@noob-stupid/dsh-plugin-console 0.3.25 → 0.3.27

package/README.md

@@ -20,20 +20,25 @@
 
 
 
-> ## 🎉 v0.3.24 — AI Empower released (2026-08-31)
+> ## 🎉 v0.3.27 released — family-bundle cards, never-crash safety & adapt-gate hardening (2026-09-04)
 >
-> Give the Plugin Console a package name or GitHub repo: the local AI reads its docs,
-> drafts a **deployment plan** (install / write config / start service / health check),
-> and — after your confirmation — executes it safely. Server-type components get an
-> automatic control card (start/stop/status/open + dropdown). An OpenViking template
-> deploys a local memory server in one flow.
+> **Family-bundle cards**: same-root subpath exports (e.g. `@linxin666/dsh-web-all/settings`) auto-group
+> into one family card at the bottom — collapse/expand, batch check-updates, **one-click unlock-adapted**,
+> known-check preview, `web-all/`-prefix-free sub-cards.
+> **Never-crash safety**: pre-enable import probe (child-process) + patch auto-heal (core-row restore &
+> missing-module auto-disable) + exports-fallback `package.json` resolution — the memory-plugin
+> false-disable incident is fixed.
+> **Adapt-gate hardening**: source-scan hard criterion (post-0.3.6 false-pass), migrate detection
+> (`dsh.migrate.to`), softened dependency-strict judgment, pending hints moved into details.
+> **Safe sub-package delete**: deleting a bundle sub-row disables only that row and keeps the bundle —
+> fixing the incident where deleting one sub-package removed the whole family bundle.
 >
 > **Install:**
 > ```bash
 > npm i -g @noob-stupid/dsh-plugin-console
 > # or in DSH: dsh plugin --profile web add @noob-stupid/dsh-plugin-console
 > ```
-> **Try it:** Plugin Console → **AI 赋能** button → enter e.g. `OpenViking` → confirm the plan.
+> **Try it:** Plugin Console → family card at the bottom → 「批量检测更新 / 一键启用已适配」.
 >
 > Feedback: [GitHub Issues](https://github.com/Noob-stupid/dsh-plugin-hub/issues).
 A **plugin management panel** for the DeepSeek Harness (DSH) Web GUI: one-click
@@ -82,6 +87,8 @@ auto-rollback).
 | | Benefit | Detail |
 |---|---|---|
 | 🤖 | **AI Empower (v0.3.24)** | Give the console a package name or GitHub repo — the local AI reads docs, drafts a **deployment plan** (install / write config / start service / health check) and executes it safely after your confirmation; server-type components get an automatic control card |
+| 🛡️ | **Framework upgrade safety & adapt gate (v0.3.25)** | Force-disables plugins incompatible with the new framework (enable locked; 「Check update → Update & adapt」auto-verifies and unlocks); full-tree checkpoint before upgrade, automatic rollback on relaunch failure, one-click rollback to the previous version |
+| 🏠 | **Family-bundle cards & safety (v0.3.27)** | Same-root subpath exports group into one family card (collapse/expand, batch check-update, one-click unlock-adapted, known-check preview); never-crash safety (pre-enable import probe + patch auto-heal + exports fallback); adapt-gate source-scan hard criterion & migrate detection; deleting a bundle sub-row disables only that row |
 | 🚀 | **Server component cards** | Left-side floating card auto-aligned to the main panel: start / stop / status / **open Web UI** buttons, multi-server dropdown, collapsible |
 | 🧩 | **Plugin & skill hub** | Auto-collected index of `dsh-plugin` topic repos (**500+** by stars) plus a **Skills tab** (`agent-skills` ∪ `claude-skills` ∪ `dsh-skill`, up to 300) — browse, search, one-click install, no GitHub API calls |
 | 🤖 | **Auto-collection CI** | GitHub Actions reruns `build-index` every 6 hours (manual trigger available); authors just add the `dsh-plugin` / `agent-skills` / `claude-skills` / `dsh-skill` topic — no application needed |
@@ -246,6 +253,47 @@ Requires: DSH ≥ 0.1.0-rc.6 (web profile, with `dsh-client-modules` / `dsh-host
 - **Card dismiss semantics**: terminal states (done/failed) are permanently dismissed on ✕
   (persisted); in-progress dismissal is session-only and the card returns after a refresh.
 
+### Framework upgrade safety & plugin adapt gate (v0.3.25)
+
+> Origin: the 2026-09-04 DSH `0.1.1-rc.2 → 0.1.2-rc.1` incident — the upgrade script ran in
+> the wrong working directory, overwrote the new CLI into the old `.pnpm` entry, left a
+> mixed-version tree, and the service could not start. This version makes upgrade safety
+> and plugin compatibility detection first-class console mechanisms.
+
+**Upgrade safety trio**
+
+1. **Framework root detection**: locates the real install root (the top-level `node_modules`
+   containing `.pnpm`), fixing the `require.resolve`-returns-`.pnpm`-realpath root cause
+   (relink no-op / new package overwriting the old tree); refuses to upgrade when the root
+   cannot be identified (service stays running);
+2. **Full-tree checkpoint before upgrade**: mirrors every `@deepseek-ai` version package in
+   `.pnpm` + the top-level scope + `lock.yaml`
+   (under `~/.dsh/plugin-console/framework-backups/<version>/fw-tree/`);
+3. **Automatic full-tree rollback + retry**: install failure or relaunch failure restores
+   the pre-upgrade tree and relaunches automatically — no more "please run it manually"
+   dead-ends; after rollback, relink/repair steps are skipped to avoid damaging the
+   restored tree a second time.
+
+**One-click rollback**: after an upgrade the framework card shows a **「回滚到上一版」** button
+(`/plugin-console/framework-rollback`): stop service → restore full tree → relaunch →
+health check, state visible throughout.
+
+**Plugin adapt gate (compatibility detection)**
+
+- After an upgrade, plugin entries recorded in `~/.dsh/plugin-console/compat-pending.json`
+  are **force-disabled**; the enable button is locked and the server rejects `/toggle` with
+  409 (unbypassable). The enabled-button label itself shows「待适配」as the state hint;
+- The **details** panel explains the flow: **Check update → Update & adapt**;
+- **Post-update auto-verification**: scans the latest `package.json` for an explicit
+  `dsh.engines.framework` / `engines.dsh` declaration plus `@deepseek-ai/*` dependency
+  ranges (built-in zero-dependency semver engine — strict npm prerelease rules for
+  dependencies, loose for explicit declarations); if the version changed and no
+  incompatibility was found, the `disabled` block is **removed automatically** and the row
+  unlocks; aggregator updates validate all synced subpackages too;
+- **AI Empower pre-check**: during planning the server pre-checks the registry's latest
+  declaration and adapt-gate hits, injects them into the subagent prompt (the plan must
+  explain the conclusion to the user) and marks it on the plan panel (red for incompatible).
+
 ### Marketplace (multi-source)
 
 - **Source switcher**: click the login pill to switch between **GitHub / Gitee / custom
@@ -349,6 +397,10 @@ GitHub Actions (every 6h, repo token)
 - Supports the **DSH 0.1.0 series** (`0.1.0-rc.6` and siblings).
 - The panel reads the running `@deepseek-ai/dsh-web-app` version: after a breaking upgrade
   (0.2 / 1.0) a compatibility warning appears instead of silent failure.
+- **Plugin adapt gate (v0.3.25)**: third-party plugins incompatible with the current
+  framework are force-disabled after an upgrade (enable locked); run 「Check update」to
+  upgrade the plugin first — it unlocks automatically after the auto-verification passes.
+  See 「Framework upgrade safety & plugin adapt gate」.
 - Likely breaking seams: patch semantics, `webServer.register`, loader entry shape,
   `dsh.client` bundle format, `settings.plugins.tab` slot.
 - Deploy scripts do not check versions; the in-panel warning is authoritative.
