@dsh-sup/dsh-core-linux-x64 0.1.6-BETA.6 → 0.1.6-BETA.8

package/core.cjs

@@ -947,7 +947,7 @@ var require_version = __commonJS({
     var fs2 = require("node:fs");
     var path2 = require("node:path");
     function guardVersion() {
-      if (true) return String("0.1.6-BETA.6");
+      if (true) return String("0.1.6-BETA.8");
       try {
         return JSON.parse(fs2.readFileSync(path2.join(__dirname, "..", "..", "package.json"), "utf8")).version || "unknown";
       } catch {
@@ -1207,7 +1207,7 @@ var require_main_store = __commonJS({
         if (!live) live = readDshMainFile();
         if (corrupt && !(typeof m.remoteToken === "string" && m.remoteToken)) {
           const l = logger();
-          if (l && l.warn) l.warn("_writeDshMain: \u6587\u4EF6\u635F\u574F\u6001\uFF0C\u62D2\u7EDD\u4EE5\u9ED8\u8BA4\u503C\u8986\u76D6\u5199\u56DE");
+          if (l && l.warn) l.warn("writeDshMain: \u6587\u4EF6\u635F\u574F\u6001\uFF0C\u62D2\u7EDD\u4EE5\u9ED8\u8BA4\u503C\u8986\u76D6\u5199\u56DE");
           return;
         }
         corrupt = false;
@@ -1227,7 +1227,7 @@ var require_main_store = __commonJS({
           writeAtomic(f, body, { mode: 384 });
         } catch (e) {
           const l = logger();
-          if (l && l.warn) l.warn("_writeDshMain: " + (e && e.message || e));
+          if (l && l.warn) l.warn("writeDshMain: " + (e && e.message || e));
         }
       }
       return { dshMainFile, registryFileName, readDshMain, readDshMainFile, writeDshMain };
@@ -3020,10 +3020,6 @@ var require_facades = __commonJS({
       _makeRouterFacade() {
         const client = createCtlClient({ getConfig: () => this.config });
         return createRouterCtlFacade({ getRouterPort: client.routerCtlPort, ctlCall: client.ctlCall });
-      },
-      _makeCtlFacade(port) {
-        const client = createCtlClient({ getConfig: () => this.config });
-        return createCtlFacade({ port, ctlCall: client.ctlCall });
       }
     };
     module2.exports = { createCtlFacade, createRouterCtlFacade, methods };
@@ -4006,27 +4002,7 @@ var require_orphan_scan = __commonJS({
         logger && logger.warn && logger.warn("[orphan] \u81EA\u68C0\u5F02\u5E38: " + (e && e.message || e));
       }
     }
-    function hostOrphanAudit() {
-      return orphanAudit({
-        getConfig: () => this.config,
-        getLogger: () => this.logger,
-        getEvents: () => this.events,
-        getInstances: () => this.instances,
-        getManagedObjects: () => this.managedObjects,
-        getCtl: () => this.ctl,
-        getDaemons: () => this.daemons,
-        getStopping: () => this._stopping,
-        getLastKey: () => this._lastOrphanKey,
-        setLastKey: (v) => {
-          this._lastOrphanKey = v;
-        },
-        getLastAt: () => this._lastOrphanAt,
-        setLastAt: (v) => {
-          this._lastOrphanAt = v;
-        }
-      });
-    }
-    module2.exports = { methods: { _orphanAudit: hostOrphanAudit }, orphanAudit };
+    module2.exports = { orphanAudit };
   }
 });
 
@@ -4132,7 +4108,6 @@ var require_collaborators = __commonJS({
         routerStatus: "routerStatus",
         status: "statusSummary"
       },
-      audit: { orphan: "_orphanAudit" },
       ui: { notify: "notify" }
     };
     var THIN_NAMES = Object.keys(THIN_SPEC);
@@ -4227,7 +4202,6 @@ var require_collaborators = __commonJS({
       host2._registryFileName = () => state.registryFileName();
       host2._readDshMain = () => state.readMainMeta();
       host2._readDshMainFile = () => state.readMainMetaFile();
-      host2._writeDshMain = (meta) => state.writeMainMeta(meta);
       host2.writeState = (force) => state.write(force);
       host2.loadState = () => state.loadState();
       host2._migrateMainRecord = () => state.migrateMainRecord();
@@ -6535,44 +6509,183 @@ var require_ip = __commonJS({
   }
 });
 
-// src/platform/distribution/policies.js
-var require_policies = __commonJS({
-  "src/platform/distribution/policies.js"(exports2, module2) {
+// src/platform/distribution/registry-ref.js
+var require_registry_ref = __commonJS({
+  "src/platform/distribution/registry-ref.js"(exports2, module2) {
     "use strict";
     var { isPrivateHostLiteral } = require_ip();
-    var FALLBACK_REGISTRIES = [
-      "https://registry.npmjs.org",
-      "https://registry.npmmirror.com"
-    ];
-    function normalizeOrigin(origin) {
-      return String(origin || "").trim().replace(/\/+$/, "");
+    var REDIRECT_MAX_HOPS = 3;
+    var MAX_BODY_BYTES = 32 * 1024 * 1024;
+    var DEFAULT_TIMEOUT_MS = 1e4;
+    function normalizeBase(raw) {
+      return String(raw == null ? "" : raw).trim().replace(/\/+$/, "");
+    }
+    function hostViolation(host2) {
+      const h = String(host2 || "").toLowerCase().replace(/^\[|\]$/g, "");
+      if (!h) return "\u955C\u50CF\u6E90\u7F3A\u5C11\u4E3B\u673A\u540D";
+      if (isPrivateHostLiteral(h)) return "\u955C\u50CF\u6E90\u4E3B\u673A\u4E0D\u5F97\u4E3A\u56DE\u73AF/\u79C1\u7F51/\u94FE\u8DEF\u672C\u5730/\u4FDD\u7559\u6BB5\u5B57\u9762\u91CF: " + h;
+      return null;
     }
-    function isValidOrigin(origin) {
-      const s = normalizeOrigin(origin);
-      if (!/^https?:\/\/(\[[0-9A-Fa-f:]+\]|[A-Za-z0-9.\-_]+)(:\d+)?$/.test(s)) return false;
+    function parseRegistryBase(raw) {
+      const base = normalizeBase(raw);
+      const bad = (violation) => ({ ok: false, base, protocol: "", host: "", violation });
+      if (!base) return bad("\u955C\u50CF\u6E90\u4E3A\u7A7A");
+      if (/[\s]/.test(base)) return bad("\u955C\u50CF\u6E90\u4E0D\u5F97\u542B\u7A7A\u767D\u5B57\u7B26");
       let u;
       try {
-        u = new URL(s);
+        u = new URL(base);
       } catch {
-        return false;
+        return bad("\u955C\u50CF\u6E90\u65E0\u6CD5\u89E3\u6790: " + base);
       }
-      if (u.protocol !== "http:" && u.protocol !== "https:") return false;
-      if (u.username || u.password) return false;
-      if (u.hash) return false;
-      if (!u.hostname) return false;
-      return u.pathname === "" || u.pathname === "/" || u.pathname === "//";
+      if (u.protocol !== "http:" && u.protocol !== "https:") return bad("\u955C\u50CF\u6E90\u5FC5\u987B\u662F http(s) \u534F\u8BAE: " + base);
+      if (u.username || u.password) return bad("\u955C\u50CF\u6E90\u4E0D\u5F97\u643A\u5E26\u7528\u6237\u540D\u6216\u5BC6\u7801: " + base);
+      if (u.search) return bad("\u955C\u50CF\u6E90\u4E0D\u5F97\u643A\u5E26\u67E5\u8BE2\u4E32: " + base);
+      if (u.hash) return bad("\u955C\u50CF\u6E90\u4E0D\u5F97\u643A\u5E26\u7247\u6BB5: " + base);
+      if (!u.hostname) return bad("\u955C\u50CF\u6E90\u7F3A\u5C11\u4E3B\u673A\u540D: " + base);
+      return { ok: true, base, protocol: u.protocol.replace(/:$/, ""), host: u.hostname, violation: null };
     }
-    function registryOriginViolation(origin) {
-      const o = normalizeOrigin(origin);
-      if (!isValidOrigin(o)) return "\u955C\u50CF\u6E90\u5FC5\u987B\u662F http(s) \u7EAF origin\uFF08\u65E0\u8DEF\u5F84/\u67E5\u8BE2/\u51ED\u8BC1\uFF09: " + o;
+    function targetHostViolation(rawUrl, fromUrl) {
       let u;
       try {
-        u = new URL(o);
+        u = new URL(String(rawUrl || ""));
       } catch {
-        return "\u955C\u50CF\u6E90\u65E0\u6CD5\u89E3\u6790: " + o;
+        return "\u8DF3\u8F6C\u76EE\u6807\u65E0\u6CD5\u89E3\u6790";
       }
-      if (isPrivateHostLiteral(u.hostname)) return "\u955C\u50CF\u6E90\u4E3B\u673A\u4E0D\u5F97\u4E3A\u56DE\u73AF/\u79C1\u7F51/\u94FE\u8DEF\u672C\u5730/\u4FDD\u7559\u6BB5\u5B57\u9762\u91CF: " + o;
-      return null;
+      if (u.protocol !== "http:" && u.protocol !== "https:") return "\u8DF3\u8F6C\u76EE\u6807\u534F\u8BAE\u975E\u6CD5: " + u.protocol;
+      if (u.username || u.password) return "\u8DF3\u8F6C\u76EE\u6807\u4E0D\u5F97\u643A\u5E26\u51ED\u8BC1";
+      let from;
+      try {
+        from = new URL(String(fromUrl || ""));
+      } catch {
+        from = null;
+      }
+      if (from && from.hostname.toLowerCase() === u.hostname.toLowerCase()) return null;
+      return hostViolation(u.hostname);
+    }
+    function registryPackagePath(pkg) {
+      return encodeURIComponent(String(pkg || ""));
