@hanamesh/dsh-app-host 0.6.18 → 0.6.21

package/README.md

@@ -1,6 +1,8 @@
+0.6.21 候选：普通市场和网站交接消费 Indexer 的固定 GitHub SHA/子目录/包名/构建名单。客户端沿原确认页展示来源、完整 commit 与本机构建提示；确认回传同一目标，目录更新不得换 SHA。执行仍走受控官方 DSH CLI / pnpm，读回精确来源与启用项后报告需完全退出重开；没有改上游或另写安装器。详见 [安装目标](docs/INSTALL_TARGET.md)。初轮已完成隔离 DSH、网站及真实 DTO 验收；本轮 R25 另修未匹配固定目标时的拒绝与退休目录版本字段，仍待复审，不宣称已发布。
+
 0.6.16 候选：普通市场通过注入的宿主 pluginManager.registries() 读取源事实，并按宿主锚点/版本守卫加载公开 ./registry 规则模块；AppHost 不声明、安装或捆绑 manager。发布依赖/peer闭包与0.6.15一致。pnpm自有源(null)不显式传--registry，配置镜像则传同一源；查询30秒具名超时，脱敏原诊断同进UI和日志。
 
-0.6.15 候选：市场保留官方 CLI 的 stdout/stderr 真实失败原因并脱敏，在卡片与安装确认的技术详情中显示。正文显示 pnpm 真实错误类别；宿主发布时间检查失败时列出受影响包，说明默认 24 小时与实际 cutoff，并提示到 DSH 设置检查版本、升级 DSH 或等待后手动重试；不修改 profile、pnpm 供应链策略或安装执行路径。
+0.6.15 候选：市场保留官方 CLI 的 stdout/stderr 真实失败原因并脱敏，在卡片与安装确认的技术详情中显示。正文显示 pnpm 真实错误类别；宿主发布时间检查失败时列出受影响包与实际 cutoff；HanaMesh 总包安装/升级使用精确发布版本，发布后即可验收；不修改 profile、pnpm 供应链策略或安装执行路径。
 
 官方桌面 0.2.0-rc.2 自带 pnpm 11.7.0 对同一包的多条精确 `minimumReleaseAgeExclude` 只采用首条，旧版条目会遮住后列新版，整份 lockfile 检查因而可阻断无关插件安装。本机桌面 0.2.1-rc.3 自带的 pnpm 11.28.5 已合并这些条目，相同样本通过；未推定首次修复版本。请通过官方渠道升级 DSH，保留失败的技术详情；AppHost 不绕过该检查。见 [兼容说明](docs/DSH_COMPATIBILITY.md)。
 

package/dist/client-ui.d.ts

@@ -17,7 +17,10 @@ export function LibraryOverlay(props?:{embedded?:boolean,preferredSubsectionId?:
 export function MarketConflictNotice():unknown;
 /** Identifiers only; metadata and confirmation are owned by the client's market. */
 /** rc.8: `contractVersion` optionally declares the install-target contract the caller speaks; absent means v1, any other value is refused with CONTRACT_VERSION_UNSUPPORTED. */
-export interface InstallTarget {itemId?:string;packageName?:string;contractVersion?:'1';}
+export type PackageInstallTarget =
+  | {source:'npm';name:string;version:string;allowBuild:string[]}
+  | {source:'github';repo:string;ref:string;path:string|null;packageName:string;allowBuild:string[]};
+export interface InstallTarget {itemId?:string;packageName?:string;contractVersion?:'1';installTarget?:PackageInstallTarget;}
 export interface InstallTargetReceipt {status:'confirmation-required'|'installing'|'already-installed'|'superseded';itemId?:string;packageName?:string;}
 /** Show/resolve a target without installing. Resolves once confirmation is ready; rejects with a visible market error. */
 export function openInstallTarget(input:InstallTarget):Promise<InstallTargetReceipt>;

package/dist/client-ui.js

@@ -53,7 +53,7 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy45": "删除",
     "copy46": "添加并启用",
     "copy47": "套件安装包来源",
-    "copy48": "选择三个官方套件组件的 npm 安装包 registry。市场目录源提供浏览清单，在「市场目录源」中单独设置。",
+    "copy48": "选择 HanaMesh 总包的 npm 安装包 registry。市场目录源提供浏览清单，在「市场目录源」中单独设置。",
     "copy49": "安装包来源",
     "copy50": "现有配置（默认）",
     "copy51": "Core 当前本机来源",
@@ -147,6 +147,7 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy135": "检测不到",
     "copy136": "（未启用）",
     "copy137": "。请完全退出客户端，使用补齐命令（仅 macOS / Linux 终端；Windows 安全命令暂未提供）修复并重新打开：",
+    "copy302": "。请完全退出客户端，重新读取总包发布版本后修复并重新打开。",
     "copy138": "；但应用库没能读回 profile（",
     "copy139": "），已安装列表可能仍显示「需重启」",
     "copy140": "；安装前状态未被改动（已逐项读回）",
@@ -187,7 +188,7 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy175": "打开",
     "copy176": "仅收录，不可安装",
     "copy177": "HanaMesh 套件",
-    "copy178": "已安装 · Core ",
+    "copy178": "已安装 · HanaMesh ",
     "copy179": "套件不完整，请查看组件状态",
     "copy180": "套件状态未知，请查看 Core 声明与阻断原因",
     "copy181": "Core 完整性：",
@@ -197,7 +198,6 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy185": "检查兼容升级",
     "copy186": "重试安装",
     "copy187": "升级",
-    "copy188": "升级到 ",
     "copy189": "补齐运行时",
     "copy190": "卸载",
     "copy191": "已卸载，重启 DSH 后生效",
@@ -223,11 +223,9 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy211": "查看安装目标",
     "copy212": "市场安装确认",
     "copy213": "插件名",
-    "copy214": "版本",
-    "copy215": "目录未提供版本",
     "copy216": "测试目录（fixture）",
     "copy217": "当前市场目录",
-    "copy218": "确认后升级三个官方组件；需要完全退出并重新打开客户端。",
+    "copy218": "确认后升级 HanaMesh 总包及其锁定组件；需要完全退出并重新打开客户端。",
     "copy219": "确认安装",
     "copy220": "取消",
     "copy221": "正在查询市场目录…",
@@ -280,7 +278,7 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy268": "交接状态只给发起它的那个网站看",
