@noob-stupid/dsh-plugin-console 0.3.24-beta.2 → 0.3.25

package/lib/index.js

@@ -200,6 +200,123 @@ function entryPkgMeta(moduleName, baseUrl) {
   return meta
 }
 
+/** 最小 semver：解析（含 prerelease/build）。 */
+function parseSemverText(v) {
+  const m = String(v ?? '').trim().replace(/^v/u, '').match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/u)
+  if (!m) return null
+  return { major: Number(m[1]), minor: Number(m[2]), patch: Number(m[3]), pre: m[4] ?? null }
+}
+function compareSemverText(a, b) {
+  if (a.major !== b.major) return a.major - b.major
+  if (a.minor !== b.minor) return a.minor - b.minor
+  if (a.patch !== b.patch) return a.patch - b.patch
+  if (a.pre === null && b.pre === null) return 0
+  if (a.pre === null) return 1
+  if (b.pre === null) return -1
+  const pa = a.pre.split('.')
+  const pb = b.pre.split('.')
+  const len = Math.max(pa.length, pb.length)
+  for (let i = 0; i < len; i += 1) {
+    const xa = pa[i]
+    const xb = pb[i]
+    if (xa === undefined) return -1
+    if (xb === undefined) return 1
+    const na = /^\d+$/u.test(xa)
+    const nb = /^\d+$/u.test(xb)
+    if (na && nb) { const d = Number(xa) - Number(xb); if (d !== 0) return d; continue }
+    if (na) return -1
+    if (nb) return 1
+    const d = xa < xb ? -1 : xa > xb ? 1 : 0
+    if (d !== 0) return d
+  }
+  return 0
+}
+/** 单段范围匹配（^ ~ >= <= > < = 精确；返回 true = 满足）。 */
+function semverCompareOne(v, raw) {
+  const rText = String(raw).trim()
+  const m = rText.match(/^(\^|~|>=|<=|>|<|=)?\s*v?(\d+)(?:\.(\d+))?(?:\.(\d+))?(?:-([0-9A-Za-z.-]+))?/u)
+  if (!m) return true
+  const op = m[1] ?? ''
+  const base = { major: Number(m[2]), minor: m[3] === undefined ? 0 : Number(m[3]), patch: m[4] === undefined ? 0 : Number(m[4]), pre: m[5] ?? null }
+  const hasMinor = m[3] !== undefined
+  const hasPatch = m[4] !== undefined
+  // npm 语义：prerelease 版本只与同 [major,minor,patch] 且范围带 prerelease 的声明匹配
+  const preAllowed = v.pre === null || (v.major === base.major && v.minor === base.minor && v.patch === base.patch && base.pre !== null)
+  switch (op) {
+    case '':
+    case '=':
+      return preAllowed && compareSemverText(v, base) === 0
+    case '<':
+      return preAllowed && compareSemverText(v, base) < 0
+    case '<=':
+      return preAllowed && compareSemverText(v, base) <= 0
+    case '>':
+      return preAllowed && compareSemverText(v, base) > 0
+    case '>=':
+      return preAllowed && compareSemverText(v, base) >= 0
+    case '~': {
+      if (!preAllowed) return false
+      if (!hasMinor) return v.major === base.major
+      if (!hasPatch) return v.major === base.major && v.minor === base.minor
+      return compareSemverText(v, base) >= 0 && !(v.major === base.major && v.minor > base.minor) && v.major === base.major
+    }
+    case '^': {
+      if (!preAllowed) return false
+      const upper = base.major === 0
+        ? (base.minor === 0 ? { major: 0, minor: 0, patch: base.patch + 1, pre: null } : { major: 0, minor: base.minor + 1, patch: 0, pre: null })
+        : { major: base.major + 1, minor: 0, patch: 0, pre: null }
+      return compareSemverText(v, base) >= 0 && compareSemverText(v, upper) < 0
+    }
+    default:
+      return true
+  }
+}
+/** 范围匹配：支持多个段以逗号/空白分隔（AND）与 `||`（OR）。 */
+function semverRangeMatch(versionText, rangeText) {
+  const v = parseSemverText(versionText)
+  if (!v) return false
+  const alternatives = String(rangeText ?? '').split(/\s*\|\|\s*/u).filter(Boolean)
+  if (alternatives.length === 0) return false
+  return alternatives.some((alt) => {
+    const parts = alt.split(/\s*[,\s]\s*/u).filter(Boolean)
+    return parts.length > 0 && parts.every((part) => semverCompareOne(v, part))
+  })
+}
+/**
+ * 宽松声明匹配（仅用于插件「显式声明兼容范围」）：prerelease 版本按同线发布版判定——
+ * 作者声明 `>=0.1.2` 即代表支持 0.1.2 线，框架运行在 0.1.2-rc.1 应判定兼容。
+ */
+function semverRangeMatchLoose(versionText, rangeText) {
+  if (semverRangeMatch(versionText, rangeText)) return true
+  const v = parseSemverText(versionText)
+  if (v === null || v.pre === null) return false
+  return semverRangeMatch(`${v.major}.${v.minor}.${v.patch}`, rangeText)
+}
+
+/**
+ * 插件-框架兼容校验（框架升级适配门）：
+ * 1) 显式兼容声明（dsh.engines.framework / dsh.compat.framework / engines.dsh）：以声明为准；
+ * 2) 否则扫描依赖/peerDeps 的 @deepseek-ai/*：任一范围明确不含框架版本 → fail；
+ * 3) 无声明且依赖全部满足 → unknown（新版变动不大；由调用方在「版本已变化」前提下降级为放行）。
+ * 返回 { decision: 'pass'|'fail'|'unknown', reason }。
+ */
+function checkPluginFrameworkCompat(pkg, frameworkVersion) {
+  const declared = pkg?.dsh?.engines?.framework ?? pkg?.dsh?.compat?.framework ?? pkg?.engines?.dsh ?? null
+  if (typeof declared === 'string' && declared !== '') {
+    return semverRangeMatchLoose(frameworkVersion, declared)
+      ? { decision: 'pass', reason: `声明兼容范围 ${declared} 满足框架 ${frameworkVersion}` }
+      : { decision: 'fail', reason: `声明兼容范围 ${declared} 不满足当前框架 ${frameworkVersion}` }
+  }
+  const deps = { ...(pkg?.dependencies ?? {}), ...(pkg?.peerDependencies ?? {}), ...(pkg?.optionalDependencies ?? {}) }
+  const hits = Object.entries(deps).filter(([name]) => /^@deepseek-ai\//u.test(name))
+  const failing = hits.filter(([, range]) => typeof range === 'string' && range !== '' && !semverRangeMatch(frameworkVersion, range))
+  if (failing.length > 0) {
+    return { decision: 'fail', reason: `依赖声明不满足：${failing.map(([n, r]) => `${n}@${r}`).join('、')}（当前框架 ${frameworkVersion}）` }
+  }
+  if (hits.length === 0) return { decision: 'unknown', reason: '未声明对 @deepseek-ai/* 的依赖，无法从声明判定（版本已更新时放行）' }
+  return { decision: 'unknown', reason: '依赖范围包含当前框架版本但未显式声明兼容（版本已更新时放行）' }
+}
+
 /** 读取用户额外 bundle（非官方模板）的补丁插入行 id 与包名，用于"额外插件"判定。 */
 async function readExtraBundleRows(profileDir) {
   const rows = new Set()
@@ -683,6 +800,18 @@ async function detectCompat(baseUrl) {
 
 const FRAMEWORK_STATE_FILE = () => join(dshHome(), 'plugin-console', 'framework-state.json')
 const FRAMEWORK_BACKUP_ROOT = () => join(dshHome(), 'plugin-console', 'framework-backups')
+const COMPAT_PENDING_FILE = () => join(dshHome(), 'plugin-console', 'compat-pending.json')
+
+/** 读取框架升级适配门清单（compat-pending.json）；损坏/缺失返回 null。 */
+function readCompatPending() {
+  try { return JSON.parse(readFileSync(COMPAT_PENDING_FILE(), 'utf8')) } catch { return null }
+}
+function writeCompatPending(payload) {
+  try {
+    mkdirSync(dirname(COMPAT_PENDING_FILE()), { recursive: true })
+    writeFileSync(COMPAT_PENDING_FILE(), JSON.stringify(payload, null, 2), 'utf8')
+  } catch {}
+}
 
