dsh-wechat-remote 1.7.5 → 1.7.6

package/README.md

@@ -1,6 +1,6 @@
-# Agent远程管理助手 · DSH 插件安装器
-
-当前安装器版本为 1.7.4，安装的正式插件仍为 1.7.2。已正常使用插件 1.7.2 的用户，无需因此重新安装。
+# Agent远程管理助手 · DSH 插件安装器
+
+当前版本为 1.7.6，安装同版本正式插件。改善全局安装及 npx 启动的识别，修复 ARM64 设备的一键更新误拦截。
 
 首次安装和升级旧插件使用同一个命令：
 
@@ -8,16 +8,18 @@
 npx -y dsh-wechat-remote@latest
 ```
 
-需已安装 DSH，使用 Node.js 22.13 或更高版本。安装工具由包依赖自动提供，无需另装 pnpm 或 Git。
+请先按原来的方式启动 DSH WebUI，再在同一个系统用户下另开终端运行本命令。无需改成全局安装 DSH；使用 `npx @deepseek-ai/dsh web` 的用户也使用同一条安装命令。需要 Node.js 22.13 或更高版本，无需另装 pnpm 或 Git。
+
+安装器安装正式插件，保留原配置、配对和会话，不会升级 DSH 本体。请先结束运行中的任务；安装完成后自动重启原 DSH 并尝试打开 WebUI。
+
+DSH 的新版本、预览版本或未登记的主机架构不会仅因缺少验证记录而被拒绝安装。安装器仍检查必要运行能力、安装包完整性和已知不兼容问题，并保留失败恢复所需的备份；无法确认恢复结果时会提示保留数据。这不代表所有宿主组合均已通过功能验证。
+
+支持已验证的 DSH `0.1.1-rc.2`、`0.1.2-rc.1`、`0.1.5-rc.1`，Windows / macOS Intel / Linux x64。普通 Node 启动、独立的 macOS launchd 和 Linux 用户级 systemd 服务可自动恢复；无法确认启动方式时不自动停止主机。
 
-安装器安装正式插件，保留原配置、配对和会话，不会升级 DSH 本体。请先结束运行中的任务；安装完成后自动重启原 DSH 并尝试打开 WebUI。
-
-DSH 的新版本、预览版本或未登记的主机架构不会仅因缺少验证记录而被拒绝安装。安装器仍检查必要运行能力、安装包完整性和已知不兼容问题，并保留失败恢复所需的备份；无法确认恢复结果时会提示保留数据。这不代表所有宿主组合均已通过功能验证。
+另已在 ARM64 Linux 电视盒子上验证 DSH `0.1.5-rc.1` 的首次安装、重复执行及重装。1.7.4 改善较慢主机启动时被误判为安装超时的问题；安装过程中请等待完成，勿重复执行命令。
 
-支持已验证的 DSH `0.1.1-rc.2`、`0.1.2-rc.1`、`0.1.5-rc.1`，Windows / macOS Intel / Linux x64。普通 Node 启动、独立的 macOS launchd 和 Linux 用户级 systemd 服务可自动恢复；无法确认启动方式时不自动停止主机。
-
-另已在 ARM64 Linux 电视盒子上验证 DSH `0.1.5-rc.1` 的首次安装、重复执行及重装。1.7.4 改善较慢主机启动时被误判为安装超时的问题；安装过程中请等待完成，勿重复执行命令。
+旧插件的一键更新如被版本或架构判断拦截，可用上述安装命令升级一次。从插件 1.7.6 起，未登记的 CPU 架构或 DSH 版本不再影响更新入口；执行前仍会检查实际安装与重启条件，无需因此降低 DSH 版本或删除节点。
 
-旧插件 1.7.1 在 DSH 0.1.5 上无法一键更新时，可用本安装命令过渡一次。从插件 1.7.2 起，后续已验证的兼容更新不再受旧的 DSH 版本列表限制；不需要因此降低 DSH 版本或删除节点。
+默认使用 `web` 配置和原来的 DSH 数据目录。自定义数据目录时，在新终端设置相同的 `DSH_HOME`，或附加 `--home "数据目录"`；使用其他配置时附加 `--profile 配置名称`。WSL、容器和其他系统用户内的 DSH，需要在对应环境中执行安装，不能跨环境替换。
 
-使用其他配置时附加 `--profile 配置名称`。安装损坏需要重装时附加 `--repair`；不会自动降级。
+DSH 未启动且找到多个安装版本时，会要求选择，不会随意选一份。也可用 `--dsh-cli "DSH的lib/bin.js路径"` 明确指定。安装损坏需要重装时附加 `--repair`；不会自动降级。

package/assets/release.json

@@ -1,13 +1,13 @@
 {
-  "version": "1.7.5",
+  "version": "1.7.6",
   "catalog": {
     "schemaVersion": 1,
-    "revision": "installer-1.7.5",
-    "issuedAt": 1789362769360,
-    "expiresAt": 1791781969360,
+    "revision": "installer-1.7.6",
+    "issuedAt": 1789480914884,
+    "expiresAt": 1791900114884,
     "releases": [
       {
-        "version": "1.7.5",
+        "version": "1.7.6",
         "channel": "stable",
         "dsh": [
           "0.1.1-rc.2",
@@ -20,13 +20,50 @@
           "linux"
         ],
         "architectures": [
-          "x64"
+          "x64",
+          "arm64"
         ],
         "asset": {
-          "url": "https://github.com/martinbear1/dsh-wechat-remote/releases/download/v1.7.5/harness-remote-dsh-wechat-remote-1.7.5.tgz",
-          "sha256": "d5545651e80242d1782fb04e86aece5d0460db80bdf1cec7688429e2abaf9e6e",
-          "bytes": 9539981
-        }
+          "url": "https://github.com/martinbear1/dsh-wechat-remote/releases/download/v1.7.6/harness-remote-dsh-wechat-remote-1.7.6.tgz",
+          "sha256": "ddd14140e93eaf1704dcca7380b1f99d8243089c2be337eaf94d2e87de4a0ff5",
+          "bytes": 9549941
+        },
+        "targets": [
+          {
+            "platform": "windows",
+            "arch": "x64",
+            "dsh": [
+              "0.1.1-rc.2",
+              "0.1.2-rc.1",
+              "0.1.5-rc.1"
+            ]
+          },
+          {
+            "platform": "macos",
+            "arch": "x64",
+            "dsh": [
+              "0.1.1-rc.2",
+              "0.1.2-rc.1",
+              "0.1.5-rc.1"
+            ]
+          },
+          {
+            "platform": "linux",
+            "arch": "x64",
+            "dsh": [
+              "0.1.1-rc.2",
+              "0.1.2-rc.1",
+              "0.1.5-rc.1"
+            ]
+          },
+          {
+            "platform": "linux",
+            "arch": "arm64",
+            "dsh": [
+              "0.1.5-rc.1"
+            ]
+          }
+        ]
       }
     ],
     "blocked": [],

package/bin/dsh-discovery.mjs

@@ -0,0 +1,165 @@
+/** Read-only discovery. A candidate is NOT the installation target until the
+ * native, token-bound host handshake confirms its home/profile/CLI/PID.
