dsh-autorestart 0.3.5 → 0.3.6

package/README.md

@@ -195,6 +195,39 @@ The rollback is deliberately conservative: it only runs when the relaunched host
 own health route. A slow start inside `rollbackTimeoutMs` is never treated as a failure, and a
 healthy host is never touched.
 
+### The one-time install question
+
+The first time the plugin is used, the composer dock shows ONE non-modal panel that asks whether the
+pre-restart backup should also snapshot the installed plugin tree:
+
+- **"Configuration + installed plugins"** — about 3 seconds and 117 MB more per restart; a plugin
+  that breaks the boot can be rolled back too.
+- **"Configuration only"** — instant, about 66 KB; plugin problems cannot be rolled back and need a
+  manual reinstall.
+
+Both options share the same base: the **configuration** is always backed up. The plugins are an
+addition to it, never a rival of it.
+
+- **It is asked exactly once.** The panel is rendered only while
+  `localStorage['dsh-autorestart:backup-choice-v1']` is missing; picking an option records the answer and the
+  panel never comes back.
+- **Closing the panel counts as answering.** `×` and `Esc` write the very same "already answered" mark as
+  picking an option, so that browser is never asked again — and closing keeps the default (configuration *and*
+  plugins).
+- **It never blocks you.** The panel is a `role="status"` block in the composer dock: the input box
+  stays usable, nothing is modal, and the panel does not disappear on its own. It is keyboard
+  reachable and `Esc` closes it.
+- **Where the answer goes.** The host writes it into the profile configuration with the official
+  `configEditor` service — the same `backupIncludePlugins` key the settings page edits, so there is
+  one source of truth. If that service is unavailable the answer degrades to
+  `<DSH_HOME>/storages/dsh-autorestart/install-choice.json` and a warning is logged. The same fallback
+  happens in a hosted profile that declares no `dsh-autorestart` row of its own: there is no row for the
+  editor to write, so the answer lands in that file instead of the profile. Declare the row (see
+  *Hosted `dsh web` deployments* below) to keep the profile configuration as the single source of truth.
+- **How to change your mind later:** Settings → Plugins → dsh-autorestart → `backupIncludePlugins`.
+  `continuum_status` always reports the value that is in effect right now
+  (`backupIncludePlugins: true | false`).
+
 ## Requirements and limits
 
 - **Windows desktop.** `restartMode: app` restarts the DSH desktop app on Windows. Any other
@@ -217,6 +250,37 @@ healthy host is never touched.
 - **The restart closes and reopens the desktop window.** It is a full app restart, not a hot reload.
 - **The resumed round consumes API tokens**, exactly like typing "continue" by hand.
 
+### Hosted `dsh web` deployments
+
+| Deployment | `restartMode` | How the host is restarted |
+| --- | --- | --- |
+| DeepSeek Harness desktop app (Windows) | `app` (the default) | The host's own app restart: the old process tree is killed and the desktop app is relaunched |
+| A hosted `dsh web` deployment | `command` | There is no "restart the app" in a web deployment — you must supply the command yourself |
+
+Minimal configuration for a hosted `dsh web` (it **replaces** the whole `config` block, it is not merged):
+
+```yaml
+- id: dsh-autorestart
+  config:
+    restartMode: command
+    restartCommand: systemctl --user restart dsh-web
+```
+
+`restartCommand` may use the placeholders `{pid}` (this host), `{ppid}` (its parent) and `{app}` (the desktop
+app path).
+
+**Without that configuration the restart fails, and it says so.** A hosted host is not the desktop app, so
+the plugin has no way to relaunch it: the log gets
+`no restart method available (not the desktop app and restartCommand is empty); leaving the checkpoint in place`,
+the pending restart is rolled back (one retry with a backoff, then it is cancelled instead of retrying
+forever), and nothing is relaunched — the checkpoint simply stays on disk, so the session is picked up again
+when the host is started by hand. `continuum_status` keeps reporting the pending state until it is cancelled.
+
+The same profile row is what the one-time install question writes into: a hosted profile that declares no
+`dsh-autorestart` row has no row for the `configEditor` service to edit, so the answer falls back to
+`<DSH_HOME>/storages/dsh-autorestart/install-choice.json` instead of the profile configuration. Declaring the
+row keeps the profile (and therefore the settings page) as the single source of truth.
+
 ## Verify
 
