@noob-stupid/dsh-plugin-console 0.3.26 → 0.3.28

package/lib/index.js

@@ -132,8 +132,8 @@ const FIBER_PHASE = {
  * （有入口）都是这样安装的，当作插件条目 insert 会漏掉它们的 bundle 补丁。 */
 async function detectBundleOnly(profileDir, packageName) {
   try {
-    const require = createRequire(join(profileDir, 'package.json'))
-    const pkgPath = require.resolve(`${packageName}/package.json`)
+    const pkgPath = resolvePackageJson(packageName, profileDir)
+    if (pkgPath === null) throw new Error('not found')
     const pkg = JSON.parse(await readFile(pkgPath, 'utf8'))
     return typeof pkg.dsh?.bundle?.patch === 'string'
   } catch {
@@ -158,17 +158,59 @@ async function addBundleToManifest(profileDir, packageName) {
 /** 官方 profile 模板自带的 bundle（其余 bundle 视为用户额外添加）。 */
 const DEFAULT_BUNDLES = ['@deepseek-ai/dsh-base', '@deepseek-ai/dsh-web-app']
 
+/** 包名归一：支持子路径导出形式（@linxin666/dsh-web-all/settings → @linxin666/dsh-web-all）。 */
+function packageNameOf(moduleName) {
+  if (typeof moduleName !== 'string') return moduleName
+  const m = moduleName.match(/^(@[^/]+\/[^/]+)(?:\/.*)?$/u)
+  return m ? m[1] : moduleName
+}
+
+/** 把 file:// URL（如 ctx.baseUrl）转成目录路径（resolve 用）。 */
+function baseDirOf(baseUrl) {
+  try {
+    if (typeof baseUrl === 'string' && baseUrl.startsWith('file:')) return dirname(fileURLToPath(baseUrl))
+  } catch {}
+  return typeof baseUrl === 'string' && baseUrl !== '' ? baseUrl : '.'
+}
+
+/**
+ * 解析包 package.json 的绝对路径（exports 限制包 fallback）：
+ * require.resolve('pkg/package.json') 对声明了 exports 且不含 './package.json' 的包会抛错
+ * （2026-09-04 教训：@openviking/dsh-memory-plugin 因此被 heal 误判模块缺失并自动禁用）——
+ * fallback 直接查 node_modules 物理路径。
+ */
+function resolvePackageJson(pkgName, baseDir, fallbackBase) {
+  const name = packageNameOf(pkgName)
+  try {
+    return createRequire(join(baseDir, 'package.json')).resolve(`${name}/package.json`)
+  } catch {}
+  const parts = String(name).split('/')
+  const candidate = join(baseDir, 'node_modules', ...parts, 'package.json')
+  if (existsSync(candidate)) return candidate
+  // issue #15：npm 全局安装 dsh 时 ctx.baseUrl 落在框架安装树（而非 profile node_modules），
+  // 官方 @deepseek-ai/* 恰好可见、第三方插件全部解析失败 → 详情/版本/仓库全空。
+  // 回退到 profile 目录（fallbackBase）再试一次。
+  if (typeof fallbackBase === 'string' && fallbackBase !== '' && fallbackBase !== baseDir) {
+    try {
+      return createRequire(join(fallbackBase, 'package.json')).resolve(`${name}/package.json`)
+    } catch {}
+    const candidate2 = join(fallbackBase, 'node_modules', ...parts, 'package.json')
+    if (existsSync(candidate2)) return candidate2
+  }
+  return null
+}
+
 /** 已加载插件的包元信息缓存（安装日期/版本/仓库），60 秒 TTL。 */
 const pkgMetaCache = new Map()
 const PKG_META_TTL = 60000
-function entryPkgMeta(moduleName, baseUrl) {
+function entryPkgMeta(moduleName, baseUrl, profileDir) {
   if (typeof moduleName !== 'string' || moduleName.startsWith('cordis:')) return null
   const hit = pkgMetaCache.get(moduleName)
   if (hit !== undefined && Date.now() - hit.at < PKG_META_TTL) return hit
   const meta = { at: Date.now(), installDate: null, version: null, repository: null }
   try {
-    const require = createRequire(baseUrl)
-    const pkgPath = require.resolve(`${moduleName}/package.json`)
+    const pkgPath = resolvePackageJson(moduleName, baseDirOf(baseUrl), profileDir ?? null)
+    if (pkgPath === null) throw new Error('not found')