     "copy269": "一个网站不能读另一个网站的交接",
     "copy270": "交接请求体不超过 4096 字节",
-    "copy271": "合法请求只有插件 id、包名、合约版本三项，最长不到 500 字节；更大的一定不是交接",
+    "copy271": "交接只包含目录身份、合约版本及已审核的结构化安装目标；正文上限为 4096 字节，不接受来源命令",
     "copy272": "端口在 1024–65535 之间、互不重复，至少一个",
     "copy273": "1024 以下要管理员权限；没有端口就没有地方让网站找到",
     "copy274": "网站必须写成来源（协议 + 域名 [+ 端口]），http 只允许 127.0.0.1 / localhost",
@@ -360,7 +358,7 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy45": "Remove",
     "copy46": "Add and enable",
     "copy47": "Suite package source",
-    "copy48": "Choose the npm registry for the three official suite components. Browseable catalogs are configured separately in Market catalog sources.",
+    "copy48": "Choose the npm registry for the HanaMesh bundle. Browseable catalogs are configured separately in Market catalog sources.",
     "copy49": "Package source",
     "copy50": "Existing configuration (default)",
     "copy51": "Core’s current local source",
@@ -454,6 +452,7 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy135": "Not available",
     "copy136": " (disabled)",
     "copy137": ". Fully quit the client and run the repair command (macOS / Linux terminal only; no safe Windows command is supplied), then reopen: ",
+    "copy302": ". Fully quit the client, read the published bundle version again, repair and reopen.",
     "copy138": "; the market could not read the profile (",
     "copy139": "), so the installed list may still show Restart required",
     "copy140": "; the pre-install state is unchanged (each item read back)",
@@ -494,7 +493,7 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy175": "Open",
     "copy176": "Listed only; not installable",
     "copy177": "HanaMesh suite",
-    "copy178": "Installed · Core ",
+    "copy178": "Installed · HanaMesh ",
     "copy179": "Suite incomplete. Check component status",
     "copy180": "Suite status unknown. Check the Core declaration and blocking reasons",
     "copy181": "Core completeness: ",
@@ -504,7 +503,6 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy185": "Check compatible upgrade",
     "copy186": "Retry installation",
     "copy187": "Upgrade",
-    "copy188": "Upgrade to ",
     "copy189": "Prepare runtime",
     "copy190": "Uninstall",
     "copy191": "Uninstalled; restart DSH to apply",
@@ -530,11 +528,9 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy211": "Review installation target",
     "copy212": "Confirm market installation",
     "copy213": "Plugin name",
-    "copy214": "Version",
-    "copy215": "No version provided by catalog",
     "copy216": "Test catalog (fixture)",
     "copy217": "Current market catalog",
-    "copy218": "Confirmation upgrades three official components. Fully quit and reopen the client afterwards.",
+    "copy218": "Confirmation upgrades the HanaMesh bundle and its locked components. Fully quit and reopen the client afterwards.",
     "copy219": "Confirm installation",
     "copy220": "Cancel",
     "copy221": "Reading market catalog…",
@@ -587,7 +583,7 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy268": "Handoff status is visible only to the website that created it.",
     "copy269": "One website cannot read another website’s handoffs.",
     "copy270": "Handoff request body must not exceed 4096 bytes.",
-    "copy271": "A valid handoff contains only item ID, package name and contract version, under 500 bytes; a larger request is not a valid handoff.",
+    "copy271": "A handoff contains only catalog identity, contract version and the reviewed package target. The body limit is 4096 bytes; source commands are not accepted.",
     "copy272": "Provide at least one distinct port between 1024 and 65535.",
     "copy273": "Lower ports need administrator permissions. Without a port the website cannot find this client.",
     "copy274": "Websites must be origins (scheme + domain [+ port]). HTTP is allowed only for 127.0.0.1 / localhost.",
@@ -619,6 +615,8 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy301": "Supports macOS 13.5+ (Apple Silicon / Intel). Windows installation, guardian and cancellation verification are not connected; this flow does not support Windows."
