@max-null/dsh-plugin-center 0.2.12 → 0.2.14

package/dist/engine.d.ts

@@ -8,7 +8,8 @@
 import { Service, type Context } from '@deepseek-ai/cordis';
 import { type InstalledPlugin } from './meta.ts';
 import { type MarketPlugin } from './market.ts';
-import { type PnpmResult, type UpdateDigest } from './update.ts';
+import { type LlmUpdatePackage, type PnpmResult, type UpdateDigest } from './update.ts';
+import { type LlmLogRecord } from './llm-log.ts';
 declare module '@deepseek-ai/cordis' {
     interface Context {
         /** The plugin-center engine (provided by this package's host half). */
@@ -75,6 +76,11 @@ export declare class PluginCenterEngine extends Service {
     readVersions(): Promise<Record<string, string>>;
     /** Persist the read-mark (best-effort; a quota/IO failure just loses the mark). */
     markRead(versions: Record<string, string>): Promise<void>;
+    /** 弹窗当天已展示标记（2026-08-27）：host 文件（DSH web 端口随机，
+     *  localStorage 按 origin 隔离会丢；文件侧稳定）。 */
+    private get whatsNewDailyPath();
+    whatsNewDaily(): Promise<string>;
+    markWhatsNewDaily(day: string): Promise<void>;
     /** Current DSH version, read from the installed @deepseek-ai/dsh package. */
     dshVersion(): Promise<string>;
     /** Non-group Loader entries, cross-matched with market categories. */
@@ -105,6 +111,20 @@ export declare class PluginCenterEngine extends Service {
      *     - 官方 dsh web（无消费方）→ 仿社区市场返回可复制 CLI 指令；
      *  3. 非锁失败（网络/版本）→ 原样报错。 */
     update(name: string, version: string): Promise<PnpmResult>;
+    /** LLM 驱动更新准备：采集信息包供确认面板/会话 prompt 使用（2026-08-28）。
+     *  只读采集（npm/GitHub/本地 package.json），不执行任何安装——执行由 LLM
+     *  Agent 在「插件更新」会话中按 skill 决策后完成。 */
+    llmUpdatePrepare(name: string): Promise<LlmUpdatePackage | null>;
+    /** 追加一条 LLM 更新动作日志(JSONL,供 client 轮询结果展示)。 */
+    appendLlmUpdateLog(entry: {
+        name: string;
+        action: string;
+        detail: string;
+        status: 'pending' | 'running' | 'success' | 'failed';
+    }): Promise<void>;
+    /** 读取某个插件最近一条 LLM 更新动作(JSONL 逆序找 name 匹配);
+     *  无记录返回 null。client 轮询据此做三态(进行中/成功/失败)。 */
+    readLlmUpdateResult(name: string): Promise<LlmLogRecord | null>;
     /** 串行执行一次 pnpm 操作并失效缓存（无论成败都放行链条后续任务）。 */
     private enqueuePnpm;
     /** Temporary diagnostics for the empty-update bug; removed once root-caused. */
@@ -116,8 +136,12 @@ export declare class PluginCenterEngine extends Service {
             source: string;
         }[];
     }>;
-    /** Disable/enable one loader entry through the profile patch layer. */
-    toggle(id: string, disabled: boolean): Promise<{
+    /** Disable/enable one loader entry through the profile patch layer.
+     *  2026-08-25 禁用失效：`dsh plugin add` 清单的 insert 子条目无 id，loader
+     *  每次启动分配随机运行时 id，按它写禁用行重启后永远匹配不到。当 patch
+     *  文件中没有 `- id: <entryId>` 行时，改用该条目的包名 name 作寻址键
+     *  （setDisabled 内按 name 把 insert 子条目升级为稳定 id 后再写禁用行）。 */
+    toggle(id: string, name: string, disabled: boolean): Promise<{
         ok: boolean;
         detail: string;
         nowDisabled: boolean | null;

