@hanamesh/dsh-app-host 0.6.17 → 0.6.20

package/README.md

@@ -1,6 +1,6 @@
 0.6.16 候选：普通市场通过注入的宿主 pluginManager.registries() 读取源事实，并按宿主锚点/版本守卫加载公开 ./registry 规则模块；AppHost 不声明、安装或捆绑 manager。发布依赖/peer闭包与0.6.15一致。pnpm自有源(null)不显式传--registry，配置镜像则传同一源；查询30秒具名超时，脱敏原诊断同进UI和日志。
 
-0.6.15 候选：市场保留官方 CLI 的 stdout/stderr 真实失败原因并脱敏，在卡片与安装确认的技术详情中显示。正文显示 pnpm 真实错误类别；宿主发布时间检查失败时列出受影响包，说明默认 24 小时与实际 cutoff，并提示到 DSH 设置检查版本、升级 DSH 或等待后手动重试；不修改 profile、pnpm 供应链策略或安装执行路径。
+0.6.15 候选：市场保留官方 CLI 的 stdout/stderr 真实失败原因并脱敏，在卡片与安装确认的技术详情中显示。正文显示 pnpm 真实错误类别；宿主发布时间检查失败时列出受影响包与实际 cutoff；HanaMesh 总包安装/升级使用精确发布版本，发布后即可验收；不修改 profile、pnpm 供应链策略或安装执行路径。
 
 官方桌面 0.2.0-rc.2 自带 pnpm 11.7.0 对同一包的多条精确 `minimumReleaseAgeExclude` 只采用首条，旧版条目会遮住后列新版，整份 lockfile 检查因而可阻断无关插件安装。本机桌面 0.2.1-rc.3 自带的 pnpm 11.28.5 已合并这些条目，相同样本通过；未推定首次修复版本。请通过官方渠道升级 DSH，保留失败的技术详情；AppHost 不绕过该检查。见 [兼容说明](docs/DSH_COMPATIBILITY.md)。
 
@@ -185,7 +185,7 @@ rc9 installation-target contract: the library accepts exact 127.0.0.1/localhost
 
 ## 0.4.0 · Devkit normal Git supply / 0.5.0 external provision supply
 
-Development installs use Node 24.13.1, pnpm 10.33.0 and the frozen `pnpm-lock.yaml`, with pnpm package-manager self-management disabled. The exact Devkit 0.2.3 / lib-provision 0.2.1 published package archives now live under `vendor/`, retaining the previous source commits and original LICENSE notices. `vendor/supply.json` records source pins and SHA256; the lock also pins archive integrity. Source installs need no private Git access or credentials. `@hanamesh/devkit` remains development-only (0.5.1 removed its unused public optional peer). The package identity is Devkit, never the shared root alias; only its published package surface is archived here. Run `pnpm run check:devkit-supply` for the public provider contract, installed archive bytes/SRI, version range and CLI checks. The provider 0.2.3 Git-only `checkConsumer` does not cover file transport and is explicitly reported as not applicable. The four mature tool engines and runtime payload are unchanged. No runtime Devkit dependency or bundled tool code is added.
+Development installs use Node 24.13.1, pnpm 10.33.0 and the frozen `pnpm-lock.yaml`, with pnpm package-manager self-management disabled. `@hanamesh/devkit` (`^0.2.6`, development-only) and `@hanamesh/lib-provision` (`^0.2.1`, bundled into the runtime tarball) are installed from the public npm registry; the lock pins version and sha512 integrity. Source installs need no private Git access or credentials. The package identity is Devkit, never the shared root alias. Run `pnpm run check:devkit-supply` for the public provider contract, installed version range, registry lock form and CLI checks. The four mature tool engines and runtime payload are unchanged. No runtime Devkit dependency or bundled tool code is added.
 
 Historical source-Git route (superseded by the fixed archives above for current installs): the upstream Git subdirectory route supports pnpm 10.33.0; npm 11.8.0 cannot install that development dependency. AppHost 0.4.x source Git consumption therefore uses pnpm, with its normal dependency build approval for this package's existing build/prepack lifecycle. A normal npm tarball runtime install remains supported and ignores development dependencies. The previously verified AppHost 0.3.0 source/tag and `^0.3.0` npm route remain byte-identical and outside the 0.4.0 range. Future 0.x minor ranges remain distinct. The independent 0.4.0 release retains the mature inlined lib-provision payload. AppHost 0.5.0 installs lib-provision from `git+https://github.com/yzsnstotz/hanamesh-lib-provision.git#semver:^0.2.1` and removes it from `dist/` and `vendor/`. The lib source candidate has no public Devkit peer or Git installation lifecycle script, so it needs no provision build allowlist; only the existing koffi lifecycle remains approved. A fresh strict two-source installation verifies this boundary. The old 0.2.0 strict peer failure remains in the task evidence; no peer override or disabled strictness is used. Run `pnpm run check:provision-supply` for the source's installed public conformance when affected; unchanged runtime/API/CLI/type checks are reused by byte evidence.
 
@@ -238,4 +238,4 @@ Actions runs on the standard public/free `macos-15` arm64 runner because the exi
 
 ## Core 公开套件声明的测试依赖
 
-源码测试通过 `@hanamesh/core/suite` 读取 Core 单源公开命令。`@hanamesh/core` 是仓库声明的 devDependency，沿本仓现有固定 vendor 正常包写法消费 Core main `62059ca586be2bffa054b5d392ebde41c51939ec` /0.3.28 的 R2 已审原件；来源、许可与完整 SHA 见 `vendor/supply.json`，声明指向本仓固定提交 `cb0bb9f7da4ca817649b65882e06ea2103b9b49d` 中该原件的公开 HTTPS tarball；现有 workflow 的 `vendor/SHA256SUMS` 和冻结 pnpm 锁分别验证同一归档的 SHA256/SRI，许可证记录见 `docs/LICENSES.json`。公开不可变 URL 符合现有发布元数据测试对新增依赖禁止 `file:/link:` 的要求，不增加例外或改变断言。干净 clone 直接按 workflow 安装，无需本机 provider consumer、手工连接或额外输入；Core 不成为运行时依赖或 bundled 包。Git 源的原 prepack 会安装私有 Devkit 开发来源，不能用于当前无凭据 CI；这里保留已审正常包原字节，不改 Core、不绕构建检查、不发布 npm。
+源码测试通过 `@hanamesh/core/suite` 读取 Core 单源公开命令。`@hanamesh/core` 是仓库声明的 devDependency，按 npm 版本范围 `^0.3.28` 从公开 npm 安装，冻结 pnpm 锁记录实际版本与 SRI；许可证记录见 `docs/LICENSES.json`。Core 不成为运行时依赖或 bundled 包。