+    }
+    function registryUrl(base, ...segments) {
+      const parsed = parseRegistryBase(base);
+      if (!parsed.ok) return null;
+      const tail = segments.filter((s) => s !== "" && s != null).map((s) => String(s).replace(/^\/+/, "").replace(/\/+$/, "")).filter(Boolean).join("/");
+      return tail ? parsed.base + "/" + tail : parsed.base;
+    }
+    async function readCapped(res, maxBytes) {
+      const cl = Number(res.headers && res.headers.get("content-length")) || 0;
+      if (cl > maxBytes) return null;
+      const reader = res.body && typeof res.body.getReader === "function" ? res.body.getReader() : null;
+      if (!reader) {
+        const text = await res.text();
+        return text.length > maxBytes ? null : text;
+      }
+      const chunks = [];
+      let total = 0;
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        if (!value) continue;
+        total += value.byteLength || value.length || 0;
+        if (total > maxBytes) {
+          try {
+            await reader.cancel();
+          } catch {
+          }
+          return null;
+        }
+        chunks.push(value);
+      }
+      const buf = Buffer.concat(chunks.map((c) => Buffer.from(c.buffer, c.byteOffset, c.byteLength)));
+      return buf.toString("utf8");
+    }
+    async function fetchRegistry(startUrl, opts) {
+      const o = opts || {};
+      const timeoutMs = Number.isFinite(o.timeoutMs) && o.timeoutMs > 0 ? o.timeoutMs : DEFAULT_TIMEOUT_MS;
+      const maxBytes = Number.isFinite(o.maxBytes) && o.maxBytes > 0 ? o.maxBytes : MAX_BODY_BYTES;
+      const maxHops = Number.isFinite(o.maxHops) ? o.maxHops : REDIRECT_MAX_HOPS;
+      let url = String(startUrl || "");
+      const hops = [];
+      const fail = (status, error) => ({ ok: false, status, json: null, error, url, hops });
+      for (let hop = 0; ; hop++) {
+        let res;
+        try {
+          res = await fetch(url, { signal: AbortSignal.timeout(timeoutMs), redirect: "manual" });
+        } catch (e) {
+          return fail(null, e && (e.name === "TimeoutError" ? "\u8D85\u65F6" : e.message) || String(e));
+        }
+        hops.push({ url, status: res.status });
+        if (res.status >= 300 && res.status < 400) {
+          try {
+            if (res.body) await res.body.cancel();
+          } catch {
+          }
+          if (hop >= maxHops) return fail(res.status, "\u8DF3\u8F6C\u6B21\u6570\u8D85\u8FC7\u4E0A\u9650");
+          const loc = res.headers.get("location");
+          if (!loc) return fail(res.status, "\u8DF3\u8F6C\u7F3A\u5C11 Location");
+          let next;
+          try {
+            next = new URL(loc, url).toString();
+          } catch {
+            return fail(res.status, "\u8DF3\u8F6C\u76EE\u6807\u65E0\u6CD5\u89E3\u6790");
+          }
+          const tv = targetHostViolation(next, url);
+          url = next;
+          if (tv) return fail(res.status, tv);
+          continue;
+        }
+        if (res.status < 200 || res.status >= 300) {
+          try {
+            if (res.body) await res.body.cancel();
+          } catch {
+          }
+          return fail(res.status, "HTTP " + res.status);
+        }
+        if (o.expect === "none") {
+          try {
+            if (res.body) await res.body.cancel();
+          } catch {
+          }
+          return { ok: true, status: res.status, json: null, error: null, url, hops };
+        }
+        let text;
+        try {
+          text = await readCapped(res, maxBytes);
+        } catch (e) {
+          return fail(res.status, "\u8BFB\u53D6\u54CD\u5E94\u4F53\u4E2D\u65AD\uFF1A" + (e && e.message || String(e)));
+        }
+        if (text === null) return fail(res.status, "\u54CD\u5E94\u4F53\u8D85\u8FC7\u4E0A\u9650");
+        if (o.expect !== "json") return { ok: true, status: res.status, json: null, text, error: null, url, hops };
+        try {
+          return { ok: true, status: res.status, json: JSON.parse(text), error: null, url, hops };
+        } catch {
+          return fail(res.status, "\u54CD\u5E94\u4E0D\u662F\u5408\u6CD5 JSON");
+        }
+      }
+    }
+    module2.exports = {
+      normalizeBase,
+      hostViolation,
+      parseRegistryBase,
+      registryPackagePath,
+      registryUrl,
+      fetchRegistry
+    };
+  }
+});
+
+// src/platform/distribution/policies.js
+var require_policies = __commonJS({
+  "src/platform/distribution/policies.js"(exports2, module2) {
+    "use strict";
+    var registryRef = require_registry_ref();
+    var FALLBACK_REGISTRIES = [
+      "https://registry.npmjs.org",
+      "https://registry.npmmirror.com"
+    ];
+    function registryOriginViolation(origin) {
+      const parsed = registryRef.parseRegistryBase(origin);
+      if (!parsed.ok) return parsed.violation;
+      return registryRef.hostViolation(parsed.host);
     }
     function effectiveOrigins(registryConfig, defaultRegistries) {
       const o = registryConfig && registryConfig.origins || [];
@@ -6590,32 +6703,27 @@ var require_policies = __commonJS({
       };
     }
     function resolveProbe(origin, spec, platformTag) {
-      const base = normalizeOrigin(origin);
+      const timeoutMs = spec && Number.isFinite(spec.timeoutMs) && spec.timeoutMs > 0 ? spec.timeoutMs : 4e3;
+      const parsed = registryRef.parseRegistryBase(origin);
+      if (!parsed.ok) return { url: null, kind: "invalid", timeoutMs, violation: parsed.violation };
       if (spec && spec.kind === "package-metadata" && spec.pathTemplate && platformTag) {
         return {
-          url: base + "/" + spec.pathTemplate.replace("{platform}", platformTag),
+          url: registryRef.registryUrl(parsed.base, spec.pathTemplate.replace("{platform}", platformTag)),
           kind: spec.kind,
-          timeoutMs: spec.timeoutMs || 4e3
+          timeoutMs
         };
       }
-      return { url: base + "/-/ping", kind: "ping", timeoutMs: spec && spec.timeoutMs || 4e3 };
-    }
-    function pickFastestReachable(results) {
-      const reachable = results.filter((r) => r.ok).sort((a, b) => a.latencyMs - b.latencyMs);
-      return reachable.length ? reachable[0] : null;
+      return { url: registryRef.registryUrl(parsed.base, "/-/ping"), kind: "ping", timeoutMs };
     }
     function isInCanaryList(state) {
       return state.canary === true;
     }
     module2.exports = {
       FALLBACK_REGISTRIES,
-      normalizeOrigin,
-      isValidOrigin,
       registryOriginViolation,
       effectiveOrigins,
       rebuildRegistryConfig,
       resolveProbe,
-      pickFastestReachable,
       isInCanaryList
     };
   }
@@ -6731,64 +6839,6 @@ var require_release = __commonJS({
   }
 });
 
-// src/platform/contract/matrix.js
-var require_matrix = __commonJS({
-  "src/platform/contract/matrix.js"(exports2, module2) {
-    "use strict";
-    var SUPPORTED = [
-      { platform: "linux", arch: "x64", osTag: "linux", npmTag: "linux-x64" },
-      { platform: "darwin", arch: "arm64", osTag: "darwin", npmTag: "darwin-arm64" },
-      { platform: "darwin", arch: "x64", osTag: "darwin", npmTag: "darwin-x64" },
-      { platform: "win32", arch: "x64", osTag: "win", npmTag: "win-x64" }
-    ];
-    var OS_TAG = { linux: "linux", darwin: "darwin", win32: "win" };
-    var FRP_OS = { linux: "linux", darwin: "darwin", win32: "windows" };
-    var FRP_ARCH = { x64: "amd64", arm64: "arm64" };
-    function osTag(platform) {
-      return OS_TAG[platform || process.platform] || null;
-    }
-    function current(platform, arch) {
-      const p = platform || process.platform;
-      const a = arch || process.arch;
-      return { platform: p, arch: a, osTag: OS_TAG[p] || null, npmTag: npmTag(p, a) };
-    }
-    function npmTag(platform, arch) {
-      const p = platform || process.platform;
-      const a = arch || process.arch;
-      const os2 = OS_TAG[p];
-      if (!os2 || a !== "x64" && a !== "arm64") {
-        throw new Error("\u4E0D\u652F\u6301\u7684\u5E73\u53F0\u7EC4\u5408: " + p + "/" + a + "\uFF08\u4EC5 linux/darwin/win32 \xD7 x64/arm64\uFF09");
-      }
-      return os2 + "-" + a;
-    }
-    function isSupported(platform, arch) {
