@noob-stupid/dsh-plugin-console 0.3.16 → 0.3.18

package/README.md

@@ -166,7 +166,7 @@ Requires: DSH ≥ 0.1.0-rc.6 (web profile, with `dsh-client-modules` / `dsh-host
 - **Real-time progress**: a `DSH-Upgrade` console window pops up showing live pnpm download
   progress; the in-panel progress card shows the waiting time;
 - **Upgrade protection**: failed installs **auto-rollback** (robocopy, backup verified before
-  upgrade), version check catches fake success, 10-min hard timeout, stall detection
+  upgrade), version check catches fake success, 15-min hard timeout, stall detection
   (no debug-log updates → auto switch registry), global trap fallback, and 15-min stale-state
   cleanup — the framework is never left broken;
 - **pnpm channel**: npm-cli.js freezes at startup in the schtasks task environment (0-byte

package/README.zh.md

@@ -152,7 +152,7 @@ git clone https://github.com/Noob-stupid/dsh-plugin-hub /tmp/dsh-plugin-console
 - **实时进度**：升级时弹出 `DSH-Upgrade` 窗口，实时显示 pnpm 下载进度；面板内进度卡片
   同步显示等待时长；
 - **升级保护**：失败**自动回滚**（robocopy，升级前校验回滚点有效）、版本校验防假成功、
-  10 分钟硬超时、卡死检测（debug 日志无更新自动切换 registry）、全局异常兜底、
+  15 分钟硬超时、卡死检测（debug 日志无更新自动切换 registry）、全局异常兜底、
   15 分钟残留状态清理——框架绝不处于损坏状态；
 - **pnpm 通道**：npm-cli.js 在 schtasks 任务环境启动即卡死（debug 日志 0 字节、网络请求
   都发不出）；升级改用 `corepack pnpm`（实测 0.4s 秒启动、11.5s 装完 rc.8）+ **国内源

package/lib/index.js

@@ -236,7 +236,6 @@ function postJsonUrl(url, formBody) {
         'user-agent': GITHUB_UA,
         accept: 'application/json',
       },
-      rejectUnauthorized: false,
       timeout: 20000,
     }, (res) => {
       const chunks = []
@@ -377,6 +376,8 @@ function cleanupStalePackageDir(profileDir, packageName) {
 
 /** 软件源配置文件（registry 列表，安装链按主→备依次尝试）。 */
 const SOURCES_FILE = join(dshHome(), 'plugin-console-sources.json')
+/** 敏感凭据单独落盘（避免与可分享配置混存）：自定义搜索源 headers + Gitee secret/token。 */
+const SOURCES_SECRETS_FILE = join(dshHome(), 'plugin-console-sources.secrets.json')
 const DEFAULT_SOURCES = {
   registries: [
     { id: 'npmmirror', name: 'npmmirror（国内镜像）', url: 'https://registry.npmmirror.com', primary: true },
@@ -425,6 +426,7 @@ function readSources() {
   const defaults = JSON.parse(JSON.stringify(DEFAULT_SOURCES))
   try {
     const data = JSON.parse(readFileSync(SOURCES_FILE, 'utf8'))
+    const secrets = readSourceSecrets()
     const registries = (Array.isArray(data.registries) ? data.registries : [])
       .filter((r) => r && typeof r.url === 'string' && isAllowedSourceUrl(r.url))
       .map((r) => ({
@@ -439,13 +441,18 @@ function readSources() {
           return { id: String(s.id), name: String(s.name ?? s.id), type: 'builtin' }
         }
         if (s && typeof s.url === 'string' && s.url.includes('{q}')) {
-          const headers = {}
-          if (Array.isArray(s.headers)) {
+          let headers = {}
+          const secretHeaders = secrets.headers?.[s.id]
+          if (secretHeaders && typeof secretHeaders === 'object') {
+            headers = { ...secretHeaders }
+          } else if (Array.isArray(s.headers)) {
             for (const h of s.headers) {
               if (h && typeof h.name === 'string' && h.name !== '' && typeof h.value === 'string') {
                 headers[h.name] = h.value
               }
             }
+          } else if (s.headers && typeof s.headers === 'object') {
+            headers = { ...s.headers }
           }
           return {
             id: String(s.id ?? `search-${Math.random().toString(36).slice(2, 8)}`).slice(0, 40),
@@ -458,16 +465,58 @@ function readSources() {
         return null
       })
       .filter((s) => s !== null)
+    const giteeBase = readGiteeConfig(data)
+    const gitee = {
+      ...giteeBase,
+      clientSecret: secrets.gitee?.clientSecret ?? giteeBase.clientSecret,
+      token: secrets.gitee?.token ?? giteeBase.token,
+    }
     if (registries.length > 0) {
       if (!registries.some((r) => r.primary)) registries[0].primary = true
-      return { registries, searchSources, gitee: readGiteeConfig(data) }
+      return { registries, searchSources, gitee }
     }
   } catch {}
   return defaults
 }
 