package/dist/client-ui.js

@@ -53,7 +53,7 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy45": "删除",
     "copy46": "添加并启用",
     "copy47": "套件安装包来源",
-    "copy48": "选择三个官方套件组件的 npm 安装包 registry。市场目录源提供浏览清单，在「市场目录源」中单独设置。",
+    "copy48": "选择 HanaMesh 总包的 npm 安装包 registry。市场目录源提供浏览清单，在「市场目录源」中单独设置。",
     "copy49": "安装包来源",
     "copy50": "现有配置（默认）",
     "copy51": "Core 当前本机来源",
@@ -147,6 +147,7 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy135": "检测不到",
     "copy136": "（未启用）",
     "copy137": "。请完全退出客户端，使用补齐命令（仅 macOS / Linux 终端；Windows 安全命令暂未提供）修复并重新打开：",
+    "copy302": "。请完全退出客户端，重新读取总包发布版本后修复并重新打开。",
     "copy138": "；但应用库没能读回 profile（",
     "copy139": "），已安装列表可能仍显示「需重启」",
     "copy140": "；安装前状态未被改动（已逐项读回）",
@@ -187,7 +188,7 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy175": "打开",
     "copy176": "仅收录，不可安装",
     "copy177": "HanaMesh 套件",
-    "copy178": "已安装 · Core ",
+    "copy178": "已安装 · HanaMesh ",
     "copy179": "套件不完整，请查看组件状态",
     "copy180": "套件状态未知，请查看 Core 声明与阻断原因",
     "copy181": "Core 完整性：",
@@ -227,7 +228,7 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy215": "目录未提供版本",
     "copy216": "测试目录（fixture）",
     "copy217": "当前市场目录",
-    "copy218": "确认后升级三个官方组件；需要完全退出并重新打开客户端。",
+    "copy218": "确认后升级 HanaMesh 总包及其锁定组件；需要完全退出并重新打开客户端。",
     "copy219": "确认安装",
     "copy220": "取消",
     "copy221": "正在查询市场目录…",
@@ -360,7 +361,7 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy45": "Remove",
     "copy46": "Add and enable",
     "copy47": "Suite package source",
-    "copy48": "Choose the npm registry for the three official suite components. Browseable catalogs are configured separately in Market catalog sources.",
+    "copy48": "Choose the npm registry for the HanaMesh bundle. Browseable catalogs are configured separately in Market catalog sources.",
     "copy49": "Package source",
     "copy50": "Existing configuration (default)",
     "copy51": "Core’s current local source",
@@ -454,6 +455,7 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy135": "Not available",
     "copy136": " (disabled)",
     "copy137": ". Fully quit the client and run the repair command (macOS / Linux terminal only; no safe Windows command is supplied), then reopen: ",
+    "copy302": ". Fully quit the client, read the published bundle version again, repair and reopen.",
     "copy138": "; the market could not read the profile (",
     "copy139": "), so the installed list may still show Restart required",
     "copy140": "; the pre-install state is unchanged (each item read back)",
@@ -494,7 +496,7 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy175": "Open",
     "copy176": "Listed only; not installable",
     "copy177": "HanaMesh suite",
-    "copy178": "Installed · Core ",
+    "copy178": "Installed · HanaMesh ",
     "copy179": "Suite incomplete. Check component status",
     "copy180": "Suite status unknown. Check the Core declaration and blocking reasons",
     "copy181": "Core completeness: ",
@@ -534,7 +536,7 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy215": "No version provided by catalog",
     "copy216": "Test catalog (fixture)",
     "copy217": "Current market catalog",
-    "copy218": "Confirmation upgrades three official components. Fully quit and reopen the client afterwards.",
+    "copy218": "Confirmation upgrades the HanaMesh bundle and its locked components. Fully quit and reopen the client afterwards.",
     "copy219": "Confirm installation",
     "copy220": "Cancel",
     "copy221": "Reading market catalog…",
@@ -772,7 +774,7 @@ h('div',{className:'hm-source-add'},h('input',{value:draft,placeholder:'https://
         h('p',null,t('现有 registry：'),h('code',null,value.configuredRegistry)),
         h('p',null,t('已保存选择：')+(value.mode==='core'?t('Core 当前本机来源'):t('现有配置'))),
         observation?.observable?h('div',null,h('p',{role:'status'},t('Core 来源：')+state.status+' · '+state.selection),state.registry?h('p',null,h('code',null,state.registry)):null,state.lastError?FailureNotice({error:state.lastError}):null):h('div',null,h('p',{role:'status'},t('Core 来源暂不可用。请检查 Core 插件及其来源设置。')),h('details',null,h('summary',null,t('技术详情')),h('code',null,observation?.code??'CORE_SUITE_SOURCE_MISSING'))),
-        h('details',null,h('summary',null,t('使用说明')),h('p',null,t('选择三个官方套件组件的 npm 安装包 registry。市场目录源提供浏览清单，在「市场目录源」中单独设置。')),h('p',null,t('保存选择不会安装。检查、确认和执行前都重新读取当前来源与 Core 兼容声明；来源变化后须重新查看并确认。')))):h('p',null,t('正在读取套件安装包来源…')));
+        h('details',null,h('summary',null,t('使用说明')),h('p',null,t('选择 HanaMesh 总包的 npm 安装包 registry。市场目录源提供浏览清单，在「市场目录源」中单独设置。')),h('p',null,t('保存选择不会安装。检查、确认和执行前都重新读取当前来源与 Core 兼容声明；来源变化后须重新查看并确认。')))):h('p',null,t('正在读取套件安装包来源…')));
   }
   function NodeRuntimeSection(){useLocale();
     const[value,setValue]=React.useState(null),[draft,setDraft]=React.useState(null),[plan,setPlan]=React.useState(null),[error,setError]=React.useState(''),[working,setWorking]=React.useState(false);
@@ -849,7 +851,7 @@ h('div',{className:'hm-source-add'},h('input',{value:draft,placeholder:'https://
     return(pnpmCode?pnpmCode+' · ':'')+(t(FAILURE_REASONS[code])??t('详细原因见宿主日志'));
   };
   const operationNotice=op=>op?h('div',null,h('p',{role:op.failed?'alert':'status',className:op.failed?'hm-library-failed':'hm-library-ok',style:{overflowWrap:'anywhere'}},t(op.text)),op.diagnostic?h('details',null,h('summary',null,t('技术详情')),h('pre',{style:{whiteSpace:'pre-wrap',overflowWrap:'anywhere'}},op.diagnostic)):null):null;
-  const suiteRecoveryText=details=>details?.stage==='suite-upgrade'?t('；升级未完成，部分组件可能已改变。当前读回：')+(details.actual?.components?.map(c=>c.label+' '+(c.version??t('检测不到'))+(c.active?'':t('（未启用）'))).join('；')||t('检测不到'))+t('。请完全退出客户端，使用补齐命令（仅 macOS / Linux 终端；Windows 安全命令暂未提供）修复并重新打开：')+details.command:'';
+  const suiteRecoveryText=details=>details?.stage==='suite-upgrade'?t('；升级未完成，部分组件可能已改变。当前读回：')+(details.actual?.components?.map(c=>c.label+' '+(c.version??t('检测不到'))+(c.active?'':t('（未启用）'))).join('；')||t('检测不到'))+(details.command?t('。请完全退出客户端，使用补齐命令（仅 macOS / Linux 终端；Windows 安全命令暂未提供）修复并重新打开：')+details.command:t('。请完全退出客户端，重新读取总包发布版本后修复并重新打开。')):'';
   /** pluginManager applied it, but the profile could not be read back: the installed list may still say 「需重启」. */
   const baselineText=result=>result?.restartBaseline?.updated===false?t('；但应用库没能读回 profile（')+result.restartBaseline.code+t('），已安装列表可能仍显示「需重启」'):'';
   /** rc.10 install recovery result: only an item-by-item readback that matched the baseline is shown as restored. */
@@ -863,7 +865,7 @@ h('div',{className:'hm-source-add'},h('input',{value:draft,placeholder:'https://
   const KIND_TEXT={application:t('应用'),plugin:t('插件'),listing:t('仅收录')};
   const STATE_TEXT={registered:t('已安装'),installed:t('已安装'),'installed-not-loaded':t('需重启'),'uninstalled-not-unloaded':t('已卸载 · 需重启'),'runtime-missing':t('缺运行时'),invalid:t('包无效')};
   // Mirrors PROTECTED_PACKAGES on the host: the suite is never offered an uninstall button (the host answers 403 anyway).
-  const PROTECTED=new Set(['@hanamesh/core','@hanamesh/usage','@hanamesh/brand','@hanamesh/dsh-app-host','hanamesh-core','hanamesh-usage','hanamesh-brand','@hanamesh/dsh-core','@hanamesh/dsh-usage']);
+  const PROTECTED=new Set(['@hanamesh/hanamesh','@hanamesh/core','@hanamesh/usage','@hanamesh/dsh-app-host','hanamesh-brand']);
   function RestartNotice({reason}){useLocale();
     return h('p',{role:'status',className:'hm-restart-notice','data-hanamesh-restart':'required'},h('strong',null,t('需重新打开客户端')),' ',reason??t('插件更改需要重新打开客户端后生效。'),' ',h('span',{className:'hm-restart-hint'},t('请完全退出 HanaMesh 客户端或 DSH 后重新打开；关闭窗口不等于退出。')));
   }
@@ -1049,7 +1051,7 @@ h('div',{className:'hm-source-add'},h('input',{value:draft,placeholder:'https://
     const card=item=>{const row=item.installed,op=pending[item.id],busy=op?.busy;const installBody={itemId:item.id,...(item.package?.name?{packageName:item.package.name}:{})};
       let action=h('span',null,t('仅收录，不可安装')),state=null;
       if(row)state=h('span',{className:'hm-market-state','data-hanamesh-state':row.state},(t(STATE_TEXT[row.state]??row.state))+(row.version?' '+row.version:''));
-      if(item.kind==='suite')return h('article',{key:item.id,'data-hanamesh-library-item':item.id,'data-hanamesh-kind':'suite'},h('h3',null,t('HanaMesh 套件')),h('p',null,item.summary),h('p',null,item.suite?.status==='installed'?t('已安装 · Core ')+item.suite.version:item.suite?.status==='incomplete'?t('套件不完整，请查看组件状态'):t('套件状态未知，请查看 Core 声明与阻断原因')),item.suite?.completeness?h('p',null,t('Core 完整性：')+item.suite.completeness):null,...(item.suite?.components??[]).map(c=>h('p',{key:c.name},c.requiredRange?c.label+t(' · 要求 ')+c.requiredRange+t(' · 实际 ')+(c.actualVersion??t('检测不到'))+' · '+c.status:c.label+' · '+(c.version??t('检测不到'))+(c.active?'':t(' · 未启用')))),...(item.suite?.blocked??[]).map((row,i)=>h('p',{key:'blocked-'+i,role:'status'},row.code+(row.moduleName?' · '+row.moduleName:'')+(row.coreVersion?' · '+row.coreVersion:''))),item.suiteUpgradeUnavailable?h('p',{role:'status'},item.suiteUpgradeUnavailable):null,h('button',{type:'button',disabled:Boolean(item.suiteUpgradeUnavailable),onClick:()=>void openInstallTarget({itemId:'hanamesh:suite-upgrade'}).catch(()=>{})},t('检查兼容升级')));
+      if(item.kind==='suite')return h('article',{key:item.id,'data-hanamesh-library-item':item.id,'data-hanamesh-kind':'suite'},h('h3',null,t('HanaMesh 套件')),h('p',null,item.summary),h('p',null,item.suite?.status==='installed'?t('已安装 · HanaMesh ')+item.suite.version:item.suite?.status==='incomplete'?t('套件不完整，请查看组件状态'):t('套件状态未知，请查看 Core 声明与阻断原因')),item.suite?.completeness?h('p',null,t('Core 完整性：')+item.suite.completeness):null,...(item.suite?.components??[]).map(c=>h('p',{key:c.name},c.requiredRange?c.label+t(' · 要求 ')+c.requiredRange+t(' · 实际 ')+(c.actualVersion??t('检测不到'))+' · '+c.status:c.label+' · '+(c.version??t('检测不到'))+(c.active?'':t(' · 未启用')))),...(item.suite?.blocked??[]).map((row,i)=>h('p',{key:'blocked-'+i,role:'status'},row.code+(row.moduleName?' · '+row.moduleName:'')+(row.bundleVersion?' · HanaMesh '+row.bundleVersion:''))),item.suiteUpgradeUnavailable?h('p',{role:'status'},item.suiteUpgradeUnavailable):null,h('button',{type:'button',disabled:Boolean(item.suiteUpgradeUnavailable),onClick:()=>void openInstallTarget({itemId:'hanamesh:suite-upgrade'}).catch(()=>{})},t('检查兼容升级')));
       if(busy)action=h('button',{type:'button',disabled:true},t(op.text));
       else if(item.kind!=='listing'&&!row)action=h('button',{type:'button',onClick:()=>void operate('/hanamesh/library/install',installBody,item.id,t('安装'))},op?.failed?t('重试安装'):t('安装'));
       else if(row&&item.upgradeAvailable)action=h('span',{className:'hm-market-actions'},h('button',{type:'button',onClick:()=>void operate('/hanamesh/library/install',installBody,item.id,t('升级'))},t('升级到 ')+item.latestVersion),row.state==='registered'?openButton(row):null);
@@ -1081,9 +1083,9 @@ h('div',{className:'hm-source-add'},h('input',{value:draft,placeholder:'https://
           h('input',{'aria-label':t('包名'),value:targetPackageName,placeholder:t('packageName（可选）'),onChange:event=>setTargetPackageName(event.target.value)}),h('button',{type:'submit'},t('查看安装目标')))):null,
         target?h('div',{role:target.status==='confirmation-required'?'dialog':'status','aria-label':t('市场安装确认')},
           target.item?h('dl',null,h('dt',null,t('插件名')),h('dd',null,target.item.displayName),h('dt',null,t('包名')),h('dd',null,target.item.package.name),h('dt',null,t('版本')),h('dd',null,target.item.latestVersion??t('目录未提供版本')),h('dt',null,t('来源')),h('dd',null,target.source?.kind==='fixture'?t('测试目录（fixture）'):target.source?.manifestUrl??t('当前市场目录'))):null,
-          target.item?.suiteUpgrade?h('ul',null,...target.item.suiteUpgrade.components.map(c=>h('li',{key:c.name},c.label+'：'+c.from+' → '+c.to)),h('li',null,t('确认后升级三个官方组件；需要完全退出并重新打开客户端。'))):null,
+          target.item?.suiteUpgrade?h('ul',null,...target.item.suiteUpgrade.components.map(c=>h('li',{key:c.name},c.label+'：'+c.from+' → '+c.to)),h('li',null,t('确认后升级 HanaMesh 总包及其锁定组件；需要完全退出并重新打开客户端。'))):null,
           target.item?.suiteUpgrade?.registry?h('p',null,'Registry：'+target.item.suiteUpgrade.registry):null,
-          ...(target.item?.suiteUpgrade?.blocked??target.details?.blocked??[]).map((row,i)=>h('p',{key:'suite-blocked-'+i,role:'status'},row.code+(row.moduleName?' · '+row.moduleName:'')+(row.coreVersion?' · '+row.coreVersion:''))),
+          ...(target.item?.suiteUpgrade?.blocked??target.details?.blocked??[]).map((row,i)=>h('p',{key:'suite-blocked-'+i,role:'status'},row.code+(row.moduleName?' · '+row.moduleName:'')+(row.bundleVersion?' · HanaMesh '+row.bundleVersion:''))),
           target.status==='confirmation-required'?h('div',null,h('button',{type:'button',onClick:()=>void confirmTarget()},t('确认安装')),h('button',{type:'button',onClick:()=>{targetSequence++;void reportHandoff(targetSelection?.handoffId,'cancelled');setTarget({...targetSelection,status:'cancelled'});}},t('取消'))):
           target.status==='failed'?FailureNotice({error:target.diagnostic??target.error}):h('p',{role:['readback-failed','suite-upgrade-failed'].includes(target.status)?'alert':'status'},({resolving:t('正在查询市场目录…'),installing:t('安装中…'),installed:t('安装完成，请查看已安装列表'),'installed-live':t('安装完成，已加载，可以直接使用'),cancelled:t('已取消，未安装'),'result-unavailable':t('安装结果不可追溯，请查看已安装列表；不会自动重试'),'already-installed':t('已安装，无需重复安装'),failed:t('未安装：')+(target.error??pending[target.item?.id]?.text??t('安装失败')),'readback-failed':target.error,'suite-upgrade-failed':suiteTargetFailure(target)})[target.status]),
           target.item?.source?h('div',{'aria-label':t('目录条目来源')},h('p',null,target.item.source.sourceId+' · '+target.item.source.sourceRef),...(target.item.source.sourceLinks??[]).map((link,index)=>h('p',{key:index},h('a',{href:link.sourceUrl,target:'_blank',rel:'noopener noreferrer'},link.sourceId+' · '+link.sourceRef),h('small',null,' '+link.firstSeenAt+' / '+link.lastSeenAt)))):null,

