@noob-stupid/dsh-plugin-console 0.3.26 → 0.3.27

package/README.md

@@ -20,23 +20,25 @@
 
 
 
-> ## 🎉 v0.3.25 released — framework-upgrade safety & plugin adapt gate (2026-09-04)
+> ## 🎉 v0.3.27 released — family-bundle cards, never-crash safety & adapt-gate hardening (2026-09-04)
 >
-> **Upgrade safety trio**: framework root detection (fixes the `.pnpm` realpath
-> mixed-version root cause), a **full-tree checkpoint** before upgrade, and
-> **automatic full-tree rollback** on install/relaunch failure — plus a
-> **one-click rollback** button on the framework card.
-> **Plugin adapt gate**: plugins incompatible with the new framework are
-> force-disabled (enable locked); 「Check update → Update & adapt」auto-verifies
-> declarations/dependencies and unlocks on success; AI Empower pre-checks
-> framework compatibility during planning.
+> **Family-bundle cards**: same-root subpath exports (e.g. `@linxin666/dsh-web-all/settings`) auto-group
+> into one family card at the bottom — collapse/expand, batch check-updates, **one-click unlock-adapted**,
+> known-check preview, `web-all/`-prefix-free sub-cards.
+> **Never-crash safety**: pre-enable import probe (child-process) + patch auto-heal (core-row restore &
+> missing-module auto-disable) + exports-fallback `package.json` resolution — the memory-plugin
+> false-disable incident is fixed.
+> **Adapt-gate hardening**: source-scan hard criterion (post-0.3.6 false-pass), migrate detection
+> (`dsh.migrate.to`), softened dependency-strict judgment, pending hints moved into details.
+> **Safe sub-package delete**: deleting a bundle sub-row disables only that row and keeps the bundle —
+> fixing the incident where deleting one sub-package removed the whole family bundle.
 >
 > **Install:**
 > ```bash
 > npm i -g @noob-stupid/dsh-plugin-console
 > # or in DSH: dsh plugin --profile web add @noob-stupid/dsh-plugin-console
 > ```
-> **Try it:** Plugin Console → **AI 赋能** button → enter e.g. `OpenViking` → confirm the plan.
+> **Try it:** Plugin Console → family card at the bottom → 「批量检测更新 / 一键启用已适配」.
 >
 > Feedback: [GitHub Issues](https://github.com/Noob-stupid/dsh-plugin-hub/issues).
 A **plugin management panel** for the DeepSeek Harness (DSH) Web GUI: one-click
@@ -86,6 +88,7 @@ auto-rollback).
 |---|---|---|
 | 🤖 | **AI Empower (v0.3.24)** | Give the console a package name or GitHub repo — the local AI reads docs, drafts a **deployment plan** (install / write config / start service / health check) and executes it safely after your confirmation; server-type components get an automatic control card |
 | 🛡️ | **Framework upgrade safety & adapt gate (v0.3.25)** | Force-disables plugins incompatible with the new framework (enable locked; 「Check update → Update & adapt」auto-verifies and unlocks); full-tree checkpoint before upgrade, automatic rollback on relaunch failure, one-click rollback to the previous version |
+| 🏠 | **Family-bundle cards & safety (v0.3.27)** | Same-root subpath exports group into one family card (collapse/expand, batch check-update, one-click unlock-adapted, known-check preview); never-crash safety (pre-enable import probe + patch auto-heal + exports fallback); adapt-gate source-scan hard criterion & migrate detection; deleting a bundle sub-row disables only that row |
 | 🚀 | **Server component cards** | Left-side floating card auto-aligned to the main panel: start / stop / status / **open Web UI** buttons, multi-server dropdown, collapsible |
 | 🧩 | **Plugin & skill hub** | Auto-collected index of `dsh-plugin` topic repos (**500+** by stars) plus a **Skills tab** (`agent-skills` ∪ `claude-skills` ∪ `dsh-skill`, up to 300) — browse, search, one-click install, no GitHub API calls |
 | 🤖 | **Auto-collection CI** | GitHub Actions reruns `build-index` every 6 hours (manual trigger available); authors just add the `dsh-plugin` / `agent-skills` / `claude-skills` / `dsh-skill` topic — no application needed |

package/README.zh.md

@@ -6,19 +6,23 @@
 
 # DSH 插件中心（dsh-plugin-hub）
 
-> ## 🎉 v0.3.25 正式发布 — 框架升级安全与插件适配门（2026-09-04）
+> ## 🎉 v0.3.27 正式发布 — 全家桶分组卡片、永不崩安全与适配门强化（2026-09-04）
 >
-> **升级安全三件套**：框架安装根识别（修复 `.pnpm` realpath 混版本根因）、升级前**全树 checkpoint**、
-> 拉起失败**自动全树回滚**；升级后框架卡片**一键回滚到上一版**。
-> **插件适配门**：升级后不兼容插件强制禁用（启用锁定），「检测更新 → 更新并适配」→
-> 自动校验声明/依赖，通过即解锁；AI 赋能规划时自动预检框架适配并给出说明。
+> **全家桶分组卡片**：同根包子路径导出（如 `@linxin666/dsh-web-all/settings`）自动聚合为一张
+> 全家桶卡片（列表底部）——收起/展开、批量检测更新、**一键启用已适配**、已知校验预览，子卡剥离
+> `web-all/` 前缀。
+> **永不崩安全**：启用前子进程导入探针 + 补丁自动自愈（核心行恢复/缺失模块自动禁用）+
+> exports 回退 `package.json` 解析——记忆插件被误禁用的事故已修复。
+> **适配门强化**：源码扫描硬判据（0.3.6 假通过教训）、迁移检测（`dsh.migrate.to`）、
+> 依赖严格判定软化、待适配提示移入详情。
+> **子包删除安全**：删除聚合包子行仅停用该行、不动 bundle——修复"删一个子包导致整个全家桶消失"的事故。
 >
 > **安装：**
 > ```bash
 > npm i -g @noob-stupid/dsh-plugin-console
-> # 或在 DSH 中更新：dsh plugin --profile web add @noob-stupid/dsh-plugin-console
+> # 或在 DSH 中：dsh plugin --profile web add @noob-stupid/dsh-plugin-console
 > ```
-> **体验入口：** 插件控制台 → 右上角 **AI 赋能** 按钮 → 输入如 `OpenViking` → 确认计划 → 自动部署。
+> **体验入口：** 插件控制台 → 列表底部全家桶卡片 → 批量检测更新 / 一键启用已适配。
 >
 > 反馈：[GitHub Issues](https://github.com/Noob-stupid/dsh-plugin-hub/issues)。
 