 /** 定位 @deepseek-ai/dsh-app-boot（与 @deepseek-ai/dsh 同级）。 */
 function locateAppBootFile(baseUrl) {
@@ -1838,6 +1967,72 @@ const aiJobs = new Map()
 let aiJobSeq = 0
 /** 组件注册表（服务型组件：启动/停止/状态控制按钮的数据源）。 */
 const COMPONENTS_FILE = join(homedir(), '.dsh', 'plugin-console', 'components.json')
+/** AI 赋能任务持久化文件（DSH 重启不丢计划/结果；running 任务重启后标记中断）。 */
+const AI_JOBS_FILE = join(homedir(), '.dsh', 'plugin-console', 'ai-jobs.json')
+/** 仓库落地根目录（可配置，默认 ~/.dsh/repos）。 */
+let reposDirCache = null
+const REPO_LAND_CONF = join(homedir(), '.dsh', 'plugin-console', 'repo-land.json')
+function getReposDir() {
+  if (reposDirCache !== null) return reposDirCache
+  try {
+    if (existsSync(REPO_LAND_CONF)) {
+      const conf = JSON.parse(readFileSync(REPO_LAND_CONF, 'utf8'))
+      if (typeof conf.dir === 'string' && conf.dir.trim() !== '') {
+        reposDirCache = conf.dir.trim()
+        return reposDirCache
+      }
+    }
+  } catch {}
+  reposDirCache = join(homedir(), '.dsh', 'repos')
+  return reposDirCache
+}
+function setReposDir(dir) {
+  reposDirCache = String(dir ?? '').trim()
+  mkdirSync(dirname(REPO_LAND_CONF), { recursive: true })
+  writeFileSync(REPO_LAND_CONF, JSON.stringify({ dir: reposDirCache }, null, 2), 'utf8')
+  return reposDirCache
+}
+/** 已落地仓库列表：扫描 dir 下两级目录（owner/name 下含 .git）。 */
+function listLandedRepos() {
+  const dir = getReposDir()
+  const out = []
+  try {
+    if (!existsSync(dir)) return out
+    for (const owner of readdirSync(dir, { withFileTypes: true })) {
+      if (!owner.isDirectory() || owner.name.startsWith('.')) continue
+      const ownerDir = join(dir, owner.name)
+      for (const entry of readdirSync(ownerDir, { withFileTypes: true })) {
+        if (!entry.isDirectory() || entry.name.startsWith('.')) continue
+        const repoDir = join(ownerDir, entry.name)
+        if (existsSync(join(repoDir, '.git'))) {
+          out.push({ owner: owner.name, name: entry.name, repo: `${owner.name}/${entry.name}`, path: repoDir })
+        }
+      }
+    }
+  } catch {}
+  return out
+}
+function saveAiJobs() {
+  try {
+    mkdirSync(dirname(AI_JOBS_FILE), { recursive: true })
+    const arr = [...aiJobs.values()].map((j) => ({ id: j.id, source: j.source, status: j.status, stage: j.stage, plan: j.plan ?? null, logText: j.logText ?? '', stepStates: j.stepStates ?? [], progress: j.progress ?? null, error: j.error ?? null, createdAt: j.createdAt, finishedAt: j.finishedAt ?? null }))
+    writeFileSync(AI_JOBS_FILE, JSON.stringify(arr, null, 2), 'utf8')
+  } catch {}
+}
+function loadAiJobs() {
+  try {
+    if (!existsSync(AI_JOBS_FILE)) return
+    const arr = JSON.parse(readFileSync(AI_JOBS_FILE, 'utf8'))
+    for (const j of arr) {
+      if (!j || typeof j.id !== 'string') continue
+      let job = j
+      if (job.status === 'running') {
+        job = { ...job, status: 'failed', error: 'DSH 重启，任务中断（可重新发起）', finishedAt: Date.now() }
+      }
+      aiJobs.set(job.id, job)
+    }
+  } catch {}
+}
 /** 静态插件索引内存缓存（/market-index 用）。 */
 let marketIndexCache = null
 
@@ -1859,6 +2054,7 @@ function installJobView(job) {
     source: job.source ?? 'github',
     curlNote: job.curlNote ?? null,
     bundleNote: job.bundleNote ?? null,
+    compatNote: job.compatNote ?? null,
     kind: job.kind ?? 'plugin',
     skillName: job.skillName ?? null,
     skillDir: job.skillDir ?? null,
@@ -2453,6 +2649,8 @@ function aiJobView(job) {
     logText: (job.logText ?? '').slice(-6000),
     createdAt: job.createdAt,
     finishedAt: job.finishedAt ?? null,
+    workspace: job.parentCwd ?? null,
+    frameworkCheck: job.frameworkCheck ?? null,
   }
 }
 
@@ -2588,6 +2786,7 @@ function isAllowedWritePath(p, profileDir) {
     norm(homedir()) + '/.openviking',
     norm(homedir()) + '/.cache/openviking',
     norm(homedir()) + '/.local/share/openviking',
+    norm(homedir()) + '/.dsh/repos',
     norm(profileDir),
     'D:/OpenVikingData',
   ]
@@ -2611,7 +2810,16 @@ function jobLog(job, line) {
 
 /** 已知组件内置模板：跳过 AI 调研，直接产出经过验证的部署计划（当前仅 OpenViking）。 */
 function builtinPlanFor(source) {
-  if (!/openviking/i.test(source)) return null
+  // 精确匹配 OpenViking 服务器本体（npm/pip 包名 openviking 或 volcengine/OpenViking 仓库），
+  // 防止宽泛子串匹配误命中 openclaw_openviking_skill 之类的第三方包（曾实际发生误判）。
+  const norm = String(source).trim().toLowerCase()
+    .replace(/^https?:\/\//u, '')
+    .replace(/^www\./u, '')
+    .replace(/^github\.com\//u, '')
+    .replace(/^raw\.githubusercontent\.com\//u, '')
+    .replace(/\.git$/u, '')
+    .replace(/\/$/u, '')
+  if (norm !== 'openviking' && norm !== 'volcengine/openviking') return null
   const home = homedir()
   const storage = /^[\x00-\x7F]+$/u.test(home) ? `${home}/.openviking/data` : 'D:/OpenVikingData'
   const vlm = resolveVlmForOpenViking()
@@ -2691,6 +2899,9 @@ async function aiEmpowerPlan(job, ctx, profileDir) {
     '你是 DSH 插件控制台挂载的「AI 赋能」部署规划器。用户想把下面的组件完整部署到本机。',
     `目标来源：${job.source}`,
     '',
+    '## 框架适配检测（控制台权威结果，规划时必须引用并向用户解释）',
+    frameworkCheckPromptText(job.frameworkCheck),
+    '',
     '【任务】只做只读调研与规划，禁止执行任何安装/写文件/启动服务/杀进程命令（curl 的 GET 抓取、gh api 查询、读取文件是允许的）。',
     '调研材料：npm README / GitHub README / docs/ 目录 / package.json / install 说明。',
     '全部调研完成后，输出且只输出一个 ```json ... ``` 代码块，内容为部署计划；代码块之外不要输出任何文字。',
@@ -2732,7 +2943,14 @@ async function aiEmpowerPlan(job, ctx, profileDir) {
     try {
       const agents = ctx.get('agents')
       const list = typeof agents?.roots === 'function' ? agents.roots() : (typeof agents?.list === 'function' ? agents.list() : [])
-      parent = list[0] ?? null
+      // 父代理选择：优先 cwd 与 DSH 服务工作区一致的会话（子代理 cwd 继承父会话），
+      // 避免多工作区/多会话时借到别的 workspace 的会话导致调研错位
+      const svcCwd = String(process.cwd() ?? '').replace(/[\\/]+$/u, '')
+      const cwdOf = (a) => {
+        try { return String(a?.session?.header?.cwd ?? a?.cwd ?? '').replace(/[\\/]+$/u, '') } catch { return '' }
+      }
+      parent = list.find((a) => cwdOf(a) !== '' && cwdOf(a) === svcCwd) ?? list[0] ?? null
+      job.parentCwd = parent ? cwdOf(parent) : null
     } catch {}
     if (parent === null) {
       job.status = 'failed'
@@ -2787,6 +3005,7 @@ async function aiEmpowerPlan(job, ctx, profileDir) {
     job.error = `AI 赋能规划异常：${error instanceof Error ? error.message : String(error)}`
   }
   job.finishedAt = Date.now()
+  saveAiJobs()
 }
 
 /** 从子代理输出中提取 ```json ... ``` 计划。 */
@@ -2846,6 +3065,7 @@ async function aiEmpowerExecute(job, ctx, profileDir, selected) {
   job.progress = { done, total: chosenList.length }
   job.finishedAt = Date.now()
   jobLog(job, job.status === 'done' ? '🎉 AI 赋能部署完成' : '⛔ AI 赋能部署中止')
+  saveAiJobs()
 }
 
 /** 单步执行器：动作白名单 + 路径白名单 + 破坏性命令拦截。 */
@@ -3032,7 +3252,23 @@ async function compStatus(id) {
     }
   }
   const running = Boolean(record.pid && processAlive(record.pid)) || healthy === true
-  return { id, name: record.name, running, healthy, pid: record.pid ?? null, port: record.port ?? null }
+  return { id, name: record.name, running, healthy, pid: record.pid ?? null, port: record.port ?? null, autoStart: record.autoStart === true }
+}
+
+/** DSH 启动时自动拉起标记 autoStart 的组件（幂等：已健康/已运行则跳过）。 */
+async function autostartComponents() {
+  for (const c of findComponents()) {
+    if (c.autoStart !== true) continue
+    if (c.healthUrl) {
+      try {
+        const res = await fetch(c.healthUrl, { signal: AbortSignal.timeout(2500) })
+        if (res.ok) continue
+      } catch {}
+    } else if (c.pid && processAlive(c.pid)) {
+      continue
+    }
+    try { await compStart(c.id) } catch {}
+  }
 }
 
 function processAlive(pid) {
@@ -3072,6 +3308,188 @@ async function syncAggregateSubpackageVersions(profileDir, packageName, registri
   return updated
 }
 