package/dist/installation-status.d.ts

@@ -12,7 +12,7 @@ export interface InstallationStatusRequest {contractVersion:'1';consent:'read-in
 export interface InstallationObservation {
  channel:'hanamesh'|'dsh'|'claude'|'codex';
  scope:{id:'current-runtime'|'other-runtime'|'agent-cli'|'desktop-app';kind:'responding-runtime'|'unobserved-runtime'|'official-user-profile'|'desktop-app';label:string};
- status:'installed'|'not-installed'|'incomplete'|'unknown';version:string|null;versionKind:'core'|'agent-distribution';
+ status:'installed'|'not-installed'|'incomplete'|'unknown';version:string|null;versionKind:'suite-bundle'|'agent-distribution';
  components:readonly {name:string;version:string|null;active?:boolean;status?:string}[];
  identity:{pluginName:string;marketplace:string}|null;
  reason:{code:string;message:string;action:string}|null;

package/dist/library/install.js

@@ -10,10 +10,10 @@ import {noteFailurePhase} from './diagnostics.js';
 import { validateDefinition } from '../descriptor.js';
 import { itemKind } from './catalog.js';
 import { profileSnapshot, runtimeSnapshot, profileChecks, runtimeChecks, packageRestoreArgs, keepOriginals } from './recovery.js';
-import {prepareSuiteUpgrade,readSuiteStatus,createCoreSuiteAdapter} from './suite.js';
+import {SUITE_BUNDLE,prepareSuiteUpgrade,readSuiteStatus,createCoreSuiteAdapter} from './suite.js';
 
