fix(dsh): preserve the host when LoopX is disabled or removed

[huangruiteng]

Goal And Delivered Outcome

Published beta.6 makes DSH's shared Web server/runtime depend on LoopX's bootstrap service. When Plugin Hub live-disables the package after removal, withdrawing that service closes the listener and disconnects the browser even though the package dependency is removed.

This change removes those shared dependencies. The native Loader wait still keeps CLI/skill initialization before the printed URL; only LoopX's Host and Driver retain bootstrap gating. Related to #5208; PR base: main.

Author Declaration

Written by: model_agent, OpenAI GPT-6 family.

Implemented against the automatic initialization contract in docs/plans/2026-08-20-dsh-native-skill-driver.md and the provider lifecycle acceptance in docs/architecture/rfcs/harness-selection-dsh-pi-v0.md, base 202cbbc71e37c42eb1f7bebc9cf86688d0660c01. The former's shared-Web dependency mechanism is corrected while retaining its readiness and safe-failure obligations.

Criterion	Disposition	Evidence
Initialization settles before readiness; no automatic model calls	implemented	Real 0.2.0-rc.2 and 0.1.5-rc.2 profiles with a delayed CLI/skill fixture
Optional plugin removal preserves DSH availability	implemented	Published package fails the new regression; candidate passes live-disable, route retirement and disabled-package cold boot
Native browser install/removal readback	implemented within macOS candidate scope	Actual DSH 0.2.0-rc.2 + released Hub 1.6.4: uninstall task done/exit 0, no restart required, dependency removed; refresh completes with Hub present and LoopX absent
Windows desktop full journey and published upgrade	deferred	Existing #5208/#5671; this source candidate is not a new plugin release

Scope And Continuation

The existing dsh-native provider under packages/dsh-loopx-plugin owns this repair; no new capability, configuration switch or Python decision owner is introduced. The bounded refactor removes duplicate readiness authority from shared host rows and leaves LoopX's own typed lifecycle intact. No shared state vocabulary is added; qualification fields are local fixture assertions.

Maintainer handoff and bilingual RFC checkpoints also distinguish the merged awesome-directory update from the still-stale Hub feeds. The actual consumer metadata is tracked in upstream #146. Existing #6000 owns the separate install-recovery README section and remains blocked by its current review. This PR does not close the install reports, observer qualification or Windows host packaging. Maintainer review/merge and a separately qualified plugin release remain required.

Validation

Tested source head: e2a0e930d236e4922b9e42f4fde0f58d58f99411. Run state: finished. Inputs: synthetic and public released packages, isolated disposable profiles. No model/provider calls.

Check	Result	Evidence / limit
Typecheck, units and real LoopX admission	passed	npm run typecheck; 207 tests; admission integration rerun against the rebased source
Build and packed Client/profile/peer ranges	passed	npm run build; packed artifact/profile smokes and peer-range smoke
Native host regression	passed	node smoke/dsh-goalbar-runtime-smoke.mjs --tarball <candidate> on DSH 0.2.0-rc.2 and 0.1.5-rc.2; delayed initialization, live-disable, route retirement, disabled-package boot
Before/after regression	passed	Same new probe fails on released beta.6 with a closed socket and passes on the candidate
Packaged browser journey	passed	Released DSH 0.2.0-rc.2 + Hub 1.6.4; real Uninstall → Complete → refresh, backend task/dependency and installed-row readback
Docs, semantics and public boundary	passed	Docs governance; full semantic-vocabulary smoke; six-path boundary scan; git diff --check
Windows desktop and DSH 0.1.7 rerun	not_run	No Windows desktop host here; 0.1.7 retains its existing qualification, with 0.1.5 and 0.2 readiness paths rechecked
Model-driven continuation / observer C0-C1	not_run	Outside this lifecycle repair

Initial local semantic validation required repository-root npm dev dependencies; it passed after npm ci --ignore-scripts. Package checks use the workflow-pinned pnpm 10.33.0 frozen dependency install, rather than the host's pnpm 11 configuration. Raw logs and disposable profile state are excluded.