+/** 当前运行框架版本（@deepseek-ai/dsh package.json）。 */
+function currentFrameworkVersion(ctx) {
+  try {
+    const require = createRequire(ctx?.baseUrl ?? 'file:///')
+    const pkgPath = require.resolve('@deepseek-ai/dsh/package.json')
+    const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
+    return typeof pkg.version === 'string' ? pkg.version : null
+  } catch {
+    return null
+  }
+}
+
+/** 定位框架安装根（顶层 node_modules）：优先运行进程入口，其次从包目录上溯找含 .pnpm 的 node_modules。 */
+function resolveFrameworkRootNodeModules(fromDir) {
+  try {
+    const entry = process.argv[1]
+    if (typeof entry === 'string' && /bin\.js$/u.test(entry)) {
+      const nm = dirname(dirname(entry))
+      if (existsSync(join(nm, '.pnpm')) && existsSync(join(nm, '@deepseek-ai'))) return nm
+    }
+  } catch {}
+  let dir = typeof fromDir === 'string' && fromDir !== '' ? fromDir : null
+  for (let i = 0; i < 24 && dir !== null; i += 1) {
+    if (basename(dir) === 'node_modules' && existsSync(join(dir, '.pnpm'))) return dir
+    const parent = dirname(dir)
+    if (parent === dir) break
+    dir = parent
+  }
+  return null
+}
+
+/**
+ * 框架全树 checkpoint（可靠回滚点）：镜像 .pnpm 中所有 @deepseek-ai 条目「自包」内容 +
+ * 顶层 @deepseek-ai scope + lock.yaml。只镜像自包、不跟随依赖 junction，避免重复拷贝；
+ * 恢复时按同路径写回 .pnpm 条目即可让整个依赖世界回到升级前。
+ */
+function checkpointFrameworkTree(fwRoot, destRoot) {
+  const pnpmRoot = join(fwRoot, '.pnpm')
+  const dest = join(destRoot, 'fw-tree', String(Date.now()))
+  mkdirSync(dest, { recursive: true })
+  let mirrored = 0
+  const selfNameOf = (entryName) => entryName.slice('@deepseek-ai+'.length).split('@')[0]
+  for (const entry of readdirSync(pnpmRoot, { withFileTypes: true })) {
+    if (!entry.isDirectory() || !entry.name.startsWith('@deepseek-ai+')) continue
+    const name = selfNameOf(entry.name)
+    const selfDir = join(pnpmRoot, entry.name, 'node_modules', '@deepseek-ai', name)
+    if (!existsSync(join(selfDir, 'package.json'))) continue
+    copyTree(selfDir, join(dest, '.pnpm', entry.name, 'node_modules', '@deepseek-ai', name))
+    mirrored += 1
+  }
+  const topScope = join(fwRoot, '@deepseek-ai')
+  if (existsSync(topScope)) copyTree(topScope, join(dest, 'top-@deepseek-ai'))
+  try { copyFileSync(join(pnpmRoot, 'lock.yaml'), join(dest, 'lock.yaml')) } catch {}
+  try { copyFileSync(join(fwRoot, 'package.json'), join(dest, 'fw-package.json')) } catch {}
+  return { dest, mirrored }
+}
+
+/** 移除补丁中的单行 disabled/forced 覆盖块（兼容门解锁用）。 */
+function removeDisableBlock(patchPath, rowId) {
+  return queuedWrite(async () => {
+    const { text } = await readPatchState(patchPath)
+    const overrideRe = new RegExp(`^- id: ${escapeRegExp(rowId)}\\s*\\r?\\n {2}disabled: (true|false)\\s*\\r?\\n`, 'mu')
+    const next = text.replace(overrideRe, '')
+    if (next !== text) await writeFile(patchPath, sanitizePatchText(next), 'utf8')
+  })
+}
+
+/** 从「子包版本对齐」记录解析纯包名（如 '@linxin666/dsh-pet@0.2.1（新装）'）。 */
+function syncNameFromNote(note) {
+  const m = String(note ?? '').match(/^((?:@[^/]+\/)?[^@]+)/u)
+  return m ? m[1] : null
+}
+
+/**
+ * 框架升级适配门：安装/更新完成后自动校验兼容性，
+ * 通过（版本已变化 + 未在声明/依赖层面明确不兼容）则移除补丁禁用块并解锁启用。
+ */
+async function maybeAutoAdaptCompat({ profileDir, packageName, syncedNames, patchPath, ctx }) {
+  const pending = readCompatPending()
+  if (!pending || !Array.isArray(pending.pending)) return { ran: false }
+  const interested = new Set([packageName, ...(syncedNames ?? [])].filter((n) => n !== null))
+  const targets = pending.pending.filter((p) => (p.status ?? 'pending') === 'pending' && interested.has(p.moduleName))
+  if (targets.length === 0) return { ran: false }
+  const fwVer = typeof pending.frameworkVersion === 'string' ? pending.frameworkVersion : '?'
+  const adopted = []
+  const kept = []
+  for (const p of targets) {
+    let pkg = null
+    try {
+      const require = createRequire(join(profileDir, 'package.json'))
+      const pkgPath = require.resolve(`${p.moduleName}/package.json`)
+      pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
+    } catch {}
+    const version = typeof pkg?.version === 'string' ? pkg.version : null
+    const changed = version !== null && version !== p.version
+    const check = pkg !== null ? checkPluginFrameworkCompat(pkg, fwVer) : { decision: 'unknown', reason: '无法读取包信息' }
+    if (changed && check.decision !== 'fail') {
+      try { await removeDisableBlock(patchPath, p.rowId) } catch {}
+      p.status = 'adopted'
+      p.adoptedAt = Date.now()
+      p.adoptedVersion = version
+      p.adoptedFramework = fwVer
+      p.check = check.decision
+      p.checkNote = check.reason ?? null
+      adopted.push({ rowId: p.rowId, moduleName: p.moduleName, version, check: check.decision })
+    } else {
+      kept.push({ rowId: p.rowId, moduleName: p.moduleName, reason: !changed ? '版本未变化（无更新可适配）' : (check.reason ?? '兼容校验未通过') })
+    }
+  }
+  if (adopted.length > 0 || kept.length > 0) writeCompatPending(pending)
+  const note = adopted.length > 0
+    ? `兼容适配：已解锁 ${adopted.length} 行（${adopted.map((a) => a.rowId).join('、')}）`
+      + (kept.length > 0 ? `；仍待适配 ${kept.length} 行（${kept.map((k) => `${k.rowId} ${k.reason}`).join('、')}）` : '')
+    : `兼容适配：暂未解锁（${kept.map((k) => `${k.rowId} ${k.reason}`).join('、')}）`
+  return { ran: true, adopted, kept, note }
+}
+
+/** AI 赋能框架适配预检：查 registry 最新版声明 + 兼容门清单，给出权威说明。 */
+async function frameworkCompatReportFor(source, ctx, profileDir) {
+  const fwVer = currentFrameworkVersion(ctx)
+  const pending = readCompatPending()
+  const norm = String(source ?? '').trim()
+  const isNpm = norm.startsWith('@') || !norm.includes('/')
+  const installed = (() => {
+    try {
+      const require = createRequire(join(profileDir, 'package.json'))
+      const pkgPath = require.resolve(`${norm}/package.json`)
+      return JSON.parse(readFileSync(pkgPath, 'utf8')).version ?? null
+    } catch { return null }
+  })()
+  const pendHits = (pending?.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending' && p.moduleName === norm)
+  if (!isNpm) {
+    return {
+      kind: 'repo', frameworkVersion: fwVer, packageName: null, latest: null, check: null,
+      pending: pendHits, installedVersion: null,
+      summary: pendHits.length > 0
+        ? `该来源命中兼容门清单（${pending.frameworkVersion}），GitHub 仓库无法在线预检——更新/部署完成后会由控制台自动校验解锁`
+        : `GitHub 仓库来源无法预检 npm 声明，部署后以实际运行为准（框架当前 ${fwVer ?? '未知'}）`,
+    }
+  }
+  const name = norm.startsWith('@')
+    ? '@' + norm.slice(1).split('@')[0]
+    : norm.split('@')[0]
+  let latest = null
+  let versionMeta = null
+  try {
+    const data = await fetchJsonUrl(`https://registry.npmmirror.com/${name.replace('/', '%2f')}`)
+    latest = data?.['dist-tags']?.latest ?? data?.['dist-tags']?.next ?? null
+    if (latest !== null) versionMeta = data?.versions?.[latest] ?? null
+  } catch (error) {
+    return {
+      kind: 'npm', frameworkVersion: fwVer, packageName: name, latest: null, check: null,
+      pending: pendHits, installedVersion: installed,
+      summary: `registry 预检失败（${error instanceof Error ? error.message : String(error)}）；本机已装 ${installed ?? '?'}${pendHits.length > 0 ? '，处于兼容门禁用中' : ''}`,
+    }
+  }
+  const check = versionMeta !== null ? checkPluginFrameworkCompat(versionMeta, fwVer) : null
+  const parts = []
+  if (pendHits.length > 0) parts.push(`已在兼容门清单（${pending.upgradeFrom ?? '?'} → ${pending.frameworkVersion}）中强制禁用，当前已装 ${installed ?? pendHits[0]?.version ?? '?'}`)
+  if (latest !== null) {
+    if (check?.decision === 'fail') parts.push(`最新版 ${latest} 不满足框架 ${fwVer}（${check.reason}）——请勿启用，等待适配版本`)
+    else if (check?.decision === 'pass') parts.push(`最新版 ${latest} 声明兼容框架 ${fwVer}，可放心启用`)
+    else parts.push(`最新版 ${latest} 未声明框架兼容（${check?.reason ?? '无声明'}），建议更新后启用并观察`)
+  }
+  return {
+    kind: 'npm', frameworkVersion: fwVer, packageName: name, latest, check, pending: pendHits, installedVersion: installed,
+    summary: parts.length > 0 ? parts.join('；') : `框架 ${fwVer}，无待适配记录`,
+  }
+}
+
+/** 把框架适配检测结果格式化为给子代理的提示段。 */
+function frameworkCheckPromptText(fc) {
+  if (fc === null || fc === undefined) return '（不可用）'
+  return [
+    `- 当前框架版本：${fc.frameworkVersion ?? '未知'}`,
+    `- ${fc.kind === 'npm' ? `npm 包 ${fc.packageName ?? '?'}` : '来源类型'}：registry 最新 ${fc.latest ?? '未知'}${fc.installedVersion ? `；本机已装 ${fc.installedVersion}` : ''}`,
+    fc.pending && fc.pending.length > 0 ? `- ⚠ 已命中兼容门：${fc.pending.map((p) => p.rowId).join('、')} 处于强制禁用（版本 ${fc.pending[0]?.version ?? '?'}），升级后仅更新并通过校验才解锁` : null,
+    fc.check ? `- 声明/依赖校验：${fc.check.decision === 'fail' ? '不兼容' : fc.check.decision === 'pass' ? '兼容' : '未知'}（${fc.check.reason}）` : null,
+    '- 计划总结必须向用户说明上述适配结论；若校验为 fail，不要建议启用，应建议「更新到最新版后再启用」。',
+  ].filter((s) => s !== null).join('\n')
+}
+
 async function runInstallJob(job, ctx) {
   try {
     job.stage = 'preparing'
@@ -3302,9 +3720,11 @@ async function runInstallJob(job, ctx) {
     }
     job.packageName = installedName
     // 聚合包子包版本对齐（确保更新后所有子包也到新版声明版本）
+    let syncedNames = []
     try {
       const synced = await syncAggregateSubpackageVersions(profileDir, installedName, registries)
       if (synced.length > 0) {
+        syncedNames = synced.map(syncNameFromNote).filter((n) => n !== null)
         job.bundleNote = (job.bundleNote ? job.bundleNote + '；' : '') + `子包版本对齐：更新 ${synced.length} 个（${synced.join('、')}）`
       }
     } catch {}
@@ -3318,6 +3738,11 @@ async function runInstallJob(job, ctx) {
           + (integrity.missing.length > 0 ? `，仍缺失 ${integrity.missing.join('、')}（网络恢复后建议重新更新）` : '')
       }
     } catch {}
+    // 框架升级适配门：更新完成后自动校验兼容性，通过则移除禁用块解锁启用
+    try {
+      const adapt = await maybeAutoAdaptCompat({ profileDir, packageName: installedName, syncedNames, patchPath, ctx })
+      if (adapt !== null && adapt.ran === true) job.compatNote = adapt.note
+    } catch {}
     job.stage = 'configuring'
     if (await detectBundleOnly(profileDir, installedName)) {
       // 官方 dsh plugin add 行为：声明 dsh.bundle 的包追加为 profile bundle 层，
@@ -3364,6 +3789,10 @@ function listEntries(ctx) {  const entries = []
 
