpec = "immutable-fail@1.0.0";
+      const failKey = preflightCacheKey(profileDir, failSpec);
+      const failReport = {
+        ok: false,
+        verdict: "blocked",
+        candidate: { name: undefined, version: undefined, kind: "unknown", rows: [] },
+        issues: [{ severity: "block", title: "预检执行失败", detail: "network unreachable" }],
+        summary: "预检执行失败，正式 profile 未被修改",
+      };
+      preflightCache.set(failKey, {
+        report: failReport,
+        fingerprint: computeProfileFingerprint(profileDir),
+        at: Date.now(),
+        pinnedAt: undefined,
+      });
+      pinPreflight(profileDir, failSpec);
+      check("blocked（探装失败）不被 pin", isPinned(preflightCache.get(failKey)) === false);
+      preflightCache.get(failKey).at = Date.now() - (PREFLIGHT_TTL + 5000); // 落库时间推出 TTL
+      let failProbes = 0;
+      const failOutcome = await runPreflight({
+        profile: "unused-by-fixture",
+        spec: failSpec,
+        _profileDir: profileDir,
+        _preflightInstall: async () => { failProbes++; return { ok: true, verdict: "safe", summary: "", issues: [], candidate: { name: "immutable-fail", version: "1.0.0", kind: "bundle", rows: [] } }; },
+      });
+      check("blocked 超过 TTL → 重新探装（临时失败不会被钉 10 分钟）",
+        failProbes === 1 && failOutcome.report.verdict === "safe",
+        `probes=${failProbes} verdict=${failOutcome.report.verdict}`);
+    }
+
+    // ── 12b1. spec 形态判定：不可变可复用 / 可核验须再核 / 其余不可复用 ──────
+    {
+      const cases = [
+        ["pkg", "npm-tag"],
+        ["pkg@latest", "npm-tag"],
+        ["pkg@*", "npm-tag"],
+        ["@scope/pkg", "npm-tag"], // scoped 裸名没有 range——判定看名字后有没有东西，不看 @
+        ["pkg@^1.2.0", "npm-range"],
+        ["@scope/pkg@~2.0.0", "npm-range"],
+        ["pkg@1.2.3", "immutable"], // 精确版本：npm 禁止覆盖已发布版本
+        ["pkg@1.2.3-beta.1", "immutable"],
+        ["github:owner/repo", null], // 未钉 sha：同版本能换代码，name/version 证明不了任何事
+        ["github:owner/repo#main", null], // 分支名不是身份
+        ["github:owner/repo.git", null],
+        ["github:owner/repo#a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2", "immutable"], // 40 位 sha 钉死
+        ["file:../local.tgz", null], // 内容能原地变
+        ["link:../pkg", null],
+        ["https://example.com/pkg.tgz", null],
+        ["owner/repo", null],
+      ];
+      let kindOk = true;
+      for (const [spec, expected] of cases) {
+        if (specIdentityKind(spec) !== expected) { kindOk = false; console.error(`  specIdentityKind(${JSON.stringify(spec)}) = ${JSON.stringify(specIdentityKind(spec))}，预期 ${JSON.stringify(expected)}`); }
+      }
+      check("spec 形态判定表（immutable/npm-tag/npm-range/不可核验）", kindOk);
+
+      // github repo 提取的正则回归：懒匹配 + 可选后缀曾把 owner/repo 截成
+      // owner/r，身份查询全部打在不存在的仓库上、无声 fail-open。
+      const repoCases = [
+        ["github:owner/repo", "owner/repo"],
+        ["github:owner/repo.git", "owner/repo"],
+        ["github:owner/repo#main", "owner/repo"],
+        ["github:owner/repo#a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2", "owner/repo"],
+        ["github:owner-with-dash/repo.with.dots", "owner-with-dash/repo.with.dots"],
+        ["owner/repo", null],
+        ["github:owner", null],
+      ];
+      let repoOk = true;
+      for (const [spec, expected] of repoCases) {
