dsh-m 0.9.7 → 0.9.8

package/README.en.md

@@ -48,6 +48,13 @@ The default registry includes DSH Skins, ModSearch, the Lark / QQ / Weixin / WeC
 
 The restart chain below applies to **Web only** (Desktop takes effect via the official app lifecycle: after installing, quit and reopen the Desktop app — see the 0.9.0 section). After any mutation, the already-open Market and Installed views refresh the profile state together, keeping badges and cards in sync without closing and reopening the marketplace; a "⚡ Restart" banner appears — under systemd, the DSH launcher's `appExit` hook hands the restart back to a unit configured with `Restart=on-failure` or `Restart=always`, avoiding a `systemctl` helper inside the unit cgroup that is about to stop; if `appExit` is unavailable, the fallback uses a manager-owned transient `systemd-run` service and only then a detached helper. The client confirms the replacement by boot id and dismisses the banner, leaving DSH Web's own background connection recovery in control; it does not force a full-page reload during the auth/route handoff. The restart chain has been live-verified on the current DSH Web `0.2.0-rc.2` (2026-10-01): dsh-m probes the unit's `Restart=` policy, hands the stop back via `appExit`, the `status=75/TEMPFAIL` exit is caught by the Restart policy and auto-started, and after recovery the page reconnects in the background with the panel fully functional. Historical scope: the `0.1.5-rc.1` era covered live `/dshm` ping and authenticated `303 → 200` checks; `0.1.2-rc.1` is covered by contract checks plus runtime shape-detection fallback (see the verified array) — with the deployment moved on, no live E2E is chased on retired generations; the transient `systemd-run` fallback only applies to hosts without `appExit` (all supported generations provide it) and stays a documented fallback rather than a release gate; repeated install/uninstall is covered by the profile-transaction test surface (compensation, post-install guard, 813 cases) plus the 0.4.0→0.4.2 consecutive-release evidence. Installs stream live pnpm progress (resolve → download → link → build).
 
+### Fixed in 0.9.8 — Desktop package operations fully wired to the official manager (install always failed; upgrade/uninstall/self-upgrade opened)
+
+- **Why every install failed**: the Host API's desktop install branch called `desktopInstall(id, cfg, opts)` without the 4th `deps` argument — `getService` never reached the adapter, so desktop installs always failed with "official pluginManager service unavailable (fail-closed)" (100% reproducible, timing irrelevant). The `dshm_install` tool had the same defect.
+- **Service resolution aligned with dsh-market** (borrowed from its official-desktop wiring, proven on this machine by two managed upgrades): the probe now checks both contexts (the hostCtx from the webServer inject callback first) and falls back to a short-timeout cordis `inject` to lazily wake the official service — `pluginManager` is lazy, so a one-shot `get` returns undefined until something used it. Only a genuinely absent service still refuses (the no-file-level-fallback red line is untouched).
+- **Capability table widened (owner decision, following dsh-market strategy)**: desktop upgrade (installBundle over the installed bundle), uninstall (removeBundle) and self-upgrade (installBundle('dsh-m@latest')) are now delegated to the official manager — exactly how dshmarket performed the dsh-m 0.9.3→0.9.4/0.9.5 upgrades on this machine. Judgment discipline unchanged (application/stage first, overridden is not a failure, build-blocked returns structured pendingBuilds, listBundles re-read never fakes success). restart stays refused (Electron lifecycle belongs to the shell).
+- All three entry points (GUI, installed-view actions, and the dshm_install / dshm_uninstall / dshm_upgrade tools) are wired in the same pass.
+
 ### Fixed in 0.9.7 — Upgrade chip on Desktop showed a red "upgrade failed" banner (capability refusal is guidance, not an error)
 
 - **Root cause**: the 0.9.1 upgrade chip always calls `self-upgrade`; the Desktop capability table refuses by design with a structured 409, but the client rendered that 409 like any other failure — a red "upgrade failed" banner. Per the capability table this is not a failure, it's a pointer to the official entry.

