@chatcode/cco-market 1.45.1

package/lib/ndjson.js

@@ -0,0 +1,154 @@
+/**
+ * pnpm `--reporter=ndjson` progress parser (P1-6).
+ *
+ * pnpm's ndjson reporter is a bole stream on stdout: one JSON object per
+ * line, e.g.
+ *
+ *   {"time":...,"level":"debug","name":"pnpm:stage","prefix":"...","stage":"resolution_started"}
+ *   {"time":...,"level":"debug","name":"pnpm:progress","packageId":"...","status":"resolved"}
+ *   {"time":...,"level":"debug","name":"pnpm:fetching-progress","packageId":"...","status":"started","size":123}
+ *   {"time":...,"level":"debug","name":"pnpm:ignored-scripts","packageNames":["esbuild"]}
+ *   {"time":...,"level":"error","name":"pnpm","err":{"message":"..."}}
+ *
+ * Verified against real pnpm 11.16.0 output (2026-08). Older pnpm majors
+ * emit a different shape or nothing at all — callers fall back to human
+ * line parsing when `seen` stays false.
+ *
+ * The reducer is pure and unit-testable: `feed` mutates the tracker's
+ * internal snapshot, `snapshot` returns a serializable copy.
+ */
+export function emptyProgress() {
+    return {
+        phase: null,
+        done: 0,
+        total: null,
+        currentPackage: null,
+        downloaded: null,
+        size: null,
+        seen: false,
+        error: null,
+        errorCode: null,
+        ignoredBuilds: [],
+    };
+}
+export function createProgressTracker() {
+    const snap = emptyProgress();
+    const seenPackages = new Set();
+    function dedupe(packageId) {
+        if (typeof packageId !== 'string' || packageId === '')
+            return;
+        if (!seenPackages.has(packageId)) {
+            seenPackages.add(packageId);
+            snap.done += 1;
+        }
+    }
+    function feed(line) {
+        let event;
+        try {
+            event = JSON.parse(line);
+        }
+        catch {
+            return; // human fallback lines are handled by the caller
+        }
+        if (typeof event !== 'object' || event === null)
+            return;
+        const msg = event;
+        const name = msg.name;
+        if (typeof name !== 'string')
+            return;
+        if (name === 'pnpm:stage') {
+            const stage = msg.stage;
+            if (stage === 'resolution_started')
+                snap.phase = 'resolving';
+            else if (stage === 'resolution_done')
+                snap.phase = 'downloading';
+            else if (stage === 'importing_started' || stage === 'importing_done')
+                snap.phase = 'linking';
+            snap.seen = true;
+            return;
+        }
+        if (name === 'pnpm:progress') {
+            snap.seen = true;
+            const status = msg.status;
+            if (status === 'resolved') {
+                if (snap.phase === null)
+                    snap.phase = 'resolving';
+                dedupe(msg.packageId);
+            }
+            else if (status === 'fetched' || status === 'found_in_store') {
+                snap.phase = 'downloading';
+                snap.currentPackage = typeof msg.packageId === 'string' ? msg.packageId : snap.currentPackage;
+                dedupe(msg.packageId);
+            }
+            return;
+        }
+        if (name === 'pnpm:fetching-progress') {
+            snap.seen = true;
+            snap.phase = 'downloading';
+            if (typeof msg.packageId === 'string')
+                snap.currentPackage = msg.packageId;
+            if (typeof msg.size === 'number')
+                snap.size = msg.size;
+            if (typeof msg.downloaded === 'number')
+                snap.downloaded = msg.downloaded;
+            dedupe(msg.packageId);
+            return;
+        }
+        if (name === 'pnpm:lifecycle') {
+            snap.seen = true;
+            snap.phase = 'building';
+            const wd = typeof msg.wd === 'string' ? msg.wd : '';
+            const dep = typeof msg.depPath === 'string' ? msg.depPath : '';
+            const base = wd.split(/[\\/]/).filter(Boolean).pop();
+            snap.currentPackage = base ?? (dep !== '' ? dep : snap.currentPackage);
+            return;
+        }
+        if (name === 'pnpm:stats') {
+            // added/removed counts land after the import pass — still linking.
+            if (msg.added !== undefined || msg.removed !== undefined)
+                snap.phase = 'linking';
+            snap.seen = true;
+            return;
+        }
+        if (name === 'pnpm:ignored-scripts') {
+            snap.seen = true;
+            if (Array.isArray(msg.packageNames)) {
+                for (const pkg of msg.packageNames) {
+                    // pnpm's ndjson event reports version-qualified names (cloudflared@0.7.3);
+                    // the approve-builds allowlist keys and node_modules lookups use bare
+                    // package names, so strip the suffix (same rule as the human-line
+                    // fallback in install.ts's parseIgnoredBuilds).