+function readSourceSecrets() {
+  try {
+    const data = JSON.parse(readFileSync(SOURCES_SECRETS_FILE, 'utf8'))
+    return data && typeof data === 'object' ? data : {}
+  } catch {
+    return {}
+  }
+}
+
+async function writeSourceSecrets(secrets) {
+  const gitee = secrets.gitee ?? {}
+  const headers = secrets.headers ?? {}
+  const hasGitee = typeof gitee.clientSecret === 'string' && gitee.clientSecret !== '' || typeof gitee.token === 'string' && gitee.token !== ''
+  const hasHeaders = Object.keys(headers).some((id) => { const h = headers[id]; return h && typeof h === 'object' && Object.keys(h).length > 0 })
+  if (!hasGitee && !hasHeaders) {
+    try { rmSync(SOURCES_SECRETS_FILE, { force: true }) } catch {}
+    return
+  }
+  await writeFile(SOURCES_SECRETS_FILE, JSON.stringify({ gitee, headers }, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 })
+}
 async function writeSources(sources) {
-  await writeFile(SOURCES_FILE, JSON.stringify(sources, null, 2) + '\n', 'utf8')
+  const secrets = { gitee: {}, headers: {} }
+  const cleanSearch = (sources.searchSources ?? []).map((s) => {
+    if (!s) return s
+    if (s.headers && typeof s.headers === 'object' && Object.keys(s.headers).length > 0) {
+      secrets.headers[s.id] = { ...s.headers }
+      const { headers, ...rest } = s
+      return rest
+    }
+    return s
+  })
+  const gitee = readGiteeConfig(sources)
+  if (typeof gitee.clientSecret === 'string' && gitee.clientSecret !== '') secrets.gitee.clientSecret = gitee.clientSecret
+  if (typeof gitee.token === 'string' && gitee.token !== '') secrets.gitee.token = gitee.token
+  const cleanGitee = { ...(sources.gitee ?? {}), clientSecret: undefined, token: undefined }
+  const main = { ...sources, searchSources: cleanSearch, gitee: cleanGitee }
+  await writeFile(SOURCES_FILE, JSON.stringify(main, null, 2) + '\n', 'utf8')
+  await writeSourceSecrets(secrets)
 }
 
 /**
@@ -900,6 +949,25 @@ function isLoopback(address) {
   return address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1'
 }
 
