@dsh-sup/dsh-core-linux-x64 0.1.6-BETA.7 → 0.1.6-BETA.9

package/core.cjs

@@ -947,7 +947,7 @@ var require_version = __commonJS({
     var fs2 = require("node:fs");
     var path2 = require("node:path");
     function guardVersion() {
-      if (true) return String("0.1.6-BETA.7");
+      if (true) return String("0.1.6-BETA.9");
       try {
         return JSON.parse(fs2.readFileSync(path2.join(__dirname, "..", "..", "package.json"), "utf8")).version || "unknown";
       } catch {
@@ -6509,44 +6509,195 @@ var require_ip = __commonJS({
   }
 });
 
-// src/platform/distribution/policies.js
-var require_policies = __commonJS({
-  "src/platform/distribution/policies.js"(exports2, module2) {
+// src/platform/distribution/registry-ref.js
+var require_registry_ref = __commonJS({
+  "src/platform/distribution/registry-ref.js"(exports2, module2) {
     "use strict";
     var { isPrivateHostLiteral } = require_ip();
-    var FALLBACK_REGISTRIES = [
-      "https://registry.npmjs.org",
-      "https://registry.npmmirror.com"
-    ];
-    function normalizeOrigin(origin) {
-      return String(origin || "").trim().replace(/\/+$/, "");
+    var REDIRECT_MAX_HOPS = 3;
+    var MAX_BODY_BYTES = 32 * 1024 * 1024;
+    var DEFAULT_TIMEOUT_MS = 1e4;
+    function normalizeBase(raw) {
+      return String(raw == null ? "" : raw).trim().replace(/\/+$/, "");
     }
-    function isValidOrigin(origin) {
-      const s = normalizeOrigin(origin);
-      if (!/^https?:\/\/(\[[0-9A-Fa-f:]+\]|[A-Za-z0-9.\-_]+)(:\d+)?$/.test(s)) return false;
+    function hostViolation(host2) {
+      const h = String(host2 || "").toLowerCase().replace(/^\[|\]$/g, "");
+      if (!h) return "\u955C\u50CF\u6E90\u7F3A\u5C11\u4E3B\u673A\u540D";
+      if (isPrivateHostLiteral(h)) return "\u955C\u50CF\u6E90\u4E3B\u673A\u4E0D\u5F97\u4E3A\u56DE\u73AF/\u79C1\u7F51/\u94FE\u8DEF\u672C\u5730/\u4FDD\u7559\u6BB5\u5B57\u9762\u91CF: " + h;
+      return null;
+    }
+    function parseRegistryBase(raw) {
+      const base = normalizeBase(raw);
+      const bad = (violation) => ({ ok: false, base, protocol: "", host: "", violation });
+      if (!base) return bad("\u955C\u50CF\u6E90\u4E3A\u7A7A");
+      if (/[\s]/.test(base)) return bad("\u955C\u50CF\u6E90\u4E0D\u5F97\u542B\u7A7A\u767D\u5B57\u7B26");
       let u;
       try {
-        u = new URL(s);
+        u = new URL(base);
       } catch {
-        return false;
+        return bad("\u955C\u50CF\u6E90\u65E0\u6CD5\u89E3\u6790: " + base);
       }
-      if (u.protocol !== "http:" && u.protocol !== "https:") return false;
-      if (u.username || u.password) return false;
-      if (u.hash) return false;
-      if (!u.hostname) return false;
-      return u.pathname === "" || u.pathname === "/" || u.pathname === "//";
+      if (u.protocol !== "http:" && u.protocol !== "https:") return bad("\u955C\u50CF\u6E90\u5FC5\u987B\u662F http(s) \u534F\u8BAE: " + base);
+      if (u.username || u.password) return bad("\u955C\u50CF\u6E90\u4E0D\u5F97\u643A\u5E26\u7528\u6237\u540D\u6216\u5BC6\u7801: " + base);
+      if (u.search) return bad("\u955C\u50CF\u6E90\u4E0D\u5F97\u643A\u5E26\u67E5\u8BE2\u4E32: " + base);
+      if (u.hash) return bad("\u955C\u50CF\u6E90\u4E0D\u5F97\u643A\u5E26\u7247\u6BB5: " + base);
+      if (!u.hostname) return bad("\u955C\u50CF\u6E90\u7F3A\u5C11\u4E3B\u673A\u540D: " + base);
+      return { ok: true, base, protocol: u.protocol.replace(/:$/, ""), host: u.hostname, violation: null };
     }
-    function registryOriginViolation(origin) {
-      const o = normalizeOrigin(origin);
-      if (!isValidOrigin(o)) return "\u955C\u50CF\u6E90\u5FC5\u987B\u662F http(s) \u7EAF origin\uFF08\u65E0\u8DEF\u5F84/\u67E5\u8BE2/\u51ED\u8BC1\uFF09: " + o;
+    function targetHostViolation(rawUrl, fromUrl) {
       let u;
       try {
-        u = new URL(o);
+        u = new URL(String(rawUrl || ""));
       } catch {
-        return "\u955C\u50CF\u6E90\u65E0\u6CD5\u89E3\u6790: " + o;
+        return "\u8DF3\u8F6C\u76EE\u6807\u65E0\u6CD5\u89E3\u6790";
       }
-      if (isPrivateHostLiteral(u.hostname)) return "\u955C\u50CF\u6E90\u4E3B\u673A\u4E0D\u5F97\u4E3A\u56DE\u73AF/\u79C1\u7F51/\u94FE\u8DEF\u672C\u5730/\u4FDD\u7559\u6BB5\u5B57\u9762\u91CF: " + o;
-      return null;
+      if (u.protocol !== "http:" && u.protocol !== "https:") return "\u8DF3\u8F6C\u76EE\u6807\u534F\u8BAE\u975E\u6CD5: " + u.protocol;
+      if (u.username || u.password) return "\u8DF3\u8F6C\u76EE\u6807\u4E0D\u5F97\u643A\u5E26\u51ED\u8BC1";
+      let from;
+      try {
+        from = new URL(String(fromUrl || ""));
+      } catch {
+        from = null;
+      }
+      if (from && from.hostname.toLowerCase() === u.hostname.toLowerCase()) return null;
+      return hostViolation(u.hostname);
+    }
+    function registryPackagePath(pkg) {
+      return encodeURIComponent(String(pkg || ""));
+    }
+    function registryUrl(base, ...segments) {
+      const parsed = parseRegistryBase(base);
+      if (!parsed.ok) return null;
+      const tail = segments.filter((s) => s !== "" && s != null).map((s) => String(s).replace(/^\/+/, "").replace(/\/+$/, "")).filter(Boolean).join("/");
+      return tail ? parsed.base + "/" + tail : parsed.base;
+    }
+    function registryEnvPair(base) {
+      const parsed = parseRegistryBase(base);
+      if (!parsed.ok) return { ok: false, violation: parsed.violation, base: null, env: null };
+      return {
+        ok: true,
+        violation: null,
+        base: parsed.base,
+        env: { npm_config_registry: parsed.base, NPM_CONFIG_REGISTRY: parsed.base }
+      };
+    }
+    async function readCapped(res, maxBytes) {
+      const cl = Number(res.headers && res.headers.get("content-length")) || 0;
+      if (cl > maxBytes) return null;
+      const reader = res.body && typeof res.body.getReader === "function" ? res.body.getReader() : null;
+      if (!reader) {
+        const text = await res.text();
+        return text.length > maxBytes ? null : text;
+      }
+      const chunks = [];
+      let total = 0;
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        if (!value) continue;
+        total += value.byteLength || value.length || 0;
+        if (total > maxBytes) {
+          try {
+            await reader.cancel();
+          } catch {
+          }
+          return null;
+        }
+        chunks.push(value);
+      }
+      const buf = Buffer.concat(chunks.map((c) => Buffer.from(c.buffer, c.byteOffset, c.byteLength)));
+      return buf.toString("utf8");
+    }
+    async function fetchRegistry(startUrl, opts) {
+      const o = opts || {};
+      const timeoutMs = Number.isFinite(o.timeoutMs) && o.timeoutMs > 0 ? o.timeoutMs : DEFAULT_TIMEOUT_MS;
+      const maxBytes = Number.isFinite(o.maxBytes) && o.maxBytes > 0 ? o.maxBytes : MAX_BODY_BYTES;
+      const maxHops = Number.isFinite(o.maxHops) ? o.maxHops : REDIRECT_MAX_HOPS;
+      let url = String(startUrl || "");
+      const hops = [];
+      const fail = (status, error) => ({ ok: false, status, json: null, error, url, hops });
+      for (let hop = 0; ; hop++) {
+        let res;
+        try {
+          res = await fetch(url, { signal: AbortSignal.timeout(timeoutMs), redirect: "manual" });
+        } catch (e) {
+          return fail(null, e && (e.name === "TimeoutError" ? "\u8D85\u65F6" : e.message) || String(e));
+        }
+        hops.push({ url, status: res.status });
+        if (res.status >= 300 && res.status < 400) {
+          try {
+            if (res.body) await res.body.cancel();
+          } catch {
+          }
+          if (hop >= maxHops) return fail(res.status, "\u8DF3\u8F6C\u6B21\u6570\u8D85\u8FC7\u4E0A\u9650");
+          const loc = res.headers.get("location");
+          if (!loc) return fail(res.status, "\u8DF3\u8F6C\u7F3A\u5C11 Location");
+          let next;
+          try {
+            next = new URL(loc, url).toString();
+          } catch {
+            return fail(res.status, "\u8DF3\u8F6C\u76EE\u6807\u65E0\u6CD5\u89E3\u6790");
+          }
+          const tv = targetHostViolation(next, url);
+          url = next;
+          if (tv) return fail(res.status, tv);
+          continue;
+        }
+        if (res.status < 200 || res.status >= 300) {
+          try {
+            if (res.body) await res.body.cancel();
+          } catch {
+          }
+          return fail(res.status, "HTTP " + res.status);
+        }
+        if (o.expect === "none") {
+          try {
+            if (res.body) await res.body.cancel();
+          } catch {
+          }
+          return { ok: true, status: res.status, json: null, error: null, url, hops };
+        }
+        let text;
+        try {
+          text = await readCapped(res, maxBytes);
+        } catch (e) {
+          return fail(res.status, "\u8BFB\u53D6\u54CD\u5E94\u4F53\u4E2D\u65AD\uFF1A" + (e && e.message || String(e)));
+        }
+        if (text === null) return fail(res.status, "\u54CD\u5E94\u4F53\u8D85\u8FC7\u4E0A\u9650");
+        if (o.expect !== "json") return { ok: true, status: res.status, json: null, text, error: null, url, hops };
+        try {
+          return { ok: true, status: res.status, json: JSON.parse(text), error: null, url, hops };
+        } catch {
+          return fail(res.status, "\u54CD\u5E94\u4E0D\u662F\u5408\u6CD5 JSON");
+        }
+      }
+    }
+    module2.exports = {
+      normalizeBase,
+      hostViolation,
+      parseRegistryBase,
+      registryEnvPair,
+      registryPackagePath,
+      registryUrl,
+      fetchRegistry
+    };
+  }
+});
+
+// src/platform/distribution/policies.js
+var require_policies = __commonJS({
+  "src/platform/distribution/policies.js"(exports2, module2) {
+    "use strict";
+    var registryRef = require_registry_ref();
+    var NPM_TIMEOUT_MS = { install: 6e5, uninstall: 9e5 };
+    var FALLBACK_REGISTRIES = [
+      "https://registry.npmjs.org",
+      "https://registry.npmmirror.com"
+    ];
+    function registryOriginViolation(origin) {
+      const parsed = registryRef.parseRegistryBase(origin);
+      if (!parsed.ok) return parsed.violation;
+      return registryRef.hostViolation(parsed.host);
     }
     function effectiveOrigins(registryConfig, defaultRegistries) {
       const o = registryConfig && registryConfig.origins || [];
@@ -6564,32 +6715,28 @@ var require_policies = __commonJS({
       };
     }
     function resolveProbe(origin, spec, platformTag) {
-      const base = normalizeOrigin(origin);