 The health route tells you whether the plugin is alive and what it has done:

package/client.js

@@ -60,6 +60,11 @@ window.__ModuleLoader__.load({
     // is only the fallback for an older Host.
     const ROUTE_PREFIX = HEALTH_URL.split('?')[0].replace(/\/[^/]*$/, '')
     const DEFAULT_PARK_URL = ROUTE_PREFIX + '/park'
+    // The route that persists the one-time install choice.
+    const DEFAULT_CHOICE_URL = ROUTE_PREFIX + '/choice'
+    // The browser-side record of the one-time install choice. The prompt is
+    // shown only while this key is missing, so it is asked exactly once.
+    const BACKUP_CHOICE_KEY = 'dsh-autorestart:backup-choice-v1'
     const POLL_MS = 2000
     // The brand accent (blue-purple). The pending-restart marker is a brand
     // signal, not a warning: no warning/yellow token is used here.
@@ -112,6 +117,21 @@ window.__ModuleLoader__.load({
       durationSeconds: '{n} 秒',
       durationMinutes: '{n} 分 {m} 秒',
       durationHours: '{n} 小时 {m} 分',
+      // The one-time install prompt (the choice is asked exactly once).
+      // "Backup" is the verb and BOTH options share the "configuration" base:
+      // the plugins are an ADDITION to the configuration, never a rival of it.
+      backupChoiceTitle: '重启前自动备份：要不要把已安装的插件也一起备份？',
+      backupChoiceBody: '每次重启前会快照当前配置，万一重启后起不来就能自动回退。',
+      backupChoiceWithPlugins: '配置 + 已安装插件',
+      backupChoiceWithPluginsHint: '多约 3 秒、约 117 MB；插件把启动搞坏时也能回退。',
+      backupChoiceConfigOnly: '只备份配置',
+      backupChoiceConfigOnlyHint: '瞬间完成、约 66 KB；插件问题无法回退，需要手动重装。',
+      backupChoiceFootnote: '以后可在 设置 → 插件 → dsh-autorestart 修改',
+      backupChoicePickPrimary: '用这个',
+      backupChoicePickSecondary: '只备份配置',
+      backupChoiceRecommended: '推荐',
+      backupChoiceDismissAria: '关闭这个一次性提示',
+      backupChoiceError: '保存失败：{message}',
     }
 
     const EN = {
@@ -149,6 +169,21 @@ window.__ModuleLoader__.load({
       durationSeconds: '{n}s',
       durationMinutes: '{n}m {m}s',
       durationHours: '{n}h {m}m',
+      // The one-time install prompt (the choice is asked exactly once).
+      // "Backup" is the verb and BOTH options share the "configuration" base:
+      // the plugins are an ADDITION to the configuration, never a rival of it.
+      backupChoiceTitle: 'Automatic pre-restart backup: include the installed plugins too?',
+      backupChoiceBody: 'A snapshot of the current configuration is taken before every restart, so a host that fails to come back can be rolled back automatically.',
+      backupChoiceWithPlugins: 'Configuration + installed plugins',
+      backupChoiceWithPluginsHint: 'About 3 seconds and 117 MB more; a plugin that breaks the boot can be rolled back too.',
+      backupChoiceConfigOnly: 'Configuration only',
+      backupChoiceConfigOnlyHint: 'Instant, about 66 KB; plugin problems cannot be rolled back and need a manual reinstall.',
+      backupChoiceFootnote: 'You can change this later in Settings → Plugins → dsh-autorestart',
+      backupChoicePickPrimary: 'Use this',
+      backupChoicePickSecondary: 'Configuration only',
+      backupChoiceRecommended: 'Recommended',
+      backupChoiceDismissAria: 'Close this one-time prompt',
+      backupChoiceError: 'Could not save the choice: {message}',
     }
 
     // Bound during `apply`. The slots are registered without a locale
@@ -336,6 +371,49 @@ window.__ModuleLoader__.load({
       return DEFAULT_PARK_URL
     }
 
