dsh-m 0.8.5 → 0.9.1

package/lib/core/host-api.js

@@ -2,9 +2,10 @@
  * /dshm Host API dispatcher（DESIGN.md §4/§5）：可注入的 method 分发 + 请求防护 +
  * HTTP 状态映射，供 host.ts 与契约测试共用。
  *
- * 解析顺序固定：只接受 POST → JSON Content-Type → 有上限读取并 drain body →
- * 顶层必须是非 null/非数组对象且有 method → `ping` 跳过 guard，否则
- * trustedRestartRequest host-equivalence guard → typed method/业务错误映射 → 其他 500。
+ * 解析顺序固定：宿主信任检查（0.9.0 起委派官方 `connection.requestRejection`，
+ * 全 method 含 ping 与未知 method，任何 body/side effect 之前，fail-closed）→
+ * 只接受 POST → JSON Content-Type → 有上限读取并 drain body →
+ * 顶层必须是非 null/非数组对象且有 method → typed method/业务错误映射 → 其他 500。
  */
 import { BOOT_ID, publicInstallStatus } from './dsh-cli.js';
 import { resolveDshVersion } from './dsh-version.js';
@@ -16,9 +17,11 @@ import { getCommunitySummary } from './community.js';
 import { RegistryConfigError } from './registry-controller.js';
 import { checkRegistryEntries } from './registry-check.js';
 import { CATEGORIES } from './registry.js';
-import { servingPort, scheduleRestart, trustedRestartRequest } from './restart.js';
+import { servingPort, scheduleRestart } from './restart.js';
 import { togglePlugin, ToggleError } from './toggle.js';
 import { IncompatibleError } from './compat-check.js';
+import { ProfileUnsupportedError, assertWriteAllowed } from './active-profile.js';
+import { DesktopOpsError, desktopInstallFromRegistry, desktopToggle } from './profile-ops.js';
 export class BadJsonError extends Error {
 }
 export class BodyTooLargeError extends Error {
@@ -66,7 +69,20 @@ function readBody(req, maxBytes = BODY_MAX_BYTES) {
         });
     });
 }
-async function parseRequest(req) {
+async function parseRequest(req, rejectRequest) {
+    // 宿主信任检查第一位（0.9.0 委派官方 requestRejection）：先于 POST/Content-Type/body——
+    // 被拒请求零 body 消耗、零业务调用（报告 §3.2/§8）。返回 401/403 原样投影。
+    let rejection;
+    try {
+        rejection = rejectRequest(req);
+    }
+    catch {
+        // 宿主检查异常一律 fail-closed，异常细节不外泄（报告 §3.2）
+        rejection = 403;
+    }
+    if (rejection !== undefined) {
+        throw new ApiProtocolError(rejection, rejection === 401 ? '请求未通过宿主认证（未登录或凭据无效）' : '请求未通过宿主信任检查（不可信 Host/Origin 或跨站）');
+    }
     if ((req.method || 'GET').toUpperCase() !== 'POST') {
         throw new ApiProtocolError(405, '只接受 POST');
     }
@@ -91,9 +107,6 @@ async function parseRequest(req) {
     const method = typeof body.method === 'string' ? body.method.trim() : '';
     if (!method)
         throw new BadJsonError('缺少 method');
-    if (method !== 'ping' && !trustedRestartRequest(req)) {
-        throw new ApiProtocolError(403, '拒绝跨源请求');
-    }
     return { method, body };
 }
 function strArg(body, key) {
@@ -139,6 +152,14 @@ function errorStatus(err) {
     }
     if (err instanceof ApiProtocolError)
         return { status: err.status, payload: { ok: false, error: err.message } };
+    if (err instanceof ProfileUnsupportedError) {
+        // 0.9.0：Desktop/未知 profile 的能力表拒绝——结构化 code + 官方入口指引
+        return { status: 409, payload: { ok: false, error: err.message, code: err.code, action: err.action, profile: err.profile, guidance: err.guidance } };
+    }
+    if (err instanceof DesktopOpsError) {
+        // 0.9.0：Desktop adapter 失败（no-manager/install-refused/enable-failed/verify-failed）
+        return { status: 409, payload: { ok: false, error: err.message, code: err.code } };
+    }
     if (err instanceof ToggleError) {
         const status = err.code === 'protected' ? 403 : err.code === 'not-installed' ? 404 : 409;
         return { status, payload: { ok: false, error: err.message, code: err.code } };
@@ -200,8 +221,14 @@ export function createApiDispatcher(ctx) {
         resolveDshVersion: ctx.deps?.resolveDshVersion ?? resolveDshVersion,
