@noob-stupid/dsh-plugin-console 0.3.16 → 0.3.19

package/README.md

@@ -166,7 +166,7 @@ Requires: DSH ≥ 0.1.0-rc.6 (web profile, with `dsh-client-modules` / `dsh-host
 - **Real-time progress**: a `DSH-Upgrade` console window pops up showing live pnpm download
   progress; the in-panel progress card shows the waiting time;
 - **Upgrade protection**: failed installs **auto-rollback** (robocopy, backup verified before
-  upgrade), version check catches fake success, 10-min hard timeout, stall detection
+  upgrade), version check catches fake success, 15-min hard timeout, stall detection
   (no debug-log updates → auto switch registry), global trap fallback, and 15-min stale-state
   cleanup — the framework is never left broken;
 - **pnpm channel**: npm-cli.js freezes at startup in the schtasks task environment (0-byte

package/README.zh.md

@@ -152,7 +152,7 @@ git clone https://github.com/Noob-stupid/dsh-plugin-hub /tmp/dsh-plugin-console
 - **实时进度**：升级时弹出 `DSH-Upgrade` 窗口，实时显示 pnpm 下载进度；面板内进度卡片
   同步显示等待时长；
 - **升级保护**：失败**自动回滚**（robocopy，升级前校验回滚点有效）、版本校验防假成功、
-  10 分钟硬超时、卡死检测（debug 日志无更新自动切换 registry）、全局异常兜底、
+  15 分钟硬超时、卡死检测（debug 日志无更新自动切换 registry）、全局异常兜底、
   15 分钟残留状态清理——框架绝不处于损坏状态；
 - **pnpm 通道**：npm-cli.js 在 schtasks 任务环境启动即卡死（debug 日志 0 字节、网络请求
   都发不出）；升级改用 `corepack pnpm`（实测 0.4s 秒启动、11.5s 装完 rc.8）+ **国内源

