@dsh-workbench/core 1.1.9 → 1.1.11

package/dist/host/index.js

@@ -8,8 +8,8 @@ import { createHash, randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import { createRequire } from "node:module";
 import writeFileAtomic from "write-file-atomic";
-import { deflateSync, inflateSync } from "node:zlib";
 import { execa } from "execa";
+import { deflateSync, inflateSync } from "node:zlib";
 //#region \0rolldown/runtime.js
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -842,7 +842,7 @@ function refusalReason() {
 }
 //#endregion
 //#region ../shared/dist/host/shell.js
-var DEFAULT_MAX_BYTES$2 = 8388608;
+var DEFAULT_MAX_BYTES$3 = 8388608;
 async function runShell(shell, command, options = {}) {
 	const { workdir, timeoutMs = GIT_TIMEOUT_MS, signal } = options;
 	const spec = shell.resolve({
@@ -850,7 +850,7 @@ async function runShell(shell, command, options = {}) {
 		...workdir === void 0 ? {} : { workdir },
 		timeoutMs,
 		onExpiry: "kill",
-		stdoutMaxBytes: DEFAULT_MAX_BYTES$2,
+		stdoutMaxBytes: DEFAULT_MAX_BYTES$3,
 		...signal === void 0 ? {} : { signal }
 	});
 	const result = await (await shell.execute(spec)).result();
@@ -4597,7 +4597,7 @@ function approvalNoteOf(call) {
 	if (line === "") return void 0;
 	return line.length > 40 ? `${line.slice(0, 40)}…` : line;
 }
-function messageOf$2(error) {
+function messageOf$3(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 function compose(detail, verdict, note) {
@@ -4622,7 +4622,7 @@ async function approvalFor(call, context = {}) {
 	} catch (error) {
 		return {
 			kind: "deny",
-			reason: `问"要不要审批"的时候套件的策略抛了错，已经停下：${messageOf$2(error)}`
+			reason: `问"要不要审批"的时候套件的策略抛了错，已经停下：${messageOf$3(error)}`
 		};
 	}
 	if (verdict?.kind === "read" || verdict?.kind === "allow") return void 0;
@@ -4640,7 +4640,7 @@ async function approvalFor(call, context = {}) {
 	} catch (error) {
 		return {
 			kind: "deny",
-			reason: `拿不到"这次会发生什么"，已经停下：${messageOf$2(error)}`
+			reason: `拿不到"这次会发生什么"，已经停下：${messageOf$3(error)}`
 		};
 	}
 	if (facts !== void 0 && "blocked" in facts) return {
@@ -6501,6 +6501,22 @@ function migrationFollowUp(input) {
 	} : void 0;
 }
 //#endregion
+//#region src/shared/api/host/profile-dependencies.ts
+function dependencyReader(profileDir) {
+	if (profileDir === null) return () => void 0;
+	let dependencies;
+	return (pkg) => {
+		if (dependencies === void 0) try {
+			const raw = JSON.parse(readFileSync(join(profileDir, "package.json"), "utf8")).dependencies;
+			dependencies = typeof raw === "object" && raw !== null ? raw : {};
+		} catch {
+			dependencies = {};
+		}
+		const value = dependencies[pkg];
+		return typeof value === "string" ? value : void 0;
+	};
+}
+//#endregion
 //#region src/shared/api/host/bundle-routes.ts
 function registryOf(search) {
 	const raw = param(search, "registry");
@@ -6564,6 +6580,7 @@ async function latestIfReleaseReady(supply, input) {
 async function workbenchVersion(supply, input) {
 	const read = supply.readProfilePackage(input.dir, PLUGIN_ID);
 	if (read === void 0) return void 0;
+	const spec = dependencyReader(input.dir)(PLUGIN_ID);
 	const registry = read.registry ?? input.fallback;
 	const shell = input.shell;
 	const queried = read.local === true || shell === void 0 || registry === void 0 ? void 0 : await supply.latestVersion({
@@ -6586,7 +6603,9 @@ async function workbenchVersion(supply, input) {
 		...latest === void 0 ? {} : { latest },
 		...input.running === void 0 ? {} : { running: input.running },
 		...read.local === true ? { local: true } : {},
-		...input.followUp === void 0 ? {} : { followUp: input.followUp }