         getService: ctx.deps?.getService,
         toggle: ctx.deps?.togglePlugin ?? togglePlugin,
+        desktopInstall: ctx.deps?.desktopInstall ?? desktopInstallFromRegistry,
+        desktopToggle: ctx.deps?.desktopToggle ?? desktopToggle,
     };
     const cfg = () => ctx.controller.config;
+    // 0.9.0：宿主信任检查委派（含 ping 与未知 method，fail-closed）；
+    // profile 为 host 生命周期内不可变对象（host.ts apply 期解析一次）
+    const rejectRequest = ctx.deps?.rejectRequest ?? (() => 403);
+    const profile = ctx.profile;
     // DSH 版本一次性解析，dispatcher 创建即预热（首个 ping 不吃 spawn 回退的延迟）
     const dshVersionP = Promise.resolve()
         .then(() => d.resolveDshVersion())
@@ -210,7 +237,7 @@ export function createApiDispatcher(ctx) {
         const abort = new AbortController();
         res.once('close', () => abort.abort());
         try {
-            const { method, body } = await parseRequest(req);
+            const { method, body } = await parseRequest(req, rejectRequest);
             const signal = abort.signal;
             let payload;
             switch (method) {
@@ -222,6 +249,8 @@ export function createApiDispatcher(ctx) {
                         boot: BOOT_ID,
                         // DSH 运行版本（头部 chip 数据源）；解析失败 → undefined → JSON 序列化时字段缺席
                         dshVersion: (await dshVersionP) ?? undefined,
+                        // 0.9.0 双 profile：GUI/工具展示当前 profile 与能力边界
+                        profile: { name: profile.name, kind: profile.kind, source: profile.source },
                     };
                     break;
                 case 'self-check': {
@@ -238,6 +267,8 @@ export function createApiDispatcher(ctx) {
                     break;
                 }
                 case 'self-upgrade': {
+                    // 0.9.0：Desktop 结构化拒绝（能力表），Web 走既有路径
+                    assertWriteAllowed(profile, 'self-upgrade');
                     // M2 Task 3：self-upgrade 收编 market.selfUpgrade（统一 mutation session + 守卫，直调事务旁路封死）
                     const result = await d.selfUpgrade(ctx.pkg.name, ctx.pkg.version, cfg(), { signal });
                     payload = {
@@ -327,7 +358,8 @@ export function createApiDispatcher(ctx) {
                     const target = strArg(body, 'pkg');
                     if (!target)
                         throw new ApiProtocolError(400, '缺少 pkg');
-                    const result = await readInstalledPluginReadme(target);
+                    // 0.9.0 双 profile：README 只读当前 profile 的 node_modules
+                    const result = await readInstalledPluginReadme(target, profile.dir);
                     payload = { ...result };
                     break;
                 }
@@ -338,6 +370,18 @@ export function createApiDispatcher(ctx) {
                     const id = strArg(body, 'id');
                     if (!id)
                         throw new ApiProtocolError(400, '缺少 id');
+                    // 0.9.0：desktop → 官方 pluginManager 委派（新包）；web → 既有事务
+                    if (profile.kind !== 'web') {
+                        assertWriteAllowed(profile, 'install');
+                        payload = { ...(await d.desktopInstall(id, cfg(), {
+                                version: typeof body.version === 'string' ? body.version : undefined,
+                                forceIncompatible: boolArg(body.forceIncompatible),
+                                namespace: 'host',
+                                profile: profile.name,
+                                signal,
+                            })) };
+                        break;
+                    }
                     const version = typeof body.version === 'string' ? body.version : undefined;
                     const result = await d.installFromRegistry(id, cfg(), {