package/lib/client.js

@@ -136,6 +136,7 @@ window.__ModuleLoader__.load({
 			loadingDetails: "正在读取详情…",
 			githubLoggedIn: "已登录 GitHub：",
 			githubCornerOut: "未登录 GitHub",
+			hubUpdateAvailable: "下载更新",
 					searchInstalledPlaceholder: "搜索已安装插件（名称或 id）",
 			extraFilter: "已装",
 			extraFilterAll: "全部",
@@ -370,6 +371,7 @@ window.__ModuleLoader__.load({
 			readmeLabel: "Readme summary",
 			loadingDetails: "Reading details…",
 			githubLoggedIn: "GitHub signed in: ",
+                    hubUpdateAvailable: "Download update",
 			githubCornerOut: "Not signed in to GitHub",
 					searchInstalledPlaceholder: "Search installed plugins (name or id)",
 			extraFilter: "Installed",
@@ -763,7 +765,7 @@ window.__ModuleLoader__.load({
 		/** monorepo 子包列表：git trees 递归列出 packages 目录下的 package.json，逐个取 npm 包名（上限 24 个）。 */
 		async function fetchSubpackages(repo, branch) {
 			const data = await githubFetch(`https://api.github.com/repos/${encodeURIComponent(repo)}/git/trees/${encodeURIComponent(branch)}?recursive=1`);
-			const paths = (data.tree ?? []).filter((node) => node.type === "blob" && /^packages\/[^/]+\/package\.json$/u.test(node.path)).map((node) => node.path);
+			const paths = (data.tree ?? []).filter((node) => node.type === "blob" && /^(?:packages|examples|plugins|skills|apps|extensions|src|lib)\/[^/]+\/package\.json$/u.test(node.path)).map((node) => node.path);
 			if (paths.length === 0) return [];
 			const out = [];
 			for (const path of paths.slice(0, 24)) {
@@ -771,7 +773,7 @@ window.__ModuleLoader__.load({
 				if (text === null) continue;
 				try {
 					const pkg = JSON.parse(text);
-					if (pkg && typeof pkg.name === "string") out.push({ dir: path.split("/")[1], name: pkg.name });
+					if (pkg && typeof pkg.name === "string") out.push({ dir: path.split("/")[1], path: path.split("/").slice(0, -1).join("/"), name: pkg.name });
 				} catch {}
 			}
 			return out;
@@ -858,6 +860,8 @@ window.__ModuleLoader__.load({
 			const [frameworkUpgrading, setFrameworkUpgrading] = react.useState(false);
 			// 框架升级进度（重连后恢复显示）：{status, message}
 			const [frameworkStatus, setFrameworkStatus] = react.useState(null);
+			// Hub 自身更新：仅在检测到远程新版时显示下载/更新按钮
+			const [selfUpdate, setSelfUpdate] = react.useState(null);
 			// 进度条步骤（与 host 脚本 SetState 的阶段对应）
 			const FW_STEPS = [
 				{ key: "starting", label: t("fwStepBackup") },
@@ -1066,6 +1070,22 @@ window.__ModuleLoader__.load({
 				};
 				run();
 			}, [market, state]);
+			// Hub 自身更新检测：只在远程 npm 有更新时显示按钮
+			react.useEffect(() => {
+				if (state.status !== "ready") return;
+				const current = state.data.selfVersion ?? null;
+				if (!current) return;
+				call("/plugin-console/check-update", { packageName: "@noob-stupid/dsh-plugin-console" }).then(
+					(data) => {
+						if (data && data.error === null && typeof data.latest === "string" && data.latest !== current) {
+							setSelfUpdate({ latest: data.latest });
+						} else {
+							setSelfUpdate(null);
+						}
+					},
+					() => setSelfUpdate(null),
+				);
+			}, [state]);
 			// 搜索源菜单：点击外部收起
 			react.useEffect(() => {
 				if (!sourceMenuOpen) return;
@@ -1629,6 +1649,11 @@ window.__ModuleLoader__.load({
 					startSuiteJob(item);
 					return;
 				}
+				if (item.subpackagePath && typeof item.packageName === "string" && item.packageName !== "") {
+					// monorepo 子包：搜索结果带 packageName，按 npm 包名安装
+					startJob(item.fullName, item.packageName, item.source ?? "github");
+					return;
+				}
 				startJob(item.fullName, null, item.source ?? "github");
 			};
 			/** 停用/启用已安装技能（写入官方调用策略 frontmatter，可逆）。 */
@@ -2073,8 +2098,8 @@ window.__ModuleLoader__.load({
 								onClick: () => doToggleSkill(detailSkillName, detailSkillDisabled),
 							}, togglingSkill === detailSkillName ? t("installingLocal") : (detailSkillDisabled ? t("skillEnable") : t("skillDisable")))
 							: null,
-						info.privateRoot ? el("div", null,
-							el("p", { className: styles.status, "data-error": "true" }, t("privateRootHint")),
+						(info.privateRoot || !info.hasPackageJson) ? el("div", null,
+							info.privateRoot ? el("p", { className: styles.status, "data-error": "true" }, t("privateRootHint")) : null,
 							el("p", { className: styles.status }, t("subpackagesTitle") + "："),
 							subpackages === null ? null
 								: subpackages.status === "loading"
@@ -2159,6 +2184,12 @@ window.__ModuleLoader__.load({
 							? t("marketTitle")
 							: t("marketTitleOther").replace("{source}", sourceDisplayName(searchSource)))),
 					el("div", { id: "pc-ghwrap", className: styles.ghwrap },
+selfUpdate !== null ? el("button", {
+type: "button",
+className: styles.ghpill,
+title: t("hubUpdateAvailable") + " v" + selfUpdate.latest,
+onClick: () => window.open(`https://github.com/Noob-stupid/dsh-plugin-hub/releases/tag/v${selfUpdate.latest}`, "_blank")
+}, "⬇ " + t("hubUpdateAvailable") + " v" + selfUpdate.latest) : null,
 						el("button", {
 							type: "button",
 							className: styles.ghpill,

package/lib/index.js

@@ -236,7 +236,6 @@ function postJsonUrl(url, formBody) {
         'user-agent': GITHUB_UA,
         accept: 'application/json',
       },
-      rejectUnauthorized: false,
       timeout: 20000,
     }, (res) => {
       const chunks = []
@@ -377,6 +376,8 @@ function cleanupStalePackageDir(profileDir, packageName) {
 
