@max-null/dsh-plugin-center 0.1.0

package/dist/meta.js

@@ -0,0 +1,111 @@
+/**
+ * Installed-plugin metadata: resolve each Loader entry's specifier to a
+ * package.json, classify its provenance, and read version / description /
+ * DSH-compat range. Read-only projection — the Loader stays the authority.
+ */
+import { createRequire } from 'node:module';
+import { readFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+/** Compact a module specifier into a display name without guessing Loader id shape. */
+export function displayName(specifier) {
+    const unscoped = specifier.startsWith('@')
+        ? specifier.slice(specifier.indexOf('/') + 1)
+        : specifier;
+    return unscoped
+        .replace(/^cordis:/, '')
+        .replace(/^cordis-plugin-/, '')
+        .replace(/^dsh-(?:host-|client-)?/, '');
+}
+/** The `@deepseek-ai/dsh*` peer-dependency range, or null when undeclared. */
+function dshCompatRange(pkg) {
+    const peers = pkg.peerDependencies ?? {};
+    for (const [name, range] of Object.entries(peers)) {
+        if (name.startsWith('@deepseek-ai/dsh'))
+            return range;
+    }
+    return null;
+}
+/** Classify provenance from the specifier shape alone (matches the §4.2 design). */
+function classifySource(specifier) {
+    if (specifier.startsWith('@deepseek-ai/dsh-'))
+        return 'official';
+    if (specifier.startsWith('file://') || specifier.startsWith('link:'))
+        return 'local';
+    if (specifier.startsWith('cordis:'))
+        return 'builtin';
+    return 'installed';
+}
+/** Process-local cache of resolved packages — stable per run, so resolve once. */
+const packageCache = new Map();
+/**
+ * Resolve one Loader entry to its package.json. `file://` specs walk upward to
+ * the nearest directory holding a package.json; `cordis:*` builtins have none.
+ * Results are cached per (baseUrl, specifier) — the resolution is a pure read
+ * and never changes within a process, so the file I/O happens only once.
+ * @param baseUrl - profile directory (the cordis.yml anchor, `ctx.baseUrl`).
+ * @param specifier - the Loader entry's module specifier.
+ * @returns the parsed package.json and its directory, or null when unresolvable.
+ */
+export function resolvePackage(baseUrl, specifier) {
+    const key = `${baseUrl}\u0000${specifier}`;
+    const cached = packageCache.get(key);
+    if (cached !== undefined)
+        return cached;
+    const pending = resolveUncached(baseUrl, specifier);
+    packageCache.set(key, pending);
+    return pending;
+}
+async function resolveUncached(baseUrl, specifier) {
+    if (specifier.startsWith('file://')) {
+        let dir = dirname(fileURLToPath(specifier));
+        for (let i = 0; i < 12; i++) {
+            const path = join(dir, 'package.json');
+            try {
+                return { pkg: JSON.parse(await readFile(path, 'utf8')), dir };
+            }
+            catch {
+                const parent = dirname(dir);
+                if (parent === dir)
+                    return null;
+                dir = parent;
+            }
+        }
+        return null;
+    }
+    if (specifier.startsWith('cordis:'))
+        return null;
+    try {
+        const require = createRequire(join(baseUrl, 'package.json'));
+        const path = require.resolve(`${specifier}/package.json`);
+        return { pkg: JSON.parse(await readFile(path, 'utf8')), dir: dirname(path) };
+    }
+    catch {
+        return null;
+    }
+}
+/** Build the Remote-ready metadata for one Loader entry. */
+export async function buildInstalledPlugin(baseUrl, entry) {
+    const resolved = await resolvePackage(baseUrl, entry.name);
+    const source = classifySource(entry.name);
+    return {
+        entryId: entry.id,
+        name: entry.name,
+        displayName: displayName(entry.name),
+        version: resolved?.pkg.version ?? null,
+        description: resolved?.pkg.description ?? null,
+        source,
+        enabled: !entry.disabled,
+        fiberPhase: entry.fiberPhase,
+        compatRange: resolved === null ? null : dshCompatRange(resolved.pkg),
+        repoUrl: resolved === null ? null : (() => {
+            const r = resolved.pkg.repository;
+            if (typeof r === 'string')
+                return r;
+            if (r !== null && typeof r === 'object' && typeof r.url === 'string')
+                return r.url;
+            return null;
+        })(),
+        categories: [],
+    };
+}