     const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
     // 安装日期：优先 curl 通道写入的 .dsh-installed-at 标记（真实安装时刻）；
     // 否则用 package.json 的 mtime，但 npm tarball 会把文件时间固定为 1985-10-26
@@ -352,6 +394,8 @@ function checkPluginFrameworkCompat(pkg, frameworkVersion, pkgDir = null) {
       return { decision: 'fail', reason: `源码仍引用 0.1.2 起已删除的 dsh-settings API（${broken.join('、')}）——实际不兼容，启用会让整个服务启动崩溃` }
     }
     if (typeof declared === 'string' && declared !== '') return { decision: 'pass', reason: `声明兼容范围 ${declared} 满足框架 ${frameworkVersion}，且源码无已删除 API 引用` }
+    // 源码扫描干净 = 权威判据：依赖范围可能滞后旧版（"假拒绝"），不作为 fail。
+    return { decision: 'unknown', reason: '源码扫描无已删除 API 引用（声明/依赖范围为参考，不作为不兼容判据）' }
   } else if (typeof declared === 'string' && declared !== '') {
     return { decision: 'pass', reason: `声明兼容范围 ${declared} 满足框架 ${frameworkVersion}` }
   }
@@ -374,8 +418,8 @@ async function readExtraBundleRows(profileDir) {
     for (const pkg of bundles) {
       if (DEFAULT_BUNDLES.includes(pkg)) continue
       try {
-        const require = createRequire(join(profileDir, 'package.json'))
-        const dir = dirname(require.resolve(`${pkg}/package.json`))
+        const pk = resolvePackageJson(pkg, profileDir)
+        const dir = dirname(pk ?? join(profileDir, 'node_modules', ...String(pkg).split('/'), 'package.json'))
         const text = await readFile(join(dir, 'cordis.patch.yml'), 'utf8')
         const lines = text.split(/\r?\n/u)
         let inInsert = false
@@ -463,8 +507,8 @@ async function readExtraBundleOwners(profileDir) {
     for (const pkg of bundles) {
       if (DEFAULT_BUNDLES.includes(pkg)) continue
       try {
-        const require = createRequire(join(profileDir, 'package.json'))
-        const dir = dirname(require.resolve(`${pkg}/package.json`))
+        const pk = resolvePackageJson(pkg, profileDir)
+        const dir = dirname(pk ?? join(profileDir, 'node_modules', ...String(pkg).split('/'), 'package.json'))
         const text = await readFile(join(dir, 'cordis.patch.yml'), 'utf8')
         const lines = text.split(/\r?\n/u)
         let inInsert = false
@@ -850,6 +894,119 @@ const FRAMEWORK_STATE_FILE = () => join(dshHome(), 'plugin-console', 'framework-
 const FRAMEWORK_BACKUP_ROOT = () => join(dshHome(), 'plugin-console', 'framework-backups')
 const COMPAT_PENDING_FILE = () => join(dshHome(), 'plugin-console', 'compat-pending.json')
 
+/** 框架核心行：误禁用会导致启动失败（2026-09-04 session-persistence-jsonl 事故：6 行 pending、
+ * 启动断言失败）。任何补丁写入（适配门/脚本/工具）都禁止禁用这些行；自愈机制自动恢复误禁。 */
+const CORE_PATCH_ROW_IDS = new Set([
+  'session-persistence-jsonl', 'webserver', 'timer', 'hmr', 'session', 'session-checkpoint-policy',
+  'message-feedback', 'workspace', 'storage', 'storage-json', 'storage-domain', 'api-gateway',
+  'api-session-controller', 'api-workspace-controller', 'credentials', 'settings', 'attachment-local',
+  'subprocess', 'sandbox', 'sandbox-policy', 'shell-env', 'agent', 'agent-loop', 'llm', 'web-runtime', 'web-startup',
+])
+
+let patchHealAt = null
+let patchHealReport = null
+
+/** 解析用户补丁中 insert 块的 id → moduleName（name 字段）。 */
+function parseInsertNames(text) {
+  const map = new Map()
+  const lines = text.split(/\r?\n/u)
+  let inInsert = false
+  let curId = null
+  for (const line of lines) {
+    if (/^- insert:\s*$/u.test(line)) { inInsert = true; curId = null; continue }
