@noob-stupid/dsh-plugin-console 0.3.18 → 0.3.20

package/lib/client.js

@@ -136,6 +136,7 @@ window.__ModuleLoader__.load({
 			loadingDetails: "正在读取详情…",
 			githubLoggedIn: "已登录 GitHub：",
 			githubCornerOut: "未登录 GitHub",
+			hubUpdateAvailable: "下载更新",
 					searchInstalledPlaceholder: "搜索已安装插件（名称或 id）",
 			extraFilter: "已装",
 			extraFilterAll: "全部",
@@ -370,6 +371,7 @@ window.__ModuleLoader__.load({
 			readmeLabel: "Readme summary",
 			loadingDetails: "Reading details…",
 			githubLoggedIn: "GitHub signed in: ",
+                    hubUpdateAvailable: "Download update",
 			githubCornerOut: "Not signed in to GitHub",
 					searchInstalledPlaceholder: "Search installed plugins (name or id)",
 			extraFilter: "Installed",
@@ -763,7 +765,7 @@ window.__ModuleLoader__.load({
 		/** monorepo 子包列表：git trees 递归列出 packages 目录下的 package.json，逐个取 npm 包名（上限 24 个）。 */
 		async function fetchSubpackages(repo, branch) {
 			const data = await githubFetch(`https://api.github.com/repos/${encodeURIComponent(repo)}/git/trees/${encodeURIComponent(branch)}?recursive=1`);
-			const paths = (data.tree ?? []).filter((node) => node.type === "blob" && /^packages\/[^/]+\/package\.json$/u.test(node.path)).map((node) => node.path);
+			const paths = (data.tree ?? []).filter((node) => node.type === "blob" && /^(?:packages|examples|plugins|skills|apps|extensions|src|lib)\/[^/]+\/package\.json$/u.test(node.path)).map((node) => node.path);
 			if (paths.length === 0) return [];
 			const out = [];
 			for (const path of paths.slice(0, 24)) {
@@ -771,7 +773,7 @@ window.__ModuleLoader__.load({
 				if (text === null) continue;
 				try {
 					const pkg = JSON.parse(text);
-					if (pkg && typeof pkg.name === "string") out.push({ dir: path.split("/")[1], name: pkg.name });
+					if (pkg && typeof pkg.name === "string") out.push({ dir: path.split("/")[1], path: path.split("/").slice(0, -1).join("/"), name: pkg.name });
 				} catch {}
 			}
 			return out;
@@ -858,6 +860,8 @@ window.__ModuleLoader__.load({
 			const [frameworkUpgrading, setFrameworkUpgrading] = react.useState(false);
 			// 框架升级进度（重连后恢复显示）：{status, message}
 			const [frameworkStatus, setFrameworkStatus] = react.useState(null);
+			// Hub 自身更新：仅在检测到远程新版时显示下载/更新按钮
+			const [selfUpdate, setSelfUpdate] = react.useState(null);
 			// 进度条步骤（与 host 脚本 SetState 的阶段对应）
 			const FW_STEPS = [
 				{ key: "starting", label: t("fwStepBackup") },
@@ -1066,6 +1070,22 @@ window.__ModuleLoader__.load({
 				};
 				run();
 			}, [market, state]);
+			// Hub 自身更新检测：只在远程 npm 有更新时显示按钮
+			react.useEffect(() => {
+				if (state.status !== "ready") return;
+				const current = state.data.selfVersion ?? null;
+				if (!current) return;
+				call("/plugin-console/check-update", { packageName: "@noob-stupid/dsh-plugin-console" }).then(
+					(data) => {
+						if (data && data.error === null && typeof data.latest === "string" && data.latest !== current) {
+							setSelfUpdate({ latest: data.latest });
+						} else {
+							setSelfUpdate(null);
+						}
+					},
+					() => setSelfUpdate(null),
+				);
+			}, [state]);
 			// 搜索源菜单：点击外部收起
 			react.useEffect(() => {
 				if (!sourceMenuOpen) return;
@@ -1347,7 +1367,7 @@ window.__ModuleLoader__.load({
 							// 立即本地拼官方安装命令（不等服务端后台补拉），手动安装引导即时可见
 							if (!data.installCommand) {
 								const short = repo.split("/")[1] ?? repo;
-								data.installCommand = "git -c http.sslVerify=false clone --recurse-submodules https://github.com/" + repo + ".git\ncd " + short + "\npowershell -ExecutionPolicy Bypass -File install.ps1";
