@noob-stupid/dsh-plugin-console 0.3.15 → 0.3.18

package/README.md

@@ -166,7 +166,7 @@ Requires: DSH ≥ 0.1.0-rc.6 (web profile, with `dsh-client-modules` / `dsh-host
 - **Real-time progress**: a `DSH-Upgrade` console window pops up showing live pnpm download
   progress; the in-panel progress card shows the waiting time;
 - **Upgrade protection**: failed installs **auto-rollback** (robocopy, backup verified before
-  upgrade), version check catches fake success, 10-min hard timeout, stall detection
+  upgrade), version check catches fake success, 15-min hard timeout, stall detection
   (no debug-log updates → auto switch registry), global trap fallback, and 15-min stale-state
   cleanup — the framework is never left broken;
 - **pnpm channel**: npm-cli.js freezes at startup in the schtasks task environment (0-byte

package/README.zh.md

@@ -152,7 +152,7 @@ git clone https://github.com/Noob-stupid/dsh-plugin-hub /tmp/dsh-plugin-console
 - **实时进度**：升级时弹出 `DSH-Upgrade` 窗口，实时显示 pnpm 下载进度；面板内进度卡片
   同步显示等待时长；
 - **升级保护**：失败**自动回滚**（robocopy，升级前校验回滚点有效）、版本校验防假成功、
-  10 分钟硬超时、卡死检测（debug 日志无更新自动切换 registry）、全局异常兜底、
+  15 分钟硬超时、卡死检测（debug 日志无更新自动切换 registry）、全局异常兜底、
   15 分钟残留状态清理——框架绝不处于损坏状态；
 - **pnpm 通道**：npm-cli.js 在 schtasks 任务环境启动即卡死（debug 日志 0 字节、网络请求
   都发不出）；升级改用 `corepack pnpm`（实测 0.4s 秒启动、11.5s 装完 rc.8）+ **国内源

package/lib/index.js

@@ -236,7 +236,6 @@ function postJsonUrl(url, formBody) {
         'user-agent': GITHUB_UA,
         accept: 'application/json',
       },
-      rejectUnauthorized: false,
       timeout: 20000,
     }, (res) => {
       const chunks = []
@@ -377,6 +376,8 @@ function cleanupStalePackageDir(profileDir, packageName) {
 
 /** 软件源配置文件（registry 列表，安装链按主→备依次尝试）。 */
 const SOURCES_FILE = join(dshHome(), 'plugin-console-sources.json')
+/** 敏感凭据单独落盘（避免与可分享配置混存）：自定义搜索源 headers + Gitee secret/token。 */
+const SOURCES_SECRETS_FILE = join(dshHome(), 'plugin-console-sources.secrets.json')
 const DEFAULT_SOURCES = {
   registries: [
     { id: 'npmmirror', name: 'npmmirror（国内镜像）', url: 'https://registry.npmmirror.com', primary: true },
@@ -425,6 +426,7 @@ function readSources() {
   const defaults = JSON.parse(JSON.stringify(DEFAULT_SOURCES))
   try {
     const data = JSON.parse(readFileSync(SOURCES_FILE, 'utf8'))
+    const secrets = readSourceSecrets()
     const registries = (Array.isArray(data.registries) ? data.registries : [])
       .filter((r) => r && typeof r.url === 'string' && isAllowedSourceUrl(r.url))
       .map((r) => ({
@@ -439,13 +441,18 @@ function readSources() {
           return { id: String(s.id), name: String(s.name ?? s.id), type: 'builtin' }
         }
         if (s && typeof s.url === 'string' && s.url.includes('{q}')) {
-          const headers = {}
-          if (Array.isArray(s.headers)) {
+          let headers = {}
+          const secretHeaders = secrets.headers?.[s.id]
+          if (secretHeaders && typeof secretHeaders === 'object') {
+            headers = { ...secretHeaders }
+          } else if (Array.isArray(s.headers)) {
             for (const h of s.headers) {
               if (h && typeof h.name === 'string' && h.name !== '' && typeof h.value === 'string') {
                 headers[h.name] = h.value
               }
             }
+          } else if (s.headers && typeof s.headers === 'object') {
+            headers = { ...s.headers }
           }
           return {
             id: String(s.id ?? `search-${Math.random().toString(36).slice(2, 8)}`).slice(0, 40),
@@ -458,16 +465,58 @@ function readSources() {
         return null
       })
       .filter((s) => s !== null)
+    const giteeBase = readGiteeConfig(data)
+    const gitee = {
+      ...giteeBase,
+      clientSecret: secrets.gitee?.clientSecret ?? giteeBase.clientSecret,
+      token: secrets.gitee?.token ?? giteeBase.token,
+    }
     if (registries.length > 0) {
       if (!registries.some((r) => r.primary)) registries[0].primary = true
-      return { registries, searchSources, gitee: readGiteeConfig(data) }
+      return { registries, searchSources, gitee }
     }
   } catch {}
   return defaults
 }
 
