@1e0zj/dsh-plugin-mall 0.4.5 → 0.4.7

package/src/guard.js

@@ -17,6 +17,7 @@ import {
   readdirSync,
   realpathSync,
   rmSync,
+  statSync,
   symlinkSync,
   writeFileSync,
 } from "node:fs";
@@ -811,6 +812,217 @@ function disabledState(value) {
   return value ? "disabled" : "enabled";
 }
 
+/**
+ * Rows that would BRICK startup: an MCP client entry, fatal on failure, whose
+ * entry file does not exist in the candidate (issue #14).
+ *
+ * The shape is deliberately the provable minimum — every condition must hold
+ * exactly, and anything short of it is left alone:
+ *
+ *   - name is exactly @deepseek-ai/dsh-mcp-client, transport stdio,
+ *     failOnStartupError is the literal true, command the literal "node";
+ *   - the row's FINAL state is enabled (checked on the composed tree, so a
+ *     user patch that disables it, retargets args, or drops the fatal flag
+ *     exempts it — and a candidate that overrides an EXISTING mcp row into
+ *     this shape is caught just the same);
+ *   - args has exactly one element — the entry — which is EXACTLY
+ *     `!!js dshHomePath('<literal>')`, no concatenation, no ternary;
+ *   - the literal points INSIDE `profiles/<this profile>/node_modules/<the
+ *     candidate's own package>/…` — other profiles and other packages are out
+ *     of scope (the probe tree cannot verify them), and the remainder is
+ *     clamped segment-wise;
+ *   - the last segment carries a runnable extension and resolves to a plain
+ *     file.
+ *
+ * A miss in the isolated probe tree is a BLOCK only when nothing could have
+ * built the entry later: no install-time scripts, no binding.gyp, no .hooks/
+ * (pnpm's requiresBuild treats all three as build-capable — verified against
+ * its worker.js source, see docs/dsh-notes.md). A build-capable candidate
+ * downgrades to a WARNING here because the probe disables lifecycle scripts
+ * while a real install may run them after approval; the hard gate for that
+ * case is mcpEntryAuditForInstall at finalize time. The browsing-time scan
+ * cannot run any of this (no file tree); this is install-preflight only.
+ */
+const DSH_MCP_CLIENT_MODULE = "@deepseek-ai/dsh-mcp-client";
+// dshHomePath 只有作为 !!js 表达式才被 loader 求值成路径；!!js 在内存里是
+// { __jsExpr: source }。只认「恰好一个单字面量实参的调用」，其余形态
+// （拼接、三元、嵌套）求值前无从判断，一律不碰。实参里允许反斜杠
+// （Windows 写法，匹配后归一成 /）；引号排除——出现引号即不是这种形状。
+const DSH_HOME_PATH_EXACT = /^dshHomePath\(\s*(['"])([^'"]*)\1\s*\)$/;
+// 安装期 lifecycle 脚本。pnpm 的 requiresBuild（worker.js: pkgRequiresBuild，
+// 11.21.0 逐字核对）实际只认 preinstall/install/postinstall；下面的
+// prepare/prepublish 是本守卫额外的保守信号——它们不在 pnpm 的清单里，
+// 但也绝非不可能在安装期产出文件，宁可多 warn 一次终检，不冒误杀风险。
+const INSTALL_TIME_SCRIPT_RE = /^(?:pre|post)?install$|^prepare$|^prepublish$/;
+const RUNNABLE_ENTRY_RE = /\.(?:js|mjs|cjs)$/i;
+
+/**
+ * Whether the entry might only exist after a build pnpm would gate behind
+ * approval. Aligned with pnpm's own requiresBuild (worker.js:
+ * pkgRequiresBuild + filesIncludeInstallScripts, verified verbatim against
+ * 11.21.0): scripts preinstall/install/postinstall, a root binding.gyp, or
+ * anything under .hooks/. guard additionally treats prepare/prepublish as
+ * build-capable — a conservative addition of ours beyond pnpm's actual set,
+ * widening the warn lane, never narrowing the block lane.
+ */
+function candidateMayBuildEntry(candidateManifest, candidateDir) {
+  if (Object.keys(candidateManifest?.scripts ?? {}).some((name) => INSTALL_TIME_SCRIPT_RE.test(name))) return true;
+  if (typeof candidateDir !== "string") return false;
+  if (isPlainFile(join(candidateDir, "binding.gyp"))) return true;
+  try {
+    return readdirSync(join(candidateDir, ".hooks")).length > 0;
+  } catch {
+    return false;
+  }
+}
+
+/** A plain file at the path (not a directory, not missing). */
+function isPlainFile(path) {
+  try {
+    return statSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Match a row against the fatal shape; returns `{ pkgName, fileSegments }` or
+ * undefined. Pure — no filesystem access — so preflight and the post-install
+ * audit share one definition of what counts.