+								data.installCommand = "git clone --recurse-submodules https://github.com/" + repo + ".git\ncd " + short + "\npowershell -ExecutionPolicy Bypass -File install.ps1";
 							}
 						}
 						setRepoInfo({ status: "ready", repo, data, direct: true });
@@ -1556,7 +1576,7 @@ window.__ModuleLoader__.load({
 					() => { setSearchSourceName(""); setSearchSourceUrl(""); setSearchSourceHeaders(""); },
 				);
 			};
-			const startJob = (repo, packageName, source = "github", kind = "plugin") => {
+			const startJob = (repo, packageName, source = "github", kind = "plugin", update = false) => {
 				// 防并发（与 addLocal 一致）：已有安装/更新进行中时忽略新点击（更新按钮此前可绕过，
 				// 反复点击会产生几十个并发任务装同一插件）
 				if (installing !== null) {
@@ -1567,7 +1587,7 @@ window.__ModuleLoader__.load({
 				setReloadHint(false);
 				setRestartHint(false);
 				setMessage(null);
-				call("/plugin-console/install", { repo: repo ?? "", packageName, source, kind }).then(
+				call("/plugin-console/install", { repo: repo ?? "", packageName, source, kind, update }).then(
 					(data) => {
 						if (data && data.jobId) {
 							setJobs((prev) => ({
@@ -1629,6 +1649,11 @@ window.__ModuleLoader__.load({
 					startSuiteJob(item);
 					return;
 				}
+				if (item.subpackagePath && typeof item.packageName === "string" && item.packageName !== "") {
+					// monorepo 子包：搜索结果带 packageName，按 npm 包名安装
+					startJob(item.fullName, item.packageName, item.source ?? "github");
+					return;
+				}
 				startJob(item.fullName, null, item.source ?? "github");
 			};
 			/** 停用/启用已安装技能（写入官方调用策略 frontmatter，可逆）。 */
@@ -1757,7 +1782,7 @@ window.__ModuleLoader__.load({
 														type: "button",
 														className: styles.toggle,
 														disabled: installing === entry.moduleName,
-														onClick: () => startJob("", entry.moduleName),
+														onClick: () => startJob("", entry.moduleName, "github", "plugin", true),
 													}, installing === entry.moduleName ? t("installing") : t("updateNow"))),
 												Array.isArray(updateCheck.depsOutdated) && updateCheck.depsOutdated.length > 0
 													? el("p", { className: styles.status, "data-error": "true" },
@@ -1970,7 +1995,7 @@ window.__ModuleLoader__.load({
 													type: "button",
 													className: styles.toggle,
 													disabled: installing === item.fullName,
-													onClick: () => startJob("", installedMatch.moduleName),
+													onClick: () => startJob("", installedMatch.moduleName, "github", "plugin", true),
 												}, installing === item.fullName ? t("installingLocal") : t("update") + " → v" + updateMap[item.fullName])
 												: el("button", {
 													type: "button",
@@ -2073,8 +2098,8 @@ window.__ModuleLoader__.load({
 								onClick: () => doToggleSkill(detailSkillName, detailSkillDisabled),
 							}, togglingSkill === detailSkillName ? t("installingLocal") : (detailSkillDisabled ? t("skillEnable") : t("skillDisable")))
 							: null,
-						info.privateRoot ? el("div", null,
-							el("p", { className: styles.status, "data-error": "true" }, t("privateRootHint")),
+						(info.privateRoot || !info.hasPackageJson) ? el("div", null,
+							info.privateRoot ? el("p", { className: styles.status, "data-error": "true" }, t("privateRootHint")) : null,
 							el("p", { className: styles.status }, t("subpackagesTitle") + "："),
 							subpackages === null ? null
 								: subpackages.status === "loading"
@@ -2159,6 +2184,25 @@ window.__ModuleLoader__.load({
 							? t("marketTitle")
 							: t("marketTitleOther").replace("{source}", sourceDisplayName(searchSource)))),