+    if (inInsert && /^- /u.test(line)) inInsert = false
+    if (inInsert) {
+      const idMatch = line.match(/^\s+- id: ([A-Za-z0-9_.-]+)/u)
+      if (idMatch) { curId = idMatch[1]; continue }
+      if (curId !== null) {
+        const nameMatch = line.match(/^\s+name: ['"]([^'"]+)['"]/u)
+        if (nameMatch) { map.set(curId, nameMatch[1]); curId = null }
+      }
+    }
+  }
+  return map
+}
+
+/**
+ * 补丁安全自愈（服务永不崩机制）：
+ * ① 核心行被误禁用 → 自动移除禁用块恢复；
+ * ② 启用态用户 insert 行的模块缺失（如引用未安装包的行）→ 自动禁用（loader 对缺失模块会致命崩溃）。
+ * return { healed:[], autoDisabled:[], healedAt } —— healedAt=0 表示本次无修改。
+ */
+async function healPatchSafety(patchPath) {
+  const profileDir = dirname(patchPath)
+  const { text } = await readPatchState(patchPath)
+  let next = text
+  const healed = []
+  const autoDisabled = []
+  for (const id of CORE_PATCH_ROW_IDS) {
+    const re = new RegExp(`^- id: ${escapeRegExp(id)}\\s*\\r?\\n {2}disabled: true\\s*\\r?\\n`, 'mu')
+    if (re.test(next)) {
+      next = next.replace(re, '')
+      healed.push(id)
+    }
+  }
+  if (healed.length === 0) {
+    const insertNames = parseInsertNames(next)
+    let require = null
+    for (const [id, moduleName] of insertNames) {
+      if (!moduleName || moduleName.startsWith('cordis:')) continue
+      let ok = true
+      try { ok = resolvePackageJson(moduleName, profileDir) !== null } catch { ok = false }
+      if (!ok && !new RegExp(`^- id: ${escapeRegExp(id)}\\s*\\r?\\n {2}disabled: true\\s*\\r?\\n`, 'mu').test(next)) {
+        next = `${next.trimEnd()}\n- id: ${id}\n  disabled: true\n`
+        autoDisabled.push(id)
+      }
+    }
+  }
+  if (next !== text) {
+    await writeFile(patchPath, sanitizePatchText(next), 'utf8')
+  }
+  return { healed, autoDisabled, healedAt: next !== text ? Date.now() : 0 }
+}
+
+/**
+ * 启用前冒烟检查（服务永不崩机制）：在独立子进程中动态 import 插件主模块，
+ * 捕获 loader 会遇到的 import/resolution 错误（SyntaxError、缺失导出、模块缺失）。
+ * 子进程失败不影响控制台；探测失败/超时按"不通过"处理（宁可拒绝，不冒险拖崩服务）。
+ */
+function probePluginImport(moduleName, profileDir) {
+  return new Promise((resolve) => {
+    const script = [
+      'import { createRequire } from "node:module";',
+      'import path from "node:path";',
+      'try {',
+      '  const req = createRequire(path.join(process.argv[1], "package.json"));',
+      '  const mainPath = req.resolve(process.argv[2]);',
+      '  const { pathToFileURL } = await import("node:url");',
+      '  await import(pathToFileURL(mainPath).href);',
+      '  console.log("PROBE_OK");',
+      '} catch (e) { console.log("PROBE_ERR:" + String(e && e.message ? e.message : e).slice(0, 400)); process.exitCode = 1; }',
+    ].join('\n')
+    let child = null
+    try {
+      child = spawn(process.execPath, ['--input-type=module', '-e', script, profileDir, moduleName], { windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'] })
+    } catch {
+      resolve({ ok: true, detail: 'probe 无法启动（放行）' })
+      return
+    }
+    let out = ''
+    let timer = null
+    const finish = (ok, detail) => {
+      if (timer !== null) clearTimeout(timer)
+      resolve({ ok, detail })
+    }
+    timer = setTimeout(() => { try { child.kill() } catch {}; finish(false, '探测超时') }, 8000)
+    child.stdout.on('data', (c) => { out += c })
+    child.stderr.on('data', (c) => { out += c })
+    child.on('error', () => finish(true, 'probe 进程错误（放行）'))
+    child.on('close', (code) => {
