@hyzyn/dsh-safe 0.3.1 → 0.4.0

package/README.en.md

@@ -67,6 +67,7 @@ Every short flag has an equivalent long form (`-u` = `--update`, `-y` = `--yes`,
 | `--to <version>` | Target dsh version, also how you roll back (explicit downgrades allowed); dsh-safe itself always upgrades to the latest |
 | `--self` | Update dsh-safe itself only; dsh and quarantine state untouched |
 | `--no-restore` | Do not auto-restore quarantined plugins after upgrading dsh |
+| `--no-verify` | Skip the post-upgrade parser self-check (boots the new dsh with a throwaway profile to confirm error recognition still works) |
 | `--pm <npm\|pnpm>` | Force the package manager (auto-detected by default) |
 
 ### Environment variables
@@ -98,8 +99,8 @@ How upgrading works: `dsh-safe update` auto-detects the dsh package name and ins
 - If the patch file itself fails YAML parsing (e.g. broken by hand-editing), plugins cannot be identified and the failure is passed through.
 - Rows inserted via `--patch` overlay layers are not part of the mapping (only the profile patch, the home patch and bundle patches are scanned).
 - To capture stderr, the wrapper pipes dsh's stderr (content is still echoed to the terminal in real time); stdout/stdin pass through unaffected.
-- Match patterns target the dsh 0.1.x error formats; a major dsh upgrade that changes them requires updating the parser.
-- Windows is best-effort: update / --self / list / restore are adapted (.cmd shim parsing, shelled npm/pnpm invocations), but the wrapped dsh boot's child-process spawn is unverified on Windows.
+- Match patterns target the dsh 0.1.x error formats; a major dsh upgrade that changes them requires updating the parser. Mitigation: after update/-u upgrades dsh it runs a parser self-check — boots the new dsh with a throwaway profile and confirms failures are still recognized, warning right away on mismatch (`--no-verify` skips it).
+- Windows is best-effort: update / --self / list / restore are adapted (.cmd shim parsing, shelled npm/pnpm invocations); the wrapped boot resolves the node entry embedded in dsh's .cmd/.ps1 shim on PATH and spawns `node <entry>` directly (.exe runs as-is, unparseable shims fall back to a shelled spawn), sidestepping Node's ban on spawning .cmd files. Not yet verified end-to-end on a real Windows machine — feedback welcome.
 
 ## Development
 

package/README.md

@@ -67,6 +67,7 @@ Error: dsh: plugin tree failed to load: failed to apply loader entry smoke-broke
 | `--to <版本>` | 指定 dsh 的目标版本，也是回滚方式（显式允许降级）；dsh-safe 自身始终升到最新 |
 | `--self` | 只更新 dsh-safe 自身，不动 dsh 与隔离状态 |
 | `--no-restore` | 升级 dsh 后不自动恢复被隔离的插件 |
+| `--no-verify` | 跳过升级后的解析器自校验（临时 profile 试启新版 dsh，验证报错识别仍有效） |
 | `--pm <npm\|pnpm>` | 强制指定包管理器（缺省自动探测） |
 
 ### 环境变量
@@ -98,13 +99,13 @@ Error: dsh: plugin tree failed to load: failed to apply loader entry smoke-broke
 - patch 文件本身 YAML 解析错误（如手改坏了）时无法识别插件，只会透传。
 - `--patch` 覆盖层里插入的行不参与对照表（对照表只扫 profile patch、home patch 与 bundle patch）。
 - 为了捕获 stderr，包装器把 dsh 的 stderr 接到管道（内容仍实时回显到终端）；stdout/stdin 直通不受影响。
-- 本项目针对 dsh 0.1.x 的报错格式做匹配；dsh 大版本升级后格式变化时需要同步更新解析器。
-- Windows 为尽力支持：update / --self / list / restore 已适配（.cmd shim 解析、shell 方式调用 npm/pnpm），包装启动 dsh 的子进程方式未在 Windows 验证。
+- 本项目针对 dsh 0.1.x 的报错格式做匹配；dsh 大版本升级后格式变化时需要同步更新解析器。缓解：update/-u 升级 dsh 后会自动做解析器自校验——临时 profile 试启新版 dsh 并确认报错仍可识别，失配当场告警（`--no-verify` 跳过）。
+- Windows 为尽力支持：update / --self / list / restore 已适配（.cmd shim 解析、shell 方式调用 npm/pnpm）；包装启动会把 PATH 上 dsh 的 .cmd/.ps1 shim 解析出内嵌的 node 入口、改为 `node <入口>` 直接启动（.exe 直接运行，shim 解析失败退回 shell 方式），绕开 Node 禁止 spawn .cmd 的限制。尚未在真实 Windows 上端到端验证，欢迎反馈。
 
