dsh-plugin-shop 0.4.3 → 0.4.4

package/lib/client.js

@@ -4350,10 +4350,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			]).optional(),
 			"detail": union([_undefined(), string()]).optional()
 		});
-		const dsh_plugin_shop_shop_restart_result$schema = union([object({
-			"ok": literal(true),
-			"url": string()
-		}), object({
+		const dsh_plugin_shop_shop_restart_result$schema = union([object({ "ok": literal(true) }), object({
 			"ok": literal(false),
 			"detail": string()
 		})]);
@@ -4400,7 +4397,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 218,
+						"line": 225,
 						"column": 9
 					}
 				},
@@ -4418,7 +4415,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 293,
+						"line": 300,
 						"column": 9
 					}
 				},
@@ -4446,7 +4443,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 244,
+						"line": 251,
 						"column": 9
 					}
 				},
@@ -4473,7 +4470,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 282,
+						"line": 289,
 						"column": 3
 					}
 				},
@@ -4491,7 +4488,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 367,
+						"line": 373,
 						"column": 9
 					}
 				},
@@ -4518,7 +4515,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 187,
+						"line": 194,
 						"column": 3
 					}
 				},
@@ -4546,7 +4543,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 333,
+						"line": 340,
 						"column": 9
 					}
 				}
@@ -4637,6 +4634,11 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			"shop",
 			"marketplace"
 		];
+		/** Competing marketplaces whose names carry no store/market keyword and so
+		* escape the pattern rules below. Named explicitly rather than guessed:
+		* `dsh-plugin` is the npm package of github.com/dshplugin/dsh-plugin-hub —
+		* a community plugin marketplace for DeepSeek Harness. */
+		const SHOP_LIKE_NAMES = ["dsh-plugin"];
 		/**
 		* Whether a package name reads as a plugin shop (a marketplace for dsh
 		* plugins, e.g. `dsh-plugin-shop`, `dsh-store`, `pluginstore`). The shop
@@ -4649,6 +4651,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 		* it matches other people's package names, not ours.
 		*/
 		function isShopLike(name) {
+			if (SHOP_LIKE_NAMES.includes(name.toLowerCase())) return true;
 			const segments = name.toLowerCase().split(/[-_.]+/);
 			const hasPlugin = segments.includes("plugin");
 			if (segments.some((segment) => /plugin(store|market|mall|shop|marketplace)/.test(segment) || /(store|market|mall|shop|marketplace)plugin/.test(segment))) return true;
@@ -4763,7 +4766,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			restartTitle: "确认重启 dsh",
 			restartBody: "重启会断开当前页面与服务器的连接，正在进行的对话和任务会中断；浏览器会自动跳转到重启后的地址，稍等片刻即可继续使用。",
 			restartConfirm: "重启",
-			restarting: "正在重启，浏览器即将跳转…",
+			restarting: "正在重启，服务器就绪后页面会自动刷新…",
+			restartFailedNotice: "重启后服务器没有回来。请手动启动：dsh web（新进程的日志在商店缓存目录的 restart.log）",
 			restartTransportFailed: "重启请求未能送达。请稍后重试。",
 			enabledSwitch: "启用",
 			toggleFailed: "设置失败，请重试。",
@@ -4828,7 +4832,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			restartTitle: "Restart dsh?",
 			restartBody: "Restarting disconnects this page and interrupts any conversation or task in progress; the browser will jump to the restarted address automatically, so give it a few seconds.",
 			restartConfirm: "Restart",
-			restarting: "Restarting; the browser will jump in a moment…",
+			restarting: "Restarting; the page will refresh once the server is back…",
+			restartFailedNotice: "The server did not come back after the restart. Start it manually: dsh web (see restart.log in the shop cache directory)",
 			restartTransportFailed: "The restart request could not be delivered. Please retry.",
 			enabledSwitch: "Enable",
 			toggleFailed: "Failed to update. Please retry.",
@@ -5376,22 +5381,27 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 		/** The §8 restart flow (amendment 2026-08-27): after an install, update, or
 		* uninstall reports done, this panel offers a restart of dsh. The
 		* confirmation gate states the cost — the page disconnects and in-flight
-		* conversations/tasks are interrupted — and on confirm the restart RPC runs;
-		* the returned URL is where the browser jumps. A failed restart renders the
-		* host's published detail: the old server is still up, nothing was lost. */
+		* conversations/tasks are interrupted — and on confirm the restart RPC
+		* commits the two-phase handoff: the host exits, a helper re-runs dsh, and
+		* this panel polls the origin after a grace period, refreshing the page
+		* once the NEW server answers. A refused restart renders the host's
+		* published detail; a server that never comes back names the manual
+		* command. */
 		function RestartPanel({ t, restart }) {
 			const [gateOpen, setGateOpen] = (0, react.useState)(false);
 			const [state, setState] = (0, react.useState)({ kind: "idle" });
 			const onConfirm = async () => {
 				setGateOpen(false);
-				setState({ kind: "restarting" });
 				try {
 					const result = await restart();
-					if (result.ok) window.location.href = result.url;
-					else setState({
-						kind: "failed",
-						detail: result.detail
-					});
+					if (!result.ok) {
+						setState({
+							kind: "failed",
+							detail: result.detail
+						});
+						return;
+					}
+					setState({ kind: "restarting" });
 				} catch {
 					setState({
 						kind: "failed",
@@ -5399,6 +5409,25 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					});
 				}
 			};
+			(0, react.useEffect)(() => {
+				if (state.kind !== "restarting") return;
+				const started = Date.now();
+				const timer = setInterval(() => {
+					const elapsed = Date.now() - started;
+					if (elapsed < 3e3) return;
+					fetch(window.location.href, { cache: "no-store" }).then(() => {
+						window.location.reload();
+					}, () => {});
+					if (elapsed > 3e4) {
+						clearInterval(timer);
+						setState({
+							kind: "failed",
+							detail: t("restartFailedNotice")
+						});
+					}
+				}, INSTALL_POLL_MS);
+				return () => clearInterval(timer);
+			}, [state, t]);
 			if (state.kind === "restarting") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 				className: _dsh_plugin_shop_css_e3675a89_default.notice,
 				"data-shop-restarting": true,

