dsh-m 0.9.77 → 0.9.79

package/CHANGELOG.md

@@ -8,6 +8,19 @@ The full release history of dsh-m, maintained bilingually: **Chinese first, Engl
 
 ## 中文
 
+### 0.9.79 功能：外部操作记录——非面板通道（CLI / Agent 工具）变更直落审计日志进面板「已结束」（ADR-0018）
+
+- **问题（审计面脱节实证）**：全局操作记录的口径 = 面板发起——quota-watch 0.1.28 经 `dshm_upgrade`（Agent 工具）升级装机成功后，面板「已结束」列表零记录，操作审计面与真实系统状态脱节。CLI 与 Agent 工具是独立进程，写不进浏览器 localStorage 的操作泵。
+- **方案（ADR-0018：机器本地直落日志，与操作泵分离）**：新增 `$DSH_HOME/dshm/external-operations.json`（`DSHM_EXTERNAL_JOURNAL_FILE` 可覆盖；机器本地、不跨机同步）——九个公共变更入口增 `channel` 参数（`'panel'|'cli'|'host-tool'`，缺省 `'external'` 兜底），非面板通道的操作终态后直落一条记录：**成功与失败都记**、滚动 200 条、tmp+rename 原子写、损坏文件改名隔离、append 任何失败被钩子吞掉（至多 stderr 一行，绝不反噬操作终态，R1-1）；reason 截断 ≤300。desktop 口径（R1-2）：desktopToggle 透传 togglePlugin（唯一嵌套对，单笔事务一条记录）；desktopInstall/Uninstall/Upgrade 自记（call-graph audit 证实不经已插桩入口）；服务缺席拒绝自记 `desktop-toggle` failed。
+- **面板消费（内存 overlay 并读，不写 localStorage）**：host-api 新增 `external-operations`（list）与 `external-operations-clear` 两 method（鉴权沿既有宿主信任检查）；「已结束」列表 = 本地操作泵（localStorage，现状不动）+ 外部记录 overlay（服务端为唯一事实源，persist 路径零触碰——防服务端淘汰后被本地副本复活，R1-3）；渠道徽标 **Agent 工具** / **命令行** / 兜底**外部**（Q2b/R1-4）；失败记录点亮红点（Q4）；外部行不渲染单条 ✕（R2-3）；「清除已结束」连带清除服务端日志 + overlay 同步清空；fetch 时机 = 面板初始化 + 每次操作完成后 + 打开操作记录卡（不轮询，R1-6）；「已结束」计数改用合并后全量，最近 50 条渲染截断照旧（R1-7）。
+- **验证**：1423 项测试全绿（0.9.78 基线 1389 + 新增 34：journal 存储 8（滚动/损坏容错/panel 拒绝/无凭据/路径上抛/截断）、通道插桩 8（panel 零记录/cli、host-tool 各一条/嵌套单条/失败 failed/append 注入抛错不反噬）、host-api 4（list/clear/鉴权/注入位）、client 模型+视图 14（overlay 升序并读/persist 纯净/幂等/徽标/✕ 出口/计数/接线锚））、typecheck 零错误；测试全程零触碰真实 `~/.dsh`（10 个既有测试文件补 journal 隔离，另新增 1 个通道插桩测试文件，沿用 cacheRoot 纪律）。实施计划经独立评审 Agent 三轮评审收敛；npm 发版与 dsh-m 自升级另行经用户确认。
+
+### 0.9.78 性能：收藏 stale 检查零网络 + 市场页零增量提交守卫（钢人 C3）
+
+- **问题（钢人报告 C3 节）**：收藏 stale 判定只需要「id 还在不在目录」的成员布尔，却穿透富 market interface 的探测段——每次收藏区访问/切换（800ms debounce 合并后）仍是 N 条收藏 × full 查询，含每命中条 npm/github latest **网络扇出**且产物全部丢弃；叠加 toggle 后 refreshViews 四连响应无条件 `setData`——数据层精心维持的引用稳定性一次 setState 即蒸发。
+- **修复**：`lookupLive` 补 `probeMode:"cache-only"`（ADR-0013 第一段模式，零网络零探测；existence = items 成员判定，语义零变化）；`fetchPage` 增设**零增量提交守卫**——新增 `marketResponseEquivalent` 纯函数（JSON 值语义递归比较，ZoneChips setGeom 同款纪律），内容等价则跳过 `setData`（dataRef/loading 语义不动）。报告可选项「客户端 stale TTL 缓存」明确不做：C1 物化后 cache-only 查询已是内存级。
+- **验证**：1389 项测试全绿（执行基线 1382 + 新增 7）、typecheck 零错误；真机差分冒烟 5 组用例（npm 主清单/自身/社区条目/不存在 id）：cache-only 与 full 的 id 集合与 total 逐项一致（红点语义不变的充分条件），cache-only ~30ms vs full 冷跑 ~250ms（零探测指纹）；实施计划经独立评审两轮闭环（F1-1 计划基线勘误）。
+
 ### 0.9.76 修复：三项展示层退役与吸顶跳动根治——「对话」徽章/「版本无关」徽章退役 + 分类行滚动锚定自激断路
 
 - **① 「对话」来源徽章退役（主人实拍：界面全点按钮却全员误标「对话」）**：`meta.session` 是 0.7.0 终审·新伤1 的**泵所有权标记**（restore 跳过 / replaceAll 不回卷 / persist 时剥离），GUI 的 `runOp` 与对话区镜像两路无条件同打同一标——它区分不了来源，且重载后徽章整体蒸发。修复：opRowVm 删 session 派生、行渲染删徽章、CSS 与 i18n 键退役；`meta.session` 本职不动（数据模型零变更），来源区分留待未来 `meta.origin` 承载。
@@ -559,6 +572,19 @@ The full release history of dsh-m, maintained bilingually: **Chinese first, Engl
 
 ## English
 
+### Feature in 0.9.79 — external operation records: non-panel channels (CLI / agent tools) land terminal-state audit entries into the panel's Ended list (ADR-0018)
+
+- **Problem (audit-surface disconnect, real incident)**: the global operation records only covered panel-initiated changes — the quota-watch 0.1.28 upgrade via `dshm_upgrade` (an agent tool) installed successfully yet left zero rows in the panel's Ended list. CLI and agent tools are separate processes and cannot write the browser-localStorage operations pump.
+- **Solution (ADR-0018: machine-local direct-write journal, decoupled from the pump)**: a new `$DSH_HOME/dshm/external-operations.json` (overridable via `DSHM_EXTERNAL_JOURNAL_FILE`; machine-local, never synced across machines) — the nine public mutation entries gain a `channel` parameter (`'panel'|'cli'|'host-tool'`, defaulting to `'external'` as the audit-safe fallback). Non-panel operations append one terminal-state record after completion: **both success and failure are recorded**, rolling cap of 200, tmp+rename atomic writes, corrupted files quarantined by rename, and any append failure swallowed by the hook (at most one stderr line — it never back-fires onto the operation result, R1-1); `reason` truncated to 300 chars. Desktop accounting (R1-2): desktopToggle passes through to togglePlugin (the only nested pair — one transaction, one record); desktopInstall/Uninstall/Upgrade self-record (call-graph audit confirms they bypass instrumented entries); the service-absent structured refusal self-records `desktop-toggle` failed.
+- **Panel consumption (in-memory overlay, never localStorage)**: host-api gains `external-operations` (list) and `external-operations-clear` methods (auth rides the existing host trust check); the Ended list = local operations pump (localStorage, untouched) + external-records overlay (the server side is the single source of truth, persist path untouched — prevents local resurrection after server-side eviction, R1-3); channel badges **Agent tool** / **CLI** / fallback **External** (Q2b/R1-4); failed external entries light the red dot (Q4); external rows render no per-row ✕ (R2-3); Clear ended also clears the server journal plus the overlay; fetch timing = panel init + after each operation + opening the operations card (no polling, R1-6); the Ended count now uses the merged total while the last-50 render cap stays (R1-7).
+- **Verification**: 1423 tests green (0.9.78 baseline 1389 + 34 added: journal storage 8 (rolling / corruption quarantine / panel rejection / no-credentials / path error propagation / truncation), channel wiring 8 (panel zero-record / cli and host-tool one each / nested single record / failure recorded as failed / injected append failure never back-fires), host-api 4 (list / clear / auth / override slots), client model+view 14 (overlay ascending merge / persist purity / idempotence / badge / ✕ exit / count / wiring anchors)), typecheck clean; tests never touch the real `~/.dsh` (10 existing test files gained journal isolation, plus 1 new channel-wiring test file, following the cacheRoot discipline). The implementation plan was closed over three independent review rounds; npm publish and dsh-m self-upgrade remain subject to separate user confirmation.
+
+### Performance in 0.9.78 — favorites stale checks go cache-only: zero-network favorites access + zero-increment commit guard (steelman C3)
+
+- **Problem (steelman report, card C3)**: the favorites stale verdict only needs a "is this id still in the catalog" membership boolean, yet it pierces the rich market interface's probe segment - every favorites visit/toggle (after the 800ms debounce merge) still fires N favorites × full queries including a per-hit npm/github latest **network fan-out** whose products are entirely discarded. On top of that, the unconditional `setData` after refreshViews' four-in-a-row responses (the post-toggle norm) evaporates the reference stability the data layer carefully maintains.
+- **Fix**: `lookupLive` now passes `probeMode:"cache-only"` (ADR-0013 first-phase mode: zero network, zero probing; existence = items membership, semantics unchanged); `fetchPage` gains a **zero-increment commit guard** - a new `marketResponseEquivalent` pure function (recursive JSON-value comparison, ZoneChips setGeom discipline) skips `setData` when content is equivalent (dataRef/loading semantics untouched). The report's optional "client-side stale TTL cache" is explicitly not done: after C1 materialization, cache-only queries are already memory-grade.
+- **Verification**: 1389 tests green (execution baseline 1382 + 7 added), typecheck clean; live-instance differential smoke across 5 cases (npm primary / self / community entry / nonexistent id): id sets and totals identical between cache-only and full (the sufficient condition for unchanged red-dot semantics), cache-only ~30ms vs cold full ~250ms (the zero-probe fingerprint); the implementation plan was closed over two independent review rounds (F1-1 plan-baseline correction).
+
 ### Fix in 0.9.76 — three presentation-layer retirements and sticky-chips jitter fixed at the root: "Chat" badge / "Version-independent" badge retired + scroll-anchoring self-excitation cut on the category row
 
