dsh-m 0.3.0 → 0.4.0

package/lib/core/dsh-cli.js

@@ -10,6 +10,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { installTimeoutMs, WEB_PROFILE, webProfileDir } from './env.js';
 import { createProgressTracker } from './progress.js';
+import { applyPreciseBuilds, readPendingBuilds } from './build-approval.js';
 /** pnpm patchedDependencies 条目键与目标包匹配：`pkg` 或 `pkg@任意版本/区间`。 */
 function matchesPatchedKey(key, pkg) {
     return key === pkg || key.startsWith(`${pkg}@`);
@@ -297,7 +298,7 @@ export function withDangerouslyAllowAllBuilds(yaml) {
         return 'dangerouslyAllowAllBuilds: true\n';
     return `${yaml.replace(/\s*$/u, '\n')}\ndangerouslyAllowAllBuilds: true\n`;
 }
-/** 基线 §17.4：放行构建脚本前必须能被明确报告（返回值带 usedAllowAllBuilds）。 */
+/** 基线 §17.4：放行构建脚本前必须能被明确报告（结果带 buildApprovals）。 */
 function writeDangerouslyAllowAllBuilds(profileDirectory) {
     const file = join(profileDirectory, 'pnpm-workspace.yaml');
     let yaml = '';
@@ -314,6 +315,31 @@ function writeDangerouslyAllowAllBuilds(profileDirectory) {
     writeFileSync(file, next);
     return true;
 }
+/**
+ * 精确放行默认实现（ADR-0002）：needs-builds 拦截后先读 pending 名单，
+ * 非空 → 逐键写 allowBuilds（approvals 携带包名）；空/不可读 → 全量兜底。
+ * 写入失败 throw（ladder 的 Y2 契约转换为 hard-fail 结果）。
+ * 已知风险（不加锁）：官方 approveBuilds 前提是 caller 持 manifest 锁；dsh-m 只有
+ * 进程内 FIFO，与官方 UI 并发安装时有低概率写竞态，相关整单失败走既有回滚语义。
+ */
+function writePreciseBuilds(profileDirectory) {
+    const file = join(profileDirectory, 'pnpm-workspace.yaml');
+    let yaml = '';
+    try {
+        yaml = readFileSync(file, 'utf8');
+    }
+    catch {
+        /* 文件缺失 → pending 名单为空 → 走兜底创建 */
+    }
+    const pending = readPendingBuilds(yaml);
+    if (pending.length > 0) {
+        mkdirSync(profileDirectory, { recursive: true });
+        writeFileSync(file, applyPreciseBuilds(yaml, pending));
+        return { approvals: pending, fallbackAll: false };
+    }
+    writeDangerouslyAllowAllBuilds(profileDirectory);
+    return { approvals: [], fallbackAll: true };
+}
 /**
  * 失败摘要：命令失败时从完整输出里提取可诊断的行，而不是盲取末尾。
  * 2026-09-05 实证（dsh-better-sidebar 安装失败）：pnpm ndjson 错误行 ~1.2KB，
@@ -550,13 +576,14 @@ export async function runDshPlugin(profile, pluginArgs, deps = {}) {
  */
 export function makeAddViaLadder(deps) {
     const run = deps.runDshPlugin;
-    const allowAllBuilds = deps.allowAllBuilds ?? writeDangerouslyAllowAllBuilds;
+    const resolveBuilds = deps.resolveBuilds ?? writePreciseBuilds;
     const opts = (signal) => (signal !== undefined ? { signal } : undefined);
     return async (source, profileDir, signal) => {
         const retryAfterPrepare = async () => {
-            // Y2（终审复审）：allowAll 写入本身失败也必须转换为结果，维持「永不 throw」契约
+            // Y2（终审复审）：放行写入本身失败也必须转换为结果，维持「永不 throw」契约
+            let decision;
             try {
-                allowAllBuilds(profileDir);
+                decision = resolveBuilds(profileDir);
             }
             catch (err) {
                 const text = errText(err);
@@ -564,7 +591,7 @@ export function makeAddViaLadder(deps) {
             }
             try {
                 const output = await run(WEB_PROFILE, ['add', source], opts(signal));
-                return { class: 'ok', output: truncateOutput(output), usedAllowAllBuilds: true };
+                return { class: 'ok', output: truncateOutput(output), buildApprovals: decision.approvals, fallbackAllBuilds: decision.fallbackAll };
             }
             catch (retryErr) {
                 return { ...classifyPnpmError(errText(retryErr)), output: truncateOutput(errText(retryErr)) };
@@ -572,7 +599,7 @@ export function makeAddViaLadder(deps) {
         };
         try {
             const output = await run(WEB_PROFILE, ['add', source], opts(signal));
-            return { class: 'ok', output: truncateOutput(output), usedAllowAllBuilds: false };