package/lib/index.js

@@ -2,9 +2,9 @@ import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { loadOptionalPatches, readProfileManifest, resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
 import { lt, minVersion } from "semver";
 import { fileURLToPath } from "node:url";
-import { createHash, randomUUID } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
+import { createHash, randomUUID } from "node:crypto";
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, writeFileSync } from "node:fs";
 import { z } from "zod";
 import { spawn } from "node:child_process";
 import { dump } from "js-yaml";
@@ -419,82 +419,50 @@ function startUninstall(options) {
 }
 //#endregion
 //#region src/host/restart.ts
-/** Restart executor: re-spawn the Host's own command line and hand the
-* browser the new server's URL. The child is detached (its own process
-* group), so it survives both the parent's exit and the launching
-* terminal's. The parent exits only AFTER the child printed its
-* `dsh web: <url>` line — a restart that fails to come up leaves the old
-* process running untouched. */
-/** How long to wait for the child to print its URL before declaring the
-* restart failed and killing the child. dsh web prints the URL once the
-* Loader tree settles; 20s is generous on slow machines. */
-const RESTART_UP_TIMEOUT_MS = 2e4;
-/** Spawn the restarted server and wait for it to announce its URL.
+/** Restart executor: hand the port to a new dsh instance, two-phase.
 *
-* The child runs the same `dsh` with the same argv the current process was
-* launched with (`process.argv.slice(2)` — node and the CLI script path
-* stripped), so the profile, port and flags reproduce the user's launch
-* verbatim. `--port 0` therefore yields a NEW port, and the returned URL is
-* how the browser finds it.
+* The old process cannot wait for the new one: the new one must bind the
+* port the old one still holds, and two live processes cannot bind it at
+* once — the first implementation spawned the child and waited for its URL,
+* and the child crashed in boot with EADDRINUSE every time. The handoff is
+* therefore inverted: the parent commits and exits FIRST, and a detached
+* helper waits for the parent's pid to disappear before exec'ing the same
+* dsh command line. The browser monitors the origin and refreshes once the
+* new server answers; a boot that fails is diagnosed from the log file,
+* since nobody is attached to the child's pipes. */
+/** Spawn the two-phase handoff. The helper is a POSIX shell wrapper that
+* polls the parent pid until it is gone, then replaces itself with the dsh
+* command — `exec "$@"` keeps the argv verbatim, so no argument quoting is
+* involved. The child's stdout/stderr go to `logFile`, opened here in
+* append mode; opening throws on failure, and the caller treats a throw as
+* a refusal (the restart is never committed without its log).
 *
-* On success the caller exits the old process — but only after delivering
-* the RPC response carrying `url`, which is the caller's sequencing duty,
-* not this module's. On failure (child exits before announcing, spawn
-* error, or the timeout) the child is killed if still running and the old
-* process is untouched. */
+* The pid-poll has the usual tiny reuse race — if the parent's pid is
+* recycled within the 0.2s polling gap the helper waits for the unrelated
+* process too. Harmless: it only delays the boot. */
 function startRestart(options) {
-	const { dshBin, argv, env, timeoutMs = RESTART_UP_TIMEOUT_MS } = options;
-	const stderr = [];
-	return new Promise((resolve) => {
-		const child = spawn(dshBin, argv, {
+	const { dshBin, argv, parentPid, logFile, env } = options;
+	const logFd = openSync(logFile, "a");
+	try {
+		spawn("sh", [
+			"-c",
+			"while kill -0 \"$1\" 2>/dev/null; do sleep 0.2; done; shift; exec \"$@\"",
+			"sh",
+			String(parentPid),
+			dshBin,
+			...argv
+		], {
 			stdio: [
 				"ignore",
-				"pipe",
-				"pipe"
+				logFd,
