dsh-m 0.8.5 → 0.9.0

package/lib/core/market.js

@@ -447,11 +447,11 @@ export async function listMarket(cfg = {}, opts = {}, deps = {}) {
     const maxLimit = withLatest ? WITH_LATEST_MAX : METADATA_ONLY_MAX;
     const signal = opts.signal;
     const remaining = () => deadlineAt - Date.now();
-    const registryTask = d.loadRegistry(cfg, { namespace, signal, force: opts.force, deadlineMs });
-    const installedTask = d.listInstalledPlugins().catch(() => null);
+    const registryTask = d.loadRegistry(cfg, { namespace, signal, force: opts.force, deadlineMs, profile: opts.profile });
+    const installedTask = d.listInstalledPlugins(opts.profileDir).catch(() => null);
     // 社区 flight 并发启动（source=primary 零调用；0.7.0 Task 7：primaryOnly 字段已删除）；共享 loader 不接收调用者 deadline——
     // listMarket 作为 waiter 在 communityOutcome 内 race 自己的剩余 deadline/signal（v10 契约）
-    const communityTask = source === 'primary' ? null : d.fetchCommunityCatalog(cfg, { namespace, signal, force: opts.force });
+    const communityTask = source === 'primary' ? null : d.fetchCommunityCatalog(cfg, { namespace, signal, force: opts.force, profile: opts.profile });
     let loaded;
     try {
         loaded = await deadlineRace(registryTask, remaining());
@@ -606,10 +606,10 @@ export async function listInstalledWithMeta(cfg = {}, opts = {}, deps = {}) {
     const namespace = opts.namespace ?? 'host';
     const signal = opts.signal;
     const remaining = () => deadlineAt - Date.now();
-    const installedPromise = d.listInstalledPlugins();
-    const registryTask = d.loadRegistry(cfg, { namespace, signal, force: opts.force, deadlineMs });
+    const installedPromise = d.listInstalledPlugins(opts.profileDir);
+    const registryTask = d.loadRegistry(cfg, { namespace, signal, force: opts.force, deadlineMs, profile: opts.profile });
     // 社区 flight 并发启动 + request-scoped GitHub 预算（本次检查 ≤25 个 wire 请求、宿主滚动 50/h）
-    const communityTask = d.fetchCommunityCatalog(cfg, { namespace, signal, force: opts.force });
+    const communityTask = d.fetchCommunityCatalog(cfg, { namespace, signal, force: opts.force, profile: opts.profile });
     const githubBudget = createGithubRequestBudget();
     const installed = await installedPromise;
     // enablement join（Task 13，ADR-0001 读路径自读）：loader ⋈ bundles ⋈ profile 覆盖行
@@ -718,8 +718,12 @@ async function probeLatest(items, ctx, d, rt) {
  *  0.7.1 修复：合并市场展示的社区条目 id 不在主清单（loadRegistry 只装载主清单，
  *  社区层只合入 listMarket 展示）——主清单 miss 时按收录 id 查社区目录再装，
  *  与 0.5.1 升级路径（findCommunityUpgradeEntry）同构。 */
-export async function installFromRegistry(id, cfg = {}, opts = {}, deps) {
-    const loaded = await (deps?.loadRegistry ?? defaultLoadRegistry)(cfg, { namespace: opts.namespace ?? 'host' });
+/**
+ * 按收录 id 解析可安装条目（0.9.0 Task 5 抽出）：主清单优先，社区目录兜底。
+ * installFromRegistry 与 Desktop adapter（profile-ops）共用同一解析与错误文案。
+ */
+export async function resolveRegistryEntry(id, cfg = {}, opts = {}, deps) {
+    const loaded = await (deps?.loadRegistry ?? defaultLoadRegistry)(cfg, { namespace: opts.namespace ?? 'host', profile: opts.profile });
     if (loaded.status === 'unavailable') {
         throw new Error(`收录清单不可用，无法安装 ${id}；请检查 registry 配置或网络后重试`);
     }
@@ -727,6 +731,10 @@ export async function installFromRegistry(id, cfg = {}, opts = {}, deps) {
         (await findCommunityInstallEntry(id, cfg, opts, deps));
     if (!entry)
         throw new Error(`registry 中没有该条目: ${id}`);
+    return entry;
+}
+export async function installFromRegistry(id, cfg = {}, opts = {}, deps) {
+    const entry = await resolveRegistryEntry(id, cfg, opts, deps);
     return installEntry(entry, cfg, opts, deps);
 }
 // ---------- M2 Task 3：统一 mutation session + 装后守卫 + 补偿接线 ----------
@@ -1025,7 +1033,7 @@ export async function installEntry(entry, cfg = {}, opts = {}, deps) {
  *  upgradePlugin 已持有 session，必须直调本函数——二次获取 session 会自死锁（session 非重入）。 */
 async function installEntryLocked(entry, cfg = {}, opts = {}, deps) {
     const timeoutMs = cfg.timeoutMs ?? 20_000;
