@hanamesh/dsh-app-host 0.6.21 → 0.6.24

package/README.md

@@ -1,6 +1,16 @@
+PX3 跨平台候选：Windows 可以运行插件/公开服务、attach 应用、受控只读 CLI 与普通包安装；`owned` 应用仍在创建进程、数据目录及请求凭据之前明确拒绝 `PLATFORM_UNSUPPORTED`。Windows 单测保留真实 attach 的 HTTP/租约/网关断言，并验证 owned 的持久失败、无进程/文件写入及不消费凭据；这些断言不构成 Windows owned 运行支持。独立 Node 可用不扩大 owned 支持；受管 Node 准备仍遵守原平台限制。Windows 本地快照采用文件 flush 加同目录 rename，不承诺断电后目录项持久；Coding OAuth Gateway 文件源因缺私有 ACL 证明继续拒绝，HTTP 提供方不变。各平台实际结果以本分支 GitHub Actions 矩阵收据为准。
+
+R115返修（同0.6.23候选）：登录shell按退出结果和封装JSON解析成功，忽略正常stderr；所选CLI保留管理器PATH与XDG目录/缺省，不再用空临时XDG隐藏全局版本。真实Bash/asdf/mise启动链回归与工具来源见 [安装状态](docs/INSTALLATION_STATUS.md)。
+
+0.6.23 候选：install-target 对名单外有效网站提供精确CORS的固定403来源拒绝，GET预检以204和按需PNA头支持浏览器读回；不开放能力/清单/安装权限。同意检测后自动发现当前用户的 Claude Code / Codex 官方 CLI，无手动读取器入口；接受不低于 2.1.301 / 0.162.1 且版本格式与清单 JSON 校验通过的版本。安装布局、优先级、只读边界及具名预算见 [安装状态](docs/INSTALLATION_STATUS.md)。
+
+PK3 开发供给：`vendor/hanamesh-core-0.3.33.tgz` 是 Core 分支提交 `969a89a1f7e383fca7d6aefa7f27507d3a1605d5` 的正常归档，仅供开发与公开合约测试；SHA256 和来源见 `vendor/core-fixture.json`，安装仍严格检查真实 peers。这不是已发布的 npm Core，也不进入运行时依赖。
+
+PK1 兼容候选：开发输入更新为 DSH 0.2.2-rc.1 / Cordis 4.1.0 / Schemastery 3.19.0（适用者）。公开 peer 保留兼容范围，并显式包含 0.2.2 预发布；不锁定用户宿主版本。本分支尚未发布，安装和原生加载结果以 PK1 交件为准。
+
 0.6.21 候选：普通市场和网站交接消费 Indexer 的固定 GitHub SHA/子目录/包名/构建名单。客户端沿原确认页展示来源、完整 commit 与本机构建提示；确认回传同一目标，目录更新不得换 SHA。执行仍走受控官方 DSH CLI / pnpm，读回精确来源与启用项后报告需完全退出重开；没有改上游或另写安装器。详见 [安装目标](docs/INSTALL_TARGET.md)。初轮已完成隔离 DSH、网站及真实 DTO 验收；本轮 R25 另修未匹配固定目标时的拒绝与退休目录版本字段，仍待复审，不宣称已发布。
 
-0.6.16 候选：普通市场通过注入的宿主 pluginManager.registries() 读取源事实，并按宿主锚点/版本守卫加载公开 ./registry 规则模块；AppHost 不声明、安装或捆绑 manager。发布依赖/peer闭包与0.6.15一致。pnpm自有源(null)不显式传--registry，配置镜像则传同一源；查询30秒具名超时，脱敏原诊断同进UI和日志。
+0.6.22 候选：普通插件只执行目录固定目标；缺 installMethods 即拒绝。套件安装命令只消费 Core，删除普通包名的元数据查询和规则加载。
 
 0.6.15 候选：市场保留官方 CLI 的 stdout/stderr 真实失败原因并脱敏，在卡片与安装确认的技术详情中显示。正文显示 pnpm 真实错误类别；宿主发布时间检查失败时列出受影响包与实际 cutoff；HanaMesh 总包安装/升级使用精确发布版本，发布后即可验收；不修改 profile、pnpm 供应链策略或安装执行路径。
 
@@ -82,7 +92,7 @@ CLI-8：未配置来源的新用户默认请求 HanaMesh 视图（`https://marke
 
 > 分支 `t6-usage-receipts`（2026-09-22，设计定案 §3「协议层」，T6，**未发版**，由派发 session 合入下一 rc）：**Router 使用回执。** app-host 自己的 storage domain `hanamesh_router_receipts` 按小时记 `{appId, providerId, model, hour, count}`（Router 每次注入记路由与 `injections`，网关每次转发 `count+1`；不记内容、不记值），`GET /hanamesh/router/receipts[?appId=]` 可查本地账。usage 席位上报的 `use` 事件改为在 **UTC 小时结束或应用最后一个活实例停止时**发出（`occurredAt` 仍是该小时首个转发请求；同 key 一小时一条不变），并附 `targetRef=appId` 与该小时的 `receipt {providerId, model, count}`；无席位只记本地账不报错；宿主死机前未报的小时在下次启动由账本补报（席位按 key 去重）。需要 usage `0.2.0-rc.7`（席位接受三个可选键；更早版本会 `rejected INVALID_RECORD_INPUT`，只 debug 日志）。
 