+      if (out.includes('PROBE_OK')) finish(true, 'import OK')
+      else finish(false, (out.match(/PROBE_ERR:([^\n]*)/u)?.[1] ?? out.slice(0, 300)).trim())
+    })
+  })
+}
+
 /** 读取框架升级适配门清单（compat-pending.json）；损坏/缺失返回 null。 */
 function readCompatPending() {
   try { return JSON.parse(readFileSync(COMPAT_PENDING_FILE(), 'utf8')) } catch { return null }
@@ -915,7 +1072,7 @@ function backupProfileSnapshot(profileDir, version, ctx) {
   try { copyFileSync(join(profileDir, 'package.json'), join(dir, 'profile-package.json')) } catch {}
   try {
     const plugins = listEntries(ctx).map((e) => {
-      const meta = entryPkgMeta(e.moduleName, ctx.baseUrl ?? 'file:///')
+      const meta = entryPkgMeta(e.moduleName, ctx.baseUrl ?? 'file:///', profileDirOf(ctx))
       return { rowId: e.rowId, moduleName: e.moduleName, enabled: e.enabled, version: meta?.version ?? null, installDate: meta?.installDate ?? null }
     })
     writeFileSync(join(dir, 'plugins.json'), JSON.stringify(plugins, null, 2), 'utf8')
@@ -960,6 +1117,15 @@ function findPatchPath(ctx) {
   return defaultPatchPath()
 }
 
+/** profile 根目录（resolvePackageJson 的 fallbackBase 用；失败返回 null）。 */
+function profileDirOf(ctx) {
+  try {
+    return dirname(findPatchPath(ctx))
+  } catch {
+    return null
+  }
+}
+
 /** 读取补丁文件并扫描：停用块与 insert 行的 id。 */
 async function readPatchState(patchPath) {
   let text = ''
@@ -1041,14 +1207,14 @@ function summarizeReadme(text) {
 }
 
 /** 读取一个已加载插件的 package.json 元信息与 README 摘要。 */
-async function readPluginDetails(moduleName, baseUrl) {
+async function readPluginDetails(moduleName, baseUrl, profileDir) {
   if (typeof moduleName !== 'string' || moduleName.startsWith('cordis:')) return { meta: null, readme: null }
   try {
-    const require = createRequire(baseUrl)
-    const pkgPath = require.resolve(`${moduleName}/package.json`)
+    const pkgPath = resolvePackageJson(moduleName, baseDirOf(baseUrl), profileDir ?? null)
+    if (pkgPath === null) throw new Error('not found')
     const pkg = JSON.parse(await readFile(pkgPath, 'utf8'))
     const meta = {
-      name: pkg.name ?? moduleName,
+      name: moduleName,
       version: pkg.version ?? null,
       description: pkg.description ?? null,
       homepage: pkg.homepage ?? null,
@@ -3504,10 +3670,11 @@ async function maybeAutoAdaptCompat({ profileDir, packageName, syncedNames, patc
     let pkg = null
     let pkgDir = null
     try {
-      const require = createRequire(join(profileDir, 'package.json'))
-      const pkgPath = require.resolve(`${p.moduleName}/package.json`)
-      pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
-      pkgDir = dirname(pkgPath)
+      const pkgPath = resolvePackageJson(p.moduleName, profileDir)
+      if (pkgPath !== null) {
+        pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
+        pkgDir = dirname(pkgPath)
+      }
     } catch {}
     const version = typeof pkg?.version === 'string' ? pkg.version : null
     const changed = version !== null && version !== p.version
@@ -3541,8 +3708,8 @@ async function frameworkCompatReportFor(source, ctx, profileDir) {
   const isNpm = norm.startsWith('@') || !norm.includes('/')
   const installed = (() => {
     try {
-      const require = createRequire(join(profileDir, 'package.json'))
-      const pkgPath = require.resolve(`${norm}/package.json`)