package/README.md

@@ -48,6 +48,13 @@
 
 以下重启链路仅适用于 **Web**（Desktop 的生效走官方应用生命周期：安装完成后退出并重新打开 Desktop 应用即可，见 0.9.0 节）。安装 / 卸载 / 升级完成后，当前已打开的市场页与已装页会一起重新读取 profile 状态并同步徽标/卡片，不需要关闭后重新打开插件市场；随后出现「⚡ 一键重启」横幅——受 systemd 管理时通过 DSH launcher 的 `appExit` 交给服务的 `Restart` 策略，避免在待停止 unit 的 cgroup 内启动 `systemctl` helper；无 `appExit` 的 systemd 兜底改用 manager-owned transient `systemd-run`，最后才退回 detached-helper。客户端按 boot id 确认新进程已恢复后关闭横幅，交由 DSH Web 自身的后台连接重试恢复页面，不强制整页刷新，避免认证/路由切换期间白屏。重启链路已在当前 DSH Web `0.2.0-rc.2` 实机核验（2026-10-01）：dsh-m 探测 unit `Restart=` 策略后经 `appExit` 交还 systemd，`status=75/TEMPFAIL` 退出由 Restart 策略接住自动拉起，服务恢复后页面后台重连、面板全功能可用。历史口径：`0.1.5-rc.1` 时代已核验 `/dshm` ping 与带认证 `303 → 200`；`0.1.2-rc.1` 按契约核对 + 形态探测兜底收录（verified 数组），部署面演进后不再追旧代 live E2E；transient `systemd-run` 兜底仅适用于无 `appExit` 的宿主（受支持代际均提供 `appExit`），保持设计兜底而非发布门槛；连续安装/卸载由 profile 事务测试面（补偿事务、装后守卫等 813 用例）与 0.4.0→0.4.2 连续发布实证覆盖。安装过程实时显示 pnpm 进度（解析 → 下载 → 链接 → 构建）。
 
+### 0.9.8 修复：Desktop 包操作全面接通官方管理器（安装恒 no-manager；升级/卸载/自升级开放）
+
+- **安装恒失败的根因**：Host API 的 desktop 安装分支调 `desktopInstall(id, cfg, opts)` 漏传第 4 参 deps——`getService` 根本没进适配器，desktop 安装恒报「官方 pluginManager 服务不可用（fail-closed）」（100% 必现，与时机无关）。工具面 `dshm_install` 同病。
+- **服务解析与 dsh-market 同源**（借鉴其 official-desktop 接线，本机两轮覆盖安装实证）：探测改双上下文（webServer 注入回调的 hostCtx 优先）+ cordis inject 惰性拉起兜底（短超时）——官方 pluginManager 是惰性服务，未被拉起前一次性 get 恒 undefined；仍缺席才结构化拒绝（绝不文件级回退的红线不动）。
+- **能力表扩充（主人裁决，借鉴 dsh-market 策略）**：desktop 的 upgrade（installBundle 覆盖安装）/ uninstall（removeBundle）/ self-upgrade（installBundle('dsh-m@latest')）全部开放——dshmarket 正是这样完成 dsh-m 0.9.3→0.9.4/0.9.5 两轮升级的；判定纪律沿用（application/stage 为准、overridden 非失败、build-blocked 结构化回传 pendingBuilds、listBundles 复读不冒充成功）。restart 继续拒绝（Electron 生命周期归官方壳）。
+- GUI 与工具面（dshm_install / dshm_uninstall / dshm_upgrade）三入口同批接线。
+
 ### 0.9.7 修复：Desktop 下点升级角标弹红色「升级失败」（能力表拒绝应为指导而非报错）
 
 - **根因**：0.9.1 的升级角标点击后一律调 `self-upgrade`；Desktop 能力表按设计 409 结构化拒绝，但客户端把 409 当普通失败渲染成红色「升级失败」横幅——按能力表这根本不是失败，是「该走官方入口」的指引。

package/lib/core/active-profile.js

@@ -8,8 +8,22 @@
  * process.cwd() 或文件存在性猜 profile（报告 §4 同业旁证 #655/#744）。
  */
 import { webProfileDir, WEB_PROFILE } from './env.js';
-/** Desktop 首发能力表（ADR-0005）：只读市场 + 安装新包 + 开关；其余结构化拒绝并指引官方入口。 */
-const DESKTOP_ALLOWED = new Set(['install', 'set-enabled']);
+/**
+ * Desktop 能力表：
+ * - 0.9.0 首发：install / set-enabled（upgrade/uninstall/self-upgrade 结构化拒绝）
+ * - 0.9.8 主人裁决（借鉴 dsh-market 官方市场同机实证：0.9.3→0.9.4/0.9.5 两轮覆盖安装、
+ *   removeBundle 卸载均由官方管理器完成）：upgrade（installBundle 覆盖安装）、
+ *   uninstall（removeBundle）、self-upgrade（installBundle('dsh-m@latest')）一并放开；
+ *   全部走官方管理器委派，服务缺席仍结构化拒绝（fail-closed 红线不动：绝不文件级回退）。
+ * - restart 继续拒绝：Electron 进程生命周期归官方壳，dsh-m 不重启宿主。
+ */
+const DESKTOP_ALLOWED = new Set([
+    'install',
+    'set-enabled',
+    'upgrade',
+    'uninstall',
+    'self-upgrade',
+]);
 /** 结构化拒绝的官方入口指引（zh；GUI/工具/HTTP 三入口共用同一文案源）。 */
 export const WRITE_GUIDANCE = {
     install: '',