 /** 应用插件：注册 /plugin-console 路由。 */
 export function apply(ctx) {
+  // 恢复 AI 赋能任务（restart 后 running 置失败，plan-ready/结果保留）
+  loadAiJobs()
+  // DSH 启动时自动拉起标记了「自启动」的服务器组件（幂等，不阻塞启动）
+  autostartComponents().catch(() => {})
   ctx.effect(() => {
     const route = {
       kind: 'prefix',
@@ -3405,6 +3834,15 @@ async function handle(ctx, req, res) {
     const patchPath = findPatchPath(ctx)
     const patch = await readPatchState(patchPath)
     const extraRows = await readExtraBundleRows(dirname(patchPath))
+    const compatPending = readCompatPending()
+    const compatPendingRows = new Set((compatPending?.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => p.rowId))
+    let rollbackRec = null
+    try {
+      const rr = JSON.parse(readFileSync(join(dshHome(), 'plugin-console', 'framework-rollback.json'), 'utf8'))
+      if (rr !== null && typeof rr.checkpointDir === 'string' && existsSync(join(rr.checkpointDir, '.pnpm'))) {
+        rollbackRec = { from: rr.from ?? null, to: rr.to ?? null, at: rr.at ?? null }
+      }
+    } catch {}
     const entries = listEntries(ctx).map((entry) => {
       const meta = entryPkgMeta(entry.moduleName, ctx.baseUrl ?? 'file:///')
       return {
@@ -3415,6 +3853,7 @@ async function handle(ctx, req, res) {
         installDate: meta?.installDate ?? null,
         version: meta?.version ?? null,
         repository: meta?.repository ?? null,
+        pendingCompat: compatPendingRows.has(entry.rowId),
       }
     })
     const compat = await detectCompat(ctx.baseUrl ?? 'file:///')
@@ -3429,7 +3868,7 @@ async function handle(ctx, req, res) {
       const selfPkg = JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json'), 'utf8'))
       selfVersion = typeof selfPkg.version === 'string' ? selfPkg.version : null
     } catch {}
-    sendJson(res, 200, { ok: true, entries, patchPath, compat, installJobs: jobs, recentFailures, github: { loggedIn: auth.loggedIn, login: auth.login }, patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts }, framework, selfVersion, components: findComponents().map((c) => ({ id: c.id, name: c.name, kind: c.kind ?? 'server', pid: c.pid ?? null, port: c.port ?? null, healthUrl: c.healthUrl ?? null, uiUrl: compUiUrl(c) })) })
+    sendJson(res, 200, { ok: true, entries, patchPath, compat, installJobs: jobs, recentFailures, github: { loggedIn: auth.loggedIn, login: auth.login }, patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts }, framework, compatPending: compatPending === null ? null : { frameworkVersion: compatPending.frameworkVersion ?? null, upgradeFrom: compatPending.upgradeFrom ?? null, pending: (compatPending.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => ({ rowId: p.rowId, moduleName: p.moduleName, version: p.version ?? null })) }, rollback: rollbackRec, selfVersion, components: findComponents().map((c) => ({ id: c.id, name: c.name, kind: c.kind ?? 'server', pid: c.pid ?? null, port: c.port ?? null, healthUrl: c.healthUrl ?? null, uiUrl: compUiUrl(c), autoStart: c.autoStart === true })) })
     return
   }
 