+        if (githubSpecRepo(spec) !== expected) { repoOk = false; console.error(`  githubSpecRepo(${JSON.stringify(spec)}) = ${JSON.stringify(githubSpecRepo(spec))}，预期 ${JSON.stringify(expected)}`); }
+      }
+      check("github spec 的 repo 提取不截断", repoOk);
+    }
+
+    // ── 12b2. 缓存复用的候选身份再校验：fail-closed ─────────────────────────
+    //
+    // 复用必须同时核住两侧：profile 指纹 + 候选身份。核不住的形态
+    // （file:/link:/URL、未钉 sha 的 github）没有可信身份可言，registry
+    // 查不到「当前值」同样算没核住——一律丢弃缓存重跑。这里曾把「核不上
+    // 就沿用旧报告」当正确答案（fail-open），等于给所有核不住的形态开了
+    // 永久通道；fixture 一并翻转。
+    {
+      const idSpec = "mutable-pkg";
+      const idKey = preflightCacheKey(profileDir, idSpec);
+      const probeCalls = { count: 0 };
+      const probeReport = (name, version) => ({
+        verdict: "safe", summary: "", issues: [],
+        candidate: { name, version, kind: "bundle", rows: [] },
+      });
+      const seedCache = (spec, name, version) => {
+        preflightCache.set(preflightCacheKey(profileDir, spec), {
+          report: probeReport(name, version),
+          fingerprint: computeProfileFingerprint(profileDir),
+          at: Date.now(),
+          pinnedAt: Date.now(),
+        });
+      };
+      let resolveCalls = 0;
+      const run = (spec, resolve) => runPreflight({
+        profile: "unused-by-fixture",
+        spec,
+        _profileDir: profileDir,
+        registry: "https://registry.npmjs.org",
+        sources: [],
+        _resolveSpecIdentity: typeof resolve === "function" ? async (args) => { resolveCalls++; return resolve(args); } : undefined,
+        _preflightInstall: async () => { probeCalls.count++; return probeReport("mutable-pkg", "2.0.0"); },
+      });
+      const probesBefore = () => probeCalls.count;
+
+      // a) 可核验形态 + 身份一致 → 复用缓存，探装不跑。
+      seedCache(idSpec, "mutable-pkg", "1.0.0");
+      const probesBeforeA = probeCalls.count;
+      const same = await run(idSpec, async () => ({ name: "mutable-pkg", version: "1.0.0" }));
+      check("身份一致 → 复用缓存不重跑探装",
+        same.report.candidate.version === "1.0.0" && probeCalls.count === probesBeforeA,
+        `version=${same.report.candidate.version} probes=${probeCalls.count}`);
+
+      // b) latest 漂了 → 缓存作废、重跑、新报告落缓存。重跑装的正是新版，
+      //    新报告的 digest 随之变化——同意绑定由此接上。
+      const drifted = await run(idSpec, async () => ({ name: "mutable-pkg", version: "2.0.0" }));
+      check("候选漂移 → 丢弃缓存重跑探装",
+        drifted.report.candidate.version === "2.0.0" && probeCalls.count === 1,
+        `version=${drifted.report.candidate.version} probes=${probeCalls.count}`);
+      check("漂移重跑后缓存里存的是新报告",
+        preflightCache.get(idKey)?.report?.candidate?.version === "2.0.0");
+
+      // c) 核不上（registry 不可达）→ 丢弃缓存重跑，不再沿用旧报告。
+      seedCache(idSpec, "mutable-pkg", "1.0.0");
+      const unreachable = await run(idSpec, async () => undefined);
+      check("身份核不上 → 丢弃缓存重跑（fail-closed）",
+        unreachable.report.candidate.version === "2.0.0" && probeCalls.count === 2,
+        `version=${unreachable.report.candidate.version} probes=${probeCalls.count}`);
+
+      // d) 解析结果没有 version → 同样没核住，丢弃重跑。
+      seedCache(idSpec, "mutable-pkg", "1.0.0");
+      const noVersion = await run(idSpec, async () => ({ name: "mutable-pkg", version: null }));
+      check("解析结果没有 version → 丢弃缓存重跑",
+        noVersion.report.candidate.version === "2.0.0" && probeCalls.count === 3);
+
+      // e) 不可核验形态（未钉 sha 的 github）→ 身份查询根本不发起，直接重跑。