+ *
+ * Path handling notes (issue #14 review): the dshHomePath literal may use
+ * backslashes on Windows, so it is normalized to `/` before matching and the
+ * profile-name segment compares case-insensitively there; and existsSync is
+ * NOT entry resolution (`node src/guard` resolves to src/guard.js) — so only
+ * paths whose last segment carries a runnable extension (.js/.mjs/.cjs) are
+ * judged at all, and a target that exists but is not a plain file counts as
+ * missing.
+ */
+function fatalMcpEntry(row, profileName) {
+  if (row.name !== DSH_MCP_CLIENT_MODULE || row.state !== "enabled") return undefined;
+  const config = row.options?.config;
+  if (config === null || typeof config !== "object" || Array.isArray(config)) return undefined;
+  if (config.transport !== "stdio" || config.failOnStartupError !== true || config.command !== "node") return undefined;
+  const args = Array.isArray(config.args) ? config.args : [];
+  // 唯一参数才是入口。多个参数里混着 Node CLI 开关和业务路径（如
+  // --output dshHomePath('runtime/result.json')），逐一当入口查会把运行期
+  // 产物误判成缺失；不解析 Node CLI，多参行一律不判。
+  if (args.length !== 1 || !isJsExpr(args[0])) return undefined;
+  const call = DSH_HOME_PATH_EXACT.exec(String(args[0].__jsExpr ?? ""));
+  if (call === null) return undefined;
+  // JS 字符串字面量里的 Windows 分隔符写作 \\（求值后是单个 \）；单独的 \
+  // 是转义序列（\w 之类），求值结果无法静态确定——含未成对反斜杠的形态
+  // 一律不判。成对的 \\ 直接折成 /。
+  const rawLiteral = call[2];
+  let soloBackslash = false;
+  const normalized = [];
+  for (let i = 0; i < rawLiteral.length; i++) {
+    const ch = rawLiteral[i];
+    if (ch === "\\") {
+      if (rawLiteral[i + 1] === "\\") {
+        normalized.push("/");
+        i++;
+      } else {
+        soloBackslash = true;
+        break;
+      }
+    } else {
+      normalized.push(ch);
+    }
+  }
+  if (soloBackslash) return undefined;
+  const segments = normalized.join("").split("/");
+  const fold = process.platform === "win32" ? (value) => value.toLowerCase() : (value) => value;
+  if (segments.length < 5) return undefined;
+  if (fold(segments[0]) !== "profiles" || fold(segments[1]) !== fold(profileName) || fold(segments[2]) !== "node_modules") return undefined;
+  const rest = segments.slice(3);
+  const pkgName = rest[0]?.startsWith("@") === true && rest.length > 1 ? `${rest[0]}/${rest[1]}` : rest[0];
+  if (typeof pkgName !== "string" || pkgName.length === 0 || !NPM_PACKAGE_NAME_RE.test(pkgName)) return undefined;
+  const fileSegments = rest.slice(pkgName.split("/").length);
+  if (fileSegments.length === 0 || fileSegments.some((part) => part.length === 0 || part === "." || part === "..")) return undefined;
+  if (!RUNNABLE_ENTRY_RE.test(fileSegments[fileSegments.length - 1])) return undefined;
+  return { pkgName, fileSegments };
+}
+
+/**
+ * Package-name equality with the platform's own semantics: Windows resolves
+ * node_modules case-insensitively, so a row written as node_modules/MCP-BRICK
+ * targets the same package as manifest name mcp-brick — comparing strictly
+ * there would let a missing entry slip past both preflight and the audit.