@@ -3626,6 +4065,15 @@ async function handle(ctx, req, res) {
       sendError(res, 400, '不能停用插件控制台自身')
       return
     }
+    if (enabled) {
+      // 框架升级适配门（事故教训）：兼容门清单内的行保持强制禁用，直到更新并通过校验
+      const compatPending = readCompatPending()
+      const pend = (compatPending?.pending ?? []).find((p) => p.rowId === rowId && (p.status ?? 'pending') === 'pending')
+      if (pend) {
+        sendError(res, 409, `「${rowId}」仍在框架升级适配门中（${compatPending.frameworkVersion ?? '?'}）被强制禁用：请先点击「更新并适配」，更新完成并通过兼容校验后系统自动解锁`)
+        return
+      }
+    }
     const patchPath = findPatchPath(ctx)
     const result = enabled
       ? await enableEntry(patchPath, rowId)
@@ -3692,6 +4140,7 @@ async function handle(ctx, req, res) {
     const query = raw === '' ? DEFAULT_SEARCH : raw
     const page = Math.max(Math.min(Number.parseInt(String(body.page), 10) || 1, 5), 1)
     const source = typeof body.source === 'string' && body.source !== '' ? body.source : 'github'
+    const all = body.all === true
     const auth = readGithubAuth()
     let items = []
     if (body.multi === true) {
@@ -3702,7 +4151,7 @@ async function handle(ctx, req, res) {
         (async () => {
           try {
             const data = await githubJson(
-              `${GITHUB_API}/search/repositories?q=${encodeURIComponent(query)}&sort=stars&order=desc&per_page=20&page=${page}`,
+              `${GITHUB_API}/search/repositories?q=${encodeURIComponent(all ? query : `${query} topic:dsh-plugin`)}&sort=stars&order=desc&per_page=20&page=${page}`,
               req.signal,
               auth.token,
             )
@@ -3801,7 +4250,7 @@ async function handle(ctx, req, res) {
       items = normalizePlatformItems(data, 'main').map((item) => ({ ...item, source, sourceName: custom.name }))
     } else {
       const data = await githubJson(
-        `${GITHUB_API}/search/repositories?q=${encodeURIComponent(query)}&sort=stars&order=desc&per_page=20&page=${page}`,
+        `${GITHUB_API}/search/repositories?q=${encodeURIComponent(all ? query : `${query} topic:dsh-plugin`)}&sort=stars&order=desc&per_page=20&page=${page}`,
         req.signal,
         auth.token,
       )
@@ -4308,6 +4757,27 @@ async function handle(ctx, req, res) {
         sendError(res, 500, `框架备份失败（回滚点${rollbackDir !== null ? `：${rollbackDir}` : '（无）'}缺失或无效），已取消升级——请检查磁盘空间/权限后重试`)
         return
       }
+      // 框架安装根识别（事故教训 2026-09-04）：require.resolve 返回 .pnpm 内部 realpath，
+      // 旧逻辑 dirname(dirname(dshDir)) 指向 .pnpm/<entry>/node_modules——「重链跳过：.pnpm 目录不存在」、
+      // 依赖修复 0 个，pnpm 还在错误 cwd 里把新 CLI 原位覆盖进旧 .pnpm 目录，旧树就此被毁。
+      const fwRoot = resolveFrameworkRootNodeModules(dshDir)
+      if (fwRoot === null || !existsSync(join(fwRoot, '.pnpm')) || !existsSync(join(fwRoot, '@deepseek-ai', 'dsh', 'lib', 'bin.js'))) {
+        sendError(res, 500, `无法定位框架安装根（期望含 .pnpm 与 @deepseek-ai/dsh 的顶层 node_modules，实际：${fwRoot ?? '未找到'}）——已取消升级，请修复框架安装后重试`)
+        return
+      }
+      // 框架全树 checkpoint（可靠回滚点）：升级前镜像全部 @deepseek-ai 版本包（自包内容）+ 顶层 scope + lock
+      let fwCheckpoint = null
+      try {
+        const cpRoot = backupDir !== null ? backupDir : join(FRAMEWORK_BACKUP_ROOT(), current ?? 'unknown')
+        fwCheckpoint = checkpointFrameworkTree(fwRoot, cpRoot)
+        steps.push(`框架全树 checkpoint 完成：${fwCheckpoint.dest}（镜像 ${fwCheckpoint.mirrored} 个 @deepseek-ai 版本包；升级失败/拉起失败会自动全树回滚，也可用框架卡片的「回滚到上一版」一键回滚）`)
+      } catch (error) {
+        steps.push(`框架全树 checkpoint 失败：${error instanceof Error ? error.message : String(error)}（回滚点降级为 CLI 备份）`)
+      }
+      // 一键回滚记录：框架卡片「回滚到上一版」按钮读取
+      try {
+        writeFileSync(join(dshHome(), 'plugin-console', 'framework-rollback.json'), JSON.stringify({ from: current, to: target, checkpointDir: fwCheckpoint?.dest ?? null, cliBackupDir: rollbackDir, fwRoot, at: Date.now() }, null, 2), 'utf8')
+      } catch {}
       const ps1 = join(tmpdir(), `fw-upgrade-${process.pid}.ps1`)
       const logFile = join(dshHome(), 'plugin-console', 'fw-upgrade.log')
       const stateFile = join(dshHome(), 'plugin-console', 'fw-upgrade-state.txt')
@@ -4337,7 +4807,7 @@ async function handle(ctx, req, res) {
         `Log '升级框架本体 ${current} -> ${target}…'`,
         // 关键：npm 的工作目录必须是缓存 node_modules（schtasks 默认 cwd 是 system32/用户目录，
         // 不指定会装错位置——缓存永远不更新的根因）
-        `Set-Location -Path ${ps(dirname(dshDir))}`,
+        `Set-Location -Path ${ps(fwRoot)}`,
         // npm 安装函数：Start-Process 跑 npm-cli.js（唯一正确入口——lib/cli.js 是函数模块，
         // 直跑只加载不执行，假成功 exit 0）+ --force（显式指定版本但已在 package.json 的
         // semver 范围内时 npm 会跳过安装，假成功）+ 15 分钟总时长硬超时。注意：**不能加
@@ -4400,17 +4870,36 @@ async function handle(ctx, req, res) {
         `  }`,
         `  return $code`,
         `}`,
-        // 回滚函数：robocopy 支持长路径（Copy-Item 对 >260 字符路径静默失败，曾导致回滚后
-        // 框架目录缺失、服务无法重启）；回滚前确保服务已停（进程 cwd 会锁住框架目录）
+        // 回滚函数（2026-09-04 事故后升级为「全树优先」）：robocopy 支持长路径（Copy-Item 对 >260
+        // 字符路径静默失败，曾导致回滚后框架目录缺失、服务无法重启）；回滚前确保服务已停
+        // （进程 cwd 会锁住框架目录）。checkpoint 存在 → 恢复全部 @deepseek-ai 版本包 + 顶层 scope；
+        // checkpoint 缺失 → CLI 兜底。
         `function Invoke-Rollback {`,
-        `  SetState 'rollback' '升级失败，回滚框架本体…'`,
-        `  Log '升级失败，回滚框架本体…'`,
-        `  # 备份缺失时绝不删除现有框架目录（曾因先删后拷失败导致框架目录为空、服务无法重启）`,
-        `  if (-not (Test-Path ${ps(join(rollbackDir, 'lib', 'bin.js'))})) { Log ('回滚失败：备份缺失（' + ${ps(rollbackDir)} + '），跳过删除框架目录'); return }`,
-        `  try { $svc = Get-NetTCPConnection -LocalPort ${port} -State Listen -ErrorAction SilentlyContinue; if ($svc) { $svc | ForEach-Object { Stop-Process -Id $_.OwningProcess -Force -ErrorAction SilentlyContinue }; Start-Sleep -Seconds 2 } } catch {}`,
+        `  SetState 'rollback' '升级失败，回滚框架（全树/CLI 备份）…'`,
+        `  Log '升级失败，回滚框架…'`,
+        `  try { $svc = Get-NetTCPConnection -LocalPort ${port} -State Listen -ErrorAction SilentlyContinue; if ($svc) { $svc | ForEach-Object { Stop-Process -Id $_.OwningProcess -Force -ErrorAction SilentlyContinue }; Start-Sleep -Seconds 3 } } catch {}`,
+        `  $cp = '${ps(fwCheckpoint?.dest ?? '')}'`,
+        `  if ($cp -ne '' -and (Test-Path (Join-Path $cp '.pnpm'))) {`,
+        `    $restored = 0`,
+        `    $entries = Get-ChildItem -Path (Join-Path $cp '.pnpm') -Directory -ErrorAction SilentlyContinue`,
+        `    foreach ($e in $entries) {`,
+        `      $name = @($e.Name -split '\\+')[1].Split('@')[0]`,
+        `      $src = Join-Path $e.FullName ('node_modules\\@deepseek-ai\\' + $name)`,
+        `      $dst = Join-Path (Join-Path '${ps(fwRoot)}' ('.pnpm\\' + $e.Name)) ('node_modules\\@deepseek-ai\\' + $name)`,
+        `      if (Test-Path (Join-Path $src 'package.json')) { New-Item -ItemType Directory -Path (Split-Path $dst -Parent) -Force | Out-Null; robocopy $src $dst /E /NFL /NDL /NJH /NJS /R:1 /W:1 | Out-Null; $restored++ }`,
+        `    }`,
+        `    $topSrc = Join-Path $cp 'top-@deepseek-ai'`,
+        `    if (Test-Path $topSrc) { Remove-Item '${ps(join(fwRoot, '@deepseek-ai'))}' -Recurse -Force -ErrorAction SilentlyContinue; robocopy $topSrc '${ps(join(fwRoot, '@deepseek-ai'))}' /E /NFL /NDL /NJH /NJS /R:1 /W:1 | Out-Null }`,
+        `    try { Copy-Item (Join-Path $cp 'lock.yaml') '${ps(join(fwRoot, '.pnpm', 'lock.yaml'))}' -Force -ErrorAction SilentlyContinue } catch {}`,
+        `    Log ('全树回滚完成：恢复 ' + $restored + ' 个版本包 + 顶层 scope')`,
+        `    $script:rolledBack = $true`,
+        `    return`,
+        `  }`,
+        `  # CLI 兜底（checkpoint 缺失或损坏）`,
+        `  if (-not (Test-Path ${ps(join(rollbackDir, 'lib', 'bin.js'))})) { Log ('回滚失败：CLI 备份也缺失（' + ${ps(rollbackDir)} + '）'); return }`,
         `  Remove-Item ${ps(dshDir)} -Recurse -Force -ErrorAction SilentlyContinue`,
         `  robocopy ${ps(rollbackDir)} ${ps(dshDir)} /E /NFL /NDL /NJH /NJS /R:1 /W:1 | Out-Null`,
-        `  if (Test-Path ${ps(join(dshDir, 'lib', 'bin.js'))}) { Log '回滚完成（框架目录已恢复）'; $script:rolledBack = $true } else { Log '回滚失败：复制失败，请手动修复框架安装' }`,
+        `  if (Test-Path ${ps(join(dshDir, 'lib', 'bin.js'))}) { Log '回滚完成（CLI 恢复）'; $script:rolledBack = $true } else { Log '回滚失败：复制失败，请手动修复框架安装' }`,
         `}`,
         `$script:rolledBack = $false`,
         `$code = Install-Framework 'https://registry.npmmirror.com'`,
@@ -4424,6 +4913,8 @@ async function handle(ctx, req, res) {
         `  if ($code -ne 0) { Log ('（停服后）npmmirror 安装失败（exit=' + $code + '），切换 registry.npmjs.org 重试一次'); $code = Install-Framework 'https://registry.npmjs.org' }`,
         `}`,
         `if ($code -ne 0) { Invoke-Rollback } else { Log '框架本体升级完成' }`,
+        // 回滚后跳过重链/依赖修复/版本对齐（它们按新树预期运行，会对已恢复的旧树造成二次破坏）
+        `if (-not $script:rolledBack) {`,
         // 重新链接框架配套包（事故教训）：pnpm 升级到新版本时 .pnpm 目录重建，
         // 但顶层 node_modules/@deepseek-ai/* 不会自动切换，仍指向旧版（如 0.1.0-rc.7）——
         // 导致框架混版本（如 dsh-llm-deepseek 旧版无 vision 模型）、部分功能异常。
@@ -4432,7 +4923,7 @@ async function handle(ctx, req, res) {
         `$relinked = 0`,
         `function Relink-FrameworkPackages($version) {`,
         `  # dshDir = .../node_modules/@deepseek-ai/dsh → nodeModules = .../node_modules`,
-        `  $nodeModules = ${ps(dirname(dirname(dshDir)))}`,
+        `  $nodeModules = ${ps(fwRoot)}`,
         `  $pnpm = Join-Path $nodeModules '.pnpm'`,
         `  if (-not (Test-Path $pnpm)) { Log ('重链跳过：.pnpm 目录不存在'); return }`,
         `  $topPkgs = Get-ChildItem -Path (Join-Path $nodeModules '@deepseek-ai') -Directory | Where-Object { $_.Name -like 'dsh-*' }`,
@@ -4470,7 +4961,7 @@ async function handle(ctx, req, res) {
         `      $bak = $top.FullName + '.bak-' + $topVer`,
         `      if (Test-Path $bak) { Remove-Item $bak -Recurse -Force -ErrorAction SilentlyContinue }`,
         `      Rename-Item -LiteralPath $top.FullName -NewName ($name + '.bak-' + $topVer) -Force`,
-        `      cmd /c mklink /J "${top.FullName}" "${best}" 2>$null | Out-Null`,
+        `      cmd /c mklink /J "$($top.FullName)" "$($best)" 2>$null | Out-Null`,
         `      if (Test-Path (Join-Path $top.FullName 'package.json')) { $script:relinked++; Log ('重链 ' + $name + ': ' + $topVer + ' -> ' + $bestVer) } else { Log ('重链失败：' + $name) }`,
         `    } catch { Log ('重链异常：' + $name + ' ' + $_.Exception.Message) }`,
         `  }`,
@@ -4484,7 +4975,7 @@ async function handle(ctx, req, res) {
         `$treeFixed = 0`,
         `function Verify-DependencyTree($refVersion) {`,
         `  # dshDir = .../node_modules/@deepseek-ai/dsh → nodeModules = .../node_modules`,
-        `  $nodeModules = ${ps(dirname(dirname(dshDir)))}`,
+        `  $nodeModules = ${ps(fwRoot)}`,
         `  $webApp = Join-Path $nodeModules '@deepseek-ai\\dsh-web-app\\package.json'`,
         `  if (-not (Test-Path $webApp)) { Log ('依赖树验证跳过：dsh-web-app 未找到'); return }`,
         `  try { $deps = (Get-Content $webApp -Raw | ConvertFrom-Json).dependencies } catch { Log ('依赖树验证跳过：读取失败'); return }`,
@@ -4552,6 +5043,7 @@ async function handle(ctx, req, res) {
         `}`,
         `Verify-SelfNameConsistency '${selfName ?? '@noob-stupid/dsh-plugin-console'}'`,
         pkgArgs.length > 0 ? `SetState 'pkg' '更新官方配套包…'\n  Log '更新官方配套包…'\n  Set-Location -Path ${ps(profileDir2)}\n  if (Test-Path ${ps(corepackJs)}) {\n    $pp = Start-Process -FilePath ${ps(nodePath)} -ArgumentList @(${ps(corepackJs)}, 'pnpm', 'update', ${pkgArgs.join(', ')}, '--no-optional', '--registry', 'https://registry.npmmirror.com') -PassThru -WindowStyle Hidden\n    if (-not $pp.WaitForExit(300000)) { Stop-Process -Id $pp.Id -Force -ErrorAction SilentlyContinue; Log '官方配套包更新超时（5 分钟），已跳过' } else { try { Log ('官方配套包更新结束（exit=' + $pp.ExitCode + '）') } catch { Log '官方配套包更新结束（退出码读取失败）' } }\n  }` : '',
+        "}",
         "SetState 'relaunching' '升级完成，重启 DSH 服务生效…'",
         "Log '重启 DSH 服务生效…'",
         // 升级全程服务保持在线（先下载后重启）：这里停掉旧服务（内存仍是旧代码），拉起新版本生效
@@ -4563,7 +5055,19 @@ async function handle(ctx, req, res) {
         `  if (-not $ok -and -not $started) { $binNow = ''; try { $env:DSH_RESOLVE_ROOT = '${join(dirname(fileURLToPath(import.meta.url)), '..')}'; $binNow = (& ${ps(nodePath)} -e "const path=require('path');const p=require.resolve('@deepseek-ai/dsh/package.json',{paths:[process.env.DSH_RESOLVE_ROOT]});console.log(path.join(path.dirname(p),'lib','bin.js'))" 2>$null | Select-Object -Last 1) } catch {}; if ($binNow -ne '' -and (Test-Path $binNow)) { Start-Process -FilePath ${ps(nodePath)} -ArgumentList $binNow,'web' -WindowStyle Hidden; $started = $true; Log '已发起拉起服务' } else { Log 'bin.js 缺失，跳过拉起' } }`,
         '  Start-Sleep -Seconds 5',
         '}',
-        `if ($ok) { if ($script:rolledBack) { SetState 'failed' '升级失败，已回滚到原版本（服务已恢复）' ; Log '升级失败已回滚，服务已恢复' } else { SetState 'done' '升级完成，服务已监听 ${port}' ; Log '服务已监听 ${port}，升级完成' } } else { SetState 'failed' '拉起失败：请手动运行 node ${binPath} web' ; Log '拉起失败：请手动运行 node ${binPath} web（参考本日志排查）' }`,
+        // 拉起失败不再只留提示（2026-09-04 教训）：自动全树回滚并再拉起一次
+        `if (-not $ok -and -not $script:rolledBack) {`,
+        `  Log '服务拉起失败，尝试自动回滚到升级前版本…'`,
+        `  Invoke-Rollback`,
+        `  $ok = $false`,
+        `  $started = $false`,
+        `  for ($i = 0; $i -lt 20; $i++) {`,
+        `    try { $c = Get-NetTCPConnection -LocalPort ${port} -State Listen -ErrorAction SilentlyContinue; if ($c.Count -gt 0) { $ok = $true; break } } catch {}`,
+        `    if (-not $ok -and -not $started) { $binNow = ''; try { $env:DSH_RESOLVE_ROOT = '${join(dirname(fileURLToPath(import.meta.url)), '..')}'; $binNow = (& ${ps(nodePath)} -e "const path=require('path');const p=require.resolve('@deepseek-ai/dsh/package.json',{paths:[process.env.DSH_RESOLVE_ROOT]});console.log(path.join(path.dirname(p),'lib','bin.js'))" 2>$null | Select-Object -Last 1) } catch {}; if ($binNow -ne '' -and (Test-Path $binNow)) { Start-Process -FilePath ${ps(nodePath)} -ArgumentList $binNow,'web' -WindowStyle Hidden; $started = $true; Log '已发起拉起服务（回滚后）' } else { Log 'bin.js 缺失，跳过拉起' } }`,
+        `    Start-Sleep -Seconds 5`,
+        `  }`,
+        `}`,
+        `if ($ok) { if ($script:rolledBack) { SetState 'failed' '升级失败，已自动回滚到升级前版本（服务已恢复）' ; Log '升级失败已自动回滚，服务已恢复' } else { SetState 'done' '升级完成，服务已监听 ${port}' ; Log '服务已监听 ${port}，升级完成' } } else { SetState 'failed' '拉起失败且自动回滚未生效：请手动运行 node ${binPath} web' ; Log '拉起失败且自动回滚未生效：请手动运行 node ${binPath} web（参考本日志排查）' }`,
         `schtasks /delete /f /tn ${taskName} 2>$null`,
       ].filter((l) => l !== '').join('\r\n')
       // 初始状态（备份完成、脚本即将执行）
@@ -4626,6 +5130,87 @@ async function handle(ctx, req, res) {
     return
   }
 
