dsh-update-status 0.3.2 → 0.4.1

package/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 All notable changes to this project are documented here.
 
+## 0.4.1 — 2026-10-09
+
+Verified DeepSeek Harness: `0.2.1-alpha.1` (the current release, and the one this profile runs), also `0.2.0-rc.2`, `0.2.0-rc.1`, `0.1.7-rc.2`, `0.1.7-rc.1` and `0.1.7-alpha.2`. Release notes: [`docs/releases/v0.4.1.md`](docs/releases/v0.4.1.md).
+
+- **The service definition now uses one audited, cross-platform PATH instead of package-manager guesses.** `install` snapshots its current PATH by default, puts the selected Node directory first, removes empty/relative/duplicate entries, keeps missing absolute directories with warnings, and persists the final value, source, capture time, PATHEXT (Windows) and warnings in the receipt. `--path-source minimal` preserves a fixed deployment, while `--service-path` supplies an explicit value. macOS launchd, Linux systemd and the Windows wrapper consume that same persisted result; preflight uses it too, and later actions locate the receipt from DSH_HOME instead of recapturing a different terminal environment. `plan --dry-run` prints the exact PATH and warnings. Old receipts retain their historical behaviour (macOS/Linux minimal PATH; Windows Task Scheduler login environment). Tests cover POSIX/Windows separators, drive/UNC/Unicode/quoted paths, PATHEXT, systemd percent escaping, warnings, length limits, native command discovery and lifecycle persistence; only macOS receives native service verification in this environment.
+- **Receipt-backed lifecycle operations are safer and independent of the invoking terminal.** The receipt persists an absolute launchctl/systemctl/schtasks path; later actions never search the caller's PATH. Status, stop and uninstall need only DSH_HOME and continue to work after the old Node/DSH/workspace was moved or deleted, while activate still requires usable launch files. Stored artifact paths must exactly match paths re-derived from the fixed service identity, platform and current home; uninstall deletes only those canonical paths, so a modified receipt cannot nominate an arbitrary file. Unknown options are rejected, XML-illegal control characters and overlong PATH/PATHEXT values are refused, and legacy Windows status honestly reports its inherited logon environment.
+
+## 0.4.0 — 2026-10-09
+
+Verified DeepSeek Harness: `0.2.1-alpha.1` (the current release, and the one this profile runs), also `0.2.0-rc.2`, `0.2.0-rc.1`, `0.1.7-rc.2`, `0.1.7-rc.1` and `0.1.7-alpha.2`. Release notes: [`docs/releases/v0.4.0.md`](docs/releases/v0.4.0.md).
+
+- **A restart can no longer turn into an endless respawn loop.** On a real host, a second `dsh web` held port 3080 while the supervised launchd job respawned a process that died with `EADDRINUSE` every 3.3 seconds — 671 failed starts and 677 startup diagnostics in 37 minutes, with nothing in the panel to say so. Every generated definition now carries an explicit failure ceiling: the macOS Agent runs a staged wrapper that gives up after five starts that each die inside 30 seconds (and no longer relies on `KeepAlive`, which can only respawn forever), the systemd unit sets `StartLimitIntervalSec=300` / `StartLimitBurst=10`, and the Windows wrapper applies the same ceiling. Each one logs why it stopped and how to restart it. `tests/service/plan.spec.ts` locks all three in CI.
+- **Restart availability asks the platform who owns the process, and nothing else.** The environment marker is inherited by every descendant, so a process started by another tool looked supervised while launchd was busy respawning a job that could never bind the port. Identity now comes from launchd's tracked `pid` (macOS), the unit's `MainPID` (Linux) or the staged wrapper as this process's parent (Windows), cached for ten seconds; a Host constructed without the probe fails closed. The environment is used only for the explicit marker: the macOS job label does **not** survive into a DSH process behind the staged `/bin/sh` wrapper — the Host reads `XPC_SERVICE_NAME=0` there — so an environment identity check disables the button on the exact setup this plugin installs. Found on a real host after activating the wrapper definition, and fixed the same day.
+- **The panel reports a failing supervisor instead of promising recovery.** A restart storm — recent first-party boot stamps plus DSH's own `startup-*.log` diagnostics — becomes the distinct `supervisor-thrashing` reason in both languages.
+- **`activate` verifies what it started.** It waits for the service to report a running process and fails with the reason if it is already crash-looping, rather than printing success over a spinning job.
+- **An installed service definition can be upgraded.** `install` now authorises replacing a definition or wrapper through its own receipt instead of byte-equality with the new rendering, which would have refused every legitimate upgrade; a path with no receipt is still refused untouched.
+- **The wrapper forwards `SIGTERM`.** `stop`/`uninstall` can no longer leave an orphaned DSH holding the port, which is the very state that creates the loop.
+- **A disabled restart now says how to get the button back.** When supervision is lost (another restart tool's instance took the port, or the wrapper gave up after repeated rapid failures), the panel and the settings card list the refusal reason **and** the two copy-only commands that recover it — `lsof -nP -iTCP:<port> -sTCP:LISTEN` to find the process holding the port, then the service's own recover command (`launchctl kickstart -k …`, or `systemctl --user reset-failed … && … enable --now …`, or the Task Scheduler run). Both come from the installer's own receipt via the new `recoverCommand` in the service plan, so the port and the command are never guessed; when no receipt exists the panel instead points at the supervision setup section. Nothing is executed and no process is killed by the plugin.
+- **The settings section shows when the service started.** *Version & updates* now reports the current DSH Web process's start time, taken from the Host's own clock, so an operator can tell how long the supervised instance has been up — including right after a restart. An older Host that does not send it simply omits the line.
+
 ## 0.3.2 — 2026-10-07
 