 ## 开发
 
 ```bash
-npm test        # node:test 单元测试 + 假 dsh 集成测试
+npm test        # node:test 单元测试 + fake dsh 集成测试
 ```
 
 ## License

package/lib/dshpaths.js

@@ -6,7 +6,7 @@
  */
 import { existsSync, readFileSync } from 'node:fs'
 import { homedir } from 'node:os'
-import { resolve, join } from 'node:path'
+import { dirname, resolve, join } from 'node:path'
 
 /** dsh home 目录：`DSH_HOME` 优先，默认 `~/.dsh`。 */
 export function dshHome() {
@@ -79,3 +79,75 @@ export function detectInvocation(args) {
   }
   return { mode: 'boot', profile: profile || null }
 }
+
+/**
+ * 解析把 dsh 跑起来的 spawn 目标（Windows 兼容的关键）。
+ *
+ * 非 Windows 的全局 bin 是 symlink / 带执行位脚本，`spawn('dsh')` 原样可用。
+ * Windows 的全局 bin 是 .cmd/.ps1 批处理：Node 出于安全禁止无 shell 地 spawn
+ * 它们（EINVAL），裸名也不参与 PATHEXT 解析（ENOENT）。因此按 PATH 目录顺序
+ * 找 `dsh.exe` / `dsh.cmd` / `dsh.ps1`：
+ *   - .exe → 直接 spawn；
+ *   - .cmd/.ps1 → 解析 shim 内嵌的 node_modules 入口脚本，改 spawn
+ *     `node <entry>`（无 shell、无参数转义问题，stderr 管道行为与 unix 一致）；
+ *   - shim 里解析不出入口 → 退回 shell 方式运行 shim 本身；
+ *   - PATH 上什么都没有 → 原样返回（报错行为与从前一致）。
+ *
+ * @param {string} command dsh 可执行名（默认 'dsh'）
+ * @param {{
+ *   platform?: string,
+ *   pathEnv?: string,
+ *   execPath?: string,
+ *   exists?: (path: string) => boolean,
+ *   readFile?: (path: string) => string | undefined,
+ * }} [inject] 测试注入
+ * @returns {{ file: string, prefix: string[], shell: boolean }}
+ *          spawn(file, [...prefix, ...args], { shell })
+ */
+export function resolveDshSpawnTarget(command, {
+  platform = process.platform,
+  pathEnv = process.env.PATH ?? '',
+  execPath = process.execPath,
+  exists = existsSync,
+  readFile = (p) => { try { return readFileSync(p, 'utf8') } catch { return undefined } },
+} = {}) {
+  if (platform !== 'win32') return { file: command, prefix: [], shell: false }
+  for (const dir of pathEnv.split(';')) {
+    if (!dir) continue
+    for (const ext of ['.exe', '.cmd', '.ps1']) { // 同目录内按 PATHEXT 惯例 .exe 优先
+      const p = join(dir, command + ext)
+      if (!exists(p)) continue
+      if (ext === '.exe') return { file: p, prefix: [], shell: false }
+      return resolveShimEntry(p, { execPath, exists, readFile })
+    }
+  }
+  return { file: command, prefix: [], shell: false }
+}
+
+/** 从 .cmd/.ps1 shim 解析内嵌入口；失败退回 shell 方式运行 shim（路径含空白时加引号）。 */
+function resolveShimEntry(shimPath, { execPath, exists, readFile }) {
+  const content = readFile(shimPath)
+  const entry = content ? findShimEntry(content, dirname(shimPath), exists) : null
+  if (entry) return { file: execPath, prefix: [entry], shell: false }
+  return { file: /\s/.test(shimPath) ? `"${shimPath}"` : shimPath, prefix: [], shell: true }
+}
+
+/**
+ * npm/pnpm 的 cmd/ps1 shim 内容里都内嵌 node_modules 下的入口脚本路径：
+ * cmd 形如 `"%~dp0\node_modules\@scope\pkg\bin\x.js"`（也可能先 SET 进变量再
+ * `node "%_prog%" %*`），ps1 形如 `$basedir/node_modules/...`。%~dp0 与
+ * $basedir 都展开为 shim 所在目录；取第一个真实存在的候选。
+ */
+function findShimEntry(content, shimDir, exists) {
+  const candidates = []
+  for (const m of content.matchAll(/"([^"\r\n]*node_modules[^"\r\n]*\.(?:js|cjs|mjs))"/gi)) candidates.push(m[1])
+  for (const m of content.matchAll(/[\w@.$%~\-\\\/]*node_modules[\w@.$%~\-\\\/]*\.(?:js|cjs|mjs)/gi)) candidates.push(m[0])
+  for (let raw of candidates) {
+    // `SET "_prog=%~dp0\..."` 会把变量名一起捕进来，切掉 `node_modules` 之前的 `xxx=`
+    const eq = raw.indexOf('=')
+    if (eq >= 0 && eq < raw.toLowerCase().indexOf('node_modules')) raw = raw.slice(eq + 1)
+    const p = resolve(raw.replace(/%~dp0|\$basedir/gi, `${shimDir}/`).replace(/\\/g, '/'))
+    if (exists(p)) return p
+  }
+  return null
+}