                         version,
@@ -352,6 +396,8 @@ export function createApiDispatcher(ctx) {
                     const target = strArg(body, 'pkg');
                     if (!target)
                         throw new ApiProtocolError(400, '缺少 pkg');
+                    // 0.9.0：Desktop 结构化拒绝（官方入口指引）
+                    assertWriteAllowed(profile, 'uninstall');
                     const result = await d.uninstallPlugin(target, cfg(), { namespace: 'host', signal });
                     payload = { ...result };
                     break;
@@ -362,6 +408,12 @@ export function createApiDispatcher(ctx) {
                         throw new ApiProtocolError(400, '缺少 pkg');
                     if (typeof body.enabled !== 'boolean')
                         throw new ApiProtocolError(400, '缺少 enabled（必须为 boolean）');
+                    // 0.9.0：desktop → 官方管理器委派（服务缺席结构化拒绝，禁 fallback 文件写）
+                    if (profile.kind !== 'web') {
+                        assertWriteAllowed(profile, 'set-enabled');
+                        payload = { ...(await d.desktopToggle(target, body.enabled, { getService: d.getService, profileDir: profile.dir })) };
+                        break;
+                    }
                     const result = await d.toggle(target, body.enabled, { getService: d.getService });
                     payload = { ...result };
                     break;
@@ -370,6 +422,8 @@ export function createApiDispatcher(ctx) {
                     const target = strArg(body, 'pkg');
                     if (!target)
                         throw new ApiProtocolError(400, '缺少 pkg');
+                    // 0.9.0：Desktop 结构化拒绝（无官方 upgrade API，指引 Settings → Plugins）
+                    assertWriteAllowed(profile, 'upgrade');
                     const result = await d.upgradePlugin(target, cfg(), {
                         forceIncompatible: boolArg(body.forceIncompatible),
                         namespace: 'host',
@@ -379,6 +433,8 @@ export function createApiDispatcher(ctx) {
                     break;
                 }
                 case 'restart': {
+                    // 0.9.0：Desktop 不触发旧 helper（Electron 生命周期归官方；杀子进程=红线）
+                    assertWriteAllowed(profile, 'restart');
                     const result = d.scheduleRestart(servingPort(req));
                     payload = { ...result };
                     break;

package/lib/core/market.js

@@ -447,11 +447,11 @@ export async function listMarket(cfg = {}, opts = {}, deps = {}) {
     const maxLimit = withLatest ? WITH_LATEST_MAX : METADATA_ONLY_MAX;
     const signal = opts.signal;
     const remaining = () => deadlineAt - Date.now();
-    const registryTask = d.loadRegistry(cfg, { namespace, signal, force: opts.force, deadlineMs });
-    const installedTask = d.listInstalledPlugins().catch(() => null);
+    const registryTask = d.loadRegistry(cfg, { namespace, signal, force: opts.force, deadlineMs, profile: opts.profile });
+    const installedTask = d.listInstalledPlugins(opts.profileDir).catch(() => null);
     // 社区 flight 并发启动（source=primary 零调用；0.7.0 Task 7：primaryOnly 字段已删除）；共享 loader 不接收调用者 deadline——
     // listMarket 作为 waiter 在 communityOutcome 内 race 自己的剩余 deadline/signal（v10 契约）
-    const communityTask = source === 'primary' ? null : d.fetchCommunityCatalog(cfg, { namespace, signal, force: opts.force });
+    const communityTask = source === 'primary' ? null : d.fetchCommunityCatalog(cfg, { namespace, signal, force: opts.force, profile: opts.profile });
     let loaded;
     try {
         loaded = await deadlineRace(registryTask, remaining());
@@ -606,10 +606,10 @@ export async function listInstalledWithMeta(cfg = {}, opts = {}, deps = {}) {
     const namespace = opts.namespace ?? 'host';
