@michengai/dsh-codex-ui 0.2.92 → 0.2.93

package/CHANGELOG.md

@@ -4,6 +4,20 @@
 
 This changelog records recent releases of DSH Codex UI and its one-click installer. Earlier changes remain available in the [Git history](https://github.com/MichengAI/dsh-codex-ui/commits/main).
 
+## 0.2.93 — 2026-08-30
+
+### Compatibility
+
+- Resolved the active DSH Desktop profile through the public `desktopProfiles` service and delegated installs and updates to the public `desktopPnpm` package manager instead of hard-coding the `web` profile.
+- Preserved the ordinary Web/CLI profile fallback while recognizing Desktop-provided runtime and companion-package state across restarts.
+- Routed new-session actions through Archive Manager's optional `uiWorkspace.startSession()` service, with the standard workspace service retained as the fallback.
+
+### Safety
+
+- Removed the dependency on the launcher-private `desktopPnpmBootstrap` implementation detail.
+- Failed safely when a Desktop generation exposes incomplete public services instead of falling back to an ambient CLI that could mutate another profile.
+- Reported the running Desktop DSH runtime as installed without fabricating a version or update when the Host exposes no supported runtime path.
+
 ## 0.2.92 — 2026-08-28
 
 Companion release: `@michengai/dsh-codex-suite-installer@0.1.9`.

package/CHANGELOG.zh-CN.md

@@ -4,6 +4,20 @@
 
 本日志记录 DSH Codex UI 及其一键安装器的最近发布；更早的变更可查看 [Git 提交历史](https://github.com/MichengAI/dsh-codex-ui/commits/main)。
 
+## 0.2.93 — 2026-08-30
+
+### 兼容性
+
+- 通过公开的 `desktopProfiles` service 读取 DSH Desktop 当前 Profile，并把安装与更新交给公开的 `desktopPnpm` 包管理服务，不再硬编码 `web` Profile。
+- 保留普通 Web/CLI 的 Profile 回退，同时在 Desktop 重启前后正确识别宿主 Runtime 与配套插件状态。
+- 新建会话优先调用 Archive Manager 可选提供的 `uiWorkspace.startSession()` service，缺失时继续使用标准工作区服务。
+
+### 安全性
+
+- 移除对 Launcher 私有实现细节 `desktopPnpmBootstrap` 的依赖。
+- Desktop generation 的公开服务不完整时安全失败，不再回退到可能修改其他 Profile 的环境 CLI。
+- 宿主没有通过受支持路径暴露 Runtime 目录时，只确认正在运行的 Desktop DSH Runtime 已安装，不伪造版本或升级状态。
+
 ## 0.2.92 — 2026-08-28
 
 配套版本：`@michengai/dsh-codex-suite-installer@0.1.9`。

package/dist/client.js

@@ -5445,6 +5445,18 @@ header [data-dcu-title-folder] svg,header [data-dcu-title-more] svg{display:bloc
 		function hasDeleteSession(value) {
 			return value !== null && typeof value === "object" && "deleteSession" in value && typeof value.deleteSession === "function";
 		}
+		function hasStartSession(value) {
+			return value !== null && typeof value === "object" && "startSession" in value && typeof value.startSession === "function";
+		}
+		/** Archive Manager replaces the official ui-workspace row with this optional service. */
+		function startWorkspaceSession(ctx, workspaceId) {
+			const uiWorkspace = ctx.get("uiWorkspace");
+			if (hasStartSession(uiWorkspace)) {
+				uiWorkspace.startSession(workspaceId);
+				return;
+			}
+			ctx.workspaces.startSession(workspaceId);
+		}
 		/** 替换 DSH 的官方 sidebar 插槽，不修改 DSH 源码或会话数据。 */
 		function apply(ctx) {
 			ctx.effect(() => ctx.locale.register(NS, {
@@ -5490,7 +5502,7 @@ header [data-dcu-title-folder] svg,header [data-dcu-title-more] svg{display:bloc
 						ctx.sessions.open(sessionId);
 					},
 					startSession: (workspaceId) => {
-						ctx.workspaces.startSession(workspaceId);
+						startWorkspaceSession(ctx, workspaceId);
 					},
 					toggleSidebar: () => {
 						ctx.layout.toggleSidebar();
@@ -5561,7 +5573,7 @@ header [data-dcu-title-folder] svg,header [data-dcu-title-more] svg{display:bloc
 					insertWorkspaceBefore: (workspaceId, beforeWorkspaceId) => ctx.workspaces.insertBefore(workspaceId, beforeWorkspaceId),
 					insertSessionBefore: (workspaceId, sessionId, beforeSessionId) => ctx.workspaces.insertSessionBefore(workspaceId, sessionId, beforeSessionId),
 					startSession: (workspaceId) => {
-						ctx.workspaces.startSession(workspaceId);
+						startWorkspaceSession(ctx, workspaceId);
 					}
 				})
 			}, CodexWorkspaceBrowser));
@@ -5601,6 +5613,7 @@ header [data-dcu-title-folder] svg,header [data-dcu-title-more] svg{display:bloc
 		//#endregion
 		exports.apply = apply;
 		exports.inject = inject;
+		exports.startWorkspaceSession = startWorkspaceSession;
 		return module.exports;
 	}
 });

