dsh-wechat-remote 1.7.8 → 1.7.10

package/README.md

@@ -1,6 +1,6 @@
 # Agent远程管理助手 · DSH 插件安装器
 
-当前版本为 `1.7.8`，内嵌同版本正式插件。
+当前版本为 `1.7.9`，内嵌同版本正式插件。
 
 首次安装和升级旧插件使用同一个命令：
 
@@ -8,20 +8,22 @@
 npx -y dsh-wechat-remote@latest
 ```
 
-在与 DSH 相同的系统用户下运行即可。无需改成全局安装 DSH；使用 `npx @deepseek-ai/dsh web` 的用户也使用同一条安装命令。需要 Node.js 22.13 或更高版本，无需另装 pnpm 或 Git。Windows CMD / PowerShell 推荐使用 `npx.cmd -y dsh-wechat-remote@latest`，不必修改脚本执行策略。
+在与 DSH 相同的系统用户下运行即可。无需改成全局安装 DSH；使用 `npx @deepseek-ai/dsh web` 的用户也使用同一条安装命令。需要 Node.js 22.13 或更高版本，无需另装 pnpm 或 Git。Windows CMD / PowerShell 推荐使用 `npx.cmd -y dsh-wechat-remote@latest`，不必修改脚本执行策略。
 
-安装器保留原配置、配对和会话，不会升级 DSH 本体。请先结束运行中的任务；安装完成后自动重启原 DSH 并尝试打开 WebUI。DSH 已关闭时会尝试启动；若启动失败，按提示查看启动日志，不要删除原有数据。
+安装器保留原配置、配对和会话，不会升级 DSH 本体。请先结束运行中的任务；安装完成后自动重启原 DSH 并尝试打开 WebUI。DSH 已关闭时会尝试启动；若启动失败，按提示查看启动日志，不要删除原有数据。
 
 DSH 的新版本、预览版本或未登记的主机架构不会仅因缺少验证记录而被拒绝安装。安装器仍检查必要运行能力、安装包完整性和已知不兼容问题，并保留失败恢复所需的备份；无法确认恢复结果时会提示保留数据。这不代表所有宿主组合均已通过功能验证。
 
-本版沿用此前已验证的跨平台安装方案，具体发行包与宿主组合以验收记录为准。普通 Node 启动、独立的 macOS launchd 和 Linux 用户级 systemd 服务有对应的自动恢复方式；无法确认启动方式时不自动停止主机。
+本版沿用此前已验证的跨平台安装方案，具体发行包与宿主组合以验收记录为准。普通 Node 启动、独立的 macOS launchd 和 Linux 用户级 systemd 服务有对应的自动恢复方式；无法确认启动方式时不自动停止主机。
 
-另已在 ARM64 Linux 电视盒子上验证 DSH `0.1.5-rc.1` 的首次安装、重复执行及重装。1.7.4 改善较慢主机启动时被误判为安装超时的问题；安装过程中请等待完成，勿重复执行命令。
+安装过程中请等待完成，勿重复执行命令。
+
+本版安装器内置完整插件，安装当前版本不依赖 GitHub 附件下载。安装后，WebUI 一键更新在 GitHub 网络下载失败时可以从已核验的 npm 安装包中取回同一插件。该能力不回写旧插件；旧插件遇到 GitHub 下载失败时，先使用上面的 npm 命令升级即可。
 
 旧插件的一键更新如被版本或架构判断拦截，可用上述安装命令升级一次。从插件 1.7.6 起，未登记的 CPU 架构或 DSH 版本不再影响更新入口；执行前仍会检查实际安装与重启条件，无需因此降低 DSH 版本或删除节点。
 
 默认使用 `web` 配置和原来的 DSH 数据目录。自定义数据目录时，在新终端设置相同的 `DSH_HOME`，或附加 `--home "数据目录"`；使用其他配置时附加 `--profile 配置名称`。WSL、容器和其他系统用户内的 DSH，需要在对应环境中执行安装，不能跨环境替换。
 
-DSH 正在运行时，优先连接它自己的安装接口；未运行时，优先使用当前终端默认的 DSH，再检查全局、当前项目和 NPX 缓存。只有存在多份缓存且没有默认选择时才询问。也可用 `--dsh-cli "DSH的lib/bin.js路径"` 明确指定。
-
-已运行的同版本插件卡在更新验证、尚未就绪时，重新执行命令会尝试修复。DSH 已退出或怀疑插件文件损坏时，附加 `--repair` 主动重装，不会自动降级。宿主本体或其他插件的故障仍可能需要另行处理；安装日志会保留，不必先删除会话或重新配对。
+DSH 正在运行时，优先连接它自己的安装接口；未运行时，优先使用当前终端默认的 DSH，再检查全局、当前项目和 NPX 缓存。只有存在多份缓存且没有默认选择时才询问。也可用 `--dsh-cli "DSH的lib/bin.js路径"` 明确指定。
+
+已运行的同版本插件卡在更新验证、尚未就绪时，重新执行命令会尝试修复。DSH 已退出或怀疑插件文件损坏时，附加 `--repair` 主动重装，不会自动降级。宿主本体或其他插件的故障仍可能需要另行处理；安装日志会保留，不必先删除会话或重新配对。

package/assets/release.json

@@ -1,19 +1,19 @@
 {
-  "version": "1.7.8",
+  "version": "1.7.10",
   "catalog": {
     "schemaVersion": 1,
-    "revision": "installer-1.7.8",
-    "issuedAt": 1789590295076,
-    "expiresAt": 1792009495076,
+    "revision": "installer-1.7.10",
+    "issuedAt": 1790187001683,
+    "expiresAt": 1792606201683,
     "releases": [
       {
-        "version": "1.7.8",
+        "version": "1.7.10",
         "channel": "stable",
         "dsh": [
-          "0.1.5-rc.1"
+          "0.1.5-rc.1",
+          "0.1.7-rc.1"
         ],
         "platforms": [
-          "windows",
           "macos",
           "linux"
         ],
@@ -21,10 +21,27 @@
           "x64"
         ],
         "asset": {
-          "url": "https://github.com/martinbear1/dsh-wechat-remote/releases/download/v1.7.8/harness-remote-dsh-wechat-remote-1.7.8.tgz",