 /** 软件源配置文件（registry 列表，安装链按主→备依次尝试）。 */
 const SOURCES_FILE = join(dshHome(), 'plugin-console-sources.json')
+/** 敏感凭据单独落盘（避免与可分享配置混存）：自定义搜索源 headers + Gitee secret/token。 */
+const SOURCES_SECRETS_FILE = join(dshHome(), 'plugin-console-sources.secrets.json')
 const DEFAULT_SOURCES = {
   registries: [
     { id: 'npmmirror', name: 'npmmirror（国内镜像）', url: 'https://registry.npmmirror.com', primary: true },
@@ -425,6 +426,7 @@ function readSources() {
   const defaults = JSON.parse(JSON.stringify(DEFAULT_SOURCES))
   try {
     const data = JSON.parse(readFileSync(SOURCES_FILE, 'utf8'))
+    const secrets = readSourceSecrets()
     const registries = (Array.isArray(data.registries) ? data.registries : [])
       .filter((r) => r && typeof r.url === 'string' && isAllowedSourceUrl(r.url))
       .map((r) => ({
@@ -439,13 +441,18 @@ function readSources() {
           return { id: String(s.id), name: String(s.name ?? s.id), type: 'builtin' }
         }
         if (s && typeof s.url === 'string' && s.url.includes('{q}')) {
-          const headers = {}
-          if (Array.isArray(s.headers)) {
+          let headers = {}
+          const secretHeaders = secrets.headers?.[s.id]
+          if (secretHeaders && typeof secretHeaders === 'object') {
+            headers = { ...secretHeaders }
+          } else if (Array.isArray(s.headers)) {
             for (const h of s.headers) {
               if (h && typeof h.name === 'string' && h.name !== '' && typeof h.value === 'string') {
                 headers[h.name] = h.value
               }
             }
+          } else if (s.headers && typeof s.headers === 'object') {
+            headers = { ...s.headers }
           }
           return {
             id: String(s.id ?? `search-${Math.random().toString(36).slice(2, 8)}`).slice(0, 40),
@@ -458,16 +465,58 @@ function readSources() {
         return null
       })
       .filter((s) => s !== null)
+    const giteeBase = readGiteeConfig(data)
+    const gitee = {
+      ...giteeBase,
+      clientSecret: secrets.gitee?.clientSecret ?? giteeBase.clientSecret,
+      token: secrets.gitee?.token ?? giteeBase.token,
+    }
     if (registries.length > 0) {
       if (!registries.some((r) => r.primary)) registries[0].primary = true
-      return { registries, searchSources, gitee: readGiteeConfig(data) }
+      return { registries, searchSources, gitee }
     }
   } catch {}
   return defaults
 }
 