-/** The HanaMesh suite itself (real names + the historical scoped spellings) is never installed or removed through the market. */
-export const PROTECTED_PACKAGES=Object.freeze(['@hanamesh/core','@hanamesh/usage','@hanamesh/brand','@hanamesh/dsh-app-host','hanamesh-core','hanamesh-usage','hanamesh-brand','@hanamesh/dsh-core','@hanamesh/dsh-usage']);
+/** Suite packages are changed only by the confirmed suite upgrade command. */
+export const PROTECTED_PACKAGES=Object.freeze([SUITE_BUNDLE,'@hanamesh/core','@hanamesh/usage','@hanamesh/dsh-app-host','hanamesh-brand']);
 const blocked=new Set(PROTECTED_PACKAGES);
 const packageName=value=>typeof value==='string'&&/^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/.test(value);
 const versionText=value=>typeof value==='string'&&/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(value);
@@ -195,24 +195,24 @@ export function createLibraryInstaller({profileDir,profileName,dataRoot,nodeBina
       requireCondition(suitePlan?.planId===planId,'SUITE_PLAN_CHANGED','升级确认已变化，请重新查看并确认。',{},409);
       const confirmed=suitePlan;suitePlan=undefined;
       const fresh=await prepareSuiteUpgrade({coreSuitePlan:suiteProvider});
-      const identity=plan=>JSON.stringify({sourceBinding:plan.sourceBinding,components:plan.components,declarationId:plan.declarationId,registry:plan.registry,selectedUpgrade:plan.selectedUpgrade,physicalBaseline:plan.physicalBaseline});
+      const identity=plan=>JSON.stringify({sourceBinding:plan.sourceBinding,bundle:plan.bundle,components:plan.components,declarationId:plan.declarationId,registry:plan.registry,selectedUpgrade:plan.selectedUpgrade,physicalBaseline:plan.physicalBaseline});
       requireCondition(identity(fresh)===identity(confirmed),'SUITE_PLAN_CHANGED','套件声明或版本已变化，请重新查看并确认。',{},409);
       requireCondition(fresh.available,'SUITE_NO_UPDATE','当前没有兼容新版。',{},409);
       const before=await readSuiteStatus(profileDir);
-      requireCondition(before.status==='installed'&&fresh.components.every((c,i)=>before.components[i]?.version===c.from),'SUITE_PLAN_CHANGED','已装版本或启用状态已变化，请重新查看并确认。',{},409);
+      requireCondition(before.status==='installed'&&before.version===fresh.bundle.from&&fresh.components.every((c,i)=>before.components[i]?.version===c.from),'SUITE_PLAN_CHANGED','已装版本或启用状态已变化，请重新查看并确认。',{},409);
       requireCondition(cliAvailable,'DSH_CLI_UNAVAILABLE','套件升级需客户端随附的官方 CLI；请恢复后重试。',{},503);
       const executing=await prepareSuiteUpgrade({coreSuitePlan:suiteProvider});
       requireCondition(identity(executing)===identity(confirmed),'SUITE_PLAN_CHANGED','执行前套件安装包来源或声明已变化，请重新查看并确认。',{},409);
-      emit({type:'library.install-started',itemId:'hanamesh:suite-upgrade',packageName:'@hanamesh/core',kind:'suite-upgrade'});
+      emit({type:'library.install-started',itemId:'hanamesh:suite-upgrade',packageName:SUITE_BUNDLE,kind:'suite-upgrade'});
       try{
-        await run(['add','--save-exact','--strict-peer-dependencies',`--registry=${fresh.registry??registry??'https://registry.npmjs.org'}`,...fresh.components.map(c=>`${c.name}@${c.to}`)]);
+        await run(['add','--save-exact','--strict-peer-dependencies',`--registry=${fresh.registry??registry??'https://registry.npmjs.org'}`,`${SUITE_BUNDLE}@${fresh.bundle.to}`]);
         const actual=await readSuiteStatus(profileDir);
         const saved=await json(join(profileDir,'package.json'));
-        requireCondition(actual.status==='installed'&&fresh.components.every((c,i)=>actual.components[i]?.version===c.to&&saved.dependencies?.[c.name]===c.to),'INSTALL_READBACK_MISMATCH','套件升级后的版本或启用状态不符，请完全退出后按补齐命令修复。',{},502);
-        return{status:'restart-required',kind:'suite-upgrade',packageName:'@hanamesh/core',components:fresh.components,version:actual.version};
+        requireCondition(actual.status==='installed'&&actual.version===fresh.bundle.to&&saved.dependencies?.[SUITE_BUNDLE]===fresh.bundle.to&&fresh.components.every((c,i)=>actual.components[i]?.version===c.to),'INSTALL_READBACK_MISMATCH','套件升级后的版本或启用状态不符，请完全退出后按补齐命令修复。',{},502);
+        return{status:'restart-required',kind:'suite-upgrade',packageName:SUITE_BUNDLE,components:fresh.components,version:actual.version};
       }catch(error){
         error.details={...error.details,stage:'suite-upgrade',actual:await readSuiteStatus(profileDir),command:fresh.installCommand};
-        emit({type:'library.install-failed',packageName:'@hanamesh/core',code:error.code??'SUITE_UPGRADE_FAILED'});throw error;
+        emit({type:'library.install-failed',packageName:SUITE_BUNDLE,code:error.code??'SUITE_UPGRADE_FAILED'});throw error;
       }
     });},
     async install(item,context){

package/dist/library/installation-status.js

@@ -1,7 +1,7 @@
 /** Read fresh public installation facts. No compatibility calculation, persistence or polling. */
 import semver from 'semver';
 import {AppHostError} from '../errors.js';
-import {createCoreSuiteAdapter,SUITE_PACKAGES} from './suite.js';
+import {SUITE_BUNDLE,createCoreSuiteAdapter,SUITE_PACKAGES} from './suite.js';
 import {SUPPORTED_READER_VERSIONS,validReader,runOfficialInstallationCommand} from './installation-cli.js';
 const object=x=>x!==null&&typeof x==='object'&&!Array.isArray(x);
 const exact=x=>typeof x==='string'&&semver.valid(x)===x?x:null;
@@ -11,7 +11,7 @@ function abortable(work,signal){
  if(signal.aborted)return Promise.reject(interrupted());
  return new Promise((resolve,reject)=>{const abort=()=>reject(interrupted());signal.addEventListener('abort',abort,{once:true});Promise.resolve(work).then(resolve,reject).finally(()=>signal.removeEventListener('abort',abort))});
 }
-const base=(channel,id,kind,label)=>({channel,scope:{id,kind,label},status:'unknown',version:null,versionKind:['dsh','hanamesh'].includes(channel)?'core':'agent-distribution',components:[],identity:null,reason:null});
+const base=(channel,id,kind,label)=>({channel,scope:{id,kind,label},status:'unknown',version:null,versionKind:['dsh','hanamesh'].includes(channel)?'suite-bundle':'agent-distribution',components:[],identity:null,reason:null});
 const unknown=(row,code,message,action)=>({...row,status:'unknown',version:null,reason:reason(code,message,action)});
 const agentBase=channel=>base(channel,'agent-cli','official-user-profile',channel==='claude'?'Claude Code 用户级插件（不覆盖项目或其他隔离资料）':'Codex CLI 本地市场用户资料（不代表桌面 App、项目或其他隔离资料）');
 const inventoryError=()=>{throw new AppHostError('AGENT_INVENTORY_INVALID','Official inventory shape is unsupported.',{},503)};
@@ -58,7 +58,7 @@ export function createInstallationStatusReader({client='dsh',core=()=>undefined,
   const row=base(client,'current-runtime','responding-runtime',client==='dsh'?'当前响应的 DSH runtime':'当前响应的 HanaMesh 客户端 runtime');
   try{const value=await abortable(suite.readFacts(),signal);
    const components=value.components.map(c=>({name:c.name,version:exact(c.version),...(['satisfied','missing','incompatible','damaged','unreadable','inactive','failed','ambiguous'].includes(c.status)?{status:c.status}:{}),...(typeof c.active==='boolean'?{active:c.active}:{})}));
-   const blocked=value.blocked.map(r=>({code:/^CORE_[A-Z0-9_]{1,75}$/.test(r.code)?r.code:'CORE_SUITE_BLOCKED',...(SUITE_PACKAGES.some(c=>c.name===r.moduleName)?{moduleName:r.moduleName}:{})}));
+   const blocked=value.blocked.map(r=>({code:/^CORE_[A-Z0-9_]{1,75}$/.test(r.code)?r.code:'CORE_SUITE_BLOCKED',...(r.moduleName===SUITE_BUNDLE||SUITE_PACKAGES.some(c=>c.name===r.moduleName)?{moduleName:r.moduleName}:{})}));
    return{...row,status:value.status,version:value.status==='unknown'?null:exact(value.version),components,blocked,
     reason:value.status==='unknown'?reason('CORE_SUITE_DECLARATION_UNKNOWN','Core 尚不能确认本 runtime 的套件完整性。','查看 Core 设置中的具名阻断原因，补齐其公开事实后重新检测。'):value.status==='incomplete'?reason('CORE_SUITE_CURRENT_INCOMPLETE','Core 报告本 runtime 的套件不完整。','在本客户端按 Core 组件说明修复后重新检测。'):null};
   }catch(error){if(signal.aborted)throw interrupted();const code=['CORE_SUITE_DECLARATION_MISSING','CORE_SUITE_DECLARATION_INVALID'].includes(error.code)?error.code:'CORE_SUITE_READ_FAILED';return unknown(row,code,code==='CORE_SUITE_DECLARATION_MISSING'?'本 runtime 未提供 Core 套件声明方法。':'本次 Core 套件声明读取失败。','启用支持 protocol 1 getSuiteDeclaration 的 Core，查看其设置并重新检测。')}