-> rc.28（2026-09-22，设计定案 §4「HanaMesh 市场」，T4）：**「应用库」升级为 HanaMesh 市场——插件与应用同一入口、同一安装路径。** 侧栏入口与页面标题改为「市场」/「HanaMesh 市场」，设置段「应用库来源」改名「市场目录源」。目录默认列出**全部**类别（客户端显式 `category=`），筛选 = 全部 / 应用（`hanamesh-app`）/ 插件（客户端视图：非应用的 npm 条目）/ 目录页里出现过的每个类别；搜索、「更多」保留。每条目带 `kind`（`application` / `plugin` / `listing`）、`installed`（已装行）与 `upgradeAvailable`（目录 `latestVersion` 严格新于已装版本，内建 semver 比较，无依赖）。卡片状态：未装「安装」/ 已装（应用「打开」「卸载」，插件「卸载」）/ 可升级「升级到 x.y.z」（同一 `dsh plugin add --save-exact` 路径）/ 需重启。**已装列表含插件**：扫 profile `package.json` 的 `dependencies`（减去应用包），`bundle`（声明 `dsh.bundle`）与 `active`（在 `dsh.profile.bundles`）；「需重启」由本插件启动时的依赖快照推出：启动后新增 → `installed-not-loaded`，启动后移除 → `uninstalled-not-unloaded`。任一操作完成或列表含上述状态时页面顶部出现「需重启 DSH」：在桌面壳内（DSH 页在壳 iframe 里）给出 `hanamesh://restart` 深链按钮，官方 DSH 直开浏览器时只提示「请手动重启 DSH」。新路由：`GET /hanamesh/library/installedPlugins` → `{plugins,apps,restartRequired}`；`POST /hanamesh/library/plugins/install {packageName}`（须在启用目录里能搜到该包；应用包走应用路径）与 `POST /hanamesh/library/plugins/uninstall {packageName}`（应用包转应用卸载：runtime + 运行中检查）→ 202 + 事件流；`POST /hanamesh/library/install` 现接受 `{itemId, packageName?}`（`packageName` 用于目录精确查找，插件条目也可装）。旧路由全部保留。**修 `LIB-PROVISION-INPUT`**：`provision` / `uninstall` / `plugins/*` 缺字段或字段非法 → 400 `INVALID_INPUT`，操作不启动（此前 TypeError → 事件 `LIBRARY_OPERATION_FAILED`）。受保护包 `hanamesh-core` / `hanamesh-usage` / `@hanamesh/dsh-app-host`（含旧写法）永不经市场装卸（`PACKAGE_DENIED`；rc.27 前阻止名单写的是从未存在过的 `@hanamesh/dsh-core`）。不做 T5（`provide('market')`、dshmarket 互斥、recommender 接线）。AH-M01–M08 测试，M13/M14 变异；真实门见 `docs/acceptance/t4-market-20260922/`。
+> rc.28（2026-09-22，设计定案 §4「HanaMesh 市场」，T4）：**「应用库」升级为 HanaMesh 市场——插件与应用同一入口、同一安装路径。** 侧栏入口与页面标题改为「市场」/「HanaMesh 市场」，设置段「应用库来源」改名「市场目录源」。目录默认列出**全部**类别（客户端显式 `category=`），筛选 = 全部 / 应用（`hanamesh-app`）/ 插件（客户端视图：非应用的 npm 条目）/ 目录页里出现过的每个类别；搜索、「更多」保留。每条目带 `kind`（`application` / `plugin` / `listing`）、`installed`（已装行）与 `upgradeAvailable`（审核 npm `installTarget.version` 严格新于已装版本）。卡片状态：未装「安装」/ 已装（应用「打开」「卸载」，插件「卸载」）/ 可升级「升级」（同一 `dsh plugin add --save-exact` 路径）/ 需重启。**已装列表含插件**：扫 profile `package.json` 的 `dependencies`（减去应用包），`bundle`（声明 `dsh.bundle`）与 `active`（在 `dsh.profile.bundles`）；「需重启」由本插件启动时的依赖快照推出：启动后新增 → `installed-not-loaded`，启动后移除 → `uninstalled-not-unloaded`。任一操作完成或列表含上述状态时页面顶部出现「需重启 DSH」：在桌面壳内（DSH 页在壳 iframe 里）给出 `hanamesh://restart` 深链按钮，官方 DSH 直开浏览器时只提示「请手动重启 DSH」。新路由：`GET /hanamesh/library/installedPlugins` → `{plugins,apps,restartRequired}`；`POST /hanamesh/library/plugins/install {packageName}`（须在启用目录里能搜到该包；应用包走应用路径）与 `POST /hanamesh/library/plugins/uninstall {packageName}`（应用包转应用卸载：runtime + 运行中检查）→ 202 + 事件流；`POST /hanamesh/library/install` 现接受 `{itemId, packageName?}`（`packageName` 用于目录精确查找，插件条目也可装）。旧路由全部保留。**修 `LIB-PROVISION-INPUT`**：`provision` / `uninstall` / `plugins/*` 缺字段或字段非法 → 400 `INVALID_INPUT`，操作不启动（此前 TypeError → 事件 `LIBRARY_OPERATION_FAILED`）。受保护包 `hanamesh-core` / `hanamesh-usage` / `@hanamesh/dsh-app-host`（含旧写法）永不经市场装卸（`PACKAGE_DENIED`；rc.27 前阻止名单写的是从未存在过的 `@hanamesh/dsh-core`）。不做 T5（`provide('market')`、dshmarket 互斥、recommender 接线）。AH-M01–M08 测试，M13/M14 变异；真实门见 `docs/acceptance/t4-market-20260922/`。
 
 > rc.27（2026-09-21，用户定，STATUS `P2-USE-EVENTS`）：**应用的使用证据由 app-host 上报。** 此前 app-host 从不调用 usage 插件的 record 座位，应用既没有 `open` 也没有 `use` 事件。现在：`ctx.inject(['hanameshUsage'])` 可选取得座位（鸭子类型 `record()`，三插件仍互不 import；缺席/不兼容/抛错/`rejected` 只 debug 日志，永不阻止启动或转发）；`open` = 实例到达 `ready` 一次（`open:<appId>:<instanceId>`）；`use` = 该实例网关真正转发了已授权请求且应用回应非 401/403，每应用每 UTC 小时一次（`use:<appId>:<YYYYMMDDHH>`，时间取桶内第一个请求）；引导票据、网关拒绝、宿主就绪探针不计。`hanaRef` = 应用 npm 包名：描述符新增可选 `packageName`（向后兼容），缺省由启动时的已安装扫描 `host.bindPackageName()` 绑定，两者都没有则该应用不产生证据。`sourcePlugin = '@hanamesh/dsh-app-host'`。新面：`host.packageName/bindPackageName/onActivity`、`FixedGateway({onForward})`、`createUsageEvidence()`、`list().apps[].packageName`。契约见 `docs/CONTRACT.md`「应用使用证据」；AH-U01–U07 测试（U07 为真实 Cordis 根，座位先于/后于本插件提供两种顺序），M11/M12 变异。
 
@@ -98,7 +108,7 @@ CLI-8：未配置来源的新用户默认请求 HanaMesh 视图（`https://marke
 >
 > rc.19（2026-09-21）：网关不再只认 cookie——嵌入式 webview（HanaMesh 桌面 Tauri/WKWebView、开了跟踪防护的 WebView2）里应用 iframe 相对壳的顶层 origin 是第三方，`SameSite=Strict` 的引导 cookie 被丢弃，303 之后每个请求都 403（响应带 `frame-ancestors 'none'`）→ 用户看到空白 iframe（2026-09-21 桌面 rc.4 + Vibe 实测）。rc.19 在 cookie 缺席时改用 Fetch Metadata：`sec-fetch-site: same-origin`（应用自身子资源/XHR）、或 `same-site` + `iframe` + 父 origin referer（引导后的框架导航）、或应用 origin 的 WebSocket 握手，且必须已有一张为仍在有效期 lease 消费过的引导票；cross-site / `none`（地址栏）一律拒绝。H15 三条测试；浏览器直开仍走 cookie。
 >
-> rc.18（2026-09-20）：应用库卡片跟踪安装/补齐运行时/卸载操作——按钮进入「…中…」，订阅 `/hanamesh/library/events` 直到 `-done`/`-failed`，失败时在卡片上显示错误码与可读原因（如 `REGISTRY_LOOKUP_FAILED`：应用包不在当前 registry），并提供「重试安装」。用户 2026-09-20 实测：点安装无任何反应。宿主逻辑不变。
+> rc.18（2026-09-20）：应用库卡片跟踪安装/补齐运行时/卸载操作——按钮进入「…中…」，订阅 `/hanamesh/library/events` 直到 `-done`/`-failed`，失败时在卡片上显示错误码与可读原因（如 `NOT_INSTALLABLE`：目录没有审核过的固定目标），并提供「重试安装」。用户 2026-09-20 实测：点安装无任何反应。宿主逻辑不变。
 
 **交付状态：rc.3 用户 ACCEPTED 2026-09-13；rc.4–rc.12 为增量 🧪；rc.13 只补上架前提（MIT 许可证、`repository` 字段、DSH peer 精确钉 `0.1.5-alpha.1`）；rc.14 删除客户端里对 `hanameshCore` 的死读取（浏览器侧 cordis 上下文不含宿主服务，该读取恒为 null，且把「未安装 HanaMesh Core」误显给已装用户）——本包对 Core 现在零引用，Core 状态只在 Core 自己的设置段；仍待用户验收。**
 
@@ -224,20 +234,14 @@ Actions runs on the standard public/free `macos-15` arm64 runner because the exi
 