+				logFd
 			],
 			env: env ?? process.env,
 			detached: true
-		});
-		child.unref();
-		const timeout = setTimeout(() => {
-			child.kill();
-			resolve({
-				ok: false,
-				detail: "the restarted server did not announce its URL in time"
-			});
-		}, timeoutMs);
-		child.stdout.on("data", (chunk) => {
-			for (const line of chunk.toString().split("\n")) {
-				if (line === "") continue;
-				const match = /dsh web: (http:\/\/\S+)/.exec(line);
-				if (match?.[1] !== void 0) {
-					clearTimeout(timeout);
-					resolve({
-						ok: true,
-						url: match[1]
-					});
-				}
-			}
-		});
-		child.stderr.on("data", (chunk) => {
-			for (const line of chunk.toString().split("\n")) if (line !== "") stderr.push(line);
-		});
-		child.on("error", (error) => {
-			const code = error.code;
-			clearTimeout(timeout);
-			resolve({
-				ok: false,
-				detail: code === "ENOENT" ? "dsh not found on PATH — restart could not be launched" : `restart spawn failed: ${error.message}`
-			});
-		});
-		child.on("close", () => {
-			clearTimeout(timeout);
-			resolve({
-				ok: false,
-				detail: `the restarted server exited during boot — ${stderr[stderr.length - 1] ?? "no output"}`
-			});
-		});
-	});
+		}).unref();
+	} finally {
+		closeSync(logFd);
+	}
 }
 //#endregion
 //#region src/host/profile.ts
@@ -731,6 +699,7 @@ let ShopGateway = (() => {
 		* production, a spy in tests. */
 		exit;
 		restartExitDelayMs;
+		restartParentPid;
 		/** The install gate runs against the last loaded snapshot, never a fresh
 		* fetch per request (§7.2: the Host's cached snapshot is the truth). */
 		/** Finished install records retained, so a poll sees the true terminal
@@ -756,6 +725,7 @@ let ShopGateway = (() => {
 			this.restartArgv = options.restartArgv ?? process.argv.slice(2);
 			this.exit = options.exit ?? ((code) => process.exit(code));
 			this.restartExitDelayMs = options.restartExitDelayMs ?? ShopGateway.RESTART_EXIT_DELAY_MS;
+			this.restartParentPid = options.restartParentPid ?? process.pid;
 		}
 		/** The boot's Loader root directory (the active profile's `cordis.yml`
 		* directory, carried on `ctx.baseUrl`), when present. A `link:` install
@@ -971,19 +941,33 @@ let ShopGateway = (() => {
 			};
 		}
 		/** Restart the dsh process the shop runs in (§8 amendment, 2026-08-27):
-		* re-spawn this process's own command line, return the new server's URL
-		* once it announces itself, and only then exit. A failed restart returns a
-		* typed failure and the old process keeps serving — the restart is
-		* all-or-nothing. The response must reach the browser before the exit, so
-		* the exit is delayed past the RPC round-trip. */
+		* commit a two-phase handoff — a detached helper waits for this pid to
+		* exit, then re-runs this process's own command line — and exit once the
+		* response is out. The browser monitors the origin and refreshes when the
+		* new server answers. Refusals are issued before anything is torn down. */
 		async restart() {
-			const outcome = await startRestart({
-				dshBin: this.dshBin,
-				argv: this.restartArgv,
-				env: process.env
-			});
-			if (outcome.ok) setTimeout(() => this.exit(0), this.restartExitDelayMs);
-			return outcome;
+			const portIndex = this.restartArgv.indexOf("--port");
+			if (portIndex !== -1 && this.restartArgv[portIndex + 1] === "0") return {
+				ok: false,
+				detail: "dsh-plugin-shop: restart is not supported when dsh was launched with --port 0; restart dsh manually"
+			};
+			try {
+				const { cacheDir } = this.rowConfig();
+				startRestart({
+					dshBin: this.dshBin,
+					argv: this.restartArgv,
+					parentPid: this.restartParentPid,
+					logFile: join(cacheDir, "restart.log"),
+					env: process.env
+				});
+			} catch (error) {
+				return {
+					ok: false,
+					detail: `dsh-plugin-shop: restart could not be started: ${error.message}`
+				};
+			}
+			setTimeout(() => this.exit(0), this.restartExitDelayMs);
+			return { ok: true };
 		}
 	};
 })();