+ * Never run an unvalidated shell shim, fetch a different DSH, or scan a disk. */
+import fs from 'node:fs'
+import path from 'node:path'
+import os from 'node:os'
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+import { createInterface } from 'node:readline/promises'
+
+const execute = promisify(execFile)
+const PACKAGE = '@deepseek-ai/dsh'
+const clean = value => String(value).replace(/[\x00-\x1f\x7f-\x9f]/g, '')
+
+export function validateDshCli(filename) {
+  const cli = fs.realpathSync(path.resolve(filename))
+  const root = path.resolve(cli, '../..')
+  const manifest = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'))
+  const bin = typeof manifest.bin === 'string' ? manifest.bin : manifest.bin?.dsh
+  if (manifest.name !== PACKAGE || path.basename(cli) !== 'bin.js' || !fs.statSync(cli).isFile()
+      || typeof bin !== 'string' || fs.realpathSync(path.resolve(root, bin)) !== cli) {
+    throw new Error('指定路径不是有效的 DSH 启动程序，未修改安装。')
+  }
+  return { cli, version: String(manifest.version || '') }
+}
+
+export function resolveHome(value, fallback = os.homedir()) {
+  const raw = String(value || '')
+  const configured = raw.trim() ? raw : ''
+  return path.resolve(configured === '~' ? fallback : /^~[/\\]/.test(configured)
+    ? path.join(fallback, configured.slice(2)) : configured || path.join(fallback, '.dsh'))
+}
+
+/** npm's own config resolves .npmrc, custom cache/prefix and Node managers.
+ * Query individual public values; never read or log registry credentials. */
+async function npmLocation(key, env, cwd) {
+  let npm = env.npm_execpath
+  if (!npm || !fs.existsSync(npm)) {
+    const roots = [path.dirname(process.execPath), ...(env.PATH || '').split(path.delimiter)]
+    npm = roots.flatMap(dir => [path.join(dir, 'node_modules/npm/bin/npm-cli.js'),
+      path.join(dir, '../lib/node_modules/npm/bin/npm-cli.js')]).find(file => fs.existsSync(file))
+  }
+  if (!npm) return ''
+  try {
+    const { stdout } = await execute(process.execPath, [npm, 'config', 'get', key], {
+      cwd, env, windowsHide: true, timeout: 10000, maxBuffer: 16384,
+    })
+    const value = stdout.trim()
+    return value && !/[\r\n\0]/.test(value) && path.isAbsolute(value) ? value : ''
+  } catch { return '' }
+}
+
+export async function discoverDsh({ env = process.env, cwd = process.cwd(), cache, prefix } = {}) {
+  const found = new Map()
+  const add = (filename, source) => {
+    try {
+      const item = validateDshCli(filename)
+      if (!found.has(item.cli)) found.set(item.cli, { ...item, source })
+    } catch { /* A missing/broken cache entry is not a usable DSH. */ }
+  }
+  for (const dir of (env.PATH || '').split(path.delimiter).filter(Boolean)) {
+    add(path.join(dir, 'dsh'), 'PATH') // POSIX symlink, never execute a Windows shim.
+    add(path.join(dir, 'node_modules/@deepseek-ai/dsh/lib/bin.js'), 'PATH')
+    add(path.join(dir, '../lib/node_modules/@deepseek-ai/dsh/lib/bin.js'), 'PATH')
+    add(path.join(dir, '../@deepseek-ai/dsh/lib/bin.js'), 'PATH') // npm .bin, including Windows.
+  }
+  for (let dir = path.resolve(cwd);;) {
+    add(path.join(dir, 'node_modules/@deepseek-ai/dsh/lib/bin.js'), 'project')
+    add(path.join(dir, 'apps/cli/lib/bin.js'), 'source')
+    const parent = path.dirname(dir)
+    if (parent === dir) break
+    dir = parent
+  }
+  const locations = await Promise.all([
+    cache !== undefined ? cache : env.npm_config_cache || npmLocation('cache', env, cwd),
+    prefix !== undefined ? prefix : npmLocation('prefix', env, cwd),
+  ])
+  if (locations[1]) {
+    add(path.join(locations[1], 'node_modules/@deepseek-ai/dsh/lib/bin.js'), 'npm-global')
+    add(path.join(locations[1], 'lib/node_modules/@deepseek-ai/dsh/lib/bin.js'), 'npm-global')
+  }
+  const cacheRoot = locations[0]
+  if (cacheRoot) {
+    try {
+      const entries = fs.readdirSync(path.join(cacheRoot, '_npx'), { withFileTypes: true })
+      if (entries.length > 512) throw new Error('npx 缓存较多，请先启动要使用的 DSH，再运行安装命令。')
+      for (const entry of entries) if (/^[a-f0-9]+$/i.test(entry.name) && entry.isDirectory()) {
+        add(path.join(cacheRoot, '_npx', entry.name, 'node_modules/@deepseek-ai/dsh/lib/bin.js'), 'npx')
+      }
+    } catch (error) { if (error.code !== 'ENOENT' && error.code !== 'ENOTDIR') throw error }
+  }
+  return [...found.values()]
+}
+
+export async function chooseDsh(options = {}) {
+  if (options.cli) return validateDshCli(options.cli).cli
+  const candidates = await discoverDsh(options)
+  if (!candidates.length) throw new Error('未找到 DSH。请先按原来的方式启动 DSH WebUI，再运行本命令。')
+  if (candidates.length === 1) return candidates[0].cli
+  // Multiple installed/cache versions are not evidence of the user's choice.
+  // A live host normally bypasses this fallback via its native handshake.