package/dist/engine.js

@@ -12,9 +12,10 @@ import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { existsSync, readFileSync } from 'node:fs';
 import { buildInstalledPlugin, clearPackageCache, resolvePackage } from "./meta.js";
 import { fetchAwesomePluginsJson, fetchDshMarketPlugins, fetchOhMyDshOverrides, fetchOhMyDshPlugins, mapConcurrent, mergePlugins, } from "./market.js";
-import { detectUpdate, installPlugin, preparePluginUpdate, updatePlugin } from "./update.js";
+import { detectUpdate, installPlugin, preparePluginUpdate, updatePlugin, buildLlmPackage, dependencySpecifierOf, isSameUpstream, sourceOf, } from "./update.js";
 import { reconcileInstalled, readDependencyKeys } from "./reconcile.js";
-import { readDisabledState, setDisabled } from "./toggle.js";
+import { readDisabledState, setDisabled, escapeRegExp } from "./toggle.js";
+import { appendLlmLog, readLlmLogLatest } from "./llm-log.js";
 /** Runtime mirror of cordis FiberState (a cross-package const enum). */
 const FIBER_PHASE = {
     0: 'pending',
@@ -135,6 +136,30 @@ export class PluginCenterEngine extends Service {
         }
         catch { /* best-effort */ }
     }
+    /** 弹窗当天已展示标记（2026-08-27）：host 文件（DSH web 端口随机，
+     *  localStorage 按 origin 隔离会丢；文件侧稳定）。 */
+    get whatsNewDailyPath() {
+        return join(this.dshHome, 'plugin-center-whatsnew-daily.json');
+    }
+    async whatsNewDaily() {
+        try {
+            const parsed = JSON.parse(await readFile(this.whatsNewDailyPath, 'utf8'));
+            return typeof parsed === 'object' && parsed !== null && typeof parsed.day === 'string'
+                ? parsed.day
+                : '';
+        }
+        catch {
+            return '';
+        }
+    }
+    async markWhatsNewDaily(day) {
+        try {
+            const path = this.whatsNewDailyPath;
+            await mkdir(dirname(path), { recursive: true });
+            await writeFile(path, JSON.stringify({ day, at: new Date().toISOString() }), 'utf8');
+        }
+        catch { /* best-effort */ }
+    }
     /** Current DSH version, read from the installed @deepseek-ai/dsh package. */
     async dshVersion() {
         const resolved = await resolvePackage(this.baseUrl, '@deepseek-ai/dsh');
@@ -310,7 +335,22 @@ export class PluginCenterEngine extends Service {
             return hit.digests;
         const [installed, localDsh] = await Promise.all([this.listInstalled(), this.dshVersion()]);
         const candidates = installed.filter(p => UPDATABLE.has(p.source) && p.version !== null);
-        const digests = await Promise.all(candidates.map(p => detectUpdate(p.name, p.version, p.repoUrl, p.compatRange, localDsh, sinceIso)));
+        const digests = await Promise.all(candidates.map(async (p) => {
+            // 同名异源保护(2026-08-29):本地自定义来源(依赖声明 vendor/tarball/
+            // local-file)时,校验 npm 同名包是否同一上游——不一致(如 dream12347
+            // 定制 vs hkkz9522 独立同名项目)排除出更新列表,防误报与覆盖定制。
+            // 无法判定(任一侧缺 repository,如 dsh-session-manager 0.2.2 作者未
+            // 声明)同样排除:宁少报不漏报——漏报只少一个提示,误报是 LLM 白跑 +
+            // 用户被误导;人工核对入口见 InstalledView/LLM 会话。
+            const spec = dependencySpecifierOf(this.baseUrl, p.name);
+            const src = spec === null ? 'npm' : sourceOf(spec, this.baseUrl);
+            if (src === 'vendor' || src === 'tarball' || src === 'local-file') {
+                const same = await isSameUpstream(p.repoUrl, p.name);
+                if (same !== true)
+                    return null;
+            }