+  if (pathname === `${ROUTE_PREFIX}/framework-rollback`) {
+    // 一键回滚（2026-09-04 事故后的新能力）：读 framework-rollback.json（升级时写入），
+    // 生成分离脚本：停服 → 全树恢复（.pnpm 自包镜像 + 顶层 scope + lock）→ 拉起 → 状态。
+    let rec = null
+    try { rec = JSON.parse(readFileSync(join(dshHome(), 'plugin-console', 'framework-rollback.json'), 'utf8')) } catch {}
+    if (rec === null || typeof rec.checkpointDir !== 'string' || typeof rec.fwRoot !== 'string'
+      || !existsSync(join(rec.checkpointDir, '.pnpm')) || !existsSync(join(rec.fwRoot, '.pnpm'))) {
+      sendError(res, 409, '没有可用的框架全树回滚点（framework-rollback.json 缺失或 checkpoint 已清理）')
+      return
+    }
+    const port = webPort(ctx)
+    const nodePath = process.execPath
+    const taskName = `DSH-FW-Rollback-${process.pid}`
+    const ps1 = join(tmpdir(), `fw-rollback-${process.pid}.ps1`)
+    const logFile = join(dshHome(), 'plugin-console', 'fw-upgrade.log')
+    const stateFile = join(dshHome(), 'plugin-console', 'fw-upgrade-state.txt')
+    const ps = (s) => JSON.stringify(s).replace(/\\\\/gu, '\\')
+    const lines = [
+      `$state = ${ps(stateFile)}`,
+      `$log = ${ps(logFile)}`,
+      "function Log($m) { try { Add-Content -Path $log -Value ((Get-Date -Format 'yyyy-MM-dd HH:mm:ss') + ' ' + $m) -Encoding UTF8 } catch {} }",
+      "function SetState($s, $m) { try { Set-Content -Path $state -Value ($s + '|' + $m) -Encoding UTF8 } catch {} }",
+      "trap {",
+      "  try { SetState 'failed' ('回滚脚本异常终止：' + $_.Exception.Message) } catch {}",
+      `  schtasks /delete /f /tn ${taskName} 2>$null`,
+      "  exit 1",
+      "}",
+      "SetState 'rollback' '回滚到升级前版本…'",
+      "Log '一键回滚脚本启动'",
+      `try { $svc = Get-NetTCPConnection -LocalPort ${port} -State Listen -ErrorAction SilentlyContinue; if ($svc) { $svc | ForEach-Object { Stop-Process -Id $_.OwningProcess -Force -ErrorAction SilentlyContinue }; Start-Sleep -Seconds 3 } } catch {}`,
+      "Log '服务已停止（回滚生效）'",
+      `$cp = ${ps(rec.checkpointDir)}`,
+      `$restored = 0`,
+      `$entries = Get-ChildItem -Path (Join-Path $cp '.pnpm') -Directory -ErrorAction SilentlyContinue`,
+      `foreach ($e in $entries) {`,
+      `  $name = @($e.Name -split '\\+')[1].Split('@')[0]`,
+      `  $src = Join-Path $e.FullName ('node_modules\\@deepseek-ai\\' + $name)`,
+      `  $dst = Join-Path (Join-Path ${ps(rec.fwRoot)} ('.pnpm\\' + $e.Name)) ('node_modules\\@deepseek-ai\\' + $name)`,
+      `  if (Test-Path (Join-Path $src 'package.json')) { New-Item -ItemType Directory -Path (Split-Path $dst -Parent) -Force | Out-Null; robocopy $src $dst /E /NFL /NDL /NJH /NJS /R:1 /W:1 | Out-Null; $restored++ }`,
+      `}`,
+      `$topSrc = Join-Path $cp 'top-@deepseek-ai'`,
+      `if (Test-Path $topSrc) { Remove-Item ${ps(join(rec.fwRoot, '@deepseek-ai'))} -Recurse -Force -ErrorAction SilentlyContinue; robocopy $topSrc ${ps(join(rec.fwRoot, '@deepseek-ai'))} /E /NFL /NDL /NJH /NJS /R:1 /W:1 | Out-Null }`,
+      `try { Copy-Item (Join-Path $cp 'lock.yaml') ${ps(join(rec.fwRoot, '.pnpm', 'lock.yaml'))} -Force -ErrorAction SilentlyContinue } catch {}`,
+      `Log ('全树回滚完成：恢复 ' + $restored + ' 个版本包 + 顶层 scope，拉起验证中…')`,
+      `$ok = $false`,
+      `$started = $false`,
+      `for ($i = 0; $i -lt 20; $i++) {`,
+      `  try { $c = Get-NetTCPConnection -LocalPort ${port} -State Listen -ErrorAction SilentlyContinue; if ($c.Count -gt 0) { $ok = $true; break } } catch {}`,
+      `  if (-not $ok -and -not $started) { $binNow = ''; try { $env:DSH_RESOLVE_ROOT = '${join(dirname(fileURLToPath(import.meta.url)), '..')}'; $binNow = (& ${ps(nodePath)} -e "const path=require('path');const p=require.resolve('@deepseek-ai/dsh/package.json',{paths:[process.env.DSH_RESOLVE_ROOT]});console.log(path.join(path.dirname(p),'lib','bin.js'))" 2>$null | Select-Object -Last 1) } catch {}; if ($binNow -ne '' -and (Test-Path $binNow)) { Start-Process -FilePath ${ps(nodePath)} -ArgumentList $binNow,'web' -WindowStyle Hidden; $started = $true; Log '已发起拉起服务（回滚后）' } else { Log 'bin.js 缺失，跳过拉起' } }`,
+      `  Start-Sleep -Seconds 5`,
+      `}`,
+      `if ($ok) { SetState 'done' ('已回滚到升级前版本 ${rec.from ?? '?'}，服务正常') ; Log '回滚完成，服务已恢复' } else { SetState 'failed' '回滚后服务拉起失败：请手动运行 node ${resolveDshBin() ?? '<bin>'} web' ; Log '回滚后拉起失败' }`,
+      `schtasks /delete /f /tn ${taskName} 2>$null`,
+    ].filter((l) => l !== '').join('\r\n')
+    try { writeFileSync(stateFile, 'rollback|回滚脚本已启动…', 'utf8') } catch {}
+    writeFile(ps1, `\uFEFF${lines}`, 'utf8').then(
+      () => {
+        const ps1Posix = ps1.replace(/\\/gu, '/')
+        const tr = / /.test(ps1Posix)
+          ? `"powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File \\"${ps1Posix}\\""`
+          : `C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File ${ps1Posix}`
+        execFile('schtasks.exe', ['/create', '/f', '/tn', taskName, '/tr', tr, '/sc', 'once', '/st', '00:00'], { windowsHide: true }, (error) => {
+          if (error) {
+            execFile('powershell.exe', ['-NoProfile', '-WindowStyle', 'Hidden', '-ExecutionPolicy', 'Bypass', '-File', ps1], { windowsHide: true, detached: true, stdio: 'ignore' }, () => {})
+            return
+          }
+          setTimeout(() => {
+            execFile('schtasks.exe', ['/run', '/tn', taskName], { windowsHide: true }, (runError) => {
+              if (runError) {
+                execFile('powershell.exe', ['-NoProfile', '-WindowStyle', 'Hidden', '-ExecutionPolicy', 'Bypass', '-File', ps1], { windowsHide: true, detached: true, stdio: 'ignore' }, () => {})
+              }
+            })
+          }, 800)
+        })
+      },
+      () => {},
+    )
+    sendJson(res, 200, { ok: true, from: rec.from ?? null, checkpointDir: rec.checkpointDir })
+    return
+  }
+
   if (pathname === `${ROUTE_PREFIX}/clean-residuals`) {
     // 清理残余备份/旧子包：删除 .old-* 备份目录，以及聚合包未声明的 @linxin666 旧子包
     const profileDir = dirname(findPatchPath(ctx))
@@ -4858,6 +5443,8 @@ async function handle(ctx, req, res) {
     const profileDir = dirname(patchPath)
     const jobId = `ai-${Date.now()}-${++aiJobSeq}`
     const job = { id: jobId, source, status: 'running', stage: 'planning', createdAt: Date.now(), logText: '', stepStates: [] }
+    // 框架适配预检（兼容门 + registry 声明）：规划期即给出权威说明，供子代理引用与用户查看
+    try { job.frameworkCheck = await frameworkCompatReportFor(source, ctx, profileDir) } catch { job.frameworkCheck = null }
     aiJobs.set(jobId, job)
     const builtin = builtinPlanFor(source)
     if (builtin !== null) {
@@ -4865,7 +5452,8 @@ async function handle(ctx, req, res) {
       job.status = 'plan-ready'
       job.stage = 'builtin'
       job.finishedAt = Date.now()
-      sendJson(res, 200, { ok: true, jobId })
+      saveAiJobs()
+      sendJson(res, 200, { ok: true, jobId, frameworkCheck: job.frameworkCheck })
       return
     }
     aiEmpowerPlan(job, ctx, profileDir).catch((error) => {
@@ -4873,7 +5461,7 @@ async function handle(ctx, req, res) {
       job.error = `规划任务异常：${error instanceof Error ? error.message : String(error)}`
       job.finishedAt = Date.now()
     })
-    sendJson(res, 200, { ok: true, jobId })
+    sendJson(res, 200, { ok: true, jobId, frameworkCheck: job.frameworkCheck })
     return
   }
 