+                    const at = typeof pkg === 'string' ? pkg.lastIndexOf('@') : -1;
+                    const bare = at > 0 ? pkg.slice(0, at) : pkg;
+                    if (typeof bare === 'string' && bare !== '' && !snap.ignoredBuilds.includes(bare))
+                        snap.ignoredBuilds.push(bare);
+                }
+            }
+            return;
+        }
+        if (name === 'pnpm' && msg.level === 'error') {
+            const err = (msg.err ?? {});
+            const message = typeof err.message === 'string' ? err.message : '';
+            // Keep more than the old 400: ERR_PNPM_UNEXPECTED_STORE spends most of
+            // its message naming two absolute store paths, and truncating them is
+            // exactly the information a user needs to fix it by hand (#244).
+            if (message !== '')
+                snap.error = message.slice(0, 2000);
+            if (typeof err.code === 'string' && err.code !== '')
+                snap.errorCode = err.code;
+            return;
+        }
+    }
+    function reset() {
+        seenPackages.clear();
+        const fresh = emptyProgress();
+        Object.assign(snap, fresh);
+    }
+    return {
+        get snapshot() {
+            return { ...snap, ignoredBuilds: [...snap.ignoredBuilds] };
+        },
+        feed,
+        reset,
+    };
+}

package/lib/net.js

@@ -0,0 +1,98 @@
+/**
+ * Outbound HTTP for the market's own server-side calls.
+ *
+ * Node's global `fetch` ignores `HTTP_PROXY` / `HTTPS_PROXY` entirely
+ * (measured on Node 25: a request with an unreachable proxy configured still
+ * succeeds directly, and setting `NODE_USE_ENV_PROXY` at runtime changes
+ * nothing — it is read at startup). On a machine whose route out is a local
+ * proxy, that is not a slowdown but a different network: the catalog fetch
+ * took 9.9s direct on a reporter's machine, seconds from the 15s timeout,
+ * while their proxy sat unused a millisecond away.
+ *
+ * `setGlobalDispatcher` from the `undici` PACKAGE cannot fix this, because
+ * `globalThis.fetch` runs on Node's INTERNAL copy of undici — a different
+ * instance. Verified: with a dispatcher installed, a global fetch still
+ * produced no CONNECT at a local proxy, while undici's own fetch produced
+ * `CONNECT awesome-dsh-plugin.com:443`.
+ *
+ * So the market calls undici's fetch with an explicit dispatcher. The scope
+ * is deliberate: only requests made by this module change, and the host's
+ * own networking is left exactly as the host configured it.
+ */
+import { EnvHttpProxyAgent, fetch as undiciFetch } from 'undici';
+/**
+ * The proxy this process would use for the catalog, if any.
+ *
+ * The standard variables mirror `EnvHttpProxyAgent`'s own resolution
+ * deliberately, rather than picking the order that reads best, because the
+ * same answer does two jobs: it decides whether to route through undici at
+ * all, and it is what the failure message CLAIMS was tried. A helper that
+ * named a proxy undici would not have used would put a false statement in
+ * every bug report. `npm_config_*` is an additional source on top of that:
+ * npm holds its proxy in its own config namespace (a machine set up with
+ * `npm config set proxy` has the proxy in `npm_config_proxy` and nowhere
+ * else), and undici does not read it — so it is resolved here and handed to
+ * the agent explicitly in `marketFetch`.
+ *
+ * Three details are undici's, not ours (env-http-proxy-agent.js):
+ *   - lowercase wins over uppercase (`https_proxy ?? HTTPS_PROXY`)
+ *   - an https request falls back to the http proxy when no https one is set
+ *   - the value is tested for truthiness, so `HTTPS_PROXY=` — which is how
+ *     people turn a proxy off — falls through instead of masking HTTP_PROXY
+ *
+ * Blank-is-unset is ours, and only widens that last one: undici would hand a
+ * whitespace-only value to `new URL()` and throw out of the constructor.
+ * Scheme-less host:port values are also common in Windows proxy fields and
+ * npm config; proxy agents require URLs, so those default to `http://`.
