@morehao/dsh-github-trending 0.1.0 → 0.1.2

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## 0.1.2
+
+> 0.1.1 从未发布到 npm（tag 推上去后 CI 在 `npm ci` 就失败），0.1.2 是它的第一次真实发布。
+
+### 修复
+
+- lockfile 里 57 个 `resolved` 指向 `registry.npmmirror.com`，npm 11 在 CI 拒绝拉取（`EALLOWREMOTE`）；统一为 `registry.npmjs.org`，并加 `scripts/check-lockfile.mjs`（`npm run check` 会跑），把这类只在发版暴露的错误前移到 PR。
+
+### 发布链路
+
+- 新增 tag 触发的发布：`.github/workflows/release.yml`（OIDC Trusted Publishing，无 NPM_TOKEN）+ `scripts/ci-publish.sh`（版本守卫 / 幂等 / 失败回读后重试）+ `scripts/release-notes.mjs`（只投影注记 tag 正文）+ `docs/publishing.md`。
+- `check.yml` 在 PR/main 上跑 `npm run check` 与 AC 机械检查。
+
+## 0.1.1
+
+分发方式变更：核心二进制不再走 npm 平台分包，改为 **GitHub Release 下载 + sha256 校验 + 本地缓存**（2026-10-30 决策 B）。
+
+### 变更
+
+- **获取核心**：`TRENDING_DIGEST_CORE` / 设置里的 `corePath`（覆盖，仅排障）→ 缓存 `$DSH_HOME/github-trending/core/v<version>/` → 按 `os/arch` 下载 `trendradar_<goos>_<goarch>`，用同目录 `checksums.txt` 校验（流式写入 + 原子 rename + 0755），失败不留半个文件；缓存命中后完全离线。
+- **版本来源**：`package.json` 的 `dsh.core.{repo,version}`；`scripts/sync-contract.mjs --ref vX.Y.Z` 会同步写入，保证「契约来源 tag」与「下载的核心版本」是同一个值。
+- **新增配置**：`coreAutoDownload`（默认 `true`）；关掉后只报 `CORE_NOT_DOWNLOADED`，由设置页显式下载。
+- **设置页**：显示 Release 版本 / 资产名 / 缓存状态 / 下载 URL，并提供「下载核心 / 重新下载」按钮（`POST /core/download`）。
+- **新增错误码**：`CORE_NOT_DOWNLOADED`（未下载，附下载地址）、`CORE_CHECKSUM_MISMATCH`（校验失败且已丢弃）；`CORE_UNAVAILABLE` 现在覆盖 404（版本未发布）、网络失败与平台不在矩阵。
+- **移除**：`optionalDependencies` 里的 6 个 `@morehao/trendradar-core-*`（从未发布，安装时只是 6 次无效探测）。
+
+### 修复（实测 v0.1.0 Release 后发现）
+
+- Windows 资产名带 `.exe`（goreleaser `formats: [binary]` 保留后缀）：`assetName()` 按平台补后缀，避免 Windows 上下载 404。
+
+### 测试
+
+- 新增 `test/release.test.mjs`（命名映射 / 下载校验 / 缓存复用 / 篡改重下 / 校验失败无残留 / 404 提示 / force）与 `test/core-status.test.mjs`（未下载 / 已缓存 / 覆盖路径三种状态）。
+- AC 脚本 AC-P-11 判据改为「环境变量优先 / 未设走 Release」，全套 71 条测试、11 条 AC 机械检查通过。
+
 ## 0.1.0
 
 首个可用版本：插件侧完整落地，内容仍全部由 `trendradar` 核心产出。

package/README.md

@@ -2,7 +2,7 @@
 
 > GitHub 趋势日报的 **DSH 入口**：每天定时 spawn 本地 [`trendradar`](https://github.com/morehao/trendradar) 核心，抓取 Trending、生成中文简介与当日总结，提交到你自己的仓库并自动合并 PR。
 
-**状态：0.1.0。** 插件侧（配置、调度、核心调用、状态与界面、两个工具）已完成；核心的平台二进制包（`@morehao/trendradar-core-*`）尚未发布，安装后运行会明确报 `CORE_UNAVAILABLE` 并给出修复指引——不会写空文件，也不会退回旧内容。
+**状态：0.1.1。** 插件侧（配置、调度、核心调用、状态与界面、两个工具）已完成。核心二进制走 **GitHub Release**：首次运行按 `os/arch` 下载、用 `checksums.txt` 校验 sha256、缓存到插件数据目录，之后离线复用。核心仓库打 tag 出资产之前，运行会明确报 `CORE_NOT_DOWNLOADED` / `CORE_UNAVAILABLE` 并给出下载地址——不会写空文件，也不会退回旧内容。
 
 ## 它做什么
 
@@ -35,11 +35,12 @@ dsh plugin --profile <profile> add @morehao/dsh-github-trending
 - 一个本地 **git 仓库**（提交目标）与可写的远端
 - 模型：provider + 模型 ID + 密钥（或用宿主已配置的 provider；OAuth 类凭据不需要密钥）
 - Git 与 GitHub 凭据（PAT / Device Flow / 本机 `gh`），仅 push 与开 PR 需要
-- 核心二进制：随插件通过 `optionalDependencies` 获取的平台包（`@morehao/trendradar-core-<os>-<cpu>`）；开发/排障时可用环境变量 `TRENDING_DIGEST_CORE` 指向一个可执行的 `trendradar`
+- 核心二进制：首次运行从 `github.com/morehao/trendradar/releases` 下载（按 `os/arch`，sha256 校验后缓存）；之后离线复用。开发/排障时可用 `TRENDING_DIGEST_CORE`（或设置里的「核心路径」）指向一个可执行的 `trendradar`，此时完全不下载
 
 **访问哪里**
 
 - 本地核心进程（一次性的 `run` 子进程）
+- `github.com/morehao/trendradar/releases`：仅首次运行（或点「下载核心」）时下载二进制与其 `checksums.txt`；之后不再联网
 - 你配置的模型端点（由**核心**发起，插件不代发）
 - `api.github.com`（由**核心**发起 push/PR；插件本身不发 GitHub 请求）
 - 本机 `127.0.0.1` 上的临时回环代理（仅当宿主 provider 的凭据不可导出时，端口随机、一次性 token、运行结束即关闭）
@@ -72,7 +73,8 @@ dsh plugin --profile <profile> add @morehao/dsh-github-trending
 | `trending.since` / `languages` / `topN` | `daily` / `all,typescript,python,go,rust` / `25` | 实际支持范围由核心决定 |
 | `output.dir` | `trending` | 仓库内相对目录 |
 | `schedule.enabled` / `time` / `timezone` | `true` / `08:30:00` / `Asia/Shanghai` | 插件自己的 60 s tick 驱动 |
-| `corePath` | 空 | 等价于 `TRENDING_DIGEST_CORE`（仅开发/排障） |
+| `corePath` | 空 | 等价于 `TRENDING_DIGEST_CORE`（仅开发/排障；设了就完全不下载） |
+| `coreAutoDownload` | `true` | 缓存缺失时是否自动下载核心；关掉后只报 `CORE_NOT_DOWNLOADED`，由你在设置页点「下载核心」 |
 
 ## 两个工具
 
@@ -87,7 +89,9 @@ dsh plugin --profile <profile> add @morehao/dsh-github-trending
 
 | 码 | 含义 | 下一步 |
 |---|---|---|
-| `CORE_UNAVAILABLE` | 找不到核心（平台包缺失 / `TRENDING_DIGEST_CORE` 无效） | 重装插件，或指向可执行的 `trendradar` |
+| `CORE_NOT_DOWNLOADED` | 核心还没下载（缓存为空，且自动下载被关或尚未触发） | 设置页点「下载核心」，或指向可执行的 `trendradar` |
+| `CORE_CHECKSUM_MISMATCH` | 下载内容的 sha256 与 `checksums.txt` 不符（已被丢弃） | 重试；仍失败则手动下载放到缓存目录（代理可能改写内容） |
+| `CORE_UNAVAILABLE` | 下载失败 / 版本还没发布（404）/ 平台不在矩阵 / 覆盖路径无效 | 按提示里的 URL 与发布顺序处理 |
 | `CORE_INCOMPATIBLE` | 核心 `ipcSchema`/`digestSchema` 与插件不一致 | 升级插件（含平台包）到同一版本 |
 | `CORE_TIMEOUT` / `CORE_CANCELLED` | 超时 / 用户取消 | 不提交任何状态，也留不下半成品 |
 | `IPC_INVALID` | 核心 stdout 不是约定的结果信封 | 升级插件与核心 |
@@ -105,15 +109,16 @@ dsh plugin --profile <profile> add @morehao/dsh-github-trending
 - 首次可在设置页「从本机 CLI 导入」一次性导入非敏感字段；**密钥不导入**
 - 别让两套定时同时开着：内容侧靠 `contentHash` 与 PR 复用兜底，模型消耗无法兜底
 
