@1e0zj/dsh-plugin-mall 0.4.7 → 0.4.14

package/src/installer.js

@@ -16,7 +16,8 @@ import { createHash } from "node:crypto";
 import { dump, load } from "js-yaml";
 import { DEFAULT_PROFILE_BUNDLES, PROFILE_TEMPLATES, initProfile, resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
 import { describeBuildScripts, npmNameOf } from "./github.js";
-import { clearPendingApprovalPause, commitPendingSnapshot, createProfileSnapshot, describeRollbackRebuild, markPendingApprovalPause, markPendingSnapshot, mcpEntryAuditForInstall, pausedCandidateBeforeState, pendingApprovalPaused, pnpmGuardEnv, pnpmSpawnPlan, readValidatedPendingSnapshot, rollbackPendingSnapshot, validateInstalledProfile, validateRemoveCompletion } from "./guard.js";
+import { clearPendingApprovalPause, commitPendingSnapshot, createProfileSnapshot, describeRollbackRebuild, markPendingApprovalPause, markPendingSnapshot, mcpEntryAuditForInstall, pausedCandidateBeforeState, pendingApprovalPaused, pnpmGuardEnv, pnpmSpawnPlan, readValidatedPendingSnapshot, rollbackPendingSnapshot, validatePendingProfile, validateRemoveCompletion } from "./guard.js";
+import { stripTerminalControlSequences } from "./terminal.js";
 
 // ── spec normalization ──────────────────────────────────────────────────────
 
@@ -630,12 +631,20 @@ const NPM_NAME_RE = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/i;
  */
 function parseIgnoredBuilds(output) {
   const found = new Map();
+  // pnpm enables colours even though stdout/stderr are pipes on some Windows
+  // setups (observed with pnpm 11).  A reset code after the selector makes the
+  // anchored `@version` parser miss, so `node-pty@1.1.0\x1b[39m` used to be
+  // treated as an invalid package name and the approval pause became an
+  // ordinary failed install. Strip CSI terminal controls again here as a
+  // fail-closed parsing boundary; the stream capture already removes them from
+  // the plain-text job log shown to users.
+  const plainOutput = stripTerminalControlSequences(output);
   // Only pnpm's own notice line is a parsing source. "allowBuilds" also
   // appears in pnpm's advice/error text (never followed by a name list), and
   // matching it fed error echoes into the allow-list, corrupting the YAML.
   const pattern = /(?:Ignored build scripts|onlyBuiltDependencies)\s*:\s*([^\n]+)/gi;
   let match;
-  while ((match = pattern.exec(output)) !== null) {
+  while ((match = pattern.exec(plainOutput)) !== null) {
     for (const raw of match[1].split(",")) {
       const candidate = raw.trim();
       if (candidate.length === 0) continue;
@@ -1562,10 +1571,11 @@ function pendingMarkerPath(profileDir) {
 function renderApprovalNeeded(spec, disclosure) {
   const lines = [
     `installing ${spec} requires running install-time code — approval needed.`,
-    "No install script ran and no plugin code loaded. The profile was restored",
-    "to its pre-install state. On approval, pnpm resolves again with scripts",
-    "blocked; the materialized bytes and commands must match this disclosure",
-    "before the verified tree is rebuilt. Nothing is left behind if you cancel.",
+    "No install script ran and no plugin code loaded. The candidate is staged",
+    "with its scripts blocked, and the original profile snapshot is retained.",
+    "On approval, the materialized bytes and commands must match this disclosure",
+    "before the verified tree is rebuilt. If you do not approve, restart dsh or",
+    "run `dsh-plugin-guard guard recover` to roll the paused transaction back.",
     "",
   ];
   for (const entry of disclosure) {
@@ -1661,8 +1671,9 @@ function runInstallInner({ profile, spec, allowBuildScripts, approvedProof, pref
   const collected = [];
   const deltaQueue = [];
   const push = (text) => {
-    collected.push(text);
-    deltaQueue.push(text);
+    const plainText = stripTerminalControlSequences(text);
+    collected.push(plainText);
+    deltaQueue.push(plainText);
   };
 
