dsh-plugin-shop 0.4.13 → 0.5.0

package/lib/index.js

@@ -1,11 +1,11 @@
 import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { loadOptionalPatches, readProfileManifest, resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
 import { lt, minVersion, valid } from "semver";
-import { closeSync, existsSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, writeFileSync } from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { spawn, spawnSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { basename, dirname, join } from "node:path";
-import { createHash, randomUUID } from "node:crypto";
 import { z } from "zod";
 import { dump } from "js-yaml";
 //#region src/own-version.ts
@@ -39,6 +39,7 @@ const entrySchema = z.object({
 	review: z.object({
 		reviewedVersion: z.string().optional(),
 		reviewedCommit: z.string().optional(),
+		reviewedSha256: z.string().optional(),
 		reviewer: z.string(),
 		reviewCommit: z.string(),
 		notes: z.string()
@@ -50,6 +51,7 @@ const entrySchema = z.object({
 			"ui",
 			"workflow",
 			"integration",
+			"theme",
 			"other"
 		]),
 		summary: z.object({
@@ -59,16 +61,43 @@ const entrySchema = z.object({
 		capabilities: z.array(z.string())
 	}).optional(),
 	source: z.enum(["npm", "github"]).default("npm"),
-	repo: z.string().optional()
+	repo: z.string().optional(),
+	subdir: z.string().regex(/^(?!.*(^|\/)\.\.?(\/|$))[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*$/).optional(),
+	added: z.string(),
+	tarball: z.object({
+		url: z.string(),
+		sha256: z.string()
+	}).optional()
 });
 const dataSchema = z.object({
 	schemaVersion: z.number(),
 	plugins: z.array(entrySchema),
 	denied: z.array(z.object({
 		name: z.string(),
-		detail: z.string()
+		detail: z.string(),
+		replacement: z.string().optional()
 	})).default([])
 });
+/** The tarball URL must be the entry's own GitHub release — path segments
+* `/<owner>/<repo>/releases/...` matching the entry's `repo` (case-
+* insensitive). A catalog row that names a trusted repo but installs an
+* archive from somewhere else is refused loudly, never installed
+* (dsh-market's release-binding rule, their sources.ts:16-49). */
+function validateEntryCoherence(entries) {
+	for (const entry of entries) {
+		if (entry.tarball === void 0) continue;
+		if (entry.source !== "github" || entry.repo === void 0) throw new Error(`catalog entry ${entry.name}: tarball requires a github entry with a repo`);
+		let parsed;
+		try {
+			parsed = new URL(entry.tarball.url);
+		} catch {
+			throw new Error(`catalog entry ${entry.name}: tarball url is unparseable`);
+		}
+		if (parsed.protocol !== "https:" || parsed.hostname !== "github.com") throw new Error(`catalog entry ${entry.name}: tarball url must be https on github.com`);
+		const segments = parsed.pathname.split("/").filter((s) => s !== "");
+		if (`${segments[0] ?? ""}/${segments[1] ?? ""}`.toLowerCase() !== entry.repo.toLowerCase() || segments[2] !== "releases") throw new Error(`catalog entry ${entry.name}: tarball url is not a release of ${entry.repo}`);
+	}
+}
 const pointerSchema = z.object({
 	schemaVersion: z.number(),
 	builtAt: z.string(),
@@ -82,7 +111,7 @@ const pointerSchema = z.object({
 		sha256: z.string()
 	}).optional()
 });
-const nodeFs = {
+const nodeFs$1 = {
 	exists: (path) => existsSync(path),
 	read: (path) => readFileSync(path, "utf8"),
 	write: (path, data) => {
@@ -126,7 +155,7 @@ function parseStarsText(text) {
 * included, degrades to no stars (spec §5).