-## 已知偏差（0.1.0）
+## 已知偏差（0.1.1）
 
 1. **核心尚无 stdin 信封**：核心当前的 `run` 只接受 `--config <path> --json`，插件据此传配置；`ok/startedAt/error.code` 形状的 `RunResult` 已兼容，核心补上后插件无需改。
 2. **密钥传输**：POSIX 上配置经 **FIFO** 交给核心（文件系统里不出现明文）；Windows 无 FIFO，退化为 0600 临时文件并在读完后立即删除。
 3. **GitHub token** 经子进程环境变量传给核心（核心只认 `GITHUB_TOKEN`/`GH_TOKEN`）；不进 argv、不进配置、不进日志。
 4. **调度**用插件自己的 60 s tick（宿主 `schedule` 是会话本地提醒，覆盖不到无人值守场景）。
-5. **平台包未发布**：`@morehao/trendradar-core-<os>-<cpu>` 404 期间，运行会明确报 `CORE_UNAVAILABLE`；发布顺序是先核心包、后插件。
+5. **二进制改为下载**（2026-10-30 决策 B）：不再随包发 npm 平台分包。首次运行需要能访问 GitHub Release；断网环境请用 `TRENDING_DIGEST_CORE` 指向本地核心。核心版本由 `package.json` 的 `dsh.core.version` 固定（`sync-contract --ref vX.Y.Z` 会同步写入）。
+6. **核心尚未打 tag**：`trendradar` 仓库还没有 Release，因此当前下载会得到「还没有发布」的明确提示；打上 `v0.1.0` 后无需改插件。
 
-## 开发
+## 开发与发版
 
 ```bash
 npm install
@@ -121,7 +126,10 @@ npm run check          # typecheck + 契约校验 + 构建 + 全部测试
 node scripts/ac/run.mjs # AC-P-01…13 的机械部分
 ```
 
-- 契约快照：`contract/`（schema + fixtures + `UPSTREAM.json`），由 `node scripts/sync-contract.mjs --ref <sha>` 从核心仓库同步；`npm run check:contract` 校验哈希与生成类型
+发版走 **tag 触发的 CI**（Trusted Publishing / OIDC，不需要 npm token）：合并 PR → 在 `main` 打注记 tag `vX.Y.Z` → CI 发 npm 并用注记正文建 Release。细节见 [docs/publishing.md](docs/publishing.md)。
+
+- 契约快照：`contract/`（schema + fixtures + `UPSTREAM.json`），由 `node scripts/sync-contract.mjs --ref <sha|vX.Y.Z>` 从核心仓库同步；ref 是 tag 时会同时把版本写进 `package.json` 的 `dsh.core.version`；`npm run check:contract` 校验哈希与生成类型
+- 核心下载与缓存：`src/core/release.ts`（`ensureCore`），缓存位置 `$DSH_HOME/github-trending/core/v<version>/`
 - 宿主半 `src/`（tsup → `lib/`），客户端半 `client/`（esbuild → `client.js`，`window.__ModuleLoader__.load`）
 
 ## 许可

package/client.js

@@ -61,10 +61,15 @@ var DICT = {
     "core.ready": "可用",
     "core.unavailable": "不可用",
     "core.incompatible": "版本不兼容",
-    "core.package": "平台包",
+    "core.cached": "已缓存",
+    "core.notDownloaded": "未下载",
+    "core.download": "下载核心",
+    "core.downloading": "下载中…",
+    "core.redownload": "重新下载",
+    "core.downloaded": "核心已下载并校验通过",
     "core.installed": "已安装",
     "core.missing": "未安装",
-    "core.order": "解析顺序：TRENDING_DIGEST_CORE（仅开发/排障）→ 平台包；都没有时报 CORE_UNAVAILABLE。",
+    "core.order": "解析顺序：TRENDING_DIGEST_CORE（仅开发/排障）→ Release 资产（缓存命中直接用，否则下载并校验）；都不可用时报 CORE_UNAVAILABLE。",
     "coexist.title": "检测到本机另有 CLI",
     "coexist.hint": "插件仍使用自带核心，不切换、不接管它的定时。",
     "card.model.title": "模型",
@@ -201,10 +206,15 @@ var DICT = {
     "core.ready": "ready",
     "core.unavailable": "unavailable",
     "core.incompatible": "incompatible",
-    "core.package": "Platform package",
     "core.installed": "installed",
     "core.missing": "missing",
-    "core.order": "Resolution order: TRENDING_DIGEST_CORE (dev/troubleshooting only) → platform package; otherwise CORE_UNAVAILABLE.",
+    "core.cached": "cached",
+    "core.notDownloaded": "not downloaded",
+    "core.download": "Download core",
+    "core.downloading": "Downloading…",
+    "core.redownload": "Re-download",
+    "core.downloaded": "Core downloaded and verified",
+    "core.order": "Resolution order: TRENDING_DIGEST_CORE (dev/troubleshooting only) → Release asset (cache first, otherwise download and verify); otherwise CORE_UNAVAILABLE.",
     "coexist.title": "Another CLI found on this machine",
     "coexist.hint": "The plugin still uses its bundled core; it never switches or takes over that CLI schedule.",
     "card.model.title": "Model",
@@ -630,6 +640,7 @@ function SettingsView(props) {
   const [preflight, setPreflight] = import_react.default.useState(null);
   const [preflighting, setPreflighting] = import_react.default.useState(false);
   const [rechecking, setRechecking] = import_react.default.useState(false);
+  const [downloading, setDownloading] = import_react.default.useState(false);
   const [quickOpen, setQuickOpen] = import_react.default.useState(false);
   import_react.default.useEffect(() => {
     if (state !== null && !dirty) setDraft(state.settings);
@@ -690,6 +701,20 @@ function SettingsView(props) {
       setRechecking(false);
     }
   };
+  const downloadCore = async () => {
+    setDownloading(true);
+    setProblems([]);
+    setMessage(null);
+    try {
+      await apiCall("POST", "/core/download", {});
+      setMessage(t("core.downloaded"));
+      await store.refresh({ quiet: true });
+    } catch (error) {
+      setMessage(error instanceof Error ? error.message : String(error));
+    } finally {
+      setDownloading(false);
+    }
+  };
   const importCli = async () => {
     try {
       const result = await apiCall(
@@ -755,12 +780,19 @@ function SettingsView(props) {
         { label: t("core.label") },
         h("span", { className: "dshgt-pill" }, h("span", { className: `dshgt-dot ${coreKind}` }), state.core.version ?? t(`core.${state.core.state}`)),
         state.core.ipcSchema === void 0 ? null : h("span", { className: "dshgt-hint dshgt-mono" }, `ipc ${state.core.ipcSchema} · digest ${state.core.digestSchema ?? "?"}`),
+        state.core.release === void 0 ? null : h("span", { className: "dshgt-hint dshgt-mono" }, `${state.core.release.tag} · ${state.core.release.asset}`),
         h(
           "span",
-          { className: "dshgt-hint dshgt-mono", title: state.core.path ?? "" },
-          state.core.source === "package" ? t("core.package") : state.core.source === "env" ? "TRENDING_DIGEST_CORE" : state.core.path ?? ""
+          { className: "dshgt-hint" },
+          state.core.download.state === "override" ? `覆盖路径：${state.core.override?.path ?? ""}` : state.core.release?.cached === true ? t("core.cached") : t("core.notDownloaded")
+        ),
+        state.core.download.state === "override" ? null : h(
+          Btn,
+          { small: true, onClick: () => void downloadCore(), disabled: downloading },
+          downloading ? t("core.downloading") : state.core.release?.cached === true ? t("core.redownload") : t("core.download")
         )
       ),
+      state.core.release === void 0 ? null : h("p", { className: "dshgt-hint dshgt-mono", style: { fontSize: 11 } }, `${state.core.release.url}  →  ${state.core.release.binaryPath}`),
       state.core.state === "ready" ? null : h(Alert, { kind: "err", title: t("core.label") }, h("div", null, state.core.message ?? ""), h("div", { className: "dshgt-hint" }, t("core.order"))),
       h("p", { className: "dshgt-hint" }, t("core.order")),
       state.coexistence.found ? h(Alert, { kind: "warn", title: t("coexist.title") }, h("div", { className: "dshgt-mono", style: { fontSize: 12 } }, `${state.coexistence.path ?? ""} ${state.coexistence.version ?? ""}`), h("div", null, state.coexistence.message ?? ""), h("div", { className: "dshgt-hint" }, t("coexist.hint"))) : null,