@@ -390,6 +442,11 @@ test-harness.mjs   Logic self-test (state/toggle/validation/loopback; search SKI
 | `/plugin-console/gitee-oauth-url` / `gitee-oauth-callback` | GET | Gitee OAuth flow |
 | `/plugin-console/ai-consent` | POST | Approve/cancel the AI-fallback step |
 | `/plugin-console/restart` | POST | Watchdog-safe self-restart (panel button equivalent) |
+| `/plugin-console/framework-upgrade` | POST | One-click framework upgrade (full-tree checkpoint → online install → rollback protection) |
+| `/plugin-console/framework-rollback` | POST | One-click rollback to the previous version (stop → full-tree restore → auto relaunch → health check) |
+| `/plugin-console/self-update` | POST | Update the console itself (latest npm tarball into the profile) |
+| `/plugin-console/ai-empower/plan` / `status` / `run` / `cancel` | POST | AI Empower: plan (with framework compat pre-check) → status polling → confirmed run → cancel |
+| `/plugin-console/components` / `component/start` / `stop` / `status` | GET/POST | Server component registry and start/stop/status |
 
 ---
 

package/README.zh.md

@@ -6,18 +6,23 @@
 
 # DSH 插件中心（dsh-plugin-hub）
 
-> ## 🎉 v0.3.24 正式发布 — AI 赋能一键部署（2026-08-31）
+> ## 🎉 v0.3.27 正式发布 — 全家桶分组卡片、永不崩安全与适配门强化（2026-09-04）
 >
-> 在插件控制台输入 npm 包名或 GitHub 仓库，本地 AI 读取文档自动生成**部署计划**，
-> 你确认后安全执行；服务器类组件自动生成控制卡片（启动/停止/状态/打开 + 下拉）。
-> 内置 OpenViking 模板，一条指令部署本地记忆服务器。
+> **全家桶分组卡片**：同根包子路径导出（如 `@linxin666/dsh-web-all/settings`）自动聚合为一张
+> 全家桶卡片（列表底部）——收起/展开、批量检测更新、**一键启用已适配**、已知校验预览，子卡剥离
+> `web-all/` 前缀。
+> **永不崩安全**：启用前子进程导入探针 + 补丁自动自愈（核心行恢复/缺失模块自动禁用）+
+> exports 回退 `package.json` 解析——记忆插件被误禁用的事故已修复。
+> **适配门强化**：源码扫描硬判据（0.3.6 假通过教训）、迁移检测（`dsh.migrate.to`）、
+> 依赖严格判定软化、待适配提示移入详情。
+> **子包删除安全**：删除聚合包子行仅停用该行、不动 bundle——修复"删一个子包导致整个全家桶消失"的事故。
 >
 > **安装：**
 > ```bash
 > npm i -g @noob-stupid/dsh-plugin-console
-> # 或在 DSH 中更新：dsh plugin --profile web add @noob-stupid/dsh-plugin-console
+> # 或在 DSH 中：dsh plugin --profile web add @noob-stupid/dsh-plugin-console
 > ```
-> **体验入口：** 插件控制台 → 右上角 **AI 赋能** 按钮 → 输入如 `OpenViking` → 确认计划 → 自动部署。
+> **体验入口：** 插件控制台 → 列表底部全家桶卡片 → 批量检测更新 / 一键启用已适配。
 >
 > 反馈：[GitHub Issues](https://github.com/Noob-stupid/dsh-plugin-hub/issues)。
 
@@ -75,6 +80,8 @@
 | | 优势 | 说明 |
 |---|---|---|
 | 🤖 | **AI 赋能（v0.3.24）** | 输入 npm 包名 / GitHub 仓库，本地 AI 读文档生成**部署计划**（安装/写配置/启动服务/健康检查），你确认后安全执行；服务器类组件自动生成控制卡片 |
+| 🛡️ | **框架升级适配门与安全（v0.3.25）** | 升级后不兼容插件强制禁用（适配门锁定，「检测更新 → 更新并适配 → 自动校验解锁」）；升级前全树 checkpoint、拉起失败自动全树回滚、框架卡片一键回滚到上一版 |
+| 🏠 | **全家桶分组卡片与安全（v0.3.27）** | 同根包子路径导出自动聚合为一张全家桶卡片（收起/展开、批量检测更新、一键启用已适配、已知校验预览）；永不崩安全（启用前导入探针 + 补丁自愈 + exports 回退）；适配门源码扫描硬判据与迁移检测；删除聚合包子行仅停用该行 |
 | 🚀 | **服务器组件卡片** | 左侧浮卡与主面板顶边对齐：启动 / 停止 / 状态 / 【打开】直达 Web UI，多服务器下拉、可折叠（状态记忆） |
 | 🧩 | **插件 + 技能双市场** | 自动收录 `dsh-plugin` topic 仓库（按 star **500+**），另有**技能 tab**（`agent-skills` ∪ `claude-skills` ∪ `dsh-skill`，最多 300）——浏览、搜索、一键安装，零 GitHub API 调用；插件自带技能（如 openviking-memory）只读展示 |
 | 🤖 | **自动收录 CI** | GitHub Actions 每 6 小时自动重跑 `build-index`（也支持手动触发）；作者只需给自己的仓库打 `dsh-plugin` / `agent-skills` / `claude-skills` / `dsh-skill` 标签，**无需申请、无需审核** |
@@ -227,6 +234,37 @@ git clone https://github.com/Noob-stupid/dsh-plugin-hub /tmp/dsh-plugin-console
 - **卡片关闭语义**：终态（成功/失败）点叉号永久关闭（持久化）；进行中点叉号仅本次会话
   隐藏，刷新后恢复显示。
 
+### 框架升级适配门与升级安全（v0.3.25）
+
+> 缘起：2026-09-04 DSH `0.1.1-rc.2 → 0.1.2-rc.1` 升级事故——升级脚本在错误的工作目录执行，
+> 把新 CLI 原位覆盖进旧 `.pnpm` 目录、依赖树混版本，服务无法拉起。本版本把「升级安全」与
+> 「插件兼容检测」固化为控制台机制。
+
+**升级安全三件套**
+
+1. **框架安装根识别**：定位真正的框架安装根（含 `.pnpm` 的顶层 `node_modules`），修复
+   `require.resolve` 返回 `.pnpm` 内部 realpath 导致的「重链空转 / 新包覆盖旧目录」根因；
+   定位不到时**拒绝升级**（不 kill 服务、服务保持运行）；
+2. **升级前全树 checkpoint**：镜像 `.pnpm` 全部 `@deepseek-ai` 版本包 + 顶层 scope +
+   `lock.yaml`（写入 `~/.dsh/plugin-console/framework-backups/<版本>/fw-tree/`）；
+3. **拉起失败自动全树回滚并重试**：安装失败或服务拉起失败都会自动恢复升级前全树并再次拉起，
+   不再只留「请手动运行」提示；回滚后跳过重链/修复（避免对已恢复旧树二次破坏）。
+
+**一键回滚**：升级后框架卡片出现「回滚到上一版」按钮（`/plugin-console/framework-rollback`）：
+停服 → 全树恢复 → 自动拉起 → 健康检测，全程状态可见。
+
+**插件适配门（插件检测）**
+
+- 升级后写入 `~/.dsh/plugin-console/compat-pending.json` 的插件行被**强制禁用**，启用按钮
+  锁定（服务端 `/toggle` 直接 409，无法绕过）；行状态以按钮文案「待适配」提示；
+- 「详情」面板给出说明与入口：**检测更新 → 更新并适配**；
+- **更新后自动校验**：扫描最新版 `package.json` 的 `dsh.engines.framework` / `engines.dsh`
+  显式声明 + `@deepseek-ai/*` 依赖范围（内置零依赖 semver 判定器：依赖判定遵循 npm
+  prerelease 严格规则、声明判定宽松）；版本已变化且未判定不兼容 → **自动移除禁用块解锁**；
+  聚合包更新连带校验同步的子包；
+- **AI 赋能适配预检**：规划时服务端预检 registry 最新版声明与适配门命中情况，注入子代理
+  提示词（要求计划向用户解释适配结论），并在计划面板标注（不兼容标红）。
+
 ### 插件市场（多搜索源）
 
 - **搜索源切换**：点击顶部登录态标识弹出菜单，在 **GitHub / Gitee / 自定义源** 间切换（选择持久化）；
@@ -323,6 +361,9 @@ GitHub Actions（每 6 小时，仓库自带 token）
 - 当前支持 **DSH 0.1.0 系列**（`0.1.0-rc.6` 及同系列版本）。
 - 面板会读取运行中的 `@deepseek-ai/dsh-web-app` 版本：官方发布破坏性升级
   （0.2 / 1.0 等）后，面板顶部会显示兼容性警告并给出本仓库地址，而不是默默失效。
+- **插件适配门（v0.3.25）**：框架升级后不兼容的第三方插件会被**强制禁用**（启用按钮锁定）；
+  请先「检测更新」升级该插件，更新并通过自动校验后才会解锁——详见
+  「框架升级适配门与升级安全」。
 - 官方破坏性更新可能改动的接口：补丁层语义、`webServer.register`、
   加载器条目结构、`dsh.client` bundle 格式、`settings.plugins.tab` 插槽。
   届时随官方版本更新本仓库即可（依赖面已收窄到上述几个点）。
@@ -341,6 +382,7 @@ scripts/apply-framework-patch.cjs   框架层补丁（issue #5，幂等，可重
 marketplace/index.json         生成的静态索引（jsDelivr CDN 分发）
 deploy.ps1 / deploy.sh   一键部署脚本（Windows / Linux·macOS）
 test-harness.mjs   逻辑自检（state/toggle/校验/环回保护；搜索视网络环境 SKIP）
+test-compat-gate.mjs   适配门单元测试（内置 semver 判定器：声明/依赖兼容规则）
 ```
 <img width="1878" height="945" alt="image" src="https://github.com/user-attachments/assets/b26f2f19-0ba4-4be7-9ca1-b3fd4c51a7a8" />
 
@@ -365,6 +407,11 @@ test-harness.mjs   逻辑自检（state/toggle/校验/环回保护；搜索视
 | `/plugin-console/gitee-oauth-url` / `gitee-oauth-callback` | GET | Gitee OAuth 流程 |
 | `/plugin-console/ai-consent` | POST | 同意/取消 AI 兜底步骤 |
 | `/plugin-console/restart` | POST | 自带守护的安全自重启（等同面板按钮） |
+| `/plugin-console/framework-upgrade` | POST | 框架一键升级（全树 checkpoint → 在线安装 → 全树回滚保护） |
+| `/plugin-console/framework-rollback` | POST | 一键回滚到升级前版本（停服 → 全树恢复 → 自动拉起 → 健康检测） |
+| `/plugin-console/self-update` | POST | 控制台自身一键更新（npm 最新 tarball 到当前 profile） |
+| `/plugin-console/ai-empower/plan` / `status` / `run` / `cancel` | POST | AI 赋能：规划（含框架适配预检）→ 状态轮询 → 确认执行 → 取消 |
+| `/plugin-console/components` / `component/start` / `stop` / `status` | GET/POST | 服务器组件清单与启动/停止/状态 |
 
 ---
 

package/lib/client.js

@@ -104,6 +104,21 @@ window.__ModuleLoader__.load({
 			pendingCompatTag: "待适配",
 			pendingCompatHint: "框架升级后被强制禁用：先点「检测更新」，如有新版按钮会变为「更新并适配」，点击后更新完成自动校验通过即解锁启用",
 			updateAndAdapt: "更新并适配",
+			familyTag: "全家桶",
+			familySubs: "子包",
+			familyUnlockAll: "一键启用已适配",
+			familyUnlockAllTip: "对全家桶内所有源码扫描通过（已适配）的子包批量解锁启用；未通过的保持禁用",
+			familyUnlockAllConfirm: "将对全家桶内所有已适配（源码扫描通过）的子包一键解锁启用？未通过的将保持禁用。",
+			familyUnlockAllDone: "已批量适配解锁",
+			familyExpand: "展开",
+			familyCollapse: "收起",
+			familyUpdate: "全家桶版本检测",
+			familyCheckUpdate: "批量检测更新",
+			adaptUnlockBtn: "已适配，立即解锁",
+			adaptUnlockHint: "已安装版本经源码扫描确认适配当前框架：立即移除禁用块并解锁启用",
+			adaptUnlockDone: "已适配解锁：刷新后该行可正常启用",
+			migrateTip: "项目已迁移（适配当前框架）",
+			migrateBtn: "迁移并适配",
 			aiEmpowerFrameworkCheck: "框架适配检测",
 			userForcedTag: "补丁强制启用",
 			protectedTag: "受保护",
@@ -404,6 +419,21 @@ window.__ModuleLoader__.load({
 			pendingCompatTag: "Pending adapt",
 			pendingCompatHint: "Force-disabled after framework upgrade: click Check update first; if a newer version exists the button becomes Update & adapt - click it and it unlocks automatically after the compat check",
 			updateAndAdapt: "Update & adapt",
+			familyTag: "Family bundle",
+			familySubs: "sub packages",
+			familyUnlockAll: "Unlock all adapted",