+		...input.followUp === void 0 ? {} : { followUp: input.followUp },
+		...spec === void 0 ? {} : { spec },
+		...registry === void 0 || read.local === true ? {} : { registry }
 	};
 }
 function moduleVersionsHandler(ctx, shell, running, selfUpdate) {
@@ -6602,10 +6621,12 @@ function moduleVersionsHandler(ctx, shell, running, selfUpdate) {
 		const refusals = new Map((ctx.get("workbenchUnits")?.refusals() ?? []).filter((one) => one.unit !== "").map((one) => [one.unit, one.reasons]));
 		const force = param(search, "force") === "1";
 		const fallback = (await manager.registries())?.resolved ?? void 0;
+		const dependencyOf = dependencyReader(dir);
 		const modules = await Promise.all(found.map(async (module) => {
 			const local = module.local === true;
 			const fromRegistry = module.fromRegistry !== false;
 			const registry = fromRegistry ? module.registry ?? fallback : void 0;
+			const spec = dependencyOf(module.pkg);
 			const latest = local || !fromRegistry || shell === void 0 || registry === void 0 ? void 0 : await supply.latestVersion({
 				shell,
 				name: module.pkg,
@@ -6642,7 +6663,9 @@ function moduleVersionsHandler(ctx, shell, running, selfUpdate) {
 					local: true,
 					latestUnavailable: "local"
 				} : latest !== void 0 ? {} : { latestUnavailable: !fromRegistry ? "not-registry" : registry === void 0 ? "no-registry" : "probe-failed" },
-				...refused === void 0 ? {} : { refused }
+				...refused === void 0 ? {} : { refused },
+				...spec === void 0 ? {} : { spec },
+				...registry === void 0 ? {} : { registry }
 			};
 		}));
 		const selfUpdateNow = selfUpdate?.();
@@ -6754,21 +6777,42 @@ function bundleInspectHandler(ctx) {
 }
 //#endregion
 //#region src/shared/api/host/git-exec.ts
-var NO_PROMPT_ENV = [
-	"GIT_TERMINAL_PROMPT=0",
-	"GIT_ASKPASS=/usr/bin/false",
-	"SSH_ASKPASS=/usr/bin/false",
-	"SSH_ASKPASS_REQUIRE=never",
-	"GCM_INTERACTIVE=never",
-	"GIT_SSH_COMMAND=ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new"
-];
-function gitNoPromptPrefix() {
-	return [quoteShellArg("env"), ...NO_PROMPT_ENV.map((one) => quoteShellArg(one))].join(" ");
-}
+var GIT_NO_PROMPT_ENV = {
+	GIT_TERMINAL_PROMPT: "0",
+	GIT_ASKPASS: "/usr/bin/false",
+	SSH_ASKPASS: "/usr/bin/false",
+	SSH_ASKPASS_REQUIRE: "never",
+	GCM_INTERACTIVE: "never",
+	GIT_SSH_COMMAND: "ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new"
+};
 function withoutAskpassNoise(text) {
 	return text.split("\n").filter((line) => !/unable to read askpass response/i.test(line)).join("\n").trim();
 }
 //#endregion
+//#region src/shared/api/host/git-process.ts
+var DEFAULT_MAX_BYTES$2 = 8388608;
+var runGitProcess = async (args, options = {}) => {
+	const result = await execa("git", [...args], {
+		...options.cwd === void 0 ? {} : { cwd: options.cwd },
+		env: {
+			...process.env,
+			...GIT_NO_PROMPT_ENV
+		},
+		stdin: "ignore",
+		reject: false,
+		...options.timeoutMs === void 0 ? {} : { timeout: options.timeoutMs },
+		killSignal: "SIGKILL",
+		maxBuffer: options.maxBytes ?? DEFAULT_MAX_BYTES$2,
+		stripFinalNewline: false
+	});
+	return {
+		exitCode: result.exitCode ?? null,
+		stdout: result.stdout ?? "",
+		stderr: result.stderr ?? "",
+		timedOut: result.timedOut === true
+	};
+};
+//#endregion
 //#region src/shared/api/host/git-probe.ts
 var PROBE_TIMEOUT_MS = 1e4;
 var AUTH_TEXT = /authentication failed|could not read (username|password)|permission denied|terminal prompts disabled|host key verification failed|repository not found|no such identity|access denied|unauthorized|forbidden/;
@@ -6776,17 +6820,15 @@ function classifyGitProbe(stderr, timedOut) {
 	if (timedOut) return "unreachable";
