@1e0zj/dsh-plugin-mall 0.1.10 → 0.1.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1e0zj/dsh-plugin-mall",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "dsh 插件市场：搜索 GitHub dsh-plugin 话题下的插件仓库，一键安装到本地 dsh profile（agent 工具 + 设置页插件市场 tab）",
   "type": "module",
   "main": "src/index.js",

package/src/client.js

@@ -43,10 +43,13 @@ window.__ModuleLoader__.load({
       ".mkt_cardActions{display:flex;gap:8px;align-items:center;flex-wrap:wrap;margin-top:auto;padding-top:4px}",
       ".mkt_cardActions .mkt_btn{text-decoration:none}",
       ".mkt_panelTitle{font-size:13px;font-weight:600;color:var(--dsw-alias-label-primary);margin:0}",
+      ".mkt_panelRow{display:flex;align-items:center;gap:8px}",
+      ".mkt_panelRow .mkt_link{margin-left:auto}",
       ".mkt_pre{font-family:Consolas,Monaco,monospace;font-size:11.5px;line-height:16px;color:var(--dsw-alias-label-secondary);background:var(--dsw-alias-bg-secondary,#f6f7f8);border-radius:6px;padding:8px;max-height:220px;overflow:auto;white-space:pre-wrap;word-break:break-all}",
       ".mkt_ok{color:var(--dsw-alias-state-success-primary,#2f855a)}",
       ".mkt_badge{display:inline-block;border-radius:999px;padding:1px 8px;font-size:11px;border:1px solid var(--dsw-alias-border-l2);color:var(--dsw-alias-label-tertiary)}",
       ".mkt_badgeOk{border-color:var(--dsw-alias-state-success-primary,#2f855a);color:var(--dsw-alias-state-success-primary,#2f855a)}",
+      ".mkt_badgeBad{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary)}",
       ".mkt_check{display:flex;align-items:center;gap:4px;font-size:12.5px;color:var(--dsw-alias-label-secondary);cursor:pointer;white-space:nowrap}",
       ".mkt_link{color:var(--dsw-alias-state-business-primary);font-size:12px;text-decoration:none;cursor:pointer}",
       ".mkt_installedHead{display:flex;align-items:center;gap:8px;width:100%;background:none;border:0;padding:0;margin:0;cursor:pointer;font:inherit;text-align:left}",
@@ -127,7 +130,11 @@ window.__ModuleLoader__.load({
         jobsRef.current = Object.assign({}, jobsRef.current, { [id]: { status: "running", spec: spec, output: "" } });
         setJobs(Object.assign({}, jobsRef.current));
       }, []);
-      return { jobs: jobs, track: track };
+      var clear = useCallback(function () {
+        jobsRef.current = {};
+        setJobs({});
+      }, []);
+      return { jobs: jobs, track: track, clear: clear };
     }
 
     // ── plugin verification badge ───────────────────────────────────────────
@@ -135,6 +142,9 @@ window.__ModuleLoader__.load({
     // dsh.bundle/dsh.client 声明，进程内缓存）。unknown 不显示徽章。
     function verifyBadge(verified) {
       if (verified === undefined || verified === null) return null;
+      if (verified.hostDeps !== undefined && verified.hostDeps.length > 0) {
+        return h("span", { className: "mkt_badge mkt_badgeBad", title: verified.hostDeps.join(", ") }, "宿主依赖风险");
+      }
       if (verified.kind === "bundle") return h("span", { className: "mkt_badge mkt_badgeOk" }, "宿主插件");
       if (verified.kind === "client") return h("span", { className: "mkt_badge mkt_badgeOk" }, "UI插件");
       if (verified.kind === "plain") return h("span", { className: "mkt_badge" }, "未声明");
@@ -181,7 +191,10 @@ window.__ModuleLoader__.load({
       var ids = Object.keys(props.jobs);
       if (ids.length === 0) return null;
       return h("div", { className: "mkt_card" },
-        h("p", { className: "mkt_panelTitle" }, "任务"),
+        h("div", { className: "mkt_panelRow" },
+          h("p", { className: "mkt_panelTitle" }, "任务"),
+          props.onClear ? h("span", { className: "mkt_link", onClick: props.onClear }, "清空") : null
+        ),
         ids.map(function (id) {
           var job = props.jobs[id];
           var done = job.status === "completed" || job.status === "failed" || job.status === "killed";
@@ -393,6 +406,7 @@ window.__ModuleLoader__.load({
       var polling = useJobPolling(call, refreshInstalled);
       var track = polling.track;
       var jobs = polling.jobs;
+      var clearJobs = polling.clear;
 
       useEffect(function () {
         doSearch();
@@ -472,16 +486,15 @@ window.__ModuleLoader__.load({
         refreshInstalled();
       }, [refreshInstalled]);
 