   }
 };
+  Object.assign(COPY.zh,{githubRepository:'来源仓库',githubCommit:'固定 commit',githubPath:'仓库子目录',githubBuild:'会在本机执行构建脚本',githubBuildPolicy:'确认后将按名单允许构建；pnpm 会把许可保存到当前 profile。',githubNoBuild:'未授予构建脚本许可'});
+  Object.assign(COPY.en,{githubRepository:'Source repository',githubCommit:'Pinned commit',githubPath:'Repository subdirectory',githubBuild:'Build scripts will run on this computer',githubBuildPolicy:'Confirmation permits the listed builds; pnpm saves these permissions in the current profile.',githubNoBuild:'No build scripts are approved'});
   const COPY_KEYS=new Map(Object.entries(COPY.zh).map(([key,text])=>[text,key]));
   let localeService=null;
   function t(text){if(typeof text==='function')return text();const key=COPY_KEYS.get(text);if(!key)return text;return localeService?localeService.bind('hanamesh.apphost')(key):COPY.zh[key];}
@@ -664,6 +662,7 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
   let targetSelection=null,targetSequence=0,pendingOperations={};
   const targetListeners=new Set(),pendingListeners=new Set();
   const INSTALL_TARGET_HASH='#hanamesh-install?',INSTALL_TARGET_CONTRACT_VERSION='1';
+  const targetQuery=input=>new URLSearchParams({...input,...(input.installTarget?{installTarget:JSON.stringify(input.installTarget)}:{})});
   const CORE_SUITE_FAILURES={CORE_SUITE_DECLARATION_MISSING:t('Core 未提供套件声明'),CORE_SUITE_DECLARATION_INVALID:t('Core 套件声明无法用于精确安装。')};
   const suiteTargetFailure=target=>target.previewFailed?t('兼容升级检查未通过，尚未执行安装：')+(t(CORE_SUITE_FAILURES[target.error])??target.error??t('检测不到结果')):t(CORE_SUITE_FAILURES[target.error])??(target.details?.stage==='suite-upgrade'?t('套件升级未完成：')+(target.error??t('检测不到结果'))+t('。请核对当前版本；完全退出后可使用 HanaMesh 设置中的补齐命令修复并重新打开。'):t('套件升级未完成或结果尚未确认：')+(target.error??t('检测不到结果'))+t('。请核对已装版本；不会自动重试。'));
   const setTarget=value=>{targetSelection=value;for(const listener of targetListeners)listener(value);};
@@ -675,11 +674,12 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
       if(!input||typeof input!=='object'||Array.isArray(input))throw new Error('INVALID_INPUT');
       // rc.8: optional contract declaration; absent keeps v1 semantics, an unsupported version is refused before any request.
       if(input.contractVersion!==undefined&&input.contractVersion!==INSTALL_TARGET_CONTRACT_VERSION)throw new Error('CONTRACT_VERSION_UNSUPPORTED');
-      if(Object.keys(input).some(key=>!['itemId','packageName','contractVersion'].includes(key))||(!input.itemId&&!input.packageName)||
+      if(Object.keys(input).some(key=>!['itemId','packageName','contractVersion','installTarget'].includes(key))||(!input.itemId&&!input.packageName)||
+        (input.installTarget!==undefined&&(!input.itemId||!input.installTarget||typeof input.installTarget!=='object'||Array.isArray(input.installTarget)))||
         (input.itemId!==undefined&&(typeof input.itemId!=='string'||!input.itemId.length||input.itemId.length>160||/[\u0000-\u001f\u007f]/.test(input.itemId)))||
         (input.packageName!==undefined&&(typeof input.packageName!=='string'||input.packageName.length>214||!/^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/.test(input.packageName))))throw new Error('INVALID_INPUT');
       setTarget({status:'resolving',input:{...input}});
-      const query=new URLSearchParams(input),resolved=await request('/hanamesh/library/target?'+query);
+      const query=targetQuery(input),resolved=await request('/hanamesh/library/target?'+query);
       if(sequence!==targetSequence)return{status:'superseded'};
       const item=resolved.item,op=pendingOperations[item.id];
       const status=op?.busy?'installing':['registered','installed','installed-not-loaded'].includes(item.installed?.state)&&!item.upgradeAvailable?'already-installed':'confirmation-required';
@@ -705,7 +705,7 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     if(handoffIssue?.poll)setHandoffIssue(null);
     for(const row of value.handoffs??[]){
       if(row.state!=='pending'||handled.has(row.handoffId))continue;handled.add(row.handoffId);
-      const input={...(row.itemId?{itemId:row.itemId}:{}),...(row.packageName&&row.itemId!=='hanamesh:suite-upgrade'?{packageName:row.packageName}:{}),contractVersion:INSTALL_TARGET_CONTRACT_VERSION};
+      const input={...(row.itemId?{itemId:row.itemId}:{}),...(row.packageName&&row.itemId!=='hanamesh:suite-upgrade'?{packageName:row.packageName}:{}),...(row.installTarget?{installTarget:row.installTarget}:{}),contractVersion:INSTALL_TARGET_CONTRACT_VERSION};
       let opened=false;
       try{await openInstallTarget(input,{handoffId:row.handoffId});opened=true;}