 					el("div", { id: "pc-ghwrap", className: styles.ghwrap },
+selfUpdate !== null ? el("button", {
+type: "button",
+className: styles.ghpill,
+title: t("hubUpdateAvailable") + " v" + selfUpdate.latest,
+onClick: () => {
+setMessage(t("installing"));
+call("/plugin-console/self-update", {}).then(
+(data) => {
+if (data && data.ok === true) {
+setMessage((data.note ?? "已更新") + "，正在重启生效…");
+call("/plugin-console/restart", {}).then(() => {}, () => {});
+} else {
+setMessage(t("failed") + "：" + (data?.reason ?? "未知"));
+}
+},
+(error) => setMessage(t("failed") + "：" + friendlyGithubError(error).message),
+);
+}
+}, "⬇ " + t("hubUpdateAvailable") + " v" + selfUpdate.latest) : null,
 						el("button", {
 							type: "button",
 							className: styles.ghpill,

package/lib/index.js

@@ -35,6 +35,26 @@ const GITHUB_UA = 'dsh-plugin-console/0.1 (local dsh web instance)'
 /** Gitee OAuth 端点（第三方应用需在 gitee.com → 数据管理 → 第三方应用 创建）。 */
 const GITEE_AUTH_URL = 'https://gitee.com/oauth/authorize'
 const GITEE_TOKEN_URL = 'https://gitee.com/oauth/token'
+/** Gitee OAuth state 一次性凭证（防止登录 CSRF / token 替换）。 */
+const GITEE_OAUTH_STATES = new Map()
+function createGiteeOAuthState() {
+  const state = globalThis.crypto?.randomUUID?.() ?? `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`
+  const now = Date.now()
+  // 只保留最近 10 分钟内的 state
+  for (const [key, at] of GITEE_OAUTH_STATES) {
+    if (now - at > 10 * 60 * 1000) GITEE_OAUTH_STATES.delete(key)
+  }
+  GITEE_OAUTH_STATES.set(state, now)
+  return state
+}
+function consumeGiteeOAuthState(state) {
+  if (typeof state !== 'string' || state === '') return false
+  const at = GITEE_OAUTH_STATES.get(state)
+  if (at === undefined) return false
+  GITEE_OAUTH_STATES.delete(state)
+  return Date.now() - at <= 10 * 60 * 1000
+}
+
 const DEFAULT_SEARCH = 'dsh-plugin'
 /** 技能市场收录的 topic（/search skills 分支三 topic 并行合并）。 */
 const SKILL_TOPICS = ['agent-skills', 'claude-skills', 'dsh-skill']
@@ -1450,7 +1470,7 @@ async function fetchRepoPackage(repo, branch) {
  * profile 目录由 pnpm 管理；若用 npm 写入会与 pnpm 的目录重建互相破坏
  * （曾导致入口链接丢失、DSH 启动崩溃）。registry 走国内镜像。
  */
-async function pnpmInstall(profileDir, spec, registry = 'https://registry.npmmirror.com', timeout = 90000) {
+async function pnpmInstall(profileDir, spec, registry = 'https://registry.npmmirror.com', timeout = 90000, signal = null) {
   const args = ['pnpm', 'add', spec, '--registry', registry]
   const opts = {
     cwd: profileDir,
@@ -1486,7 +1506,7 @@ async function pnpmInstall(profileDir, spec, registry = 'https://registry.npmmir
  * 零依赖包可完整安装；带依赖包记录未补齐列表（不阻塞，供面板提示）。
  * 返回 { version, missingDeps }；失败抛错由调用方落入 next 通道。
  */
-async function curlManualInstall(profileDir, packageName, registries) {
+async function curlManualInstall(profileDir, packageName, registries, signal = null, exactVersion = null) {
   let meta = null
   let metaError = null
   for (const reg of registries) {
@@ -1501,7 +1521,7 @@ async function curlManualInstall(profileDir, packageName, registries) {
     }
   }
   if (!meta || typeof meta !== 'object') throw new Error(`curl 通道：无法获取 registry 元数据（${metaError?.message ?? '未知'}）`)
-  const version = meta['dist-tags']?.latest ?? null
+  const version = exactVersion ?? meta['dist-tags']?.latest ?? null
   const tarball = version ? meta.versions?.[version]?.dist?.tarball ?? null : null
   if (!version || !tarball) throw new Error('curl 通道：registry 无 dist-tags.latest / tarball')
   const bin = process.platform === 'win32' ? 'curl.exe' : 'curl'
@@ -1509,9 +1529,16 @@ async function curlManualInstall(profileDir, packageName, registries) {