+ */
+export function configuredProxy() {
+    const { http, https } = proxyFromEnv();
+    return https ?? http;
+}
+/**
+ * Proxy URLs resolved from the process environment, standard variables
+ * first and npm's own config (`npm_config_https_proxy` / `npm_config_proxy`)
+ * as the fallback. npm's config is the second source, not a preference: a
+ * standard variable always wins over npm's, and npm's https proxy falls
+ * back to npm's http proxy the same way undici's does.
+ */
+function proxyFromEnv() {
+    const pick = (raw) => {
+        const value = raw?.trim();
+        if (value === undefined || value === '')
+            return null;
+        return /^[a-z][a-z\d+.-]*:\/\//iu.test(value) ? value : `http://${value}`;
+    };
+    const https = pick(process.env.https_proxy ?? process.env.HTTPS_PROXY) ??
+        pick(process.env.npm_config_https_proxy);
+    const http = pick(process.env.http_proxy ?? process.env.HTTP_PROXY) ??
+        pick(process.env.npm_config_proxy);
+    return { http, https };
+}
+/**
+ * Built once and reused: an agent per request would drop connection reuse,
+ * and this one reads NO_PROXY as well, so a host that excludes its own
+ * registry mirror keeps being excluded.
+ */
+let agent = null;
+/**
+ * Fetch through the proxy this machine is configured to use.
+ *
+ * Falls back to the global fetch when no proxy is set, which keeps the
+ * ordinary case on the runtime's own path rather than routing it through a
+ * second HTTP stack for no reason.
+ */
+export async function marketFetch(url, init) {
+    const { http, https } = proxyFromEnv();
+    if (http === null && https === null)
+        return await fetch(url, init);
+    // Pass the resolved proxies explicitly. EnvHttpProxyAgent itself reads
+    // only http(s)_proxy out of the environment, so a proxy that lives in
+    // npm_config_* must be handed over directly — otherwise the agent would
+    // silently go direct while configuredProxy() claims a proxy was used.
+    agent ??= new EnvHttpProxyAgent({
+        httpProxy: http ?? undefined,
+        httpsProxy: https ?? undefined,
+    });
+    return await undiciFetch(url, { ...init, dispatcher: agent });
+}

package/lib/order.js

@@ -0,0 +1,284 @@
+/**
+ * Community bundle ordering — issue #98 (phase 2): let the user reorder the
+ * community bundles of the profile's layer stack, with author-declared
+ * before/after rules enforced before anything is written.
+ *
+ * Official in-box bundles (@deepseek-ai/dsh-base, @deepseek-ai/dsh-web-app,
+ * @deepseek-ai/dsh-headless) are fixed: they keep their exact positions in
+ * the stack, are never part of a user-supplied order, and are never added,
+ * removed or duplicated by a reorder (#98 boundary). The profile's own
+ * cordis.patch.yml and --patch overlays are not part of the bundle stack and
+ * are never touched here.
+ *
+ * Pure functions plus one manifest write-back; no processes, no network.
+ */
+import { existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { join } from 'node:path';
+import { findDshInstallDir } from './dsh-install.js';
+/** Profile bundles that ship with the dsh host and must stay put (#98). */
+export const INBOX_BUNDLES = new Set([
+    '@deepseek-ai/dsh-base',
+    '@deepseek-ai/dsh-web-app',
+    '@deepseek-ai/dsh-headless',
+]);
+/**
+ * Atomic same-directory replace (write temp + rename): a crash mid-write can
+ * never leave the profile manifest truncated, which would break every later
+ * pnpm run. Used for every package.json write this module makes.
+ */
+function writeFileAtomic(file, content) {
+    const temp = `${file}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+    writeFileSync(temp, content);
+    renameSync(temp, file);
+}
+/** Read the profile's bundle stack (empty when the manifest is unreadable). */
+export function readBundleStack(profileDir) {
+    try {
+        const manifest = JSON.parse(readFileSync(join(profileDir, 'package.json'), 'utf8'));
+        const bundles = Array.isArray(manifest.dsh?.profile?.bundles)
+            ? manifest.dsh.profile.bundles.filter((name) => typeof name === 'string')
+            : [];
+        return {
+            bundles,
+            community: bundles.filter(name => !INBOX_BUNDLES.has(name)),
+        };
+    }
+    catch {
+        return { bundles: [], community: [] };
+    }
+}
+/**
+ * The bundle package.json, resolved the way the dsh boot resolves bundles
+ * (dsh-app-boot's resolveBundleDir, mirrored by check.ts): the dsh
+ * installation anchor first — official in-box bundles live in the install's
+ * node_modules, never the profile's — then the profile directory, whose
+ * createRequire search paths also cover pnpm workspace-root hoisting
+ * (`<profiles>/node_modules` when the profile lives under `<profiles>/<name>`).