package/contract/UPSTREAM.json

@@ -1,9 +1,9 @@
 {
   "repo": "https://github.com/morehao/trendradar.git",
-  "ref": "d3bf720",
+  "ref": "v0.1.0",
   "commit": "d3bf720a869732e7a2ee04fa39d32dd50868fd61",
   "aggregate": "eb7f1ac9e117a709d15d87de89cf30e309c479e62dfa3d320cb8f154d3f1dc1e",
-  "syncedAt": "2026-10-30T13:20:43.663Z",
+  "syncedAt": "2026-10-30T14:06:16.766Z",
   "files": [
     {
       "path": "schema/api.v1.yaml",

package/lib/{chunk-CWB5L7RW.js → chunk-RXYA5WFW.js}

@@ -48,7 +48,8 @@ var DEFAULT_SETTINGS = {
   trending: { since: "daily", languages: ["all", "typescript", "python", "go", "rust"], topN: 25 },
   output: { dir: "trending" },
   schedule: { enabled: true, time: "08:30:00", timezone: "Asia/Shanghai" },
-  corePath: ""
+  corePath: "",
+  coreAutoDownload: true
 };
 var PROVIDER_BASE_URLS = {
   deepseek: "https://api.deepseek.com/v1",
@@ -125,7 +126,8 @@ function normalizeSettings(input) {
       time: str(schedule.time, DEFAULT_SETTINGS.schedule.time),
       timezone: str(schedule.timezone, DEFAULT_SETTINGS.schedule.timezone)
     },
-    corePath: str(raw.corePath, DEFAULT_SETTINGS.corePath).trim()
+    corePath: str(raw.corePath, DEFAULT_SETTINGS.corePath).trim(),
+    coreAutoDownload: bool(raw.coreAutoDownload, DEFAULT_SETTINGS.coreAutoDownload)
   };
 }
 var TIME_RE = /^([01]\d|2[0-3]):([0-5]\d)(?::([0-5]\d))?$/;
@@ -403,6 +405,8 @@ var PLUGIN_CODES = [
   "CORE_TIMEOUT",
   "CORE_CANCELLED",
   "CORE_CONFIG_CHANNEL_FAILED",
+  "CORE_NOT_DOWNLOADED",
+  "CORE_CHECKSUM_MISMATCH",
   "IPC_INVALID",
   "MODEL_KEY_MISSING",
   "MODEL_NOT_FOUND",
@@ -435,6 +439,8 @@ var RETRIABLE = {
   CORE_TIMEOUT: true,
   CORE_CANCELLED: false,
   CORE_CONFIG_CHANNEL_FAILED: true,
+  CORE_NOT_DOWNLOADED: false,
+  CORE_CHECKSUM_MISMATCH: true,
   IPC_INVALID: false,
   MODEL_KEY_MISSING: false,
   MODEL_NOT_FOUND: false,
@@ -464,6 +470,10 @@ function hintOf(code) {
       return "\u8FD0\u884C\u5DF2\u53D6\u6D88\uFF1A\u6838\u5FC3\u5DF2\u7EC8\u6B62\uFF0C\u672A\u63D0\u4EA4\u72B6\u6001\uFF0C\u4E5F\u672A\u7559\u534A\u6210\u54C1\u3002";
     case "CORE_CONFIG_CHANNEL_FAILED":
       return "\u914D\u7F6E\u901A\u9053\u5EFA\u7ACB\u5931\u8D25\uFF08FIFO \u4E0D\u53EF\u7528\uFF09\uFF1A\u6539\u7528\u4E34\u65F6\u6587\u4EF6\u6A21\u5F0F\u91CD\u8BD5\uFF0C\u6216\u68C0\u67E5\u76EE\u6807\u6587\u4EF6\u7CFB\u7EDF\u3002";
+    case "CORE_NOT_DOWNLOADED":
+      return "\u6838\u5FC3\u8FD8\u6CA1\u4E0B\u8F7D\uFF1A\u5728\u8BBE\u7F6E\u9875\u70B9\u300C\u4E0B\u8F7D\u6838\u5FC3\u300D\uFF08\u6216\u7528 TRENDING_DIGEST_CORE \u6307\u5411\u672C\u5730\u6838\u5FC3\uFF09\u3002\u9996\u6B21\u8FD0\u884C\u9700\u8981\u8054\u7F51\u3002";
+    case "CORE_CHECKSUM_MISMATCH":
+      return "\u6838\u5FC3\u4E8C\u8FDB\u5236\u6821\u9A8C\u5931\u8D25\u4E14\u5DF2\u4E22\u5F03\uFF1A\u7F51\u7EDC\u4EE3\u7406\u53EF\u80FD\u6539\u5199\u4E86\u5185\u5BB9\uFF0C\u91CD\u8BD5\u4E00\u6B21\uFF1B\u4ECD\u5931\u8D25\u8BF7\u624B\u52A8\u4E0B\u8F7D\u540E\u653E\u5230\u7F13\u5B58\u76EE\u5F55\u3002";
     case "IPC_INVALID":
       return "\u6838\u5FC3\u8F93\u51FA\u4E0D\u662F\u7EA6\u5B9A\u7684\u7ED3\u679C\u4FE1\u5C01\uFF1A\u5347\u7EA7\u63D2\u4EF6\u4E0E\u6838\u5FC3\u5230\u540C\u4E00\u7248\u672C\u3002";
     case "MODEL_KEY_MISSING":
@@ -731,105 +741,289 @@ async function handshake(core, options = {}) {
   return { version, corePath: core.path, durationMs: result.durationMs, supportedProviders };
 }
 