   mkdirSync(tmp, { recursive: true })
   try {
     const tgz = join(tmp, 'pkg.tgz')
-    await execFileAsync(bin, ['-s', '-L', '-m', '60', '-o', tgz, tarball], { timeout: 70000, windowsHide: true })
-    await execFileAsync('tar', ['-xzf', tgz, '-C', tmp], { timeout: 30000, windowsHide: true })
-    const pkgPath = join(tmp, 'package')
+    await execFileAsync(bin, ['-s', '-L', '-m', '60', '-o', tgz, tarball], { timeout: 70000, windowsHide: true, ...(signal ? { signal } : {}) })
+    await execFileAsync('tar', ['-xzf', tgz, '-C', tmp], { timeout: 30000, windowsHide: true, ...(signal ? { signal } : {}) })
+    let pkgPath = join(tmp, 'package')
+    if (!existsSync(join(pkgPath, 'package.json'))) {
+      const candidates = readdirSync(tmp, { withFileTypes: true })
+        .filter((d) => d.isDirectory())
+        .map((d) => join(tmp, d.name))
+      pkgPath = candidates.find((p) => existsSync(join(p, 'package.json'))) ?? pkgPath
+    }
+    if (!existsSync(join(pkgPath, 'package.json'))) throw new Error('curl 通道：解压后未找到含 package.json 的目录')
     // 盒子实验：解压后先验证，通过才覆盖正式位置（失败保留旧版本，服务不中断）
     const box = verifyPackageBox(pkgPath, profileDir, packageName)
     const pkg = JSON.parse(readFileSync(join(pkgPath, 'package.json'), 'utf8'))
@@ -1532,6 +1559,34 @@ async function curlManualInstall(profileDir, packageName, registries) {
   }
 }
 
+/** 安装通道并行竞速：pnpm 与 curl 同时尝试，先成功者生效；失败方被 abort 不干扰。 */
+async function raceInstallChannels(profileDir, name, registries) {
+  const controller = new AbortController()
+  const signal = controller.signal
+  const pnpmTask = (async () => {
+    let lastError = null
+    for (const registry of registries) {
+      try {
+        await pnpmInstall(profileDir, name, registry, 90000, signal)
+        return { channel: 'pnpm', info: null }
+      } catch (error) {
+        lastError = error
+        if (signal.aborted) throw error
+      }
+    }
+    throw lastError ?? new Error('pnpm 通道失败')
+  })()
+  const curlTask = (async () => {
+    const info = await curlManualInstall(profileDir, name, registries, signal)
+    return { channel: 'curl', info }
+  })()
+  const waitSuccess = (promise) => promise.then((value) => ({ value }), () => new Promise(() => {}))
+  const timeout = new Promise((resolve) => setTimeout(() => resolve(null), 120000))
+  const winner = await Promise.race([waitSuccess(pnpmTask), waitSuccess(curlTask), timeout])
+  controller.abort()
+  return winner ? winner.value : null
+}
+
 /**
  * 盒子实验验证：解压后的包目录先通过静态校验再允许覆盖正式位置。
  * - package.json 必须可解析且 name 与安装目标一致
@@ -1570,7 +1625,7 @@ function verifyPackageBox(pkgPath, profileDir, packageName, refCheckRoot = null)
         const refs = parseBundlePatchRefs(readFileSync(bundlePatch, 'utf8'))
         const missingRefs = refs.filter((r) => !existsSync(join(checkRoot, r.name)))
         if (missingRefs.length > 0) {
-          throw new Error(`盒子验证失败：bundle patch 引用的包缺失（${missingRefs.map((r) => r.name).join('、')}），已保留旧版本，请先补装后再更新`)
+          note.push(`bundle 引用缺失：${missingRefs.map((r) => r.name).join('、')}（安装后由聚合完整性检查补齐/禁用）`)
         }
         if (refs.length > 0) note.push(`bundle 引用 ${refs.length} 个已就位`)
       }
@@ -2208,7 +2263,7 @@ async function fetchSubpackageNames(repo, branch, auth) {
   try {
     const data = await githubJson(`${GITHUB_API}/repos/${repo}/git/trees/${encodeURIComponent(branch)}?recursive=1`, undefined, auth)
     const paths = (data.tree ?? [])
-      .filter((node) => node.type === 'blob' && /^packages\/[^/]+\/package\.json$/u.test(node.path))