+            return detectUpdate(p.name, p.version, p.repoUrl, p.compatRange, localDsh, sinceIso);
+        }));
         this.updatesCache = { since: sinceIso, at: now, digests: digests.filter((d) => d !== null) };
         return this.updatesCache.digests;
     }
@@ -357,6 +397,29 @@ export class PluginCenterEngine extends Service {
         const profileName = basename(this.baseUrl) || 'web';
         return { ok: true, detail: '', durationMs: direct.durationMs, command: `dsh plugin --profile ${profileName} add ${name}@${version}` };
     }
+    /** LLM 驱动更新准备：采集信息包供确认面板/会话 prompt 使用（2026-08-28）。
+     *  只读采集（npm/GitHub/本地 package.json），不执行任何安装——执行由 LLM
+     *  Agent 在「插件更新」会话中按 skill 决策后完成。 */
+    async llmUpdatePrepare(name) {
+        // 从已安装列表找该插件的元数据（版本/repo/兼容范围）
+        const installed = await this.listInstalled();
+        const p = installed.find(i => i.name === name);
+        if (p === undefined || p.version === null)
+            return null;
+        const localDsh = await this.dshVersion();
+        const since = new Date(Date.now() - 30 * 24 * 3600 * 1000).toISOString();
+        // detectUpdate 同款采集参数,复用 buildLlmPackage
+        return buildLlmPackage(p.name, p.version, p.repoUrl, p.compatRange, localDsh, since, this.baseUrl);
+    }
+    /** 追加一条 LLM 更新动作日志(JSONL,供 client 轮询结果展示)。 */
+    async appendLlmUpdateLog(entry) {
+        await appendLlmLog(entry);
+    }
+    /** 读取某个插件最近一条 LLM 更新动作(JSONL 逆序找 name 匹配);
+     *  无记录返回 null。client 轮询据此做三态(进行中/成功/失败)。 */
+    async readLlmUpdateResult(name) {
+        return readLlmLogLatest(name);
+    }
     /** 串行执行一次 pnpm 操作并失效缓存（无论成败都放行链条后续任务）。 */
     enqueuePnpm(op) {
         const run = this.pnpmChain.then(async () => {
@@ -378,9 +441,30 @@ export class PluginCenterEngine extends Service {
             installed: (await this.listInstalled()).map(p => ({ name: p.name, version: p.version, source: p.source })),
         };
     }
-    /** Disable/enable one loader entry through the profile patch layer. */
-    async toggle(id, disabled) {
-        const result = await setDisabled(this.baseUrl, id, disabled);
+    /** Disable/enable one loader entry through the profile patch layer.
+     *  2026-08-25 禁用失效：`dsh plugin add` 清单的 insert 子条目无 id，loader
+     *  每次启动分配随机运行时 id，按它写禁用行重启后永远匹配不到。当 patch
+     *  文件中没有 `- id: <entryId>` 行时，改用该条目的包名 name 作寻址键
+     *  （setDisabled 内按 name 把 insert 子条目升级为稳定 id 后再写禁用行）。 */
+    async toggle(id, name, disabled) {
+        // 老调用方（未透传 name 的 client）兜底：从 loader 实时取包名。
+        const entryName = name !== '' ? name : [...this.ctx.loader.entries()].find(e => e.id === id)?.options.name ?? '';
+        if (entryName === '') {
+            return { ok: false, detail: `entry "${id}" not found in loader`, nowDisabled: null };
+        }
+        // 寻址键：patch 文件中已有 `- id: <id>` 行 → 稳定 id 直接用；否则是该
+        // 条目的随机运行时 id → 只能用 name 找到它的 insert 子条目。
+        const patchId = id.replace(/^include:/u, '');
+        let key = entryName;
+        try {
+            const patchPath = join(this.baseUrl, 'cordis.patch.yml');
+            if (existsSync(patchPath)
+                && new RegExp(`^- id: ${escapeRegExp(patchId)}$`, 'm').test(readFileSync(patchPath, 'utf8'))) {
+                key = patchId;
+            }
+        }
+        catch { /* 读失败：走 name 寻址，由 setDisabled 报具体错误 */ }
+        const result = await setDisabled(this.baseUrl, key, entryName, disabled);
         this.installedNamesCache = null;
         return result;
     }

