@deepseek-ai/dsh-plugin-manager 0.1.7-alpha.1 → 0.1.7-alpha.2

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/boot/plugin-manager/README.md
-README.md: d937d265a7942f824f5f4a02c0a5eaba62208994
-README.zh.md: 388a2e249613299753ae63c3c20d2ca89311dc4f
+README.md: 1de9c9d78e421d44eb006f1ab7fd82656f006a2a
+README.zh.md: f7502aab64738ad1feccf58b84ff945213df2eff

package/README.md

@@ -47,6 +47,8 @@ A selected bundle that cannot load remains in `listBundles` with an `error`; `en
 
 Registries are asked in turn. The plan starts at `options.registry`, else the configured `registry` (`null` is the one pnpm's own configuration names), and continues through `fallbackRegistries` while a registry is unreachable, times out, or answers that it has no such package or version, which a mirror not yet synced does. A registry outside the configured set is asked alone, so a private registry never falls through to a public one; pnpm's own registry counts as part of the set only while what it names, read through `pnpm config get registry` before each plan, is npm's own registry or one of the fallbacks, and is otherwise asked alone as a private one. A registry pnpm's own configuration already names is asked once. The lookup runs `pnpm view` with `--registry` and without pnpm's own retries, so a dead registry is reported within `inspectTimeoutMs` and the next one is asked; pnpm prints its refusal as JSON on stdout, which is read like stderr. The install keeps pnpm's retry settings. `registries()` answers the configured set and what pnpm names, for a picker. The [registry Agent Note](../../../.agents/notes/implemented/architecture/2026-09-18-plugin-install-registries.md) owns the rationale.
 
+The browser-safe `@deepseek-ai/dsh-plugin-manager/registry` entry exports `OFFICIAL_NPM_REGISTRY` and `NPMMIRROR_REGISTRY` for consumers that identify those public registries.
+
 `installBundle` accepts a caller-generated `requestId`, under which `plugin-manager/install-log` streams each pnpm run's output and `plugin-manager/install-state` announces `installing`, `cancelling`, and `applying`; `installing` is announced once per registry asked, with the `attempt`'s registry, position, and the plan's length. The install asks the same plan as the lookup, from `options.registry`, running `pnpm add` with `--registry` and restoring the profile files between attempts; it moves on for the failures another registry can change and stops at any other, and at a failure whose error line names the host a git or tarball spec is fetched from, which no registry stands in for; `failedAt` says which of the two the last failed run could not reach. `cancelInstall(requestId)` stops the run and answers `cancelled` only after pnpm exited and the files are back, `too-late` once the bundle is being applied, and `not-running` for any other id; the install call then reports `application: 'cancelled'`. A run that fails, is cancelled, or adds a package without a bundle patch restores `package.json` and `pnpm-lock.yaml` as they were; `packageResult.kind` classifies the last run from its exit and output, `registries` names every registry asked, and `bundle` names the package a finished run added. `listBundles` carries each bundle's one-liner (the package `description`), the rows its patch declares with their live entries, and the built-in rows it overrides; it lists the profile's own bundles, the bundles the installation supplies, and a selected name without a bundle patch as a `not-bundle` problem, while an unselected plain dependency is left out. A bundle the launcher's `OPTIONAL_BUNDLES` names is `optional`: shipped switched off for the person to turn on, never removable, and selected by no shipped template ([rationale](../../../.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.md)). Every completed operation emits `plugin-manager/changed`; a patch generation applied outside the manager, by HMR's watcher after a CLI or hand edit, announces nothing, so the page learns of it on its next read.
 
 `waitForInstall(requestId)` lets a client recover a lost response by waiting for the active installation, including its non-cancellable application phase. It returns the same outcome as the original call, or `null` if the request is not active. Completed results are not retained; `null` establishes neither success nor cancellation.

package/README.zh.md

@@ -47,6 +47,8 @@ kind: "package-reference"
 
 注册表按顺序询问。计划从 `options.registry` 开始，否则从配置的 `registry`（`null` 即 pnpm 自身配置指定的那个）开始，并在一个注册表不可达、超时或答复没有这个包或版本（尚未同步的镜像会如此）时继续问 `fallbackRegistries`。配置集合之外的注册表只问它自己，因而私有源永远不会落到公共源；pnpm 自身的注册表只在它指向的地址（每次做计划前经 `pnpm config get registry` 读出）是 npm 官方源或某个备选源时才算集合成员，否则视为私有源只问它自己。pnpm 自身配置已经指向的注册表只问一次。查询以 `--registry` 运行 `pnpm view` 且不带 pnpm 自身的重试，所以死掉的注册表会在 `inspectTimeoutMs` 内报告并转问下一个；pnpm 把拒绝以 JSON 打印在 stdout，读法与 stderr 相同。安装保留 pnpm 的重试设置。`registries()` 把配置集合和 pnpm 指向的地址答复给选择器。[注册表 Agent Note](../../../.agents/notes/implemented/architecture/2026-09-18-plugin-install-registries.zh.md) 拥有理由。
 