-    const profileDir = deps?.transaction?.profileDir ?? webProfileDir();
+    const profileDir = deps?.transaction?.profileDir ?? deps?.profileDir ?? webProfileDir();
     const d = {
         npmLatest: deps?.npmLatest ?? defaultNpmLatest,
         npmVersion: deps?.npmVersion ?? npmVersion,
@@ -1267,11 +1275,11 @@ export function upgradePlugin(pkg, cfg = {}, opts = {}, deps) {
     return withMutationSession(() => upgradePluginLocked(pkg, cfg, opts, deps));
 }
 async function upgradePluginLocked(pkg, cfg = {}, opts = {}, deps) {
-    const loaded = await (deps?.loadRegistry ?? defaultLoadRegistry)(cfg, { namespace: opts.namespace ?? 'host' });
+    const loaded = await (deps?.loadRegistry ?? defaultLoadRegistry)(cfg, { namespace: opts.namespace ?? 'host', profile: opts.profile });
     if (loaded.status === 'unavailable') {
         throw new Error(`收录清单不可用，无法升级 ${pkg}；请检查 registry 配置或网络后重试`);
     }
-    const { items: installed } = await (deps?.listInstalledPlugins ?? defaultListInstalledPlugins)();
+    const { items: installed } = await (deps?.listInstalledPlugins ?? defaultListInstalledPlugins)(opts.profileDir);
     const target = installed.find((it) => it.pkg === pkg);
     if (!target)
         throw new Error(`web profile 未安装该插件: ${pkg}`);
@@ -1293,7 +1301,7 @@ async function upgradePluginLocked(pkg, cfg = {}, opts = {}, deps) {
  */
 async function findCommunityInstallEntry(id, cfg, opts, deps) {
     try {
-        const loaded = await (deps?.fetchCommunityCatalog ?? defaultFetchCommunityCatalog)(cfg, { namespace: opts.namespace ?? 'host', signal: opts.signal });
+        const loaded = await (deps?.fetchCommunityCatalog ?? defaultFetchCommunityCatalog)(cfg, { namespace: opts.namespace ?? 'host', signal: opts.signal, profile: opts.profile });
         if (!loaded.catalog)
             return undefined;
         return adaptCommunityCatalog(loaded.catalog).entries.find((e) => e.id === id);
@@ -1308,7 +1316,7 @@ async function findCommunityInstallEntry(id, cfg, opts, deps) {
  */
 async function findCommunityUpgradeEntry(target, cfg, opts, deps) {
     try {
-        const loaded = await (deps?.fetchCommunityCatalog ?? defaultFetchCommunityCatalog)(cfg, { namespace: opts.namespace ?? 'host', signal: opts.signal });
+        const loaded = await (deps?.fetchCommunityCatalog ?? defaultFetchCommunityCatalog)(cfg, { namespace: opts.namespace ?? 'host', signal: opts.signal, profile: opts.profile });
         if (!loaded.catalog)
             return undefined;
         const adapted = adaptCommunityCatalog(loaded.catalog);

package/lib/core/patch-yaml.js

@@ -2,7 +2,7 @@
  * cordis 补丁层 YAML 的三个纯函数（0.4.0 开关功能，DESIGN/plan Task 2）：
  *
  * 1) readBundlePatchRows —— 包内 `cordis.patch.yml`（dsh.bundle.patch 层）行枚举，
- *    供「单行/多行插件」粒度判定（CONTEXT.md：行覆盖 vs Bundle 选择）；
+ *    供「单行/多行插件」粒度判定（GLOSSARY.md：行覆盖 vs Bundle 选择）；
  * 2) planRowOverride —— 官方 `writePluginEnabled`（dsh-plugin-manager L881-916）的纯函数版：
  *    在 profile `cordis.patch.yml` 文本上做保注释的 `disabled` 覆盖编辑（findLast 按 id 匹配、
  *    跳过含 insert 的行、name 可选限定、已是目标态 changed:false、无匹配 append `{id, disabled}`；

package/lib/core/profile-ops.js

@@ -0,0 +1,158 @@
+/**
+ * ProfileOperations 接缝的 Desktop adapter（0.9.0，ADR-0005）。
+ *
+ * Desktop profile 的包操作一律委派官方 pluginManager（`ctx.get('pluginManager')`，
+ * 鸭子类型投影，无静态依赖）：`installBundle(spec, { enabled?, approvedBuilds? })`。
+ * dsh-m 保留自己的收录条目解析（resolveRegistryEntry）与 peer 兼容预检
+ * （precheckNpmCompat，web 同语义）；完整性/锁/构建脚本审批/生效相位归官方管理器。
+ *
+ * 判定纪律（报告 §5.2，dsh-market #703/#772 实证）：
+ * - 以 `application`/`stage` 为准，绝不只看 `packageResult.exitCode`——
+ *   `stage:'enable'` + `application:'failed'` 可跟在 exitCode 0 之后；
+ * - `application:'overridden'` 是「成功但被更高层 patch 覆盖」，如实标注非失败；
+ * - 构建脚本：`build-blocked` + `pendingBuilds` → 结构化 needsBuildApproval 结果，
+ *   重试把 pending 名单原样传回 `approvedBuilds`（键格式由官方管理器自己写），
+ *   dsh-m 绝不直接编辑 desktop profile 的 pnpm-workspace.yaml，绝不全量放行；
+ * - 成功判定 = 官方结果无 error + `listBundles()` 复读目标 bundle 在装，二者同时满足。