 */
 async function loadCatalog(options) {
-	const { baseUrl, cacheDir, refresh = false, fetchImpl = fetch, now = () => /* @__PURE__ */ new Date(), fsImpl = nodeFs } = options;
+	const { baseUrl, cacheDir, refresh = false, fetchImpl = fetch, now = () => /* @__PURE__ */ new Date(), fsImpl = nodeFs$1 } = options;
 	const indexPath = join(cacheDir, "index.json");
 	const metaPath = join(cacheDir, META_FILE);
 	/** The timestamp freshness is measured from: the sidecar's fetch time when
@@ -141,30 +170,33 @@ async function loadCatalog(options) {
 		return Number.isNaN(built) ? null : built;
 	};
 	const readCached = () => {
+		let pointer;
+		let data;
 		try {
-			const pointer = pointerSchema.parse(JSON.parse(fsImpl.read(indexPath)));
-			if (pointer.schemaVersion > 3) throw new Error(`catalog schemaVersion ${pointer.schemaVersion} is newer than this build supports (3)`);
+			pointer = pointerSchema.parse(JSON.parse(fsImpl.read(indexPath)));
+			if (pointer.schemaVersion > 5) throw new Error(`catalog schemaVersion ${pointer.schemaVersion} is newer than this build supports (5)`);
 			const dataPath = join(cacheDir, basename(pointer.plugins.url));
 			const dataText = fsImpl.read(dataPath);
 			const actual = createHash("sha256").update(dataText).digest("hex");
 			if (actual !== pointer.plugins.sha256) throw new Error(`cached catalog data failed integrity check: expected ${pointer.plugins.sha256}, got ${actual}`);
-			const data = dataSchema.parse(JSON.parse(dataText));
-			if (data.schemaVersion > 3) throw new Error(`catalog schemaVersion ${data.schemaVersion} is newer than this build supports (3)`);
-			let stars = {};
-			if (pointer.stars !== void 0) try {
-				const starsText = fsImpl.read(join(cacheDir, basename(pointer.stars.url)));
-				if (createHash("sha256").update(starsText).digest("hex") === pointer.stars.sha256) stars = parseStarsText(starsText);
-			} catch {}
-			return {
-				schemaVersion: pointer.schemaVersion,
-				builtAt: pointer.builtAt,
-				entries: data.plugins,
-				denied: data.denied,
-				stars
-			};
+			data = dataSchema.parse(JSON.parse(dataText));
+			if (data.schemaVersion > 5) throw new Error(`catalog schemaVersion ${data.schemaVersion} is newer than this build supports (5)`);
 		} catch {
 			return null;
 		}
+		validateEntryCoherence(data.plugins);
+		let stars = {};
+		if (pointer.stars !== void 0) try {
+			const starsText = fsImpl.read(join(cacheDir, basename(pointer.stars.url)));
+			if (createHash("sha256").update(starsText).digest("hex") === pointer.stars.sha256) stars = parseStarsText(starsText);
+		} catch {}
+		return {
+			schemaVersion: pointer.schemaVersion,
+			builtAt: pointer.builtAt,
+			entries: data.plugins,
+			denied: data.denied,
+			stars
+		};
 	};
 	if (!refresh && fsImpl.exists(indexPath)) {
 		const cached = readCached();
@@ -190,7 +222,7 @@ async function loadCatalog(options) {
 		throw error;
 	}
 	const pointer = pointerSchema.parse(JSON.parse(pointerText));
-	if (pointer.schemaVersion > 3) throw new Error(`catalog schemaVersion ${pointer.schemaVersion} is newer than this build supports (3)`);
+	if (pointer.schemaVersion > 5) throw new Error(`catalog schemaVersion ${pointer.schemaVersion} is newer than this build supports (5)`);
 	const dataUrl = resolveDataUrl(baseUrl, pointer.plugins.url);
 	let dataText;
 	try {
@@ -208,7 +240,8 @@ async function loadCatalog(options) {
 	const actual = createHash("sha256").update(dataText).digest("hex");
 	if (actual !== pointer.plugins.sha256) throw new Error(`catalog data failed integrity check: expected ${pointer.plugins.sha256}, got ${actual}`);
 	const data = dataSchema.parse(JSON.parse(dataText));
-	if (data.schemaVersion > 3) throw new Error(`catalog schemaVersion ${data.schemaVersion} is newer than this build supports (3)`);
+	if (data.schemaVersion > 5) throw new Error(`catalog schemaVersion ${data.schemaVersion} is newer than this build supports (5)`);
+	validateEntryCoherence(data.plugins);
 	let stars = {};
 	if (pointer.stars !== void 0) try {
 		const starsResponse = await fetchImpl(resolveDataUrl(baseUrl, pointer.stars.url));
@@ -320,20 +353,30 @@ function confirmBundleRemoval(profile, home, expectedName) {
 * real-install test pins DSH_HOME to a temporary directory this way.