+            return { class: 'ok', output: truncateOutput(output), buildApprovals: [], fallbackAllBuilds: false };
         }
         catch (err) {
             const text = errText(err);
@@ -586,7 +613,7 @@ export function makeAddViaLadder(deps) {
                 }
                 try {
                     const output = await run(WEB_PROFILE, ['add', source], opts(signal));
-                    return { class: 'ok', output: truncateOutput(output), usedAllowAllBuilds: false };
+                    return { class: 'ok', output: truncateOutput(output), buildApprovals: [], fallbackAllBuilds: false };
                 }
                 catch (retryErr) {
                     const retryText = errText(retryErr);

package/lib/core/enablement.js

@@ -0,0 +1,92 @@
+import { isSingleRowPlugin } from './patch-yaml.js';
+/** 官方 Cordis FiberState 数字枚举（跨包 const enum 的运行时镜像，inventory 同款）。 */
+const FIBER_PHASE = {
+    0: 'pending',
+    1: 'loading',
+    2: 'active',
+    3: 'failed',
+    5: 'unloading',
+};
+export const PROTECTED_MODULES = [
+    'dsh-m',
+    '@deepseek-ai/dsh-plugin-manager',
+    '@deepseek-ai/cordis-plugin-loader',
+    '@deepseek-ai/cordis-plugin-include',
+    '@deepseek-ai/dsh-api-gateway',
+    '@deepseek-ai/dsh-host-webserver',
+    '@deepseek-ai/dsh-client-modules',
+    '@deepseek-ai/dsh-client-ui-settings-plugin-inventory',
+    '@deepseek-ai/dsh-client-ui-plugin-manager',
+    '@deepseek-ai/dsh-host-plugin-inventory',
+    '@deepseek-ai/dsh-typert-registry',
+    '@deepseek-ai/dsh-api-remotes',
+    '@deepseek-ai/cordis-plugin-timer',
+    '@deepseek-ai/dsh-client-connection',
+    '@deepseek-ai/dsh-host-frontend-static',
+    '@deepseek-ai/dsh-tools',
+    '@deepseek-ai/dsh-hmr',
+];
+function mapPhase(fiber) {
+    if (fiber === undefined || fiber === null)
+        return null;
+    const state = typeof fiber.state === 'string' ? Number(fiber.state) : fiber.state;
+    if (typeof state !== 'number' || !Number.isInteger(state))
+        return null;
+    return FIBER_PHASE[state] ?? null;
+}
+/** 按模块名在 loader 条目中找插件的第一条非 group 条目（官方 moduleName 匹配同款）。 */
+function findLoaderEntry(entries, pkg) {
+    for (const entry of entries) {
+        if (entry && entry.options?.name === pkg)
+            return entry;
+    }
+    return null;
+}
+/**
+ * 已装清单 → 每包 { enabled, phase, granularity, toggleable, lockReason }。
+ * toggleable=false 当且仅当：命中保护名单（protected/self）或「不在 bundles 且
+ * loader 无 entry」（no-entry——未装载不是被关）。粒度由包内补丁层行枚举决定。
+ */
+export function composeEnablement(input) {
+    const { items, loaderEntries, bundles, profileOverrides } = input;
+    const result = new Map();
+    const overrideIndex = new Map(profileOverrides.map((row) => [row.id, row.disabled]));
+    for (const item of items) {
+        const pkg = item.pkg;
+        const entry = loaderEntries !== null ? findLoaderEntry(loaderEntries, pkg) : null;
+        const inBundles = bundles.includes(pkg);
+        const rowIds = item.patchRows?.inserts.map((row) => row.id) ?? [];
+        let enabled;
+        let phase = null;
+        if (loaderEntries !== null) {
+            // loader 是活体权威：无 entry = 未运行（bundle 未选 / 树缺条目），enabled:false
+            enabled = entry !== null && !entry.disabled;
+            if (entry !== null)
+                phase = mapPhase(entry.fiber);
+        }
+        else {
+            // CLI 无 loader 形态：在 bundles 且其补丁行无 disabled 覆盖 → 视为启用
+            const disabledByOverride = rowIds.some((id) => overrideIndex.get(id) === true);
+            enabled = inBundles && !disabledByOverride;
+        }
+        let lockReason;
+        // 有补丁层却不在 bundles = Bundle 退选（dsh-m / 官方插件页可再开），不是纯依赖
+        const hasPatchLayer = Boolean(item.patchRows?.readable && item.patchRows.inserts.length);
+        if (pkg === 'dsh-m')
+            lockReason = 'self';