+    /**
+     * The route that persists the one-time install choice: the one the Host
+     * sent with the state payload, or the one derived from the health path.
+     */
+    function choiceUrlFor(info) {
+      const sent = info && typeof info.choiceUrl === 'string' ? info.choiceUrl.trim() : ''
+      if (sent.startsWith('/')) return sent
+      return DEFAULT_CHOICE_URL
+    }
+
+    /**
+     * Whether the one-time install prompt may be shown.
+     *
+     * It may be shown only while the browser has no record of a choice yet,
+     * i.e. while `localStorage['dsh-autorestart:backup-choice-v1']` is
+     * missing. A browser without a usable localStorage answers "no": the
+     * prompt must not come back on every reload there.
+     */
+    function backupChoicePending() {
+      try {
+        if (typeof window === 'undefined' || !window.localStorage) return false
+        return window.localStorage.getItem(BACKUP_CHOICE_KEY) === null
+      } catch {
+        return false
+      }
+    }
+
+    /**
+     * Record the one-time choice in the browser.
+     *
+     * The key is written as soon as the user picks an option (or closes the
+     * prompt), so the question is asked exactly once.
+     */
+    function writeBackupChoice(value) {
+      try {
+        if (typeof window === 'undefined' || !window.localStorage) return false
+        window.localStorage.setItem(BACKUP_CHOICE_KEY, String(value))
+        return true
+      } catch {
+        return false
+      }
+    }
+
     /** A short, human readable description of a failed request. */
     function describeError(error) {
       if (!error) return 'unknown error'
@@ -486,6 +564,180 @@ window.__ModuleLoader__.load({
       color: 'var(--dsw-alias-danger, #d14343)',
     }
 