+ *
+ * 禁止事项：desktop 路径零 Web fallback——不做文件级装后守卫（app.asar 探测盲区）、
+ * 不写 allowBuilds、不跑 dsh-m 自实现 pnpm 编排、服务缺席一律结构化拒绝。
+ */
+import { withMutationSession, resolveRegistryEntry } from './market.js';
+import { precheckNpmCompat, IncompatibleError } from './compat-check.js';
+import { npmLatest as defaultNpmLatest, githubLatestTag as defaultGithubLatestTag } from './versions.js';
+import { togglePlugin, ToggleError } from './toggle.js';
+export class DesktopOpsError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'DesktopOpsError';
+        this.code = code;
+    }
+}
+function changeOf(raw) {
+    if (raw && typeof raw === 'object')
+        return raw;
+    return {};
+}
+/**
+ * Desktop 安装（仅新包）：收录条目解析（web 同源）→ spec 精确锁定 → compat 预检
+ * （npm 源；web 同语义）→ 官方 installBundle → ChangeResult 判定 → listBundles 复读。
+ * 全程 within mutation session（与 web 五入口同一 FIFO）。
+ */
+export async function desktopInstallFromRegistry(id, cfg = {}, opts = {}, deps = {}) {
+    return withMutationSession(() => desktopInstallLocked(id, cfg, opts, deps));
+}
+async function desktopInstallLocked(id, cfg, opts, deps) {
+    const service = deps.getService?.();
+    if (!service || typeof service.installBundle !== 'function') {
+        throw new DesktopOpsError('no-manager', '官方 pluginManager 服务不可用（desktop profile 必须由官方管理器执行包操作）；拒绝安装（fail-closed）');
+    }
+    const timeoutMs = cfg.timeoutMs ?? 20_000;
+    const entry = await (deps.resolveEntry ?? resolveRegistryEntry)(id, cfg, opts, { loadRegistry: deps.loadRegistry });
+    let spec;
+    let pkg;
+    let version;
+    let sha;
+    let tag;
+    let compat = null;
+    let compatSkipped;
+    if (entry.source === 'npm' && entry.npm) {
+        pkg = entry.npm;
+        if (opts.version) {
+            version = opts.version;
+        }
+        else {
+            const latest = await (deps.npmLatest ?? defaultNpmLatest)(pkg, timeoutMs, opts.signal);
+            version = latest.version;
+        }
+        spec = `${pkg}@${version}`;
+        // peer 兼容预检（web 同语义）：预检自身失败视为未检，不拦安装
+        try {
+            compat = await (deps.precheck ?? precheckNpmCompat)(pkg, version, { timeoutMs, signal: opts.signal });
+        }
+        catch {
+            compat = null;
+        }
+        if (compat !== null && opts.forceIncompatible !== true)
+            throw new IncompatibleError(compat);
+    }
+    else if (entry.github) {
+        // github 源：锁 HEAD SHA（web 同语义），不做兼容预检（明示 compatSkipped）
+        const resolved = await (deps.githubLatestTag ?? defaultGithubLatestTag)(entry.github, timeoutMs, opts.signal);
+        sha = resolved.sha;
+        tag = resolved.tag;
+        pkg = entry.github.split('/')[1] ?? entry.github;
+        spec = `github:${entry.github}#${sha}`;
+        compatSkipped = 'github-source';
+    }
+    else {
+        throw new DesktopOpsError('install-refused', `收录条目 ${entry.id} 缺少 npm/github 来源，无法在 desktop 安装`);
+    }
+    const raw = await service.installBundle(spec, {
+        enabled: true,
+        ...(opts.approvedBuilds ? { approvedBuilds: opts.approvedBuilds } : {}),
+    });
+    const change = changeOf(raw);
+    if (change.application === 'cancelled') {
+        throw new DesktopOpsError('install-refused', `安装已被取消（${pkg}）：desktop profile 文件已由官方管理器恢复，未安装`);
+    }
+    if (change.application === 'failed' || change.error) {
+        const pending = Array.isArray(change.pendingBuilds) ? change.pendingBuilds.filter((n) => typeof n === 'string') : [];
+        const buildBlocked = change.packageResult?.kind === 'build-blocked';
+        if (buildBlocked && pending.length > 0) {
+            return {
+                ok: false,
+                needsBuildApproval: true,
+                id: entry.id,
+                pkg,
+                spec,
+                pendingBuilds: pending,
+                message: `该插件需要执行构建脚本（${pending.join('、')}）。确认后带同样的包名名单重试（approvedBuilds）；dsh-m 不做全量放行（ADR-0002 同语义）`,
+            };
+        }