package/dist/index.mjs

@@ -56,13 +56,63 @@ function managedDependency(id) {
 const PROFILE_PENDING_UPDATES_FILE = ".dsh-pending-updates.json";
 const APPLY_PLUGIN_UPDATES_IPC = "apply-plugin-updates";
 const PLUGIN_INSTALL_TIMEOUT_MS = 6e5;
-function profileDirectory() {
-	if (process.env.DSH_PROFILE_DIR !== void 0) return process.env.DSH_PROFILE_DIR;
-	return resolve(homedir(), ".dsh", "profiles", "web");
+function optionalService(ctx, name) {
+	if (ctx === void 0) return void 0;
+	return typeof ctx.get === "function" ? ctx.get(name) : ctx[name];
 }
-async function declaredPluginNames() {
+function validProfileName(value) {
+	return typeof value === "string" && value !== "" && value !== "." && value !== ".." && value !== "node_modules" && !value.includes("/") && !value.includes("\\") && !/[\0-\x1f\x7f]/.test(value);
+}
+function profileNameFromArgv(argv) {
+	for (let index = 2; index < argv.length; index += 1) {
+		const argument = argv[index];
+		if (argument === "--profile") return argv[index + 1];
+		if (argument?.startsWith("--profile=")) return argument.slice(10);
+	}
+	return argv[2] === "web" ? "web" : void 0;
+}
+/**
+* Desktop 通过可选 Host service 暴露当前 profile；普通 Web/CLI 继续使用
+* DSH_PROFILE_DIR、命令行 profile 与默认 web profile。
+*/
+function resolveDependencyRuntime(ctx, options = {}) {
+	const env = options.env ?? process.env;
+	const argv = options.argv ?? process.argv;
+	const cwd = options.cwd ?? process.cwd();
+	const home = options.homeDir ?? homedir();
+	const profiles = optionalService(ctx, "desktopProfiles");
+	const desktopPnpm = optionalService(ctx, "desktopPnpm");
+	if (profiles !== void 0) {
+		const current = profiles.current;
+		if (!validProfileName(current?.name) || typeof current.dir !== "string" || !isAbsolute(current.dir)) throw new Error("DSH Desktop 当前 Profile 信息无效，请重启 Desktop 后重试。");
+		if (typeof desktopPnpm?.runPlugin !== "function") throw new Error("DSH Desktop 包管理服务尚未就绪，请重启 Desktop 后重试。");
+		const profileDir = resolve(current.dir);
+		const runtimeRoots = typeof env.DSH_RUNTIME_DIR === "string" && isAbsolute(env.DSH_RUNTIME_DIR) ? [resolve(env.DSH_RUNTIME_DIR)] : [];
+		return {
+			environmentKind: "desktop",
+			profileName: current.name,
+			profileDir,
+			runtimeRoots,
+			desktopPnpm
+		};
+	}
+	const profileDir = resolve(env.DSH_PROFILE_DIR ?? resolve(home, ".dsh", "profiles", "web"));
+	const selected = profileNameFromArgv(argv);
+	const profileName = validProfileName(selected) ? selected : validProfileName(basename(profileDir)) ? basename(profileDir) : "web";
+	const cliRuntimeRoot = argv[1] === void 0 ? void 0 : resolveDshRuntimeRoot(argv[1], cwd);
+	return {
+		environmentKind: "cli",
+		profileName,
+		profileDir,
+		runtimeRoots: [env.DSH_RUNTIME_DIR, cliRuntimeRoot].filter((root) => root !== void 0 && root !== "")
+	};
+}
+function profileDirectory(runtime) {
+	return runtime.profileDir;
+}
+async function declaredPluginNames(runtime) {
 	try {
-		const manifest = JSON.parse(await readFile(resolve(profileDirectory(), "package.json"), "utf8"));
+		const manifest = JSON.parse(await readFile(resolve(profileDirectory(runtime), "package.json"), "utf8"));
 		return [.../* @__PURE__ */ new Set([...Object.keys({
 			...manifest.devDependencies,
 			...manifest.dependencies
@@ -101,17 +151,12 @@ function resolveDshRuntimeRoot(entry = process.argv[1], cwd = process.cwd()) {
 	const root = cliEntry.slice(0, index);