     const signal = opts.signal;
     const remaining = () => deadlineAt - Date.now();
-    const installedPromise = d.listInstalledPlugins();
-    const registryTask = d.loadRegistry(cfg, { namespace, signal, force: opts.force, deadlineMs });
+    const installedPromise = d.listInstalledPlugins(opts.profileDir);
+    const registryTask = d.loadRegistry(cfg, { namespace, signal, force: opts.force, deadlineMs, profile: opts.profile });
     // 社区 flight 并发启动 + request-scoped GitHub 预算（本次检查 ≤25 个 wire 请求、宿主滚动 50/h）
-    const communityTask = d.fetchCommunityCatalog(cfg, { namespace, signal, force: opts.force });
+    const communityTask = d.fetchCommunityCatalog(cfg, { namespace, signal, force: opts.force, profile: opts.profile });
     const githubBudget = createGithubRequestBudget();
     const installed = await installedPromise;
     // enablement join（Task 13，ADR-0001 读路径自读）：loader ⋈ bundles ⋈ profile 覆盖行
@@ -718,8 +718,12 @@ async function probeLatest(items, ctx, d, rt) {
  *  0.7.1 修复：合并市场展示的社区条目 id 不在主清单（loadRegistry 只装载主清单，
  *  社区层只合入 listMarket 展示）——主清单 miss 时按收录 id 查社区目录再装，
  *  与 0.5.1 升级路径（findCommunityUpgradeEntry）同构。 */
-export async function installFromRegistry(id, cfg = {}, opts = {}, deps) {
-    const loaded = await (deps?.loadRegistry ?? defaultLoadRegistry)(cfg, { namespace: opts.namespace ?? 'host' });
+/**
+ * 按收录 id 解析可安装条目（0.9.0 Task 5 抽出）：主清单优先，社区目录兜底。
+ * installFromRegistry 与 Desktop adapter（profile-ops）共用同一解析与错误文案。
+ */
+export async function resolveRegistryEntry(id, cfg = {}, opts = {}, deps) {
+    const loaded = await (deps?.loadRegistry ?? defaultLoadRegistry)(cfg, { namespace: opts.namespace ?? 'host', profile: opts.profile });
     if (loaded.status === 'unavailable') {
         throw new Error(`收录清单不可用，无法安装 ${id}；请检查 registry 配置或网络后重试`);
     }
@@ -727,6 +731,10 @@ export async function installFromRegistry(id, cfg = {}, opts = {}, deps) {
         (await findCommunityInstallEntry(id, cfg, opts, deps));
     if (!entry)
         throw new Error(`registry 中没有该条目: ${id}`);
+    return entry;
+}
+export async function installFromRegistry(id, cfg = {}, opts = {}, deps) {
+    const entry = await resolveRegistryEntry(id, cfg, opts, deps);
     return installEntry(entry, cfg, opts, deps);
 }
 // ---------- M2 Task 3：统一 mutation session + 装后守卫 + 补偿接线 ----------
@@ -1025,7 +1033,7 @@ export async function installEntry(entry, cfg = {}, opts = {}, deps) {
  *  upgradePlugin 已持有 session，必须直调本函数——二次获取 session 会自死锁（session 非重入）。 */
 async function installEntryLocked(entry, cfg = {}, opts = {}, deps) {
     const timeoutMs = cfg.timeoutMs ?? 20_000;
-    const profileDir = deps?.transaction?.profileDir ?? webProfileDir();
+    const profileDir = deps?.transaction?.profileDir ?? deps?.profileDir ?? webProfileDir();
     const d = {
         npmLatest: deps?.npmLatest ?? defaultNpmLatest,
         npmVersion: deps?.npmVersion ?? npmVersion,
@@ -1267,11 +1275,11 @@ export function upgradePlugin(pkg, cfg = {}, opts = {}, deps) {
     return withMutationSession(() => upgradePluginLocked(pkg, cfg, opts, deps));
 }
 async function upgradePluginLocked(pkg, cfg = {}, opts = {}, deps) {
-    const loaded = await (deps?.loadRegistry ?? defaultLoadRegistry)(cfg, { namespace: opts.namespace ?? 'host' });
+    const loaded = await (deps?.loadRegistry ?? defaultLoadRegistry)(cfg, { namespace: opts.namespace ?? 'host', profile: opts.profile });
     if (loaded.status === 'unavailable') {
         throw new Error(`收录清单不可用，无法升级 ${pkg}；请检查 registry 配置或网络后重试`);
     }
-    const { items: installed } = await (deps?.listInstalledPlugins ?? defaultListInstalledPlugins)();
+    const { items: installed } = await (deps?.listInstalledPlugins ?? defaultListInstalledPlugins)(opts.profileDir);