+      const ghSpec = "github:owner/repo";
+      seedCache(ghSpec, "some-pkg", "1.0.0");
+      const resolvesBefore = resolveCalls;
+      const ghRun = await run(ghSpec, async () => ({ name: "some-pkg", version: "1.0.0" }));
+      check("未钉 sha 的 github → 不发起身份查询，直接丢弃重跑",
+        resolveCalls === resolvesBefore && ghRun.report.candidate.version === "2.0.0" && probeCalls.count === 4,
+        `resolves=${resolveCalls - resolvesBefore} probes=${probeCalls.count}`);
+      const fileRun = await run("file:../local.tgz", async () => ({ name: "x", version: "1.0.0" }));
+      check("file: 路径 → 同样不可核验，直接重跑",
+        fileRun.report.candidate.version === "2.0.0" && probeCalls.count === 5);
+
+      // f) 不可变形态（精确版本）→ 不发起查询，无条件复用。
+      const exactSpec = "fixed-pkg@1.2.3";
+      seedCache(exactSpec, "fixed-pkg", "1.2.3");
+      const resolvesBeforeExact = resolveCalls;
+      const exactRun = await run(exactSpec, async () => { throw new Error("不可变形态不该发起身份查询"); });
+      check("精确版本 → 不发起身份查询，复用缓存",
+        resolveCalls === resolvesBeforeExact && exactRun.report.candidate.version === "1.2.3",
+        `resolves=${resolveCalls - resolvesBeforeExact}`);
+
+      // g) 取消上抛，且缓存保持原样——取消不是「核不上」，不许走丢弃分支。
+      seedCache(idSpec, "mutable-pkg", "1.0.0");
+      let aborted = false;
+      try {
+        await run(idSpec, async () => { const error = new Error("cancelled"); error.name = "AbortError"; throw error; });
+      } catch (error) { aborted = error?.name === "AbortError"; }
+      check("身份再校验中取消 → 上抛 AbortError 且缓存原样",
+        aborted && preflightCache.get(idKey)?.report?.candidate?.version === "1.0.0" && probeCalls.count === 5);
+
+      // h) 不可核验的形态不 pin——pin 了也只是把注定要丢弃的缓存钉在原地。
+      seedCache("github:owner/pin-test", "some-pkg", "1.0.0");
+      const pinGuardKey = preflightCacheKey(profileDir, "github:owner/pin-test");
+      preflightCache.get(pinGuardKey).pinnedAt = undefined; // 种子不带 pin
+      pinPreflight(profileDir, "github:owner/pin-test");
+      check("不可核验形态 → pinPreflight 拒绝钉住", isPinned(preflightCache.get(pinGuardKey)) === false);
+    }
+
+    // ── 12b. 预检的告警原文必须留在 job 日志里 ──────────────────────────────
+    //
+    // 此前浏览器侧只 push 了一行 verdict，逐条原因走 extras 进风险卡片。卡片
+    // 一关（或点了「继续安装」）那些原因就再也找不回来了，而用户回头想弄清
+    // 「刚才到底警告了什么」只有日志可查。
+    {
+      const log = preflightVerdictLog({
+        verdict: "warning",
+        issues: [
+          { severity: "warn", title: "无法验证宿主依赖", detail: "需要 @deepseek-ai/dsh-client-ui-slots@^0.1.0-rc.8，但预检无法解析宿主版本。" },
+          { severity: "block", title: "重复挂载", detail: "两行指向同一个模块" },
+        ],
+      });
+      check("预检日志带结论", /预检结论：warning/.test(log));
+      check("预检日志逐条带 WARN 原文（含 detail，不是只有标题）",
+        /\[WARN\] 无法验证宿主依赖: .*dsh-client-ui-slots@\^0\.1\.0-rc\.8/.test(log));
+      check("预检日志逐条带 BLOCK 原文", /\[BLOCK\] 重复挂载: 两行指向同一个模块/.test(log));
+      check("没有 issues 时不炸、仍带结论",
+        preflightVerdictLog({ verdict: "safe" }) === "[dsh-plugin-mall] 预检结论：safe\n");
+    }
+
+    // ── 12b3. 预检 job 全链路（startCustom → get）：日志行与 digest 真的
+    // 能走完 tracker 的整条路。只测 formatter 测不出「extras 序列化下发」
+    // 这一段——前端拿 digest 全靠它。
+    {
+      const integrationReport = {
+        verdict: "warning",
+        summary: "有需要确认的改动",
+        candidate: { name: "x", version: "1.0.0" },
+        issues: [{ severity: "warn", title: "替换整块 config", detail: "sandbox-policy" }],