+function readSourceSecrets() {
+  try {
+    const data = JSON.parse(readFileSync(SOURCES_SECRETS_FILE, 'utf8'))
+    return data && typeof data === 'object' ? data : {}
+  } catch {
+    return {}
+  }
+}
+
+async function writeSourceSecrets(secrets) {
+  const gitee = secrets.gitee ?? {}
+  const headers = secrets.headers ?? {}
+  const hasGitee = typeof gitee.clientSecret === 'string' && gitee.clientSecret !== '' || typeof gitee.token === 'string' && gitee.token !== ''
+  const hasHeaders = Object.keys(headers).some((id) => { const h = headers[id]; return h && typeof h === 'object' && Object.keys(h).length > 0 })
+  if (!hasGitee && !hasHeaders) {
+    try { rmSync(SOURCES_SECRETS_FILE, { force: true }) } catch {}
+    return
+  }
+  await writeFile(SOURCES_SECRETS_FILE, JSON.stringify({ gitee, headers }, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 })
+}
 async function writeSources(sources) {
-  await writeFile(SOURCES_FILE, JSON.stringify(sources, null, 2) + '\n', 'utf8')
+  const secrets = { gitee: {}, headers: {} }
+  const cleanSearch = (sources.searchSources ?? []).map((s) => {
+    if (!s) return s
+    if (s.headers && typeof s.headers === 'object' && Object.keys(s.headers).length > 0) {
+      secrets.headers[s.id] = { ...s.headers }
+      const { headers, ...rest } = s
+      return rest
+    }
+    return s
+  })
+  const gitee = readGiteeConfig(sources)
+  if (typeof gitee.clientSecret === 'string' && gitee.clientSecret !== '') secrets.gitee.clientSecret = gitee.clientSecret
+  if (typeof gitee.token === 'string' && gitee.token !== '') secrets.gitee.token = gitee.token
+  const cleanGitee = { ...(sources.gitee ?? {}), clientSecret: undefined, token: undefined }
+  const main = { ...sources, searchSources: cleanSearch, gitee: cleanGitee }
+  await writeFile(SOURCES_FILE, JSON.stringify(main, null, 2) + '\n', 'utf8')
+  await writeSourceSecrets(secrets)
 }
 
 /**
@@ -900,6 +949,25 @@ function isLoopback(address) {
   return address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1'
 }
 