 * When `confirm` is given, a zero exit is checked against the profile
 * manifest before the command reports `done` (§7.2 step 6 and its uninstall
-* mirror). */
+* mirror). When `afterDone` is given, a zero exit that passes `confirm`
+* withholds the terminal `done` until the callback — typically the hot-mount
+* attempt — settles; its result sets `needsRestart` (default `true`) and
+* `restartReason`. The client stops polling at `done`, so the hot outcome
+* must settle before it. A throwing callback never fails the install — the
+* package IS installed; it reports `done` with the restart fallback. */
 function spawnPluginCli(options) {
-	const { profile, argv, dshBin, env, confirm, onStatus } = options;
+	const { profile, argv, dshBin, env, confirm, afterDone, onStatus } = options;
 	const target = argv[1];
 	if (target === void 0 || target.startsWith("-")) throw new Error(`dsh-plugin-shop: refusing to spawn with a flag-like operand: ${target ?? "(none)"}`);
 	const installId = randomUUID();
 	const log = [];
 	let logBytes = 0;
 	let state = "running";
+	let needsRestartOnDone = true;
+	let restartReason;
 	let detail;
 	const status = () => ({
 		state,
 		log: [...log],
-		...state === "done" ? { needsRestart: true } : {},
+		...state === "done" ? {
+			needsRestart: needsRestartOnDone,
+			...restartReason !== void 0 ? { restartReason } : {}
+		} : {},
 		...detail !== void 0 ? { detail } : {}
 	});
 	const append = (line) => {
@@ -375,17 +418,24 @@ function spawnPluginCli(options) {
 				onStatus?.(status());
 				resolve(status());
 			});
-			child.on("close", (exitCode) => {
+			child.on("close", async (exitCode) => {
 				if (state !== "running") return;
 				if (exitCode === 0) {
-					state = "done";
-					if (confirm !== void 0) {
-						const confirmDetail = confirm(env?.DSH_HOME);
-						if (confirmDetail !== null) {
-							state = "failed";
-							detail = confirmDetail;
+					const confirmDetail = confirm?.(env?.DSH_HOME);
+					if (confirmDetail != null) {
+						state = "failed";
+						detail = confirmDetail;
+					} else if (afterDone !== void 0) {
+						try {
+							const outcome = await afterDone(env?.DSH_HOME);
+							needsRestartOnDone = outcome?.needsRestart ?? true;
+							restartReason = outcome?.restartReason;
+						} catch {
+							needsRestartOnDone = true;
+							restartReason = "热挂载失败,重启后生效 / hot-mount failed — restart required";
 						}
-					}
+						state = "done";
+					} else state = "done";
 				} else {
 					state = "failed";
 					const lastLogLine = log[log.length - 1] ?? "";
@@ -400,16 +450,18 @@ function spawnPluginCli(options) {
 /**
 * Run one `dsh plugin --profile <profile> add <spec>` and track it.
 * When `expectedName` is given, a zero exit is confirmed against the profile
-* manifest (§7.2 step 6) before the install reports `done`.
+* manifest (§7.2 step 6) before the install reports `done`. When `afterDone`
+* is given, the terminal `done` waits for it to settle (§D hot mount).
 */
 function startInstall(options) {
-	const { profile, spec, dshBin = "dsh", env, expectedName, onStatus } = options;
+	const { profile, spec, dshBin = "dsh", env, expectedName, afterDone, onStatus } = options;
 	return spawnPluginCli({
 		profile,
 		argv: ["add", spec],
 		dshBin,
 		env,
 		confirm: expectedName !== void 0 ? (home) => confirmBundleActivation(profile, home, expectedName) : void 0,
+		afterDone,
 		onStatus
 	});
 }
@@ -417,20 +469,292 @@ function startInstall(options) {
 * Run one `dsh plugin --profile <profile> remove <name>` and track it.
 * When `expectedName` is given, a zero exit is confirmed against the profile
 * manifest — the bundle must actually have LEFT `dsh.profile.bundles` — before
-* the uninstall reports `done`.
+* the uninstall reports `done`. When `afterDone` is given, the terminal `done`
+* waits for it to settle (§D hot mount).
 */
 function startUninstall(options) {
-	const { profile, name, dshBin = "dsh", env, expectedName, onStatus } = options;
+	const { profile, name, dshBin = "dsh", env, expectedName, afterDone, onStatus } = options;
 	return spawnPluginCli({
 		profile,
 		argv: ["remove", name],
 		dshBin,
 		env,
 		confirm: expectedName !== void 0 ? (home) => confirmBundleRemoval(profile, home, expectedName) : void 0,
+		afterDone,
 		onStatus
 	});
 }
 //#endregion
+//#region src/host/hot.ts
+/**
+* Restart-free installs: mount a freshly installed plugin into the running
+* composition through a shop-owned Include subtree (design 2026-08-31
+* market-borrowings §4, mechanism ported from dsh-market's hot.ts).
+*
+* Durable state stays with the profile's `dsh.profile.bundles`, so the next
+* boot loads the plugin through the normal bundle layer. The subtree exists
+* only for this process: its input files live under `<profile>/.dsh-shop/`
+* and are wiped on every boot, so a crash can never leave a file that
+* collides with the bundle layer (inserting an id the bundle layer also
+* inserts is a hard boot failure). Rows are prefixed `mkt-` for the same
+* reason: within this session the hot entry must never share an id with a
+* boot-layer entry, including a disabled one left behind by an update swap.
+*
+* The Include subclass suppresses `write()` — the loader otherwise persists
+* tree changes back to the file it read (dsh-market hot.ts; the in-tree
+* precedent is dsh's agent-presets PresetTree).
+*
+* Deliberate non-port: dsh-market's client-only shim (`mountClientOnlyDeps`
+* and `shimNames`, which hot-mounted a package with no server-side entry by
+* inserting a shim loader entry) is omitted. Our catalog never lists a
+* package without `dsh.bundle`, so the shim branch is unreachable here
+* (YAGNI). `hotMount` still distinguishes "no patch file / not
+* hot-mountable" from "restart will fix it" through the bilingual `reason`.