 Verified DeepSeek Harness: `0.2.1-alpha.1` (the current release, and the one this profile runs), also `0.2.0-rc.2`, `0.2.0-rc.1`, `0.1.7-rc.2`, `0.1.7-rc.1` and `0.1.7-alpha.2`. Release notes: [`docs/releases/v0.3.2.md`](docs/releases/v0.3.2.md).

package/README.md

@@ -142,11 +142,12 @@ dsh plugin --profile web exec dsh-update-status-service install \
   --workspace "$PWD"
 
 # 3. Stop the terminal-started dsh web yourself, then activate the service.
-dsh plugin --profile web exec dsh-update-status-service activate \
-  --workspace "$PWD"
+dsh plugin --profile web exec dsh-update-status-service activate
 ```
 
-`activate` stops if the port is still busy instead of killing anything, so the DSH you are already using is never taken down by surprise. From then on, **Restart** lists what is running, asks for a second confirmation when something is, and lets DSH exit; the service starts it again and the page comes back on its own.
+`activate` stops if the port is still busy instead of killing anything, so the DSH you are already using is never taken down by surprise. It also checks afterwards that the service it just started really took over; a service that begins failing immediately is reported as a failure, not as a success. From then on, **Restart** lists what is running, asks for a second confirmation when something is, and lets DSH exit; the service starts it again and the page comes back on its own.
+
+Only one thing may start DSH Web on that port. If another tool starts its own `dsh web` — a second plugin's restart helper, a `nohup` script — that process holds the port while your service keeps failing to start. The plugin asks your operating system which process the service really owns, so **Restart** stays disabled in that state instead of promising a recovery that cannot happen, and it shows the two copy-only commands that fix it: one to find whoever holds the port, one to give the service back. The generated service also stops after a few failed starts in a row rather than respawning forever, and writes the reason to its log. Settings shows when the service started, so a fresh restart and a long-running instance are easy to tell apart. More detail: [user-service supervision](docs/service-supervision.md).
 
 | Platform | User-level owner | Starts | Restart works after setup | Notes |
 | --- | --- | --- | --- | --- |
@@ -154,9 +155,9 @@ dsh plugin --profile web exec dsh-update-status-service activate \
 | Linux | `systemd --user` | at user login | Implemented; verify on your host | `loginctl enable-linger` is optional for running after logout and is never enabled automatically. The unit template is render-tested but has not been run on a real Linux host yet. |
 | Windows | Task Scheduler + current-user wrapper | at user logon | Template supplied; verify on Windows before production use | No administrator account required. |
 
-The generated service files contain absolute paths and **no secrets** — never your API keys, npm tokens, cookies or proxy credentials. Native files, logs, status and removal: [user-service supervision](docs/service-supervision.md). To check Linux or Windows on your own machine: [platform acceptance](docs/platform-acceptance.md).
+The generated service files contain absolute paths, one audited `PATH`, and **no secrets** — never your API keys, npm tokens, cookies or proxy credentials. By default `install` saves the PATH of the terminal that ran it, so Homebrew, MacPorts, Nix, asdf, Conda, Cargo and hand-installed tools all follow the same rule; `--path-source minimal` keeps a fixed environment and `--service-path` supplies an explicit one. `plan --dry-run` shows the final value and every warning before anything is written. Native files, logs, status and removal: [user-service supervision](docs/service-supervision.md). To check Linux or Windows on your own machine: [platform acceptance](docs/platform-acceptance.md).
 
-A restart interrupts running work and does not save it. If DSH cannot list what is running, or was started by hand or by the desktop app, it refuses to restart at all — a web page cannot talk it into it.
+A restart interrupts running work and does not save it. If DSH cannot list what is running, cannot verify that your service owns the current process, or was started by hand or by the desktop app, it refuses to restart at all — a web page cannot talk it into it.
 
 ## LAN / non-loopback pages
 
@@ -171,13 +172,15 @@ If you want DSH's stock policy instead (a non-loopback page never persists setti
 
 ## Compatibility
 
-Current release: plugin **`0.3.2`** is verified against DeepSeek Harness **`0.2.1-alpha.1`** (the current release), **`0.2.0-rc.2`**, **`0.2.0-rc.1`**, **`0.1.7-rc.2`**, **`0.1.7-rc.1`** and **`0.1.7-alpha.2`**.
+Current release: plugin **`0.4.1`** is verified against DeepSeek Harness **`0.2.1-alpha.1`** (the current release), **`0.2.0-rc.2`**, **`0.2.0-rc.1`**, **`0.1.7-rc.2`**, **`0.1.7-rc.1`** and **`0.1.7-alpha.2`**.
 
 ### Which plugin version goes with which DeepSeek Harness version
 
 | Plugin | Verified DeepSeek Harness | On npm | What that version is |
 | --- | --- | --- | --- |
-| **`0.3.2`** | `0.2.1-alpha.1`, `0.2.0-rc.2`, `0.2.0-rc.1`, `0.1.7-rc.2`, `0.1.7-rc.1`, `0.1.7-alpha.2` | `latest` | Documentation only: the version table and every past release note are now plain language. Behaves exactly like `0.3.1` |
+| **`0.4.1`** | `0.2.1-alpha.1`, `0.2.0-rc.2`, `0.2.0-rc.1`, `0.1.7-rc.2`, `0.1.7-rc.1`, `0.1.7-alpha.2` | `latest` | The service saves the PATH used during installation, so tools installed by any package manager stay available after DSH is supervised |
+| **`0.4.0`** | `0.2.1-alpha.1`, `0.2.0-rc.2`, `0.2.0-rc.1`, `0.1.7-rc.2`, `0.1.7-rc.1`, `0.1.7-alpha.2` | published | Restart you can trust: the service stops instead of restarting forever, the button needs the service to really own the process, and a disabled button shows the two commands that recover it. Settings also shows when the service started |
+| **`0.3.2`** | `0.2.1-alpha.1`, `0.2.0-rc.2`, `0.2.0-rc.1`, `0.1.7-rc.2`, `0.1.7-rc.1`, `0.1.7-alpha.2` | published | Documentation only: the version table and every past release note are now plain language. Behaves exactly like `0.3.1` |
 | **`0.3.1`** | `0.2.1-alpha.1`, `0.2.0-rc.2`, `0.2.0-rc.1`, `0.1.7-rc.2`, `0.1.7-rc.1`, `0.1.7-alpha.2` | published | Small polish: the settings page explains Restart too, and a long job name can no longer push the buttons away. |
 | **`0.3.0`** | `0.2.1-alpha.1`, `0.2.0-rc.2`, `0.2.0-rc.1`, `0.1.7-rc.2`, `0.1.7-rc.1`, `0.1.7-alpha.2` | published | Adds **Restart** to the panel, plus the one-command service setup it needs. Without that service the button stays disabled and says why. |
 | **`0.2.1`** | `0.2.1-alpha.1`, `0.2.0-rc.2`, `0.2.0-rc.1`, `0.1.7-rc.2`, `0.1.7-rc.1`, `0.1.7-alpha.2` | published | Hiding the version chip brings DSH’s own name and fish mark back, instead of leaving the brand row blank. |

package/README.zh.md

@@ -141,11 +141,12 @@ dsh plugin --profile web exec dsh-update-status-service install \
   --workspace "$PWD"
 
 # 3. 由你自己在旧终端停止直启的 dsh web，再激活服务。
-dsh plugin --profile web exec dsh-update-status-service activate \
-  --workspace "$PWD"
+dsh plugin --profile web exec dsh-update-status-service activate
 ```
 