package/lib/typert.host.js

@@ -69,7 +69,6 @@ const dsh_plugin_shop_shop_installStatus_result$schema = z.object({
 })
 const dsh_plugin_shop_shop_restart_result$schema = z.union([z.object({
   'ok': z.literal(true),
-  'url': z.string(),
 }), z.object({
   'ok': z.literal(false),
   'detail': z.string(),
@@ -123,7 +122,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopCatalogResult',
         schema: dsh_plugin_shop_shop_catalog_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":218,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":225,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installed',
@@ -138,7 +137,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop#shop/installed:result',
         schema: dsh_plugin_shop_shop_installed_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":293,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":300,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installStart',
@@ -164,7 +163,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopInstallResult',
         schema: dsh_plugin_shop_shop_installStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":244,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":251,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installStatus',
@@ -189,7 +188,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopInstallStatusResult',
         schema: dsh_plugin_shop_shop_installStatus_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":282,"column":3},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":289,"column":3},
     },
     {
       id: 'dsh-plugin-shop#shop/restart',
@@ -204,7 +203,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopRestartResult',
         schema: dsh_plugin_shop_shop_restart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":367,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":373,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/setEnabled',
@@ -229,7 +228,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopSetEnabledResult',
         schema: dsh_plugin_shop_shop_setEnabled_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":187,"column":3},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":194,"column":3},
     },
     {
       id: 'dsh-plugin-shop#shop/uninstallStart',
@@ -255,7 +254,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopUninstallResult',
         schema: dsh_plugin_shop_shop_uninstallStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":333,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":340,"column":9},
     },
   ],
   model: {
@@ -320,8 +319,8 @@ export const TYPERT = {
             "kind": "method",
             "name": "restart",
             "signature": "@Remote('restart') async restart(): Promise<ShopRestartResult>",
-            "summary": "Restart the dsh process the shop runs in (§8 amendment, 2026-08-27): re-spawn this process's own command line, return the new server's URL once it announces itself, and only then exit.",
-            "jsDoc": "/** Restart the dsh process the shop runs in (§8 amendment, 2026-08-27):\n * re-spawn this process's own command line, return the new server's URL\n * once it announces itself, and only then exit. A failed restart returns a\n * typed failure and the old process keeps serving — the restart is\n * all-or-nothing. The response must reach the browser before the exit, so\n * the exit is delayed past the RPC round-trip. */"
+            "summary": "Restart the dsh process the shop runs in (§8 amendment, 2026-08-27): commit a two-phase handoff — a detached helper waits for this pid to exit, then re-runs this process's own command line — and exit once the response is out.",
+            "jsDoc": "/** Restart the dsh process the shop runs in (§8 amendment, 2026-08-27):\n * commit a two-phase handoff — a detached helper waits for this pid to\n * exit, then re-runs this process's own command line — and exit once the\n * response is out. The browser monitors the origin and refreshes when the\n * new server answers. Refusals are issued before anything is torn down. */"
           }
         ],
         "types": [
@@ -359,7 +358,7 @@ export const TYPERT = {
           },
           {
             "name": "RestartOutcome",
-            "declaration": "export type RestartOutcome = { ok: true; url: string; } | { ok: false; detail: string; };"
+            "declaration": "export type RestartOutcome = { ok: true; } | { ok: false; detail: string; };"
           },
           {
             "name": "ShopCatalogResult",