+*/
+const nodeFs = {
+	read: (path) => readFileSync(path, "utf8"),
+	write: (path, data) => {
+		mkdirSync(dirname(path), { recursive: true });
+		writeFileSync(path, data);
+	},
+	list: (path) => readdirSync(path)
+};
+/** This session's mounts, keyed by package name — the same key `hotUnmount`
+* and the gateway's flows use. The subtree unwinds with the shop's own
+* fiber; the map exists so a name can be disposed on demand. */
+const hotHandles = /* @__PURE__ */ new Map();
+/** The shop's own namespace for ephemeral mount inputs. */
+const HOT_DIR = ".dsh-shop";
+/** `hot-<n>.yml` files: the only things `cleanHotDir` wipes and the only
+* files `hotMount` writes. */
+const HOT_FILE_RE = /^hot-(\d+)\.yml$/;
+/** Reasons, bilingual, distinguishing the P0-2 categories: a transient mount
+* failure ("restart will fix it") versus a package that structurally cannot
+* hot-mount. All tell the user to restart; the head names which category. */
+const NO_PATCH_REASON = "该插件没有可热挂载的补丁文件,重启后生效 / the plugin has no patch file to hot-mount — restart required";
+const NOT_SIMPLE_REASON = "该插件的补丁包含无法热挂载的配置,重启后生效 / the plugin's patch has config rows that cannot be hot-mounted — restart required";
+const HOST_CANNOT_HOT_MOUNT_REASON = "当前环境不支持热挂载,重启后生效 / this harness cannot hot-mount — restart required";
+const TIMEOUT_REASON = "热挂载超时,重启后生效 / hot-mount timed out — restart required";
+const MOUNT_FAILED_REASON = "热挂载失败,重启后生效 / hot-mount failed — restart required";
+const ID_LINE_RE = /^- id: (.+)$/;
+const NAME_LINE_RE = /^  name: (.+)$/;
+/**
+* Parse a bundle patch into the plain insert rows a hot tree can replicate.
+* Only `- id:` / `name:` pairs parse — a row with config, an expression
+* name, or a dangling id returns null, and the caller falls back to restart
+* activation. CRLF-aware: a patch authored with Windows line endings must
+* not read as "contains config rows" (the Windows-patch regression their
+* hot.ts documents). Pure: string in, rows out.
+*/
+function parseSimplePatch(patchText) {
+	const lines = patchText.split(/\r?\n/);
+	const rows = [];
+	for (let i = 0; i < lines.length; i++) {
+		const raw = lines[i] ?? "";
+		if (raw.trim() === "" || raw.trim().startsWith("#")) continue;
+		const idMatch = ID_LINE_RE.exec(raw);
+		if (idMatch === null) return null;
+		const id = idMatch[1];
+		if (id === void 0) return null;
+		let name;
+		while (i + 1 < lines.length) {
+			i++;
+			const next = lines[i] ?? "";
+			if (next === "" || next.trim().startsWith("#")) continue;
+			const nameMatch = NAME_LINE_RE.exec(next);
+			if (nameMatch === null) return null;
+			const value = nameMatch[1];
+			if (value === void 0) return null;
+			if (value.includes("!!js/expression")) return null;
+			name = value;
+			break;
+		}
+		if (name === void 0) return null;
+		rows.push({
+			id,
+			name
+		});
+	}
+	return rows.length > 0 ? rows : null;
+}
+/** Render the accepted rows with prefixed ids — the exact input file the
+* Include tree mounts. Only values the line scan accepted are emitted, and
+* the output is itself a simple patch (round-trips through
+* parseSimplePatch). */
+function renderRows(rows, prefix) {
+	return rows.map((row) => `- id: ${prefix}${row.id}\n  name: ${row.name}`).join("\n") + "\n";
+}
+/** The next free `hot-<n>` number: one past the highest existing file, or 1
+* when the directory does not exist yet (the write recreates it). */
+function nextHotNumber(fs, dir) {
+	let names;
+	try {
+		names = fs.list(dir);
+	} catch {
+		return 1;
+	}
+	let max = 0;
+	for (const name of names) {
+		const match = HOT_FILE_RE.exec(name);
+		if (match !== null && match[1] !== void 0) max = Math.max(max, Number(match[1]));
+	}
+	return max + 1;
+}
+/** Read the installed package's own `dsh` section to locate its bundle patch
+* (the Include input), or null when the package or the field is absent —
+* the "no patch file" rejection names this. */
+function readPkgDsh(fs, packageDir) {
+	try {
+		const patch = JSON.parse(fs.read(join(packageDir, "package.json"))).dsh?.bundle?.patch;
+		return typeof patch === "string" ? { patch } : null;
+	} catch {
+		return null;
+	}
+}
+/** Load the Include class through a computed dynamic import, or null when
+* the optional peer is missing (an older harness — every path then falls
+* back to restart activation). */
+async function loadHotTreeClass() {
+	const specifier = "@deepseek-ai/cordis-plugin-include";
+	try {
+		return (await import(specifier)).default;
+	} catch {
+		return null;
+	}
+}
+/** Wrap a tree class in a subclass that suppresses `write()` — the loader
+* otherwise persists tree changes back to the file it read. The hot file is
+* written once with the mkt- ids and must never be rewritten from live tree
+* state. */
+function suppressWrite(treeClass) {
+	const Base = treeClass;
+	return class HotTree extends Base {
+		write() {}
+	};
+}
+/**
+* Mount one installed package into the running composition through an
+* Include subtree: read its bundle patch, replicate the simple rows under
+* `mkt-` ids into `<profile>/.dsh-shop/hot-<n>.yml`, register the tree, and
+* race its activation against `timeoutMs`. Success returns `ok: true` with
+* no reason; any fallback returns `ok: false` with a bilingual reason
+* distinguishing "restart will fix it" (timeout, activation failure,
+* unavailable include) from "this package can never hot-mount" (no patch
+* file, or rows the hot tree cannot replicate). The plugin is installed in
+* the bundle layer either way, so a restart always activates it.