-`activate` 发现端口还被占着就停手，绝不去杀进程，所以你正在用的 DSH 不会被突然掐掉。这之后就交给**重启**按钮：它先列出正在跑的东西，有东西在跑时再问一次，然后才让 DSH 退出；服务把新的拉起来，页面自己回来。
+`activate` 发现端口还被占着就停手，绝不去杀进程，所以你正在用的 DSH 不会被突然掐掉；激活之后它还会确认服务真的接管了——一启动就不停失败的服务会被当作失败报出来，而不是假装成功。这之后就交给**重启**按钮：它先列出正在跑的东西，有东西在跑时再问一次，然后才让 DSH 退出；服务把新的拉起来，页面自己回来。
+
+同一个端口只允许一个启动者。如果别的工具自己拉起了 `dsh web`——另一个插件的重启助手、`nohup` 脚本——那个进程会占着端口，而你的服务会一直启动失败。插件会直接问操作系统「这个服务真正拥有的是哪个进程」，所以这种情况下**重启**按钮会保持禁用，而不是承诺一个做不到的恢复；同时它会给出两条只复制的命令：一条找出谁占着端口，一条把服务交还回去。生成的服务在连续几次启动失败后也会停下来（不再无限重拉），并把原因写进自己的日志。设置页会显示服务启动时间，刚重启和跑了很久的实例一眼就能分清。更多细节见[用户服务监督说明](docs/service-supervision.md)。
 
 | 平台 | 用户级拥有者 | 启动时机 | 接管后页面重启 | 说明 |
 | --- | --- | --- | --- | --- |
@@ -153,9 +154,9 @@ dsh plugin --profile web exec dsh-update-status-service activate \
 | Linux | `systemd --user` | 用户登录 | 已实现；请在你自己机器上验证 | 想在登出后继续运行，可自行开启 `loginctl enable-linger`（本插件不会替你开）。 |
 | Windows | 任务计划程序 + 当前用户 wrapper | 用户登录 | 已实现；请在你自己机器上验证 | 不需要管理员。 |
 
-生成的服务文件里只有绝对路径，**没有密钥**——不会带上你终端里的 API key、npm token、cookie 或代理凭据。原生文件、日志、状态与卸载见[用户服务监督说明](docs/service-supervision.md)；想在 Linux 或 Windows 上自己确认，见[跨平台验收步骤](docs/platform-acceptance.md)。
+生成的服务文件里只有绝对路径、一条可审计的 `PATH`，以及**没有密钥**——不会带上你终端里的 API key、npm token、cookie 或代理凭据。默认情况下，`install` 会保存执行安装命令的终端 PATH，因此 Homebrew、MacPorts、Nix、asdf、Conda、Cargo 和手工安装走的是同一套规则；`--path-source minimal` 保留固定环境，`--service-path` 则使用你明确给出的完整 PATH。`plan --dry-run` 会在写文件前列出最终值和全部提示。原生文件、日志、状态与卸载见[用户服务监督说明](docs/service-supervision.md)；想在 Linux 或 Windows 上自己确认，见[跨平台验收步骤](docs/platform-acceptance.md)。
 
-重启会中断正在跑的工作，且不会保存。如果 DSH 列不出正在跑什么，或者它本来就是终端直启、桌面应用托管的，它会直接拒绝重启——网页端说什么都没用。
+重启会中断正在跑的工作，且不会保存。如果 DSH 列不出正在跑什么、无法确认当前进程确实由你装的服务拥有，或者它本来就是终端直启、桌面应用托管的，它会直接拒绝重启——网页端说什么都没用。
 
 ## 局域网（非回环页面）访问
 
@@ -170,13 +171,15 @@ DSH 对来源不是 loopback（`localhost` / `127.0.0.1`）的页面会关闭 Ho
 
 ## 兼容性
 
-当前发布：插件 **`0.3.2`** 已针对 DeepSeek Harness **`0.2.1-alpha.1`**（当前发布版）、**`0.2.0-rc.2`**、**`0.2.0-rc.1`**、**`0.1.7-rc.2`**、**`0.1.7-rc.1`** 与 **`0.1.7-alpha.2`** 验证。
+当前发布：插件 **`0.4.1`** 已针对 DeepSeek Harness **`0.2.1-alpha.1`**（当前发布版）、**`0.2.0-rc.2`**、**`0.2.0-rc.1`**、**`0.1.7-rc.2`**、**`0.1.7-rc.1`** 与 **`0.1.7-alpha.2`** 验证。
 