+			familyUnlockAllTip: "Batch-unlock every sub package in this family whose source scan passed; failed ones stay disabled",
+			familyUnlockAllConfirm: "Unlock all adapted (source-scan passed) sub packages in this family? Failed ones stay disabled.",
+			familyUnlockAllDone: "Family batch unlock done",
+			familyExpand: "Expand",
+			familyCollapse: "Collapse",
+			familyUpdate: "Family version check",
+			familyCheckUpdate: "Check all",
+			adaptUnlockBtn: "Adapted - unlock now",
+			adaptUnlockHint: "Installed version passed the source scan for the current framework: unlock immediately",
+			adaptUnlockDone: "Unlocked: refresh and the row is enabled",
+			migrateTip: "Project migrated (adapted to the current framework)",
+			migrateBtn: "Migrate & adapt",
 			aiEmpowerFrameworkCheck: "Framework compat check",
 			userForcedTag: "Forced on by patch",
 			protectedTag: "Protected",
@@ -971,10 +1001,12 @@ window.__ModuleLoader__.load({
 		function PluginConsoleTab({ t }) {
 			const [state, setState] = react.useState({ status: "loading" });
 			const [busy, setBusy] = react.useState(null);
+			const [adaptUnlocking, setAdaptUnlocking] = react.useState(null);
 			const [message, setMessage] = react.useState(null);
 			const [reloadHint, setReloadHint] = react.useState(false);
 			const [restartHint, setRestartHint] = react.useState(false);
 			const [jobs, setJobs] = react.useState({});
+			const [familyCollapsed, setFamilyCollapsed] = react.useState({});
 			const [query, setQuery] = react.useState(() => {
 				try { return localStorage.getItem("pc-market-query") ?? ""; } catch { return ""; }
 			});
@@ -1396,7 +1428,29 @@ window.__ModuleLoader__.load({
 			// 挂载时加载静态插件索引（GitHub 源空查询时秒开浏览，零 API 调用）
 			react.useEffect(() => {
 				call("/plugin-console/market-index").then(
-					(data) => { if (data && Array.isArray(data.items)) setIndexData({ items: data.items, skills: Array.isArray(data.skills) ? data.skills : [], loaded: true }); },
+					(data) => {
+						if (data && Array.isArray(data.items)) {
+							setIndexData({ items: data.items, skills: Array.isArray(data.skills) ? data.skills : [], loaded: true });
+							// ★「只看官方」需要官方标记：索引条目补标（网络/服务端此前判定失败时不动已有标记，避免 null 覆盖）
+							// 服务端 /enrich 已带 24h 结果缓存时，此处仅兜底浏览器直连失败部分。
+							const base = data.items;
+							enrichOfficialBundle(base).then((enriched) => {
+								if (!Array.isArray(enriched)) return;
+								const merged = enriched.map((e, i) => {
+									const b = base[i] ?? {};
+									return {
+										...e,
+										official: e.official !== null ? e.official : (b.official ?? null),
+										aggregate: e.aggregate === true || b.aggregate === true,
+										aggregateInstallable: b.aggregateInstallable === true,
+										hasSkill: e.hasSkill === true || b.hasSkill === true,
+										hasSuite: e.hasSuite === true || b.hasSuite === true,
+									};
+								});
+								setIndexData((prev) => (prev !== null && prev.loaded === true ? { ...prev, items: merged } : prev));
+							});
+						}
+					},
 					() => {},
 				);
 				// 市场状态记忆：关闭前搜索过 → 重开时自动恢复该搜索（query 已从 localStorage 初始化）
@@ -2217,13 +2271,31 @@ window.__ModuleLoader__.load({
 					: ((searchSourcesList !== null ? searchSourcesList.find((s) => s.id === source)?.name : undefined) ?? source);
 			const extraIds = new Set((state.status === "ready" ? state.data.patch?.inserts ?? [] : []));
 			const extraCount = state.status === "ready" ? state.data.entries.filter((entry) => entry.extra === true || extraIds.has(entry.rowId)).length : 0;
-			const rows = state.status === "ready"
+			const pkgRootOf = (m) => { const mm = String(m ?? ""); const x = mm.match(/^(@[^/]+\/[^/]+)(?:\/.*)?$/u); return x ? x[1] : mm; };
+			const filteredEntries = state.status === "ready"
 				? state.data.entries.filter((entry) => {
 					if (extraOnly && !(entry.extra === true || extraIds.has(entry.rowId))) return false;
 					if (installedQueryNorm === "") return true;
 					return [entry.moduleName, entry.entryId, entry.rowId]
 						.some((value) => String(value ?? "").toLowerCase().includes(installedQueryNorm));
-				}).map((entry) => {
+				})
+				: [];
+			// 聚合包分组：仅「同根包 + 子路径导出」（web-all 0.3.14 式，moduleName=pkg/sub）→ 全家桶组；
+			// 经典多子包聚合（每子包独立名）不归组。组头与子包卡片一律置于列表【最底部】。
+			const famRootOf = (entry) => {
+				const m = String(entry.moduleName ?? "");
+				if (m.startsWith("@deepseek-ai/")) return null;
+				return pkgRootOf(m);
+			};
+			const familyCounts = new Map();
+			for (const entry of (state.status === "ready" ? state.data.entries : [])) {
+				const root = famRootOf(entry);
+				if (root === null) continue;
+				familyCounts.set(root, (familyCounts.get(root) ?? 0) + 1);
+			}
+			const familyCards = filteredEntries.map((entry) => {
+					const familyRoot = String(entry.moduleName ?? "").startsWith("@deepseek-ai/") ? null : pkgRootOf(entry.moduleName);
+					void familyRoot;
 					const open = details !== null && details.entryId === entry.entryId;
 					let detailPanel = null;
 					if (open) {
@@ -2236,10 +2308,13 @@ window.__ModuleLoader__.load({
 						} else {
 							const meta = details.data.meta;
 							const readme = details.data.readme;
+							const compatInfo = state.status === "ready" && state.data.compatPending
+								? (state.data.compatPending.pending ?? []).find((p) => p.rowId === entry.rowId) ?? null
+								: null;
 							detailPanel = el("div", { className: styles.detail },
 								meta !== null ? el("p", { className: styles.desc }, meta.description ?? t("noDetail")) : null,
 								entry.pendingCompat === true
-									? el("p", { className: styles.status, "data-pending": "true" }, t("pendingCompatHint"))
+									? el("p", { className: styles.status, "data-pending": "true" }, t("pendingCompatHint") + (compatInfo && compatInfo.checkNote ? "；已知校验：" + compatInfo.checkNote : ""))
 									: null,
 								meta !== null && meta.version ? el("div", { className: styles.rowTop },
 									el("p", { className: styles.status }, t("versionLabel") + "：" + meta.version),
@@ -2254,7 +2329,38 @@ window.__ModuleLoader__.load({
 										className: styles.toggle,
 										title: t("aiEmpowerTitle"),
 										onClick: () => openAiFor(String(entry.moduleName ?? entry.repo ?? "")),
-									}, t("aiEmpowerLabel"))) : null,
+									}, t("aiEmpowerLabel")),
+									entry.pendingCompat === true
+										? el("button", {
+											type: "button",
+											className: styles.toggle,
+											"data-pending": "true",
+											title: t("adaptUnlockHint"),
+											disabled: installing === entry.moduleName || adaptUnlocking === entry.entryId,
+											onClick: () => {
+												setAdaptUnlocking(entry.entryId);
+												call("/plugin-console/adapt-unlock", { rowId: entry.rowId }).then(
+													() => {
+														setAdaptUnlocking(null);
+														setMessage(t("adaptUnlockDone"));
+														window.setTimeout(() => window.location.reload(), 1200);
+													},
+													(error) => { setAdaptUnlocking(null); setMessage(t("failed") + "：" + friendlyGithubError(error).message); },
+												);
+											},
+										}, adaptUnlocking === entry.entryId ? t("loadingPhase") : t("adaptUnlockBtn"))
+										: null) : null,
+								updateCheck !== null && updateCheck.status === "ready" && updateCheck.migrate && updateCheck.migrate.compatible
+									? el("div", null,
+										el("div", { className: styles.rowTop },
+											el("p", { className: styles.status }, t("migrateTip") + "：" + String(updateCheck.migrate.to ?? "") + (updateCheck.migrate.latest ? " v" + updateCheck.migrate.latest : "")),