@@ -77,6 +81,7 @@
 |---|---|---|
 | 🤖 | **AI 赋能（v0.3.24）** | 输入 npm 包名 / GitHub 仓库，本地 AI 读文档生成**部署计划**（安装/写配置/启动服务/健康检查），你确认后安全执行；服务器类组件自动生成控制卡片 |
 | 🛡️ | **框架升级适配门与安全（v0.3.25）** | 升级后不兼容插件强制禁用（适配门锁定，「检测更新 → 更新并适配 → 自动校验解锁」）；升级前全树 checkpoint、拉起失败自动全树回滚、框架卡片一键回滚到上一版 |
+| 🏠 | **全家桶分组卡片与安全（v0.3.27）** | 同根包子路径导出自动聚合为一张全家桶卡片（收起/展开、批量检测更新、一键启用已适配、已知校验预览）；永不崩安全（启用前导入探针 + 补丁自愈 + exports 回退）；适配门源码扫描硬判据与迁移检测；删除聚合包子行仅停用该行 |
 | 🚀 | **服务器组件卡片** | 左侧浮卡与主面板顶边对齐：启动 / 停止 / 状态 / 【打开】直达 Web UI，多服务器下拉、可折叠（状态记忆） |
 | 🧩 | **插件 + 技能双市场** | 自动收录 `dsh-plugin` topic 仓库（按 star **500+**），另有**技能 tab**（`agent-skills` ∪ `claude-skills` ∪ `dsh-skill`，最多 300）——浏览、搜索、一键安装，零 GitHub API 调用；插件自带技能（如 openviking-memory）只读展示 |
 | 🤖 | **自动收录 CI** | GitHub Actions 每 6 小时自动重跑 `build-index`（也支持手动触发）；作者只需给自己的仓库打 `dsh-plugin` / `agent-skills` / `claude-skills` / `dsh-skill` 标签，**无需申请、无需审核** |