-// src/core/locate.ts
-var locate_exports = {};
-__export(locate_exports, {
-  PLATFORM_PACKAGE_PREFIX: () => PLATFORM_PACKAGE_PREFIX,
-  locateCore: () => locateCore,
-  packageInstalled: () => packageInstalled,
-  platformPackageName: () => platformPackageName
+// src/core/release.ts
+var release_exports = {};
+__export(release_exports, {
+  assetName: () => assetName,
+  describeRelease: () => describeRelease,
+  ensureCore: () => ensureCore,
+  goTarget: () => goTarget,
+  readCoreRelease: () => readCoreRelease,
+  verifyCached: () => verifyCached
 });
+import { createHash } from "crypto";
+import { chmodSync, createWriteStream, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync as renameSync2, rmSync, statSync, unlinkSync } from "fs";
 import { createRequire } from "module";
-import { accessSync, constants, existsSync as existsSync2, readFileSync as readFileSync2, statSync } from "fs";
+import { pipeline } from "stream/promises";
+import { Readable } from "stream";
 import path4 from "path";
-var PLATFORM_PACKAGE_PREFIX = "@morehao/trendradar-core";
-function platformPackageName(platform = process.platform, arch = process.arch) {
-  return `${PLATFORM_PACKAGE_PREFIX}-${platform}-${arch}`;
+var DOWNLOAD_TIMEOUT_MS = 18e4;
+function requireJson() {
+  const require2 = createRequire(import.meta.url);
+  return require2("../package.json");
 }
-function executable(file) {
+function readCoreRelease(pkg) {
+  const source = pkg ?? requireJson();
+  const repo = source.dsh?.core?.repo;
+  const version = source.dsh?.core?.version;
+  if (typeof repo !== "string" || !/^[\w.-]+\/[\w.-]+$/.test(repo)) {
+    throw new IpcError("CORE_UNAVAILABLE", "package.json \u7F3A\u5C11 dsh.core.repo\uFF08owner/repo\uFF09\uFF0C\u65E0\u6CD5\u5B9A\u4F4D\u6838\u5FC3 Release");
+  }
+  if (typeof version !== "string" || !/^\d+\.\d+\.\d+(?:-[\w.]+)?$/.test(version)) {
+    throw new IpcError("CORE_UNAVAILABLE", "package.json \u7F3A\u5C11 dsh.core.version\uFF08\u5F62\u5982 0.1.0\uFF09\uFF0C\u65E0\u6CD5\u5B9A\u4F4D\u6838\u5FC3 Release");
+  }
+  return { repo, version };
+}
+function goTarget(platform = process.platform, arch = process.arch) {
+  const goos = platform === "win32" ? "windows" : platform === "darwin" ? "darwin" : platform === "linux" ? "linux" : platform;
+  const goarch = arch === "x64" ? "amd64" : arch === "arm64" ? "arm64" : arch === "ia32" ? "386" : arch;
+  return { goos, goarch };
+}
+function assetName(platform = process.platform, arch = process.arch) {
+  const { goos, goarch } = goTarget(platform, arch);
+  const suffix = platform === "win32" ? ".exe" : "";
+  return `trendradar_${goos}_${goarch}${suffix}`;
+}
+function binaryName(platform = process.platform) {
+  return platform === "win32" ? "trendradar.exe" : "trendradar";
+}
+function describeRelease(release, options = {}) {
+  const env = options.env ?? process.env;
+  const platform = options.platform ?? process.platform;
+  const arch = options.arch ?? process.arch;
+  const { goos, goarch } = goTarget(platform, arch);
+  const asset = assetName(platform, arch);
+  const tag = `v${release.version}`;
+  const base = `https://github.com/${release.repo}/releases/download/${tag}`;
+  const cacheDir = path4.join(dataDir(env), "core", tag);
+  const binaryPath = path4.join(cacheDir, binaryName(platform));
+  return {
+    ...release,
+    tag,
+    goos,
+    goarch,
+    asset,
+    url: `${base}/${asset}`,
+    checksumsUrl: `${base}/checksums.txt`,
+    cacheDir,
+    binaryPath,
+    cached: existsSync2(binaryPath)
+  };
+}
+function sha256File(file) {
+  return createHash("sha256").update(readFileSync2(file)).digest("hex");
+}
+function markerPath(binaryPath) {
+  return `${binaryPath}.sha256`;
+}
+function verifyCached(binaryPath) {
+  let info;
   try {
-    if (!statSync(file).isFile()) return false;
-    accessSync(file, constants.X_OK);
-    return true;
+    info = statSync(binaryPath);
   } catch {
-    return false;
+    return { ok: false, reason: "missing" };
+  }
+  if (!info.isFile()) return { ok: false, reason: "not-a-file" };
+  if (process.platform !== "win32" && (info.mode & 73) === 0) return { ok: false, reason: "not-executable" };
+  const marker = markerPath(binaryPath);
+  if (!existsSync2(marker)) return { ok: true };
+  const expected = readFileSync2(marker, "utf8").trim();
+  if (expected === "") return { ok: true };
+  try {
+    return sha256File(binaryPath) === expected ? { ok: true } : { ok: false, reason: "checksum-mismatch" };
+  } catch {
+    return { ok: false, reason: "unreadable" };
   }
 }
-function binCandidates(packageJsonPath, packageDir) {
-  const candidates = [];
+function fetchOf(options) {
+  if (options.fetchImpl !== void 0) return options.fetchImpl;
+  if (typeof fetch !== "function") {
+    throw new IpcError("CORE_UNAVAILABLE", "\u5F53\u524D Node \u6CA1\u6709\u5168\u5C40 fetch\uFF08\u9700\u8981 Node \u2265 18\uFF09\uFF0C\u65E0\u6CD5\u4E0B\u8F7D\u6838\u5FC3");
+  }
+  return fetch;
+}
+async function fetchChecksum(descriptor, options) {
+  options.onProgress?.({ phase: "checksums" });
+  const response = await fetchOf(options)(descriptor.checksumsUrl, { signal: AbortSignal.timeout(3e4) }).catch((error) => {
+    throw new IpcError(
+      "CORE_UNAVAILABLE",
+      `\u65E0\u6CD5\u83B7\u53D6\u6838\u5FC3\u6821\u9A8C\u6587\u4EF6\uFF1A${descriptor.checksumsUrl}\uFF08${error instanceof Error ? error.message : String(error)}\uFF09\u3002\u82E5\u5728\u516C\u53F8\u7F51\u7EDC\u5185\uFF0C\u8BF7\u786E\u8BA4\u4EE3\u7406\u53EF\u7528\uFF1B\u4E5F\u53EF\u7528 TRENDING_DIGEST_CORE \u6307\u5411\u672C\u5730\u5DF2\u7F16\u8BD1\u7684\u6838\u5FC3\u3002`
+    );
+  });
+  if (!response.ok) {
+    throw new IpcError(
+      "CORE_UNAVAILABLE",
+      `\u6838\u5FC3 ${descriptor.tag} \u8FD8\u6CA1\u6709\u53D1\u5E03\uFF08${descriptor.checksumsUrl} \u8FD4\u56DE HTTP ${response.status}\uFF09\u3002\u53D1\u5E03\u987A\u5E8F\u662F\u5148\u5728 trendradar \u6253 tag \u5E76\u4E0A\u4F20 Release \u8D44\u4EA7\uFF0C\u63D2\u4EF6\u968F\u540E\u624D\u80FD\u4E0B\u8F7D\u3002`
+    );
+  }
+  const text = await response.text();
+  for (const line of text.split("\n")) {
+    const match = /^([0-9a-f]{64})\s+\*?(.+)$/.exec(line.trim());
+    if (match !== null && match[2] === descriptor.asset) return match[1];
+  }
+  throw new IpcError(
+    "CORE_UNAVAILABLE",
+    `checksums.txt \u91CC\u6CA1\u6709 ${descriptor.asset}\uFF08\u5F53\u524D\u5E73\u53F0 ${descriptor.goos}/${descriptor.goarch} \u53EF\u80FD\u4E0D\u5728\u53D1\u5E03\u77E9\u9635\u5185\uFF09`
+  );
+}
+async function download(descriptor, options) {
+  const expected = await fetchChecksum(descriptor, options);
+  options.onProgress?.({ phase: "download" });
+  const response = await fetchOf(options)(descriptor.url, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) }).catch((error) => {
+    throw new IpcError(
+      "CORE_UNAVAILABLE",
+      `\u4E0B\u8F7D\u6838\u5FC3\u5931\u8D25\uFF1A${descriptor.url}\uFF08${error instanceof Error ? error.message : String(error)}\uFF09\u3002\u53EF\u624B\u52A8\u4E0B\u8F7D\u540E\u653E\u5230 ${descriptor.binaryPath}\uFF0C\u6216\u7528 TRENDING_DIGEST_CORE \u6307\u5B9A\u8DEF\u5F84\u3002`
+    );
+  });
+  if (!response.ok || response.body === null) {
+    throw new IpcError(
+      "CORE_UNAVAILABLE",
+      `\u4E0B\u8F7D\u6838\u5FC3\u5931\u8D25\uFF1A${descriptor.url} \u8FD4\u56DE HTTP ${response.status}\uFF08\u7248\u672C ${descriptor.tag} / ${descriptor.asset}\uFF09`
+    );
+  }
+  mkdirSync2(descriptor.cacheDir, { recursive: true, mode: 448 });
+  const temp = `${descriptor.binaryPath}.${process.pid}.${Date.now()}.part`;
+  const hash = createHash("sha256");
+  const total = Number(response.headers.get("content-length") ?? "0") || void 0;
+  let bytes = 0;
   try {
-    const pkg = JSON.parse(readFileSync2(packageJsonPath, "utf8"));
-    const bin = pkg.bin;
-    if (typeof bin === "string") candidates.push(path4.join(packageDir, bin));
-    else if (typeof bin === "object" && bin !== null) {
-      const entry = bin["trendradar"];
-      if (typeof entry === "string") candidates.push(path4.join(packageDir, entry));
+    await pipeline(
+      Readable.fromWeb(response.body),
+      async function* (source) {
+        for await (const chunk of source) {
+          const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+          hash.update(buf);
+          bytes += buf.length;
+          yield buf;
+        }
+      },
+      createWriteStream(temp, { mode: 384 })
+    );
+    const actual = hash.digest("hex");
+    options.onProgress?.({ phase: "verify", bytes, total });
+    if (actual !== expected) {
+      throw new IpcError(
+        "CORE_CHECKSUM_MISMATCH",
+        `\u6838\u5FC3\u4E8C\u8FDB\u5236\u6821\u9A8C\u5931\u8D25\uFF1A\u671F\u671B ${expected}\uFF0C\u5B9E\u9645 ${actual}\uFF08${descriptor.url}\uFF09\u3002\u5DF2\u4E22\u5F03\u4E0B\u8F7D\u7ED3\u679C\u3002`
+      );
     }
-  } catch {
+    chmodSync(temp, 493);
+    renameSync2(temp, descriptor.binaryPath);
+    const fs = await import("fs");
+    fs.writeFileSync(markerPath(descriptor.binaryPath), `${actual}
+`, { mode: 384 });
+    return { path: descriptor.binaryPath, sha256: actual };
+  } catch (error) {
+    rmSync(temp, { force: true });
+    throw error;
   }
-  candidates.push(path4.join(packageDir, "bin", "trendradar"));
-  candidates.push(path4.join(packageDir, "trendradar"));
-  return candidates;
 }
-function locateCore(options) {
-  const env = options.env ?? process.env;
-  const override = options.settings.corePath !== "" ? options.settings.corePath : env.TRENDING_DIGEST_CORE?.trim() ?? "";
-  const searched = [];
-  if (override !== "") {
-    const resolved = path4.isAbsolute(override) ? override : path4.resolve(override);
-    searched.push(resolved);
-    if (!existsSync2(resolved)) {
+async function ensureCore(options = {}) {
+  const release = options.release ?? readCoreRelease();
+  const descriptor = describeRelease(release, options);
+  if (!options.force && existsSync2(descriptor.binaryPath)) {
+    const verified = verifyCached(descriptor.binaryPath);
+    if (verified.ok) {
+      return { path: descriptor.binaryPath, source: "cache", descriptor };
+    }
+    if (options.allowDownload === false) {
       throw new IpcError(
         "CORE_UNAVAILABLE",
-        `TRENDING_DIGEST_CORE \u6307\u5411\u7684\u8DEF\u5F84\u4E0D\u5B58\u5728\uFF1A${resolved}\u3002\u8BE5\u53D8\u91CF\u53EA\u7528\u4E8E\u5F00\u53D1/\u6392\u969C\uFF0C\u6B63\u5E38\u5B89\u88C5\u8BF7\u5220\u6389\u5B83\u3002`
+        `\u672C\u5730\u6838\u5FC3\u7F13\u5B58\u4E0D\u53EF\u7528\uFF08${verified.reason ?? "unknown"}\uFF09\uFF1A${descriptor.binaryPath}\u3002\u5220\u9664\u8BE5\u6587\u4EF6\u540E\u91CD\u8BD5\uFF0C\u6216\u5728\u8BBE\u7F6E\u9875\u70B9\u300C\u91CD\u65B0\u4E0B\u8F7D\u6838\u5FC3\u300D\u3002`
       );
     }
-    if (!executable(resolved)) {
-      throw new IpcError("CORE_UNAVAILABLE", `TRENDING_DIGEST_CORE \u6307\u5411\u7684\u6587\u4EF6\u4E0D\u53EF\u6267\u884C\uFF1A${resolved}`);
+    try {
+      unlinkSync(descriptor.binaryPath);
+    } catch {
     }
-    return {
-      path: resolved,
-      source: options.settings.corePath !== "" ? "settings" : "env",
-      searched
-    };
   }
-  const platform = options.platform ?? process.platform;
-  const arch = options.arch ?? process.arch;
-  const packageName = platformPackageName(platform, arch);
-  const resolve = options.resolve ?? createRequire(import.meta.url);
-  try {
-    const packageJson = resolve(`${packageName}/package.json`);
-    const packageDir = path4.dirname(packageJson);
-    for (const candidate of binCandidates(packageJson, packageDir)) {
-      searched.push(candidate);
-      if (executable(candidate)) {
-        return { path: candidate, source: "package", packageName, searched };
-      }
-    }
+  if (options.allowDownload === false) {
     throw new IpcError(
-      "CORE_UNAVAILABLE",
-      `\u5E73\u53F0\u5305 ${packageName} \u5DF2\u5B89\u88C5\uFF0C\u4F46\u627E\u4E0D\u5230\u53EF\u6267\u884C\u7684\u6838\u5FC3\uFF08\u627E\u8FC7\uFF1A${searched.join("\u3001")}\uFF09\u3002\u91CD\u88C5\u63D2\u4EF6\u53EF\u4FEE\u590D\u3002`
-    );
-  } catch (error) {
-    if (error instanceof IpcError) throw error;
-    throw new IpcError(
-      "CORE_UNAVAILABLE",
-      `\u627E\u4E0D\u5230\u6838\u5FC3\u4E8C\u8FDB\u5236\uFF1A\u672A\u8BBE\u7F6E TRENDING_DIGEST_CORE\uFF0C\u5E73\u53F0\u5305 ${packageName} \u4E5F\u672A\u5B89\u88C5\u3002\u8BF7\u91CD\u88C5\u63D2\u4EF6\uFF08\u4F1A\u5E26\u4E0A\u5BF9\u5E94\u5E73\u53F0\u7684\u5305\uFF09\uFF1B\u652F\u6301\u7684\u5E73\u53F0\uFF1Adarwin/linux/win32 \xD7 x64/arm64\u3002`
+      "CORE_NOT_DOWNLOADED",
+      `\u6838\u5FC3 ${descriptor.tag} \u5C1A\u672A\u4E0B\u8F7D\uFF08\u7F13\u5B58\u76EE\u5F55 ${descriptor.cacheDir}\uFF09\u3002\u4E0B\u8F7D\u5730\u5740\uFF1A${descriptor.url}\uFF1B\u6216\u5728\u8BBE\u7F6E\u9875\u70B9\u300C\u4E0B\u8F7D\u6838\u5FC3\u300D\uFF0C\u6216\u8BBE\u7F6E TRENDING_DIGEST_CORE \u6307\u5411\u672C\u5730\u6838\u5FC3\u3002`
     );
   }
+  const downloaded = await download(descriptor, options);
+  return { path: downloaded.path, source: "download", descriptor, sha256: downloaded.sha256 };
 }
-function packageInstalled(options) {
-  const platform = options.platform ?? process.platform;
-  const arch = options.arch ?? process.arch;
-  const packageName = platformPackageName(platform, arch);
-  const resolve = options.resolve ?? createRequire(import.meta.url);
+
+// src/core/locate.ts
+var locate_exports = {};
+__export(locate_exports, {
+  inspectRelease: () => inspectRelease,
+  locateCore: () => locateCore,
+  overridePath: () => overridePath
+});
+import { accessSync, constants, existsSync as existsSync3, statSync as statSync2 } from "fs";
+import path5 from "path";
+function executable(file) {
   try {
-    resolve(`${packageName}/package.json`);
+    if (!statSync2(file).isFile()) return false;
+    accessSync(file, constants.X_OK);
     return true;
   } catch {
     return false;
   }
 }
+function overridePath(settings, env = process.env) {
+  const fromSettings = settings.corePath.trim();
+  if (fromSettings !== "") {
+    return { path: path5.isAbsolute(fromSettings) ? fromSettings : path5.resolve(fromSettings), source: "settings" };
+  }
+  const fromEnv2 = env.TRENDING_DIGEST_CORE?.trim() ?? "";
+  if (fromEnv2 !== "") return { path: path5.isAbsolute(fromEnv2) ? fromEnv2 : path5.resolve(fromEnv2), source: "env" };
+  return void 0;
+}
+async function locateCore(options) {
+  const env = options.env ?? process.env;
+  const override = overridePath(options.settings, env);
+  if (override !== void 0) {
+    if (!existsSync3(override.path)) {
+      throw new IpcError(
+        "CORE_UNAVAILABLE",
+        `${override.source === "settings" ? "\u8BBE\u7F6E\u91CC\u7684 corePath" : "TRENDING_DIGEST_CORE"} \u6307\u5411\u7684\u8DEF\u5F84\u4E0D\u5B58\u5728\uFF1A${override.path}\u3002\u8BE5\u8986\u76D6\u53EA\u7528\u4E8E\u5F00\u53D1/\u6392\u969C\uFF0C\u6B63\u5E38\u4F7F\u7528\u8BF7\u6E05\u7A7A\u5B83\u3002`
+      );
+    }
+    if (!executable(override.path)) {
+      throw new IpcError("CORE_UNAVAILABLE", `${override.path} \u4E0D\u53EF\u6267\u884C\uFF08\u7F3A\u6267\u884C\u4F4D\u6216\u4E0D\u662F\u6587\u4EF6\uFF09`);
+    }
+    return { path: override.path, source: override.source };
+  }
+  const result = await ensureCore({
+    ...options.release === void 0 ? {} : { release: options.release },
+    env,
+    ...options.platform === void 0 ? {} : { platform: options.platform },
+    ...options.arch === void 0 ? {} : { arch: options.arch },
+    ...options.allowDownload === void 0 ? {} : { allowDownload: options.allowDownload },
+    ...options.forceDownload === void 0 ? {} : { force: options.forceDownload },
+    ...options.fetchImpl === void 0 ? {} : { fetchImpl: options.fetchImpl }
+  });
+  return {
+    path: result.path,
+    source: result.source,
+    release: { repo: result.descriptor.repo, version: result.descriptor.version },
+    tag: result.descriptor.tag,
+    downloaded: result.source === "download",
+    ...result.sha256 === void 0 ? {} : { sha256: result.sha256 }
+  };
+}
+function inspectRelease(settings, options = {}) {
+  const env = options.env ?? process.env;
+  const override = overridePath(settings, env);
+  if (override !== void 0) return { override };
+  try {
+    const release = options.release ?? readCoreRelease();
+    return {
+      descriptor: describeRelease(release, {
+        env,
+        ...options.platform === void 0 ? {} : { platform: options.platform },
+        ...options.arch === void 0 ? {} : { arch: options.arch }
+      })
+    };
+  } catch (error) {
+    return { error: error instanceof Error ? error.message : String(error) };
+  }
+}
 