-          "sha256": "bcadaf80e8a2dff008b421870bb42cad89d490178104df1f4d9103aa03cd62a6",
-          "bytes": 9554570
-        }
+          "url": "https://github.com/martinbear1/dsh-wechat-remote/releases/download/v1.7.10/harness-remote-dsh-wechat-remote-1.7.10.tgz",
+          "sha256": "f146d61eb8f301012d5c52da82efb469a38e46d27a6f16d128b546b68650d48e",
+          "bytes": 10362228
+        },
+        "targets": [
+          {
+            "platform": "macos",
+            "arch": "x64",
+            "dsh": [
+              "0.1.5-rc.1",
+              "0.1.7-rc.1"
+            ]
+          },
+          {
+            "platform": "linux",
+            "arch": "x64",
+            "dsh": [
+              "0.1.5-rc.1"
+            ]
+          }
+        ]
       }
     ],
     "blocked": [],

package/bin/dsh-discovery.mjs

@@ -10,8 +10,8 @@ import { createInterface } from 'node:readline/promises'
 
 const execute = promisify(execFile)
 const PACKAGE = '@deepseek-ai/dsh'
-const clean = value => String(value).replace(/[\x00-\x1f\x7f-\x9f]/g, '')
-const environmentPath = env => env[Object.keys(env).find(key => key.toLowerCase() === 'path')] || ''
+const clean = value => String(value).replace(/[\x00-\x1f\x7f-\x9f]/g, '')
+const environmentPath = env => env[Object.keys(env).find(key => key.toLowerCase() === 'path')] || ''
 
 export function validateDshCli(filename) {
   const cli = fs.realpathSync(path.resolve(filename))
@@ -37,7 +37,7 @@ export function resolveHome(value, fallback = os.homedir()) {
 async function npmLocation(key, env, cwd) {
   let npm = env.npm_execpath
   if (!npm || !fs.existsSync(npm)) {
-    const roots = [path.dirname(process.execPath), ...environmentPath(env).split(path.delimiter)]
+    const roots = [path.dirname(process.execPath), ...environmentPath(env).split(path.delimiter)]
     npm = roots.flatMap(dir => [path.join(dir, 'node_modules/npm/bin/npm-cli.js'),
       path.join(dir, '../lib/node_modules/npm/bin/npm-cli.js')]).find(file => fs.existsSync(file))
   }
@@ -59,7 +59,7 @@ export async function discoverDsh({ env = process.env, cwd = process.cwd(), cach
       if (!found.has(item.cli)) found.set(item.cli, { ...item, source })
     } catch { /* A missing/broken cache entry is not a usable DSH. */ }
   }
-  for (const dir of environmentPath(env).split(path.delimiter).filter(Boolean)) {
+  for (const dir of environmentPath(env).split(path.delimiter).filter(Boolean)) {
     add(path.join(dir, 'dsh'), 'PATH') // POSIX symlink, never execute a Windows shim.
     add(path.join(dir, 'node_modules/@deepseek-ai/dsh/lib/bin.js'), 'PATH')
     add(path.join(dir, '../lib/node_modules/@deepseek-ai/dsh/lib/bin.js'), 'PATH')
@@ -81,9 +81,9 @@ export async function discoverDsh({ env = process.env, cwd = process.cwd(), cach
     add(path.join(locations[1], 'lib/node_modules/@deepseek-ai/dsh/lib/bin.js'), 'npm-global')
   }
   const cacheRoot = locations[0]
-  // Cached NPX versions cannot supersede a normal default executable. Avoid
-  // probing a large/unreadable cache when the terminal already has that default.