   const workspacePath = join(profileDir, "pnpm-workspace.yaml");
@@ -2154,7 +2165,7 @@ function runRemoveInner({ profile, packageName, _profileDir, _spawn, _corepack =
   }
   const deltaQueue = [];
   const push = (text) => {
-    deltaQueue.push(text);
+    deltaQueue.push(stripTerminalControlSequences(text));
   };
   let current = undefined;
   let cancelRequested = false; // see endedByCancel: exit codes cannot tell us this on Windows
@@ -2221,7 +2232,7 @@ function runRemoveInner({ profile, packageName, _profileDir, _spawn, _corepack =
   try {
     proc = (_spawn ?? spawn)(plan.command, ["remove", packageName, "--reporter=append-only"], {
       cwd: profileDir,
-      env: process.env,
+      env: pnpmGuardEnv(process.env),
       shell: plan.shell,
       stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true,
@@ -2284,7 +2295,7 @@ function runRemoveInner({ profile, packageName, _profileDir, _spawn, _corepack =
       // 退出码 0 不等于卸干净了。落盘校验用的是启动恢复同一套判据：
       // profile 整体仍然自洽，且这个包确实从清单和装配层里消失了。任何一条
       // 不过就还原——一个「装着但坏」的 profile 比一个没卸掉的插件糟得多。
-      const profileCheck = validateInstalledProfile(profileDir);
+      const profileCheck = validatePendingProfile(profileDir);
       const removeCheck = validateRemoveCompletion(profileDir, packageName);
       if (!profileCheck.ok || !removeCheck.ok) {
         const blockers = [...profileCheck.issues, ...removeCheck.issues]
@@ -2703,7 +2714,10 @@ async function runTransactionFixtures() {
     try {
       materializeFakePackage(profileDir, "some-plugin", "1.0.0");
       materializeFakePackage(profileDir, "node-pty", "1.0.0", { install: "node install.js" });
-      const { spawnFn, calls } = scriptedSpawn([{ code: 0, out: "Packages are cloned\nIgnored build scripts: node-pty@1.0.0\nDone\n" }]);
+      // pnpm 11 on Windows may colour stderr even when it is captured through a
+      // pipe.  In particular, the reset code lands directly after the selector.
+      const colouredIgnoredBuilds = "Packages are cloned\n\u001b[31mIgnored build scripts: node-pty@1.0.0\u001b[39m\nDone\n";
+      const { spawnFn, calls } = scriptedSpawn([{ code: 0, out: colouredIgnoredBuilds }]);
       const producer = runInstall({
         profile: "p",
         spec: "some-plugin",
@@ -2725,7 +2739,7 @@ async function runTransactionFixtures() {
       const output = producer.readOutput();
       const markerBefore = pendingMarkerPath(profileDir);
       check(
-        "退出码 0 + Ignored build scripts（未批准）→ 停在批准闸，返回 proof，不 finalize，暂停保留 marker",
+        "退出码 0 + 彩色 Ignored build scripts（未批准）→ 停在批准闸，返回 proof，不 finalize，暂停保留 marker",
         outcome.status === "failed"
           && Array.isArray(outcome.needsApproval)
           && outcome.needsApproval.some((entry) => entry.name === "node-pty")
@@ -2740,7 +2754,11 @@ async function runTransactionFixtures() {
             && entry.weeklyDownloads === 123)
           && calls.length === 1
           && existsSync(markerBefore)
-          && /paused for build-script approval/.test(output),
+          && /candidate is staged/.test(outcome.detail ?? "")
+          && !/profile was restored/.test(outcome.detail ?? "")
+          && /paused for build-script approval/.test(output)
+          && /Ignored build scripts: node-pty@1\.0\.0/.test(output)
+          && !output.includes("\u001b["),
         `status=${outcome.status} calls=${calls.length} marker=${existsSync(markerBefore)}`,
       );
       check(
@@ -3413,7 +3431,7 @@ async function runTransactionFixtures() {
       let snapshotsWhileRunning = [];
       const { spawnFn } = scriptedSpawn([{
         code: 0,
-        out: "Done\n",
+        out: "\u001b[32mDone\u001b[39m\n",
         // pnpm 真正卸掉：清单与目录都拿走，落盘校验才会通过。
         beforeExit: () => {
           snapshotsWhileRunning = listSnapshots();
@@ -3423,14 +3441,17 @@ async function runTransactionFixtures() {
           rmSync(join(profileDir, "node_modules", "pkg-f"), { recursive: true, force: true });
         },
       }]);
-      const outcome = await runRemove({ profile: "p", packageName: "pkg-f", _profileDir: profileDir, _spawn: spawnFn }).done;
+      const producer = runRemove({ profile: "p", packageName: "pkg-f", _profileDir: profileDir, _spawn: spawnFn });
+      const outcome = await producer.done;
+      const output = producer.readOutput();
       const snapshotsLeft = listSnapshots();
       check(
-        "卸载成功 → marker 与 snapshot 都被提交清理（且快照确实创建过）",
+        "卸载成功 → 日志去色，marker 与 snapshot 都被提交清理（且快照确实创建过）",
         outcome.status === "completed"
           && snapshotsWhileRunning.length === 1
           && !existsSync(pendingMarkerPath(profileDir))
-          && snapshotsLeft.length === 0,
+          && snapshotsLeft.length === 0
+          && output === "Done\n",
         `status=${outcome.status} 运行中快照=${snapshotsWhileRunning.join(",")} marker=${existsSync(pendingMarkerPath(profileDir))} 残留快照=${snapshotsLeft.join(",")} detail=${JSON.stringify(outcome.detail)}`,
       );
     } finally {