package/dist/rpc.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `PluginCenterRpc` — a private loopback RPC channel exposing the engine to
+ * the browser half. The Typert Remote path is closed to third-party packages
+ * (api-remotes imports an explicit allowlist of official `./remote` artifacts),
+ * so the client calls `ctx.connection.rpc.call('/plugin-center', ...)` instead
+ * of `ctx.remote.pluginCenter.*` — the same seam dsh-think-any-lang uses.
+ */
+import { Service, type Context } from '@deepseek-ai/cordis';
+export declare class PluginCenterRpc extends Service {
+    static inject: string[];
+    constructor(ctx: Context);
+}
+export default PluginCenterRpc;

package/dist/rpc.js

@@ -0,0 +1,57 @@
+/**
+ * `PluginCenterRpc` — a private loopback RPC channel exposing the engine to
+ * the browser half. The Typert Remote path is closed to third-party packages
+ * (api-remotes imports an explicit allowlist of official `./remote` artifacts),
+ * so the client calls `ctx.connection.rpc.call('/plugin-center', ...)` instead
+ * of `ctx.remote.pluginCenter.*` — the same seam dsh-think-any-lang uses.
+ */
+import { Service } from '@deepseek-ai/cordis';
+const CHANNEL = '/plugin-center';
+/** Fold a thrown value into the RpcResult error branch (closed `internal` code). */
+function internal(message) {
+    return { ok: false, error: { code: 'internal', message, details: {} } };
+}
+export class PluginCenterRpc extends Service {
+    static inject = ['pluginCenter', 'connection'];
+    constructor(ctx) {
+        super(ctx, 'pluginCenterRpc');
+        ctx.connection.rpc.handle(CHANNEL, async (endpoint, payload) => {
+            try {
+                switch (endpoint) {
+                    case 'listInstalled':
+                        return { ok: true, value: await ctx.pluginCenter.listInstalled() };
+                    case 'listMarket':
+                        return { ok: true, value: await ctx.pluginCenter.listMarket((payload?.source ?? 'all')) };
+                    case 'checkUpdates':
+                        return { ok: true, value: await ctx.pluginCenter.checkUpdates(payload?.since ?? '') };
+                    case 'install': {
+                        const spec = payload?.spec;
+                        if (typeof spec !== 'string' || spec === '')
+                            return internal('install: spec is required');
+                        return { ok: true, value: await ctx.pluginCenter.install(spec) };
+                    }
+                    case 'update': {
+                        const name = payload?.name;
+                        if (typeof name !== 'string' || name === '')
+                            return internal('update: name is required');
+                        return { ok: true, value: await ctx.pluginCenter.update(name) };
+                    }
+                    case 'debug':
+                        return { ok: true, value: await ctx.pluginCenter.debug() };
+                    case 'readVersions':
+                        return { ok: true, value: await ctx.pluginCenter.readVersions() };
+                    case 'markRead': {
+                        const versions = payload?.versions ?? {};
+                        return { ok: true, value: await ctx.pluginCenter.markRead(versions) };
+                    }
+                    default:
+                        return internal(`unknown endpoint "${endpoint}"`);
+                }
+            }
+            catch (error) {
+                return internal(error instanceof Error ? error.message : String(error));
+            }
+        }, { authority: 'loopback' });
+    }
+}
+export default PluginCenterRpc;

package/dist/semver.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Hand-rolled semver comparison for `major.minor.patch[-prerelease]`.
+ * Kept dependency-free: the plugin compares local vs remote versions and
+ * matches peer-dependency ranges with just these two rules.
+ */
+/** A parsed semver (prerelease tag kept verbatim for lexical tie-breaks). */
+export interface Semver {
+    major: number;
+    minor: number;
+    patch: number;
+    pre: string;
+}
+/** Parse a `major.minor.patch[-prerelease]` (optional `v` prefix); null when unparsable. */
+export declare function parseVersion(version: string): Semver | null;
+/** Compare two versions: -1 (a<b), 0 (equal), 1 (a>b). Unparsable sides compare equal. */
+export declare function compareVersions(a: string, b: string): number;
+/** Whether `version` satisfies a caret/tilde/range constraint like `^0.1.0-rc.6` or `>=0.0.1-rc.1`. */
+export declare function satisfies(version: string, range: string): boolean;