-  if (cacheRoot && found.size === 0) {
+  // Cached NPX versions cannot supersede a normal default executable. Avoid
+  // probing a large/unreadable cache when the terminal already has that default.
+  if (cacheRoot && found.size === 0) {
     try {
       const entries = fs.readdirSync(path.join(cacheRoot, '_npx'), { withFileTypes: true })
       if (entries.length > 512) throw new Error('npx 缓存较多，请先启动要使用的 DSH，再运行安装命令。')
@@ -97,17 +97,17 @@ export async function discoverDsh({ env = process.env, cwd = process.cwd(), cach
 
 export async function chooseDsh(options = {}) {
   if (options.cli) return validateDshCli(options.cli).cli
-  const candidates = await discoverDsh(options)
-  if (!candidates.length) throw new Error('未找到 DSH。请先按原来的方式启动 DSH WebUI，再运行本命令。')
-  // A stopped host has no handshake yet. Follow the terminal's ordinary DSH
-  // resolution before consulting old NPX cache entries; no version sorting or
-  // downloading. This fallback never overrides an already running host.
-  const normal = candidates.find(item => item.source === 'PATH')
-    || candidates.find(item => item.source === 'npm-global')
-    || candidates.find(item => item.source === 'project' || item.source === 'source')
-  if (normal) return normal.cli
-  if (candidates.length === 1) return candidates[0].cli
-  // Multiple cache-only versions are not evidence of the user's choice.
+  const candidates = await discoverDsh(options)
+  if (!candidates.length) throw new Error('未找到 DSH。请先按原来的方式启动 DSH WebUI，再运行本命令。')
+  // A stopped host has no handshake yet. Follow the terminal's ordinary DSH
+  // resolution before consulting old NPX cache entries; no version sorting or
+  // downloading. This fallback never overrides an already running host.
+  const normal = candidates.find(item => item.source === 'PATH')
+    || candidates.find(item => item.source === 'npm-global')
+    || candidates.find(item => item.source === 'project' || item.source === 'source')
+  if (normal) return normal.cli
+  if (candidates.length === 1) return candidates[0].cli
+  // Multiple cache-only versions are not evidence of the user's choice.
   // A live host normally bypasses this fallback via its native handshake.
   const prompt = options.prompt || (process.stdin.isTTY && process.stdout.isTTY ? async message => {
     const rl = createInterface({ input: process.stdin, output: process.stdout })

package/bin/native-recovery.mjs

@@ -1,44 +1,44 @@
-/** Verify a restored, plugin-free DSH through the same native control adapter.
- * Only the first-install rollback uses this; ordinary updates probe the plugin.
- * Bundled outside the profile so neither a failed add nor rollback removes it. */
-import fs from 'node:fs'
-import path from 'node:path'
-import { randomBytes } from 'node:crypto'
-import { attachControl, waitForJson } from './native-control.mjs'
-
-export async function verifyNativeRestore(job, start, sessionIds, readableIds) {
-  const directory = path.join(job.home, 'harness-remote-updates', randomBytes(16).toString('hex'))
-  fs.mkdirSync(directory, { mode: 0o700 })
-  fs.writeFileSync(path.join(directory, 'package.json'), '{"type":"module"}\n', { mode: 0o600 })
-  const helper = path.join(directory, 'install-control.js'), token = randomBytes(24).toString('hex')
-  fs.copyFileSync(path.join(job.directory, 'install-control.js'), helper)
-  const remove = attachControl(job.profile, helper, { directory, token, pnpm: job.pnpm })
-  let ref
-  const request = async (method, payload = {}) => {
-    const response = await fetch(ref.origin + '/' + method, { method: 'POST', headers: {
-      authorization: `Bearer ${token}`, 'content-type': 'application/json',
-    }, body: JSON.stringify(payload), redirect: 'error', signal: AbortSignal.timeout(12000) })
-    const value = await response.json()
-    if (!response.ok) throw new Error('原 DSH 恢复检查未通过。')
-    return value
-  }
-  try {
-    const child = start()
-    ref = await waitForJson(path.join(directory, 'control-ready.json'), value =>
-      Number.isInteger(value.pid) && value.pid > 0 && (!child || value.pid === child.pid)
-      && /^http:\/\/127\.0\.0\.1:[1-9]\d{0,4}$/.test(value.origin), 180000)
-    const host = await request('describe')
-    if (host.pid !== ref.pid || host.home !== job.home || host.profile !== job.profile
-      || host.cli !== job.cli || host.dshVersion !== job.dshVersion || host.pluginVersion !== '0.0.0') {
-      throw new Error('恢复后的 DSH 身份不匹配。')
-    }
-    const items = (await request('read', { method: 'session.list' })).items
-    if (!Array.isArray(items) || JSON.stringify(items.map(s => s.sessionId).sort()) !== JSON.stringify(sessionIds)) {
-      throw new Error('恢复后的会话列表不一致。')
-    }
-    for (const sessionId of readableIds) await request('read', { method: 'session.history', payload: { sessionId, maxMessages: 1 } })
-  } finally {
-    try { remove() }
-    finally { if (ref) { try { await request('close') } catch {} } }
-  }
-}
+/** Verify a restored DSH through the same independent native control adapter.
