@1e0zj/dsh-plugin-mall 0.4.5 → 0.4.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1e0zj/dsh-plugin-mall",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "description": "dsh 插件市场：搜索 GitHub dsh-plugin 话题下的插件仓库，一键安装到本地 dsh profile（agent 工具 + 设置页插件市场 tab）",
   "type": "module",
   "main": "src/index.js",

package/src/client.js

@@ -16,9 +16,6 @@ window.__ModuleLoader__.load({
     // ── styles ──────────────────────────────────────────────────────────────
     var css = [
       ".mkt_root{display:flex;flex-direction:column;gap:12px;max-width:1040px}",
-      ".mkt_head{display:flex;flex-direction:column;gap:2px}",
-      ".mkt_title{font-size:16px;font-weight:600;color:var(--dsw-alias-label-primary)}",
-      ".mkt_sub{font-size:12px;color:var(--dsw-alias-label-tertiary)}",
       ".mkt_row{display:flex;gap:8px;align-items:center;flex-wrap:wrap}",
       ".mkt_input{flex:1;min-width:200px;background:var(--dsw-specific-input-major);border:1px solid var(--dsw-alias-border-l2);border-radius:6px;padding:6px 10px;font-size:13px;color:var(--dsw-alias-label-primary)}",
       ".mkt_input::placeholder{color:var(--dsw-alias-label-caption)}",
@@ -985,10 +982,6 @@ window.__ModuleLoader__.load({
       var verifyPending = results !== null && results.items.some(function (it) { return verified[it.fullName] === undefined; });
 
       return h("div", { className: "mkt_root" },
-        h("div", { className: "mkt_head" },
-          h("div", { className: "mkt_title" }, "插件市场"),
-          h("div", { className: "mkt_sub" }, "搜索 GitHub dsh-plugin 话题插件 · 装/卸后需重启 dsh 生效")
-        ),
         h("div", { className: "mkt_row" },
           h("input", {
             className: "mkt_input",
@@ -1007,7 +1000,6 @@ window.__ModuleLoader__.load({
             h("option", { value: "forks" }, "按 fork")
           ),
           h("button", { className: "mkt_btn mkt_btnPrimary", disabled: loading, onClick: doSearch }, loading ? "搜索中…" : "搜索"),
-          h("button", { className: "mkt_btn", onClick: refreshInstalled }, "刷新已装"),
           h("button", { className: "mkt_btn mkt_btnDanger", disabled: restarting, onClick: doRestart }, restarting ? "重启中…" : "重启 dsh"),
           h("label", { className: "mkt_check" },
             h("input", { type: "checkbox", checked: verifiedOnly, onChange: function (e) { setVerifiedOnly(e.target.checked); } }),

package/src/guard.js

@@ -17,6 +17,7 @@ import {
   readdirSync,
   realpathSync,
   rmSync,
+  statSync,
   symlinkSync,
   writeFileSync,
 } from "node:fs";
@@ -811,6 +812,217 @@ function disabledState(value) {
   return value ? "disabled" : "enabled";
 }
 
+/**
+ * Rows that would BRICK startup: an MCP client entry, fatal on failure, whose
+ * entry file does not exist in the candidate (issue #14).
+ *
+ * The shape is deliberately the provable minimum — every condition must hold
+ * exactly, and anything short of it is left alone:
+ *
+ *   - name is exactly @deepseek-ai/dsh-mcp-client, transport stdio,
+ *     failOnStartupError is the literal true, command the literal "node";
+ *   - the row's FINAL state is enabled (checked on the composed tree, so a
+ *     user patch that disables it, retargets args, or drops the fatal flag
+ *     exempts it — and a candidate that overrides an EXISTING mcp row into
+ *     this shape is caught just the same);
+ *   - args has exactly one element — the entry — which is EXACTLY
+ *     `!!js dshHomePath('<literal>')`, no concatenation, no ternary;
+ *   - the literal points INSIDE `profiles/<this profile>/node_modules/<the
+ *     candidate's own package>/…` — other profiles and other packages are out
+ *     of scope (the probe tree cannot verify them), and the remainder is
+ *     clamped segment-wise;
+ *   - the last segment carries a runnable extension and resolves to a plain
+ *     file.
+ *
+ * A miss in the isolated probe tree is a BLOCK only when nothing could have
+ * built the entry later: no install-time scripts, no binding.gyp, no .hooks/
+ * (pnpm's requiresBuild treats all three as build-capable — verified against
+ * its worker.js source, see docs/dsh-notes.md). A build-capable candidate
+ * downgrades to a WARNING here because the probe disables lifecycle scripts
+ * while a real install may run them after approval; the hard gate for that
+ * case is mcpEntryAuditForInstall at finalize time. The browsing-time scan
+ * cannot run any of this (no file tree); this is install-preflight only.