 ### 插件版本与 DeepSeek Harness 版本的对应关系
 
 | 插件版本 | 已验证的 DeepSeek Harness | npm 发布状态 | 该版本是什么 |
 | --- | --- | --- | --- |
-| **`0.3.2`** | `0.2.1-alpha.1`、`0.2.0-rc.2`、`0.2.0-rc.1`、`0.1.7-rc.2`、`0.1.7-rc.1`、`0.1.7-alpha.2` | `latest` | 只改文档：版本对照表和历史发布说明都改成人话。功能与 `0.3.1` 完全一样 |
+| **`0.4.1`** | `0.2.1-alpha.1`、`0.2.0-rc.2`、`0.2.0-rc.1`、`0.1.7-rc.2`、`0.1.7-rc.1`、`0.1.7-alpha.2` | `latest` | 安装服务时保存当时使用的 PATH，不论工具由哪种包管理器安装，受托管后仍能找到 |
+| **`0.4.0`** | `0.2.1-alpha.1`、`0.2.0-rc.2`、`0.2.0-rc.1`、`0.1.7-rc.2`、`0.1.7-rc.1`、`0.1.7-alpha.2` | 已发布 | 重启变得靠得住：服务连续失败会停下而不是无限重启；按钮要求系统服务真正托管当前进程；禁用时会给出两条可复制的恢复命令。设置页还能看到服务启动时间 |
+| **`0.3.2`** | `0.2.1-alpha.1`、`0.2.0-rc.2`、`0.2.0-rc.1`、`0.1.7-rc.2`、`0.1.7-rc.1`、`0.1.7-alpha.2` | 已发布 | 只改文档：版本对照表和历史发布说明都改成人话。功能与 `0.3.1` 完全一样 |
 | **`0.3.1`** | `0.2.1-alpha.1`、`0.2.0-rc.2`、`0.2.0-rc.1`、`0.1.7-rc.2`、`0.1.7-rc.1`、`0.1.7-alpha.2` | 已发布 | 小补丁：设置页也说明了重启前提，长任务名不再把按钮挤走。 |
 | **`0.3.0`** | `0.2.1-alpha.1`、`0.2.0-rc.2`、`0.2.0-rc.1`、`0.1.7-rc.2`、`0.1.7-rc.1`、`0.1.7-alpha.2` | 已发布 | 面板新增**重启**，以及它需要的那条服务安装命令；没装服务时按钮保持禁用并说明原因。 |
 | **`0.2.1`** | `0.2.1-alpha.1`、`0.2.0-rc.2`、`0.2.0-rc.1`、`0.1.7-rc.2`、`0.1.7-rc.1`、`0.1.7-alpha.2` | 已发布 | 隐藏版本芯片后，品牌行恢复成 DSH 官方的名称与鱼标，而不是变成空白。 |

package/docs/platform-acceptance.md

@@ -10,7 +10,7 @@ Three steps, each one safe to stop at. If a step fails, the section below says w
 dsh plugin --profile web exec dsh-update-status-service plan --workspace "$PWD" --dry-run
 ```
 
-Check the printed Node path, DSH path and port against what you actually run. Override any of them with `--node`, `--dsh`, `--port`.
+Check the printed Node path, DSH path, absolute native-service command, port and **servicePath** against what you actually run. The default `current` value should contain the directories where your terminal finds the tools you need; warnings are visible before anything is written. Override launch facts with `--node`, `--dsh`, `--port`; use `--path-source minimal` for a fixed PATH, or `--service-path` (plus `--service-pathext` on Windows when needed) for an explicit one.
 
 ## 2. Write the service definition — still starts nothing
 
@@ -18,18 +18,20 @@ Check the printed Node path, DSH path and port against what you actually run. Ov
 dsh plugin --profile web exec dsh-update-status-service install --workspace "$PWD"
 ```
 
-It runs a boot precheck that does not bind the port. If that precheck fails, nothing is written.
+It runs a boot precheck that does not bind the port and uses the exact same PATH that will be written into the service. If that precheck fails, nothing is written. The receipt keeps that PATH, its source, capture time, PATHEXT on Windows and all warnings; later commands reuse it instead of reading the shell that happens to invoke them.
 
 ## 3. Stop your terminal's `dsh web` yourself, then
 
 ```sh
-dsh plugin --profile web exec dsh-update-status-service activate --workspace "$PWD"
+dsh plugin --profile web exec dsh-update-status-service activate
 ```
 
 It refuses to start while the port is still busy — that is deliberate, so the DSH you are using is never pushed aside.
 
 Then reopen the Web UI and check that **Restart** in the update panel is enabled (not greyed out). That is the whole acceptance test: restart availability means the running process was recognised as service-managed.
 
+One more check worth doing on a new machine: start something else on the same port (a second `dsh web`), then look at the panel. Restart should go grey within a few seconds, and the panel should show the two copy-only commands that recover it. Stop the extra instance and run the second command; the button comes back. That is the ceiling doing its job — the service tries a few times and then stops instead of filling the log forever.
+
 ## Where to look when something is off
 
 | Platform | Status command |
@@ -37,12 +39,12 @@ Then reopen the Web UI and check that **Restart** in the update panel is enabled
 | Linux | `systemctl --user status dsh-update-status-web.service` and `journalctl --user -u dsh-update-status-web.service -f` |
 | Windows | Task Scheduler → **DSH Update Status Web**, or `schtasks /Query /TN "DSH Update Status Web" /V /FO LIST` |
 
-If **Restart** stays greyed out after activating, the running process was not recognised as the service's process. For an issue report, include the `plan` output and the status output above.
+If **Restart** stays greyed out after activating, the running process was not recognised as the service's process — most often because something else (a restart script, another plugin's helper, a hand-started `dsh web`) is holding the port and the service is failing to start. Check `lsof -nP -iTCP:<port> -sTCP:LISTEN` and the service log before reporting. For an issue report, include the `plan` output and the status output above.
 