+      };
+      const integrationTracker = createJobTracker();
+      const integrationId = integrationTracker.startCustom({
+        kind: "dsh-plugin-preflight",
+        label: "preflight x",
+        profile: "web",
+        spec: "x",
+        surface: "browser",
+        session: "sess-i",
+        run: async (push) => {
+          push("[dsh-plugin-mall] 预检 x：隔离目录探装（脚本禁用）\n");
+          push(preflightVerdictLog(integrationReport));
+          return {
+            status: "completed",
+            detail: `预检完成：${integrationReport.verdict}`,
+            extras: { ...integrationReport, consentDigest: preflightConsentDigest(integrationReport, "fp-i") },
+          };
+        },
+      });
+      await new Promise((resolvePromise) => setImmediate(resolvePromise));
+      const integrationDelta = integrationTracker.get(integrationId, "sess-i");
+      const integrationLog = integrationDelta.output ?? "";
+      check("预检 job 集成：结论与逐条 WARN 进快照输出",
+        /预检结论：warning/.test(integrationLog) && /\[WARN\] 替换整块 config: sandbox-policy/.test(integrationLog),
+        `output=${JSON.stringify(integrationLog)}`);
+      check("预检 job 集成：digest 随 extras 送达",
+        integrationDelta.snapshot?.extras?.consentDigest === preflightConsentDigest(integrationReport, "fp-i"),
+        `extras=${JSON.stringify(integrationDelta.snapshot?.extras)?.slice(0, 120)}`);
+    }
+
     // ── 13. market_install：整条链跑在 job 里（issue #8）────────────────────
     // 原来 registry 查询 → 防抢注解析 → 隔离预检全在 ctx.jobs.start() 之前 await，
     // 于是几十秒里没有 job id、没有日志、job_kill 够不着，而工具描述写的是
@@ -3308,6 +3800,178 @@ export async function runSelfTests() {
       check("预检 warning 未确认 → failed 且提示 acceptWarnings",
         warnOutcome?.status === "failed" && /acceptWarnings: true/.test(warnOutcome?.detail ?? "") && warnInstalls.calls === 0);
 
+      // 13a2b. digest 的敏感性：报告的任何一个承重维度变了，digest 必须变。
+      // 「同意绑定的是这份报告」靠它成立——漏一个维度，那个维度上的漂移就
+      // 能从旧同意底下溜过去。
+      {
+        const consentReport = {
+          verdict: "warning",
+          candidate: { name: "warn-pkg", version: "1.0.0" },
+          issues: [{ severity: "warn", title: "替换整块 config", detail: "sandbox-policy" }],
+        };
+        const d0 = preflightConsentDigest(consentReport, "fp-consent");
+        check("digest 对同一输入稳定", d0 === preflightConsentDigest(consentReport, "fp-consent"));
+        check("issues 变化 → digest 变",
+          d0 !== preflightConsentDigest({ ...consentReport, issues: [{ severity: "warn", title: "替换整块 config", detail: "别的块" }] }, "fp-consent"));
+        check("候选版本变化 → digest 变",
+          d0 !== preflightConsentDigest({ ...consentReport, candidate: { name: "warn-pkg", version: "2.0.0" } }, "fp-consent"));
+        check("profile 指纹变化 → digest 变", d0 !== preflightConsentDigest(consentReport, "fp-other"));
+        check("verdict 变化 → digest 变", d0 !== preflightConsentDigest({ ...consentReport, verdict: "safe" }, "fp-consent"));
+      }
+
+      // 13a3. 同意绑定 digest：acceptWarnings:true 不再是无条件的通行证。
+      // 用户确认警告到重试之间，报告可能整个换过（profile 变了触发重跑、
+      // 候选发了新版）——布尔同意不得沿用，必须重新看新的警告。
+      {
+        const consentReport = {
+          verdict: "warning",
+          candidate: { name: "warn-pkg", version: "1.0.0" },
+          issues: [{ severity: "warn", title: "替换整块 config", detail: "sandbox-policy" }],
+        };
+        const consentFingerprint = "fp-consent";