package/dist/library/service.js

@@ -2,7 +2,7 @@ import { randomUUID } from 'node:crypto';
 import { AppHostError, requireCondition, SerialQueue } from '../errors.js';
 import { loadCatalog, isApplication, itemKind, upgradeAvailable, validateManifestUrl } from './catalog.js';
 import { scanInstalled, scanInstalledPlugins, snapshotProfileDependencies } from './installed.js';
-import {SUITE_TARGET,SUITE_PACKAGES,readSuiteStatus,CORE_SUITE_DECLARATION_MISSING,readSuiteSourceState} from './suite.js';
+import {SUITE_BUNDLE,SUITE_TARGET,SUITE_PACKAGES,readSuiteStatus,CORE_SUITE_DECLARATION_MISSING,readSuiteSourceState} from './suite.js';
 import { PROTECTED_PACKAGES } from './install.js';
 import { handoffSettings } from './handoff.js';
 import { INSTALLATION_STATUS_CAPABILITY } from '../installation-status.js';
@@ -70,7 +70,7 @@ export function createLibraryService({domain,host,config={},dataRoot,ledgerReade
       requireCondition(packageName===undefined,'INVALID_INPUT','套件升级不接受包名或任意替换参数。');
       requireCondition(typeof installer?.prepareSuiteUpgrade==='function','SUITE_UPGRADE_UNAVAILABLE','当前客户端还不支持安全套件升级，请使用补齐命令。',{},503);
       const plan=await installer.prepareSuiteUpgrade();
-      return{contractVersion:'1',source:{kind:'suite',manifestUrl:'https://github.com/yzsnstotz'},item:{id:SUITE_TARGET,displayName:'HanaMesh 套件',kind:'suite-upgrade',package:{registry:'npm',name:'@hanamesh/core'},latestVersion:plan.components[0].to,installed:{state:'installed',version:suiteStatus.version},upgradeAvailable:plan.available,suiteUpgrade:plan}};
+      return{contractVersion:'1',source:{kind:'suite',manifestUrl:'https://github.com/yzsnstotz'},item:{id:SUITE_TARGET,displayName:'HanaMesh 套件',kind:'suite-upgrade',package:{registry:'npm',name:SUITE_BUNDLE},latestVersion:plan.bundle.to,installed:{state:'installed',version:suiteStatus.version},upgradeAvailable:plan.available,suiteUpgrade:plan}};
     }
     requireCondition(itemId!==undefined||packageName!==undefined,'INVALID_INPUT','itemId or packageName is required.');
     requireCondition(itemId===undefined||(text(itemId,160)&&!/[\u0000-\u001f\u007f]/.test(itemId)),'INVALID_INPUT','itemId is invalid.');
@@ -152,7 +152,7 @@ export function createLibraryService({domain,host,config={},dataRoot,ledgerReade
     get live(){return Boolean(installer?.live);},
     async upgradeSuite(input){requireInstaller('Suite upgrade is unavailable.');
       requireCondition(input&&Object.keys(input).length===1&&typeof input.planId==='string','INVALID_INPUT','Only the current planId is accepted.');
-      return await operation('install',async()=>{try{const result=await installer.upgradeSuite(input);suiteStatus={...await suiteFacts(),restartRequired:true};return result;}catch(error){if(error.details?.stage!=='suite-upgrade')throw error;const actual=await readSuiteStatus(config.profileDir);suiteStatus={...await suiteFacts(),restartRequired:true,upgradeError:error.code??'SUITE_UPGRADE_FAILED'};error.details={...error.details,stage:'suite-upgrade',actual,command:error.details.command};emit({type:'library.install-failed',packageName:'@hanamesh/core',code:error.code??'SUITE_UPGRADE_FAILED',details:{stage:'suite-upgrade',actual,command:error.details.command}});throw error;}});
+      return await operation('install',async()=>{try{const result=await installer.upgradeSuite(input);suiteStatus={...await suiteFacts(),restartRequired:true};return result;}catch(error){if(error.details?.stage!=='suite-upgrade')throw error;const actual=await readSuiteStatus(config.profileDir);suiteStatus={...await suiteFacts(),restartRequired:true,upgradeError:error.code??'SUITE_UPGRADE_FAILED'};error.details={...error.details,stage:'suite-upgrade',actual,command:error.details.command};emit({type:'library.install-failed',packageName:SUITE_BUNDLE,code:error.code??'SUITE_UPGRADE_FAILED',details:{stage:'suite-upgrade',actual,command:error.details.command}});throw error;}});
     },
     async install(input){requireCondition(input?.itemId!==SUITE_TARGET,'SUITE_CONFIRMATION_REQUIRED','请在客户端确认完整升级计划。',{},403);requireInstaller('Install requires absolute profileDir, nodeBinary, dshBin and profileName.');const{item}=await resolveTarget(input??{});if(present(item.installed)&&!item.upgradeAvailable)return{status:'already-installed',itemId:item.id,packageName:item.package.name};return await installItem(item);},
     async provision(input){requireInstaller('Runtime provision is unavailable.');

package/dist/library/suite.js

@@ -1,9 +1,12 @@
 import {readFile} from 'node:fs/promises';
 import {join} from 'node:path';
 import semver from 'semver';
+import {createRequire} from 'node:module';
+import {pathToFileURL} from 'node:url';
 import {randomUUID} from 'node:crypto';
 import {requireCondition} from '../errors.js';
 