package/lib/i18n.js

@@ -20,7 +20,7 @@ const ZH = {
   dsh-safe list [--profile <名>]    查看隔离名单（缺省列出全部 profile）
   dsh-safe restore --profile <名> (--id <id> | --all) [--dry-run]
                                     恢复被自动禁用的插件（升级修复后使用）
-  dsh-safe update [-y] [--to <版本>] [--self] [--no-restore] [--pm npm|pnpm]
+  dsh-safe update [-y] [--to <版本>] [--self] [--no-restore] [--no-verify] [--pm npm|pnpm]
                                     升级 dsh 与 dsh-safe 自身，并自动恢复被隔离的插件
   dsh-safe help                     显示本帮助
   dsh-safe --version                显示版本
@@ -89,6 +89,11 @@ const ZH = {
   updateRestoreSkipped: '[dsh-safe] 已按 --no-restore 跳过恢复；可稍后用 dsh-safe restore --profile <名> --all 恢复。',
   updateVerifyHint: '[dsh-safe] 请启动 dsh 验证；仍不兼容的插件会自动再次隔离。',
   updateRollbackHint: '[dsh-safe] 如需回滚: dsh-safe update --to {version}',
+  verifyRunning: '[dsh-safe] 正在自校验解析器：用临时 profile 试启新版 dsh（预期失败）…',
+  verifyPassed: '[dsh-safe] 解析器自校验通过：新版 dsh 的报错能被识别，自动隔离可用。',
+  verifyFailNoHit: '[dsh-safe] 警告：解析器自校验未通过——无法从新版 dsh 的报错里识别坏插件，自动隔离可能失效；建议回滚（dsh-safe update --to {version}）并反馈给 dsh-safe。',
+  verifyFailBoot: '[dsh-safe] 警告：解析器自校验未通过——坏插件试启意外成功，未触发报错，自动隔离未验证。',
+  verifyFailTimeout: '[dsh-safe] 警告：解析器自校验未完成（试启超时或无法启动），自动隔离未验证。',
   selfUpdateLagHint: '[dsh-safe] dsh-safe 已更新: {old} → {new}（本次运行仍是旧版，下次启动生效）',
   updateNotify: '[dsh-safe] 提示: dsh-safe 有新版本 {new}（当前 {old}）',
   updateNotifyHow: '           升级: npm i -g {name} 或 dsh-safe update --self',
@@ -112,7 +117,7 @@ Usage:
   dsh-safe list [--profile <name>] show quarantined plugins (defaults to all profiles)
   dsh-safe restore --profile <name> (--id <id> | --all) [--dry-run]
                                     re-enable auto-disabled plugins (after a fixed plugin upgrade)
-  dsh-safe update [-y] [--to <ver>] [--self] [--no-restore] [--pm npm|pnpm]
+  dsh-safe update [-y] [--to <ver>] [--self] [--no-restore] [--no-verify] [--pm npm|pnpm]
                                     upgrade dsh and dsh-safe itself, auto-restore quarantined plugins
   dsh-safe help                     show this help
   dsh-safe --version                show version
@@ -184,6 +189,11 @@ Notes:
   updateRestoreSkipped: '[dsh-safe] restore skipped due to --no-restore; restore later with dsh-safe restore --profile <name> --all.',
   updateVerifyHint: '[dsh-safe] start dsh to verify; plugins still incompatible will be auto-quarantined again.',
   updateRollbackHint: '[dsh-safe] to roll back: dsh-safe update --to {version}',
+  verifyRunning: '[dsh-safe] verifying the parser: booting the new dsh with a throwaway profile (expected to fail)…',
+  verifyPassed: '[dsh-safe] parser self-check passed: failures from the new dsh are recognized, auto-quarantine is available.',
+  verifyFailNoHit: '[dsh-safe] warning: parser self-check failed — the broken plugin could not be recognized in the new dsh errors; auto-quarantine may be broken. Consider rolling back (dsh-safe update --to {version}) and reporting it to dsh-safe.',
+  verifyFailBoot: '[dsh-safe] warning: parser self-check failed — the deliberately broken profile booted unexpectedly, no error was triggered; auto-quarantine unverified.',
+  verifyFailTimeout: '[dsh-safe] warning: parser self-check did not finish (boot timed out or could not start); auto-quarantine unverified.',
   selfUpdateLagHint: '[dsh-safe] dsh-safe updated: {old} → {new} (this run still uses the old version; takes effect on the next run)',
   updateNotify: '[dsh-safe] notice: a new dsh-safe version is available: {new} (current {old})',
   updateNotifyHow: '           to upgrade: npm i -g {name} or dsh-safe update --self',