 ## 发布检查：平台依赖闭包（不可关闭）
 
-`DSH_PNPM_PLATFORM_CLOSURE` 是正确性不变量，Mac/Windows/Linux 同样适用：DSH 自带 pnpm 11.7.0 处理不适用平台 optional 子包时可能安装完不退出，导致 DSH 持续等待。正常 tarball、bundled 包及完整锁定依赖闭包发现 os/cpu/libc 字段或平台子包 optionalDependencies 即拒绝，报具体包名/路径；缺闭包证据也拒绝。不能以开关、超时、重试、omit-optional 或静默兜底绕过；应改用单包内含多平台文件的中立依赖。
-
-运行 `npm run release:check` 正常打包并检查；发布仅用 `npm run release:publish`，发布已检查的同一 tarball。直接目录 npm publish 会被 prepublishOnly 明确拒绝。开发工具 `@hanamesh/release-platform-gate` 仅 devDependency，先按接线请求复制经 SHA 固定的正常工具包并更新冻结锁；CI 必须接入这个发布门。详细输出包含不可关闭的原因、正常包/锁 SHA 和扫描路径；absent optional peer 按 npm 定义列明，不等同 optionalDependencies。
-
-共享门已升级到 R2 PASS 的 0.1.10，原正常工具 tar SHA256 为 `c72010c96a5f22e36d65f6c1fd850e583dead7e843644eba1657b4416d9cbd0d`；最终 main 来源见 `vendor/release-platform-gate.json`。本仓接线仍须 R1 独审，不等于 npm 发布放行，本次不发布。
-
-`verify:pack` 原有 tarball 参数保持；正常消费者验证之后通过共享公开 checkRelease 核对同一个归档，CI沿该入口必经硬门，不另打一个包代替原包。接线没有复制扫描实现。
+共享 `@hanamesh/release-platform-gate` **0.1.12** 已经 R119b 复审 PASS，来源 `hanamesh-docs/tools/release-platform-gate` 分支 `fix/pg1-leoventory-installer-risk-20261109`，提交 `95e54102f9380ea2e8e4d8a2e36eacd387c3f7e7`。正常工具 tgz SHA256 `caf78747649b1dd37cbe9ba331351c81f94a48dc9e779aee83c75336140068d1`；七载荷摘要、复审提交及冻结 SRI 见 `vendor/release-platform-gate.json`、`vendor/SHA256SUMS` 和锁。它仅为 devDependency，不进入运行时或产品 bundle。
 
-有限依赖形态合同为正常开发工具包中的 `DEPENDENCY_SHAPES.md`（dependency-shapes-v1）：支持 registry/git/file/link/tarball/workspace/bundled/vendor 的明确子集，不能当作 npm/pnpm 的无限全集。合同外一律 `UNSUPPORTED_DEPENDENCY_SHAPE`，逐项公开 `package/path/shape/why/action/contract`；缓存、bundle、环境变量或额外 CLI 开关都不能绕过准入。已知缺证据、冻结漂移、完整性和平台违规仍各自具名拒绝，不能以“任意失败”代替正确理由。
+`DSH_PNPM_PLATFORM_CLOSURE` 是不可关闭的正确性不变量（disableable:false）。历史 DSH bundled pnpm 11.7.0 位于 pnpm#12297 风险系列，修复收录于 pnpm 11.23.0。原始 HanaMesh 挂起进程首错仍未找回，不能宣称历史身份/归因已闭合。合法 optional 平台字段和完整强 SRI 也不能独自证明安装器会退出。
 
-发布说明：DSH 内置 pnpm 11.7.0 处理不适用平台 optional 子包时可能安装后不退出，使 DSH 一直等安装结束；因此本门是正确性不变量（`disableable:false`），没有关闭开关。所有 OS/CPU/libc 都必须具备平台中立的完整安装依赖闭包，不能用本机已装、omit-optional、ignore-scripts、超时、重试、放宽断言或改客户端代替。每次 PASS/FAIL 的 JSON/receipt 都包含触发背景和不能关闭的 reason；release:check 正常 pack，release:publish 只发布同一已检查且再核 SHA 的 tar。源码目录发布由 prepublishOnly 拒绝，CI 的 verify:pack/preflight 必经该门；无可失败 job 或旁路入口。
+根及必需路径的 os/cpu/libc 继续 PLATFORM_FIELD 拒绝；可选子图先完整核锁、实际归档、名称/版本/范围/peer、选择器一致与强 SRI，再按 `dsh-pnpm-platform-exit-v1` 核安装矩阵。所有平台工件均扫描，不按检查机过滤。缺矩阵为 INSTALLATION_TARGETS_REQUIRED，旧风险组合为 PNPM_PLATFORM_HANG_RISK，未审组合为 INSTALLATION_TARGET_UNSUPPORTED；混入一个安全目标不能洗绿旧组合。未知依赖形态仍 UNSUPPORTED_DEPENDENCY_SHAPE，输出 shape / why / action / contract；有限 dependency-shapes-v1 与 INSTALLATION_RISK.md 均随正常工具包交付。没有 skip/关闭开关、环境推断、重试、超时、omit-optional 或白名单绕过。
 
-固定提供方 main 提交 `13ec0db3bc6aa6b6235f2105d3f0a6b998855ff5`，与 R2 审过的 0.1.10 正常包6载荷逐字一致；来源/归档摘要见 `vendor/release-platform-gate.json`。
+本次发布资格的完整目标明确保存在 `release/installation-targets.json`：DSH **0.2.2-rc.1 / pnpm 11.28.5 / darwin-arm64、linux-arm64**。这是 R119b 有退出证据的两个组合，不是检查机自动选择，也不把公开宽 peer 范围当作已通过的安装矩阵；其他宿主/安装器/架构不计入本次资格，旧组合仍拒绝。开发冻结安装的 pnpm 10.33.0 不是 bundled 11.28.5 的实装证据；后续 GT19 两机门必须核实际 pnpm 版本和完整闭包。
 
-## Core 公开套件声明的测试依赖
+`release:check` 与 `release:publish` 都显式传同一 `--installation-targets release/installation-targets.json`；`verify:pack` 在原消费者验证后通过共享公开 `checkRelease({installationTargets:...})` 检查同一归档，没有复制扫描实现或捕获忽略门错误。
 
-源码测试通过 `@hanamesh/core/suite` 读取 Core 单源公开命令。`@hanamesh/core` 是仓库声明的 devDependency，按 npm 版本范围 `^0.3.28` 从公开 npm 安装，冻结 pnpm 锁记录实际版本与 SRI；许可证记录见 `docs/LICENSES.json`。Core 不成为运行时依赖或 bundled 包。
+运行 `npm run release:check` 产生正常归档并核验；`release:publish` 只发布同一已检查且复核 SHA 的 tar。`prepublishOnly` 的 source-guard 拒绝源码目录直接发布。CI 的既有 verify:pack / preflight 必经此门；无 continue-on-error 或旁路。此接线提交没有执行 npm publish、tag、部署或产品真机发布验收。