Frontend / Visual Evidence

UI impact: none to renderer or layout. The existing DSH/Hub uninstall entrypoint is exercised through the real packaged browser and its backend. Before: published package disconnects; after: task completes, refresh succeeds and only the LoopX entry retires. No LoopX first viewport, CLI authority or Lark surface is changed. Screenshots/readback are retained as local qualification evidence, not public attachments.

Boundary Checklist

• Public-safe diff/body; no credentials, raw traces, private state or local machine paths.
• Existing provider and [Task][RFC]: Qualify DSH/Pi observation and managed-runtime selection #5208 scope; no competing authority or benchmark work.
• Two purpose-aligned commits, each with DCO sign-off.
• Runtime change is proposed for maintainer review, not self-merged.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=xhigh

Approval conclusion

动机

在 DSH 中关闭或卸载可选 LoopX 插件的用户，需要继续使用宿主 Web。 原包把共享 Web 服务绑定到 LoopX 启动服务；移除插件会连带关掉 Web、断开浏览器。候选包只约束 LoopX 自己的 Host 和 Driver，关闭插件后宿主继续运行。 同一真实 DSH 检查用于固定 base 包时连接断开；新 head 包关闭后 Web 返回200、LoopX RPC返回404，冷启动关闭状态也通过。 本 PR 不发布新的插件版本，不修复 Hub feed、历史 lockfile 或 Windows 宿主包装问题，也不关闭模型驱动与 C0/C1 验收。 宿主关闭隔离切片已经可用；Windows 全流程、0.1.7 实机、模型持续工作和公开 beta.6 的新版本发布仍未由本轮证明。

改动思路

共享 Web 的生命周期属于 DSH；可选 LoopX provider 只能控制自己的 Host、Driver 和 Client。原生 Loader 的异步等待已经提供启动 readiness，移除全局依赖比增加新的延时或服务更小且更可靠。 当前切片交付原生 Loader 下的启动、实时关闭及移除恢复，保留 bootstrap 和显式业务授权；Hub 浏览器按钮与更广平台发布验收各有原 owner。

最强反对场景：Removing optional provider closes native Web or bootstrap no longer precedes readiness. 独立验证按原已接受规范判断，而不是候选 checkpoint 自证。仅应用本次 advisory 中“验证有用调用结果及恢复”的建议，不沿用历史 verdict 或声称 memory utility。

具体改动

精确 head e2a0e930d236e4922b9e42f4fde0f58d58f99411，固定 base 32db4d13dbf2f499faf9560789c3c57a478aad02。cordis.patch.yml 删除共享 Web rows 的 loopxBootstrap 覆盖，保留四个 LoopX rows。未改的 src/init-command.ts 异步 apply 在 ready/safe-failure 后提供 service；src/index.ts 和 src/driver.ts 保留自己的 inject。实际 native Loader 先等启动树再宣布 Web URL。扩展既有 runtime smoke 的 exerciseRealDshWeb 使用 Hub 同样的 Entry.update，核验 live-disable 的 Web、Client manifest、GoalBar route 和 CLI call log；disabled cold boot 及 native removal 也执行。6文件+194/-60包含 README、原启动计划和中英文 RFC checkpoint；未增加 runtime framework。

独立规范 docs/plans/2026-08-20-dsh-native-skill-driver.md；spec_revision 32db4d13dbf2f499faf9560789c3c57a478aad02。

• criterion_id Goal：One-step provider installation and /loopx-init repair; initialization must not issue Goal work or model turns. 验证：207 unit tests, packed real DSH delayed startup, four expected bootstrap CLI calls and idle/disposal no extra calls.
• criterion_id Automatic Initialization And /loopx-init Repair Contract：Loader waits for bootstrap ready/safe failure before readiness; no DSH default-input/model startup mutation. 验证：Delayed skill installation precedes actual Web URL readiness; package disabled boots real Web.
• criterion_id Verification：Qualify packed install, real skill availability, failure/repair, removal and no duplicate Driver or effects. 验证：Same new production-path harness base package fails when disabling; head passes200/404, disabled boot, native removal and teardown; stronger cross-platform acceptance remains separately scoped.

