dsh-retrace 0.4.29 → 0.4.31

package/README.md

@@ -360,7 +360,7 @@ Read it before filing an issue.
 ### Upgrading
 
 ```bash
-dsh plugin --profile desktop add dsh-retrace@0.4.29
+dsh plugin --profile desktop add dsh-retrace@0.4.30
 # then restart DSH — plugins are not hot-reloaded
 ```
 
@@ -452,6 +452,21 @@ the **host surface**, not by semver alone.
 > arms the native gate; it relies on the running banner plus the dispose notice. The gate is
 > armed only where the host reports that the page really surfaces a native dialog
 > (`quitVeto: true`, i.e. browser pages).
+>
+> **Both criteria must hold** (2026-09-18, second round): the host side is only a
+> *non-objection*, and the client keeps a **veto** — if this page's `navigator.userAgent`
+> contains `Electron`, or the page URL contains `dsh-desktop-` (the external report's shell
+> puts its desktop marker in the query string), the gate is **never** armed. The host-side
+> criteria were widened to four request-level facts: the `x-dsh-desktop-renderer` capability
+> header, a request `User-Agent` containing `Electron`, or a request URL **or `Referer`**
+> containing `dsh-desktop-` — **any one** of them classifies the page as a desktop page. (Our own
+> polling URL carries no query string, so the page marker is in practice read from `Referer`,
+> which a same-origin `fetch` sends by default.) That covers the
+> hosts that expose no desktop evidence at all (the reporter's: a pure-Node harness plus an
+> Electron renderer, where all three older criteria were false, and the old code filed
+> "no evidence at all" as a browser page ⇒ the gate was still armed ⇒ the exit still hung).
+> If Desktop cannot quit, turning off "Exit confirmation (close guard)" in settings recovers
+> immediately (no restart).
 
 > Command surface: `retrace.runningState` (host RPC) + `GET|POST /api/plugins/retrace/runningState` (HTTP).
 

package/README.zh.md

@@ -336,6 +336,15 @@ dsh plugin --profile desktop add dsh-retrace@0.4.26
 > `requestQuit(0) → window.destroy() → app.exit(0)`）上，退出本来就不受影响。页面里分不出
 > 自己属于哪一类，因此**桌面端一律不武装**原生门，保护由运行中横幅 + dispose 提示承担；
 > 只有宿主回报"这个页面会弹原生确认框"（`quitVeto: true`，即普通浏览器页）时才武装。
+>
+> **两道判据都成立才武装**（2026-09-18 第二轮）：宿主那条只是"不反对"，客户端还有**一票否决** ——
+> 本页 `navigator.userAgent` 含 `Electron`，或页面 URL 含 `dsh-desktop-`（外部报告那套壳的查询参数
+> 前缀）⇒ 一律不武装。宿主侧的判据也补成四条请求级证据：能力头 `x-dsh-desktop-renderer` /
+> 请求 UA 含 Electron / 请求 URL **或 `Referer`** 含 `dsh-desktop-`（我们自己的轮询 URL 没有 query，
+> 所以页面标记实际是从 `Referer` 读到的），**任一成立**即判桌面页面。这样"壳什么桌面痕迹
+> 都不给"的宿主（报告人那台：纯 Node 跑 harness + Electron 渲染页，三条旧判据全不成立，
+> 旧实现把"完全没有证据"归成了浏览器页 ⇒ 照旧武装 ⇒ 仍退不掉）也不会再把退出卡住。
+> 桌面端退不掉时，把设置里的「退出确认（关闭守卫）」关掉即可立即恢复（不用重启）。
 
 **未来计划**——agent 业务层规划（运行时守护、中断治理、生态开放接口）**尚未发布**，此节是**计划**而非已上线能力。本 README 描述的是**开发线（main）**，可能领先于 npm 上最新发布版。