package/dist/client-ui.js

@@ -129,15 +129,11 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy121": "固定规则（不能关）",
     "copy122": "为什么：",
     "copy123": "安装命令返回成功，但 profile 读回的版本与固定版本不一致",
-    "copy124": "无法查询 DSH 配置的 registry；检查 DSH 源设置与网络，展开技术详情后手动重试",
-    "registryLookupTimeout": "registry 查询超过 30 秒；检查 DSH 源设置与网络后手动重试",
-    "registryConfigUnavailable": "DSH 未提供可读的源配置；检查客户端插件管理器，展开技术详情",
     "copy125": "DSH 安装命令失败，请展开技术详情查看原始原因",
-    "installAgeRejected": "宿主的依赖发布时间检查未通过（默认需发布满 24 小时，以技术详情中的 cutoff 为准）。已知 DSH 0.2.0-rc.2 内置 pnpm 11.7.0 对同名多条白名单只认第一条。请在 DSH 设置中检查当前版本并升级 DSH，或等待受影响版本满足规则后手动重试。",
+    "installAgeRejected": "宿主的依赖发布时间检查未通过。请核对安装目标包含精确版本并保留技术详情；若仍失败，请在 DSH 设置中检查并升级 DSH。",
     "installAffectedPackages": "受影响包：",
     "copy126": "当前宿主未提供安装参数（profile / node 路径）",
     "copy127": "目录里已没有这一项，刷新后重试",
-    "copy128": "registry 上的最新版是预发布版（rc），客户端未允许安装预发布版",
     "copy129": "运行时归档下载失败，检查网络或来源",
     "copy130": "10 分钟内没有结果，可稍后重试",
     "copy131": "HanaMesh 套件自身不能从市场安装或卸载",
@@ -271,8 +267,8 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy261": "准备安装环境未完成。请查看技术详情中的准确原因；未自动换源或重试。",
     "copy262": "只在本机 127.0.0.1 上监听，请求的 Host 必须是 127.0.0.1 或 localhost 加监听端口",
     "copy263": "防止别的机器或 DNS 重绑定的网页冒充本机",
-    "copy264": "只有「允许交接的网站」里的网站能探测本客户端、交接安装、读交接状态；别的网站什么也读不到",
-    "copy265": "否则任何网页都能知道你装了什么客户端、缺什么，用来识别你",
+    "copy264": "只有「允许交接的网站」能读取客户端能力、交接安装和交接状态；未许可网站仅能读取固定的来源拒绝提示",
+    "copy265": "拒绝提示只说明本机监听拒绝了该网站，不透露客户端类型、能力、安装情况或允许名单",
     "copy266": "网站交接只会在应用库里弹出确认；只有你点「确认安装」才会安装",
     "copy267": "网站不能替你决定装什么",
     "copy268": "交接状态只给发起它的那个网站看",
@@ -434,15 +430,11 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy121": "Required rules",
     "copy122": "Reason: ",
     "copy123": "Installation command succeeded, but the version read from the profile differs from the confirmed version",
-    "copy124": "Cannot query the registry configured in DSH. Check DSH source settings and network, expand technical details, then retry manually",
-    "registryLookupTimeout": "Registry lookup exceeded 30 seconds. Check DSH source settings and network, then retry manually",
-    "registryConfigUnavailable": "DSH did not expose readable registry configuration. Check the client plugin manager and expand technical details",
     "copy125": "DSH installation failed. Expand Technical details for the original cause",
-    "installAgeRejected": "The host rejected a dependency's release age (the default requires 24 hours since publication; see the actual cutoff in Technical details). Known issue: pnpm 11.7.0 bundled with DSH 0.2.0-rc.2 only recognizes the first allowlist entry for a package name. Check your version in DSH Settings and upgrade DSH, or wait until the affected versions meet the rule before trying again manually.",
+    "installAgeRejected": "The host rejected a dependency release-age check. Verify the exact installation target and retain Technical details. If it still fails, check and upgrade DSH in Settings.",
     "installAffectedPackages": "Affected packages: ",
     "copy126": "This host has not provided installation parameters (profile / Node path)",
     "copy127": "This item is no longer in the catalog. Refresh before trying again",
-    "copy128": "The latest registry version is a prerelease, which this client has not allowed",
     "copy129": "Runtime archive download failed. Check the network or source",
     "copy130": "No result within 10 minutes. Check the installed state before trying again",
     "copy131": "The HanaMesh suite cannot be installed or uninstalled through the market",
@@ -576,8 +568,8 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy261": "Installation environment preparation did not complete. See Technical details for the exact reason. No automatic source switching or retry occurred.",
     "copy262": "Listen only on 127.0.0.1. The request Host must be 127.0.0.1 or localhost with the listening port.",
     "copy263": "Prevents remote machines or DNS-rebinding pages from impersonating this machine.",
-    "copy264": "Only allowed websites can discover this client, hand off installation or read handoff status.",
-    "copy265": "Prevents unrelated websites from identifying you through installed clients or missing capabilities.",
+    "copy264": "Only allowed websites can read client capabilities, hand off installations or read handoff status. Other websites can read only a fixed origin-refusal message.",
+    "copy265": "The refusal reveals only that a local listener rejected the website, without client type, capabilities, installations or the allowlist.",
     "copy266": "Website handoffs only open market confirmation. Installation requires your Confirm installation action.",
     "copy267": "A website cannot decide what to install for you.",
     "copy268": "Handoff status is visible only to the website that created it.",
@@ -841,12 +833,12 @@ h('div',{className:'hm-source-add'},h('input',{value:draft,placeholder:'https://
         defaults&&names?h('div',null,h('h3',null,t('设置名称与默认值')),h('dl',null,...['enabled','ports','allowedOrigins','ttlMs','pollMs'].flatMap(key=>[h('dt',{key:key+'-name'},names[key]),h('dd',{key:key+'-value'},Array.isArray(defaults[key])?defaults[key].join(', '):typeof defaults[key]==='boolean'?(defaults[key]?t('开'):t('关')):String(defaults[key]))]))):null,
         value?.rules?h('div',null,h('h3',null,t('固定规则（不能关）')),h('ul',null,...value.rules.map(row=>h('li',{key:row.rule},t(row.rule),h('br',null),h('small',null,t('为什么：')+t(row.why)))))):null));
   }
-  const FAILURE_REASONS={...CORE_SUITE_FAILURES,INSTALL_READBACK_MISMATCH:t('安装命令返回成功，但 profile 读回的版本与固定版本不一致'),REGISTRY_LOOKUP_FAILED:t('无法查询 DSH 配置的 registry；检查 DSH 源设置与网络，展开技术详情后手动重试'),REGISTRY_LOOKUP_TIMEOUT:t('registry 查询超过 30 秒；检查 DSH 源设置与网络后手动重试'),REGISTRY_CONFIG_UNAVAILABLE:t('DSH 未提供可读的源配置；检查客户端插件管理器，展开技术详情'),DSH_PLUGIN_FAILED:t('DSH 安装命令失败，请展开技术详情查看原始原因'),LIBRARY_INSTALL_UNAVAILABLE:t('当前宿主未提供安装参数（profile / node 路径）'),CATALOG_ITEM_MISSING:t('目录里已没有这一项，刷新后重试'),UNSTABLE_VERSION:t('registry 上的最新版是预发布版（rc），客户端未允许安装预发布版'),RUNTIME_ARCHIVE_UNAVAILABLE:t('运行时归档下载失败，检查网络或来源'),OPERATION_TIMEOUT:t('10 分钟内没有结果，可稍后重试'),PACKAGE_DENIED:t('HanaMesh 套件自身不能从市场安装或卸载'),INSTANCE_IN_USE:t('先关闭该应用的所有视图再卸载')};
+  const FAILURE_REASONS={...CORE_SUITE_FAILURES,INSTALL_READBACK_MISMATCH:t('安装命令返回成功，但 profile 读回的版本与固定版本不一致'),DSH_PLUGIN_FAILED:t('DSH 安装命令失败，请展开技术详情查看原始原因'),LIBRARY_INSTALL_UNAVAILABLE:t('当前宿主未提供安装参数（profile / node 路径）'),CATALOG_ITEM_MISSING:t('目录里已没有这一项，刷新后重试'),RUNTIME_ARCHIVE_UNAVAILABLE:t('运行时归档下载失败，检查网络或来源'),OPERATION_TIMEOUT:t('10 分钟内没有结果，可稍后重试'),PACKAGE_DENIED:t('HanaMesh 套件自身不能从市场安装或卸载'),INSTANCE_IN_USE:t('先关闭该应用的所有视图再卸载')};
   const failureReason=(code,details)=>{
     const diagnostic=code==='DSH_PLUGIN_FAILED'?details?.diagnostic??'':'',pnpmCode=diagnostic.match(/\bERR_PNPM_[A-Z0-9_]+\b/)?.[0];
     if(pnpmCode==='ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION'){
       const packages=[...new Set([...diagnostic.matchAll(/((?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*@\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)\s+was published\b/g)].map(match=>match[1]))];
-      return pnpmCode+' · '+t('宿主的依赖发布时间检查未通过（默认需发布满 24 小时，以技术详情中的 cutoff 为准）。已知 DSH 0.2.0-rc.2 内置 pnpm 11.7.0 对同名多条白名单只认第一条。请在 DSH 设置中检查当前版本并升级 DSH，或等待受影响版本满足规则后手动重试。')+(packages.length?' '+t('受影响包：')+packages.join(', '):'');
+      return pnpmCode+' · '+t('宿主的依赖发布时间检查未通过。请核对安装目标包含精确版本并保留技术详情；若仍失败，请在 DSH 设置中检查并升级 DSH。')+(packages.length?' '+t('受影响包：')+packages.join(', '):'');
     }
     return(pnpmCode?pnpmCode+' · ':'')+(t(FAILURE_REASONS[code])??t('详细原因见宿主日志'));
   };

package/dist/dsh-compat.js

@@ -1,6 +1,6 @@
 import semver from 'semver';
 