+/** 写请求跨站防护：浏览器同源策略不阻止跨站发送，必须校验 Origin / Sec-Fetch-Site。
+ * 非浏览器客户端（无 Origin/Sec-Fetch-Site 头）仍允许，避免 curl/脚本/测试被误伤。 */
+function isAllowedWriteOrigin(req, port) {
+  const origin = typeof req.headers?.origin === 'string' ? req.headers.origin : null
+  const site = typeof req.headers?.['sec-fetch-site'] === 'string' ? req.headers['sec-fetch-site'] : null
+  if (origin !== null && origin !== '' && !ALLOWED_LOCAL_ORIGINS(port).has(origin)) return false
+  if (site !== null && site !== 'same-origin' && site !== 'none') return false
+  return true
+}
+
+function ALLOWED_LOCAL_ORIGINS(port) {
+  return new Set([
+    `http://127.0.0.1:${port}`,
+    `http://localhost:${port}`,
+    `http://[::1]:${port}`,
+  ])
+}
+
+
 function sendJson(res, status, body) {
   const payload = JSON.stringify(body)
   res.writeHead(status, {
@@ -939,7 +1007,6 @@ function githubRequestOnce(url, { signal, accept, token, timeout = 20000 } = {})
         accept: accept ?? 'application/vnd.github+json',
         ...(token ? { authorization: `Bearer ${token}` } : {}),
       },
-      rejectUnauthorized: false,
     }, resolve)
     req.on('error', reject)
     req.setTimeout(timeout, () => req.destroy(new Error('GitHub 请求超时')))
@@ -1124,7 +1191,7 @@ async function githubText(url, signal, token = null) {
 /** 用 curl 子进程请求 JSON（绕过本机中间设备对 node:https TLS 指纹的拦截；curl 走系统网络栈）。 */
 async function curlJson(url, timeout = 15000, headers = {}) {
   const bin = process.platform === 'win32' ? 'curl.exe' : 'curl'
-  const args = ['-s', '-m', String(Math.max(5, Math.ceil(timeout / 1000))), '--insecure', '-H', 'accept: application/json', '-w', '\n__HTTP__%{http_code}']
+  const args = ['-s', '-m', String(Math.max(5, Math.ceil(timeout / 1000))), '-H', 'accept: application/json', '-w', '\n__HTTP__%{http_code}']
   for (const [key, value] of Object.entries(headers)) args.push('-H', `${key}: ${value}`)
   args.push(url)
   const { stdout } = await execFileAsync(bin, args, { timeout: timeout + 3000, windowsHide: true, maxBuffer: 8 * 1024 * 1024 })
@@ -1140,7 +1207,7 @@ async function curlText(url, timeout = 10000) {
   const bin = process.platform === 'win32' ? 'curl.exe' : 'curl'
   const { stdout } = await execFileAsync(
     bin,
-    ['-s', '-m', String(Math.max(3, Math.ceil(timeout / 1000))), '--insecure', '-H', 'accept: text/plain', '-w', '\n__HTTP__%{http_code}', url],
+    ['-s', '-m', String(Math.max(3, Math.ceil(timeout / 1000))), '-H', 'accept: text/plain', '-w', '\n__HTTP__%{http_code}', url],
     { timeout: timeout + 3000, windowsHide: true, maxBuffer: 8 * 1024 * 1024 },
   )
   const m = String(stdout).match(/\n__HTTP__(\d+)\s*$/u)
@@ -1383,7 +1450,7 @@ async function fetchRepoPackage(repo, branch) {
  * profile 目录由 pnpm 管理；若用 npm 写入会与 pnpm 的目录重建互相破坏
  * （曾导致入口链接丢失、DSH 启动崩溃）。registry 走国内镜像。
  */
-async function pnpmInstall(profileDir, spec, registry = 'https://registry.npmmirror.com', timeout = 90000) {
+async function pnpmInstall(profileDir, spec, registry = 'https://registry.npmmirror.com', timeout = 90000, signal = null) {
   const args = ['pnpm', 'add', spec, '--registry', registry]
   const opts = {
     cwd: profileDir,
@@ -1419,7 +1486,7 @@ async function pnpmInstall(profileDir, spec, registry = 'https://registry.npmmir
  * 零依赖包可完整安装；带依赖包记录未补齐列表（不阻塞，供面板提示）。
  * 返回 { version, missingDeps }；失败抛错由调用方落入 next 通道。
  */
-async function curlManualInstall(profileDir, packageName, registries) {
+async function curlManualInstall(profileDir, packageName, registries, signal = null) {
   let meta = null
   let metaError = null
   for (const reg of registries) {
@@ -1442,8 +1509,8 @@ async function curlManualInstall(profileDir, packageName, registries) {
   mkdirSync(tmp, { recursive: true })
   try {
     const tgz = join(tmp, 'pkg.tgz')
-    await execFileAsync(bin, ['-s', '-L', '-m', '60', '-o', tgz, tarball], { timeout: 70000, windowsHide: true })
-    await execFileAsync('tar', ['-xzf', tgz, '-C', tmp], { timeout: 30000, windowsHide: true })
+    await execFileAsync(bin, ['-s', '-L', '-m', '60', '-o', tgz, tarball], { timeout: 70000, windowsHide: true, ...(signal ? { signal } : {}) })
+    await execFileAsync('tar', ['-xzf', tgz, '-C', tmp], { timeout: 30000, windowsHide: true, ...(signal ? { signal } : {}) })
     const pkgPath = join(tmp, 'package')
     // 盒子实验：解压后先验证，通过才覆盖正式位置（失败保留旧版本，服务不中断）
     const box = verifyPackageBox(pkgPath, profileDir, packageName)
@@ -1465,6 +1532,34 @@ async function curlManualInstall(profileDir, packageName, registries) {
   }
 }
 