 - **① "Chat" source badge retired (owner screenshot: every row flagged despite all-UI clicks)**: `meta.session` is the **pump-ownership marker** from the 0.7.0 final review (restore skip / replaceAll no-rollback / stripped on persist) — both the GUI `runOp` path and the chat-mirror path set it unconditionally, so it cannot distinguish origins, and the badge vanishes entirely after a page reload. Fix: opRowVm drops the session derivation; the row badge, its CSS and i18n keys retire; `meta.session` keeps its day job (zero data-model change); a future `meta.origin` would be the honest carrier for source attribution.

package/lib/cli.js

@@ -337,6 +337,7 @@ async function runCliDispatch(argv, deps, io) {
                     version,
                     forceIncompatible: flags.force === true,
                     namespace: 'cli',
+                    channel: 'cli',
                 });
             }
             catch (e) {
@@ -361,6 +362,7 @@ async function runCliDispatch(argv, deps, io) {
                 res = await d.upgradePlugin(target, cfg, {
                     forceIncompatible: flags.force === true,
                     namespace: 'cli',
+                    channel: 'cli',
                 });
             }
             catch (e) {
@@ -386,7 +388,7 @@ async function runCliDispatch(argv, deps, io) {
             if (onFlag === offFlag)
                 throw new Error('开关命令需要恰好一个 --on 或 --off');
             requireYes(flags, '切换插件运行状态');
-            const res = await d.togglePlugin(target, onFlag);
+            const res = await d.togglePlugin(target, onFlag, { channel: 'cli' });
             out(`✅ 已${onFlag ? '启用' : '停用'} ${res.pkg}（profile 文件已更新）`);
             if (res.applied === 'live')
                 out('本次进程内已即时生效；重启后状态保持。');
@@ -397,7 +399,7 @@ async function runCliDispatch(argv, deps, io) {
         case 'uninstall': {
             const target = needFlag(flags, 'pkg');
             requireYes(flags, '卸载');
-            const res = await d.uninstallPlugin(target, cfg, { namespace: 'cli' });
+            const res = await d.uninstallPlugin(target, cfg, { namespace: 'cli', channel: 'cli' });
             out(`✅ 已卸载 ${res.pkg}${res.liveDisabled ? '（运行中的界面已先下线）' : ''}`);
             if (res.leftovers.length)
                 out(`ℹ️  疑似残留数据（未删除）：${res.leftovers.join('、')}`);