 	return root.endsWith(sep) ? root.slice(0, -1) : root;
 }
-function packageLookupRoots(packageName) {
-	if (!isOfficialRuntimePackage(packageName)) return [profileDirectory()];
-	const runtimeDir = process.env.DSH_RUNTIME_DIR;
-	return [...new Set([
-		runtimeDir,
-		resolveDshRuntimeRoot(),
-		profileDirectory()
-	].filter((root) => root !== void 0 && root !== ""))];
+function packageLookupRoots(packageName, runtime) {
+	if (!isOfficialRuntimePackage(packageName)) return [profileDirectory(runtime)];
+	return [.../* @__PURE__ */ new Set([...runtime.runtimeRoots, profileDirectory(runtime)])];
 }
-async function installedPackageVersion(packageName) {
-	for (const root of packageLookupRoots(packageName)) try {
+async function installedPackageVersion(packageName, runtime) {
+	for (const root of packageLookupRoots(packageName, runtime)) try {
 		const manifest = JSON.parse(await readFile(resolve(root, "node_modules", ...packageName.split("/"), "package.json"), "utf8"));
 		if (typeof manifest.version === "string" && manifest.version !== "") return manifest.version;
 	} catch (error) {
@@ -183,9 +228,9 @@ function applyReleaseExclude(source, packageName, version) {
 	return `${source}${source === "" || source.endsWith("\n") ? "" : eol}minimumReleaseAgeExclude:${eol}${entry}${eol}`;
 }
 /** 将用户本次确认的精确版本加入 Profile 的 pnpm 发布时间保护例外。 */
-async function ensureLatestReleaseAllowed(packageName, version) {
+async function ensureLatestReleaseAllowed(packageName, version, runtime) {
 	if (parseSemver(version) === void 0) throw new Error("npm 返回了无法识别的最新版本。");
-	const path = resolve(profileDirectory(), "pnpm-workspace.yaml");
+	const path = resolve(profileDirectory(runtime), "pnpm-workspace.yaml");
 	let source;
 	try {
 		source = await readFile(path, "utf8");
@@ -231,11 +276,16 @@ function newerVersion(installed, latest) {
 	for (let index = 0; index < current.core.length; index += 1) if (candidate.core[index] !== current.core[index]) return candidate.core[index] > current.core[index];
 	return comparePrerelease(candidate.prerelease, current.prerelease) > 0;
 }
-/** 返回 Web profile 中固定管理插件的实际安装版本与 npm latest 状态。 */
-async function dependencyStatuses() {
-	const declaredNames = await declaredPluginNames();
+/** 返回当前 profile 中固定管理插件的实际安装版本与 npm latest 状态。 */
+async function dependencyStatuses(runtime = resolveDependencyRuntime()) {
+	const declaredNames = await declaredPluginNames(runtime);
 	return Promise.all(MANAGED_DEPENDENCIES.map(async (dependency) => {
-		const version = await installedPackageVersion(dependency.packageName);
+		const version = await installedPackageVersion(dependency.packageName, runtime);
+		if (version === void 0 && runtime.environmentKind === "desktop" && isOfficialRuntimePackage(dependency.packageName)) return {
+			...dependency,
+			installed: true,
+			updateAvailable: false
+		};
 		const declared = isOfficialRuntimePackage(dependency.packageName) || isManagedPackageDeclared(dependency.packageName, declaredNames);
 		if (version === void 0 || !isManagedPackageInstalled({
 			installedVersion: version,
@@ -273,8 +323,8 @@ function isRestartableInstallError(error) {
 	const message = error instanceof Error ? error.message : String(error);
 	return /完全退出桌面端|正在运行的插件|pnpm 仓库不一致/.test(message);
 }
-async function recordPendingUpdate(packageName, version) {
-	const pendingPath = resolve(profileDirectory(), PROFILE_PENDING_UPDATES_FILE);
+async function recordPendingUpdate(packageName, version, runtime) {