+  const prompt = options.prompt || (process.stdin.isTTY && process.stdout.isTTY ? async message => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout })
+    try { return await rl.question(message) } finally { rl.close() }
+  } : undefined)
+  if (!prompt) throw new Error('找到多份 DSH。请先启动要使用的 DSH，或用 --dsh-cli 指定其 lib/bin.js；未修改插件。')
+  const list = candidates.map((item, index) => `${index + 1}. DSH ${clean(item.version)} — ${clean(item.cli)}`).join('\n')
+  const answer = String(await prompt(`找到多份 DSH，请选择要使用的一份（直接回车取消）：\n${list}\n编号：`)).trim()
+  const index = Number(answer) - 1
+  if (!/^\d+$/.test(answer) || !Number.isInteger(index) || !candidates[index]) throw new Error('已取消安装，未修改插件。')
+  return candidates[index].cli
+}
+
+// POSIX npm/npx normally starts through a bin symlink, not lib/bin.js.
+// This is a conservative stop signal only; target authority is the handshake.
+export function looksLikeDshProcess(command) {
+  return /(?:[/\\](?:dsh|apps[/\\]cli)[/\\]lib[/\\]bin\.js|[/\\](?:\.bin|bin)[/\\]dsh)(?:["'\s]|$)/i.test(command || '')
+}
+
+/** Conservatively prevent a second host while a live profile reloads on a
+ * non-default port. We use process listings only as a stop signal, never as
+ * authority to install, stop a PID, or select another user's data directory. */
+export async function mayHaveRunningDsh() {
+  try {
+    if (process.platform === 'win32') {
+      const command = "Get-CimInstance Win32_Process -Filter \"Name='node.exe' OR Name='node'\" | Select-Object -ExpandProperty CommandLine | ConvertTo-Json -Compress"
+      const { stdout } = await execute('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', command], {
+        windowsHide: true, timeout: 10000, maxBuffer: 1024 * 1024,
+      })
+      const data = stdout.trim() ? JSON.parse(stdout) : []
+      return [data].flat().some(looksLikeDshProcess)
+    }
+    if (process.platform === 'linux') {
+      for (const pid of fs.readdirSync('/proc').filter(name => /^\d+$/.test(name))) {
+        try {
+          const args = fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8').split('\0')
+          if (args.some(looksLikeDshProcess)) return true
+        } catch { /* Exited or inaccessible process. */ }
+      }
+      return false
+    }
+    const { stdout } = await execute('/bin/ps', ['-axo', 'command='], { timeout: 10000, maxBuffer: 2 * 1024 * 1024 })
+    return looksLikeDshProcess(stdout)
+  } catch { return true } // Unknown process ownership must never authorize an extra host.
+}
+
+export function assertInstallTarget(host, { home, profile, cli, pid }) {
+  if (host.home !== home || host.profile !== profile || !Number.isInteger(host.pid) || host.pid < 1
+      || host.pid !== pid || (cli && host.cli !== validateDshCli(cli).cli)
+      || host.cli !== validateDshCli(host.cli).cli) {
+    throw new Error('当前 DSH 身份与安装目标不一致，未修改安装。')
+  }
+}
+
+/** Preserve arguments but use the validated real entry point for restart.
+ * On macOS/Linux argv[0] can be npm's .bin/dsh symlink while host.cli is its
+ * canonical target. The worker requires a canonical CLI, as the WebUI updater
+ * already does. Never accept a different executable hidden in argv. */
+export function installHostArgv(host) {
+  if (!Array.isArray(host.argv) || !host.argv.length || !host.argv.every(arg => typeof arg === 'string')
+      || validateDshCli(host.argv[0]).cli !== host.cli) {
+    throw new Error('DSH 启动参数与安装目标不一致，未修改安装。')
+  }
+  return [host.cli, ...host.argv.slice(1)]
+}

package/bin/native-control.mjs

@@ -51,14 +51,16 @@ export async function waitForJson(filename, accept, timeout = 20000) {
     try { const value = JSON.parse(fs.readFileSync(filename, 'utf8')); if (accept(value)) return value } catch {}
     await new Promise(resolve => setTimeout(resolve, 100))
   }
-  throw new Error('DSH 没有完成安装握手；原插件未替换。请确认 DSH WebUI 正在运行且允许原生插件热加载。')
+  const error = new Error('DSH 没有完成安装握手；原插件未替换。请确认 DSH WebUI 正在运行且允许原生插件热加载。')
+  error.code = 'DSH_HANDSHAKE_TIMEOUT'
+  throw error
 }
 
 /** One bounded native handshake, including a possible offline host start.
  * A listening WebUI is not proof that the asynchronous profile reload finished.
  * Keep the same control entry/token while waiting; never restart a live host. */
 export async function waitForInstallControl(filename, {
-  accept, ensureRunning, onWaiting = () => {}, timeoutMs = 180000, initialWaitMs = 5000,
+  accept, ensureRunning, onWaiting = () => {}, timeoutMs = 180000, initialWaitMs = 5000,
 }) {
   const deadline = Date.now() + timeoutMs
   try { return await waitForJson(filename, accept, Math.min(initialWaitMs, timeoutMs)) }

package/bin/release-selection.mjs

@@ -1,33 +1,36 @@
-import { validateCatalog, compareVersions, trustedReleaseAsset } from '../lib/update-policy.js'
-
-/** Explicit CLI installation is not an automatic-update recommendation.
- * Tested DSH/platform/architecture lists describe evidence, not admission.
- * Keep trusted artifacts, explicit withdrawals and the no-downgrade floor.
- */
-export function selectInstallTarget(pinned, remote, current, now = Date.now()) {
-  const local = validateCatalog(pinned.catalog)
-  const bundled = local.releases.find(r => r.version === pinned.version && r.channel === 'stable')
-  if (!bundled || !trustedReleaseAsset(bundled.asset, bundled.version)) {
-    throw new Error('安装包信息不完整，请重新获取官方安装器。')
-  }
-  let online
-  try {
-    const candidate = validateCatalog(remote)
-    if (candidate.issuedAt <= now + 300000 && candidate.expiresAt > now) online = candidate
-  } catch { /* The authenticated npm package remains usable without the catalog. */ }
-
-  // An installer never silently substitutes an older plugin than its own bundle.
-  // Keep the bundled bytes/hash for the same version even if remote metadata differs.