package/src/restart-protocol.js

@@ -2,10 +2,33 @@
 // standalone guard CLI.  The parent must not infer readiness from a child pid:
 // an incompatible CLI can spawn successfully and then die on argument parsing.
 
+import { readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+
 export const RESTART_HELPER_READY_TYPE = "@1e0zj/dsh-plugin-mall:restart-helper-ready";
 export const RESTART_HELPER_PROTOCOL_VERSION = 1;
 export const RESTART_RESPONSE_DRAIN_MS = 1000;
 
+// cmd.exe metacharacters. Rather than "escaping" these for a cmd round trip
+// (cmd's quoting rules are famously inconsistent), the launch wrapper refuses
+// them outright — a dsh invocation never needs them.
+export const CMD_METACHAR_RE = /[&|<>^%!\r\n]/;
+
+/**
+ * Quote one token for a %ComSpec% /d /s /c command line. Follows the MSVCRT /
+ * CommandLineToArgvW rules (backslashes before a quote or the closing quote are
+ * doubled, quotes become \") and rejects cmd metacharacters instead of trying
+ * to escape them. The command after `--` is never concatenated unquoted.
+ */
+export function quoteCmdArg(token) {
+  const value = String(token ?? "");
+  if (value.length === 0) return '""';
+  if (CMD_METACHAR_RE.test(value)) {
+    throw new Error(`cannot quote safely for cmd.exe (shell metacharacter present): ${JSON.stringify(value)}`);
+  }
+  const escaped = value.replace(/(\\*)"/g, "$1$1\\\"").replace(/(\\+)$/, "$1$1");
+  return `"${escaped}"`;
+}
+
 export function createRestartHelperReadyMessage(awaitExitPid) {
   return {
     type: RESTART_HELPER_READY_TYPE,
@@ -142,3 +165,238 @@ export function superviseRestartHelper(child, {
     state: () => phase,
   };
 }
+
+// ── restart plan & file-channel handoff (Windows visible console) ────────────
+//
+// A visible restart launches the guard through `cmd /c start`: the guard runs
+// in a brand-new console as a grandchild, so neither stdio nor an IPC channel
+// connects it back to the old Host. The launch plan travels as a JSON file
+// (never concatenated into the cmd command line), and readiness is
+// acknowledged through a second file with the same semantics the IPC message
+// carries.
+
+export const RESTART_PLAN_TYPE = "@1e0zj/dsh-plugin-mall:restart-plan";
+export const RESTART_PLAN_VERSION = 1;
+
+/**
+ * Validate the payload of a restart plan file. Structural checks only:
+ * profile-name safety is enforced where the name builds paths (the guard's
+ * profileDirOf / the plugin's assertSafeProfileName), not here.
+ */
+export function validateRestartPlanPayload(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return { ok: false, error: "restart plan is not a JSON object" };
+  }
+  if (value.version !== RESTART_PLAN_VERSION) {
+    return { ok: false, error: `restart plan version ${JSON.stringify(value.version)} is not supported (expected ${RESTART_PLAN_VERSION})` };
+  }
+  if (value.type !== RESTART_PLAN_TYPE) {
+    return { ok: false, error: `restart plan type ${JSON.stringify(value.type)} does not match ${RESTART_PLAN_TYPE}` };
+  }
+  for (const key of ["profile", "logPath", "readyFile", "cwd", "command"]) {
+    if (typeof value[key] !== "string" || value[key].length === 0) {
+      return { ok: false, error: `restart plan field ${JSON.stringify(key)} must be a non-empty string` };
+    }
+  }
+  if (!Number.isInteger(value.awaitExitPid) || value.awaitExitPid <= 0) {
+    return { ok: false, error: `restart plan awaitExitPid ${JSON.stringify(value.awaitExitPid)} must be a positive integer` };
+  }
+  if (!Array.isArray(value.args) || value.args.length === 0 || value.args.some((entry) => typeof entry !== "string")) {
+    return { ok: false, error: "restart plan args must be a non-empty array of strings" };
+  }
+  return { ok: true, plan: value };
+}
+
+/**