+export const SUITE_BUNDLE='@hanamesh/hanamesh';
 export const SUITE_TARGET='hanamesh:suite-upgrade';
 export const SUITE_PACKAGES=Object.freeze([
   {name:'@hanamesh/core',label:'Core',repo:'hanamesh-core'},
@@ -17,11 +20,16 @@ export async function readSuiteStatus(profileDir){
   try{
     const profile=await json(join(profileDir,'package.json'));
     if(!profile.dependencies||!Array.isArray(profile.dsh?.profile?.bundles))throw new Error('unreadable profile');
+    const resolver=createRequire(pathToFileURL(join(profileDir,'package.json')));
+    let bundle,bundlePath;try{bundlePath=resolver.resolve(`${SUITE_BUNDLE}/package.json`);bundle=await json(bundlePath);}catch{}
+    const memberResolver=bundlePath?createRequire(bundlePath):resolver;
+    const selected=profile.dsh.profile.bundles.includes(SUITE_BUNDLE)&&Object.hasOwn(profile.dependencies,SUITE_BUNDLE);
     const components=await Promise.all(SUITE_PACKAGES.map(async({name,label})=>{
-      let pkg;try{pkg=await json(join(profileDir,'node_modules',name,'package.json'));}catch{}
-      return{name,label,version:pkg?.name===name&&semver.valid(pkg.version)?pkg.version:null,active:profile.dsh.profile.bundles.includes(name)};
+      let pkg;try{pkg=await json(memberResolver.resolve(`${name}/package.json`));}catch{}
+      return{name,label,version:pkg?.name===name&&semver.valid(pkg.version)?pkg.version:null,active:selected};
     }));
-    return{status:components.every(c=>c.version&&c.active)?'installed':'incomplete',version:components[0].version,components};
+    const version=bundle?.name===SUITE_BUNDLE&&semver.valid(bundle.version)?bundle.version:null;
+    return{status:version&&selected&&components.every(c=>c.version&&bundle.dependencies?.[c.name]===c.version)?'installed':'incomplete',version,components};
   }catch{return{status:'unknown',version:null,components:[]};}
 }
 export const CORE_SUITE_DECLARATION_MISSING='Core 未提供套件声明';
@@ -31,10 +39,16 @@ const exact=value=>typeof value==='string'&&semver.valid(value)===value;
 const digest=value=>typeof value==='string'&&/^[a-f0-9]{64}$/.test(value);
 const nullableText=value=>value===null||text(value);
 const invalid=()=>requireCondition(false,'CORE_SUITE_DECLARATION_INVALID','Core 套件声明无法用于精确安装。',{},503);
+function exactInstallCommand(value){
+  if(value===null)return true;
+  const prefix=`dsh plugin --profile desktop add --save-exact ${SUITE_BUNDLE}@`;
+  return typeof value==='string'&&value.startsWith(prefix)&&exact(value.slice(prefix.length));
+}
 function validateDeclaration(value){
-  if(!object(value)||value.schemaVersion!==1||!text(value.checkedAt)||!text(value.installCommand)||!digest(value.declarationId)||!text(value.nodeVersion)||!nullableText(value.registry)||!['complete','incomplete','unknown'].includes(value.completeness))invalid();
+  if(!object(value)||value.schemaVersion!==1||!text(value.checkedAt)||!exactInstallCommand(value.installCommand)||!digest(value.declarationId)||!text(value.nodeVersion)||!nullableText(value.registry)||!(value.bundleVersion===null||exact(value.bundleVersion))||!['complete','incomplete','unknown'].includes(value.completeness))invalid();
+  if(value.completeness==='complete'&&!exact(value.bundleVersion))invalid();
   const manifest=value.manifest;
-  if(!object(manifest)||manifest.schemaVersion!==1||!text(manifest.id)||!object(manifest.core)||manifest.core.name!==SUITE_PACKAGES[0].name||!exact(manifest.core.version)||!text(manifest.core.repository)||!Array.isArray(manifest.components)||manifest.components.length!==2)invalid();
+  if(!object(manifest)||manifest.schemaVersion!==1||!text(manifest.id)||!object(manifest.bundle)||manifest.bundle.name!==SUITE_BUNDLE||!text(manifest.bundle.repository)||!object(manifest.core)||manifest.core.name!==SUITE_PACKAGES[0].name||!exact(manifest.core.version)||!text(manifest.core.repository)||!Array.isArray(manifest.components)||manifest.components.length!==2)invalid();
   const members=new Map();
   for(const row of manifest.components){if(!object(row)||!text(row.id)||!SUITE_PACKAGES.slice(1).some(p=>p.name===row.moduleName)||members.has(row.moduleName)||!text(row.versionRange)||!text(row.repository))invalid();members.set(row.moduleName,row.id);}
   if(!Array.isArray(value.installed)||value.installed.length!==3||!Array.isArray(value.upgrades)||!Array.isArray(value.blocked)||!object(value.peerFacts)||!object(value.metadataDigests))invalid();
@@ -43,13 +57,12 @@ function validateDeclaration(value){
     if(!object(row)||!text(row.id)||!SUITE_PACKAGES.some(p=>p.name===row.moduleName)||installed.has(row.moduleName)||!text(row.requiredRange)||!text(row.repository)||!(row.actualVersion===null||exact(row.actualVersion))||!nullableText(row.actualRepository)||!text(row.status)||(row.runningVersion!==undefined&&!exact(row.runningVersion)))invalid();
     installed.set(row.moduleName,row);
   }
-  for(const row of value.blocked)if(!object(row)||!text(row.code)||(row.coreVersion!==undefined&&!text(row.coreVersion))||(row.moduleName!==undefined&&!text(row.moduleName)))invalid();
+  for(const row of value.blocked)if(!object(row)||!text(row.code)||(row.bundleVersion!==undefined&&!exact(row.bundleVersion))||(row.moduleName!==undefined&&!text(row.moduleName)))invalid();
   if(!Object.values(value.peerFacts).every(nullableText)||!Object.values(value.metadataDigests).every(text))invalid();
   for(const upgrade of value.upgrades){
-    if(!object(upgrade)||!exact(upgrade.coreVersion)||!text(upgrade.registry)||!digest(upgrade.manifestDigest)||!Array.isArray(upgrade.targets)||upgrade.targets.length!==3)invalid();
+    if(!object(upgrade)||!object(upgrade.bundle)||!text(upgrade.bundle.id)||upgrade.bundle.moduleName!==SUITE_BUNDLE||!exact(upgrade.bundle.version)||!text(upgrade.bundle.repository)||!digest(upgrade.bundle.metadataDigest)||!text(upgrade.registry)||!Array.isArray(upgrade.targets)||upgrade.targets.length!==3)invalid();
     const targets=new Set();
     for(const row of upgrade.targets){if(!object(row)||!text(row.id)||!SUITE_PACKAGES.some(p=>p.name===row.moduleName)||targets.has(row.moduleName)||!exact(row.version)||!text(row.repository)||!digest(row.metadataDigest))invalid();targets.add(row.moduleName);}
-    if(upgrade.targets.find(row=>row.moduleName===SUITE_PACKAGES[0].name).version!==upgrade.coreVersion)invalid();
   }
   return structuredClone(value);
 }
@@ -98,12 +111,12 @@ export function createCoreSuiteAdapter({core=()=>undefined,registry,suiteSourceM
     const selectedUpgrade=declaration.upgrades[0];
     requireCondition(selectedUpgrade.registry===declaration.registry,'CORE_SUITE_SOURCE_MISMATCH','Core 升级组合来源与执行 registry 不符。',{},409);
     const components=SUITE_PACKAGES.map(({name,label})=>{const from=declaration.installed.find(row=>row.moduleName===name).actualVersion;if(!exact(from))invalid();return{name,label,from,to:selectedUpgrade.targets.find(row=>row.moduleName===name).version};});
-    return{available:true,components,installCommand:declaration.installCommand,sourceBinding:binding,declarationId:declaration.declarationId,registry:declaration.registry,selectedUpgrade,physicalBaseline:declaration.installed,upgrades:declaration.upgrades,blocked:declaration.blocked};
+    return{available:true,bundle:{name:SUITE_BUNDLE,from:declaration.bundleVersion,to:selectedUpgrade.bundle.version},components,installCommand:declaration.installCommand,sourceBinding:binding,declarationId:declaration.declarationId,registry:declaration.registry,selectedUpgrade,physicalBaseline:declaration.installed,upgrades:declaration.upgrades,blocked:declaration.blocked};
   };
   Object.defineProperty(get,'unavailable',{get:()=>current()?null:CORE_SUITE_DECLARATION_MISSING});
   get.readFacts=async()=>{
     const declaration=await read();
-    return{status:declaration.completeness==='complete'?'installed':declaration.completeness,completeness:declaration.completeness,version:declaration.installed.find(row=>row.moduleName==='@hanamesh/core').actualVersion,
+    return{status:declaration.completeness==='complete'?'installed':declaration.completeness,completeness:declaration.completeness,version:declaration.bundleVersion,
       components:declaration.installed.map(row=>({...row,name:row.moduleName,label:SUITE_PACKAGES.find(p=>p.name===row.moduleName).label,version:row.actualVersion})),blocked:declaration.blocked};
   };
   return get;
@@ -119,7 +132,7 @@ export async function prepareSuiteUpgrade({coreSuitePlan}={}){
   const plan=await coreSuitePlan();
   requireCondition(plan!==undefined&&plan!==null,'CORE_SUITE_DECLARATION_MISSING',CORE_SUITE_DECLARATION_MISSING,{},503);
   const invalid=()=>requireCondition(false,'CORE_SUITE_DECLARATION_INVALID','Core 套件声明无法用于精确安装。',{},503);
-  if(typeof plan!=='object'||Array.isArray(plan)||typeof plan.available!=='boolean'||!text(plan.installCommand)||!Array.isArray(plan.components)||plan.components.length!==SUITE_PACKAGES.length)invalid();
+  if(typeof plan!=='object'||Array.isArray(plan)||typeof plan.available!=='boolean'||!object(plan.bundle)||plan.bundle.name!==SUITE_BUNDLE||!exact(plan.bundle.from)||!exact(plan.bundle.to)||!exactInstallCommand(plan.installCommand)||!Array.isArray(plan.components)||plan.components.length!==SUITE_PACKAGES.length)invalid();
   const rows=new Map();
   for(const row of plan.components){
     if(!row||typeof row!=='object'||!SUITE_PACKAGES.some(p=>p.name===row.name)||rows.has(row.name)||typeof row.from!=='string'||semver.valid(row.from)!==row.from||typeof row.to!=='string'||semver.valid(row.to)!==row.to)invalid();

package/docs/INSTALLATION_STATUS.md

@@ -40,7 +40,7 @@ interface InstallationObservation {
     kind:'responding-runtime'|'unobserved-runtime'|'official-user-profile'|'desktop-app';label:string};
   status:'installed'|'not-installed'|'incomplete'|'unknown';
   version:string|null;
-  versionKind:'core'|'agent-distribution';
+  versionKind:'suite-bundle'|'agent-distribution';
   components:readonly {name:string;version:string|null;active?:boolean;status?:string}[];
   identity:{pluginName:string;marketplace:string}|null;
   reason:{code:string;message:string;action:string}|null;
@@ -50,7 +50,7 @@ interface InstallationObservation {
 
 The five distinct observations are: responding runtime, the other DSH/HanaMesh runtime (always `unknown`, not observed by this responder), Claude Code configured user-level CLI scope, Codex CLI configured local-marketplace user scope, and Codex/ChatGPT desktop App scope (always named `unknown`). CLI labels explicitly exclude project/other isolated profiles and desktop App. A valid absence is absence **only in the named configured scope**; never show it as a machine-wide uninstall. Preserve every responder/scope; ports are not durable instance identities. Conflicts between responders are unknown, never resolved by choosing one installed result.
 