+        if (change.stage === 'enable') {
+            throw new DesktopOpsError('enable-failed', `安装后启用阶段失败（${pkg}；application=failed、stage=enable${change.error?.code ? `、error=${change.error.code}` : ''}）：包已写入但未能启用，请在官方 Desktop 插件页查看状态或重试`);
+        }
+        throw new DesktopOpsError('install-refused', `官方管理器安装失败（${pkg}；application=${change.application ?? 'failed'}${change.error?.code ? `、error=${change.error.code}` : ''}${change.error?.diagnostic ? `：${change.error.diagnostic}` : ''}）`);
+    }
+    // 复读校验：listBundles 可用必须见目标在装；不可用（老管理器）至少要求官方宣称产出 bundle
+    const bundleName = change.bundle ?? pkg;
+    if (typeof service.listBundles === 'function') {
+        const bundles = await service.listBundles();
+        const found = (bundles ?? []).find((b) => b && b.name === bundleName);
+        if (!found || found.installed === false) {
+            throw new DesktopOpsError('verify-failed', `安装复读失败（${pkg}）：官方结果为 ${change.application ?? 'unknown'} 但 listBundles 未見目标 bundle 在装——不冒充安装成功`);
+        }
+    }
+    else if (!change.bundle) {
+        throw new DesktopOpsError('verify-failed', `安装复读不可用（${pkg}）：官方结果未携带 bundle 字段且 listBundles 缺席——不冒充安装成功`);
+    }
+    return {
+        id: entry.id,
+        pkg,
+        spec,
+        ...(version !== undefined ? { version } : {}),
+        ...(sha !== undefined ? { sha } : {}),
+        ...(tag !== undefined ? { tag } : {}),
+        buildApprovals: Array.isArray(change.approvedBuilds) ? change.approvedBuilds : [],
+        fallbackAllBuilds: false,
+        ...(compat !== null ? { compat } : {}),
+        ...(compatSkipped ? { compatSkipped } : {}),
+        needsRestart: true,
+        output: `official pluginManager: application=${change.application ?? 'applied'}, bundle=${bundleName}${change.changed === false ? ', changed=false' : ''}`,
+        via: 'desktop-manager',
+        ...(change.application === 'overridden' ? { overridden: true } : {}),
+    };
+}
+/**
+ * Desktop 开关：服务缺席 → 结构化拒绝（ToggleError/unaddressable，禁 fallback 文件写）；
+ * 服务在用 → 既有 togglePlugin 委派路径（installed 校验按 profileDir，与 web 委派同代码）。
+ */
+export async function desktopToggle(pkg, enabled, deps = {}) {
+    const service = deps.getService?.();
+    if (!service) {
+        throw new ToggleError('unaddressable', '官方 pluginManager 服务不可用：desktop profile 的开关必须走官方管理器（dsh-m 不做文件级 fallback）；请在官方 Desktop 插件页操作');
+    }
+    return togglePlugin(pkg, enabled, { getService: () => service, profileDir: deps.profileDir });
+}

package/lib/core/registry-controller.js

@@ -8,7 +8,7 @@
  */
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { cacheDir } from './env.js';
+import { WEB_PROFILE, cacheRoot } from './env.js';
 import { commitActiveSource, loadDefaultRegistry, loadRegistry, loadRegistryCandidate, parseRegistryAddress, } from './registry.js';
 export class RegistryConfigError extends Error {
     errors;
@@ -19,10 +19,10 @@ export class RegistryConfigError extends Error {
     }
 }
 const ACCEPTED_SOURCE_FILE = 'active-source.json';
-/** 读取 host accepted-source metadata（损坏/缺失返回 null）。 */
-export async function readAcceptedSourceMetadata() {
+/** 读取 host accepted-source metadata（损坏/缺失返回 null；profile 决定缓存段，0.9.0 双 profile）。 */
+export async function readAcceptedSourceMetadata(profile = WEB_PROFILE) {
     try {
-        const raw = JSON.parse(await readFile(join(cacheDir(), 'host', ACCEPTED_SOURCE_FILE), 'utf8'));
+        const raw = JSON.parse(await readFile(join(cacheRoot(profile), 'host', ACCEPTED_SOURCE_FILE), 'utf8'));
         if (!raw || typeof raw !== 'object')
             return null;
         if (raw.version !== 1 || raw.namespace !== 'host')
@@ -57,9 +57,11 @@ function placeholderLoaded(configuredAddress) {
 function errorMessage(err) {
     return err instanceof Error ? err.message : String(err);
 }
-export function createRegistryController(initial = {}) {
+export function createRegistryController(initial = {}, opts = {}) {
     // config 是共享对象：host.ts 把它传给 tools/API，controller 原地更新字段实现 live 生效