 /** Public host compatibility; exact dependency versions in devDependencies remain reproducible test inputs. */
-export const DSH_RANGE='>=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0';
+export const DSH_RANGE='>=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0 || >=0.2.2-0 <0.3.0-0';
 /** saveExact entered the public PluginManager contract in 0.2.1-alpha.2. Unknown versions fail closed. */
 export function managerSupportsExactSave(version){return typeof version==='string'&&semver.satisfies(version,'>=0.2.1-alpha.2 <0.3.0-0',{includePrerelease:true});}

package/dist/dsh.d.ts

@@ -1,4 +1,3 @@
-import type {InstallationReaderConfig} from './installation-status.js';
 import type { AppHost, AppDefinition, AuthenticatedSubject, Awaitable, DshStorageBinding } from './index.js';
 export const name: 'hanamesh-app-host';
 export const DSH_TARGET: '>=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0';
@@ -13,7 +12,7 @@ export interface DshPluginConfig {
   /** `sources` undefined → the HanaMesh catalog source; explicit `[]` → none. `profileDir`/`profileName`/`dshBin` (and
    *  `nodeBinary`) are inferred from the proven Desktop layout or plain DSH when undefined — see docs/CONTRACT.md 「应用库配置」; explicit values win. */
   /** rc.28: the same keys serve the HanaMesh market (plugins + applications; routes `/hanamesh/library*`, see docs/CONTRACT.md「市场」). */
-  library?:{fixture?:string;sources?:Array<{manifestUrl:string;enabled?:boolean}>;profileDir?:string;profileName?:string;dshBin?:string;registry?:string;allowPrerelease?:boolean;eventRetention?:number;installationReaders?:Partial<Record<'claude'|'codex',InstallationReaderConfig>>};
+  library?:{fixture?:string;sources?:Array<{manifestUrl:string;enabled?:boolean}>;profileDir?:string;profileName?:string;dshBin?:string;registry?:string;eventRetention?:number};
   applications?: AppDefinition[]; leaseTtlMs?: number; sweepIntervalMs?: number;
 }
 /** Adapt an open `ctx.storageDomain` handle (single layout, global snapshot) to the store binding. */

package/dist/dsh.js

@@ -73,11 +73,9 @@ export const Config = z.object({
     sources:z.union([z.array(z.any()),z.const(undefined)]),
     /** Locations are inferred from the verified Desktop argv/profile or plain DSH (see library/locate.js). */
     profileDir:z.string(),profileName:z.string(),dshBin:z.string(),
-    registry:z.string(),allowPrerelease:z.boolean(),
+    registry:z.string(),
     /** Publicly named event history capacity; a lost cursor reports resetRequired. */
     eventRetention:z.number().default(512),
-    /** Explicit official CLI readers; unset means unknown, never inferred from PATH or private files. */
-    installationReaders:z.union([z.any(),z.const(undefined)]),
     /** Website → client handoff listener (library/handoff.js). Unset fields use the defaults shown in the library
      *  settings page, where they can also be changed (saved values win over this config). */
     handoff:z.object({enabled:z.boolean(),ports:z.union([z.array(z.number()),z.const(undefined)]),
@@ -236,8 +234,6 @@ export async function apply(ctx, config) {
       locations.inferred.map(key=>[key,key==='sources'?locations.sources.map(source=>source.manifestUrl):locations[key]]))));
     // Exact-save capability comes from the host's public package metadata. Older managers use the public CLI
     // for installs and preserve restart-required; applications and compensation also use that CLI.
-    let pluginManager;
-    optional('pluginManager', service => { pluginManager=service; });
     let dshBin=locations.dshBin;
     if(!dshBin&&locations.profileDir&&!desktop)try{dshBin=createRequire(join(locations.profileDir,'package.json')).resolve('@deepseek-ai/dsh/lib/bin.js');}catch{dshBin=undefined;}
     const cliUsable=Boolean(locations.desktopLauncher||dshBin&&(!desktop||locations.desktopCli||config.library?.dshBin));
@@ -245,9 +241,9 @@ export async function apply(ctx, config) {
     if(locations.profileDir&&locations.profileName){
       provisionApi=await import('@hanamesh/lib-provision');
       installer=nodeBinding(()=>nodeRuntime.executable,nodeBinary=>createLibraryInstaller({profileDir:locations.profileDir,profileName:locations.profileName,dataRoot,
-        ...(cliUsable?{nodeBinary,dshBin,desktopCli:locations.desktopCli,desktopLauncher:locations.desktopLauncher}:{}),pluginManagerVersion:locations.pluginManagerVersion,profileWriter,registryRules:locations.pluginManagerRegistry?()=>import(pathToFileURL(locations.pluginManagerRegistry).href):undefined,
-        registry:libraryConfig.registry,allowPrerelease:libraryConfig.allowPrerelease,provision:provisionApi.provision,remove:provisionApi.remove,ledger:provisionApi.ledger,
-        coreService:()=>coreService,suiteSourceService:()=>suiteSourceService,suiteSourceMode:()=>library?.suiteSourceSettings().mode??'configured',pluginManager:()=>pluginManager,emit:event=>library?.emit(event)}));
+        ...(cliUsable?{nodeBinary,dshBin,desktopCli:locations.desktopCli,desktopLauncher:locations.desktopLauncher}:{}),pluginManagerVersion:locations.pluginManagerVersion,profileWriter,
+        registry:libraryConfig.registry,provision:provisionApi.provision,remove:provisionApi.remove,ledger:provisionApi.ledger,
+        coreService:()=>coreService,suiteSourceService:()=>suiteSourceService,suiteSourceMode:()=>library?.suiteSourceSettings().mode??'configured',emit:event=>library?.emit(event)}));
     }
     /** What a person must do so the library can install, in their words (C-MARKET probe `error.need`). */
     const unavailable=()=>{
@@ -262,7 +258,7 @@ export async function apply(ctx, config) {
     };
     const identity=await detectClient({desktop});
     if(typeof ctx.logger?.info==='function')ctx.logger.info('hanamesh-app-host library: client %s (%s)',identity.client,identity.evidence);
-    library=createLibraryService({domain:{global:libraryDomain.global,close:closeLibraryDomain},host,config:libraryConfig,dataRoot,ledgerReader:provisionApi?.ledger??(async()=>({schema:1,items:{}})),installer,client:identity.client,unavailable,suiteSourceService:()=>suiteSourceService,installationStatus:nodeStatusBinding(()=>nodeRuntime.executable,workerNode=>createInstallationStatusReader({client:identity.client,core:()=>coreService,workerNode,readers:libraryConfig.installationReaders})),logger:ctx.logger});
+    library=createLibraryService({domain:{global:libraryDomain.global,close:closeLibraryDomain},host,config:libraryConfig,dataRoot,ledgerReader:provisionApi?.ledger??(async()=>({schema:1,items:{}})),installer,client:identity.client,unavailable,suiteSourceService:()=>suiteSourceService,installationStatus:nodeStatusBinding(()=>nodeRuntime.executable,workerNode=>createInstallationStatusReader({client:identity.client,core:()=>coreService,workerNode})),logger:ctx.logger});
     own('library', () => library.close());
     await library.init();
     // rc.27: app bundles register plain `app.json` (no package name); the installed scan knows which npm package ships