package/dist/llm-log.d.ts

@@ -0,0 +1,25 @@
+export type LlmLogStatus = 'pending' | 'running' | 'success' | 'failed';
+export interface LlmLogEntry {
+    name: string;
+    action: string;
+    detail: string;
+    status: LlmLogStatus;
+}
+/** 最近一条记录(JSONL 逆序找 name 匹配;坏行跳过;无记录/文件缺失 → null)。 */
+export interface LlmLogRecord {
+    at: number;
+    name: string;
+    action: string;
+    detail: string;
+    status: LlmLogStatus;
+}
+/** 日志文件路径(DSH_HOME 未设时回退 ~/.dsh)。 */
+export declare function llmLogPath(dshHome?: string | undefined): string;
+/** 追加一条记录(目录自动创建;失败静默——日志绝不阻断主流程)。 */
+export declare function appendLlmLog(entry: LlmLogEntry, dshHome?: string | undefined): Promise<void>;
+/** 解析一行 JSON:合法且 name 匹配 → 记录;其他 → null。 */
+export declare function parseLlmLogLine(line: string, name: string): LlmLogRecord | null;
+/** 读取某插件最近一条记录(逆序;文件缺失/全坏行 → null)。 */
+export declare function readLlmLogLatest(name: string, dshHome?: string | undefined): Promise<LlmLogRecord | null>;
+/** 按文本扫最后一行含 name 的 JSON(提取解析出的 attr——测试断言用)。 */
+export declare function extractLlmLogField(line: string): Record<string, unknown> | null;

package/dist/llm-log.js

@@ -0,0 +1,70 @@
+/**
+ * LLM 更新动作日志(JSONL)——纯文件读写模块(无 engine 依赖,可单测)。
+ * 文件位置:$DSH_HOME/plugin-center/llm-update-log.jsonl
+ * 行格式:{"at":number,"name":string,"action":string,"detail":string,"status":...}
+ * client 侧轮询 llm-update.result 依赖此文件做三态(执行中/成功/失败)。
+ */
+import { appendFile, mkdir, readFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { homedir } from 'node:os';
+/** 日志文件路径(DSH_HOME 未设时回退 ~/.dsh)。 */
+export function llmLogPath(dshHome = process.env.DSH_HOME) {
+    return join(dshHome ?? join(homedir(), '.dsh'), 'plugin-center', 'llm-update-log.jsonl');
+}
+/** 追加一条记录(目录自动创建;失败静默——日志绝不阻断主流程)。 */
+export async function appendLlmLog(entry, dshHome) {
+    try {
+        const file = llmLogPath(dshHome);
+        await mkdir(dirname(file), { recursive: true });
+        const line = JSON.stringify({ at: Date.now(), ...entry }) + '\n';
+        await appendFile(file, line, 'utf8');
+    }
+    catch { /* best-effort */ }
+}
+/** 解析一行 JSON:合法且 name 匹配 → 记录;其他 → null。 */
+export function parseLlmLogLine(line, name) {
+    try {
+        const rec = JSON.parse(line);
+        if (rec.name !== name)
+            return null;
+        const status = rec.status === 'pending' || rec.status === 'running' || rec.status === 'success' || rec.status === 'failed' ? rec.status : 'running';
+        return {
+            at: typeof rec.at === 'number' ? rec.at : 0,
+            name,
+            action: typeof rec.action === 'string' ? rec.action : '',
+            detail: typeof rec.detail === 'string' ? rec.detail : '',
+            status,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/** 读取某插件最近一条记录(逆序;文件缺失/全坏行 → null)。 */
+export async function readLlmLogLatest(name, dshHome) {
+    try {
+        const text = await readFile(llmLogPath(dshHome), 'utf8');
+        const lines = text.split('\n');
+        for (let i = lines.length - 1; i >= 0; i--) {
+            const line = lines[i]?.trim();
+            if (line === undefined || line === '')
+                continue;
+            const rec = parseLlmLogLine(line, name);
+            if (rec !== null)
+                return rec;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/** 按文本扫最后一行含 name 的 JSON(提取解析出的 attr——测试断言用)。 */
+export function extractLlmLogField(line) {
+    try {
+        return JSON.parse(line);
+    }
+    catch {
+        return null;
+    }
+}