+/** 写请求跨站防护：浏览器同源策略不阻止跨站发送，必须校验 Origin / Sec-Fetch-Site。
+ * 非浏览器客户端（无 Origin/Sec-Fetch-Site 头）仍允许，避免 curl/脚本/测试被误伤。 */
+function isAllowedWriteOrigin(req, port) {
+  const origin = typeof req.headers?.origin === 'string' ? req.headers.origin : null
+  const site = typeof req.headers?.['sec-fetch-site'] === 'string' ? req.headers['sec-fetch-site'] : null
+  if (origin !== null && origin !== '' && !ALLOWED_LOCAL_ORIGINS(port).has(origin)) return false
+  if (site !== null && site !== 'same-origin' && site !== 'none') return false
+  return true
+}
+
+function ALLOWED_LOCAL_ORIGINS(port) {
+  return new Set([
+    `http://127.0.0.1:${port}`,
+    `http://localhost:${port}`,
+    `http://[::1]:${port}`,
+  ])
+}
+
+
 function sendJson(res, status, body) {
   const payload = JSON.stringify(body)
   res.writeHead(status, {
@@ -939,7 +1007,6 @@ function githubRequestOnce(url, { signal, accept, token, timeout = 20000 } = {})
         accept: accept ?? 'application/vnd.github+json',
         ...(token ? { authorization: `Bearer ${token}` } : {}),
       },
-      rejectUnauthorized: false,
     }, resolve)
     req.on('error', reject)
     req.setTimeout(timeout, () => req.destroy(new Error('GitHub 请求超时')))
@@ -1124,7 +1191,7 @@ async function githubText(url, signal, token = null) {
 /** 用 curl 子进程请求 JSON（绕过本机中间设备对 node:https TLS 指纹的拦截；curl 走系统网络栈）。 */
 async function curlJson(url, timeout = 15000, headers = {}) {
   const bin = process.platform === 'win32' ? 'curl.exe' : 'curl'
-  const args = ['-s', '-m', String(Math.max(5, Math.ceil(timeout / 1000))), '--insecure', '-H', 'accept: application/json', '-w', '\n__HTTP__%{http_code}']
+  const args = ['-s', '-m', String(Math.max(5, Math.ceil(timeout / 1000))), '-H', 'accept: application/json', '-w', '\n__HTTP__%{http_code}']
   for (const [key, value] of Object.entries(headers)) args.push('-H', `${key}: ${value}`)
   args.push(url)
   const { stdout } = await execFileAsync(bin, args, { timeout: timeout + 3000, windowsHide: true, maxBuffer: 8 * 1024 * 1024 })
@@ -1140,7 +1207,7 @@ async function curlText(url, timeout = 10000) {
   const bin = process.platform === 'win32' ? 'curl.exe' : 'curl'
   const { stdout } = await execFileAsync(
     bin,
-    ['-s', '-m', String(Math.max(3, Math.ceil(timeout / 1000))), '--insecure', '-H', 'accept: text/plain', '-w', '\n__HTTP__%{http_code}', url],
+    ['-s', '-m', String(Math.max(3, Math.ceil(timeout / 1000))), '-H', 'accept: text/plain', '-w', '\n__HTTP__%{http_code}', url],
     { timeout: timeout + 3000, windowsHide: true, maxBuffer: 8 * 1024 * 1024 },
   )
   const m = String(stdout).match(/\n__HTTP__(\d+)\s*$/u)
@@ -2559,6 +2626,18 @@ export function apply(ctx) {
           sendError(res, 403, '仅允许本机访问')
           return
         }
+        const port = webPort(ctx)
+        const host = typeof req.headers?.host === 'string' ? req.headers.host : ''
+        if (![`127.0.0.1:${port}`, `localhost:${port}`, `[::1]:${port}`].includes(host)) {
+          sendError(res, 403, 'Host 校验失败（仅允许本机访问）')
+          return
+        }
+        // 安全护栏（issue #9）：写路由必须是本机同源请求，防止恶意网页跨站驱动敏感操作。
+        const method = req.method ?? 'GET'
+        if (method !== 'GET' && method !== 'HEAD' && !isAllowedWriteOrigin(req, port)) {
+          sendError(res, 403, '跨站请求被拒绝（Origin/Sec-Fetch-Site 校验）')
+          return
+        }
         try {
           await handle(ctx, req, res)
         } catch (error) {
@@ -3445,18 +3524,18 @@ async function handle(ctx, req, res) {
         `Set-Location -Path ${ps(dirname(dshDir))}`,
         // npm 安装函数：Start-Process 跑 npm-cli.js（唯一正确入口——lib/cli.js 是函数模块，
         // 直跑只加载不执行，假成功 exit 0）+ --force（显式指定版本但已在 package.json 的
-        // semver 范围内时 npm 会跳过安装，假成功）+ 10 分钟总时长硬超时。注意：**不能加
+        // semver 范围内时 npm 会跳过安装，假成功）+ 15 分钟总时长硬超时。注意：**不能加
         // -RedirectStandardOutput/-RedirectStandardError**——schtasks 任务环境下带重定向的
         // Start-Process 子进程会启动即异常退出（ExitCode 读不到、输出 0 字节，实测）；
         // 无重定向时 ExitCode 正常（实测 exit=0）。npm 自身 debug 日志（cache\_logs）留档。
-        // 超时策略：总时长 10 分钟硬上限 + npm debug 日志 5 分钟无更新判定卡死（网络黑洞/挂起时
-        // 快速失败换 registry，不用干等 10 分钟）；等待期间每 15 秒更新进度状态（客户端可见）。
+        // 超时策略：总时长 15 分钟硬上限 + npm debug 日志 5 分钟无更新判定卡死（网络黑洞/挂起时
+        // 快速失败换 registry，不用干等 15 分钟）；等待期间每 15 秒更新进度状态（客户端可见）。
         // 成功后校验 package.json 版本 === target（防 npm 假成功）。
         // 另注意：npm install 在 schtasks 环境启动慢（约 1-2 分钟 0 日志，初始化/编译缓存），
         // 属正常，5 分钟卡死阈值不会误杀。
         `function Install-Framework($reg) {`,
         `  $startAt = Get-Date`,
-        `  $deadline = $startAt.AddMinutes(10)`,
+        `  $deadline = $startAt.AddMinutes(15)`,
         `  $stallDeadline = $startAt.AddMinutes(5)`,
         `  $lastLogM = (Get-Date)`,
         `  $logSeen = $false`,
@@ -3493,7 +3572,7 @@ async function handle(ctx, req, res) {
         `    }`,
         `  }`,
         `  if (-not $done) {`,
-        `    Log 'pnpm 超过 10 分钟未完成，判定超时'`,
+        `    Log 'pnpm 超过 15 分钟未完成，判定超时'`,
         `    try { taskkill /F /FI "WINDOWTITLE eq DSH-Upgrade" 2>$null | Out-Null } catch {}`,
         `    return 1`,
         `  }`,
@@ -3609,10 +3688,10 @@ async function handle(ctx, req, res) {
         `      $tgz = Join-Path $tmpDir 'pkg.tgz'`,
         `      $encName = $name.Replace('/','%2f')`,
         `      $url = 'https://registry.npmmirror.com/' + $encName + '/-/' + $short + '-' + $refVersion + '.tgz'`,
-        `      curl.exe -s -L -m 60 --insecure -o $tgz $url`,
+        `      curl.exe -s -L -m 60 -o $tgz $url`,
         `      if (-not (Test-Path $tgz) -or (Get-Item $tgz).Length -lt 1000) {`,
         `        $url = 'https://registry.npmjs.org/' + $encName + '/-/' + $short + '-' + $refVersion + '.tgz'`,
-        `        curl.exe -s -L -m 60 --insecure -o $tgz $url`,
+        `        curl.exe -s -L -m 60 -o $tgz $url`,
         `      }`,
         `      if (-not (Test-Path $tgz) -or (Get-Item $tgz).Length -lt 1000) { Remove-Item $tmpDir -Recurse -Force -ErrorAction SilentlyContinue; continue }`,
         `      tar -xzf $tgz -C $tmpDir`,

