@goodandready/dsh-subscriptions 0.6.30 → 0.6.32

package/README.md

@@ -262,7 +262,7 @@ Supports Anthropic's adaptive thinking (`thinking: { type: "adaptive" }`) and re
 
 ## 🚀 One-Click Plugin Updater & Stability Hardening (Added in v0.6.9)
 
-- **Host One-Click Updater**: Automatic in-place updater mounted at `/dsh-subscriptions/update`, checking the npm registry for newer releases and executing single-flight installation via the host DSH CLI (`dsh plugin add --config.minimumReleaseAge=0`).
+- **Host One-Click Updater**: Automatic in-place updater mounted at `/dsh-subscriptions/update`, checking the npm registry for newer releases and executing single-flight installation via the host DSH CLI (`dsh plugin add`).
 - **Security & Origin Protection**: Updater endpoints enforce strict loopback address checks (supporting IPv4 `127.0.0.1`, IPv6 `::1`, `localhost`), `x-dsh-plugin-update` header verification, and same-origin validation to prevent unauthorized updates.
 - **Header Badge & UI Action**: The settings header bar displays current plugin version, an update warning badge when a new release is detected, and an instant "Update" button with live restart countdown.
 - **Network Timeout Hardening**: Quota balance and smoke test probes now enforce guaranteed 15-second abort timeouts (`AbortSignal.timeout(15_000)`), preventing hanging sockets during vendor outages.

package/README.ru.md

@@ -235,7 +235,7 @@ dsh-subscriptions:
 
 ## 🚀 Обновление в один клик и повышение стабильности (Добавлено в v0.6.9)
 
-- **Встроенный апдейтер в один клик**: Фоновая проверка новых версий в npm registry и обновление на месте по маршруту `/dsh-subscriptions/update` через хостовый CLI DSH (`dsh plugin add --config.minimumReleaseAge=0`).
+- **Встроенный апдейтер в один клик**: Фоновая проверка новых версий в npm registry и обновление на месте по маршруту `/dsh-subscriptions/update` через хостовый CLI DSH (`dsh plugin add`).
 - **Безопасность и защита эндпоинта**: Строгая верификация loopback-адресов (поддержка IPv4 `127.0.0.1`, IPv6 `::1`, `localhost`), валидация заголовка `x-dsh-plugin-update` и защита от CSRF/cross-origin запросов.
 - **Индикатор в шапке и кнопка обновления**: В строке состояния панели отображается текущая версия, бейдж наличия обновления и кнопка быстрого обновления («Update → vX.Y.Z») с уведомлением о перезапуске службы.
 - **Сетевые таймауты и устойчивость**: Ограничение времени ожидания запросов баланса и smoke-тестов до 15 секунд (`AbortSignal.timeout(15_000)`), предотвращающее зависание сокетов при недоступности внешних API.

package/README.zh.md

@@ -157,7 +157,7 @@ dsh plugin --profile web add @goodandready/dsh-subscriptions
 
 ## 🚀 一键插件自更新与稳定性强化 (v0.6.9 新增)
 
-- **宿主端一键更新**: 挂载于 `/dsh-subscriptions/update` 的就地更新机制，自动对比 npm registry 最新版本并通过宿主 DSH CLI 执行单飞安装 (`dsh plugin add --config.minimumReleaseAge=0`)。
+- **宿主端一键更新**: 挂载于 `/dsh-subscriptions/update` 的就地更新机制，自动对比 npm registry 最新版本并通过宿主 DSH CLI 执行单飞安装 (`dsh plugin add`)。
 - **安全与来源防护**: 更新接口严格校验环回地址（支持 IPv4 `127.0.0.1`、IPv6 `::1`、`localhost`）、`x-dsh-plugin-update` 请求头及同源策略，阻断未授权跨站调用。
 - **状态栏徽章与更新按钮**: 设置面板顶部状态栏显示当前插件版本，有新版本时提示告警徽章并提供一键更新按钮与重启提示。
 - **网络超时熔断**: 配额检测与冒烟测试增加 15 秒超时信号保护 (`AbortSignal.timeout(15_000)`)，防止外部服务商接口故障导致请求挂起。

package/lib/index.js

@@ -65,7 +65,7 @@ const OK_HTML = `<!doctype html>
 </html>`
 
 export function apply(ctx, rawConfig) {
-  const logger = ctx.logger ? ctx.logger('subscriptions') : undefined
+  const logger = typeof ctx.logger === 'function' ? ctx.logger('subscriptions') : (ctx.logger || ctx.log)
   let settingsApi
 
   let cachedConfig = Config(rawConfig || {})
@@ -185,7 +185,7 @@ export function apply(ctx, rawConfig) {
       bestEffort('emit limit-notice', () => ctx.emit && ctx.emit('subscriptions.limit-notice', { provider, ref, window: win.id, usedPercent: win.usedPercent, threshold }), undefined, logger)
     },
   })
-  const historyDir = ctx?.historyDir || ctx?.storageDir || resolveHistoryDir()
+  const historyDir = resolveHistoryDir()
   const history = new HistoryStore(historyDir, 7 * 24 * 60 * 60 * 1000, 1000)
   if (typeof ctx?.on === 'function') {
     ctx.on('dispose', () => history.dispose())

package/lib/updater.js

@@ -1,5 +1,5 @@
 import { spawn } from 'node:child_process'
-import { existsSync, readFileSync } from 'node:fs'
+import { existsSync, readFileSync, rmSync, statSync } from 'node:fs'
 import { readFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { basename, dirname, isAbsolute, resolve } from 'node:path'
@@ -162,12 +162,82 @@ export async function getUpdaterStatus(options, target = getRuntime()) {
   }
 }
 