     const target = installed.find((it) => it.pkg === pkg);
     if (!target)
         throw new Error(`web profile 未安装该插件: ${pkg}`);
@@ -1293,7 +1301,7 @@ async function upgradePluginLocked(pkg, cfg = {}, opts = {}, deps) {
  */
 async function findCommunityInstallEntry(id, cfg, opts, deps) {
     try {
-        const loaded = await (deps?.fetchCommunityCatalog ?? defaultFetchCommunityCatalog)(cfg, { namespace: opts.namespace ?? 'host', signal: opts.signal });
+        const loaded = await (deps?.fetchCommunityCatalog ?? defaultFetchCommunityCatalog)(cfg, { namespace: opts.namespace ?? 'host', signal: opts.signal, profile: opts.profile });
         if (!loaded.catalog)
             return undefined;
         return adaptCommunityCatalog(loaded.catalog).entries.find((e) => e.id === id);
@@ -1308,7 +1316,7 @@ async function findCommunityInstallEntry(id, cfg, opts, deps) {
  */
 async function findCommunityUpgradeEntry(target, cfg, opts, deps) {
     try {
-        const loaded = await (deps?.fetchCommunityCatalog ?? defaultFetchCommunityCatalog)(cfg, { namespace: opts.namespace ?? 'host', signal: opts.signal });
+        const loaded = await (deps?.fetchCommunityCatalog ?? defaultFetchCommunityCatalog)(cfg, { namespace: opts.namespace ?? 'host', signal: opts.signal, profile: opts.profile });
         if (!loaded.catalog)
             return undefined;
         const adapted = adaptCommunityCatalog(loaded.catalog);

package/lib/core/patch-yaml.js

@@ -2,7 +2,7 @@
  * cordis 补丁层 YAML 的三个纯函数（0.4.0 开关功能，DESIGN/plan Task 2）：
  *
  * 1) readBundlePatchRows —— 包内 `cordis.patch.yml`（dsh.bundle.patch 层）行枚举，
- *    供「单行/多行插件」粒度判定（CONTEXT.md：行覆盖 vs Bundle 选择）；
+ *    供「单行/多行插件」粒度判定（GLOSSARY.md：行覆盖 vs Bundle 选择）；
  * 2) planRowOverride —— 官方 `writePluginEnabled`（dsh-plugin-manager L881-916）的纯函数版：
  *    在 profile `cordis.patch.yml` 文本上做保注释的 `disabled` 覆盖编辑（findLast 按 id 匹配、
  *    跳过含 insert 的行、name 可选限定、已是目标态 changed:false、无匹配 append `{id, disabled}`；

package/lib/core/profile-ops.js

@@ -0,0 +1,158 @@
+/**
+ * ProfileOperations 接缝的 Desktop adapter（0.9.0，ADR-0005）。
+ *
+ * Desktop profile 的包操作一律委派官方 pluginManager（`ctx.get('pluginManager')`，
+ * 鸭子类型投影，无静态依赖）：`installBundle(spec, { enabled?, approvedBuilds? })`。
+ * dsh-m 保留自己的收录条目解析（resolveRegistryEntry）与 peer 兼容预检
+ * （precheckNpmCompat，web 同语义）；完整性/锁/构建脚本审批/生效相位归官方管理器。
+ *
+ * 判定纪律（报告 §5.2，dsh-market #703/#772 实证）：
+ * - 以 `application`/`stage` 为准，绝不只看 `packageResult.exitCode`——
+ *   `stage:'enable'` + `application:'failed'` 可跟在 exitCode 0 之后；
+ * - `application:'overridden'` 是「成功但被更高层 patch 覆盖」，如实标注非失败；
+ * - 构建脚本：`build-blocked` + `pendingBuilds` → 结构化 needsBuildApproval 结果，
+ *   重试把 pending 名单原样传回 `approvedBuilds`（键格式由官方管理器自己写），
+ *   dsh-m 绝不直接编辑 desktop profile 的 pnpm-workspace.yaml，绝不全量放行；
+ * - 成功判定 = 官方结果无 error + `listBundles()` 复读目标 bundle 在装，二者同时满足。
+ *
+ * 禁止事项：desktop 路径零 Web fallback——不做文件级装后守卫（app.asar 探测盲区）、
+ * 不写 allowBuilds、不跑 dsh-m 自实现 pnpm 编排、服务缺席一律结构化拒绝。
+ */
+import { withMutationSession, resolveRegistryEntry } from './market.js';
+import { precheckNpmCompat, IncompatibleError } from './compat-check.js';
+import { npmLatest as defaultNpmLatest, githubLatestTag as defaultGithubLatestTag } from './versions.js';
+import { togglePlugin, ToggleError } from './toggle.js';
+export class DesktopOpsError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'DesktopOpsError';
+        this.code = code;
+    }
+}
+function changeOf(raw) {
+    if (raw && typeof raw === 'object')
+        return raw;
+    return {};
+}
+/**
+ * Desktop 安装（仅新包）：收录条目解析（web 同源）→ spec 精确锁定 → compat 预检
+ * （npm 源；web 同语义）→ 官方 installBundle → ChangeResult 判定 → listBundles 复读。
+ * 全程 within mutation session（与 web 五入口同一 FIFO）。
+ */
+export async function desktopInstallFromRegistry(id, cfg = {}, opts = {}, deps = {}) {