对主干的风险

无阻塞 finding。已验证当前切片的实用改善；下述未执行平台和已发布包仍保留原验收边界。

当前 head 207单测/11文件、host/client/testing typecheck、build、peer-range/artifact/profile smoke 和 real packed DSH0.2.0-rc.2 lifecycle通过。将固定 base 打成包，使用完全相同新 runtime harness 在 live-disable 时出现 UND_ERR_SOCKET / other side closed；head 包同输入通过 Web200、GoalBar404、Client撤下、冷启动 disabled package 与 native CLI removal。延迟 bootstrap 仍在真实 ready URL之前完成，只有4次预期 CLI startup calls，idle/disposal 未添加业务命令。native Web、Loader、package install/removal 和HTTP是真实实现；Goal/session及 LoopX CLI是隔离 synthetic fixture。diff-check通过。没有改门槛、关闭断言或仅挑最后一次成功。首次 npm pack parser 被 prepack 输出扰动，按既有产物恢复后测，保留该 reviewer setup error。

外部 checkpoint 的 Catalog6633、Hub98/102 已合并及1.5.0/1.6.4 release 已直接读回：Catalog6633、Hub102、Hub146仍开放。Feed直接读取403，本轮没有独立重证其所有当前内容，不能把目录合并或 Hub升级当作 feed adoption。作者记录的 macOS Hub按钮完成路径、0.1.5和Windows等没有重新归为本轮运行；本轮验证其原生 Loader等价操作。候选仍未发布，公开 beta.6 的关闭宿主、CLI移除、重启指引继续适用。

语义/权限：Bootstrap-before-readiness is preserved by existing native Loader; workaround guidance distinguishes published beta.6 from this source candidate. No new business command, global driver/default input or obligation minted. 本 PR 不发布新的插件版本，不修复 Hub feed、历史 lockfile 或 Windows 宿主包装问题，也不关闭模型驱动与 C0/C1 验收。 没有新 spawn/claim/lease/quota、外部发布或 model input 权限。安装、发现或 ready 不等于业务激活；disabled package 不安装 skills、不发业务 CLI，shared Web 继续可用。 机器义务和操作建议各有原 owner，没有把硬义务改叫 guidance。未查询、轮询或等待 CI。

我的整体评价

APPROVE，justified_increment。当前切片交付原生 Loader 下的启动、实时关闭及移除恢复，保留 bootstrap 和显式业务授权；Hub 浏览器按钮与更广平台发布验收各有原 owner。 宿主关闭隔离切片已经可用；Windows 全流程、0.1.7 实机、模型持续工作和公开 beta.6 的新版本发布仍未由本轮证明。 future-facing pass：删除重复的共享 Web readiness 权限，保留原 Loader 和自有依赖；无需新增 service、timeout、配置状态或 UI 抽象。

Independent review reran actual packed macOS DSH0.2 Loader/HTTP/native CLI lifecycle, not the author Hub browser click or DSH0.1.5/0.1.7/Windows/model journey. Existing Client UI source is unchanged. Feed direct reader403; upstream issue146 remains open, catalog6633/Hub98/102 and releases independently read back. Candidate not published.

English verdict: APPROVE - exact head e2a0e930d236e4922b9e42f4fde0f58d58f99411; the same packed native DSH0.2 lifecycle harness loses the Web socket with the immutable base package and preserves Web200 while retiring LoopX404 with this head.207 tests, typechecks, build and package smokes pass; delayed bootstrap readiness and no extra business CLI effects remain. Broader Windows/model/release acceptance, current feed contents and the author Hub browser click are not independently requalified here. No blocking finding and no CI queried.