+        else if (PROTECTED_MODULES.includes(pkg))
+            lockReason = 'protected';
+        else if (entry === null && !inBundles && !hasPatchLayer)
+            lockReason = 'no-entry';
+        const granularity = item.patchRows && isSingleRowPlugin(item.patchRows) ? 'row' : 'bundle';
+        result.set(pkg, {
+            pkg,
+            enabled,
+            phase,
+            granularity,
+            toggleable: lockReason === undefined,
+            ...(lockReason === undefined ? {} : { lockReason }),
+        });
+    }
+    return result;
+}

package/lib/core/host-api.js

@@ -16,6 +16,8 @@ import { RegistryConfigError } from './registry-controller.js';
 import { checkRegistryEntries } from './registry-check.js';
 import { CATEGORIES } from './registry.js';
 import { servingPort, scheduleRestart, trustedRestartRequest } from './restart.js';
+import { togglePlugin, ToggleError } from './toggle.js';
+import { IncompatibleError } from './compat-check.js';
 export class BadJsonError extends Error {
 }
 export class BodyTooLargeError extends Error {
@@ -131,6 +133,14 @@ function errorStatus(err) {
     }
     if (err instanceof ApiProtocolError)
         return { status: err.status, payload: { ok: false, error: err.message } };
+    if (err instanceof ToggleError) {
+        const status = err.code === 'protected' ? 403 : err.code === 'not-installed' ? 404 : 409;
+        return { status, payload: { ok: false, error: err.message, code: err.code } };
+    }
+    if (err instanceof IncompatibleError) {
+        // 结构化 issue：GUI 据此弹「仍要安装」确认（forceIncompatible 重试）
+        return { status: 409, payload: { ok: false, error: err.message, issue: err.issue } };
+    }
     if (err instanceof TransactionError) {
         // detail 白名单投影：结构化事实，不含 raw output（GUI 只读 error，零改动）
         const r = err.result;
@@ -164,7 +174,15 @@ export function createApiDispatcher(ctx) {
         runTransaction: ctx.deps?.runTransaction ?? runProfileTransaction,
         scheduleRestart: ctx.deps?.scheduleRestart ?? scheduleRestart,
         resolveDshVersion: ctx.deps?.resolveDshVersion ?? resolveDshVersion,
+        getService: ctx.deps?.getService,
+        toggle: ctx.deps?.togglePlugin ?? togglePlugin,
+        probe: ctx.deps?.probe,
+        probeSnapshot: ctx.deps?.probeSnapshot,
+        probeConfigGet: ctx.deps?.probeConfigGet,
+        probeConfigSet: ctx.deps?.probeConfigSet,
     };
+    // 元数据源探测注入（Task 8/14）：市场/安装/升级/已装的元数据读取共用
+    const probeDeps = d.probe !== undefined ? { probe: d.probe } : {};
     const cfg = () => ctx.controller.config;
     // DSH 版本一次性解析，dispatcher 创建即预热（首个 ping 不吃 spawn 回退的延迟）
     const dshVersionP = Promise.resolve()
@@ -210,7 +228,8 @@ export function createApiDispatcher(ctx) {
                     payload = {
                         pkg: ctx.pkg.name,
                         version: latest.version,
-                        usedAllowAllBuilds: result.usedAllowAllBuilds === true,
+                        buildApprovals: result.buildApprovals ?? [],
+                        fallbackAllBuilds: result.fallbackAllBuilds === true,
                         needsRestart: true,
                     };
                     break;
@@ -240,13 +259,13 @@ export function createApiDispatcher(ctx) {
                         withLatest: true,
                         namespace: 'host',
                         signal,
-                    });
+                    }, probeDeps);
                     payload = { ...result };
                     break;
                 }
                 case 'installed': {
                     await ctx.controller.ensureReady();
-                    const result = await d.listInstalledWithMeta(cfg(), { namespace: 'host', signal });
+                    const result = await d.listInstalledWithMeta(cfg(), { namespace: 'host', signal }, probeDeps);