+ * Also supports restoring an already-broken plugin, without claiming it is fixed.
+ * Bundled outside the profile so neither a failed add nor rollback removes it. */
+import fs from 'node:fs'
+import path from 'node:path'
+import { randomBytes } from 'node:crypto'
+import { attachControl, waitForJson } from './native-control.mjs'
+
+export async function verifyNativeRestore(job, start, sessionIds, readableIds) {
+  const directory = path.join(job.home, 'harness-remote-updates', randomBytes(16).toString('hex'))
+  fs.mkdirSync(directory, { mode: 0o700 })
+  fs.writeFileSync(path.join(directory, 'package.json'), '{"type":"module"}\n', { mode: 0o600 })
+  const helper = path.join(directory, 'install-control.js'), token = randomBytes(24).toString('hex')
+  fs.copyFileSync(path.join(job.directory, 'install-control.js'), helper)
+  const remove = attachControl(job.profile, helper, { directory, token, pnpm: job.pnpm })
+  let ref
+  const request = async (method, payload = {}) => {
+    const response = await fetch(ref.origin + '/' + method, { method: 'POST', headers: {
+      authorization: `Bearer ${token}`, 'content-type': 'application/json',
+    }, body: JSON.stringify(payload), redirect: 'error', signal: AbortSignal.timeout(12000) })
+    const value = await response.json()
+    if (!response.ok) throw new Error('原 DSH 恢复检查未通过。')
+    return value
+  }
+  try {
+    const child = start()
+    ref = await waitForJson(path.join(directory, 'control-ready.json'), value =>
+      Number.isInteger(value.pid) && value.pid > 0 && (!child || value.pid === child.pid)
+      && /^http:\/\/127\.0\.0\.1:[1-9]\d{0,4}$/.test(value.origin), 180000)
+    const host = await request('describe')
+    if (host.pid !== ref.pid || host.home !== job.home || host.profile !== job.profile
+      || host.cli !== job.cli || host.dshVersion !== job.dshVersion || host.pluginVersion !== job.previousVersion) {
+      throw new Error('恢复后的 DSH 身份不匹配。')
+    }
+    const items = (await request('read', { method: 'session.list' })).items
+    if (!Array.isArray(items) || JSON.stringify(items.map(s => s.sessionId).sort()) !== JSON.stringify(sessionIds)) {
+      throw new Error('恢复后的会话列表不一致。')
+    }
+    for (const sessionId of readableIds) await request('read', { method: 'session.history', payload: { sessionId, maxMessages: 1 } })
+  } finally {
+    try { remove() }
+    finally { if (ref) { try { await request('close') } catch {} } }
+  }
+}

package/bin/release-selection.mjs

@@ -4,7 +4,7 @@ import { validateCatalog, compareVersions, trustedReleaseAsset } from '../lib/up
  * Tested DSH/platform/architecture lists describe evidence, not admission.
  * Keep trusted artifacts, explicit withdrawals and the no-downgrade floor.
  */
-export function selectInstallTarget(pinned, remote, current, now = Date.now()) {
+export function selectInstallTarget(pinned, remote, current, now = Date.now(), bundledOnly = false) {
   const local = validateCatalog(pinned.catalog)
   // Choosing an explicit prerelease installer authorizes its exact embedded
   // preview, not arbitrary remote previews or a change to stable recommendations.
@@ -21,7 +21,7 @@ export function selectInstallTarget(pinned, remote, current, now = Date.now()) {
 
   // An installer never silently substitutes an older plugin than its own bundle.
   // Keep the bundled bytes/hash for the same version even if remote metadata differs.