+ */
+function resolveBundlePackageJson(profileDir, name) {
+    const dshInstall = findDshInstallDir();
+    const anchors = [
+        dshInstall !== null ? join(dshInstall, 'package.json') : null,
+        join(profileDir, 'package.json'),
+    ];
+    for (const anchor of anchors) {
+        if (anchor === null)
+            continue;
+        let paths = [];
+        try {
+            paths = createRequire(anchor).resolve.paths(name) ?? [];
+        }
+        catch {
+            continue;
+        }
+        for (const searchPath of paths) {
+            const candidate = join(searchPath, name);
+            if (existsSync(join(candidate, 'package.json')))
+                return join(candidate, 'package.json');
+        }
+    }
+    return null;
+}
+/**
+ * Read each bundle's declared ordering rules from its package manifest
+ * (`dsh.bundle.order.{before,after}` — a list of bundle package names).
+ * Unresolvable packages and missing declarations contribute nothing.
+ */
+export function readBundleRules(profileDir) {
+    const { bundles } = readBundleStack(profileDir);
+    const rules = [];
+    for (const name of bundles) {
+        const packageJson = resolveBundlePackageJson(profileDir, name);
+        if (packageJson === null)
+            continue;
+        try {
+            const manifest = JSON.parse(readFileSync(packageJson, 'utf8'));
+            const order = manifest.dsh?.bundle?.order;
+            if (order === null || typeof order !== 'object' || Array.isArray(order))
+                continue;
+            const listOf = (value) => Array.isArray(value)
+                ? value.filter((item) => typeof item === 'string')
+                : [];
+            const rule = {
+                name,
+                after: listOf(order.after),
+                before: listOf(order.before),
+            };
+            if (rule.after.length > 0 || rule.before.length > 0)
+                rules.push(rule);
+        }
+        catch { /* package unreadable — no rule */ }
+    }
+    return rules;
+}
+/**
+ * Check a bundle order against the declared before/after rules. Rules naming
+ * bundles outside `order` are ignored (a rule for a not-yet-installed bundle
+ * must not block the current stack).
+ * @returns every violated rule with a readable reason; [] when all hold.
+ */
+export function validateOrder(bundleNames, rules) {
+    const position = new Map(bundleNames.map((name, index) => [name, index]));
+    const conflicts = [];
+    for (const rule of rules) {
+        const pos = position.get(rule.name);
+        if (pos === undefined)
+            continue;
+        for (const other of rule.after) {
+            const otherPos = position.get(other);
+            if (otherPos === undefined)
+                continue;
+            if (otherPos >= pos) {
+                conflicts.push({
+                    name: rule.name,
+                    reason: `must load after ${other}, but ${other} is currently before/equal (position ${otherPos} vs ${pos})`,
+                });
+            }
+        }
+        for (const other of rule.before) {
+            const otherPos = position.get(other);
+            if (otherPos === undefined)
+                continue;
+            if (otherPos <= pos) {
+                conflicts.push({
+                    name: rule.name,
+                    reason: `must load before ${other}, but ${other} is currently after/equal (position ${otherPos} vs ${pos})`,
+                });
+            }
+        }
+    }
+    return conflicts;
+}
+/**
+ * Merge a community-bundle permutation into the full stack. Official in-box
+ * bundles keep their EXACT positions (never moved); community bundles are
+ * replaced by `newOrder` in order of appearance. Pure — nothing is written.
+ * @returns the merged full stack, or the rejection reason when `newOrder` is
+ * not a permutation of the community bundles (duplicates, additions,
+ * omissions, official names).