package/dist/git-command-worker.js

@@ -0,0 +1,12 @@
+// Live Windows tree anchor; its reaper closes the tree before removing trace files.
+import {spawn,spawnSync} from 'node:child_process';
+import {join} from 'node:path';
+const stop=()=>{spawnSync(join(process.env.SystemRoot,'System32','taskkill.exe'),['/PID',String(process.pid),'/T','/F'],{stdio:'ignore',windowsHide:true});process.exit(1);};
+process.once('disconnect',stop);
+process.once('message',({command,args,options})=>{
+ const {input,...spawnOptions}=options;
+ const child=spawn(command,args,{...spawnOptions,stdio:[input===undefined?'ignore':'pipe','inherit','inherit'],detached:false});
+ if(input!==undefined){child.stdin.on('error',()=>{});child.stdin.end(input);}
+ child.once('error',error=>{if(process.connected)process.send({error:{code:error.code??'SPAWN_FAILED'}});});
+ child.once('close',(code,signal)=>{if(process.connected)process.send({result:{code,status:code,signal}});});
+});

package/dist/git-process.js

@@ -7,6 +7,11 @@ const policy=Object.freeze({GIT_CONFIG_NOSYSTEM:'1',GIT_TERMINAL_PROMPT:'0',GIT_
   GIT_CONFIG_KEY_1:'credential.helper',GIT_CONFIG_VALUE_1:'!gh auth git-credential'});
 export function safeGitEnv(base=process.env){
  const env={...base};
+ // Nested guards share ownership only within the same explicitly selected temp root.
+ // A caller choosing a different scratch root starts an independent trace owner.
+ if(!env.HM_GIT_GUARD_PARENT_ROOT&&base.TMPDIR===process.env.TMPDIR&&process.env.HM_GIT_GUARD_PARENT_ROOT){
+  env.HM_GIT_GUARD_PARENT_ROOT=process.env.HM_GIT_GUARD_PARENT_ROOT;env.HM_GIT_GUARD_TMP_ROOT=process.env.HM_GIT_GUARD_TMP_ROOT;
+ }
  for(const key of Object.keys(env))if(/^GIT_CONFIG_(?:COUNT|KEY_\d+|VALUE_\d+|PARAMETERS)$/.test(key)||/^GIT_TRACE/.test(key)||['GIT_ASKPASS','SSH_ASKPASS'].includes(key))delete env[key];
  return {...env,...policy,npm_config_manage_package_manager_versions:'false',pnpm_config_manage_package_manager_versions:'false'};
 }
@@ -27,7 +32,7 @@ export function observeGitTrace(directory){
    let event;try{event=JSON.parse(line);}catch{throw Object.assign(new Error('Invalid Git credential trace.'),{code:'GIT_TRACE_INVALID'});}
    if(['child_start','exec'].includes(event.event)&&forbidden.test((event.argv??[]).join(' '))){failure=Object.assign(new Error('Forbidden macOS keychain helper was invoked; operation failed.'),{code:'GIT_KEYCHAIN_FORBIDDEN'});throw failure;}
   }
- },close(){if(closed)return;closed=true;try{closeSync(fd);}finally{rmSync(directory,{recursive:true,force:true});}}};
+ },close(){if(closed)return;closed=true;try{closeSync(fd);}finally{rmSync(directory,{recursive:true,force:true,maxRetries:4,retryDelay:25});}}};
 }
 export function guardNodeBinary({workerNode,versions=process.versions,execPath=process.execPath}={}){
  if(workerNode!==undefined)return typeof workerNode==='string'&&isAbsolute(workerNode)?workerNode:undefined;
@@ -43,7 +48,7 @@ export async function spawnGitSafe(command,args,options={}){
  try{
   if(signal?.aborted)throw Object.assign(new Error('Guarded command aborted.'),{name:'AbortError',code:'ABORT_ERR'});
   const stdio=options.stdio==='inherit'?['ignore','inherit','inherit','ipc']:['ignore','pipe','pipe','ipc'];
-  worker=fork(new URL('./git-worker.js',import.meta.url),[],{cwd:options.cwd,env:safeGitEnv(options.env??process.env),execArgv:[],execPath:nodeRuntime,detached:process.platform!=='win32',stdio});
+  worker=fork(new URL('./git-worker.js',import.meta.url),[],{cwd:options.cwd,env:safeGitEnv(options.env??process.env),execArgv:[],execPath:nodeRuntime,detached:true,windowsHide:true,stdio});
   worker.stdout?.on('data',chunk=>{stdout=(stdout+chunk.toString(encoding)).slice(-4*1024*1024);});
   worker.stderr?.on('data',chunk=>{stderr=(stderr+chunk.toString(encoding)).slice(-4*1024*1024);});
   signal?.addEventListener('abort',abort,{once:true});
@@ -59,6 +64,6 @@ export async function spawnGitSafe(command,args,options={}){
  }finally{
   clearTimeout(deadline);clearTimeout(abortFallback);signal?.removeEventListener('abort',abort);
   if(worker?.connected)worker.disconnect();
-  if(directory)rmSync(directory,{recursive:true,force:true});
+  if(directory)rmSync(directory,{recursive:true,force:true,maxRetries:4,retryDelay:25});
  }
 }