+											el("button", {
+												type: "button",
+												className: styles.toggle,
+												disabled: installing === entry.moduleName,
+												onClick: () => startJob("", updateCheck.migrate.to, "github", "plugin", false),
+											}, installing === entry.moduleName ? t("installing") : t("migrateBtn"))))
+									: null,
 								updateCheck !== null && updateCheck.status === "ready"
 									? (updateCheck.error
 										? el("p", { className: styles.status, "data-error": "true" }, t("updateCheckFailed") + "：" + updateCheck.error)
@@ -2292,7 +2398,13 @@ window.__ModuleLoader__.load({
 					}
 					return el("li", { key: entry.entryId, className: styles.row },
 						el("div", { className: styles.rowTop },
-							el("strong", { className: styles.name, title: entry.moduleName }, moduleShortName(entry.moduleName)),
+							el("strong", { className: styles.name, title: entry.moduleName }, (() => {
+								const famRoot = famRootOf(entry);
+								const mn = String(entry.moduleName ?? "");
+								return famRoot !== null && (familyCounts.get(famRoot) ?? 0) > 1 && mn.startsWith(famRoot + "/")
+									? mn.slice(famRoot.length + 1)
+									: moduleShortName(entry.moduleName);
+							})()),
 							el("span", { className: styles.tag, "data-enabled": entry.enabled ? "true" : "false" },
 								t(entry.enabled ? "enabledTag" : "disabledTag")),
 							entry.extra === true ? el("span", { className: styles.tag, "data-user": "true" }, t("extraTag")) : null,
@@ -2338,7 +2450,7 @@ window.__ModuleLoader__.load({
 															setMessage(t("deleteBundleNote") + "：" + (data.packageName ?? "") + (data.uninstallError ? "（包卸载警告：" + data.uninstallError + "）" : ""));
 															setRestartHint(true);
 														} else {
-															setMessage(t("deleteNote") + "：" + (data.packageName ?? "") + (data.uninstallError ? "（包卸载警告：" + data.uninstallError + "）" : ""));
+															setMessage(t("deleteNote") + "：" + (data.packageName ?? "") + (data.note ? "；" + data.note : "") + (data.uninstallError ? "（包卸载警告：" + data.uninstallError + "）" : ""));
 															setTimeout(refresh, 1500);
 														}
 													},
@@ -2366,8 +2478,72 @@ window.__ModuleLoader__.load({
 						),
 						detailPanel,
 					);
-				})
-				: [];
+				});
+			// 全家桶组头：聚合包（同根包 ≥2 行）合并展示为一个「web 包」卡片
+			const familyHeaders = [];
+			const familySeen = new Set();
+			for (const entry of filteredEntries) {
+				const root = famRootOf(entry);
+				if (root === null || (familyCounts.get(root) ?? 0) <= 1 || familySeen.has(root)) continue;
+				familySeen.add(root);
+				familyHeaders.push(el("div", { key: "family-" + root, className: styles.detail, style: { border: "1px solid var(--dsw-alias-state-business-primary)", borderRadius: 10, padding: "8px 12px", gridColumn: "1 / -1" } },
+					el("div", { className: styles.rowTop, style: { alignItems: "center" } },
+						el("strong", { className: styles.name, style: { flex: "0 1 auto", minWidth: 0, whiteSpace: "nowrap", overflow: "hidden", textOverflow: "ellipsis" }, title: root }, root.replace(/^@[^/]+\//u, "").replace(/^dsh-/u, "")),
+						el("span", { className: styles.tag, "data-user": "true" }, t("familyTag") + " · " + (familyCounts.get(root) ?? 0) + " " + t("familySubs")),
+						el("button", {
+							type: "button",
+							className: styles.toggle,
+							style: { whiteSpace: "nowrap", flexShrink: 0 },
+							onClick: () => setFamilyCollapsed((prev) => ({ ...prev, [root]: prev[root] !== true })),
+						}, familyCollapsed[root] === true ? "▸ " + t("familyExpand") : "▾ " + t("familyCollapse")),
+						el("button", {
+							type: "button",
+							className: styles.toggle,
+							style: { whiteSpace: "nowrap", flexShrink: 0 },
+							onClick: () => {
+								setMessage(t("checkingUpdate"));
+								call("/plugin-console/check-update", { packageName: root }).then(
+									(d) => setMessage(t("familyUpdate") + "：" + root + " " + (d?.latest ?? "?") + (d?.migrate && d.migrate.compatible ? " → " + d.migrate.to + " v" + d.migrate.latest : "") + (d?.error ? "（" + d.error + "）" : "")),
+									(e) => setMessage(t("failed") + "：" + friendlyGithubError(e).message),
+								);
+							},
+						}, t("familyCheckUpdate")),
+						el("button", {
+							type: "button",
+							className: styles.toggle,
+							style: { whiteSpace: "nowrap", flexShrink: 0 },
+							title: t("familyUnlockAllTip"),
+							onClick: () => {
+								if (!window.confirm(t("familyUnlockAllConfirm"))) return;
+								call("/plugin-console/adapt-unlock-all", { root }).then(
+									(d) => {
+										setMessage(t("familyUnlockAllDone") + "：" + (d.unlocked ?? []).length + " 行" + (Array.isArray(d.kept) && d.kept.length > 0 ? "；保留 " + d.kept.length + " 行（未通过校验）" : ""));
+										window.setTimeout(() => window.location.reload(), 1500);
+									},
+									(e) => setMessage(t("failed") + "：" + friendlyGithubError(e).message),
+								);
+							},
+						}, t("familyUnlockAll")))
+				));
+			}
+			// 组头放到最底部：普通条目在前，全家桶（组头+子包卡片）整体在后
+			const nonFamilyCards = [];
+			const familySections = new Map();
+			familyCards.forEach((card, i) => {
+				const e = filteredEntries[i];
+				if (e === undefined) { nonFamilyCards.push(card); return; }
+				const root = famRootOf(e);
+				if (root === null || (familyCounts.get(root) ?? 0) <= 1) { nonFamilyCards.push(card); return; }
+				if (!familySections.has(root)) familySections.set(root, { head: familyHeaders.find((h) => h && h.key === "family-" + root) ?? null, cards: [] });
+				familySections.get(root).cards.push(card);
+			});
+			const familySectionEls = [];
+			for (const [, section] of familySections) {
+				if (section.head !== null) familySectionEls.push(section.head);
+				const root = section.head !== null ? section.head.key.slice("family-".length) : null;
+				if (root === null || familyCollapsed[root] !== true) familySectionEls.push(...section.cards);
+			}
+			const rows = state.status === "ready" ? [...nonFamilyCards, ...familySectionEls] : [];
 			const marketShown = market === null || market.status !== "ready"
 				? []
 				: officialOnly

package/lib/index.js

@@ -132,8 +132,8 @@ const FIBER_PHASE = {
  * （有入口）都是这样安装的，当作插件条目 insert 会漏掉它们的 bundle 补丁。 */
 async function detectBundleOnly(profileDir, packageName) {
   try {
-    const require = createRequire(join(profileDir, 'package.json'))
-    const pkgPath = require.resolve(`${packageName}/package.json`)
+    const pkgPath = resolvePackageJson(packageName, profileDir)
+    if (pkgPath === null) throw new Error('not found')
     const pkg = JSON.parse(await readFile(pkgPath, 'utf8'))
     return typeof pkg.dsh?.bundle?.patch === 'string'
   } catch {
@@ -158,6 +158,37 @@ async function addBundleToManifest(profileDir, packageName) {
 /** 官方 profile 模板自带的 bundle（其余 bundle 视为用户额外添加）。 */
 const DEFAULT_BUNDLES = ['@deepseek-ai/dsh-base', '@deepseek-ai/dsh-web-app']
 
+/** 包名归一：支持子路径导出形式（@linxin666/dsh-web-all/settings → @linxin666/dsh-web-all）。 */
+function packageNameOf(moduleName) {
+  if (typeof moduleName !== 'string') return moduleName
+  const m = moduleName.match(/^(@[^/]+\/[^/]+)(?:\/.*)?$/u)
+  return m ? m[1] : moduleName
+}
+
+/** 把 file:// URL（如 ctx.baseUrl）转成目录路径（resolve 用）。 */
+function baseDirOf(baseUrl) {
+  try {
+    if (typeof baseUrl === 'string' && baseUrl.startsWith('file:')) return dirname(fileURLToPath(baseUrl))
+  } catch {}
+  return typeof baseUrl === 'string' && baseUrl !== '' ? baseUrl : '.'