+ */
+function samePackageName(left, right) {
+  return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
+}
+
+function mcpStartupFileIssues(mountedRows, candidateManifest, candidateName, candidateDir, profileDir) {
+  if (candidateName.length === 0 || typeof candidateDir !== "string") return [];
+  const profileName = basename(profileDir);
+  const hasInstallScripts = candidateMayBuildEntry(candidateManifest, candidateDir);
+  const issues = [];
+  for (const row of mountedRows) {
+    const fatal = fatalMcpEntry(row, profileName);
+    if (fatal === undefined || !samePackageName(fatal.pkgName, candidateName)) continue; // 只判候选自己的包：探针树里只有它
+    if (isPlainFile(join(candidateDir, ...fatal.fileSegments))) continue;
+    const fileRel = fatal.fileSegments.join("/");
+    if (hasInstallScripts) {
+      // 探装禁了 lifecycle 脚本，正式安装可能在用户审批后执行它们并生成
+      // 入口——静态「必缺」在这里不成立；硬保证移到装后终检。
+      issues.push(issue(
+        "warn",
+        "mcp-entry-unverifiable",
+        "入口缺失，但候选可能在构建后才生成它",
+        `行 ${row.id}（${DSH_MCP_CLIENT_MODULE}）设置了 failOnStartupError: true 并以 node 启动 ${fileRel}，探装（脚本禁用）里该文件不存在。候选带安装期脚本或构建清单（binding.gyp / .hooks），入口可能要等构建执行后才生成：预检不据此拦截，安装完成前会对照真树终检，仍缺失则回滚。`,
+        { row: row.id, file: fileRel },
+      ));
+    } else {
+      issues.push(issue(
+        "block",
+        "mcp-entry-missing",
+        "安装会使 dsh 无法启动",
+        `行 ${row.id}（${DSH_MCP_CLIENT_MODULE}，stdio）设置了 failOnStartupError: true，并以 node 启动候选包内的 ${fileRel}，但候选包里没有这个文件（未构建的源码安装的典型形态，且没有安装期脚本可能生成它）。安装后 dsh 会在装配阶段因该行失败而直接退出。`,
+        { row: row.id, file: fileRel },
+      ));
+    }
+  }
+  return issues;
+}
+
+/**
+ * Post-install audit (issue #14): the REAL profile tree, at the moment a
+ * successful install is about to commit. Scripts that were going to run have
+ * run (or were never declared); if the fatal entry is still not a plain file,
+ * committing would leave a profile that cannot start. The caller treats any
+ * returned issue as install failure so the outer handler rolls back.
+ *
+ * Only rows whose entry points into THE CANDIDATE's own package are judged —
+ * other packages' rows are not this install's doing, and the audit is not the
+ * place to condemn pre-existing profile state.
+ */
+export function mcpEntryAuditForInstall({ profileDir, candidateName }) {
+  if (typeof candidateName !== "string" || candidateName.length === 0 || typeof profileDir !== "string") return [];
+  let current;
+  try {
+    current = installedProfile(profileDir, []);
+  } catch {
+    return []; // unreadable profile is somebody else's error to report
+  }
+  const profileName = basename(profileDir);
+  const issues = [];
+  for (const row of current.composedRows) {
+    const fatal = fatalMcpEntry(row, profileName);
+    if (fatal === undefined || !samePackageName(fatal.pkgName, candidateName)) continue;
+    // Windows 文件系统本身不区分大小写，行里写 MCP-BRICK 也能落到同一目录。
+    if (isPlainFile(join(profileDir, "node_modules", ...fatal.pkgName.split("/"), ...fatal.fileSegments))) continue;
+    issues.push(issue(
+      "block",
+      "mcp-entry-missing",
+      "安装完成但入口仍缺失",
+      `行 ${row.id}（${DSH_MCP_CLIENT_MODULE}）以 failOnStartupError: true 启动 ${fatal.fileSegments.join("/")}，安装完成后该文件仍不存在——提交这个 profile 会让 dsh 在装配阶段退出。`,
+      { row: row.id, file: fatal.fileSegments.join("/") },
+    ));
+  }
+  return issues;
+}
 /** How a pair of projected rows would mount together. */
 function bothMount(left, right) {
   const states = [left.state, right.state];
@@ -1310,6 +1522,11 @@ export function inspectCandidate({ profileDir, candidateManifestPath, spec }) {
   issues.push(...namelessRowIssues(simulated.mounted.filter((row) => row.owner === candidateName), candidateName || spec));
   issues.push(...newConflictIssues(candidateName, current.composedRows, simulated.mounted));
   issues.push(...patchTargetIssues(candidateName, candidate.manifest, patch, current, simulated));
+  // 落盘后的文件树检查只能在这里做：探针树里候选包已实体化，MCP 入口存不
+  // 存在是可判定的（带安装期脚本的候选降为 warn，硬保证在装后终检——见
+  // mcpStartupFileIssues 的注释）。浏览期扫描（inspectRemoteCandidate）
+  // 没有文件树，不参与。
+  issues.push(...mcpStartupFileIssues(simulated.mounted, candidate.manifest, candidateName, candidate.dir, profileDir));
 
   // UI replacements historically predate exclusiveGroups.  Keep the
   // heuristic advisory-only to avoid blocking legitimate sidebar extensions.