@@ -4887,9 +5475,30 @@ async function handle(ctx, req, res) {
     sendJson(res, 200, { ok: true, ...aiJobView(job) })
     return
   }
+  if (pathname === `${ROUTE_PREFIX}/ai-empower/list`) {
+    // 并发任务列表（轻量视图，不含日志全文）：面板展示/切换多个并发 AI 赋能任务
+    const list = [...aiJobs.values()].slice(-10).reverse().map((job) => ({
+      jobId: job.id,
+      source: job.source,
+      status: job.status,
+      stage: job.stage,
+      type: job.plan?.type ?? null,
+      displayName: job.plan?.displayName ?? null,
+      progress: job.progress ?? { done: 0, total: (job.plan?.steps ?? []).length },
+      error: job.error ?? null,
+      createdAt: job.createdAt,
+    }))
+    sendJson(res, 200, { ok: true, tasks: list })
+    return
+  }
   if (pathname === `${ROUTE_PREFIX}/ai-empower/run`) {
     const jobId = typeof body.jobId === 'string' ? body.jobId : ''
     const selected = Array.isArray(body.steps) ? body.steps : null
+    // 纵深防御：必须显式确认（前端「同意并部署」按钮携带 confirmed:true），防止任何绕过同意直接执行
+    if (body.confirmed !== true) {
+      sendError(res, 400, '未确认部署：请先在面板勾选步骤并点击「同意并部署」')
+      return
+    }
     const job = aiJobs.get(jobId)
     if (!job) {
       sendError(res, 404, '没有这个 AI 赋能任务')
@@ -4905,6 +5514,7 @@ async function handle(ctx, req, res) {
       job.status = 'failed'
       job.error = `执行任务异常：${error instanceof Error ? error.message : String(error)}`
       job.finishedAt = Date.now()
+      saveAiJobs()
     })
     sendJson(res, 200, { ok: true, jobId })
     return
@@ -4922,6 +5532,7 @@ async function handle(ctx, req, res) {
       job.status = 'failed'
       job.error = '已取消执行（用户中断）'
       job.finishedAt = Date.now()
+      saveAiJobs()
     }
     sendJson(res, 200, { ok: true, jobId })
     return
@@ -4934,13 +5545,124 @@ async function handle(ctx, req, res) {
       try {
         enriched.push(await compStatus(c.id))
       } catch {
-        enriched.push({ id: c.id, name: c.name, running: false, healthy: null, pid: null, port: c.port ?? null })
+        enriched.push({ id: c.id, name: c.name, running: false, healthy: null, pid: null, port: c.port ?? null, autoStart: c.autoStart === true })
       }
     }
     sendJson(res, 200, { ok: true, components: enriched.map((x) => ({ ...x, uiUrl: compUiUrl(compFind(x.id) ?? {}) })) })
     return
   }
 