package/package.json

@@ -1,39 +1,39 @@
-{
-    "name": "@noob-stupid/dsh-plugin-console",
-    "version": "0.3.16",
-    "description": "DSH plugin management panel & marketplace: one-click enable/disable, multi-source market (GitHub/Gitee/custom), static-index market (500+ plugins / 300 skills), skills, suites, and one-click framework upgrade.",
-    "repository": {
-        "type": "git",
-        "url": "https://github.com/Noob-stupid/dsh-plugin-hub"
-    },
-    "type": "module",
-    "main": "./lib/index.js",
-    "exports": {
-        ".": "./lib/index.js",
-        "./client": "./lib/client.js",
-        "./package.json": "./package.json"
-    },
-    "keywords": [
-        "dsh-plugin",
-        "deepseek-harness",
-        "plugin-manager"
-    ],
-    "dsh": {
-        "bundle": {
-            "patch": "./cordis.patch.yml"
-        },
-        "client": {
-            "platform": "web",
-            "inject": [
-                "@deepseek-ai/dsh-client-runtime",
-                "@deepseek-ai/dsh-client-locale",
-                "@deepseek-ai/dsh-client-ui-settings"
-            ]
-        }
-    },
-    "files": [
-        "lib",
-        "cordis.patch.yml"
-    ],
-    "license": "MIT"
-}
+{
+    "name": "@noob-stupid/dsh-plugin-console",
+    "version": "0.3.18",
+    "description": "DSH plugin management panel & marketplace: one-click enable/disable, multi-source market (GitHub/Gitee/custom), static-index market (500+ plugins / 300 skills), skills, suites, and one-click framework upgrade.",
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/Noob-stupid/dsh-plugin-hub"
+    },
+    "type": "module",
+    "main": "./lib/index.js",
+    "exports": {
+        ".": "./lib/index.js",
+        "./client": "./lib/client.js",
+        "./package.json": "./package.json"
+    },
+    "keywords": [
+        "dsh-plugin",
+        "deepseek-harness",
+        "plugin-manager"
+    ],
+    "dsh": {
+        "bundle": {
+            "patch": "./cordis.patch.yml"
+        },
+        "client": {
+            "platform": "web",
+            "inject": [
+                "@deepseek-ai/dsh-client-runtime",
+                "@deepseek-ai/dsh-client-locale",
+                "@deepseek-ai/dsh-client-ui-settings"
+            ]
+        }
+    },
+    "files": [
+        "lib",
+        "cordis.patch.yml"
+    ],
+    "license": "MIT"
+}