package/dist/rpc.js

@@ -54,12 +54,46 @@ export class PluginCenterRpc extends Service {
                             },
                         };
                     }
+                    case 'llm-update.prepare': {
+                        // LLM 驱动更新信息包(只读采集):来源/版本/兼容/变更,供确认面板与
+                        // 会话 prompt。执行由 LLM Agent 在插件更新会话中按 skill 决策完成。
+                        const name = payload?.name;
+                        if (typeof name !== 'string' || name === '')
+                            return internal('llm-update.prepare: name is required');
+                        const pkg = await ctx.pluginCenter.llmUpdatePrepare(name);
+                        if (pkg === null)
+                            return internal('llm-update.prepare: 插件不存在或版本未知');
+                        return { ok: true, value: pkg };
+                    }
+                    case 'llm-update.log': {
+                        // 追加一条 LLM 更新动作日志(host JSONL,client 轮询结果展示)。
+                        const p = payload;
+                        if (typeof p?.name !== 'string' || typeof p.status !== 'string')
+                            return internal('llm-update.log: bad payload');
+                        await ctx.pluginCenter.appendLlmUpdateLog({
+                            name: p.name,
+                            action: typeof p.action === 'string' ? p.action : '',
+                            detail: typeof p.detail === 'string' ? p.detail : '',
+                            status: p.status,
+                        });
+                        return { ok: true, value: null };
+                    }
+                    case 'llm-update.result': {
+                        // 读某插件最近一条 LLM 更新动作(轮询三态:running/success/failed)。
+                        const name = payload?.name;
+                        if (typeof name !== 'string' || name === '')
+                            return internal('llm-update.result: name is required');
+                        return { ok: true, value: await ctx.pluginCenter.readLlmUpdateResult(name) };
+                    }
                     case 'toggle': {
-                        const id = payload?.id;
-                        const disabled = payload?.disabled;
+                        const payload2 = payload;
+                        const id = payload2?.id;
+                        const name = payload2?.name;
+                        const disabled = payload2?.disabled;
                         if (typeof id !== 'string' || id === '')
                             return internal('toggle: id is required');
-                        const result = await ctx.pluginCenter.toggle(id, disabled === true);
+                        // name 用于无稳定 id 条目的 seek-by-name 寻址（2026-08-25 禁用失效修复）。
+                        const result = await ctx.pluginCenter.toggle(id, typeof name === 'string' ? name : '', disabled === true);
                         if (!result.ok)
                             return internal(`toggle ${id} 失败：${result.detail}`);
                         return { ok: true, value: { nowDisabled: result.nowDisabled } };
@@ -86,6 +120,14 @@ export class PluginCenterRpc extends Service {
                         const versions = payload?.versions ?? {};
                         return { ok: true, value: await ctx.pluginCenter.markRead(versions) };
                     }
+                    case 'whatsNewDaily':
+                        return { ok: true, value: await ctx.pluginCenter.whatsNewDaily() };
+                    case 'markWhatsNewDaily': {
+                        const day = payload?.day;
+                        if (typeof day !== 'string' || day === '')
+                            return internal('markWhatsNewDaily: day is required');
+                        return { ok: true, value: await ctx.pluginCenter.markWhatsNewDaily(day) };
+                    }
                     default:
                         return internal(`unknown endpoint "${endpoint}"`);
                 }

package/dist/toggle.d.ts

@@ -10,6 +10,15 @@
  * followed by an optional `disabled:` line), serialized so concurrent
  * toggles cannot interleave a read-modify-write, refused when the file is
  * not a plain entry list, and protected for host-infrastructure rows.
+ *
+ * Stable ids: `dsh plugin add` install lists mount entries as id-less
+ * `insert` children (`- name: X`), which the Loader gives a RANDOM runtime
+ * id on every boot (cordis-plugin-loader ensureId). Toggling by that
+ * runtime id writes a row no later boot matches (applyEntryPatches warns
+ * and skips) — the 2026-08-25 disable-broken bug. When no `- id:` row
+ * matches, this module addresses the entry by `name` instead: the id-less
+ * insert child is upgraded in place to a stable `- id: X` so the appended
+ * disable row actually hits. It never guesses: no match = refused write.
  */
 export interface ToggleResult {
     ok: boolean;
@@ -19,13 +28,18 @@ export interface ToggleResult {
 }
 /** What the user patch layer currently says about every row id. */
 export declare function readDisabledState(patchPath: string): Map<string, boolean>;
+/** Escape a literal for use inside a RegExp (plugin names may contain `.` etc.). */
+export declare function escapeRegExp(text: string): string;
 /**
  * Set one entry's disabled stance in the profile patch layer. The file is
  * only touched when the stance changes; a malformed file (not a plain
  * entry list) is reported instead of being made worse.
  * @param profileDir - the profile directory holding cordis.patch.yml.
  * @param id - the loader entry id to toggle.
+ * @param name - the entry's package name; used as the addressing key when
+ *   `id` is a Loader-assigned random runtime id with no `- id:` row in the
+ *   patch file (id-less insert children of `dsh plugin add` lists).
  * @param disabled - the target stance.
  * @returns the outcome; `nowDisabled` mirrors the stance or null when refused.
  */
-export declare function setDisabled(profileDir: string, entryId: string, disabled: boolean): Promise<ToggleResult>;
+export declare function setDisabled(profileDir: string, entryId: string, name: string, disabled: boolean): Promise<ToggleResult>;