@@ -3368,6 +3585,279 @@ async function selfTest() {
       if (validateInstalledProfile(p).ok !== true) throw new Error("healthy profile should validate clean");
     }
 
+    // ── MCP failOnStartupError 指向缺失文件（issue #14）────────────────────
+    //
+    // 事故形态（2026-08-22，managed-agents）：候选从 github: 源装下来没有
+    // dist/，insert 的 MCP 行 failOnStartupError: true 指向不存在的入口，
+    // 装上即砖、dsh 装配阶段退出。判定只认可证形状，扫的是**最终组合行**：
+    // 用户 patch 停用或改参可豁免，候选改坏既有 MCP 行同样抓得到。
+    {
+      const p = join(root, "profiles", "mcpcheck");
+      mkdirSync(p, { recursive: true });
+      const resetProfile = (userPatch) => {
+        writeFileSync(join(p, "package.json"), JSON.stringify({ dependencies: {} }));
+        writeFileSync(join(p, "cordis.patch.yml"), userPatch ?? "[]\n");
+      };
+      const mcpInsert = (file, extra = {}) => `
+- insert:
+    - id: mcp-x
+      name: '@deepseek-ai/dsh-mcp-client'
+      config:
+        serverName: x
+        transport: stdio
+        command: node
+        args:
+          - !!js dshHomePath('profiles/mcpcheck/node_modules/mcp-brick/${file}')
+        failOnStartupError: true
+`.replace("failOnStartupError: true", `failOnStartupError: ${extra.fatal ?? true}`)
+        + (extra.append ?? "");
+      const candidate = (label, pkgName, patchText) => {
+        const dir = join(root, `cand-${label}`);
+        mkdirSync(dir, { recursive: true });
+        writeFileSync(join(dir, "package.json"), JSON.stringify({ name: pkgName, version: "1.0.0", dsh: { bundle: { patch: "./cordis.patch.yml" } } }));
+        writeFileSync(join(dir, "cordis.patch.yml"), patchText);
+        return dir;
+      };
+      const inspect = (dir, name, userPatch) => {
+        resetProfile(userPatch);
+        return inspectCandidate({ profileDir: p, candidateManifestPath: join(dir, "package.json"), spec: name });
+      };
+
+      // 1) 入口缺失 → block（事故原样：无 dist 的源码树）。
+      const missing = inspect(candidate("missing", "mcp-brick", mcpInsert("dist/mcp/index.js")), "mcp-brick");
+      if (missing.verdict !== "blocked" || !missing.issues.some((e) => e.code === "mcp-entry-missing")) {
+        throw new Error(`MCP 入口缺失必须 block，实得 ${missing.verdict}: ${JSON.stringify(missing.issues.map((e) => e.code))}`);
+      }
+      console.log("PASS MCP 入口：缺失 + failOnStartupError → block");
+
+      // 2) 入口存在 → 放行。
+      const presentDir = candidate("present", "mcp-brick", mcpInsert("dist/mcp/index.js"));
+      mkdirSync(join(presentDir, "dist", "mcp"), { recursive: true });
+      writeFileSync(join(presentDir, "dist", "mcp", "index.js"), "");
+      const present = inspect(presentDir, "mcp-brick");
+      if (present.issues.some((e) => e.code === "mcp-entry-missing")) throw new Error("入口存在时不得报 mcp-entry-missing");
+      console.log("PASS MCP 入口：文件存在 → 放行");
+
+      // 3) failOnStartupError: false → 不判（失败不致命，装上也不会砖）。
+      const lenient = inspect(candidate("lenient", "mcp-brick", mcpInsert("dist/none.js", { fatal: false })), "mcp-brick");
+      if (lenient.issues.some((e) => e.code === "mcp-entry-missing")) throw new Error("failOnStartupError:false 不得判入口");
+      console.log("PASS MCP 入口：failOnStartupError:false → 放行");
+
+      // 4) 用户 patch 停用该行 → 最终行不运行，不判。
+      const disabledRow = inspect(candidate("disabled", "mcp-brick", mcpInsert("dist/none.js")), "mcp-brick", "- id: mcp-x\n  disabled: true\n");
+      if (disabledRow.issues.some((e) => e.code === "mcp-entry-missing")) throw new Error("用户停用的行不得判入口");
+      console.log("PASS MCP 入口：用户 patch 停用 → 放行");