+      .filter((node) => node.type === 'blob' && /^(?:packages|examples|plugins|skills|apps|extensions|src|lib)\/[^/]+\/package\.json$/u.test(node.path))
       .map((node) => node.path)
     // 并行读取：黑洞期单条最坏 40s，24 条串行会拖到十几分钟
     const results = await Promise.all(paths.slice(0, 24).map(async (path) => {
@@ -2216,7 +2271,7 @@ async function fetchSubpackageNames(repo, branch, auth) {
       if (bodyText === null) return null
       try {
         const pkg = JSON.parse(bodyText)
-        if (pkg && typeof pkg.name === 'string') return { dir: path.split('/')[1], name: pkg.name }
+        if (pkg && typeof pkg.name === 'string') return { dir: path.split('/')[1], path: path.split('/').slice(0, -1).join('/'), name: pkg.name }
       } catch {}
       return null
     }))
@@ -2358,6 +2413,36 @@ async function aiRepair(job, ctx, profileDir, candidates, lastError) {
   }
 }
 
+/** 聚合包更新后的子包版本对齐：按新版聚合包声明的依赖版本，逐个对齐已存在的子包。 */
+async function syncAggregateSubpackageVersions(profileDir, packageName, registries) {
+  const pkgPath = join(profileDir, 'node_modules', packageName, 'package.json')
+  if (!existsSync(pkgPath)) return []
+  let pkg = null
+  try { pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) } catch { return [] }
+  const deps = { ...(pkg.dependencies ?? {}), ...(pkg.peerDependencies ?? {}) }
+  const updated = []
+  for (const dep of Object.keys(deps)) {
+    if (dep.startsWith('@deepseek-ai/')) continue
+    const spec = String(deps[dep] ?? '').replace(/^[\^~>=< ]+/u, '')
+    if (!spec) continue
+    const currentPath = join(profileDir, 'node_modules', dep, 'package.json')
+    if (!existsSync(currentPath)) {
+      try {
+        await curlManualInstall(profileDir, dep, registries, null, spec)
+        updated.push(`${dep}@${spec}（新装）`)
+      } catch {}
+      continue
+    }
+    try {
+      const current = JSON.parse(readFileSync(currentPath, 'utf8'))
+      if (current.version === spec) continue
+      await curlManualInstall(profileDir, dep, registries, null, spec)
+      updated.push(`${dep}@${spec}`)
+    } catch {}
+  }
+  return updated
+}
+
 async function runInstallJob(job, ctx) {
   try {
     job.stage = 'preparing'
@@ -2431,6 +2516,32 @@ async function runInstallJob(job, ctx) {
     for (let index = 0; index < candidates.length && installedName === null; index += 1) {
       if (Date.now() > deadline) break
       const name = candidates[index]
+        // 加法优化：包已在 node_modules 且名字匹配时，不再重复安装/触发 EPERM，直接进入启用流程
+        if (installedName === null) {
+          const existingTarget = join(profileDir, 'node_modules', name, 'package.json')
+          if (existsSync(existingTarget)) {
+            try {
+              const existingPkg = JSON.parse(readFileSync(existingTarget, 'utf8'))
+              if (existingPkg && existingPkg.name === name && job.update !== true) {
+                installedName = name
+                job.curlNote = `已检测到本地已安装 ${name}@${existingPkg.version ?? '?'}，跳过重复下载`
+              }
+            } catch {}
+          }
+        }
+        // 加法并行竞速：pnpm 与 curl 同时启动，先成功者生效；失败方 abort，不影响后续串行通道
+        if (installedName === null && !subpackageMode && !expanded) {
+          const raced = await raceInstallChannels(profileDir, name, registries)
+          if (raced) {
+            installedName = name
+            if (raced.channel === 'curl') {
+              const racedInfo = raced.info
+              const stillMissing = await backfillMissingDeps(profileDir, racedInfo.missingDeps, registries)
+              job.curlNote = `已通过并行 curl 通道安装 v${racedInfo.version}${stillMissing.length > 0 ? `（依赖仍未补齐：${stillMissing.join('、')}，网络恢复后建议重新安装）` : '（捆绑依赖已补齐）'}`