-  const candidates = [bundled, ...(online?.releases || []).filter(r => r.channel === 'stable'
+  const candidates = [bundled, ...(bundledOnly ? [] : online?.releases || []).filter(r => r.channel === 'stable'
     && compareVersions(r.version, bundled.version) > 0 && trustedReleaseAsset(r.asset, r.version))]
     .sort((a, b) => compareVersions(b.version, a.version))
   const rules = [...local.blocked, ...(online?.blocked || [])]

package/bin/setup.mjs

@@ -6,11 +6,11 @@ import { spawn } from 'node:child_process'
 import { randomBytes, createHash } from 'node:crypto'
 import { fileURLToPath } from 'node:url'
 import { attachControl, waitForJson, waitForInstallControl } from './native-control.mjs'
-import { resolveInstallRuntime, verifyInstallRuntime } from '../lib/install-runtime.js'
-import { installProfile, backupProfile, NativeInstallError } from '../lib/install-profile.js'
+import { resolveInstallRuntime, verifyInstallRuntime } from '../lib/install-runtime.js'
+import { installProfile, backupProfile, NativeInstallError } from '../lib/install-profile.js'
 import { compareVersions } from '../lib/update-policy.js'
 import { selectInstallTarget } from './release-selection.mjs'
-import { boundedFetch, downloadRelease, auditArchive } from '../lib/update-download.js'
+import { boundedFetch, downloadRelease, auditArchive, DownloadUnavailableError } from '../lib/update-download.js'
 import { writePrivateJsonAtomic } from '../lib/secure-file.js'
 import { control, validateJob, releaseOwnedUpdateLock } from '../lib/update-worker.js'
 import { chooseDsh, validateDshCli, resolveHome, mayHaveRunningDsh, assertInstallTarget, installHostArgv } from './dsh-discovery.mjs'
@@ -25,8 +25,8 @@ function portBusy(port) {
     socket.setTimeout(500, () => end(false)); socket.once('connect', () => end(true)); socket.once('error', () => end(false))
   })
 }
-export async function selectRelease(host, assetsRoot = path.join(root, 'assets'), repair = false,
-  fetchCatalog = () => boundedFetch('https://relay.xyxfood.xyz/v1/update-policy', 256 * 1024)) {
+export async function selectRelease(host, assetsRoot = path.join(root, 'assets'), repair = false,
+  fetchCatalog = () => boundedFetch('https://relay.xyxfood.xyz/v1/update-policy', 256 * 1024), fetchPackage = fetch) {
   const current = { agentKind: 'dsh', agentVersion: host.dshVersion, pluginVersion: host.pluginVersion,
     platform: { win32: 'windows', darwin: 'macos', linux: 'linux' }[host.platform], arch: host.arch }
   const pinned = JSON.parse(fs.readFileSync(path.join(assetsRoot, 'release.json'), 'utf8'))
@@ -34,64 +34,83 @@ export async function selectRelease(host, assetsRoot = path.join(root, 'assets')
   try {
     remote = JSON.parse((await fetchCatalog()).toString('utf8'))
   } catch { /* Authenticated npm package retains its bundled release. */ }
-  const release = selectInstallTarget(pinned, remote, current)
+  const selectionTime = Date.now()
+  let release = selectInstallTarget(pinned, remote, current, selectionTime)
   if (host.pluginVersion !== '0.0.0' && (compareVersions(host.pluginVersion, release.version) > 0
     || (compareVersions(host.pluginVersion, release.version) === 0 && !repair))) return { release, archive: null }
   let archive
   if (release.version === pinned.version) archive = fs.readFileSync(path.join(assetsRoot, 'plugin.tgz'))
-  else archive = await downloadRelease(release)
+  else {
+    try { archive = await downloadRelease(release, fetchPackage) }
+    catch (error) {
+      if (!(error instanceof DownloadUnavailableError)) throw error
+      // Keep BOTH local and valid online withdrawals when falling back. Dropping
+      // the catalog here would accidentally reinstall a known-broken bundle.
+      // Retain rules accepted at selection even if their catalog expires while
+      // a slow download is in flight; expiry must not erase a known withdrawal.
+      const bundled = selectInstallTarget(pinned, remote, current, selectionTime, true)
+      if (host.pluginVersion !== '0.0.0' && compareVersions(host.pluginVersion, bundled.version) > 0) throw error
+      release = bundled
+      console.log(`较新版本暂时无法下载，使用安装器内置的 ${release.version}；未升级到线上最新版本。`)
+      if (host.pluginVersion === release.version && !repair) return { release, archive: null }
+      archive = fs.readFileSync(path.join(assetsRoot, 'plugin.tgz'))
+    }
+  }
   auditArchive(archive, release)
-  return { release, archive }
-}
-
-/** With no running host, native plugin add needs neither HMR nor healthy third-
- * party plugins. Reuse the same installation core; only live hosts need disposal. */
-async function installStopped({ cli, home, profile, profileName, directory, id, runtime, assetsRoot, repair, open }) {
-  const dsh = validateDshCli(cli)
-  let version = '0.0.0'
-  try { version = JSON.parse(fs.readFileSync(path.join(profile, 'node_modules', packageName, 'package.json'), 'utf8')).version } catch {}
-  const selected = await selectRelease({ dshVersion: dsh.version, pluginVersion: version, platform: process.platform, arch: process.arch }, assetsRoot, repair)
-  fs.mkdirSync(profile, { recursive: true, mode: 0o700 })
-  if (fs.realpathSync(profile) !== profile) throw new Error('无法确认 DSH 配置目录的实际位置。')
-  const lock = path.join(profile, '.harness-remote-update.lock')
-  const fd = fs.openSync(lock, 'wx', 0o600); fs.writeFileSync(fd, id); fs.closeSync(fd)
-  let modified = false, keepLock = false
-  try {
-    // Recheck immediately before writing: a host may have started during npm
-    // discovery/download. Never mutate its dependencies underneath that process.