-      // 活动任务置顶（紧跟已装面板，点安装立刻看到进度）；全部静止后归档到底部当日志。
-      var jobsActive = false;
-      for (var jid in jobs) { if (jobs[jid] && jobs[jid].status === "running") { jobsActive = true; break; } }
-
+      // 任务面板位置固定（已装面板之后）：不随任务状态在顶部/底部之间
+      // 跳——npm 安装几秒即完成，"完成即落底"曾让结果凭空消失。
       // "只看已验证"开关下的可见项：verify 判定 bundle/client 的才算插件。
       // verifyPending：当前加载的仓库里还有未验证完的（verified map 尚未覆盖）。
       var visibleItems = results === null ? [] : results.items.filter(function (it) {
         if (verifiedOnly !== true) return true;
         var v = verified[it.fullName];
-        return v !== undefined && (v.kind === "bundle" || v.kind === "client");
+        return v !== undefined && (v.kind === "bundle" || v.kind === "client")
+          && !(v.hostDeps !== undefined && v.hostDeps.length > 0);
       });
       var verifyPending = results !== null && results.items.some(function (it) { return verified[it.fullName] === undefined; });
 
@@ -516,7 +529,7 @@ window.__ModuleLoader__.load({
         ),
         error ? h("div", { className: "mkt_error" }, error) : null,
         h(InstalledPanel, { installed: installed, removing: removing, updates: updates, onUninstall: doUninstall, onInstallSpec: doInstallSpec }),
-        jobsActive ? h(JobsPanel, { jobs: jobs }) : null,
+        h(JobsPanel, { jobs: jobs, onClear: clearJobs }),
         h("div", { className: "mkt_list" },
           results == null
             ? h("div", { className: "mkt_meta mkt_listHead" }, loading ? "正在加载最热插件…" : "—")
@@ -552,8 +565,7 @@ window.__ModuleLoader__.load({
                   ? h("div", { className: "mkt_loadMore", ref: sentinelRef }, loadingMore ? "加载中…" : Date.now() < retryAt ? "GitHub 限流中，稍后再下滑加载" : "下滑加载更多")
                   : h("div", { className: "mkt_loadMore" }, reachedLimit ? "已达 GitHub 搜索上限（前 1000 个结果）" : "已显示全部 " + results.items.length + " 个")
               )
-        ),
-        jobsActive ? null : h(JobsPanel, { jobs: jobs })
+        )
       );
     }
 

package/src/github.js

@@ -137,7 +137,7 @@ export async function npmPackageInfo(name) {
       if (typeof latest === "string") {
         const rawRepository = body?.repository;
         const repositoryUrl = typeof rawRepository === "string" ? rawRepository : rawRepository?.url;
-        info = { latest, repositoryUrl: typeof repositoryUrl === "string" ? repositoryUrl : undefined };
+        info = { latest, repositoryUrl: typeof repositoryUrl === "string" ? repositoryUrl : undefined, hostDeps: hostShadowDependencies(body) };
       }
     }
   } catch {
@@ -166,6 +166,32 @@ export async function preferNpmSpec({ spec }) {
   return pointsBack ? declaredName : raw;
 }
 
+/**
+ * Refuse to install a package whose `dependencies` shadow host framework
+ * packages. Host copies inside a profile split module identities and crash
+ * all tool scheduling — the dsh contract is peerDependencies, but the host
+ * enforces nothing, so the marketplace is the last line of defense.
+ * Sources: registry abbreviated metadata for npm names, the verify cache
+ * (raw package.json) for github: specs.
+ */
+export async function assertSafeToInstall({ spec }) {
+  const raw = String(spec ?? "");
+  let hostDeps;
+  if (/^(?:@[\w.-]+\/)?[\w.-]+$/.test(raw)) {
+    const info = await npmPackageInfo(raw);
+    hostDeps = info?.hostDeps;
+  } else {
+    const match = /^github:([^/\s]+\/[^/\s]+?)(?:\.git)?$/i.exec(raw);
+    if (match !== null) {
+      const { results } = await verifyPlugins({ repos: [match[1]] });
+      hostDeps = results[match[1]]?.hostDeps;
+    }
+  }
+  if (hostDeps !== undefined && hostDeps.length > 0) {
+    throw new Error(`${raw} declares ${hostDeps.length} host framework package(s) as dependencies (${hostDeps.slice(0, 3).join(", ")}${hostDeps.length > 3 ? ", …" : ""}) — installing it would duplicate host modules and crash dsh tool scheduling. Ask the plugin author to move @deepseek-ai/* to peerDependencies.`);
+  }
+}
+
 /** Loose semver-ish comparison: "0.2.10" vs "0.2.9" → 1. Non-numeric parts read as 0. */
 export function compareVersions(a, b) {
   const pa = String(a ?? "").split(".");
@@ -222,10 +248,27 @@ async function fetchRawPackageJson(repo, signal) {
   throw lastError ?? new Error("no raw source reachable");
 }
 