 	return AUTH_TEXT.test(stderr.toLowerCase()) ? "auth" : "unreachable";
 }
-async function probeGitAddress(shell, url, options = {}) {
-	const line = [
-		gitNoPromptPrefix(),
-		quoteShellArg("git"),
-		quoteShellArg("ls-remote"),
-		quoteShellArg(url),
-		quoteShellArg("HEAD")
-	].join(" ");
+async function probeGitAddress(url, options = {}) {
+	const runGit = options.runGit ?? runGitProcess;
 	let result;
 	try {
-		result = await runShell(shell, line, { timeoutMs: options.timeoutMs ?? PROBE_TIMEOUT_MS });
+		result = await runGit([
+			"ls-remote",
+			url,
+			"HEAD"
+		], { timeoutMs: options.timeoutMs ?? PROBE_TIMEOUT_MS });
 	} catch (error) {
 		return {
 			status: "unreachable",
@@ -6802,10 +6844,10 @@ async function probeGitAddress(shell, url, options = {}) {
 }
 var PROBE_CACHE_MS = 6e4;
 var probeCache = /* @__PURE__ */ new Map();
-async function probeGitAddressCached(shell, url, options = {}) {
+async function probeGitAddressCached(url, options = {}) {
 	const hit = probeCache.get(url);
 	if (hit !== void 0 && Date.now() - hit.at < PROBE_CACHE_MS) return hit.payload;
-	const payload = await probeGitAddress(shell, url, options);
+	const payload = await probeGitAddress(url, options);
 	probeCache.set(url, {
 		at: Date.now(),
 		payload
@@ -6814,7 +6856,7 @@ async function probeGitAddressCached(shell, url, options = {}) {
 }
 //#endregion
 //#region src/shared/api/host/git-routes.ts
-function gitProbeHandler(ctx) {
+function gitProbeHandler(options = {}) {
 	return async (search) => {
 		const url = param(search, "url");
 		if (url === void 0) return {
@@ -6824,17 +6866,9 @@ function gitProbeHandler(ctx) {
 				message: "要探哪个地址？缺 url。"
 			}
 		};
-		const shell = ctx.get("shell");
-		if (shell === void 0) return {
-			ok: false,
-			error: {
-				code: "workbench/no-shell",
-				message: "这台机器上没有执行缝，探不了 git 地址"
-			}
-		};
 		return {
 			ok: true,
-			...await probeGitAddress(shell, url)
+			...await probeGitAddress(url, options)
 		};
 	};
 }
@@ -6848,7 +6882,7 @@ function createHostRoutes(input) {
 		[DSH_PLUGINS_ROUTE]: profile.dshPlugins(ctx),
 		[BUNDLE_REGISTRIES_ROUTE]: bundleRegistriesHandler(ctx),
 		[BUNDLE_INSPECT_ROUTE]: bundleInspectHandler(ctx),
-		[MARKET_GIT_PROBE_ROUTE]: gitProbeHandler(ctx),
+		[MARKET_GIT_PROBE_ROUTE]: gitProbeHandler(),
 		[MODULE_VERSIONS_ROUTE]: moduleVersionsHandler(ctx, ctx.get("shell"), running, () => profile.selfUpdateView(dshHome(), basename(profile.dirOf(ctx) ?? "")))
 	};
 }
@@ -11096,24 +11130,34 @@ function siblingAuthorOf(root, unit) {
 	}
 	return authors.size === 1 ? [...authors][0] : void 0;
 }
-async function localGitIdentityOf(shell, dir) {
-	if (shell === void 0) return void 0;
-	const read = async (argv) => {
-		const result = await runShell(shell, `git -C ${quoteShellArg(dir)} ${argv}`, { workdir: dir });
-		return result.exitCode === 0 ? result.stdout.trim() : "";
+async function localGitIdentityOf(dir, runGit = runGitProcess) {
+	const read = async (args) => {
+		try {
+			const result = await runGit(args, { cwd: dir });
+			return result.exitCode === 0 ? result.stdout.trim() : "";
+		} catch {
+			return "";
+		}
 	};
-	const name = await read(`config ${quoteShellArg("user.name")}`);
+	const name = await read(["config", "user.name"]);
 	if (name === "") return void 0;
-	const email = await read(`config ${quoteShellArg("user.email")}`);
+	const email = await read(["config", "user.email"]);
 	return email === "" ? name : `${name} <${email}>`;
 }
-async function lastCommitAuthorOf(shell, dir) {
-	if (shell === void 0) return void 0;
-	const result = await runShell(shell, `git -C ${quoteShellArg(dir)} log -1 --format=${quoteShellArg("%an <%ae>")}`, { workdir: dir });