+function readSourceSecrets() {
+  try {
+    const data = JSON.parse(readFileSync(SOURCES_SECRETS_FILE, 'utf8'))
+    return data && typeof data === 'object' ? data : {}
+  } catch {
+    return {}
+  }
+}
+
+async function writeSourceSecrets(secrets) {
+  const gitee = secrets.gitee ?? {}
+  const headers = secrets.headers ?? {}
+  const hasGitee = typeof gitee.clientSecret === 'string' && gitee.clientSecret !== '' || typeof gitee.token === 'string' && gitee.token !== ''
+  const hasHeaders = Object.keys(headers).some((id) => { const h = headers[id]; return h && typeof h === 'object' && Object.keys(h).length > 0 })
+  if (!hasGitee && !hasHeaders) {
+    try { rmSync(SOURCES_SECRETS_FILE, { force: true }) } catch {}
+    return
+  }
+  await writeFile(SOURCES_SECRETS_FILE, JSON.stringify({ gitee, headers }, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 })
+}
 async function writeSources(sources) {
-  await writeFile(SOURCES_FILE, JSON.stringify(sources, null, 2) + '\n', 'utf8')
+  const secrets = { gitee: {}, headers: {} }
+  const cleanSearch = (sources.searchSources ?? []).map((s) => {
+    if (!s) return s
+    if (s.headers && typeof s.headers === 'object' && Object.keys(s.headers).length > 0) {
+      secrets.headers[s.id] = { ...s.headers }
+      const { headers, ...rest } = s
+      return rest
+    }
+    return s
+  })
+  const gitee = readGiteeConfig(sources)
+  if (typeof gitee.clientSecret === 'string' && gitee.clientSecret !== '') secrets.gitee.clientSecret = gitee.clientSecret
+  if (typeof gitee.token === 'string' && gitee.token !== '') secrets.gitee.token = gitee.token
+  const cleanGitee = { ...(sources.gitee ?? {}), clientSecret: undefined, token: undefined }
+  const main = { ...sources, searchSources: cleanSearch, gitee: cleanGitee }
+  await writeFile(SOURCES_FILE, JSON.stringify(main, null, 2) + '\n', 'utf8')
+  await writeSourceSecrets(secrets)
 }
 
 /**
@@ -520,6 +569,30 @@ function queuedWrite(fn) {
   return run
 }
 
+/** 解析 DSH 框架版本号为可比较对象；正式版（无预发布段）视为 rc.∞。 */
+function parseFrameworkVersion(value) {
+  const m = String(value ?? '').match(/^(\d+)\.(\d+)\.(\d+)(?:-(?:[a-z]+\.)?(\d+))?$/iu)
+  if (!m) return -1
+  const [, maj, min, pat, rc] = m
+  return {
+    maj: Number.parseInt(maj, 10),
+    min: Number.parseInt(min, 10),
+    pat: Number.parseInt(pat, 10),
+    rc: rc === undefined ? Number.POSITIVE_INFINITY : Number.parseInt(rc, 10),
+  }
+}
+
+/** 判断 candidate 是否比 current 更新（候选与当前必须是合法版本号，否则视为不可比）。 */
+function isFrameworkVersionNewer(candidate, current) {
+  const a = parseFrameworkVersion(candidate)
+  const b = parseFrameworkVersion(current)
+  if (a === -1 || b === -1) return false
+  if (a.maj !== b.maj) return a.maj > b.maj
+  if (a.min !== b.min) return a.min > b.min
+  if (a.pat !== b.pat) return a.pat > b.pat
+  return a.rc > b.rc
+}
+
 /** 默认 profile 用户补丁层路径（无 include 条目可推导时的兜底）。 */
 function defaultPatchPath() {
   const home = dshHome()
@@ -876,6 +949,25 @@ function isLoopback(address) {
   return address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1'
 }
 