+}
+
+/**
+ * 解析包 package.json 的绝对路径（exports 限制包 fallback）：
+ * require.resolve('pkg/package.json') 对声明了 exports 且不含 './package.json' 的包会抛错
+ * （2026-09-04 教训：@openviking/dsh-memory-plugin 因此被 heal 误判模块缺失并自动禁用）——
+ * fallback 直接查 node_modules 物理路径。
+ */
+function resolvePackageJson(pkgName, baseDir) {
+  const name = packageNameOf(pkgName)
+  try {
+    return createRequire(join(baseDir, 'package.json')).resolve(`${name}/package.json`)
+  } catch {}
+  const parts = String(name).split('/')
+  const candidate = join(baseDir, 'node_modules', ...parts, 'package.json')
+  return existsSync(candidate) ? candidate : null
+}
+
 /** 已加载插件的包元信息缓存（安装日期/版本/仓库），60 秒 TTL。 */
 const pkgMetaCache = new Map()
 const PKG_META_TTL = 60000
@@ -167,8 +198,8 @@ function entryPkgMeta(moduleName, baseUrl) {
   if (hit !== undefined && Date.now() - hit.at < PKG_META_TTL) return hit
   const meta = { at: Date.now(), installDate: null, version: null, repository: null }
   try {
-    const require = createRequire(baseUrl)
-    const pkgPath = require.resolve(`${moduleName}/package.json`)
+    const pkgPath = resolvePackageJson(moduleName, baseDirOf(baseUrl))
+    if (pkgPath === null) throw new Error('not found')
     const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
     // 安装日期：优先 curl 通道写入的 .dsh-installed-at 标记（真实安装时刻）；
     // 否则用 package.json 的 mtime，但 npm tarball 会把文件时间固定为 1985-10-26
@@ -293,19 +324,69 @@ function semverRangeMatchLoose(versionText, rangeText) {
   return semverRangeMatch(`${v.major}.${v.minor}.${v.patch}`, rangeText)
 }
 
+/**
+ * 扫描已安装包源码，检测对已删除的 dsh-settings API 的引用
+ * （2026-09-04 教训：0.1.2-rc.1 起 settingsNamespace / installSettingsSection 已删除，
+ * 静态声明检查判 pass 是假通过；真实兼容性只有模块 import 时见分晓，而 loader 单行失败
+ * = 整个服务启动崩溃）。返回命中的符号列表，空数组 = 干净。
+ */
+function scanSettingsApiUsage(pkgDir) {
+  const found = []
+  const seen = new Set()
+  const walk = (dir, depth) => {
+    if (depth > 3) return
+    let entries = []
+    try { entries = readdirSync(dir, { withFileTypes: true }) } catch { return }
+    for (const entry of entries) {
+      const full = join(dir, entry.name)
+      if (entry.isDirectory()) {
+        if (entry.name === 'node_modules' || entry.name.startsWith('.')) continue
+        walk(full, depth + 1)
+        continue
+      }
+      if (!entry.isFile() || !/\.(?:js|mjs|cjs)$/u.test(entry.name)) continue
+      if (seen.has(full)) continue
+      seen.add(full)
+      if (seen.size > 120) return
+      try {
+        const text = readFileSync(full, 'utf8').slice(0, 400000)
+        for (const sym of ['settingsNamespace', 'installSettingsSection']) {
+          if (text.includes(sym) && !found.includes(sym)) found.push(sym)
+        }
+      } catch {}
+    }
+  }
+  walk(pkgDir, 0)
+  return found
+}
+
 /**
  * 插件-框架兼容校验（框架升级适配门）：
  * 1) 显式兼容声明（dsh.engines.framework / dsh.compat.framework / engines.dsh）：以声明为准；
- * 2) 否则扫描依赖/peerDeps 的 @deepseek-ai/*：任一范围明确不含框架版本 → fail；
- * 3) 无声明且依赖全部满足 → unknown（新版变动不大；由调用方在「版本已变化」前提下降级为放行）。
+ * 2) 扫描依赖/peerDeps 的 @deepseek-ai/*：任一范围明确不含框架版本 → fail；
+ * 3) 【硬判据】提供 pkgDir 时扫描包源码：命中已删除的 dsh-settings API
+ *    （settingsNamespace / installSettingsSection）→ 直接 fail（2026-09-04 教训：
+ *    0.3.6 全家仍引用旧 API，静态声明/依赖检查判 pass 是假通过，loader 单行失败 = 服务崩溃）；
+ * 4) 无声明且依赖全部满足 → unknown（新版变动不大；由调用方在「版本已变化」前提下放行）。
  * 返回 { decision: 'pass'|'fail'|'unknown', reason }。
  */
-function checkPluginFrameworkCompat(pkg, frameworkVersion) {
+function checkPluginFrameworkCompat(pkg, frameworkVersion, pkgDir = null) {
   const declared = pkg?.dsh?.engines?.framework ?? pkg?.dsh?.compat?.framework ?? pkg?.engines?.dsh ?? null
   if (typeof declared === 'string' && declared !== '') {
-    return semverRangeMatchLoose(frameworkVersion, declared)
-      ? { decision: 'pass', reason: `声明兼容范围 ${declared} 满足框架 ${frameworkVersion}` }
-      : { decision: 'fail', reason: `声明兼容范围 ${declared} 不满足当前框架 ${frameworkVersion}` }
+    const ok = semverRangeMatchLoose(frameworkVersion, declared)
+    if (!ok) return { decision: 'fail', reason: `声明兼容范围 ${declared} 不满足当前框架 ${frameworkVersion}` }
+  }
+  // 硬判据：实际源码扫描（比声明/依赖更接近真实兼容性）
+  if (pkgDir !== null && typeof pkgDir === 'string' && semverRangeMatchLoose(frameworkVersion, '>=0.1.2')) {
+    const broken = scanSettingsApiUsage(pkgDir)
+    if (broken.length > 0) {
+      return { decision: 'fail', reason: `源码仍引用 0.1.2 起已删除的 dsh-settings API（${broken.join('、')}）——实际不兼容，启用会让整个服务启动崩溃` }
+    }
+    if (typeof declared === 'string' && declared !== '') return { decision: 'pass', reason: `声明兼容范围 ${declared} 满足框架 ${frameworkVersion}，且源码无已删除 API 引用` }
+    // 源码扫描干净 = 权威判据：依赖范围可能滞后旧版（"假拒绝"），不作为 fail。
+    return { decision: 'unknown', reason: '源码扫描无已删除 API 引用（声明/依赖范围为参考，不作为不兼容判据）' }
+  } else if (typeof declared === 'string' && declared !== '') {
+    return { decision: 'pass', reason: `声明兼容范围 ${declared} 满足框架 ${frameworkVersion}` }
   }
   const deps = { ...(pkg?.dependencies ?? {}), ...(pkg?.peerDependencies ?? {}), ...(pkg?.optionalDependencies ?? {}) }
   const hits = Object.entries(deps).filter(([name]) => /^@deepseek-ai\//u.test(name))
@@ -326,8 +407,8 @@ async function readExtraBundleRows(profileDir) {
     for (const pkg of bundles) {
       if (DEFAULT_BUNDLES.includes(pkg)) continue
       try {
-        const require = createRequire(join(profileDir, 'package.json'))
-        const dir = dirname(require.resolve(`${pkg}/package.json`))
+        const pk = resolvePackageJson(pkg, profileDir)
+        const dir = dirname(pk ?? join(profileDir, 'node_modules', ...String(pkg).split('/'), 'package.json'))
         const text = await readFile(join(dir, 'cordis.patch.yml'), 'utf8')
         const lines = text.split(/\r?\n/u)
         let inInsert = false
@@ -415,8 +496,8 @@ async function readExtraBundleOwners(profileDir) {
     for (const pkg of bundles) {
       if (DEFAULT_BUNDLES.includes(pkg)) continue
       try {
-        const require = createRequire(join(profileDir, 'package.json'))
-        const dir = dirname(require.resolve(`${pkg}/package.json`))
+        const pk = resolvePackageJson(pkg, profileDir)
+        const dir = dirname(pk ?? join(profileDir, 'node_modules', ...String(pkg).split('/'), 'package.json'))
         const text = await readFile(join(dir, 'cordis.patch.yml'), 'utf8')
         const lines = text.split(/\r?\n/u)
         let inInsert = false
@@ -802,6 +883,119 @@ const FRAMEWORK_STATE_FILE = () => join(dshHome(), 'plugin-console', 'framework-
 const FRAMEWORK_BACKUP_ROOT = () => join(dshHome(), 'plugin-console', 'framework-backups')
 const COMPAT_PENDING_FILE = () => join(dshHome(), 'plugin-console', 'compat-pending.json')
 
+/** 框架核心行：误禁用会导致启动失败（2026-09-04 session-persistence-jsonl 事故：6 行 pending、
+ * 启动断言失败）。任何补丁写入（适配门/脚本/工具）都禁止禁用这些行；自愈机制自动恢复误禁。 */
+const CORE_PATCH_ROW_IDS = new Set([
+  'session-persistence-jsonl', 'webserver', 'timer', 'hmr', 'session', 'session-checkpoint-policy',
+  'message-feedback', 'workspace', 'storage', 'storage-json', 'storage-domain', 'api-gateway',
+  'api-session-controller', 'api-workspace-controller', 'credentials', 'settings', 'attachment-local',
+  'subprocess', 'sandbox', 'sandbox-policy', 'shell-env', 'agent', 'agent-loop', 'llm', 'web-runtime', 'web-startup',
+])
+
+let patchHealAt = null
+let patchHealReport = null
+
+/** 解析用户补丁中 insert 块的 id → moduleName（name 字段）。 */
+function parseInsertNames(text) {
+  const map = new Map()
+  const lines = text.split(/\r?\n/u)
+  let inInsert = false
+  let curId = null
+  for (const line of lines) {
+    if (/^- insert:\s*$/u.test(line)) { inInsert = true; curId = null; continue }
+    if (inInsert && /^- /u.test(line)) inInsert = false
+    if (inInsert) {
+      const idMatch = line.match(/^\s+- id: ([A-Za-z0-9_.-]+)/u)
+      if (idMatch) { curId = idMatch[1]; continue }
+      if (curId !== null) {
+        const nameMatch = line.match(/^\s+name: ['"]([^'"]+)['"]/u)
+        if (nameMatch) { map.set(curId, nameMatch[1]); curId = null }
+      }
+    }
+  }
+  return map
+}
+
+/**
+ * 补丁安全自愈（服务永不崩机制）：
+ * ① 核心行被误禁用 → 自动移除禁用块恢复；
+ * ② 启用态用户 insert 行的模块缺失（如引用未安装包的行）→ 自动禁用（loader 对缺失模块会致命崩溃）。
+ * return { healed:[], autoDisabled:[], healedAt } —— healedAt=0 表示本次无修改。
+ */
+async function healPatchSafety(patchPath) {
+  const profileDir = dirname(patchPath)