+*/
+async function hotMount(ctx, profileDir, packageName, deps = {}) {
+	const { fs = nodeFs, dir = join(profileDir, HOT_DIR), timeoutMs = Number(process.env.DSH_SHOP_HOT_MOUNT_TIMEOUT_MS) || 1e4, now = Date.now } = deps;
+	const packageDir = join(profileDir, "node_modules", packageName);
+	const dsh = readPkgDsh(fs, packageDir);
+	let patchText;
+	try {
+		patchText = fs.read(join(packageDir, dsh?.patch ?? "cordis.patch.yml"));
+	} catch {
+		ctx.logger?.warn(`hot-mount ${packageName}: no patch file to mount — restart will activate it`);
+		return {
+			ok: false,
+			reason: NO_PATCH_REASON
+		};
+	}
+	const rows = parseSimplePatch(patchText);
+	if (rows === null) {
+		ctx.logger?.warn(`hot-mount ${packageName}: patch has rows that cannot be hot-mounted — restart will activate it`);
+		return {
+			ok: false,
+			reason: NOT_SIMPLE_REASON
+		};
+	}
+	let treeClass = deps.hotTreeClass;
+	if (treeClass === void 0) treeClass = await loadHotTreeClass();
+	if (treeClass === null) {
+		ctx.logger?.warn(`hot-mount ${packageName}: the include plugin is unavailable in this harness — restart will activate it`);
+		return {
+			ok: false,
+			reason: HOST_CANNOT_HOT_MOUNT_REASON
+		};
+	}
+	const file = join(dir, `hot-${nextHotNumber(fs, dir)}.yml`);
+	fs.write(file, renderRows(rows, "mkt-"));
+	let handle;
+	try {
+		const HotTree = suppressWrite(treeClass);
+		handle = ctx.plugin(HotTree, { path: pathToFileURL(file).href });
+	} catch (error) {
+		ctx.logger?.warn(`hot-mount ${packageName}: mounting the include tree failed — restart will activate it (${String(error)})`);
+		return {
+			ok: false,
+			reason: MOUNT_FAILED_REASON
+		};
+	}
+	const previous = hotHandles.get(packageName);
+	if (previous !== void 0) {
+		try {
+			await previous.dispose();
+		} catch (error) {
+			ctx.logger?.warn(`hot-mount ${packageName}: the previous hot mount refused to dispose (${String(error)})`);
+		}
+		hotHandles.delete(packageName);
+	}
+	const outcome = await withTimeout(handle.await(), timeoutMs, now);
+	if (outcome === "settled") {
+		hotHandles.set(packageName, handle);
+		ctx.logger?.info(`hot-mounted ${packageName} (${file})`);
+		return {
+			ok: true,
+			reason: null
+		};
+	}
+	try {
+		await handle.dispose();
+	} catch (error) {
+		ctx.logger?.warn(`hot-mount ${packageName}: dispose after a failed mount also failed — a restart cleans up (${String(error)})`);
+	}
+	return {
+		ok: false,
+		reason: outcome === "timeout" ? TIMEOUT_REASON : MOUNT_FAILED_REASON
+	};
+}
+/** Race the fiber's activation against the deadline. The remaining time is
+* measured on the injectable clock so tests can drive the timeout
+* deterministically; the timer is cleared when the activation wins. */
+function withTimeout(activation, timeoutMs, now) {
+	const deadline = now() + timeoutMs;
+	let timer;
+	const timeout = new Promise((resolve) => {
+		timer = setTimeout(() => resolve("timeout"), Math.max(0, deadline - now()));
+	});
+	return Promise.race([activation.then(() => "settled", () => "failed"), timeout]).finally(() => {
+		if (timer !== void 0) clearTimeout(timer);
+	});
+}
+/**
+* Dispose a package's hot mount. Returns false (without touching anything)
+* when the name is not mounted; the handle leaves the map before the
+* dispose so a mount can never be disposed twice, and a throwing dispose
+* propagates — the plugin may still be live in this session.