+/** 写请求跨站防护：浏览器同源策略不阻止跨站发送，必须校验 Origin / Sec-Fetch-Site。
+ * 非浏览器客户端（无 Origin/Sec-Fetch-Site 头）仍允许，避免 curl/脚本/测试被误伤。 */
+function isAllowedWriteOrigin(req, port) {
+  const origin = typeof req.headers?.origin === 'string' ? req.headers.origin : null
+  const site = typeof req.headers?.['sec-fetch-site'] === 'string' ? req.headers['sec-fetch-site'] : null
+  if (origin !== null && origin !== '' && !ALLOWED_LOCAL_ORIGINS(port).has(origin)) return false
+  if (site !== null && site !== 'same-origin' && site !== 'none') return false
+  return true
+}
+
+function ALLOWED_LOCAL_ORIGINS(port) {
+  return new Set([
+    `http://127.0.0.1:${port}`,
+    `http://localhost:${port}`,
+    `http://[::1]:${port}`,
+  ])
+}
+
+
 function sendJson(res, status, body) {
   const payload = JSON.stringify(body)
   res.writeHead(status, {
@@ -915,7 +1007,6 @@ function githubRequestOnce(url, { signal, accept, token, timeout = 20000 } = {})
         accept: accept ?? 'application/vnd.github+json',
         ...(token ? { authorization: `Bearer ${token}` } : {}),
       },
-      rejectUnauthorized: false,
     }, resolve)
     req.on('error', reject)
     req.setTimeout(timeout, () => req.destroy(new Error('GitHub 请求超时')))
@@ -1100,7 +1191,7 @@ async function githubText(url, signal, token = null) {
 /** 用 curl 子进程请求 JSON（绕过本机中间设备对 node:https TLS 指纹的拦截；curl 走系统网络栈）。 */
 async function curlJson(url, timeout = 15000, headers = {}) {
   const bin = process.platform === 'win32' ? 'curl.exe' : 'curl'
-  const args = ['-s', '-m', String(Math.max(5, Math.ceil(timeout / 1000))), '--insecure', '-H', 'accept: application/json', '-w', '\n__HTTP__%{http_code}']
+  const args = ['-s', '-m', String(Math.max(5, Math.ceil(timeout / 1000))), '-H', 'accept: application/json', '-w', '\n__HTTP__%{http_code}']
   for (const [key, value] of Object.entries(headers)) args.push('-H', `${key}: ${value}`)
   args.push(url)
   const { stdout } = await execFileAsync(bin, args, { timeout: timeout + 3000, windowsHide: true, maxBuffer: 8 * 1024 * 1024 })
@@ -1116,7 +1207,7 @@ async function curlText(url, timeout = 10000) {
   const bin = process.platform === 'win32' ? 'curl.exe' : 'curl'
   const { stdout } = await execFileAsync(
     bin,
-    ['-s', '-m', String(Math.max(3, Math.ceil(timeout / 1000))), '--insecure', '-H', 'accept: text/plain', '-w', '\n__HTTP__%{http_code}', url],
+    ['-s', '-m', String(Math.max(3, Math.ceil(timeout / 1000))), '-H', 'accept: text/plain', '-w', '\n__HTTP__%{http_code}', url],
     { timeout: timeout + 3000, windowsHide: true, maxBuffer: 8 * 1024 * 1024 },
   )
   const m = String(stdout).match(/\n__HTTP__(\d+)\s*$/u)
@@ -2535,6 +2626,18 @@ export function apply(ctx) {
           sendError(res, 403, '仅允许本机访问')
           return
         }
+        const port = webPort(ctx)
+        const host = typeof req.headers?.host === 'string' ? req.headers.host : ''
+        if (![`127.0.0.1:${port}`, `localhost:${port}`, `[::1]:${port}`].includes(host)) {
+          sendError(res, 403, 'Host 校验失败（仅允许本机访问）')
+          return
+        }
+        // 安全护栏（issue #9）：写路由必须是本机同源请求，防止恶意网页跨站驱动敏感操作。