+ */
+export function mergeOrder(bundles, newOrder) {
+    const communitySet = new Set(bundles.filter(name => !INBOX_BUNDLES.has(name)));
+    if (new Set(newOrder).size !== newOrder.length) {
+        return { ok: false, error: 'duplicate bundle names in the new order / 新顺序包含重复的 bundle' };
+    }
+    if (newOrder.length !== communitySet.size) {
+        return { ok: false, error: 'the new order must contain exactly the current community bundles / 新顺序必须恰好包含全部社区 bundle' };
+    }
+    for (const name of newOrder) {
+        if (!communitySet.has(name)) {
+            return { ok: false, error: `${name} is not a reorderable community bundle / ${name} 不是可排序的社区 bundle` };
+        }
+    }
+    const merged = [...bundles];
+    let cursor = 0;
+    for (let index = 0; index < merged.length; index += 1) {
+        const name = merged[index];
+        if (name === undefined || INBOX_BUNDLES.has(name))
+            continue;
+        merged[index] = newOrder[cursor];
+        cursor += 1;
+    }
+    return { ok: true, bundles: merged };
+}
+/**
+ * Topologically sort the community bundles by their before/after rules — the
+ * "auto-fix" counterpart to validateOrder. Returns null when no declared rule
+ * applies to the current stack (nothing to suggest). With rules, Kahn's
+ * algorithm breaks ties by the CURRENT order: unconstrained bundles keep
+ * their current relative order and constrained bundles move only as far as
+ * the rules require — the suggestion is the minimal change that satisfies
+ * every rule, never an arbitrary canonical rewrite of a hand-picked order
+ * (issue #125 review).
+ * @returns the suggested community order, null when there are no rules, or a
+ * cycle report when the constraints cannot be satisfied (references to
+ * unlisted bundles ignored).
+ */
+export function suggestOrder(bundleNames, rules) {
+    const names = bundleNames.filter(name => !INBOX_BUNDLES.has(name));
+    const inOrder = new Set(names);
+    const active = rules.filter(rule => inOrder.has(rule.name));
+    // No rule applies to the current stack — nothing to suggest.
+    if (active.length === 0)
+        return null;
+    const position = new Map(names.map((name, index) => [name, index]));
+    // Constraint: "a must load before b" (from a.before or b.after) → edge a → b.
+    const beforeOf = new Map(); // name → bundles that must come after it
+    const deps = new Map(); // name → bundles that must come before it
+    for (const name of names) {
+        beforeOf.set(name, new Set());
+        deps.set(name, new Set());
+    }
+    const addEdge = (a, b) => {
+        if (!inOrder.has(a) || !inOrder.has(b) || a === b)
+            return;
+        beforeOf.get(a)?.add(b);
+        deps.get(b)?.add(a);
+    };
+    for (const rule of active) {
+        for (const other of rule.before)
+            addEdge(rule.name, other);
+        for (const other of rule.after)
+            addEdge(other, rule.name);
+    }
+    const remaining = new Map();
+    for (const [name, depsOf] of deps)
+        remaining.set(name, new Set(depsOf));
+    const ready = names.filter(name => (remaining.get(name)?.size ?? 0) === 0);
+    const ordered = [];
+    while (ready.length > 0) {
+        // Minimal-change tie-break: among the ready bundles, prefer the one that
+        // comes FIRST in the current order. Bundles the rules do not constrain
+        // therefore keep their current relative order; constrained bundles move
+        // only as far as the rules require (issue #125 review).
+        let best = 0;
+        for (let i = 1; i < ready.length; i += 1) {
+            const a = ready[i];
+            const b = ready[best];
+            if (a !== undefined && b !== undefined && (position.get(a) ?? 0) < (position.get(b) ?? 0))
+                best = i;
+        }
+        const name = ready.splice(best, 1)[0];
+        if (name === undefined)
+            break;
+        ordered.push(name);
+        for (const dependent of beforeOf.get(name) ?? []) {
+            const depsOf = remaining.get(dependent);
+            if (depsOf === undefined)
+                continue;
+            depsOf.delete(name);
+            if (depsOf.size === 0 && !ordered.includes(dependent) && !ready.includes(dependent))
+                ready.push(dependent);
+        }
+    }
+    if (ordered.length < names.length) {
+        return { ok: false, cycle: names.filter(name => !ordered.includes(name)) };
+    }
+    return { ok: true, order: ordered };
+}
+/**
+ * Apply a new community-bundle order to the profile manifest. The official
+ * in-box bundles keep their exact positions; `newOrder` must be a permutation
+ * of the current community bundles (no duplicates, no additions, no
+ * omissions). On any failure the manifest is left untouched.
+ * @returns the new full stack on success, or an error description.
+ */
+export function applyBundleOrder(profileDir, newOrder) {
+    const { bundles } = readBundleStack(profileDir);
+    const merged = mergeOrder(bundles, newOrder);
+    if (!merged.ok)
+        return merged;
+    try {
+        const manifestPath = join(profileDir, 'package.json');
+        const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+        manifest.dsh ??= {};
+        manifest.dsh.profile ??= {};
+        manifest.dsh.profile.bundles = merged.bundles;
+        writeFileAtomic(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
+        return merged;
+    }
+    catch (error) {
+        return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    }
+}