       catch(error){noteHandoffIssue(t('确认框打不开'),error);await reportHandoff(row.handoffId,'failed',{code:errorCode(error)});}
@@ -718,7 +718,9 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     const hash=globalThis.location?.hash;if(!hash?.startsWith(INSTALL_TARGET_HASH))return;
     const params=new URLSearchParams(hash.slice(INSTALL_TARGET_HASH.length));
     if(new Set(params.keys()).size!==[...params.keys()].length){targetSequence++;if(entryVisible)setLibraryVisible(true);setTarget({status:'failed',error:'INVALID_INPUT'});return;}
-    void openInstallTarget(Object.fromEntries(params)).catch(()=>{});
+    const input=Object.fromEntries(params);
+    if(input.installTarget!==undefined){try{input.installTarget=JSON.parse(input.installTarget);}catch{setTarget({status:'failed',error:'INVALID_INPUT'});return;}}
+    void openInstallTarget(input).catch(()=>{});
   }
   // rc.32 market seat. The shell's Extension Management panel (dsh-tauri-panel-extension) reads the client-side
   // cordis service `market` via `ctx.reflect.get('market')` and shows a 「市场」 tab when it is there; it calls
@@ -772,7 +774,7 @@ h('div',{className:'hm-source-add'},h('input',{value:draft,placeholder:'https://
         h('p',null,t('现有 registry：'),h('code',null,value.configuredRegistry)),
         h('p',null,t('已保存选择：')+(value.mode==='core'?t('Core 当前本机来源'):t('现有配置'))),
         observation?.observable?h('div',null,h('p',{role:'status'},t('Core 来源：')+state.status+' · '+state.selection),state.registry?h('p',null,h('code',null,state.registry)):null,state.lastError?FailureNotice({error:state.lastError}):null):h('div',null,h('p',{role:'status'},t('Core 来源暂不可用。请检查 Core 插件及其来源设置。')),h('details',null,h('summary',null,t('技术详情')),h('code',null,observation?.code??'CORE_SUITE_SOURCE_MISSING'))),
-        h('details',null,h('summary',null,t('使用说明')),h('p',null,t('选择三个官方套件组件的 npm 安装包 registry。市场目录源提供浏览清单，在「市场目录源」中单独设置。')),h('p',null,t('保存选择不会安装。检查、确认和执行前都重新读取当前来源与 Core 兼容声明；来源变化后须重新查看并确认。')))):h('p',null,t('正在读取套件安装包来源…')));
+        h('details',null,h('summary',null,t('使用说明')),h('p',null,t('选择 HanaMesh 总包的 npm 安装包 registry。市场目录源提供浏览清单，在「市场目录源」中单独设置。')),h('p',null,t('保存选择不会安装。检查、确认和执行前都重新读取当前来源与 Core 兼容声明；来源变化后须重新查看并确认。')))):h('p',null,t('正在读取套件安装包来源…')));
   }
   function NodeRuntimeSection(){useLocale();
     const[value,setValue]=React.useState(null),[draft,setDraft]=React.useState(null),[plan,setPlan]=React.useState(null),[error,setError]=React.useState(''),[working,setWorking]=React.useState(false);
@@ -849,7 +851,7 @@ h('div',{className:'hm-source-add'},h('input',{value:draft,placeholder:'https://
     return(pnpmCode?pnpmCode+' · ':'')+(t(FAILURE_REASONS[code])??t('详细原因见宿主日志'));
   };
   const operationNotice=op=>op?h('div',null,h('p',{role:op.failed?'alert':'status',className:op.failed?'hm-library-failed':'hm-library-ok',style:{overflowWrap:'anywhere'}},t(op.text)),op.diagnostic?h('details',null,h('summary',null,t('技术详情')),h('pre',{style:{whiteSpace:'pre-wrap',overflowWrap:'anywhere'}},op.diagnostic)):null):null;
-  const suiteRecoveryText=details=>details?.stage==='suite-upgrade'?t('；升级未完成，部分组件可能已改变。当前读回：')+(details.actual?.components?.map(c=>c.label+' '+(c.version??t('检测不到'))+(c.active?'':t('（未启用）'))).join('；')||t('检测不到'))+t('。请完全退出客户端，使用补齐命令（仅 macOS / Linux 终端；Windows 安全命令暂未提供）修复并重新打开：')+details.command:'';
+  const suiteRecoveryText=details=>details?.stage==='suite-upgrade'?t('；升级未完成，部分组件可能已改变。当前读回：')+(details.actual?.components?.map(c=>c.label+' '+(c.version??t('检测不到'))+(c.active?'':t('（未启用）'))).join('；')||t('检测不到'))+(details.command?t('。请完全退出客户端，使用补齐命令（仅 macOS / Linux 终端；Windows 安全命令暂未提供）修复并重新打开：')+details.command:t('。请完全退出客户端，重新读取总包发布版本后修复并重新打开。')):'';
   /** pluginManager applied it, but the profile could not be read back: the installed list may still say 「需重启」. */
   const baselineText=result=>result?.restartBaseline?.updated===false?t('；但应用库没能读回 profile（')+result.restartBaseline.code+t('），已安装列表可能仍显示「需重启」'):'';
   /** rc.10 install recovery result: only an item-by-item readback that matched the baseline is shown as restored. */
@@ -863,7 +865,7 @@ h('div',{className:'hm-source-add'},h('input',{value:draft,placeholder:'https://
   const KIND_TEXT={application:t('应用'),plugin:t('插件'),listing:t('仅收录')};
   const STATE_TEXT={registered:t('已安装'),installed:t('已安装'),'installed-not-loaded':t('需重启'),'uninstalled-not-unloaded':t('已卸载 · 需重启'),'runtime-missing':t('缺运行时'),invalid:t('包无效')};
   // Mirrors PROTECTED_PACKAGES on the host: the suite is never offered an uninstall button (the host answers 403 anyway).