 // src/core/channel.ts
 var channel_exports = {};
@@ -843,10 +1037,10 @@ import { constants as constants2 } from "fs";
 import { open, rm, stat, unlink, writeFile } from "fs/promises";
 import { mkdtempSync } from "fs";
 import os2 from "os";
-import path5 from "path";
+import path6 from "path";
 var WRITE_TIMEOUT_MS = 15e3;
 function tempDir() {
-  return mkdtempSync(path5.join(os2.tmpdir(), "dsh-trending-"));
+  return mkdtempSync(path6.join(os2.tmpdir(), "dsh-trending-"));
 }
 async function mkfifo(file) {
   await new Promise((resolve, reject) => {
@@ -864,7 +1058,7 @@ async function mkfifo(file) {
   });
 }
 async function createFifoChannel(dir, writeTimeoutMs) {
-  const file = path5.join(dir, "core.yml");
+  const file = path6.join(dir, "core.yml");
   await mkfifo(file);
   let disposed = false;
   return {
@@ -905,7 +1099,7 @@ async function createFifoChannel(dir, writeTimeoutMs) {
   };
 }
 async function createTmpfileChannel(dir) {
-  const file = path5.join(dir, "core.yml");
+  const file = path6.join(dir, "core.yml");
   let disposed = false;
   return {
     kind: "tmpfile",
@@ -938,7 +1132,7 @@ async function removeChannelDir(channel) {
     if (info.isFIFO()) return;
   } catch {
   }
-  await rm(path5.dirname(channel.path), { recursive: true, force: true }).catch(() => void 0);
+  await rm(path6.dirname(channel.path), { recursive: true, force: true }).catch(() => void 0);
 }
 
