@koishi-ce/plugin-market 1.1.0 → 1.1.2

package/src/node/installer.ts

@@ -1,586 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-only
-// Copyright (c) 2019-present Shigma and Koishijs contributors.
-// Copyright (c) 2026-present Koishi-CE contributors.
-
-import {
-	existsSync,
-	readFileSync,
-	realpathSync,
-} from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join, resolve } from "node:path";
-import type {} from "@koishi-ce/console";
-import {
-	type Context,
-	type Dict,
-	defineProperty,
-	type HTTP,
-	Logger,
-	pick,
-	Schema,
-	Service,
-	Time,
-	valueMap,
-} from "@koishi-ce/koishi";
-import type {} from "@koishi-ce/loader";
-import type {} from "@koishi-ce/plugin-market";
-import Scanner, {
-	type DependencyMetaKey,
-	isResidentInCache,
-	mapLimit,
-	type PackageJson,
-	type Registry,
-	type RemotePackage,
-	resolvePackageJson,
-} from "@koishi-ce/registry";
-import { compare, satisfies, valid } from "semver";
-import { spawnBun } from "./proc.ts";
-
-const logger = new Logger("market");
-
-/**
- * 判断依赖声明是否受护栏保护、不可被安装清单覆盖或删除。两类：
- * - `workspace:` 声明是本仓库（monorepo）对上游名的归属（如 koishi
- *   裸名 shim，见 packages/shim/koishi）；
- * - `npm:@koishi-ce/...` alias 是下游脚手架生成项目对上游名的归属
- *   （如 "koishi": "npm:@koishi-ce/koishi-shim@^4.18.11"，见
- *   packages/shim/koishi-shim）。
- * 两者被覆盖或删除都会让 peer 解析失去归属，重新拉下 npm 官方包形成
- * 第二份框架副本。
- */
-function isGuardedRequest(
-	request: string | undefined,
-): boolean {
-	return (
-		request?.startsWith("workspace:") === true ||
-		request?.startsWith("npm:@koishi-ce") === true
-	);
-}
-
-/**
- * 从 fromDir 沿 node_modules 链纯 fs 探测依赖包,命中返回其真实目录。
- * realpath 化是 isolated 布局的关键:顶层条目是 symlink,包的依赖链接
- * 挂在 .bun 真实目录的同级 node_modules,从链接路径向上爬会错误地查
- * 顶层(isolated 不提升传递依赖)。
- */
-function probePackage(
-	fromDir: string,
-	name: string,
-): string | undefined {
-	let dir = resolve(fromDir);
-	for (;;) {
-		const manifestPath = join(
-			dir,
-			"node_modules",
-			name,
-			"package.json",
-		);
-		if (existsSync(manifestPath)) {
-			try {
-				return dirname(realpathSync(manifestPath));
-			} catch {
-				return undefined;
-			}
-		}
-		const parent = dirname(dir);
-		if (parent === dir) return undefined;
-		dir = parent;
-	}
-}
-
-/** 从单个 .npmrc 文件提取 registry 配置项；文件不存在或读取出错一律视为未配置 */
-function readNpmrcRegistry(
-	file: string,
-): string | undefined {
-	try {
-		for (const line of readFileSync(file, "utf8").split(
-			/\r?\n/,
-		)) {
-			const matched = /^\s*registry\s*=\s*(\S+)\s*$/.exec(
-				line,
-			);
-			const value = matched?.[1];
-			if (value) return value;
-		}
-	} catch {}
-	return undefined;
-}
-
-/**
- * 读取本机 npm registry 配置（优先级对齐 npm 自身：环境变量 > 项目
- * .npmrc > 用户 ~/.npmrc）。刻意不 spawn 子进程探测——原依赖
- * get-registry 按 user-agent 选 `bun config get registry`，而 Bun 没有
- * config 子命令，Bun 运行时下子进程退出码 1 直接炸掉 market 服务启动；
- * 读 npmrc 是零子进程的等价路径。任何一步都拿不到时回落 npm 官方
- * 源（对齐被移除的 get-registry 的默认值），保证 http 恒有 endpoint
- * 可拼接相对 URL——缺省时相对请求会在 resolveURL 抛 Invalid URL。
- */
-function getLocalRegistry(
-	cwd: string,