                     payload = { ...result };
                     break;
                 }
@@ -259,14 +278,49 @@ export function createApiDispatcher(ctx) {
                     break;
                 }
                 case 'status':
-                    payload = { ...publicInstallStatus() };
+                    payload = { ...publicInstallStatus(), probe: d.probeSnapshot?.() ?? null };
+                    break;
+                case 'probe-config': {
+                    if (!d.probeConfigGet)
+                        throw new ApiProtocolError(501, 'probe 配置读取不可用');
+                    payload = { ...d.probeConfigGet(), writable: typeof d.probeConfigSet === 'function' };
                     break;
+                }
+                case 'probe-config-set': {
+                    if (!d.probeConfigGet || !d.probeConfigSet)
+                        throw new ApiProtocolError(501, 'probe 配置写入不可用（设置服务缺席）');
+                    const patch = {};
+                    if (body.probeEnabled !== undefined)
+                        patch.probeEnabled = boolArg(body.probeEnabled);
+                    if (body.probeTimeoutMs !== undefined) {
+                        const n = Number(body.probeTimeoutMs);
+                        if (!Number.isFinite(n) || n < 100 || n > 30_000)
+                            throw new ApiProtocolError(400, 'probeTimeoutMs 须在 100..30000 之间');
+                        patch.probeTimeoutMs = Math.floor(n);
+                    }
+                    if (body.probeCacheTtlMin !== undefined) {
+                        const n = Number(body.probeCacheTtlMin);
+                        if (!Number.isFinite(n) || n < 0 || n > 1440)
+                            throw new ApiProtocolError(400, 'probeCacheTtlMin 须在 0..1440 之间');
+                        patch.probeCacheTtlMin = Math.floor(n);
+                    }
+                    if (Object.keys(patch).length === 0)
+                        throw new ApiProtocolError(400, '缺少可更新字段');
+                    await d.probeConfigSet(patch);
+                    payload = { ...d.probeConfigGet(), writable: true };
+                    break;
+                }
                 case 'install': {
                     const id = strArg(body, 'id');
                     if (!id)
                         throw new ApiProtocolError(400, '缺少 id');
                     const version = typeof body.version === 'string' ? body.version : undefined;
-                    const result = await d.installFromRegistry(id, cfg(), { version, namespace: 'host', signal });
+                    const result = await d.installFromRegistry(id, cfg(), {
+                        version,
+                        forceIncompatible: boolArg(body.forceIncompatible),
+                        namespace: 'host',
+                        signal,
+                    }, probeDeps);
                     payload = { ...result };
                     break;
                 }
@@ -278,11 +332,25 @@ export function createApiDispatcher(ctx) {
                     payload = { ...result };
                     break;
                 }
+                case 'set-enabled': {
+                    const target = strArg(body, 'pkg');
+                    if (!target)
+                        throw new ApiProtocolError(400, '缺少 pkg');
+                    if (typeof body.enabled !== 'boolean')
+                        throw new ApiProtocolError(400, '缺少 enabled（必须为 boolean）');
+                    const result = await d.toggle(target, body.enabled, { getService: d.getService });
+                    payload = { ...result };
+                    break;
+                }
                 case 'upgrade': {
                     const target = strArg(body, 'pkg');
                     if (!target)