+      const pkgPath = resolvePackageJson(norm, profileDir)
+      if (pkgPath === null) return null
       return JSON.parse(readFileSync(pkgPath, 'utf8')).version ?? null
     } catch { return null }
   })()
@@ -3730,7 +3897,7 @@ async function runInstallJob(job, ctx) {
           let ghRepo = typeof job.repo === 'string' && job.repo !== '' && job.repo.includes('/') ? job.repo : null
           if (ghRepo === null) {
             try {
-              const meta = entryPkgMeta(name, ctx.baseUrl ?? 'file:///')
+              const meta = entryPkgMeta(name, ctx.baseUrl ?? 'file:///', profileDirOf(ctx))
               const repoUrl = typeof meta?.repository === 'string' ? meta.repository : (meta?.repository && typeof meta.repository === 'object' ? meta.repository.url : null)
               const m = typeof repoUrl === 'string' ? repoUrl.replace(/^git\+/u, '').match(/github\.com[/:]([^/]+\/[^/]+?)(?:\.git)?$/u) : null
               if (m) ghRepo = m[1]
@@ -3941,6 +4108,17 @@ async function handle(ctx, req, res) {
   if (method === 'GET' && pathname === `${ROUTE_PREFIX}/state`) {
     const patchPath = findPatchPath(ctx)
     const patch = await readPatchState(patchPath)
+    // 补丁安全自愈（核心行误禁用恢复 / 缺失模块行自动禁用）——每 2 分钟最多跑一次
+    let patchHeal = null
+    try {
+      if (patchHealAt === null || Date.now() - patchHealAt > 120000) {
+        patchHealAt = Date.now()
+        patchHeal = await healPatchSafety(patchPath)
+      } else {
+        patchHeal = patchHealReport
+      }
+      if (patchHeal !== null) patchHealReport = patchHeal
+    } catch {}
     const extraRows = await readExtraBundleRows(dirname(patchPath))
     const compatPending = readCompatPending()
     const compatPendingRows = new Set((compatPending?.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => p.rowId))
@@ -3952,7 +4130,7 @@ async function handle(ctx, req, res) {
       }
     } catch {}
     const entries = listEntries(ctx).map((entry) => {
-      const meta = entryPkgMeta(entry.moduleName, ctx.baseUrl ?? 'file:///')
+      const meta = entryPkgMeta(entry.moduleName, ctx.baseUrl ?? 'file:///', profileDirOf(ctx))
       return {
         ...entry,
         userDisabled: patch.disables.includes(entry.rowId),
@@ -3976,7 +4154,7 @@ async function handle(ctx, req, res) {
       const selfPkg = JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json'), 'utf8'))
       selfVersion = typeof selfPkg.version === 'string' ? selfPkg.version : null
     } catch {}
-    sendJson(res, 200, { ok: true, entries, patchPath, compat, installJobs: jobs, recentFailures, github: { loggedIn: auth.loggedIn, login: auth.login }, patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts }, framework, compatPending: compatPending === null ? null : { frameworkVersion: compatPending.frameworkVersion ?? null, upgradeFrom: compatPending.upgradeFrom ?? null, pending: (compatPending.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => ({ rowId: p.rowId, moduleName: p.moduleName, version: p.version ?? null })) }, rollback: rollbackRec, selfVersion, components: findComponents().map((c) => ({ id: c.id, name: c.name, kind: c.kind ?? 'server', pid: c.pid ?? null, port: c.port ?? null, healthUrl: c.healthUrl ?? null, uiUrl: compUiUrl(c), autoStart: c.autoStart === true })) })