-	const author = result.exitCode === 0 ? result.stdout.trim() : "";
-	return author === "" ? void 0 : author;
+async function lastCommitAuthorOf(dir, runGit = runGitProcess) {
+	try {
+		const result = await runGit([
+			"log",
+			"-1",
+			"--format=%an <%ae>"
+		], { cwd: dir });
+		const author = result.exitCode === 0 ? result.stdout.trim() : "";
+		return author === "" ? void 0 : author;
+	} catch {
+		return;
+	}
 }
-async function inferredAuthorOf(root, unit, shell) {
+async function inferredAuthorOf(root, unit, runGit = runGitProcess) {
 	const fact = moduleFactOf(root, unit);
 	if (fact === null) return void 0;
 	if (fact.author !== "") return fact.author;
@@ -11124,9 +11168,9 @@ async function inferredAuthorOf(root, unit, shell) {
 	}
 	const sibling = root === null || root === void 0 ? void 0 : siblingAuthorOf(root, unit);
 	if (sibling !== void 0) return sibling;
-	const local = await localGitIdentityOf(shell, fact.dir);
+	const local = await localGitIdentityOf(fact.dir, runGit);
 	if (local !== void 0) return local;
-	return lastCommitAuthorOf(shell, fact.dir);
+	return lastCommitAuthorOf(fact.dir, runGit);
 }
 function publishPreviewOf(root, unit, options = {}) {
 	if (root === null || root === void 0 || unit === "") return null;
@@ -14325,6 +14369,20 @@ function createMarketService(options) {
 }
 //#endregion
 //#region src/modules/panels/model/market-discover.ts
+var SANDBOX_BLOCK = [
+	"- id: sandbox-policy",
+	"  config:",
+	"    mode: !!js process.env.DSH_PERMISSION_MODE ?? 'workspace-write'",
+	"    workspaceRoot: !!js dshHomePath('workbench')"
+].join("\n");
+function explainProblem(problem, profilePath) {
+	if (problem.kind !== "sandbox" || profilePath === void 0 || profilePath === "") return problem;
+	const file = join(profilePath, "cordis.patch.yml");
+	return {
+		...problem,
+		detail: `被系统拦住了：这个 profile 的可写根盖不住工作台的缓存目录。\n退出 dsh 后，把下面这段加进 ${file}，再启动：\n${SANDBOX_BLOCK}`
+	};
+}
 var DEFAULT_PEER_TTL_MS = 6e5;
 var DEFAULT_TIMEOUT_MS$3 = 15e3;
 var CORE_PEER = "@dsh-workbench/core";
@@ -14476,12 +14534,12 @@ function createMarketDiscover(options) {
 				sources: rows,
 				selected: source.id,
 				entries: [],
-				problem: read.problem
+				problem: explainProblem(read.problem, options.profilePath)
 			};
 			return {
 				...await payloadOf(source, read.cached.index, rows, source.id, filter, read.cached.fetchedAt, read.cached.commit),
 				stale: true,
-				problem: read.problem
+				problem: explainProblem(read.problem, options.profilePath)
 			};
 		}
 		return payloadOf(source, read.index, rows, source.id, filter, read.fetchedAt, read.commit);
@@ -14611,22 +14669,6 @@ function transportOfSpec(spec) {
 	};
 }
 //#endregion
-//#region src/shared/api/host/profile-dependencies.ts
-function dependencyReader(profileDir) {
-	if (profileDir === null) return () => void 0;
-	let dependencies;
-	return (pkg) => {
-		if (dependencies === void 0) try {
-			const raw = JSON.parse(readFileSync(join(profileDir, "package.json"), "utf8")).dependencies;
-			dependencies = typeof raw === "object" && raw !== null ? raw : {};
-		} catch {
-			dependencies = {};
-		}
-		const value = dependencies[pkg];
-		return typeof value === "string" ? value : void 0;
-	};
-}
-//#endregion
 //#region src/modules/panels/model/market-sources-act.ts
 function marketSourcesRoutes(store) {
 	return { [MARKET_SOURCES_ROUTE]: async () => ({
@@ -14784,7 +14826,7 @@ function publishPreviewRoutes(workshop, inferredAuthorOf = async () => void 0) {
 var DEFAULT_TTL_MS = 3e5;
 var DEFAULT_TIMEOUT_MS$2 = 3e4;
 var DEFAULT_MAX_BYTES$1 = 4194304;