-Current runtime status/version/components come only from the optional public Core protocol `'1'` `getSuiteDeclaration()` **without an argument**, through the existing Core adapter. No registry request, health substitution, physical file-count completeness, version-range/peer/source algorithm or local upgrade selection is added. Complete maps to installed; incomplete stays incomplete; unknown stays unknown with top-level version null but known component versions and sanitized named blocked codes retained. Missing method, malformed declaration and read failure have distinct reasons. Each detection re-reads; Core removal/invalidation cannot reuse an old installed answer. Agent distribution version is independent of Core version. Missing active fields remain absent.
+Current runtime status/version/components come only from the optional public Core protocol `'1'` `getSuiteDeclaration()` **without an argument**, through the existing Core adapter. No registry request, health substitution, physical file-count completeness, version-range/peer/source algorithm or local upgrade selection is added. Complete maps to installed; incomplete stays incomplete; unknown stays unknown with top-level version null but known component versions and sanitized named blocked codes retained. Missing method, malformed declaration and read failure have distinct reasons. Each detection re-reads; Core removal/invalidation cannot reuse an old installed answer. Agent distribution version is independent of the DSH suite bundle version. Missing active fields remain absent.
 
 ## Explicit agent reader settings
 
@@ -94,3 +94,5 @@ Per-scope unknown reasons always include a safe code/message/action:
 Start each explicit detection by clearing previous observations. Cancel fetch when the person clears/revokes/leaves, the consumer/identity changes, or the window unmounts. Discard late request generations. A failed read/capability disappearance never keeps old installed status. Do not poll, persist, forward inventory or change Core/Usage recording consent. G's website consumer owns these page lifecycle rules; the bridge cancels on disconnect and module unload and holds no cross-request observation cache.
 
 Official command references: [Claude Code plugin commands](https://code.claude.com/docs/en/plugins/cli-reference), [Codex CLI plugin reference](https://learn.chatgpt.com/docs/cli/reference). [OpenAI local plugin scope documentation](https://developers.openai.com/plugins/build/plugins) describes multiple client scopes; CLI installation is not used here as proof of the desktop App.
+
+For DSH/HanaMesh runtime observations, versionKind is suite-bundle and version is the installed @hanamesh/hanamesh version. Component rows retain their physical versions. Agent distribution observations retain their existing semantics.

package/docs/LIBRARY.md

@@ -94,3 +94,5 @@ HanaMesh 视图原样保留可选 `official:boolean`（包括 false）与 C-INDE
 原生 lookup 异常包为 `REGISTRY_LOOKUP_FAILED`，原 Error 保留于 cause；已知具名码保留。`library.*-failed.details.diagnostic` 最多4001字符，含脱敏异常类型/消息/cause.code 与实际 registry configuration/fetch/readback、CLI run、profile readback 阶段；CLI 非零另含 exit、signal 与 stderr/输出摘要。同一摘要及 operationId 写宿主 logger.warn（logger失效时安全console），UI已有可展开技术详情显示，并提示检查 DSH 源设置/网络后手动重试。不记录请求头、正文、环境、stack 或任意 details；不猜历史丢失的原错。
 
 规则模块只由宿主公开exports提供；普通DSH用与manager版本查询相同createRequire(anchor)，Desktop限已证明的runtimeDir与匹配版本。没有新增manager依赖/peer、没有生产规则副本；无法定位/加载规则或端口不完整均REGISTRY_CONFIG_UNAVAILABLE。钉SHA的rc.2规则仅位于tests/fixtures，不进入发布包。
+
+D1: DSH suite installation and upgrades use only @hanamesh/hanamesh. Core owns the bundle metadata and exact three dependency targets. A confirmed strict CLI add changes the bundle once; readback checks its saved version, activation and locked physical children. The suite display version is the bundle version. Ordinary market install/remove denies the bundle.

package/docs/LICENSES.json

@@ -1,7 +1,7 @@
 {
   "package": {
     "name": "@hanamesh/dsh-app-host",
-    "version": "0.6.17",
+    "version": "0.6.20",
     "license": "SEE LICENSE IN LICENSE",
     "source": "git+https://github.com/yzsnstotz/hanamesh-plugin-app-host.git",
     "purpose": "Application ownership, view leases, Router forwarding, and application library for official DSH"
@@ -11,16 +11,13 @@
     "@hanamesh/lib-provision": {
       "version": "0.2.1",
       "license": "SEE LICENSE IN LICENSE",
-      "source": "file:vendor/hanamesh-lib-provision-0.2.1.tgz",
+      "source": "^0.2.1",
       "purpose": "Runtime provision/remove/ledger API; 随包分发、源仓不变; no inlined copy",
-      "sha256": "4217b9fe1be98f6e82437539d1c4c43166ed1f5c292efff100733e0cb09530e9",
       "specs": {
-        "dependencies": "file:vendor/hanamesh-lib-provision-0.2.1.tgz"
+        "dependencies": "^0.2.1"
       },
-      "sourceCommit": "575d63fb70e08c47e980dbf25f07921a7ba5aa2a",
-      "distribution": "bundleDependencies; original LICENSE at node_modules/@hanamesh/lib-provision/LICENSE",
-      "originalSource": "git+https://github.com/yzsnstotz/hanamesh-lib-provision.git#575d63fb70e08c47e980dbf25f07921a7ba5aa2a",
-      "archiveSha256": "4217b9fe1be98f6e82437539d1c4c43166ed1f5c292efff100733e0cb09530e9"
+      "sourceCommit": "838cf462de9192fb5f2d63497212e7275f5c6e39",
+      "distribution": "bundleDependencies; original LICENSE at node_modules/@hanamesh/lib-provision/LICENSE"
     },
     "zod": {
       "version": "4.5.4",
@@ -235,27 +232,25 @@
       }
     },
     "@hanamesh/devkit": {
-      "version": "0.2.3",
+      "version": "0.2.6",
       "license": "SEE LICENSE IN LICENSE",
-      "source": "file:vendor/hanamesh-devkit-0.2.3.tgz",
+      "source": "https://registry.npmjs.org/@hanamesh/devkit/-/devkit-0.2.6.tgz",
       "purpose": "Development-only centralized tool execution; never imported by runtime; no public peer",
       "usedAs": [
         "devDependencies"
       ],
       "specs": {
-        "devDependencies": "file:vendor/hanamesh-devkit-0.2.3.tgz"
+        "devDependencies": "^0.2.6"
       },
-      "sourceCommit": "e6ccf710369a77c5fbf9ce4810b182727e4f2aa8",
       "licenseNotice": "# HanaMesh distribution notice\n\nThis package contains HanaMesh-owned code. The project owner confirmed that its\nown code may be distributed (D-2026-10-05-02) and directed correction of outdated\nprivate / UNLICENSED package metadata (D-2026-10-05-16, 2026-10-05).\n\nThis notice records that distribution authorization. It does not assign an SPDX\nlicense identifier, adopt MIT or another standard license, or grant additional\nrelicensing rights. Rights not covered by the owner's recorded distribution\nauthorization remain reserved. See LICENSE_RECORD.md for the package name,\nversion, source, purpose and third-party boundaries.\n\nThird-party components retain their existing licenses. No third-party component\nis relicensed by this notice. This metadata change is not an npm publication or\na change to repository visibility.\n",
-      "distributionRecord": "# Devkit license and distribution record\n\n| Name | Version | License / authorization | Source | Purpose |\n| --- | --- | --- | --- | --- |\n| @hanamesh/devkit | 0.2.3 | SEE LICENSE IN LICENSE; HanaMesh-owned distribution authorized in D-2026-10-05-02 and D-2026-10-05-16; no new standard license or relicensing grant | yzsnstotz/hanamesh-server-shared, packages/devkit; baseline b2b5c9bb7faa990e3eb9f99007abd6427d62e88b / rc.1 | Development preflight, mutation execution, package verification and toolchain checks |\n\nThe original rc.1 manifest contained private=true and license=UNLICENSED, with no\nstandalone LICENSE text. Those obsolete metadata fields are superseded for rc.2\nby private=false and this explicit distribution notice. The old tarball and\nrecords remain unchanged. 0.2.0 adds Git tag-range installation and the\n`contract/` supply schema, fixtures and suite under the same authorization;\nit still adds no dependency. This package has no dependency or peerDependency and\nships no third-party runtime or compiler. It uses Node standard-library APIs;\nNode itself is supplied by the consumer and is not bundled here.\n\nAuthority: the project owner's 2026-10-05 instruction to correct lib-provision\nand devkit vendor metadata under D-2026-10-05-02, recorded in D-2026-10-05-16.\nThe notice does not extend that instruction into a new general license.\n",
+      "distributionRecord": "# Devkit license and distribution record\n\n| Name | Version | License / authorization | Source | Purpose |\n| --- | --- | --- | --- | --- |\n| @hanamesh/devkit | 0.2.6 | SEE LICENSE IN LICENSE; HanaMesh-owned distribution authorized in D-2026-10-05-02 and D-2026-10-05-16; no new standard license or relicensing grant | yzsnstotz/hanamesh-server-shared, packages/devkit; baseline b2b5c9bb7faa990e3eb9f99007abd6427d62e88b / rc.1 | Development preflight, mutation execution, package verification and toolchain checks |\n\nThe original rc.1 manifest contained private=true and license=UNLICENSED, with no\nstandalone LICENSE text. Those obsolete metadata fields are superseded for rc.2\nby private=false and this explicit distribution notice. The old tarball and\nrecords remain unchanged. 0.2.0 adds Git tag-range installation and the\n`contract/` supply schema, fixtures and suite under the same authorization;\nit still adds no dependency. This package has no dependency or peerDependency and\nships no third-party runtime or compiler. It uses Node standard-library APIs;\nNode itself is supplied by the consumer and is not bundled here.\n\nAuthority: the project owner's 2026-10-05 instruction to correct lib-provision\nand devkit vendor metadata under D-2026-10-05-02, recorded in D-2026-10-05-16.\nThe notice does not extend that instruction into a new general license.\n",
       "licenseSha256": "242b0b71d3a4a91899ccf38fb70f06d151f3f005c3d7ac7d1e4a6c0461dc0e2d",
       "historicalArtifact": {
         "version": "0.2.0",
         "sha256": "de15f0913dd6de5ba9ce96b8d92ea862ec44489eb698628de963cbbead68bc25",
         "sourceCommit": "8f9bcc69cbacf01d97ffe63bbbade4f865e6dd89"
       },
-      "originalSource": "git+https://github.com/yzsnstotz/hanamesh-server-shared.git#semver:^0.2.0&path:/packages/devkit",
-      "archiveSha256": "40d7ad33b2802677d12111943f3472aa6e4564ba000d48074a32de33ff51c7bb"
+      "sourceCommit": "019033b83aa0ede9e0c54d735f1ee5349fe39998"
     },
     "semver": {
       "version": "7.8.5",
@@ -298,13 +293,13 @@
     "@hanamesh/core": {
       "version": "0.3.28",
       "license": "MIT",
-      "source": "https://raw.githubusercontent.com/yzsnstotz/hanamesh-plugin-app-host/cb0bb9f7da4ca817649b65882e06ea2103b9b49d/vendor/hanamesh-core-0.3.28.tgz",
+      "source": "https://registry.npmjs.org/@hanamesh/core/-/core-0.3.28.tgz",
       "purpose": "Development-only public Core suite declaration and provider-owned install command for clean CI; never runtime or bundled",
       "usedAs": [
         "devDependencies"
       ],
       "specs": {
-        "devDependencies": "https://raw.githubusercontent.com/yzsnstotz/hanamesh-plugin-app-host/cb0bb9f7da4ca817649b65882e06ea2103b9b49d/vendor/hanamesh-core-0.3.28.tgz"
+        "devDependencies": "^0.3.28"
       },
       "sourceCommit": "62059ca586be2bffa054b5d392ebde41c51939ec",
       "archiveSha256": "9ef8c250efa3bc46de583dc82103719d71d9f3dcc2233fd49731b4467337efa9",