+*/
+async function hotUnmount(packageName) {
+	const handle = hotHandles.get(packageName);
+	if (handle === void 0) return false;
+	hotHandles.delete(packageName);
+	await handle.dispose();
+	return true;
+}
+/** Wipe the session's mount inputs at host start: `hot-<n>.yml` files under
+* `<profile>/.dsh-shop/` only — anything else in the namespace directory is
+* left alone, and a missing directory is a no-op. */
+function cleanHotDir(profileDir) {
+	const dir = join(profileDir, HOT_DIR);
+	let names;
+	try {
+		names = readdirSync(dir);
+	} catch {
+		return;
+	}
+	for (const name of names) if (HOT_FILE_RE.test(name)) rmSync(join(dir, name), { force: true });
+}
+//#endregion
 //#region src/host/restart.ts
 /** Restart executor: hand the port to a new dsh instance, two-phase.
 *
@@ -500,6 +824,11 @@ async function fetchLatestVersion(fetchFn = fetch) {
 	}
 }
 //#endregion
+//#region src/host/supervisor.ts
+function detectSupervisor(env, proc) {
+	return (env.INVOCATION_ID !== void 0 || env.JOURNAL_STREAM !== void 0) && proc.ppid === 1 ? "systemd" : null;
+}
+//#endregion
 //#region src/host/repo-pins.ts
 /** Read the pins file; any irregularity degrades to an empty record. */
 function readRepoPins(fs, path) {
@@ -632,6 +961,50 @@ var __esDecorate = function(ctor, descriptorIn, decorators, contextIn, initializ
 	if (target) Object.defineProperty(target, contextIn.name, descriptor);
 	done = true;
 };
+/** How many bytes a release tarball may be at the integrity check. The
+* registry already refuses to publish a tarball over 32 MiB, so 64 MiB is
+* headroom, not a gate of its own. */
+const MAX_TARBALL_BYTES = 67108864;
+/**
+* Fetch a release tarball and verify its sha256 against the catalog record
+* (market borrowings §3.1). Returns a rejection detail, or null when the
+* bytes match. The read streams through the byte cap, so an oversized or
+* hostile body is refused without ever being buffered. Every failure — fetch
+* throw, non-2xx, unreadable body, over-cap, hash mismatch — carries the same
+* `tarball-integrity` code with a detail naming what happened, so the plugin
+* author can read the cause.
+*/
+async function verifyTarballSha256(fetchTarball, url, recordedSha256, maxBytes = MAX_TARBALL_BYTES) {
+	let response;
+	try {
+		response = await fetchTarball(url);
+	} catch (error) {
+		return `dsh-plugin-shop: the release tarball could not be fetched (network failure: ${error.message}); refusing to install`;
+	}
+	if (!response.ok) return `dsh-plugin-shop: the release tarball could not be fetched (HTTP ${response.status}); refusing to install`;
+	if (response.body === null) return "dsh-plugin-shop: the release tarball has no readable body; refusing to install";
+	const hash = createHash("sha256");
+	let bytes = 0;
+	const reader = response.body.getReader();
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			bytes += value.byteLength;
+			if (bytes > maxBytes) {
+				try {
+					await reader.cancel();
+				} catch {}
+				return `dsh-plugin-shop: the release tarball exceeds the size cap (${maxBytes} bytes); refusing to install`;
+			}
+			hash.update(value);
+		}
+	} catch (error) {
+		return `dsh-plugin-shop: the release tarball download failed (${error.message}); refusing to install`;
+	}
+	if (hash.digest("hex") !== recordedSha256) return "dsh-plugin-shop: the release tarball failed sha256 verification against the catalog record; refusing to install";
+	return null;
+}
 /** Remote-only service exposing the shop Remote methods of §7.3.