     const config = { ...initial };
+    // profile 缓存段（0.9.0 双 profile）：默认 web=旧路径，行为零漂移；desktop 落 `<root>/desktop` 段
+    const profile = opts.profile ?? WEB_PROFILE;
     let activeConfigAddress = trimAddress(initial.registryUrl);
     let loaded = placeholderLoaded(activeConfigAddress);
     let pendingAddress = null;
@@ -120,7 +122,7 @@ export function createRegistryController(initial = {}) {
         }
     }
     function candidateFor(rawAddress, signal) {
-        return loadRegistryCandidate({ ...config, registryUrl: rawAddress }, { namespace: 'host', signal });
+        return loadRegistryCandidate({ ...config, registryUrl: rawAddress }, { namespace: 'host', profile, signal });
     }
     const bootstrap = async () => {
         await enqueue(async (gen) => {
@@ -130,7 +132,7 @@ export function createRegistryController(initial = {}) {
             // 社区字段初始值（两代 store 同型：legacy/forms 的 get() 都经 unwrapConfig 透传）
             syncCommunityFields(source);
             const raw = trimAddress(source.registryUrl);
-            const attempt = await loadRegistry({ ...config, registryUrl: raw }, { namespace: 'host' });
+            const attempt = await loadRegistry({ ...config, registryUrl: raw }, { namespace: 'host', profile });
             if (disposed || gen !== generation)
                 return;
             if (attempt.status !== 'unavailable') {
@@ -139,9 +141,9 @@ export function createRegistryController(initial = {}) {
             }
             // 持久化 custom 不可达：先试 accepted address（含其 cache），无 accepted 则默认
             configErrors = [...attempt.errors];
-            const accepted = await readAcceptedSourceMetadata();
+            const accepted = await readAcceptedSourceMetadata(profile);
             const recoverAddress = accepted && accepted.configuredAddress !== raw ? accepted.configuredAddress : '';
-            const recovered = await loadRegistry({ ...config, registryUrl: recoverAddress }, { namespace: 'host', force: true });
+            const recovered = await loadRegistry({ ...config, registryUrl: recoverAddress }, { namespace: 'host', force: true, profile });
             if (disposed || gen !== generation)
                 return;
             if (recovered.status !== 'unavailable') {
@@ -204,7 +206,7 @@ export function createRegistryController(initial = {}) {
                 config.timeoutMs = nextConfig.timeoutMs;
                 config.cacheTtlMin = nextConfig.cacheTtlMin;
                 try {
-                    const commit = await commitActiveSource(parseRegistryAddress(raw), 'host');
+                    const commit = await commitActiveSource(parseRegistryAddress(raw), 'host', profile);
                     if (commit.warning)
                         warnings.push(commit.warning);
                 }
@@ -240,7 +242,7 @@ export function createRegistryController(initial = {}) {
         await startBootstrap();
         if (opts.force) {
             await enqueue(async (gen) => {
-                const attempt = await loadRegistry(config, { namespace: 'host', force: true, signal: opts.signal });
+                const attempt = await loadRegistry(config, { namespace: 'host', force: true, signal: opts.signal, profile });
                 if (disposed || gen !== generation)
                     return;
                 loaded = attempt;
@@ -250,7 +252,7 @@ export function createRegistryController(initial = {}) {
         return snapshotInternal();
     }
     function loadDefault(opts = {}) {
-        return loadDefaultRegistry(config, { namespace: 'host', force: opts?.force, signal: opts?.signal });
+        return loadDefaultRegistry(config, { namespace: 'host', force: opts?.force, signal: opts?.signal, profile });
     }
     function apply(rawAddress, opts = {}) {
         return enqueue(async (gen) => {
@@ -300,7 +302,7 @@ export function createRegistryController(initial = {}) {
             }
             adopt(gen, trimmed, candidate);
             try {