+ */
+const DSH_MCP_CLIENT_MODULE = "@deepseek-ai/dsh-mcp-client";
+// dshHomePath 只有作为 !!js 表达式才被 loader 求值成路径；!!js 在内存里是
+// { __jsExpr: source }。只认「恰好一个单字面量实参的调用」，其余形态
+// （拼接、三元、嵌套）求值前无从判断，一律不碰。实参里允许反斜杠
+// （Windows 写法，匹配后归一成 /）；引号排除——出现引号即不是这种形状。
+const DSH_HOME_PATH_EXACT = /^dshHomePath\(\s*(['"])([^'"]*)\1\s*\)$/;
+// 安装期 lifecycle 脚本。pnpm 的 requiresBuild（worker.js: pkgRequiresBuild，
+// 11.21.0 逐字核对）实际只认 preinstall/install/postinstall；下面的
+// prepare/prepublish 是本守卫额外的保守信号——它们不在 pnpm 的清单里，
+// 但也绝非不可能在安装期产出文件，宁可多 warn 一次终检，不冒误杀风险。
+const INSTALL_TIME_SCRIPT_RE = /^(?:pre|post)?install$|^prepare$|^prepublish$/;
+const RUNNABLE_ENTRY_RE = /\.(?:js|mjs|cjs)$/i;
+
+/**
+ * Whether the entry might only exist after a build pnpm would gate behind
+ * approval. Aligned with pnpm's own requiresBuild (worker.js:
+ * pkgRequiresBuild + filesIncludeInstallScripts, verified verbatim against
+ * 11.21.0): scripts preinstall/install/postinstall, a root binding.gyp, or
+ * anything under .hooks/. guard additionally treats prepare/prepublish as
+ * build-capable — a conservative addition of ours beyond pnpm's actual set,
+ * widening the warn lane, never narrowing the block lane.
+ */
+function candidateMayBuildEntry(candidateManifest, candidateDir) {
+  if (Object.keys(candidateManifest?.scripts ?? {}).some((name) => INSTALL_TIME_SCRIPT_RE.test(name))) return true;
+  if (typeof candidateDir !== "string") return false;
+  if (isPlainFile(join(candidateDir, "binding.gyp"))) return true;
+  try {
+    return readdirSync(join(candidateDir, ".hooks")).length > 0;
+  } catch {
+    return false;
+  }
+}
+
+/** A plain file at the path (not a directory, not missing). */
+function isPlainFile(path) {
+  try {
+    return statSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Match a row against the fatal shape; returns `{ pkgName, fileSegments }` or
+ * undefined. Pure — no filesystem access — so preflight and the post-install
+ * audit share one definition of what counts.
+ *
+ * Path handling notes (issue #14 review): the dshHomePath literal may use
+ * backslashes on Windows, so it is normalized to `/` before matching and the
+ * profile-name segment compares case-insensitively there; and existsSync is
+ * NOT entry resolution (`node src/guard` resolves to src/guard.js) — so only
+ * paths whose last segment carries a runnable extension (.js/.mjs/.cjs) are
+ * judged at all, and a target that exists but is not a plain file counts as
+ * missing.
+ */
+function fatalMcpEntry(row, profileName) {
+  if (row.name !== DSH_MCP_CLIENT_MODULE || row.state !== "enabled") return undefined;
+  const config = row.options?.config;
+  if (config === null || typeof config !== "object" || Array.isArray(config)) return undefined;
+  if (config.transport !== "stdio" || config.failOnStartupError !== true || config.command !== "node") return undefined;
+  const args = Array.isArray(config.args) ? config.args : [];
+  // 唯一参数才是入口。多个参数里混着 Node CLI 开关和业务路径（如
+  // --output dshHomePath('runtime/result.json')），逐一当入口查会把运行期
+  // 产物误判成缺失；不解析 Node CLI，多参行一律不判。
+  if (args.length !== 1 || !isJsExpr(args[0])) return undefined;
+  const call = DSH_HOME_PATH_EXACT.exec(String(args[0].__jsExpr ?? ""));
+  if (call === null) return undefined;
+  // JS 字符串字面量里的 Windows 分隔符写作 \\（求值后是单个 \）；单独的 \
+  // 是转义序列（\w 之类），求值结果无法静态确定——含未成对反斜杠的形态
+  // 一律不判。成对的 \\ 直接折成 /。
+  const rawLiteral = call[2];
+  let soloBackslash = false;
+  const normalized = [];
+  for (let i = 0; i < rawLiteral.length; i++) {
+    const ch = rawLiteral[i];
+    if (ch === "\\") {
+      if (rawLiteral[i + 1] === "\\") {
+        normalized.push("/");
+        i++;
+      } else {
+        soloBackslash = true;
+        break;
+      }
+    } else {
+      normalized.push(ch);
+    }
+  }
+  if (soloBackslash) return undefined;
+  const segments = normalized.join("").split("/");
+  const fold = process.platform === "win32" ? (value) => value.toLowerCase() : (value) => value;
+  if (segments.length < 5) return undefined;
+  if (fold(segments[0]) !== "profiles" || fold(segments[1]) !== fold(profileName) || fold(segments[2]) !== "node_modules") return undefined;
+  const rest = segments.slice(3);
+  const pkgName = rest[0]?.startsWith("@") === true && rest.length > 1 ? `${rest[0]}/${rest[1]}` : rest[0];
+  if (typeof pkgName !== "string" || pkgName.length === 0 || !NPM_PACKAGE_NAME_RE.test(pkgName)) return undefined;
+  const fileSegments = rest.slice(pkgName.split("/").length);
+  if (fileSegments.length === 0 || fileSegments.some((part) => part.length === 0 || part === "." || part === "..")) return undefined;
+  if (!RUNNABLE_ENTRY_RE.test(fileSegments[fileSegments.length - 1])) return undefined;
+  return { pkgName, fileSegments };
+}
+
+/**
+ * Package-name equality with the platform's own semantics: Windows resolves
+ * node_modules case-insensitively, so a row written as node_modules/MCP-BRICK
+ * targets the same package as manifest name mcp-brick — comparing strictly
+ * there would let a missing entry slip past both preflight and the audit.