package/lib/core/host-api.js

@@ -21,7 +21,7 @@ import { servingPort, scheduleRestart } from './restart.js';
 import { togglePlugin, ToggleError } from './toggle.js';
 import { IncompatibleError } from './compat-check.js';
 import { ProfileUnsupportedError, assertWriteAllowed } from './active-profile.js';
-import { DesktopOpsError, desktopInstallFromRegistry, desktopToggle } from './profile-ops.js';
+import { DesktopOpsError, desktopInstallFromRegistry, desktopToggle, desktopUninstall, desktopUpgradeFromRegistry } from './profile-ops.js';
 export class BadJsonError extends Error {
 }
 export class BodyTooLargeError extends Error {
@@ -223,6 +223,9 @@ export function createApiDispatcher(ctx) {
         toggle: ctx.deps?.togglePlugin ?? togglePlugin,
         desktopInstall: ctx.deps?.desktopInstall ?? desktopInstallFromRegistry,
         desktopToggle: ctx.deps?.desktopToggle ?? desktopToggle,
+        desktopUninstall: ctx.deps?.desktopUninstall ?? desktopUninstall,
+        desktopUpgrade: ctx.deps?.desktopUpgrade ?? desktopUpgradeFromRegistry,
+        ensureService: ctx.deps?.ensureService,
     };
     const cfg = () => ctx.controller.config;
     // 0.9.0：宿主信任检查委派（含 ping 与未知 method，fail-closed）；
@@ -267,8 +270,29 @@ export function createApiDispatcher(ctx) {
                     break;
                 }
                 case 'self-upgrade': {
-                    // 0.9.0：Desktop 结构化拒绝（能力表），Web 走既有路径
                     assertWriteAllowed(profile, 'self-upgrade');
+                    // 0.9.8：desktop → 官方管理器覆盖安装 dsh-m@latest（dsh-market 同策略实证；
+                    // 生效仍需重启 Desktop——banner.desktop 指引由客户端 needsRestart 通道给出）
+                    if (profile.kind !== 'web') {
+                        const managed = await d.desktopInstall(ctx.pkg.name, cfg(), {
+                            namespace: 'host',
+                            profile: profile.name,
+                            signal,
+                        }, { getService: d.getService, ensureService: d.ensureService });
+                        if ('needsBuildApproval' in managed) {
+                            // build-blocked（自升级罕见）：结构化透出，不冒充成功
+                            payload = { ...managed };
+                            break;
+                        }
+                        payload = {
+                            pkg: managed.pkg,
+                            version: managed.version,
+                            buildApprovals: managed.buildApprovals ?? [],
+                            fallbackAllBuilds: false,
+                            needsRestart: true,
+                        };
+                        break;
+                    }
                     // M2 Task 3：self-upgrade 收编 market.selfUpgrade（统一 mutation session + 守卫，直调事务旁路封死）
                     const result = await d.selfUpgrade(ctx.pkg.name, ctx.pkg.version, cfg(), { signal });
                     payload = {
@@ -391,7 +415,7 @@ export function createApiDispatcher(ctx) {
                                 namespace: 'host',
                                 profile: profile.name,
                                 signal,
-                            })) };
+                            }, { getService: d.getService, ensureService: d.ensureService })) };
                         break;
                     }
                     const version = typeof body.version === 'string' ? body.version : undefined;
@@ -408,8 +432,12 @@ export function createApiDispatcher(ctx) {
                     const target = strArg(body, 'pkg');
                     if (!target)
                         throw new ApiProtocolError(400, '缺少 pkg');
-                    // 0.9.0：Desktop 结构化拒绝（官方入口指引）
                     assertWriteAllowed(profile, 'uninstall');
+                    // 0.9.8：desktop → 官方管理器 removeBundle（dsh-market 同策略；此前结构化拒绝）
+                    if (profile.kind !== 'web') {
+                        payload = { ...(await d.desktopUninstall(target, { getService: d.getService, ensureService: d.ensureService, profileDir: profile.dir })) };
+                        break;
+                    }
                     const result = await d.uninstallPlugin(target, cfg(), { namespace: 'host', signal });
                     payload = { ...result };
                     break;
@@ -434,8 +462,18 @@ export function createApiDispatcher(ctx) {
                     const target = strArg(body, 'pkg');
                     if (!target)
                         throw new ApiProtocolError(400, '缺少 pkg');
-                    // 0.9.0：Desktop 结构化拒绝（无官方 upgrade API，指引 Settings → Plugins）
                     assertWriteAllowed(profile, 'upgrade');
+                    // 0.9.8：desktop → 官方管理器覆盖安装（dsh-market 同策略；此前结构化拒绝）
+                    if (profile.kind !== 'web') {
+                        payload = { ...(await d.desktopUpgrade(target, cfg(), {
+                                forceIncompatible: boolArg(body.forceIncompatible),
+                                namespace: 'host',
+                                profile: profile.name,
+                                profileDir: profile.dir,
+                                signal,
+                            }, { getService: d.getService, ensureService: d.ensureService })) };
+                        break;
+                    }
                     const result = await d.upgradePlugin(target, cfg(), {
                         forceIncompatible: boolArg(body.forceIncompatible),
                         namespace: 'host',