-function messageOf$1(error) {
+function messageOf$2(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 function directoryOf(root, source) {
@@ -14853,6 +14895,10 @@ function classifyGitError(stderr, timedOut) {
 		detail: "git 拉取超时"
 	};
 	const text = stderr.toLowerCase();
+	if (text.includes("operation not permitted") || /\beperm\b/.test(text)) return {
+		kind: "sandbox",
+		detail: "被系统拦住了：这个 profile 的可写根盖不住工作台的缓存目录"
+	};
 	if (/couldn'?t find remote ref\s+["']?head/.test(text) || /could not find remote ref\s+["']?head/.test(text)) return {
 		kind: "git-empty",
 		detail: "仓库还没有任何提交"
@@ -14880,6 +14926,7 @@ function createMarketIndexReader(options) {
 	const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS$2;
 	const maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES$1;
 	const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+	const runGit = options.runGit ?? runGitProcess;
 	const inFlight = /* @__PURE__ */ new Map();
 	async function readHttp(source) {
 		const bad = httpProblemOf(source.url);
@@ -14902,7 +14949,7 @@ function createMarketIndexReader(options) {
 					detail: `拉索引超过 ${String(Math.round(timeoutMs / 1e3))} 秒`
 				} : {
 					kind: "http-network",
-					detail: messageOf$1(error)
+					detail: messageOf$2(error)
 				}
 			};
 		}
@@ -14939,17 +14986,13 @@ function createMarketIndexReader(options) {
 			fetchedAt
 		};
 	}
-	async function run(line) {
-		const shell = options.shell;
-		if (shell === void 0) return {
-			ok: false,
-			problem: {
-				kind: "git-missing",
-				detail: "没有执行缝，读不了 git 索引"
-			}
-		};
+	async function run(args, cwd) {
 		try {
-			const result = await runShell(shell, `${gitNoPromptPrefix()} ${line}`, { timeoutMs });
+			const result = await runGit(args, {
+				...cwd === void 0 ? {} : { cwd },
+				timeoutMs,
+				maxBytes
+			});
 			if (result.exitCode !== 0) return {
 				ok: false,
 				problem: classifyGitError(result.stderr, result.timedOut),
@@ -14960,7 +15003,7 @@ function createMarketIndexReader(options) {
 				stdout: result.stdout
 			};
 		} catch (error) {
-			const text = messageOf$1(error);
+			const text = messageOf$2(error);
 			if (/not found|no such file|ENOENT/i.test(text)) return {
 				ok: false,
 				problem: {
@@ -14978,7 +15021,11 @@ function createMarketIndexReader(options) {
 		}
 	}
 	async function branchOf(repo) {
-		const result = await run(`git -C ${quoteShellArg(repo)} symbolic-ref --short HEAD`);
+		const result = await run([
+			"symbolic-ref",
+			"--short",
+			"HEAD"
+		], repo);
 		const branch = result.ok ? result.stdout.trim() : "";
 		return branch === "" ? void 0 : branch;
 	}
@@ -14999,20 +15046,21 @@ function createMarketIndexReader(options) {
 			ok: false,
 			problem: bad
 		};
-		if (options.shell === void 0) return {
-			ok: false,
-			problem: {
-				kind: "git-missing",
-				detail: "没有 git 执行缝"
-			}
-		};
 		const repo = repoOf(options.root, source);
 		const path = ((source.path ?? "market").replace(/^\/+/, "") || "market").replace(/\/+$/, "");
 		const ref = (source.ref ?? "").trim();
 		let revision = "FETCH_HEAD";
 		mkdirSync(directoryOf(options.root, source), { recursive: true });
 		if (!existsSync(repo)) {
-			const cloned = await run(`git clone --bare --depth 1 ${ref === "" ? "" : `--branch ${quoteShellArg(ref)} `}${quoteShellArg(source.url)} ${quoteShellArg(repo)}`);
+			const cloned = await run([
+				"clone",
+				"--bare",
+				"--depth",
+				"1",
+				...ref === "" ? [] : ["--branch", ref],
+				source.url,
+				repo
+			]);
 			if (!cloned.ok) {
 				rmSync(repo, {
 					recursive: true,
@@ -15022,17 +15070,27 @@ function createMarketIndexReader(options) {