package/lib/client.js

@@ -104,6 +104,21 @@ window.__ModuleLoader__.load({
 			pendingCompatTag: "待适配",
 			pendingCompatHint: "框架升级后被强制禁用：先点「检测更新」，如有新版按钮会变为「更新并适配」，点击后更新完成自动校验通过即解锁启用",
 			updateAndAdapt: "更新并适配",
+			familyTag: "全家桶",
+			familySubs: "子包",
+			familyUnlockAll: "一键启用已适配",
+			familyUnlockAllTip: "对全家桶内所有源码扫描通过（已适配）的子包批量解锁启用；未通过的保持禁用",
+			familyUnlockAllConfirm: "将对全家桶内所有已适配（源码扫描通过）的子包一键解锁启用？未通过的将保持禁用。",
+			familyUnlockAllDone: "已批量适配解锁",
+			familyExpand: "展开",
+			familyCollapse: "收起",
+			familyUpdate: "全家桶版本检测",
+			familyCheckUpdate: "批量检测更新",
+			adaptUnlockBtn: "已适配，立即解锁",
+			adaptUnlockHint: "已安装版本经源码扫描确认适配当前框架：立即移除禁用块并解锁启用",
+			adaptUnlockDone: "已适配解锁：刷新后该行可正常启用",
+			migrateTip: "项目已迁移（适配当前框架）",
+			migrateBtn: "迁移并适配",
 			aiEmpowerFrameworkCheck: "框架适配检测",
 			userForcedTag: "补丁强制启用",
 			protectedTag: "受保护",
@@ -404,6 +419,21 @@ window.__ModuleLoader__.load({
 			pendingCompatTag: "Pending adapt",
 			pendingCompatHint: "Force-disabled after framework upgrade: click Check update first; if a newer version exists the button becomes Update & adapt - click it and it unlocks automatically after the compat check",
 			updateAndAdapt: "Update & adapt",
+			familyTag: "Family bundle",
+			familySubs: "sub packages",
+			familyUnlockAll: "Unlock all adapted",
+			familyUnlockAllTip: "Batch-unlock every sub package in this family whose source scan passed; failed ones stay disabled",
+			familyUnlockAllConfirm: "Unlock all adapted (source-scan passed) sub packages in this family? Failed ones stay disabled.",
+			familyUnlockAllDone: "Family batch unlock done",
+			familyExpand: "Expand",
+			familyCollapse: "Collapse",
+			familyUpdate: "Family version check",
+			familyCheckUpdate: "Check all",
+			adaptUnlockBtn: "Adapted - unlock now",
+			adaptUnlockHint: "Installed version passed the source scan for the current framework: unlock immediately",
+			adaptUnlockDone: "Unlocked: refresh and the row is enabled",
+			migrateTip: "Project migrated (adapted to the current framework)",
+			migrateBtn: "Migrate & adapt",
 			aiEmpowerFrameworkCheck: "Framework compat check",
 			userForcedTag: "Forced on by patch",
 			protectedTag: "Protected",
@@ -971,10 +1001,12 @@ window.__ModuleLoader__.load({
 		function PluginConsoleTab({ t }) {
 			const [state, setState] = react.useState({ status: "loading" });
 			const [busy, setBusy] = react.useState(null);
+			const [adaptUnlocking, setAdaptUnlocking] = react.useState(null);
 			const [message, setMessage] = react.useState(null);
 			const [reloadHint, setReloadHint] = react.useState(false);
 			const [restartHint, setRestartHint] = react.useState(false);
 			const [jobs, setJobs] = react.useState({});
+			const [familyCollapsed, setFamilyCollapsed] = react.useState({});
 			const [query, setQuery] = react.useState(() => {
 				try { return localStorage.getItem("pc-market-query") ?? ""; } catch { return ""; }
 			});
@@ -2239,13 +2271,31 @@ window.__ModuleLoader__.load({
 					: ((searchSourcesList !== null ? searchSourcesList.find((s) => s.id === source)?.name : undefined) ?? source);
 			const extraIds = new Set((state.status === "ready" ? state.data.patch?.inserts ?? [] : []));
 			const extraCount = state.status === "ready" ? state.data.entries.filter((entry) => entry.extra === true || extraIds.has(entry.rowId)).length : 0;
-			const rows = state.status === "ready"
+			const pkgRootOf = (m) => { const mm = String(m ?? ""); const x = mm.match(/^(@[^/]+\/[^/]+)(?:\/.*)?$/u); return x ? x[1] : mm; };
+			const filteredEntries = state.status === "ready"
 				? state.data.entries.filter((entry) => {
 					if (extraOnly && !(entry.extra === true || extraIds.has(entry.rowId))) return false;
 					if (installedQueryNorm === "") return true;
 					return [entry.moduleName, entry.entryId, entry.rowId]
 						.some((value) => String(value ?? "").toLowerCase().includes(installedQueryNorm));
-				}).map((entry) => {
+				})
+				: [];
+			// 聚合包分组：仅「同根包 + 子路径导出」（web-all 0.3.14 式，moduleName=pkg/sub）→ 全家桶组；
+			// 经典多子包聚合（每子包独立名）不归组。组头与子包卡片一律置于列表【最底部】。
+			const famRootOf = (entry) => {
+				const m = String(entry.moduleName ?? "");
+				if (m.startsWith("@deepseek-ai/")) return null;
+				return pkgRootOf(m);
+			};
+			const familyCounts = new Map();
+			for (const entry of (state.status === "ready" ? state.data.entries : [])) {
+				const root = famRootOf(entry);
+				if (root === null) continue;
+				familyCounts.set(root, (familyCounts.get(root) ?? 0) + 1);
+			}
+			const familyCards = filteredEntries.map((entry) => {
+					const familyRoot = String(entry.moduleName ?? "").startsWith("@deepseek-ai/") ? null : pkgRootOf(entry.moduleName);
+					void familyRoot;
 					const open = details !== null && details.entryId === entry.entryId;
 					let detailPanel = null;
 					if (open) {
@@ -2258,10 +2308,13 @@ window.__ModuleLoader__.load({
 						} else {
 							const meta = details.data.meta;
 							const readme = details.data.readme;
+							const compatInfo = state.status === "ready" && state.data.compatPending
+								? (state.data.compatPending.pending ?? []).find((p) => p.rowId === entry.rowId) ?? null
+								: null;
 							detailPanel = el("div", { className: styles.detail },
 								meta !== null ? el("p", { className: styles.desc }, meta.description ?? t("noDetail")) : null,
 								entry.pendingCompat === true
-									? el("p", { className: styles.status, "data-pending": "true" }, t("pendingCompatHint"))
+									? el("p", { className: styles.status, "data-pending": "true" }, t("pendingCompatHint") + (compatInfo && compatInfo.checkNote ? "；已知校验：" + compatInfo.checkNote : ""))
 									: null,
 								meta !== null && meta.version ? el("div", { className: styles.rowTop },
 									el("p", { className: styles.status }, t("versionLabel") + "：" + meta.version),
@@ -2276,7 +2329,38 @@ window.__ModuleLoader__.load({
 										className: styles.toggle,
 										title: t("aiEmpowerTitle"),
 										onClick: () => openAiFor(String(entry.moduleName ?? entry.repo ?? "")),
-									}, t("aiEmpowerLabel"))) : null,
+									}, t("aiEmpowerLabel")),
+									entry.pendingCompat === true
+										? el("button", {
+											type: "button",
+											className: styles.toggle,
+											"data-pending": "true",
+											title: t("adaptUnlockHint"),
+											disabled: installing === entry.moduleName || adaptUnlocking === entry.entryId,
+											onClick: () => {
+												setAdaptUnlocking(entry.entryId);
+												call("/plugin-console/adapt-unlock", { rowId: entry.rowId }).then(
+													() => {
+														setAdaptUnlocking(null);
+														setMessage(t("adaptUnlockDone"));
+														window.setTimeout(() => window.location.reload(), 1200);
+													},