+      const timeoutMs = spec && Number.isFinite(spec.timeoutMs) && spec.timeoutMs > 0 ? spec.timeoutMs : 4e3;
+      const parsed = registryRef.parseRegistryBase(origin);
+      if (!parsed.ok) return { url: null, kind: "invalid", timeoutMs, violation: parsed.violation };
       if (spec && spec.kind === "package-metadata" && spec.pathTemplate && platformTag) {
         return {
-          url: base + "/" + spec.pathTemplate.replace("{platform}", platformTag),
+          url: registryRef.registryUrl(parsed.base, spec.pathTemplate.replace("{platform}", platformTag)),
           kind: spec.kind,
-          timeoutMs: spec.timeoutMs || 4e3
+          timeoutMs
         };
       }
-      return { url: base + "/-/ping", kind: "ping", timeoutMs: spec && spec.timeoutMs || 4e3 };
-    }
-    function pickFastestReachable(results) {
-      const reachable = results.filter((r) => r.ok).sort((a, b) => a.latencyMs - b.latencyMs);
-      return reachable.length ? reachable[0] : null;
+      return { url: registryRef.registryUrl(parsed.base, "/-/ping"), kind: "ping", timeoutMs };
     }
     function isInCanaryList(state) {
       return state.canary === true;
     }
     module2.exports = {
       FALLBACK_REGISTRIES,
-      normalizeOrigin,
-      isValidOrigin,
+      NPM_TIMEOUT_MS,
       registryOriginViolation,
       effectiveOrigins,
       rebuildRegistryConfig,
       resolveProbe,
-      pickFastestReachable,
       isInCanaryList
     };
   }
@@ -6705,64 +6852,6 @@ var require_release = __commonJS({
   }
 });
 
-// src/platform/contract/matrix.js
-var require_matrix = __commonJS({
-  "src/platform/contract/matrix.js"(exports2, module2) {
-    "use strict";
-    var SUPPORTED = [
-      { platform: "linux", arch: "x64", osTag: "linux", npmTag: "linux-x64" },
-      { platform: "darwin", arch: "arm64", osTag: "darwin", npmTag: "darwin-arm64" },
-      { platform: "darwin", arch: "x64", osTag: "darwin", npmTag: "darwin-x64" },
-      { platform: "win32", arch: "x64", osTag: "win", npmTag: "win-x64" }
-    ];
-    var OS_TAG = { linux: "linux", darwin: "darwin", win32: "win" };
-    var FRP_OS = { linux: "linux", darwin: "darwin", win32: "windows" };
-    var FRP_ARCH = { x64: "amd64", arm64: "arm64" };
-    function osTag(platform) {
-      return OS_TAG[platform || process.platform] || null;
-    }
-    function current(platform, arch) {
-      const p = platform || process.platform;
-      const a = arch || process.arch;
-      return { platform: p, arch: a, osTag: OS_TAG[p] || null, npmTag: npmTag(p, a) };
-    }
-    function npmTag(platform, arch) {
-      const p = platform || process.platform;
-      const a = arch || process.arch;
-      const os2 = OS_TAG[p];
-      if (!os2 || a !== "x64" && a !== "arm64") {
-        throw new Error("\u4E0D\u652F\u6301\u7684\u5E73\u53F0\u7EC4\u5408: " + p + "/" + a + "\uFF08\u4EC5 linux/darwin/win32 \xD7 x64/arm64\uFF09");
-      }
-      return os2 + "-" + a;
-    }
-    function isSupported(platform, arch) {
-      const p = platform || process.platform;
-      const a = arch || process.arch;
-      return SUPPORTED.some((x) => x.platform === p && x.arch === a);
-    }
-    function frpTag(platform, arch) {
-      const p = platform || process.platform;
-      const a = arch || process.arch;
-      const os2 = FRP_OS[p];
-      const am = FRP_ARCH[a];
-      if (!os2 || !am) return null;
-      return { os: os2, arch: am, tag: os2 + "_" + am, exe: p === "win32" };
-    }
-    function supportsProcessGroup(platform) {
-      return (platform || process.platform) !== "win32";
-    }
-    module2.exports = {
-      SUPPORTED,
-      osTag,
-      current,
-      npmTag,
-      isSupported,
-      frpTag,
-      supportsProcessGroup
-    };
-  }
-});
-
 // src/platform/contract/registry.js
 var require_registry = __commonJS({
   "src/platform/contract/registry.js"(exports2, module2) {
@@ -6864,26 +6953,16 @@ var require_registry = __commonJS({
   }
 });
 
-// src/platform/distribution/registry.js
-var require_registry2 = __commonJS({
-  "src/platform/distribution/registry.js"(exports2, module2) {
+// src/platform/distribution/registry-config.js
+var require_registry_config = __commonJS({
+  "src/platform/distribution/registry-config.js"(exports2, module2) {
     "use strict";
     var fs2 = require("node:fs");
     var path2 = require("node:path");
-    var matrix = require_matrix();
     var registryContract = require_registry();
     var { writeAtomic } = require_fs();
     var policies = require_policies();
     var CONTRACT_TTL_MS = 60 * 1e3;
-    function platformTag() {
-      return matrix.npmTag();
-    }
-    function reloadContractIfStale(state) {
-      const now = Date.now();
-      if (state._contractLoadedAt && now - state._contractLoadedAt < CONTRACT_TTL_MS) return;
-      loadRegistryConfig(state);
-      state._contractLoadedAt = now;
-    }
     function loadRegistryConfig(state) {
       state.contract = registryContract.read(state.registryFile);
       if (!state.contract.ok) {
@@ -6910,6 +6989,12 @@ var require_registry2 = __commonJS({
         state.logger.warn && state.logger.warn("dist: registry config load failed: " + e.message);
       }
     }
+    function reloadContractIfStale(state) {
+      const now = Date.now();
+      if (state._contractLoadedAt && now - state._contractLoadedAt < CONTRACT_TTL_MS) return;
+      loadRegistryConfig(state);
+      state._contractLoadedAt = now;
+    }
     function saveRegistryConfig(state) {
       if (!state.registryFile) return;
       try {
@@ -6940,6 +7025,85 @@ var require_registry2 = __commonJS({
       doc.manualOrigin = rc.manualOrigin;
       writeAtomic(f, JSON.stringify(doc, null, 2) + "\n", { mode: 384 });
     }
+    module2.exports = {
+      CONTRACT_TTL_MS,
+      loadRegistryConfig,
+      reloadContractIfStale,
+      saveRegistryConfig
+    };
+  }
+});
+
+// src/platform/contract/matrix.js
+var require_matrix = __commonJS({
+  "src/platform/contract/matrix.js"(exports2, module2) {
+    "use strict";
+    var SUPPORTED = [
+      { platform: "linux", arch: "x64", osTag: "linux", npmTag: "linux-x64" },
+      { platform: "darwin", arch: "arm64", osTag: "darwin", npmTag: "darwin-arm64" },
+      { platform: "darwin", arch: "x64", osTag: "darwin", npmTag: "darwin-x64" },
+      { platform: "win32", arch: "x64", osTag: "win", npmTag: "win-x64" }
+    ];
+    var OS_TAG = { linux: "linux", darwin: "darwin", win32: "win" };
+    var FRP_OS = { linux: "linux", darwin: "darwin", win32: "windows" };
+    var FRP_ARCH = { x64: "amd64", arm64: "arm64" };
+    function osTag(platform) {
+      return OS_TAG[platform || process.platform] || null;
+    }
+    function current(platform, arch) {
+      const p = platform || process.platform;
+      const a = arch || process.arch;
+      return { platform: p, arch: a, osTag: OS_TAG[p] || null, npmTag: npmTag(p, a) };
+    }
+    function npmTag(platform, arch) {
+      const p = platform || process.platform;
+      const a = arch || process.arch;
+      const os2 = OS_TAG[p];
+      if (!os2 || a !== "x64" && a !== "arm64") {
+        throw new Error("\u4E0D\u652F\u6301\u7684\u5E73\u53F0\u7EC4\u5408: " + p + "/" + a + "\uFF08\u4EC5 linux/darwin/win32 \xD7 x64/arm64\uFF09");
+      }
+      return os2 + "-" + a;
+    }
+    function isSupported(platform, arch) {
+      const p = platform || process.platform;
+      const a = arch || process.arch;
+      return SUPPORTED.some((x) => x.platform === p && x.arch === a);
+    }
+    function frpTag(platform, arch) {
+      const p = platform || process.platform;
+      const a = arch || process.arch;
+      const os2 = FRP_OS[p];
+      const am = FRP_ARCH[a];
+      if (!os2 || !am) return null;
+      return { os: os2, arch: am, tag: os2 + "_" + am, exe: p === "win32" };
+    }
+    function supportsProcessGroup(platform) {
+      return (platform || process.platform) !== "win32";
+    }
+    module2.exports = {
+      SUPPORTED,
+      osTag,
+      current,
+      npmTag,
+      isSupported,
+      frpTag,
+      supportsProcessGroup
+    };
+  }
+});
+
+// src/platform/distribution/registry.js
+var require_registry2 = __commonJS({
+  "src/platform/distribution/registry.js"(exports2, module2) {
+    "use strict";
+    var matrix = require_matrix();
+    var policies = require_policies();
+    var ref = require_registry_ref();
+    var config = require_registry_config();
+    var PROBE_MAX_BODY_BYTES = 8 * 1024 * 1024;
+    function platformTag() {
+      return matrix.npmTag();
+    }
     async function probeRegistry(state, origin) {
       const spec = state.contract && state.contract.ok && state.contract.probe || null;
       let tag = null;
@@ -6949,106 +7113,154 @@ var require_registry2 = __commonJS({
         tag = null;
       }
       const target = policies.resolveProbe(origin, spec, tag);
-      const start = Date.now();
-      try {
-        const res = await fetch(target.url, { signal: AbortSignal.timeout(target.timeoutMs), redirect: "manual" });
-        const ok = res.status >= 200 && res.status < 300;
-        return { ok, latencyMs: Date.now() - start, probe: target.kind };
-      } catch (e) {
-        return { ok: false, latencyMs: Date.now() - start, probe: target.kind };
+      if (!target.url) {
+        return { ok: false, latencyMs: 0, probe: target.kind, error: target.violation || "\u955C\u50CF\u57FA\u5740\u975E\u6CD5" };
       }
+      const start = Date.now();
+      const r = await ref.fetchRegistry(target.url, {
+        timeoutMs: target.timeoutMs,
+        expect: "text",
+        maxBytes: PROBE_MAX_BODY_BYTES
+      });
+      return { ok: !!r.ok, latencyMs: Date.now() - start, probe: target.kind, error: r.error || null };
     }
     async function probeOrigin(state, origin) {
-      const o = policies.normalizeOrigin(origin);
-      if (!policies.isValidOrigin(o)) return { origin: o, ok: false, latencyMs: null, error: "\u975E\u6CD5 origin" };
-      const p = await probeRegistry(state, o);
-      return { origin: o, ok: !!p.ok, latencyMs: p.latencyMs, probe: p.probe };
+      const parsed = ref.parseRegistryBase(origin);
+      if (!parsed.ok) return { origin: ref.normalizeBase(origin), ok: false, latencyMs: null, error: parsed.violation };
+      const p = await probeRegistry(state, parsed.base);
+      return { origin: parsed.base, ok: !!p.ok, latencyMs: p.latencyMs, probe: p.probe, error: p.error || null };
     }