+	const pendingPath = resolve(profileDirectory(runtime), PROFILE_PENDING_UPDATES_FILE);
 	let packages = [];
 	try {
 		const parsed = JSON.parse(await readFile(pendingPath, "utf8"));
@@ -297,8 +347,8 @@ async function recordPendingUpdate(packageName, version) {
 	});
 	await writeFile(pendingPath, `${JSON.stringify({ packages }, void 0, 2)}\n`, "utf8");
 }
-async function removePendingUpdate(packageName) {
-	const pendingPath = resolve(profileDirectory(), PROFILE_PENDING_UPDATES_FILE);
+async function removePendingUpdate(packageName, runtime) {
+	const pendingPath = resolve(profileDirectory(runtime), PROFILE_PENDING_UPDATES_FILE);
 	try {
 		const parsed = JSON.parse(await readFile(pendingPath, "utf8"));
 		if (!Array.isArray(parsed.packages)) return;
@@ -313,8 +363,8 @@ async function removePendingUpdate(packageName) {
 		if (error.code !== "ENOENT") throw error;
 	}
 }
-async function recordDeclaredVersion(packageName, version) {
-	const manifestPath = resolve(profileDirectory(), "package.json");
+async function recordDeclaredVersion(packageName, version, runtime) {
+	const manifestPath = resolve(profileDirectory(runtime), "package.json");
 	let manifest;
 	try {
 		manifest = JSON.parse(await readFile(manifestPath, "utf8"));
@@ -344,6 +394,7 @@ function pluginExecArgv(args = process.execArgv) {
 	return args.filter((arg) => !/^--(?:inspect|inspect-brk|debug|debug-brk)(?:=|$)/.test(arg));
 }
 const activePluginChildren = /* @__PURE__ */ new Set();
+const activeDesktopPluginHandles = /* @__PURE__ */ new Set();
 function terminatePluginChild(child) {
 	if (child.exitCode !== null || child.killed) return;
 	if (process.platform === "win32" && child.pid !== void 0) {
@@ -367,6 +418,7 @@ function terminatePluginChild(child) {
 /** 插件停用时终止仍在运行的安装进程，避免热更新后遗留 pnpm。 */
 function disposeDependencyInstaller() {
 	for (const child of activePluginChildren) terminatePluginChild(child);
+	for (const handle of activeDesktopPluginHandles) handle.cancel();
 }
 function monitorPluginChild(child, timeoutMs = PLUGIN_INSTALL_TIMEOUT_MS) {
 	return new Promise((resolvePromise, reject) => {
@@ -398,14 +450,52 @@ function monitorPluginChild(child, timeoutMs = PLUGIN_INSTALL_TIMEOUT_MS) {
 		timeout.unref?.();
 	});
 }
-function runDshPlugin(args, timeoutMs = PLUGIN_INSTALL_TIMEOUT_MS) {
+function monitorDesktopPlugin(handle, timeoutMs = PLUGIN_INSTALL_TIMEOUT_MS) {
+	return new Promise((resolvePromise, reject) => {
+		activeDesktopPluginHandles.add(handle);
+		let output = "";
+		let settled = false;
+		const collect = (chunk) => {
+			output = `${output}${String(chunk)}`.slice(-65536);
+		};
+		const finish = (error) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timeout);
+			activeDesktopPluginHandles.delete(handle);
+			error === void 0 ? resolvePromise() : reject(error);
+		};
+		handle.stdout?.on("data", collect);
+		handle.stderr?.on("data", collect);
+		handle.stdout?.once("error", () => {
+			handle.cancel();
+			finish(/* @__PURE__ */ new Error("无法读取 DSH Desktop 插件安装输出。"));
+		});
+		handle.stderr?.once("error", () => {
+			handle.cancel();
+			finish(/* @__PURE__ */ new Error("无法读取 DSH Desktop 插件安装输出。"));
+		});
+		handle.done.then((outcome) => {
+			finish(outcome.exitCode === 0 && outcome.signal === null ? void 0 : pluginCommandError(output));
+		}, () => {
+			finish(pluginCommandError(output));
+		});
+		const timeout = setTimeout(() => {
+			handle.cancel();