-export async function installExactPackage(target, packageSpec, options) {
+export function readLockPid(lockPath) {
+  try {
+    if (!existsSync(lockPath)) return undefined
+    const stat = statSync(lockPath)
+    if (stat.isDirectory()) return undefined
+    const content = readFileSync(lockPath, "utf8").trim()
+    if (!content) return undefined
+    try {
+      const parsed = JSON.parse(content)
+      if (parsed && typeof parsed.pid === "number") return parsed.pid
+    } catch {}
+    const num = parseInt(content, 10)
+    if (!isNaN(num) && num > 0) return num
+    const match = /\b(\d{1,8})\b/.exec(content)
+    if (match) return Number(match[1])
+    return undefined
+  } catch {
+    return undefined
+  }
+}
+
+export function isPidAlive(pid) {
+  if (typeof pid !== "number" || isNaN(pid) || pid <= 0) return false
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch (err) {
+    return err?.code === "EPERM"
+  }
+}
+
+export function checkAndCleanLock(profileDir, childPid) {
+  const lockPath = resolve(profileDir, "package.json.lock")
+  if (!existsSync(lockPath)) return { locked: false }
+  const pid = readLockPid(lockPath)
+  if (pid !== undefined) {
+    if (isPidAlive(pid)) {
+      if (childPid !== undefined && pid === childPid) {
+        try {
+          rmSync(lockPath, { recursive: true, force: true })
+          return { locked: false, cleaned: true }
+        } catch {
+          return { locked: true, pid }
+        }
+      }
+      return { locked: true, pid }
+    }
+    try {
+      rmSync(lockPath, { recursive: true, force: true })
+      return { locked: false, cleaned: true }
+    } catch {
+      return { locked: true, pid }
+    }
+  }
+  if (childPid !== undefined) {
+    try {
+      rmSync(lockPath, { recursive: true, force: true })
+      return { locked: false, cleaned: true }
+    } catch {}
+  }
+  return { locked: true }
+}
+
+export async function installExactPackage(target, packageSpec, options = {}) {
   if (target.cliEntry === undefined) throw new Error('Automatic update is unavailable in this runtime.')
+  const lockStatus = checkAndCleanLock(target.profileDir)
+  if (lockStatus.locked) {
+    const error = new Error('Another plugin installation is currently in progress.')
+    error.status = 409
+    error.code = 'ELOCKED'
+    throw error
+  }
   await new Promise((resolvePromise, reject) => {
     const child = spawn(process.execPath, [
       target.cliEntry, 'plugin', '--profile', target.profileName, 'add',
-      '--config.minimumReleaseAge=0', packageSpec,
+      packageSpec,
       `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
     ], {
       cwd: target.profileDir,
@@ -178,13 +248,24 @@ export async function installExactPackage(target, packageSpec, options) {
     let detail = ''
     child.stdout?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4_000) })
     child.stderr?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4_000) })
+    let timedOut = false
+    const timeoutMs = options.timeoutMs ?? UPDATE_TIMEOUT_MS
     const timer = setTimeout(() => {
-      child.kill()
+      timedOut = true
+      try { child.kill('SIGTERM') } catch {}
+      setTimeout(() => {
+        try { child.kill('SIGKILL') } catch {}
+        checkAndCleanLock(target.profileDir, child.pid)
+      }, 500).unref?.()
       reject(new Error('Update timed out; use the normal DSH update flow.'))
-    }, UPDATE_TIMEOUT_MS)
+    }, timeoutMs)
     child.once('error', error => { clearTimeout(timer); reject(error) })
-    child.once('exit', code => {
+    child.once('exit', (code) => {
       clearTimeout(timer)
+      if (timedOut) {
+        checkAndCleanLock(target.profileDir, child.pid)
+        return
+      }
       if (code === 0) resolvePromise()
       else reject(new Error(detail.trim() || `Update exited with code ${String(code)}.`))
     })
@@ -218,6 +299,11 @@ export function registerPluginUpdater(ctx, options) {
           writeJson(response, 409, { ok: false, error: { code: 'busy', message: 'This plugin is already updating.' } })
           return
         }
+        const profileLock = checkAndCleanLock(target.profileDir)
+        if (profileLock.locked) {
+          writeJson(response, 409, { ok: false, error: { code: 'busy', message: 'Another plugin installation is currently in progress in this profile.' } })
+          return
+        }
         installing = true
         try {
           const before = await getUpdaterStatus(options, target)
@@ -240,6 +326,10 @@ export function registerPluginUpdater(ctx, options) {
           installing = false
         }
       } catch (error) {
+        if (error?.status === 409 || error?.code === 'ELOCKED') {
+          writeJson(response, 409, { ok: false, error: { code: 'busy', message: error.message || 'Another plugin installation is currently in progress.' } })
+          return
+        }
         ctx.logger?.warn?.(`plugin updater failed: ${String(error)}`)
         writeJson(response, 503, { ok: false, error: { code: 'update_failed', message: String(error?.message || error) } })
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.30",
+  "version": "0.6.32",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",