-  const candidates = [bundled, ...(online?.releases || []).filter(r => r.channel === 'stable'
-    && compareVersions(r.version, bundled.version) > 0 && trustedReleaseAsset(r.asset, r.version))]
-    .sort((a, b) => compareVersions(b.version, a.version))
-  const rules = [...local.blocked, ...(online?.blocked || [])]
-  const blocked = release => rules.find(b => b.pluginVersion === release.version
-    && (!b.dsh || b.dsh.includes(current.agentVersion))
-    && (!b.platforms || b.platforms.includes(current.platform)))
-  const release = candidates.find(r => !blocked(r))
-  if (!release) {
-    throw new Error(`当前插件存在已知不兼容问题：${blocked(bundled).reason}；未替换现有插件。`)
-  }
-  return release
-}
+import { validateCatalog, compareVersions, trustedReleaseAsset } from '../lib/update-policy.js'
+
+/** Explicit CLI installation is not an automatic-update recommendation.
+ * Tested DSH/platform/architecture lists describe evidence, not admission.
+ * Keep trusted artifacts, explicit withdrawals and the no-downgrade floor.
+ */
+export function selectInstallTarget(pinned, remote, current, now = Date.now()) {
+  const local = validateCatalog(pinned.catalog)
+  // Choosing an explicit prerelease installer authorizes its exact embedded
+  // preview, not arbitrary remote previews or a change to stable recommendations.
+  const channel = pinned.version.includes('-') ? 'preview' : 'stable'
+  const bundled = local.releases.find(r => r.version === pinned.version && r.channel === channel)
+  if (!bundled || !trustedReleaseAsset(bundled.asset, bundled.version)) {
+    throw new Error('安装包信息不完整，请重新获取官方安装器。')
+  }
+  let online
+  try {
+    const candidate = validateCatalog(remote)
+    if (candidate.issuedAt <= now + 300000 && candidate.expiresAt > now) online = candidate
+  } catch { /* The authenticated npm package remains usable without the catalog. */ }
+
+  // An installer never silently substitutes an older plugin than its own bundle.
+  // Keep the bundled bytes/hash for the same version even if remote metadata differs.
+  const candidates = [bundled, ...(online?.releases || []).filter(r => r.channel === 'stable'
+    && compareVersions(r.version, bundled.version) > 0 && trustedReleaseAsset(r.asset, r.version))]
+    .sort((a, b) => compareVersions(b.version, a.version))
+  const rules = [...local.blocked, ...(online?.blocked || [])]
+  const blocked = release => rules.find(b => b.pluginVersion === release.version
+    && (!b.dsh || b.dsh.includes(current.agentVersion))
+    && (!b.platforms || b.platforms.includes(current.platform)))
+  const release = candidates.find(r => !blocked(r))
+  if (!release) {
+    throw new Error(`当前插件存在已知不兼容问题：${blocked(bundled).reason}；未替换现有插件。`)
+  }
+  return release
+}

package/bin/setup.mjs

@@ -1,37 +1,22 @@
 #!/usr/bin/env node
 import fs from 'node:fs'
 import path from 'node:path'
-import os from 'node:os'
 import net from 'node:net'
 import { spawn } from 'node:child_process'
 import { randomBytes, createHash } from 'node:crypto'
 import { fileURLToPath } from 'node:url'
 import { attachControl, waitForJson, waitForInstallControl } from './native-control.mjs'
 import { resolveInstallRuntime, verifyInstallRuntime } from '../lib/install-runtime.js'
-import { compareVersions } from '../lib/update-policy.js'
-import { selectInstallTarget } from './release-selection.mjs'
+import { compareVersions } from '../lib/update-policy.js'
+import { selectInstallTarget } from './release-selection.mjs'
 import { boundedFetch, downloadRelease, auditArchive } from '../lib/update-download.js'
 import { writePrivateJsonAtomic } from '../lib/secure-file.js'
 import { control, validateJob, releaseOwnedUpdateLock } from '../lib/update-worker.js'
+import { chooseDsh, validateDshCli, resolveHome, mayHaveRunningDsh, assertInstallTarget, installHostArgv } from './dsh-discovery.mjs'
 
 const root = fileURLToPath(new URL('../', import.meta.url))
 const packageName = '@harness-remote/dsh-wechat-remote'
 const sleep = ms => new Promise(resolve => setTimeout(resolve, ms))
-export function findDsh() {
-  const candidates = []
-  for (const dir of (process.env.PATH || '').split(path.delimiter).filter(Boolean)) {
-    candidates.push(path.join(dir, 'node_modules/@deepseek-ai/dsh/lib/bin.js'), path.join(dir, '../lib/node_modules/@deepseek-ai/dsh/lib/bin.js'))
-    try { candidates.push(fs.realpathSync(path.join(dir, 'dsh'))) } catch {}
-  }
-  for (const candidate of candidates) {
-    try {
-      const cli = fs.realpathSync(candidate)
-      const manifest = JSON.parse(fs.readFileSync(path.resolve(cli, '../../package.json'), 'utf8'))
-      if (manifest.name === '@deepseek-ai/dsh' && path.basename(cli) === 'bin.js') return cli
-    } catch {}
-  }
-  throw new Error('未找到已安装的 DSH。请先安装并启动 DeepSeek Harness。')
-}
 function portBusy(port) {
   return new Promise(resolve => {
     const socket = net.connect({ host: '127.0.0.1', port })
@@ -39,16 +24,16 @@ function portBusy(port) {
     socket.setTimeout(500, () => end(false)); socket.once('connect', () => end(true)); socket.once('error', () => end(false))
   })
 }
-export async function selectRelease(host, assetsRoot = path.join(root, 'assets'), repair = false,
-  fetchCatalog = () => boundedFetch('https://relay.xyxfood.xyz/v1/update-policy', 256 * 1024)) {
+export async function selectRelease(host, assetsRoot = path.join(root, 'assets'), repair = false,
+  fetchCatalog = () => boundedFetch('https://relay.xyxfood.xyz/v1/update-policy', 256 * 1024)) {
   const current = { agentKind: 'dsh', agentVersion: host.dshVersion, pluginVersion: host.pluginVersion,
     platform: { win32: 'windows', darwin: 'macos', linux: 'linux' }[host.platform], arch: host.arch }
   const pinned = JSON.parse(fs.readFileSync(path.join(assetsRoot, 'release.json'), 'utf8'))
-  let remote
-  try {
-    remote = JSON.parse((await fetchCatalog()).toString('utf8'))
-  } catch { /* Authenticated npm package retains its bundled release. */ }
-  const release = selectInstallTarget(pinned, remote, current)
+  let remote
+  try {
+    remote = JSON.parse((await fetchCatalog()).toString('utf8'))
+  } catch { /* Authenticated npm package retains its bundled release. */ }
+  const release = selectInstallTarget(pinned, remote, current)
   if (host.pluginVersion !== '0.0.0' && (compareVersions(host.pluginVersion, release.version) > 0
     || (compareVersions(host.pluginVersion, release.version) === 0 && !repair))) return { release, archive: null }
   let archive
@@ -57,10 +42,11 @@ export async function selectRelease(host, assetsRoot = path.join(root, 'assets')
   auditArchive(archive, release)
   return { release, archive }
 }
-export async function install({ profileName = 'web', cli = findDsh(), assetsRoot, open = true, repair = false } = {}) {
+export async function install({ profileName = 'web', cli, home: configuredHome, assetsRoot, open = true, repair = false } = {}) {
   if (!/^[A-Za-z0-9_-]{1,80}$/.test(profileName)) throw new Error('无效的 profile 名称。')
+  if (cli) cli = validateDshCli(cli).cli
   const runtime = resolveInstallRuntime(root); await verifyInstallRuntime(runtime)
-  const home = path.resolve(process.env.DSH_HOME || path.join(os.homedir(), '.dsh'))
+  const home = resolveHome(configuredHome || process.env.DSH_HOME)
   fs.mkdirSync(home, { recursive: true, mode: 0o700 })
   if (fs.realpathSync(home) !== home) throw new Error('DSH 数据目录是链接，暂不自动替换安装。')
   const profile = path.join(home, 'profiles', profileName), id = randomBytes(16).toString('hex')
@@ -72,15 +58,17 @@ export async function install({ profileName = 'web', cli = findDsh(), assetsRoot
   try {
     // Initialize missing profiles through DSH itself, never synthesize a bundle list.