-  const PROTECTED=new Set(['@hanamesh/core','@hanamesh/usage','@hanamesh/brand','@hanamesh/dsh-app-host','hanamesh-core','hanamesh-usage','hanamesh-brand','@hanamesh/dsh-core','@hanamesh/dsh-usage']);
+  const PROTECTED=new Set(['@hanamesh/hanamesh','@hanamesh/core','@hanamesh/usage','@hanamesh/dsh-app-host','hanamesh-brand']);
   function RestartNotice({reason}){useLocale();
     return h('p',{role:'status',className:'hm-restart-notice','data-hanamesh-restart':'required'},h('strong',null,t('需重新打开客户端')),' ',reason??t('插件更改需要重新打开客户端后生效。'),' ',h('span',{className:'hm-restart-hint'},t('请完全退出 HanaMesh 客户端或 DSH 后重新打开；关闭窗口不等于退出。')));
   }
@@ -988,14 +990,15 @@ h('div',{className:'hm-source-add'},h('input',{value:draft,placeholder:'https://
       const selected=targetSelection;if(selected?.status!=='confirmation-required'||pendingOperations[selected.item.id]?.busy)return;
       setTarget({...selected,status:'installing'});
       const suite=selected.item.kind==='suite-upgrade';
-      const outcome=await operate(suite?'/hanamesh/library/suite/upgrade':'/hanamesh/library/install',suite?{planId:selected.item.suiteUpgrade.planId}:{itemId:selected.item.id,packageName:selected.item.package.name},selected.item.id,suite?t('升级套件'):t('安装'),true);
+      const reviewed={itemId:selected.item.id,packageName:selected.item.package.name,...(selected.item.installTarget?{installTarget:selected.item.installTarget}:{})};
+      const outcome=await operate(suite?'/hanamesh/library/suite/upgrade':'/hanamesh/library/install',suite?{planId:selected.item.suiteUpgrade.planId}:reviewed,selected.item.id,suite?t('升级套件'):t('安装'),true);
       if(outcome){
         if(!outcome.ok){if(targetSelection?.item?.id===selected.item.id)setTarget({...targetSelection,status:outcome.unknown?'result-unavailable':suite?'suite-upgrade-failed':'failed',error:outcome.code,details:outcome.details});return;}
         if(suite){
           try{const snapshot=await request('/hanamesh/library/installedPlugins');if(!outcome.result.components.every(c=>snapshot.plugins.some(p=>p.packageName===c.name&&p.version===c.to&&p.active)))throw new Error('INSTALL_READBACK_MISMATCH');setPending(p=>({...p,[selected.item.id]:{label:t("升级套件"),text:()=>(t('套件升级已读回，请完全退出并重新打开客户端。'))}}));setChanged(true);setTarget({...selected,status:'installed'});}
           catch(error){setPending(p=>({...p,[selected.item.id]:{label:t("升级套件"),text:()=>(t('套件版本读回失败，请检查三个组件。')),failed:true}}));setTarget({...selected,status:'readback-failed',error:String(error.message??error)});}return;
         }
-        try{const fresh=await request('/hanamesh/library/target?'+new URLSearchParams({itemId:selected.item.id,packageName:selected.item.package.name}));
+        try{const fresh=await request('/hanamesh/library/target?'+targetQuery(reviewed));
           const row=fresh.item?.installed;
           if(row?.packageName!==selected.item.package.name||!['registered','installed','installed-not-loaded'].includes(row.state)||(outcome.result?.version&&row.version!==outcome.result.version))throw new Error('INSTALL_READBACK_MISMATCH');
           const live=outcome.result?.status==='applied';setPending(p=>({...p,[selected.item.id]:{label:t("安装"),text:()=>(live?t('安装完成，已加载，可以直接使用（已按精确版本读回）')+baselineText(outcome.result):t('安装完成，已按精确版本读回'))}}));if(!live)setChanged(true);
@@ -1046,20 +1049,21 @@ h('div',{className:'hm-source-add'},h('input',{value:draft,placeholder:'https://
     const restartRequired=changed||Boolean(snapshot?.restartRequired);
     const filters=[...BASE_FILTERS,...seenCategories.filter(c=>c!=='hanamesh-app').map(c=>[c,c])];
     const openButton=row=>h('button',{type:'button',disabled:Boolean(openingAppId),onClick:()=>void open(row)},openingAppId===row.appId?t('打开中…'):t('打开'));
-    const card=item=>{const row=item.installed,op=pending[item.id],busy=op?.busy;const installBody={itemId:item.id,...(item.package?.name?{packageName:item.package.name}:{})};
+    const card=item=>{const row=item.installed,op=pending[item.id],busy=op?.busy;const installBody={itemId:item.id,...(item.package?.name?{packageName:item.package.name}:{}),...(item.installTarget?{installTarget:item.installTarget}:{})};
+      const reviewOrInstall=label=>item.installTarget?openInstallTarget(installBody).catch(()=>{}):operate('/hanamesh/library/install',installBody,item.id,label);
       let action=h('span',null,t('仅收录，不可安装')),state=null;
       if(row)state=h('span',{className:'hm-market-state','data-hanamesh-state':row.state},(t(STATE_TEXT[row.state]??row.state))+(row.version?' '+row.version:''));