-	userHome: string = homedir(),
-): string {
-	const candidates = [
-		process.env["npm_config_registry"],
-		readNpmrcRegistry(join(cwd, ".npmrc")),
-		readNpmrcRegistry(join(userHome, ".npmrc")),
-	];
-	for (const candidate of candidates) {
-		if (
-			candidate?.startsWith("https://") ||
-			candidate?.startsWith("http://")
-		) {
-			return candidate;
-		}
-	}
-	return "https://registry.npmjs.org/";
-}
-
-export interface Dependency {
-	/**
-	 * requested semver range
-	 * @example `^1.2.3` -> `1.2.3`
-	 */
-	request: string;
-	/**
-	 * installed package version
-	 * @example `1.2.5`
-	 */
-	resolved?: string | undefined;
-	/** whether it is a workspace package */
-	workspace?: boolean | undefined;
-	/** valid (unsupported) syntax */
-	invalid?: boolean | undefined;
-	/** latest version */
-	latest?: string | undefined;
-}
-
-interface LocalPackage extends PackageJson {
-	private?: boolean;
-	$workspace?: boolean;
-	/** loadManifest 归一化保证 dependencies 必有 */
-	dependencies: Record<string, string>;
-}
-
-function loadManifest(name: string) {
-	// resolvePackageJson 以纯 fs 探测为主路径：市场安装流程在包落盘前的
-	// 探测不能触碰解析 API，否则触发 Bun 的父目录快照缓存（装完即失败）
-	const filename = resolvePackageJson(name);
-	const meta: LocalPackage = JSON.parse(
-		readFileSync(filename, "utf8"),
-	);
-	meta.dependencies ||= {};
-	defineProperty(
-		meta,
-		"$workspace",
-		!filename.includes("node_modules"),
-	);
-	return meta;
-}
-
-function getVersions(versions: RemotePackage[]) {
-	return Object.fromEntries(
-		versions
-			.map(
-				(item) =>
-					[
-						item.version,
-						pick(item, [
-							"peerDependencies",
-							"peerDependenciesMeta",
-							"deprecated",
-						]),
-					] as const,
-			)
-			.sort(([a], [b]) => compare(b, a)),
-	);
-}
-
-class Installer extends Service {
-	declare http: HTTP;
-	declare endpoint: string | undefined;
-	public fullCache: Dict<
-		Dict<Pick<RemotePackage, DependencyMetaKey>>
-	> = {};
-	public tempCache: Dict<
-		Dict<Pick<RemotePackage, DependencyMetaKey>>
-	> = {};
-
-	private pkgTasks: Dict<
-		Promise<Dict<Pick<RemotePackage, DependencyMetaKey>>>
-	> = {};
-	private manifest: LocalPackage;
-	declare private depTask: Promise<Dict<Dependency>>;
-	private flushData: () => void;
-
-	override config: Installer.Config;
-
-	constructor(ctx: Context, config: Installer.Config) {
-		super(ctx, "installer");
-		this.config = config;
-		this.manifest = loadManifest(this.cwd);
-		this.flushData = ctx.throttle(() => {
-			ctx
-				.get("console")
-				?.broadcast("market/registry", this.tempCache);
-			this.tempCache = {};
-		}, 500);
-	}
-
-	get cwd() {
-		return this.ctx.baseDir;
-	}
-
-	override async start() {
-		const { endpoint, timeout } = this.config;
-		this.endpoint = endpoint ?? getLocalRegistry(this.cwd);
-		const options: HTTP.Config = {};
-		if (this.endpoint) options.endpoint = this.endpoint;
-		if (timeout !== undefined) options.timeout = timeout;
-		this.http = this.ctx.http.extend(options);
-	}
-
-	resolveName(name: string) {