+													(error) => { setAdaptUnlocking(null); setMessage(t("failed") + "：" + friendlyGithubError(error).message); },
+												);
+											},
+										}, adaptUnlocking === entry.entryId ? t("loadingPhase") : t("adaptUnlockBtn"))
+										: null) : null,
+								updateCheck !== null && updateCheck.status === "ready" && updateCheck.migrate && updateCheck.migrate.compatible
+									? el("div", null,
+										el("div", { className: styles.rowTop },
+											el("p", { className: styles.status }, t("migrateTip") + "：" + String(updateCheck.migrate.to ?? "") + (updateCheck.migrate.latest ? " v" + updateCheck.migrate.latest : "")),
+											el("button", {
+												type: "button",
+												className: styles.toggle,
+												disabled: installing === entry.moduleName,
+												onClick: () => startJob("", updateCheck.migrate.to, "github", "plugin", false),
+											}, installing === entry.moduleName ? t("installing") : t("migrateBtn"))))
+									: null,
 								updateCheck !== null && updateCheck.status === "ready"
 									? (updateCheck.error
 										? el("p", { className: styles.status, "data-error": "true" }, t("updateCheckFailed") + "：" + updateCheck.error)
@@ -2314,7 +2398,13 @@ window.__ModuleLoader__.load({
 					}
 					return el("li", { key: entry.entryId, className: styles.row },
 						el("div", { className: styles.rowTop },
-							el("strong", { className: styles.name, title: entry.moduleName }, moduleShortName(entry.moduleName)),
+							el("strong", { className: styles.name, title: entry.moduleName }, (() => {
+								const famRoot = famRootOf(entry);
+								const mn = String(entry.moduleName ?? "");
+								return famRoot !== null && (familyCounts.get(famRoot) ?? 0) > 1 && mn.startsWith(famRoot + "/")
+									? mn.slice(famRoot.length + 1)
+									: moduleShortName(entry.moduleName);
+							})()),
 							el("span", { className: styles.tag, "data-enabled": entry.enabled ? "true" : "false" },
 								t(entry.enabled ? "enabledTag" : "disabledTag")),
 							entry.extra === true ? el("span", { className: styles.tag, "data-user": "true" }, t("extraTag")) : null,
@@ -2360,7 +2450,7 @@ window.__ModuleLoader__.load({
 															setMessage(t("deleteBundleNote") + "：" + (data.packageName ?? "") + (data.uninstallError ? "（包卸载警告：" + data.uninstallError + "）" : ""));
 															setRestartHint(true);
 														} else {
-															setMessage(t("deleteNote") + "：" + (data.packageName ?? "") + (data.uninstallError ? "（包卸载警告：" + data.uninstallError + "）" : ""));
+															setMessage(t("deleteNote") + "：" + (data.packageName ?? "") + (data.note ? "；" + data.note : "") + (data.uninstallError ? "（包卸载警告：" + data.uninstallError + "）" : ""));
 															setTimeout(refresh, 1500);
 														}
 													},
@@ -2388,8 +2478,72 @@ window.__ModuleLoader__.load({
 						),
 						detailPanel,
 					);
-				})
-				: [];
+				});
+			// 全家桶组头：聚合包（同根包 ≥2 行）合并展示为一个「web 包」卡片
+			const familyHeaders = [];
+			const familySeen = new Set();
+			for (const entry of filteredEntries) {
+				const root = famRootOf(entry);
+				if (root === null || (familyCounts.get(root) ?? 0) <= 1 || familySeen.has(root)) continue;
+				familySeen.add(root);
+				familyHeaders.push(el("div", { key: "family-" + root, className: styles.detail, style: { border: "1px solid var(--dsw-alias-state-business-primary)", borderRadius: 10, padding: "8px 12px", gridColumn: "1 / -1" } },
+					el("div", { className: styles.rowTop, style: { alignItems: "center" } },
+						el("strong", { className: styles.name, style: { flex: "0 1 auto", minWidth: 0, whiteSpace: "nowrap", overflow: "hidden", textOverflow: "ellipsis" }, title: root }, root.replace(/^@[^/]+\//u, "").replace(/^dsh-/u, "")),
+						el("span", { className: styles.tag, "data-user": "true" }, t("familyTag") + " · " + (familyCounts.get(root) ?? 0) + " " + t("familySubs")),
+						el("button", {
+							type: "button",
+							className: styles.toggle,
+							style: { whiteSpace: "nowrap", flexShrink: 0 },
+							onClick: () => setFamilyCollapsed((prev) => ({ ...prev, [root]: prev[root] !== true })),
+						}, familyCollapsed[root] === true ? "▸ " + t("familyExpand") : "▾ " + t("familyCollapse")),
+						el("button", {
+							type: "button",
+							className: styles.toggle,
+							style: { whiteSpace: "nowrap", flexShrink: 0 },
+							onClick: () => {
+								setMessage(t("checkingUpdate"));
+								call("/plugin-console/check-update", { packageName: root }).then(
+									(d) => setMessage(t("familyUpdate") + "：" + root + " " + (d?.latest ?? "?") + (d?.migrate && d.migrate.compatible ? " → " + d.migrate.to + " v" + d.migrate.latest : "") + (d?.error ? "（" + d.error + "）" : "")),
+									(e) => setMessage(t("failed") + "：" + friendlyGithubError(e).message),
+								);
+							},
+						}, t("familyCheckUpdate")),
+						el("button", {
+							type: "button",
+							className: styles.toggle,
+							style: { whiteSpace: "nowrap", flexShrink: 0 },
+							title: t("familyUnlockAllTip"),
+							onClick: () => {
+								if (!window.confirm(t("familyUnlockAllConfirm"))) return;
+								call("/plugin-console/adapt-unlock-all", { root }).then(
+									(d) => {
+										setMessage(t("familyUnlockAllDone") + "：" + (d.unlocked ?? []).length + " 行" + (Array.isArray(d.kept) && d.kept.length > 0 ? "；保留 " + d.kept.length + " 行（未通过校验）" : ""));
+										window.setTimeout(() => window.location.reload(), 1500);
+									},
+									(e) => setMessage(t("failed") + "：" + friendlyGithubError(e).message),
+								);
+							},
+						}, t("familyUnlockAll")))
+				));
+			}
+			// 组头放到最底部：普通条目在前，全家桶（组头+子包卡片）整体在后
+			const nonFamilyCards = [];
+			const familySections = new Map();
+			familyCards.forEach((card, i) => {
+				const e = filteredEntries[i];
+				if (e === undefined) { nonFamilyCards.push(card); return; }
+				const root = famRootOf(e);
+				if (root === null || (familyCounts.get(root) ?? 0) <= 1) { nonFamilyCards.push(card); return; }
+				if (!familySections.has(root)) familySections.set(root, { head: familyHeaders.find((h) => h && h.key === "family-" + root) ?? null, cards: [] });
+				familySections.get(root).cards.push(card);
+			});
+			const familySectionEls = [];
+			for (const [, section] of familySections) {
+				if (section.head !== null) familySectionEls.push(section.head);
+				const root = section.head !== null ? section.head.key.slice("family-".length) : null;
+				if (root === null || familyCollapsed[root] !== true) familySectionEls.push(...section.cards);
+			}
+			const rows = state.status === "ready" ? [...nonFamilyCards, ...familySectionEls] : [];
 			const marketShown = market === null || market.status !== "ready"
 				? []
 				: officialOnly