package/lib/core/market.js

@@ -209,7 +209,8 @@ function classifyLatestError(err) {
         return 'rate-limited';
     return 'network-error';
 }
-function matchInstalledByEntry(entry, installed) {
+/** 0.9.8 导出（原模块私有）：desktopUpgrade 的「已装 ↔ 收录条目」匹配与 web upgradePlugin 同语义。 */
+export function matchInstalledByEntry(entry, installed) {
     return installed.find((it) => {
         if (entry.npm && it.pkg === entry.npm)
             return true;

package/lib/core/profile-ops.js

@@ -18,7 +18,11 @@
  * 禁止事项：desktop 路径零 Web fallback——不做文件级装后守卫（app.asar 探测盲区）、
  * 不写 allowBuilds、不跑 dsh-m 自实现 pnpm 编排、服务缺席一律结构化拒绝。
  */
-import { withMutationSession, resolveRegistryEntry } from './market.js';
+import { withMutationSession, resolveRegistryEntry, matchInstalledByEntry } from './market.js';
+import { loadRegistry as defaultLoadRegistry } from './registry.js';
+import { fetchCommunityCatalog as defaultFetchCommunityCatalog } from './community.js';
+import { adaptCommunityCatalog } from './community-adapter.js';
+import { listInstalledPlugins as defaultListInstalled } from './installed.js';
 import { precheckNpmCompat, IncompatibleError } from './compat-check.js';
 import { npmLatest as defaultNpmLatest, githubLatestTag as defaultGithubLatestTag } from './versions.js';
 import { togglePlugin, ToggleError } from './toggle.js';
@@ -30,6 +34,21 @@ export class DesktopOpsError extends Error {
         this.code = code;
     }
 }
+/** 结构化信号：build-blocked + pendingBuilds（desktopInstall/Upgrade 共享，调用方映射各自返回形态）。 */
+export class DesktopBuildApprovalNeeded extends Error {
+    pendingBuilds;
+    constructor(pending) {
+        super(`该插件需要执行构建脚本（${pending.join('、')}）。确认后带同样的包名名单重试（approvedBuilds）；dsh-m 不做全量放行（ADR-0002 同语义）`);
+        this.name = 'DesktopBuildApprovalNeeded';
+        this.pendingBuilds = pending;
+    }
+}
+async function resolveManager(deps) {
+    const direct = deps.getService?.();
+    if (direct)
+        return direct;
+    return deps.ensureService ? await deps.ensureService() : undefined;
+}
 function changeOf(raw) {
     if (raw && typeof raw === 'object')
         return raw;
@@ -44,7 +63,7 @@ export async function desktopInstallFromRegistry(id, cfg = {}, opts = {}, deps =
     return withMutationSession(() => desktopInstallLocked(id, cfg, opts, deps));
 }
 async function desktopInstallLocked(id, cfg, opts, deps) {
-    const service = deps.getService?.();
+    const service = await resolveManager(deps);
     if (!service || typeof service.installBundle !== 'function') {
         throw new DesktopOpsError('no-manager', '官方 pluginManager 服务不可用（desktop profile 必须由官方管理器执行包操作）；拒绝安装（fail-closed）');
     }
@@ -89,9 +108,55 @@ async function desktopInstallLocked(id, cfg, opts, deps) {
     else {
         throw new DesktopOpsError('install-refused', `收录条目 ${entry.id} 缺少 npm/github 来源，无法在 desktop 安装`);
     }
+    let change;
+    let bundleName;
+    try {
+        ({ change, bundleName } = await runManagedInstall(service, pkg, spec, opts.approvedBuilds));
+    }
+    catch (err) {
+        if (err instanceof DesktopBuildApprovalNeeded) {
+            return { ok: false, needsBuildApproval: true, id: entry.id, pkg, spec, pendingBuilds: err.pendingBuilds, message: err.message };
+        }
+        throw err;
+    }
+    return {
+        id: entry.id,
+        pkg,
+        spec,
+        ...(version !== undefined ? { version } : {}),
+        ...(sha !== undefined ? { sha } : {}),
+        ...(tag !== undefined ? { tag } : {}),
+        buildApprovals: Array.isArray(change.approvedBuilds) ? change.approvedBuilds : [],
+        fallbackAllBuilds: false,
+        ...(compat !== null ? { compat } : {}),
+        ...(compatSkipped ? { compatSkipped } : {}),
+        needsRestart: true,
+        output: `official pluginManager: application=${change.application ?? 'applied'}, bundle=${bundleName}${change.changed === false ? ', changed=false' : ''}`,
+        via: 'desktop-manager',
+        ...(change.application === 'overridden' ? { overridden: true } : {}),
+    };
+}
+/**
+ * Desktop 开关：服务缺席 → 结构化拒绝（ToggleError/unaddressable，禁 fallback 文件写）；
+ * 服务在用 → 既有 togglePlugin 委派路径（installed 校验按 profileDir，与 web 委派同代码）。
+ */
+export async function desktopToggle(pkg, enabled, deps = {}) {
+    const service = await resolveManager(deps);
+    if (!service) {