+/** 安装通道并行竞速：pnpm 与 curl 同时尝试，先成功者生效；失败方被 abort 不干扰。 */
+async function raceInstallChannels(profileDir, name, registries) {
+  const controller = new AbortController()
+  const signal = controller.signal
+  const pnpmTask = (async () => {
+    let lastError = null
+    for (const registry of registries) {
+      try {
+        await pnpmInstall(profileDir, name, registry, 90000, signal)
+        return { channel: 'pnpm', info: null }
+      } catch (error) {
+        lastError = error
+        if (signal.aborted) throw error
+      }
+    }
+    throw lastError ?? new Error('pnpm 通道失败')
+  })()
+  const curlTask = (async () => {
+    const info = await curlManualInstall(profileDir, name, registries, signal)
+    return { channel: 'curl', info }
+  })()
+  const waitSuccess = (promise) => promise.then((value) => ({ value }), () => new Promise(() => {}))
+  const timeout = new Promise((resolve) => setTimeout(() => resolve(null), 120000))
+  const winner = await Promise.race([waitSuccess(pnpmTask), waitSuccess(curlTask), timeout])
+  controller.abort()
+  return winner ? winner.value : null
+}
+
 /**
  * 盒子实验验证：解压后的包目录先通过静态校验再允许覆盖正式位置。
  * - package.json 必须可解析且 name 与安装目标一致
@@ -2141,7 +2236,7 @@ async function fetchSubpackageNames(repo, branch, auth) {
   try {
     const data = await githubJson(`${GITHUB_API}/repos/${repo}/git/trees/${encodeURIComponent(branch)}?recursive=1`, undefined, auth)
     const paths = (data.tree ?? [])
-      .filter((node) => node.type === 'blob' && /^packages\/[^/]+\/package\.json$/u.test(node.path))
+      .filter((node) => node.type === 'blob' && /^(?:packages|examples|plugins|skills|apps|extensions|src|lib)\/[^/]+\/package\.json$/u.test(node.path))
       .map((node) => node.path)
     // 并行读取：黑洞期单条最坏 40s，24 条串行会拖到十几分钟
     const results = await Promise.all(paths.slice(0, 24).map(async (path) => {
@@ -2149,7 +2244,7 @@ async function fetchSubpackageNames(repo, branch, auth) {
       if (bodyText === null) return null
       try {
         const pkg = JSON.parse(bodyText)
-        if (pkg && typeof pkg.name === 'string') return { dir: path.split('/')[1], name: pkg.name }
+        if (pkg && typeof pkg.name === 'string') return { dir: path.split('/')[1], path: path.split('/').slice(0, -1).join('/'), name: pkg.name }
       } catch {}
       return null
     }))
@@ -2364,6 +2459,32 @@ async function runInstallJob(job, ctx) {
     for (let index = 0; index < candidates.length && installedName === null; index += 1) {
       if (Date.now() > deadline) break
       const name = candidates[index]
+        // 加法优化：包已在 node_modules 且名字匹配时，不再重复安装/触发 EPERM，直接进入启用流程
+        if (installedName === null) {
+          const existingTarget = join(profileDir, 'node_modules', name, 'package.json')
+          if (existsSync(existingTarget)) {
+            try {
+              const existingPkg = JSON.parse(readFileSync(existingTarget, 'utf8'))