+
+      // 5) 用户 patch 修正 args 指向存在的文件 → 放行。
+      const fixDir = candidate("fixed", "mcp-brick", mcpInsert("dist/none.js"));
+      mkdirSync(join(fixDir, "dist"), { recursive: true });
+      writeFileSync(join(fixDir, "dist", "fixed.js"), "");
+      const fixed = inspect(fixDir, "mcp-brick", `
+- id: mcp-x
+  config:
+    serverName: x
+    transport: stdio
+    command: node
+    args:
+      - !!js dshHomePath('profiles/mcpcheck/node_modules/mcp-brick/dist/fixed.js')
+    failOnStartupError: true
+`);
+      if (fixed.issues.some((e) => e.code === "mcp-entry-missing")) throw new Error("用户已把 args 修到存在的文件，不得再判");
+      console.log("PASS MCP 入口：用户 patch 修正 args → 放行");
+
+      // 6) 非精确 !!js 表达式（拼接）→ 求值前无从判断，不判。
+      const inexact = inspect(candidate("inexact", "mcp-brick", `
+- insert:
+    - id: mcp-x
+      name: '@deepseek-ai/dsh-mcp-client'
+      config:
+        transport: stdio
+        command: node
+        args:
+          - !!js dshHomePath('profiles/mcpcheck/node_modules/' + 'mcp-brick/dist/none.js')
+        failOnStartupError: true
+`), "mcp-brick");
+      if (inexact.issues.some((e) => e.code === "mcp-entry-missing")) throw new Error("拼接表达式不得判入口");
+      console.log("PASS MCP 入口：非精确 !!js 表达式 → 不误判");
+
+      // 7) 候选改坏既有 MCP 行（override）→ 同样检出。行是 existing-host
+      //    插的、原本不致命；候选把 config 整个换成指向自己包内缺失文件
+      //    且 failOnStartupError: true —— 只看 insert 会漏掉这一种。
+      resetProfile();
+      // 真实形态：已装插件同时在 dependencies 和 dsh.profile.bundles 里
+      // （bundleLayers 只从 bundles 列表构建，光有依赖不成层）。
+      writeFileSync(join(p, "package.json"), JSON.stringify({ dependencies: { "existing-host": "1.0.0" }, dsh: { profile: { bundles: ["existing-host"] } } }));
+      mkdirSync(join(p, "node_modules", "existing-host"), { recursive: true });
+      writeFileSync(join(p, "node_modules", "existing-host", "package.json"), JSON.stringify({ name: "existing-host", version: "1.0.0", dsh: { bundle: { patch: "./cordis.patch.yml" } } }));
+      writeFileSync(join(p, "node_modules", "existing-host", "cordis.patch.yml"), `
+- insert:
+    - id: mcp-existing
+      name: '@deepseek-ai/dsh-mcp-client'
+      config:
+        transport: stdio
+        command: node
+        args:
+          - !!js dshHomePath('profiles/mcpcheck/node_modules/existing-host/dist/mcp.js')
+        failOnStartupError: false
+`);
+      const breaker = inspectCandidate({ profileDir: p, candidateManifestPath: join(candidate("breaker", "mcp-brick", `
+- id: mcp-existing
+  config:
+    transport: stdio
+    command: node
+    args:
+      - !!js dshHomePath('profiles/mcpcheck/node_modules/mcp-brick/dist/none.js')
+    failOnStartupError: true
+`), "package.json"), spec: "mcp-brick" });
+      if (!breaker.issues.some((e) => e.code === "mcp-entry-missing")) {
+        throw new Error(`候选 override 既有 MCP 行改坏必须检出，实得 ${JSON.stringify(breaker.issues.map((e) => e.code))}`);
+      }
+      console.log("PASS MCP 入口：候选 override 既有行改坏 → 检出");
+
+      // 8) scoped 候选包：路径前缀含 scope 段，同样判得到。
+      const scopedDir = candidate("scoped", "@scope/mcp-pkg", `
+- insert:
+    - id: mcp-x
+      name: '@deepseek-ai/dsh-mcp-client'
+      config:
+        transport: stdio
+        command: node
+        args:
+          - !!js dshHomePath('profiles/mcpcheck/node_modules/@scope/mcp-pkg/dist/none.js')
+        failOnStartupError: true
+`);
+      resetProfile();
+      const scopedRep = inspectCandidate({ profileDir: p, candidateManifestPath: join(scopedDir, "package.json"), spec: "@scope/mcp-pkg" });