 // src/core/run.ts
@@ -1111,12 +1305,12 @@ __export(core_exports, {
   findOnPath: () => findOnPath,
   inspectCore: () => inspectCore
 });
-import { accessSync as accessSync2, constants as constants3, statSync as statSync2 } from "fs";
-import path6 from "path";
+import { accessSync as accessSync2, constants as constants3, statSync as statSync3 } from "fs";
+import path7 from "path";
 var CACHE_TTL_MS = 3e4;
 function executable2(file) {
   try {
-    if (!statSync2(file).isFile()) return false;
+    if (!statSync3(file).isFile()) return false;
     accessSync2(file, constants3.X_OK);
     return true;
   } catch {
@@ -1126,10 +1320,10 @@ function executable2(file) {
 function findOnPath(command, env = process.env) {
   const raw = env.PATH ?? "";
   const exts = process.platform === "win32" ? [".exe", ".cmd", ".bat", ""] : [""];
-  for (const dir of raw.split(path6.delimiter)) {
+  for (const dir of raw.split(path7.delimiter)) {
     if (dir.trim() === "") continue;
     for (const ext of exts) {
-      const candidate = path6.join(dir, `${command}${ext}`);
+      const candidate = path7.join(dir, `${command}${ext}`);
       if (executable2(candidate)) return candidate;
     }
   }
@@ -1142,14 +1336,25 @@ async function inspectCore(settings, options = {}) {
   if (!options.fresh && cached !== void 0 && cached.key === key && Date.now() - cached.at < CACHE_TTL_MS) {
     return cached.status;
   }
-  const packageName = platformPackageName();
+  const view = inspectRelease(settings, { env });
+  const release = view.descriptor === void 0 ? void 0 : {
+    repo: view.descriptor.repo,
+    tag: view.descriptor.tag,
+    asset: view.descriptor.asset,
+    url: view.descriptor.url,
+    checksumsUrl: view.descriptor.checksumsUrl,
+    cacheDir: view.descriptor.cacheDir,
+    binaryPath: view.descriptor.binaryPath,
+    cached: view.descriptor.cached
+  };
   const base = {
-    packageName,
-    packageInstalled: packageInstalled({ settings, env })
+    ...release === void 0 ? {} : { release },
+    ...view.override === void 0 ? {} : { override: view.override },
+    download: view.override !== void 0 ? { state: "override" } : release === void 0 ? { state: "missing", reason: view.error ?? "release \u672A\u914D\u7F6E" } : { state: release.cached ? "cached" : "missing" }
   };
   const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
   try {
-    const core = locateCore({ settings, env });
+    const core = await locateCore({ settings, env, allowDownload: false });
     const result = await handshake(core, { timeoutMs: 5e3 });
     const status = {
       ...base,
@@ -1186,7 +1391,7 @@ async function detectCoexistence(ownPath, options = {}) {
   const env = options.env ?? process.env;
   const found = findOnPath("trendradar", env);
   if (found === void 0) return { found: false };
-  if (ownPath !== void 0 && path6.resolve(found) === path6.resolve(ownPath)) return { found: false };
+  if (ownPath !== void 0 && path7.resolve(found) === path7.resolve(ownPath)) return { found: false };
   if (!options.fresh && coexistCache !== void 0 && coexistCache.key === found && Date.now() - coexistCache.at < CACHE_TTL_MS) {
     return coexistCache.status;
   }
@@ -1563,17 +1768,17 @@ var runner_exports = {};
 __export(runner_exports, {
   Runner: () => Runner
 });
-import { existsSync as existsSync3, statSync as statSync3 } from "fs";
-import path7 from "path";
+import { existsSync as existsSync4, statSync as statSync4 } from "fs";
+import path8 from "path";
 function repoProblem(repoPath) {
   if (repoPath.trim() === "") return { code: "CONFIG_INVALID", message: "\u8FD8\u6CA1\u6709\u9009\u62E9\u5F52\u6863\u4ED3\u5E93" };
-  if (!existsSync3(repoPath)) return { code: "REPO_NOT_GIT", message: `\u76EE\u5F55\u4E0D\u5B58\u5728\uFF1A${repoPath}` };
+  if (!existsSync4(repoPath)) return { code: "REPO_NOT_GIT", message: `\u76EE\u5F55\u4E0D\u5B58\u5728\uFF1A${repoPath}` };
   try {
-    if (!statSync3(repoPath).isDirectory()) return { code: "REPO_NOT_GIT", message: `\u4E0D\u662F\u76EE\u5F55\uFF1A${repoPath}` };
+    if (!statSync4(repoPath).isDirectory()) return { code: "REPO_NOT_GIT", message: `\u4E0D\u662F\u76EE\u5F55\uFF1A${repoPath}` };
   } catch {
     return { code: "REPO_NOT_GIT", message: `\u65E0\u6CD5\u8BBF\u95EE\uFF1A${repoPath}` };
   }
-  if (!existsSync3(path7.join(repoPath, ".git"))) {
+  if (!existsSync4(path8.join(repoPath, ".git"))) {
     return { code: "REPO_NOT_GIT", message: `\u4E0D\u662F git \u4ED3\u5E93\uFF1A${repoPath}\uFF08\u63D2\u4EF6\u4E0D\u4F1A\u66FF\u4F60 git init\uFF09` };
   }
   return void 0;
@@ -1616,7 +1821,10 @@ var Runner = class {
     const startedMs = Date.now();
     let proxy;
     try {
-      const core = locateCore({ settings, env });
+      const core = await locateCore({ settings, env, allowDownload: settings.coreAutoDownload });
+      if (core.downloaded === true) {
+        store.appendLog(logFile, `[core] \u5DF2\u4E0B\u8F7D\u6838\u5FC3 ${core.tag ?? ""} \u2192 ${core.path}`);
+      }
       const handshakeResult = await handshake(core, { signal: controller.signal });
       if (!handshakeResult.supportedProviders.includes(settings.model.provider)) {
         throw new IpcError(
@@ -1666,7 +1874,17 @@ var Runner = class {
         onStderr: (line) => store.appendLog(logFile, line)
       });
       const outcome = result.outcome;
-      const summary = this.summarize({ id, outcome, dryRun, ...options.date === void 0 ? {} : { date: options.date }, logFile, channel: result.channelKind, proxy: proxy !== void 0 });
+      const summary = this.summarize({
+        id,
+        outcome,
+        dryRun,
+        ...options.date === void 0 ? {} : { date: options.date },
+        logFile,
+        channel: result.channelKind,
+        proxy: proxy !== void 0,
+        coreSource: core.source,
+        ...core.tag === void 0 ? {} : { coreTag: core.tag }
+      });
       this.record(summary, settings);
       return summary;
     } catch (error) {
@@ -1716,7 +1934,9 @@ var Runner = class {
       warnings: outcome.warnings,
       logFile: input.logFile,
       ...input.channel === void 0 ? {} : { channel: input.channel },
-      proxy: input.proxy
+      proxy: input.proxy,
+      ...input.coreSource === void 0 ? {} : { coreSource: input.coreSource },
+      ...input.coreTag === void 0 ? {} : { coreTag: input.coreTag }
     };
   }
   failureSummary(input) {
@@ -1957,14 +2177,14 @@ __export(import_cli_exports, {
 });
 import { readFileSync as readFileSync3 } from "fs";
 import os3 from "os";
-import path8 from "path";
+import path9 from "path";
 function cliConfigCandidates(env = process.env, home = os3.homedir()) {
   const xdg = env.XDG_CONFIG_HOME?.trim();
-  const base = xdg !== void 0 && xdg !== "" ? path8.resolve(xdg) : path8.join(home, ".config");
+  const base = xdg !== void 0 && xdg !== "" ? path9.resolve(xdg) : path9.join(home, ".config");
   return [
     env.TRENDradar_CONFIG?.trim() ?? "",
-    path8.join(base, "trendradar", "config.yaml"),
-    path8.join(home, ".trendradar", "config.yaml")
+    path9.join(base, "trendradar", "config.yaml"),
+    path9.join(home, ".trendradar", "config.yaml")
   ].filter((item) => item !== "");
 }
 function unquote(raw) {
@@ -2376,6 +2596,11 @@ async function dispatch(method, pathname, url, request, deps) {
     const coexistence = await detectCoexistence(core.path, { env });
     return { core, coexistence };
   }
+  if (method === "POST" && pathname === "/core/download") {
+    const core = await locateCore({ settings, env, forceDownload: true });
+    const status = await inspectCore(settings, { env, fresh: true });
+    return { downloaded: true, path: core.path, tag: core.tag ?? null, core: status };
+  }
   if (method === "POST" && pathname === "/config") {
     const body = await readBody2(request);
     const next = normalizeSettings(body.settings ?? body);
@@ -2661,6 +2886,7 @@ export {
   errors_exports,
   ipc_exports,
   handshake_exports,
+  release_exports,
   locate_exports,
   channel_exports,
   run_exports,