+    return withMutationSession(() => desktopInstallLocked(id, cfg, opts, deps));
+}
+async function desktopInstallLocked(id, cfg, opts, deps) {
+    const service = deps.getService?.();
+    if (!service || typeof service.installBundle !== 'function') {
+        throw new DesktopOpsError('no-manager', '官方 pluginManager 服务不可用（desktop profile 必须由官方管理器执行包操作）；拒绝安装（fail-closed）');
+    }
+    const timeoutMs = cfg.timeoutMs ?? 20_000;
+    const entry = await (deps.resolveEntry ?? resolveRegistryEntry)(id, cfg, opts, { loadRegistry: deps.loadRegistry });
+    let spec;
+    let pkg;
+    let version;
+    let sha;
+    let tag;
+    let compat = null;
+    let compatSkipped;
+    if (entry.source === 'npm' && entry.npm) {
+        pkg = entry.npm;
+        if (opts.version) {
+            version = opts.version;
+        }
+        else {
+            const latest = await (deps.npmLatest ?? defaultNpmLatest)(pkg, timeoutMs, opts.signal);
+            version = latest.version;
+        }
+        spec = `${pkg}@${version}`;
+        // peer 兼容预检（web 同语义）：预检自身失败视为未检，不拦安装
+        try {
+            compat = await (deps.precheck ?? precheckNpmCompat)(pkg, version, { timeoutMs, signal: opts.signal });
+        }
+        catch {
+            compat = null;
+        }
+        if (compat !== null && opts.forceIncompatible !== true)
+            throw new IncompatibleError(compat);
+    }
+    else if (entry.github) {
+        // github 源：锁 HEAD SHA（web 同语义），不做兼容预检（明示 compatSkipped）
+        const resolved = await (deps.githubLatestTag ?? defaultGithubLatestTag)(entry.github, timeoutMs, opts.signal);
+        sha = resolved.sha;
+        tag = resolved.tag;
+        pkg = entry.github.split('/')[1] ?? entry.github;
+        spec = `github:${entry.github}#${sha}`;
+        compatSkipped = 'github-source';
+    }
+    else {
+        throw new DesktopOpsError('install-refused', `收录条目 ${entry.id} 缺少 npm/github 来源，无法在 desktop 安装`);
+    }
+    const raw = await service.installBundle(spec, {
+        enabled: true,
+        ...(opts.approvedBuilds ? { approvedBuilds: opts.approvedBuilds } : {}),
+    });
+    const change = changeOf(raw);
+    if (change.application === 'cancelled') {
+        throw new DesktopOpsError('install-refused', `安装已被取消（${pkg}）：desktop profile 文件已由官方管理器恢复，未安装`);
+    }
+    if (change.application === 'failed' || change.error) {
+        const pending = Array.isArray(change.pendingBuilds) ? change.pendingBuilds.filter((n) => typeof n === 'string') : [];
+        const buildBlocked = change.packageResult?.kind === 'build-blocked';
+        if (buildBlocked && pending.length > 0) {
+            return {
+                ok: false,
+                needsBuildApproval: true,
+                id: entry.id,
+                pkg,
+                spec,
+                pendingBuilds: pending,
+                message: `该插件需要执行构建脚本（${pending.join('、')}）。确认后带同样的包名名单重试（approvedBuilds）；dsh-m 不做全量放行（ADR-0002 同语义）`,
+            };
+        }
+        if (change.stage === 'enable') {
+            throw new DesktopOpsError('enable-failed', `安装后启用阶段失败（${pkg}；application=failed、stage=enable${change.error?.code ? `、error=${change.error.code}` : ''}）：包已写入但未能启用，请在官方 Desktop 插件页查看状态或重试`);
+        }
+        throw new DesktopOpsError('install-refused', `官方管理器安装失败（${pkg}；application=${change.application ?? 'failed'}${change.error?.code ? `、error=${change.error.code}` : ''}${change.error?.diagnostic ? `：${change.error.diagnostic}` : ''}）`);
+    }
+    // 复读校验：listBundles 可用必须见目标在装；不可用（老管理器）至少要求官方宣称产出 bundle
+    const bundleName = change.bundle ?? pkg;
+    if (typeof service.listBundles === 'function') {
+        const bundles = await service.listBundles();