-                const commit = await commitActiveSource(address, 'host');
+                const commit = await commitActiveSource(address, 'host', profile);
                 if (commit.warning)
                     warnings.push(commit.warning);
             }

package/lib/core/registry.js

@@ -8,7 +8,7 @@ import { createRequire } from 'node:module';
 import { isAbsolute, join, normalize } from 'node:path';
 import { constants as fsConstants, mkdirSync } from 'node:fs';
 import { lstat, mkdir, open, readFile, readdir, realpath, rename, rm } from 'node:fs/promises';
-import { cacheDir } from './env.js';
+import { WEB_PROFILE, cacheRoot } from './env.js';
 import { decodeUtf8Fatal, fetchJsonLimitedMeta, describeFetchFailure } from './httpx.js';
 export const CATEGORIES = ['market', 'tools', 'ui', 'search', 'other'];
 /** 容量上限：2 MiB 是原始 UTF-8 bytes（不是字符数）；条目超限拒绝整份清单。 */
@@ -367,14 +367,14 @@ export async function readRegistryFile(path, hooks = {}) {
 const CACHE_FILE_VERSION = 2;
 const DEFAULT_CACHE_KEY = 'default';
 const ACTIVE_SOURCE_FILE = 'active-source.json';
-function nsDir(namespace) {
-    return join(cacheDir(), namespace);
+function nsDir(namespace, profile = WEB_PROFILE) {
+    return join(cacheRoot(profile), namespace);
 }
-function cacheFilePath(namespace, cacheKey) {
-    return join(nsDir(namespace), `${cacheKey}.json`);
+function cacheFilePath(namespace, cacheKey, profile = WEB_PROFILE) {
+    return join(nsDir(namespace, profile), `${cacheKey}.json`);
 }
-function cacheDirSyncMode() {
-    mkdirSync(cacheDir(), { recursive: true, mode: 0o700 });
+function cacheDirSyncMode(profile = WEB_PROFILE) {
+    mkdirSync(cacheRoot(profile), { recursive: true, mode: 0o700 });
 }
 /** 同 key 写锁：进程内串行化同一 cache 文件的写入。 */
 const writeLocks = new Map();
@@ -390,11 +390,11 @@ function withKeyLock(key, task) {
     return next;
 }
 /** 原子写：0600 临时文件（O_CREAT|O_EXCL）→ fsync → rename。目标为 symlink 时拒绝。 */
-async function atomicWriteJson(target, dir, value) {
+async function atomicWriteJson(target, dir, value, profile = WEB_PROFILE) {
     return withKeyLock(target, async () => {
         try {
             await mkdir(dir, { recursive: true, mode: 0o700 });
-            cacheDirSyncMode();
+            cacheDirSyncMode(profile);
             let existing = null;
             try {
                 existing = await lstat(target);
@@ -421,12 +421,12 @@ async function atomicWriteJson(target, dir, value) {
         }
     });
 }
-async function writeCacheFile(file) {
-    return atomicWriteJson(cacheFilePath(file.namespace, file.cacheKey), nsDir(file.namespace), file);
+async function writeCacheFile(file, profile = WEB_PROFILE) {
+    return atomicWriteJson(cacheFilePath(file.namespace, file.cacheKey, profile), nsDir(file.namespace, profile), file, profile);
 }
-async function readCacheFile(namespace, cacheKey) {
+async function readCacheFile(namespace, cacheKey, profile = WEB_PROFILE) {
     try {
-        const raw = JSON.parse(await readFile(cacheFilePath(namespace, cacheKey), 'utf8'));
+        const raw = JSON.parse(await readFile(cacheFilePath(namespace, cacheKey, profile), 'utf8'));
         if (!raw || typeof raw !== 'object')
             return null;
         if (raw.version !== CACHE_FILE_VERSION || raw.namespace !== namespace || raw.cacheKey !== cacheKey)
@@ -449,9 +449,9 @@ function cacheFresh(file, ttlMin) {
     return Date.now() - t < ttlMin * 60_000;
 }
 /** 清理 namespace 内非 default、非当前 custom 的 cache 文件（不动 metadata）。 */
-async function pruneCaches(namespace, keepCustomKey) {
+async function pruneCaches(namespace, keepCustomKey, profile = WEB_PROFILE) {
     try {
-        const dir = nsDir(namespace);
+        const dir = nsDir(namespace, profile);
         const entries = await readdir(dir).catch(() => []);
         const keep = new Set([`${DEFAULT_CACHE_KEY}.json`, ACTIVE_SOURCE_FILE]);
         if (keepCustomKey)
@@ -474,7 +474,7 @@ async function pruneCaches(namespace, keepCustomKey) {
  * 再 prune 非当前 custom cache。metadata 失败 → 不 prune；prune 失败 → 保留旧 cache；
