@max-null/dsh-plugin-center 0.2.12 → 0.2.13

package/client.js

@@ -1041,9 +1041,9 @@ function CenterPanel({ variant = "section" }) {
     const id = p.entryId;
     const nextEnabled = !p.enabled;
     const wasPending = pendingToggles.has(id);
-    console.log("[plugin-center] toggle", { id, fromEnabled: p.enabled, toEnabled: nextEnabled, wasPending });
+    console.log("[plugin-center] toggle", { id, name: p.name, fromEnabled: p.enabled, toEnabled: nextEnabled, wasPending });
     setTogglingId(p.name);
-    void rpc("toggle", { id, disabled: !nextEnabled }).then(
+    void rpc("toggle", { id, name: p.name, disabled: !nextEnabled }).then(
       (v) => {
         setTogglingId(null);
         const nowDisabled = typeof v === "object" && v !== null ? v.nowDisabled : null;

package/dist/engine.d.ts

@@ -116,8 +116,12 @@ export declare class PluginCenterEngine extends Service {
             source: string;
         }[];
     }>;
-    /** Disable/enable one loader entry through the profile patch layer. */
-    toggle(id: string, disabled: boolean): Promise<{
+    /** Disable/enable one loader entry through the profile patch layer.
+     *  2026-08-25 禁用失效：`dsh plugin add` 清单的 insert 子条目无 id，loader
+     *  每次启动分配随机运行时 id，按它写禁用行重启后永远匹配不到。当 patch
+     *  文件中没有 `- id: <entryId>` 行时，改用该条目的包名 name 作寻址键
+     *  （setDisabled 内按 name 把 insert 子条目升级为稳定 id 后再写禁用行）。 */
+    toggle(id: string, name: string, disabled: boolean): Promise<{
         ok: boolean;
         detail: string;
         nowDisabled: boolean | null;

package/dist/engine.js

@@ -14,7 +14,7 @@ import { buildInstalledPlugin, clearPackageCache, resolvePackage } from "./meta.
 import { fetchAwesomePluginsJson, fetchDshMarketPlugins, fetchOhMyDshOverrides, fetchOhMyDshPlugins, mapConcurrent, mergePlugins, } from "./market.js";
 import { detectUpdate, installPlugin, preparePluginUpdate, updatePlugin } from "./update.js";
 import { reconcileInstalled, readDependencyKeys } from "./reconcile.js";
-import { readDisabledState, setDisabled } from "./toggle.js";
+import { readDisabledState, setDisabled, escapeRegExp } from "./toggle.js";
 /** Runtime mirror of cordis FiberState (a cross-package const enum). */
 const FIBER_PHASE = {
     0: 'pending',
@@ -378,9 +378,30 @@ export class PluginCenterEngine extends Service {
             installed: (await this.listInstalled()).map(p => ({ name: p.name, version: p.version, source: p.source })),
         };
     }
-    /** Disable/enable one loader entry through the profile patch layer. */
-    async toggle(id, disabled) {
-        const result = await setDisabled(this.baseUrl, id, disabled);
+    /** Disable/enable one loader entry through the profile patch layer.
+     *  2026-08-25 禁用失效：`dsh plugin add` 清单的 insert 子条目无 id，loader
+     *  每次启动分配随机运行时 id，按它写禁用行重启后永远匹配不到。当 patch
+     *  文件中没有 `- id: <entryId>` 行时，改用该条目的包名 name 作寻址键
+     *  （setDisabled 内按 name 把 insert 子条目升级为稳定 id 后再写禁用行）。 */
+    async toggle(id, name, disabled) {
+        // 老调用方（未透传 name 的 client）兜底：从 loader 实时取包名。
+        const entryName = name !== '' ? name : [...this.ctx.loader.entries()].find(e => e.id === id)?.options.name ?? '';
+        if (entryName === '') {
+            return { ok: false, detail: `entry "${id}" not found in loader`, nowDisabled: null };
+        }
+        // 寻址键：patch 文件中已有 `- id: <id>` 行 → 稳定 id 直接用；否则是该
+        // 条目的随机运行时 id → 只能用 name 找到它的 insert 子条目。
+        const patchId = id.replace(/^include:/u, '');
+        let key = entryName;
+        try {
+            const patchPath = join(this.baseUrl, 'cordis.patch.yml');
+            if (existsSync(patchPath)
+                && new RegExp(`^- id: ${escapeRegExp(patchId)}$`, 'm').test(readFileSync(patchPath, 'utf8'))) {
+                key = patchId;
+            }
+        }
+        catch { /* 读失败：走 name 寻址，由 setDisabled 报具体错误 */ }
+        const result = await setDisabled(this.baseUrl, key, entryName, disabled);
         this.installedNamesCache = null;
         return result;
     }