-    if (await mayHaveRunningDsh()) throw new Error('DSH 已开始运行，请重新执行安装命令以连接该实例。')
-    if (selected.archive) {
-      fs.writeFileSync(path.join(directory, 'release.tgz'), selected.archive, { mode: 0o600, flag: 'wx' })
-      backupProfile(profile, path.join(directory, 'profile-before'))
-      console.log(`正在通过 DSH 原生方式安装插件 ${selected.release.version}…`)
-      modified = true
-      await installProfile({ profile, directory, cli: dsh.cli, targetVersion: selected.release.version, runtime })
-    }
-  } catch (error) {
-    keepLock = error instanceof NativeInstallError && error.mayStillBeRunning
-    if (modified && !keepLock) {
-      fs.renameSync(profile, path.join(directory, 'profile-failed'))
-      fs.renameSync(path.join(directory, 'profile-before'), profile)
-    }
-    throw error
-  } finally { if (!keepLock) releaseOwnedUpdateLock(lock, id) }
-  // Use DSH's own browser opening behavior. Startup failure does not undo an
-  // otherwise successful native add; an unrelated plugin can fail to boot.
-  const logFile = path.join(directory, 'startup.log'), log = fs.openSync(logFile, 'a', 0o600)
-  const env = { ...process.env, DSH_HOME: home }
-  delete env.HARNESS_REMOTE_UPDATE_JOB
-  const child = spawn(process.execPath, [dsh.cli, '--profile', profileName, ...(open ? [] : ['--no-open'])],
-    { cwd: process.cwd(), env, detached: true, windowsHide: true, stdio: ['ignore', log, log] })
-  fs.closeSync(log)
-  let launchError
-  child.on('error', error => { launchError = error }); child.unref()
-  await sleep(1200)
-  const starting = !launchError && child.pid && child.exitCode === null && child.signalCode === null
-  const installedVersion = selected.archive ? selected.release.version : version
-  console.log(`插件 ${installedVersion} 已安装。${starting ? '已启动 DSH，请等待 WebUI 就绪。' : `DSH 未能启动，请查看：${logFile}`}`)
-  return { version: installedVersion, changed: Boolean(selected.archive), starting: Boolean(starting) }
-}
-export async function install({ profileName = 'web', cli, home: configuredHome, assetsRoot, open = true, repair = false } = {}) {
+  return { release, archive }
+}
+
+/** With no running host, native plugin add needs neither HMR nor healthy third-
+ * party plugins. Reuse the same installation core; only live hosts need disposal. */
+async function installStopped({ cli, home, profile, profileName, directory, id, runtime, assetsRoot, repair, open }) {
+  const dsh = validateDshCli(cli)
+  let version = '0.0.0'
+  try { version = JSON.parse(fs.readFileSync(path.join(profile, 'node_modules', packageName, 'package.json'), 'utf8')).version } catch {}
+  // A stopped host cannot prove its installed copy is loadable. Re-executing
+  // the normal installation command also repairs that copy (never downgrades),
+  // using the same backed-up native add rather than a second repair workflow.
+  const selected = await selectRelease({ dshVersion: dsh.version, pluginVersion: version, platform: process.platform, arch: process.arch }, assetsRoot, repair || version !== '0.0.0')
+  fs.mkdirSync(profile, { recursive: true, mode: 0o700 })
+  if (fs.realpathSync(profile) !== profile) throw new Error('无法确认 DSH 配置目录的实际位置。')
+  const lock = path.join(profile, '.harness-remote-update.lock')
+  const fd = fs.openSync(lock, 'wx', 0o600); fs.writeFileSync(fd, id); fs.closeSync(fd)
+  let modified = false, keepLock = false
+  try {
+    // Recheck immediately before writing: a host may have started during npm
+    // discovery/download. Never mutate its dependencies underneath that process.
+    if (await mayHaveRunningDsh()) throw new Error('DSH 已开始运行，请重新执行安装命令以连接该实例。')
+    if (selected.archive) {
+      fs.writeFileSync(path.join(directory, 'release.tgz'), selected.archive, { mode: 0o600, flag: 'wx' })
+      backupProfile(profile, path.join(directory, 'profile-before'))
+      console.log(`正在通过 DSH 原生方式安装插件 ${selected.release.version}…`)
+      modified = true
+      await installProfile({ profile, directory, cli: dsh.cli, targetVersion: selected.release.version, runtime })
+    }
+  } catch (error) {
+    keepLock = error instanceof NativeInstallError && error.mayStillBeRunning
+    if (modified && !keepLock) {
+      fs.renameSync(profile, path.join(directory, 'profile-failed'))
+      fs.renameSync(path.join(directory, 'profile-before'), profile)
+    }
+    throw error
+  } finally { if (!keepLock) releaseOwnedUpdateLock(lock, id) }
+  // Use DSH's own browser opening behavior. Startup failure does not undo an
+  // otherwise successful native add; an unrelated plugin can fail to boot.