     function registryOrigins(state) {
-      return policies.effectiveOrigins(state.registryConfig, state.defaultRegistries);
+      const seen = /* @__PURE__ */ new Set();
+      const out = [];
+      for (const raw of policies.effectiveOrigins(state.registryConfig, state.defaultRegistries)) {
+        const parsed = ref.parseRegistryBase(raw);
+        const base = parsed.ok ? parsed.base : ref.normalizeBase(raw);
+        if (seen.has(base)) continue;
+        seen.add(base);
+        out.push(base);
+      }
+      return out;
+    }
+    async function probeAllOrigins(state, origins) {
+      const results = await Promise.all(origins.map(async (origin) => {
+        const p = await probeRegistry(state, origin);
+        return { origin, ok: !!p.ok, latencyMs: p.latencyMs, error: p.error || null };
+      }));
+      results.sort((a, b) => a.ok === b.ok ? a.latencyMs - b.latencyMs : a.ok ? -1 : 1);
+      return results;
+    }
+    function orderFor(primary, origins, results) {
+      const usable = (o) => ref.parseRegistryBase(o).ok;
+      const ranked = (results || []).filter((r) => r.ok).map((r) => r.origin);
+      const ordered = [];
+      for (const o of [primary, ...ranked, ...origins]) {
+        if (!o || !usable(o)) continue;
+        if (!ordered.includes(o)) ordered.push(o);
+      }
+      return ordered;
     }
     async function selectRegistry(state, force) {
-      reloadContractIfStale(state);
+      config.reloadContractIfStale(state);
       const rc = state.registryConfig || {};
-      if (rc.mode === "manual" && rc.manualOrigin) {
-        const origin = policies.normalizeOrigin(rc.manualOrigin);
-        state.selectedRegistry = { origin, latencyMs: null, checkedAt: Date.now(), manual: true, probes: [] };
-        return origin;
-      }
+      const origins = registryOrigins(state);
+      const manualParsed = ref.parseRegistryBase(rc.manualOrigin);
+      const manualBase = manualParsed.ok ? manualParsed.base : "";
+      const manual = rc.mode === "manual" && !!manualBase;
       const now = Date.now();
-      if (!force && state.selectedRegistry && !state.selectedRegistry.manual && state.selectedRegistry.checkedAt && now - state.selectedRegistry.checkedAt < 30 * 60 * 1e3) {
-        return state.selectedRegistry.origin;
+      const cached = state.selectedRegistry;
+      if (!force && cached && cached.checkedAt && now - cached.checkedAt < 30 * 60 * 1e3) {
+        return cached;
       }
       const c = state.contract;
-      if (!force && c && c.ok && c.selected) {
+      if (!force && !manual && c && c.ok && c.selected) {
         const age = Math.floor(Date.now() / 1e3) - c.selected.checkedAt;
-        if (age >= 0 && age < 30 * 60) {
+        const adopted = ref.parseRegistryBase(c.selected.origin);
+        if (age >= 0 && age < 30 * 60 && adopted.ok) {
+          const origin = adopted.base;
           state.selectedRegistry = {
-            origin: c.selected.origin,
-            latencyMs: c.selected.latencyMs,
-            checkedAt: Date.now(),
-            manual: false,
+            origin,
+            ordered: orderFor(origin, origins, null),
             source: "shell",
-            probes: []
+            manual: false,
+            checkedAt: now,
+            latencyMs: Number.isFinite(c.selected.latencyMs) ? c.selected.latencyMs : null,
+            probes: [{ origin, ok: true, latencyMs: c.selected.latencyMs, error: null, from: "shell-contract" }]
           };
           if (state.events) {
             try {
-              state.events.append("dist_registry_selected", { origin: c.selected.origin, source: "shell-contract" });
+              state.events.append("dist_registry_selected", { origin, source: "shell-contract" });
             } catch {
             }
           }
-          return c.selected.origin;
+          return state.selectedRegistry;
         }
-      }
-      const origins = registryOrigins(state);
-      const results = await Promise.all(origins.map(async (origin) => {
-        const p = await probeRegistry(state, origin);
-        return { origin, ok: p.ok, latencyMs: p.latencyMs };
-      }));
-      const picked = policies.pickFastestReachable(results);
-      if (!picked) {
-        state.selectedRegistry = { origin: null, latencyMs: null, checkedAt: null, manual: false, probes: results };
-        if (state.events) {
-          state.events.append("dist_registry_unreachable", {
-            candidates: results.map((r) => r.origin + ":" + r.latencyMs + "ms")
-          });
+        if (!adopted.ok && state.logger && state.logger.warn) {
+          state.logger.warn("dist: \u5951\u7EA6 selected \u57FA\u5740\u975E\u6CD5\uFF0C\u6539\u4E3A\u81EA\u884C\u6D4B\u901F\uFF08" + adopted.violation + "\uFF09");
         }
-        return null;
       }
-      state.selectedRegistry = {
-        origin: picked.origin,
-        latencyMs: picked.latencyMs,
-        checkedAt: Date.now(),
-        manual: false,
+      const results = await probeAllOrigins(state, origins);
+      const firstReachable = results.find((r) => r.ok);
+      const primary = manual ? manualBase : firstReachable && firstReachable.origin || null;
+      const selected = {
+        origin: primary,
+        ordered: orderFor(primary, origins, results),
+        source: manual ? "manual" : firstReachable ? "probe" : "unreachable",
+        manual,
+        checkedAt: firstReachable || manual ? now : null,
+        // 全不可达不缓存坏选择：下次调用仍会重测
+        latencyMs: firstReachable && firstReachable.origin === primary ? firstReachable.latencyMs : null,
         probes: results
       };
+      state.selectedRegistry = selected;
       if (state.events) {
-        state.events.append("dist_registry_selected", {
-          origin: picked.origin,
-          latencyMs: picked.latencyMs,
-          candidates: results.map((r) => r.origin + ":" + r.latencyMs + "ms")
-        });
+        try {
+          state.events.append(firstReachable || manual ? "dist_registry_selected" : "dist_registry_unreachable", {
+            origin: primary,
+            source: selected.source,
+            candidates: results.map((r) => r.origin + ":" + (r.ok ? r.latencyMs + "ms" : r.error || "\u4E0D\u53EF\u8FBE"))
+          });
+        } catch {
+        }
       }
-      return picked.origin;
+      return selected;
+    }
+    async function registryOrigin(state, force) {
+      const sel = await selectRegistry(state, force);
+      return sel && sel.origin || null;
     }
     async function registryInfo(state) {
-      reloadContractIfStale(state);
-      const origin = await selectRegistry(state, false);
+      config.reloadContractIfStale(state);
+      const sel = await selectRegistry(state, false) || {};
       const rc = state.registryConfig || {};
       const c = state.contract;
-      const sel = state.selectedRegistry;
+      const verdictOf = (origin) => (sel.probes || []).find((p) => p.origin === origin) || null;
       return {
-        origin,
+        origin: sel.origin || null,
+        ordered: sel.ordered || [],
+        source: sel.source || null,
         mode: rc.mode || "auto",
         manualOrigin: rc.manualOrigin || "",
         candidates: registryOrigins(state).map((o) => ({ origin: o })),
+        registries: registryOrigins(state).map((o) => {
+          const parsed = ref.parseRegistryBase(o);
+          const v = verdictOf(o);
+          return {
+            base: parsed.base,
+            usable: parsed.ok,
+            violation: parsed.violation,
+            reachable: v ? v.ok : null,
+            latencyMs: v ? v.latencyMs : null,
+            error: v ? v.error || null : null
+          };
+        }),
         // 预设 = 壳投放的目录；契约不可用时为空数组，UI 应展示 candidates。
         presets: c && c.ok ? c.catalog : [],
         catalogSource: c && c.ok ? c.writtenBy || "shell" : "fallback",
-        latencyMs: sel && sel.latencyMs || null,
-        checkedAt: sel && sel.checkedAt || null,
-        manual: !!(sel && sel.manual),
-        probes: sel && sel.probes || []
+        latencyMs: sel.latencyMs || null,
+        checkedAt: sel.checkedAt || null,
+        manual: !!sel.manual,
+        probes: sel.probes || []
       };
     }
     async function setRegistryConfig(state, cfg) {
@@ -7085,7 +7297,7 @@ var require_registry2 = __commonJS({
         }
       }
       state.registryConfig = rc;
-      saveRegistryConfig(state);
+      config.saveRegistryConfig(state);
       state.selectedRegistry = null;
       const info = await registryInfo(state);
       if (rejected.length) {
@@ -7097,21 +7309,127 @@ var require_registry2 = __commonJS({
       return info;
     }
     module2.exports = {
-      CONTRACT_TTL_MS,
       platformTag,
-      reloadContractIfStale,
-      loadRegistryConfig,
-      saveRegistryConfig,
       probeRegistry,
       probeOrigin,
+      probeAllOrigins,
       registryOrigins,
+      orderFor,
       selectRegistry,
+      registryOrigin,
       registryInfo,
       setRegistryConfig
     };
   }
 });
 
+// src/platform/distribution/version-check.js
+var require_version_check = __commonJS({
+  "src/platform/distribution/version-check.js"(exports2, module2) {
+    "use strict";
+    var { VERSION_RE } = require_version2();
+    var input = require_input();
+    var policies = require_policies();
+    var registry = require_registry2();
+    var ref = require_registry_ref();
+    var release = require_release();
+    var PKG_NAME_RE = input.PKG_NAME_RE;
+    var METADATA_TIMEOUT_MS = 8e3;
+    var FETCH_BUDGET_MS = 25e3;
+    async function versionFromOrigin(state, base, pkg) {
+      const url = ref.registryUrl(base, ref.registryPackagePath(pkg));
+      const res = await ref.fetchRegistry(url, { timeoutMs: METADATA_TIMEOUT_MS, expect: "json" });
+      if (!res.ok) return { version: null, error: res.error || "HTTP " + res.status };
+      const picked = release.pickReleaseVersion(res.json, {
+        isOurs: release.isOurReleasePackage(pkg),
+        canary: policies.isInCanaryList(state),
+        // 仅 isOurs 分支消费
+        isValid: (v2) => typeof v2 === "string" && VERSION_RE.test(v2)
+      });
+      if (picked) return { version: picked, error: null };
+      const lr = await ref.fetchRegistry(
+        ref.registryUrl(base, ref.registryPackagePath(pkg), "latest"),
+        { timeoutMs: METADATA_TIMEOUT_MS, expect: "json" }
+      );
+      if (!lr.ok) return { version: null, error: lr.error || "HTTP " + lr.status };