+ */
+function samePackageName(left, right) {
+  return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
+}
+
+function mcpStartupFileIssues(mountedRows, candidateManifest, candidateName, candidateDir, profileDir) {
+  if (candidateName.length === 0 || typeof candidateDir !== "string") return [];
+  const profileName = basename(profileDir);
+  const hasInstallScripts = candidateMayBuildEntry(candidateManifest, candidateDir);
+  const issues = [];
+  for (const row of mountedRows) {
+    const fatal = fatalMcpEntry(row, profileName);
+    if (fatal === undefined || !samePackageName(fatal.pkgName, candidateName)) continue; // 只判候选自己的包：探针树里只有它
+    if (isPlainFile(join(candidateDir, ...fatal.fileSegments))) continue;
+    const fileRel = fatal.fileSegments.join("/");
+    if (hasInstallScripts) {
+      // 探装禁了 lifecycle 脚本，正式安装可能在用户审批后执行它们并生成
+      // 入口——静态「必缺」在这里不成立；硬保证移到装后终检。
+      issues.push(issue(
+        "warn",
+        "mcp-entry-unverifiable",
+        "入口缺失，但候选可能在构建后才生成它",
+        `行 ${row.id}（${DSH_MCP_CLIENT_MODULE}）设置了 failOnStartupError: true 并以 node 启动 ${fileRel}，探装（脚本禁用）里该文件不存在。候选带安装期脚本或构建清单（binding.gyp / .hooks），入口可能要等构建执行后才生成：预检不据此拦截，安装完成前会对照真树终检，仍缺失则回滚。`,
+        { row: row.id, file: fileRel },
+      ));
+    } else {
+      issues.push(issue(
+        "block",
+        "mcp-entry-missing",
+        "安装会使 dsh 无法启动",
+        `行 ${row.id}（${DSH_MCP_CLIENT_MODULE}，stdio）设置了 failOnStartupError: true，并以 node 启动候选包内的 ${fileRel}，但候选包里没有这个文件（未构建的源码安装的典型形态，且没有安装期脚本可能生成它）。安装后 dsh 会在装配阶段因该行失败而直接退出。`,
+        { row: row.id, file: fileRel },
+      ));
+    }
+  }
+  return issues;
+}
+
+/**
+ * Post-install audit (issue #14): the REAL profile tree, at the moment a
+ * successful install is about to commit. Scripts that were going to run have
+ * run (or were never declared); if the fatal entry is still not a plain file,
+ * committing would leave a profile that cannot start. The caller treats any
+ * returned issue as install failure so the outer handler rolls back.
+ *
+ * Only rows whose entry points into THE CANDIDATE's own package are judged —
+ * other packages' rows are not this install's doing, and the audit is not the
+ * place to condemn pre-existing profile state.
+ */
+export function mcpEntryAuditForInstall({ profileDir, candidateName }) {
+  if (typeof candidateName !== "string" || candidateName.length === 0 || typeof profileDir !== "string") return [];
+  let current;
+  try {
+    current = installedProfile(profileDir, []);
+  } catch {
+    return []; // unreadable profile is somebody else's error to report
+  }
+  const profileName = basename(profileDir);
+  const issues = [];
+  for (const row of current.composedRows) {
+    const fatal = fatalMcpEntry(row, profileName);
+    if (fatal === undefined || !samePackageName(fatal.pkgName, candidateName)) continue;
+    // Windows 文件系统本身不区分大小写，行里写 MCP-BRICK 也能落到同一目录。
+    if (isPlainFile(join(profileDir, "node_modules", ...fatal.pkgName.split("/"), ...fatal.fileSegments))) continue;
+    issues.push(issue(
+      "block",
+      "mcp-entry-missing",
+      "安装完成但入口仍缺失",
+      `行 ${row.id}（${DSH_MCP_CLIENT_MODULE}）以 failOnStartupError: true 启动 ${fatal.fileSegments.join("/")}，安装完成后该文件仍不存在——提交这个 profile 会让 dsh 在装配阶段退出。`,
+      { row: row.id, file: fatal.fileSegments.join("/") },
+    ));
+  }
+  return issues;
+}
 /** How a pair of projected rows would mount together. */
 function bothMount(left, right) {
   const states = [left.state, right.state];
@@ -1310,6 +1522,11 @@ export function inspectCandidate({ profileDir, candidateManifestPath, spec }) {
   issues.push(...namelessRowIssues(simulated.mounted.filter((row) => row.owner === candidateName), candidateName || spec));
   issues.push(...newConflictIssues(candidateName, current.composedRows, simulated.mounted));
   issues.push(...patchTargetIssues(candidateName, candidate.manifest, patch, current, simulated));
+  // 落盘后的文件树检查只能在这里做：探针树里候选包已实体化，MCP 入口存不
+  // 存在是可判定的（带安装期脚本的候选降为 warn，硬保证在装后终检——见
+  // mcpStartupFileIssues 的注释）。浏览期扫描（inspectRemoteCandidate）
+  // 没有文件树，不参与。
+  issues.push(...mcpStartupFileIssues(simulated.mounted, candidate.manifest, candidateName, candidate.dir, profileDir));
 
   // UI replacements historically predate exclusiveGroups.  Keep the
   // heuristic advisory-only to avoid blocking legitimate sidebar extensions.