                         throw new ApiProtocolError(400, '缺少 pkg');
-                    const result = await d.upgradePlugin(target, cfg(), { namespace: 'host', signal });
+                    const result = await d.upgradePlugin(target, cfg(), {
+                        forceIncompatible: boolArg(body.forceIncompatible),
+                        namespace: 'host',
+                        signal,
+                    }, probeDeps);
                     payload = { ...result };
                     break;
                 }

package/lib/core/installed.js

@@ -12,6 +12,7 @@
 import { open, readFile } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 import { webProfileDir } from './env.js';
+import { readBundlePatchRows } from './patch-yaml.js';
 const PKG_NAME_RE = /^(@[A-Za-z0-9-*~][A-Za-z0-9-*._~]*\/)?[A-Za-z0-9-._~]+$/;
 export function isSafePkgName(raw) {
     const name = String(raw || '').trim();
@@ -172,6 +173,11 @@ export async function listInstalledPlugins(profileDir = webProfileDir()) {
             continue;
         }
         const info = sanitizePkgJson(raw, pkg);
+        // 包内补丁层行枚举（开关粒度判定原料）：缺失 → readable:false（按多行 → Bundle 级处理）
+        const patchText = await readTextLimited(join(dir, 'cordis.patch.yml'), PATCH_MAX_BYTES);
+        const patchRows = patchText
+            ? readBundlePatchRows(patchText.text)
+            : { inserts: [], configRows: 0, readable: false };
         items.push({
             pkg,
             name: info.name,
@@ -183,6 +189,7 @@ export async function listInstalledPlugins(profileDir = webProfileDir()) {
             dsh: true,
             path: dir,
             githubRepo: githubRepoFromRepository(raw.repository),
+            patchRows,
         });
     }
     return { items, others, complete, profileDir: root };
@@ -190,6 +197,8 @@ export async function listInstalledPlugins(profileDir = webProfileDir()) {
 // ---------- README 预览（借鉴 skillhub，64KB 截断） ----------
 const README_MAX_BYTES = 64 * 1024;
 const README_FILES = ['README.md', 'README.markdown', 'README'];
+/** 包内 cordis.patch.yml 读取上限（补丁层是小文件，256KB 远超正常体积）。 */
+const PATCH_MAX_BYTES = 256 * 1024;
 /** 限量读取文本文件：只读前 limit 字节，超限标记 truncated。 */
 async function readTextLimited(path, limit) {
     let fh;

package/lib/core/market.js

@@ -8,12 +8,65 @@
  * 新发布后 NO_MATCHING_VERSION 的退避重试 + packument 预热（B3）。
  */
 import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { dshHome } from './env.js';
 import { runProfileTransaction, makeNpmWarmPackument, TransactionError, } from './profile-transaction.js';
 import { listInstalledPlugins as defaultListInstalledPlugins, } from './installed.js';
+import { loaderHost } from './live-plugin.js';
+import { precheckNpmCompat, IncompatibleError } from './compat-check.js';
+import { PROTECTED_MODULES, composeEnablement } from './enablement.js';
+import { readProfileOverrides } from './patch-yaml.js';
 import { loadRegistry as defaultLoadRegistry, } from './registry.js';
 import { githubLatestTag as defaultGithubLatestTag, isNewerVersion, npmLatest as defaultNpmLatest, npmVersion, } from './versions.js';
+/** profile package.json 的 dsh.profile.bundles 数组（读不到 → []；Task 13）。 */
+async function readProfileBundles(profileDir) {
+    try {
+        const raw = JSON.parse(await readFile(join(profileDir, 'package.json'), 'utf8'));
+        const bundles = raw?.dsh?.profile?.bundles;
+        return Array.isArray(bundles) ? bundles.filter((name) => typeof name === 'string') : [];
+    }
+    catch {
+        return [];
+    }
+}
+/** profile cordis.patch.yml 覆盖行（读不到 → []；Task 13）。 */
+async function readProfileOverrideRows(profileDir) {
+    try {
+        return readProfileOverrides(await readFile(join(profileDir, 'cordis.patch.yml'), 'utf8'));
+    }
+    catch {
+        return [];
+    }
+}
