@1e0zj/dsh-plugin-mall 0.3.2 → 0.3.4

package/src/installer.js

@@ -16,7 +16,7 @@ import { createHash } from "node:crypto";
 import { dump, load } from "js-yaml";
 import { DEFAULT_PROFILE_BUNDLES, PROFILE_TEMPLATES, initProfile, resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
 import { describeBuildScripts, npmNameOf } from "./github.js";
-import { commitPendingSnapshot, createProfileSnapshot, markPendingSnapshot, pnpmGuardEnv, pnpmSpawnPlan, readValidatedPendingSnapshot, rollbackPendingSnapshot } from "./guard.js";
+import { clearPendingApprovalPause, commitPendingSnapshot, createProfileSnapshot, markPendingApprovalPause, markPendingSnapshot, pausedCandidateBeforeState, pendingApprovalPaused, pnpmGuardEnv, pnpmSpawnPlan, readValidatedPendingSnapshot, rollbackPendingSnapshot } from "./guard.js";
 
 // ── spec normalization ──────────────────────────────────────────────────────
 
@@ -188,7 +188,20 @@ export function reconcileBundles(profileDir, beforeDeps = new Set()) {
   return result;
 }
 
-/** List a profile's installed plugins (dependencies with classification + version). */
+/**
+ * List a profile's installed plugins (dependencies with classification +
+ * version).
+ *
+ * An install paused at the build-script approval gate is reported as the
+ * snapshot has it, not as the half-written profile has it: the candidate's
+ * scripts were never approved, dsh has not loaded it, and the next startup
+ * rolls it back, so calling it "installed" tells the user the opposite of what
+ * is true — an update would show the NEW version while the old one is what is
+ * actually running and what a restart restores. A paused fresh install drops
+ * out of the list entirely. Every consumer goes through here (the browser's
+ * installed panel, the `updates` check that decides whether an update button
+ * appears, and the `market_installed` agent tool), so they all agree.
+ */
 export function listInstalled(profile) {
   const dir = resolveProfileDir(profile);
   const manifestPath = join(dir, "package.json");
@@ -209,7 +222,13 @@ export function listInstalled(profile) {
     }
     return { name, version, kind };
   });
-  return { dir, deps };
+  const before = pausedCandidateBeforeState(dir);
+  if (before === undefined) return { dir, deps };
+  if (!before.present) return { dir, deps: deps.filter((dep) => dep.name !== before.name) };
+  return {
+    dir,
+    deps: deps.map((dep) => (dep.name === before.name ? { ...dep, version: before.version ?? "?" } : dep)),
+  };
 }
 