+        const found = (bundles ?? []).find((b) => b && b.name === bundleName);
+        if (!found || found.installed === false) {
+            throw new DesktopOpsError('verify-failed', `安装复读失败（${pkg}）：官方结果为 ${change.application ?? 'unknown'} 但 listBundles 未見目标 bundle 在装——不冒充安装成功`);
+        }
+    }
+    else if (!change.bundle) {
+        throw new DesktopOpsError('verify-failed', `安装复读不可用（${pkg}）：官方结果未携带 bundle 字段且 listBundles 缺席——不冒充安装成功`);
+    }
+    return {
+        id: entry.id,
+        pkg,
+        spec,
+        ...(version !== undefined ? { version } : {}),
+        ...(sha !== undefined ? { sha } : {}),
+        ...(tag !== undefined ? { tag } : {}),
+        buildApprovals: Array.isArray(change.approvedBuilds) ? change.approvedBuilds : [],
+        fallbackAllBuilds: false,
+        ...(compat !== null ? { compat } : {}),
+        ...(compatSkipped ? { compatSkipped } : {}),
+        needsRestart: true,
+        output: `official pluginManager: application=${change.application ?? 'applied'}, bundle=${bundleName}${change.changed === false ? ', changed=false' : ''}`,
+        via: 'desktop-manager',
+        ...(change.application === 'overridden' ? { overridden: true } : {}),
+    };
+}
+/**
+ * Desktop 开关：服务缺席 → 结构化拒绝（ToggleError/unaddressable，禁 fallback 文件写）；
+ * 服务在用 → 既有 togglePlugin 委派路径（installed 校验按 profileDir，与 web 委派同代码）。
+ */
+export async function desktopToggle(pkg, enabled, deps = {}) {
+    const service = deps.getService?.();
+    if (!service) {
+        throw new ToggleError('unaddressable', '官方 pluginManager 服务不可用：desktop profile 的开关必须走官方管理器（dsh-m 不做文件级 fallback）；请在官方 Desktop 插件页操作');
+    }
+    return togglePlugin(pkg, enabled, { getService: () => service, profileDir: deps.profileDir });
+}

package/lib/core/registry-controller.js

@@ -8,7 +8,7 @@
  */
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { cacheDir } from './env.js';
+import { WEB_PROFILE, cacheRoot } from './env.js';
 import { commitActiveSource, loadDefaultRegistry, loadRegistry, loadRegistryCandidate, parseRegistryAddress, } from './registry.js';
 export class RegistryConfigError extends Error {
     errors;
@@ -19,10 +19,10 @@ export class RegistryConfigError extends Error {
     }
 }
 const ACCEPTED_SOURCE_FILE = 'active-source.json';
-/** 读取 host accepted-source metadata（损坏/缺失返回 null）。 */
-export async function readAcceptedSourceMetadata() {
+/** 读取 host accepted-source metadata（损坏/缺失返回 null；profile 决定缓存段，0.9.0 双 profile）。 */
+export async function readAcceptedSourceMetadata(profile = WEB_PROFILE) {
     try {
-        const raw = JSON.parse(await readFile(join(cacheDir(), 'host', ACCEPTED_SOURCE_FILE), 'utf8'));
+        const raw = JSON.parse(await readFile(join(cacheRoot(profile), 'host', ACCEPTED_SOURCE_FILE), 'utf8'));
         if (!raw || typeof raw !== 'object')
             return null;
         if (raw.version !== 1 || raw.namespace !== 'host')
@@ -57,9 +57,11 @@ function placeholderLoaded(configuredAddress) {
 function errorMessage(err) {
     return err instanceof Error ? err.message : String(err);
 }
-export function createRegistryController(initial = {}) {
+export function createRegistryController(initial = {}, opts = {}) {
     // config 是共享对象：host.ts 把它传给 tools/API，controller 原地更新字段实现 live 生效
     const config = { ...initial };
+    // profile 缓存段（0.9.0 双 profile）：默认 web=旧路径，行为零漂移；desktop 落 `<root>/desktop` 段
+    const profile = opts.profile ?? WEB_PROFILE;
     let activeConfigAddress = trimAddress(initial.registryUrl);
     let loaded = placeholderLoaded(activeConfigAddress);
     let pendingAddress = null;
@@ -120,7 +122,7 @@ export function createRegistryController(initial = {}) {
         }
     }
     function candidateFor(rawAddress, signal) {