+        const method = req.method ?? 'GET'
+        if (method !== 'GET' && method !== 'HEAD' && !isAllowedWriteOrigin(req, port)) {
+          sendError(res, 403, '跨站请求被拒绝（Origin/Sec-Fetch-Site 校验）')
+          return
+        }
         try {
           await handle(ctx, req, res)
         } catch (error) {
@@ -3331,10 +3434,11 @@ async function handle(ctx, req, res) {
       // 网络黑洞/超时：区分「检测失败」与「无更新」，避免误导用户以为已是最新
       registryError = error instanceof Error ? error.message : String(error)
     }
-    // 升级目标：稳定版 latest 优先；latest 与当前相同而 next（预发布渠道）更新时，目标取 next
-    const target = latest !== null && current !== null && latest !== current
+    // 升级目标：稳定版 latest 优先；latest 不高于当前而 next（预发布渠道）确实更新时，目标取 next。
+    // 必须用版本号比较而不是字符串不等（避免 current=0.1.1 稳定版时被 next=0.1.1-rc.3 反向降级）。
+    const target = latest !== null && current !== null && isFrameworkVersionNewer(latest, current)
       ? latest
-      : (next !== null && current !== null && next !== current ? next : null)
+      : (next !== null && current !== null && isFrameworkVersionNewer(next, current) ? next : null)
     const profileDir = dirname(findPatchPath(ctx))
     // 1) 升级前打包备份现有配置（patch / profile package.json / 插件清单）
     let backupDir = null
@@ -3420,18 +3524,18 @@ async function handle(ctx, req, res) {
         `Set-Location -Path ${ps(dirname(dshDir))}`,
         // npm 安装函数：Start-Process 跑 npm-cli.js（唯一正确入口——lib/cli.js 是函数模块，
         // 直跑只加载不执行，假成功 exit 0）+ --force（显式指定版本但已在 package.json 的
-        // semver 范围内时 npm 会跳过安装，假成功）+ 10 分钟总时长硬超时。注意：**不能加
+        // semver 范围内时 npm 会跳过安装，假成功）+ 15 分钟总时长硬超时。注意：**不能加
         // -RedirectStandardOutput/-RedirectStandardError**——schtasks 任务环境下带重定向的
         // Start-Process 子进程会启动即异常退出（ExitCode 读不到、输出 0 字节，实测）；
         // 无重定向时 ExitCode 正常（实测 exit=0）。npm 自身 debug 日志（cache\_logs）留档。
-        // 超时策略：总时长 10 分钟硬上限 + npm debug 日志 5 分钟无更新判定卡死（网络黑洞/挂起时
-        // 快速失败换 registry，不用干等 10 分钟）；等待期间每 15 秒更新进度状态（客户端可见）。
+        // 超时策略：总时长 15 分钟硬上限 + npm debug 日志 5 分钟无更新判定卡死（网络黑洞/挂起时
+        // 快速失败换 registry，不用干等 15 分钟）；等待期间每 15 秒更新进度状态（客户端可见）。
         // 成功后校验 package.json 版本 === target（防 npm 假成功）。
         // 另注意：npm install 在 schtasks 环境启动慢（约 1-2 分钟 0 日志，初始化/编译缓存），
         // 属正常，5 分钟卡死阈值不会误杀。
         `function Install-Framework($reg) {`,
         `  $startAt = Get-Date`,
-        `  $deadline = $startAt.AddMinutes(10)`,
+        `  $deadline = $startAt.AddMinutes(15)`,
         `  $stallDeadline = $startAt.AddMinutes(5)`,
         `  $lastLogM = (Get-Date)`,
         `  $logSeen = $false`,
@@ -3468,7 +3572,7 @@ async function handle(ctx, req, res) {
         `    }`,
         `  }`,
         `  if (-not $done) {`,
-        `    Log 'pnpm 超过 10 分钟未完成，判定超时'`,
+        `    Log 'pnpm 超过 15 分钟未完成，判定超时'`,
         `    try { taskkill /F /FI "WINDOWTITLE eq DSH-Upgrade" 2>$null | Out-Null } catch {}`,
         `    return 1`,
         `  }`,
@@ -3583,8 +3687,12 @@ async function handle(ctx, req, res) {
         `      New-Item -ItemType Directory -Path $tmpDir -Force | Out-Null`,
         `      $tgz = Join-Path $tmpDir 'pkg.tgz'`,
         `      $encName = $name.Replace('/','%2f')`,