 // ── npm registry resolution ─────────────────────────────────────────────────
@@ -1094,6 +1113,9 @@ export function createJobTracker() {
         // 待批准的构建脚本清单：浏览器侧据此渲染「允许并继续」，没有它就只有
         // 一段文本，用户看不出要批准的到底是什么。
         record.needsApproval = outcome.needsApproval;
+        // 这次失败的原因活不过一次重启（见 failedNow），浏览器据此在重启后
+        // 撤掉记录，而不是把一段现在时的描述当成当前状态留在面板上。
+        record.staleOnRestart = outcome.staleOnRestart === true;
         record.finishedAt = Date.now();
         onSettled?.(outcome);
       });
@@ -1112,6 +1134,7 @@ export function createJobTracker() {
           status: record.status,
           detail: record.detail,
           needsApproval: record.needsApproval,
+          staleOnRestart: record.staleOnRestart,
           spec: record.spec,
           startedAt: record.startedAt,
           finishedAt: record.finishedAt,
@@ -1455,14 +1478,28 @@ function runInstallInner({ profile, spec, allowBuildScripts, approvedProof, pref
   try {
     existingMarker = readValidatedPendingSnapshot(profileDir);
   } catch (error) {
-    return failedNow(`profile has an unreadable pending marker — refusing to install ${spec} (${error.message}); run \`dsh-plugin-guard guard recover\` first`);
+    return failedNow(`profile 里有一个读不出来的安装记录，无法判断它是什么，因此拒绝安装 ${spec}（${error.message}）。请先运行 \`dsh-plugin-guard guard recover\` 处理它。`);
   }
   if (existingMarker !== undefined) {
     const previous = existingMarker.metadata?.spec ?? existingMarker.metadata?.packageName ?? "unknown";
     if (existingMarker.operation !== "install" || existingMarker.metadata?.spec !== spec) {
-      return failedNow(`profile has a pending ${existingMarker.operation} transaction for ${JSON.stringify(previous)} — refusing to install ${spec}; restart dsh (startup recovery) or run \`dsh-plugin-guard guard recover\` first`);
+      // 拒绝是对的（marker 是一次性事务，不能被覆盖），但用户看不见 marker，
+      // 所以要说清楚挡路的是什么、以及怎么让它让开。暂停在批准闸的那种最
+      // 常见——它正是用户刚点过取消的那次安装。
+      const paused = pendingApprovalPaused(existingMarker) !== undefined;
+      const what = existingMarker.operation === "remove" ? "卸载" : "安装";
+      return failedNow(paused
+        ? `${previous} 的${what}还没做完——它停在「允许安装依赖」那一步等你决定，没有批准就不会真正装上。现在无法安装 ${spec}。重启 dsh 会撤回那次未批准的${what}，之后就能重新操作；也可以运行 \`dsh-plugin-guard guard recover\` 立即撤回。`
+        : `${previous} 的${what}还没了结，现在无法安装 ${spec}。重启 dsh 会自动了结它（装好的提交、没批准的撤回），也可以运行 \`dsh-plugin-guard guard recover\` 手动处理。`,
+      { staleOnRestart: true });
     }
     push(`[dsh-plugin-mall] resuming the paused install transaction for ${spec} — its original snapshot stays the rollback target\n`);
+    // 事务复活：清掉暂停标记，否则重试成功后的启动提交会被它拦下错误回滚。
+    try {
+      clearPendingApprovalPause(profileDir);
+    } catch (pauseError) {
+      push(`[dsh-plugin-mall] WARNING: could not clear the approval-pause mark: ${pauseError.message}\n`);
+    }
   } else {
     let snapshot;
     try {
@@ -1719,7 +1756,15 @@ function runInstallInner({ profile, spec, allowBuildScripts, approvedProof, pref
         // The retry's rebuild branch also needs this tree in place. Leave the
         // on-disk state and the marker for the token retry; an abandoned pause
         // is settled by startup recovery / `guard recover`, whose rollback
-        // target is still the pre-first-attempt snapshot.
+        // target is still the pre-first-attempt snapshot. The pause is also
+        // marked ON the marker: without the mark a restart that passes the
+        // static validation would commit the never-approved version and drop
+        // the snapshot (both recovery commit points check it).
+        try {
+          markPendingApprovalPause(profileDir);
+        } catch (pauseError) {
+          push(`[dsh-plugin-mall] WARNING: could not mark the pause on the pending marker: ${pauseError.message}\n`);
+        }
         push("\n[dsh-plugin-mall] install paused for build-script approval — the candidate stays installed with its scripts blocked; approve in the UI to finish, or restart dsh / run `dsh-plugin-guard guard recover` to roll back\n");
       } else {
         try {
@@ -1747,10 +1792,21 @@ function runInstallInner({ profile, spec, allowBuildScripts, approvedProof, pref
 // ── the background uninstall job ────────────────────────────────────────────
 