+      if (!scopedRep.issues.some((e) => e.code === "mcp-entry-missing")) throw new Error("scoped 候选的缺失入口必须检出");
+      console.log("PASS MCP 入口：scoped 包路径 → 检出");
+
+      // 9) 多参数：唯一参数才是入口，业务路径不参与判定（review P1）。业务
+      //    路径故意用 .js 后缀——过得了扩展名闸门，钉的就是「唯一参数」这
+      //    条规则本身，不是被扩展名顺带挡住的。
+      const multiArg = inspect(candidate("multiarg", "mcp-brick", `
+- insert:
+    - id: mcp-x
+      name: '@deepseek-ai/dsh-mcp-client'
+      config:
+        transport: stdio
+        command: node
+        args:
+          - server.js
+          - '--output'
+          - !!js dshHomePath('profiles/mcpcheck/node_modules/mcp-brick/runtime/out.js')
+        failOnStartupError: true
+`), "mcp-brick");
+      if (multiArg.issues.some((e) => e.code === "mcp-entry-missing" || e.code === "mcp-entry-unverifiable")) {
+        throw new Error("多参数行的业务路径不得当入口判");
+      }
+      console.log("PASS MCP 入口：多参数（业务路径）→ 不判");
+
+      // 10) 无扩展名入口：node 会做扩展名/目录解析，existsSync 不等价——不判。
+      const extless = inspect(candidate("extless", "mcp-brick", mcpInsert("dist/mcp/entry")), "mcp-brick");
+      if (extless.issues.some((e) => e.code === "mcp-entry-missing")) throw new Error("无扩展名路径不得判入口");
+      console.log("PASS MCP 入口：无扩展名 → 不判");
+
+      // 11) 路径存在但是目录（名字带 .js）：不是普通文件，按缺失论。
+      const dirDir = candidate("dir-entry", "mcp-brick", mcpInsert("dist/index.js"));
+      mkdirSync(join(dirDir, "dist", "index.js"), { recursive: true }); // 目录！
+      const dirEntry = inspect(dirDir, "mcp-brick");
+      if (!dirEntry.issues.some((e) => e.code === "mcp-entry-missing")) throw new Error("目录顶替入口文件必须 block");
+      console.log("PASS MCP 入口：路径是目录（非普通文件）→ block");
+
+      // 12) 候选带 postinstall + 入口缺失 → 降为 warn（装后终检把关），不 block。
+      const scriptedDir = candidate("scripted", "mcp-brick", mcpInsert("dist/mcp/index.js"));
+      writeFileSync(join(scriptedDir, "package.json"), JSON.stringify({ name: "mcp-brick", version: "1.0.0", scripts: { postinstall: "node build.js" }, dsh: { bundle: { patch: "./cordis.patch.yml" } } }));
+      const scripted = inspect(scriptedDir, "mcp-brick");
+      const unverifiable = scripted.issues.find((e) => e.code === "mcp-entry-unverifiable");
+      if (scripted.verdict !== "warning" || unverifiable === undefined || scripted.issues.some((e) => e.code === "mcp-entry-missing")) {
+        throw new Error(`带安装期脚本的候选应降为 warn（终检把关），实得 ${scripted.verdict}: ${JSON.stringify(scripted.issues.map((e) => e.code))}`);
+      }
+      console.log("PASS MCP 入口：候选带 postinstall → warn 不 block（终检把关）");
+
+      // 13) 反斜杠路径：JS 字面量里的真实写法是 \\（求值后单个 \）——归一
+      //     后同样检出。单个不成对的 \ 是转义序列（\w 之类），求值结果无
+      //     从静态确定，不判。
+      const backslash = inspect(candidate("backslash", "mcp-brick", `
+- insert:
+    - id: mcp-x
+      name: '@deepseek-ai/dsh-mcp-client'
+      config:
+        transport: stdio
+        command: node
+        args:
+          - !!js dshHomePath('profiles\\\\mcpcheck\\\\node_modules\\\\mcp-brick\\\\dist\\\\none.js')
+        failOnStartupError: true
+`), "mcp-brick");
+      if (!backslash.issues.some((e) => e.code === "mcp-entry-missing")) {
+        throw new Error(`反斜杠路径（\\\\ 形式）应归一检出，实得 ${JSON.stringify(backslash.issues.map((e) => e.code))}`);
+      }
+      console.log("PASS MCP 入口：反斜杠路径（\\\\ 形式）归一 → 检出");
+      const soloBackslash = inspect(candidate("solo-backslash", "mcp-brick", `
+- insert:
+    - id: mcp-x
+      name: '@deepseek-ai/dsh-mcp-client'
+      config:
+        transport: stdio
+        command: node
+        args:
+          - !!js dshHomePath('profiles\\mcpcheck\\node_modules\\mcp-brick\\dist\\none.js')
+        failOnStartupError: true
+`), "mcp-brick");
+      if (soloBackslash.issues.some((e) => e.code === "mcp-entry-missing" || e.code === "mcp-entry-unverifiable")) {
+        throw new Error("不成对的单个反斜杠（转义序列）不得判");
+      }
+      console.log("PASS MCP 入口：单个反斜杠（转义序列）→ 不判");
+
+      // 13b) binding.gyp（无任何 scripts）：pnpm 的 requiresBuild 同样视为
+      //      需构建——入口可能由 node-gyp 链路产出，静态只 warn。
+      const gypDir = candidate("gyp", "mcp-brick", mcpInsert("dist/mcp/index.js"));
+      writeFileSync(join(gypDir, "binding.gyp"), "{}\n");
+      const gyp = inspect(gypDir, "mcp-brick");
+      if (!gyp.issues.some((e) => e.code === "mcp-entry-unverifiable") || gyp.issues.some((e) => e.code === "mcp-entry-missing")) {
+        throw new Error(`binding.gyp 候选应降为 warn，实得 ${gyp.verdict}: ${JSON.stringify(gyp.issues.map((e) => e.code))}`);
+      }
+      console.log("PASS MCP 入口：binding.gyp（无 scripts）→ warn 不 block");
+
+      // 13c) 包名大小写变体：manifest 是 mcp-brick，行里写 MCP-BRICK。
+      //      win32 上 node_modules 解析不区分大小写——同一个包，照判；
+      //      posix 上那是另一个名字，不判。两平台各自的判定才是正确语义。
+      const cased = inspect(candidate("cased", "mcp-brick", `
+- insert:
+    - id: mcp-x
+      name: '@deepseek-ai/dsh-mcp-client'
+      config:
+        transport: stdio
+        command: node
+        args:
+          - !!js dshHomePath('profiles/mcpcheck/node_modules/MCP-BRICK/dist/none.js')
+        failOnStartupError: true
+`), "mcp-brick");
+      const casedBlocked = cased.issues.some((e) => e.code === "mcp-entry-missing");
+      if (process.platform === "win32" ? !casedBlocked : casedBlocked) {
+        throw new Error(`包名大小写变体在 ${process.platform} 上判定错误: ${JSON.stringify(cased.issues.map((e) => e.code))}`);
+      }
+      console.log(`PASS MCP 入口：包名大小写变体按平台语义判定（${process.platform} → ${casedBlocked ? "检出" : "不判"}）`);
+
+      // 14) 装后终检：真树里入口仍缺 → issue；存在 → 空；别人的包 → 不判。
+      {
+        resetProfile();
+        writeFileSync(join(p, "package.json"), JSON.stringify({ dependencies: { "mcp-brick": "1.0.0" }, dsh: { profile: { bundles: ["mcp-brick"] } } }));
+        const installedCand = join(p, "node_modules", "mcp-brick");
+        mkdirSync(installedCand, { recursive: true });
+        writeFileSync(join(installedCand, "package.json"), JSON.stringify({ name: "mcp-brick", version: "1.0.0", dsh: { bundle: { patch: "./cordis.patch.yml" } } }));
+        writeFileSync(join(installedCand, "cordis.patch.yml"), mcpInsert("dist/mcp/index.js"));
+        const auditMissing = mcpEntryAuditForInstall({ profileDir: p, candidateName: "mcp-brick" });
+        if (auditMissing.length !== 1 || auditMissing[0].code !== "mcp-entry-missing") throw new Error("终检：入口缺失必须报");
+        mkdirSync(join(installedCand, "dist", "mcp"), { recursive: true });
+        writeFileSync(join(installedCand, "dist", "mcp", "index.js"), "");
+        if (mcpEntryAuditForInstall({ profileDir: p, candidateName: "mcp-brick" }).length !== 0) throw new Error("终检：入口存在不得报");
+        if (mcpEntryAuditForInstall({ profileDir: p, candidateName: "someone-else" }).length !== 0) throw new Error("终检：别人的包不归这次安装判");
+        console.log("PASS MCP 入口：装后终检（缺→报、有→过、他人包→不判）");
+      }
+
+      resetProfile();
+    }
+
     // validateInstalledProfile detects a loader-id collision between two
     // already-installed bundles (the failure mode a bad install introduces).