+/** 宿主内 loader entries（CLI/测试进程 → null；Task 13 读路径始终自读）。 */
+function loaderEntriesOrNull() {
+    const entries = loaderHost()?.loader?.entries;
+    if (typeof entries !== 'function')
+        return null;
+    try {
+        return [...entries.call(loaderHost().loader)];
+    }
+    catch {
+        return null;
+    }
+}
+/** 探测结果 → versions.ts 的 registry base；探测失败/禁用 → undefined（默认 npmjs）。 */
+async function probeRegistryBase(probe) {
+    if (probe === undefined)
+        return undefined;
+    try {
+        const source = await probe.fastest();
+        if (source === 'npmjs')
+            return 'https://registry.npmjs.org';
+        if (source === 'npmmirror')
+            return 'https://registry.npmmirror.com';
+    }
+    catch {
+        /* 探测失败 → 默认源 */
+    }
+    return undefined;
+}
 // ---------- 通用工具 ----------
 const DEFAULT_DEADLINE_MS = 60_000;
 const WITH_LATEST_MAX = 50;
@@ -115,9 +168,9 @@ function writeLatestCache(key, value) {
     }
     latestCache.set(key, { at: Date.now(), value });
 }
-function probeTask(item, deps, timeoutMs, signal) {
+function probeTask(item, deps, timeoutMs, signal, registry) {
     if (item.source === 'npm' && item.npm) {
-        return deps.npmLatest(item.npm, timeoutMs, signal).then((r) => ({ version: r.version }));
+        return deps.npmLatest(item.npm, timeoutMs, signal, registry).then((r) => ({ version: r.version }));
     }
     return deps.githubLatestTag(item.github, timeoutMs, signal).then((r) => ({ tag: r.tag, sha: r.sha }));
 }
@@ -278,9 +331,10 @@ export async function listMarket(cfg = {}, opts = {}, deps = {}) {
                 latestTimedOut = true;
             }
             else {
+                const probeRegistry = await probeRegistryBase(d.probe);
                 await mapWithConcurrency(todo, LATEST_WORKERS, async (item) => {
                     const perBudget = Math.max(1, remaining());
-                    const task = probeTask(item, d, Math.min(cfg.timeoutMs ?? 20_000, perBudget), signal);
+                    const task = probeTask(item, d, Math.min(cfg.timeoutMs ?? 20_000, perBudget), signal, probeRegistry);
                     const outcome = await probeWithBudget(task, perBudget, signal);
                     if (outcome.ok && outcome.value) {
                         applyProbe(item, outcome.value);
@@ -329,7 +383,19 @@ export async function listInstalledWithMeta(cfg = {}, opts = {}, deps = {}) {
     const installedPromise = d.listInstalledPlugins();
     const registryTask = d.loadRegistry(cfg, { namespace, signal, force: opts.force, deadlineMs });
     const installed = await installedPromise;
-    const items = installed.items.map((it) => ({ ...it, outdated: false }));
+    // enablement join（Task 13，ADR-0001 读路径自读）：loader ⋈ bundles ⋈ profile 覆盖行
+    const compose = d.composeEnablement ?? composeEnablement;
+    const enablement = await compose({
+        items: installed.items,
+        loaderEntries: loaderEntriesOrNull(),
+        bundles: await readProfileBundles(installed.profileDir),
+        profileOverrides: await readProfileOverrideRows(installed.profileDir),
+    });
+    const items = installed.items.map((it) => ({
+        ...it,
+        outdated: false,
+        ...(enablement.get(it.pkg) ?? { pkg: it.pkg, enabled: true, phase: null, granularity: 'bundle', toggleable: false, lockReason: 'no-entry' }),
+    }));
     let loaded;
     try {
         loaded = await deadlineRace(registryTask, remaining());
@@ -414,6 +480,7 @@ export async function installEntry(entry, cfg = {}, opts = {}, deps) {
     const d = {
         npmLatest: deps?.npmLatest ?? defaultNpmLatest,
         npmVersion: deps?.npmVersion ?? npmVersion,
+        registry: await probeRegistryBase(deps?.probe),
     };
     if (entry.source === 'npm' && entry.npm) {
         const pkg = entry.npm;