+              if (racedInfo.boxNote) job.curlNote += `（盒子验证：${racedInfo.boxNote}）`
+            }
+          }
+        }
       // 通道 1..n：配置的软件源依次尝试（每源 90 秒封顶）
       for (let ri = 0; ri < registries.length && installedName === null; ri += 1) {
         try {
@@ -2561,6 +2672,13 @@ async function runInstallJob(job, ctx) {
       return
     }
     job.packageName = installedName
+    // 聚合包子包版本对齐（确保更新后所有子包也到新版声明版本）
+    try {
+      const synced = await syncAggregateSubpackageVersions(profileDir, installedName, registries)
+      if (synced.length > 0) {
+        job.bundleNote = (job.bundleNote ? job.bundleNote + '；' : '') + `子包版本对齐：更新 ${synced.length} 个（${synced.join('、')}）`
+      }
+    } catch {}
     // 聚合包完整性保障（防崩）：bundle patch 引用的包缺失 → 补装；仍缺自动禁用该行
     try {
       const integrity = await ensureBundlePatchIntegrity(profileDir, installedName, patchPath)
@@ -2677,7 +2795,13 @@ async function handle(ctx, req, res) {
     // 框架升级检测与适配（备份快照 + 重打框架补丁），try 包裹不阻塞 state 返回
     let framework = null
     try { framework = detectFrameworkUpgrade(ctx) } catch {}
-    sendJson(res, 200, { ok: true, entries, patchPath, compat, installJobs: jobs, recentFailures, github: { loggedIn: auth.loggedIn, login: auth.login }, patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts }, framework })
+    let selfVersion = null
+    try {
+      const selfRequire = createRequire(import.meta.url)
+      const selfPkg = JSON.parse(readFileSync(selfRequire.resolve('../package.json'), 'utf8'))
+      selfVersion = typeof selfPkg.version === 'string' ? selfPkg.version : null
+    } catch {}
+    sendJson(res, 200, { ok: true, entries, patchPath, compat, installJobs: jobs, recentFailures, github: { loggedIn: auth.loggedIn, login: auth.login }, patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts }, framework, selfVersion })
     return
   }
 
@@ -2697,13 +2821,15 @@ async function handle(ctx, req, res) {
     const redirect = `http://127.0.0.1:${port}/plugin-console/gitee-oauth-callback`
     // scope 请求 user_info + projects：Gitee 会校验请求的 scope 必须在应用已勾选的权限范围内，
     // 应用权限必须同步勾选 user_info、projects，否则报「请求范围无效、未知或格式不正确」
-    const url = `${GITEE_AUTH_URL}?client_id=${encodeURIComponent(gitee.clientId)}&redirect_uri=${encodeURIComponent(redirect)}&response_type=code&scope=${encodeURIComponent('user_info projects')}`
-    sendJson(res, 200, { ok: true, url, redirect })
+    const state = createGiteeOAuthState()
+    const url = `${GITEE_AUTH_URL}?client_id=${encodeURIComponent(gitee.clientId)}&redirect_uri=${encodeURIComponent(redirect)}&response_type=code&scope=${encodeURIComponent('user_info projects')}&state=${encodeURIComponent(state)}`
+    sendJson(res, 200, { ok: true, url, redirect, state })
     return
   }
 
   if (method === 'GET' && pathname === `${ROUTE_PREFIX}/gitee-oauth-callback`) {
     const code = new URL(req.url ?? '/', 'http://x').searchParams.get('code')
+    const state = new URL(req.url ?? '/', 'http://x').searchParams.get('state')
     const sources = readSources()
     const gitee = readGiteeConfig(sources)
     const failPage = (text) => {
@@ -2714,6 +2840,10 @@ async function handle(ctx, req, res) {
       failPage('这是 Gitee 授权回调地址，不能直接访问。<br>正确流程：插件面板 → 软件源管理 → 填入 client_id / client_secret → 保存配置 → 点击「授权登录 Gitee」，授权完成后会自动跳回这里。')
       return
     }
+    if (!state || !consumeGiteeOAuthState(state)) {
+      failPage('Gitee OAuth state 校验失败，请重新发起授权。')
+      return
+    }
     if (!gitee.clientId || !gitee.clientSecret) {
       failPage('未配置 Gitee 应用：请先在 gitee.com 创建第三方应用（回调地址填本页完整地址），再在插件面板 → 软件源管理 中填入 client_id / client_secret 并保存。')