     if (!fs.existsSync(path.join(profile, 'package.json'))) {
+      if (await mayHaveRunningDsh()) throw new Error('当前目录下没有此 DSH 配置，但检测到 DSH 正在运行。请使用相同的 DSH_HOME／--home 和 --profile，未修改正在运行的实例。')
+      cli ||= await chooseDsh()
       const log = fs.openSync(path.join(directory, 'startup.log'), 'a', 0o600)
       launched = spawn(process.execPath, [cli, '--profile', profileName, '--no-open'], {
-        cwd: process.cwd(), env: process.env, detached: true, windowsHide: true, stdio: ['ignore', log, log] })
+        cwd: process.cwd(), env: { ...process.env, DSH_HOME: home }, detached: true, windowsHide: true, stdio: ['ignore', log, log] })
       fs.closeSync(log); launched.on('error', () => {}); launched.unref()
-      const initializedBy = Date.now() + 180000
-      while (!fs.existsSync(path.join(profile, 'package.json')) && Date.now() < initializedBy) {
-        if (launched.exitCode !== null || launched.signalCode !== null) break
-        await sleep(100)
-      }
+      const initializedBy = Date.now() + 180000
+      while (!fs.existsSync(path.join(profile, 'package.json')) && Date.now() < initializedBy) {
+        if (launched.exitCode !== null || launched.signalCode !== null) break
+        await sleep(100)
+      }
       if (!fs.existsSync(path.join(profile, 'package.json'))) throw new Error('DSH 未能初始化 profile；详情见本机安装记录。')
       await sleep(2000)
     }
@@ -95,17 +83,23 @@ export async function install({ profileName = 'web', cli = findDsh(), assetsRoot
         accept: v => Number.isInteger(v.pid) && v.pid > 0 && (!launched || v.pid === launched.pid),
         onWaiting: () => console.log('正在等待 DSH 完成安装准备，请勿重复执行命令…'),
         ensureRunning: async () => {
-          if (launched || await portBusy(Number(process.env.DSH_PORT || 3080))) return
+          if (launched || await portBusy(Number(process.env.DSH_PORT || 3080)) || await mayHaveRunningDsh()) return
+          cli ||= await chooseDsh()
           const log = fs.openSync(path.join(directory, 'startup.log'), 'a', 0o600)
           launched = spawn(process.execPath, [cli, '--profile', profileName, '--no-open'], {
-            cwd: process.cwd(), env: process.env, detached: true, windowsHide: true, stdio: ['ignore', log, log] })
+            cwd: process.cwd(), env: { ...process.env, DSH_HOME: home }, detached: true, windowsHide: true, stdio: ['ignore', log, log] })
           fs.closeSync(log); launched.on('error', () => {}); launched.unref()
         },
       })
+      if (!/^http:\/\/127\.0\.0\.1:[1-9]\d{0,4}$/.test(ref.origin) || Number(new URL(ref.origin).port) > 65535) {
+        ref = undefined
+        throw new Error('DSH 安装握手地址无效，未修改插件。')
+      }
       writePrivateJsonAtomic(path.join(directory, 'handshake.json'), {
         state: 'ready', elapsedMs: Date.now() - handshakeStarted, startedHost: Boolean(launched),
       })
-    } catch {
+    } catch (error) {
+      if (error.code !== 'DSH_HANDSHAKE_TIMEOUT') throw error
       writePrivateJsonAtomic(path.join(directory, 'handshake.json'), {
         state: 'timeout', elapsedMs: Date.now() - handshakeStarted, startedHost: Boolean(launched),
       })
@@ -113,13 +107,16 @@ export async function install({ profileName = 'web', cli = findDsh(), assetsRoot
     }
     job = { controlOrigin: ref.origin, statusToken: token }
     const host = await control(job, 'describe')
-    if (host.home !== home || host.profile !== profile || host.cli !== fs.realpathSync(cli) || (launched && host.pid !== launched.pid)) throw new Error('当前 DSH 身份与安装目标不一致，未修改安装。')
+    // The authenticated live host is authoritative. A global install or cached
+    // version found on PATH must not override the actual npx/local/source host.
+    // Explicit choices and installer-started hosts still require an exact match.