+    sendJson(res, 200, { ok: true, entries, patchPath, compat, installJobs: jobs, recentFailures, github: { loggedIn: auth.loggedIn, login: auth.login }, patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts }, framework, patchHeal: patchHeal === null ? null : { healed: patchHeal.healed ?? [], autoDisabled: patchHeal.autoDisabled ?? [], healedAt: patchHeal.healedAt ?? 0 }, compatPending: compatPending === null ? null : { frameworkVersion: compatPending.frameworkVersion ?? null, upgradeFrom: compatPending.upgradeFrom ?? null, pending: (compatPending.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => ({ rowId: p.rowId, moduleName: p.moduleName, version: p.version ?? null, checkNote: p.checkNote ?? null, check: p.check ?? null })) }, rollback: rollbackRec, selfVersion, components: findComponents().map((c) => ({ id: c.id, name: c.name, kind: c.kind ?? 'server', pid: c.pid ?? null, port: c.port ?? null, healthUrl: c.healthUrl ?? null, uiUrl: compUiUrl(c), autoStart: c.autoStart === true })) })
     return
   }
 
@@ -4143,7 +4321,7 @@ async function handle(ctx, req, res) {
       return
     }
     const moduleName = entry.options.name
-    const details = await readPluginDetails(moduleName, ctx.baseUrl ?? 'file:///')
+    const details = await readPluginDetails(moduleName, ctx.baseUrl ?? 'file:///', profileDirOf(ctx))
     sendJson(res, 200, { ok: true, entryId, rowId: rowIdOf(ctx, entryId), moduleName, ...details })
     return
   }
@@ -4178,11 +4356,25 @@ async function handle(ctx, req, res) {
       const compatPending = readCompatPending()
       const pend = (compatPending?.pending ?? []).find((p) => p.rowId === rowId && (p.status ?? 'pending') === 'pending')
       if (pend) {
-        sendError(res, 409, `「${rowId}」仍在框架升级适配门中（${compatPending.frameworkVersion ?? '?'}）被强制禁用：请先点击「更新并适配」，更新完成并通过兼容校验后系统自动解锁`)
+        sendError(res, 409, `「${rowId}」仍在框架升级适配门中（${compatPending.frameworkVersion ?? '?'}）被强制禁用：请先点击「更新并适配 / 已适配，立即解锁」，通过兼容校验后系统自动解锁`)
         return
       }
     }
     const patchPath = findPatchPath(ctx)
+    // 启用前冒烟检查（服务永不崩机制）：第三方模块在独立子进程中试 import，
+    // 失败（SyntaxError/缺失导出/模块缺失）即拒绝启用，杜绝「单行 import 失败→整个服务启动崩溃」
+    if (enabled) {
+      const moduleName = target?.options?.name
+      if (typeof moduleName === 'string' && !moduleName.startsWith('cordis:') && !moduleName.startsWith('@deepseek-ai/')) {
+        try {
+          const probe = await probePluginImport(moduleName, dirname(patchPath))
+          if (probe.ok !== true) {
+            sendError(res, 409, `启用前冒烟检查未通过：模块加载失败（${probe.detail ?? '未知'}）——该插件与当前框架不兼容或依赖缺失，已阻止启用（服务不会再被拖崩）；请先「检测更新/更新并适配」其适配版`)
+            return
+          }
+        } catch {}
+      }
+    }
     const result = enabled
       ? await enableEntry(patchPath, rowId)
       : await disableEntry(patchPath, rowId)
@@ -4218,14 +4410,18 @@ async function handle(ctx, req, res) {
     const owners = await readExtraBundleOwners(profileDir)
     const ownerBundle = owners.get(rowId) ?? owners.get(moduleName)
     if (ownerBundle !== undefined) {
-      await removeBundleFromManifest(profileDir, ownerBundle)
-      let uninstallError = null
-      try {
-        await pnpmRemove(profileDir, ownerBundle)
-      } catch (error) {
-        uninstallError = error instanceof Error ? error.message : String(error)
-      }
-      sendJson(res, 200, { ok: true, removed: 'bundle', packageName: ownerBundle, restart: true, uninstallError })