package/lib/client.js

@@ -34,6 +34,7 @@ __export(market_state_exports, {
   countBeyondRows: () => countBeyondRows,
   createZoneState: () => createZoneState,
   marketNotice: () => marketNotice,
+  marketResponseEquivalent: () => marketResponseEquivalent,
   mergeLatestFields: () => mergeLatestFields,
   normalizeMarketQuery: () => normalizeMarketQuery,
   normalizeMarketResponse: () => normalizeMarketResponse,
@@ -235,6 +236,25 @@ function mergeLatestFields(nextItems, prevItems) {
   });
   return touched ? out : nextItems;
 }
+function marketResponseEquivalent(a, b) {
+  if (a === b) return true;
+  if (!a || !b || typeof a !== "object" || typeof b !== "object") return false;
+  if (Array.isArray(a) !== Array.isArray(b)) return false;
+  if (Array.isArray(a)) {
+    if (a.length !== b.length) return false;
+    for (let i = 0; i < a.length; i++) {
+      if (!marketResponseEquivalent(a[i], b[i])) return false;
+    }
+    return true;
+  }
+  const ka = Object.keys(a).filter((k) => a[k] !== void 0);
+  const kb = Object.keys(b).filter((k) => b[k] !== void 0);
+  if (ka.length !== kb.length) return false;
+  for (const k of ka) {
+    if (!Object.prototype.hasOwnProperty.call(b, k) || !marketResponseEquivalent(a[k], b[k])) return false;
+  }
+  return true;
+}
 function chipRows(offsets) {
   if (!Array.isArray(offsets)) return 0;
   let rows = 0;
@@ -1324,10 +1344,28 @@ __export(operations_exports, {
   createOperationsStore: () => createOperationsStore,
   createOpsPump: () => createOpsPump,
   drainRestored: () => drainRestored,
+  externalToRecord: () => externalToRecord,
   opAppliesTo: () => opAppliesTo,
   restoreRecords: () => restoreRecords,
   upgradeNotify: () => upgradeNotify
 });
+function externalToRecord(er) {
+  if (!er || typeof er !== "object") return null;
+  const meta = {};
+  if (typeof er.fromVersion === "string" && er.fromVersion !== "") meta.from = er.fromVersion;
+  if (typeof er.toVersion === "string" && er.toVersion !== "") meta.to = er.toVersion;
+  return {
+    id: typeof er.id === "string" && er.id !== "" ? er.id : `ext-${er.at ?? "unknown"}`,
+    kind: er.kind,
+    target: typeof er.target === "string" ? er.target : "",
+    status: er.result === "failed" ? "failed" : "done",
+    createdAt: Number.isFinite(er.at) ? er.at : 0,
+    updatedAt: Number.isFinite(er.at) ? er.at : 0,
+    channel: typeof er.channel === "string" && er.channel !== "" ? er.channel : "external",
+    ...er.reason ? { error: String(er.reason) } : {},
+    ...Object.keys(meta).length > 0 ? { meta } : {}
+  };
+}
 function upgradeNotify(activation) {
   if (activation === "client-only") return { needsRestart: false, suffixKey: "notify.upgraded.clientonly" };
   if (activation === "unknown") return { needsRestart: true, suffixKey: "notify.upgraded.activationUnknown" };
@@ -1365,6 +1403,7 @@ function createOperationsStore(storage) {
   const s = storageOf(storage);
   let records = safeParse(s.read());
   let persistDegraded = false;
+  let externalOverlay = [];
   const persist = () => {
     if (persistDegraded) return;
     try {
@@ -1378,6 +1417,28 @@ function createOperationsStore(storage) {
     list() {
       return records.map((r) => ({ ...r }));
     },
+    /** 外部记录 overlay（内存）：id 幂等合并（后到值覆盖），返回合并视图。 */
+    setExternal(next) {
+      const incoming = (Array.isArray(next) ? next : []).filter((r) => r && typeof r === "object" && typeof r.id === "string");
+      const byId = new Map(externalOverlay.map((r) => [r.id, r]));
+      for (const r of incoming) byId.set(r.id, { ...byId.get(r.id) || {}, ...r });
+      externalOverlay = [...byId.values()];
+      return this.listMerged();
+    },
+    /** 清空外部 overlay（「清除已结束」联动 external-operations-clear 成功后调用）。 */
+    clearExternal() {
+      externalOverlay = [];
+      return this.listMerged();
+    },
+    /** @returns {OperationRecord[]} 外部 overlay 当前快照（原始形态，浅拷贝）。 */
+    externalList() {
+      return externalOverlay.map((r) => ({ ...r }));
+    },
+    /** 本地 + 外部合并视图：外部映射为渲染记录后与本地按 createdAt 升序（groupOpsByDay 假定升序输入）。 */
+    listMerged() {
+      const external = externalOverlay.map(externalToRecord).filter(Boolean);
+      return [...records.map((r) => ({ ...r })), ...external].sort((a, b) => (a.createdAt ?? 0) - (b.createdAt ?? 0));
+    },
     get persistDegraded() {
       return persistDegraded;
     },
@@ -1596,6 +1657,8 @@ var init_operations = __esm({
 // src/client/operations-view.js
 var operations_view_exports = {};
 __export(operations_view_exports, {
+  canRemoveRow: () => canRemoveRow,
+  channelLabelKey: () => channelLabelKey,
   fmtOpClock: () => fmtOpClock,
   fmtOpDuration: () => fmtOpDuration,
   fmtOpFull: () => fmtOpFull,
@@ -1666,9 +1729,19 @@ function opRowVm(r) {
     durText: durMs === null ? "" : fmtOpDuration(durMs),
     dir: isToggle && typeof meta.on === "boolean" ? meta.on ? "on" : "off" : null,
     version,
-    target: typeof rec.target === "string" ? rec.target : ""
+    target: typeof rec.target === "string" ? rec.target : "",
+    // 外部记录渠道标记（0.9.79 ADR-0018）：非空 = 渠道徽标渲染 + 无单条 ✕ 出口
+    channel: typeof rec.channel === "string" && rec.channel !== "" ? rec.channel : null
   };
 }
+function canRemoveRow(r) {
+  if (!r || typeof r !== "object") return false;
+  if (r.channel) return false;
+  return r.status === "input" || r.status === "failed" || r.status === "superseded";
+}
+function channelLabelKey(channel) {
+  return `op.channel.${channel === "host-tool" || channel === "cli" ? channel : "external"}`;
+}
 var init_operations_view = __esm({
   "src/client/operations-view.js"() {
     "use strict";
@@ -1866,7 +1939,7 @@ var h = React.createElement;
 var { useState, useEffect, useLayoutEffect, useCallback, useMemo, useRef } = React;
 var PLUGIN_ID = "dsh-m";
 var API = "/dshm";
-var { DEFAULT_PAGE_SIZE: DEFAULT_PAGE_SIZE2, MARKET_PAGE_SIZES: MARKET_PAGE_SIZES2, pageItems: pageItems2, createZoneState: createZoneState2, normalizeMarketQuery: normalizeMarketQuery2, resetPageOnFilterChange: resetPageOnFilterChange2, normalizeMarketResponse: normalizeMarketResponse2, registryNotice: registryNotice2, zoneChips: zoneChips2, marketNotice: marketNotice2, searchSourceOf: searchSourceOf2, mergeLatestFields: mergeLatestFields2, chipRows: chipRows2, countBeyondRows: countBeyondRows2, clipTopOf: clipTopOf2, visibleRowTop: visibleRowTop2, autoExpandDecision: autoExpandDecision2 } = (init_market_state(), __toCommonJS(market_state_exports));
+var { DEFAULT_PAGE_SIZE: DEFAULT_PAGE_SIZE2, MARKET_PAGE_SIZES: MARKET_PAGE_SIZES2, pageItems: pageItems2, createZoneState: createZoneState2, normalizeMarketQuery: normalizeMarketQuery2, resetPageOnFilterChange: resetPageOnFilterChange2, normalizeMarketResponse: normalizeMarketResponse2, registryNotice: registryNotice2, zoneChips: zoneChips2, marketNotice: marketNotice2, searchSourceOf: searchSourceOf2, mergeLatestFields: mergeLatestFields2, chipRows: chipRows2, countBeyondRows: countBeyondRows2, clipTopOf: clipTopOf2, visibleRowTop: visibleRowTop2, autoExpandDecision: autoExpandDecision2, marketResponseEquivalent: marketResponseEquivalent2 } = (init_market_state(), __toCommonJS(market_state_exports));
 var { readMarketSnapshot: readMarketSnapshot2, writeMarketSnapshot: writeMarketSnapshot2, isDefaultFirstPageQuery: isDefaultFirstPageQuery2 } = (init_market_snapshot(), __toCommonJS(market_snapshot_exports));
 var { backdropCloseHandlers: backdropCloseHandlers2 } = (init_backdrop(), __toCommonJS(backdrop_exports));
 var { lbStep: lbStep2, lbNeighbors: lbNeighbors2, swipeDir: swipeDir2 } = (init_lightbox(), __toCommonJS(lightbox_exports));
@@ -1882,7 +1955,7 @@ var { RESTART_POLL_MS: RESTART_POLL_MS2, RESTART_DEADLINE_MS: RESTART_DEADLINE_M
 var { refreshAfterMutation: refreshAfterMutation2 } = (init_view_refresh(), __toCommonJS(view_refresh_exports));
 var { applyInstalledUpdates: applyInstalledUpdates2, installedUpdateStats: installedUpdateStats2 } = (init_installed_updates(), __toCommonJS(installed_updates_exports));
 var { createOperationsStore: createOperationsStore2, restoreRecords: restoreRecords2, createOpsPump: createOpsPump2, opAppliesTo: opAppliesTo2, TERMINAL_CLEARABLE: TERMINAL_CLEARABLE2, upgradeNotify: upgradeNotify2, REGISTRY_DEFAULT_TARGET: REGISTRY_DEFAULT_TARGET2 } = (init_operations(), __toCommonJS(operations_exports));
-var { groupOpsByDay: groupOpsByDay2, opRowVm: opRowVm2, opUpgradeMeta: opUpgradeMeta2 } = (init_operations_view(), __toCommonJS(operations_view_exports));
+var { groupOpsByDay: groupOpsByDay2, opRowVm: opRowVm2, opUpgradeMeta: opUpgradeMeta2, canRemoveRow: canRemoveRow2, channelLabelKey: channelLabelKey2 } = (init_operations_view(), __toCommonJS(operations_view_exports));
 var { createFavoritesStore: createFavoritesStore2, partitionStale: partitionStale2 } = (init_favorites(), __toCommonJS(favorites_exports));
 var { readSelfCheckCache: readSelfCheckCache2, writeSelfCheckCache: writeSelfCheckCache2, clearSelfCheckCache: clearSelfCheckCache2, deriveChipState: deriveChipState2 } = (init_self_check(), __toCommonJS(self_check_exports));