 			}
 			revision = "HEAD";
 		} else {
-			const fetched = await run(`git -C ${quoteShellArg(repo)} fetch --depth 1 origin ${quoteShellArg(ref === "" ? "HEAD" : ref)}`);
+			const fetched = await run([
+				"fetch",
+				"--depth",
+				"1",
+				"origin",
+				ref === "" ? "HEAD" : ref
+			], repo);
 			if (!fetched.ok) return withBranch(fetched, repo);
 		}
-		if (!(await run(`git -C ${quoteShellArg(repo)} rev-parse --verify HEAD`)).ok) return withBranch({
+		if (!(await run([
+			"rev-parse",
+			"--verify",
+			"HEAD"
+		], repo)).ok) return withBranch({
 			ok: false,
 			problem: {
 				kind: "git-empty",
 				detail: "仓库还没有任何提交"
 			}
 		}, repo);
-		const head = await run(`git -C ${quoteShellArg(repo)} rev-parse ${revision}`);
+		const head = await run(["rev-parse", revision], repo);
 		if (!head.ok) return head;
 		const commit = head.stdout.trim();
 		if (!/^[0-9a-f]{40}$/.test(commit)) return {
@@ -15042,7 +15100,13 @@ function createMarketIndexReader(options) {
 				detail: `读到的 commit 不是 40 位：${commit}`
 			}
 		};
-		const listed = await run(`git -C ${quoteShellArg(repo)} ls-tree -r ${quoteShellArg(commit)} -- ${quoteShellArg(path)}`);
+		const listed = await run([
+			"ls-tree",
+			"-r",
+			commit,
+			"--",
+			path
+		], repo);
 		if (!listed.ok) {
 			if (listed.problem.kind === "git-file") return withBranch({
 				ok: false,
@@ -15078,7 +15142,7 @@ function createMarketIndexReader(options) {
 			};
 		};
 		const readLegacy = async (file) => {
-			const shown = await run(`git -C ${quoteShellArg(repo)} show ${quoteShellArg(commit)}:${quoteShellArg(file)}`);
+			const shown = await run(["show", `${commit}:${file}`], repo);
 			if (!shown.ok) return void 0;
 			const parsed = parseMarketIndexJson(shown.stdout);
 			if (!parsed.ok) return {
@@ -15102,7 +15166,7 @@ function createMarketIndexReader(options) {
 				for (;;) {
 					const next = queue.shift();
 					if (next === void 0 || failed !== void 0) return;
-					const shown = await run(`git -C ${quoteShellArg(repo)} show ${quoteShellArg(commit)}:${quoteShellArg(next.file)}`);
+					const shown = await run(["show", `${commit}:${next.file}`], repo);
 					if (!shown.ok) {
 						failed = shown;
 						return;
@@ -15155,7 +15219,7 @@ function createMarketIndexReader(options) {
 			ok: false,
 			problem: {
 				kind: "unknown",
-				detail: messageOf$1(error)
+				detail: messageOf$2(error)
 			}
 		})).then((result) => {
 			if (result.ok) return result;
@@ -15184,7 +15248,7 @@ var FILES = {
 var DEFAULT_TIMEOUT_MS$1 = 15e3;
 var DEFAULT_MAX_BYTES = 204800;
 var DEFAULT_REGISTRY = "https://registry.npmjs.org";
-function messageOf(error) {
+function messageOf$1(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 function clipped(text, maxBytes) {
@@ -15199,6 +15263,7 @@ function createMarketDocReader(options) {
 	const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS$1;
 	const maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES;
 	const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+	const runGit = options.runGit ?? runGitProcess;
 	const cache = /* @__PURE__ */ new Map();
 	function fail(kind, version, reason, detail) {
 		return {
@@ -15216,22 +15281,40 @@ function createMarketDocReader(options) {
 	async function readGit(source, target, kind) {
 		const git = target.source;
 		if (git.type !== "git") return fail(kind, target.version, "missing");
-		const shell = options.shell;
-		if (shell === void 0) return fail(kind, target.version, "unavailable", "没有 git 执行缝");
 		const key = `${git.commit}|${git.path ?? ""}|${kind}`;
 		const cached = cache.get(key);