+    assertInstallTarget(host, { home, profile, cli, pid: launched?.pid || ref.pid })
     remove(); remove = undefined
     await sleep(600)
     const selected = await selectRelease(host, assetsRoot, repair)
     if (!selected.archive) { console.log(`插件 ${host.pluginVersion} 无需更新。`); return { version: host.pluginVersion, changed: false } }
     console.log(`正在安装插件 ${selected.release.version}，保留原配对与会话…`)
-    job = { ...host, id, directory, parentPid: host.pid, pnpm: runtime.cli, targetVersion: selected.release.version,
+    job = { ...host, argv: installHostArgv(host), id, directory, parentPid: host.pid, pnpm: runtime.cli, targetVersion: selected.release.version,
       previousVersion: host.pluginVersion, statusToken: token, controlOrigin: ref.origin }
     validateJob(job)
     fs.writeFileSync(path.join(directory, 'release.tgz'), selected.archive, { mode: 0o600, flag: 'wx' })
@@ -156,10 +153,21 @@ export async function install({ profileName = 'web', cli = findDsh(), assetsRoot
     if (locked && !authorized) releaseOwnedUpdateLock(lockFile, id)
   }
 }
+export function parseArguments(args) {
+  const options = {}, seen = new Set()
+  const names = { '--profile': 'profileName', '--dsh-cli': 'cli', '--home': 'home' }
+  for (let i = 0; i < args.length; i++) {
+    const flag = args[i]
+    if (seen.has(flag)) throw new Error('参数重复。使用 --help 查看用法。')
+    seen.add(flag)
+    if (flag === '--repair') options.repair = true
+    else if (names[flag] && args[i + 1] && !args[i + 1].startsWith('--')) options[names[flag]] = args[++i]
+    else throw new Error('不支持的参数。使用 --help 查看用法。')
+  }
+  return options
+}
 if (process.argv[1] && fs.realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  const args = process.argv.slice(2), repair = args.includes('--repair')
-  if (repair) args.splice(args.indexOf('--repair'), 1)
-  if (args.includes('--help') || args.includes('-h')) console.log('安装或升级 DSH 微信连接插件：npx -y dsh-wechat-remote@latest\n可选：--profile <名称>（默认 web）；--repair（重新安装当前兼容版本，不降级）')
-  else if (args.length && !(args.length === 2 && args[0] === '--profile')) { console.error('不支持的参数。使用 --help 查看用法。'); process.exitCode = 1 }
-  else install({ profileName: args[1] || 'web', repair }).catch(error => { console.error(error.message); process.exitCode = 1 })
+  const args = process.argv.slice(2)
+  if (args.includes('--help') || args.includes('-h')) console.log('安装或升级 DSH 微信连接插件：npx -y dsh-wechat-remote@latest\n请先按原来的方式启动 DSH WebUI，支持全局安装与 npx 启动。\n可选：--profile <名称>（默认 web）；--home <DSH 数据目录>；--dsh-cli <DSH 的 lib/bin.js>；--repair（重新安装，不降级）')
+  else Promise.resolve().then(() => install(parseArguments(args))).catch(error => { console.error(error.message); process.exitCode = 1 })
 }

package/lib/update-policy.js

@@ -41,8 +41,17 @@ function validateCatalog(value) {
   if (!c || c.schemaVersion !== 1 || typeof c.revision !== "string" || !/^[\w.-]{1,80}$/.test(c.revision) || !Number.isSafeInteger(c.issuedAt) || !Number.isSafeInteger(c.expiresAt) || c.expiresAt <= c.issuedAt || c.expiresAt - c.issuedAt > 32 * 864e5 || !Array.isArray(c.releases) || c.releases.length > 100 || !Array.isArray(c.blocked) || c.blocked.length > 100 || !strings(c.retiredDsh)) throw new Error("Invalid update catalog");
   const versions = /* @__PURE__ */ new Set();
   for (const r of c.releases) {
-    if (!r || !validVersion(r.version) || versions.has(r.version) || !["stable", "preview"].includes(r.channel) || r.channel === "stable" && versionPattern.exec(r.version)[4] || !strings(r.dsh) || !r.dsh.length || !r.dsh.every(validVersion) || !strings(r.platforms, 3) || !r.platforms.length || !r.platforms.every((p) => ["windows", "macos", "linux"].includes(p)) || !strings(r.architectures, 4) || !r.architectures.length || !r.architectures.every((a) => ["x64", "arm64"].includes(a)) || r.asset && !trustedReleaseAsset(r.asset, r.version)) throw new Error("Invalid release entry");
+    if (!r || !validVersion(r.version) || versions.has(r.version) || !["stable", "preview"].includes(r.channel) || r.channel === "stable" && versionPattern.exec(r.version)[4] || !strings(r.dsh) || !r.dsh.length || !r.dsh.every(validVersion) || !strings(r.platforms, 3) || !r.platforms.length || !r.platforms.every((p) => ["windows", "macos", "linux"].includes(p)) || !strings(r.architectures, 32) || !r.architectures.length || !r.architectures.every((a) => /^[a-z0-9_-]{1,32}$/.test(a)) || r.asset && !trustedReleaseAsset(r.asset, r.version)) throw new Error("Invalid release entry");
     versions.add(r.version);
+    if (r.targets !== void 0) {
+      if (!Array.isArray(r.targets) || !r.targets.length || r.targets.length > 12) throw new Error("Invalid release targets");
+      const seen = /* @__PURE__ */ new Set();
+      for (const target of r.targets) {
+        const key = `${target?.platform}:${target?.arch}`;
+        if (!target || !r.platforms.includes(target.platform) || !r.architectures.includes(target.arch) || !strings(target.dsh) || !target.dsh.length || !target.dsh.every((v) => r.dsh.includes(v)) || seen.has(key)) throw new Error("Invalid release target");
+        seen.add(key);
+      }
+    }
   }
   for (const b of c.blocked) if (!b || !validVersion(b.pluginVersion) || typeof b.reason !== "string" || !b.reason || b.reason.length > 240 || b.dsh && !strings(b.dsh) || b.platforms && !strings(b.platforms, 3)) throw new Error("Invalid blocked entry");
