@1e0zj/dsh-plugin-mall 0.4.2 → 0.4.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1e0zj/dsh-plugin-mall",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "dsh 插件市场：搜索 GitHub dsh-plugin 话题下的插件仓库，一键安装到本地 dsh profile（agent 工具 + 设置页插件市场 tab）",
   "type": "module",
   "main": "src/index.js",

package/src/client.js

@@ -499,10 +499,10 @@ window.__ModuleLoader__.load({
                 busy: props.approving === job.spec,
                 onApprove: function (names) {
                   // 不先 drop：旧条目由重试任务的 track(carryFromId) 原子接管
-                  // （撤条目 + 日志接续一拍完成）。先删的话，call("install")
-                  // 要走数秒（重试还会重跑一次隔离预检），面板会空白一段，
-                  // 「批准后任务消失、开始安装才冒出来」的割裂就是这么来的。
-                  // 等待期间按钮由 approving 态显示「继续中…」。
+                  // （撤条目 + 日志接续一拍完成）。install RPC 现在只做本地校验、
+                  // 立刻返回新 job id，但保留这个次序仍然是它最稳的形态——
+                  // 万一 RPC 失败，旧条目和日志还在。等待期间按钮由 approving
+                  // 态显示「继续中…」。
                   props.onApprove(job.spec, names, job.approvalToken, id);
                 },
                 onDismiss: function () { props.onDismiss(id); },
@@ -1056,7 +1056,10 @@ window.__ModuleLoader__.load({
             var spec = preflight.spec;
             var carry = preflight.jobId;
             setPreflight(null);
-            doRawInstall(spec, { acceptWarnings: true }, carry);
+            // consentDigest 来自预检 job 的 extras，装的时候与当前报告比对：
+            // 用户点「继续」到安装真正开跑之间候选包或 profile 变了，
+            // 布尔同意不得沿用，要重新看新的警告。
+            doRawInstall(spec, { acceptWarnings: true, acceptedReportDigest: preflight.report.consentDigest }, carry);
           },
           onClose: function () {
             if (preflight && preflight.spec) delete approvalTokensRef.current[preflight.spec];

package/src/github.js

@@ -173,16 +173,19 @@ function normalizeRegistry(registry) {
  * @param name - the npm package name.
  * @param options - `registry` defaults to npmjs; pass what pnpm installs from.
  *   `signal` cancels the request (and, critically, keeps the cancellation out
- *   of the cache — see below).
+ *   of the cache — see below). `fresh` skips the read side of the cache: a
+ *   cached "current version" is stale by construction, and the preflight
+ *   staleness check exists precisely to compare against what the registry
+ *   says NOW (the write side still populates the cache for other callers).
  * @returns `{latest, repositoryUrl, hostDeps}`, or null when unknown/unreachable.
  */
-export async function npmPackageInfo(name, { registry, signal } = {}) {
+export async function npmPackageInfo(name, { registry, signal, fresh = false } = {}) {
   const clean = String(name ?? "").trim();
   if (clean.length === 0 || !/^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/i.test(clean)) return null;
   const base = normalizeRegistry(registry);
   const key = `${base}|${clean}`;
   const cached = npmCache.get(key);
-  if (cached !== undefined && Date.now() - cached.at < NPM_CACHE_TTL) return cached.info;
+  if (fresh !== true && cached !== undefined && Date.now() - cached.at < NPM_CACHE_TTL) return cached.info;
   let info = null;
   try {
     // 单版本端点返回 latest 的完整 manifest（dependencies + repository 都在）。
@@ -215,6 +218,44 @@ export async function npmPackageInfo(name, { registry, signal } = {}) {
   return info;
 }
 
+const npmVersionsCache = new Map();
+
+/**
+ * All published version strings of a package, oldest to newest, for resolving
+ * a RANGE spec ("pkg@^1.2.0") to the version pnpm would actually pick today.
+ * `/latest` cannot answer that — a new release inside the range is invisible
+ * to it until it becomes latest. Fetches the full packument (one request),
+ * which is why this lives behind its own TTL like npmPackageInfo. Same
+ * cancellation rule: AbortError is rethrown, never cached as an empty answer.
+ * @returns string[], or null when unreachable/unknown.
+ */
+export async function npmPackageVersions(name, { registry, signal, fresh = false } = {}) {
+  const clean = String(name ?? "").trim();
+  if (clean.length === 0 || !/^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/i.test(clean)) return null;
+  const base = normalizeRegistry(registry);
+  const key = `${base}|${clean}`;
+  const cached = npmVersionsCache.get(key);
+  if (fresh !== true && cached !== undefined && Date.now() - cached.at < NPM_CACHE_TTL) return cached.versions;
+  let versions = null;
+  try {
+    const response = await fetch(`${base}/${clean.replace("/", "%2F")}`, {
+      headers: { "User-Agent": "dsh-plugin-mall", Accept: "application/json" },
+      signal,
+    });
+    if (response.ok) {
+      const body = await response.json();
+      if (body?.versions !== null && typeof body?.versions === "object") {
+        versions = Object.keys(body.versions);
+      }
+    }
+  } catch (error) {
+    if (error?.name === "AbortError") throw error;
+    versions = null;
+  }
+  npmVersionsCache.set(key, { versions, at: Date.now() });
+  return versions;
+}
+
 /**
  * Rewrite "github:owner/repo" (or "owner/repo") to the npm package name when
  * that package exists on npm AND its repository URL points back at the repo