+              if (existingPkg && existingPkg.name === name) {
+                installedName = name
+                job.curlNote = `已检测到本地已安装 ${name}@${existingPkg.version ?? '?'}，跳过重复下载`
+              }
+            } catch {}
+          }
+        }
+        // 加法并行竞速：pnpm 与 curl 同时启动，先成功者生效；失败方 abort，不影响后续串行通道
+        if (installedName === null && !subpackageMode && !expanded) {
+          const raced = await raceInstallChannels(profileDir, name, registries)
+          if (raced) {
+            installedName = name
+            if (raced.channel === 'curl') {
+              const racedInfo = raced.info
+              const stillMissing = await backfillMissingDeps(profileDir, racedInfo.missingDeps, registries)
+              job.curlNote = `已通过并行 curl 通道安装 v${racedInfo.version}${stillMissing.length > 0 ? `（依赖仍未补齐：${stillMissing.join('、')}，网络恢复后建议重新安装）` : '（捆绑依赖已补齐）'}`
+              if (racedInfo.boxNote) job.curlNote += `（盒子验证：${racedInfo.boxNote}）`
+            }
+          }
+        }
       // 通道 1..n：配置的软件源依次尝试（每源 90 秒封顶）
       for (let ri = 0; ri < registries.length && installedName === null; ri += 1) {
         try {
@@ -2559,6 +2680,18 @@ export function apply(ctx) {
           sendError(res, 403, '仅允许本机访问')
           return
         }
+        const port = webPort(ctx)
+        const host = typeof req.headers?.host === 'string' ? req.headers.host : ''
+        if (![`127.0.0.1:${port}`, `localhost:${port}`, `[::1]:${port}`].includes(host)) {
+          sendError(res, 403, 'Host 校验失败（仅允许本机访问）')
+          return
+        }
+        // 安全护栏（issue #9）：写路由必须是本机同源请求，防止恶意网页跨站驱动敏感操作。
+        const method = req.method ?? 'GET'
+        if (method !== 'GET' && method !== 'HEAD' && !isAllowedWriteOrigin(req, port)) {
+          sendError(res, 403, '跨站请求被拒绝（Origin/Sec-Fetch-Site 校验）')
+          return
+        }
         try {
           await handle(ctx, req, res)
         } catch (error) {
@@ -2598,7 +2731,13 @@ async function handle(ctx, req, res) {
     // 框架升级检测与适配（备份快照 + 重打框架补丁），try 包裹不阻塞 state 返回
     let framework = null
     try { framework = detectFrameworkUpgrade(ctx) } catch {}
-    sendJson(res, 200, { ok: true, entries, patchPath, compat, installJobs: jobs, recentFailures, github: { loggedIn: auth.loggedIn, login: auth.login }, patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts }, framework })
+    let selfVersion = null
+    try {
+      const selfRequire = createRequire(import.meta.url)
+      const selfPkg = JSON.parse(readFileSync(selfRequire.resolve('../package.json'), 'utf8'))
+      selfVersion = typeof selfPkg.version === 'string' ? selfPkg.version : null
+    } catch {}
+    sendJson(res, 200, { ok: true, entries, patchPath, compat, installJobs: jobs, recentFailures, github: { loggedIn: auth.loggedIn, login: auth.login }, patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts }, framework, selfVersion })
     return
   }
 