+      const v = lr.json && typeof lr.json.version === "string" && VERSION_RE.test(lr.json.version) ? lr.json.version : null;
+      return { version: v, error: v ? null : "\u5143\u6570\u636E\u65E0\u53EF\u7528\u7248\u672C" };
+    }
+    async function fetchNpmLatest(state, pkg, opts) {
+      const o = opts || {};
+      const fail = (error, attempts2) => ({ ok: false, version: null, origin: null, attempts: attempts2 || [], error });
+      if (!pkg) return fail("\u7F3A\u5C11\u5305\u540D");
+      if (!PKG_NAME_RE.test(pkg)) return fail("\u975E\u6CD5\u5305\u540D\uFF08\u5B57\u7B26\u96C6\u767D\u540D\u5355\u4E0D\u901A\u8FC7\uFF09: " + String(pkg).slice(0, 80));
+      let candidates = [];
+      if (o.authoritative) {
+        const list = registry.registryOrigins(state).filter((x) => ref.parseRegistryBase(x).ok);
+        candidates = list.filter((x) => /registry\.npmjs\.org/.test(x));
+        if (!candidates.length && list.length) candidates = [list[0]];
+      } else {
+        const sel = await registry.selectRegistry(state, false);
+        candidates = sel && sel.ordered || [];
+      }
+      if (!candidates.length) return fail("\u65E0\u53EF\u7528\u7684\u955C\u50CF\u6E90\u5019\u9009\uFF08\u5168\u90E8\u57FA\u5740\u975E\u6CD5\u6216\u5217\u8868\u4E3A\u7A7A\uFF09");
+      const attempts = [];
+      const deadline = Date.now() + FETCH_BUDGET_MS;
+      for (let i = 0; i < candidates.length; i++) {
+        if (i && Date.now() >= deadline) {
+          attempts.push({ origin: candidates.slice(i).join(","), error: "\u672A\u5C1D\u8BD5\uFF08\u8D85\u51FA " + Math.round(FETCH_BUDGET_MS / 1e3) + "s \u603B\u9884\u7B97\uFF09" });
+          break;
+        }
+        const base = candidates[i];
+        const r = await versionFromOrigin(state, base, pkg);
+        if (r.version) return { ok: true, version: r.version, origin: base, attempts, error: null };
+        attempts.push({ origin: base, error: r.error || "\u672A\u53D6\u5230\u7248\u672C" });
+      }
+      return fail("\u5168\u90E8\u955C\u50CF\u672A\u53D6\u5230 " + pkg + " \u7684\u7248\u672C\uFF1A" + attempts.map((a) => a.origin + "=" + a.error).join("; "), attempts);
+    }
+    async function fetchGithubLatest(owner, repo) {
+      if (!owner || !repo) return null;
+      try {
+        const res = await fetch(
+          "https://api.github.com/repos/" + encodeURIComponent(owner) + "/" + encodeURIComponent(repo) + "/releases/latest",
+          { signal: AbortSignal.timeout(1e4), headers: { "User-Agent": "dsh-supervisor" } }
+        );
+        if (!res.ok) return null;
+        const j = await res.json();
+        const tag = j && typeof j.tag_name === "string" ? j.tag_name : j && typeof j.name === "string" ? j.name : null;
+        if (!tag) return null;
+        return String(tag).replace(/^v/, "");
+      } catch (e) {
+        return null;
+      }
+    }
+    async function fetchVersionInfo(state, pkg, channel, opts) {
+      const ch = channel || "npm";
+      const o = opts || {};
+      if (ch === "github") {
+        const slash = String(pkg).split("/");
+        const version = slash.length >= 2 ? await fetchGithubLatest(slash[0], slash.slice(1).join("/")) : null;
+        return {
+          ok: !!version,
+          version: version || null,
+          origin: null,
+          attempts: [],
+          error: version ? null : "GitHub Releases \u672A\u67E5\u8BE2\u5230 " + pkg + " \u7684\u6700\u65B0\u7248"
+        };
+      }
+      return fetchNpmLatest(state, pkg, { authoritative: o.authoritative === true });
+    }
+    async function fetchLatestVersion(state, pkg, channel, opts) {
+      const r = await fetchVersionInfo(state, pkg, channel, opts);
+      return r.ok ? r.version : null;
+    }
+    module2.exports = {
+      METADATA_TIMEOUT_MS,
+      FETCH_BUDGET_MS,
+      fetchNpmLatest,
+      fetchVersionInfo,
+      fetchLatestVersion
+    };
+  }
+});
+
 // src/platform/contract/runtime.js
 var require_runtime = __commonJS({
   "src/platform/contract/runtime.js"(exports2, module2) {
@@ -7189,72 +7507,12 @@ var require_install = __commonJS({
     var runtimeContract = require_runtime();
     var service = require_service().current();
     var { VERSION_RE } = require_version2();
-    var release = require_release();
-    var registry = require_registry2();
+    var ref = require_registry_ref();
     var policies = require_policies();
     var input = require_input();
     var PKG_NAME_RE = input.PKG_NAME_RE;
     var BAD_ARGV_CHAR_RE = input.ARGV_UNSAFE_RE;
     var WIN_DRIVE_ABS_RE = input.WIN_ABS_PATH_RE;
-    async function fetchNpmLatest(state, pkg, opts) {
-      if (!pkg) return null;
-      const o = opts || {};
-      let origin = null;
-      if (o.authoritative) {
-        const list = registry.registryOrigins(state);
-        origin = list.find((x) => /registry\.npmjs\.org/.test(x)) || list[0] || "https://registry.npmjs.org";
-      } else {
-        origin = await registry.selectRegistry(state, false);
-      }
-      if (!origin) return null;
-      const base = policies.normalizeOrigin(origin);
-      if (!policies.isValidOrigin(base)) return null;
-      if (!PKG_NAME_RE.test(pkg)) return null;
-      try {
-        const res = await fetch(base + "/" + encodeURIComponent(pkg), { signal: AbortSignal.timeout(1e4) });
-        if (!res.ok) return null;
-        const j = await res.json();
-        const picked = release.pickReleaseVersion(j, {
-          isOurs: release.isOurReleasePackage(pkg),
-          canary: policies.isInCanaryList(state),
-          // 仅 isOurs 分支消费
-          isValid: (v) => typeof v === "string" && VERSION_RE.test(v)
-        });
-        if (picked) return picked;
-        const lr = await fetch(base + "/" + encodeURIComponent(pkg) + "/latest", { signal: AbortSignal.timeout(8e3) });
-        if (!lr.ok) return null;
-        const lj = await lr.json();
-        return lj && typeof lj.version === "string" && VERSION_RE.test(lj.version) ? lj.version : null;
-      } catch (e) {
-        return null;
-      }
-    }
-    async function fetchGithubLatest(owner, repo) {
-      if (!owner || !repo) return null;
-      try {
-        const res = await fetch(
-          "https://api.github.com/repos/" + encodeURIComponent(owner) + "/" + encodeURIComponent(repo) + "/releases/latest",
-          { signal: AbortSignal.timeout(1e4), headers: { "User-Agent": "dsh-supervisor" } }
-        );
-        if (!res.ok) return null;
-        const j = await res.json();
-        const tag = j && typeof j.tag_name === "string" ? j.tag_name : j && typeof j.name === "string" ? j.name : null;
-        if (!tag) return null;
-        return String(tag).replace(/^v/, "");
-      } catch (e) {
-        return null;
-      }
-    }
-    async function fetchLatestVersion(state, pkg, channel, opts) {
-      const ch = channel || "npm";
-      const o = opts || {};
-      if (ch === "github") {
-        const slash = String(pkg).split("/");
-        if (slash.length >= 2) return fetchGithubLatest(slash[0], slash.slice(1).join("/"));
-        return null;
-      }
-      return fetchNpmLatest(state, pkg, { authoritative: o.authoritative === true });
-    }
     var INFLIGHT_NPM = /* @__PURE__ */ new Set();
     function inflightNpmCount() {
       return INFLIGHT_NPM.size;
@@ -7271,50 +7529,55 @@ var require_install = __commonJS({
     }
     function runNpmInstall(opts) {
       const o = opts || {};
+      const action = o.action === void 0 || o.action === null ? "install" : String(o.action);
+      const bad = (r) => ({ ok: false, error: null, output: [], exitCode: null, timedOut: false, aborted: false, ...r });
+      const fail = (error) => Promise.resolve(bad({ error }));
+      if (action !== "install" && action !== "uninstall") return fail("runNpmInstall: \u672A\u77E5 action\uFF08\u53EA\u63A5\u53D7 install/uninstall\uFF09: " + action.slice(0, 40));
       const pkg = o.pkg || "@deepseek-ai/dsh";
-      if (!o.version) return Promise.resolve({ ok: false, error: "runNpmInstall: \u7F3A\u5C11 version\uFF08\u5FC5\u987B\u663E\u5F0F\u643A\u5E26\uFF09", output: [] });
-      if (!PKG_NAME_RE.test(pkg)) return Promise.resolve({ ok: false, error: "runNpmInstall: \u975E\u6CD5\u5305\u540D\uFF08\u5B57\u7B26\u96C6\u767D\u540D\u5355\u4E0D\u901A\u8FC7\uFF09: " + String(pkg).slice(0, 80), output: [] });
-      if (!VERSION_RE.test(String(o.version))) return Promise.resolve({ ok: false, error: "runNpmInstall: \u975E\u6CD5\u7248\u672C\u53F7\uFF08\u987B\u4E3A\u4E25\u683C semver\uFF09: " + String(o.version).slice(0, 80), output: [] });
+      if (action === "install" && !o.version) return fail("runNpmInstall: \u7F3A\u5C11 version\uFF08\u5FC5\u987B\u663E\u5F0F\u643A\u5E26\uFF09");
+      if (!PKG_NAME_RE.test(pkg)) return fail("runNpmInstall: \u975E\u6CD5\u5305\u540D\uFF08\u5B57\u7B26\u96C6\u767D\u540D\u5355\u4E0D\u901A\u8FC7\uFF09: " + String(pkg).slice(0, 80));
+      if (action === "install" && !VERSION_RE.test(String(o.version))) return fail("runNpmInstall: \u975E\u6CD5\u7248\u672C\u53F7\uFF08\u987B\u4E3A\u4E25\u683C semver\uFF09: " + String(o.version).slice(0, 80));
       let argv;
-      const launcher = runtimeContract.npmLauncher();
+      const contractLauncher = runtimeContract.npmLauncher();
+      const launcher = o.launcher && o.launcher.program ? { program: String(o.launcher.program), args: Array.isArray(o.launcher.args) ? o.launcher.args.map(String) : [] } : contractLauncher;
       let bin = launcher.program;
       if (Array.isArray(o.commandTemplate) && o.commandTemplate.length) {
-        argv = o.commandTemplate.map((s) => String(s).replace(/{pkg}/g, pkg).replace(/{version}/g, o.version).replace(/{prefix}/g, o.prefix || ""));
+        argv = o.commandTemplate.map((s) => String(s).replace(/{pkg}/g, pkg).replace(/{version}/g, o.version || "").replace(/{prefix}/g, o.prefix || ""));
         const fromTemplate = argv[0] !== "npm";
         bin = fromTemplate ? argv[0] : launcher.program;
         argv = (fromTemplate ? [] : launcher.args).concat(argv.slice(1));
         if (!fromTemplate && launcher.source === "path" && bin === "npm" && !execPath.resolveExecutable("npm")) {
-          return Promise.resolve({ ok: false, error: 'runNpmInstall: \u672A\u627E\u5230\u53EF\u6267\u884C\u7684 npm\uFF08commandTemplate[0]="npm" \u89E3\u6790\u5931\u8D25\uFF09', output: [] });
+          return fail('runNpmInstall: \u672A\u627E\u5230\u53EF\u6267\u884C\u7684 npm\uFF08commandTemplate[0]="npm" \u89E3\u6790\u5931\u8D25\uFF09');