package/dist/git-worker.js

@@ -1,16 +1,32 @@
 // Internal IPC supervisor. The parent never detaches a package manager directly.
-import {spawn,spawnSync} from 'node:child_process';
+import {spawn,spawnSync,fork} from 'node:child_process';
 import {existsSync,mkdtempSync,writeFileSync,rmSync,realpathSync} from 'node:fs';
 import {tmpdir} from 'node:os';
 import {dirname,join,basename} from 'node:path';
+import {createWindowsJob} from './windows-job.js';
 import {observeGitTrace} from './git-process.js';
-let monitor,directory,timer,done=false,started=false;
-function finish(payload){
+let monitor,directory,timer,done=false,started=false,anchor,anchorClosed,windowsJob,jobStarting,jobController;
+async function finish(payload){
  if(done)return;done=true;clearInterval(timer);
+ if(process.platform==='win32'&&anchor){
+  try{
+   if(!windowsJob){jobController?.abort();try{await jobStarting}catch{}}
+   if(windowsJob)await windowsJob.stop();else if(anchor.exitCode===null&&anchor.signalCode===null)anchor.kill('SIGKILL');
+   await anchorClosed;
+  }catch{payload={error:{code:'GIT_TREE_CLEANUP_FAILED'}};}
+ }
+ finalize(payload);
+}
+async function commandResult(payload){
+ if(done)return;
+ if(!payload.error){try{while(!done&&await windowsJob.active()>1)await new Promise(resolve=>setTimeout(resolve,5));}catch{void finish({error:{code:'GIT_TREE_CLEANUP_FAILED'}});return;}}
+ if(!done)void finish(payload);
+}
+function finalize(payload){
  try{monitor?.check(true);}catch(error){payload={error:{code:error.code??'GIT_TRACE_INVALID'}};}
  try{if(monitor)monitor.close();else if(directory)rmSync(directory,{recursive:true,force:true});}catch{payload={error:{code:'GIT_TRACE_CLEANUP_FAILED'}};}
  const end=()=>{
-  if(process.platform==='win32'){spawnSync('taskkill',['/pid',String(process.pid),'/T','/F'],{stdio:'ignore'});process.exit(1);}
+  if(process.platform==='win32')process.exit(0);
   else process.kill(-process.pid,'SIGKILL');
  };
  if(process.connected)process.send(payload,end);else end();
@@ -19,15 +35,17 @@ function abort(code='ABORT_ERR'){finish({error:{code,...(code==='ABORT_ERR'?{nam
 process.once('disconnect',()=>abort());
 process.once('SIGTERM',()=>abort());process.once('SIGINT',()=>abort());
 if(!process.connected)process.exit(1);
-process.on('message',request=>{
+process.on('message',async request=>{
  if(request.abort)return abort();if(request.timeout)return abort('ETIMEDOUT');
  if(started)return;started=true;
  try{
   let {command,args,options}=request;
   // No caller-owned trace exists before this IPC worker can clean on disconnect.
-  directory=mkdtempSync(join(realpathSync(options.env.TMPDIR??tmpdir()),'hm-git-guard-'));
+  const temporaryRoot=realpathSync(options.env.TMPDIR??tmpdir());
+  const parentRoot=options.env.HM_GIT_GUARD_TMP_ROOT===temporaryRoot&&options.env.HM_GIT_GUARD_PARENT_ROOT?realpathSync(options.env.HM_GIT_GUARD_PARENT_ROOT):temporaryRoot;
+  directory=mkdtempSync(join(parentRoot,'hm-git-guard-'));
   writeFileSync(join(directory,'events.jsonl'),'',{mode:0o600});monitor=observeGitTrace(directory);
-  options.env={...options.env,GIT_TRACE2_EVENT:join(directory,'events.jsonl'),GIT_TRACE_REDACT:'1'};
+  options.env={...options.env,HM_GIT_GUARD_PARENT_ROOT:directory,HM_GIT_GUARD_TMP_ROOT:temporaryRoot,GIT_TRACE2_EVENT:join(directory,'events.jsonl'),GIT_TRACE_REDACT:'1'};
   if(!process.connected)return abort();
   process.send({directory},error=>{if(error)abort();});
   // Native Windows .cmd shims cannot be executed by spawn without a shell.
@@ -40,6 +58,18 @@ process.on('message',request=>{
    const cli=candidates.find(path=>existsSync(path));if(!cli)throw Object.assign(new Error('Package manager JS entry unavailable.'),{code:'PACKAGE_MANAGER_UNAVAILABLE'});
    command=process.execPath;args=[cli,...args];
   }
+  if(process.platform==='win32'){
+   anchor=fork(new URL('./git-command-worker.js',import.meta.url),[],{cwd:options.cwd,env:options.env,execArgv:[],stdio:['ignore','inherit','inherit','ipc']});
+   anchorClosed=new Promise(resolve=>anchor.once('close',resolve));
+   anchor.once('message',value=>{void commandResult(value)});anchor.once('error',error=>{void finish({error:{code:error.code??'SPAWN_FAILED'}})});
+   jobController=new AbortController();
+   jobStarting=createWindowsJob({pid:anchor.pid,env:{...options.env,TMPDIR:directory,TMP:directory,TEMP:directory},cwd:options.cwd,signal:jobController.signal});
+   windowsJob=await jobStarting;
+   if(done)return;
+   anchor.send({command,args,options});
+   timer=setInterval(()=>{try{monitor.check();}catch(error){finish({error:{code:error.code??'GIT_TRACE_INVALID'}});}},25);
+   return;
+  }
   const {input,...spawnOptions}=options;
   const child=spawn(command,args,{...spawnOptions,stdio:[input===undefined?'ignore':'pipe','inherit','inherit'],detached:false});
   if(input!==undefined){child.stdin.on('error',()=>{});child.stdin.end(input);}

package/dist/install-target/suite.js

@@ -5,7 +5,7 @@
  * real provider. Fixture data is a test catalog and is labelled as such in the market UI.
  */
 import { readFile, writeFile, mkdir } from 'node:fs/promises';
-import { join, dirname } from 'node:path';
+import { join, dirname, resolve } from 'node:path';
 import { createServer, request } from 'node:http';
 import { randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
@@ -94,8 +94,8 @@ export async function sourceRecoveryProfile({recovery},item={}){
   if(item.mode==='upgrade')await profile.seed(target.packageName,app.previous);
   for(const [command,phase,skip] of item.inject??[])profile.fail(command,phase,skip);
   if(item.concurrent)profile.concurrentAdd('@fixture/concurrent','1.0.0');
-  // Named single-source contract fixture; not production registry policy.
-  const installer=emit=>createLibraryInstaller({registryRules:async()=>({registryPlan:(_requested,configured)=>[configured.registry],attributeFailure:()=>'other'}),pluginManager:()=>({registries:async()=>({registry:'https://source-fixture.invalid/',fallbackRegistries:[],resolved:'https://source-fixture.invalid/'})}),profileDir:profile.profileDir,profileName:profile.profileName,dataRoot:profile.dataRoot,nodeBinary:'/source-fixture/bin/node',dshBin:'/source-fixture/dsh/lib/bin.js',
+  // The catalog fixture already supplies the exact reviewed version.
+  const installer=emit=>createLibraryInstaller({profileDir:profile.profileDir,profileName:profile.profileName,dataRoot:profile.dataRoot,nodeBinary:resolve('/source-fixture/bin/node'),dshBin:resolve('/source-fixture/dsh/lib/bin.js'),
     fetchImpl:profile.fetchImpl({[app.packageName]:app.latest,[plugin.packageName]:plugin.latest}),spawn:profile.spawn,provision:profile.provision,remove:profile.remove,ledger:profile.ledger,emit});
   return{profile,target,installer};
 }

package/dist/installation-status.d.ts

@@ -1,13 +1,5 @@
 /** Advertised metadata only. Discovery performs no installation read. */
 export const INSTALLATION_STATUS_CAPABILITY:Readonly<{contract:'hanamesh.installation-status';contractVersion:'1';path:'/hanamesh/library/installation-status'}>;
-export interface InstallationReaderConfig {
- /** Absolute official executable and explicitly selected user/config directories. Never supplied by a website. */
- executable:string;home:string;configDir:string;
- /** Identity and exact HTTPS marketplace URL from the registered AgentPluginDTO. */
- pluginName:string;marketplace:string;marketplaceUrl:string;
- /** Required positive bounded operation budgets. No product default is inferred. */
- timeoutMs:number;maxOutputBytes:number;
-}
 export interface InstallationStatusRequest {contractVersion:'1';consent:'read-installations'}
 export interface InstallationObservation {
  channel:'hanamesh'|'dsh'|'claude'|'codex';

package/dist/library/diagnostics.js

@@ -27,7 +27,6 @@ export function installationDiagnostic(error){
     cause=field(cause,'cause');
   }
   // Only known installer fields, never arbitrary details/stack/response objects.
-  if(error instanceof AppHostError&&error.code==='REGISTRY_LOOKUP_FAILED'&&Number.isInteger(error.details?.status))lines.push(`Registry HTTP status: ${error.details.status}`);
   if(error instanceof AppHostError&&error.code==='DSH_PLUGIN_FAILED'){
     lines.push(`CLI exit: ${Number.isInteger(error.details?.code)?error.details.code:'unknown'}; signal: ${clean(error.details?.signal,80)||'none'}`);
     lines.push(`stderr: ${clean(error.details?.stderr)||'<empty>'}`);