@@ -2956,6 +3095,48 @@ async function handle(ctx, req, res) {
       )
       items = normalizePlatformItems(data.items ?? [], 'main').map((item) => ({ ...item, source: 'github' }))
       items = await enrichItems(items)
+      // monorepo 子包增强（OpenViking/examples/dsh-memory-plugin 等可按子包名搜到）
+      if (raw !== '' && !body.skills) {
+        try {
+          const codeData = await githubJson(
+            `${GITHUB_API}/search/code?q=${encodeURIComponent(`${raw} filename:package.json`)}`,
+            req.signal,
+            auth.token,
+          )
+          const subItems = []
+          for (const hit of (codeData.items ?? []).slice(0, 10)) {
+            const hitPath = typeof hit.path === 'string' ? hit.path : ''
+            if (!/^(?:packages|examples|plugins|skills|apps|extensions|src|lib)\/[^/]+\/package\.json$/u.test(hitPath)) continue
+            const repoName = hit.repository?.full_name ?? ''
+            if (!repoName) continue
+            const dir = hitPath.split('/').slice(0, -1).join('/')
+            let packageName = dir.split('/').slice(-1)[0]
+            try {
+              const pkgText = await rawTextWithFallback(repoName, 'main', hitPath)
+              if (pkgText !== null) {
+                const pkg = JSON.parse(pkgText)
+                if (pkg && typeof pkg.name === 'string') packageName = pkg.name
+              }
+            } catch {}
+            subItems.push({
+              fullName: repoName,
+              description: `子包：${dir}`,
+              htmlUrl: `https://github.com/${repoName}/tree/main/${dir}`,
+              stars: 0,
+              updatedAt: '',
+              defaultBranch: 'main',
+              topics: [],
+              source: 'github',
+              subpackagePath: dir,
+              packageName,
+            })
+            if (subItems.length >= 5) break
+          }
+          for (const sub of subItems) {
+            if (!items.some((x) => x.fullName === sub.fullName)) items.push(sub)
+          }
+        } catch {}
+      }
     }
     items = items.filter((item) => item.fullName !== '')
     sendJson(res, 200, { ok: true, query, items, authenticated: auth.loggedIn, source })
@@ -3445,18 +3626,18 @@ async function handle(ctx, req, res) {
         `Set-Location -Path ${ps(dirname(dshDir))}`,
         // npm 安装函数：Start-Process 跑 npm-cli.js（唯一正确入口——lib/cli.js 是函数模块，
         // 直跑只加载不执行，假成功 exit 0）+ --force（显式指定版本但已在 package.json 的
-        // semver 范围内时 npm 会跳过安装，假成功）+ 10 分钟总时长硬超时。注意：**不能加
+        // semver 范围内时 npm 会跳过安装，假成功）+ 15 分钟总时长硬超时。注意：**不能加
         // -RedirectStandardOutput/-RedirectStandardError**——schtasks 任务环境下带重定向的
         // Start-Process 子进程会启动即异常退出（ExitCode 读不到、输出 0 字节，实测）；
         // 无重定向时 ExitCode 正常（实测 exit=0）。npm 自身 debug 日志（cache\_logs）留档。
-        // 超时策略：总时长 10 分钟硬上限 + npm debug 日志 5 分钟无更新判定卡死（网络黑洞/挂起时
-        // 快速失败换 registry，不用干等 10 分钟）；等待期间每 15 秒更新进度状态（客户端可见）。
+        // 超时策略：总时长 15 分钟硬上限 + npm debug 日志 5 分钟无更新判定卡死（网络黑洞/挂起时
+        // 快速失败换 registry，不用干等 15 分钟）；等待期间每 15 秒更新进度状态（客户端可见）。
         // 成功后校验 package.json 版本 === target（防 npm 假成功）。
         // 另注意：npm install 在 schtasks 环境启动慢（约 1-2 分钟 0 日志，初始化/编译缓存），
         // 属正常，5 分钟卡死阈值不会误杀。
         `function Install-Framework($reg) {`,
         `  $startAt = Get-Date`,
-        `  $deadline = $startAt.AddMinutes(10)`,
+        `  $deadline = $startAt.AddMinutes(15)`,
         `  $stallDeadline = $startAt.AddMinutes(5)`,
         `  $lastLogM = (Get-Date)`,
         `  $logSeen = $false`,
@@ -3493,7 +3674,7 @@ async function handle(ctx, req, res) {
         `    }`,
         `  }`,
         `  if (-not $done) {`,
-        `    Log 'pnpm 超过 10 分钟未完成，判定超时'`,
+        `    Log 'pnpm 超过 15 分钟未完成，判定超时'`,
         `    try { taskkill /F /FI "WINDOWTITLE eq DSH-Upgrade" 2>$null | Out-Null } catch {}`,
         `    return 1`,
         `  }`,
@@ -3609,10 +3790,10 @@ async function handle(ctx, req, res) {
         `      $tgz = Join-Path $tmpDir 'pkg.tgz'`,
         `      $encName = $name.Replace('/','%2f')`,
         `      $url = 'https://registry.npmmirror.com/' + $encName + '/-/' + $short + '-' + $refVersion + '.tgz'`,
-        `      curl.exe -s -L -m 60 --insecure -o $tgz $url`,
+        `      curl.exe -s -L -m 60 -o $tgz $url`,
         `      if (-not (Test-Path $tgz) -or (Get-Item $tgz).Length -lt 1000) {`,
         `        $url = 'https://registry.npmjs.org/' + $encName + '/-/' + $short + '-' + $refVersion + '.tgz'`,
-        `        curl.exe -s -L -m 60 --insecure -o $tgz $url`,
+        `        curl.exe -s -L -m 60 -o $tgz $url`,
         `      }`,
         `      if (-not (Test-Path $tgz) -or (Get-Item $tgz).Length -lt 1000) { Remove-Item $tmpDir -Recurse -Force -ErrorAction SilentlyContinue; continue }`,
         `      tar -xzf $tgz -C $tmpDir`,

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@noob-stupid/dsh-plugin-console",
-    "version": "0.3.16",
+    "version": "0.3.19",
     "description": "DSH plugin management panel & marketplace: one-click enable/disable, multi-source market (GitHub/Gitee/custom), static-index market (500+ plugins / 300 skills), skills, suites, and one-click framework upgrade.",
     "repository": {
         "type": "git",