package/dist/rpc.js

@@ -55,11 +55,14 @@ export class PluginCenterRpc extends Service {
                         };
                     }
                     case 'toggle': {
-                        const id = payload?.id;
-                        const disabled = payload?.disabled;
+                        const payload2 = payload;
+                        const id = payload2?.id;
+                        const name = payload2?.name;
+                        const disabled = payload2?.disabled;
                         if (typeof id !== 'string' || id === '')
                             return internal('toggle: id is required');
-                        const result = await ctx.pluginCenter.toggle(id, disabled === true);
+                        // name 用于无稳定 id 条目的 seek-by-name 寻址（2026-08-25 禁用失效修复）。
+                        const result = await ctx.pluginCenter.toggle(id, typeof name === 'string' ? name : '', disabled === true);
                         if (!result.ok)
                             return internal(`toggle ${id} 失败：${result.detail}`);
                         return { ok: true, value: { nowDisabled: result.nowDisabled } };

package/dist/toggle.d.ts

@@ -10,6 +10,15 @@
  * followed by an optional `disabled:` line), serialized so concurrent
  * toggles cannot interleave a read-modify-write, refused when the file is
  * not a plain entry list, and protected for host-infrastructure rows.
+ *
+ * Stable ids: `dsh plugin add` install lists mount entries as id-less
+ * `insert` children (`- name: X`), which the Loader gives a RANDOM runtime
+ * id on every boot (cordis-plugin-loader ensureId). Toggling by that
+ * runtime id writes a row no later boot matches (applyEntryPatches warns
+ * and skips) — the 2026-08-25 disable-broken bug. When no `- id:` row
+ * matches, this module addresses the entry by `name` instead: the id-less
+ * insert child is upgraded in place to a stable `- id: X` so the appended
+ * disable row actually hits. It never guesses: no match = refused write.
  */
 export interface ToggleResult {
     ok: boolean;
@@ -19,13 +28,18 @@ export interface ToggleResult {
 }
 /** What the user patch layer currently says about every row id. */
 export declare function readDisabledState(patchPath: string): Map<string, boolean>;
+/** Escape a literal for use inside a RegExp (plugin names may contain `.` etc.). */
+export declare function escapeRegExp(text: string): string;
 /**
  * Set one entry's disabled stance in the profile patch layer. The file is
  * only touched when the stance changes; a malformed file (not a plain
  * entry list) is reported instead of being made worse.
  * @param profileDir - the profile directory holding cordis.patch.yml.
  * @param id - the loader entry id to toggle.
+ * @param name - the entry's package name; used as the addressing key when
+ *   `id` is a Loader-assigned random runtime id with no `- id:` row in the
+ *   patch file (id-less insert children of `dsh plugin add` lists).
  * @param disabled - the target stance.
  * @returns the outcome; `nowDisabled` mirrors the stance or null when refused.
  */
-export declare function setDisabled(profileDir: string, entryId: string, disabled: boolean): Promise<ToggleResult>;
+export declare function setDisabled(profileDir: string, entryId: string, name: string, disabled: boolean): Promise<ToggleResult>;