package/dist/library/github-target.js

@@ -34,7 +34,7 @@ export function packageInstallTarget(value){
 
 export const installTargetName=target=>target.source==='github'?target.packageName:target.name;
 export const sameInstallTarget=(left,right)=>JSON.stringify(packageInstallTarget(left))===JSON.stringify(packageInstallTarget(right));
-export const catalogInstallationAllowed=item=>item?.installMethods===undefined?item?.oneClickInstall?.allowed!==false:item?.oneClickInstall?.allowed===true;
+export const catalogInstallationAllowed=item=>Array.isArray(item?.installMethods)&&item?.oneClickInstall?.allowed===true;
 export function catalogPackageTargets(item){
   if(!catalogInstallationAllowed(item))return[];
   return (item.installMethods??[]).filter(method=>['hanamesh','dsh'].includes(method.channel)&&method.target)

package/dist/library/handoff.js

@@ -1,4 +1,5 @@
 import { installationStatusCors, serveInstallationStatus } from './installation-status-http.js';
+import {serveInstallTargetProbe} from './install-target-http.js';
 /**
  * Website → client install handoff (C-MARKET, 2026-10-15 E/F). Upstream Desktop listens on an OS-assigned port that
  * nothing records, and a browser tab without the launch token gets 401, so a website can neither find nor enter the
@@ -33,7 +34,7 @@ const TIMER_MAX_MS = 2_147_483_647;
 /** Fixed rules (correctness, not policy): listed on the settings page with the reason they cannot be switched off. */
 export const HANDOFF_RULES = Object.freeze([
   { rule: '只在本机 127.0.0.1 上监听，请求的 Host 必须是 127.0.0.1 或 localhost 加监听端口', why: '防止别的机器或 DNS 重绑定的网页冒充本机' },
-  { rule: '只有「允许交接的网站」里的网站能探测本客户端、交接安装、读交接状态；别的网站什么也读不到', why: '否则任何网页都能知道你装了什么客户端、缺什么，用来识别你' },
+  { rule: '只有「允许交接的网站」能读取客户端能力、交接安装和交接状态；未许可网站仅能读取固定的来源拒绝提示', why: '拒绝提示只说明本机监听拒绝了该网站，不透露客户端类型、能力、安装情况或允许名单' },
   { rule: '网站交接只会在应用库里弹出确认；只有你点「确认安装」才会安装', why: '网站不能替你决定装什么' },
   { rule: '交接状态只给发起它的那个网站看', why: '一个网站不能读另一个网站的交接' },
   { rule: `交接请求体不超过 ${HANDOFF_BODY_MAX_BYTES} 字节`, why: '交接只包含目录身份、合约版本及已审核的结构化安装目标；正文上限为 4096 字节，不接受来源命令' },
@@ -168,16 +169,7 @@ export function createHandoffHandler({ library, queue, settings, port }) {
       requireCondition([`127.0.0.1:${bound}`, `localhost:${bound}`].includes(req.headers.host), 'HOST_DENIED', 'Unrecognized request host.', {}, 403);
       const url = new URL(req.url ?? '/', `http://${req.headers.host}`), path = url.pathname, origin = req.headers.origin;
       if (path === '/hanamesh/library/install-target') {
-        // A website not in allowedOrigins gets no CORS grant and no body: it cannot tell which client runs or what it lacks.
-        // Requests without an Origin are not from a website (a person's address bar, a local tool) and are answered.
-        if (origin !== undefined) {
-          requireCondition(settings().allowedOrigins.includes(origin), 'ORIGIN_DENIED', 'Not available.', undefined, 403);
-          cors = { 'access-control-allow-origin': origin, vary: 'Origin', 'access-control-allow-private-network': 'true' };
-        }
-        if (req.method === 'OPTIONS') { send(res, 204, undefined, { ...cors, 'access-control-allow-methods': 'GET' }); return; }
-        requireCondition(req.method === 'GET', 'METHOD_NOT_ALLOWED', 'Discovery requires GET.', {}, 405);
-        requireCondition(!url.search, 'UNKNOWN_FIELDS', 'Discovery takes no parameters.');
-        send(res, 200, { ...library.installTarget(), traceId }, cors); return;
+        serveInstallTargetProbe(req,res,{allowedOrigins:settings().allowedOrigins,read:()=>library.installTarget(),traceId,send});return;
       }
       if(path === '/hanamesh/library/installation-status'){
         cors=installationStatusCors(req,settings().allowedOrigins);

package/dist/library/install-target-http.js

@@ -0,0 +1,39 @@
+/** Public discovery only: an unapproved website may read one constant refusal, never client facts. */
+import {AppHostError,requireCondition} from '../errors.js';
+const PATH='/hanamesh/library/install-target';
+const VARY='Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Access-Control-Request-Private-Network';
+function browserOrigin(origin){
+ if(typeof origin!=='string')return false;
+ try{const url=new URL(origin);return ['https:','http:'].includes(url.protocol)&&url.origin===origin}catch{return false}
+}
+export function serveInstallTargetProbe(req,res,{allowedOrigins,read,traceId,send}){
+ let cors={};
+ try{
+  requireCondition(req.url?.startsWith('/')&&!req.url.startsWith('//')&&!req.url.includes('\\')&&req.url.split('?')[0]===PATH,'BAD_TARGET','Invalid discovery target.');
+  requireCondition(req.headers['sec-fetch-dest']!=='iframe','FRAME_CONTROL_DENIED','An application frame cannot inspect the host.',{},403);
+  const url=new URL(req.url,'http://127.0.0.1'),origin=req.headers.origin,approved=origin===undefined||allowedOrigins.includes(origin);
+  if(!approved){
+   requireCondition(browserOrigin(origin),'ORIGIN_DENIED','Not available.',{},403);
+   requireCondition(req.method==='GET'||req.method==='OPTIONS','METHOD_NOT_ALLOWED','Discovery requires GET.',{},405);
+   requireCondition(!url.search,'UNKNOWN_FIELDS','Discovery takes no parameters.');
+   requireCondition(req.headers.cookie===undefined&&req.headers.authorization===undefined,'CREDENTIALS_NOT_ACCEPTED','Discovery requires credentials: omit.',{},403);
+  }
+  if(req.method==='OPTIONS'){
+   const method=req.headers['access-control-request-method'],headers=req.headers['access-control-request-headers'],privateNetwork=req.headers['access-control-request-private-network'];
+   requireCondition(method==='GET'||(approved&&method===undefined),'METHOD_NOT_ALLOWED','Discovery preflight permits GET only.',{},405);
+   requireCondition(headers===undefined||headers.trim()==='','PREFLIGHT_HEADERS_DENIED','Discovery preflight accepts no additional request headers.',{},403);
+   requireCondition(privateNetwork===undefined||privateNetwork==='true','INVALID_PREFLIGHT','Invalid private-network preflight.');
+   cors=origin===undefined?{}:{'access-control-allow-origin':origin};
+   // A non-2xx preflight hides the subsequent refusal from fetch. This grants only the fixed GET response.
+   send(res,204,undefined,{...cors,vary:VARY,'access-control-allow-methods':'GET',...(origin!==undefined&&privateNetwork==='true'?{'access-control-allow-private-network':'true'}:{})});return;
+  }
+  cors=origin===undefined?{}:{'access-control-allow-origin':origin,vary:'Origin'};
+  if(!approved){send(res,403,{error:{code:'ORIGIN_DENIED',message:'This website is not allowed to read discovery.'}},cors);return;}
+  requireCondition(req.method==='GET','METHOD_NOT_ALLOWED','Discovery requires GET.',{},405);
+  requireCondition(!url.search,'UNKNOWN_FIELDS','Discovery takes no parameters.');
+  send(res,200,{...read(),traceId},cors);
+ }catch(error){
+  const trusted=error instanceof AppHostError;
+  send(res,trusted?error.status:500,{error:{code:trusted?error.code:'INTERNAL_ERROR',message:trusted?error.message:'The operation could not be completed.'},traceId},cors);
+ }
+}