package/docs/PROVENANCE.json

@@ -69,35 +69,31 @@
   "historicalCandidateLicense": "UNLICENSED; no upstream-license inheritance or open-source grant asserted",
   "developmentArtifacts": {
     "@hanamesh/devkit": {
-      "version": "0.2.3",
-      "source": "file:vendor/hanamesh-devkit-0.2.3.tgz",
-      "sourceCommit": "e6ccf710369a77c5fbf9ce4810b182727e4f2aa8",
-      "mode": "Fixed provider package archive; unchanged published files at sourceCommit; development-only, excluded from runtime tarball",
+      "version": "0.2.6",
+      "source": "https://registry.npmjs.org/@hanamesh/devkit/-/devkit-0.2.6.tgz",
+      "sourceCommit": "019033b83aa0ede9e0c54d735f1ee5349fe39998",
+      "mode": "Public npm package; development-only, excluded from runtime tarball",
       "license": "SEE LICENSE IN LICENSE",
       "distributionNotice": "Canonical LICENSE and LICENSE_RECORD.md copied verbatim to docs/LICENSES.json; no new MIT or relicensing grant",
       "lockfile": {
         "path": "pnpm-lock.yaml",
-        "resolution": "fixed file archive with integrity, no Git credentials"
+        "resolution": "npm registry version with sha512 integrity, no Git credentials"
       },
       "licenseSha256": "242b0b71d3a4a91899ccf38fb70f06d151f3f005c3d7ac7d1e4a6c0461dc0e2d",
       "historicalArtifact": {
         "version": "0.2.0",
         "sha256": "de15f0913dd6de5ba9ce96b8d92ea862ec44489eb698628de963cbbead68bc25",
         "sourceCommit": "8f9bcc69cbacf01d97ffe63bbbade4f865e6dd89"
-      },
-      "originalSource": "git+https://github.com/yzsnstotz/hanamesh-server-shared.git#semver:^0.2.0&path:/packages/devkit",
-      "sha256": "40d7ad33b2802677d12111943f3472aa6e4564ba000d48074a32de33ff51c7bb"
+      }
     }
   },
   "externalArtifacts": {
     "@hanamesh/lib-provision": {
       "version": "0.2.1",
-      "source": "file:vendor/hanamesh-lib-provision-0.2.1.tgz",
-      "sha256": "4217b9fe1be98f6e82437539d1c4c43166ed1f5c292efff100733e0cb09530e9",
-      "mode": "Fixed provider package archive; unchanged published files at sourceCommit; bundled runtime dependency",
-      "sourceCommit": "575d63fb70e08c47e980dbf25f07921a7ba5aa2a",
-      "license": "SEE LICENSE IN LICENSE",
-      "originalSource": "git+https://github.com/yzsnstotz/hanamesh-lib-provision.git#575d63fb70e08c47e980dbf25f07921a7ba5aa2a"
+      "source": "https://registry.npmjs.org/@hanamesh/lib-provision/-/lib-provision-0.2.1.tgz",
+      "mode": "Public npm package; bundled runtime dependency",
+      "sourceCommit": "838cf462de9192fb5f2d63497212e7275f5c6e39",
+      "license": "SEE LICENSE IN LICENSE"
     }
   },
   "historicalInputNotice": "Top-level legacy input/runtime/prototype fields below describe the original rc.12 intake only. Current candidate identity and verification are in currentCandidate; they do not inherit legacy host/UI evidence."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanamesh/dsh-app-host",
-  "version": "0.6.17",
+  "version": "0.6.20",
   "description": "HanaMesh application ownership, durable view leases, and application library for official DSH 0.2.x",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",
@@ -86,7 +86,7 @@
   },
   "dependencies": {
     "zod": "4.5.4",
-    "@hanamesh/lib-provision": "file:vendor/hanamesh-lib-provision-0.2.1.tgz",
+    "@hanamesh/lib-provision": "^0.2.1",
     "semver": "7.8.5"
   },
   "peerDependencies": {
@@ -115,7 +115,7 @@
     }
   },
   "devDependencies": {
-    "@hanamesh/core": "https://raw.githubusercontent.com/yzsnstotz/hanamesh-plugin-app-host/cb0bb9f7da4ca817649b65882e06ea2103b9b49d/vendor/hanamesh-core-0.3.28.tgz",
+    "@hanamesh/core": "^0.3.28",
     "@deepseek-ai/cordis": "4.0.5-alpha.1",
     "@deepseek-ai/dsh-host-webserver": "0.2.1-alpha.2",
     "@deepseek-ai/dsh-scope": "0.2.1-alpha.2",
@@ -128,7 +128,7 @@
     "@deepseek-ai/dsh-storage-json": "0.2.1-alpha.2",
     "@deepseek-ai/schemastery": "3.18.5-alpha.1",
     "typescript": "5.8.3",
-    "@hanamesh/devkit": "file:vendor/hanamesh-devkit-0.2.3.tgz",
+    "@hanamesh/devkit": "^0.2.6",
     "@deepseek-ai/dsh-client-ui-renderer": "0.2.1-alpha.2",
     "@hanamesh/release-platform-gate": "file:vendor/hanamesh-release-platform-gate-0.1.10.tgz"
   },