+    // The one-time install prompt. It is NOT a modal: it is an ordinary block
+    // in the composer dock, so the input box stays usable and nothing is
+    // blocked. It never disappears on its own.
+    //
+    // The look follows the established DSH plugin styling: one 14px/600
+    // heading, a muted subtitle, two selectable rows (a name + a note on the
+    // left, the action on the right) and a muted footnote. The primary option
+    // carries a "recommended" pill and a solid button; the secondary one is
+    // outlined. Only theme tokens are used, so light and dark themes both
+    // work.
+    const CHOICE_STYLE_ID = 'dsh-autorestart-choice'
+    const CHOICE_CSS = [
+      '.dsh-autorestart-choice{',
+      '  display:flex;',
+      '  flex-direction:column;',
+      '  gap:8px;',
+      '  width:min(560px,94vw);',
+      '  max-width:100%;',
+      '  box-sizing:border-box;',
+      '  margin:0 0 6px;',
+      '  padding:16px 18px;',
+      '  border:1px solid var(--dsw-alias-border-l1);',
+      '  border-radius:12px;',
+      '  background:var(--dsw-alias-bg-layer-1);',
+      '  box-shadow:0 8px 24px color-mix(in srgb, var(--dsw-alias-bg-mask-3) 20%, transparent);',
+      '  color:var(--dsw-alias-label-secondary);',
+      '  font-size:13px;',
+      '  line-height:18px;',
+      '}',
+      '.dsh-autorestart-choice h3{',
+      '  margin:0;',
+      '  font-size:14px;',
+      '  font-weight:600;',
+      '  line-height:20px;',
+      '  color:var(--dsw-alias-label-primary);',
+      '}',
+      '.dsh-autorestart-choice p{margin:0;}',
+      '.dsh-autorestart-choice__head{',
+      '  display:flex;',
+      '  align-items:flex-start;',
+      '  justify-content:space-between;',
+      '  gap:10px;',
+      '}',
+      '.dsh-autorestart-choice__subtitle{',
+      '  font-size:12.5px;',
+      '  line-height:18px;',
+      '  color:var(--dsw-alias-label-secondary);',
+      '}',
+      '.dsh-autorestart-choice__options{',
+      '  display:flex;',
+      '  flex-direction:column;',
+      '  gap:10px;',
+      '}',
+      '.dsh-autorestart-choice__row{',
+      '  display:flex;',
+      '  align-items:center;',
+      '  justify-content:space-between;',
+      '  gap:10px;',
+      '  padding:10px 12px;',
+      '  border:1px solid transparent;',
+      '  border-radius:10px;',
+      '  cursor:pointer;',
+      '  transition:background-color .14s,border-color .14s;',
+      '}',
+      '.dsh-autorestart-choice__row:hover,',
+      '.dsh-autorestart-choice__row:focus-within{',
+      '  border-color:var(--dsw-alias-border-l1);',
+      '  background:var(--dsw-alias-bg-layer-2, color-mix(in srgb, var(--dsw-alias-label-primary) 4%, transparent));',
+      '}',
+      '.dsh-autorestart-choice__row:focus-visible{',
+      '  outline:2px solid var(--dsw-alias-state-business-primary,var(--dsw-alias-brand-primary,#4d6bfe));',
+      '  outline-offset:2px;',
+      '}',
+      '.dsh-autorestart-choice__text{flex:1 1 auto;min-width:0;}',
+      '.dsh-autorestart-choice__title{',
+      '  display:flex;',
+      '  align-items:center;',
+      '  gap:6px;',
+      '  min-width:0;',
+      '}',
+      '.dsh-autorestart-choice__name{',
+      '  font-size:13px;',
+      '  font-weight:600;',
+      '  line-height:18px;',
+      '  color:var(--dsw-alias-label-primary);',
+      '}',
+      '.dsh-autorestart-choice__hint{',
+      '  display:block;',
+      '  margin-top:2px;',
+      '  font-size:12px;',
+      '  line-height:17px;',
+      '  color:var(--dsw-alias-label-secondary);',