-      const p = platform || process.platform;
-      const a = arch || process.arch;
-      return SUPPORTED.some((x) => x.platform === p && x.arch === a);
-    }
-    function frpTag(platform, arch) {
-      const p = platform || process.platform;
-      const a = arch || process.arch;
-      const os2 = FRP_OS[p];
-      const am = FRP_ARCH[a];
-      if (!os2 || !am) return null;
-      return { os: os2, arch: am, tag: os2 + "_" + am, exe: p === "win32" };
-    }
-    function supportsProcessGroup(platform) {
-      return (platform || process.platform) !== "win32";
-    }
-    module2.exports = {
-      SUPPORTED,
-      osTag,
-      current,
-      npmTag,
-      isSupported,
-      frpTag,
-      supportsProcessGroup
-    };
-  }
-});
-
 // src/platform/contract/registry.js
 var require_registry = __commonJS({
   "src/platform/contract/registry.js"(exports2, module2) {
@@ -6890,26 +6940,16 @@ var require_registry = __commonJS({
   }
 });
 
-// src/platform/distribution/registry.js
-var require_registry2 = __commonJS({
-  "src/platform/distribution/registry.js"(exports2, module2) {
+// src/platform/distribution/registry-config.js
+var require_registry_config = __commonJS({
+  "src/platform/distribution/registry-config.js"(exports2, module2) {
     "use strict";
     var fs2 = require("node:fs");
     var path2 = require("node:path");
-    var matrix = require_matrix();
     var registryContract = require_registry();
     var { writeAtomic } = require_fs();
     var policies = require_policies();
     var CONTRACT_TTL_MS = 60 * 1e3;
-    function platformTag() {
-      return matrix.npmTag();
-    }
-    function reloadContractIfStale(state) {
-      const now = Date.now();
-      if (state._contractLoadedAt && now - state._contractLoadedAt < CONTRACT_TTL_MS) return;
-      loadRegistryConfig(state);
-      state._contractLoadedAt = now;
-    }
     function loadRegistryConfig(state) {
       state.contract = registryContract.read(state.registryFile);
       if (!state.contract.ok) {
@@ -6936,6 +6976,12 @@ var require_registry2 = __commonJS({
         state.logger.warn && state.logger.warn("dist: registry config load failed: " + e.message);
       }
     }
+    function reloadContractIfStale(state) {
+      const now = Date.now();
+      if (state._contractLoadedAt && now - state._contractLoadedAt < CONTRACT_TTL_MS) return;
+      loadRegistryConfig(state);
+      state._contractLoadedAt = now;
+    }
     function saveRegistryConfig(state) {
       if (!state.registryFile) return;
       try {
@@ -6966,6 +7012,85 @@ var require_registry2 = __commonJS({
       doc.manualOrigin = rc.manualOrigin;
       writeAtomic(f, JSON.stringify(doc, null, 2) + "\n", { mode: 384 });
     }
+    module2.exports = {
+      CONTRACT_TTL_MS,
+      loadRegistryConfig,
+      reloadContractIfStale,
+      saveRegistryConfig
+    };
+  }
+});
+
+// src/platform/contract/matrix.js
+var require_matrix = __commonJS({
+  "src/platform/contract/matrix.js"(exports2, module2) {
+    "use strict";
+    var SUPPORTED = [
+      { platform: "linux", arch: "x64", osTag: "linux", npmTag: "linux-x64" },
+      { platform: "darwin", arch: "arm64", osTag: "darwin", npmTag: "darwin-arm64" },
+      { platform: "darwin", arch: "x64", osTag: "darwin", npmTag: "darwin-x64" },
+      { platform: "win32", arch: "x64", osTag: "win", npmTag: "win-x64" }
+    ];
+    var OS_TAG = { linux: "linux", darwin: "darwin", win32: "win" };
+    var FRP_OS = { linux: "linux", darwin: "darwin", win32: "windows" };
+    var FRP_ARCH = { x64: "amd64", arm64: "arm64" };
+    function osTag(platform) {
+      return OS_TAG[platform || process.platform] || null;
+    }
+    function current(platform, arch) {
+      const p = platform || process.platform;
+      const a = arch || process.arch;
+      return { platform: p, arch: a, osTag: OS_TAG[p] || null, npmTag: npmTag(p, a) };
+    }
+    function npmTag(platform, arch) {
+      const p = platform || process.platform;
+      const a = arch || process.arch;
+      const os2 = OS_TAG[p];
+      if (!os2 || a !== "x64" && a !== "arm64") {
+        throw new Error("\u4E0D\u652F\u6301\u7684\u5E73\u53F0\u7EC4\u5408: " + p + "/" + a + "\uFF08\u4EC5 linux/darwin/win32 \xD7 x64/arm64\uFF09");
+      }
+      return os2 + "-" + a;
+    }
+    function isSupported(platform, arch) {
+      const p = platform || process.platform;
+      const a = arch || process.arch;
+      return SUPPORTED.some((x) => x.platform === p && x.arch === a);
+    }
+    function frpTag(platform, arch) {
+      const p = platform || process.platform;
+      const a = arch || process.arch;
+      const os2 = FRP_OS[p];
+      const am = FRP_ARCH[a];
+      if (!os2 || !am) return null;
+      return { os: os2, arch: am, tag: os2 + "_" + am, exe: p === "win32" };
+    }
+    function supportsProcessGroup(platform) {
+      return (platform || process.platform) !== "win32";
+    }
+    module2.exports = {
+      SUPPORTED,
+      osTag,
+      current,
+      npmTag,
+      isSupported,
+      frpTag,
+      supportsProcessGroup
+    };
+  }
+});
+
+// src/platform/distribution/registry.js
+var require_registry2 = __commonJS({
+  "src/platform/distribution/registry.js"(exports2, module2) {
+    "use strict";
+    var matrix = require_matrix();
+    var policies = require_policies();
+    var ref = require_registry_ref();
+    var config = require_registry_config();
+    var PROBE_MAX_BODY_BYTES = 8 * 1024 * 1024;
+    function platformTag() {
+      return matrix.npmTag();
+    }
     async function probeRegistry(state, origin) {
       const spec = state.contract && state.contract.ok && state.contract.probe || null;
       let tag = null;
@@ -6975,106 +7100,154 @@ var require_registry2 = __commonJS({
         tag = null;
       }
       const target = policies.resolveProbe(origin, spec, tag);
-      const start = Date.now();
-      try {
-        const res = await fetch(target.url, { signal: AbortSignal.timeout(target.timeoutMs), redirect: "manual" });
-        const ok = res.status >= 200 && res.status < 300;
-        return { ok, latencyMs: Date.now() - start, probe: target.kind };
-      } catch (e) {
-        return { ok: false, latencyMs: Date.now() - start, probe: target.kind };
+      if (!target.url) {
+        return { ok: false, latencyMs: 0, probe: target.kind, error: target.violation || "\u955C\u50CF\u57FA\u5740\u975E\u6CD5" };
       }
+      const start = Date.now();
+      const r = await ref.fetchRegistry(target.url, {
+        timeoutMs: target.timeoutMs,
+        expect: "text",
+        maxBytes: PROBE_MAX_BODY_BYTES
+      });
+      return { ok: !!r.ok, latencyMs: Date.now() - start, probe: target.kind, error: r.error || null };
     }
     async function probeOrigin(state, origin) {
-      const o = policies.normalizeOrigin(origin);
-      if (!policies.isValidOrigin(o)) return { origin: o, ok: false, latencyMs: null, error: "\u975E\u6CD5 origin" };
-      const p = await probeRegistry(state, o);
-      return { origin: o, ok: !!p.ok, latencyMs: p.latencyMs, probe: p.probe };
+      const parsed = ref.parseRegistryBase(origin);
+      if (!parsed.ok) return { origin: ref.normalizeBase(origin), ok: false, latencyMs: null, error: parsed.violation };
+      const p = await probeRegistry(state, parsed.base);
+      return { origin: parsed.base, ok: !!p.ok, latencyMs: p.latencyMs, probe: p.probe, error: p.error || null };
     }
     function registryOrigins(state) {
-      return policies.effectiveOrigins(state.registryConfig, state.defaultRegistries);
+      const seen = /* @__PURE__ */ new Set();
+      const out = [];
+      for (const raw of policies.effectiveOrigins(state.registryConfig, state.defaultRegistries)) {
+        const parsed = ref.parseRegistryBase(raw);
+        const base = parsed.ok ? parsed.base : ref.normalizeBase(raw);
+        if (seen.has(base)) continue;
+        seen.add(base);
+        out.push(base);
+      }
+      return out;
+    }
+    async function probeAllOrigins(state, origins) {
+      const results = await Promise.all(origins.map(async (origin) => {
+        const p = await probeRegistry(state, origin);