 /** A terminal producer for fast-fail cases (no pnpm spawn needed). */
-function failedNow(detail) {
+/**
+ * @param staleOnRestart - true when this failure's CAUSE cannot outlive a
+ *   restart, so the browser should drop the record instead of keeping it as
+ *   history. Only the "another transaction owns this profile" refusals qualify:
+ *   startup recovery settles that transaction on the way up, so the message
+ *   ("X is still waiting at the approval gate, so Y cannot install") describes a
+ *   situation that is guaranteed gone — and it is written in the present tense,
+ *   so a reader after the restart takes it for the current state. Ordinary
+ *   failures (network, preflight blockers, pnpm errors) may well still apply
+ *   after a restart and keep their diagnostic value, so they stay.
+ */
+function failedNow(detail, { staleOnRestart = false } = {}) {
   return {
     cancel: () => {},
-    done: Promise.resolve({ status: "failed", detail }),
+    done: Promise.resolve({ status: "failed", detail, staleOnRestart }),
     readOutput: () => "",
   };
 }
@@ -1786,7 +1842,11 @@ function runRemoveInner({ profile, packageName, _profileDir, _spawn }, selfHeale
   // hard as a valid one, and is left untouched for the recovery path.
   const markerPath = pendingMarkerPath(profileDir);
   if (existsSync(markerPath)) {
-    return failedNow(`profile "${profile}" has a pending install transaction (${markerPath}) — refusing to remove ${packageName} until it is resolved; restart dsh (startup recovery) or run \`dsh-plugin-guard guard recover\` first`);
+    // 存在性判断（同 markPendingSnapshot）：坏 marker 也照样挡路。所以这里
+    // 只能拿到「有」而拿不到「是什么」，文案相应保持笼统，但仍要给出路。
+    return failedNow(
+      `profile "${profile}" 里有一个还没了结的安装事务，在它了结之前无法卸载 ${packageName}。重启 dsh 会自动了结它（装好的提交、没批准的撤回），也可以运行 \`dsh-plugin-guard guard recover\` 手动处理（事务记录：${markerPath}）。`,
+      { staleOnRestart: true });
   }
   const manifestPath = join(profileDir, "package.json");
   if (!existsSync(manifestPath)) {
@@ -2175,13 +2235,50 @@ async function runTransactionFixtures() {
           && /paused for build-script approval/.test(output),
         `status=${outcome.status} calls=${calls.length} marker=${existsSync(markerBefore)}`,
       );
+      check(
+        "暂停必须落盘到 marker（metadata.paused）——重启后的恢复靠它区分「装完待验证」与「停在批准闸被放弃」",
+        (() => {
+          try {
+            const marker = JSON.parse(readFileSync(markerBefore, "utf8"));
+            return marker?.metadata?.paused?.reason === "paused for build-script approval";
+          } catch { return false; }
+        })(),
+      );
+
+      // 1a-ter. 暂停期间装别的包：拒绝是对的（marker 是一次性事务），但用户
+      // 看不见 marker，所以报错必须点名挡路的是那次「停在允许安装依赖」的
+      // 安装，并给出让它让开的办法。这里 marker 仍带 paused。
+      {
+        const during = scriptedSpawn([{ code: 0, out: "Done\n" }]);
+        const duringOutcome = await runInstall({
+          profile: "p",
+          spec: "other-during-pause",
+          preflight: preflightStub("other-during-pause"),
+          _profileDir: profileDir,
+          _spawn: during.spawnFn,
+          _describe: async () => [],
+        }).done;
+        check(
+          // staleOnRestart：这条报错是现在时写的，而挡路的事务必然被启动恢复
+          // 了结——留到重启之后会被当成当前状态读，所以面板要撤掉它。
+          "暂停期间装别的包 → 拒绝，报错点名「停在允许安装依赖」+ 撤回办法 + 标记重启后失效",
+          duringOutcome.status === "failed"
+            && /停在「允许安装依赖」/.test(duringOutcome.detail ?? "")
+            && /重启 dsh/.test(duringOutcome.detail ?? "")
+            && duringOutcome.staleOnRestart === true
+            && during.calls.length === 0,
+          `status=${duringOutcome.status} detail=${(duringOutcome.detail ?? "").slice(0, 120)}`,
+        );
+      }
 