+/**
+ * Framework packages the host provides via the profiles/node_modules fallback.
+ * A plugin declaring any of these as `dependencies` (instead of
+ * peerDependencies) installs real copies into the profile — the loader then
+ * holds two module instances, symbol identities split, and every tool call
+ * crashes with an undiagnosable "reading 'prepare'". See installer docs.
+ */
+const HOST_PACKAGES = /^(@deepseek-ai\/|cosmokit$|schemastery$)/;
+
+/** The @deepseek-ai/* (and cordis runtime) entries inside `dependencies`. */
+function hostShadowDependencies(pkg) {
+  if (pkg === undefined || typeof pkg !== "object") return undefined;
+  const deps = Object.keys(pkg.dependencies ?? {});
+  const host = deps.filter((name) => HOST_PACKAGES.test(name));
+  return host.length > 0 ? host : undefined;
+}
+
 /**
  * Verify repositories as real dsh plugins by their package.json declaration.
  * @param {{repos: string[], signal?: AbortSignal}} options - "owner/name" list.
- * @returns the {results} map: fullName -> {kind: "bundle"|"client"|"plain"|"no-manifest"|"unknown", name?, version?}.
+ * @returns the {results} map: fullName -> {kind: "bundle"|"client"|"plain"|"no-manifest"|"unknown", name?, version?, hostDeps?}.
  */
 export async function verifyPlugins({ repos, signal }) {
   const wanted = [...new Set((Array.isArray(repos) ? repos : []).map(String)
@@ -241,7 +284,7 @@ export async function verifyPlugins({ repos, signal }) {
           : typeof pkg.dsh?.bundle?.patch === "string" ? "bundle"
             : pkg.dsh?.client !== undefined ? "client"
               : "plain";
-        verifyCache.set(repo, { kind, name: pkg?.name, version: pkg?.version });
+        verifyCache.set(repo, { kind, name: pkg?.name, version: pkg?.version, hostDeps: hostShadowDependencies(pkg) });
       } catch (error) {
         if (error?.name === "AbortError") throw error;
         verifyCache.set(repo, { kind: "unknown" });

package/src/index.js

@@ -19,7 +19,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { spawn } from "node:child_process";
 import { resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
-import { repoInfo, searchPlugins, verifyPlugins, preferNpmSpec, npmPackageInfo, compareVersions } from "./github.js";
+import { repoInfo, searchPlugins, verifyPlugins, preferNpmSpec, npmPackageInfo, compareVersions, assertSafeToInstall } from "./github.js";
 import { ensureProfile, listInstalled, normalizeSpec, runInstall, runRemove, createJobTracker } from "./installer.js";
 
 export const name = "@1e0zj/dsh-plugin-mall";
@@ -212,6 +212,13 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
       // npm tarball 优先（小而快、带 integrity）；registry 条目不同源的包名
       // 视为抢注，回退 github: 全仓库 spec。
       spec = await preferNpmSpec({ spec });
+      // 宿主依赖硬拦：dependencies 里拖着 @deepseek-ai/* 的包装进 profile
+      // 就是双模块实例 + 全工具调度崩溃（宿主无任何护栏，市场是最后防线）。
+      try {
+        await assertSafeToInstall({ spec });
+      } catch (error) {
+        return rpcFail(error);
+      }
       try {
         const profileDir = resolveProfileDir(profile);
         if (!existsSync(join(profileDir, "package.json"))) ensureProfile(profile);
@@ -419,6 +426,7 @@ export function apply(ctx, config = {}) {
     async execute(args, exec) {
       const profile = String(args.profile ?? defaultProfile).trim();
       const spec = await preferNpmSpec({ spec: normalizeSpec(args.spec) });
+      await assertSafeToInstall({ spec });
       let profileDir;
       try {
         profileDir = resolveProfileDir(profile);