+			finish(/* @__PURE__ */ new Error("插件安装超时，已终止安装进程。请检查网络后重试。"));
+		}, timeoutMs);
+		timeout.unref?.();
+	});
+}
+function runDshPlugin(args, runtime = resolveDependencyRuntime(), timeoutMs = PLUGIN_INSTALL_TIMEOUT_MS) {
+	if (runtime.desktopPnpm !== void 0) return monitorDesktopPlugin(runtime.desktopPnpm.runPlugin(args, runtime.profileDir), timeoutMs);
 	const entry = resolveDshCliEntry();
 	return monitorPluginChild(spawn(process.execPath, [
 		...pluginExecArgv(),
 		entry,
 		"plugin",
 		"--profile",
-		"web",
+		runtime.profileName,
 		...args
 	], {
 		cwd: process.cwd(),
@@ -424,11 +514,11 @@ function runDshPlugin(args, timeoutMs = PLUGIN_INSTALL_TIMEOUT_MS) {
 /** 并发安装互斥：pnpm 锁文件竞争会触发 EPERM/EBUSY，同一时间只允许一个安装进程。 */
 let installing = false;
 /** 仅允许安装固定依赖，避免把浏览器输入转成任意命令。 */
-async function installDependency(id, requestHotUpdate = requestDesktopHotUpdate) {
+async function installDependency(id, requestHotUpdate = requestDesktopHotUpdate, runtime = resolveDependencyRuntime()) {
 	if (installing) throw new Error("已有依赖安装正在进行，请等待完成后再试。");
 	installing = true;
 	try {
-		return await installDependenciesLocked([id], requestHotUpdate);
+		return await installDependenciesLocked([id], requestHotUpdate, runtime);
 	} finally {
 		installing = false;
 	}
@@ -438,31 +528,31 @@ function updatableDependencyIds(statuses) {
 	return statuses.filter((status) => status.installed && status.updateAvailable).map((status) => status.id);
 }
 /** 把所有待更新版本一次写入清单，最后只请求一次桌面热更新。 */
-async function updateAllDependencies(requestHotUpdate = requestDesktopHotUpdate) {
+async function updateAllDependencies(requestHotUpdate = requestDesktopHotUpdate, runtime = resolveDependencyRuntime()) {
 	if (installing) throw new Error("已有依赖安装正在进行，请等待完成后再试。");
 	installing = true;
 	try {
-		const current = await dependencyStatuses();
+		const current = await dependencyStatuses(runtime);
 		const ids = updatableDependencyIds(current);
 		if (ids.length === 0) return {
 			dependencies: current,
 			updatedCount: 0
 		};
 		return {
-			dependencies: await installDependenciesLocked(ids, requestHotUpdate),
+			dependencies: await installDependenciesLocked(ids, requestHotUpdate, runtime),
 			updatedCount: ids.length
 		};
 	} finally {
 		installing = false;
 	}
 }
-async function installDependenciesLocked(ids, requestHotUpdate) {
+async function installDependenciesLocked(ids, requestHotUpdate, runtime) {
 	const dependencies = [...new Set(ids)].map((id) => {
 		const dependency = managedDependency(id);
 		if (dependency === void 0) throw new Error("不支持安装该依赖。");
 		return dependency;
 	});
-	const declared = await declaredPluginNames();
+	const declared = await declaredPluginNames(runtime);
 	const requestedTargets = await Promise.all(dependencies.map(async (dependency) => {
 		const latestVersion = await npmLatestVersion(dependency.packageName);
 		if (latestVersion === void 0) throw new Error("无法获取 npm 最新版本，请检查网络或 npm registry 后重试。");
@@ -482,7 +572,7 @@ async function installDependenciesLocked(ids, requestHotUpdate) {
 			packageName,
 			version: requestedVersion
 		};
-		const version = await installedPackageVersion(packageName) ?? await npmLatestVersion(packageName);
+		const version = await installedPackageVersion(packageName, runtime) ?? await npmLatestVersion(packageName);
 		if (version === void 0) throw new Error("无法读取 Suite 成员版本，请检查 npm 安装后重试。");
 		return {
 			packageName,