 ## Removing it again
 
 ```sh
-dsh plugin --profile web exec dsh-update-status-service uninstall --workspace "$PWD"
+dsh plugin --profile web exec dsh-update-status-service uninstall
 ```
 
 That removes only the definition this tool created. Logs are kept.

package/docs/service-supervision.md

@@ -25,15 +25,14 @@ This document describes the explicit, opt-in setup. The plugin never installs a
 5. Activate the staged service:
 
    ```sh
-   dsh plugin --profile web exec dsh-update-status-service activate \
-     --workspace "$PWD"
+   dsh plugin --profile web exec dsh-update-status-service activate
    ```
 
-   `activate` refuses to run while the requested port is occupied. It never kills an existing process; this prevents an `EADDRINUSE` crash loop.
+   `activate` refuses to run while the requested port is occupied, and it never kills an existing process. After starting the service it also verifies that the service really owns a running process: a service that begins crash-looping makes `activate` fail with that reason instead of reporting success.
 
 6. Reopen the normal Web URL. The update panel should report a restart-capable supervised process. Perform the first real page restart yourself while present, then confirm that the page reconnects.
 
-Use `status`, `stop`, and `uninstall` with the same `--workspace` argument for later maintenance. `uninstall` preserves logs.
+After `install`, the receipt under `DSH_HOME` is the source of truth. `activate`, `status`, `stop`, and `uninstall` need no workspace/profile/PATH arguments; use only `--dsh-home` when the receipt is outside the default `~/.dsh`. Unknown options are rejected instead of silently falling back to another receipt. The receipt also stores an absolute launchctl/systemctl/schtasks path, so these actions do not depend on the shell that invokes them. Status, stop and uninstall remain available even if the old Node/DSH path or workspace no longer exists; activate still checks all launch files before it starts anything. `uninstall` preserves logs and re-derives every deletion path from the validated fixed service identity, platform and current home — mutable receipt paths are never trusted.
 
 > `dsh plugin --profile web exec` is pnpm's profile-local executable runner. Do not assume `dsh-update-status-service` is globally installed.
 
@@ -45,9 +44,12 @@ The staged definition contains only explicit, non-secret launch facts:
 - profile, workspace, host, port, and `--no-open`;
 - `DSH_HOME` when explicitly configured;
 - an explicit `DSH_WEB_SUPERVISOR=dsh-update-status` marker;
-- private stdout/stderr log paths.
+- private stdout/stderr log paths;
+- one final `PATH`, its source (`current`, `minimal`, or `explicit`), capture time, Windows `PATHEXT` when applicable, and any warnings produced while resolving it.
+
+It intentionally does **not** copy the full terminal environment. The default `current` mode snapshots only the PATH of the process that runs `plan`/`install`; no login or interactive shell startup file is executed. The selected Node directory is placed first, empty and relative entries are ignored, duplicates are removed in order, and missing absolute directories are preserved with a warning because a mount or tool directory may appear later. The result is persisted in the receipt and reused by preflight, the native definition, activation and status — later commands never recapture a different terminal PATH.
 
-It intentionally does **not** inherit the full terminal environment. If your DSH startup requires secret environment variables, configure them through your operating system's secret-management mechanism before activating the service; do not paste secrets into this plugin's configuration or issue tracker.
+For a fixed deployment use `--path-source minimal`; to supply the exact value yourself use `--service-path "..."` (which implies the `explicit` source). On Windows `--service-pathext` can pin command extensions as well. `plan --dry-run` prints the final PATH, source, capture time, PATHEXT and every warning before anything is written; `install` repeats the final PATH before preflight, so running the two commands from different terminals cannot hide a changed input. A too-long value or a value containing NUL/line breaks is rejected rather than silently shortened. If your DSH startup requires other environment variables or secrets, configure them through your operating system's secret-management mechanism before activating the service; do not paste secrets into this plugin's configuration or issue tracker.
 
 ## macOS — LaunchAgent
 
@@ -57,7 +59,22 @@ The CLI stages a current-user plist at:
 ~/Library/LaunchAgents/com.idoall.dsh-update-status.web.plist
 ```
 
-It runs at login (`RunAtLoad`) and keeps DSH alive (`KeepAlive`). The plugin accepts page restart only when both the explicit marker and launchd's `XPC_SERVICE_NAME=com.idoall.dsh-update-status.web` identify the current process. A terminal process that merely has a similarly named environment variable is refused.
+The plist receives the one PATH resolved above. This is package-manager-neutral: Homebrew, MacPorts, pkgsrc, Nix, asdf, Conda, Cargo and hand-installed tools work when their directory was already in the terminal PATH used for `install`; no prefix is hardcoded into the macOS renderer.
+
+It runs at login (`RunAtLoad`) and starts a small wrapper, also staged by the CLI:
+
+```text
+~/.dsh/dsh-update-status/dsh-web-supervisor.sh
+```
+
+The wrapper — not launchd — owns the restart loop, because `KeepAlive` can only respawn forever: if another launcher holds the port, every respawn dies with `EADDRINUSE` within a couple of seconds and the machine spins. The wrapper counts children that die before 30 seconds, stops after 5 of those in a row, writes why to the service log, and exits instead of respawning. A child that ran longer resets the counter, so ordinary restarts and long uptimes never trip it. The wrapper also forwards `SIGTERM` to its child, so `stop`/`uninstall` cannot leave an orphaned DSH behind holding the port.
+
+The plugin accepts a page restart only when **both** hold:
+
+- the explicit `DSH_WEB_SUPERVISOR=dsh-update-status` marker is present, and
+- launchd reports this process (or its wrapper parent) as the tracked `pid` of the job labelled `com.idoall.dsh-update-status.web`.
+
+The second check is the identity. Every descendant of a supervised process inherits the marker, so a process started by some other tool claims to be supervised while launchd is busy respawning a job that can never bind the port; the tracked pid cannot be inherited. The label is asked for by name rather than read from the environment: launchd does configure `XPC_SERVICE_NAME` for the job, but inside DSH — behind the staged `/bin/sh` wrapper — that variable reads `0`, so an environment check would refuse the very setup this plugin installs.
 
 Useful native inspection commands:
 
@@ -66,7 +83,7 @@ launchctl print "gui/$(id -u)/com.idoall.dsh-update-status.web"
 launchctl kickstart -k "gui/$(id -u)/com.idoall.dsh-update-status.web"
 ```
 