package/lib/typert.remote-client.js

@@ -69,7 +69,6 @@ const dsh_plugin_shop_shop_installStatus_result$schema = z.object({
 })
 const dsh_plugin_shop_shop_restart_result$schema = z.union([z.object({
   'ok': z.literal(true),
-  'url': z.string(),
 }), z.object({
   'ok': z.literal(false),
   'detail': z.string(),
@@ -120,7 +119,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopCatalogResult',
         schema: dsh_plugin_shop_shop_catalog_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":218,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":225,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installed',
@@ -135,7 +134,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop#shop/installed:result',
         schema: dsh_plugin_shop_shop_installed_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":293,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":300,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installStart',
@@ -161,7 +160,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopInstallResult',
         schema: dsh_plugin_shop_shop_installStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":244,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":251,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installStatus',
@@ -186,7 +185,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopInstallStatusResult',
         schema: dsh_plugin_shop_shop_installStatus_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":282,"column":3},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":289,"column":3},
     },
     {
       id: 'dsh-plugin-shop#shop/restart',
@@ -201,7 +200,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopRestartResult',
         schema: dsh_plugin_shop_shop_restart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":367,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":373,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/setEnabled',
@@ -226,7 +225,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopSetEnabledResult',
         schema: dsh_plugin_shop_shop_setEnabled_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":187,"column":3},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":194,"column":3},
     },
     {
       id: 'dsh-plugin-shop#shop/uninstallStart',
@@ -252,7 +251,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopUninstallResult',
         schema: dsh_plugin_shop_shop_uninstallStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":333,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":340,"column":9},
     },
   ],
 }

package/lib/types/client/locales.d.ts

@@ -59,6 +59,7 @@ export declare const zh: {
     restartBody: string;
     restartConfirm: string;
     restarting: string;
+    restartFailedNotice: string;
     restartTransportFailed: string;
     enabledSwitch: string;
     toggleFailed: string;
@@ -126,6 +127,7 @@ export declare const en: {
     restartBody: string;
     restartConfirm: string;
     restarting: string;
+    restartFailedNotice: string;
     restartTransportFailed: string;
     enabledSwitch: string;
     toggleFailed: string;

package/lib/types/client/present.d.ts

@@ -58,6 +58,13 @@ export type InstallEvent = {
 };
 /** §7.2 once-per-second poll cadence, as a named constant. */
 export declare const INSTALL_POLL_MS = 1000;
+/** §8 restart handoff: the client polls the origin only after this grace
+ * period (the host's exit delay plus margin), so an origin that answers is
+ * the NEW server, never the dying old one. */
+export declare const RESTART_GRACE_MS = 3000;
+/** §8 restart handoff: how long the client waits for the new server to
+ * answer before reporting the manual restart command. */
+export declare const RESTART_WAIT_MS = 30000;
 /** How many shelf cards mount at a time. The shelf holds ~1900 entries; one
  * commit of the whole grid is ~28k DOM nodes, so the list renders in batches
  * behind a sentinel (§A1) and grows on scroll. 48 is ~3-4 rows. */