@@ -3368,6 +3585,279 @@ async function selfTest() {
       if (validateInstalledProfile(p).ok !== true) throw new Error("healthy profile should validate clean");
     }
 
+    // ── MCP failOnStartupError 指向缺失文件（issue #14）────────────────────
+    //
+    // 事故形态（2026-08-22，managed-agents）：候选从 github: 源装下来没有
+    // dist/，insert 的 MCP 行 failOnStartupError: true 指向不存在的入口，
+    // 装上即砖、dsh 装配阶段退出。判定只认可证形状，扫的是**最终组合行**：
+    // 用户 patch 停用或改参可豁免，候选改坏既有 MCP 行同样抓得到。
+    {
+      const p = join(root, "profiles", "mcpcheck");
+      mkdirSync(p, { recursive: true });
+      const resetProfile = (userPatch) => {
+        writeFileSync(join(p, "package.json"), JSON.stringify({ dependencies: {} }));
+        writeFileSync(join(p, "cordis.patch.yml"), userPatch ?? "[]\n");
+      };
+      const mcpInsert = (file, extra = {}) => `
+- insert:
+    - id: mcp-x
+      name: '@deepseek-ai/dsh-mcp-client'
+      config:
+        serverName: x
+        transport: stdio
+        command: node
+        args:
+          - !!js dshHomePath('profiles/mcpcheck/node_modules/mcp-brick/${file}')
+        failOnStartupError: true
+`.replace("failOnStartupError: true", `failOnStartupError: ${extra.fatal ?? true}`)
+        + (extra.append ?? "");
+      const candidate = (label, pkgName, patchText) => {
+        const dir = join(root, `cand-${label}`);
+        mkdirSync(dir, { recursive: true });
+        writeFileSync(join(dir, "package.json"), JSON.stringify({ name: pkgName, version: "1.0.0", dsh: { bundle: { patch: "./cordis.patch.yml" } } }));
+        writeFileSync(join(dir, "cordis.patch.yml"), patchText);
+        return dir;
+      };
+      const inspect = (dir, name, userPatch) => {
+        resetProfile(userPatch);
+        return inspectCandidate({ profileDir: p, candidateManifestPath: join(dir, "package.json"), spec: name });
+      };
+
+      // 1) 入口缺失 → block（事故原样：无 dist 的源码树）。
+      const missing = inspect(candidate("missing", "mcp-brick", mcpInsert("dist/mcp/index.js")), "mcp-brick");
+      if (missing.verdict !== "blocked" || !missing.issues.some((e) => e.code === "mcp-entry-missing")) {
+        throw new Error(`MCP 入口缺失必须 block，实得 ${missing.verdict}: ${JSON.stringify(missing.issues.map((e) => e.code))}`);
+      }
+      console.log("PASS MCP 入口：缺失 + failOnStartupError → block");
+
+      // 2) 入口存在 → 放行。
+      const presentDir = candidate("present", "mcp-brick", mcpInsert("dist/mcp/index.js"));
+      mkdirSync(join(presentDir, "dist", "mcp"), { recursive: true });
+      writeFileSync(join(presentDir, "dist", "mcp", "index.js"), "");
+      const present = inspect(presentDir, "mcp-brick");
+      if (present.issues.some((e) => e.code === "mcp-entry-missing")) throw new Error("入口存在时不得报 mcp-entry-missing");
+      console.log("PASS MCP 入口：文件存在 → 放行");
+
+      // 3) failOnStartupError: false → 不判（失败不致命，装上也不会砖）。
+      const lenient = inspect(candidate("lenient", "mcp-brick", mcpInsert("dist/none.js", { fatal: false })), "mcp-brick");
+      if (lenient.issues.some((e) => e.code === "mcp-entry-missing")) throw new Error("failOnStartupError:false 不得判入口");
+      console.log("PASS MCP 入口：failOnStartupError:false → 放行");
+
+      // 4) 用户 patch 停用该行 → 最终行不运行，不判。
+      const disabledRow = inspect(candidate("disabled", "mcp-brick", mcpInsert("dist/none.js")), "mcp-brick", "- id: mcp-x\n  disabled: true\n");
+      if (disabledRow.issues.some((e) => e.code === "mcp-entry-missing")) throw new Error("用户停用的行不得判入口");
+      console.log("PASS MCP 入口：用户 patch 停用 → 放行");
+
+      // 5) 用户 patch 修正 args 指向存在的文件 → 放行。
+      const fixDir = candidate("fixed", "mcp-brick", mcpInsert("dist/none.js"));
+      mkdirSync(join(fixDir, "dist"), { recursive: true });
+      writeFileSync(join(fixDir, "dist", "fixed.js"), "");
+      const fixed = inspect(fixDir, "mcp-brick", `
+- id: mcp-x
+  config:
+    serverName: x
+    transport: stdio
+    command: node
+    args:
+      - !!js dshHomePath('profiles/mcpcheck/node_modules/mcp-brick/dist/fixed.js')
+    failOnStartupError: true
+`);
+      if (fixed.issues.some((e) => e.code === "mcp-entry-missing")) throw new Error("用户已把 args 修到存在的文件，不得再判");