@@ -491,27 +581,27 @@ async function installDependenciesLocked(ids, requestHotUpdate) {
 	}));
 	const remove = [...new Set(targets.flatMap((target) => pluginsToRemoveBeforeInstall(declared, target.packageName)))];
 	for (const target of targets) {
-		await ensureLatestReleaseAllowed(target.packageName, target.version);
-		if (!isOfficialRuntimePackage(target.packageName)) await recordDeclaredVersion(target.packageName, target.version);
-		await recordPendingUpdate(target.packageName, target.version);
+		await ensureLatestReleaseAllowed(target.packageName, target.version, runtime);
+		if (!isOfficialRuntimePackage(target.packageName)) await recordDeclaredVersion(target.packageName, target.version, runtime);
+		await recordPendingUpdate(target.packageName, target.version, runtime);
 	}
-	if (remove.length > 0) await runDshPlugin(["remove", ...remove]);
-	if (requestHotUpdate()) return dependencyStatuses();
+	if (remove.length > 0) await runDshPlugin(["remove", ...remove], runtime);
+	if (runtime.desktopPnpm === void 0 && requestHotUpdate()) return dependencyStatuses(runtime);
 	for (const target of targets) {
 		try {
 			await runDshPlugin([
 				"add",
 				`${target.packageName}@${target.version}`,
 				"--registry=https://registry.npmjs.org/"
-			]);
+			], runtime);
 		} catch (error) {
-			if (isRestartableInstallError(error)) return dependencyStatuses();
+			if (isRestartableInstallError(error)) return dependencyStatuses(runtime);
 			throw error;
 		}
-		if (await installedPackageVersion(target.packageName) !== target.version) return dependencyStatuses();
-		await removePendingUpdate(target.packageName);
+		if (await installedPackageVersion(target.packageName, runtime) !== target.version) return dependencyStatuses(runtime);
+		await removePendingUpdate(target.packageName, runtime);
 	}
-	return dependencyStatuses();
+	return dependencyStatuses(runtime);
 }
 //#endregion
 //#region src/explorer-path-policy.ts
@@ -950,7 +1040,7 @@ function apply(ctx) {
 				const url = new URL(request.url ?? "/", "http://localhost");
 				try {
 					if (request.method === "GET") {
-						const dependencies = await dependencyStatuses();
+						const dependencies = await dependencyStatuses(resolveDependencyRuntime(ctx));
 						response.writeHead(200, {
 							"content-type": "application/json; charset=utf-8",
 							"cache-control": "no-store"
@@ -972,7 +1062,7 @@ function apply(ctx) {
 							const { dependencies, updatedCount } = await updateAllDependencies(() => {
 								restartAfterResponse = typeof process.send === "function";
 								return restartAfterResponse;
-							});
+							}, resolveDependencyRuntime(ctx));
 							response.writeHead(200, {
 								"content-type": "application/json; charset=utf-8",
 								"cache-control": "no-store"
@@ -990,7 +1080,7 @@ function apply(ctx) {
 						const dependencies = await installDependency(url.searchParams.get("dependency"), () => {
 							restartAfterResponse = typeof process.send === "function";
 							return restartAfterResponse;
-						});
+						}, resolveDependencyRuntime(ctx));
 						response.writeHead(200, {
 							"content-type": "application/json; charset=utf-8",
 							"cache-control": "no-store"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@michengai/dsh-codex-ui",
-  "version": "0.2.92",
+  "version": "0.2.93",
   "description": "以 Codex 风格重构 DSH Web 侧栏的独立客户端插件",
   "license": "Apache-2.0",
   "publishConfig": {