+        return { origin, ok: !!p.ok, latencyMs: p.latencyMs, error: p.error || null };
+      }));
+      results.sort((a, b) => a.ok === b.ok ? a.latencyMs - b.latencyMs : a.ok ? -1 : 1);
+      return results;
+    }
+    function orderFor(primary, origins, results) {
+      const usable = (o) => ref.parseRegistryBase(o).ok;
+      const ranked = (results || []).filter((r) => r.ok).map((r) => r.origin);
+      const ordered = [];
+      for (const o of [primary, ...ranked, ...origins]) {
+        if (!o || !usable(o)) continue;
+        if (!ordered.includes(o)) ordered.push(o);
+      }
+      return ordered;
     }
     async function selectRegistry(state, force) {
-      reloadContractIfStale(state);
+      config.reloadContractIfStale(state);
       const rc = state.registryConfig || {};
-      if (rc.mode === "manual" && rc.manualOrigin) {
-        const origin = policies.normalizeOrigin(rc.manualOrigin);
-        state.selectedRegistry = { origin, latencyMs: null, checkedAt: Date.now(), manual: true, probes: [] };
-        return origin;
-      }
+      const origins = registryOrigins(state);
+      const manualParsed = ref.parseRegistryBase(rc.manualOrigin);
+      const manualBase = manualParsed.ok ? manualParsed.base : "";
+      const manual = rc.mode === "manual" && !!manualBase;
       const now = Date.now();
-      if (!force && state.selectedRegistry && !state.selectedRegistry.manual && state.selectedRegistry.checkedAt && now - state.selectedRegistry.checkedAt < 30 * 60 * 1e3) {
-        return state.selectedRegistry.origin;
+      const cached = state.selectedRegistry;
+      if (!force && cached && cached.checkedAt && now - cached.checkedAt < 30 * 60 * 1e3) {
+        return cached;
       }
       const c = state.contract;
-      if (!force && c && c.ok && c.selected) {
+      if (!force && !manual && c && c.ok && c.selected) {
         const age = Math.floor(Date.now() / 1e3) - c.selected.checkedAt;
-        if (age >= 0 && age < 30 * 60) {
+        const adopted = ref.parseRegistryBase(c.selected.origin);
+        if (age >= 0 && age < 30 * 60 && adopted.ok) {
+          const origin = adopted.base;
           state.selectedRegistry = {
-            origin: c.selected.origin,
-            latencyMs: c.selected.latencyMs,
-            checkedAt: Date.now(),
-            manual: false,
+            origin,
+            ordered: orderFor(origin, origins, null),
             source: "shell",
-            probes: []
+            manual: false,
+            checkedAt: now,
+            latencyMs: Number.isFinite(c.selected.latencyMs) ? c.selected.latencyMs : null,
+            probes: [{ origin, ok: true, latencyMs: c.selected.latencyMs, error: null, from: "shell-contract" }]
           };
           if (state.events) {
             try {
-              state.events.append("dist_registry_selected", { origin: c.selected.origin, source: "shell-contract" });
+              state.events.append("dist_registry_selected", { origin, source: "shell-contract" });
             } catch {
             }
           }
-          return c.selected.origin;
+          return state.selectedRegistry;
         }
-      }
-      const origins = registryOrigins(state);
-      const results = await Promise.all(origins.map(async (origin) => {
-        const p = await probeRegistry(state, origin);
-        return { origin, ok: p.ok, latencyMs: p.latencyMs };
-      }));
-      const picked = policies.pickFastestReachable(results);
-      if (!picked) {
-        state.selectedRegistry = { origin: null, latencyMs: null, checkedAt: null, manual: false, probes: results };
-        if (state.events) {
-          state.events.append("dist_registry_unreachable", {
-            candidates: results.map((r) => r.origin + ":" + r.latencyMs + "ms")
-          });
+        if (!adopted.ok && state.logger && state.logger.warn) {
+          state.logger.warn("dist: \u5951\u7EA6 selected \u57FA\u5740\u975E\u6CD5\uFF0C\u6539\u4E3A\u81EA\u884C\u6D4B\u901F\uFF08" + adopted.violation + "\uFF09");
         }
-        return null;
       }
-      state.selectedRegistry = {
-        origin: picked.origin,
-        latencyMs: picked.latencyMs,
-        checkedAt: Date.now(),
-        manual: false,
+      const results = await probeAllOrigins(state, origins);
+      const firstReachable = results.find((r) => r.ok);
+      const primary = manual ? manualBase : firstReachable && firstReachable.origin || null;
+      const selected = {
+        origin: primary,
+        ordered: orderFor(primary, origins, results),
+        source: manual ? "manual" : firstReachable ? "probe" : "unreachable",
+        manual,
+        checkedAt: firstReachable || manual ? now : null,
+        // 全不可达不缓存坏选择：下次调用仍会重测
+        latencyMs: firstReachable && firstReachable.origin === primary ? firstReachable.latencyMs : null,
         probes: results
       };
+      state.selectedRegistry = selected;
       if (state.events) {
-        state.events.append("dist_registry_selected", {
-          origin: picked.origin,
-          latencyMs: picked.latencyMs,
-          candidates: results.map((r) => r.origin + ":" + r.latencyMs + "ms")
-        });
+        try {
+          state.events.append(firstReachable || manual ? "dist_registry_selected" : "dist_registry_unreachable", {
+            origin: primary,
+            source: selected.source,
+            candidates: results.map((r) => r.origin + ":" + (r.ok ? r.latencyMs + "ms" : r.error || "\u4E0D\u53EF\u8FBE"))
+          });
+        } catch {
+        }
       }
-      return picked.origin;
+      return selected;
+    }
+    async function registryOrigin(state, force) {
+      const sel = await selectRegistry(state, force);
+      return sel && sel.origin || null;
     }
     async function registryInfo(state) {
-      reloadContractIfStale(state);
-      const origin = await selectRegistry(state, false);
+      config.reloadContractIfStale(state);
+      const sel = await selectRegistry(state, false) || {};
       const rc = state.registryConfig || {};
       const c = state.contract;
-      const sel = state.selectedRegistry;
+      const verdictOf = (origin) => (sel.probes || []).find((p) => p.origin === origin) || null;
       return {
-        origin,
+        origin: sel.origin || null,
+        ordered: sel.ordered || [],
+        source: sel.source || null,
         mode: rc.mode || "auto",
         manualOrigin: rc.manualOrigin || "",
         candidates: registryOrigins(state).map((o) => ({ origin: o })),
+        registries: registryOrigins(state).map((o) => {
+          const parsed = ref.parseRegistryBase(o);
+          const v = verdictOf(o);
+          return {
+            base: parsed.base,
+            usable: parsed.ok,
+            violation: parsed.violation,
+            reachable: v ? v.ok : null,
+            latencyMs: v ? v.latencyMs : null,
+            error: v ? v.error || null : null
+          };
+        }),
         // 预设 = 壳投放的目录；契约不可用时为空数组，UI 应展示 candidates。
         presets: c && c.ok ? c.catalog : [],
         catalogSource: c && c.ok ? c.writtenBy || "shell" : "fallback",
-        latencyMs: sel && sel.latencyMs || null,
-        checkedAt: sel && sel.checkedAt || null,
-        manual: !!(sel && sel.manual),
-        probes: sel && sel.probes || []
+        latencyMs: sel.latencyMs || null,
+        checkedAt: sel.checkedAt || null,
+        manual: !!sel.manual,
+        probes: sel.probes || []
       };
     }
     async function setRegistryConfig(state, cfg) {
@@ -7111,7 +7284,7 @@ var require_registry2 = __commonJS({
         }
       }
       state.registryConfig = rc;
-      saveRegistryConfig(state);
+      config.saveRegistryConfig(state);
       state.selectedRegistry = null;
       const info = await registryInfo(state);
       if (rejected.length) {
@@ -7123,21 +7296,117 @@ var require_registry2 = __commonJS({
       return info;
     }
     module2.exports = {
-      CONTRACT_TTL_MS,
       platformTag,
-      reloadContractIfStale,
-      loadRegistryConfig,
-      saveRegistryConfig,
       probeRegistry,
       probeOrigin,