 var { shouldShowInstallCmd: shouldShowInstallCmd2 } = (init_install_cmd(), __toCommonJS(install_cmd_exports));
@@ -1931,6 +2004,14 @@ var ZH = {
   "op.kind.toggle": "\u5F00\u5173",
   "op.kind.community-toggle": "\u793E\u533A\u76EE\u5F55\u5F00\u5173",
   "op.kind.registry-url": "\u6E05\u5355\u6E90\u53D8\u66F4",
+  "op.kind.self-upgrade": "\u81EA\u5347\u7EA7",
+  "op.kind.desktop-install": "\u684C\u9762\u5B89\u88C5",
+  "op.kind.desktop-uninstall": "\u684C\u9762\u5378\u8F7D",
+  "op.kind.desktop-upgrade": "\u684C\u9762\u5347\u7EA7",
+  "op.kind.desktop-toggle": "\u684C\u9762\u5F00\u5173",
+  "op.channel.host-tool": "Agent \u5DE5\u5177",
+  "op.channel.cli": "\u547D\u4EE4\u884C",
+  "op.channel.external": "\u5916\u90E8",
   "op.state.on": "\u5F00",
   "op.state.off": "\u5173",
   "op.status.queued": "\u6392\u961F\u4E2D",
@@ -2222,6 +2303,14 @@ var EN = {
   "op.kind.toggle": "Toggle",
   "op.kind.community-toggle": "Community catalog toggle",
   "op.kind.registry-url": "Registry source change",
+  "op.kind.self-upgrade": "Self-upgrade",
+  "op.kind.desktop-install": "Desktop install",
+  "op.kind.desktop-uninstall": "Desktop uninstall",
+  "op.kind.desktop-upgrade": "Desktop upgrade",
+  "op.kind.desktop-toggle": "Desktop toggle",
+  "op.channel.host-tool": "Agent tool",
+  "op.channel.cli": "CLI",
+  "op.channel.external": "External",
   "op.state.on": "On",
   "op.state.off": "Off",
   "op.status.queued": "Queued",
@@ -2713,6 +2802,8 @@ var CSS = `
 .dsvm-opdir{font-size:11px;line-height:16px;padding:0 6px;border-radius:8px;border:1px solid currentColor}
 .dsvm-opdir.on{color:#15803d}
 .dsvm-opdir.off{color:var(--dsw-alias-label-secondary,#4b5563)}
+/* 0.9.79 \u5916\u90E8\u8BB0\u5F55\u6E20\u9053\u5FBD\u6807\uFF08Agent \u5DE5\u5177/\u547D\u4EE4\u884C/\u5916\u90E8\uFF09\uFF1A\u4E2D\u6027\u63CF\u8FB9\u80F6\u56CA\uFF0C\u4E0E\u65B9\u5411\u5FBD\u7AE0\u540C\u5F62\u4E0D\u540C\u8272 */
+.dsvm-opchan{font-size:11px;line-height:16px;padding:0 6px;border-radius:8px;border:1px solid currentColor;color:var(--dsw-alias-label-caption,#9ca3af)}
 .dsvm-opver{font-size:11px;color:var(--dsw-alias-label-secondary,#4b5563);font-variant-numeric:tabular-nums;overflow-wrap:anywhere}
 .dsvm-favbtn{appearance:none;border:0;background:transparent;color:var(--dsw-alias-label-caption,#9ca3af);font-size:15px;line-height:1;cursor:pointer;padding:0 2px;margin-left:auto}
 .dsvm-favbtn:hover{color:var(--dsw-alias-state-business-primary,#4d6bfe)}
@@ -2944,11 +3035,12 @@ function useMarketData(zone = "community") {
     return api("market", params, ac.signal).then((raw) => {
       if (genRef.current !== gen || ac.signal.aborted) return;
       const next = normalizeMarketResponse2(raw);
-      const prevItems = dataRef.current && Array.isArray(dataRef.current.items) ? dataRef.current.items : null;
+      const prevData = dataRef.current;
+      const prevItems = prevData && Array.isArray(prevData.items) ? prevData.items : null;
       const mergedItems = mergeLatestFields2(next.items, prevItems);
       const merged = mergedItems === next.items ? next : { ...next, items: mergedItems };
       dataRef.current = merged;
-      setData(merged);
+      if (!marketResponseEquivalent2(prevData, merged)) setData(merged);
       setLoading(false);
       if (probeMode === "cache-only" && next.latestComplete === false) {
         return fetchPage(nextQuery, force, true, "full");
@@ -4730,7 +4822,7 @@ function FavoriteZone({ favorites, onOpen }) {
       void (async () => {
         const lookupLive = async (fav) => {
           try {
-            const res = await api("market", { query: fav.id, source: "all", limit: 8 });
+            const res = await api("market", { query: fav.id, source: "all", limit: 8, probeMode: "cache-only" });
             const items = res && Array.isArray(res.items) ? res.items : [];
             return items.some((x) => x && x.id === fav.id);
           } catch {
@@ -4839,7 +4931,8 @@ function useScrollableContain(dep) {
 }
 function OperationsCard({ records, onClearFinished, onRemove }) {
   const active = records.filter((r) => r.status === "queued" || r.status === "running" || r.status === "input");
-  const finished = records.filter((r) => active.indexOf(r) < 0).slice(-50);
+  const finishedAll = records.filter((r) => active.indexOf(r) < 0);
+  const finished = finishedAll.slice(-50);
   const clearable = records.some((r) => TERMINAL_CLEARABLE2.has(r.status));
   const [scrollRef, scrollCls] = useScrollableContain(finished.length);
   const dayGroups = useMemo(() => groupOpsByDay2(finished), [records]);
@@ -4852,6 +4945,7 @@ function OperationsCard({ records, onClearFinished, onRemove }) {
       vm.clock ? h("span", { className: "dsvm-optime", title: vm.full }, vm.clock) : null,
       h("span", { className: "dsvm-opstatus" }, lookup("op.status." + r.status)),
       h("span", { className: "dsvm-opkind" }, lookup("op.kind." + r.kind)),
+      vm.channel ? h("span", { className: "dsvm-opchan", title: lookup(channelLabelKey2(vm.channel)) }, lookup(channelLabelKey2(vm.channel))) : null,
       vm.dir ? h("span", { className: `dsvm-opdir ${vm.dir}` }, lookup(vm.dir === "on" ? "op.state.on" : "op.state.off")) : null,
       h("span", { className: "dsvm-optarget", title: tip || void 0 }, vm.target),
       vm.version ? h("span", { className: "dsvm-opver", title: tip || void 0 }, vm.version) : null,
@@ -4859,8 +4953,10 @@ function OperationsCard({ records, onClearFinished, onRemove }) {
       r.status === "running" ? Spin() : null,
       r.error ? h("span", { className: "dsvm-opnote" }, r.error) : null,
       r.warning ? h("span", { className: "dsvm-opnote" }, r.warning) : null,
-      // 单条移除（终审·新伤2）：input/failed/superseded 行给出口（对话区来源的 input 不再永挂）
-      (r.status === "input" || r.status === "failed" || r.status === "superseded") && onRemove ? h("button", { className: "dshm-xbtn", title: lookup("op.remove"), onClick: () => onRemove(r.id) }, h(XIcon)) : null
+      // 单条移除（终审·新伤2 → 0.9.79 R3-1/R2-3）：出口判定下沉 canRemoveRow——
+      // 本地 input/failed/superseded 保留 ✕；外部记录（channel 非空）不给单条 ✕（防按 id 复活），
+      // 移除出口仅「清除已结束」。
+      canRemoveRow2(r) && onRemove ? h("button", { className: "dshm-xbtn", title: lookup("op.remove"), onClick: () => onRemove(r.id) }, h(XIcon)) : null
     );
   };
   return h(
@@ -4872,7 +4968,7 @@ function OperationsCard({ records, onClearFinished, onRemove }) {
     finished.length ? h(
       "div",
       { className: "dsvm-ops-caption", style: { marginTop: active.length ? "7px" : "0" } },
-      lookup("settings.ops.group.done.n", { n: finished.length })
+      lookup("settings.ops.group.done.n", { n: finishedAll.length })
     ) : null,
     finished.length ? h(
       "div",
@@ -5190,8 +5286,24 @@ function MarketPanel({ onClose }) {
   const markets = { community: marketCommunity, primary: marketPrimary };
   const installed = useAsync(() => api("installed", { probe: false }), []);
   const updates = useAsync(() => api("installedUpdates"), []);
-  const [opRecords, setOpRecords] = useState(() => opsStore.list().map((r) => ({ ...r })));
-  const syncOps = useCallback(() => setOpRecords(opsStore.list().map((r) => ({ ...r }))), []);
+  const [opRecords, setOpRecords] = useState(() => opsStore.listMerged().map((r) => ({ ...r })));
+  const syncOps = useCallback(() => setOpRecords(opsStore.listMerged().map((r) => ({ ...r }))), []);
+  const fetchExternalOps = useCallback(async () => {
+    try {
+      const r = await api("external-operations");
+      if (r && Array.isArray(r.records)) {
+        opsStore.setExternal(r.records);
+        syncOps();
+      }
+    } catch {
+    }
+  }, [syncOps]);
+  useEffect(() => {
+    void fetchExternalOps();
+  }, [fetchExternalOps]);
+  useEffect(() => {
+    if (tab === "settings") void fetchExternalOps();
+  }, [tab, fetchExternalOps]);
   const openOps = useCallback(() => {
     setTab("settings");
     if (typeof document !== "undefined") {
@@ -5206,9 +5318,13 @@ function MarketPanel({ onClose }) {
     (kind, target, exec, meta = {}, reuseId) => (
       // session:true = 活会话标记（终审·新伤1）：重挂载的 restore 跳过（泵仍拥有）；persist 时剥离。
       // 入队与 waiters/原始错误保真都在 createOpsPump（评审 P4：实现与测试同源）。
-      opsPump.enqueue({ ...reuseId ? { id: reuseId } : {}, kind, target, status: "queued", meta: { ...meta, session: true } }, exec)
+      // 0.9.79（R1-6）：操作终态后连带拉取一次外部记录——他终端（CLI/Agent 工具）的并发变更
+      // 尽快可见；拉取失败静默。
+      opsPump.enqueue({ ...reuseId ? { id: reuseId } : {}, kind, target, status: "queued", meta: { ...meta, session: true } }, exec).finally(() => {
+        void fetchExternalOps();
+      })
     ),
-    []
+    [fetchExternalOps]
   );
   const disposeOp = useCallback((id, note) => {
     opsStore.upsert({ id, status: "superseded", error: note });
@@ -5422,7 +5538,10 @@ function MarketPanel({ onClose }) {
           opsRecords: opRecords,
           onOpsClearFinished: () => {
             opsStore.clearFinished();
+            opsStore.clearExternal();
             syncOps();
+            void api("external-operations-clear").catch(() => {
+            });
           },
           onOpsRemove: (id) => {
             opsStore.remove(id);