package/dist/toggle.js

@@ -10,6 +10,15 @@
  * followed by an optional `disabled:` line), serialized so concurrent
  * toggles cannot interleave a read-modify-write, refused when the file is
  * not a plain entry list, and protected for host-infrastructure rows.
+ *
+ * Stable ids: `dsh plugin add` install lists mount entries as id-less
+ * `insert` children (`- name: X`), which the Loader gives a RANDOM runtime
+ * id on every boot (cordis-plugin-loader ensureId). Toggling by that
+ * runtime id writes a row no later boot matches (applyEntryPatches warns
+ * and skips) — the 2026-08-25 disable-broken bug. When no `- id:` row
+ * matches, this module addresses the entry by `name` instead: the id-less
+ * insert child is upgraded in place to a stable `- id: X` so the appended
+ * disable row actually hits. It never guesses: no match = refused write.
  */
 import { readFileSync, writeFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
@@ -89,6 +98,46 @@ export function readDisabledState(patchPath) {
     }
     return state;
 }
+/** Escape a literal for use inside a RegExp (plugin names may contain `.` etc.). */
+export function escapeRegExp(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&');
+}
+/**
+ * Address a `dsh plugin add` install-list insert child by name: an id-less
+ * child (`    - name: X`, 4-space indent under `- insert:`) gets upgraded in
+ * place to a stable-id form (`    - id: X` + `      name: X`), then a
+ * `- id: X / disabled: <bool>` row is appended. A child that already carries
+ * the stable id (`    - id: X`) just gets the row appended (the upgrade must
+ * not regress to a random runtime id). The insert block always stays before
+ * the appended row, so applyEntryPatches registers the id before the toggle
+ * row reads it. Returns false when nothing matches (or `name` is empty) —
+ * callers must refuse the write, never append blindly.
+ */
+function patchInsertChildByName(lines, name, disabled) {
+    if (name === '')
+        return false;
+    const idPattern = new RegExp(`^ {4}- id: ${escapeRegExp(name)}$`, 'u');
+    const namePattern = new RegExp(`^ {4}- name: ${escapeRegExp(name)}$`, 'u');
+    let found = false;
+    for (let i = 0; i < lines.length; i++) {
+        if (namePattern.test(lines[i])) {
+            // 无 id 子条目 → 原地升级为稳定 id（4 空格 + 6 空格 name）。
+            lines[i] = `    - id: ${name}\n      name: ${name}`;
+            found = true;
+            break;
+        }
+        if (idPattern.test(lines[i])) {
+            // 已是稳定 id 子条目 → 无需升级，直接追加禁用行。
+            found = true;
+            break;
+        }
+    }
+    if (!found)
+        return false;
+    const tail = lines.length > 0 && lines[lines.length - 1] !== '' ? '\n' : '';
+    lines.push(`${tail}- id: ${name}\n  disabled: ${String(disabled)}`);
+    return true;
+}
 /** Serialize toggles so concurrent writes cannot interleave. */
 let toggleChain = Promise.resolve();
 /**
@@ -97,10 +146,13 @@ let toggleChain = Promise.resolve();
  * entry list) is reported instead of being made worse.
  * @param profileDir - the profile directory holding cordis.patch.yml.
  * @param id - the loader entry id to toggle.
+ * @param name - the entry's package name; used as the addressing key when
+ *   `id` is a Loader-assigned random runtime id with no `- id:` row in the
+ *   patch file (id-less insert children of `dsh plugin add` lists).
  * @param disabled - the target stance.
  * @returns the outcome; `nowDisabled` mirrors the stance or null when refused.
  */
-export function setDisabled(profileDir, entryId, disabled) {
+export function setDisabled(profileDir, entryId, name, disabled) {
     const run = toggleChain.then(async () => {
         // Loader runtime ids (include:<id>) never match patch composition —
         // always address rows by their original patch id.
@@ -157,9 +209,22 @@ export function setDisabled(profileDir, entryId, disabled) {
             out.push(line);
         }
         if (!patched) {
-            // Append a new row (the file ends with a newline when non-empty).
-            const tail = out.length > 0 && out[out.length - 1] !== '' ? '\n' : '';
-            out.push(`${tail}- id: ${id}\n  disabled: ${String(disabled)}`);
+            // 2026-08-25 禁用失效根因：id-less insert 子条目每次启动拿随机运行时
+            // id，按它追加的禁用行重启后永远匹配不到（applyEntryPatches warn 后
+            // 静默跳过）。所以这里绝不静默追加：先按 name 寻址 insert 子条目行，
+            // 原地升级为稳定 id 再追加；都找不到 → 拒绝（不写文件）。
+            if (!patchInsertChildByName(out, name, disabled)) {
+                if (/^[0-9a-f]{8}$/u.test(id)) {
+                    return {
+                        ok: false,
+                        detail: `entry "${id}" has no stable patch id (random runtime id); ` +
+                            'edit cordis.patch.yml to give its insert child an explicit id',
+                        nowDisabled: null,
+                    };
+                }
+                return { ok: false, detail: `no patch row or insert child matches "${id}"`, nowDisabled: null };
+            }
+            patched = true;
         }
         try {
             writeFileSync(patchPath, out.join('\n') + '\n');