 		if (cached !== void 0) return cached;
 		const directory = (git.path ?? "").replace(/^\/+|\/+$/g, "");
 		const file = directory === "" ? FILES[kind] : `${directory}/${FILES[kind]}`;
 		const repo = join(options.root, "market-index", marketSourceKey(source), "repo.git");
-		const show = () => runShell(shell, `git -C ${quoteShellArg(repo)} show ${git.commit}:${quoteShellArg(file)}`, { timeoutMs });
+		const show = () => runGit(["show", `${git.commit}:${file}`], {
+			cwd: repo,
+			timeoutMs,
+			maxBytes
+		});
 		const hasCommit = async () => {
-			return (await runShell(shell, `git -C ${quoteShellArg(repo)} cat-file -e ${quoteShellArg(`${git.commit}^{commit}`)}`, { timeoutMs })).exitCode === 0;
+			return (await runGit([
+				"cat-file",
+				"-e",
+				`${git.commit}^{commit}`
+			], {
+				cwd: repo,
+				timeoutMs
+			})).exitCode === 0;
 		};
 		try {
 			let result = await show();
 			if (result.exitCode !== 0 && !await hasCommit()) {
-				if ((await runShell(shell, `git -C ${quoteShellArg(repo)} fetch --depth 1 origin ${git.commit}`, { timeoutMs })).exitCode === 0) result = await show();
+				if ((await runGit([
+					"fetch",
+					"--depth",
+					"1",
+					"origin",
+					git.commit
+				], {
+					cwd: repo,
+					timeoutMs
+				})).exitCode === 0) result = await show();
 			}
 			if (result.exitCode !== 0) {
 				const text = result.stderr.trim();
@@ -15244,8 +15327,8 @@ function createMarketDocReader(options) {
 				text: clipped(result.stdout, maxBytes)
 			});
 		} catch (error) {
-			options.logger?.warn?.(`[dsh-workbench] 读 ${file} 失败：${messageOf(error)}`);
-			return fail(kind, target.version, "unavailable", messageOf(error));
+			options.logger?.warn?.(`[dsh-workbench] 读 ${file} 失败：${messageOf$1(error)}`);
+			return fail(kind, target.version, "unavailable", messageOf$1(error));
 		}
 	}
 	async function readNpm(target, kind) {
@@ -15271,8 +15354,8 @@ function createMarketDocReader(options) {
 				text: clipped(text, maxBytes)
 			});
 		} catch (error) {
-			options.logger?.warn?.(`[dsh-workbench] 读 ${target.name} 的说明失败：${messageOf(error)}`);
-			return fail(kind, target.version, "unavailable", messageOf(error));
+			options.logger?.warn?.(`[dsh-workbench] 读 ${target.name} 的说明失败：${messageOf$1(error)}`);
+			return fail(kind, target.version, "unavailable", messageOf$1(error));
 		}
 	}
 	return { read: (source, target, kind) => target.source.type === "git" ? readGit(source, target, kind) : readNpm(target, kind) };
@@ -15391,8 +15474,17 @@ var CACHE_FILES = [
 	"index.json",
 	"meta.json"
 ];
+function messageOf(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+var SANDBOX_TEXT = "被系统拦住了：这个 profile 的可写根盖不住工作台的缓存目录";
+function sandboxBlocked(text) {
+	const lower = text.toLowerCase();
+	return lower.includes("operation not permitted") || /\beperm\b/.test(lower);
+}
 function createMarketSourceInitializer(options) {
 	const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+	const runGit = options.runGit ?? runGitProcess;
 	function forget(source, next) {
 		const base = join(options.root, "market-index");
 		const oldKey = marketSourceKey(source);
@@ -15415,22 +15507,22 @@ function createMarketSourceInitializer(options) {
 		});
 	}
 	return async (request) => {
-		const shell = options.shell;
-		if (shell === void 0) throw new Error("这台机器上没有 shell 服务，初始化不了索引仓库");
 		const source = options.store.read().sources.find((one) => one.id === request.id);
 		if (source === void 0) throw new Error("这个索引源已经不在了 —— 刷新后再试");
 		if (source.kind !== "git") throw new Error("只有 git 仓库能初始化成市场索引");
 		if (!gitUrlOk(source.url)) throw new Error(`这个 git 地址不合格：${source.url}`);