+      probeAllOrigins,
       registryOrigins,
+      orderFor,
       selectRegistry,
+      registryOrigin,
       registryInfo,
       setRegistryConfig
     };
   }
 });
 
+// src/platform/distribution/version-check.js
+var require_version_check = __commonJS({
+  "src/platform/distribution/version-check.js"(exports2, module2) {
+    "use strict";
+    var { VERSION_RE } = require_version2();
+    var input = require_input();
+    var policies = require_policies();
+    var registry = require_registry2();
+    var ref = require_registry_ref();
+    var release = require_release();
+    var PKG_NAME_RE = input.PKG_NAME_RE;
+    var METADATA_TIMEOUT_MS = 8e3;
+    var FETCH_BUDGET_MS = 25e3;
+    async function versionFromOrigin(state, base, pkg) {
+      const url = ref.registryUrl(base, ref.registryPackagePath(pkg));
+      const res = await ref.fetchRegistry(url, { timeoutMs: METADATA_TIMEOUT_MS, expect: "json" });
+      if (!res.ok) return { version: null, error: res.error || "HTTP " + res.status };
+      const picked = release.pickReleaseVersion(res.json, {
+        isOurs: release.isOurReleasePackage(pkg),
+        canary: policies.isInCanaryList(state),
+        // 仅 isOurs 分支消费
+        isValid: (v2) => typeof v2 === "string" && VERSION_RE.test(v2)
+      });
+      if (picked) return { version: picked, error: null };
+      const lr = await ref.fetchRegistry(
+        ref.registryUrl(base, ref.registryPackagePath(pkg), "latest"),
+        { timeoutMs: METADATA_TIMEOUT_MS, expect: "json" }
+      );
+      if (!lr.ok) return { version: null, error: lr.error || "HTTP " + lr.status };
+      const v = lr.json && typeof lr.json.version === "string" && VERSION_RE.test(lr.json.version) ? lr.json.version : null;
+      return { version: v, error: v ? null : "\u5143\u6570\u636E\u65E0\u53EF\u7528\u7248\u672C" };
+    }
+    async function fetchNpmLatest(state, pkg, opts) {
+      const o = opts || {};
+      const fail = (error, attempts2) => ({ ok: false, version: null, origin: null, attempts: attempts2 || [], error });
+      if (!pkg) return fail("\u7F3A\u5C11\u5305\u540D");
+      if (!PKG_NAME_RE.test(pkg)) return fail("\u975E\u6CD5\u5305\u540D\uFF08\u5B57\u7B26\u96C6\u767D\u540D\u5355\u4E0D\u901A\u8FC7\uFF09: " + String(pkg).slice(0, 80));
+      let candidates = [];
+      if (o.authoritative) {
+        const list = registry.registryOrigins(state).filter((x) => ref.parseRegistryBase(x).ok);
+        candidates = list.filter((x) => /registry\.npmjs\.org/.test(x));
+        if (!candidates.length && list.length) candidates = [list[0]];
+      } else {
+        const sel = await registry.selectRegistry(state, false);
+        candidates = sel && sel.ordered || [];
+      }
+      if (!candidates.length) return fail("\u65E0\u53EF\u7528\u7684\u955C\u50CF\u6E90\u5019\u9009\uFF08\u5168\u90E8\u57FA\u5740\u975E\u6CD5\u6216\u5217\u8868\u4E3A\u7A7A\uFF09");
+      const attempts = [];
+      const deadline = Date.now() + FETCH_BUDGET_MS;
+      for (let i = 0; i < candidates.length; i++) {
+        if (i && Date.now() >= deadline) {
+          attempts.push({ origin: candidates.slice(i).join(","), error: "\u672A\u5C1D\u8BD5\uFF08\u8D85\u51FA " + Math.round(FETCH_BUDGET_MS / 1e3) + "s \u603B\u9884\u7B97\uFF09" });
+          break;
+        }
+        const base = candidates[i];
+        const r = await versionFromOrigin(state, base, pkg);
+        if (r.version) return { ok: true, version: r.version, origin: base, attempts, error: null };
+        attempts.push({ origin: base, error: r.error || "\u672A\u53D6\u5230\u7248\u672C" });
+      }
+      return fail("\u5168\u90E8\u955C\u50CF\u672A\u53D6\u5230 " + pkg + " \u7684\u7248\u672C\uFF1A" + attempts.map((a) => a.origin + "=" + a.error).join("; "), attempts);
+    }
+    async function fetchGithubLatest(owner, repo) {
+      if (!owner || !repo) return null;
+      try {
+        const res = await fetch(
+          "https://api.github.com/repos/" + encodeURIComponent(owner) + "/" + encodeURIComponent(repo) + "/releases/latest",
+          { signal: AbortSignal.timeout(1e4), headers: { "User-Agent": "dsh-supervisor" } }
+        );
+        if (!res.ok) return null;
+        const j = await res.json();
+        const tag = j && typeof j.tag_name === "string" ? j.tag_name : j && typeof j.name === "string" ? j.name : null;
+        if (!tag) return null;
+        return String(tag).replace(/^v/, "");
+      } catch (e) {
+        return null;
+      }
+    }
+    async function fetchLatestVersion(state, pkg, channel, opts) {
+      const ch = channel || "npm";
+      const o = opts || {};
+      if (ch === "github") {
+        const slash = String(pkg).split("/");
+        if (slash.length >= 2) return fetchGithubLatest(slash[0], slash.slice(1).join("/"));
+        return null;
+      }
+      const r = await fetchNpmLatest(state, pkg, { authoritative: o.authoritative === true });
+      return r.ok ? r.version : null;
+    }
+    module2.exports = {
+      METADATA_TIMEOUT_MS,
+      FETCH_BUDGET_MS,
+      fetchNpmLatest,
+      fetchLatestVersion
+    };
+  }
+});
+
 // src/platform/contract/runtime.js
 var require_runtime = __commonJS({
   "src/platform/contract/runtime.js"(exports2, module2) {
@@ -7215,72 +7484,11 @@ var require_install = __commonJS({
     var runtimeContract = require_runtime();
     var service = require_service().current();
     var { VERSION_RE } = require_version2();
-    var release = require_release();
-    var registry = require_registry2();
-    var policies = require_policies();
+    var ref = require_registry_ref();
     var input = require_input();
     var PKG_NAME_RE = input.PKG_NAME_RE;
     var BAD_ARGV_CHAR_RE = input.ARGV_UNSAFE_RE;
     var WIN_DRIVE_ABS_RE = input.WIN_ABS_PATH_RE;
-    async function fetchNpmLatest(state, pkg, opts) {
-      if (!pkg) return null;
-      const o = opts || {};
-      let origin = null;
-      if (o.authoritative) {
-        const list = registry.registryOrigins(state);
-        origin = list.find((x) => /registry\.npmjs\.org/.test(x)) || list[0] || "https://registry.npmjs.org";
-      } else {
-        origin = await registry.selectRegistry(state, false);
-      }
-      if (!origin) return null;
-      const base = policies.normalizeOrigin(origin);
-      if (!policies.isValidOrigin(base)) return null;
-      if (!PKG_NAME_RE.test(pkg)) return null;
-      try {
-        const res = await fetch(base + "/" + encodeURIComponent(pkg), { signal: AbortSignal.timeout(1e4) });
-        if (!res.ok) return null;
-        const j = await res.json();
-        const picked = release.pickReleaseVersion(j, {
-          isOurs: release.isOurReleasePackage(pkg),
-          canary: policies.isInCanaryList(state),
-          // 仅 isOurs 分支消费
-          isValid: (v) => typeof v === "string" && VERSION_RE.test(v)
-        });
-        if (picked) return picked;
-        const lr = await fetch(base + "/" + encodeURIComponent(pkg) + "/latest", { signal: AbortSignal.timeout(8e3) });
-        if (!lr.ok) return null;
-        const lj = await lr.json();
-        return lj && typeof lj.version === "string" && VERSION_RE.test(lj.version) ? lj.version : null;
-      } catch (e) {
-        return null;
-      }
-    }
-    async function fetchGithubLatest(owner, repo) {
-      if (!owner || !repo) return null;
-      try {
-        const res = await fetch(
-          "https://api.github.com/repos/" + encodeURIComponent(owner) + "/" + encodeURIComponent(repo) + "/releases/latest",
-          { signal: AbortSignal.timeout(1e4), headers: { "User-Agent": "dsh-supervisor" } }
-        );
-        if (!res.ok) return null;
-        const j = await res.json();
-        const tag = j && typeof j.tag_name === "string" ? j.tag_name : j && typeof j.name === "string" ? j.name : null;
-        if (!tag) return null;
-        return String(tag).replace(/^v/, "");
-      } catch (e) {
-        return null;
-      }
-    }
-    async function fetchLatestVersion(state, pkg, channel, opts) {
-      const ch = channel || "npm";
-      const o = opts || {};
-      if (ch === "github") {
-        const slash = String(pkg).split("/");