   if (!c.retiredDsh.every(validVersion)) throw new Error("Invalid retired DSH");
@@ -50,7 +59,7 @@ function validateCatalog(value) {
   return c;
 }
 function releaseMatches(r, current) {
-  return r.dsh.includes(current.agentVersion) && r.platforms.includes(current.platform) && (!current.arch || r.architectures.includes(current.arch));
+  return r.dsh.includes(current.agentVersion) && r.platforms.includes(current.platform) && Boolean(current.arch && r.architectures.includes(current.arch)) && (!r.targets || r.targets.some((t) => t.platform === current.platform && (!current.arch || t.arch === current.arch) && t.dsh.includes(current.agentVersion)));
 }
 function assessUpdate(raw, current, now = Date.now(), preview = false) {
   const base = {
@@ -79,23 +88,21 @@ function assessUpdate(raw, current, now = Date.now(), preview = false) {
   const blocked = (version) => c.blocked.find((b) => b.pluginVersion === version && (!b.dsh || b.dsh.includes(current.agentVersion)) && (!b.platforms || b.platforms.includes(current.platform)));
   const own = c.releases.find((r) => r.version === current.pluginVersion);
   const compatible = Boolean(current.arch && own && releaseMatches(own, current) && !blocked(own.version));
-  const target = c.releases.filter((r) => (r.channel === "stable" || preview) && releaseMatches(r, current) && !blocked(r.version) && compareVersions(r.version, current.pluginVersion) > 0).sort((a, b) => compareVersions(b.version, a.version))[0];
+  if (c.retiredDsh.includes(current.agentVersion)) return {
+    ...base,
+    severity: "required",
+    component: "agent",
+    code: "agent-retired",
+    label: "\u9700\u8981\u66F4\u65B0 DSH",
+    message: "\u6B64 DSH \u7248\u672C\u5DF2\u505C\u6B62\u652F\u6301\u3002\u8BF7\u5728\u4E3B\u673A\u4E0A\u6309\u53D1\u5E03\u8BF4\u660E\u5347\u7EA7 DSH\uFF1B\u4E0D\u4F1A\u81EA\u52A8\u4FEE\u6539 DSH\u3002",
+    releaseUrl: `${RELEASE_REPOSITORY}/releases`
+  };
+  const target = c.releases.filter((r) => (r.channel === "stable" || preview) && !blocked(r.version) && compareVersions(r.version, current.pluginVersion) > 0).sort((a, b) => compareVersions(b.version, a.version))[0];
   const issue = blocked(current.pluginVersion);
   if (target) {
     const manual = c.manualUpgradePlugins?.includes(current.pluginVersion) ? {
       manualUpdate: `\u6B64\u65E7\u63D2\u4EF6\u6CA1\u6709\u68C0\u67E5\u66F4\u65B0\u548C\u4E00\u952E\u66F4\u65B0\u529F\u80FD\u3002\u9996\u6B21\u9700\u5728\u8282\u70B9\u6240\u5728\u7535\u8111\uFF0C\u6309\u76EE\u6807\u7248\u672C ${target.version} \u7684\u53D1\u5E03\u8BF4\u660E\u624B\u5DE5\u5347\u7EA7\u63D2\u4EF6\uFF0C\u5E76\u4F7F\u7528\u539F\u6765\u7684 DSH_HOME \u548C profile \u91CD\u542F\u3002\u4E0D\u8981\u5220\u9664\u8282\u70B9\u6216\u91CD\u65B0\u914D\u5BF9\uFF1B\u5347\u7EA7\u540E\u624D\u53EF\u4F7F\u7528\u4E00\u952E\u66F4\u65B0\u3002`
     } : {};
-    if (!current.arch) return {
-      ...base,
-      ...manual,
-      severity: "recommended",
-      component: "plugin",
-      code: "plugin-check-host",
-      label: "\u63D2\u4EF6\u53EF\u66F4\u65B0",
-      message: `\u63D2\u4EF6 ${target.version} \u7684\u7248\u672C\u6761\u4EF6\u4E0E\u5F53\u524D DSH \u5339\u914D\uFF0C\u4F46\u65E7\u8282\u70B9\u672A\u4E0A\u62A5\u4E3B\u673A\u67B6\u6784\u3002\u8BF7\u5230\u6B64\u4E3B\u673A WebUI \u68C0\u67E5\u786E\u8BA4\u540E\u66F4\u65B0\u63D2\u4EF6\uFF1B\u65E0\u9700\u5148\u66F4\u65B0 DSH\u3002`,
-      targetVersion: target.version,
-      releaseUrl: `${RELEASE_REPOSITORY}/releases/tag/v${target.version}`
-    };
     const required = Boolean(issue);
     return {
       ...base,
@@ -104,7 +111,7 @@ function assessUpdate(raw, current, now = Date.now(), preview = false) {
       component: "plugin",
       code: required ? "plugin-required" : "plugin-available",
       label: required ? "\u5FC5\u987B\u66F4\u65B0\u63D2\u4EF6" : "\u63D2\u4EF6\u53EF\u66F4\u65B0",
-      message: (issue?.reason || (required ? "\u5F53\u524D\u63D2\u4EF6\u4E0D\u5728\u6B64 DSH / \u4E3B\u673A\u7EC4\u5408\u7684\u652F\u6301\u8303\u56F4\u5185\u3002" : compatible ? "\u5F53\u524D\u7EC4\u5408\u53D7\u652F\u6301\u3002" : "\u5F53\u524D\u63D2\u4EF6\u7EC4\u5408\u5C1A\u672A\u9A8C\u8BC1\u3002")) + `\u63D2\u4EF6 ${target.version} \u5DF2\u652F\u6301\u5F53\u524D DSH\uFF1B\u4EC5\u66F4\u65B0\u63D2\u4EF6\uFF0C\u65E0\u9700\u66F4\u65B0 DSH\u3002`,
+      message: (issue ? issue.reason + "\u3002" : "") + `\u53EF\u66F4\u65B0\u81F3\u63D2\u4EF6 ${target.version}\uFF1B\u66F4\u65B0\u524D\u4F1A\u68C0\u67E5\u5F53\u524D\u4E3B\u673A\u7684\u5B89\u88C5\u4E0E\u91CD\u542F\u6761\u4EF6\uFF0C\u4E0D\u4F1A\u66F4\u6362 DSH \u672C\u4F53\u3002`,
       targetVersion: target.version,
       releaseUrl: `${RELEASE_REPOSITORY}/releases/tag/v${target.version}`
     };
@@ -119,20 +126,12 @@ function assessUpdate(raw, current, now = Date.now(), preview = false) {
     releaseUrl: `${RELEASE_REPOSITORY}/releases`
   };
   if (compatible) return { ...base, severity: "none", code: "compatible", label: "\u6682\u65E0\u53EF\u7528\u66F4\u65B0", message: "\u5F53\u524D\u7EC4\u5408\u5DF2\u9A8C\u8BC1\uFF0C\u6682\u672A\u53D1\u73B0\u9002\u7528\u4E8E\u6B64 DSH \u548C\u4E3B\u673A\u7684\u66F4\u65B0\u3002" };
-  if (c.retiredDsh.includes(current.agentVersion)) return {