+      '}',
+      '.dsh-autorestart-choice__badge{',
+      '  flex:none;',
+      '  display:inline-block;',
+      '  padding:1px 7px;',
+      '  border-radius:999px;',
+      '  font-size:11px;',
+      '  font-weight:600;',
+      '  line-height:16px;',
+      '  color:var(--dsw-alias-state-business-primary,var(--dsw-alias-brand-primary,#4d6bfe));',
+      '  background:color-mix(in srgb, var(--dsw-alias-state-business-primary,var(--dsw-alias-brand-primary,#4d6bfe)) 12%, transparent);',
+      '}',
+      '.dsh-autorestart-choice__cta{',
+      '  flex:none;',
+      '  min-width:28px;',
+      '  min-height:28px;',
+      '  padding:4px 12px;',
+      '  border-radius:8px;',
+      '  font:inherit;',
+      '  font-size:12.5px;',
+      '  font-weight:600;',
+      '  line-height:18px;',
+      '  cursor:pointer;',
+      '  transition:background-color .14s,border-color .14s,color .14s;',
+      '}',
+      '.dsh-autorestart-choice__cta:focus-visible{',
+      '  outline:2px solid var(--dsw-alias-state-business-primary,var(--dsw-alias-brand-primary,#4d6bfe));',
+      '  outline-offset:2px;',
+      '}',
+      '.dsh-autorestart-choice__cta--primary{',
+      '  border:1px solid transparent;',
+      '  background:var(--dsw-alias-state-business-primary,var(--dsw-alias-brand-primary,#4d6bfe));',
+      '  color:var(--dsw-alias-bg-layer-1,#fff);',
+      '}',
+      '.dsh-autorestart-choice__cta--secondary{',
+      '  border:1px solid var(--dsw-alias-border-l1);',
+      '  background:transparent;',
+      '  color:var(--dsw-alias-label-primary);',
+      '}',
+      '.dsh-autorestart-choice__cta--secondary:hover{',
+      '  border-color:var(--dsw-alias-state-business-primary,var(--dsw-alias-brand-primary,#4d6bfe));',
+      '  color:var(--dsw-alias-state-business-primary,var(--dsw-alias-brand-primary,#4d6bfe));',
+      '}',
+      '.dsh-autorestart-choice__close{',
+      '  flex:none;',
+      '  width:28px;',
+      '  height:28px;',
+      '  padding:0;',
+      '  border:1px solid transparent;',
+      '  border-radius:8px;',
+      '  background:transparent;',
+      '  color:var(--dsw-alias-label-secondary);',
+      '  font:inherit;',
+      '  font-size:16px;',
+      '  line-height:1;',
+      '  cursor:pointer;',
+      '  transition:background-color .14s;',
+      '}',
+      '.dsh-autorestart-choice__close:hover{',
+      '  background:var(--dsw-alias-bg-layer-2, color-mix(in srgb, var(--dsw-alias-label-primary) 6%, transparent));',
+      '}',
+      '.dsh-autorestart-choice__close:focus-visible{',
+      '  outline:2px solid var(--dsw-alias-state-business-primary,var(--dsw-alias-brand-primary,#4d6bfe));',
+      '  outline-offset:2px;',
+      '}',
+      '.dsh-autorestart-choice__footnote{',
+      '  margin-top:10px;',
+      '  padding-top:10px;',
+      '  border-top:1px solid var(--dsw-alias-border-l1);',
+      '  font-size:11px;',
+      '  line-height:16px;',
+      '  color:var(--dsw-alias-label-secondary);',
+      '}',
+      '@media (max-width:1023px){',
+      '  .dsh-autorestart-choice{width:calc(100vw - 32px);}',
+      '}',
+      '@media (max-width:640px){',
+      '  .dsh-autorestart-choice__row{flex-direction:column;align-items:stretch;}',
+      '  .dsh-autorestart-choice__cta{width:100%;}',
+      '}',
+    ].join('\n')
+
     /**
      * One compact pill in the composer tool row, visible only while THIS
      * session is waiting for a pending restart. Clicking it (or pressing
@@ -681,6 +933,220 @@ window.__ModuleLoader__.load({
       })
     }
 