-		if (name.startsWith("@koishijs/plugin-")) return [name];
-		if (name.match(/(^|\/)koishi-plugin-/)) return [name];
-		if (name[0] === "@") {
-			const [left, right] = name.split("/");
-			return [`${left}/koishi-plugin-${right}`];
-		} else {
-			return [
-				`@koishijs/plugin-${name}`,
-				`koishi-plugin-${name}`,
-			];
-		}
-	}
-
-	async findVersion(names: string[]) {
-		const entries = await Promise.all(
-			names.map(async (name) => {
-				try {
-					const versions = Object.entries(
-						await this.getPackage(name),
-					);
-					const [latest] = versions;
-					if (!latest) return undefined;
-					return { [name]: latest[0] };
-				} catch {
-					return undefined;
-				}
-			}),
-		);
-		return entries.find(
-			(entry): entry is Dict<string> => entry !== undefined,
-		);
-	}
-
-	private async _getPackage(name: string) {
-		try {
-			const registry = await this.http.get<Registry>(
-				`/${name}`,
-			);
-			const versions = getVersions(
-				Object.values(registry.versions).filter(
-					(remote) => {
-						if (name === "koishi")
-							return satisfies(remote.version, "4");
-						return (
-							!Scanner.isPlugin(name) ||
-							Scanner.isCompatible("4", remote)
-						);
-					},
-				),
-			);
-			this.fullCache[name] = this.tempCache[name] =
-				versions;
-			this.flushData();
-			return versions;
-		} catch (error) {
-			logger.warn(error);
-			return {};
-		}
-	}
-
-	setPackage(name: string, versions: RemotePackage[]) {
-		this.fullCache[name] = this.tempCache[name] =
-			getVersions(versions);
-		this.flushData();
-		this.pkgTasks[name] = Promise.resolve(
-			this.fullCache[name],
-		);
-	}
-
-	getPackage(name: string) {
-		return (this.pkgTasks[name] ||= this._getPackage(name));
-	}
-
-	private async _getDeps() {
-		const result = valueMap(
-			this.manifest.dependencies,
-			(request) => {
-				return {
-					request: request.replace(/^[~^]/, ""),
-				} as Dependency;
-			},
-		);
-		await mapLimit(
-			Object.keys(result),
-			10,
-			async (name) => {
-				const dep = result[name];
-				if (!dep) return;
-				try {
-					// some dependencies may be left with no local installation
-					const meta = loadManifest(name);
-					dep.resolved = meta.version;
-					dep.workspace = meta.$workspace;
-					if (meta.$workspace) return;
-				} catch {}
-
-				if (!valid(dep.request)) {
-					dep.invalid = true;
-				}
-
-				const versions = await this.getPackage(name);
-				if (versions) dep.latest = Object.keys(versions)[0];
-			},
-		);
-		return result;
-	}
-
-	getDeps() {
-		return (this.depTask ||= this._getDeps());
-	}
-
-	refreshData() {
-		this.ctx.get("console")?.refresh("registry");
-		this.ctx.get("console")?.refresh("packages");
-	}
-
-	refresh(refresh = false) {
-		this.pkgTasks = {};
-		this.fullCache = {};
-		this.tempCache = {};
-		this.depTask = this._getDeps();
-		if (!refresh) return;
-		this.refreshData();
-	}
-
-	async exec(args: string[]) {
-		// Bun-first：CE 生态只存在 bun 这一种包管理器，直接驱动 bun 执行