       return
@@ -3035,6 +3165,48 @@ async function handle(ctx, req, res) {
       )
       items = normalizePlatformItems(data.items ?? [], 'main').map((item) => ({ ...item, source: 'github' }))
       items = await enrichItems(items)
+      // monorepo 子包增强（OpenViking/examples/dsh-memory-plugin 等可按子包名搜到）
+      if (raw !== '' && !body.skills) {
+        try {
+          const codeData = await githubJson(
+            `${GITHUB_API}/search/code?q=${encodeURIComponent(`${raw} filename:package.json`)}`,
+            req.signal,
+            auth.token,
+          )
+          const subItems = []
+          for (const hit of (codeData.items ?? []).slice(0, 10)) {
+            const hitPath = typeof hit.path === 'string' ? hit.path : ''
+            if (!/^(?:packages|examples|plugins|skills|apps|extensions|src|lib)\/[^/]+\/package\.json$/u.test(hitPath)) continue
+            const repoName = hit.repository?.full_name ?? ''
+            if (!repoName) continue
+            const dir = hitPath.split('/').slice(0, -1).join('/')
+            let packageName = dir.split('/').slice(-1)[0]
+            try {
+              const pkgText = await rawTextWithFallback(repoName, 'main', hitPath)
+              if (pkgText !== null) {
+                const pkg = JSON.parse(pkgText)
+                if (pkg && typeof pkg.name === 'string') packageName = pkg.name
+              }
+            } catch {}
+            subItems.push({
+              fullName: repoName,
+              description: `子包：${dir}`,
+              htmlUrl: `https://github.com/${repoName}/tree/main/${dir}`,
+              stars: 0,
+              updatedAt: '',
+              defaultBranch: 'main',
+              topics: [],
+              source: 'github',
+              subpackagePath: dir,
+              packageName,
+            })
+            if (subItems.length >= 5) break
+          }
+          for (const sub of subItems) {
+            if (!items.some((x) => x.fullName === sub.fullName)) items.push(sub)
+          }
+        } catch {}
+      }
     }
     items = items.filter((item) => item.fullName !== '')
     sendJson(res, 200, { ok: true, query, items, authenticated: auth.loggedIn, source })
@@ -3077,10 +3249,10 @@ async function handle(ctx, req, res) {
       const short = repo.split('/')[1] ?? repo
       const hasInstallScript = (await rawTextWithFallback(repo, branch, 'install.ps1')) !== null
         || (await rawTextWithFallback(repo, branch, 'install.sh')) !== null
-      // 纯命令（无注释，CMD/PowerShell 通用）；sslVerify=false 兼容本机证书链问题；
+      // 纯命令（无注释，CMD/PowerShell 通用）；不再关闭 TLS 校验；
       // 脚本用 powershell -File 调用，CMD 里也能跑
       installCommand = [
-        `git -c http.sslVerify=false clone --recurse-submodules https://github.com/${repo}.git`,
+        `git clone --recurse-submodules https://github.com/${repo}.git`,
         `cd ${short}`,
         hasInstallScript
           ? `powershell -ExecutionPolicy Bypass -File install.ps1`
@@ -3810,6 +3982,33 @@ async function handle(ctx, req, res) {
     return
   }
 
+  if (pathname === `${ROUTE_PREFIX}/self-update`) {
+    // Hub 自身一键更新：下载 npm 最新 tarball 到当前 profile，成功后由前端重启生效
+    let selfVersion = null
+    try {
+      const selfPkg = JSON.parse(readFileSync(createRequire(import.meta.url).resolve('../package.json'), 'utf8'))
+      selfVersion = typeof selfPkg.version === 'string' ? selfPkg.version : null
+    } catch {}
+    let latest = null
+    try {
+      const data = await fetchJsonUrl('https://registry.npmmirror.com/@noob-stupid%2fdsh-plugin-console')