+    /**
+     * Inject the prompt styles exactly once. The id keeps a second injection
+     * from duplicating the rule.
+     */
+    function ensureChoiceStyle() {
+      if (typeof document === 'undefined' || !document.head) return
+      try {
+        if (document.getElementById(CHOICE_STYLE_ID)) return
+        const style = document.createElement('style')
+        style.id = CHOICE_STYLE_ID
+        style.textContent = CHOICE_CSS
+        document.head.appendChild(style)
+      } catch {
+        // Without the stylesheet the prompt is still readable, just plainer.
+      }
+    }
+
+    /**
+     * The one-time install prompt.
+     *
+     * It asks ONE question — should the pre-restart backup also snapshot the
+     * installed plugin tree? — and it is asked exactly once: the panel is
+     * rendered only while `localStorage['dsh-autorestart:backup-choice-v1']`
+     * is missing.
+     *
+     * "Backup" is the verb and BOTH options share the "configuration" base:
+     * the plugins are an addition to the configuration, never a rival of it.
+     *
+     * It is deliberately NOT a modal: it is an ordinary block in the composer
+     * dock (`role="status"`), so the input box stays usable, nothing is
+     * blocked, and it never disappears on its own — it stays until the user
+     * picks an option or closes it. It is keyboard reachable (focusable, Esc
+     * closes it) and adapts to a narrow window.
+     *
+     * The answer goes to the Host, which writes it into the profile
+     * configuration (the same key the settings page edits).
+     */
+    function BackupChoicePanel() {
+      const info = useSharedInfo(true)
+      // The prompt is rendered only while the browser has no record yet.
+      const [visible, setVisible] = useState(backupChoicePending)
+      const [busy, setBusy] = useState(false)
+      const [error, setError] = useState('')
+      const t = translate ?? ((name) => name)
+
+      /**
+       * Hand the choice to the Host.
+       *
+       * The browser records the choice FIRST (so the question is never asked
+       * twice) and then posts it to the Host, which persists it in the
+       * profile configuration.
+       */
+      const choose = (includePlugins) => {
+        if (busy) return
+        setBusy(true)
+        setError('')
+        writeBackupChoice(includePlugins ? 'plugins' : 'config-only')
+        setVisible(false)
+        void (async () => {
+          try {
+            const response = await fetch(choiceUrlFor(info), {
+              method: 'POST',
+              headers: { 'content-type': 'application/json' },
+              body: JSON.stringify({ includePlugins }),
+            })
+            if (!response.ok) {
+              setError(fill(t('backupChoiceError'), { message: String(response.status) }))
+            }
+          } catch (failure) {
+            setError(fill(t('backupChoiceError'), { message: describeError(failure) }))
+          } finally {
+            setBusy(false)
+          }
+        })()
+      }
+
+      /**
+       * Close the prompt without answering: the default (the configuration
+       * AND the installed plugins) stays in place, and the question is not
+       * asked again.
+       */
+      const dismiss = () => {
+        if (busy) return
+        writeBackupChoice('dismissed')
+        setVisible(false)
+      }
+
+      /** Esc closes the prompt (the panel itself is focusable). */
+      const onKeyDown = (event) => {
+        if (!event) return
+        if (event.key === 'Escape' || event.key === 'Esc') dismiss()
+      }
+
+      if (!visible) return null
+      ensureChoiceStyle()
+
+      /**
+       * One option row.
+       *
+       * The WHOLE row is the click target (and it is focusable, with the
+       * radio semantics of a one-of-two choice), while the right side carries
+       * the concrete action. The primary row wears a "recommended" pill and a
+       * solid button; the secondary one an outlined button.
+       */
+      const optionRow = (key, name, hint, cta, variant, recommended) => {
+        const pick = () => choose(key === 'plugins')
+        const onRowClick = () => pick()
+        const onRowKeyDown = (event) => {
+          if (!event) return
+          if (event.key === 'Enter' || event.key === ' ' || event.key === 'Spacebar') {
+            if (typeof event.preventDefault === 'function') event.preventDefault()
+            pick()
+          }
+        }
+        // The button inside the row must not trigger the row a second time.
+        const onCtaClick = (event) => {
+          if (event && typeof event.stopPropagation === 'function') event.stopPropagation()
+          pick()
+        }
+        return h(
+          'div',
+          {
+            key,
+            className: 'dsh-autorestart-choice__row',
+            role: 'radio',
+            'aria-checked': 'false',
+            'aria-label': name,
+            tabIndex: busy ? -1 : 0,
+            'data-backup-choice': key,
+            onClick: onRowClick,
+            onKeyDown: onRowKeyDown,
+          },
+          h(
+            'div',
+            { className: 'dsh-autorestart-choice__text' },
+            h(
+              'span',
+              { className: 'dsh-autorestart-choice__title' },
+              recommended
+                ? h('span', { className: 'dsh-autorestart-choice__badge' }, t('backupChoiceRecommended'))
+                : null,
+              h('span', { className: 'dsh-autorestart-choice__name' }, name),
+            ),
+            h('span', { className: 'dsh-autorestart-choice__hint' }, hint),
+          ),
+          h(
+            'button',
+            {
+              type: 'button',
+              className: 'dsh-autorestart-choice__cta dsh-autorestart-choice__cta--' + variant,
+              'data-backup-choice': key,
+              'aria-label': cta,
+              title: cta,
+              disabled: busy,
+              onClick: onCtaClick,
+            },
+            cta,
+          ),
+        )
+      }
+
+      return h(
+        'div',
+        {
+          className: 'dsh-autorestart-choice',
+          role: 'status',
+          'aria-live': 'polite',
+          tabIndex: 0,
+          onKeyDown,
+          'data-dsh-autorestart-backup-choice': 'true',
+        },
+        h(
+          'div',
+          { className: 'dsh-autorestart-choice__head' },
+          h('h3', null, t('backupChoiceTitle')),
+          h(
+            'button',
+            {
+              type: 'button',
+              className: 'dsh-autorestart-choice__close',
+              'aria-label': t('backupChoiceDismissAria'),
+              title: t('backupChoiceDismissAria'),
+              disabled: busy,
+              onClick: dismiss,
+            },
+            '×',
+          ),
+        ),
+        h('p', { className: 'dsh-autorestart-choice__subtitle' }, t('backupChoiceBody')),
+        h(
+          'div',
+          { className: 'dsh-autorestart-choice__options' },
+          optionRow(
+            'plugins',
+            t('backupChoiceWithPlugins'),
+            t('backupChoiceWithPluginsHint'),
+            t('backupChoicePickPrimary'),
+            'primary',
+            true,
+          ),
+          optionRow(
+            'config-only',
+            t('backupChoiceConfigOnly'),
+            t('backupChoiceConfigOnlyHint'),
+            t('backupChoicePickSecondary'),
+            'secondary',
+            false,
+          ),
+        ),
+        h('p', { className: 'dsh-autorestart-choice__footnote' }, t('backupChoiceFootnote')),
+        error === '' ? null : h('p', { role: 'alert' }, error),
+      )
+    }
+
     return {
       inject: ['slots', 'locale'],
       apply(ctx) {
@@ -692,6 +1158,7 @@ window.__ModuleLoader__.load({
         translate = t
         ctx.slots.inject('conversation.input.left', () => ctx.slots.register({ name: 'conversation.input.left', id: 'autorestart-restart-pill', order: 0 }, RestartPill))
         ctx.slots.inject('sidebar.session.row.leading', () => ctx.slots.register({ name: 'sidebar.session.row.leading', id: 'autorestart-restart-dot', order: 20 }, RestartDot))
+        ctx.slots.inject('conversation.input.dock', () => ctx.slots.register({ name: 'conversation.input.dock', id: 'autorestart-backup-choice', order: 7, locale: NS }, BackupChoicePanel))
       },
     }
   },