+      // 2026-09-04 事故教训：删除聚合包子路径行（如 @linxin666/dsh-web-all/plugin-manager）时
+      // 曾把整个 bundle 从清单移除，pnpm 卸载失败（corepack 报错）后重启，全家桶整体消失。
+      // 现改为：任何 bundle 行的「删除」= 仅停用该行（patch disabled:true），bundle 清单不动，
+      // 之后随时可「启用」恢复；整体卸载请走包管理器。
+      await disableEntry(patchPath, rowId)
+      sendJson(res, 200, {
+        ok: true,
+        removed: 'row',
+        packageName: moduleName,
+        restart: false,
+        note: '该行来自聚合包 ' + ownerBundle + '，已仅停用本行（bundle 保留，可随时启用恢复）；整体卸载请用包管理器执行 pnpm remove ' + ownerBundle,
+      })
       return
     }
     if (!patch.inserts.includes(rowId)) {
@@ -4664,11 +4860,105 @@ async function handle(ctx, req, res) {
     return
   }
 
+  if (pathname === `${ROUTE_PREFIX}/adapt-unlock`) {
+    // 待适配行「已适配，立即解锁」：无需等新版本——对已装模块重跑源码扫描，通过即移除禁用块。
+    const rowId = typeof body.rowId === 'string' ? body.rowId : ''
+    if (!/^[A-Za-z0-9_:.-]{1,80}$/u.test(rowId)) {
+      sendError(res, 400, 'rowId 无效')
+      return
+    }
+    const pending = readCompatPending()
+    const entry = (pending?.pending ?? []).find((p) => p.rowId === rowId && (p.status ?? 'pending') === 'pending')
+    if (entry === undefined) {
+      sendError(res, 404, '该行不在适配门待适配清单中（或已解锁）')
+      return
+    }
+    const patchPath = findPatchPath(ctx)
+    const profileDir = dirname(patchPath)
+    let pkg = null
+    let pkgDir = null
+    let version = null
+    try {
+      const require = createRequire(join(profileDir, 'package.json'))
+      const pkgPath = resolvePackageJson(entry.moduleName, profileDir)
+      if (pkgPath !== null) {
+        pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
+        version = typeof pkg?.version === 'string' ? pkg.version : null
+        pkgDir = dirname(pkgPath)
+      }
+    } catch {}
+    const fwVer = typeof pending.frameworkVersion === 'string' ? pending.frameworkVersion : '?'
+    const check = pkg !== null ? checkPluginFrameworkCompat(pkg, fwVer, pkgDir) : { decision: 'unknown', reason: '无法读取包信息' }
+    if (check.decision === 'fail') {
+      sendError(res, 409, `适配校验未通过：${check.reason}`)
+      return
+    }
+    await removeDisableBlock(patchPath, rowId)
+    entry.status = 'adopted'
+    entry.adoptedAt = Date.now()
+    entry.adoptedVersion = version
+    entry.adoptedFramework = fwVer
+    entry.check = check.decision
+    entry.checkNote = check.reason ?? null
+    writeCompatPending(pending)
+    sendJson(res, 200, { ok: true, rowId, adopted: true, check: check.decision, note: check.reason ?? null })
+    return
+  }
+
+  if (pathname === `${ROUTE_PREFIX}/adapt-unlock-all`) {
+    // 全家桶「一键启用已适配」：对家庭内所有待适配行批量重跑源码扫描，通过的全部解锁，未通过保留禁用。
+    const root = typeof body.root === 'string' ? body.root : ''
+    if (!/^(@[a-z0-9-][a-z0-9-._~]*\/)?[a-z0-9-][a-z0-9-._~]*$/u.test(root) || root.length > 214) {
+      sendError(res, 400, 'root 无效')
+      return
+    }
+    const pending = readCompatPending()
+    const patchPath = findPatchPath(ctx)
+    const profileDir = dirname(patchPath)
+    const targets = (pending?.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending' && (p.moduleName === root || String(p.moduleName).startsWith(root + '/')))
+    if (targets.length === 0) {
+      sendError(res, 404, '该全家桶没有待适配行（或已全部解锁）')
+      return
+    }
+    const fwVer = typeof pending.frameworkVersion === 'string' ? pending.frameworkVersion : '?'
