@1e0zj/dsh-plugin-mall 0.1.11 → 0.1.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1e0zj/dsh-plugin-mall",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "dsh 插件市场：搜索 GitHub dsh-plugin 话题下的插件仓库，一键安装到本地 dsh profile（agent 工具 + 设置页插件市场 tab）",
   "type": "module",
   "main": "src/index.js",

package/src/client.js

@@ -351,11 +351,16 @@ window.__ModuleLoader__.load({
       // 无限滚动：哨兵进入视口时拉下一页并追加。GitHub topic 的翻页间数据
       // 可能移动造成重复，按 fullName 去重；已显示数追上 total 即到底。
       var canLoadMore = results !== null && results.items.length < results.total && !reachedLimit;
+      var loadMoreLock = useRef(false);
       var loadMore = useCallback(function () {
         if (!canLoadMore || loading || loadingMore) return;
+        // 同一 tick 内 observer 可能连续触发两次，state 更新不阻塞闭包读值，
+        // 用 ref 做重入闸。
+        if (loadMoreLock.current) return;
         // 限流熔断：失败后 60s 内不再自动请求（哨兵重渲染会反复触发
         // IntersectionObserver，不熔断会连环 500 直到限流窗口过去）。
         if (Date.now() < retryAt) return;
+        loadMoreLock.current = true;
         setLoadingMore(true);
         call("search", { query: query, sort: sort, perPage: 20, page: page + 1 }).then(function (value) {
           if (value.truncated === true) { setReachedLimit(true); return; }
@@ -376,6 +381,7 @@ window.__ModuleLoader__.load({
           setError(errorText(e));
           setRetryAt(Date.now() + 60000);
         }).finally(function () {
+          loadMoreLock.current = false;
           setLoadingMore(false);
         });
       }, [call, canLoadMore, loading, loadingMore, page, query, sort, retryAt]);
@@ -451,7 +457,12 @@ window.__ModuleLoader__.load({
           var tries = 0;
           var ping = setInterval(function () {
             tries++;
-            if (tries > 40) { clearInterval(ping); return; }
+            if (tries > 40) {
+              clearInterval(ping);
+              setRestarting(false);
+              setError("2 分钟内未检测到 dsh 重启完成，请手动检查 dsh 状态后刷新页面。");
+              return;
+            }
             rpc.call("/market", "installed", {}).then(function () {
               clearInterval(ping);
               window.location.reload();

package/src/github.js

@@ -1,6 +1,8 @@
 // GitHub API helpers for the dsh plugin marketplace.
 // Pure functions with no harness imports, so this module is unit-testable
 // standalone (node src/github.js --self-test).
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
 
 const SEARCH_TOPIC = "topic:dsh-plugin";
 /** GitHub search never serves past the first 1000 results. */
@@ -116,34 +118,41 @@ export async function searchPlugins({ query, sort = "stars", perPage = 10, page
 // to the explicit github: spec).
 
 const NPM_REGISTRY = "https://registry.npmjs.org";
-const npmCache = new Map(); // name -> {latest, repositoryUrl} | null (unknown/not found)
+const npmCache = new Map(); // name -> {info, at} — null misses expire after 5 min
 