+      console.log("PASS MCP 入口：用户 patch 修正 args → 放行");
+
+      // 6) 非精确 !!js 表达式（拼接）→ 求值前无从判断，不判。
+      const inexact = inspect(candidate("inexact", "mcp-brick", `
+- insert:
+    - id: mcp-x
+      name: '@deepseek-ai/dsh-mcp-client'
+      config:
+        transport: stdio
+        command: node
+        args:
+          - !!js dshHomePath('profiles/mcpcheck/node_modules/' + 'mcp-brick/dist/none.js')
+        failOnStartupError: true
+`), "mcp-brick");
+      if (inexact.issues.some((e) => e.code === "mcp-entry-missing")) throw new Error("拼接表达式不得判入口");
+      console.log("PASS MCP 入口：非精确 !!js 表达式 → 不误判");
+
+      // 7) 候选改坏既有 MCP 行（override）→ 同样检出。行是 existing-host
+      //    插的、原本不致命；候选把 config 整个换成指向自己包内缺失文件
+      //    且 failOnStartupError: true —— 只看 insert 会漏掉这一种。
+      resetProfile();
+      // 真实形态：已装插件同时在 dependencies 和 dsh.profile.bundles 里
+      // （bundleLayers 只从 bundles 列表构建，光有依赖不成层）。
+      writeFileSync(join(p, "package.json"), JSON.stringify({ dependencies: { "existing-host": "1.0.0" }, dsh: { profile: { bundles: ["existing-host"] } } }));
+      mkdirSync(join(p, "node_modules", "existing-host"), { recursive: true });
+      writeFileSync(join(p, "node_modules", "existing-host", "package.json"), JSON.stringify({ name: "existing-host", version: "1.0.0", dsh: { bundle: { patch: "./cordis.patch.yml" } } }));
+      writeFileSync(join(p, "node_modules", "existing-host", "cordis.patch.yml"), `
+- insert:
+    - id: mcp-existing
+      name: '@deepseek-ai/dsh-mcp-client'
+      config:
+        transport: stdio
+        command: node
+        args:
+          - !!js dshHomePath('profiles/mcpcheck/node_modules/existing-host/dist/mcp.js')
+        failOnStartupError: false
+`);
+      const breaker = inspectCandidate({ profileDir: p, candidateManifestPath: join(candidate("breaker", "mcp-brick", `
+- id: mcp-existing
+  config:
+    transport: stdio
+    command: node
+    args:
+      - !!js dshHomePath('profiles/mcpcheck/node_modules/mcp-brick/dist/none.js')
+    failOnStartupError: true
+`), "package.json"), spec: "mcp-brick" });
+      if (!breaker.issues.some((e) => e.code === "mcp-entry-missing")) {
+        throw new Error(`候选 override 既有 MCP 行改坏必须检出，实得 ${JSON.stringify(breaker.issues.map((e) => e.code))}`);
+      }
+      console.log("PASS MCP 入口：候选 override 既有行改坏 → 检出");
+
+      // 8) scoped 候选包：路径前缀含 scope 段，同样判得到。
+      const scopedDir = candidate("scoped", "@scope/mcp-pkg", `
+- insert:
+    - id: mcp-x
+      name: '@deepseek-ai/dsh-mcp-client'
+      config:
+        transport: stdio
+        command: node
+        args:
+          - !!js dshHomePath('profiles/mcpcheck/node_modules/@scope/mcp-pkg/dist/none.js')
+        failOnStartupError: true
+`);
+      resetProfile();
+      const scopedRep = inspectCandidate({ profileDir: p, candidateManifestPath: join(scopedDir, "package.json"), spec: "@scope/mcp-pkg" });
+      if (!scopedRep.issues.some((e) => e.code === "mcp-entry-missing")) throw new Error("scoped 候选的缺失入口必须检出");
+      console.log("PASS MCP 入口：scoped 包路径 → 检出");
+
+      // 9) 多参数：唯一参数才是入口，业务路径不参与判定（review P1）。业务
+      //    路径故意用 .js 后缀——过得了扩展名闸门，钉的就是「唯一参数」这
+      //    条规则本身，不是被扩展名顺带挡住的。
+      const multiArg = inspect(candidate("multiarg", "mcp-brick", `
+- insert:
+    - id: mcp-x
+      name: '@deepseek-ai/dsh-mcp-client'
+      config:
+        transport: stdio
+        command: node
+        args:
+          - server.js
+          - '--output'
+          - !!js dshHomePath('profiles/mcpcheck/node_modules/mcp-brick/runtime/out.js')
+        failOnStartupError: true
+`), "mcp-brick");
+      if (multiArg.issues.some((e) => e.code === "mcp-entry-missing" || e.code === "mcp-entry-unverifiable")) {
+        throw new Error("多参数行的业务路径不得当入口判");
+      }
+      console.log("PASS MCP 入口：多参数（业务路径）→ 不判");
+
+      // 10) 无扩展名入口：node 会做扩展名/目录解析，existsSync 不等价——不判。
+      const extless = inspect(candidate("extless", "mcp-brick", mcpInsert("dist/mcp/entry")), "mcp-brick");
+      if (extless.issues.some((e) => e.code === "mcp-entry-missing")) throw new Error("无扩展名路径不得判入口");
+      console.log("PASS MCP 入口：无扩展名 → 不判");
+
+      // 11) 路径存在但是目录（名字带 .js）：不是普通文件，按缺失论。