-		// 安装（上游经 which-pm-runs 探测 npm/yarn/bun，此处固定为 bun）
-		args.unshift("install");
-		return new Promise<number>((resolve) => {
-			const child = spawnBun(args, this.cwd);
-			child.on("exit", (code) => resolve(code ?? -1));
-			child.on("error", () => resolve(-1));
-
-			let stderr = "";
-			child.stderr?.on("data", (data) => {
-				stderr += data.toString();
-				const lines = stderr.split("\n");
-				stderr = lines.pop() ?? "";
-				for (const line of lines) {
-					logger.warn(line);
-				}
-			});
-
-			let stdout = "";
-			child.stdout?.on("data", (data) => {
-				stdout += data.toString();
-				const lines = stdout.split("\n");
-				stdout = lines.pop() ?? "";
-				for (const line of lines) {
-					logger.info(line);
-				}
-			});
-		});
-	}
-
-	async override(deps: Dict<string | null>) {
-		const filename = resolve(this.cwd, "package.json");
-		// 现读现写：this.manifest 原为构造期的启动快照，运行期间根
-		// package.json 可能已被外部更新，基于快照整体重写会抹掉变更
-		this.manifest = JSON.parse(
-			readFileSync(filename, "utf8"),
-		) as LocalPackage;
-		this.manifest.dependencies ||= {};
-		for (const key in deps) {
-			if (deps[key]) {
-				if (
-					isGuardedRequest(this.manifest.dependencies[key])
-				) {
-					continue;
-				}
-				this.manifest.dependencies[key] = deps[key];
-			} else if (
-				!isGuardedRequest(this.manifest.dependencies[key])
-			) {
-				delete this.manifest.dependencies[key];
-			}
-		}
-		this.manifest.dependencies = Object.fromEntries(
-			Object.entries(this.manifest.dependencies).sort(
-				(a, b) => a[0].localeCompare(b[0]),
-			),
-		);
-		// 仓库格式权威是 biome（tab 缩进），按 tab 写出避免装插件后
-		// package.json 被重排成空格、lint 报格式漂移
-		await Bun.write(
-			filename,
-			`${JSON.stringify(this.manifest, null, "\t")}\n`,
-		);
-	}
-
-	private _install() {
-		const args: string[] = [];
-		if (this.endpoint) {
-			args.push("--registry", this.endpoint);
-		}
-		return this.exec(args);
-	}
-
-	/**
-	 * 安装完整性校验:从本次安装的包出发递归纯 fs 探测依赖可达性,返回
-	 * 「包: 缺失依赖」描述列表。背景是 Bun isolated 布局的增量安装缺陷
-	 * (2026-09-07 实证):升级插件时包目录 hash 变化,而其依赖的解析
-	 * 结果未变,bun 的增量安装跳过新包目录内的依赖链接建立——插件入口
-	 * (顶层 symlink)可加载,内部依赖的 require 却炸 MODULE_NOT_FOUND;
-	 * 此时补跑一次普通 bun install,bun 按磁盘实际状态检测到包不完整
-	 * 即重建链接(秒级)。全程只走 existsSync / readFileSync /
-	 * realpathSync,不触碰解析 API(防父目录快照缓存,与
-	 * resolvePackageJson 同一纪律)。peer / optional 依赖由宿主或按需
-	 * 提供不入校验;workspace / alias 等非 semver 声明的落盘名与键名无
-	 * 直接映射,同样跳过。
-	 */
-	private _findMissingDeps(
-		deps: Dict<string | null>,
-	): string[] {
-		const problems: string[] = [];
-		const visited = new Set<string>();
-		const walk = (dir: string, label: string) => {
-			if (visited.has(dir)) return;
-			visited.add(dir);
-			let manifest: LocalPackage;
-			try {
-				manifest = JSON.parse(
-					readFileSync(join(dir, "package.json"), "utf8"),
-				) as LocalPackage;
-			} catch {
-				return;
-			}
-			for (const [dep, request] of Object.entries(
-				manifest.dependencies ?? {},
-			)) {
-				if (request.includes(":")) continue;
-				const depDir = probePackage(dir, dep);
-				if (!depDir) {