+ * Atomically publish the helper-ready handshake as a file: write a sibling
+ * .tmp, then rename onto the final path (nonce-unique, so it does not exist
+ * yet), so the parent never observes half-written JSON. The parent — and only
+ * the parent — deletes the file after consuming it; the writer never touches
+ * it again, which is what keeps a healthy handoff from racing its own cleanup.
+ */
+export function writeRestartHelperReadyFile(readyFile, { awaitExitPid, guardPid }) {
+  const message = {
+    type: RESTART_HELPER_READY_TYPE,
+    protocol: RESTART_HELPER_PROTOCOL_VERSION,
+    awaitExitPid,
+    guardPid,
+  };
+  const tmp = `${readyFile}.tmp`;
+  writeFileSync(tmp, `${JSON.stringify(message)}\n`);
+  renameSync(tmp, readyFile);
+}
+
+/** Read a ready file; a missing or unparseable file reads as "not yet". */
+export function readRestartHelperReadyFile(readyFile) {
+  let text;
+  try {
+    text = readFileSync(readyFile, "utf8");
+  } catch {
+    return undefined;
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    return undefined;
+  }
+}
+
+function defaultProbePid(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    if (error?.code === "EPERM") return true; // exists, not ours to signal
+    // ESRCH — and anything unprobeable — reads as gone: fail closed and keep
+    // the old Host rather than trusting an uncertain probe.
+    return false;
+  }
+}
+
+/**
+ * File-channel twin of superviseRestartHelper, phase for phase: handshake
+ * (poll the ready file) → stability (probe the guard pid) → accepted (the RPC
+ * may answer now — but keep probing) → committed (onHostExit). Continuing to
+ * probe through accepted mirrors the IPC version's live exit listener: a guard
+ * that dies after the RPC answered still cancels the old Host's exit instead
+ * of leaving it gone with no successor.
+ *
+ * The guard pid is only ever killed from a payload whose type identifies it
+ * as one of our restart helpers; garbage or unrelated files never turn into a
+ * kill of an unrelated (possibly recycled) pid. `failFast` lets the caller
+ * surface an early external failure (e.g. cmd itself exited nonzero before
+ * the guard ever started) without waiting out the handshake timeout.
+ */
+export function superviseRestartHelperFile({
+  readyFile,
+  awaitExitPid,
+  handshakeTimeoutMs = 5000,
+  stabilityMs = 600,
+  responseDelayMs = RESTART_RESPONSE_DRAIN_MS,
+  pollMs = 100,
+  probe = defaultProbePid,
+  kill = (pid) => process.kill(pid),
+  onHostExit = () => process.exit(0),
+  onFailure = () => {},
+} = {}) {
+  let phase = "handshake";
+  let deadlineTimer;
+  let pollTimer;
+  let probeTimer;
+  let guardPid;
+  let readySettled = false;
+  let resolveReady;
+  const ready = new Promise((resolvePromise) => { resolveReady = resolvePromise; });
+
+  const clearTimers = () => {
+    if (deadlineTimer !== undefined) {
+      clearTimeout(deadlineTimer);
+      deadlineTimer = undefined;
+    }
+    // pollTimer included: a terminal state must leave no polling interval
+    // behind, or the Host process can never exit naturally.
+    if (pollTimer !== undefined) {
+      clearInterval(pollTimer);
+      pollTimer = undefined;
+    }
+    if (probeTimer !== undefined) {
+      clearInterval(probeTimer);
+      probeTimer = undefined;
+    }
+  };
+  const bestEffortUnlink = () => {
+    try { unlinkSync(readyFile); } catch { /* nonce-named residue is inert */ }
+  };
+  const settleReady = (result) => {
+    if (readySettled) return;
+    readySettled = true;
+    resolveReady(result);
+  };
+  const terminateGuard = () => {
+    if (guardPid === undefined) return;
+    try { kill(guardPid); } catch { /* already gone */ }
+  };
+  const fail = (message, { terminate = false } = {}) => {
+    if (phase === "failed" || phase === "disposed" || phase === "committed") return;