+      const dirDir = candidate("dir-entry", "mcp-brick", mcpInsert("dist/index.js"));
+      mkdirSync(join(dirDir, "dist", "index.js"), { recursive: true }); // 目录！
+      const dirEntry = inspect(dirDir, "mcp-brick");
+      if (!dirEntry.issues.some((e) => e.code === "mcp-entry-missing")) throw new Error("目录顶替入口文件必须 block");
+      console.log("PASS MCP 入口：路径是目录（非普通文件）→ block");
+
+      // 12) 候选带 postinstall + 入口缺失 → 降为 warn（装后终检把关），不 block。
+      const scriptedDir = candidate("scripted", "mcp-brick", mcpInsert("dist/mcp/index.js"));
+      writeFileSync(join(scriptedDir, "package.json"), JSON.stringify({ name: "mcp-brick", version: "1.0.0", scripts: { postinstall: "node build.js" }, dsh: { bundle: { patch: "./cordis.patch.yml" } } }));
+      const scripted = inspect(scriptedDir, "mcp-brick");
+      const unverifiable = scripted.issues.find((e) => e.code === "mcp-entry-unverifiable");
+      if (scripted.verdict !== "warning" || unverifiable === undefined || scripted.issues.some((e) => e.code === "mcp-entry-missing")) {
+        throw new Error(`带安装期脚本的候选应降为 warn（终检把关），实得 ${scripted.verdict}: ${JSON.stringify(scripted.issues.map((e) => e.code))}`);
+      }
+      console.log("PASS MCP 入口：候选带 postinstall → warn 不 block（终检把关）");
+
+      // 13) 反斜杠路径：JS 字面量里的真实写法是 \\（求值后单个 \）——归一
+      //     后同样检出。单个不成对的 \ 是转义序列（\w 之类），求值结果无
+      //     从静态确定，不判。
+      const backslash = inspect(candidate("backslash", "mcp-brick", `
+- insert:
+    - id: mcp-x
+      name: '@deepseek-ai/dsh-mcp-client'
+      config:
+        transport: stdio
+        command: node
+        args:
+          - !!js dshHomePath('profiles\\\\mcpcheck\\\\node_modules\\\\mcp-brick\\\\dist\\\\none.js')
+        failOnStartupError: true
+`), "mcp-brick");
+      if (!backslash.issues.some((e) => e.code === "mcp-entry-missing")) {
+        throw new Error(`反斜杠路径（\\\\ 形式）应归一检出，实得 ${JSON.stringify(backslash.issues.map((e) => e.code))}`);
+      }
+      console.log("PASS MCP 入口：反斜杠路径（\\\\ 形式）归一 → 检出");
+      const soloBackslash = inspect(candidate("solo-backslash", "mcp-brick", `
+- insert:
+    - id: mcp-x
+      name: '@deepseek-ai/dsh-mcp-client'
+      config:
+        transport: stdio
+        command: node
+        args:
+          - !!js dshHomePath('profiles\\mcpcheck\\node_modules\\mcp-brick\\dist\\none.js')
+        failOnStartupError: true
+`), "mcp-brick");
+      if (soloBackslash.issues.some((e) => e.code === "mcp-entry-missing" || e.code === "mcp-entry-unverifiable")) {
+        throw new Error("不成对的单个反斜杠（转义序列）不得判");
+      }
+      console.log("PASS MCP 入口：单个反斜杠（转义序列）→ 不判");
+
+      // 13b) binding.gyp（无任何 scripts）：pnpm 的 requiresBuild 同样视为
+      //      需构建——入口可能由 node-gyp 链路产出，静态只 warn。
+      const gypDir = candidate("gyp", "mcp-brick", mcpInsert("dist/mcp/index.js"));
+      writeFileSync(join(gypDir, "binding.gyp"), "{}\n");
+      const gyp = inspect(gypDir, "mcp-brick");
+      if (!gyp.issues.some((e) => e.code === "mcp-entry-unverifiable") || gyp.issues.some((e) => e.code === "mcp-entry-missing")) {
+        throw new Error(`binding.gyp 候选应降为 warn，实得 ${gyp.verdict}: ${JSON.stringify(gyp.issues.map((e) => e.code))}`);
+      }
+      console.log("PASS MCP 入口：binding.gyp（无 scripts）→ warn 不 block");
+
+      // 13c) 包名大小写变体：manifest 是 mcp-brick，行里写 MCP-BRICK。
+      //      win32 上 node_modules 解析不区分大小写——同一个包，照判；
+      //      posix 上那是另一个名字，不判。两平台各自的判定才是正确语义。
+      const cased = inspect(candidate("cased", "mcp-brick", `
+- insert:
+    - id: mcp-x
+      name: '@deepseek-ai/dsh-mcp-client'
+      config:
+        transport: stdio
+        command: node
+        args:
+          - !!js dshHomePath('profiles/mcpcheck/node_modules/MCP-BRICK/dist/none.js')
+        failOnStartupError: true
+`), "mcp-brick");
+      const casedBlocked = cased.issues.some((e) => e.code === "mcp-entry-missing");
+      if (process.platform === "win32" ? !casedBlocked : casedBlocked) {
+        throw new Error(`包名大小写变体在 ${process.platform} 上判定错误: ${JSON.stringify(cased.issues.map((e) => e.code))}`);
+      }
+      console.log(`PASS MCP 入口：包名大小写变体按平台语义判定（${process.platform} → ${casedBlocked ? "检出" : "不判"}）`);