     {
@@ -4789,4 +5279,4 @@ if (process.argv[1]?.endsWith("guard.js") && process.argv.includes("--self-test"
     console.error(`FAIL ${error.stack ?? error.message}`);
     process.exitCode = 1;
   });
-}
+}

package/src/index.js

@@ -1084,14 +1084,13 @@ export function createJobTracker({ producerFactory } = {}) {
   const prune = () => {
     const now = Date.now();
     for (const [id, record] of records) {
-      const terminal = record.status !== "running";
-      if (terminal && record.finishedAt !== undefined && now - record.finishedAt > 3600000) records.delete(id);
+      if (record.finishedAt !== undefined && now - record.finishedAt > 3600000) records.delete(id);
     }
     if (records.size > 20) {
       const ordered = [...records.entries()].sort((a, b) => a[1].startedAt - b[1].startedAt);
       for (const [id, record] of ordered) {
         if (records.size <= 20) break;
-        if (record.status !== "running") records.delete(id);
+        if (record.finishedAt !== undefined) records.delete(id);
       }
     }
   };
@@ -1314,6 +1313,9 @@ export function createJobTracker({ producerFactory } = {}) {
         }
       }
       if (typeof record.producer?.cancel === "function") {
+        if (record.finishedAt === undefined && record.status === "running") {
+          record.status = "stopping";
+        }
         record.producer.cancel();
       }
       if (record.approvalToken) {
@@ -1330,6 +1332,9 @@ export function createJobTracker({ producerFactory } = {}) {
       if (record.surface === "browser" && (record.session === "" || record.session !== session)) {
         return false;
       }
+      // Dismiss hides settled history. Live work must go through cancel and
+      // remain observable until its producer reports a terminal outcome.
+      if (record.finishedAt === undefined) return false;
       // Marked, not deleted: `list` (panel restore after a remount) skips these,
       // so a cleared panel stays cleared across remounts.
       record.dismissed = true;
@@ -3012,6 +3017,40 @@ export async function runSelfTests() {
     const snapAfterDismiss = sessionTracker.get(sessionJobId, "session-alpha").snapshot;
     check("dismiss 后 job snapshot 中 approvalToken 为 undefined", snapAfterDismiss.approvalToken === undefined);
 
+    // 运行中任务不能靠 dismiss 从观察面消失；cancel 先进入 stopping，等
+    // producer 真正结算后才成为可清理的历史。
+    {
+      let settleLive;
+      let cancelCalls = 0;
+      const liveProducer = {
+        cancel: () => { cancelCalls++; },
+        done: new Promise((resolvePromise) => { settleLive = resolvePromise; }),
+        readOutput: () => "",
+      };
+      const liveTracker = createJobTracker({ producerFactory: () => liveProducer });
+      const liveJobId = liveTracker.start({
+        profile: "web",
+        spec: "live-pkg",
+        surface: "browser",
+        session: "session-alpha",
+      });
+      check("运行中 job 拒绝 dismiss", liveTracker.dismiss(liveJobId, "session-alpha") === false);
+      check("dismiss 被拒后运行中 job 仍可恢复",
+        liveTracker.list("session-alpha").some((entry) => entry.id === liveJobId));
+      check("cancel 请求把可杀 job 标为 stopping",
+        liveTracker.cancel(liveJobId, "session-alpha") === "requested"
+        && liveTracker.get(liveJobId, "session-alpha").snapshot.status === "stopping"
+        && cancelCalls === 1);
+      check("stopping job 仍拒绝 dismiss", liveTracker.dismiss(liveJobId, "session-alpha") === false);
+      settleLive({ status: "killed", detail: "cancelled" });
+      await new Promise((resolvePromise) => setImmediate(resolvePromise));
+      check("producer 结算后 job 进入 killed",
+        liveTracker.get(liveJobId, "session-alpha").snapshot.status === "killed");
+      check("终态 job 可 dismiss 并不再恢复",
+        liveTracker.dismiss(liveJobId, "session-alpha") === true
+        && liveTracker.list("session-alpha").every((entry) => entry.id !== liveJobId));
+    }
+
     // ── 5b. list（重挂载恢复）：日志累积、dismissed 过滤、session 隔离 ────────
     // 安装事务改写 cordis.patch.yml 会让 dsh 重放装配树、市场 UI 整体重挂载，
     // 前端 state 全丢。任务记录在后端活着——list 就是恢复通道：drain 过的