+  const { text } = await readPatchState(patchPath)
+  let next = text
+  const healed = []
+  const autoDisabled = []
+  for (const id of CORE_PATCH_ROW_IDS) {
+    const re = new RegExp(`^- id: ${escapeRegExp(id)}\\s*\\r?\\n {2}disabled: true\\s*\\r?\\n`, 'mu')
+    if (re.test(next)) {
+      next = next.replace(re, '')
+      healed.push(id)
+    }
+  }
+  if (healed.length === 0) {
+    const insertNames = parseInsertNames(next)
+    let require = null
+    for (const [id, moduleName] of insertNames) {
+      if (!moduleName || moduleName.startsWith('cordis:')) continue
+      let ok = true
+      try { ok = resolvePackageJson(moduleName, profileDir) !== null } catch { ok = false }
+      if (!ok && !new RegExp(`^- id: ${escapeRegExp(id)}\\s*\\r?\\n {2}disabled: true\\s*\\r?\\n`, 'mu').test(next)) {
+        next = `${next.trimEnd()}\n- id: ${id}\n  disabled: true\n`
+        autoDisabled.push(id)
+      }
+    }
+  }
+  if (next !== text) {
+    await writeFile(patchPath, sanitizePatchText(next), 'utf8')
+  }
+  return { healed, autoDisabled, healedAt: next !== text ? Date.now() : 0 }
+}
+
+/**
+ * 启用前冒烟检查（服务永不崩机制）：在独立子进程中动态 import 插件主模块，
+ * 捕获 loader 会遇到的 import/resolution 错误（SyntaxError、缺失导出、模块缺失）。
+ * 子进程失败不影响控制台；探测失败/超时按"不通过"处理（宁可拒绝，不冒险拖崩服务）。
+ */
+function probePluginImport(moduleName, profileDir) {
+  return new Promise((resolve) => {
+    const script = [
+      'import { createRequire } from "node:module";',
+      'import path from "node:path";',
+      'try {',
+      '  const req = createRequire(path.join(process.argv[1], "package.json"));',
+      '  const mainPath = req.resolve(process.argv[2]);',
+      '  const { pathToFileURL } = await import("node:url");',
+      '  await import(pathToFileURL(mainPath).href);',
+      '  console.log("PROBE_OK");',
+      '} catch (e) { console.log("PROBE_ERR:" + String(e && e.message ? e.message : e).slice(0, 400)); process.exitCode = 1; }',
+    ].join('\n')
+    let child = null
+    try {
+      child = spawn(process.execPath, ['--input-type=module', '-e', script, profileDir, moduleName], { windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'] })
+    } catch {
+      resolve({ ok: true, detail: 'probe 无法启动（放行）' })
+      return
+    }
+    let out = ''
+    let timer = null
+    const finish = (ok, detail) => {
+      if (timer !== null) clearTimeout(timer)
+      resolve({ ok, detail })
+    }
+    timer = setTimeout(() => { try { child.kill() } catch {}; finish(false, '探测超时') }, 8000)
+    child.stdout.on('data', (c) => { out += c })
+    child.stderr.on('data', (c) => { out += c })
+    child.on('error', () => finish(true, 'probe 进程错误（放行）'))
+    child.on('close', (code) => {
+      if (out.includes('PROBE_OK')) finish(true, 'import OK')
+      else finish(false, (out.match(/PROBE_ERR:([^\n]*)/u)?.[1] ?? out.slice(0, 300)).trim())
+    })
+  })
+}
+
 /** 读取框架升级适配门清单（compat-pending.json）；损坏/缺失返回 null。 */
 function readCompatPending() {
   try { return JSON.parse(readFileSync(COMPAT_PENDING_FILE(), 'utf8')) } catch { return null }
@@ -996,11 +1190,11 @@ function summarizeReadme(text) {
 async function readPluginDetails(moduleName, baseUrl) {
   if (typeof moduleName !== 'string' || moduleName.startsWith('cordis:')) return { meta: null, readme: null }
   try {
-    const require = createRequire(baseUrl)
-    const pkgPath = require.resolve(`${moduleName}/package.json`)
+    const pkgPath = resolvePackageJson(moduleName, baseDirOf(baseUrl))
+    if (pkgPath === null) throw new Error('not found')
     const pkg = JSON.parse(await readFile(pkgPath, 'utf8'))
     const meta = {
-      name: pkg.name ?? moduleName,
+      name: moduleName,
       version: pkg.version ?? null,
       description: pkg.description ?? null,
       homepage: pkg.homepage ?? null,
@@ -1485,56 +1679,114 @@ async function fetchSkillMeta(repo, branch, skillDir) {
  * 全部条目并发 + raw 主站与镜像双通道竞速，单条 4 秒封顶。
  * 聚合仓库（根包 private+workspaces）额外检查子包是否有 dsh.bundle 清单：
  * 任一子包可 `dsh plugin add` 直装 → aggregateInstallable = true（★ 筛选会包含它）。 */
-async function enrichItems(items) {
-  return Promise.all(items.map(async (item) => {
-    let official = null
-    let aggregate = false
-    let aggregateInstallable = false
-    let hasSkill = false
-    let hasSuite = false
-    try {
-      const branch = item.defaultBranch ?? 'main'
-      const base = `https://raw.githubusercontent.com/${item.fullName}/${encodeURIComponent(branch)}/package.json`
-      const [pkgResult, skillResult, suiteResult] = await Promise.allSettled([
-        Promise.any([
-          curlText(base, 4000),
-          curlText(`https://ghproxy.net/${base}`, 4000),
-        ]),
-        detectSkillRepo(item.fullName, branch),
-        rawTextWithFallback(item.fullName, branch, '.gitmodules'),
-      ])
-      if (suiteResult.status === 'fulfilled' && suiteResult.value !== null) {
-        hasSuite = true
-      }
-      if (pkgResult.status === 'fulfilled') {
-        const pkg = JSON.parse(pkgResult.value)
-        if (typeof pkg.dsh?.bundle?.patch === 'string') {
-          official = true
-        } else if (pkg.private === true && (Array.isArray(pkg.workspaces) || /(^|-)dsh[-/]/u.test(String(pkg.name ?? '')))) {
-          aggregate = true
-          try {
-            const tree = await curlJson(`https://api.github.com/repos/${item.fullName}/git/trees/${encodeURIComponent(branch)}?recursive=1`, 6000)
-            const pkgPaths = (tree.tree ?? [])
-              .filter((n) => n.type === 'blob' && /^packages\/[^/]+\/package\.json$/u.test(n.path))
-              .map((n) => n.path)
-              .slice(0, 12)
-            if (pkgPaths.length > 0) {
-              const subs = await Promise.all(pkgPaths.map((p) => curlText(`https://raw.githubusercontent.com/${item.fullName}/${encodeURIComponent(branch)}/${p}`, 4000)
-                .then((t) => { try { return JSON.parse(t) } catch { return null } })
-                .catch(() => null)))
-              if (subs.some((sp) => sp && typeof sp.dsh?.bundle?.patch === 'string')) {
-                aggregateInstallable = true
-              }
+const ENRICH_CACHE_FILE = () => join(dshHome(), 'plugin-console', 'enrich-cache.json')
+const ENRICH_CACHE_TTL = 24 * 60 * 60 * 1000
+
+function readEnrichCache() {
+  try {
+    const j = JSON.parse(readFileSync(ENRICH_CACHE_FILE(), 'utf8'))
+    return j !== null && typeof j === 'object' ? j : {}
+  } catch { return {} }
+}
+function writeEnrichCache(cache) {
+  try {
+    mkdirSync(dirname(ENRICH_CACHE_FILE()), { recursive: true })
+    const entries = Object.entries(cache).sort((a, b) => (b[1]?.at ?? 0) - (a[1]?.at ?? 0)).slice(0, 2000)
+    writeFileSync(ENRICH_CACHE_FILE(), JSON.stringify(Object.fromEntries(entries), null, 2), 'utf8')
+  } catch {}
+}
+
+/** 单项识别：官方通道 / 聚合仓库 / 技能 / 套装（失败返回 official=null）。 */
+async function enrichItemOne(item) {
+  let official = /^deepseek-ai\//u.test(item.fullName ?? '') ? true : null
+  let aggregate = false
+  let aggregateInstallable = false
+  let hasSkill = false
+  let hasSuite = false
+  try {
+    const branch = item.defaultBranch ?? 'main'
+    const base = `https://raw.githubusercontent.com/${item.fullName}/${encodeURIComponent(branch)}/package.json`
+    const [pkgResult, skillResult, suiteResult] = await Promise.allSettled([
+      Promise.any([
+        curlText(base, 4000),
+        curlText(`https://ghproxy.net/${base}`, 4000),
+      ]),
+      detectSkillRepo(item.fullName, branch),
+      rawTextWithFallback(item.fullName, branch, '.gitmodules'),
+    ])
+    if (suiteResult.status === 'fulfilled' && suiteResult.value !== null) {
+      hasSuite = true
+    }
+    if (pkgResult.status === 'fulfilled') {
+      const pkg = JSON.parse(pkgResult.value)
+      if (typeof pkg.dsh?.bundle?.patch === 'string') {
+        official = true
+      } else if (pkg.private === true && (Array.isArray(pkg.workspaces) || /(^|-)dsh[-/]/u.test(String(pkg.name ?? '')))) {
+        aggregate = true
+        try {
+          const tree = await curlJson(`https://api.github.com/repos/${item.fullName}/git/trees/${encodeURIComponent(branch)}?recursive=1`, 6000)
+          const pkgPaths = (tree.tree ?? [])
+            .filter((n) => n.type === 'blob' && /^packages\/[^/]+\/package\.json$/u.test(n.path))
+            .map((n) => n.path)