package/lib/index.js

@@ -132,8 +132,8 @@ const FIBER_PHASE = {
  * （有入口）都是这样安装的，当作插件条目 insert 会漏掉它们的 bundle 补丁。 */
 async function detectBundleOnly(profileDir, packageName) {
   try {
-    const require = createRequire(join(profileDir, 'package.json'))
-    const pkgPath = require.resolve(`${packageName}/package.json`)
+    const pkgPath = resolvePackageJson(packageName, profileDir)
+    if (pkgPath === null) throw new Error('not found')
     const pkg = JSON.parse(await readFile(pkgPath, 'utf8'))
     return typeof pkg.dsh?.bundle?.patch === 'string'
   } catch {
@@ -158,6 +158,37 @@ async function addBundleToManifest(profileDir, packageName) {
 /** 官方 profile 模板自带的 bundle（其余 bundle 视为用户额外添加）。 */
 const DEFAULT_BUNDLES = ['@deepseek-ai/dsh-base', '@deepseek-ai/dsh-web-app']
 
+/** 包名归一：支持子路径导出形式（@linxin666/dsh-web-all/settings → @linxin666/dsh-web-all）。 */
+function packageNameOf(moduleName) {
+  if (typeof moduleName !== 'string') return moduleName
+  const m = moduleName.match(/^(@[^/]+\/[^/]+)(?:\/.*)?$/u)
+  return m ? m[1] : moduleName
+}
+
+/** 把 file:// URL（如 ctx.baseUrl）转成目录路径（resolve 用）。 */
+function baseDirOf(baseUrl) {
+  try {
+    if (typeof baseUrl === 'string' && baseUrl.startsWith('file:')) return dirname(fileURLToPath(baseUrl))
+  } catch {}
+  return typeof baseUrl === 'string' && baseUrl !== '' ? baseUrl : '.'
+}
+
+/**
+ * 解析包 package.json 的绝对路径（exports 限制包 fallback）：
+ * require.resolve('pkg/package.json') 对声明了 exports 且不含 './package.json' 的包会抛错
+ * （2026-09-04 教训：@openviking/dsh-memory-plugin 因此被 heal 误判模块缺失并自动禁用）——
+ * fallback 直接查 node_modules 物理路径。
+ */
+function resolvePackageJson(pkgName, baseDir) {
+  const name = packageNameOf(pkgName)
+  try {
+    return createRequire(join(baseDir, 'package.json')).resolve(`${name}/package.json`)
+  } catch {}
+  const parts = String(name).split('/')
+  const candidate = join(baseDir, 'node_modules', ...parts, 'package.json')
+  return existsSync(candidate) ? candidate : null
+}
+
 /** 已加载插件的包元信息缓存（安装日期/版本/仓库），60 秒 TTL。 */
 const pkgMetaCache = new Map()
 const PKG_META_TTL = 60000
@@ -167,8 +198,8 @@ function entryPkgMeta(moduleName, baseUrl) {
   if (hit !== undefined && Date.now() - hit.at < PKG_META_TTL) return hit
   const meta = { at: Date.now(), installDate: null, version: null, repository: null }
   try {
-    const require = createRequire(baseUrl)
-    const pkgPath = require.resolve(`${moduleName}/package.json`)
+    const pkgPath = resolvePackageJson(moduleName, baseDirOf(baseUrl))
+    if (pkgPath === null) throw new Error('not found')
     const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
     // 安装日期：优先 curl 通道写入的 .dsh-installed-at 标记（真实安装时刻）；
     // 否则用 package.json 的 mtime，但 npm tarball 会把文件时间固定为 1985-10-26
@@ -352,6 +383,8 @@ function checkPluginFrameworkCompat(pkg, frameworkVersion, pkgDir = null) {
       return { decision: 'fail', reason: `源码仍引用 0.1.2 起已删除的 dsh-settings API（${broken.join('、')}）——实际不兼容，启用会让整个服务启动崩溃` }
     }
     if (typeof declared === 'string' && declared !== '') return { decision: 'pass', reason: `声明兼容范围 ${declared} 满足框架 ${frameworkVersion}，且源码无已删除 API 引用` }
+    // 源码扫描干净 = 权威判据：依赖范围可能滞后旧版（"假拒绝"），不作为 fail。
+    return { decision: 'unknown', reason: '源码扫描无已删除 API 引用（声明/依赖范围为参考，不作为不兼容判据）' }
   } else if (typeof declared === 'string' && declared !== '') {
     return { decision: 'pass', reason: `声明兼容范围 ${declared} 满足框架 ${frameworkVersion}` }
   }
@@ -374,8 +407,8 @@ async function readExtraBundleRows(profileDir) {
     for (const pkg of bundles) {
       if (DEFAULT_BUNDLES.includes(pkg)) continue
       try {
-        const require = createRequire(join(profileDir, 'package.json'))
-        const dir = dirname(require.resolve(`${pkg}/package.json`))
+        const pk = resolvePackageJson(pkg, profileDir)
+        const dir = dirname(pk ?? join(profileDir, 'node_modules', ...String(pkg).split('/'), 'package.json'))
         const text = await readFile(join(dir, 'cordis.patch.yml'), 'utf8')
         const lines = text.split(/\r?\n/u)
         let inInsert = false
@@ -463,8 +496,8 @@ async function readExtraBundleOwners(profileDir) {
     for (const pkg of bundles) {
       if (DEFAULT_BUNDLES.includes(pkg)) continue
       try {
-        const require = createRequire(join(profileDir, 'package.json'))
-        const dir = dirname(require.resolve(`${pkg}/package.json`))
+        const pk = resolvePackageJson(pkg, profileDir)
+        const dir = dirname(pk ?? join(profileDir, 'node_modules', ...String(pkg).split('/'), 'package.json'))
         const text = await readFile(join(dir, 'cordis.patch.yml'), 'utf8')
         const lines = text.split(/\r?\n/u)
         let inInsert = false
@@ -850,6 +883,119 @@ const FRAMEWORK_STATE_FILE = () => join(dshHome(), 'plugin-console', 'framework-
 const FRAMEWORK_BACKUP_ROOT = () => join(dshHome(), 'plugin-console', 'framework-backups')
 const COMPAT_PENDING_FILE = () => join(dshHome(), 'plugin-console', 'compat-pending.json')
 