-        if (slash.length >= 2) return fetchGithubLatest(slash[0], slash.slice(1).join("/"));
-        return null;
-      }
-      return fetchNpmLatest(state, pkg, { authoritative: o.authoritative === true });
-    }
     var INFLIGHT_NPM = /* @__PURE__ */ new Set();
     function inflightNpmCount() {
       return INFLIGHT_NPM.size;
@@ -7329,11 +7537,12 @@ var require_install = __commonJS({
       }
       const envVars = runtimeContract.withPath(process.env);
       if (o.registry) {
-        if (!policies.isValidOrigin(o.registry)) {
-          return Promise.resolve({ ok: false, error: "runNpmInstall: \u975E\u6CD5 registry origin\uFF08\u987B\u4E3A\u7EAF http(s) origin\uFF09: " + String(o.registry).slice(0, 80), output: [] });
+        const rv = ref.parseRegistryBase(o.registry);
+        if (!rv.ok) {
+          return Promise.resolve({ ok: false, error: "runNpmInstall: \u975E\u6CD5 registry \u57FA\u5740\uFF08" + rv.violation + "\uFF09: " + String(o.registry).slice(0, 80), output: [] });
         }
-        envVars.npm_config_registry = o.registry;
-        envVars.NPM_CONFIG_REGISTRY = o.registry;
+        envVars.npm_config_registry = rv.base;
+        envVars.NPM_CONFIG_REGISTRY = rv.base;
       }
       return new Promise((resolve) => {
         let child;
@@ -7443,9 +7652,6 @@ var require_install = __commonJS({
       PKG_NAME_RE,
       BAD_ARGV_CHAR_RE,
       WIN_DRIVE_ABS_RE,
-      fetchNpmLatest,
-      fetchGithubLatest,
-      fetchLatestVersion,
       runNpmInstall,
       waitPortHealthy,
       // 在途 npm 的记账/中止出口（关停路径经 platform/distribution 门面 re-export）
@@ -7461,7 +7667,9 @@ var require_distribution = __commonJS({
     "use strict";
     var policies = require_policies();
     var release = require_release();
+    var registryConfig = require_registry_config();
     var registry = require_registry2();
+    var versionCheck = require_version_check();
     var install = require_install();
     var { semverCompare, VERSION_RE } = require_version2();
     var DistributionManager = class {
@@ -7475,18 +7683,18 @@ var require_distribution = __commonJS({
         this.registryConfig = { mode: "auto", origins: [...this.defaultRegistries], manualOrigin: this.defaultRegistries[0] || "" };
         this.canary = opts.canary === true;
         this.selectedRegistry = null;
-        registry.loadRegistryConfig(this);
+        registryConfig.loadRegistryConfig(this);
         this._contractLoadedAt = Date.now();
       }
-      // ---- 镜像源（registry.js）----
+      // ---- 镜像源（registry-config.js 载入/落盘，registry.js 探测/选源）----
       _reloadContractIfStale() {
-        registry.reloadContractIfStale(this);
+        registryConfig.reloadContractIfStale(this);
       }
       _loadRegistryConfig() {
-        registry.loadRegistryConfig(this);
+        registryConfig.loadRegistryConfig(this);
       }
       _saveRegistryConfig() {
-        registry.saveRegistryConfig(this);
+        registryConfig.saveRegistryConfig(this);
       }
       _platformTag() {
         return registry.platformTag();
@@ -7503,6 +7711,9 @@ var require_distribution = __commonJS({
       selectRegistry(force) {
         return registry.selectRegistry(this, force);
       }
+      registryOrigin(force) {
+        return registry.registryOrigin(this, force);
+      }
       registryInfo() {
         return registry.registryInfo(this);
       }
@@ -7512,15 +7723,13 @@ var require_distribution = __commonJS({
       _inCanaryList() {
         return policies.isInCanaryList(this);
       }
-      // ---- 版本检查 / 安装 / 健康（install.js）----
+      // ---- 版本检查 / 安装 / 健康（version-check.js + install.js）----
+      // fetchNpmLatest 回结构化结果（含实际给出该版本的 origin 与逐源原因）；fetchLatestVersion 只回版本字符串。
       fetchNpmLatest(pkg, opts) {
-        return install.fetchNpmLatest(this, pkg, opts);
-      }
-      fetchGithubLatest(owner, repo) {
-        return install.fetchGithubLatest(owner, repo);
+        return versionCheck.fetchNpmLatest(this, pkg, opts);
       }
       fetchLatestVersion(pkg, channel, opts) {
-        return install.fetchLatestVersion(this, pkg, channel, opts);
+        return versionCheck.fetchLatestVersion(this, pkg, channel, opts);
       }
       runNpmInstall(opts) {
         return install.runNpmInstall(opts);
@@ -12150,7 +12359,8 @@ var require_facets = __commonJS({
       { name: "domain-actions/router", mod: require_router2(), factory: "createRouterActions" },
       { name: "domain-actions/lan", mod: require_lan2(), factory: "createLanActions" },
       { name: "domain-actions/main", mod: require_main2(), factory: "createMainActions" },
-      { name: "audit/orphan-scan", mod: require_orphan_scan() },
+      // audit/orphan-scan 不在本清单：它是真 ctor 工厂（assembly/collaborators.js 的 installAuditFactory
+      //   构造 host.audit），实现体本身只是纯函数，不再需要 host 兼容外壳切面。
       { name: "settings/env", mod: require_env() },
       { name: "settings/node-lts", mod: require_node_lts() },
       { name: "settings/versions", mod: require_versions() },
@@ -13944,7 +14154,7 @@ var require_model = __commonJS({
         adapter: p.adapter || null,
         proxyAppId: p.proxyAppId || null,
         proxyRunning: p.proxyRunning || false,
-        selectedAccountKeyId: p.selectedAccountKeyId || p.selectedProxyKeyId || null,
+        selectedAccountKeyId: p.selectedAccountKeyId || null,
         activeAccountKeyId: p.activeAccount && p.activeAccount.keyId || null,
         accounts: (p.accounts || []).map((a) => {
           p._normalizeConsistency(a);
@@ -14356,7 +14566,6 @@ var require_freeze = __commonJS({
       const usable = !!acc && acc.status === "ready" && (typeof provider.isAccountUsable !== "function" || provider.isAccountUsable(acc));
       if (!usable) {
         provider.selectedAccountKeyId = null;
-        if (provider.selectedProxyKeyId === lockedId) provider.selectedProxyKeyId = null;
       }
     }
     module2.exports = { setStatus, ensureLimit, previewLimit, setLimit, freezeLimited, markCreditsExhausted, markQuotaExhausted, markBanned, applyDetection, normalizeConsistency, reconcileLock };
@@ -15284,7 +15493,7 @@ var require_pkg_cache = __commonJS({
       if (!app || !app.pkg) return { ok: true };
       if (cachedPkgBin(app.pkg)) return { ok: true, cached: true };
       try {
-        const regOrigin = provider.dist ? await provider.dist.selectRegistry(false).catch(() => null) : null;
+        const regOrigin = provider.dist ? await provider.dist.registryOrigin(false).catch(() => null) : null;
         const env = Object.assign({}, process.env);
         if (regOrigin) {
           env.npm_config_registry = regOrigin;
@@ -15981,7 +16190,7 @@ var require_proxy = __commonJS({
       }
       /** 解析启动命令（缓存优先 + fallback npx）：拼装委托 command.js；凭证剔除留在本层（纪律）。 */
       async _resolveLaunchCommand(app, port, key) {
-        const registry = this.dist ? await this.dist.selectRegistry(false).catch(() => null) : null;
+        const registry = this.dist ? await this.dist.registryOrigin(false).catch(() => null) : null;
         const cachedBin = this._cachedPkgBin(app.pkg);
         const launch = buildCommand({ app, port, cachedBin, registry, launcher: npxLauncher(), execPath: process.execPath });
         if (!launch || !launch.ok) return launch || { ok: false, error: "\u547D\u4EE4\u62FC\u88C5\u5931\u8D25" };
@@ -17616,12 +17825,18 @@ var require_apps_registry = __commonJS({
             continue;
           }
           let ver = null;
+          let why = "\u5206\u53D1\u670D\u52A1\u4E0D\u53EF\u7528";
           try {
-            if (dist) ver = await dist.fetchNpmLatest(a.registry);
-          } catch {
+            if (dist) {
+              const r = await dist.fetchNpmLatest(a.registry);
+              ver = r && r.ok ? r.version : null;
+              why = r && r.ok ? null : r && r.error || "\u672A\u53D6\u5230\u7248\u672C";
+            }
+          } catch (e) {
+            why = e && e.message || String(e);
           }
           const prev = c.latest || null;
-          cache[a.id] = { pkg: a.registry, latest: ver, checkedAt: Date.now(), error: ver ? null : "query failed" };