+可在浏览器使用的 `@deepseek-ai/dsh-plugin-manager/registry` 入口导出 `OFFICIAL_NPM_REGISTRY` 和 `NPMMIRROR_REGISTRY`，供消费方识别这两个公共注册表。
+
 `installBundle` 接受调用方生成的 `requestId`，`plugin-manager/install-log` 在其下流式转发每次 pnpm 运行的输出，`plugin-manager/install-state` 通告 `installing`、`cancelling` 与 `applying`；每问一个注册表通告一次 `installing`，`attempt` 带上这次的注册表、序号和计划长度。安装沿用查询的计划，从 `options.registry` 开始，以 `--registry` 运行 `pnpm add`，两次尝试之间恢复 profile 文件；换一个注册表能改变的失败才转问下一个，其他失败即停，错误行点名 git 或 tarball spec 自身拉取主机的失败也停，因为没有注册表能替代那台主机；`failedAt` 说明最后一次失败的运行连不上的是二者中的哪一个。`cancelInstall(requestId)` 停止运行，只在 pnpm 退出且文件恢复后答复 `cancelled`，组合包已在应用时答复 `too-late`，其他 id 答复 `not-running`；安装调用随后报告 `application: 'cancelled'`。失败、被取消或装入了没有组合包 patch 的包的运行，会把 `package.json` 与 `pnpm-lock.yaml` 恢复原样；`packageResult.kind` 按退出方式与输出对最后一次运行分类，`registries` 列出问过的每个注册表，`bundle` 给出完成的运行新增的包。`listBundles` 携带每个组合包的一句话简介（包的 `description`）、其 patch 声明的行及其存活条目，以及它覆盖的内置行；它列出 profile 自己的组合包、安装提供的组合包，以及被选中却没有组合包 patch 的名字（作为 `not-bundle` 问题），未选中的普通依赖不列出。启动器的 `OPTIONAL_BUNDLES` 点名的组合包是 `optional`：随安装提供、默认关闭、由用户开启，永不可卸载，也不被任何随附模板选中（[理由](../../../.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.zh.md)）。每个完成的操作都会发出 `plugin-manager/changed`；在管理器之外应用的一代 patch（HMR 监视到 CLI 或手工编辑后）不发通知，页面要到下一次读取才知道。
 
 `waitForInstall(requestId)` 让客户端在响应丢失后等待活动安装的结果，包括不可取消的应用阶段。它返回与原调用相同的结果，请求不在活动中时返回 `null`。已完成的结果不保留；`null` 不表示成功或已取消。

package/lib/index.js

@@ -363,6 +363,8 @@ function parseInstallSpec(raw) {
 		range
 	};
 }
+/** Public npmmirror URL shared by the fallback configuration and public-registry comparison. */
+const NPMMIRROR_REGISTRY = "https://registry.npmmirror.com/";
 /**
 * Parse a registry URL into the form pnpm compares registries in: lower-case host, trailing slash.
 * @param url - the registry as configured or requested.
@@ -829,7 +831,7 @@ let PluginManager = (() => {
 			lockWaitMs: z.number().step(1).min(0).default(12e4),
 			inspectTimeoutMs: z.number().step(1).min(1e3).default(2e4),
 			registry: z.string().pattern(REGISTRY_URL),
-			fallbackRegistries: z.array(z.string().pattern(REGISTRY_URL)).default(["https://registry.npmmirror.com/"])
+			fallbackRegistries: z.array(z.string().pattern(REGISTRY_URL)).default([NPMMIRROR_REGISTRY])
 		});
 		/** Management bundles remain protected if their files become unreadable. */
 		managementBundles = (__runInitializers(this, _instanceExtraInitializers), /* @__PURE__ */ new Set());

package/lib/types/index.js

@@ -46,7 +46,7 @@ import { readPluginMeta, readProfileManifest, resolveBundleDir, loadOverlayPatch
 import { bundleManifest, readProfileRegistry, registryArguments, runProfilePnpm, saveManifest, viewProfilePackage } from "./operations.js";
 import { classifyInstallFailure } from "./install-failure.js";
 import { InvalidInstallSpecError, parseInstallSpec } from "./install-spec.js";
-import { attributeFailure, normalizeRegistry, registryPlan } from "./registry.js";
+import { attributeFailure, normalizeRegistry, NPMMIRROR_REGISTRY, registryPlan } from "./registry.js";
 import { writePluginEnabled } from "./patch.js";
 import { ManagementFailure } from "./failure.js";
 import { approveBuilds, readPendingBuilds } from "./build-approval.js";
@@ -182,7 +182,7 @@ let PluginManager = (() => {
             lockWaitMs: z.number().step(1).min(0).default(120000),
             inspectTimeoutMs: z.number().step(1).min(1000).default(20000),
             registry: z.string().pattern(REGISTRY_URL),
-            fallbackRegistries: z.array(z.string().pattern(REGISTRY_URL)).default(['https://registry.npmmirror.com/']),
+            fallbackRegistries: z.array(z.string().pattern(REGISTRY_URL)).default([NPMMIRROR_REGISTRY]),
         });
         /** Management bundles remain protected if their files become unreadable. */
         managementBundles = (__runInitializers(this, _instanceExtraInitializers), new Set());