 /**
- * Look up a package on the npm registry (abbreviated metadata). Cached for
- * the process lifetime; null means "not on npm / unreachable".
+ * Look up a package on the npm registry (abbreviated metadata). Successful
+ * lookups cache for the process lifetime; "not found / unreachable" (null)
+ * expires after 5 minutes so a transient registry failure self-heals.
  */
 export async function npmPackageInfo(name) {
   const clean = String(name ?? "").trim();
   if (clean.length === 0 || !/^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/i.test(clean)) return null;
-  if (npmCache.has(clean)) return npmCache.get(clean);
+  const cached = npmCache.get(clean);
+  if (cached !== undefined && (cached.info !== null || Date.now() - cached.at < 300000)) return cached.info;
   let info = null;
   try {
-    const response = await fetch(`${NPM_REGISTRY}/${clean.replace("/", "%2F")}`, {
-      headers: { "User-Agent": "dsh-plugin-mall", Accept: "application/vnd.npm.install-v1+json" },
+    // 单版本端点返回 latest 的完整 manifest（dependencies + repository 都在）。
+    // abbreviated packument 不含 repository，防抢注比对会永远落空。
+    const response = await fetch(`${NPM_REGISTRY}/${clean.replace("/", "%2F")}/latest`, {
+      headers: { "User-Agent": "dsh-plugin-mall", Accept: "application/json" },
     });
     if (response.ok) {
       const body = await response.json();
-      const latest = body?.["dist-tags"]?.latest;
-      if (typeof latest === "string") {
-        const rawRepository = body?.repository;
+      if (typeof body?.version === "string") {
+        const rawRepository = body.repository;
         const repositoryUrl = typeof rawRepository === "string" ? rawRepository : rawRepository?.url;
-        info = { latest, repositoryUrl: typeof repositoryUrl === "string" ? repositoryUrl : undefined, hostDeps: hostShadowDependencies(body) };
+        info = {
+          latest: body.version,
+          repositoryUrl: typeof repositoryUrl === "string" ? repositoryUrl : undefined,
+          hostDeps: hostShadowDependencies(body),
+        };
       }
     }
   } catch {
     info = null; // registry unreachable — caller falls back
   }
-  npmCache.set(clean, info);
+  npmCache.set(clean, { info, at: Date.now() });
   return info;
 }
 
@@ -174,25 +183,56 @@ export async function preferNpmSpec({ spec }) {
  * Sources: registry abbreviated metadata for npm names, the verify cache
  * (raw package.json) for github: specs.
  */
+/**
+ * Extract the bare npm package name: "name", "name@version", "@s/n@version"
+ * → "name"/"@s/n". Returns null for anything that is not an npm name shape.
+ */
+function npmNameOf(raw) {
+  if (typeof raw !== "string" || raw.length === 0) return null;
+  if (raw.startsWith("@")) {
+    const match = /^(@[^/@\s]+\/[^/@\s]+?)(?:@[^/\s]+)?$/.exec(raw);
+    return match === null ? null : match[1];
+  }
+  const match = /^([^@\s]+?)(?:@[^/\s]+)?$/.exec(raw);
+  return match === null ? null : match[1];
+}
+
 export async function assertSafeToInstall({ spec }) {
   const raw = String(spec ?? "");
   let hostDeps;
-  if (/^(?:@[\w.-]+\/)?[\w.-]+$/.test(raw)) {
-    const info = await npmPackageInfo(raw);
-    hostDeps = info?.hostDeps;
+  if (/^(?:file:|link:)/i.test(raw)) {
+    // 本地路径直通：直接读它的 package.json 查 dependencies。
+    const dir = raw.replace(/^(?:file:|link:)/i, "").replace(/[\\/]+$/, "");
+    try {
+      const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+      hostDeps = hostShadowDependencies(pkg);
+    } catch {
+      return; // 读不到清单——pnpm 会给出真实错误，这里放行
+    }
+  } else if (/^github:([^/\s]+\/[^/\s]+?)(?:\.git)?(?:#.+)?$/i.test(raw)) {
+    const repo = /^github:([^/\s]+\/[^/\s]+?)(?:\.git)?(?:#.+)?$/i.exec(raw)[1];
+    const { results } = await verifyPlugins({ repos: [repo] });
+    hostDeps = results[repo]?.hostDeps;
+  } else if (/^https?:\/\//i.test(raw)) {
+    return; // 远程 tarball 下载前无法廉价检查；罕见路径，放行
   } else {
-    const match = /^github:([^/\s]+\/[^/\s]+?)(?:\.git)?$/i.exec(raw);
-    if (match !== null) {
-      const { results } = await verifyPlugins({ repos: [match[1]] });
-      hostDeps = results[match[1]]?.hostDeps;
+    // npm 名（含带版本形式）：剥掉 @version 再查。
+    const name = npmNameOf(raw);
+    if (name === null || name.length === 0) {
+      // 无法识别形状的 spec 一律拒绝，而不是静默跳过检查。
+      throw new Error(`cannot analyze install spec ${JSON.stringify(raw)} for host-shadow dependencies — refusing to install`);
     }
+    const info = await npmPackageInfo(name);
+    hostDeps = info?.hostDeps;
   }
-  if (hostDeps !== undefined && hostDeps.length > 0) {
+  if (hostDeps !== undefined && hostDeps !== null && hostDeps.length > 0) {
     throw new Error(`${raw} declares ${hostDeps.length} host framework package(s) as dependencies (${hostDeps.slice(0, 3).join(", ")}${hostDeps.length > 3 ? ", …" : ""}) — installing it would duplicate host modules and crash dsh tool scheduling. Ask the plugin author to move @deepseek-ai/* to peerDependencies.`);
   }
 }
 