+        throw new ToggleError('unaddressable', '官方 pluginManager 服务不可用：desktop profile 的开关必须走官方管理器（dsh-m 不做文件级 fallback）；请在官方 Desktop 插件页操作');
+    }
+    return togglePlugin(pkg, enabled, { getService: () => service, profileDir: deps.profileDir });
+}
+/**
+ * 管理器安装共享核心（0.9.8）：installBundle + ChangeResult 判定 + listBundles 复读。
+ * desktopInstall / desktopUpgrade 共用；build-blocked 以 DesktopBuildApprovalNeeded 抛出，
+ * 由调用方映射各自的返回形态。判定纪律沿用文件头「报告 §5.2」（dsh-market #703/#772 实证）：
+ * 以 application/stage 为准，绝不只看 packageResult.exitCode；overridden 非失败。
+ */
+async function runManagedInstall(service, pkg, spec, approvedBuilds) {
     const raw = await service.installBundle(spec, {
         enabled: true,
-        ...(opts.approvedBuilds ? { approvedBuilds: opts.approvedBuilds } : {}),
+        ...(approvedBuilds && approvedBuilds.length > 0 ? { approvedBuilds } : {}),
     });
     const change = changeOf(raw);
     if (change.application === 'cancelled') {
@@ -99,17 +164,8 @@ async function desktopInstallLocked(id, cfg, opts, deps) {
     }
     if (change.application === 'failed' || change.error) {
         const pending = Array.isArray(change.pendingBuilds) ? change.pendingBuilds.filter((n) => typeof n === 'string') : [];
-        const buildBlocked = change.packageResult?.kind === 'build-blocked';
-        if (buildBlocked && pending.length > 0) {
-            return {
-                ok: false,
-                needsBuildApproval: true,
-                id: entry.id,
-                pkg,
-                spec,
-                pendingBuilds: pending,
-                message: `该插件需要执行构建脚本（${pending.join('、')}）。确认后带同样的包名名单重试（approvedBuilds）；dsh-m 不做全量放行（ADR-0002 同语义）`,
-            };
+        if (change.packageResult?.kind === 'build-blocked' && pending.length > 0) {
+            throw new DesktopBuildApprovalNeeded(pending);
         }
         if (change.stage === 'enable') {
             throw new DesktopOpsError('enable-failed', `安装后启用阶段失败（${pkg}；application=failed、stage=enable${change.error?.code ? `、error=${change.error.code}` : ''}）：包已写入但未能启用，请在官方 Desktop 插件页查看状态或重试`);
@@ -128,6 +184,122 @@ async function desktopInstallLocked(id, cfg, opts, deps) {
     else if (!change.bundle) {
         throw new DesktopOpsError('verify-failed', `安装复读不可用（${pkg}）：官方结果未携带 bundle 字段且 listBundles 缺席——不冒充安装成功`);
     }
+    return { change, bundleName };
+}
+/**
+ * Desktop 卸载（0.9.8，dsh-market 同策略）：removeBundle 委派 + ChangeResult 判定 +
+ * listBundles 复读（可用时必须不见目标在装）。服务缺席 → 结构化拒绝，零 CLI、零文件级 fallback。
+ */
+export async function desktopUninstall(pkg, deps = {}) {
+    const service = await resolveManager(deps);
+    if (!service || typeof service.removeBundle !== 'function') {
+        throw new DesktopOpsError('no-manager', '官方 pluginManager 服务不可用（desktop profile 的卸载必须由官方管理器执行）；拒绝卸载（fail-closed）');
+    }
+    const raw = await service.removeBundle(pkg);
+    const change = changeOf(raw);
+    if (change.application === 'failed' || change.error) {
+        throw new DesktopOpsError('remove-failed', `官方管理器卸载失败（${pkg}；application=${change.application ?? 'failed'}${change.error?.code ? `、error=${change.error.code}` : ''}${change.error?.diagnostic ? `：${change.error.diagnostic}` : ''}）`);
+    }
+    if (typeof service.listBundles === 'function') {
+        const bundles = await service.listBundles();
+        const found = (bundles ?? []).find((b) => b && b.name === (change.bundle ?? pkg));
+        if (found && found.installed === true) {
+            throw new DesktopOpsError('verify-failed', `卸载复读失败（${pkg}）：官方结果为 ${change.application ?? 'unknown'} 但 listBundles 仍见目标在装——不冒充卸载成功`);
+        }
+    }
+    return {
+        pkg,
+        liveDisabled: false,
+        needsRestart: change.application === 'restart-required',
+        leftovers: [],
+        via: 'desktop-manager',
+        output: `official pluginManager: application=${change.application ?? 'applied'}`,
+    };
+}
+/**
+ * Desktop 升级（0.9.8，dsh-market 同策略——本机 0.9.3→0.9.4/0.9.5 即此路径实证）：
+ * 覆盖安装 = installBundle(latest 精确 spec)。收录匹配（主清单 → 社区目录）与
+ * upgradePluginLocked 同语义；非 dsh-m 收录的插件结构化拒绝（官方插件页负责）。
+ */
+export async function desktopUpgradeFromRegistry(pkg, cfg = {}, opts = {}, deps = {}) {
+    return withMutationSession(() => desktopUpgradeLocked(pkg, cfg, opts, deps));
+}
+async function desktopUpgradeLocked(pkg, cfg, opts, deps) {