-        `      $url = 'https://registry.npmjs.org/' + $encName + '/-/' + $short + '-' + $refVersion + '.tgz'`,
+        `      $url = 'https://registry.npmmirror.com/' + $encName + '/-/' + $short + '-' + $refVersion + '.tgz'`,
         `      curl.exe -s -L -m 60 -o $tgz $url`,
+        `      if (-not (Test-Path $tgz) -or (Get-Item $tgz).Length -lt 1000) {`,
+        `        $url = 'https://registry.npmjs.org/' + $encName + '/-/' + $short + '-' + $refVersion + '.tgz'`,
+        `        curl.exe -s -L -m 60 -o $tgz $url`,
+        `      }`,
         `      if (-not (Test-Path $tgz) -or (Get-Item $tgz).Length -lt 1000) { Remove-Item $tmpDir -Recurse -Force -ErrorAction SilentlyContinue; continue }`,
         `      tar -xzf $tgz -C $tmpDir`,
         `      $ver = (Get-Content (Join-Path $tmpDir 'package\\package.json') -Raw | ConvertFrom-Json).version`,
@@ -3612,6 +3720,10 @@ async function handle(ctx, req, res) {
         `  $indexJs = Join-Path $selfDir 'lib\\index.js'`,
         `  $clientJs = Join-Path $selfDir 'lib\\client.js'`,
         `  if (-not (Test-Path $indexJs)) { Log ('自报名校验跳过：index.js 未找到'); return }`,
+        `  # 计算部署目录的完整包名（scoped 包为 @scope/name，非 scoped 包为 name）`,
+        `  $leaf = Split-Path $selfDir -Leaf`,
+        `  $parentLeaf = Split-Path (Split-Path $selfDir -Parent) -Leaf`,
+        `  if ($parentLeaf.StartsWith('@')) { $deployName = $parentLeaf + '/' + $leaf } else { $deployName = $leaf }`,
         `  $idx = Get-Content $indexJs -Raw`,
         `  $nameOk = $idx.Contains("export const name = '" + $expectedName + "'")`,
         `  $clientOk = $true`,
@@ -3619,7 +3731,8 @@ async function handle(ctx, req, res) {
         `    $cli = Get-Content $clientJs -Raw`,
         `    $clientOk = $cli.Contains('id: "' + $expectedName + '"')`,
         `  }`,
-        `  if ($nameOk -and $clientOk) { Log ('自报名一致性 OK：' + $expectedName) } else { Log ('⚠️ 自报名一致性异常：部署目录=' + (Split-Path $selfDir -Leaf) + '，期望 ' + $expectedName + '（index=' + $nameOk + ' client=' + $clientOk + '）——请检查部署目录与包名是否匹配') }`,
+        `  $dirOk = ($deployName -eq $expectedName)`,
+        `  if ($nameOk -and $clientOk -and $dirOk) { Log ('自报名一致性 OK：' + $expectedName + ' @ ' + $deployName) } else { Log ('⚠️ 自报名一致性异常：部署目录=' + $deployName + '，期望 ' + $expectedName + '（index=' + $nameOk + ' client=' + $clientOk + ' dir=' + $dirOk + '）——请检查部署目录与包名是否匹配') }`,
         `}`,
         `Verify-SelfNameConsistency '${selfName ?? '@noob-stupid/dsh-plugin-console'}'`,
         pkgArgs.length > 0 ? `SetState 'pkg' '更新官方配套包…'\n  Log '更新官方配套包…'\n  Set-Location -Path ${ps(profileDir2)}\n  if (Test-Path ${ps(corepackJs)}) {\n    $pp = Start-Process -FilePath ${ps(nodePath)} -ArgumentList @(${ps(corepackJs)}, 'pnpm', 'update', ${pkgArgs.join(', ')}, '--no-optional', '--registry', 'https://registry.npmmirror.com') -PassThru -WindowStyle Hidden\n    if (-not $pp.WaitForExit(300000)) { Stop-Process -Id $pp.Id -Force -ErrorAction SilentlyContinue; Log '官方配套包更新超时（5 分钟），已跳过' } else { try { Log ('官方配套包更新结束（exit=' + $pp.ExitCode + '）') } catch { Log '官方配套包更新结束（退出码读取失败）' } }\n  }` : '',