  * 都只返回 warning，不反向撤销已成功的 settings update。
  */
-export async function commitActiveSource(address, namespace) {
+export async function commitActiveSource(address, namespace, profile = WEB_PROFILE) {
     let metadataCommitted = true;
     if (namespace === 'host') {
         const meta = {
@@ -484,12 +484,12 @@ export async function commitActiveSource(address, namespace) {
             cacheKey: address.cacheKey,
             savedAt: new Date().toISOString(),
         };
-        metadataCommitted = await atomicWriteJson(join(nsDir('host'), ACTIVE_SOURCE_FILE), nsDir('host'), meta);
+        metadataCommitted = await atomicWriteJson(join(nsDir('host', profile), ACTIVE_SOURCE_FILE), nsDir('host', profile), meta, profile);
     }
     if (!metadataCommitted) {
         return { metadataCommitted: false, pruned: false, warning: 'accepted-source 元数据写入失败，已跳过旧 cache 清理（新配置仍生效）' };
     }
-    const pruned = await pruneCaches(namespace, address.kind === 'default' ? null : address.cacheKey);
+    const pruned = await pruneCaches(namespace, address.kind === 'default' ? null : address.cacheKey, profile);
     if (!pruned) {
         return { metadataCommitted: true, pruned: false, warning: '旧来源 cache 清理失败（不影响新配置生效）' };
     }
@@ -588,7 +588,7 @@ async function loadDefaultChain(cfg, opts, chain) {
                 source: candidate.source,
                 fetchedAt,
                 registry,
-            });
+            }, chain.profile);
             return {
                 ...buildState({
                     configuredAddress: '',
@@ -606,7 +606,7 @@ async function loadDefaultChain(cfg, opts, chain) {
             errors.push(describeFetchFailure({ label: candidate.source, url: candidate.url, err, elapsedMs: Date.now() - startedAt }));
         }
     }
-    const cached = await readCacheFile(chain.namespace, DEFAULT_CACHE_KEY);
+    const cached = await readCacheFile(chain.namespace, DEFAULT_CACHE_KEY, chain.profile);
     if (cached)
         return loadedFromCacheFile(cached, '', errors);
     if (chain.includeBundled) {
@@ -656,7 +656,7 @@ async function loadCustomChain(address, cfg, opts, chain) {
             source,
             fetchedAt,
             registry: result.registry,
-        });
+        }, chain.profile);
         return {
             ...buildState({
                 configuredAddress: address.normalized,
@@ -674,7 +674,7 @@ async function loadCustomChain(address, cfg, opts, chain) {
         errors.push(describeFetchFailure({ label: source, url: address.normalized, err, elapsedMs: Date.now() - startedAt }));
     }
     if (chain.allowCacheFallback) {
-        const cached = await readCacheFile(chain.namespace, address.cacheKey);
+        const cached = await readCacheFile(chain.namespace, address.cacheKey, chain.profile);
         if (cached)
             return loadedFromCacheFile(cached, address.normalized, errors);
     }
@@ -694,42 +694,45 @@ async function loadCustomChain(address, cfg, opts, chain) {
 /** active 读取：default/custom 各自 fallback；网络成功后可在本 namespace 内 prune。 */
 export async function loadRegistry(cfg = {}, opts = {}) {
     const namespace = opts.namespace ?? 'host';
+    const profile = opts.profile ?? WEB_PROFILE;
     const address = parseRegistryAddress(cfg.registryUrl);
     const ttlMin = Math.max(0, cfg.cacheTtlMin ?? 60);
     if (!opts.force) {
         const cacheKey = address.kind === 'default' ? DEFAULT_CACHE_KEY : address.cacheKey;
-        const cached = await readCacheFile(namespace, cacheKey);
+        const cached = await readCacheFile(namespace, cacheKey, profile);
         if (cached && cacheFresh(cached, ttlMin))
             return loadedFromCacheFile(cached, address.normalized, []);
     }
     if (address.kind === 'default') {
-        const loaded = await loadDefaultChain(cfg, opts, { namespace, includeBundled: true });
+        const loaded = await loadDefaultChain(cfg, opts, { namespace, profile, includeBundled: true });