+
+      // 14) 装后终检：真树里入口仍缺 → issue；存在 → 空；别人的包 → 不判。
+      {
+        resetProfile();
+        writeFileSync(join(p, "package.json"), JSON.stringify({ dependencies: { "mcp-brick": "1.0.0" }, dsh: { profile: { bundles: ["mcp-brick"] } } }));
+        const installedCand = join(p, "node_modules", "mcp-brick");
+        mkdirSync(installedCand, { recursive: true });
+        writeFileSync(join(installedCand, "package.json"), JSON.stringify({ name: "mcp-brick", version: "1.0.0", dsh: { bundle: { patch: "./cordis.patch.yml" } } }));
+        writeFileSync(join(installedCand, "cordis.patch.yml"), mcpInsert("dist/mcp/index.js"));
+        const auditMissing = mcpEntryAuditForInstall({ profileDir: p, candidateName: "mcp-brick" });
+        if (auditMissing.length !== 1 || auditMissing[0].code !== "mcp-entry-missing") throw new Error("终检：入口缺失必须报");
+        mkdirSync(join(installedCand, "dist", "mcp"), { recursive: true });
+        writeFileSync(join(installedCand, "dist", "mcp", "index.js"), "");
+        if (mcpEntryAuditForInstall({ profileDir: p, candidateName: "mcp-brick" }).length !== 0) throw new Error("终检：入口存在不得报");
+        if (mcpEntryAuditForInstall({ profileDir: p, candidateName: "someone-else" }).length !== 0) throw new Error("终检：别人的包不归这次安装判");
+        console.log("PASS MCP 入口：装后终检（缺→报、有→过、他人包→不判）");
+      }
+
+      resetProfile();
+    }
+
     // validateInstalledProfile detects a loader-id collision between two
     // already-installed bundles (the failure mode a bad install introduces).
     {
@@ -4789,4 +5279,4 @@ if (process.argv[1]?.endsWith("guard.js") && process.argv.includes("--self-test"
     console.error(`FAIL ${error.stack ?? error.message}`);
     process.exitCode = 1;
   });
-}
+}

package/src/installer.js

@@ -16,7 +16,7 @@ import { createHash } from "node:crypto";
 import { dump, load } from "js-yaml";
 import { DEFAULT_PROFILE_BUNDLES, PROFILE_TEMPLATES, initProfile, resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
 import { describeBuildScripts, npmNameOf } from "./github.js";
-import { clearPendingApprovalPause, commitPendingSnapshot, createProfileSnapshot, describeRollbackRebuild, markPendingApprovalPause, markPendingSnapshot, pausedCandidateBeforeState, pendingApprovalPaused, pnpmGuardEnv, pnpmSpawnPlan, readValidatedPendingSnapshot, rollbackPendingSnapshot, validateInstalledProfile, validateRemoveCompletion } from "./guard.js";
+import { clearPendingApprovalPause, commitPendingSnapshot, createProfileSnapshot, describeRollbackRebuild, markPendingApprovalPause, markPendingSnapshot, mcpEntryAuditForInstall, pausedCandidateBeforeState, pendingApprovalPaused, pnpmGuardEnv, pnpmSpawnPlan, readValidatedPendingSnapshot, rollbackPendingSnapshot, validateInstalledProfile, validateRemoveCompletion } from "./guard.js";
 
 // ── spec normalization ──────────────────────────────────────────────────────
 
@@ -1811,6 +1811,18 @@ function runInstallInner({ profile, spec, allowBuildScripts, approvedProof, pref
   /** Post-success accounting: reconcile bundles, register client rows, summarize. */
   const finalizeSuccess = () => {
     const bundles = reconcileBundles(profileDir, beforeDeps);
+    // 装后终检（issue #14）：预检的探装禁了 lifecycle 脚本，正式安装可能
+    // 在用户审批后执行了它们——入口是否真的产生，只有此刻这棵真树说了算
+    // （预检对带安装期脚本的候选只给了 warn）。此刻构建要么跑完要么本来
+    // 就没有，终检不过就按失败结算，外层回滚到装前快照。
+    const auditIssues = mcpEntryAuditForInstall({ profileDir, candidateName: preflight?.candidate?.name ?? npmNameOf(spec) });
+    if (auditIssues.length > 0) {
+      push(`\n[dsh-plugin-mall] ${auditIssues[0].title}: ${auditIssues[0].detail}\n`);
+      // 只描述失败，不预言恢复：回滚此刻还没发生（在外层收尾里），成没成
+      // 由它自己的三态结论去说。在这里写「已回滚」，回滚失败时 detail 会
+      // 同时出现「已回滚」和「无法回滚」两句打架的话。
+      return { status: "failed", detail: `pnpm installed ${spec}, but ${auditIssues[0].title}: 行 ${auditIssues[0].row ?? auditIssues[0].extra?.row} 的入口 ${auditIssues[0].file ?? auditIssues[0].extra?.file} 仍缺失，安装按失败结算。` };
+    }
     const manifest = readManifest(profileDir);
     const currentDeps = new Set(Object.keys(manifest.dependencies ?? {}));
     const clientRows = [];