 *
 * @typert service shop */
@@ -771,6 +1144,8 @@ let ShopGateway = (() => {
 		profile;
 		profileDir;
 		inventory;
+		hot;
+		loaderEntriesInjected;
 		dshBin;
 		/** The argv `shop/restart` re-spawns: the real process argv minus node and
 		* the CLI script path, or a test-provided substitute. */
@@ -783,6 +1158,14 @@ let ShopGateway = (() => {
 		latestVersion;
 		hasGit;
 		pinFs;
+		allowRestart;
+		env;
+		/** The parent pid `detectSupervisor` inspects; production defaults to
+		* process.ppid (a systemd unit's main process has ppid 1). */
+		ppid;
+		/** The release-tarball fetch for the install-time integrity check; global
+		* fetch in production, a fixture response in tests. */
+		fetchTarball;
 		/** The install gate runs against the last loaded snapshot, never a fresh
 		* fetch per request (§7.2: the Host's cached snapshot is the truth). */
 		/** Finished install records retained, so a poll sees the true terminal
@@ -804,6 +1187,8 @@ let ShopGateway = (() => {
 			this.profile = options.profile ?? discoverProfile(fileURLToPath(import.meta.url), this.bootBaseDir()).name;
 			this.profileDir = options.profileDir;
 			this.inventory = options.inventory;
+			this.hot = options.hot;
+			this.loaderEntriesInjected = options.loaderEntries;
 			this.dshBin = options.dshBin ?? "dsh";
 			this.restartArgv = options.restartArgv ?? process.argv.slice(2);
 			this.exit = options.exit ?? ((code) => process.exit(code));
@@ -819,6 +1204,13 @@ let ShopGateway = (() => {
 					writeFileSync(path, data);
 				}
 			};
+			this.allowRestart = options.allowRestart;
+			this.env = options.env ?? process.env;
+			this.ppid = options.ppid ?? process.ppid;
+			this.fetchTarball = options.fetchTarball ?? ((url) => fetch(url));
+			try {
+				cleanHotDir(this.profileDirResolved());
+			} catch {}
 		}
 		/** The pins file lives in the shop's own cache, next to the catalog cache. */
 		pinsPath() {
@@ -849,10 +1241,46 @@ let ShopGateway = (() => {
 			if (inventory === void 0) throw new Error("dsh-plugin-shop: pluginInventory service is not mounted");
 			return inventory.list();
 		}
+		/** The Loader's boot-layer entries; a harness without the loader answers
+		* with an empty list (there is then nothing to live-disable). */
+		loaderEntries() {
+			if (this.loaderEntriesInjected !== void 0) return this.loaderEntriesInjected();
+			const loader = this.ctx.loader;
+			return loader === void 0 ? [] : [...loader.entries()];
+		}
+		/** Live-disable one boot-layer entry, retrying until its fiber is actually
+		* down. A disable can land while the entry's init is still in flight: the
+		* options flip but the finishing init brings the fiber up anyway, and a
+		* plain re-update no-ops on the empty diff (dsh-market themes.ts:74-93).
+		* For an update swap this sequencing is mandatory, not defensive: two live
+		* instances of a service-providing plugin would collide at provision. */
+		async liveDisable(name) {
+			let found = false;
+			for (const entry of this.loaderEntries()) {
+				if (entry.options.name !== name) continue;
+				for (let attempt = 0; attempt < 3; attempt++) {
+					try {
+						await entry.update({ disabled: true }, false, true);
+						found = true;
+					} catch {
+						break;
+					}
+					if (entry.fiber === void 0) break;
+					await new Promise((resolve) => setTimeout(resolve, 200));
+				}
+			}
+			return found;
+		}
 		/** Enable or disable one installed plugin, hot (§8): a disable writes the
 		* row to the user layer, an enable drops it again so the bundle default
-		* rules — the CLI's watchUserPatches applies either through HMR. */
+		* rules — the CLI's watchUserPatches applies either through HMR. The shop's
+		* own row and the framework's bundles are never toggleable: disabling the
+		* host chain would break HMR itself. */
 		setEnabled(args) {
+			if (args.name === "dsh-plugin-shop" || args.name.startsWith("@deepseek-ai/")) return {
+				ok: false,
+				detail: `dsh-plugin-shop: ${args.name} is part of the harness chain and cannot be toggled from the shop`
+			};
 			const entry = this.listInventory().find((entry) => entry.moduleName === args.name);
 			if (entry === void 0) return {
 				ok: false,
@@ -881,6 +1309,13 @@ let ShopGateway = (() => {
 				cacheDir
 			};
 		}
+		/** The explicit restart override. Only the row's `config:` sub-object is
+		* passed to a plugin — a top-level `allowRestart:` beside `name:` would be
+		* silently ignored by the loader (dsh-market README, #227). */
+		allowRestartConfigured() {
+			if (this.allowRestart !== void 0) return this.allowRestart;
+			return ((this.ctx.loader?.entries().find((entry) => entry.options.name === "dsh-plugin-shop"))?.options.config)?.allowRestart === true;
+		}
 		/** Browse the catalog (§7.3): cached snapshot, refreshed on demand. */
 		async catalog(args) {
 			const { catalogUrl, cacheDir } = this.rowConfig();
@@ -900,7 +1335,7 @@ let ShopGateway = (() => {
 			};
 		}
 		/**
-		* Install one cataloged version into the profile (§7.2). The four rejection
+		* Install one cataloged version into the profile (§7.2). The rejection
 		* paths run against this Host's snapshot before anything is spawned; only a
 		* passing request reaches the executor.