package/dist/semver.js

@@ -0,0 +1,65 @@
+/**
+ * Hand-rolled semver comparison for `major.minor.patch[-prerelease]`.
+ * Kept dependency-free: the plugin compares local vs remote versions and
+ * matches peer-dependency ranges with just these two rules.
+ */
+/** Parse a `major.minor.patch[-prerelease]` (optional `v` prefix); null when unparsable. */
+export function parseVersion(version) {
+    const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/.exec(version);
+    if (match === null)
+        return null;
+    return {
+        major: Number(match[1]),
+        minor: Number(match[2]),
+        patch: Number(match[3]),
+        pre: match[4] ?? '',
+    };
+}
+/** Compare two versions: -1 (a<b), 0 (equal), 1 (a>b). Unparsable sides compare equal. */
+export function compareVersions(a, b) {
+    const pa = parseVersion(a);
+    const pb = parseVersion(b);
+    if (pa === null || pb === null)
+        return 0;
+    for (const key of ['major', 'minor', 'patch']) {
+        if (pa[key] !== pb[key])
+            return pa[key] > pb[key] ? 1 : -1;
+    }
+    if (pa.pre === pb.pre)
+        return 0;
+    if (pa.pre === '')
+        return 1; // release > prerelease
+    if (pb.pre === '')
+        return -1;
+    return pa.pre > pb.pre ? 1 : -1;
+}
+/** Whether `version` satisfies a caret/tilde/range constraint like `^0.1.0-rc.6` or `>=0.0.1-rc.1`. */
+export function satisfies(version, range) {
+    const v = parseVersion(version);
+    if (v === null)
+        return false;
+    const trimmed = range.trim();
+    if (trimmed === '*' || trimmed === '')
+        return true;
+    // `>= x`
+    const gte = /^>=\s*(.+)$/.exec(trimmed);
+    if (gte !== null)
+        return compareVersions(version, gte[1]) >= 0;
+    // `^ x.y.z` — same major, at least the stated minor/patch (prerelease-aware)
+    const caret = /^\^\s*(.+)$/.exec(trimmed);
+    if (caret !== null) {
+        const base = parseVersion(caret[1]);
+        if (base === null)
+            return false;
+        if (base.major > 0) {
+            return v.major === base.major && compareVersions(version, caret[1]) >= 0;
+        }
+        // ^0.x.z — same minor
+        return v.major === base.major && v.minor === base.minor && compareVersions(version, caret[1]) >= 0;
+    }
+    // bare version
+    const exact = parseVersion(trimmed);
+    if (exact !== null)
+        return compareVersions(version, trimmed) === 0;
+    return false;
+}

package/dist/update.d.ts

@@ -0,0 +1,30 @@
+/** A detected update for one installed plugin. */
+export interface UpdateDigest {
+    name: string;
+    fromVersion: string;
+    toVersion: string;
+    changelog: string[];
+    compat: 'compatible' | 'incompatible' | 'unknown';
+    compatRange: string | null;
+}
+/** Latest published version on the npm registry; null when unreachable/unpublished. */
+export declare function npmLatest(packageName: string): Promise<string | null>;
+/** Commit-message changelog: the reliable source for repos without release notes. */
+export declare function fetchCommitChangelog(repoUrl: string | null, sinceIso: string): Promise<string[]>;
+/**
+ * Detect one plugin's update: compare local vs remote version, pull commit
+ * changelog since `sinceIso`, and check DSH compatibility against the local
+ * DSH version via the plugin's peer-dependency range.
+ */
+export declare function detectUpdate(name: string, localVersion: string, repoUrl: string | null, compatRange: string | null, localDshVersion: string, sinceIso: string): Promise<UpdateDigest | null>;
+/**
+ * Run pnpm in the profile directory. Output inherits the process stdio (no
+ * pipe capture — the host sandbox forbids named-pipe stdio); the exit code is
+ * the only result this layer needs.
+ * @returns the child exit code, or 1 when spawn itself fails.
+ */
+export declare function runPnpm(args: readonly string[], cwd: string): Promise<number>;
+/** Install a package into the web profile, mirroring `dsh plugin add` semantics. */
+export declare function installPlugin(packageSpec: string, profileDir: string): Promise<boolean>;
+/** Update a package to latest, mirroring `dsh plugin add <pkg>` (pnpm installs latest). */
+export declare function updatePlugin(packageName: string, profileDir: string): Promise<boolean>;