+    const unlocked = []
+    const kept = []
+    for (const p of targets) {
+      let pkg = null
+      let pkgDir = null
+      let version = null
+      try {
+        const pkgPath = resolvePackageJson(p.moduleName, profileDir)
+        if (pkgPath !== null) {
+          pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
+          version = typeof pkg?.version === 'string' ? pkg.version : null
+          pkgDir = dirname(pkgPath)
+        }
+      } catch {}
+      const check = pkg !== null ? checkPluginFrameworkCompat(pkg, fwVer, pkgDir) : { decision: 'fail', reason: '无法读取包信息' }
+      if (check.decision === 'fail') {
+        kept.push({ rowId: p.rowId, reason: check.reason })
+        continue
+      }
+      await removeDisableBlock(patchPath, p.rowId)
+      p.status = 'adopted'
+      p.adoptedAt = Date.now()
+      p.adoptedVersion = version
+      p.adoptedFramework = fwVer
+      p.check = check.decision
+      p.checkNote = check.reason ?? null
+      unlocked.push(p.rowId)
+    }
+    writeCompatPending(pending)
+    sendJson(res, 200, { ok: true, root, unlocked, kept })
+    return
+  }
+
   if (pathname === `${ROUTE_PREFIX}/check-update`) {
     // 检测已安装插件是否有新版本：curl registry 元数据取 dist-tags.latest（node 网络黑洞时 curl 可用）。
     // 聚合包（有 dependencies）额外对比子包版本：声明版本 vs 本地 node_modules 实际版本，
     // 返回 depsOutdated 提示"更新本包需同步子包"，避免半更新混搭导致启动冲突。
-    const packageName = typeof body.packageName === 'string' ? body.packageName.trim() : ''
+    const packageName = packageNameOf(typeof body.packageName === 'string' ? body.packageName.trim() : '')
     if (!packageName) {
       sendError(res, 400, 'packageName 不能为空')
       return
@@ -4715,7 +5005,7 @@ async function handle(ctx, req, res) {
       // 覆盖 dsh-plugin-console（本面板）这类"源码在 GitHub、npm 上不存在"的宿主插件。
       let fallbackError = err instanceof Error ? err.message : String(err)
       try {
-        const meta = entryPkgMeta(packageName, ctx.baseUrl ?? 'file:///')
+        const meta = entryPkgMeta(packageName, ctx.baseUrl ?? 'file:///', profileDirOf(ctx))
         const repo = typeof meta?.repository === 'string'
           ? meta.repository.replace(/^git\+/u, '').replace(/\.git$/u, '')
           : (meta?.repository && typeof meta.repository === 'object' ? meta.repository.url : null)
@@ -4764,7 +5054,29 @@ async function handle(ctx, req, res) {
         error = `npm registry 查询失败且 GitHub 回退不可用（${fallbackError}；${fbErr instanceof Error ? fbErr.message : String(fbErr)}）`
       }
     }
-    sendJson(res, 200, { ok: true, packageName, latest, next, beta, depsOutdated, error, source })
+    // migrate 换名检测（2026-09-04 缺陷修复）：本地包声明 dsh.migrate.to 时查目标包最新版/引擎声明，
+    // 识别「项目已改名/迁移发布」的更新（如 @linxin666/dsh-web-ui-all → @linxin666/dsh-web-all 0.3.14）
+    let migrate = null
+    try {
+      const localPath = resolvePackageJson(packageName, profileDir)
+      if (localPath !== null) {
+      const localPkg = JSON.parse(readFileSync(localPath, 'utf8'))
+      const to = typeof localPkg.dsh?.migrate?.to === 'string' ? localPkg.dsh.migrate.to : null
+      if (to !== null && to !== '' && to !== packageName) {
+        const encTo = to.startsWith('@')
+          ? `@${encodeURIComponent(to.slice(1).split('/')[0])}%2f${encodeURIComponent(to.split('/').slice(1).join('/'))}`
+          : encodeURIComponent(to)
+        const meta = await fetchJsonUrl(`https://registry.npmmirror.com/${encTo}`)
+        const toLatest = meta?.['dist-tags']?.latest ?? meta?.['dist-tags']?.next ?? null
+        const toPkg = toLatest !== null ? (meta?.versions?.[toLatest] ?? null) : null
+        const engine = toPkg?.dsh?.engines?.dsh ?? toPkg?.engines?.dsh ?? null
+        const fwVer = currentFrameworkVersion(ctx)
+        const compatible = fwVer !== null && (engine === null || semverRangeMatchLoose(fwVer, engine))
+        migrate = { to, latest: toLatest, engine, compatible }
+      }
+      }
+    } catch {}
+    sendJson(res, 200, { ok: true, packageName, latest, next, beta, depsOutdated, error, source, migrate })
     return
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noob-stupid/dsh-plugin-console",
-  "version": "0.3.26",
+  "version": "0.3.28",
   "description": "DSH plugin management panel & marketplace: one-click enable/disable, multi-source market (GitHub/Gitee/custom), static-index market (500+ plugins / 300 skills), skills, suites, and one-click framework upgrade.",
   "repository": {
     "type": "git",