-        return loadRegistryCandidate({ ...config, registryUrl: rawAddress }, { namespace: 'host', signal });
+        return loadRegistryCandidate({ ...config, registryUrl: rawAddress }, { namespace: 'host', profile, signal });
     }
     const bootstrap = async () => {
         await enqueue(async (gen) => {
@@ -130,7 +132,7 @@ export function createRegistryController(initial = {}) {
             // 社区字段初始值（两代 store 同型：legacy/forms 的 get() 都经 unwrapConfig 透传）
             syncCommunityFields(source);
             const raw = trimAddress(source.registryUrl);
-            const attempt = await loadRegistry({ ...config, registryUrl: raw }, { namespace: 'host' });
+            const attempt = await loadRegistry({ ...config, registryUrl: raw }, { namespace: 'host', profile });
             if (disposed || gen !== generation)
                 return;
             if (attempt.status !== 'unavailable') {
@@ -139,9 +141,9 @@ export function createRegistryController(initial = {}) {
             }
             // 持久化 custom 不可达：先试 accepted address（含其 cache），无 accepted 则默认
             configErrors = [...attempt.errors];
-            const accepted = await readAcceptedSourceMetadata();
+            const accepted = await readAcceptedSourceMetadata(profile);
             const recoverAddress = accepted && accepted.configuredAddress !== raw ? accepted.configuredAddress : '';
-            const recovered = await loadRegistry({ ...config, registryUrl: recoverAddress }, { namespace: 'host', force: true });
+            const recovered = await loadRegistry({ ...config, registryUrl: recoverAddress }, { namespace: 'host', force: true, profile });
             if (disposed || gen !== generation)
                 return;
             if (recovered.status !== 'unavailable') {
@@ -204,7 +206,7 @@ export function createRegistryController(initial = {}) {
                 config.timeoutMs = nextConfig.timeoutMs;
                 config.cacheTtlMin = nextConfig.cacheTtlMin;
                 try {
-                    const commit = await commitActiveSource(parseRegistryAddress(raw), 'host');
+                    const commit = await commitActiveSource(parseRegistryAddress(raw), 'host', profile);
                     if (commit.warning)
                         warnings.push(commit.warning);
                 }
@@ -240,7 +242,7 @@ export function createRegistryController(initial = {}) {
         await startBootstrap();
         if (opts.force) {
             await enqueue(async (gen) => {
-                const attempt = await loadRegistry(config, { namespace: 'host', force: true, signal: opts.signal });
+                const attempt = await loadRegistry(config, { namespace: 'host', force: true, signal: opts.signal, profile });
                 if (disposed || gen !== generation)
                     return;
                 loaded = attempt;
@@ -250,7 +252,7 @@ export function createRegistryController(initial = {}) {
         return snapshotInternal();
     }
     function loadDefault(opts = {}) {
-        return loadDefaultRegistry(config, { namespace: 'host', force: opts?.force, signal: opts?.signal });
+        return loadDefaultRegistry(config, { namespace: 'host', force: opts?.force, signal: opts?.signal, profile });
     }
     function apply(rawAddress, opts = {}) {
         return enqueue(async (gen) => {
@@ -300,7 +302,7 @@ export function createRegistryController(initial = {}) {
             }
             adopt(gen, trimmed, candidate);
             try {
-                const commit = await commitActiveSource(address, 'host');
+                const commit = await commitActiveSource(address, 'host', profile);
                 if (commit.warning)
                     warnings.push(commit.warning);
             }