package/lib/update.js

@@ -13,6 +13,7 @@ import { createInterface } from 'node:readline/promises'
 import { delimiter, dirname, join } from 'node:path'
 import { loadLedger, restoreQuarantine } from './quarantine.js'
 import { readIfExists, updateCheckFile } from './dshpaths.js'
+import { verifyParser } from './verify.js'
 import { t } from './i18n.js'
 
 const err = (line) => process.stderr.write(`${line}\n`)
@@ -235,11 +236,12 @@ export async function cmdUpdateAndBoot(args, { boot } = {}) {
 /**
  * 更新主体；bootArgs 非空时更新成功（或已最新/检查失败）后继续启动。
  * 默认同时检查 dsh 与 dsh-safe 自身，谁旧升谁（一条安装命令）；--self 只更新自身。
- * @param {{ to?: string, yes?: boolean, restore?: boolean, pm?: string, selfOnly?: boolean }} opts
+ * dsh 更新成功后默认跑解析器自校验（--no-verify 跳过）。
+ * @param {{ to?: string, yes?: boolean, restore?: boolean, pm?: string, selfOnly?: boolean, noVerify?: boolean }} opts
  * @param {string[] | null} bootArgs
- * @param {{ boot?: (args: string[]) => Promise<number> }} hooks
+ * @param {{ boot?: (args: string[]) => Promise<number>, verify?: typeof verifyParser }} hooks
  */
-async function updateAndMaybeBoot(opts, bootArgs, { boot } = {}) {
+async function updateAndMaybeBoot(opts, bootArgs, { boot, verify = verifyParser } = {}) {
   const dshPkg = opts.selfOnly ? null : resolveDshPackage()
   const selfPkg = resolveSelfPackage()
   if (!dshPkg && !selfPkg) {
@@ -317,6 +319,9 @@ async function updateAndMaybeBoot(opts, bootArgs, { boot } = {}) {
       err(t('selfUpdateLagHint', { old: p.pkg.version, new: p.target }))
     }
   }
+  if (dshUpdated && !opts.noVerify) {
+    await verify({ rollbackVersion: plans.find((p) => p.pkg === dshPkg)?.pkg.version, log: err })
+  }
 
   if (opts.restore && dshUpdated) {
     const ledger = loadLedger()
@@ -343,12 +348,13 @@ async function updateAndMaybeBoot(opts, bootArgs, { boot } = {}) {
 