package/dist/toggle.js

@@ -10,6 +10,15 @@
  * followed by an optional `disabled:` line), serialized so concurrent
  * toggles cannot interleave a read-modify-write, refused when the file is
  * not a plain entry list, and protected for host-infrastructure rows.
+ *
+ * Stable ids: `dsh plugin add` install lists mount entries as id-less
+ * `insert` children (`- name: X`), which the Loader gives a RANDOM runtime
+ * id on every boot (cordis-plugin-loader ensureId). Toggling by that
+ * runtime id writes a row no later boot matches (applyEntryPatches warns
+ * and skips) — the 2026-08-25 disable-broken bug. When no `- id:` row
+ * matches, this module addresses the entry by `name` instead: the id-less
+ * insert child is upgraded in place to a stable `- id: X` so the appended
+ * disable row actually hits. It never guesses: no match = refused write.
  */
 import { readFileSync, writeFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
@@ -89,6 +98,46 @@ export function readDisabledState(patchPath) {
     }
     return state;
 }
+/** Escape a literal for use inside a RegExp (plugin names may contain `.` etc.). */
+export function escapeRegExp(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&');
+}
+/**
+ * Address a `dsh plugin add` install-list insert child by name: an id-less
+ * child (`    - name: X`, 4-space indent under `- insert:`) gets upgraded in
+ * place to a stable-id form (`    - id: X` + `      name: X`), then a
+ * `- id: X / disabled: <bool>` row is appended. A child that already carries
+ * the stable id (`    - id: X`) just gets the row appended (the upgrade must
+ * not regress to a random runtime id). The insert block always stays before
+ * the appended row, so applyEntryPatches registers the id before the toggle
+ * row reads it. Returns false when nothing matches (or `name` is empty) —
+ * callers must refuse the write, never append blindly.
+ */
+function patchInsertChildByName(lines, name, disabled) {
+    if (name === '')
+        return false;
+    const idPattern = new RegExp(`^ {4}- id: ${escapeRegExp(name)}$`, 'u');
+    const namePattern = new RegExp(`^ {4}- name: ${escapeRegExp(name)}$`, 'u');
+    let found = false;
+    for (let i = 0; i < lines.length; i++) {
+        if (namePattern.test(lines[i])) {
+            // 无 id 子条目 → 原地升级为稳定 id（4 空格 + 6 空格 name）。
+            lines[i] = `    - id: ${name}\n      name: ${name}`;
+            found = true;
+            break;
+        }
+        if (idPattern.test(lines[i])) {
+            // 已是稳定 id 子条目 → 无需升级，直接追加禁用行。
+            found = true;
+            break;
+        }
+    }
+    if (!found)
+        return false;
+    const tail = lines.length > 0 && lines[lines.length - 1] !== '' ? '\n' : '';
+    lines.push(`${tail}- id: ${name}\n  disabled: ${String(disabled)}`);
+    return true;
+}
 /** Serialize toggles so concurrent writes cannot interleave. */
 let toggleChain = Promise.resolve();
 /**
@@ -97,10 +146,13 @@ let toggleChain = Promise.resolve();
  * entry list) is reported instead of being made worse.
  * @param profileDir - the profile directory holding cordis.patch.yml.
  * @param id - the loader entry id to toggle.
+ * @param name - the entry's package name; used as the addressing key when
+ *   `id` is a Loader-assigned random runtime id with no `- id:` row in the
+ *   patch file (id-less insert children of `dsh plugin add` lists).
  * @param disabled - the target stance.
  * @returns the outcome; `nowDisabled` mirrors the stance or null when refused.
  */
-export function setDisabled(profileDir, entryId, disabled) {
+export function setDisabled(profileDir, entryId, name, disabled) {
     const run = toggleChain.then(async () => {
         // Loader runtime ids (include:<id>) never match patch composition —
         // always address rows by their original patch id.
@@ -157,9 +209,22 @@ export function setDisabled(profileDir, entryId, disabled) {
             out.push(line);
         }
         if (!patched) {
-            // Append a new row (the file ends with a newline when non-empty).
-            const tail = out.length > 0 && out[out.length - 1] !== '' ? '\n' : '';
-            out.push(`${tail}- id: ${id}\n  disabled: ${String(disabled)}`);
+            // 2026-08-25 禁用失效根因：id-less insert 子条目每次启动拿随机运行时
+            // id，按它追加的禁用行重启后永远匹配不到（applyEntryPatches warn 后
+            // 静默跳过）。所以这里绝不静默追加：先按 name 寻址 insert 子条目行，
+            // 原地升级为稳定 id 再追加；都找不到 → 拒绝（不写文件）。
+            if (!patchInsertChildByName(out, name, disabled)) {
+                if (/^[0-9a-f]{8}$/u.test(id)) {
+                    return {
+                        ok: false,
+                        detail: `entry "${id}" has no stable patch id (random runtime id); ` +
+                            'edit cordis.patch.yml to give its insert child an explicit id',
+                        nowDisabled: null,
+                    };
+                }
+                return { ok: false, detail: `no patch row or insert child matches "${id}"`, nowDisabled: null };
+            }
+            patched = true;
         }
         try {
             writeFileSync(patchPath, out.join('\n') + '\n');