-      if(item.kind==='suite')return h('article',{key:item.id,'data-hanamesh-library-item':item.id,'data-hanamesh-kind':'suite'},h('h3',null,t('HanaMesh 套件')),h('p',null,item.summary),h('p',null,item.suite?.status==='installed'?t('已安装 · Core ')+item.suite.version:item.suite?.status==='incomplete'?t('套件不完整，请查看组件状态'):t('套件状态未知，请查看 Core 声明与阻断原因')),item.suite?.completeness?h('p',null,t('Core 完整性：')+item.suite.completeness):null,...(item.suite?.components??[]).map(c=>h('p',{key:c.name},c.requiredRange?c.label+t(' · 要求 ')+c.requiredRange+t(' · 实际 ')+(c.actualVersion??t('检测不到'))+' · '+c.status:c.label+' · '+(c.version??t('检测不到'))+(c.active?'':t(' · 未启用')))),...(item.suite?.blocked??[]).map((row,i)=>h('p',{key:'blocked-'+i,role:'status'},row.code+(row.moduleName?' · '+row.moduleName:'')+(row.coreVersion?' · '+row.coreVersion:''))),item.suiteUpgradeUnavailable?h('p',{role:'status'},item.suiteUpgradeUnavailable):null,h('button',{type:'button',disabled:Boolean(item.suiteUpgradeUnavailable),onClick:()=>void openInstallTarget({itemId:'hanamesh:suite-upgrade'}).catch(()=>{})},t('检查兼容升级')));
+      if(item.kind==='suite')return h('article',{key:item.id,'data-hanamesh-library-item':item.id,'data-hanamesh-kind':'suite'},h('h3',null,t('HanaMesh 套件')),h('p',null,item.summary),h('p',null,item.suite?.status==='installed'?t('已安装 · HanaMesh ')+item.suite.version:item.suite?.status==='incomplete'?t('套件不完整，请查看组件状态'):t('套件状态未知，请查看 Core 声明与阻断原因')),item.suite?.completeness?h('p',null,t('Core 完整性：')+item.suite.completeness):null,...(item.suite?.components??[]).map(c=>h('p',{key:c.name},c.requiredRange?c.label+t(' · 要求 ')+c.requiredRange+t(' · 实际 ')+(c.actualVersion??t('检测不到'))+' · '+c.status:c.label+' · '+(c.version??t('检测不到'))+(c.active?'':t(' · 未启用')))),...(item.suite?.blocked??[]).map((row,i)=>h('p',{key:'blocked-'+i,role:'status'},row.code+(row.moduleName?' · '+row.moduleName:'')+(row.bundleVersion?' · HanaMesh '+row.bundleVersion:''))),item.suiteUpgradeUnavailable?h('p',{role:'status'},item.suiteUpgradeUnavailable):null,h('button',{type:'button',disabled:Boolean(item.suiteUpgradeUnavailable),onClick:()=>void openInstallTarget({itemId:'hanamesh:suite-upgrade'}).catch(()=>{})},t('检查兼容升级')));
       if(busy)action=h('button',{type:'button',disabled:true},t(op.text));
-      else if(item.kind!=='listing'&&!row)action=h('button',{type:'button',onClick:()=>void operate('/hanamesh/library/install',installBody,item.id,t('安装'))},op?.failed?t('重试安装'):t('安装'));
-      else if(row&&item.upgradeAvailable)action=h('span',{className:'hm-market-actions'},h('button',{type:'button',onClick:()=>void operate('/hanamesh/library/install',installBody,item.id,t('升级'))},t('升级到 ')+item.latestVersion),row.state==='registered'?openButton(row):null);
+      else if(item.kind!=='listing'&&!row)action=h('button',{type:'button',onClick:()=>void reviewOrInstall(t('安装'))},op?.failed?t('重试安装'):t('安装'));
+      else if(row&&item.upgradeAvailable)action=h('span',{className:'hm-market-actions'},h('button',{type:'button',onClick:()=>void reviewOrInstall(t('升级'))},item.installTarget?.source==='github'?t('查看安装目标'):t('升级')),row.state==='registered'?openButton(row):null);
       else if(row?.state==='runtime-missing')action=h('button',{type:'button',onClick:()=>void operate('/hanamesh/library/provision',{appId:row.appId,packageName:row.packageName,runtimeItem:row.runtimeItem},item.id,t('补齐运行时'))},t('补齐运行时'));
       else if(row?.state==='registered')action=h('span',{className:'hm-market-actions'},openButton(row),h('button',{type:'button',onClick:()=>void operate('/hanamesh/library/uninstall',{appId:row.appId,packageName:row.packageName,runtimeItem:row.runtimeItem},item.id,t('卸载'))},t('卸载')));
       else if(row?.state==='installed')action=PROTECTED.has(row.packageName)?h('span',null,t('HanaMesh 套件')):h('button',{type:'button',onClick:()=>void operate('/hanamesh/library/plugins/uninstall',{packageName:row.packageName},item.id,t('卸载'))},t('卸载'));
       else if(row?.state==='uninstalled-not-unloaded')action=h('span',null,t('已卸载，重启 DSH 后生效'));
       else if(row)action=h('span',null,t('已安装，重启 DSH 后生效'));
       return h('article',{key:item.id,'data-hanamesh-library-item':item.id,'data-hanamesh-kind':item.kind},h('h3',null,item.displayName),h('p',null,item.summary),
-        h('small',null,t(KIND_TEXT[item.kind])+' · '+(item.publisher?.name??t('未知发布者'))+' · '+(item.latestVersion??'—')+((item.categories??[]).length?' · '+item.categories.join('、'):'')),
+        h('small',null,t(KIND_TEXT[item.kind])+' · '+(item.publisher?.name??t('未知发布者'))+((item.categories??[]).length?' · '+item.categories.join('、'):'')),
         state,action,op&&!busy?operationNotice(op):null);};
