@max-null/dsh-plugin-center 0.1.4 → 0.1.5

package/client.js

@@ -500,7 +500,7 @@ function UpdatesView({ updates, refresh, updateOne, busy }) {
       u.compat === "incompatible" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "pc-tag danger", children: t("incompat") }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "pc-spacer" }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { className: "pc-btn primary", disabled: busy !== null, onClick: () => {
-        updateOne(u.name);
+        updateOne(u.name, u.toVersion);
       }, children: busy === u.name || busy === "__all__" ? t("updating") : t("update") })
     ] }),
     u.changelog.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("ul", { className: "pc-wn-list", children: u.changelog.slice(0, 5).map((line, i) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("li", { children: line }, i)) })
@@ -580,9 +580,9 @@ function CenterPanel({ variant = "section" }) {
       if (timer !== null) clearTimeout(timer);
     };
   }, []);
-  const updateOne = (name) => {
+  const updateOne = (name, version) => {
     setBusyUpdate(name);
-    void rpc("update", { name }).then(
+    void rpc("update", { name, version }).then(
       (v) => {
         if (v !== true) throw new Error(t("updateNotApplied"));
         setBusyUpdate(null);
@@ -602,7 +602,7 @@ function CenterPanel({ variant = "section" }) {
     const failures = [];
     for (const u of updates) {
       try {
-        const v = await rpc("update", { name: u.name });
+        const v = await rpc("update", { name: u.name, version: u.toVersion });
         if (v !== true) throw new Error(t("updateNotApplied"));
         okCount++;
         okNames.push(u.name);
@@ -755,7 +755,7 @@ function WhatsNewDialog() {
     const failures = [];
     for (const u of whatsNewDigests) {
       try {
-        const v = await rpc("update", { name: u.name });
+        const v = await rpc("update", { name: u.name, version: u.toVersion });
         if (v !== true) throw new Error(t("updateNotApplied"));
         okCount++;
       } catch (e) {

package/dist/engine.d.ts

@@ -69,7 +69,8 @@ export declare class PluginCenterEngine extends Service {
         ok: boolean;
         detail: string;
     }>;
-    update(name: string): Promise<{
+    /** Update one installed plugin to the detected target version (exact — see update.ts). */
+    update(name: string, version: string): Promise<{
         ok: boolean;
         detail: string;
     }>;

package/dist/engine.js

@@ -9,7 +9,7 @@ import { Service } from '@deepseek-ai/cordis';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
-import { buildInstalledPlugin, resolvePackage } from "./meta.js";
+import { buildInstalledPlugin, clearPackageCache, resolvePackage } from "./meta.js";
 import { fetchAwesomePluginsJson, fetchOhMyDshOverrides, fetchOhMyDshPlugins, mapConcurrent, mergePlugins } from "./market.js";
 import { detectUpdate, installPlugin, updatePlugin } from "./update.js";
 /** Runtime mirror of cordis FiberState (a cross-package const enum). */
@@ -225,8 +225,9 @@ export class PluginCenterEngine extends Service {
     async install(spec) {
         return this.enqueuePnpm(() => installPlugin(spec, this.baseUrl));
     }
-    async update(name) {
-        return this.enqueuePnpm(() => updatePlugin(name, this.baseUrl));
+    /** Update one installed plugin to the detected target version (exact — see update.ts). */
+    async update(name, version) {
+        return this.enqueuePnpm(() => updatePlugin(name, version, this.baseUrl));
     }
     /** 串行执行一次 pnpm 操作并失效缓存（无论成败都放行链条后续任务）。 */
     enqueuePnpm(op) {
@@ -234,6 +235,9 @@ export class PluginCenterEngine extends Service {
             const result = await op();
             this.installedNamesCache = null;
             this.updatesCache = null;
+            // pnpm rewrote node_modules on disk: drop the process-local package.json
+            // snapshot so the next listInstalled reads the new versions.
+            clearPackageCache();
             return result;
         });
         this.pnpmChain = run.catch(() => { });

package/dist/meta.d.ts

@@ -27,6 +27,14 @@ interface PackageJson {
 }
 /** Compact a module specifier into a display name without guessing Loader id shape. */
 export declare function displayName(specifier: string): string;
+/**
+ * Drop every cached package.json resolution. Called after install/update:
+ * pnpm rewrites node_modules on disk, and the next `listInstalled` must see
+ * the new versions instead of the process-start snapshot (2026-08-18 — a
+ * stale cache reported the pre-update version forever, so the update looked
+ * perpetually available).
+ */
+export declare function clearPackageCache(): void;
 /**
  * Resolve one Loader entry to its package.json. `file://` specs walk upward to
  * the nearest directory holding a package.json; `cordis:*` builtins have none.