+/** 框架核心行：误禁用会导致启动失败（2026-09-04 session-persistence-jsonl 事故：6 行 pending、
+ * 启动断言失败）。任何补丁写入（适配门/脚本/工具）都禁止禁用这些行；自愈机制自动恢复误禁。 */
+const CORE_PATCH_ROW_IDS = new Set([
+  'session-persistence-jsonl', 'webserver', 'timer', 'hmr', 'session', 'session-checkpoint-policy',
+  'message-feedback', 'workspace', 'storage', 'storage-json', 'storage-domain', 'api-gateway',
+  'api-session-controller', 'api-workspace-controller', 'credentials', 'settings', 'attachment-local',
+  'subprocess', 'sandbox', 'sandbox-policy', 'shell-env', 'agent', 'agent-loop', 'llm', 'web-runtime', 'web-startup',
+])
+
+let patchHealAt = null
+let patchHealReport = null
+
+/** 解析用户补丁中 insert 块的 id → moduleName（name 字段）。 */
+function parseInsertNames(text) {
+  const map = new Map()
+  const lines = text.split(/\r?\n/u)
+  let inInsert = false
+  let curId = null
+  for (const line of lines) {
+    if (/^- insert:\s*$/u.test(line)) { inInsert = true; curId = null; continue }
+    if (inInsert && /^- /u.test(line)) inInsert = false
+    if (inInsert) {
+      const idMatch = line.match(/^\s+- id: ([A-Za-z0-9_.-]+)/u)
+      if (idMatch) { curId = idMatch[1]; continue }
+      if (curId !== null) {
+        const nameMatch = line.match(/^\s+name: ['"]([^'"]+)['"]/u)
+        if (nameMatch) { map.set(curId, nameMatch[1]); curId = null }
+      }
+    }
+  }
+  return map
+}
+
+/**
+ * 补丁安全自愈（服务永不崩机制）：
+ * ① 核心行被误禁用 → 自动移除禁用块恢复；
+ * ② 启用态用户 insert 行的模块缺失（如引用未安装包的行）→ 自动禁用（loader 对缺失模块会致命崩溃）。
+ * return { healed:[], autoDisabled:[], healedAt } —— healedAt=0 表示本次无修改。
+ */
+async function healPatchSafety(patchPath) {
+  const profileDir = dirname(patchPath)
+  const { text } = await readPatchState(patchPath)
+  let next = text
+  const healed = []
+  const autoDisabled = []
+  for (const id of CORE_PATCH_ROW_IDS) {
+    const re = new RegExp(`^- id: ${escapeRegExp(id)}\\s*\\r?\\n {2}disabled: true\\s*\\r?\\n`, 'mu')
+    if (re.test(next)) {
+      next = next.replace(re, '')
+      healed.push(id)
+    }
+  }
+  if (healed.length === 0) {
+    const insertNames = parseInsertNames(next)
+    let require = null
+    for (const [id, moduleName] of insertNames) {
+      if (!moduleName || moduleName.startsWith('cordis:')) continue
+      let ok = true
+      try { ok = resolvePackageJson(moduleName, profileDir) !== null } catch { ok = false }
+      if (!ok && !new RegExp(`^- id: ${escapeRegExp(id)}\\s*\\r?\\n {2}disabled: true\\s*\\r?\\n`, 'mu').test(next)) {
+        next = `${next.trimEnd()}\n- id: ${id}\n  disabled: true\n`
+        autoDisabled.push(id)
+      }
+    }
+  }
+  if (next !== text) {
+    await writeFile(patchPath, sanitizePatchText(next), 'utf8')
+  }
+  return { healed, autoDisabled, healedAt: next !== text ? Date.now() : 0 }
+}
+
+/**
+ * 启用前冒烟检查（服务永不崩机制）：在独立子进程中动态 import 插件主模块，
+ * 捕获 loader 会遇到的 import/resolution 错误（SyntaxError、缺失导出、模块缺失）。
+ * 子进程失败不影响控制台；探测失败/超时按"不通过"处理（宁可拒绝，不冒险拖崩服务）。
+ */
+function probePluginImport(moduleName, profileDir) {
+  return new Promise((resolve) => {
+    const script = [
+      'import { createRequire } from "node:module";',
+      'import path from "node:path";',
+      'try {',
+      '  const req = createRequire(path.join(process.argv[1], "package.json"));',
+      '  const mainPath = req.resolve(process.argv[2]);',
+      '  const { pathToFileURL } = await import("node:url");',
+      '  await import(pathToFileURL(mainPath).href);',
+      '  console.log("PROBE_OK");',
+      '} catch (e) { console.log("PROBE_ERR:" + String(e && e.message ? e.message : e).slice(0, 400)); process.exitCode = 1; }',
+    ].join('\n')
+    let child = null
+    try {
+      child = spawn(process.execPath, ['--input-type=module', '-e', script, profileDir, moduleName], { windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'] })
+    } catch {
+      resolve({ ok: true, detail: 'probe 无法启动（放行）' })
+      return
+    }
+    let out = ''
+    let timer = null
+    const finish = (ok, detail) => {
+      if (timer !== null) clearTimeout(timer)
+      resolve({ ok, detail })
+    }
+    timer = setTimeout(() => { try { child.kill() } catch {}; finish(false, '探测超时') }, 8000)
+    child.stdout.on('data', (c) => { out += c })
+    child.stderr.on('data', (c) => { out += c })
+    child.on('error', () => finish(true, 'probe 进程错误（放行）'))
+    child.on('close', (code) => {
+      if (out.includes('PROBE_OK')) finish(true, 'import OK')
+      else finish(false, (out.match(/PROBE_ERR:([^\n]*)/u)?.[1] ?? out.slice(0, 300)).trim())
+    })
+  })
+}
+
 /** 读取框架升级适配门清单（compat-pending.json）；损坏/缺失返回 null。 */
 function readCompatPending() {
   try { return JSON.parse(readFileSync(COMPAT_PENDING_FILE(), 'utf8')) } catch { return null }
@@ -1044,11 +1190,11 @@ function summarizeReadme(text) {
 async function readPluginDetails(moduleName, baseUrl) {
   if (typeof moduleName !== 'string' || moduleName.startsWith('cordis:')) return { meta: null, readme: null }
   try {
-    const require = createRequire(baseUrl)
-    const pkgPath = require.resolve(`${moduleName}/package.json`)
+    const pkgPath = resolvePackageJson(moduleName, baseDirOf(baseUrl))
+    if (pkgPath === null) throw new Error('not found')
     const pkg = JSON.parse(await readFile(pkgPath, 'utf8'))
     const meta = {
-      name: pkg.name ?? moduleName,
+      name: moduleName,
       version: pkg.version ?? null,
       description: pkg.description ?? null,
       homepage: pkg.homepage ?? null,
@@ -3504,10 +3650,11 @@ async function maybeAutoAdaptCompat({ profileDir, packageName, syncedNames, patc
     let pkg = null
     let pkgDir = null
     try {
-      const require = createRequire(join(profileDir, 'package.json'))
-      const pkgPath = require.resolve(`${p.moduleName}/package.json`)
-      pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
-      pkgDir = dirname(pkgPath)
+      const pkgPath = resolvePackageJson(p.moduleName, profileDir)
+      if (pkgPath !== null) {
+        pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
+        pkgDir = dirname(pkgPath)
+      }
     } catch {}
     const version = typeof pkg?.version === 'string' ? pkg.version : null
     const changed = version !== null && version !== p.version
@@ -3541,8 +3688,8 @@ async function frameworkCompatReportFor(source, ctx, profileDir) {
   const isNpm = norm.startsWith('@') || !norm.includes('/')
   const installed = (() => {
     try {
-      const require = createRequire(join(profileDir, 'package.json'))
-      const pkgPath = require.resolve(`${norm}/package.json`)
+      const pkgPath = resolvePackageJson(norm, profileDir)
+      if (pkgPath === null) return null
       return JSON.parse(readFileSync(pkgPath, 'utf8')).version ?? null
     } catch { return null }
   })()
@@ -3941,6 +4088,17 @@ async function handle(ctx, req, res) {
   if (method === 'GET' && pathname === `${ROUTE_PREFIX}/state`) {
     const patchPath = findPatchPath(ctx)
     const patch = await readPatchState(patchPath)
+    // 补丁安全自愈（核心行误禁用恢复 / 缺失模块行自动禁用）——每 2 分钟最多跑一次
+    let patchHeal = null
+    try {
+      if (patchHealAt === null || Date.now() - patchHealAt > 120000) {
+        patchHealAt = Date.now()
+        patchHeal = await healPatchSafety(patchPath)
+      } else {
+        patchHeal = patchHealReport
+      }
+      if (patchHeal !== null) patchHealReport = patchHeal
+    } catch {}
     const extraRows = await readExtraBundleRows(dirname(patchPath))
     const compatPending = readCompatPending()
     const compatPendingRows = new Set((compatPending?.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => p.rowId))
@@ -3976,7 +4134,7 @@ async function handle(ctx, req, res) {
       const selfPkg = JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json'), 'utf8'))
       selfVersion = typeof selfPkg.version === 'string' ? selfPkg.version : null
     } catch {}
-    sendJson(res, 200, { ok: true, entries, patchPath, compat, installJobs: jobs, recentFailures, github: { loggedIn: auth.loggedIn, login: auth.login }, patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts }, framework, compatPending: compatPending === null ? null : { frameworkVersion: compatPending.frameworkVersion ?? null, upgradeFrom: compatPending.upgradeFrom ?? null, pending: (compatPending.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => ({ rowId: p.rowId, moduleName: p.moduleName, version: p.version ?? null })) }, rollback: rollbackRec, selfVersion, components: findComponents().map((c) => ({ id: c.id, name: c.name, kind: c.kind ?? 'server', pid: c.pid ?? null, port: c.port ?? null, healthUrl: c.healthUrl ?? null, uiUrl: compUiUrl(c), autoStart: c.autoStart === true })) })
+    sendJson(res, 200, { ok: true, entries, patchPath, compat, installJobs: jobs, recentFailures, github: { loggedIn: auth.loggedIn, login: auth.login }, patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts }, framework, patchHeal: patchHeal === null ? null : { healed: patchHeal.healed ?? [], autoDisabled: patchHeal.autoDisabled ?? [], healedAt: patchHeal.healedAt ?? 0 }, compatPending: compatPending === null ? null : { frameworkVersion: compatPending.frameworkVersion ?? null, upgradeFrom: compatPending.upgradeFrom ?? null, pending: (compatPending.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => ({ rowId: p.rowId, moduleName: p.moduleName, version: p.version ?? null, checkNote: p.checkNote ?? null, check: p.check ?? null })) }, rollback: rollbackRec, selfVersion, components: findComponents().map((c) => ({ id: c.id, name: c.name, kind: c.kind ?? 'server', pid: c.pid ?? null, port: c.port ?? null, healthUrl: c.healthUrl ?? null, uiUrl: compUiUrl(c), autoStart: c.autoStart === true })) })
     return
   }
 