         }
         for (const a of argv) {
           if (BAD_ARGV_CHAR_RE.test(String(a)) && !WIN_DRIVE_ABS_RE.test(String(a))) {
-            return Promise.resolve({ ok: false, error: "runNpmInstall: commandTemplate \u66FF\u6362\u540E\u542B\u7981\u7528\u5B57\u7B26\uFF08\u7A7A\u767D/shell \u5143\u5B57\u7B26\uFF09: " + String(a).slice(0, 80), output: [] });
+            return fail("runNpmInstall: commandTemplate \u66FF\u6362\u540E\u542B\u7981\u7528\u5B57\u7B26\uFF08\u7A7A\u767D/shell \u5143\u5B57\u7B26\uFF09: " + String(a).slice(0, 80));
           }
         }
       } else {
-        argv = [...launcher.args, "install", "-g", "--no-audit", "--no-fund"];
+        argv = [...launcher.args, action, "-g"];
+        if (action === "install") argv.push("--no-audit", "--no-fund");
         argv.push("--ignore-scripts");
         if (o.prefix) {
           const pv = input.prefixViolation(o.prefix);
-          if (pv) return Promise.resolve({ ok: false, error: "runNpmInstall: " + pv, output: [] });
+          if (pv) return fail("runNpmInstall: " + pv);
           argv.push("--prefix", String(o.prefix));
         }
-        argv.push(pkg + "@" + o.version);
+        argv.push(action === "install" ? pkg + "@" + o.version : pkg);
       }
       const envVars = runtimeContract.withPath(process.env);
-      if (o.registry) {
-        if (!policies.isValidOrigin(o.registry)) {
-          return Promise.resolve({ ok: false, error: "runNpmInstall: \u975E\u6CD5 registry origin\uFF08\u987B\u4E3A\u7EAF http(s) origin\uFF09: " + String(o.registry).slice(0, 80), output: [] });
-        }
-        envVars.npm_config_registry = o.registry;
-        envVars.NPM_CONFIG_REGISTRY = o.registry;
+      if (o.registry && action === "install") {
+        const rp = ref.registryEnvPair(o.registry);
+        if (!rp.ok) return fail("runNpmInstall: \u975E\u6CD5 registry \u57FA\u5740\uFF08" + rp.violation + "\uFF09: " + String(o.registry).slice(0, 80));
+        Object.assign(envVars, rp.env);
       }
+      const timeoutMs = Number(o.timeoutMs) > 0 ? Number(o.timeoutMs) : policies.NPM_TIMEOUT_MS[action];
       return new Promise((resolve) => {
         let child;
         try {
           child = spawnOS.piped(bin, argv, { env: envVars, detached: o.detached !== false });
         } catch (e) {
-          return resolve({ ok: false, error: e.message, output: [] });
+          return resolve(bad({ error: e.message }));
         }
         const out = [];
         let settled = false;
@@ -7341,13 +7604,13 @@ var require_install = __commonJS({
           pid: child.pid,
           abort: (reason) => {
             killTree();
-            finish({ ok: false, aborted: true, error: "\u5B89\u88C5\u88AB\u4E2D\u6B62: " + (reason || "guard-exit"), output: out });
+            finish(bad({ aborted: true, error: "npm " + action + " \u88AB\u4E2D\u6B62: " + (reason || "guard-exit"), output: out }));
           }
         };
         const timer = setTimeout(() => {
           killTree();
-          finish({ ok: false, error: "\u5B89\u88C5\u8D85\u65F6", output: out });
-        }, o.timeoutMs || 6e5);
+          finish(bad({ timedOut: true, error: "npm " + action + " \u8D85\u65F6\uFF08" + Math.round(timeoutMs / 1e3) + "s\uFF09\u5DF2\u7EC8\u6B62", output: out }));
+        }, timeoutMs);
         INFLIGHT_NPM.add(handle);
         const onLine = (buf) => {
           for (const l of String(buf).split(/\r?\n/)) {
@@ -7365,10 +7628,11 @@ var require_install = __commonJS({
         child.stdout.on("data", onLine);
         child.stderr.on("data", onLine);
         child.on("error", (e) => {
-          finish({ ok: false, error: e.message, output: out });
+          finish(bad({ error: e.message, output: out }));
         });
         child.on("exit", (code) => {
-          finish({ ok: code === 0, error: code === 0 ? null : "npm install \u9000\u51FA\u7801 " + code, output: out });
+          const c = code === null ? -1 : code;
+          finish({ ok: c === 0, error: c === 0 ? null : "npm " + action + " \u9000\u51FA\u7801 " + c, output: out, exitCode: c, timedOut: false, aborted: false });
         });
       });
     }
@@ -7417,9 +7681,6 @@ var require_install = __commonJS({
       PKG_NAME_RE,
       BAD_ARGV_CHAR_RE,
       WIN_DRIVE_ABS_RE,
-      fetchNpmLatest,
-      fetchGithubLatest,
-      fetchLatestVersion,
       runNpmInstall,
       waitPortHealthy,
       // 在途 npm 的记账/中止出口（关停路径经 platform/distribution 门面 re-export）
@@ -7435,7 +7696,9 @@ var require_distribution = __commonJS({
     "use strict";
     var policies = require_policies();
     var release = require_release();
+    var registryConfig = require_registry_config();
     var registry = require_registry2();
+    var versionCheck = require_version_check();
     var install = require_install();
     var { semverCompare, VERSION_RE } = require_version2();
     var DistributionManager = class {
@@ -7449,18 +7712,18 @@ var require_distribution = __commonJS({
         this.registryConfig = { mode: "auto", origins: [...this.defaultRegistries], manualOrigin: this.defaultRegistries[0] || "" };
         this.canary = opts.canary === true;
         this.selectedRegistry = null;
-        registry.loadRegistryConfig(this);
+        registryConfig.loadRegistryConfig(this);
         this._contractLoadedAt = Date.now();
       }
-      // ---- 镜像源（registry.js）----
+      // ---- 镜像源（registry-config.js 载入/落盘，registry.js 探测/选源）----
       _reloadContractIfStale() {
-        registry.reloadContractIfStale(this);
+        registryConfig.reloadContractIfStale(this);
       }
       _loadRegistryConfig() {
-        registry.loadRegistryConfig(this);
+        registryConfig.loadRegistryConfig(this);
       }
       _saveRegistryConfig() {
-        registry.saveRegistryConfig(this);
+        registryConfig.saveRegistryConfig(this);
       }
       _platformTag() {
         return registry.platformTag();
@@ -7477,6 +7740,9 @@ var require_distribution = __commonJS({
       selectRegistry(force) {
         return registry.selectRegistry(this, force);
       }
+      registryOrigin(force) {
+        return registry.registryOrigin(this, force);
+      }
       registryInfo() {
         return registry.registryInfo(this);
       }
@@ -7486,15 +7752,18 @@ var require_distribution = __commonJS({
       _inCanaryList() {
         return policies.isInCanaryList(this);
       }
-      // ---- 版本检查 / 安装 / 健康（install.js）----
+      // ---- 版本检查 / 安装 / 健康（version-check.js + install.js）----
+      // fetchNpmLatest 回 npm 通道的结构化结果（含给出该版本的 origin 与逐源原因）。
+      // fetchVersionInfo 是**跨通道**的结构化口（npm|github，github 的 origin 恒 null）；
+      // fetchLatestVersion 只回版本字符串，只要版本号的调用方走它。
       fetchNpmLatest(pkg, opts) {
-        return install.fetchNpmLatest(this, pkg, opts);
+        return versionCheck.fetchNpmLatest(this, pkg, opts);
       }
-      fetchGithubLatest(owner, repo) {
-        return install.fetchGithubLatest(owner, repo);
+      fetchVersionInfo(pkg, channel, opts) {
+        return versionCheck.fetchVersionInfo(this, pkg, channel, opts);
       }
       fetchLatestVersion(pkg, channel, opts) {
-        return install.fetchLatestVersion(this, pkg, channel, opts);
+        return versionCheck.fetchLatestVersion(this, pkg, channel, opts);
       }
       runNpmInstall(opts) {
         return install.runNpmInstall(opts);
@@ -15194,6 +15463,7 @@ var require_pkg_cache = __commonJS({
     var fs2 = require("node:fs");
     var ex2 = require_exec();
     var { npxCacheDir, npxLauncher } = require_npx_forms();
+    var registryRef = require_registry_ref();
     var HASH_DIR_RE = /^[0-9a-f]{8,}$/i;
     function pkgCacheDirs(pkg) {
       if (!pkg) return [];
@@ -15258,12 +15528,10 @@ var require_pkg_cache = __commonJS({
       if (!app || !app.pkg) return { ok: true };
       if (cachedPkgBin(app.pkg)) return { ok: true, cached: true };
       try {
-        const regOrigin = provider.dist ? await provider.dist.selectRegistry(false).catch(() => null) : null;
+        const regOrigin = provider.dist ? await provider.dist.registryOrigin(false).catch(() => null) : null;
         const env = Object.assign({}, process.env);
-        if (regOrigin) {
-          env.npm_config_registry = regOrigin;
-          env.NPM_CONFIG_REGISTRY = regOrigin;
-        }
+        const rp = registryRef.registryEnvPair(regOrigin);
+        if (rp.ok) Object.assign(env, rp.env);
         const launcher = npxLauncher();
         await ex2.runOutAsync(launcher.program, [...launcher.args, "--yes", app.pkg, "--help"], { env, timeoutMs: 12e4 });
         return { ok: !!cachedPkgBin(app.pkg) };
@@ -15291,6 +15559,7 @@ var require_probe5 = __commonJS({
     var { cachedPkgBin, ensurePkgCached } = require_pkg_cache();
     var stateRoot2 = require_state_root();
     var { Rotator } = require_log();
+    var registryRef = require_registry_ref();
     var INSTANCE_LOG_MAX_BYTES = 2 * 1024 * 1024;
     async function spawnInstance(provider, inst) {
       const app = provider.app;
@@ -15360,10 +15629,9 @@ var require_probe5 = __commonJS({
           envVars[k] = String(v).replace("{{key}}", inst.key).replace("{{port}}", String(port));
         }
       }
-      if (launch.registry) {
-        envVars.npm_config_registry = launch.registry;
-        envVars.NPM_CONFIG_REGISTRY = launch.registry;
-      }
+      const rpReg = registryRef.registryEnvPair(launch.registry);
+      if (rpReg.ok) Object.assign(envVars, rpReg.env);
+      else if (launch.registry && provider.logger) provider.logger.warn("[proxy-instance] \u5951\u7EA6 registry \u975E\u6CD5\uFF08" + rpReg.violation + "\uFF09\uFF0C\u6539\u7528 npx \u9ED8\u8BA4\u6E90");
       const logFilter = /error|streaming|idle|timeout|ECONN|abort|socket|finish|truncat/i;
       const baseDir = provider.stateDir || stateRoot2.supervisorDir();
       let logWriter = null;
@@ -15955,7 +16223,7 @@ var require_proxy = __commonJS({
       }
       /** 解析启动命令（缓存优先 + fallback npx）：拼装委托 command.js；凭证剔除留在本层（纪律）。 */
       async _resolveLaunchCommand(app, port, key) {
-        const registry = this.dist ? await this.dist.selectRegistry(false).catch(() => null) : null;
+        const registry = this.dist ? await this.dist.registryOrigin(false).catch(() => null) : null;
         const cachedBin = this._cachedPkgBin(app.pkg);
         const launch = buildCommand({ app, port, cachedBin, registry, launcher: npxLauncher(), execPath: process.execPath });