+  if (pathname === `${ROUTE_PREFIX}/repo-clone`) {
+    // 仓库落地：从 GitHub 克隆任意项目到 <配置路径>/<owner>/<name>（不限于 DSH 插件）
+    const raw = typeof body.repo === 'string' ? body.repo.trim() : ''
+    let repo = raw
+      .replace(/^https?:\/\/github\.com\//u, '')
+      .replace(/^git@github\.com:/u, '')
+      .replace(/\.git$/u, '')
+      .replace(/\/+$/u, '')
+    const m = /^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/u.exec(repo)
+    if (!m) {
+      sendError(res, 400, '仓库格式不正确：请提供 owner/repo 或 GitHub 仓库链接')
+      return
+    }
+    const [, owner, name] = m
+    const root = getReposDir()
+    const target = join(root, owner, name)
+    if (existsSync(target)) {
+      sendError(res, 400, `已存在：${target}（如需更新请先手动处理该目录）`)
+      return
+    }
+    try {
+      mkdirSync(root, { recursive: true })
+      await execFileAsync('git.exe', ['clone', '--depth', '1', `https://github.com/${owner}/${name}.git`, target], { cwd: root, timeout: 600000, windowsHide: true, maxBuffer: 4 * 1024 * 1024 })
+      sendJson(res, 200, { ok: true, owner, name, path: target })
+    } catch (error) {
+      sendError(res, 500, `克隆失败：${error instanceof Error ? error.message : String(error)}`)
+    }
+    return
+  }
+
+  if (pathname === `${ROUTE_PREFIX}/repo-list`) {
+    try {
+      sendJson(res, 200, { ok: true, dir: getReposDir(), repos: listLandedRepos() })
+    } catch (error) {
+      sendError(res, 500, error instanceof Error ? error.message : String(error))
+    }
+    return
+  }
+
+  if (pathname === `${ROUTE_PREFIX}/repo-land-config`) {
+    const dir = typeof body.dir === 'string' ? body.dir.trim() : ''
+    if (dir === '' || !/^[A-Za-z]:[\\/]/.test(dir) && !/^\\\\/.test(dir)) {
+      sendError(res, 400, '保存路径不合法：请提供绝对路径（如 D:\\dsh\\repos）')
+      return
+    }
+    try {
+      setReposDir(dir)
+      sendJson(res, 200, { ok: true, dir: getReposDir() })
+    } catch (error) {
+      sendError(res, 500, error instanceof Error ? error.message : String(error))
+    }
+    return
+  }
+
+  if (pathname === `${ROUTE_PREFIX}/repo-remove`) {
+    const target = typeof body.path === 'string' ? body.path : ''
+    const rootNorm = getReposDir().replace(/[\\/]+$/u, '')
+    const tNorm = target.replace(/[\\/]+$/u, '')
+    if (!tNorm.startsWith(rootNorm) || tNorm === rootNorm || !existsSync(target)) {
+      sendError(res, 400, '路径不在仓库落地目录内或不存在')
+      return
+    }
+    try {
+      rmSync(target, { recursive: true, force: true })
+      sendJson(res, 200, { ok: true })
+    } catch (error) {
+      sendError(res, 500, `删除失败：${error instanceof Error ? error.message : String(error)}`)
+    }
+    return
+  }
+
+  if (pathname === `${ROUTE_PREFIX}/repo-open`) {
+    const target = typeof body.path === 'string' ? body.path : ''
+    const rootNorm = getReposDir().replace(/[\\/]+$/u, '')
+    const tNorm = target.replace(/[\\/]+$/u, '')
+    if (!tNorm.startsWith(rootNorm) || tNorm === rootNorm) {
+      sendError(res, 400, '路径不在仓库落地目录内')
+      return
+    }
+    if (!existsSync(target)) {
+      sendError(res, 404, `目录不存在：${target}`)
+      return
+    }
+    try {
+      execFile('explorer.exe', [target], { windowsHide: true, detached: true }).unref()
+      sendJson(res, 200, { ok: true })
+    } catch (error) {
+      sendError(res, 500, `打开失败：${error instanceof Error ? error.message : String(error)}`)
+    }
+    return
+  }
+
+  if (pathname === `${ROUTE_PREFIX}/component/autostart`) {
+    const id = typeof body.id === 'string' ? body.id : ''
+    const enabled = body.enabled === true
+    if (id === '') {
+      sendError(res, 400, '缺少组件 id')
+      return
+    }
+    if (!compFind(id)) {
+      sendError(res, 404, '组件不存在')
+      return
+    }
+    compUpsert({ id, autoStart: enabled })
+    if (enabled) {
+      compStart(id).catch(() => {})
+    }
+    sendJson(res, 200, { ok: true, id, autoStart: enabled })
+    return
+  }
+
   if (pathname === `${ROUTE_PREFIX}/component/start`) {
     const id = typeof body.id === 'string' ? body.id : ''
     if (id === '') {