+            .slice(0, 12)
+          if (pkgPaths.length > 0) {
+            const subs = await Promise.all(pkgPaths.map((p) => curlText(`https://raw.githubusercontent.com/${item.fullName}/${encodeURIComponent(branch)}/${p}`, 4000)
+              .then((t) => { try { return JSON.parse(t) } catch { return null } })
+              .catch(() => null)))
+            if (subs.some((sp) => sp && typeof sp.dsh?.bundle?.patch === 'string')) {
+              aggregateInstallable = true
             }
-          } catch {}
-        }
+          }
+        } catch {}
       }
-      if (skillResult.status === 'fulfilled' && skillResult.value?.hasSkill === true) {
-        hasSkill = true
+    }
+    if (skillResult.status === 'fulfilled' && skillResult.value?.hasSkill === true) {
+      hasSkill = true
+    }
+  } catch {}
+  return { ...item, official, aggregate, aggregateInstallable, hasSkill, hasSuite }
+}
+
+/**
+ * 批量识别（★ 筛选数据源）：并发限流 + 24h 结果缓存。
+ * 网络黑洞期（raw.githubusercontent 大部分拉取失败）自动回退缓存中的上次判定，
+ * 保证「只看官方」不因瞬时网络而坍缩成 0/1 条。
+ */
+async function enrichItems(items) {
+  const cache = readEnrichCache()
+  const out = new Array(items.length)
+  let next = 0
+  let cacheDirty = false
+  async function worker() {
+    while (true) {
+      const i = next
+      next += 1
+      if (i >= items.length) return
+      const item = items[i]
+      const key = `${item.fullName}@${item.defaultBranch ?? 'main'}`
+      const cached = cache[key]
+      try {
+        if (cached !== undefined && typeof cached?.at === 'number' && Date.now() - cached.at < ENRICH_CACHE_TTL && cached.data && (cached.data.official !== null || item.fullName.startsWith('deepseek-ai/'))) {
+          out[i] = { ...item, ...cached.data }
+          continue
+        }
+        let result = await enrichItemOne(item)
+        // 本次失败 → 回退缓存（哪怕已过期），避免「看天吃饭」
+        if ((result.official === null && !/^deepseek-ai\//u.test(item.fullName ?? '')) && cached?.data) {
+          result = { ...item, ...cached.data }
+        } else {
+          cache[key] = { at: Date.now(), data: { official: result.official, aggregate: result.aggregate, aggregateInstallable: result.aggregateInstallable, hasSkill: result.hasSkill, hasSuite: result.hasSuite } }
+          cacheDirty = true
+        }
+        out[i] = result
+      } catch {
+        out[i] = cached?.data ? { ...item, ...cached.data } : { ...item, official: null, aggregate: false, aggregateInstallable: false, hasSkill: false, hasSuite: false }
       }
-    } catch {}
-    return { ...item, official, aggregate, aggregateInstallable, hasSkill, hasSuite }
-  }))
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(12, items.length) }, worker))
+  if (cacheDirty) writeEnrichCache(cache)
+  return out
 }
 
 function githubRepoInfo(repo) {
@@ -3396,14 +3648,17 @@ async function maybeAutoAdaptCompat({ profileDir, packageName, syncedNames, patc
   const kept = []
   for (const p of targets) {
     let pkg = null
+    let pkgDir = null
     try {
-      const require = createRequire(join(profileDir, 'package.json'))
-      const pkgPath = require.resolve(`${p.moduleName}/package.json`)
-      pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
+      const pkgPath = resolvePackageJson(p.moduleName, profileDir)
+      if (pkgPath !== null) {
+        pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
+        pkgDir = dirname(pkgPath)
+      }
     } catch {}
     const version = typeof pkg?.version === 'string' ? pkg.version : null
     const changed = version !== null && version !== p.version
-    const check = pkg !== null ? checkPluginFrameworkCompat(pkg, fwVer) : { decision: 'unknown', reason: '无法读取包信息' }
+    const check = pkg !== null ? checkPluginFrameworkCompat(pkg, fwVer, pkgDir) : { decision: 'unknown', reason: '无法读取包信息' }
     if (changed && check.decision !== 'fail') {
       try { await removeDisableBlock(patchPath, p.rowId) } catch {}
       p.status = 'adopted'
@@ -3433,8 +3688,8 @@ async function frameworkCompatReportFor(source, ctx, profileDir) {
   const isNpm = norm.startsWith('@') || !norm.includes('/')
   const installed = (() => {
     try {
-      const require = createRequire(join(profileDir, 'package.json'))
-      const pkgPath = require.resolve(`${norm}/package.json`)
+      const pkgPath = resolvePackageJson(norm, profileDir)
+      if (pkgPath === null) return null
       return JSON.parse(readFileSync(pkgPath, 'utf8')).version ?? null
     } catch { return null }
   })()
@@ -3833,6 +4088,17 @@ async function handle(ctx, req, res) {
   if (method === 'GET' && pathname === `${ROUTE_PREFIX}/state`) {
     const patchPath = findPatchPath(ctx)
     const patch = await readPatchState(patchPath)
+    // 补丁安全自愈（核心行误禁用恢复 / 缺失模块行自动禁用）——每 2 分钟最多跑一次
+    let patchHeal = null
+    try {
+      if (patchHealAt === null || Date.now() - patchHealAt > 120000) {
+        patchHealAt = Date.now()
+        patchHeal = await healPatchSafety(patchPath)
+      } else {
+        patchHeal = patchHealReport
+      }
+      if (patchHeal !== null) patchHealReport = patchHeal
+    } catch {}
     const extraRows = await readExtraBundleRows(dirname(patchPath))
     const compatPending = readCompatPending()
     const compatPendingRows = new Set((compatPending?.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => p.rowId))
@@ -3868,7 +4134,7 @@ async function handle(ctx, req, res) {
       const selfPkg = JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json'), 'utf8'))
       selfVersion = typeof selfPkg.version === 'string' ? selfPkg.version : null
     } catch {}
-    sendJson(res, 200, { ok: true, entries, patchPath, compat, installJobs: jobs, recentFailures, github: { loggedIn: auth.loggedIn, login: auth.login }, patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts }, framework, compatPending: compatPending === null ? null : { frameworkVersion: compatPending.frameworkVersion ?? null, upgradeFrom: compatPending.upgradeFrom ?? null, pending: (compatPending.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => ({ rowId: p.rowId, moduleName: p.moduleName, version: p.version ?? null })) }, rollback: rollbackRec, selfVersion, components: findComponents().map((c) => ({ id: c.id, name: c.name, kind: c.kind ?? 'server', pid: c.pid ?? null, port: c.port ?? null, healthUrl: c.healthUrl ?? null, uiUrl: compUiUrl(c), autoStart: c.autoStart === true })) })
+    sendJson(res, 200, { ok: true, entries, patchPath, compat, installJobs: jobs, recentFailures, github: { loggedIn: auth.loggedIn, login: auth.login }, patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts }, framework, patchHeal: patchHeal === null ? null : { healed: patchHeal.healed ?? [], autoDisabled: patchHeal.autoDisabled ?? [], healedAt: patchHeal.healedAt ?? 0 }, compatPending: compatPending === null ? null : { frameworkVersion: compatPending.frameworkVersion ?? null, upgradeFrom: compatPending.upgradeFrom ?? null, pending: (compatPending.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => ({ rowId: p.rowId, moduleName: p.moduleName, version: p.version ?? null, checkNote: p.checkNote ?? null, check: p.check ?? null })) }, rollback: rollbackRec, selfVersion, components: findComponents().map((c) => ({ id: c.id, name: c.name, kind: c.kind ?? 'server', pid: c.pid ?? null, port: c.port ?? null, healthUrl: c.healthUrl ?? null, uiUrl: compUiUrl(c), autoStart: c.autoStart === true })) })
     return
   }
 
@@ -4070,11 +4336,25 @@ async function handle(ctx, req, res) {
       const compatPending = readCompatPending()
       const pend = (compatPending?.pending ?? []).find((p) => p.rowId === rowId && (p.status ?? 'pending') === 'pending')
       if (pend) {
-        sendError(res, 409, `「${rowId}」仍在框架升级适配门中（${compatPending.frameworkVersion ?? '?'}）被强制禁用：请先点击「更新并适配」，更新完成并通过兼容校验后系统自动解锁`)
+        sendError(res, 409, `「${rowId}」仍在框架升级适配门中（${compatPending.frameworkVersion ?? '?'}）被强制禁用：请先点击「更新并适配 / 已适配，立即解锁」，通过兼容校验后系统自动解锁`)
         return
       }
     }
     const patchPath = findPatchPath(ctx)
+    // 启用前冒烟检查（服务永不崩机制）：第三方模块在独立子进程中试 import，
+    // 失败（SyntaxError/缺失导出/模块缺失）即拒绝启用，杜绝「单行 import 失败→整个服务启动崩溃」
+    if (enabled) {
+      const moduleName = target?.options?.name
+      if (typeof moduleName === 'string' && !moduleName.startsWith('cordis:') && !moduleName.startsWith('@deepseek-ai/')) {