         if (!launch || !launch.ok) return launch || { ok: false, error: "\u547D\u4EE4\u62FC\u88C5\u5931\u8D25" };
@@ -17590,12 +17858,18 @@ var require_apps_registry = __commonJS({
             continue;
           }
           let ver = null;
+          let why = "\u5206\u53D1\u670D\u52A1\u4E0D\u53EF\u7528";
           try {
-            if (dist) ver = await dist.fetchNpmLatest(a.registry);
-          } catch {
+            if (dist) {
+              const r = await dist.fetchNpmLatest(a.registry);
+              ver = r && r.ok ? r.version : null;
+              why = r && r.ok ? null : r && r.error || "\u672A\u53D6\u5230\u7248\u672C";
+            }
+          } catch (e) {
+            why = e && e.message || String(e);
           }
           const prev = c.latest || null;
-          cache[a.id] = { pkg: a.registry, latest: ver, checkedAt: Date.now(), error: ver ? null : "query failed" };
+          cache[a.id] = { pkg: a.registry, latest: ver, checkedAt: Date.now(), error: ver ? null : why || "query failed" };
           if (ver && prev && ver !== prev && events) events.append("proxy_update_available", { appId: a.id, pkg: a.registry, from: prev, to: ver });
           results[a.id] = ver;
         }
@@ -19970,8 +20244,7 @@ var require_dsh_install = __commonJS({
     function createDshInstall(deps) {
       const { store, dist, tasks, logger, instancesRoot } = deps;
       const save = () => store.save();
-      let _latestDshVer = null;
-      let _latestDshVerAt = 0;
+      let _latestDsh = null;
       function installTimeoutWatchdog(inst, task) {
         try {
           if (inst.state && inst.state.phase === "INSTALLING") {
@@ -20036,49 +20309,38 @@ var require_dsh_install = __commonJS({
             } catch {
             }
           }
-          const env = Object.assign({}, process.env);
-          let reg = null;
-          if (dist) {
-            try {
-              reg = await dist.selectRegistry(false);
-              if (reg) {
-                env.npm_config_registry = reg;
-                env.NPM_CONFIG_REGISTRY = reg;
-              }
-            } catch (e) {
-              logger.warn && logger.warn("sandbox registry select failed: " + e.message);
-            }
-          }
-          const latestVer = await latestDshVersion();
-          pushLog("\u5B89\u88C5\u76EE\u6807\u7248\u672C\uFF1A" + (latestVer || "latest tag"));
-          if (!latestVer) {
+          if (!dist) {
             inst.state.installOk = false;
-            inst.state.installError = "\u65E0\u6CD5\u83B7\u53D6\u6700\u65B0\u7248\u672C";
+            inst.state.installError = "dist \u5206\u53D1\u670D\u52A1\u4E0D\u53EF\u7528";
             save();
             if (task) {
               try {
-                tasks.fail(task.id, "\u65E0\u6CD5\u83B7\u53D6\u6700\u65B0\u7248\u672C");
+                tasks.fail(task.id, "dist \u5206\u53D1\u670D\u52A1\u4E0D\u53EF\u7528");
               } catch {
               }
             }
-            return { ok: false, error: "\u65E0\u6CD5\u83B7\u53D6\u6700\u65B0\u7248\u672C" };
+            return { ok: false, error: "dist \u5206\u53D1\u670D\u52A1\u4E0D\u53EF\u7528" };
           }
-          if (!dist) {
+          const pick = await latestDsh();
+          pushLog("\u5B89\u88C5\u76EE\u6807\u7248\u672C\uFF1A" + (pick.version || "\u672A\u77E5") + (pick.origin ? "\uFF08\u6E90 " + pick.origin + "\uFF09" : ""));
+          if (!pick.version) {
+            const why = "\u65E0\u6CD5\u83B7\u53D6\u6700\u65B0\u7248\u672C\uFF1A" + (pick.error || "\u672A\u77E5\u539F\u56E0");
             inst.state.installOk = false;
-            inst.state.installError = "dist \u5206\u53D1\u670D\u52A1\u4E0D\u53EF\u7528";
+            inst.state.installError = why;
             save();
             if (task) {
               try {
-                tasks.fail(task.id, "dist \u5206\u53D1\u670D\u52A1\u4E0D\u53EF\u7528");
+                tasks.fail(task.id, why);
               } catch {
               }
             }
-            return { ok: false, error: "dist \u5206\u53D1\u670D\u52A1\u4E0D\u53EF\u7528" };
+            return { ok: false, error: why };
           }
+          const latestVer = pick.version;
           const watchdog = setTimeout(() => installTimeoutWatchdog(inst, task), 10 * 60 * 1e3);
           let res;
           try {
-            res = await dist.runNpmInstall({ pkg: "@deepseek-ai/dsh", version: latestVer, prefix: installDir, registry: reg, onLine: pushLog });
+            res = await dist.runNpmInstall({ pkg: "@deepseek-ai/dsh", version: latestVer, prefix: installDir, registry: pick.origin, onLine: pushLog });
           } finally {
             clearTimeout(watchdog);
           }
@@ -20124,18 +20386,24 @@ var require_dsh_install = __commonJS({
           return null;
         }
       }
-      async function latestDshVersion() {
-        if (_latestDshVer && Date.now() - _latestDshVerAt < 3e4) return _latestDshVer;
-        let v = null;
-        try {
-          if (dist) v = await dist.fetchNpmLatest("@deepseek-ai/dsh");
-        } catch {
+      async function latestDsh() {
+        if (_latestDsh && Date.now() - _latestDsh.at < 3e4) return _latestDsh;
+        let r = { ok: false, version: null, origin: null, attempts: [], error: "dist \u5206\u53D1\u670D\u52A1\u4E0D\u53EF\u7528" };
+        if (dist) {
+          try {
+            r = await dist.fetchNpmLatest("@deepseek-ai/dsh");
+          } catch (e) {
+            r = { ok: false, version: null, origin: null, attempts: [], error: e && e.message || String(e) };
+          }
         }
-        _latestDshVer = v;
-        _latestDshVerAt = Date.now();
-        return v;
+        if (r.ok && r.version) _latestDsh = Object.assign({ at: Date.now() }, r);
+        return r;
       }
-      return { installSandbox, readInstalledVersion, latestDshVersion };
+      async function latestDshVersion() {
+        const r = await latestDsh();
+        return r.version;
+      }
+      return { installSandbox, readInstalledVersion, latestDsh, latestDshVersion };
     }
     module2.exports = { createDshInstall };
   }
@@ -20183,6 +20451,9 @@ var require_upgrade = __commonJS({
       function readInstalledVersion(inst) {
         return install.readInstalledVersion(inst);
       }
+      async function latestDsh() {
+        return install.latestDsh();
+      }
       async function latestDshVersion() {
         return install.latestDshVersion();
       }
@@ -20213,8 +20484,9 @@ var require_upgrade = __commonJS({
         let latest = cached && cached.latest || null;
         if (!latest || !cached || Date.now() - cached.checkedAt > _updTTL) {
           try {
-            latest = await dist.fetchNpmLatest("@deepseek-ai/dsh");
-            _updCache[id] = { latest, checkedAt: Date.now(), error: latest ? null : "\u67E5\u8BE2\u5931\u8D25" };
+            const pick = await dist.fetchNpmLatest("@deepseek-ai/dsh");
+            latest = pick.ok ? pick.version : null;
+            _updCache[id] = { latest, checkedAt: Date.now(), error: pick.ok ? null : pick.error || "\u67E5\u8BE2\u5931\u8D25" };
           } catch (e) {
             latest = null;
             _updCache[id] = { latest: null, checkedAt: Date.now(), error: e.message };
@@ -20241,16 +20513,6 @@ var require_upgrade = __commonJS({
         _updJobs[id] = nj;
         (async () => {
           const installDir = sandbox.installDir(instancesRoot, inst);
-          const env = Object.assign({}, process.env);
-          let reg = null;
-          try {
-            reg = await dist.selectRegistry(false);
-            if (reg) {
-              env.npm_config_registry = reg;
-              env.NPM_CONFIG_REGISTRY = reg;
-            }
-          } catch {
-          }
           let wasRunning = false;
           try {
             wasRunning = lifecycle.probe(inst).running;
@@ -20277,12 +20539,15 @@ var require_upgrade = __commonJS({
             const s = tasks.step(task.id, "\u5B89\u88C5\u6700\u65B0\u7248");
             tasks.stepState(task.id, tasks.get(task.id).steps.indexOf(s), "running");
           }
-          const targetVer = await latestDshVersion();
-          if (task) tasks.log(task.id, "\u76EE\u6807\u7248\u672C\uFF1A" + (targetVer || "latest tag"));
+          const pick = await latestDsh();
+          const targetVer = pick.version;
+          const reg = pick.origin;
+          if (task) tasks.log(task.id, "\u76EE\u6807\u7248\u672C\uFF1A" + (targetVer || "\u672A\u77E5") + (reg ? "\uFF08\u6E90 " + reg + "\uFF09" : ""));
           if (!targetVer) {
+            const why = "\u65E0\u6CD5\u83B7\u53D6\u6700\u65B0\u7248\u672C\uFF1A" + (pick.error || "\u672A\u77E5\u539F\u56E0");
             nj.errors++;
-            nj.error = "\u65E0\u6CD5\u83B7\u53D6\u6700\u65B0\u7248\u672C";
-            if (task) tasks.log(task.id, "\u65E0\u6CD5\u83B7\u53D6\u6700\u65B0\u7248\u672C");
+            nj.error = why;
+            if (task) tasks.log(task.id, why);
           } else {
             if (!dist) {
               nj.errors++;
@@ -21048,6 +21313,7 @@ var require_market_sources = __commonJS({
   "src/domains/plugin/market-sources.js"(exports2, module2) {
     "use strict";
     var { getJson, getText } = require_market_net();
+    var ref = require_registry_ref();
     var RAW_MIRRORS = ["https://gh-proxy.com/", "https://ghproxy.net/"];
     async function rawGet(pathPart, isJson, timeoutMs = 15e3) {
       const direct = "https://raw.githubusercontent.com/" + pathPart;
@@ -21061,12 +21327,10 @@ var require_market_sources = __commonJS({
       throw new Error("raw fetch failed for " + pathPart);
     }
     async function fetchLatest(origin, name) {
-      try {
-        const base = String(origin || "").replace(/\/+$/, "");
-        return await getJson(base + "/" + encodeURIComponent(name) + "/latest", 8e3);
-      } catch {
-        return null;
-      }
+      const url = ref.registryUrl(origin, ref.registryPackagePath(name), "latest");
+      if (!url) return null;
+      const r = await ref.fetchRegistry(url, { timeoutMs: 8e3, expect: "json" });
+      return r.ok ? r.json : null;
     }
     async function repoPkg(fullName) {
       for (const branch of ["master", "main"]) {
@@ -21381,16 +21645,16 @@ var require_market = __commonJS({
         }
         return out;
       }
-      /** npm 镜像源 origin（经 dist 统一选择；dist 不可达降级官方源）。 */
+      /** npm 镜像源基址（经 dist 统一选择；dist 不可达降级官方源）。尾斜杠归一交给 registry-ref。 */