         if (opts.prune !== false && loaded.status === 'ready')
-            await pruneCaches(namespace, null);
+            await pruneCaches(namespace, null, profile);
         return loaded;
     }
-    const loaded = await loadCustomChain(address, cfg, opts, { namespace, allowCacheFallback: true });
+    const loaded = await loadCustomChain(address, cfg, opts, { namespace, allowCacheFallback: true, profile });
     if (opts.prune !== false && loaded.status === 'ready')
-        await pruneCaches(namespace, address.cacheKey);
+        await pruneCaches(namespace, address.cacheKey, profile);
     return loaded;
 }
 /** candidate 读取：apply 前校验专用。只写候选 cache、绝不 prune；default 不落 bundled。 */
 export async function loadRegistryCandidate(cfg, opts = {}) {
     const namespace = opts.namespace ?? 'host';
+    const profile = opts.profile ?? WEB_PROFILE;
     const address = parseRegistryAddress(cfg.registryUrl);
     if (address.kind === 'default') {
-        return loadDefaultChain(cfg, opts, { namespace, includeBundled: false });
+        return loadDefaultChain(cfg, opts, { namespace, profile, includeBundled: false });
     }
-    return loadCustomChain(address, cfg, opts, { namespace, allowCacheFallback: true });
+    return loadCustomChain(address, cfg, opts, { namespace, allowCacheFallback: true, profile });
 }
 /** default 显式加载（下载/主动刷新）。写 default cache，从不 prune。 */
 export async function loadDefaultRegistry(cfg = {}, opts = {}) {
     const namespace = opts.namespace ?? 'host';
+    const profile = opts.profile ?? WEB_PROFILE;
     const ttlMin = Math.max(0, cfg.cacheTtlMin ?? 60);
     if (!opts.force) {
-        const cached = await readCacheFile(namespace, DEFAULT_CACHE_KEY);
+        const cached = await readCacheFile(namespace, DEFAULT_CACHE_KEY, profile);
         if (cached && cacheFresh(cached, ttlMin))
             return loadedFromCacheFile(cached, '', []);
     }
-    return loadDefaultChain(cfg, opts, { namespace, includeBundled: true });
+    return loadDefaultChain(cfg, opts, { namespace, profile, includeBundled: true });
 }

package/lib/core/restart.js

@@ -32,17 +32,6 @@ function isLoopbackHost(host) {
         return false;
     return parsed.hostname === '127.0.0.1' || parsed.hostname === 'localhost' || parsed.hostname === '::1';
 }
-function hostsMatch(originHost, candidate) {
-    const a = parseHost(originHost);
-    const b = parseHost(candidate);
-    if (a === null || b === null)
-        return false;
-    if (a.hostname !== b.hostname)
-        return false;
-    if (a.port !== '' && b.port !== '' && a.port !== b.port)
-        return false;
-    return true;
-}
 export function servingPort(request) {
     const host = headerString(request.headers.host);
     if (host === undefined || !isLoopbackHost(host))
@@ -53,25 +42,9 @@ export function servingPort(request) {
     const port = Number(match[1]);
     return Number.isInteger(port) && port > 0 && port < 65536 ? port : null;
 }
-export function trustedRestartRequest(request) {
-    const origin = headerString(request.headers.origin);
-    if (origin === undefined)
-        return false;
-    let from;
-    try {
-        const parsed = new URL(origin);
-        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
-            return false;
-        from = parsed.host;
-    }
-    catch {
-        return false;
-    }
-    const host = headerString(request.headers.host);
-    const forwardedHost = headerString(request.headers['x-forwarded-host']);
-    const candidates = [host, forwardedHost].filter((value) => value !== undefined);
-    return candidates.some((candidate) => hostsMatch(from, candidate));
-}
+// 0.9.0 起trustedRestartRequest 已删除：/dshm 入口信任检查改委派官方
+// `connection.requestRejection()`（ADR-0005，语义含 trustedHosts/cross-site/Origin:null），
+// 本模块只剩 servingPort / 重启实现。
 export function readProcCgroup(readFile = (path, encoding) => readFileSync(path, encoding)) {
     try {
         return readFile('/proc/self/cgroup', 'utf8');