@@ -421,17 +488,32 @@ export async function installEntry(entry, cfg = {}, opts = {}, deps) {
         let version;
         let expectedIntegrity;
         if (opts.version) {
-            const meta = await d.npmVersion(pkg, opts.version, timeoutMs, opts.signal);
+            const meta = await d.npmVersion(pkg, opts.version, timeoutMs, opts.signal, d.registry);
             version = meta.version;
             expectedIntegrity = meta.integrity;
         }
         else {
-            const latest = await d.npmLatest(pkg, timeoutMs, opts.signal);
+            const latest = await d.npmLatest(pkg, timeoutMs, opts.signal, d.registry);
             version = latest.version;
             expectedIntegrity = latest.integrity;
         }
         if (!expectedIntegrity)
             throw new Error(`npm metadata 缺少 dist integrity：${pkg}@${version}，拒绝安装`);
+        // peer 兼容预检（Task 11，事务外 metadata 阶段；force = 用户已确认风险）。
+        // 预检自身的元数据读取失败（网络错/404）不拦安装——视为未检，安装事务自有失败语义。
+        let compat = null;
+        try {
+            compat = await (deps?.precheck ?? precheckNpmCompat)(pkg, version, {
+                timeoutMs,
+                signal: opts.signal,
+                registry: d.registry,
+            });
+        }
+        catch {
+            compat = null;
+        }
+        if (compat !== null && opts.forceIncompatible !== true)
+            throw new IncompatibleError(compat);
         // 生产预热绑定：未注入时 B3 用 makeNpmWarmPackument（保留 timeout/signal、失败吞错）
         const result = await runProfileTransaction({ kind: 'install-npm', pkg, version, integrity: expectedIntegrity, signal: opts.signal }, {
             ...deps?.transaction,
@@ -445,7 +527,10 @@ export async function installEntry(entry, cfg = {}, opts = {}, deps) {
             pkg: result.pkg ?? pkg,
             spec: result.spec ?? `${pkg}@${version}`,
             version: result.version ?? version,
-            usedAllowAllBuilds: result.usedAllowAllBuilds === true,
+            buildApprovals: result.buildApprovals ?? [],
+            fallbackAllBuilds: result.fallbackAllBuilds === true,
+            ...(result.bundleWarning ? { bundleWarning: result.bundleWarning } : {}),
+            compat: compat ?? null,
             needsRestart: true,
             output: result.output + (notes.length > 0 ? `\n[dsh-m 自愈] ${notes.join('；')}` : ''),
             healActions: result.healActions,
@@ -464,7 +549,10 @@ export async function installEntry(entry, cfg = {}, opts = {}, deps) {
             spec: result.spec ?? `github:${entry.github}#${sha}`,
             sha: result.sha ?? sha,
             tag: result.tag ?? tag,
-            usedAllowAllBuilds: result.usedAllowAllBuilds === true,
+            buildApprovals: result.buildApprovals ?? [],
+            fallbackAllBuilds: result.fallbackAllBuilds === true,
+            ...(result.bundleWarning ? { bundleWarning: result.bundleWarning } : {}),
+            compatSkipped: 'github-source',
             needsRestart: true,
             output: result.output + (notes.length > 0 ? `\n[dsh-m 自愈] ${notes.join('；')}` : ''),
             healActions: result.healActions,
@@ -474,6 +562,10 @@ export async function installEntry(entry, cfg = {}, opts = {}, deps) {
 }
 /** 卸载：validate（严格读取）→ live-disable → 摘补丁 → pnpm remove → verify gone（DESIGN.md §3：删包不删数据）。 */
 export async function uninstallPlugin(pkg, _cfg = {}, opts = {}, deps = {}) {
+    // 保护门（Task 12，grilling Q3）：dsh-m 自身与官方宿主命脉拒绝卸载（升级不受影响）
+    if (pkg === 'dsh-m' || PROTECTED_MODULES.includes(pkg)) {
+        throw new Error(`拒绝卸载受保护插件: ${pkg}（dsh-m 自身或官方宿主命脉）。如确需移除，请使用官方插件管理页或 dsh plugin CLI`);
+    }
     const result = await runProfileTransaction({ kind: 'uninstall', pkg, signal: opts.signal }, deps.transaction ?? {});
     if (!result.ok)
         throw new TransactionError(result);