       async _npmOrigin() {
         let origin = null;
         if (this.dist) {
           try {
-            origin = await this.dist.selectRegistry(false);
+            origin = await this.dist.registryOrigin(false);
           } catch {
           }
         }
-        return (origin || REGISTRY).replace(/\/+$/, "");
+        return origin || REGISTRY;
       }
       /** npm 最新版元数据查询（镜像源选择见 _npmOrigin）。 */
       async safeFetchLatest(name) {
@@ -21840,13 +22104,14 @@ var require_cli = __commonJS({
     "use strict";
     var spawn = require_spawn();
     var procOS = require_process();
+    var registryRef = require_registry_ref();
     var { assertSafeCliArgs, cliArgv } = require_policies2();
     var CLI_TIMEOUT_MS = 18e4;
     var DEFAULT_REGISTRY = "https://registry.npmjs.org";
     async function registryOrigin(dist) {
       if (dist) {
         try {
-          return dist.selectRegistry(false);
+          return await dist.registryOrigin(false);
         } catch {
         }
       }
@@ -21868,12 +22133,10 @@ var require_cli = __commonJS({
           }
         };
         Promise.resolve().then(() => registryOrigin2()).then((regRaw) => {
-          const reg = regRaw || null;
+          const rp = registryRef.registryEnvPair(regRaw);
           const envBase = Object.assign({}, process.env, target.env);
-          if (reg) {
-            envBase.npm_config_registry = reg;
-            envBase.NPM_CONFIG_REGISTRY = reg;
-          } else if (logger && logger.warn) logger.warn("plugin CLI: \u65E0\u53EF\u7528\u7684 registry \u955C\u50CF\uFF0C\u56DE\u9000 pnpm \u9ED8\u8BA4\uFF08npmjs.org\uFF09");
+          if (rp.ok) Object.assign(envBase, rp.env);
+          else if (logger && logger.warn) logger.warn("plugin CLI: \u65E0\u53EF\u7528\u7684 registry \u955C\u50CF\uFF08" + rp.violation + "\uFF09\uFF0C\u56DE\u9000 pnpm \u9ED8\u8BA4\uFF08npmjs.org\uFF09");
           const env = envBase;
           let child;
           try {
@@ -22417,6 +22680,23 @@ var require_updater = __commonJS({
   "src/domains/plugin/updater.js"(exports2, module2) {
     "use strict";
     var { specType, isUpdateAvailable } = require_policies2();
+    async function latestCached(ctx, name, force) {
+      const c = ctx._updCache[name];
+      if (c && !force && Date.now() - c.at < ctx._updTTL) return { latest: c.latest, error: null };
+      let latest = null;
+      let error = "\u5206\u53D1\u670D\u52A1\u4E0D\u53EF\u7528";
+      if (ctx.dist) {
+        try {
+          const r = await ctx.dist.fetchNpmLatest(name);
+          latest = r && r.ok ? r.version : null;
+          error = r && r.ok ? null : r && r.error || "\u672A\u53D6\u5230\u7248\u672C";
+        } catch (e) {
+          error = e && e.message || String(e);
+        }
+      }
+      if (latest !== null) ctx._updCache[name] = { latest, at: Date.now() };
+      return { latest, error };
+    }
     async function checkUpdates(ctx, force) {
       const targets = [ctx._nativeTarget(), ...ctx._allSandboxTargets()];
       const meta = /* @__PURE__ */ new Map();
@@ -22425,17 +22705,7 @@ var require_updater = __commonJS({
           if (meta.has(p.name)) continue;
           const st = specType(p.source);
           let latest = null;
-          const c = ctx._updCache[p.name];
-          if (c && !force && Date.now() - c.at < ctx._updTTL) latest = c.latest;
-          else {
-            if (st === "npm" && ctx.dist) {
-              try {
-                latest = await ctx.dist.fetchNpmLatest(p.name);
-              } catch {
-              }
-            }
-            if (latest !== null) ctx._updCache[p.name] = { latest, at: Date.now() };
-          }
+          if (st === "npm" && ctx.dist) latest = (await latestCached(ctx, p.name, force)).latest;
           meta.set(p.name, { specType: st, latest });
         }
       }
@@ -22468,19 +22738,9 @@ var require_updater = __commonJS({
         const desc = targetStr === "all" ? "\u4EFB\u4F55\u76EE\u6807" : "\u76EE\u6807\u300C" + (targetStr || "native") + "\u300D";
         return { ok: false, error: desc + " \u672A\u5B89\u88C5\u63D2\u4EF6 " + name };
       }
-      let latest = null;
-      const c = ctx._updCache[name];
-      if (c && Date.now() - c.at < ctx._updTTL) latest = c.latest;
-      else {
-        if (ctx.dist) {
-          try {
-            latest = await ctx.dist.fetchNpmLatest(name);
-          } catch {
-          }
-        }
-        if (latest !== null) ctx._updCache[name] = { latest, at: Date.now() };
-      }
-      if (!latest) return { ok: false, error: "\u65E0\u6CD5\u83B7\u53D6 " + name + " \u7684\u6700\u65B0\u7248\u672C\uFF08registry \u4E0D\u53EF\u8FBE\uFF09\uFF0C\u8BF7\u68C0\u67E5\u7F51\u7EDC\u540E\u91CD\u8BD5" };
+      const pick = await latestCached(ctx, name, false);
+      const latest = pick.latest;
+      if (!latest) return { ok: false, error: "\u65E0\u6CD5\u83B7\u53D6 " + name + " \u7684\u6700\u65B0\u7248\u672C\uFF08" + (pick.error || "registry \u4E0D\u53EF\u8FBE") + "\uFF09\uFF0C\u8BF7\u68C0\u67E5\u7F51\u7EDC\u540E\u91CD\u8BD5" };
       const job = ctx.jobs.createJob("update", name, targetStr || "native", targets);
       if (ctx.events) ctx.events.append("plugin_update_started", { name, jobId: job.id, target: job.target, targets: targets.map((t) => t.name) });
       let idx = 0;
@@ -23407,33 +23667,39 @@ var require_npm = __commonJS({
     async function latestVersion(host2) {
       if (!host2.dist || !host2.config.packageName) throw new Error("\u5206\u53D1\u670D\u52A1\u672A\u521D\u59CB\u5316\uFF0C\u65E0\u6CD5\u67E5\u8BE2\u6700\u65B0\u7248\u672C");
       const channel = host2.config.releaseChannel || "npm";
-      return host2.dist.fetchLatestVersion(host2.config.packageName, channel);
+      return host2.dist.fetchVersionInfo(host2.config.packageName, channel);
     }
     async function selectRegistry(host2) {
       if (!host2.dist) return null;
       try {
-        return await host2.dist.selectRegistry(true);
+        return await host2.dist.registryOrigin(true);
       } catch {
         return null;
       }
     }
-    function runInstall(host2, version, registry) {
-      if (!host2.dist) return Promise.resolve({ ok: false, error: "dist \u5206\u53D1\u670D\u52A1\u4E0D\u53EF\u7528\uFF0C\u65E0\u6CD5\u5B89\u88C5", output: [] });
-      const pkg = host2.config.packageName || "@deepseek-ai/dsh";
-      const tpl = host2.config.installCommandTemplate;
+    function runNpm(host2, opts) {
+      const a = opts && opts.action || "install";
+      const verb = a === "uninstall" ? "\u5378\u8F7D" : "\u5B89\u88C5";
+      if (!host2.dist) return Promise.resolve({ ok: false, error: "dist \u5206\u53D1\u670D\u52A1\u4E0D\u53EF\u7528\uFF0C\u65E0\u6CD5" + verb, output: [] });
+      const tpl = a === "install" ? host2.config.installCommandTemplate : null;
       return host2.dist.runNpmInstall({
-        pkg,
-        version,
-        registry,
+        action: a,
+        pkg: host2.config.packageName || "@deepseek-ai/dsh",
+        version: opts && opts.version,
+        // 前缀单源：装与卸必须落在同一个全局前缀，否则「卸载成功」而包还在原地。
+        prefix: host2.npmRoot || null,
+        registry: opts && opts.registry,
+        // 只在显式注入过 npm 形态时接管启动形态；生产留空，由执行器按运行期契约解析一次。
+        launcher: host2._npmBin ? npmLaunch(host2) : null,
         commandTemplate: Array.isArray(tpl) && tpl.length ? tpl : null,
-        timeoutMs: host2.config.upgradeTimeoutMs || 6e5,
+        timeoutMs: a === "uninstall" ? host2.config.uninstallTimeoutMs : host2.config.upgradeTimeoutMs,
         onLine: (l) => {
           host2._appendUpgradeLog(l);
           if (host2.installing) host2._appendInstallLog(l);
         }
       });
     }
-    module2.exports = { npmLaunch, resolveNpmRoot, checkEnvironment, latestVersion, selectRegistry, runInstall };
+    module2.exports = { npmLaunch, resolveNpmRoot, checkEnvironment, latestVersion, selectRegistry, runNpm };
   }
 });
 
@@ -23442,9 +23708,6 @@ var require_ops4 = __commonJS({
   "src/app/native/ops.js"(exports2, module2) {
     "use strict";
     var fs2 = require("node:fs");
-    var spawnOS = require_spawn();
-    var { killTree } = require_process();
-    var { npmLaunch } = require_npm();
     var policies = require_policies3();
     var PKG_DEFAULT = "@deepseek-ai/dsh";
     function status(host2) {
@@ -23476,13 +23739,15 @@ var require_ops4 = __commonJS({
           host2.lastCheck = { at: (/* @__PURE__ */ new Date()).toISOString(), installed: null, latest: null, updateAvailable: false, note: "not-installed" };
           return policies.versionInfo(host2, installed);
         }
-        const latest = await host2._latestVersion();
+        const info = await host2._latestVersion();
+        const latest = info.ok ? info.version : null;
         host2.lastCheck = {
           at: (/* @__PURE__ */ new Date()).toISOString(),
           installed,
           latest,
           updateAvailable: latest ? policies.isNewer(latest, installed) : false,
-          error: latest ? null : "\u955C\u50CF\u6E90\u4E0D\u53EF\u8FBE\u6216\u672A\u67E5\u8BE2\u5230\u7248\u672C"
+          // 拒因指名到源：「镜像源全挂」与「确实没有更新」显示成两句话是这块的全部意义。
+          error: latest ? null : info.error || "\u955C\u50CF\u6E90\u4E0D\u53EF\u8FBE\u6216\u672A\u67E5\u8BE2\u5230\u7248\u672C"
         };
         if (host2.events) host2.events.append("version_checked", { installed, latest, updateAvailable: host2.lastCheck.updateAvailable });
       } catch (e) {
@@ -23509,20 +23774,24 @@ var require_ops4 = __commonJS({
         if (!env.ok) return { ok: false, error: "\u73AF\u5883\u68C0\u67E5\u5931\u8D25: " + env.errors.join("; ") };
         task = beginTask(host2, "install", { to: version || null, createdBy: "user" });
         let target = version;
+        let registry = null;
         if (!target) {
-          target = await host2._latestVersion().catch(() => null);
-          if (!target) {
+          const info = await host2._latestVersion().catch(() => null);
+          if (!info || !info.ok || !info.version) {
             host2.installing = null;
-            if (task) host2.tasks.fail(task.id, "\u65E0\u6CD5\u4ECE\u955C\u50CF\u6E90\u83B7\u53D6\u6700\u65B0\u7248\u672C");
-            return { ok: false, error: "\u65E0\u6CD5\u4ECE\u955C\u50CF\u6E90\u83B7\u53D6\u6700\u65B0\u7248\u672C" };
+            const why = info && info.error || "\u65E0\u6CD5\u4ECE\u955C\u50CF\u6E90\u83B7\u53D6\u6700\u65B0\u7248\u672C";
+            if (task) host2.tasks.fail(task.id, why);