+    const afterReady = readySettled;
+    phase = "failed";
+    clearTimers();
+    if (terminate) terminateGuard();
+    bestEffortUnlink();
+    settleReady({ ok: false, error: message });
+    try { onFailure(message, { afterReady }); } catch { /* diagnostics are best effort */ }
+  };
+
+  function acceptHandshake(message) {
+    phase = "stability";
+    clearTimers(); // the handshake deadline no longer applies
+    guardPid = message.guardPid;
+    bestEffortUnlink(); // the parent owns the ready file's lifecycle
+    probeTimer = setInterval(() => {
+      if (phase !== "stability" && phase !== "accepted") return;
+      if (!probe(message.guardPid)) {
+        fail(
+          `restart helper (pid ${message.guardPid}) exited ${phase === "stability" ? "during the stability window" : "after the handoff was accepted"}`,
+        );
+      }
+    }, pollMs);
+    deadlineTimer = setTimeout(() => {
+      if (phase !== "stability") return;
+      phase = "accepted";
+      settleReady({ ok: true });
+      // Keep watching until committed; a death here cancels the pending exit.
+      deadlineTimer = setTimeout(() => {
+        if (phase !== "accepted") return;
+        phase = "committed";
+        clearTimers();
+        try {
+          onHostExit();
+        } catch (error) {
+          phase = "failed";
+          try { onFailure(`could not exit old Host: ${error?.message ?? String(error)}`, { afterReady: true }); } catch { /* best effort */ }
+        }
+      }, responseDelayMs);
+    }, stabilityMs);
+  }
+
+  function pollOnce() {
+    if (phase !== "handshake") return;
+    const message = readRestartHelperReadyFile(readyFile);
+    if (message?.type !== RESTART_HELPER_READY_TYPE) return; // missing/half-written/unrelated
+    if (!Number.isInteger(message.guardPid) || message.guardPid <= 0) return;
+    if (message.protocol !== RESTART_HELPER_PROTOCOL_VERSION || message.awaitExitPid !== awaitExitPid) {
+      // Identified as one of our helpers but speaking the wrong protocol or
+      // waiting for a different Host: stop it rather than let it linger.
+      guardPid = message.guardPid;
+      fail(
+        `restart helper protocol mismatch (expected v${RESTART_HELPER_PROTOCOL_VERSION} for pid ${awaitExitPid})`,
+        { terminate: true },
+      );
+      return;
+    }
+    acceptHandshake(message);
+  }
+
+  deadlineTimer = setTimeout(() => {
+    if (phase !== "handshake") return;
+    fail(`restart helper did not write ${readyFile} within ${handshakeTimeoutMs}ms`);
+  }, handshakeTimeoutMs);
+  pollTimer = setInterval(pollOnce, pollMs);
+  pollOnce(); // an already-present ready file must not wait out one interval
+
+  const dispose = () => {
+    if (phase === "failed" || phase === "disposed" || phase === "committed") return;
+    phase = "disposed";
+    clearTimers();
+    terminateGuard();
+    bestEffortUnlink();
+    settleReady({ ok: false, error: "restart handoff cancelled because the plugin unloaded" });
+  };
+
+  return {
+    ready,
+    dispose,
+    failFast: (message) => fail(message, { terminate: true }),
+    state: () => phase,
+  };
+}

package/src/terminal.js

@@ -0,0 +1,11 @@
+// Job logs are rendered as plain text in the browser. Child processes such as
+// pnpm may still emit terminal colour controls when their stdio is piped (for
+// example when FORCE_COLOR is inherited), which the browser shows as `[96m`.
+// Keep the sanitizer dependency-free and limited to CSI sequences: those cover
+// pnpm's colours/progress controls without deleting ordinary user text.
+
+const ANSI_CSI_RE = new RegExp("\\u001b\\[[0-?]*[ -/]*[@-~]", "g");
+
+export function stripTerminalControlSequences(value) {
+  return String(value ?? "").replace(ANSI_CSI_RE, "");
+}