package/lib/core/external-journal.js

@@ -0,0 +1,137 @@
+/**
+ * 机器本地的外部操作日志（0.9.79，ADR-0018）：外部通道（dshm CLI / Agent 工具）发起的
+ * Profile 变更以终态直落记录进入本文件——不入操作泵、永不 queued/running、不参与恢复重放、
+ * 宿主重启后原样保留；记录机器本地、不跨机同步；不含凭据与原始命令输出。
+ *
+ * - 存储文件：`$DSH_HOME/dshm/external-operations.json`（`DSHM_EXTERNAL_JOURNAL_FILE` 可整文件
+ *   覆盖供测试；与 dshm/cache 同基址、不带 profile 维度、不被缓存清理波及）。
+ * - append：mkdir recursive 先行（R2-4：全新机器上 `dshm/` 目录可能尚不存在，首条审计记录
+ *   恰是最有价值的一条，不能静默丢失）→ tmp+rename 原子替换（community.ts 同款惯例）→
+ *   滚动保留最新 200 条。channel='panel' 拒绝（防御性不变量：面板通道不走外部日志，
+ *   面板调用点应在钩子层被跳过）。错误一律上抛——吞错是上层钩子的职责（R1-1）。
+ * - list：按 `at` 降序（新→旧）；文件缺失 = 空列表；损坏文件不抛——改名
+ *   `<file>.corrupt-<ts>` 隔离留证后从空开始（best-effort，隔离失败同样不抛）。
+ * - clear：写空数组，文件保留（面板「清除已结束」联动出口）。
+ */
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { dshHome } from './env.js';
+const MAX_RECORDS = 200;
+const REASON_MAX = 300;
+/** 日志文件路径：env 整文件覆盖优先（测试隔离），缺省 $DSH_HOME/dshm/external-operations.json。 */
+export function journalFile() {
+    return process.env.DSHM_EXTERNAL_JOURNAL_FILE || join(dshHome(), 'dshm', 'external-operations.json');
+}
+/** 显式字段白名单重组（超集字段一律不落盘——「记录不含凭据」的形状级保证）；reason 截断 ≤300。 */
+function normalizeRecord(record) {
+    const reason = typeof record.reason === 'string' ? record.reason.slice(0, REASON_MAX) : undefined;
+    return {
+        id: record.id,
+        at: record.at,
+        channel: record.channel,
+        kind: record.kind,
+        target: record.target,
+        ...(record.fromVersion !== undefined ? { fromVersion: record.fromVersion } : {}),
+        ...(record.toVersion !== undefined ? { toVersion: record.toVersion } : {}),
+        result: record.result,
+        ...(reason !== undefined && reason !== '' ? { reason } : {}),
+    };
+}
+async function atomicWrite(path, text) {
+    const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
+    await writeFile(tmp, text);
+    await rename(tmp, path);
+}
+/** 读全量记录（插入序 = 时间升序）；损坏 → 隔离改名后按空处理；文件缺失 → []。 */
+async function readAll(file) {
+    let text;
+    try {
+        text = await readFile(file, 'utf8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return [];
+        throw err;
+    }
+    try {
+        const parsed = JSON.parse(text);
+        return Array.isArray(parsed) ? parsed.filter((r) => r && typeof r === 'object') : [];
+    }
+    catch {
+        // 损坏容错：整文件改名隔离留证（best-effort），从空开始；不抛——读路径永不炸
+        const quarantined = `${file}.corrupt-${Date.now()}`;
+        try {
+            await rename(file, quarantined);
+        }
+        catch {
+            try {
+                // 同毫秒重入等极小概率命名冲突：换一个带随机尾缀的名字再试一次；仍败则放弃隔离
+                const fallback = `${file}.corrupt-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+                await rename(file, fallback);
+            }
+            catch {
+                /* 放弃隔离：按空继续 */
+            }
+        }
+        return [];
+    }
+}
+/**
+ * 追加一条终态记录（成功与失败都记）。channel='panel' 抛错（防御性不变量）；
+ * 不可创建路径/磁盘错误等存储失败原样上抛，由上层钩子吞（R1-1：绝不反噬操作终态）。
+ */
+export async function appendExternalOperation(record) {
+    if (record.channel === 'panel') {
+        throw new Error('panel 通道不入外部操作日志（防御性不变量：面板调用点应在钩子层跳过 append）');
+    }
+    const file = journalFile();
+    await mkdir(dirname(file), { recursive: true });
+    const records = await readAll(file);
+    records.push(normalizeRecord(record));
+    const kept = records.slice(-MAX_RECORDS);
+    await atomicWrite(file, `${JSON.stringify(kept, null, 2)}\n`);
+}
+/** 全量外部记录，按 `at` 降序（新→旧）。 */
+export async function listExternalOperations() {
+    const records = await readAll(journalFile());
+    return records
+        .slice()
+        .sort((a, b) => (b.at ?? 0) - (a.at ?? 0))
+        .map((r) => ({ ...r }));
+}
+/** 清空外部记录：文件保留（空数组），面板「清除已结束」联动出口。 */
+export async function clearExternalOperations() {
+    const file = journalFile();
+    await mkdir(dirname(file), { recursive: true });
+    await atomicWrite(file, '[]\n');
+}
+/**
+ * 九个公共变更入口共用的终态直落钩子（0.9.79，ADR-0018）：
+ * - channel 缺省 'external'（审计上漏报更糟，未知调用方落兜底而非丢弃）；
+ * - channel='panel' 在钩子层**跳过**（面板通道零记录；append 侧的 panel 抛错仅为防御性不变量）；
+ * - append 任何失败被吞（至多 stderr 一行）——**绝不反噬操作终态与返回值**（R1-1）；
+ * - reason 截断 ≤300 字符（R1-8）。
+ * 调用时机 = 操作终态之后（成功与失败都记）。
+ */
+export async function journalExternalOperation(channel, record, result, deps = {}) {
+    const ch = channel ?? 'external';
+    if (ch === 'panel')
+        return;
+    try {
+        const reason = typeof deps.reason === 'string' ? deps.reason.slice(0, REASON_MAX) : undefined;
+        await (deps.appendExternalOperation ?? appendExternalOperation)({
+            id: `ext-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
+            at: Date.now(),
+            channel: ch,
+            kind: record.kind,
+            target: record.target,
+            ...(record.fromVersion !== undefined ? { fromVersion: record.fromVersion } : {}),
+            ...(record.toVersion !== undefined ? { toVersion: record.toVersion } : {}),
+            result,
+            ...(reason !== undefined && reason !== '' ? { reason } : {}),
+        });
+    }
+    catch (err) {
+        console.error(`[dsh-m] 外部操作记录落盘失败（不影响操作结果）: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}

package/lib/core/host-api.js

@@ -12,6 +12,7 @@ import { resolveDshVersion, readLauncherPackageVersion } from './dsh-version.js'
 import { runDoctor } from './doctor.js';
 import { listInstalledWithMeta, listMarket, installFromRegistry, selfUpgrade, uninstallPlugin, upgradePlugin, InstallGuardError, } from './market.js';
 import { runProfileTransaction, TransactionError } from './profile-transaction.js';
+import { listExternalOperations, clearExternalOperations } from './external-journal.js';
 import { readInstalledPluginReadme } from './installed.js';
 import { loadPrimaryScreenshots } from './primary-screenshots.js';
 import { isNewerVersion, npmLatest, npmPackumentReadme } from './versions.js';
@@ -231,6 +232,8 @@ export function createApiDispatcher(ctx) {
         desktopUninstall: ctx.deps?.desktopUninstall ?? desktopUninstall,
         desktopUpgrade: ctx.deps?.desktopUpgrade ?? desktopUpgradeFromRegistry,
         ensureService: ctx.deps?.ensureService,
+        listExternalOperations: ctx.deps?.listExternalOperations ?? listExternalOperations,
+        clearExternalOperations: ctx.deps?.clearExternalOperations ?? clearExternalOperations,
     };
     const cfg = () => ctx.controller.config;
     // 0.9.0：宿主信任检查委派（含 ping 与未知 method，fail-closed）；
@@ -284,6 +287,7 @@ export function createApiDispatcher(ctx) {
                             profile: profile.name,
                             profileDir: profile.dir,
                             signal,
+                            channel: 'panel', // 0.9.79：面板自升级零外部记录（漏标 = 落 external，违反面板零记录不变量）
                         }, { getService: d.getService, ensureService: d.ensureService });
                         if ('needsBuildApproval' in managed) {
                             // build-blocked（自升级罕见）：结构化透出，不冒充成功
@@ -300,7 +304,7 @@ export function createApiDispatcher(ctx) {
                         break;
                     }
                     // M2 Task 3：self-upgrade 收编 market.selfUpgrade（统一 mutation session + 守卫，直调事务旁路封死）
-                    const result = await d.selfUpgrade(ctx.pkg.name, ctx.pkg.version, cfg(), { signal });
+                    const result = await d.selfUpgrade(ctx.pkg.name, ctx.pkg.version, cfg(), { signal, channel: 'panel' });
                     payload = {
                         pkg: result.pkg,
                         version: result.version,
@@ -502,6 +506,7 @@ export function createApiDispatcher(ctx) {
                                 profile: profile.name,
                                 profileDir: profile.dir,
                                 signal,
+                                channel: 'panel',
                             }, { getService: d.getService, ensureService: d.ensureService })) };
                         break;
                     }
@@ -511,6 +516,7 @@ export function createApiDispatcher(ctx) {
                         forceIncompatible: boolArg(body.forceIncompatible),
                         namespace: 'host',
                         signal,
+                        channel: 'panel',
                     });
                     payload = { ...result };
                     break;
@@ -522,10 +528,10 @@ export function createApiDispatcher(ctx) {
                     assertWriteAllowed(profile, 'uninstall');
                     // 0.9.8：desktop → 官方管理器 removeBundle（dsh-market 同策略；此前结构化拒绝）
                     if (profile.kind !== 'web') {
-                        payload = { ...(await d.desktopUninstall(target, { getService: d.getService, ensureService: d.ensureService, profileDir: profile.dir })) };
+                        payload = { ...(await d.desktopUninstall(target, { getService: d.getService, ensureService: d.ensureService, profileDir: profile.dir, channel: 'panel' })) };
                         break;
                     }
-                    const result = await d.uninstallPlugin(target, cfg(), { namespace: 'host', signal });
+                    const result = await d.uninstallPlugin(target, cfg(), { namespace: 'host', signal, channel: 'panel' });
                     payload = { ...result };
                     break;
                 }
@@ -538,10 +544,10 @@ export function createApiDispatcher(ctx) {
                     // 0.9.0：desktop → 官方管理器委派（服务缺席结构化拒绝，禁 fallback 文件写）
                     if (profile.kind !== 'web') {
                         assertWriteAllowed(profile, 'set-enabled');
-                        payload = { ...(await d.desktopToggle(target, body.enabled, { getService: d.getService, profileDir: profile.dir })) };
+                        payload = { ...(await d.desktopToggle(target, body.enabled, { getService: d.getService, profileDir: profile.dir, channel: 'panel' })) };
                         break;
                     }
-                    const result = await d.toggle(target, body.enabled, { getService: d.getService });
+                    const result = await d.toggle(target, body.enabled, { getService: d.getService, channel: 'panel' });
                     payload = { ...result };
                     break;
                 }
@@ -558,6 +564,7 @@ export function createApiDispatcher(ctx) {
                                 profile: profile.name,
                                 profileDir: profile.dir,
                                 signal,
+                                channel: 'panel',
                             }, { getService: d.getService, ensureService: d.ensureService })) };
                         break;
                     }
@@ -565,10 +572,23 @@ export function createApiDispatcher(ctx) {
                         forceIncompatible: boolArg(body.forceIncompatible),
                         namespace: 'host',
                         signal,
+                        channel: 'panel',
                     });
                     payload = { ...result };
                     break;
                 }
+                case 'external-operations': {
+                    // 0.9.79 外部操作记录（ADR-0018）：面板「已结束」overlay 数据源；鉴权走方法分发前的
+                    // 既有宿主信任检查（零新增特例）
+                    const records = await d.listExternalOperations();
+                    payload = { records };
+                    break;
+                }
+                case 'external-operations-clear': {
+                    await d.clearExternalOperations();
+                    payload = {};
+                    break;
+                }
                 case 'restart': {
                     // 0.9.0：Desktop 不触发旧 helper（Electron 生命周期归官方；杀子进程=红线）
                     assertWriteAllowed(profile, 'restart');