       // 1a-bis. 同 spec 重试接管暂停的 marker：不再新建快照（回滚目标仍是
-      // 第一次安装前的现场），继续 spawn pnpm；异 spec 则拒绝且不 spawn。
+      // 第一次安装前的现场），继续 spawn pnpm；这次给批准后的成功路径——
+      // completed 后 marker 保留给启动提交，且暂停标记必须已被接管清掉
+      // （否则启动提交会被它拦下错误回滚）。异 spec 则拒绝且不 spawn。
       {
         const snapshotRootDir = join(dirname(dirname(profileDir)), "guard", "snapshots");
         const snapshotsBefore = readdirSync(snapshotRootDir, { withFileTypes: true }).filter((e) => e.isDirectory()).length;
-        const retry = scriptedSpawn([{ code: 0, out: "Ignored build scripts: node-pty@1.0.0\nDone\n" }]);
+        const retry = scriptedSpawn([{ code: 0, out: "Done in 1s\n" }]);
         const retryProducer = runInstall({
           profile: "p",
           spec: "some-plugin",
@@ -2194,12 +2291,18 @@ async function runTransactionFixtures() {
         const retryOutput = retryProducer.readOutput();
         const snapshotsAfter = readdirSync(snapshotRootDir, { withFileTypes: true }).filter((e) => e.isDirectory()).length;
         check(
-          "同 spec 重试接管暂停的 marker → 复用原快照，继续安装而非拒绝",
-          retryOutcome.status === "failed"
-            && Array.isArray(retryOutcome.needsApproval)
+          "同 spec 重试接管暂停的 marker → 复用原快照、继续安装并清掉暂停标记",
+          retryOutcome.status === "completed"
             && retry.calls.length === 1
             && /resuming the paused install transaction/.test(retryOutput)
-            && snapshotsAfter === snapshotsBefore,
+            && snapshotsAfter === snapshotsBefore
+            && existsSync(markerBefore)
+            && (() => {
+              try {
+                const marker = JSON.parse(readFileSync(markerBefore, "utf8"));
+                return marker?.metadata?.paused === undefined;
+              } catch { return false; }
+            })(),
           `status=${retryOutcome.status} calls=${retry.calls.length} snapshots=${snapshotsBefore}->${snapshotsAfter}`,
         );
         const other = scriptedSpawn([{ code: 0, out: "Done\n" }]);
@@ -2212,9 +2315,13 @@ async function runTransactionFixtures() {
           _describe: async () => [],
         }).done;
         check(
-          "异 spec 遇暂停 marker → 拒绝且不 spawn",
+          // 此刻 paused 已被上面的接管清掉，所以报错走的是「未了结」那一支，
+          // 而不是「停在允许安装依赖」那一支。
+          "异 spec 遇既有（已非暂停）marker → 拒绝且不 spawn",
           otherOutcome.status === "failed"
-            && /pending install transaction/.test(otherOutcome.detail ?? "")
+            && /还没了结/.test(otherOutcome.detail ?? "")
+            && !/停在「允许安装依赖」/.test(otherOutcome.detail ?? "")
+            && otherOutcome.staleOnRestart === true
             && other.calls.length === 0,
           `status=${otherOutcome.status} calls=${other.calls.length}`,
         );
@@ -2551,6 +2658,8 @@ async function runTransactionFixtures() {
           && installOutcome.status === "failed"
           && removeOutcome.status === "failed"
           && /not a dependency/.test(removeOutcome.detail ?? "")
+          // 普通失败不标记：重启治不好「这个包本来就不在依赖里」。
+          && removeOutcome.staleOnRestart !== true
           && procs.length === 1,
         `procs=${procs.length} install=${installOutcome.status} remove=${removeOutcome.status} ${JSON.stringify(removeOutcome.detail)}`,
       );
@@ -2579,9 +2688,12 @@ async function runTransactionFixtures() {
       const snapshotsDir = join(dirname(marker), "snapshots");
       const leftoverSnapshots = existsSync(snapshotsDir) ? readdirSync(snapshotsDir) : [];
       check(
-        "损坏/既有 pending marker → install 不 spawn、不覆盖证据、不遗留新 snapshot",
+        // 不标 staleOnRestart：损坏的 marker 重启后仍然 fail-closed 留给人工
+        // 检查，不会被启动恢复了结——这条失败的原因活得过重启，面板要留着。
+        "损坏/既有 pending marker → install 不 spawn、不覆盖证据、不遗留新 snapshot，且不标记重启后失效",
         outcome.status === "failed"
-          && /unreadable pending marker/.test(outcome.detail ?? "")
+          && /读不出来的安装记录/.test(outcome.detail ?? "")
+          && outcome.staleOnRestart !== true
           && calls.length === 0
           && readFileSync(marker, "utf8") === corruptBytes
           && leftoverSnapshots.length === 0,
@@ -2604,7 +2716,8 @@ async function runTransactionFixtures() {
       check(
         "pending marker 存在 → remove 拒绝执行且不 spawn pnpm，marker 保留",
         outcome.status === "failed"
-          && /pending install transaction/.test(outcome.detail ?? "")
+          && /还没了结的安装事务/.test(outcome.detail ?? "")
+          && outcome.staleOnRestart === true
           && procs.length === 0
           && existsSync(pendingMarkerPath(profileDir)),
         `status=${outcome.status} procs=${procs.length} ${JSON.stringify(outcome.detail)}`,