+        const goodDigest = preflightConsentDigest(consentReport, consentFingerprint);
+
+        // a) digest 匹配 → 通过警告关卡，进入安装。
+        const matchInstalls = { calls: 0 };
+        const matchOutcome = await settleWithin(createInstallJobProducer({
+          profile: "web",
+          spec: "warn-pkg",
+          agentOwner: "agent-selftest",
+          acceptWarnings: true,
+          reportDigest: goodDigest,
+          ...seams({
+            _runPreflight: async () => ({ report: consentReport, profileDir, fingerprint: consentFingerprint }),
+            _runInstall: neverInstall(matchInstalls),
+          }),
+        }).done, 5000, "digest 匹配");
+        check("警告同意 digest 匹配 → 进入安装",
+          matchOutcome?.status === "completed" && matchInstalls.calls === 1,
+          `status=${matchOutcome?.status} calls=${matchInstalls.calls} detail=${matchOutcome?.detail}`);
+
+        // b) digest 过期：重跑后报告变了（多了一条警告、候选升了版本）。
+        //    拒绝，且 detail 给出**新** digest——模型照着新警告重新确认。
+        const driftedReport = {
+          verdict: "warning",
+          candidate: { name: "warn-pkg", version: "2.0.0" },
+          issues: [
+            { severity: "warn", title: "替换整块 config", detail: "sandbox-policy" },
+            { severity: "warn", title: "新版本的额外改动", detail: "loader-id 顶掉现有行" },
+          ],
+        };
+        const newDigest = preflightConsentDigest(driftedReport, consentFingerprint);
+        const driftInstalls = { calls: 0 };
+        const driftOutcome = await settleWithin(createInstallJobProducer({
+          profile: "web",
+          spec: "warn-pkg",
+          agentOwner: "agent-selftest",
+          acceptWarnings: true,
+          reportDigest: goodDigest, // 用户当初确认的是旧报告的 digest
+          ...seams({
+            _runPreflight: async () => ({ report: driftedReport, profileDir, fingerprint: consentFingerprint }),
+            _runInstall: neverInstall(driftInstalls),
+          }),
+        }).done, 5000, "digest 过期");
+        check("报告变了 → 旧 digest 拒绝安装",
+          driftOutcome?.status === "failed" && driftInstalls.calls === 0,
+          `status=${driftOutcome?.status} calls=${driftInstalls.calls}`);
+        check("报告变了 → 拒绝时展示新警告原文", /新版本的额外改动/.test(driftOutcome?.detail ?? ""));
+        check("报告变了 → 拒绝时给出新 digest 供重新确认",
+          driftOutcome?.detail?.includes(newDigest) === true && !driftOutcome.detail.includes(goodDigest));
+
+        // c) acceptWarnings:true 但压根没给 digest → 同样拒绝。
+        const bareInstalls = { calls: 0 };
+        const bareOutcome = await settleWithin(createInstallJobProducer({
+          profile: "web",
+          spec: "warn-pkg",
+          agentOwner: "agent-selftest",
+          acceptWarnings: true,
+          ...seams({
+            _runPreflight: async () => ({ report: consentReport, profileDir, fingerprint: consentFingerprint }),
+            _runInstall: neverInstall(bareInstalls),
+          }),
+        }).done, 5000, "无 digest");
+        check("acceptWarnings:true 无 digest → 拒绝并索要 digest",
+          bareOutcome?.status === "failed" && /reportDigest/.test(bareOutcome?.detail ?? "") && bareInstalls.calls === 0);
+
+        // d) 审批 token 路径不需要裸 digest：consumeApprovalToken 自己比对
+        //    报告摘要（那次真实事故「preflight report changed」就是它拦的），
+        //    再要求一份裸 digest 属于重复关卡。
+        check("审批 token 路径不受裸 digest 关卡影响",