package/dist/update.d.ts

@@ -64,6 +64,15 @@ export declare function logPnpm(profileDir: string, args: readonly string[], res
  *  CreateProcess 只找 pnpm.exe（.cmd/.ps1 必须经 shell）——2026-08-17 实测
  *  spawn('pnpm', shell:false) 直接 ENOENT，更新永远假成功。 */
 export declare function pnpmCandidates(): string[];
+/** Wrap a bundled pnpm CLI path into a runnable command line. SSID_PNPM
+ *  (SSiD 捆绑 pnpm) points at `pnpm.cjs` — a node script. On Windows,
+ *  spawning it directly through `shell: true` makes cmd hand the .cjs to
+ *  its file association (ShellExecute): cmd returns exit 0 immediately and
+ *  node never runs (2026-08-25 another machine: 142ms fake success, npm
+ *  add 未生效; output redirection test produced a 0-byte file). Non-.cjs
+ *  paths (e.g. pnpm.exe) are used as-is.
+ */
+export declare function pnpmExecCommand(bundled: string): string;
 /** 归档 profile 的 node_modules 由 pnpm `<major>` 生成（SSiD 部署时把构建机
  *  store 元数据改写成本机路径且保留 major 后缀——shell/main.mjs rewire）。
  *  若执行机全局 pnpm 是另一个 major（常见：机器装 pnpm 10，归档是 pnpm 11

package/dist/update.js

@@ -185,6 +185,32 @@ export function pnpmCandidates() {
     }
     return commands;
 }
+/** One node executable that can run pnpm scripts.
+ *  SSiD 注入的 SSID_MCP_NODE（与 SSID_PNPM 同模式注入，存在即用）→ 本进程
+ *  execPath（官方 dsh 是 node 进程）→ PATH 的 node。 */
+function nodeCandidate() {
+    const fromEnv = process.env.SSID_MCP_NODE;
+    if (fromEnv !== undefined && fromEnv !== '')
+        return fromEnv;
+    const exe = process.execPath;
+    if (/node(?:\.exe)?$/i.test(exe))
+        return exe;
+    return 'node';
+}
+/** Wrap a bundled pnpm CLI path into a runnable command line. SSID_PNPM
+ *  (SSiD 捆绑 pnpm) points at `pnpm.cjs` — a node script. On Windows,
+ *  spawning it directly through `shell: true` makes cmd hand the .cjs to
+ *  its file association (ShellExecute): cmd returns exit 0 immediately and
+ *  node never runs (2026-08-25 another machine: 142ms fake success, npm
+ *  add 未生效; output redirection test produced a 0-byte file). Non-.cjs
+ *  paths (e.g. pnpm.exe) are used as-is.
+ */
+export function pnpmExecCommand(bundled) {
+    if (!/\.(cjs|mjs|js)$/i.test(bundled))
+        return bundled;
+    const node = nodeCandidate();
+    return node === null ? bundled : `"${node}" "${bundled}"`;
+}
 /** 归档 profile 的 node_modules 由 pnpm `<major>` 生成（SSiD 部署时把构建机
  *  store 元数据改写成本机路径且保留 major 后缀——shell/main.mjs rewire）。
  *  若执行机全局 pnpm 是另一个 major（常见：机器装 pnpm 10，归档是 pnpm 11
@@ -214,7 +240,7 @@ export function pnpmCommandCandidates(profileDir) {
     const commands = [];
     const bundled = process.env.SSID_PNPM;
     if (bundled !== undefined && bundled !== '')
-        commands.push(bundled);
+        commands.push(pnpmExecCommand(bundled));
     commands.push(...pnpmCandidates());
     const major = detectStoreMajor(profileDir);
     if (major !== undefined) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@max-null/dsh-plugin-center",
-  "version": "0.2.12",
+  "version": "0.2.13",
   "description": "Plugin center for DeepSeek Harness 閳?installed metadata, community market, update detection, and What's New",
   "license": "MIT",
   "publishConfig": {