-					problems.push(`${label} 的依赖 ${dep} 未被链接`);
-					continue;
-				}
-				walk(depDir, `${label} → ${dep}`);
-			}
-		};
-		for (const name in deps) {
-			const request = deps[name];
-			if (!request || request.includes(":")) continue;
-			const dir = probePackage(this.cwd, name);
-			// 顶层包未落盘属于安装失败,由退出码与后续加载告警兜底,
-			// 不属于「包已装但链接缺失」的补装场景
-			if (!dir) continue;
-			walk(dir, name);
-		}
-		return problems;
-	}
-
-	private _getLocalDeps(override: Dict<string | null>) {
-		return valueMap(override, (request, name) => {
-			const dep = { request } as Dependency;
-			try {
-				const meta = loadManifest(name);
-				dep.resolved = meta.version;
-				dep.workspace = meta.$workspace;
-			} catch {}
-			return dep;
-		});
-	}
-
-	async install(
-		deps: Dict<string | null>,
-		forced?: boolean,
-	) {
-		const localDeps = this._getLocalDeps(deps);
-		await this.override(deps);
-
-		let shouldInstall = forced === true;
-		for (const name in deps) {
-			const request = deps[name];
-			const local = localDeps[name];
-			if (
-				local?.workspace ||
-				(request &&
-					local?.resolved &&
-					satisfies(local.resolved, request, {
-						includePrerelease: true,
-					}))
-			)
-				continue;
-			shouldInstall = true;
-			break;
-		}
-
-		if (shouldInstall) {
-			const code = await this._install();
-			if (code) return code;
-			// isolated 布局的增量安装可能漏建新包目录的依赖链接(机理
-			// 见 _findMissingDeps 注释):装完即校验,缺失时补跑一次
-			// 安装——bun 按磁盘实际状态重建链接,秒级自愈,无需人工
-			const missing = this._findMissingDeps(deps);
-			if (missing.length) {
-				logger.warn(
-					`检测到增量安装未建立部分依赖链接(isolated 布局已知缺陷),正在补装: ${missing.join("; ")}`,
-				);
-				const retry = await this._install();
-				if (retry) return retry;
-				if (this._findMissingDeps(deps).length) {
-					logger.warn(
-						"自动补装后依赖链接仍不完整,请在项目根目录运行 bun install --force 并重启 koishi",
-					);
-				}
-			}
-		}
-
-		this.refresh();
-		const newDeps = await this.getDeps();
-		for (const name in localDeps) {
-			const local = localDeps[name];
-			const newDep = newDeps[name];
-			if (!local || !newDep || local.workspace) continue;
-			if (newDep.resolved === local.resolved) continue;
-			// 版本变化且旧版本仍驻留内存时才需要整进程重载（判定不走
-			// 解析 API，规避 Bun 负缓存，见 isResidentInCache）
-			if (isResidentInCache(name))
-				this.ctx.loader.fullReload();
-		}
-		this.refreshData();
-
-		return 0;
-	}
-
-	// erasableSyntaxOnly 禁止含运行时值的 namespace，
-	// 原 namespace 内的 Config 常量移到此处的静态字段，对外形状不变
-	static Config: Schema<Installer.Config> = Schema.object({
-		endpoint: Schema.string().role("link"),
-		timeout: Schema.number()
-			.role("time")
-			.default(Time.second * 5),
-	}); // TODO .hidden()
-}
-
-declare namespace Installer {
-	export interface Config {
-		endpoint?: string;
-		timeout?: number;
-	}
-}
-
-export default Installer;

package/src/node/locales/message.de-DE.yml

@@ -1,29 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-only
-# Copyright (c) 2019-present Shigma and Koishijs contributors.
-# Copyright (c) 2026-present Koishi-CE contributors.