-    ...base,
-    severity: "required",
-    component: "agent",
-    code: "agent-retired",
-    label: "\u9700\u8981\u66F4\u65B0 DSH",
-    message: "\u6B64 DSH \u7248\u672C\u5DF2\u505C\u6B62\u652F\u6301\u3002\u8BF7\u5728\u4E3B\u673A\u4E0A\u6309\u517C\u5BB9\u53D1\u5E03\u8BF4\u660E\u5347\u7EA7 DSH \u548C\u8FDE\u63A5\u63D2\u4EF6\uFF1B\u4E0D\u4F1A\u81EA\u52A8\u4FEE\u6539 DSH\u3002",
-    releaseUrl: `${RELEASE_REPOSITORY}/releases`
-  };
   return {
     ...base,
-    code: "unverified",
-    label: "\u517C\u5BB9\u6027\u5F85\u786E\u8BA4",
-    message: "\u6CA1\u6709\u8DB3\u591F\u7684\u517C\u5BB9\u8BC1\u636E\u6216\u5339\u914D\u7684\u6B63\u5F0F\u66F4\u65B0\u3002\u8FD9\u4E0D\u7B49\u4E8E\u8282\u70B9\u79BB\u7EBF\uFF0C\u4E5F\u4E0D\u8868\u793A\u5FC5\u987B\u5347\u7EA7\u6216\u964D\u7EA7 DSH\u3002",
+    severity: "none",
+    code: "no-update",
+    label: "\u6682\u65E0\u53EF\u7528\u66F4\u65B0",
+    message: "\u5F53\u524D\u901A\u9053\u6682\u65E0\u66F4\u9AD8\u7248\u672C\uFF0C\u4E0D\u5F71\u54CD\u7EE7\u7EED\u4F7F\u7528\u3002",
     releaseUrl: `${RELEASE_REPOSITORY}/releases`
   };
 }

package/lib/update-worker.js

@@ -416,7 +416,7 @@ async function stopOriginal(job) {
   }
   throw new Error("\u539F DSH \u5C1A\u672A\u7ED3\u675F\uFF0C\u672A\u66FF\u6362\u63D2\u4EF6");
 }
-async function stopRestarted(child, timeoutMs = 3e4) {
+async function stopRestarted(child, timeoutMs = 3e4, forceTimeoutMs = 5e3) {
   if (child.exitCode !== null || child.signalCode !== null) return;
   child.kill("SIGTERM");
   const deadline = Date.now() + timeoutMs;
@@ -425,8 +425,54 @@ async function stopRestarted(child, timeoutMs = 3e4) {
     await wait(Math.min(100, Math.max(1, deadline - Date.now())));
   }
   if (child.exitCode !== null || child.signalCode !== null) return;
+  child.kill("SIGKILL");
+  const forcedDeadline = Date.now() + forceTimeoutMs;
+  while (Date.now() < forcedDeadline) {
+    if (child.exitCode !== null || child.signalCode !== null) return;
+    await wait(Math.min(100, Math.max(1, forcedDeadline - Date.now())));
+  }
+  if (child.exitCode !== null || child.signalCode !== null) return;
   throw new Error("\u66F4\u65B0\u540E\u7684 DSH \u672A\u6309\u65F6\u505C\u6B62");
 }
+function captureCandidateLock(home, child) {
+  if (!child.pid || child.exitCode !== null || child.signalCode !== null) return;
+  const filename = path3.join(home, ".credentials.yaml.lock");
+  try {
+    const info = fs3.lstatSync(filename);
+    if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || info.size > 32) return;
+    const value = fs3.readFileSync(filename, "utf8");
+    let owned = value === `${child.pid}
+`;
+    if (!owned && value === "" && process.platform === "linux") {
+      const directory = `/proc/${child.pid}/fd`;
+      owned = fs3.readdirSync(directory).some((fd) => {
+        try {
+          const file = path3.join(directory, fd);
+          if (fs3.readlinkSync(file) !== filename) return false;
+          const opened = fs3.statSync(file);
+          return opened.dev === info.dev && opened.ino === info.ino;
+        } catch {
+          return false;
+        }
+      });
+    }
+    if (owned) return { filename, dev: info.dev, ino: info.ino, pid: child.pid };
+  } catch {
+  }
+}
+function retireCandidateLock(lock, child, directory) {
+  if (!lock || child.pid !== lock.pid || child.exitCode === null && child.signalCode === null) return;
+  try {
+    const info = fs3.lstatSync(lock.filename);
+    if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || info.dev !== lock.dev || info.ino !== lock.ino || info.size > 32) return;
+    const value = fs3.readFileSync(lock.filename, "utf8");
+    if (value !== "" && value !== `${lock.pid}
+`) return;
+    const saved = path3.join(directory, "candidate-credentials-lock.before-rollback");
+    if (!fs3.existsSync(saved)) fs3.renameSync(lock.filename, saved);
+  } catch {
+  }
+}
 async function stopChild(pid) {
   process.kill(pid, "SIGTERM");
   for (let i = 0; i < 100; i++) {
@@ -524,8 +570,11 @@ async function executeUpdate(job, progress, quiesce) {
           await stopOriginal(job);
           stopped = true;
         }
-        if (newChild) await stopRestarted(newChild);
-        else if (swapped && job.manager && job.manager.kind !== "process") stopManagedHost(job.manager);
+        if (newChild) {
+          const ownedLock = captureCandidateLock(job.home, newChild);
+          await stopRestarted(newChild);
+          retireCandidateLock(ownedLock, newChild, job.directory);
+        } else if (swapped && job.manager && job.manager.kind !== "process") stopManagedHost(job.manager);
         if (swapped) {
           fs3.renameSync(job.profile, path3.join(job.directory, "profile-failed"));
           fs3.renameSync(previous, job.profile);
@@ -679,11 +728,13 @@ if (process.argv[1] && path3.resolve(process.argv[1]) === fileURLToPath(import.m
   });
 }
 export {
+  captureCandidateLock,
   control,
   executeUpdate,
   healthy,
   migrateLegacyGrantOwner,
   releaseOwnedUpdateLock,
+  retireCandidateLock,
   stopRestarted,
   validateJob
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-wechat-remote",
-  "version": "1.7.5",
+  "version": "1.7.6",
   "private": false,
   "description": "Agent远程管理助手：DSH 微信连接插件的一键安装与升级",
   "type": "module",