@@ -4178,11 +4336,25 @@ async function handle(ctx, req, res) {
       const compatPending = readCompatPending()
       const pend = (compatPending?.pending ?? []).find((p) => p.rowId === rowId && (p.status ?? 'pending') === 'pending')
       if (pend) {
-        sendError(res, 409, `「${rowId}」仍在框架升级适配门中（${compatPending.frameworkVersion ?? '?'}）被强制禁用：请先点击「更新并适配」，更新完成并通过兼容校验后系统自动解锁`)
+        sendError(res, 409, `「${rowId}」仍在框架升级适配门中（${compatPending.frameworkVersion ?? '?'}）被强制禁用：请先点击「更新并适配 / 已适配，立即解锁」，通过兼容校验后系统自动解锁`)
         return
       }
     }
     const patchPath = findPatchPath(ctx)
+    // 启用前冒烟检查（服务永不崩机制）：第三方模块在独立子进程中试 import，
+    // 失败（SyntaxError/缺失导出/模块缺失）即拒绝启用，杜绝「单行 import 失败→整个服务启动崩溃」
+    if (enabled) {
+      const moduleName = target?.options?.name
+      if (typeof moduleName === 'string' && !moduleName.startsWith('cordis:') && !moduleName.startsWith('@deepseek-ai/')) {
+        try {
+          const probe = await probePluginImport(moduleName, dirname(patchPath))
+          if (probe.ok !== true) {
+            sendError(res, 409, `启用前冒烟检查未通过：模块加载失败（${probe.detail ?? '未知'}）——该插件与当前框架不兼容或依赖缺失，已阻止启用（服务不会再被拖崩）；请先「检测更新/更新并适配」其适配版`)
+            return
+          }
+        } catch {}
+      }
+    }
     const result = enabled
       ? await enableEntry(patchPath, rowId)
       : await disableEntry(patchPath, rowId)
@@ -4218,14 +4390,18 @@ async function handle(ctx, req, res) {
     const owners = await readExtraBundleOwners(profileDir)
     const ownerBundle = owners.get(rowId) ?? owners.get(moduleName)
     if (ownerBundle !== undefined) {
-      await removeBundleFromManifest(profileDir, ownerBundle)
-      let uninstallError = null
-      try {
-        await pnpmRemove(profileDir, ownerBundle)
-      } catch (error) {
-        uninstallError = error instanceof Error ? error.message : String(error)
-      }
-      sendJson(res, 200, { ok: true, removed: 'bundle', packageName: ownerBundle, restart: true, uninstallError })
+      // 2026-09-04 事故教训：删除聚合包子路径行（如 @linxin666/dsh-web-all/plugin-manager）时
+      // 曾把整个 bundle 从清单移除，pnpm 卸载失败（corepack 报错）后重启，全家桶整体消失。
+      // 现改为：任何 bundle 行的「删除」= 仅停用该行（patch disabled:true），bundle 清单不动，
+      // 之后随时可「启用」恢复；整体卸载请走包管理器。
+      await disableEntry(patchPath, rowId)
+      sendJson(res, 200, {
+        ok: true,
+        removed: 'row',
+        packageName: moduleName,
+        restart: false,
+        note: '该行来自聚合包 ' + ownerBundle + '，已仅停用本行（bundle 保留，可随时启用恢复）；整体卸载请用包管理器执行 pnpm remove ' + ownerBundle,
+      })
       return
     }
     if (!patch.inserts.includes(rowId)) {
@@ -4664,11 +4840,105 @@ async function handle(ctx, req, res) {
     return
   }
 