+      latest = data?.['dist-tags']?.latest ?? null
+    } catch {}
+    if (!latest || selfVersion === null || latest === selfVersion) {
+      sendJson(res, 200, { ok: false, current: selfVersion, latest, updated: false, reason: latest === selfVersion ? '已是最新版本' : '版本检测失败' })
+      return
+    }
+    const profileDir = dirname(findPatchPath(ctx))
+    const registries = orderedRegistries(readSources())
+    try {
+      const info = await curlManualInstall(profileDir, '@noob-stupid/dsh-plugin-console', registries)
+      sendJson(res, 200, { ok: true, current: selfVersion, latest, updated: true, version: info.version, note: '已下载最新代码，重启服务后生效' })
+    } catch (error) {
+      sendError(res, 500, `Hub 自动更新失败：${error instanceof Error ? error.message : String(error)}`)
+    }
+    return
+  }
+
   if (pathname === `${ROUTE_PREFIX}/install`) {
     // repo 允许为空：纯 registry 更新（已安装插件的"检测更新"走此路径，无 git 兜底）
     const rawRepo = typeof body.repo === 'string' ? body.repo.trim() : ''
@@ -3861,6 +4060,7 @@ async function handle(ctx, req, res) {
       aiNote: null,
       subpackages: null,
       lastError: null,
+        update: body.update === true,
       kind,
     }
     installJobs.set(job.id, job)

package/package.json

@@ -1,39 +1,39 @@
-{
-    "name": "@noob-stupid/dsh-plugin-console",
-    "version": "0.3.18",
-    "description": "DSH plugin management panel & marketplace: one-click enable/disable, multi-source market (GitHub/Gitee/custom), static-index market (500+ plugins / 300 skills), skills, suites, and one-click framework upgrade.",
-    "repository": {
-        "type": "git",
-        "url": "https://github.com/Noob-stupid/dsh-plugin-hub"
-    },
-    "type": "module",
-    "main": "./lib/index.js",
-    "exports": {
-        ".": "./lib/index.js",
-        "./client": "./lib/client.js",
-        "./package.json": "./package.json"
-    },
-    "keywords": [
-        "dsh-plugin",
-        "deepseek-harness",
-        "plugin-manager"
-    ],
-    "dsh": {
-        "bundle": {
-            "patch": "./cordis.patch.yml"
-        },
-        "client": {
-            "platform": "web",
-            "inject": [
-                "@deepseek-ai/dsh-client-runtime",
-                "@deepseek-ai/dsh-client-locale",
-                "@deepseek-ai/dsh-client-ui-settings"
-            ]
-        }
-    },
-    "files": [
-        "lib",
-        "cordis.patch.yml"
-    ],
-    "license": "MIT"
-}
+{
+    "name": "@noob-stupid/dsh-plugin-console",
+    "version": "0.3.20",
+    "description": "DSH plugin management panel & marketplace: one-click enable/disable, multi-source market (GitHub/Gitee/custom), static-index market (500+ plugins / 300 skills), skills, suites, and one-click framework upgrade.",
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/Noob-stupid/dsh-plugin-hub"
+    },
+    "type": "module",
+    "main": "./lib/index.js",
+    "exports": {
+        ".": "./lib/index.js",
+        "./client": "./lib/client.js",
+        "./package.json": "./package.json"
+    },
+    "keywords": [
+        "dsh-plugin",
+        "deepseek-harness",
+        "plugin-manager"
+    ],
+    "dsh": {
+        "bundle": {
+            "patch": "./cordis.patch.yml"
+        },
+        "client": {
+            "platform": "web",
+            "inject": [
+                "@deepseek-ai/dsh-client-runtime",
+                "@deepseek-ai/dsh-client-locale",
+                "@deepseek-ai/dsh-client-ui-settings"
+            ]
+        }
+    },
+    "files": [
+        "lib",
+        "cordis.patch.yml"
+    ],
+    "license": "MIT"
+}