package/lib/types/host/index.d.ts

@@ -36,6 +36,10 @@ export interface ShopGatewayOptions {
     /** Test-only injection: the exit the restart calls after the response is
      * delivered. Production uses `process.exit`. */
     exit?: (code?: number) => void;
+    /** The pid the restart helper waits on before exec'ing the new dsh;
+     * defaults to this process. Tests point it at a dead pid so the fixture
+     * runs immediately instead of waiting for the vitest worker to exit. */
+    restartParentPid?: number;
     /** How long the gateway waits after a successful restart response before
      * exiting the old process; test-only shortening, production uses 2s. */
     restartExitDelayMs?: number;
@@ -111,6 +115,7 @@ export declare class ShopGateway extends TypertRemoteService {
      * production, a spy in tests. */
     private readonly exit;
     private readonly restartExitDelayMs;
+    private readonly restartParentPid;
     /** The install gate runs against the last loaded snapshot, never a fresh
      * fetch per request (§7.2: the Host's cached snapshot is the truth). */
     /** Finished install records retained, so a poll sees the true terminal
@@ -184,11 +189,10 @@ export declare class ShopGateway extends TypertRemoteService {
         name: string;
     }): Promise<ShopUninstallResult>;
     /** Restart the dsh process the shop runs in (§8 amendment, 2026-08-27):
-     * re-spawn this process's own command line, return the new server's URL
-     * once it announces itself, and only then exit. A failed restart returns a
-     * typed failure and the old process keeps serving — the restart is
-     * all-or-nothing. The response must reach the browser before the exit, so
-     * the exit is delayed past the RPC round-trip. */
+     * commit a two-phase handoff — a detached helper waits for this pid to
+     * exit, then re-runs this process's own command line — and exit once the
+     * response is out. The browser monitors the origin and refreshes when the
+     * new server answers. Refusals are issued before anything is torn down. */
     restart(): Promise<ShopRestartResult>;
 }
 export default ShopGateway;

package/lib/types/host/restart.d.ts

@@ -1,35 +1,38 @@
-/** Restart executor: re-spawn the Host's own command line and hand the
- * browser the new server's URL. The child is detached (its own process
- * group), so it survives both the parent's exit and the launching
- * terminal's. The parent exits only AFTER the child printed its
- * `dsh web: <url>` line — a restart that fails to come up leaves the old
- * process running untouched. */
-/** `shop/restart` outcome: the new server's URL, or a typed failure with an
- * author-readable detail. A failure means the OLD process is still serving —
- * the restart is all-or-nothing. */
+/** Restart executor: hand the port to a new dsh instance, two-phase.
+ *
+ * The old process cannot wait for the new one: the new one must bind the
+ * port the old one still holds, and two live processes cannot bind it at
+ * once — the first implementation spawned the child and waited for its URL,
+ * and the child crashed in boot with EADDRINUSE every time. The handoff is
+ * therefore inverted: the parent commits and exits FIRST, and a detached
+ * helper waits for the parent's pid to disappear before exec'ing the same
+ * dsh command line. The browser monitors the origin and refreshes once the
+ * new server answers; a boot that fails is diagnosed from the log file,
+ * since nobody is attached to the child's pipes. */
+/** `shop/restart` result: committed, or a typed refusal issued BEFORE
+ * anything is torn down. Once `ok` is returned the old process WILL exit —
+ * the client monitors the new server and reports a failed boot with the
+ * manual command. */
 export type RestartOutcome = {
     ok: true;
-    url: string;
 } | {
     ok: false;
     detail: string;
 };
-/** Spawn the restarted server and wait for it to announce its URL.
- *
- * The child runs the same `dsh` with the same argv the current process was
- * launched with (`process.argv.slice(2)` — node and the CLI script path
- * stripped), so the profile, port and flags reproduce the user's launch
- * verbatim. `--port 0` therefore yields a NEW port, and the returned URL is
- * how the browser finds it.
+/** Spawn the two-phase handoff. The helper is a POSIX shell wrapper that
+ * polls the parent pid until it is gone, then replaces itself with the dsh
+ * command — `exec "$@"` keeps the argv verbatim, so no argument quoting is
+ * involved. The child's stdout/stderr go to `logFile`, opened here in
+ * append mode; opening throws on failure, and the caller treats a throw as
+ * a refusal (the restart is never committed without its log).
  *
- * On success the caller exits the old process — but only after delivering
- * the RPC response carrying `url`, which is the caller's sequencing duty,
- * not this module's. On failure (child exits before announcing, spawn
- * error, or the timeout) the child is killed if still running and the old
- * process is untouched. */
+ * The pid-poll has the usual tiny reuse race — if the parent's pid is
+ * recycled within the 0.2s polling gap the helper waits for the unrelated
+ * process too. Harmless: it only delays the boot. */
 export declare function startRestart(options: {
     dshBin: string;
     argv: string[];
+    parentPid: number;
+    logFile: string;
     env?: NodeJS.ProcessEnv;
-    timeoutMs?: number;
-}): Promise<RestartOutcome>;
+}): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-shop",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "The DeepSeek Harness plugin shop: browse, install, enable, and update dsh plugins from a git-auditable catalog.",
   "repository": {
     "type": "git",