 /** 解析 update 子命令参数；出错返回 { error: { key, params? } } 供 i18n。 */
 function parseUpdateArgs(args) {
-  const opts = { to: undefined, yes: false, restore: true, pm: undefined, selfOnly: false }
+  const opts = { to: undefined, yes: false, restore: true, pm: undefined, selfOnly: false, noVerify: false }
   for (let i = 0; i < args.length; i++) {
     const a = args[i]
     if (a === '-y' || a === '--yes') opts.yes = true
     else if (a === '--no-restore') opts.restore = false
     else if (a === '--self') opts.selfOnly = true
+    else if (a === '--no-verify') opts.noVerify = true
     else if (a === '--to') {
       const v = args[++i]
       if (v === undefined) return { error: { key: 'updateUnknownFlag', params: { arg: '--to' } } }
@@ -375,13 +381,14 @@ function parseUpdateArgs(args) {
  * dsh 启动参数（宽松处理——不像子命令那样对未知参数报错）。
  */
 function parseLeadingUpdateArgs(args) {
-  const opts = { to: undefined, yes: false, restore: true, pm: undefined, selfOnly: false }
+  const opts = { to: undefined, yes: false, restore: true, pm: undefined, selfOnly: false, noVerify: false }
   let i = 0
   for (; i < args.length; i++) {
     const a = args[i]
     if (a === '-y' || a === '--yes') opts.yes = true
     else if (a === '--no-restore') opts.restore = false
     else if (a === '--self') opts.selfOnly = true
+    else if (a === '--no-verify') opts.noVerify = true
     else if (a === '--to' && args[i + 1] !== undefined) opts.to = args[++i]
     else if (a.startsWith('--to=')) opts.to = a.slice('--to='.length)
     else if (a === '--pm' && args[i + 1] !== undefined) opts.pm = args[++i]