package/lib/core/market.js

@@ -30,6 +30,7 @@ import { classifyUpgradeActivation } from './activation.js';
 import { HttpError } from './httpx.js';
 import { ensureLatestCacheSwept, invalidateLatestCache, latestCacheKey, latestItemId, peekLatestCache, readLatestCache, writeLatestCache } from './latest-cache.js';
 import { verifyInstalledAdditions } from './install-guard.js';
+import { journalExternalOperation } from './external-journal.js';
 import { fetchTextLimited } from './httpx.js';
 import { githubLatestTag as defaultGithubLatestTag, isNewerVersion, npmLatest as defaultNpmLatest, npmVersion, } from './versions.js';
 /** profile package.json 的 dsh.profile.bundles 数组（读不到 → []；Task 13）。 */
@@ -672,8 +673,17 @@ export async function resolveRegistryEntry(id, cfg = {}, opts = {}, deps) {
     throw new Error(`registry 中没有该条目: ${id}`);
 }
 export async function installFromRegistry(id, cfg = {}, opts = {}, deps) {
-    const entry = await resolveRegistryEntry(id, cfg, opts, deps);
-    return installEntry(entry, cfg, opts, deps);
+    // 0.9.79 外部操作直落（ADR-0018）：终态后挂钩，成功与失败都记；append 失败被钩子吞（R1-1）
+    try {
+        const entry = await resolveRegistryEntry(id, cfg, opts, deps);
+        const result = await installEntry(entry, cfg, opts, deps);
+        await journalExternalOperation(opts.channel, { kind: 'install', target: id, ...(result.version ? { toVersion: result.version } : {}) }, 'ok', { appendExternalOperation: deps?.appendExternalOperation });
+        return result;
+    }
+    catch (err) {
+        await journalExternalOperation(opts.channel, { kind: 'install', target: id }, 'failed', { reason: errText(err), appendExternalOperation: deps?.appendExternalOperation });
+        throw err;
+    }
 }
 // ---------- M2 Task 3：统一 mutation session + 装后守卫 + 补偿接线 ----------
 let sessionTail = Promise.resolve();
@@ -1196,7 +1206,23 @@ async function installEntryLocked(entry, cfg = {}, opts = {}, deps) {
 }
 /** 卸载：validate（严格读取）→ live-disable → 摘补丁 → pnpm remove → verify gone（DESIGN.md §3：删包不删数据）。 */
 export function uninstallPlugin(pkg, cfg = {}, opts = {}, deps = {}) {
-    return withMutationSession(() => uninstallPluginLocked(pkg, cfg, opts, deps));
+    // 0.9.79 外部操作直落（ADR-0018）：终态后挂钩，session 区间内保持单写者
+    return withMutationSession(async () => {
+        try {
+            const result = await uninstallPluginLocked(pkg, cfg, opts, deps);
+            await journalExternalOperation(opts.channel, { kind: 'uninstall', target: pkg }, 'ok', {
+                appendExternalOperation: deps.appendExternalOperation,
+            });
+            return result;
+        }
+        catch (err) {
+            await journalExternalOperation(opts.channel, { kind: 'uninstall', target: pkg }, 'failed', {
+                reason: errText(err),
+                appendExternalOperation: deps.appendExternalOperation,
+            });
+            throw err;
+        }
+    });
 }
 async function uninstallPluginLocked(pkg, _cfg = {}, opts = {}, deps = {}) {
     // 保护门（Task 12，grilling Q3）：dsh-m 自身与官方宿主命脉拒绝卸载（升级不受影响）
@@ -1221,7 +1247,26 @@ async function uninstallPluginLocked(pkg, _cfg = {}, opts = {}, deps = {}) {
 }
 /** 升级 = 按最新重新安装（npm 拉最新精确版；github 重新锁 HEAD）。 */
 export function upgradePlugin(pkg, cfg = {}, opts = {}, deps) {
-    return withMutationSession(() => upgradePluginLocked(pkg, cfg, opts, deps));
+    // 0.9.79 外部操作直落（ADR-0018）：终态后挂钩，session 区间内保持单写者
+    return withMutationSession(async () => {
+        try {
+            const result = await upgradePluginLocked(pkg, cfg, opts, deps);
+            await journalExternalOperation(opts.channel, {
+                kind: 'upgrade',
+                target: pkg,
+                ...(result.fromVersion ? { fromVersion: result.fromVersion } : {}),
+                ...(result.version ? { toVersion: result.version } : {}),
+            }, 'ok', { appendExternalOperation: deps?.appendExternalOperation });
+            return result;
+        }
+        catch (err) {
+            await journalExternalOperation(opts.channel, { kind: 'upgrade', target: pkg }, 'failed', {
+                reason: errText(err),
+                appendExternalOperation: deps?.appendExternalOperation,
+            });
+            throw err;
+        }
+    });
 }
 async function upgradePluginLocked(pkg, cfg = {}, opts = {}, deps) {
     const loaded = await (deps?.loadRegistry ?? defaultLoadRegistry)(cfg, { namespace: opts.namespace ?? 'host', profile: opts.profile });
@@ -1278,29 +1323,42 @@ async function upgradePluginLocked(pkg, cfg = {}, opts = {}, deps) {
  * （owner--name 等），主清单 miss 时按同一 id 查社区目录。社区清单未启用/不可用/加载
  * 异常/未命中 → undefined，由调用方统一报「registry 中没有该条目」。
  */
-/** 自升级（0.5.0 收编：host-api 直调事务的旁路封死）：npmLatest + integrity fail-closed + installEntryLocked（session/守卫经 installEntry）。 */
+/** 自升级（0.5.0 收编：host-api 直调事务的旁路封死）：npmLatest + integrity fail-closed；函数体直调事务（call-graph audit：不经 installEntry，无嵌套双记）。 */
 export async function selfUpgrade(pkgName, currentVersion, cfg = {}, opts = {}, deps) {
     return withMutationSession(async () => {
-        const timeoutMs = cfg.timeoutMs ?? 20_000;
-        const latest = await (deps?.npmLatest ?? defaultNpmLatest)(pkgName, timeoutMs, opts.signal);
-        if (!latest.integrity) {
-            throw new Error(`npm metadata 缺少 dist integrity：${pkgName}@${latest.version}，拒绝升级`);
+        try {
+            const timeoutMs = cfg.timeoutMs ?? 20_000;
+            const latest = await (deps?.npmLatest ?? defaultNpmLatest)(pkgName, timeoutMs, opts.signal);
+            if (!latest.integrity) {
+                throw new Error(`npm metadata 缺少 dist integrity：${pkgName}@${latest.version}，拒绝升级`);
+            }
+            const result = await runProfileTransaction({ kind: 'install-npm', pkg: pkgName, version: latest.version, integrity: latest.integrity, signal: opts.signal }, { ...(deps?.transaction ?? {}), warmPackument: deps?.transaction?.warmPackument ?? makeNpmWarmPackument(timeoutMs) });
+            if (!result.ok)
+                throw new TransactionError(result);
+            const payload = {
+                id: pkgName,
+                pkg: result.pkg ?? pkgName,
+                spec: result.spec ?? `${pkgName}@${latest.version}`,
+                version: result.version ?? latest.version,
+                buildApprovals: result.buildApprovals ?? [],
+                fallbackAllBuilds: result.fallbackAllBuilds === true,
+                ...(result.bundleWarning ? { bundleWarning: result.bundleWarning } : {}),
+                needsRestart: true,
+                output: result.output,
+                healActions: result.healActions,
+            };
+            await journalExternalOperation(opts.channel, {
+                kind: 'self-upgrade',
+                target: pkgName,
+                ...(currentVersion ? { fromVersion: currentVersion } : {}),
+                ...(payload.version ? { toVersion: payload.version } : {}),
+            }, 'ok', { appendExternalOperation: deps?.appendExternalOperation });
+            return payload;
+        }
+        catch (err) {
+            await journalExternalOperation(opts.channel, { kind: 'self-upgrade', target: pkgName, ...(currentVersion ? { fromVersion: currentVersion } : {}) }, 'failed', { reason: errText(err), appendExternalOperation: deps?.appendExternalOperation });
+            throw err;
         }
-        const result = await runProfileTransaction({ kind: 'install-npm', pkg: pkgName, version: latest.version, integrity: latest.integrity, signal: opts.signal }, { ...(deps?.transaction ?? {}), warmPackument: deps?.transaction?.warmPackument ?? makeNpmWarmPackument(timeoutMs) });
-        if (!result.ok)
-            throw new TransactionError(result);
-        return {
-            id: pkgName,
-            pkg: result.pkg ?? pkgName,
-            spec: result.spec ?? `${pkgName}@${latest.version}`,
-            version: result.version ?? latest.version,
-            buildApprovals: result.buildApprovals ?? [],
-            fallbackAllBuilds: result.fallbackAllBuilds === true,
-            ...(result.bundleWarning ? { bundleWarning: result.bundleWarning } : {}),
-            needsRestart: true,
-            output: result.output,
-            healActions: result.healActions,
-        };
     });
 }
 /** 疑似残留路径（存在才列出）：删包不删数据，只报告。 */