 		const asked = (request.ref ?? "").trim();
 		if (asked !== "" && !marketBranchOk(asked)) throw new Error(`分支名不合格：${asked}`);
-		const git = (argv, workdir) => runShell(shell, [
-			"git",
-			argv[0],
-			...argv.slice(1).map((one) => quoteShellArg(one))
-		].join(" "), {
-			...workdir === void 0 ? {} : { workdir },
-			timeoutMs
-		});
+		const git = async (args, workdir) => {
+			try {
+				return await runGit(args, {
+					...workdir === void 0 ? {} : { cwd: workdir },
+					timeoutMs
+				});
+			} catch (error) {
+				throw new Error(`git 跑不起来：${messageOf(error)}`, { cause: error });
+			}
+		};
 		const workdir = join(options.root, "market-index", marketSourceKey(source), "worktree");
 		mkdirSync(dirname(workdir), { recursive: true });
 		if (!existsSync(join(workdir, ".git"))) {
@@ -15444,6 +15536,7 @@ function createMarketSourceInitializer(options) {
 					recursive: true,
 					force: true
 				});
+				if (sandboxBlocked(cloned.stderr)) throw new Error(SANDBOX_TEXT);
 				throw new Error(`索引仓库克隆不下来：${tailLines(cloned.stderr || cloned.stdout, 4)}`);
 			}
 		}
@@ -16568,6 +16661,8 @@ async function installedPlugins(options) {
 				...release.latest === void 0 ? {} : { latest: release.latest }
 			},
 			...entry.local === true ? { local: true } : {},
+			...entry.registry === void 0 ? {} : { registry: entry.registry },
+			...entry.installedAt === void 0 ? {} : { installedAt: entry.installedAt },
 			...pluginOnDisk(entry, ledger.pluginFiles) ? {} : { broken: true }
 		});
 	}
@@ -16912,24 +17007,22 @@ var OWNED = [{
 		});
 		const marketIndex = createMarketIndexReader({
 			root: marketRoot,
-			shell,
 			...logger === void 0 ? {} : { logger }
 		});
 		const marketDocs = createMarketDocReader({
 			root: marketRoot,
-			shell,
 			...logger === void 0 ? {} : { logger }
 		});
 		const marketInit = createMarketSourceInitializer({
 			root: marketRoot,
-			store: marketSources,
-			...shell === void 0 ? {} : { shell }
+			store: marketSources
 		});
 		const discover = createMarketDiscover({
 			store: marketSources,
 			reader: marketIndex,
 			docs: marketDocs,
 			modules: () => supply.profileModules(profileDir),
+			...profileDir === null ? {} : { profilePath: profileDir },
 			defaultRegistry: async () => {
 				try {
 					return (await bundles?.registries())?.resolved ?? void 0;
@@ -16959,9 +17052,9 @@ var OWNED = [{
 					dependencyOf: dependencyReader(profileDir),
 					isNewer: supply.isNewerVersion,
 					preferred: (host) => marketSources.read().transports?.[host],
-					...shell === void 0 ? {} : { probe: (url) => probeGitAddressCached(shell, url, { timeoutMs: 4e3 }).then((one) => one.status) }
+					probe: (url) => probeGitAddressCached(url, { timeoutMs: 4e3 }).then((one) => one.status)
 				}) })),
-				...publishPreviewRoutes(workshopPathOf(ctx), (unit) => inferredAuthorOf(workshopPathOf(ctx), unit, shell))
+				...publishPreviewRoutes(workshopPathOf(ctx), (unit) => inferredAuthorOf(workshopPathOf(ctx), unit))
 			},
 			registerTools: () => [
 				...registerPanelTools(ctx, panels, values),
@@ -16970,7 +17063,7 @@ var OWNED = [{
 					init: marketInit,
 					readOnly: (id) => markSourceReadOnly(marketSources, id)
 				}),
-				...registerDiyTools(ctx, market, panels, debug, (unit) => publishPreviewOf(workshopPathOf(ctx), unit), (unit) => inferredAuthorOf(workshopPathOf(ctx), unit, shell)),
+				...registerDiyTools(ctx, market, panels, debug, (unit) => publishPreviewOf(workshopPathOf(ctx), unit), (unit) => inferredAuthorOf(workshopPathOf(ctx), unit)),
 				...registerRecordTools(ctx, record),
 				...registerLongTaskTools(ctx, longTaskRuns)
 			],