+  if (pathname === `${ROUTE_PREFIX}/adapt-unlock`) {
+    // 待适配行「已适配，立即解锁」：无需等新版本——对已装模块重跑源码扫描，通过即移除禁用块。
+    const rowId = typeof body.rowId === 'string' ? body.rowId : ''
+    if (!/^[A-Za-z0-9_:.-]{1,80}$/u.test(rowId)) {
+      sendError(res, 400, 'rowId 无效')
+      return
+    }
+    const pending = readCompatPending()
+    const entry = (pending?.pending ?? []).find((p) => p.rowId === rowId && (p.status ?? 'pending') === 'pending')
+    if (entry === undefined) {
+      sendError(res, 404, '该行不在适配门待适配清单中（或已解锁）')
+      return
+    }
+    const patchPath = findPatchPath(ctx)
+    const profileDir = dirname(patchPath)
+    let pkg = null
+    let pkgDir = null
+    let version = null
+    try {
+      const require = createRequire(join(profileDir, 'package.json'))
+      const pkgPath = resolvePackageJson(entry.moduleName, profileDir)
+      if (pkgPath !== null) {
+        pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
+        version = typeof pkg?.version === 'string' ? pkg.version : null
+        pkgDir = dirname(pkgPath)
+      }
+    } catch {}
+    const fwVer = typeof pending.frameworkVersion === 'string' ? pending.frameworkVersion : '?'
+    const check = pkg !== null ? checkPluginFrameworkCompat(pkg, fwVer, pkgDir) : { decision: 'unknown', reason: '无法读取包信息' }
+    if (check.decision === 'fail') {
+      sendError(res, 409, `适配校验未通过：${check.reason}`)
+      return
+    }
+    await removeDisableBlock(patchPath, rowId)
+    entry.status = 'adopted'
+    entry.adoptedAt = Date.now()
+    entry.adoptedVersion = version
+    entry.adoptedFramework = fwVer
+    entry.check = check.decision
+    entry.checkNote = check.reason ?? null
+    writeCompatPending(pending)
+    sendJson(res, 200, { ok: true, rowId, adopted: true, check: check.decision, note: check.reason ?? null })
+    return
+  }
+
+  if (pathname === `${ROUTE_PREFIX}/adapt-unlock-all`) {
+    // 全家桶「一键启用已适配」：对家庭内所有待适配行批量重跑源码扫描，通过的全部解锁，未通过保留禁用。
+    const root = typeof body.root === 'string' ? body.root : ''
+    if (!/^(@[a-z0-9-][a-z0-9-._~]*\/)?[a-z0-9-][a-z0-9-._~]*$/u.test(root) || root.length > 214) {
+      sendError(res, 400, 'root 无效')
+      return
+    }
+    const pending = readCompatPending()
+    const patchPath = findPatchPath(ctx)
+    const profileDir = dirname(patchPath)
+    const targets = (pending?.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending' && (p.moduleName === root || String(p.moduleName).startsWith(root + '/')))
+    if (targets.length === 0) {
+      sendError(res, 404, '该全家桶没有待适配行（或已全部解锁）')
+      return
+    }
+    const fwVer = typeof pending.frameworkVersion === 'string' ? pending.frameworkVersion : '?'
+    const unlocked = []
+    const kept = []
+    for (const p of targets) {
+      let pkg = null
+      let pkgDir = null
+      let version = null
+      try {
+        const pkgPath = resolvePackageJson(p.moduleName, profileDir)
+        if (pkgPath !== null) {
+          pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
+          version = typeof pkg?.version === 'string' ? pkg.version : null
+          pkgDir = dirname(pkgPath)
+        }
+      } catch {}
+      const check = pkg !== null ? checkPluginFrameworkCompat(pkg, fwVer, pkgDir) : { decision: 'fail', reason: '无法读取包信息' }
+      if (check.decision === 'fail') {
+        kept.push({ rowId: p.rowId, reason: check.reason })
+        continue
+      }
+      await removeDisableBlock(patchPath, p.rowId)
+      p.status = 'adopted'
+      p.adoptedAt = Date.now()
+      p.adoptedVersion = version
+      p.adoptedFramework = fwVer
+      p.check = check.decision
+      p.checkNote = check.reason ?? null
+      unlocked.push(p.rowId)
+    }
+    writeCompatPending(pending)
+    sendJson(res, 200, { ok: true, root, unlocked, kept })
+    return
+  }
+
   if (pathname === `${ROUTE_PREFIX}/check-update`) {
     // 检测已安装插件是否有新版本：curl registry 元数据取 dist-tags.latest（node 网络黑洞时 curl 可用）。
     // 聚合包（有 dependencies）额外对比子包版本：声明版本 vs 本地 node_modules 实际版本，
     // 返回 depsOutdated 提示"更新本包需同步子包"，避免半更新混搭导致启动冲突。
-    const packageName = typeof body.packageName === 'string' ? body.packageName.trim() : ''
+    const packageName = packageNameOf(typeof body.packageName === 'string' ? body.packageName.trim() : '')
     if (!packageName) {
       sendError(res, 400, 'packageName 不能为空')
       return
@@ -4764,7 +5034,29 @@ async function handle(ctx, req, res) {
         error = `npm registry 查询失败且 GitHub 回退不可用（${fallbackError}；${fbErr instanceof Error ? fbErr.message : String(fbErr)}）`
       }
     }
-    sendJson(res, 200, { ok: true, packageName, latest, next, beta, depsOutdated, error, source })
+    // migrate 换名检测（2026-09-04 缺陷修复）：本地包声明 dsh.migrate.to 时查目标包最新版/引擎声明，
+    // 识别「项目已改名/迁移发布」的更新（如 @linxin666/dsh-web-ui-all → @linxin666/dsh-web-all 0.3.14）
+    let migrate = null
+    try {
+      const localPath = resolvePackageJson(packageName, profileDir)
+      if (localPath !== null) {
+      const localPkg = JSON.parse(readFileSync(localPath, 'utf8'))
+      const to = typeof localPkg.dsh?.migrate?.to === 'string' ? localPkg.dsh.migrate.to : null
+      if (to !== null && to !== '' && to !== packageName) {
+        const encTo = to.startsWith('@')
+          ? `@${encodeURIComponent(to.slice(1).split('/')[0])}%2f${encodeURIComponent(to.split('/').slice(1).join('/'))}`
+          : encodeURIComponent(to)
+        const meta = await fetchJsonUrl(`https://registry.npmmirror.com/${encTo}`)
+        const toLatest = meta?.['dist-tags']?.latest ?? meta?.['dist-tags']?.next ?? null
+        const toPkg = toLatest !== null ? (meta?.versions?.[toLatest] ?? null) : null
+        const engine = toPkg?.dsh?.engines?.dsh ?? toPkg?.engines?.dsh ?? null
+        const fwVer = currentFrameworkVersion(ctx)
+        const compatible = fwVer !== null && (engine === null || semverRangeMatchLoose(fwVer, engine))
+        migrate = { to, latest: toLatest, engine, compatible }
+      }
+      }
+    } catch {}
+    sendJson(res, 200, { ok: true, packageName, latest, next, beta, depsOutdated, error, source, migrate })
     return
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noob-stupid/dsh-plugin-console",
-  "version": "0.3.26",
+  "version": "0.3.27",
   "description": "DSH plugin management panel & marketplace: one-click enable/disable, multi-source market (GitHub/Gitee/custom), static-index market (500+ plugins / 300 skills), skills, suites, and one-click framework upgrade.",
   "repository": {
     "type": "git",