+            return { ok: false, error: why };
           }
+          target = info.version;
+          registry = info.origin;
         }
-        const registry = await host2._selectRegistry();
+        if (!registry) registry = await host2._selectRegistry();
         const pkg = host2.config.packageName || PKG_DEFAULT;
         if (task) host2.tasks.log(task.id, "\u5B89\u88C5 " + pkg + "@" + target + (registry ? " via " + registry : ""));
         if (host2.events) host2.events.append("native_install_started", { version: target, registry });
         if (host2.logger.info) host2.logger.info("native install: " + pkg + "@" + target + (registry ? " via " + registry : ""));
-        const res = await host2._runInstall(target, registry);
+        const res = await host2._runNpm({ action: "install", version: target, registry });
         if (!res.ok) {
           host2.installing = null;
           host2.lastInstall = { ok: false, version: null, error: res.error, at: (/* @__PURE__ */ new Date()).toISOString(), log: host2.installLog.slice(-8) };
@@ -23614,46 +23883,9 @@ var require_ops4 = __commonJS({
           host2.tasks.start(task.id);
           host2.tasks.log(task.id, "\u5378\u8F7D " + (host2.config.packageName || PKG_DEFAULT));
         }
-        const pkg = host2.config.packageName || PKG_DEFAULT;
-        const uninstallArgs = ["uninstall", "-g"];
-        if (host2.npmRoot) uninstallArgs.push("--prefix", host2.npmRoot);
-        uninstallArgs.push(pkg);
-        const UNINSTALL_TIMEOUT_MS = typeof host2.config.uninstallTimeoutMs === "number" && host2.config.uninstallTimeoutMs > 0 ? host2.config.uninstallTimeoutMs : 15 * 60 * 1e3;
-        let uninstallTimedOut = false;
-        const exitCode = await new Promise((resolve) => {
-          let child;
-          try {
-            const np = npmLaunch(host2);
-            child = spawnOS.piped(np.program, np.args.concat(uninstallArgs));
-          } catch (e) {
-            return resolve(-1);
-          }
-          child.stdout.resume();
-          child.stderr.resume();
-          let done = false;
-          const finish = (code) => {
-            if (done) return;
-            done = true;
-            clearTimeout(timer);
-            resolve(code);
-          };
-          const timer = setTimeout(() => {
-            uninstallTimedOut = true;
-            host2.logger.warn && host2.logger.warn("npm uninstall \u8D85\u65F6\uFF08" + Math.round(UNINSTALL_TIMEOUT_MS / 1e3) + "s\uFF09\uFF0C\u7EC8\u6B62\u8FDB\u7A0B\u6811");
-            try {
-              killTree(child.pid, "SIGKILL", () => finish(-1));
-            } catch (e) {
-              try {
-                child.kill("SIGKILL");
-              } catch (e2) {
-              }
-              finish(-1);
-            }
-          }, UNINSTALL_TIMEOUT_MS);
-          if (timer.unref) timer.unref();
-          child.on("error", () => finish(-1));
-          child.on("exit", (code) => finish(code == null ? -1 : code));
-        });
+        const res = await host2._runNpm({ action: "uninstall" });
+        const exitCode = res.ok === true ? 0 : Number.isFinite(res.exitCode) ? res.exitCode : -1;
+        const timedOut = res.timedOut === true || res.aborted === true;
         if (exitCode === 0 && m) {
           if (m.packageDir) rm(m.packageDir);
           if (m.binPath) rm(m.binPath);
@@ -23664,17 +23896,17 @@ var require_ops4 = __commonJS({
         } else {
           host2.logger.warn && host2.logger.warn("npm uninstall exit " + exitCode + "\uFF0C\u4FDD\u7559 manifest \u4EE5\u4FBF\u91CD\u8BD5\uFF08\u6570\u636E\u8DEF\u5F84\u672A\u5220\uFF09");
         }
-        const uninstallError = exitCode === 0 ? null : uninstallTimedOut ? "npm uninstall \u8D85\u65F6\uFF08" + Math.round(UNINSTALL_TIMEOUT_MS / 1e3) + "s\uFF09\u5DF2\u7EC8\u6B62\uFF0C\u5305\u53EF\u80FD\u4ECD\u5728\uFF0C\u53EF\u91CD\u8BD5" : "npm uninstall \u9000\u51FA\u7801 " + exitCode;
-        host2.lastUninstall = { ok: exitCode === 0, removed, error: uninstallError, timedOut: uninstallTimedOut, at: (/* @__PURE__ */ new Date()).toISOString() };
+        const uninstallError = exitCode === 0 ? null : timedOut ? (res.error || "npm uninstall \u8D85\u65F6\u5DF2\u7EC8\u6B62") + "\uFF0C\u5305\u53EF\u80FD\u4ECD\u5728\uFF0C\u53EF\u91CD\u8BD5" : "npm uninstall \u9000\u51FA\u7801 " + exitCode;
+        host2.lastUninstall = { ok: exitCode === 0, removed, error: uninstallError, timedOut, at: (/* @__PURE__ */ new Date()).toISOString() };
         if (host2.events) host2.events.append("native_uninstalled", { removed });
         if (host2.logger.info) host2.logger.info("native uninstalled, removed " + removed.length + " paths");
         if (task) {
           if (exitCode === 0) {
             host2.tasks.log(task.id, "\u5378\u8F7D\u5B8C\u6210\uFF0C\u6E05\u7406 " + removed.length + " \u4E2A\u8DEF\u5F84");
             host2.tasks.succeed(task.id);
-          } else host2.tasks.fail(task.id, "npm uninstall \u9000\u51FA\u7801 " + exitCode);
+          } else host2.tasks.fail(task.id, uninstallError || "npm uninstall \u9000\u51FA\u7801 " + exitCode);
         }
-        return { ok: exitCode === 0, removed, timedOut: uninstallTimedOut, error: uninstallError };
+        return { ok: exitCode === 0, removed, timedOut, error: uninstallError };
       } finally {
         host2.uninstalling = null;
       }
@@ -23723,12 +23955,12 @@ var require_upgrade2 = __commonJS({
       return task;
     }
     async function resolveTarget(host2, requestedVersion, task) {
-      if (requestedVersion) return requestedVersion;
+      if (requestedVersion) return { version: requestedVersion, origin: null };
       taskLog(host2, task, "\u67E5\u8BE2\u6700\u65B0\u7248\u672C\u2026");
       log(host2, "\u67E5\u8BE2\u6700\u65B0\u7248\u672C\u2026");
-      const target = await host2._latestVersion();
-      if (!target) throw new Error("\u65E0\u6CD5\u4ECE\u4EFB\u4F55 registry \u83B7\u53D6\u6700\u65B0\u7248\u672C");
-      return target;
+      const info = await host2._latestVersion();
+      if (!info || !info.ok || !info.version) throw new Error(info && info.error || "\u65E0\u6CD5\u4ECE\u4EFB\u4F55 registry \u83B7\u53D6\u6700\u65B0\u7248\u672C");
+      return { version: info.version, origin: info.origin };
     }
     async function stopForUpgrade(host2, task) {
       if (!(host2.hooks.isDshActive && host2.hooks.isDshActive())) return;
@@ -23741,10 +23973,10 @@ var require_upgrade2 = __commonJS({
       }
       if (host2.hooks.stopForUpgrade) await host2.hooks.stopForUpgrade();
     }
-    async function installTarget(host2, oldV, target, task) {
-      const registry = await host2._selectRegistry();
+    async function installTarget(host2, oldV, target, origin, task) {
+      const registry = origin || await host2._selectRegistry();
       markStep(host2, task, "\u5B89\u88C5 " + target);
-      const res = await host2._runInstall(target, registry);
+      const res = await host2._runNpm({ action: "install", version: target, registry });
       if (!res.ok) throw new Error(res.error || "install failed");
       const newV = host2.installedVersion();
       if (newV !== target) throw new Error("\u5B89\u88C5\u540E\u7248\u672C\u6821\u9A8C\u5931\u8D25\uFF1A\u671F\u671B " + target + "\uFF0C\u5B9E\u9645 " + newV);
@@ -23840,7 +24072,7 @@ var require_upgrade2 = __commonJS({
       }
       tlog("\u81EA\u52A8\u56DE\u6EDA\u5230 " + oldVersion + "\u2026");
       const registry = await host2._selectRegistry();
-      const res = await host2._runInstall(oldVersion, registry);
+      const res = await host2._runNpm({ action: "install", version: oldVersion, registry });
       let okVer = false;
       try {
         okVer = host2.installedVersion() === oldVersion;
@@ -23870,7 +24102,7 @@ var require_upgrade2 = __commonJS({
       if (host2.events) host2.events.append("upgrade_rollback_started", { to: host2.oldVersion });
       log(host2, "\u56DE\u6EDA\u5230 " + host2.oldVersion + "\u2026");
       const registry = await host2._selectRegistry();
-      const res = await host2._runInstall(host2.oldVersion, registry);
+      const res = await host2._runNpm({ action: "install", version: host2.oldVersion, registry });
       let okVer = false;
       try {
         okVer = host2.installedVersion() === host2.oldVersion;
@@ -23934,7 +24166,8 @@ var require_upgrade2 = __commonJS({
       try {
         const oldV = host2.installedVersion();
         host2.oldVersion = oldV;
-        const target = await resolveTarget(host2, requestedVersion, task);
+        const pick = await resolveTarget(host2, requestedVersion, task);
+        const target = pick.version;
         host2.targetVersion = target;
         taskLog(host2, task, "\u76EE\u6807\u7248\u672C " + target);
         if (!oldV) {
@@ -23948,7 +24181,7 @@ var require_upgrade2 = __commonJS({
         log(host2, "\u5347\u7EA7 " + oldV + " \u2192 " + target);
         taskLog(host2, task, "\u5347\u7EA7 " + oldV + " \u2192 " + target);
         await stopForUpgrade(host2, task);
-        await installTarget(host2, oldV, target, task);
+        await installTarget(host2, oldV, target, pick.origin, task);
         if (!(host2.hooks.desiredRunning && host2.hooks.desiredRunning())) return finishStopped(host2, oldV, target, task);
         return await verifyAndFinalize(host2, oldV, target, task);
       } catch (err) {
@@ -24002,7 +24235,7 @@ var require_installer = __commonJS({
         this.lastInstall = null;
         this.lastUninstall = null;
       }
-      /** 追加安装输出（有界，仅任务进行中由 _runInstall 写入）。 */
+      /** 追加安装输出（有界，仅任务进行中由 _runNpm 的行日志写入）。 */
       _appendInstallLog(line) {
         this.installLog.push(line);
         if (this.installLog.length > 60) this.installLog.splice(0, this.installLog.length - 60);
@@ -24045,12 +24278,15 @@ var require_installer = __commonJS({
       _claimDataPaths() {
         return manifest.claimDataPaths(this);
       }
-      _runInstall(version, registry) {
-        return npm.runInstall(this, version, registry);
+      /** npm 动作的唯一出口（装/升/回滚/卸载同源），入参见 npm.runNpm。 */
+      _runNpm(opts) {
+        return npm.runNpm(this, opts);
       }
+      /** 最新版本 + 给出它的那个镜像源（结构化，回 {ok,version,origin,error}）。 */
       _latestVersion() {
         return npm.latestVersion(this);
       }
+      /** 只选源（钉死版本的安装与回滚用）；查询过版本的安装路径走 _latestVersion 的 origin。 */
       _selectRegistry() {
         return npm.selectRegistry(this);
       }