-Use the plugin CLI `stop` or `uninstall`, not `kill`, to intentionally stop a `KeepAlive` service. Killing the DSH child alone asks launchd to start it again.
+If the wrapper gave up, fix the cause (usually a second `dsh web` holding the port), then `launchctl kickstart -k` the job. Killing the wrapper itself is not a way back either: launchd no longer keeps a `KeepAlive` promise for it, which is precisely what bounds the loop — `kickstart` or the next login starts it again. Use the plugin CLI `stop` or `uninstall`, not `kill`, to intentionally stop the service: the wrapper forwards the signal to DSH.
 
 ## Linux — systemd user service
 
@@ -76,13 +93,22 @@ The CLI stages:
 ~/.config/systemd/user/dsh-update-status-web.service
 ```
 
-It uses `Restart=on-failure`, so DSH's restart exit code causes systemd to relaunch it. It is a **user** service: normally it starts after that user logs in.
+The unit receives the persisted POSIX PATH, with literal `%` escaped so systemd cannot treat a directory as a specifier. WSL reports itself as Linux and therefore uses the same colon-separated rules; a Windows semicolon PATH is never written into the unit.
+
+It uses `Restart=on-failure`, so DSH's restart exit code causes systemd to relaunch it, and it bounds the loop with `StartLimitIntervalSec=300` / `StartLimitBurst=10`: ten starts inside five minutes stops the unit instead of respawning forever. It is a **user** service: normally it starts after that user logs in.
 
 ```sh
 systemctl --user status dsh-update-status-web.service
 journalctl --user -u dsh-update-status-web.service -f
 ```
 
+If the start limit tripped (usually because a second `dsh web` held the port), fix the cause and clear the limit before starting again:
+
+```sh
+systemctl --user reset-failed dsh-update-status-web.service
+systemctl --user start dsh-update-status-web.service
+```
+
 To keep it alive after logout, a machine administrator may enable user lingering:
 
 ```sh
@@ -99,15 +125,27 @@ The CLI stages a current-user Task Scheduler definition and a PowerShell wrapper
 %LOCALAPPDATA%\dsh-update-status\
 ```
 
-The task starts at user logon with least privilege. The wrapper owns the long-running DSH child and restarts it after an intentional restart or unexpected exit. Use Task Scheduler to inspect the task named **DSH Update Status Web**.
+New receipts pin both the semicolon-separated PATH and PATHEXT in the PowerShell wrapper, including drive paths, UNC shares, spaces and Unicode; PATH keys are read case-insensitively. Old receipts preserve their historical Task Scheduler logon environment instead of being narrowed during an upgrade.
+
+The task starts at user logon with least privilege. The wrapper owns the long-running DSH child, restarts it after an intentional restart or unexpected exit, and stops after five starts that each die within 30 seconds (the same ceiling as macOS) instead of respawning forever. Use Task Scheduler to inspect the task named **DSH Update Status Web**.
 
 Windows behavior must be verified on a Windows host before it is described as production-supported; use `plan --dry-run` to inspect the generated XML and wrapper first.
 
+## One launcher, one port
+
+Supervision only means something while the service is the only thing starting DSH Web on that port. Any other launcher — a second plugin's restart helper, a `nohup` restart script, a hand-started `dsh web` — takes the port for itself and leaves the service respawning a process that dies immediately. That is the one failure mode this plugin cannot fix from inside a page, so it detects and refuses it instead:
+
+- restart availability requires the platform to report **this** process as the service's own (see each platform above);
+- a restart storm (recent boot stamps plus DSH's own `startup-*.log` diagnostics, four within three minutes) is reported in the panel as its own reason;
+- every generated definition carries a failure ceiling, and the wrapper/log line says which limit was reached.
+
+Recovery is always the same: stop the extra instance, confirm the port is free (`lsof -nP -iTCP:3080 -sTCP:LISTEN`), then restart the service with the platform command above. The plugin never kills that other process for you — but it does hand you both commands: while a restart is refused, the panel and the settings card show the refusal reason followed by the two copy-only lines, taken from the installer's own receipt (the port) and the service plan (`recoverCommand`, which includes `systemctl --user reset-failed` on Linux because the unit's own start limit is what stopped the storm). With no receipt, the panel points at this document instead.
+
 ## Restart behavior and limits
 
 The panel's flow is deliberately conservative:
 
-1. It verifies that the **current** DSH process is supervised.
+1. It verifies that the **current** DSH process is supervised *and* that the platform service owns it.
 2. It lists running agents, jobs, and terminals. If this inspection is incomplete, restart is refused.
 3. If work is running, a second **Force restart** confirmation is required. A restart interrupts that work; it does not save or resume it.
 4. The Host returns an accepted response, then exits with code `42` after a short grace period.
@@ -122,8 +160,7 @@ Node/NVM upgrades can change the absolute Node path captured in a service defini
 To remove supervision without deleting DSH profiles, sessions, or plugin preferences:
 