package/dist/meta.js

@@ -38,6 +38,16 @@ function classifySource(specifier) {
 }
 /** Process-local cache of resolved packages — stable per run, so resolve once. */
 const packageCache = new Map();
+/**
+ * Drop every cached package.json resolution. Called after install/update:
+ * pnpm rewrites node_modules on disk, and the next `listInstalled` must see
+ * the new versions instead of the process-start snapshot (2026-08-18 — a
+ * stale cache reported the pre-update version forever, so the update looked
+ * perpetually available).
+ */
+export function clearPackageCache() {
+    packageCache.clear();
+}
 /**
  * Resolve one Loader entry to its package.json. `file://` specs walk upward to
  * the nearest directory holding a package.json; `cordis:*` builtins have none.

package/dist/rpc.js

@@ -35,9 +35,12 @@ export class PluginCenterRpc extends Service {
                     }
                     case 'update': {
                         const name = payload?.name;
+                        const version = payload?.version;
                         if (typeof name !== 'string' || name === '')
                             return internal('update: name is required');
-                        const result = await ctx.pluginCenter.update(name);
+                        if (typeof version !== 'string' || version === '')
+                            return internal('update: version is required');
+                        const result = await ctx.pluginCenter.update(name, version);
                         if (!result.ok)
                             return internal(`update ${name} 失败：${result.detail}`);
                         return { ok: true, value: true };

package/dist/update.d.ts

@@ -34,5 +34,12 @@ export declare function pnpmCandidates(): string[];
 export declare function runPnpm(args: readonly string[], cwd: string): Promise<PnpmResult>;
 /** Install a package into the web profile, mirroring `dsh plugin add` semantics. */
 export declare function installPlugin(packageSpec: string, profileDir: string): Promise<PnpmResult>;
-/** Update a package to latest, mirroring `dsh plugin add <pkg>` (pnpm installs latest). */
-export declare function updatePlugin(packageName: string, profileDir: string): Promise<PnpmResult>;
+/**
+ * Update a package to the given version, mirroring `dsh plugin add <pkg>`.
+ * The exact version is required: with a bare package name, pnpm 11's
+ * `minimumReleaseAge` supply-chain policy silently refuses a too-recent
+ * latest (exit 0, nothing installed) — a false-success update. An explicit
+ * `<name>@<version>` pins the target and pnpm records it in
+ * `minimumReleaseAgeExclude` itself (2026-08-18, reproduced in-process).
+ */
+export declare function updatePlugin(packageName: string, version: string, profileDir: string): Promise<PnpmResult>;

package/dist/update.js

@@ -118,7 +118,14 @@ export async function installPlugin(packageSpec, profileDir) {
     // `-w` is required: every profile ships a pnpm-workspace.yaml.
     return runPnpm(['add', '-w', packageSpec], profileDir);
 }
-/** Update a package to latest, mirroring `dsh plugin add <pkg>` (pnpm installs latest). */
-export async function updatePlugin(packageName, profileDir) {
-    return runPnpm(['add', '-w', packageName], profileDir);
+/**
+ * Update a package to the given version, mirroring `dsh plugin add <pkg>`.
+ * The exact version is required: with a bare package name, pnpm 11's
+ * `minimumReleaseAge` supply-chain policy silently refuses a too-recent
+ * latest (exit 0, nothing installed) — a false-success update. An explicit
+ * `<name>@<version>` pins the target and pnpm records it in
+ * `minimumReleaseAgeExclude` itself (2026-08-18, reproduced in-process).
+ */
+export async function updatePlugin(packageName, version, profileDir) {
+    return runPnpm(['add', '-w', `${packageName}@${version}`], profileDir);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@max-null/dsh-plugin-center",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Plugin center for DeepSeek Harness — installed metadata, community market, update detection, and What's New",
   "license": "MIT",
   "publishConfig": {