-
-commands.plugin:
-  description: 插件管理
-commands.plugin.install:
-  description: 安装插件
-  messages:
-    expect-name: 请输入插件名。
-    already-installed: 该插件已安装。
-    not-found: 未找到该插件。
-    success: 安装成功！
-commands.plugin.uninstall:
-  description: 卸载插件
-  messages:
-    expect-name: 请输入插件名。
-    not-installed: 该插件未安装。
-    success: 卸载成功！
-commands.plugin.upgrade:
-  description: 升级插件
-  options:
-    self: 升级 Koishi 本体
-  messages:
-    all-updated: 所有插件已是最新版本。
-    available: 有可用的依赖更新：
-    prompt: 输入「Y」升级全部依赖，输入「N」取消操作。
-    cancelled: 已取消操作。
-    success: 升级成功！

package/src/node/locales/message.en-US.yml

@@ -1,29 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-only
-# Copyright (c) 2019-present Shigma and Koishijs contributors.
-# Copyright (c) 2026-present Koishi-CE contributors.
-
-commands.plugin:
-  description: Plugin management
-commands.plugin.install:
-  description: Install Plugins
-  messages:
-    expect-name: 请输入插件名。
-    already-installed: 该插件已安装。
-    not-found: 未找到该插件。
-    success: Installation Successful!
-commands.plugin.uninstall:
-  description: Uninstall plugin
-  messages:
-    expect-name: 请输入插件名。
-    not-installed: 该插件未安装。
-    success: 卸载成功！
-commands.plugin.upgrade:
-  description: Upgrade Plugin
-  options:
-    self: Upgrade Koishi core
-  messages:
-    all-updated: 所有插件已是最新版本。
-    available: 有可用的依赖更新：
-    prompt: 输入「Y」升级全部依赖，输入「N」取消操作。
-    cancelled: Operation canceled.
-    success: Upgrade Successful!

package/src/node/locales/message.fr-FR.yml

@@ -1,29 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-only
-# Copyright (c) 2019-present Shigma and Koishijs contributors.
-# Copyright (c) 2026-present Koishi-CE contributors.
-
-commands.plugin:
-  description: 插件管理
-commands.plugin.install:
-  description: Installation de plugins
-  messages:
-    expect-name: 请输入插件名。
-    already-installed: 该插件已安装。
-    not-found: 未找到该插件。
-    success: 安装成功！
-commands.plugin.uninstall:
-  description: 卸载插件
-  messages:
-    expect-name: 请输入插件名。
-    not-installed: 该插件未安装。
-    success: 卸载成功！
-commands.plugin.upgrade:
-  description: 升级插件
-  options:
-    self: 升级 Koishi 本体
-  messages:
-    all-updated: 所有插件已是最新版本。
-    available: 有可用的依赖更新：
-    prompt: 输入「Y」升级全部依赖，输入「N」取消操作。
-    cancelled: 已取消操作。
-    success: 升级成功！

package/src/node/locales/message.ja-JP.yml

@@ -1,29 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-only
-# Copyright (c) 2019-present Shigma and Koishijs contributors.
-# Copyright (c) 2026-present Koishi-CE contributors.
-
-commands.plugin:
-  description: 插件管理
-commands.plugin.install:
-  description: 安装插件
-  messages:
-    expect-name: 请输入插件名。
-    already-installed: 该插件已安装。
-    not-found: 未找到该插件。
-    success: 安装成功！
-commands.plugin.uninstall:
-  description: 卸载插件
-  messages:
-    expect-name: 请输入插件名。
-    not-installed: 该插件未安装。
-    success: 卸载成功！
-commands.plugin.upgrade:
-  description: 升级插件
-  options:
-    self: 升级 Koishi 本体
-  messages:
-    all-updated: 所有插件已是最新版本。
-    available: 有可用的依赖更新：
-    prompt: 输入「Y」升级全部依赖，输入「N」取消操作。
-    cancelled: 已取消操作。
-    success: 升级成功！