 ```sh
-dsh plugin --profile web exec dsh-update-status-service uninstall \
-  --workspace "$PWD"
+dsh plugin --profile web exec dsh-update-status-service uninstall
 ```
 
 The command removes only the definition and receipt created by this installer. It preserves logs for diagnosis.

package/lib/client.js

@@ -251,8 +251,28 @@ window.__ModuleLoader__.load({
 				en: "DSH Desktop manages this Host. Quit and reopen the desktop app instead."
 			},
 			"restart.unavailableMismatch": {
-				zh: "检测到监督标记，但当前进程不符合对应平台服务的身份。为安全起见，重启已禁用。",
-				en: "A supervision marker exists, but this process does not match the platform service identity. Restart is disabled for safety."
+				zh: "检测到监督标记，但当前进程不是该平台服务真正启动并持有的那个（例如被另一个重启工具拉起）。重启后无法保证恢复，按钮已禁用。",
+				en: "A supervision marker exists, but this process is not the one that platform service actually started and owns (another restart tool launched it, for example). Restart is disabled so the page cannot strand itself."
+			},
+			"restart.recoverIntro": {
+				zh: "第一行只列出占用端口的进程，不会杀它；请先自行停止它，再执行第二行让监督服务重新接管。",
+				en: "The first line only lists whoever holds the port — it kills nothing. Stop that process yourself, then run the second line to hand supervision back."
+			},
+			"restart.recoverLabel": {
+				zh: "恢复命令",
+				en: "Recovery commands"
+			},
+			"restart.recoverNote": {
+				zh: "仅复制，不会执行，也不会杀任何进程。",
+				en: "Copy only — nothing runs here, and no process is killed."
+			},
+			"restart.recoverInstall": {
+				zh: "尚未安装用户级监督服务；请按 README 的「受监督的重启」一节安装并接管 DSH，之后这个按钮才会启用。",
+				en: "No user-level supervisor is installed. Follow the “Supervised restart” section of the README to install and activate one; this button stays disabled until then."
+			},
+			"restart.unavailableThrashing": {
+				zh: "监督服务正在反复启动失败（检测到重启风暴）。请先停止占用该端口的另一个 DSH 实例，并查看服务日志；在那之前重启可能无法恢复。",
+				en: "The supervisor is repeatedly failing to start (a restart storm was detected). Stop the other DSH instance holding this port and check the service logs; until then a restart may not recover."
 			},
 			"restart.unavailableActivity": {
 				zh: "无法完整读取正在运行的任务。为避免中断未能列出的工作，重启已禁用。",
@@ -313,6 +333,10 @@ window.__ModuleLoader__.load({
 			"settings.readonly": {
 				zh: "此连接的设置为只读；显示状态不受影响。",
 				en: "Settings are read-only on this connection; status display is unchanged."
+			},
+			"settings.serviceStarted": {
+				zh: "服务启动时间",
+				en: "Service started"
 			}
 		};
 		function languageOf() {
@@ -497,6 +521,7 @@ window.__ModuleLoader__.load({
 		function restartUnavailableText(reason) {
 			if (reason === "desktop") return t("restart.unavailableDesktop");
 			if (reason === "supervisor-mismatch") return t("restart.unavailableMismatch");
+			if (reason === "supervisor-thrashing") return t("restart.unavailableThrashing");
 			if (reason === "activity-unavailable") return t("restart.unavailableActivity");
 			if (reason === "timer-unavailable") return t("restart.unavailableTimer");
 			if (reason === "stale-instance") return t("restart.unavailableStale");
@@ -509,6 +534,7 @@ window.__ModuleLoader__.load({
 			}, [restart]);
 			const unavailable = snapshot.status !== null && !snapshot.status.available;
 			const hasActivity = snapshot.activity.length > 0;
+			const recoverable = snapshot.status?.recovery?.commands ?? null;
 			const waiting = snapshot.phase === "waiting";
 			const label = snapshot.phase === "unknown" ? t("restart.loading") : snapshot.phase === "checking" ? t("restart.checking") : snapshot.phase === "armed" ? hasActivity ? t("restart.force") : t("restart.confirm") : waiting ? t("restart.waitingShort") : snapshot.phase === "timeout" ? t("restart.retry") : snapshot.phase === "error" ? t("restart.retry") : t("restart.button");
 			const disabled = snapshot.phase === "unknown" || snapshot.phase === "checking" || waiting || unavailable;
@@ -543,6 +569,21 @@ window.__ModuleLoader__.load({
 					role: "status",
 					children: restartUnavailableText(snapshot.status?.unavailableReason)
 				}),
+				unavailable && recoverable !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: "dus-restart-recover",
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dus-restart-message",
+						children: t("restart.recoverIntro")
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CommandBlock, {
+						command: recoverable,
+						label: t("restart.recoverLabel"),
+						note: t("restart.recoverNote")
+					})]
+				}),
+				unavailable && snapshot.status?.unavailableReason === "not-supervised" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+					className: "dus-restart-message",
+					children: t("restart.recoverInstall")
+				}),
 				snapshot.phase === "armed" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 					className: "dus-restart-message",
 					role: "status",
@@ -614,7 +655,7 @@ window.__ModuleLoader__.load({
 		* The one upgrade command plus its copy affordance, shared by the panel and the
 		* settings section so both surfaces can never disagree about what to run.
 		*/
-		function CommandBlock({ command, disabled = false }) {
+		function CommandBlock({ command, disabled = false, label = t("panel.command"), note = t("panel.commandNote") }) {
 			const commandRef = React.useRef(null);
 			const [copyMessage, setCopyMessage] = React.useState(null);
 			const copy = async () => {
@@ -631,7 +672,7 @@ window.__ModuleLoader__.load({
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
 				/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 					className: "dus-command-label",
-					children: t("panel.command")
+					children: label
 				}),
 				/* @__PURE__ */ (0, react_jsx_runtime.jsx)("code", {
 					ref: commandRef,
@@ -657,7 +698,7 @@ window.__ModuleLoader__.load({
 				}),
 				/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 					className: "dus-note",
-					children: t("panel.commandNote")
+					children: note
 				})
 			] });