+  const logFile = path.join(directory, 'startup.log'), log = fs.openSync(logFile, 'a', 0o600)
+  const env = { ...process.env, DSH_HOME: home }
+  delete env.HARNESS_REMOTE_UPDATE_JOB
+  const child = spawn(process.execPath, [dsh.cli, '--profile', profileName, ...(open ? [] : ['--no-open'])],
+    { cwd: process.cwd(), env, detached: true, windowsHide: true, stdio: ['ignore', log, log] })
+  fs.closeSync(log)
+  let launchError
+  child.on('error', error => { launchError = error }); child.unref()
+  await sleep(1200)
+  const starting = !launchError && child.pid && child.exitCode === null && child.signalCode === null
+  const installedVersion = selected.archive ? selected.release.version : version
+  console.log(`插件 ${installedVersion} 已安装。${starting ? '已启动 DSH，请等待 WebUI 就绪。' : `DSH 未能启动，请查看：${logFile}`}`)
+  return { version: installedVersion, changed: Boolean(selected.archive), starting: Boolean(starting) }
+}
+export async function install({ profileName = 'web', cli, home: configuredHome, assetsRoot, open = true, repair = false } = {}) {
   if (!/^[A-Za-z0-9_-]{1,80}$/.test(profileName)) throw new Error('无效的 profile 名称。')
   if (cli) cli = validateDshCli(cli).cli
   const runtime = resolveInstallRuntime(root); await verifyInstallRuntime(runtime)
@@ -103,16 +122,16 @@ export async function install({ profileName = 'web', cli, home: configuredHome,
   fs.mkdirSync(directory, { recursive: true, mode: 0o700 })
   let remove, ref, job, locked = false, authorized = false, launched
   const lockFile = path.join(profile, '.harness-remote-update.lock')
-  console.log('正在检查 DSH 与插件…')
-  try {
-    if (!await mayHaveRunningDsh()) {
-      cli ||= await chooseDsh()
-      return await installStopped({ cli, home, profile, profileName, directory, id, runtime, assetsRoot, repair, open })
-    }
-    // A live host must identify the same home/profile; never synthesize a second
-    // profile just because this terminal inherited different environment values.
-    if (!fs.existsSync(path.join(profile, 'package.json'))) {
-      throw new Error('当前目录下没有此 DSH 配置，但检测到 DSH 正在运行。请使用相同的 DSH_HOME／--home 和 --profile，未修改正在运行的实例。')
+  console.log('正在检查 DSH 与插件…')
+  try {
+    if (!await mayHaveRunningDsh()) {
+      cli ||= await chooseDsh()
+      return await installStopped({ cli, home, profile, profileName, directory, id, runtime, assetsRoot, repair, open })
+    }
+    // A live host must identify the same home/profile; never synthesize a second
+    // profile just because this terminal inherited different environment values.
+    if (!fs.existsSync(path.join(profile, 'package.json'))) {
+      throw new Error('当前目录下没有此 DSH 配置，但检测到 DSH 正在运行。请使用相同的 DSH_HOME／--home 和 --profile，未修改正在运行的实例。')
     }
     const fd = fs.openSync(lockFile, 'wx', 0o600); fs.writeFileSync(fd, id); fs.closeSync(fd); locked = true
     const helper = path.join(directory, 'install-control.js')
@@ -155,28 +174,32 @@ export async function install({ profileName = 'web', cli, home: configuredHome,
     assertInstallTarget(host, { home, profile, cli, pid: launched?.pid || ref.pid })
     remove(); remove = undefined
     await sleep(600)
-    let selected = await selectRelease(host, assetsRoot, repair)
-    if (!selected.archive && host.pluginVersion === selected.release.version) {
-      // A version string on disk is not proof that a prior restart completed.
-      // Re-running the normal command must also repair a stuck installed copy.
-      let ready = false
-      try {
-        const response = await fetch(`http://127.0.0.1:${host.localPort}/gate/status`, { signal: AbortSignal.timeout(5000), redirect: 'error' })
-        await response.arrayBuffer(); ready = response.ok
-      } catch {}
-      if (!ready) {
-        console.log('检测到已安装插件尚未就绪，正在重新安装修复…')
-        selected = await selectRelease(host, assetsRoot, true)
-      }
-    }
+    let selected = await selectRelease(host, assetsRoot, repair)
+    if (!selected.archive && host.pluginVersion === selected.release.version) {
+      // A version string on disk is not proof that a prior restart completed.
+      // Re-running the normal command must also repair a stuck installed copy.