package/lib/index.js

@@ -6,7 +6,7 @@ import {
   createRoutes,
   createTrendingHistoryTool,
   createTrendingRunTool
-} from "./chunk-CWB5L7RW.js";
+} from "./chunk-RXYA5WFW.js";
 import "./chunk-XLIFTAVL.js";
 
 // src/index.ts

package/lib/internal.d.ts

@@ -64,7 +64,7 @@ declare const IPC_SCHEMA_VERSION: 1;
  */
 
 /** 插件在核心之外新增的码。前缀统一避免与核心码冲突。 */
-declare const PLUGIN_CODES: readonly ["CORE_UNAVAILABLE", "CORE_INCOMPATIBLE", "CORE_SPAWN_FAILED", "CORE_TIMEOUT", "CORE_CANCELLED", "CORE_CONFIG_CHANNEL_FAILED", "IPC_INVALID", "MODEL_KEY_MISSING", "MODEL_NOT_FOUND", "MODEL_PROVIDER_UNSUPPORTED", "GITHUB_AUTH", "PUSH_FAILED", "REPO_DIRTY"];
+declare const PLUGIN_CODES: readonly ["CORE_UNAVAILABLE", "CORE_INCOMPATIBLE", "CORE_SPAWN_FAILED", "CORE_TIMEOUT", "CORE_CANCELLED", "CORE_CONFIG_CHANNEL_FAILED", "CORE_NOT_DOWNLOADED", "CORE_CHECKSUM_MISMATCH", "IPC_INVALID", "MODEL_KEY_MISSING", "MODEL_NOT_FOUND", "MODEL_PROVIDER_UNSUPPORTED", "GITHUB_AUTH", "PUSH_FAILED", "REPO_DIRTY"];
 type PluginCode = (typeof PLUGIN_CODES)[number];
 type AnyCode = ErrorCode | PluginCode;
 interface ClassifiedError {
@@ -264,6 +264,8 @@ interface Settings {
     schedule: ScheduleSettings;
     /** 核心二进制覆盖；只在开发/排障时用，对应 TRENDING_DIGEST_CORE。 */
     corePath: string;
+    /** 缓存缺失时是否自动从 Release 下载核心（首次运行需要联网）。 */
+    coreAutoDownload: boolean;
 }
 declare const DEFAULT_SETTINGS: Settings;
 /** 核心支持的 provider 默认端点（空字符串 = 必须由用户填）。 */
@@ -470,35 +472,137 @@ declare namespace state {
   export { type state_DigestIdentity as DigestIdentity, state_HISTORY_LIMIT as HISTORY_LIMIT, type state_HistoryFile as HistoryFile, type state_PendingPr as PendingPr, type state_PluginState as PluginState, type state_RunRecord as RunRecord, state_Store as Store, type state_StoreOptions as StoreOptions, state_newRunId as newRunId, state_writeJsonAtomic as writeJsonAtomic };
 }
 
-declare const PLATFORM_PACKAGE_PREFIX = "@morehao/trendradar-core";
+interface CoreRelease {
+    /** `owner/repo`（GitHub）。 */
+    repo: string;
+    /** 不带 `v` 的版本号，例如 `0.1.0`；对应 tag `v0.1.0`。 */
+    version: string;
+}
+interface ReleaseDescriptor extends CoreRelease {
+    tag: string;
+    goos: string;
+    goarch: string;
+    asset: string;
+    url: string;
+    checksumsUrl: string;
+    cacheDir: string;
+    binaryPath: string;
+    cached: boolean;
+}
+/** 从本包的 package.json 读核心版本（`sync-contract --ref vX` 会同时更新它）。 */
+declare function readCoreRelease(pkg?: {
+    dsh?: {
+        core?: {
+            repo?: unknown;
+            version?: unknown;
+        };
+    };
+}): CoreRelease;
+/** Node 的 platform/arch → Go 的 GOOS/GOARCH（两个生态词汇不同，映射必须显式）。 */
+declare function goTarget(platform?: NodeJS.Platform, arch?: string): {
+    goos: string;
+    goarch: string;
+};
+declare function assetName(platform?: NodeJS.Platform, arch?: string): string;
+declare function describeRelease(release: CoreRelease, options?: {
+    env?: NodeJS.ProcessEnv;
+    platform?: NodeJS.Platform;
+    arch?: string;
+}): ReleaseDescriptor;
+/** 缓存里的二进制是否可信：可执行 + 与下载时记录的哈希一致。 */
+declare function verifyCached(binaryPath: string): {
+    ok: boolean;
+    reason?: string;
+};
+interface EnsureOptions {
+    release?: CoreRelease;
+    env?: NodeJS.ProcessEnv;
+    platform?: NodeJS.Platform;
+    arch?: string;
+    /** false 时只查缓存，不联网（设置页探测、离线诊断用）。 */
+    allowDownload?: boolean;
+    /** true 时忽略缓存重新下载（「重新下载核心」按钮）。 */
+    force?: boolean;
+    fetchImpl?: typeof fetch;
+    onProgress?: (event: {
+        phase: 'checksums' | 'download' | 'verify';
+        bytes?: number;
+        total?: number;
+    }) => void;
+}
+interface EnsureResult {
+    path: string;
+    source: 'cache' | 'download';
+    descriptor: ReleaseDescriptor;
+    sha256?: string;
+}
+/**
+ * 确保本地有一份可用的核心二进制。
+ * 缓存命中就不联网；`allowDownload=false` 时缓存缺失直接报错（不带网络副作用）。
+ */
+declare function ensureCore(options?: EnsureOptions): Promise<EnsureResult>;
+
+type release_CoreRelease = CoreRelease;
+type release_EnsureOptions = EnsureOptions;
+type release_EnsureResult = EnsureResult;
+type release_ReleaseDescriptor = ReleaseDescriptor;
+declare const release_assetName: typeof assetName;
+declare const release_describeRelease: typeof describeRelease;
+declare const release_ensureCore: typeof ensureCore;
+declare const release_goTarget: typeof goTarget;
+declare const release_readCoreRelease: typeof readCoreRelease;
+declare const release_verifyCached: typeof verifyCached;
+declare namespace release {
+  export { type release_CoreRelease as CoreRelease, type release_EnsureOptions as EnsureOptions, type release_EnsureResult as EnsureResult, type release_ReleaseDescriptor as ReleaseDescriptor, release_assetName as assetName, release_describeRelease as describeRelease, release_ensureCore as ensureCore, release_goTarget as goTarget, release_readCoreRelease as readCoreRelease, release_verifyCached as verifyCached };
+}
+
 interface CoreLocation {
     path: string;
-    source: 'settings' | 'env' | 'package';
-    packageName?: string;
-    /** 解析失败时给用户看的候选清单。 */
-    searched?: string[];
+    source: 'settings' | 'env' | 'cache' | 'download';
+    release?: CoreRelease;
+    tag?: string;
+    /** 本次调用是否真的下载了（用于日志与状态提示）。 */
+    downloaded?: boolean;
+    sha256?: string;
 }
-declare function platformPackageName(platform?: NodeJS.Platform, arch?: string): string;
 interface LocateOptions {
     settings: Settings;
     env?: NodeJS.ProcessEnv;
     platform?: NodeJS.Platform;
     arch?: string;
-    /** 测试注入：默认 `createRequire(import.meta.url)`。 */
-    resolve?: (id: string) => string;
+    /** 默认 true；false 时只查缓存（设置页探测用）。 */
+    allowDownload?: boolean;
+    forceDownload?: boolean;
+    fetchImpl?: typeof fetch;
+    release?: CoreRelease;
 }
-declare function locateCore(options: LocateOptions): CoreLocation;
-/** 平台包是否已安装（不执行），供设置页提前展示。 */
-declare function packageInstalled(options: LocateOptions): boolean;
+declare function overridePath(settings: Settings, env?: NodeJS.ProcessEnv): {
+    path: string;
+    source: 'settings' | 'env';
+} | undefined;
+declare function locateCore(options: LocateOptions): Promise<CoreLocation>;
+/** 只读的 Release 视图：不联网、不创建目录，供设置页展示「有没有、从哪来」。 */
+declare function inspectRelease(settings: Settings, options?: {
+    env?: NodeJS.ProcessEnv;
+    platform?: NodeJS.Platform;
+    arch?: string;
+    release?: CoreRelease;
+}): {
+    descriptor?: ReleaseDescriptor;
+    override?: {
+        path: string;
+        source: 'settings' | 'env';
+    };
+    error?: string;
+};
 