package/dist/update.d.ts

@@ -7,8 +7,24 @@ export interface UpdateDigest {
     compat: 'compatible' | 'incompatible' | 'unknown';
     compatRange: string | null;
 }
+/** 服务面判定:目标客户端 bundle 是否深度依赖 Remote BFF(ctx.remote.*)。
+ *  SSiD 内核(0.1.x)无 remote BFF 服务(走 /plugin-center RPC channel),
+ *  这类版本在 SSiD 上必然「pending waiting for service: remote.session」。
+ *  案例: dsh-sidebar-qa 0.4.1/0.4.2(2026-08-29 两次实崩)。 */
+export declare function clientBundleUsesRemote(content: string): boolean;
+/** 下载目标 tgz 并抽取 client bundle,判定 remote 服务依赖。
+ *  仅返回 boolean 不用 pnpm(直接 registry 下载 tgz + bsdtar 抽文件)。 */
+export declare function targetClientUsesRemote(name: string, version: string): Promise<boolean>;
 /** Latest published version on the npm registry; null when unreachable/unpublished. */
 export declare function npmLatest(packageName: string): Promise<string | null>;
+/** 测试用:清空 repository 缓存(生产无调用)。 */
+export declare function clearNpmRepoCache(): void;
+/** 读 npm 包根级 repository.url(带 24h 缓存;失败/缺失 null)。 */
+export declare function npmRepository(packageName: string): Promise<string | null>;
+/** 仓库 URL 归一化(去 scheme/git+ 前缀/尾 .git/尾斜杠/大小写)用于同源比较。 */
+export declare function normalizeRepoUrl(url: string): string;
+/** 同源判定:true=同一上游;false=同名异源;null=无法判定(任一侧缺 repo)。 */
+export declare function isSameUpstream(localRepoUrl: string | null, packageName: string): Promise<boolean | null>;
 /** Commit-message changelog: the reliable source for repos without release notes. */
 export declare function fetchCommitChangelog(repoUrl: string | null, sinceIso: string): Promise<string[]>;
 /**
@@ -64,6 +80,15 @@ export declare function logPnpm(profileDir: string, args: readonly string[], res
  *  CreateProcess 只找 pnpm.exe（.cmd/.ps1 必须经 shell）——2026-08-17 实测
  *  spawn('pnpm', shell:false) 直接 ENOENT，更新永远假成功。 */
 export declare function pnpmCandidates(): string[];
+/** Wrap a bundled pnpm CLI path into a runnable command line. SSID_PNPM
+ *  (SSiD 捆绑 pnpm) points at `pnpm.cjs` — a node script. On Windows,
+ *  spawning it directly through `shell: true` makes cmd hand the .cjs to
+ *  its file association (ShellExecute): cmd returns exit 0 immediately and
+ *  node never runs (2026-08-25 another machine: 142ms fake success, npm
+ *  add 未生效; output redirection test produced a 0-byte file). Non-.cjs
+ *  paths (e.g. pnpm.exe) are used as-is.
+ */
+export declare function pnpmExecCommand(bundled: string): string;
 /** 归档 profile 的 node_modules 由 pnpm `<major>` 生成（SSiD 部署时把构建机