+        try {
+          const probe = await probePluginImport(moduleName, dirname(patchPath))
+          if (probe.ok !== true) {
+            sendError(res, 409, `启用前冒烟检查未通过：模块加载失败（${probe.detail ?? '未知'}）——该插件与当前框架不兼容或依赖缺失，已阻止启用（服务不会再被拖崩）；请先「检测更新/更新并适配」其适配版`)
+            return
+          }
+        } catch {}
+      }
+    }
     const result = enabled
       ? await enableEntry(patchPath, rowId)
       : await disableEntry(patchPath, rowId)
@@ -4110,14 +4390,18 @@ async function handle(ctx, req, res) {
     const owners = await readExtraBundleOwners(profileDir)
     const ownerBundle = owners.get(rowId) ?? owners.get(moduleName)
     if (ownerBundle !== undefined) {
-      await removeBundleFromManifest(profileDir, ownerBundle)
-      let uninstallError = null
-      try {
-        await pnpmRemove(profileDir, ownerBundle)
-      } catch (error) {
-        uninstallError = error instanceof Error ? error.message : String(error)
-      }
-      sendJson(res, 200, { ok: true, removed: 'bundle', packageName: ownerBundle, restart: true, uninstallError })
+      // 2026-09-04 事故教训：删除聚合包子路径行（如 @linxin666/dsh-web-all/plugin-manager）时
+      // 曾把整个 bundle 从清单移除，pnpm 卸载失败（corepack 报错）后重启，全家桶整体消失。
+      // 现改为：任何 bundle 行的「删除」= 仅停用该行（patch disabled:true），bundle 清单不动，
+      // 之后随时可「启用」恢复；整体卸载请走包管理器。
+      await disableEntry(patchPath, rowId)
+      sendJson(res, 200, {
+        ok: true,
+        removed: 'row',
+        packageName: moduleName,
+        restart: false,
+        note: '该行来自聚合包 ' + ownerBundle + '，已仅停用本行（bundle 保留，可随时启用恢复）；整体卸载请用包管理器执行 pnpm remove ' + ownerBundle,
+      })
       return
     }
     if (!patch.inserts.includes(rowId)) {
@@ -4556,11 +4840,105 @@ async function handle(ctx, req, res) {
     return
   }
 
+  if (pathname === `${ROUTE_PREFIX}/adapt-unlock`) {
+    // 待适配行「已适配，立即解锁」：无需等新版本——对已装模块重跑源码扫描，通过即移除禁用块。
+    const rowId = typeof body.rowId === 'string' ? body.rowId : ''
+    if (!/^[A-Za-z0-9_:.-]{1,80}$/u.test(rowId)) {
+      sendError(res, 400, 'rowId 无效')
+      return
+    }
+    const pending = readCompatPending()
+    const entry = (pending?.pending ?? []).find((p) => p.rowId === rowId && (p.status ?? 'pending') === 'pending')
+    if (entry === undefined) {
+      sendError(res, 404, '该行不在适配门待适配清单中（或已解锁）')
+      return
+    }
+    const patchPath = findPatchPath(ctx)
+    const profileDir = dirname(patchPath)
+    let pkg = null
+    let pkgDir = null
+    let version = null
+    try {
+      const require = createRequire(join(profileDir, 'package.json'))
+      const pkgPath = resolvePackageJson(entry.moduleName, profileDir)
+      if (pkgPath !== null) {
+        pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
+        version = typeof pkg?.version === 'string' ? pkg.version : null
+        pkgDir = dirname(pkgPath)
+      }
+    } catch {}
+    const fwVer = typeof pending.frameworkVersion === 'string' ? pending.frameworkVersion : '?'
+    const check = pkg !== null ? checkPluginFrameworkCompat(pkg, fwVer, pkgDir) : { decision: 'unknown', reason: '无法读取包信息' }
+    if (check.decision === 'fail') {
+      sendError(res, 409, `适配校验未通过：${check.reason}`)
+      return
+    }
+    await removeDisableBlock(patchPath, rowId)
+    entry.status = 'adopted'
+    entry.adoptedAt = Date.now()
+    entry.adoptedVersion = version
+    entry.adoptedFramework = fwVer
+    entry.check = check.decision
+    entry.checkNote = check.reason ?? null
+    writeCompatPending(pending)
+    sendJson(res, 200, { ok: true, rowId, adopted: true, check: check.decision, note: check.reason ?? null })
+    return
+  }
+
+  if (pathname === `${ROUTE_PREFIX}/adapt-unlock-all`) {
+    // 全家桶「一键启用已适配」：对家庭内所有待适配行批量重跑源码扫描，通过的全部解锁，未通过保留禁用。
+    const root = typeof body.root === 'string' ? body.root : ''
+    if (!/^(@[a-z0-9-][a-z0-9-._~]*\/)?[a-z0-9-][a-z0-9-._~]*$/u.test(root) || root.length > 214) {
+      sendError(res, 400, 'root 无效')
+      return
+    }
+    const pending = readCompatPending()
+    const patchPath = findPatchPath(ctx)
+    const profileDir = dirname(patchPath)
+    const targets = (pending?.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending' && (p.moduleName === root || String(p.moduleName).startsWith(root + '/')))
+    if (targets.length === 0) {
+      sendError(res, 404, '该全家桶没有待适配行（或已全部解锁）')
+      return
+    }
+    const fwVer = typeof pending.frameworkVersion === 'string' ? pending.frameworkVersion : '?'
+    const unlocked = []
+    const kept = []
+    for (const p of targets) {
+      let pkg = null
+      let pkgDir = null
+      let version = null
+      try {
+        const pkgPath = resolvePackageJson(p.moduleName, profileDir)
+        if (pkgPath !== null) {
+          pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
+          version = typeof pkg?.version === 'string' ? pkg.version : null
+          pkgDir = dirname(pkgPath)
+        }
+      } catch {}
+      const check = pkg !== null ? checkPluginFrameworkCompat(pkg, fwVer, pkgDir) : { decision: 'fail', reason: '无法读取包信息' }
+      if (check.decision === 'fail') {
+        kept.push({ rowId: p.rowId, reason: check.reason })
+        continue
+      }
+      await removeDisableBlock(patchPath, p.rowId)
+      p.status = 'adopted'
+      p.adoptedAt = Date.now()
+      p.adoptedVersion = version
+      p.adoptedFramework = fwVer
+      p.check = check.decision
+      p.checkNote = check.reason ?? null
+      unlocked.push(p.rowId)
+    }
+    writeCompatPending(pending)
+    sendJson(res, 200, { ok: true, root, unlocked, kept })
+    return
+  }
+
   if (pathname === `${ROUTE_PREFIX}/check-update`) {
     // 检测已安装插件是否有新版本：curl registry 元数据取 dist-tags.latest（node 网络黑洞时 curl 可用）。
     // 聚合包（有 dependencies）额外对比子包版本：声明版本 vs 本地 node_modules 实际版本，
     // 返回 depsOutdated 提示"更新本包需同步子包"，避免半更新混搭导致启动冲突。
-    const packageName = typeof body.packageName === 'string' ? body.packageName.trim() : ''
+    const packageName = packageNameOf(typeof body.packageName === 'string' ? body.packageName.trim() : '')
     if (!packageName) {
       sendError(res, 400, 'packageName 不能为空')
       return
@@ -4656,7 +5034,29 @@ async function handle(ctx, req, res) {
         error = `npm registry 查询失败且 GitHub 回退不可用（${fallbackError}；${fbErr instanceof Error ? fbErr.message : String(fbErr)}）`
       }
     }
-    sendJson(res, 200, { ok: true, packageName, latest, next, beta, depsOutdated, error, source })
+    // migrate 换名检测（2026-09-04 缺陷修复）：本地包声明 dsh.migrate.to 时查目标包最新版/引擎声明，
+    // 识别「项目已改名/迁移发布」的更新（如 @linxin666/dsh-web-ui-all → @linxin666/dsh-web-all 0.3.14）
+    let migrate = null
+    try {
+      const localPath = resolvePackageJson(packageName, profileDir)
+      if (localPath !== null) {
+      const localPkg = JSON.parse(readFileSync(localPath, 'utf8'))
+      const to = typeof localPkg.dsh?.migrate?.to === 'string' ? localPkg.dsh.migrate.to : null
+      if (to !== null && to !== '' && to !== packageName) {
+        const encTo = to.startsWith('@')
+          ? `@${encodeURIComponent(to.slice(1).split('/')[0])}%2f${encodeURIComponent(to.split('/').slice(1).join('/'))}`
+          : encodeURIComponent(to)
+        const meta = await fetchJsonUrl(`https://registry.npmmirror.com/${encTo}`)
+        const toLatest = meta?.['dist-tags']?.latest ?? meta?.['dist-tags']?.next ?? null
+        const toPkg = toLatest !== null ? (meta?.versions?.[toLatest] ?? null) : null
+        const engine = toPkg?.dsh?.engines?.dsh ?? toPkg?.engines?.dsh ?? null
+        const fwVer = currentFrameworkVersion(ctx)
+        const compatible = fwVer !== null && (engine === null || semverRangeMatchLoose(fwVer, engine))
+        migrate = { to, latest: toLatest, engine, compatible }
+      }
+      }
+    } catch {}
+    sendJson(res, 200, { ok: true, packageName, latest, next, beta, depsOutdated, error, source, migrate })
     return
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noob-stupid/dsh-plugin-console",
-  "version": "0.3.25",
+  "version": "0.3.27",
   "description": "DSH plugin management panel & marketplace: one-click enable/disable, multi-source market (GitHub/Gitee/custom), static-index market (500+ plugins / 300 skills), skills, suites, and one-click framework upgrade.",
   "repository": {
     "type": "git",