+          cache[a.id] = { pkg: a.registry, latest: ver, checkedAt: Date.now(), error: ver ? null : why || "query failed" };
           if (ver && prev && ver !== prev && events) events.append("proxy_update_available", { appId: a.id, pkg: a.registry, from: prev, to: ver });
           results[a.id] = ver;
         }
@@ -19996,8 +20211,7 @@ var require_dsh_install = __commonJS({
     function createDshInstall(deps) {
       const { store, dist, tasks, logger, instancesRoot } = deps;
       const save = () => store.save();
-      let _latestDshVer = null;
-      let _latestDshVerAt = 0;
+      let _latestDsh = null;
       function installTimeoutWatchdog(inst, task) {
         try {
           if (inst.state && inst.state.phase === "INSTALLING") {
@@ -20062,49 +20276,38 @@ var require_dsh_install = __commonJS({
             } catch {
             }
           }
-          const env = Object.assign({}, process.env);
-          let reg = null;
-          if (dist) {
-            try {
-              reg = await dist.selectRegistry(false);
-              if (reg) {
-                env.npm_config_registry = reg;
-                env.NPM_CONFIG_REGISTRY = reg;
-              }
-            } catch (e) {
-              logger.warn && logger.warn("sandbox registry select failed: " + e.message);
-            }
-          }
-          const latestVer = await latestDshVersion();
-          pushLog("\u5B89\u88C5\u76EE\u6807\u7248\u672C\uFF1A" + (latestVer || "latest tag"));
-          if (!latestVer) {
+          if (!dist) {
             inst.state.installOk = false;
-            inst.state.installError = "\u65E0\u6CD5\u83B7\u53D6\u6700\u65B0\u7248\u672C";
+            inst.state.installError = "dist \u5206\u53D1\u670D\u52A1\u4E0D\u53EF\u7528";
             save();
             if (task) {
               try {
-                tasks.fail(task.id, "\u65E0\u6CD5\u83B7\u53D6\u6700\u65B0\u7248\u672C");
+                tasks.fail(task.id, "dist \u5206\u53D1\u670D\u52A1\u4E0D\u53EF\u7528");
               } catch {
               }
             }
-            return { ok: false, error: "\u65E0\u6CD5\u83B7\u53D6\u6700\u65B0\u7248\u672C" };
+            return { ok: false, error: "dist \u5206\u53D1\u670D\u52A1\u4E0D\u53EF\u7528" };
           }
-          if (!dist) {
+          const pick = await latestDsh();
+          pushLog("\u5B89\u88C5\u76EE\u6807\u7248\u672C\uFF1A" + (pick.version || "\u672A\u77E5") + (pick.origin ? "\uFF08\u6E90 " + pick.origin + "\uFF09" : ""));
+          if (!pick.version) {
+            const why = "\u65E0\u6CD5\u83B7\u53D6\u6700\u65B0\u7248\u672C\uFF1A" + (pick.error || "\u672A\u77E5\u539F\u56E0");
             inst.state.installOk = false;
-            inst.state.installError = "dist \u5206\u53D1\u670D\u52A1\u4E0D\u53EF\u7528";
+            inst.state.installError = why;
             save();
             if (task) {
               try {
-                tasks.fail(task.id, "dist \u5206\u53D1\u670D\u52A1\u4E0D\u53EF\u7528");
+                tasks.fail(task.id, why);
               } catch {
               }
             }
-            return { ok: false, error: "dist \u5206\u53D1\u670D\u52A1\u4E0D\u53EF\u7528" };
+            return { ok: false, error: why };
           }
+          const latestVer = pick.version;
           const watchdog = setTimeout(() => installTimeoutWatchdog(inst, task), 10 * 60 * 1e3);
           let res;
           try {
-            res = await dist.runNpmInstall({ pkg: "@deepseek-ai/dsh", version: latestVer, prefix: installDir, registry: reg, onLine: pushLog });
+            res = await dist.runNpmInstall({ pkg: "@deepseek-ai/dsh", version: latestVer, prefix: installDir, registry: pick.origin, onLine: pushLog });
           } finally {
             clearTimeout(watchdog);
           }
@@ -20150,18 +20353,24 @@ var require_dsh_install = __commonJS({
           return null;
         }
       }
-      async function latestDshVersion() {
-        if (_latestDshVer && Date.now() - _latestDshVerAt < 3e4) return _latestDshVer;
-        let v = null;
-        try {
-          if (dist) v = await dist.fetchNpmLatest("@deepseek-ai/dsh");
-        } catch {
+      async function latestDsh() {
+        if (_latestDsh && Date.now() - _latestDsh.at < 3e4) return _latestDsh;
+        let r = { ok: false, version: null, origin: null, attempts: [], error: "dist \u5206\u53D1\u670D\u52A1\u4E0D\u53EF\u7528" };
+        if (dist) {
+          try {
+            r = await dist.fetchNpmLatest("@deepseek-ai/dsh");
+          } catch (e) {
+            r = { ok: false, version: null, origin: null, attempts: [], error: e && e.message || String(e) };
+          }
         }
-        _latestDshVer = v;
-        _latestDshVerAt = Date.now();
-        return v;
+        if (r.ok && r.version) _latestDsh = Object.assign({ at: Date.now() }, r);
+        return r;
       }
-      return { installSandbox, readInstalledVersion, latestDshVersion };
+      async function latestDshVersion() {
+        const r = await latestDsh();
+        return r.version;
+      }
+      return { installSandbox, readInstalledVersion, latestDsh, latestDshVersion };
     }
     module2.exports = { createDshInstall };
   }
@@ -20209,6 +20418,9 @@ var require_upgrade = __commonJS({
       function readInstalledVersion(inst) {
         return install.readInstalledVersion(inst);
       }
+      async function latestDsh() {
+        return install.latestDsh();
+      }
       async function latestDshVersion() {
         return install.latestDshVersion();
       }
@@ -20239,8 +20451,9 @@ var require_upgrade = __commonJS({
         let latest = cached && cached.latest || null;
         if (!latest || !cached || Date.now() - cached.checkedAt > _updTTL) {
           try {
-            latest = await dist.fetchNpmLatest("@deepseek-ai/dsh");
-            _updCache[id] = { latest, checkedAt: Date.now(), error: latest ? null : "\u67E5\u8BE2\u5931\u8D25" };
+            const pick = await dist.fetchNpmLatest("@deepseek-ai/dsh");
+            latest = pick.ok ? pick.version : null;
+            _updCache[id] = { latest, checkedAt: Date.now(), error: pick.ok ? null : pick.error || "\u67E5\u8BE2\u5931\u8D25" };
           } catch (e) {
             latest = null;
             _updCache[id] = { latest: null, checkedAt: Date.now(), error: e.message };
@@ -20267,16 +20480,6 @@ var require_upgrade = __commonJS({
         _updJobs[id] = nj;
         (async () => {
           const installDir = sandbox.installDir(instancesRoot, inst);
-          const env = Object.assign({}, process.env);
-          let reg = null;
-          try {
-            reg = await dist.selectRegistry(false);
-            if (reg) {
-              env.npm_config_registry = reg;
-              env.NPM_CONFIG_REGISTRY = reg;
-            }
-          } catch {
-          }
           let wasRunning = false;
           try {
             wasRunning = lifecycle.probe(inst).running;
@@ -20303,12 +20506,15 @@ var require_upgrade = __commonJS({
             const s = tasks.step(task.id, "\u5B89\u88C5\u6700\u65B0\u7248");
             tasks.stepState(task.id, tasks.get(task.id).steps.indexOf(s), "running");
           }
-          const targetVer = await latestDshVersion();
-          if (task) tasks.log(task.id, "\u76EE\u6807\u7248\u672C\uFF1A" + (targetVer || "latest tag"));
+          const pick = await latestDsh();
+          const targetVer = pick.version;
+          const reg = pick.origin;
+          if (task) tasks.log(task.id, "\u76EE\u6807\u7248\u672C\uFF1A" + (targetVer || "\u672A\u77E5") + (reg ? "\uFF08\u6E90 " + reg + "\uFF09" : ""));
           if (!targetVer) {
+            const why = "\u65E0\u6CD5\u83B7\u53D6\u6700\u65B0\u7248\u672C\uFF1A" + (pick.error || "\u672A\u77E5\u539F\u56E0");
             nj.errors++;
-            nj.error = "\u65E0\u6CD5\u83B7\u53D6\u6700\u65B0\u7248\u672C";
-            if (task) tasks.log(task.id, "\u65E0\u6CD5\u83B7\u53D6\u6700\u65B0\u7248\u672C");
+            nj.error = why;
+            if (task) tasks.log(task.id, why);
           } else {
             if (!dist) {
               nj.errors++;
@@ -21074,6 +21280,7 @@ var require_market_sources = __commonJS({