+    const service = await resolveManager(deps);
+    if (!service || typeof service.installBundle !== 'function') {
+        throw new DesktopOpsError('no-manager', '官方 pluginManager 服务不可用（desktop profile 的升级必须由官方管理器执行覆盖安装）；拒绝升级（fail-closed）');
+    }
+    const timeoutMs = cfg.timeoutMs ?? 20_000;
+    const loaded = await (deps.loadRegistry ?? defaultLoadRegistry)(cfg, { namespace: opts.namespace ?? 'host', profile: opts.profile });
+    if (loaded.status === 'unavailable') {
+        throw new DesktopOpsError('install-refused', `收录清单不可用，无法升级 ${pkg}；请检查 registry 配置或网络后重试`);
+    }
+    const { items } = await (deps.listInstalled ?? defaultListInstalled)(opts.profileDir);
+    const target = items.find((it) => it.pkg === pkg);
+    if (!target)
+        throw new DesktopOpsError('install-refused', `desktop profile 未安装该插件: ${pkg}（升级目标必须是已装插件）`);
+    let entry = loaded.registry.plugins.find((e) => matchInstalledByEntry(e, [target]));
+    if (!entry) {
+        // 0.5.1 同语义：主清单 miss 查社区目录（合并市场安装的社区条目同样可升级）
+        try {
+            const community = await (deps.fetchCommunityCatalog ?? defaultFetchCommunityCatalog)(cfg, { namespace: opts.namespace ?? 'host', signal: opts.signal, profile: opts.profile });
+            entry = community.catalog
+                ? adaptCommunityCatalog(community.catalog).entries.find((e) => matchInstalledByEntry(e, [target]))
+                : undefined;
+        }
+        catch {
+            entry = undefined;
+        }
+    }
+    if (!entry)
+        throw new DesktopOpsError('install-refused', `「${pkg}」不是经 dsh-m 收录的插件；desktop 升级请在官方 Desktop 插件页操作`);
+    let spec;
+    let version;
+    let sha;
+    let tag;
+    let compat = null;
+    let compatSkipped;
+    if (entry.source === 'npm' && entry.npm) {
+        if (opts.version) {
+            version = opts.version;
+        }
+        else {
+            const latest = await (deps.npmLatest ?? defaultNpmLatest)(entry.npm, timeoutMs, opts.signal);
+            version = latest.version;
+        }
+        spec = `${entry.npm}@${version}`;
+        if (version !== undefined) {
+            try {
+                compat = await (deps.precheck ?? precheckNpmCompat)(entry.npm, version, { timeoutMs, signal: opts.signal });
+            }
+            catch {
+                compat = null;
+            }
+            if (compat !== null && opts.forceIncompatible !== true)
+                throw new IncompatibleError(compat);
+        }
+    }
+    else if (entry.github) {
+        const resolved = await (deps.githubLatestTag ?? defaultGithubLatestTag)(entry.github, timeoutMs, opts.signal);
+        sha = resolved.sha;
+        tag = resolved.tag;
+        spec = `github:${entry.github}#${sha}`;
+        compatSkipped = 'github-source';
+    }
+    else {
+        throw new DesktopOpsError('install-refused', `收录条目 ${entry.id} 缺少 npm/github 来源，无法在 desktop 升级`);
+    }
+    let change;
+    let bundleName;
+    try {
+        ({ change, bundleName } = await runManagedInstall(service, pkg, spec, opts.approvedBuilds));
+    }
+    catch (err) {
+        if (err instanceof DesktopBuildApprovalNeeded) {
+            return { ok: false, needsBuildApproval: true, id: entry.id, pkg, spec, pendingBuilds: err.pendingBuilds, message: err.message };
+        }
+        throw err;
+    }
     return {
         id: entry.id,
         pkg,
@@ -143,16 +315,6 @@ async function desktopInstallLocked(id, cfg, opts, deps) {
         output: `official pluginManager: application=${change.application ?? 'applied'}, bundle=${bundleName}${change.changed === false ? ', changed=false' : ''}`,
         via: 'desktop-manager',
         ...(change.application === 'overridden' ? { overridden: true } : {}),
+        fromVersion: target.version,
     };
 }
-/**
- * Desktop 开关：服务缺席 → 结构化拒绝（ToggleError/unaddressable，禁 fallback 文件写）；
- * 服务在用 → 既有 togglePlugin 委派路径（installed 校验按 profileDir，与 web 委派同代码）。
- */
-export async function desktopToggle(pkg, enabled, deps = {}) {
-    const service = deps.getService?.();
-    if (!service) {
-        throw new ToggleError('unaddressable', '官方 pluginManager 服务不可用：desktop profile 的开关必须走官方管理器（dsh-m 不做文件级 fallback）；请在官方 Desktop 插件页操作');
-    }
-    return togglePlugin(pkg, enabled, { getService: () => service, profileDir: deps.profileDir });
-}