package/cordis.patch.yml

@@ -36,6 +36,9 @@
         backupOnRestart: true
         # Include the installed plugin tree in that snapshot (bigger: ~120 MB here,
         # but it is what lets a rollback undo "a plugin upgrade broke the boot").
+        # The first install asks once whether this should be on; the answer is
+        # written to THIS key through the official configEditor service, so the
+        # settings page and the one-time prompt always show the same value.
         backupIncludePlugins: true
         # Keep at most this many snapshots; older ones are deleted automatically.
         maxBackups: 2

package/docs/README.zh.md

@@ -71,6 +71,21 @@ session resume on boot, durable-goal re-arm, and an agent-callable idle-aware gr
 - 下次启动时 `continuum_status` 会报 `lastRollback`（时间、等了多久、是否回滚、快照路径、崩溃日志名与尾部摘要）。
 - 开关：`backupOnRestart`（默认 `true`）、`backupIncludePlugins`（默认 `true`，关掉就只备配置文件）、`maxBackups`（默认 `2`）、`rollbackTimeoutMs`（默认 `90000`）。
 
+### 首次安装只问一次：备份要不要连已装插件一起备
+
+第一次用这个插件时，输入框上方会出现**一条非模态提示**（不是弹窗，不挡输入框，也不会自己消失），问一句：
+
+- **「配置 + 已安装插件」** —— 每次重启多约 3 秒、约 117 MB；插件把启动搞坏时也能一起回退。
+- **「只备份配置」** —— 瞬间完成、约 66 KB；插件问题无法回退，需要手动重装。
+
+两个选项共享同一个基底：**配置一定会被备份**，插件只是"要不要额外带上"，不是二选一。
+
+- **只问一次**：只有 `localStorage['dsh-autorestart:backup-choice-v1']` 缺失时才渲染；点任一项都会写下这个键，之后不再出现。
+- **关掉也算作答**：按 `×` 或 `Esc` 与点选项写的是同一个「已作答」标记，这个浏览器此后**不会再被问**；关掉等于保留默认（配置 + 已安装插件）。
+- **不打扰**：面板是 `role="status"` 的普通块，放在输入框下方的 dock 里；可聚焦、键盘可达、`Esc` 关闭。
+- **答案存在哪**：宿主用官方 `configEditor` Service 写进 profile 配置（就是设置页里那个 `backupIncludePlugins` 键，**只有一份真相**）。万一这个服务不可用，才退化到写 `<DSH_HOME>/storages/dsh-autorestart/install-choice.json` 并在日志里 `warn`。**托管 profile 如果自己没有声明 `dsh-autorestart` 行**，就没有行可写，答案同样落在这个文件里而不是 profile 里 —— 声明那一行（见「平台与部署」）才能让 profile 配置保持唯一真相。
+- **想改主意**：设置 → 插件 → dsh-autorestart → `backupIncludePlugins`。`continuum_status` 里随时能看到当前生效值（`backupIncludePlugins: true | false`）。
+
 ## 工作方式
 
 ```
@@ -492,6 +507,18 @@ or by requesting the health path with ?gate=1.
     restartCommand: systemctl --user restart dsh-web
 ```
 
+`restartCommand` 里可以用占位符 `{pid}`（当前宿主）、`{ppid}`（它的父进程）、`{app}`（桌面端路径）。
+
+**不配这个，重启就会失败，而且失败是有提示的**：托管宿主不是桌面端，插件没有「重启应用」的能力，
+日志里会出现
+`no restart method available (not the desktop app and restartCommand is empty); leaving the checkpoint in place`，
+待重启会被回退（退避后重试一次，再失败就取消，不会永远重试），**不会有任何进程被拉起** —— 只是把检查点
+留在盘上，等你手动把宿主再起一次时它会接着跑。`continuum_status` 在取消之前会一直报待重启状态。
+
+同一个 profile 行也是首次安装那次提问的落点：**托管 profile 如果自己没有 `dsh-autorestart` 行**，
+`configEditor` 就没有行可写，答案会退到 `<DSH_HOME>/storages/dsh-autorestart/install-choice.json`
+而不是 profile 配置；声明这一行才能让 profile（以及设置页）保持唯一真相。
+
 - **浏览器侧的「待重启」小胶囊**依赖 `GET <healthPath>?state=1` 这条状态路由。这条路由现在接受
   **loopback 调用者**，*或* **宿主 connection 服务判定为「已认证浏览器」的请求**
   （`connection.requestRejection` 不给拒绝码就放行）。所以：**托管部署必须允许已认证浏览器访问这条状态路由**，