package/dist/update.js

@@ -0,0 +1,100 @@
+/**
+ * Update detection, changelog extraction, and install/update execution.
+ * npm registry is the primary version source; changelog is commit-history
+ * first (many community repos ship no release/tag/CHANGELOG — verified §7.2).
+ */
+import { spawn } from 'node:child_process';
+import { compareVersions, satisfies } from "./semver.js";
+const UA = { 'User-Agent': 'dsh-plugin-center' };
+/** Latest published version on the npm registry; null when unreachable/unpublished. */
+export async function npmLatest(packageName) {
+    for (const registry of ['https://registry.npmjs.org', 'https://registry.npmmirror.com']) {
+        try {
+            const res = await fetch(`${registry}/${packageName}/latest`, {
+                signal: AbortSignal.timeout(8000),
+            });
+            if (res.ok)
+                return (await res.json()).version ?? null;
+        }
+        catch { /* next registry */ }
+    }
+    return null;
+}
+/** Extract owner/repo from a package.json repository field. */
+function repoOf(repoUrl) {
+    if (repoUrl === null)
+        return null;
+    const match = /github\.com[/:]([^/]+)\/([^/.#]+)/.exec(repoUrl);
+    if (match === null)
+        return null;
+    return { owner: match[1], repo: match[2] };
+}
+/** Commit-message changelog: the reliable source for repos without release notes. */
+export async function fetchCommitChangelog(repoUrl, sinceIso) {
+    const repo = repoOf(repoUrl);
+    if (repo === null)
+        return [];
+    try {
+        const res = await fetch(`https://api.github.com/repos/${repo.owner}/${repo.repo}/commits?since=${encodeURIComponent(sinceIso)}&per_page=20`, { headers: UA, signal: AbortSignal.timeout(15000) });
+        if (!res.ok)
+            return [];
+        const commits = await res.json();
+        return commits.map(c => c.commit.message.split('\n')[0]).filter(line => line !== '');
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Detect one plugin's update: compare local vs remote version, pull commit
+ * changelog since `sinceIso`, and check DSH compatibility against the local
+ * DSH version via the plugin's peer-dependency range.
+ */
+export async function detectUpdate(name, localVersion, repoUrl, compatRange, localDshVersion, sinceIso) {
+    const latest = await npmLatest(name);
+    if (latest === null || compareVersions(latest, localVersion) <= 0)
+        return null;
+    let compat = 'unknown';
+    if (compatRange !== null) {
+        compat = satisfies(localDshVersion, compatRange) ? 'compatible' : 'incompatible';
+    }
+    return {
+        name,
+        fromVersion: localVersion,
+        toVersion: latest,
+        changelog: await fetchCommitChangelog(repoUrl, sinceIso),
+        compat,
+        compatRange,
+    };
+}
+/**
+ * Run pnpm in the profile directory. Output inherits the process stdio (no
+ * pipe capture — the host sandbox forbids named-pipe stdio); the exit code is
+ * the only result this layer needs.
+ * @returns the child exit code, or 1 when spawn itself fails.
+ */
+export function runPnpm(args, cwd) {
+    return new Promise((resolve) => {
+        let child;
+        try {
+            child = spawn('pnpm', [...args], { cwd, stdio: 'inherit', shell: false });
+        }
+        catch {
+            resolve(1);
+            return;
+        }
+        child.on('error', () => resolve(1));
+        child.on('close', code => resolve(code ?? 1));
+    });
+}
+/** Install a package into the web profile, mirroring `dsh plugin add` semantics. */
+export async function installPlugin(packageSpec, profileDir) {
+    // `-w` is required: every profile ships a pnpm-workspace.yaml.
+    const code = await runPnpm(['add', '-w', packageSpec], profileDir);
+    return code === 0;
+}
+/** Update a package to latest, mirroring `dsh plugin add <pkg>` (pnpm installs latest). */
+export async function updatePlugin(packageName, profileDir) {
+    const code = await runPnpm(['add', '-w', packageName], profileDir);
+    return code === 0;
+}

package/package.json

@@ -0,0 +1,85 @@
+{
+  "name": "@max-null/dsh-plugin-center",
+  "version": "0.1.0",
+  "description": "Plugin center for DeepSeek Harness — installed metadata, community market, update detection, and What's New",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./client": "./client.js",
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "client.js",
+    "cordis.patch.yml",
+    "assets"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-connection",
+        "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-settings",
+        "@deepseek-ai/dsh-client-ui-conversation",
+        "@deepseek-ai/dsh-client-ui-slots",
+        "@deepseek-ai/dsh-api-remotes"
+      ],
+      "platform": "web",
+      "immediately": true
+    }
+  },
+  "keywords": [
+    "deepseek",
+    "harness",
+    "dsh",
+    "dsh-plugin",
+    "deepseek-harness",
+    "plugin",
+    "market",
+    "update",
+    "cordis"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Max-Null/dsh-plugin-center.git"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json && node build-client.mjs",
+    "typecheck": "tsc --noEmit -p tsconfig.json"
+  },
+  "dependencies": {
+    "js-yaml": "^4.1.0"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/cordis-plugin-loader": "^1.0.2",
+    "@deepseek-ai/dsh-client-connection": ">=0.0.1-rc.5",
+    "@deepseek-ai/dsh-host-apiproxy": ">=0.0.1-rc.5"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/cordis-plugin-loader": "^1.0.2",
+    "@deepseek-ai/dsh-client-connection": ">=0.0.1-rc.5",
+    "@deepseek-ai/dsh-host-apiproxy": ">=0.0.1-rc.5",
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^26.2.0",
+    "@types/react": "~18.3.1",
+    "esbuild": "^0.24.0",
+    "react": "^18.2.0",
+    "typescript": "^5.5.0"
+  }
+}