package/lib/host.js

@@ -43,9 +43,44 @@ export function apply(ctx, config) {
     // using it avoids guessing the service unit from release-specific cgroups.
     const appExit = appExitFromContext(ctx);
     const restart = (port = null) => scheduleRestart(port, { appExit });
-    // 开关委派的官方服务探测（ADR-0001）：运行时按服务存在性探测，不判 DSH 版本号
-    const getService = () => ctx.get?.('pluginManager');
-    registerTools(ctx, controller.config, { restart }, profile);
+    // 开关委派的官方服务探测（ADR-0001）：运行时按服务存在性探测，不判 DSH 版本号。
+    // 0.9.8 与 dsh-market 同源修正（Windows 实机 2026-10-01）：pluginManager 是惰性服务，
+    // 外层 apply ctx 的一次性 get 在本机探不到；改为双上下文探测（webServer 注入回调的
+    // hostCtx 优先——dshmarket 即此路径，两轮覆盖安装实证）+ inject 惰性拉起兜底。
+    let serviceCtx = undefined;
+    const getService = () => {
+        for (const c of [serviceCtx, ctx]) {
+            const svc = c?.get?.('pluginManager');
+            if (svc !== undefined && svc !== null)
+                return svc;
+        }
+        return undefined;
+    };
+    // 惰性拉起：get 缺席时经 cordis inject 等官方服务实例化（短超时，仍缺席由调用方 fail-closed）
+    const ensureService = (timeoutMs = 5_000) => new Promise((resolve) => {
+        const immediate = getService();
+        if (immediate !== undefined) {
+            resolve(immediate);
+            return;
+        }
+        let settled = false;
+        const finish = () => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(getService());
+        };
+        const timer = setTimeout(finish, timeoutMs);
+        try {
+            ;
+            ctx.inject?.(['pluginManager'], () => finish());
+        }
+        catch {
+            finish();
+        }
+    });
+    registerTools(ctx, controller.config, { restart, getService, ensureService }, profile);
     // 设置页接线（双代兼容，详见 core/settings-compat.ts）：
     // - ≤0.1.5：settings.register('dshm', …) scope（get/update/watch）；
     // - 0.1.7-rc.1 / rc.2：Config `.volatile()` 字段自动生成设置页（autoGenerate 默认开，无需 configure），
@@ -78,6 +113,7 @@ export function apply(ctx, config) {
     // 服务缺席或抛错一律 fail-closed 403（warn 一次）。
     ctx.inject(['webServer'], (c) => {
         const server = c.webServer;
+        serviceCtx = c; // 0.9.8：webServer 注入回调的 hostCtx 是 pluginManager 的可见上下文（dsh-market 同款）
         const rejectRequest = createRequestRejection(ctx);
         const handleApi = createApiDispatcher({
             controller,
@@ -86,6 +122,7 @@ export function apply(ctx, config) {
             deps: {
                 scheduleRestart: restart,
                 getService,
+                ensureService,
                 rejectRequest,
             },
         });