  *  store 元数据改写成本机路径且保留 major 后缀——shell/main.mjs rewire）。
  *  若执行机全局 pnpm 是另一个 major（常见：机器装 pnpm 10，归档是 pnpm 11
@@ -113,3 +138,44 @@ export declare function hostFilesChanged(before: FileIdentity[], after: FileIden
  * `minimumReleaseAgeExclude` itself (2026-08-18, reproduced in-process).
  */
 export declare function updatePlugin(packageName: string, version: string, profileDir: string): Promise<PnpmResult>;
+/** 插件来源判定：依据依赖声明形态 + profile 目录（复用前置设计 §4.2 算法）。
+ *  vendor 定制是 SSiD 生态核心（open-sea-skin/genui/panels 均本地魔改），
+ *  机械更新会把 file: 覆盖回 npm —— 来源标记给 LLM 决策「保持 vendor」。 */
+export type PluginSource = 'official' | 'npm' | 'vendor' | 'tarball' | 'local-file';
+export declare function sourceOf(specifier: string, profileDir: string): PluginSource;
+/** 读 profile dependencies 里该插件的声明形态（npm 纯净 / file: vendor / link: 等）。 */
+export declare function dependencySpecifierOf(profileDir: string, name: string): string | null;
+/** LLM 更新信息包:在 UpdateDigest 基础上补充来源/定制标记,驱动 Agent 决策。 */
+export interface LlmUpdatePackage {
+    name: string;
+    /** 当前本地版本(实体 package.json)。 */
+    fromVersion: string;
+    /** npm latest(可 null=未发布/不可达,LLM 走 GitHub commit 路径)。 */
+    toVersion: string | null;
+    /** GitHub commit changelog(更新前后差异,截前 10 条)。 */
+    changelog: string[];
+    /** DSH 兼容性(peer 检查)。 */
+    compat: 'compatible' | 'incompatible' | 'unknown';
+    /** peer 声明的 DSH 版本范围。 */
+    compatRange: string | null;
+    /** 来源判定。 */
+    source: PluginSource;
+    /** 依赖声明形态(file:/github:等等),机械更新可能覆盖定制的线索。 */
+    specifier: string | null;
+    /** 是否本地定制(vendor/tarball/local-file)。 */
+    isVendorModified: boolean;
+    /** 插件所在 profile 目录(host 运行时锚点;LLM 只允许在此目录内操作)。
+     *  内部技术字段——不直接展示给用户,由 runtimeLabel 承担语义化表达。 */
+    profileDir: string;
+    /** 同名异源警告:npm 同名包与本地上游不是同一项目(repository 不一致)。
+     *  真机案例: dsh-session-manager(dream12347 定制)vs npm 0.4.1(独立项目)。 */
+    upstreamMismatch: boolean;
+    /** 用户可读的环境标签(小白视角):'SSID'(思灵应用内)/'DSH-WEB'。 */
+    runtimeLabel: string;
+    /** 已组装的 Agent prompt(host 单一来源,client 直接注入会话)。 */
+    prompt: string;
+}
+/** 采集一个插件用于 LLM 更新的完整信息包。 */
+export declare function buildLlmPackage(name: string, localVersion: string, repoUrl: string | null, compatRange: string | null, localDshVersion: string, sinceIso: string, profileDir: string): Promise<LlmUpdatePackage>;
+/** 组装发给 LLM 会话的 prompt(角色设定 + 信息包 + 规则引用)。 */
+export declare function buildLlmPrompt(pkg: LlmUpdatePackage): string;