package/package.json

@@ -1,39 +1,39 @@
-{
-    "name":  "@noob-stupid/dsh-plugin-console",
-    "version":  "0.3.15",
-    "description":  "DSH plugin management panel \u0026 marketplace: one-click enable/disable, multi-source market (GitHub/Gitee/custom), static-index market (500+ plugins / 300 skills), skills, suites, and one-click framework upgrade.",
-    "repository":  {
-                       "type":  "git",
-                       "url":  "https://github.com/Noob-stupid/dsh-plugin-hub"
-                   },
-    "type":  "module",
-    "main":  "./lib/index.js",
-    "exports":  {
-                    ".":  "./lib/index.js",
-                    "./client":  "./lib/client.js",
-                    "./package.json":  "./package.json"
-                },
-    "keywords":  [
-                     "dsh-plugin",
-                     "deepseek-harness",
-                     "plugin-manager"
-                 ],
-    "dsh":  {
-                "bundle":  {
-                               "patch":  "./cordis.patch.yml"
-                           },
-                "client":  {
-                               "platform":  "web",
-                               "inject":  [
-                                              "@deepseek-ai/dsh-client-runtime",
-                                              "@deepseek-ai/dsh-client-locale",
-                                              "@deepseek-ai/dsh-client-ui-settings"
-                                          ]
-                           }
-            },
-    "files":  [
-                  "lib",
-                  "cordis.patch.yml"
-              ],
-    "license":  "MIT"
-}
+{
+    "name": "@noob-stupid/dsh-plugin-console",
+    "version": "0.3.18",
+    "description": "DSH plugin management panel & marketplace: one-click enable/disable, multi-source market (GitHub/Gitee/custom), static-index market (500+ plugins / 300 skills), skills, suites, and one-click framework upgrade.",
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/Noob-stupid/dsh-plugin-hub"
+    },
+    "type": "module",
+    "main": "./lib/index.js",
+    "exports": {
+        ".": "./lib/index.js",
+        "./client": "./lib/client.js",
+        "./package.json": "./package.json"
+    },
+    "keywords": [
+        "dsh-plugin",
+        "deepseek-harness",
+        "plugin-manager"
+    ],
+    "dsh": {
+        "bundle": {
+            "patch": "./cordis.patch.yml"
+        },
+        "client": {
+            "platform": "web",
+            "inject": [
+                "@deepseek-ai/dsh-client-runtime",
+                "@deepseek-ai/dsh-client-locale",
+                "@deepseek-ai/dsh-client-ui-settings"
+            ]
+        }
+    },
+    "files": [
+        "lib",
+        "cordis.patch.yml"
+    ],
+    "license": "MIT"
+}