-/** Loose semver-ish comparison: "0.2.10" vs "0.2.9" → 1. Non-numeric parts read as 0. */
+/** Loose semver-ish comparison: "0.2.10" vs "0.2.9" → 1. Non-numeric parts
+ *  read as 0; numerically equal versions where one carries a pre-release
+ *  segment ("-rc.1") sort below the plain release ("2.0.0-beta" < "2.0.0"). */
 export function compareVersions(a, b) {
   const pa = String(a ?? "").split(".");
   const pb = String(b ?? "").split(".");
@@ -201,6 +241,9 @@ export function compareVersions(a, b) {
     const nb = Number(pb[index]) || 0;
     if (na !== nb) return na < nb ? -1 : 1;
   }
+  const preA = String(a ?? "").includes("-");
+  const preB = String(b ?? "").includes("-");
+  if (preA !== preB) return preA ? -1 : 1;
   return 0;
 }
 // ── plugin verification (raw CDN, no API quota) ─────────────────────────────
@@ -273,7 +316,12 @@ function hostShadowDependencies(pkg) {
 export async function verifyPlugins({ repos, signal }) {
   const wanted = [...new Set((Array.isArray(repos) ? repos : []).map(String)
     .filter((repo) => /^[^/\s]+\/[^/\s]+$/.test(repo) && !repo.includes("..")))];
-  const pending = wanted.filter((repo) => !verifyCache.has(repo));
+  // "unknown"（网络失败）60s 后过期重试；成功结果进程内永久缓存。
+  const pending = wanted.filter((repo) => {
+    const cached = verifyCache.get(repo);
+    if (cached === undefined) return true;
+    return cached.kind === "unknown" && Date.now() - (cached.ts ?? 0) > 60000;
+  });
   let cursor = 0;
   const worker = async () => {
     while (cursor < pending.length) {
@@ -287,13 +335,18 @@ export async function verifyPlugins({ repos, signal }) {
         verifyCache.set(repo, { kind, name: pkg?.name, version: pkg?.version, hostDeps: hostShadowDependencies(pkg) });
       } catch (error) {
         if (error?.name === "AbortError") throw error;
-        verifyCache.set(repo, { kind: "unknown" });
+        verifyCache.set(repo, { kind: "unknown", ts: Date.now() });
       }
     }
   };
   await Promise.all(Array.from({ length: Math.min(VERIFY_CONCURRENCY, pending.length) }, worker));
   const results = {};
-  for (const repo of wanted) results[repo] = verifyCache.get(repo) ?? { kind: "unknown" };
+  for (const repo of wanted) {
+    const cached = verifyCache.get(repo);
+    results[repo] = cached === undefined || cached.ts !== undefined
+      ? { kind: cached?.kind ?? "unknown", name: cached?.name, version: cached?.version, hostDeps: cached?.hostDeps }
+      : cached;
+  }
   return { results };
 }
 

package/src/index.js

@@ -20,7 +20,7 @@ import { join } from "node:path";
 import { spawn } from "node:child_process";
 import { resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
 import { repoInfo, searchPlugins, verifyPlugins, preferNpmSpec, npmPackageInfo, compareVersions, assertSafeToInstall } from "./github.js";
-import { ensureProfile, listInstalled, normalizeSpec, runInstall, runRemove, createJobTracker } from "./installer.js";
+import { ensureProfile, listInstalled, normalizeSpec, runInstall, runRemove, createJobTracker, assertSafeSpec } from "./installer.js";
 