package/lib/types/registry.d.ts

@@ -10,6 +10,8 @@ import type { ParsedInstallSpec } from './install-spec.ts';
 import type { PluginInstallFailureKind, PluginRegistries, Registry } from './types.ts';
 /** npm's own registry: what pnpm names without any configuration, and the one public registry a plan trusts as such. */
 export declare const OFFICIAL_NPM_REGISTRY = "https://registry.npmjs.org/";
+/** Public npmmirror URL shared by the fallback configuration and public-registry comparison. */
+export declare const NPMMIRROR_REGISTRY = "https://registry.npmmirror.com/";
 /** An http(s) URL, as pnpm's `--registry` takes it. */
 export declare const REGISTRY_URL: RegExp;
 /**

package/lib/types/registry.js

@@ -8,6 +8,8 @@
  */
 /** npm's own registry: what pnpm names without any configuration, and the one public registry a plan trusts as such. */
 export const OFFICIAL_NPM_REGISTRY = 'https://registry.npmjs.org/';
+/** Public npmmirror URL shared by the fallback configuration and public-registry comparison. */
+export const NPMMIRROR_REGISTRY = 'https://registry.npmmirror.com/';
 /** An http(s) URL, as pnpm's `--registry` takes it. */
 export const REGISTRY_URL = /^https?:\/\/\S+$/;
 /**

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-plugin-manager",
   "description": "Current-profile plugin and bundle management shared by dsh CLI, Web and agent tools",
-  "version": "0.1.7-alpha.1",
+  "version": "0.1.7-alpha.2",
   "publishConfig": {
     "access": "public"
   },
@@ -59,23 +59,23 @@
     "execa": "^10.0.0",
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
-    "@deepseek-ai/dsh-app-boot": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-atomic-write": "^0.1.7-alpha.1",
-    "@deepseek-ai/schemastery": "^3.18.3",
-    "@deepseek-ai/dsh-util-values": "^0.1.7-alpha.1"
+    "@deepseek-ai/dsh-app-boot": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-atomic-write": "0.1.7-alpha.2",
+    "@deepseek-ai/schemastery": "~3.18.4",
+    "@deepseek-ai/dsh-util-values": "0.1.7-alpha.2"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.3",
-    "@deepseek-ai/cordis-plugin-loader": "^1.0.4",
-    "@deepseek-ai/dsh-host-plugin-inventory": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-subprocess": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-typert-protocol": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-tools": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-hmr": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-brand": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-sandbox-policy": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-sandbox": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-user-approval": "^0.1.7-alpha.1"
+    "@deepseek-ai/cordis": "~4.0.4",
+    "@deepseek-ai/cordis-plugin-loader": "~1.0.5",
+    "@deepseek-ai/dsh-host-plugin-inventory": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-subprocess": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-typert-protocol": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-tools": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-hmr": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-brand": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-sandbox-policy": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-sandbox": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-user-approval": "0.1.7-alpha.2"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-hmr": {
@@ -86,22 +86,22 @@
     }
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-package-manifest": "^0.1.7-alpha.1",
-    "@deepseek-ai/cordis": "^4.0.3",
-    "@deepseek-ai/cordis-plugin-loader": "^1.0.4",
-    "@deepseek-ai/dsh-host-plugin-inventory": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-subprocess": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-typert-protocol": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-tools": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-system-prompt": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-hmr": "^0.1.7-alpha.1",
-    "@deepseek-ai/cordis-plugin-timer": "^1.1.5",
-    "@deepseek-ai/dsh-brand": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-session": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-session-projection": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-sandbox": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-user-approval": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-agent": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-sandbox-policy": "^0.1.7-alpha.1"
+    "@deepseek-ai/dsh-package-manifest": "0.1.7-alpha.2",
+    "@deepseek-ai/cordis": "~4.0.4",
+    "@deepseek-ai/dsh-host-plugin-inventory": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-subprocess": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-typert-protocol": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-tools": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-system-prompt": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-hmr": "0.1.7-alpha.2",
+    "@deepseek-ai/cordis-plugin-timer": "~1.1.6",
+    "@deepseek-ai/dsh-brand": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-sandbox-policy": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-agent": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-session": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-session-projection": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-sandbox": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-user-approval": "0.1.7-alpha.2",
+    "@deepseek-ai/cordis-plugin-loader": "~1.0.5"
   }
 }