@@ -3665,6 +3677,94 @@ async function runTransactionFixtures() {
     }
   }
 
+  // 4c. 装后终检（issue #14）：预检的探装禁了 lifecycle 脚本，带安装期脚本
+  // 的候选入口要等构建后才可能出现——预检对它们只 warn，这里是硬闸。
+  // pnpm 成功、入口在真树里仍缺 → failed + 回滚（绝不提交一块砖）；
+  // 构建产出了入口 → completed。beforeExit 模拟 pnpm add 的落盘效果
+  // （node_modules 实体化 + manifest 依赖写入）。
+  {
+    const fatalPatch = `
+- insert:
+    - id: mcp-x
+      name: '@deepseek-ai/dsh-mcp-client'
+      config:
+        transport: stdio
+        command: node
+        args:
+          - !!js dshHomePath('profiles/p/node_modules/mcp-brick-pkg/dist/mcp/index.js')
+        failOnStartupError: true
+`;
+    const materializeCandidate = (profileDir, withEntry) => {
+      const dir = join(profileDir, "node_modules", "mcp-brick-pkg");
+      mkdirSync(dir, { recursive: true });
+      if (withEntry) {
+        mkdirSync(join(dir, "dist", "mcp"), { recursive: true });
+        writeFileSync(join(dir, "dist", "mcp", "index.js"), "");
+      }
+      writeFileSync(join(dir, "package.json"), JSON.stringify({ name: "mcp-brick-pkg", version: "1.0.0", scripts: { postinstall: "node build.js" }, dsh: { bundle: { patch: "./cordis.patch.yml" } } }));
+      writeFileSync(join(dir, "cordis.patch.yml"), fatalPatch);
+      const manifest = JSON.parse(readFileSync(join(profileDir, "package.json"), "utf8"));
+      manifest.dependencies = { ...(manifest.dependencies ?? {}), "mcp-brick-pkg": "1.0.0" };
+      writeFileSync(join(profileDir, "package.json"), JSON.stringify(manifest, undefined, 2) + "\n");
+    };
+    const runAuditInstall = (profileDir, withEntry) => {
+      const spawn = scriptedSpawn([{ code: 0, out: "Done in 1s\n", beforeExit: () => materializeCandidate(profileDir, withEntry) }]);
+      return runInstall({ profile: "p", spec: "mcp-brick-pkg", preflight: preflightStub("mcp-brick-pkg"), _profileDir: profileDir, _spawn: spawn.spawnFn, _describe: async () => [] }).done;
+    };
+
+    {
+      const { profileDir, cleanup } = makeTempProfile("audit-missing");
+      try {
+        const outcome = await runAuditInstall(profileDir, false);
+        const depGone = JSON.parse(readFileSync(join(profileDir, "package.json"), "utf8")).dependencies?.["mcp-brick-pkg"] === undefined;
+        check(
+          "装后终检：入口仍缺 → failed 且回滚（不提交砖）",
+          outcome.status === "failed" && /入口/.test(outcome.detail ?? "") && depGone && !existsSync(pendingMarkerPath(profileDir)),
+          `status=${outcome.status} detail=${(outcome.detail ?? "").slice(0, 120)}`,
+        );
+      } finally {
+        cleanup();
+      }
+    }
+    {
+      const { profileDir, cleanup } = makeTempProfile("audit-present");
+      try {
+        const outcome = await runAuditInstall(profileDir, true);
+        check("装后终检：构建产出了入口 → completed", outcome.status === "completed", `status=${outcome.status} detail=${(outcome.detail ?? "").slice(0, 120)}`);
+      } finally {
+        cleanup();
+      }
+    }
+
+    // 终检失败 + 回滚做不成（marker 被外部抽掉）：detail 绝不能同时出现
+    // 「已回滚」和「无法回滚」——终检文案只说失败，恢复结论由外层三态拼。
+    {
+      const { profileDir, cleanup } = makeTempProfile("audit-rollback-fails");
+      try {
+        const spawn = scriptedSpawn([{
+          code: 0,
+          out: "Done in 1s\n",
+          beforeExit: () => {
+            materializeCandidate(profileDir, false);
+            rmSync(pendingMarkerPath(profileDir), { force: true }); // 抽掉还原目标
+          },
+        }]);
+        const outcome = await runInstall({ profile: "p", spec: "mcp-brick-pkg", preflight: preflightStub("mcp-brick-pkg"), _profileDir: profileDir, _spawn: spawn.spawnFn, _describe: async () => [] }).done;
+        const detail = outcome.detail ?? "";
+        check(
+          "终检失败 + 回滚失败 → 不预言恢复，failed 且指名 marker",
+          outcome.status === "failed"
+            && /仍缺失/.test(detail)
+            && /could NOT be restored|marker/.test(detail)
+            && !/has been rolled back/.test(detail),
+          `status=${outcome.status} detail=${detail.slice(0, 160)}`,
+        );
+      } finally {
+        cleanup();
+      }
+    }
+  }
+
   // 4b-2. 取消了，但回滚做不成。marker 被外部删掉（外部清理、磁盘故障、
   // 或本轮压根没登记上），rollbackPendingSnapshot 返回 undefined 而不抛。
   //