     const catalogSection=receipt?h('div',{className:'hm-app-frame'},h('div',null,h('strong',null,receipt.instance.appId),h('button',{type:'button',disabled:closing,onClick:()=>void close()},closing?t('关闭中…'):t('关闭视图'))),h('iframe',{ref:frame,src:receipt.uiUrl,title:receipt.instance.appId,sandbox:'allow-forms allow-modals allow-popups allow-same-origin allow-scripts'})):
       h('div',{className:'hm-library-grid',key:'catalog'},...items.map(card));
@@ -1080,10 +1084,12 @@ h('div',{className:'hm-source-add'},h('input',{value:draft,placeholder:'https://
           h('input',{'aria-label':t('目录条目 ID'),value:targetItemId,placeholder:t('itemId（可选）'),onChange:event=>setTargetItemId(event.target.value)}),
           h('input',{'aria-label':t('包名'),value:targetPackageName,placeholder:t('packageName（可选）'),onChange:event=>setTargetPackageName(event.target.value)}),h('button',{type:'submit'},t('查看安装目标')))):null,
         target?h('div',{role:target.status==='confirmation-required'?'dialog':'status','aria-label':t('市场安装确认')},
-          target.item?h('dl',null,h('dt',null,t('插件名')),h('dd',null,target.item.displayName),h('dt',null,t('包名')),h('dd',null,target.item.package.name),h('dt',null,t('版本')),h('dd',null,target.item.latestVersion??t('目录未提供版本')),h('dt',null,t('来源')),h('dd',null,target.source?.kind==='fixture'?t('测试目录（fixture）'):target.source?.manifestUrl??t('当前市场目录'))):null,
-          target.item?.suiteUpgrade?h('ul',null,...target.item.suiteUpgrade.components.map(c=>h('li',{key:c.name},c.label+'：'+c.from+' → '+c.to)),h('li',null,t('确认后升级三个官方组件；需要完全退出并重新打开客户端。'))):null,
+          target.item?h('dl',null,h('dt',null,t('插件名')),h('dd',null,target.item.displayName),h('dt',null,t('包名')),h('dd',null,target.item.package.name),h('dt',null,t('来源')),h('dd',null,target.source?.kind==='fixture'?t('测试目录（fixture）'):target.source?.manifestUrl??t('当前市场目录'))):null,
+          target.item?.installTarget?.source==='github'?h('dl',{'data-github-confirmation':true},h('dt',null,t('来源仓库')),h('dd',null,'https://github.com/'+target.item.installTarget.repo),h('dt',null,t('固定 commit')),h('dd',null,target.item.installTarget.ref),...(target.item.installTarget.path?[h('dt',null,t('仓库子目录')),h('dd',null,target.item.installTarget.path)]:[])):null,
+          target.item?.installTarget?(target.item.installTarget.allowBuild.length?h('div',{role:'alert','data-build-warning':true},h('strong',null,t('会在本机执行构建脚本')),h('p',null,target.item.installTarget.allowBuild.join(', ')),h('p',null,t('确认后将按名单允许构建；pnpm 会把许可保存到当前 profile。'))):h('p',null,t('未授予构建脚本许可'))):null,
+          target.item?.suiteUpgrade?h('ul',null,...target.item.suiteUpgrade.components.map(c=>h('li',{key:c.name},c.label+'：'+c.from+' → '+c.to)),h('li',null,t('确认后升级 HanaMesh 总包及其锁定组件；需要完全退出并重新打开客户端。'))):null,
           target.item?.suiteUpgrade?.registry?h('p',null,'Registry：'+target.item.suiteUpgrade.registry):null,
-          ...(target.item?.suiteUpgrade?.blocked??target.details?.blocked??[]).map((row,i)=>h('p',{key:'suite-blocked-'+i,role:'status'},row.code+(row.moduleName?' · '+row.moduleName:'')+(row.coreVersion?' · '+row.coreVersion:''))),
+          ...(target.item?.suiteUpgrade?.blocked??target.details?.blocked??[]).map((row,i)=>h('p',{key:'suite-blocked-'+i,role:'status'},row.code+(row.moduleName?' · '+row.moduleName:'')+(row.bundleVersion?' · HanaMesh '+row.bundleVersion:''))),
           target.status==='confirmation-required'?h('div',null,h('button',{type:'button',onClick:()=>void confirmTarget()},t('确认安装')),h('button',{type:'button',onClick:()=>{targetSequence++;void reportHandoff(targetSelection?.handoffId,'cancelled');setTarget({...targetSelection,status:'cancelled'});}},t('取消'))):
           target.status==='failed'?FailureNotice({error:target.diagnostic??target.error}):h('p',{role:['readback-failed','suite-upgrade-failed'].includes(target.status)?'alert':'status'},({resolving:t('正在查询市场目录…'),installing:t('安装中…'),installed:t('安装完成，请查看已安装列表'),'installed-live':t('安装完成，已加载，可以直接使用'),cancelled:t('已取消，未安装'),'result-unavailable':t('安装结果不可追溯，请查看已安装列表；不会自动重试'),'already-installed':t('已安装，无需重复安装'),failed:t('未安装：')+(target.error??pending[target.item?.id]?.text??t('安装失败')),'readback-failed':target.error,'suite-upgrade-failed':suiteTargetFailure(target)})[target.status]),
           target.item?.source?h('div',{'aria-label':t('目录条目来源')},h('p',null,target.item.source.sourceId+' · '+target.item.source.sourceRef),...(target.item.source.sourceLinks??[]).map((link,index)=>h('p',{key:index},h('a',{href:link.sourceUrl,target:'_blank',rel:'noopener noreferrer'},link.sourceId+' · '+link.sourceRef),h('small',null,' '+link.firstSeenAt+' / '+link.lastSeenAt)))):null,