+      let ready = false
+      try {
+        const response = await fetch(`http://127.0.0.1:${host.localPort}/gate/status`, { signal: AbortSignal.timeout(5000), redirect: 'error' })
+        await response.arrayBuffer()
+        const business = response.ok ? await control(job, 'health') : undefined
+        ready = business?.ready === true
+      } catch {}
+      if (!ready) {
+        console.log('检测到已安装插件尚未就绪，正在重新安装修复…')
+        selected = await selectRelease(host, assetsRoot, true)
+      }
+    }
     if (!selected.archive) { console.log(`插件 ${host.pluginVersion} 无需更新。`); return { version: host.pluginVersion, changed: false } }
     console.log(`正在安装插件 ${selected.release.version}，保留原配对与会话…`)
     job = { ...host, argv: installHostArgv(host), id, directory, parentPid: host.pid, pnpm: runtime.cli, targetVersion: selected.release.version,
       previousVersion: host.pluginVersion, statusToken: token, controlOrigin: ref.origin }
     validateJob(job)
     fs.writeFileSync(path.join(directory, 'release.tgz'), selected.archive, { mode: 0o600, flag: 'wx' })
-    fs.copyFileSync(path.join(root, 'lib/update-worker.js'), path.join(directory, 'update-worker.js'))
-    if (host.pluginVersion === '0.0.0') fs.copyFileSync(path.join(root, 'lib/native-recovery.js'), path.join(directory, 'native-recovery.js'))
+    fs.copyFileSync(path.join(root, 'lib/update-worker.js'), path.join(directory, 'update-worker.js'))
+    // Recovery belongs to the independent installer, including when the old
+    // plugin already failed before this operation and cannot serve health RPC.
+    fs.copyFileSync(path.join(root, 'lib/native-recovery.js'), path.join(directory, 'native-recovery.js'))
     writePrivateJsonAtomic(path.join(directory, 'job.json'), job)
     await control(job, 'launch')
     const ready = await waitForJson(path.join(directory, 'worker-ready.json'), v => v.id === id)
@@ -184,9 +207,9 @@ export async function install({ profileName = 'web', cli, home: configuredHome,
     writePrivateJsonAtomic(path.join(home, 'harness-remote-updates', `profile-${scope}.json`), { jobId: id, statusOrigin: ready.origin, statusToken: token })
     writePrivateJsonAtomic(path.join(directory, 'authorized.json'), { id }); authorized = true
     let previous = '', result
-    // Native download/install has its own bounded deadline; allow its restart
-    // and possible rollback to finish before reporting an unknown outcome.
-    const until = Date.now() + 1200000
+    // Native download/install has its own bounded deadline; allow its restart
+    // and possible rollback to finish before reporting an unknown outcome.
+    const until = Date.now() + 1200000
     while (Date.now() < until) {
       try { result = JSON.parse(fs.readFileSync(path.join(directory, 'result.json'), 'utf8')) } catch {}
       if (result?.phase !== previous && result?.phase) { console.log(`${result.progress}% ${result.message}`); previous = result.phase }
@@ -205,12 +228,12 @@ export async function install({ profileName = 'web', cli, home: configuredHome,
       } catch { console.log('插件已更新；请返回原 DSH WebUI 查看。') }
     }
     return { version: selected.release.version, changed: true }
-  } finally {
-    try { remove?.() }
-    finally {
-      if (ref && !authorized) { try { await control({ controlOrigin: ref.origin, statusToken: token }, 'close') } catch {} }
-      if (locked && !authorized) releaseOwnedUpdateLock(lockFile, id)
-    }
+  } finally {
+    try { remove?.() }
+    finally {
+      if (ref && !authorized) { try { await control({ controlOrigin: ref.origin, statusToken: token }, 'close') } catch {} }
+      if (locked && !authorized) releaseOwnedUpdateLock(lockFile, id)
+    }
   }
 }
 export function parseArguments(args) {
@@ -228,6 +251,6 @@ export function parseArguments(args) {
 }
 if (process.argv[1] && fs.realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) {
   const args = process.argv.slice(2)
-  if (args.includes('--help') || args.includes('-h')) console.log('安装或升级 DSH 微信连接插件：npx -y dsh-wechat-remote@latest\n支持全局安装与 npx 使用的 DSH，已启动或关闭均可；请在相同系统账号下执行。Windows 可使用 npx.cmd。\n可选：--profile <名称>（默认 web）；--home <DSH 数据目录>；--dsh-cli <DSH 的 lib/bin.js>；--repair（重新安装，不降级）')
+  if (args.includes('--help') || args.includes('-h')) console.log('安装或升级 DSH 微信连接插件：npx -y dsh-wechat-remote@latest\n支持全局安装与 npx 使用的 DSH，已启动或关闭均可；请在相同系统账号下执行。Windows 可使用 npx.cmd。\n可选：--profile <名称>（默认 web）；--home <DSH 数据目录>；--dsh-cli <DSH 的 lib/bin.js>；--repair（重新安装，不降级）')
   else Promise.resolve().then(() => install(parseArguments(args))).catch(error => { console.error(error.message); process.exitCode = 1 })
 }