package/lib/tools.js

@@ -5,7 +5,7 @@ import { COMMUNITY_CATEGORY_LABELS } from './core/community.js';
 import { appExitFromContext, scheduleRestart } from './core/restart.js';
 import { togglePlugin as coreTogglePlugin } from './core/toggle.js';
 import { resolveActiveProfile, assertWriteAllowed } from './core/active-profile.js';
-import { desktopInstallFromRegistry, desktopToggle } from './core/profile-ops.js';
+import { desktopInstallFromRegistry, desktopToggle, desktopUninstall, desktopUpgradeFromRegistry } from './core/profile-ops.js';
 export const CATEGORY_LABELS = {
     market: '市场',
     tools: '工具',
@@ -67,11 +67,15 @@ export function registerTools(ctx, cfg, deps = {}, profile = resolveActiveProfil
         upgradePlugin: deps.upgradePlugin ?? upgradePlugin,
         desktopInstall: deps.desktopInstall ?? desktopInstallFromRegistry,
         desktopToggle: deps.desktopToggle ?? desktopToggle,
+        desktopUninstall: deps.desktopUninstall ?? desktopUninstall,
+        desktopUpgrade: deps.desktopUpgrade ?? desktopUpgradeFromRegistry,
     };
     const restart = deps.restart ?? ((port = null) => scheduleRestart(port, { appExit: appExitFromContext(ctx) }));
     const toggle = deps.togglePlugin ?? coreTogglePlugin;
-    // 开关委派服务探测（ADR-0001）：运行时按存在性，不判版本号
-    const getService = () => ctx.get?.('pluginManager');
+    // 开关委派服务探测（ADR-0001）：运行时按存在性，不判版本号。
+    // 0.9.8：host.ts 共用解析器（双上下文 + 惰性拉起）优先；缺省退回外层 ctx 一次性 get（旧行为）。
+    const getService = deps.getService ?? (() => ctx.get?.('pluginManager'));
+    const ensureService = deps.ensureService;
     ctx.tools.register(defineTool({
         name: 'dshm_search',
         description: 'Search the DSH plugin marketplace (dsh-m) and show clickable plugin cards. ALWAYS call this instead of web_search or bash when the user wants to find/recommend/browse DSH plugins (插件). Call EXACTLY ONCE per user message; extract a real keyword (主题, 搜索) rather than pasting the whole sentence. Dual catalog: ~22 hand-curated 精选 entries plus a 4,000+ community catalog — default searches all; pass source="community" or "primary" to zone in. Returns 10 cards by default; use offset (take nextOffset from the result) for more batches. After cards appear, reply with AT MOST one short sentence. Do not print install commands.',
@@ -250,7 +254,8 @@ export function registerTools(ctx, cfg, deps = {}, profile = resolveActiveProfil
             // 0.9.0：desktop → 官方 pluginManager 委派（新包）；未知 profile → 结构化拒绝
             if (profile.kind !== 'web') {
                 assertWriteAllowed(profile, 'install');
-                return cloneJson(await m.desktopInstall(id, cfg, { version, forceIncompatible: force, namespace: 'host', profile: profile.name }));
+                // 0.9.8：补传服务解析 deps（此前漏传 → desktop 安装恒 no-manager，实机 2026-10-01）
+                return cloneJson(await m.desktopInstall(id, cfg, { version, forceIncompatible: force, namespace: 'host', profile: profile.name }, { getService: getService, ensureService: ensureService }));
             }
             try {
                 return cloneJson(await m.installFromRegistry(id, cfg, { version, forceIncompatible: force, namespace: 'host' }));
@@ -296,7 +301,7 @@ export function registerTools(ctx, cfg, deps = {}, profile = resolveActiveProfil
             // 0.9.0：desktop → 官方管理器委派（服务缺席结构化拒绝）；web → 既有委派/降级
             if (profile.kind !== 'web') {
                 assertWriteAllowed(profile, 'set-enabled');
-                return cloneJson(await m.desktopToggle(target, args.enabled, { getService: getService, profileDir: profile.dir }));
+                return cloneJson(await m.desktopToggle(target, args.enabled, { getService: getService, ensureService: ensureService, profileDir: profile.dir }));
             }
             return cloneJson(await toggle(target, args.enabled, { getService: getService }));
         },
@@ -324,6 +329,10 @@ export function registerTools(ctx, cfg, deps = {}, profile = resolveActiveProfil
             if (!target)
                 throw new Error('缺少 pkg');
             assertWriteAllowed(profile, 'uninstall');
+            // 0.9.8：desktop → 官方管理器 removeBundle（dsh-market 同策略；此前该工具在 desktop 走 web 事务必然错位）
+            if (profile.kind !== 'web') {
+                return cloneJson(await m.desktopUninstall(target, { getService: getService, ensureService: ensureService, profileDir: profile.dir }));
+            }
             return cloneJson(await m.uninstallPlugin(target, cfg, { namespace: 'host' }));
         },
     }));
@@ -407,6 +416,10 @@ export function registerTools(ctx, cfg, deps = {}, profile = resolveActiveProfil
                 throw new Error('缺少 pkg');
             const force = args.force === true;
             assertWriteAllowed(profile, 'upgrade');
+            // 0.9.8：desktop → 官方管理器覆盖安装（dsh-market 同策略；此前该工具在 desktop 走 web 事务必然错位）
+            if (profile.kind !== 'web') {
+                return cloneJson(await m.desktopUpgrade(target, cfg, { forceIncompatible: force, namespace: 'host', profile: profile.name, profileDir: profile.dir }, { getService: getService, ensureService: ensureService }));
+            }
             try {
                 return cloneJson(await m.upgradePlugin(target, cfg, { forceIncompatible: force, namespace: 'host' }));
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-m",
-  "version": "0.9.7",
+  "version": "0.9.8",
   "description": "可自定义收录清单的 DSH 插件市场：收录、安装、卸载、升级一站完成，附 agent 工具与 dshm CLI。",
   "license": "MIT",
   "type": "module",