 		}
@@ -852,6 +893,7 @@ window.__ModuleLoader__.load({
 		function UpdateSettings({ ui }) {
 			const preferences = useObservable(ui.preferences);
 			const snapshot = useObservable(ui.status);
+			const startedAt = useObservable(ui.restart).status?.startedAt ?? null;
 			const status = snapshot.status;
 			const summary = statusSummary(status, snapshot.loading, snapshot.error);
 			const hasUpdate = status?.hasUpdate === true && status.latestVersion !== null;
@@ -890,13 +932,23 @@ window.__ModuleLoader__.load({
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: "dus-settings-card",
 						children: [
-							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
-								className: "dus-settings-hint",
-								children: [
-									t("panel.current"),
-									": ",
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("code", { children: status?.currentVersion ?? "…" })
-								]
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "dus-settings-pair",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
+									className: "dus-settings-hint",
+									children: [
+										t("panel.current"),
+										": ",
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("code", { children: status?.currentVersion ?? "…" })
+									]
+								}), startedAt !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
+									className: "dus-settings-hint",
+									children: [
+										t("settings.serviceStarted"),
+										": ",
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("code", { children: timeText(startedAt) })
+									]
+								})]
 							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 								className: "dus-state",
@@ -970,13 +1022,18 @@ window.__ModuleLoader__.load({
 			const supervisor = record.supervisor === null ? null : record.supervisor === "launchd" || record.supervisor === "systemd" || record.supervisor === "task-scheduler" || record.supervisor === "unknown" ? record.supervisor : void 0;
 			const unavailableReason = record.unavailableReason === null ? null : record.unavailableReason === "not-supervised" || record.unavailableReason === "desktop" || record.unavailableReason === "supervisor-mismatch" || record.unavailableReason === "activity-unavailable" || record.unavailableReason === "timer-unavailable" || record.unavailableReason === "stale-instance" ? record.unavailableReason : void 0;
 			if (supervisor === void 0 || unavailableReason === void 0) return void 0;
+			if (record.startedAt !== void 0 && (typeof record.startedAt !== "string" || record.startedAt === "")) return void 0;
+			const recovery = record.recovery === void 0 ? void 0 : objectOf(record.recovery);
+			if (record.recovery !== void 0 && (recovery === void 0 || typeof recovery.commands !== "string" || recovery.commands === "")) return void 0;
 			if (record.available && (supervisor === null || unavailableReason !== null)) return void 0;
 			if (!record.available && unavailableReason === null) return void 0;
 			return {
 				instanceId: record.instanceId,
+				...record.startedAt === void 0 ? {} : { startedAt: record.startedAt },
 				available: record.available,
 				supervisor,
-				unavailableReason
+				unavailableReason,
+				...recovery === void 0 ? {} : { recovery: { commands: recovery.commands } }
 			};
 		}
 		function restartActivityOf(value) {
@@ -2073,6 +2130,9 @@ window.__ModuleLoader__.load({
 /* A job label is a whole shell command: clamp it so one long command cannot push
    the panel's buttons off a 390px card. */
 .dus-restart-work li{display:-webkit-box;-webkit-box-orient:vertical;-webkit-line-clamp:2;overflow:hidden}
+/* Recovery steps live under the disabled button and take their own row, like the
+   active-work list: the instruction, the copyable commands, then the no-op note. */
+.dus-restart-recover{flex-basis:100%}
 .dus-command-label{color:var(--dsw-alias-label-secondary);font-size:12px;font-weight:600;margin:0 0 6px}
 .dus-command{background:var(--dsw-specific-input-major);border:1px solid var(--dsw-alias-border-l2);border-radius:8px;display:block;font-family:var(--dsw-font-family-mono,ui-monospace,SFMono-Regular,Menlo,monospace);font-size:11px;line-height:1.5;margin:0;overflow-wrap:anywhere;padding:9px;tab-size:2;user-select:text;white-space:pre-wrap}
 .dus-command:focus{outline:2px solid var(--dsw-alias-state-business-primary);outline-offset:2px}
@@ -2084,6 +2144,16 @@ window.__ModuleLoader__.load({
 .dus-settings-toggle{align-items:flex-start;cursor:pointer;display:flex;gap:10px;font-size:13px;line-height:1.4}
 .dus-settings-toggle input{accent-color:var(--dsw-alias-state-business-primary);height:18px;margin:0;min-height:18px;min-width:18px;width:18px}
 .dus-settings-hint{color:var(--dsw-alias-label-secondary);font-size:12px;line-height:1.45;margin:8px 0 0}
+/* Running version and service start time share one row: version left, start time
+   flush right. Each line asks for a 200px basis, so the row wraps into two stacked
+   lines on a phone-width card instead of squeezing either value — the break is
+   driven by available width, which keeps one declaration correct at every size and
+   needs no width query. min(200px,100%) keeps a very narrow card from overflowing.
+   The 5px bottom margin is the breathing room the status block below used to do
+   without: the hints carry margin:8px 0 0, so the row's own box ends at the text and
+   the green state block sat flush against it. */
+.dus-settings-pair{align-items:baseline;display:flex;flex-wrap:wrap;gap:0 12px;justify-content:space-between;margin:0 0 5px}
+.dus-settings-pair>.dus-settings-hint{flex:0 1 auto;min-width:min(200px,100%);overflow-wrap:anywhere}
 .dus-compat{color:var(--dsw-alias-label-secondary)}
 .dus-compat[data-compatibility=verified]{color:var(--dsw-alias-state-success-primary)}
 .dus-compat[data-compatibility=incompatible]{color:var(--dsw-alias-state-error-primary)}