+          preflightRefusal(consentReport, true, "lbl", { fingerprint: consentFingerprint, consentBoundByToken: true }) === undefined);
+      }
+
+      // 13a4. surface/owner 参数化：producer 是唯一签发者，浏览器 surface
+      // 签出的 token 必须归属那个 session——参数要是接错线（漏传、写死
+      // agent），token 会落在错误的归属域里，跨域消费的隔离就形同虚设。
+      {
+        const surfProof = proofFor("surf-pkg");
+        const surfOutcome = await settleWithin(createInstallJobProducer({
+          profile: "web",
+          spec: "surf-pkg",
+          surface: "browser",
+          owner: "session-surf",
+          ...seams({
+            _runPreflight: async () => ({ report: cleanReport, profileDir, fingerprint: "fp-surf" }),
+            _runInstall: () => ({
+              cancel: () => {},
+              done: Promise.resolve({
+                status: "needsApproval",
+                detail: "approval needed",
+                needsApproval: disclosureFor(surfProof),
+                proof: surfProof,
+              }),
+              readOutput: () => "",
+            }),
+          }),
+        }).done, 5000, "surface job");
+        const surfToken = surfOutcome?.approvalToken;
+        const surfConsume = typeof surfToken === "string"
+          ? consumeApprovalToken({
+            token: surfToken,
+            profile: "web",
+            profileDir,
+            spec: "surf-pkg",
+            preflightReport: cleanReport,
+            allowBuildScripts: ["surf-pkg"],
+            surface: "browser",
+            owner: "session-surf",
+          })
+          : { valid: false, reason: "no token" };
+        check("browser surface 的 producer 签发归属该 session 的 token",
+          surfConsume.valid === true,
+          `token=${typeof surfToken} reason=${surfConsume.reason}`);
+        // token 绝不进 browser 的 detail：tracker.get/list 无条件下发 detail，
+        // 只有独立的 approvalToken 字段做 session 隔离——拼进去等于发给
+        // 所有 session。浏览器只走 outcome.approvalToken → 同 session 快照。
+        check("browser surface 的 detail 不含 token（防跨 session 泄漏）",
+          !String(surfOutcome?.detail ?? "").includes(String(surfToken)),
+          `detail=${String(surfOutcome?.detail ?? "").slice(0, 120)}`);
+
+        // agent 的 detail 必须仍然带 token：宿主按 owner 隔离 job_output，
+        // 模型重试全靠从 detail 里读到它。
+        const agentProof = proofFor("surf-agent-pkg");
+        const agentDetailOutcome = await settleWithin(createInstallJobProducer({
+          profile: "web",
+          spec: "surf-agent-pkg",
+          agentOwner: "agent-surf",
+          ...seams({
+            _runPreflight: async () => ({ report: cleanReport, profileDir, fingerprint: "fp-surf-agent" }),
+            _runInstall: () => ({
+              cancel: () => {},
+              done: Promise.resolve({
+                status: "needsApproval",
+                detail: "approval needed",
+                needsApproval: disclosureFor(agentProof),
+                proof: agentProof,
+              }),
+              readOutput: () => "",
+            }),
+          }),
+        }).done, 5000, "agent surface job");
+        check("agent surface 的 detail 仍带 token（模型重试要读它）",
+          /Approval token \(pass to approvalToken on retry\)/.test(String(agentDetailOutcome?.detail ?? "")));
+      }
+
       // 13b. 预检通过 → 进入安装。同时钉两件事：pnpm 拿到的是防抢注解析后的
       // spec（label 用的是归一 spec，两者可以不同），以及 readOutput 的顺序。
       let preflightSpec;