 export const name = "@1e0zj/dsh-plugin-mall";
 export const inject = ["tools", "jobs", "systemPrompt"];
@@ -206,6 +206,7 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
       let spec;
       try {
         spec = normalizeSpec(payload?.spec);
+        assertSafeSpec(spec);
       } catch (error) {
         return rpcFail(error);
       }
@@ -236,6 +237,11 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
       const profile = String(payload?.profile ?? defaultProfile).trim();
       const packageName = String(payload?.package ?? "").trim();
       if (packageName.length === 0) return rpcFail(new Error("uninstall: package name is required"));
+      try {
+        assertSafeSpec(packageName);
+      } catch (error) {
+        return rpcFail(error);
+      }
       try {
         const profileDir = resolveProfileDir(profile);
         if (!existsSync(join(profileDir, "package.json"))) {
@@ -274,7 +280,7 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
         : `sleep 2 && ${relaunch}`;
       const child = spawn(launcher, { shell: true, detached: true, stdio: "ignore", cwd: process.cwd(), windowsHide: true });
       child.unref();
-      setTimeout(() => process.exit(0), 800);
+      setTimeout(() => process.exit(0), 1500);
       return rpcOk({ restarting: true });
     }
     case "jobCancel": {
@@ -425,7 +431,9 @@ export function apply(ctx, config = {}) {
     },
     async execute(args, exec) {
       const profile = String(args.profile ?? defaultProfile).trim();
-      const spec = await preferNpmSpec({ spec: normalizeSpec(args.spec) });
+      const normalized = normalizeSpec(args.spec);
+      assertSafeSpec(normalized);
+      const spec = await preferNpmSpec({ spec: normalized });
       await assertSafeToInstall({ spec });
       let profileDir;
       try {
@@ -481,6 +489,7 @@ export function apply(ctx, config = {}) {
       const profile = String(args.profile ?? defaultProfile).trim();
       const packageName = String(args.package ?? "").trim();
       if (packageName.length === 0) throw new Error("market_uninstall: package name is required");
+      assertSafeSpec(packageName);
       try {
         resolveProfileDir(profile);
       } catch (error) {

package/src/installer.js

@@ -361,6 +361,20 @@ export function createJobTracker() {
   };
 }
 
+// ── spec shape guard ────────────────────────────────────────────────────────
+
+// Windows spawn 走 shell，spec 会被拼进 cmd 行；agent 传入的参数不可信。
+// 合法的 npm 名 / github:owner\/repo / git·file·link·URL spec 都不含这些
+// shell 元字符——出现即拒绝，宁可误杀不放开命令注入面。
+const UNSAFE_SPEC_RE = /[;&|`$()<>^"!*\n\r]/;
+
+/** Reject install/remove specs carrying shell metacharacters. */
+export function assertSafeSpec(spec) {
+  if (UNSAFE_SPEC_RE.test(String(spec ?? ""))) {
+    throw new Error(`spec contains characters that are not allowed in an install spec: ${JSON.stringify(String(spec))}`);
+  }
+}
+
 // ── pnpm self-heal (corepack) ───────────────────────────────────────────────
 
 /**
@@ -565,10 +579,12 @@ export function runRemove({ profile, packageName }, selfHealed = false) {
     proc.on("close", (exitCode) => resolve({ exitCode, signal: proc.signalCode }));
   }).then(async (outcome) => {
     if (outcome.spawnError !== undefined) {
-      // pnpm 缺失时先 corepack 自愈一次再重试（重试在新 producer 里跑）。
+      // pnpm 缺失时先 corepack 自愈一次再重试（重试在新 producer 里跑，
+      // 这里必须返回它的 done outcome——返回 producer 本体会让 tracker
+      // 把成功任务记成 failed）。
       if (outcome.spawnError.code === "ENOENT" && selfHealed !== true) {
-        const healed = await enablePnpmViaCorepack(() => {});
-        if (healed) return runRemove({ profile, packageName }, true);
+        const healed = await enablePnpmViaCorepack(push);
+        if (healed) return await runRemove({ profile, packageName }, true).done;
       }
       const hint = outcome.spawnError.code === "ENOENT"
         ? "pnpm not found on PATH — install pnpm (e.g. `corepack enable pnpm`) to manage profile plugins"