 type locate_CoreLocation = CoreLocation;
 type locate_LocateOptions = LocateOptions;
-declare const locate_PLATFORM_PACKAGE_PREFIX: typeof PLATFORM_PACKAGE_PREFIX;
+declare const locate_inspectRelease: typeof inspectRelease;
 declare const locate_locateCore: typeof locateCore;
-declare const locate_packageInstalled: typeof packageInstalled;
-declare const locate_platformPackageName: typeof platformPackageName;
+declare const locate_overridePath: typeof overridePath;
 declare namespace locate {
-  export { type locate_CoreLocation as CoreLocation, type locate_LocateOptions as LocateOptions, locate_PLATFORM_PACKAGE_PREFIX as PLATFORM_PACKAGE_PREFIX, locate_locateCore as locateCore, locate_packageInstalled as packageInstalled, locate_platformPackageName as platformPackageName };
+  export { type locate_CoreLocation as CoreLocation, type locate_LocateOptions as LocateOptions, locate_inspectRelease as inspectRelease, locate_locateCore as locateCore, locate_overridePath as overridePath };
 }
 
 interface HandshakeResult {
@@ -622,12 +726,31 @@ declare namespace run {
   export { run_DEFAULT_RUN_TIMEOUT_MS as DEFAULT_RUN_TIMEOUT_MS, type run_RunCoreOptions as RunCoreOptions, type run_RunCoreResult as RunCoreResult, run_buildCoreArgs as buildCoreArgs, run_runCore as runCore };
 }
 
+/** Release 分发下的核心视图：用户一眼能看出「版本、下没下、从哪来」。 */
+interface ReleaseStatus {
+    repo: string;
+    tag: string;
+    asset: string;
+    url: string;
+    checksumsUrl: string;
+    cacheDir: string;
+    binaryPath: string;
+    cached: boolean;
+}
 interface CoreStatus {
     state: 'ready' | 'unavailable' | 'incompatible';
     path?: string;
     source?: CoreLocation['source'];
-    packageName: string;
-    packageInstalled: boolean;
+    /** Release 分发状态（有覆盖路径时只有 override，没有 release）。 */
+    release?: ReleaseStatus;
+    override?: {
+        path: string;
+        source: 'settings' | 'env';
+    };
+    download: {
+        state: 'cached' | 'missing' | 'override';
+        reason?: string;
+    };
     version?: string;
     commit?: string;
     ipcSchema?: number;
@@ -665,11 +788,12 @@ declare function detectCoexistence(ownPath: string | undefined, options?: {
 
 type core_CoexistenceStatus = CoexistenceStatus;
 type core_CoreStatus = CoreStatus;
+type core_ReleaseStatus = ReleaseStatus;
 declare const core_detectCoexistence: typeof detectCoexistence;
 declare const core_findOnPath: typeof findOnPath;
 declare const core_inspectCore: typeof inspectCore;
 declare namespace core {
-  export { type core_CoexistenceStatus as CoexistenceStatus, type core_CoreStatus as CoreStatus, core_detectCoexistence as detectCoexistence, core_findOnPath as findOnPath, core_inspectCore as inspectCore };
+  export { type core_CoexistenceStatus as CoexistenceStatus, type core_CoreStatus as CoreStatus, type core_ReleaseStatus as ReleaseStatus, core_detectCoexistence as detectCoexistence, core_findOnPath as findOnPath, core_inspectCore as inspectCore };
 }
 
 /**
@@ -926,6 +1050,9 @@ interface RunSummary {
     logFile?: string;
     channel?: 'fifo' | 'tmpfile';
     proxy?: boolean;
+    /** 核心从哪来：env/settings 覆盖、缓存、还是本次下载。 */
+    coreSource?: 'settings' | 'env' | 'cache' | 'download';
+    coreTag?: string;
 }
 interface RunRequestOptions {
     dryRun?: boolean;
@@ -1313,4 +1440,4 @@ declare namespace tools {
   export { tools_createTrendingHistoryTool as createTrendingHistoryTool, tools_createTrendingRunTool as createTrendingRunTool };
 }
 
-export { channel, config, core, credentials, errors, exec, handshake$1 as handshake, importCli, ipc, locate, paths, preflight, proxy, quickfill, routes, run, runner, schedule, state, tools };
+export { channel, config, core, credentials, errors, exec, handshake$1 as handshake, importCli, ipc, locate, paths, preflight, proxy, quickfill, release, routes, run, runner, schedule, state, tools };

package/lib/internal.js

@@ -12,13 +12,14 @@ import {
   preflight_exports,
   proxy_exports,
   quickfill_exports,
+  release_exports,
   routes_exports,
   run_exports,
   runner_exports,
   schedule_exports,
   state_exports,
   tools_exports
-} from "./chunk-CWB5L7RW.js";
+} from "./chunk-RXYA5WFW.js";
 import {
   exec_exports
 } from "./chunk-XLIFTAVL.js";
@@ -37,6 +38,7 @@ export {
   preflight_exports as preflight,
   proxy_exports as proxy,
   quickfill_exports as quickfill,
+  release_exports as release,
   routes_exports as routes,
   run_exports as run,
   runner_exports as runner,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@morehao/dsh-github-trending",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "GitHub 趋势日报插件：每天定时 spawn 本地 trendradar 核心，抓取 Trending、生成中文简介与总结，提交到你的仓库并自动合并 PR。",
   "type": "module",
   "main": "lib/index.js",
@@ -43,14 +43,6 @@
     "node": ">=22.20",
     "dsh": ">=0.2.1-rc.3 <0.3.0-0"
   },
-  "optionalDependencies": {
-    "@morehao/trendradar-core-darwin-arm64": "0.1.0",
-    "@morehao/trendradar-core-darwin-x64": "0.1.0",
-    "@morehao/trendradar-core-linux-arm64": "0.1.0",
-    "@morehao/trendradar-core-linux-x64": "0.1.0",
-    "@morehao/trendradar-core-win32-arm64": "0.1.0",
-    "@morehao/trendradar-core-win32-x64": "0.1.0"
-  },
   "peerDependencies": {
     "@deepseek-ai/dsh-tools": ">=0.2.1-rc.3 <0.3.0-0"
   },
@@ -63,6 +55,10 @@
     "bundle": {
       "patch": "./cordis.patch.yml"
     },
+    "core": {
+      "repo": "morehao/trendradar",
+      "version": "0.1.0"
+    },
     "client": {
       "platform": "web",
       "immediately": true,
@@ -80,9 +76,10 @@
     "typecheck": "tsc --noEmit",
     "gen:ipc": "node scripts/gen-ipc-types.mjs",
     "check:contract": "node scripts/sync-contract.mjs --check && node scripts/gen-ipc-types.mjs --check",
+    "check:lockfile": "node scripts/check-lockfile.mjs",
     "test": "node --test \"test/*.test.mjs\"",
     "pretest": "npm run build",
-    "check": "npm run typecheck && npm run check:contract && npm run build && npm test",
+    "check": "npm run typecheck && npm run check:lockfile && npm run check:contract && npm run build && npm test",
     "prepublishOnly": "npm run check"
   },
   "devDependencies": {