 		*/
@@ -926,7 +1361,15 @@ let ShopGateway = (() => {
 				detail: `dsh-plugin-shop: ${args.name} is not in the catalog`
 			};
 			let spec;
-			if (entry.source === "github") {
+			if (entry.source === "github" && entry.tarball !== void 0) {
+				const integrity = await verifyTarballSha256(this.fetchTarball, entry.tarball.url, entry.tarball.sha256);
+				if (integrity !== null) return {
+					ok: false,
+					code: "tarball-integrity",
+					detail: integrity
+				};
+				spec = entry.tarball.url;
+			} else if (entry.source === "github") {
 				if (entry.repo === void 0 || !/^[0-9a-f]{40}$/.test(args.version)) return {
 					ok: false,
 					code: "version-mismatch",
@@ -937,13 +1380,26 @@ let ShopGateway = (() => {
 					code: "git-missing",
 					detail: "dsh-plugin-shop: git is not on PATH, which github installs require; install git and retry"
 				};
-				spec = `github:${entry.repo}#${args.version}`;
+				spec = `github:${entry.repo}#${args.version}${entry.subdir !== void 0 ? `&path:${entry.subdir}` : ""}`;
 			} else spec = `${args.name}@${args.version}`;
+			const isUpdate = (readProfileManifest("dsh-plugin-shop", this.profileDirResolved()).dependencies ?? {})[args.name] !== void 0;
 			const running = startInstall({
 				profile: this.profile,
 				spec,
 				dshBin: this.dshBin,
-				expectedName: args.name
+				expectedName: args.name,
+				afterDone: async () => {
+					const hot = this.hot ?? {
+						mount: hotMount,
+						unmount: hotUnmount
+					};
+					if (isUpdate) await this.liveDisable(args.name);
+					const result = await hot.mount({ plugin: (plugin, config) => this.ctx.plugin(plugin, config) }, this.profileDirResolved(), args.name);
+					return result.ok ? { needsRestart: false } : {
+						needsRestart: true,
+						restartReason: result.reason ?? void 0
+					};
+				}
 			});
 			if (entry.source === "github") {
 				const pins = readRepoPins(this.pinFs, this.pinsPath());
@@ -1001,6 +1457,10 @@ let ShopGateway = (() => {
 			}
 			const dependencies = readProfileManifest("dsh-plugin-shop", this.profileDirResolved()).dependencies ?? {};
 			const pins = readRepoPins(this.pinFs, this.pinsPath());
+			let byName = /* @__PURE__ */ new Map();
+			try {
+				byName = new Map(this.listInventory().map((entry) => [entry.moduleName, entry.enabled]));
+			} catch {}
 			const installed = [];
 			for (const entry of this.lastSnapshot.entries) {
 				const spec = dependencies[entry.name];
@@ -1011,13 +1471,15 @@ let ShopGateway = (() => {
 						name: entry.name,
 						installed: pin ?? spec,
 						latest: entry.version,
-						outdated: pin !== void 0 && pin !== entry.version
+						outdated: pin !== void 0 && pin !== entry.version,
+						enabled: byName.get(entry.name) ?? true
 					});
 				} else installed.push({
 					name: entry.name,
 					installed: spec,
 					latest: entry.version,
-					outdated: this.isBehind(spec, entry.version)
+					outdated: this.isBehind(spec, entry.version),
+					enabled: byName.get(entry.name) ?? true
 				});
 			}
 			return installed;
@@ -1063,7 +1525,14 @@ let ShopGateway = (() => {
 				profile: this.profile,
 				name: args.name,
 				dshBin: this.dshBin,
-				expectedName: args.name
+				expectedName: args.name,
+				afterDone: async () => {
+					await (this.hot ?? {
+						mount: hotMount,
+						unmount: hotUnmount
+					}).unmount(args.name) || await this.liveDisable(args.name);
+					return { needsRestart: false };
+				}
 			});
 			const pins = readRepoPins(this.pinFs, this.pinsPath());
 			if (pins[args.name] !== void 0) {
@@ -1084,6 +1553,10 @@ let ShopGateway = (() => {
 		* response is out. The browser monitors the origin and refreshes when the
 		* new server answers. Refusals are issued before anything is torn down. */
 		async restart() {
+			if (detectSupervisor(this.env, { ppid: this.ppid }) === "systemd" && !this.allowRestartConfigured()) return {
+				ok: false,
+				detail: "dsh-plugin-shop: restart is disabled because this process is a systemd service — a restart would kill the takeover helper along with the unit, and the service would not come back. Set allowRestart: true in the shop row config to override."
+			};
 			const portIndex = this.restartArgv.indexOf("--port");
 			if (portIndex !== -1 && this.restartArgv[portIndex + 1] === "0") return {
 				ok: false,
@@ -1117,7 +1590,8 @@ let ShopGateway = (() => {
 			return {
 				installed,
 				latest,
-				outdated: latest !== null && lt(installed, latest)
+				outdated: latest !== null && lt(installed, latest),
+				restartSupported: detectSupervisor(this.env, { ppid: this.ppid }) === null || this.allowRestartConfigured()
 			};
 		}
 		/** Update the shop itself to a published version (§7.3): the explicit pin