   "src/domains/plugin/market-sources.js"(exports2, module2) {
     "use strict";
     var { getJson, getText } = require_market_net();
+    var ref = require_registry_ref();
     var RAW_MIRRORS = ["https://gh-proxy.com/", "https://ghproxy.net/"];
     async function rawGet(pathPart, isJson, timeoutMs = 15e3) {
       const direct = "https://raw.githubusercontent.com/" + pathPart;
@@ -21087,12 +21294,10 @@ var require_market_sources = __commonJS({
       throw new Error("raw fetch failed for " + pathPart);
     }
     async function fetchLatest(origin, name) {
-      try {
-        const base = String(origin || "").replace(/\/+$/, "");
-        return await getJson(base + "/" + encodeURIComponent(name) + "/latest", 8e3);
-      } catch {
-        return null;
-      }
+      const url = ref.registryUrl(origin, ref.registryPackagePath(name), "latest");
+      if (!url) return null;
+      const r = await ref.fetchRegistry(url, { timeoutMs: 8e3, expect: "json" });
+      return r.ok ? r.json : null;
     }
     async function repoPkg(fullName) {
       for (const branch of ["master", "main"]) {
@@ -21407,16 +21612,16 @@ var require_market = __commonJS({
         }
         return out;
       }
-      /** npm 镜像源 origin（经 dist 统一选择；dist 不可达降级官方源）。 */
+      /** npm 镜像源基址（经 dist 统一选择；dist 不可达降级官方源）。尾斜杠归一交给 registry-ref。 */
       async _npmOrigin() {
         let origin = null;
         if (this.dist) {
           try {
-            origin = await this.dist.selectRegistry(false);
+            origin = await this.dist.registryOrigin(false);
           } catch {
           }
         }
-        return (origin || REGISTRY).replace(/\/+$/, "");
+        return origin || REGISTRY;
       }
       /** npm 最新版元数据查询（镜像源选择见 _npmOrigin）。 */
       async safeFetchLatest(name) {
@@ -21872,7 +22077,7 @@ var require_cli = __commonJS({
     async function registryOrigin(dist) {
       if (dist) {
         try {
-          return dist.selectRegistry(false);
+          return await dist.registryOrigin(false);
         } catch {
         }
       }
@@ -22443,6 +22648,23 @@ var require_updater = __commonJS({
   "src/domains/plugin/updater.js"(exports2, module2) {
     "use strict";
     var { specType, isUpdateAvailable } = require_policies2();
+    async function latestCached(ctx, name, force) {
+      const c = ctx._updCache[name];
+      if (c && !force && Date.now() - c.at < ctx._updTTL) return { latest: c.latest, error: null };
+      let latest = null;
+      let error = "\u5206\u53D1\u670D\u52A1\u4E0D\u53EF\u7528";
+      if (ctx.dist) {
+        try {
+          const r = await ctx.dist.fetchNpmLatest(name);
+          latest = r && r.ok ? r.version : null;
+          error = r && r.ok ? null : r && r.error || "\u672A\u53D6\u5230\u7248\u672C";
+        } catch (e) {
+          error = e && e.message || String(e);
+        }
+      }
+      if (latest !== null) ctx._updCache[name] = { latest, at: Date.now() };
+      return { latest, error };
+    }
     async function checkUpdates(ctx, force) {
       const targets = [ctx._nativeTarget(), ...ctx._allSandboxTargets()];
       const meta = /* @__PURE__ */ new Map();
@@ -22451,17 +22673,7 @@ var require_updater = __commonJS({
           if (meta.has(p.name)) continue;
           const st = specType(p.source);
           let latest = null;
-          const c = ctx._updCache[p.name];
-          if (c && !force && Date.now() - c.at < ctx._updTTL) latest = c.latest;
-          else {
-            if (st === "npm" && ctx.dist) {
-              try {
-                latest = await ctx.dist.fetchNpmLatest(p.name);
-              } catch {
-              }
-            }
-            if (latest !== null) ctx._updCache[p.name] = { latest, at: Date.now() };
-          }
+          if (st === "npm" && ctx.dist) latest = (await latestCached(ctx, p.name, force)).latest;
           meta.set(p.name, { specType: st, latest });
         }
       }
@@ -22494,19 +22706,9 @@ var require_updater = __commonJS({
         const desc = targetStr === "all" ? "\u4EFB\u4F55\u76EE\u6807" : "\u76EE\u6807\u300C" + (targetStr || "native") + "\u300D";
         return { ok: false, error: desc + " \u672A\u5B89\u88C5\u63D2\u4EF6 " + name };
       }
-      let latest = null;
-      const c = ctx._updCache[name];
-      if (c && Date.now() - c.at < ctx._updTTL) latest = c.latest;
-      else {
-        if (ctx.dist) {
-          try {
-            latest = await ctx.dist.fetchNpmLatest(name);
-          } catch {
-          }
-        }
-        if (latest !== null) ctx._updCache[name] = { latest, at: Date.now() };
-      }
-      if (!latest) return { ok: false, error: "\u65E0\u6CD5\u83B7\u53D6 " + name + " \u7684\u6700\u65B0\u7248\u672C\uFF08registry \u4E0D\u53EF\u8FBE\uFF09\uFF0C\u8BF7\u68C0\u67E5\u7F51\u7EDC\u540E\u91CD\u8BD5" };
+      const pick = await latestCached(ctx, name, false);
+      const latest = pick.latest;
+      if (!latest) return { ok: false, error: "\u65E0\u6CD5\u83B7\u53D6 " + name + " \u7684\u6700\u65B0\u7248\u672C\uFF08" + (pick.error || "registry \u4E0D\u53EF\u8FBE") + "\uFF09\uFF0C\u8BF7\u68C0\u67E5\u7F51\u7EDC\u540E\u91CD\u8BD5" };
       const job = ctx.jobs.createJob("update", name, targetStr || "native", targets);
       if (ctx.events) ctx.events.append("plugin_update_started", { name, jobId: job.id, target: job.target, targets: targets.map((t) => t.name) });
       let idx = 0;
@@ -23438,7 +23640,7 @@ var require_npm = __commonJS({
     async function selectRegistry(host2) {
       if (!host2.dist) return null;
       try {
-        return await host2.dist.selectRegistry(true);
+        return await host2.dist.registryOrigin(true);
       } catch {
         return null;
       }
@@ -26911,10 +27113,7 @@ var require_managed = __commonJS({
       const main = typeof mainOf === "function" ? mainOf() : null;
       return main ? [...sandboxes, main] : sandboxes;
     }
-    function findManaged(list, id) {
-      return (list || []).find((x) => x.id === id) || null;
-    }
-    module2.exports = { localAddresses, allManaged, findManaged };
+    module2.exports = { localAddresses, allManaged };
   }
 });
 
@@ -27620,7 +27819,6 @@ var require_ops5 = __commonJS({
         this.instances = opts.instances;
         this.configPath = opts.configPath || "";
         this.mainOf = opts.mainOf || null;
-        this.persist = opts.persist || null;
         this.frp = opts.frp || new FrpManager({ dir: opts.stateDir, logger: this.logger, events: this.events });
         this.lanInstances = [];
         this._reconcileInFlight = null;
@@ -27631,31 +27829,10 @@ var require_ops5 = __commonJS({
       localAddresses() {
         return managed.localAddresses();
       }
-      /** 持久化：优先注入的 persist 路由，否则回退沙箱 instances.save()。 */
-      _saveAll() {
-        if (typeof this.persist === "function") {
-          try {
-            this.persist();
-          } catch (e) {
-            this.logger && this.logger.warn && this.logger.warn("lan persist: " + (e && e.message));
-          }
-          return;
-        }
-        if (this.instances && typeof this.instances.save === "function") {
-          try {
-            this.instances.save();
-          } catch {
-          }
-        }
-      }
       /** 受管 DSH 合成清单（沙箱 + 原生主干 main）。 */
       _allManaged() {
         return managed.allManaged({ instances: this.instances, mainOf: this.mainOf });
       }
-      /** 合成查找：按 id 取首个匹配。 */
-      _findManaged(id) {
-        return managed.findManaged(this._allManaged(), id);
-      }
       /** frpc 子进程句柄只读访问器：不暴露 frp 私有对象，供 daemon 优雅停机等待其退出。 */
       frpChild() {
         return this.frp && this.frp.child || null;
@@ -27935,13 +28112,6 @@ var require_supervisor = __commonJS({
               m.kind = "native";
               return m;
             },
-            persist: () => {
-              try {
-                if (this.instances && this.instances.save) this.instances.save();
-              } catch {
-              }
-              this._writeDshMain({});
-            },
             tokenOf: (id) => this.tokenService.get(id)
           });
         }