package/lib/core/profile-ops.js

@@ -33,6 +33,7 @@ import { classifyUpgradeActivation } from './activation.js';
 import { togglePlugin, ToggleError } from './toggle.js';
 import { describeReleaseAgeFailure, releaseAgePrecheck } from './release-age.js';
 import { governExcludeBlock, registerExclusion } from './exclude-governance.js';
+import { journalExternalOperation } from './external-journal.js';
 /** desktop 升级社区兜底的等待上限（对齐 market.ts DEFAULT_DEADLINE_MS 量级；仅本路径使用）。 */
 const DEFAULT_COMMUNITY_DEADLINE_MS = 60_000;
 // 0.9.19：等待期失败翻译移入 release-age.ts（describeReleaseAgeFailure）——全量违规解析 +
@@ -77,7 +78,27 @@ function changeOf(raw) {
  * 全程 within mutation session（与 web 五入口同一 FIFO）。
  */
 export async function desktopInstallFromRegistry(id, cfg = {}, opts = {}, deps = {}) {
-    return withMutationSession(() => desktopInstallLocked(id, cfg, opts, deps));
+    // 0.9.79 外部操作直落（ADR-0018）：自记（call-graph audit：内部走 resolveEntry + service.installBundle，
+    // 不经 market.ts 已插桩入口）；成功/失败/needsBuildApproval（结构化未遂）都记；append 失败被钩子吞
+    try {
+        const result = await withMutationSession(() => desktopInstallLocked(id, cfg, opts, deps));
+        if ('needsBuildApproval' in result) {
+            await journalExternalOperation(opts.channel, { kind: 'desktop-install', target: id }, 'failed', {
+                reason: result.message,
+                appendExternalOperation: deps.appendExternalOperation,
+            });
+            return result;
+        }
+        await journalExternalOperation(opts.channel, { kind: 'desktop-install', target: id, ...(result.version ? { toVersion: result.version } : {}) }, 'ok', { appendExternalOperation: deps.appendExternalOperation });
+        return result;
+    }
+    catch (err) {
+        await journalExternalOperation(opts.channel, { kind: 'desktop-install', target: id }, 'failed', {
+            reason: err instanceof Error ? err.message : String(err),
+            appendExternalOperation: deps.appendExternalOperation,
+        });
+        throw err;
+    }
 }
 async function desktopInstallLocked(id, cfg, opts, deps) {
     const service = await resolveManager(deps);
@@ -197,15 +218,27 @@ async function desktopInstallLocked(id, cfg, opts, deps) {
     };
 }
 /**
- * Desktop 开关：服务缺席 → 结构化拒绝（ToggleError/unaddressable，禁 fallback 文件写）；
- * 服务在用 → 既有 togglePlugin 委派路径（installed 校验按 profileDir，与 web 委派同代码）。
+ * Desktop 开关：服务缺席 → 结构化拒绝（ToggleError/unaddressable，禁 fallback 文件写；
+ * 该拒绝发生在透传前，由本入口自记 desktop-toggle failed——类型契约中该 kind 的唯一可达路径）；
+ * 服务在用 → 既有 togglePlugin 委派路径（installed 校验按 profileDir，与 web 委派同代码；
+ * channel/钩子透传，单笔事务只产生一条 toggle 记录，不双记——R1-2）。
  */
 export async function desktopToggle(pkg, enabled, deps = {}) {
     const service = await resolveManager(deps);
     if (!service) {
-        throw new ToggleError('unaddressable', '官方 pluginManager 服务不可用：desktop profile 的开关必须走官方管理器（dsh-m 不做文件级 fallback）；请在官方 Desktop 插件页操作');
+        const message = '官方 pluginManager 服务不可用：desktop profile 的开关必须走官方管理器（dsh-m 不做文件级 fallback）；请在官方 Desktop 插件页操作';
+        await journalExternalOperation(deps.channel, { kind: 'desktop-toggle', target: pkg }, 'failed', {
+            reason: message,
+            appendExternalOperation: deps.appendExternalOperation,
+        });
+        throw new ToggleError('unaddressable', message);
     }
-    return togglePlugin(pkg, enabled, { getService: () => service, profileDir: deps.profileDir });
+    return togglePlugin(pkg, enabled, {
+        getService: () => service,
+        profileDir: deps.profileDir,
+        channel: deps.channel,
+        appendExternalOperation: deps.appendExternalOperation,
+    });
 }
 /**
  * 管理器安装共享核心（0.9.8）：installBundle + ChangeResult 判定 + listBundles 复读。
@@ -363,40 +396,78 @@ async function runManagedInstall(service, ctx, deps = {}) {
 /**
  * Desktop 卸载（0.9.8，dsh-market 同策略）：removeBundle 委派 + ChangeResult 判定 +
  * listBundles 复读（可用时必须不见目标在装）。服务缺席 → 结构化拒绝，零 CLI、零文件级 fallback。
+ * 0.9.79：自记外部操作（call-graph audit：内部直接 service.removeBundle，不经 market.ts 插桩入口）。
  */
 export async function desktopUninstall(pkg, deps = {}) {
-    const service = await resolveManager(deps);
-    if (!service || typeof service.removeBundle !== 'function') {
-        throw new DesktopOpsError('no-manager', '官方 pluginManager 服务不可用（desktop profile 的卸载必须由官方管理器执行）；拒绝卸载（fail-closed）');
-    }
-    const raw = await service.removeBundle(pkg);
-    const change = changeOf(raw);
-    if (change.application === 'failed' || change.error) {
-        throw new DesktopOpsError('remove-failed', `官方管理器卸载失败（${pkg}；application=${change.application ?? 'failed'}${change.error?.code ? `、error=${change.error.code}` : ''}${change.error?.diagnostic ? `：${change.error.diagnostic}` : ''}）`);
-    }
-    if (typeof service.listBundles === 'function') {
-        const bundles = await service.listBundles();
-        const found = (bundles ?? []).find((b) => b && b.name === (change.bundle ?? pkg));
-        if (found && found.installed === true) {
-            throw new DesktopOpsError('verify-failed', `卸载复读失败（${pkg}）：官方结果为 ${change.application ?? 'unknown'} 但 listBundles 仍见目标在装——不冒充卸载成功`);
+    try {
+        const service = await resolveManager(deps);
+        if (!service || typeof service.removeBundle !== 'function') {
+            throw new DesktopOpsError('no-manager', '官方 pluginManager 服务不可用（desktop profile 的卸载必须由官方管理器执行）；拒绝卸载（fail-closed）');
+        }
+        const raw = await service.removeBundle(pkg);
+        const change = changeOf(raw);
+        if (change.application === 'failed' || change.error) {
+            throw new DesktopOpsError('remove-failed', `官方管理器卸载失败（${pkg}；application=${change.application ?? 'failed'}${change.error?.code ? `、error=${change.error.code}` : ''}${change.error?.diagnostic ? `：${change.error.diagnostic}` : ''}）`);
+        }
+        if (typeof service.listBundles === 'function') {
+            const bundles = await service.listBundles();
+            const found = (bundles ?? []).find((b) => b && b.name === (change.bundle ?? pkg));
+            if (found && found.installed === true) {
+                throw new DesktopOpsError('verify-failed', `卸载复读失败（${pkg}）：官方结果为 ${change.application ?? 'unknown'} 但 listBundles 仍见目标在装——不冒充卸载成功`);
+            }
         }
+        await journalExternalOperation(deps.channel, { kind: 'desktop-uninstall', target: pkg }, 'ok', {
+            appendExternalOperation: deps.appendExternalOperation,
+        });
+        return {
+            pkg,
+            liveDisabled: false,
+            needsRestart: change.application === 'restart-required',
+            leftovers: [],
+            via: 'desktop-manager',
+            output: `official pluginManager: application=${change.application ?? 'applied'}`,
+        };
+    }
+    catch (err) {
+        await journalExternalOperation(deps.channel, { kind: 'desktop-uninstall', target: pkg }, 'failed', {
+            reason: err instanceof Error ? err.message : String(err),
+            appendExternalOperation: deps.appendExternalOperation,
+        });
+        throw err;
     }
-    return {
-        pkg,
-        liveDisabled: false,
-        needsRestart: change.application === 'restart-required',
-        leftovers: [],
-        via: 'desktop-manager',
-        output: `official pluginManager: application=${change.application ?? 'applied'}`,
-    };
 }
 /**
  * Desktop 升级（0.9.8，dsh-market 同策略——本机 0.9.3→0.9.4/0.9.5 即此路径实证）：
  * 覆盖安装 = installBundle(latest 精确 spec)。收录匹配（主清单 → 社区目录）与
  * upgradePluginLocked 同语义；非 dsh-m 收录的插件结构化拒绝（官方插件页负责）。
+ * 0.9.79：自记外部操作（call-graph audit：内部走 loadRegistry/mergedOutcome + service.installBundle，
+ * 不经 market.ts 已插桩入口）；needsBuildApproval（结构化未遂）记 failed。
  */
 export async function desktopUpgradeFromRegistry(pkg, cfg = {}, opts = {}, deps = {}) {
-    return withMutationSession(() => desktopUpgradeLocked(pkg, cfg, opts, deps));
+    try {
+        const result = await withMutationSession(() => desktopUpgradeLocked(pkg, cfg, opts, deps));
+        if ('needsBuildApproval' in result) {
+            await journalExternalOperation(opts.channel, { kind: 'desktop-upgrade', target: pkg }, 'failed', {
+                reason: result.message,
+                appendExternalOperation: deps.appendExternalOperation,
+            });
+            return result;
+        }
+        await journalExternalOperation(opts.channel, {
+            kind: 'desktop-upgrade',
+            target: pkg,
+            ...(result.fromVersion ? { fromVersion: result.fromVersion } : {}),
+            ...(result.version ? { toVersion: result.version } : {}),
+        }, 'ok', { appendExternalOperation: deps.appendExternalOperation });
+        return result;
+    }
+    catch (err) {
+        await journalExternalOperation(opts.channel, { kind: 'desktop-upgrade', target: pkg }, 'failed', {
+            reason: err instanceof Error ? err.message : String(err),
+            appendExternalOperation: deps.appendExternalOperation,
+        });
+        throw err;
+    }
 }
 async function desktopUpgradeLocked(pkg, cfg, opts, deps) {
     const service = await resolveManager(deps);