package/dist/install-target/fixtures/catalog.json

@@ -1,13 +1,12 @@
 {
-  "schemaVersion": "1.0.0",
-  "revision": "install-target-contract-fixture-1",
+  "schemaVersion": "hanamesh.catalog.v1",
+  "generatedAt": "2026-11-05T00:00:00.000Z",
   "items": [
     {
       "id": "fixture.install-target.plugin",
       "name": "@hanamesh-fixture/install-target-plugin",
       "displayName": "测试目录 · 安装目标插件",
       "summary": "Install-target contract fixture (test catalog, not a real product).",
-      "latestVersion": "1.2.3",
       "categories": [
         "utility"
       ],
@@ -17,6 +16,43 @@
       },
       "publisher": {
         "name": "HanaMesh fixture"
+      },
+      "itemId": "fixture.install-target.plugin",
+      "packageName": "@hanamesh-fixture/install-target-plugin",
+      "catalogKind": "plugin",
+      "source": {
+        "sourceId": "hanamesh",
+        "sourceRef": "fixture.install-target.plugin",
+        "sourceLinks": [
+          {
+            "sourceId": "hanamesh",
+            "sourceRef": "fixture.install-target.plugin",
+            "sourceUrl": "https://catalog-fixture.example/fixture.install-target.plugin",
+            "firstSeenAt": "2026-11-05T00:00:00.000Z",
+            "lastSeenAt": "2026-11-05T00:00:00.000Z"
+          }
+        ]
+      },
+      "installMethods": [
+        {
+          "channel": "hanamesh",
+          "kind": "npm",
+          "spec": "@hanamesh-fixture/install-target-plugin",
+          "command": null,
+          "allowBuild": [],
+          "sourceId": "hanamesh",
+          "sourceRef": "fixture.install-target.plugin",
+          "target": {
+            "source": "npm",
+            "name": "@hanamesh-fixture/install-target-plugin",
+            "version": "1.2.3",
+            "allowBuild": []
+          }
+        }
+      ],
+      "oneClickInstall": {
+        "allowed": true,
+        "reason": null
       }
     },
     {
@@ -24,7 +60,6 @@
       "name": "@hanamesh-fixture/install-target-app",
       "displayName": "测试目录 · 安装目标应用",
       "summary": "Install-target contract fixture application (test catalog).",
-      "latestVersion": "0.4.0",
       "categories": [
         "hanamesh-app"
       ],
@@ -34,6 +69,43 @@
       },
       "publisher": {
         "name": "HanaMesh fixture"
+      },
+      "itemId": "fixture.install-target.app",
+      "packageName": "@hanamesh-fixture/install-target-app",
+      "catalogKind": "application",
+      "source": {
+        "sourceId": "hanamesh",
+        "sourceRef": "fixture.install-target.app",
+        "sourceLinks": [
+          {
+            "sourceId": "hanamesh",
+            "sourceRef": "fixture.install-target.app",
+            "sourceUrl": "https://catalog-fixture.example/fixture.install-target.app",
+            "firstSeenAt": "2026-11-05T00:00:00.000Z",
+            "lastSeenAt": "2026-11-05T00:00:00.000Z"
+          }
+        ]
+      },
+      "installMethods": [
+        {
+          "channel": "hanamesh",
+          "kind": "npm",
+          "spec": "@hanamesh-fixture/install-target-app",
+          "command": null,
+          "allowBuild": [],
+          "sourceId": "hanamesh",
+          "sourceRef": "fixture.install-target.app",
+          "target": {
+            "source": "npm",
+            "name": "@hanamesh-fixture/install-target-app",
+            "version": "0.4.0",
+            "allowBuild": []
+          }
+        }
+      ],
+      "oneClickInstall": {
+        "allowed": true,
+        "reason": null
       }
     },
     {
@@ -45,14 +117,33 @@
         "utility"
       ],
       "repository": {
-        "url": "https://example.com/repository"
+        "url": "https://github.com/fixture/repository-only"
       },
       "publisher": {
         "name": "HanaMesh fixture"
+      },
+      "itemId": "fixture.install-target.repository-only",
+      "packageName": null,
+      "catalogKind": "entry",
+      "source": {
+        "sourceId": "hanamesh",
+        "sourceRef": "fixture.install-target.repository-only",
+        "sourceLinks": [
+          {
+            "sourceId": "hanamesh",
+            "sourceRef": "fixture.install-target.repository-only",
+            "sourceUrl": "https://catalog-fixture.example/fixture.install-target.repository-only",
+            "firstSeenAt": "2026-11-05T00:00:00.000Z",
+            "lastSeenAt": "2026-11-05T00:00:00.000Z"
+          }
+        ]
+      },
+      "installMethods": [],
+      "oneClickInstall": {
+        "allowed": false,
+        "reason": "no-install-method"
       }
     }
   ],
-  "page": {
-    "total": 3
-  }
+  "page": {}
 }