package/lib/verify.js

@@ -0,0 +1,78 @@
+/**
+ * @hyzyn/dsh-safe — 升级 dsh 后的解析器自校验。
+ *
+ * 风险背景：报错解析器与 dsh 的 stderr 格式耦合，dsh 升级可能让特征失配，
+ * 保险丝静默失效。自校验在临时 DSH_HOME 里搭一次性 profile（引用现场生成
+ * 的坏插件），用 PATH 上新装的 dsh 试启——预期启动失败，再确认解析器能从
+ * 报错里识别出坏插件。识别失败只告警（附回滚命令），不阻断后续启动。
+ */
+import { spawnSync } from 'node:child_process'
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { parseFailureReport } from './failures.js'
+import { matchFailures } from './knownrows.js'
+import { resolveDshSpawnTarget } from './dshpaths.js'
+import { t } from './i18n.js'
+
+const BAD_ID = 'dsh-safe-verify'
+const BAD_NAME = '@dsh-safe-verify/broken'
+
+/**
+ * @param {{
+ *   rollbackVersion?: string,
+ *   log?: (line: string) => void,
+ *   timeoutMs?: number,
+ *   spawn?: typeof spawnSync,
+ * }} [options]
+ * @returns {Promise<boolean>} 自校验是否通过
+ */
+export async function verifyParser({ rollbackVersion, log = (line) => process.stderr.write(`${line}\n`), timeoutMs = 60_000, spawn = spawnSync } = {}) {
+  log(t('verifyRunning'))
+  const home = mkdtempSync(join(tmpdir(), 'dsh-safe-verify-'))
+  try {
+    // 一次性 profile：patch 行引用现场生成的坏插件（模块级 throw → import 失败）
+    const profileDir = join(home, 'profiles', 'verify')
+    const modDir = join(profileDir, 'node_modules', BAD_NAME)
+    mkdirSync(join(modDir, 'lib'), { recursive: true })
+    writeFileSync(join(profileDir, 'package.json'), JSON.stringify({ name: 'dsh-profile-verify', private: true }))
+    const patchPath = join(profileDir, 'cordis.patch.yml')
+    writeFileSync(patchPath, `- id: ${BAD_ID}\n  name: '${BAD_NAME}'\n`)
+    writeFileSync(
+      join(modDir, 'package.json'),
+      JSON.stringify({ name: BAD_NAME, version: '0.0.1', type: 'module', main: 'lib/index.js' }),
+    )
+    writeFileSync(join(modDir, 'lib', 'index.js'), `throw new Error('dsh-safe parser self-check')\n`)
+
+    const target = resolveDshSpawnTarget('dsh')
+    const { status, stderr } = spawn(target.file, [...target.prefix, '--profile', 'verify'], {
+      env: { ...process.env, DSH_HOME: home },
+      stdio: ['ignore', 'ignore', 'pipe'],
+      timeout: timeoutMs,
+      shell: target.shell,
+      encoding: 'utf8',
+    })
+
+    if (status === 0) {
+      log(t('verifyFailBoot'))
+      return false
+    }
+    if (status === null) {
+      // 超时被杀或无法启动试启进程
+      log(t('verifyFailTimeout'))
+      return false
+    }
+    const report = parseFailureReport(stderr ?? '')
+    const hits = matchFailures(report, {
+      rows: [{ id: BAD_ID, name: BAD_NAME, disabled: false, file: patchPath }],
+    })
+    if (hits.length) {
+      log(t('verifyPassed'))
+      return true
+    }
+    log(t('verifyFailNoHit', { version: rollbackVersion ?? '' }))
+    return false
+  } finally {
+    rmSync(home, { recursive: true, force: true })
+  }
+}

package/lib/wrap.js

@@ -6,11 +6,14 @@
  *   - 失败退出 → 从 stderr 解析坏插件，对照 patch 行后把对应行置为 disabled
  *     （写入托管区块 + 台账），然后重试；识别不出、超过重试上限、或命中
  *     第一方插件（@deepseek-ai/*，默认保护）时原样透传退出码。
+ *
+ * Windows 上经 resolveDshSpawnTarget 把 dsh 的 .cmd shim 解析成 `node <入口>`
+ * 再启动（见 dshpaths.js），其余平台原样 spawn。
  */
 import { spawn } from 'node:child_process'
 import { summarizeLine, parseFailureReport } from './failures.js'
 import { collectKnownRows, matchFailures } from './knownrows.js'
-import { detectInvocation } from './dshpaths.js'
+import { detectInvocation, resolveDshSpawnTarget } from './dshpaths.js'
 import { writeQuarantine } from './quarantine.js'
 import { t } from './i18n.js'
 
@@ -19,12 +22,17 @@ const FIRST_PARTY_PREFIX = '@deepseek-ai/'
 
 const isFirstParty = (name) => typeof name === 'string' && name.startsWith(FIRST_PARTY_PREFIX)
 
+/** shell 方式兜底时给含空白的参数补引号（正常路径不走 shell，不受影响）。 */
+const quoteShellArg = (a) => (/\s/.test(a) && !/^".*"$/.test(a) ? `"${a}"` : a)
+
 /** 运行 dsh：stdin/stdout 直通，stderr 回显并捕获（上限内）。 */
 export function spawnDsh(args, { command = 'dsh' } = {}) {
+  const target = resolveDshSpawnTarget(command)
   return new Promise((resolve) => {
-    const child = spawn(command, args, {
+    const child = spawn(target.file, [...target.prefix, ...(target.shell ? args.map(quoteShellArg) : args)], {
       stdio: ['inherit', 'inherit', 'pipe'],
       env: process.env,
+      shell: target.shell,
     })
     let captured = ''
     child.stderr?.on('data', (chunk) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyzyn/dsh-safe",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "dsh 启动保险丝：社区插件不兼容导致 dsh 启动失败时，自动禁用坏插件并重试",
   "type": "module",
   "license": "MIT",