package/lib/core/toggle.js

@@ -24,6 +24,7 @@ import { isSingleRowPlugin, planRowOverride } from './patch-yaml.js';
 import { PROTECTED_MODULES } from './enablement.js';
 import { withMutationSession } from './market.js';
 import { setLivePluginDisabled, loaderHost } from './live-plugin.js';
+import { journalExternalOperation } from './external-journal.js';
 import { webProfileDir } from './env.js';
 export class ToggleError extends Error {
     code;
@@ -55,7 +56,23 @@ async function readPatchText(io, path) {
 }
 export function togglePlugin(pkg, enabled, deps = {}) {
     // M2 Task 3：toggle 纳入统一 mutation session（本体单点获取；自身 file lock 在 session 内层）
-    return withMutationSession(() => togglePluginLocked(pkg, enabled, deps));
+    // 0.9.79 外部操作直落（ADR-0018）：终态后挂钩，成功与失败都记；append 失败被钩子吞（R1-1）
+    return withMutationSession(async () => {
+        try {
+            const result = await togglePluginLocked(pkg, enabled, deps);
+            await journalExternalOperation(deps.channel, { kind: 'toggle', target: pkg }, 'ok', {
+                appendExternalOperation: deps.appendExternalOperation,
+            });
+            return result;
+        }
+        catch (err) {
+            await journalExternalOperation(deps.channel, { kind: 'toggle', target: pkg }, 'failed', {
+                reason: err instanceof Error ? err.message : String(err),
+                appendExternalOperation: deps.appendExternalOperation,
+            });
+            throw err;
+        }
+    });
 }
 async function togglePluginLocked(pkg, enabled, deps = {}) {
     const key = String(pkg || '').trim();

package/lib/tools.js

@@ -257,10 +257,10 @@ export function registerTools(ctx, cfg, deps = {}, profile = resolveActiveProfil
             if (profile.kind !== 'web') {
                 assertWriteAllowed(profile, 'install');
                 // 0.9.8：补传服务解析 deps（此前漏传 → desktop 安装恒 no-manager，实机 2026-10-01）
-                return cloneJson(await m.desktopInstall(id, cfg, { version, forceIncompatible: force, namespace: 'host', profile: profile.name, profileDir: profile.dir }, { getService: getService, ensureService: ensureService }));
+                return cloneJson(await m.desktopInstall(id, cfg, { version, forceIncompatible: force, namespace: 'host', profile: profile.name, profileDir: profile.dir, channel: 'host-tool' }, { getService: getService, ensureService: ensureService }));
             }
             try {
-                return cloneJson(await m.installFromRegistry(id, cfg, { version, forceIncompatible: force, namespace: 'host' }));
+                return cloneJson(await m.installFromRegistry(id, cfg, { version, forceIncompatible: force, namespace: 'host', channel: 'host-tool' }));
             }
             catch (err) {
                 if (err instanceof InstallGuardError) {
@@ -303,9 +303,9 @@ export function registerTools(ctx, cfg, deps = {}, profile = resolveActiveProfil
             // 0.9.0：desktop → 官方管理器委派（服务缺席结构化拒绝）；web → 既有委派/降级
             if (profile.kind !== 'web') {
                 assertWriteAllowed(profile, 'set-enabled');
-                return cloneJson(await m.desktopToggle(target, args.enabled, { getService: getService, ensureService: ensureService, profileDir: profile.dir }));
+                return cloneJson(await m.desktopToggle(target, args.enabled, { getService: getService, ensureService: ensureService, profileDir: profile.dir, channel: 'host-tool' }));
             }
-            return cloneJson(await toggle(target, args.enabled, { getService: getService }));
+            return cloneJson(await toggle(target, args.enabled, { getService: getService, channel: 'host-tool' }));
         },
     }));
     ctx.tools.register(defineTool({
@@ -333,9 +333,9 @@ export function registerTools(ctx, cfg, deps = {}, profile = resolveActiveProfil
             assertWriteAllowed(profile, 'uninstall');
             // 0.9.8：desktop → 官方管理器 removeBundle（dsh-market 同策略；此前该工具在 desktop 走 web 事务必然错位）
             if (profile.kind !== 'web') {
-                return cloneJson(await m.desktopUninstall(target, { getService: getService, ensureService: ensureService, profileDir: profile.dir }));
+                return cloneJson(await m.desktopUninstall(target, { getService: getService, ensureService: ensureService, profileDir: profile.dir, channel: 'host-tool' }));
             }
-            return cloneJson(await m.uninstallPlugin(target, cfg, { namespace: 'host' }));
+            return cloneJson(await m.uninstallPlugin(target, cfg, { namespace: 'host', channel: 'host-tool' }));
         },
     }));
     ctx.tools.register(defineTool({
@@ -420,10 +420,10 @@ export function registerTools(ctx, cfg, deps = {}, profile = resolveActiveProfil
             assertWriteAllowed(profile, 'upgrade');
             // 0.9.8：desktop → 官方管理器覆盖安装（dsh-market 同策略；此前该工具在 desktop 走 web 事务必然错位）
             if (profile.kind !== 'web') {
-                return cloneJson(await m.desktopUpgrade(target, cfg, { forceIncompatible: force, namespace: 'host', profile: profile.name, profileDir: profile.dir }, { getService: getService, ensureService: ensureService }));
+                return cloneJson(await m.desktopUpgrade(target, cfg, { forceIncompatible: force, namespace: 'host', profile: profile.name, profileDir: profile.dir, channel: 'host-tool' }, { getService: getService, ensureService: ensureService }));
             }
             try {
-                return cloneJson(await m.upgradePlugin(target, cfg, { forceIncompatible: force, namespace: 'host' }));
+                return cloneJson(await m.upgradePlugin(target, cfg, { forceIncompatible: force, namespace: 'host', channel: 'host-tool' }));
             }
             catch (err) {
                 if (err instanceof InstallGuardError) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-m",
-  "version": "0.9.77",
+  "version": "0.9.79",
   "description": "可自定义收录清单的 DSH 插件市场：收录、安装、卸载、升级一站完成，附 agent 工具与 dshm CLI。",
   "license": "MIT",
   "type": "module",