@noob-stupid/dsh-plugin-console 0.3.19 → 0.3.20

package/lib/client.js

@@ -1367,7 +1367,7 @@ window.__ModuleLoader__.load({
 							// 立即本地拼官方安装命令（不等服务端后台补拉），手动安装引导即时可见
 							if (!data.installCommand) {
 								const short = repo.split("/")[1] ?? repo;
-								data.installCommand = "git -c http.sslVerify=false clone --recurse-submodules https://github.com/" + repo + ".git\ncd " + short + "\npowershell -ExecutionPolicy Bypass -File install.ps1";
+								data.installCommand = "git clone --recurse-submodules https://github.com/" + repo + ".git\ncd " + short + "\npowershell -ExecutionPolicy Bypass -File install.ps1";
 							}
 						}
 						setRepoInfo({ status: "ready", repo, data, direct: true });
@@ -1576,7 +1576,7 @@ window.__ModuleLoader__.load({
 					() => { setSearchSourceName(""); setSearchSourceUrl(""); setSearchSourceHeaders(""); },
 				);
 			};
-			const startJob = (repo, packageName, source = "github", kind = "plugin") => {
+			const startJob = (repo, packageName, source = "github", kind = "plugin", update = false) => {
 				// 防并发（与 addLocal 一致）：已有安装/更新进行中时忽略新点击（更新按钮此前可绕过，
 				// 反复点击会产生几十个并发任务装同一插件）
 				if (installing !== null) {
@@ -1587,7 +1587,7 @@ window.__ModuleLoader__.load({
 				setReloadHint(false);
 				setRestartHint(false);
 				setMessage(null);
-				call("/plugin-console/install", { repo: repo ?? "", packageName, source, kind }).then(
+				call("/plugin-console/install", { repo: repo ?? "", packageName, source, kind, update }).then(
 					(data) => {
 						if (data && data.jobId) {
 							setJobs((prev) => ({
@@ -1782,7 +1782,7 @@ window.__ModuleLoader__.load({
 														type: "button",
 														className: styles.toggle,
 														disabled: installing === entry.moduleName,
-														onClick: () => startJob("", entry.moduleName),
+														onClick: () => startJob("", entry.moduleName, "github", "plugin", true),
 													}, installing === entry.moduleName ? t("installing") : t("updateNow"))),
 												Array.isArray(updateCheck.depsOutdated) && updateCheck.depsOutdated.length > 0
 													? el("p", { className: styles.status, "data-error": "true" },
@@ -1995,7 +1995,7 @@ window.__ModuleLoader__.load({
 													type: "button",
 													className: styles.toggle,
 													disabled: installing === item.fullName,
-													onClick: () => startJob("", installedMatch.moduleName),
+													onClick: () => startJob("", installedMatch.moduleName, "github", "plugin", true),
 												}, installing === item.fullName ? t("installingLocal") : t("update") + " → v" + updateMap[item.fullName])
 												: el("button", {
 													type: "button",
@@ -2188,7 +2188,20 @@ selfUpdate !== null ? el("button", {
 type: "button",
 className: styles.ghpill,
 title: t("hubUpdateAvailable") + " v" + selfUpdate.latest,
-onClick: () => window.open(`https://github.com/Noob-stupid/dsh-plugin-hub/releases/tag/v${selfUpdate.latest}`, "_blank")
+onClick: () => {
+setMessage(t("installing"));
+call("/plugin-console/self-update", {}).then(
+(data) => {
+if (data && data.ok === true) {
+setMessage((data.note ?? "已更新") + "，正在重启生效…");
+call("/plugin-console/restart", {}).then(() => {}, () => {});
+} else {
+setMessage(t("failed") + "：" + (data?.reason ?? "未知"));
+}
+},
+(error) => setMessage(t("failed") + "：" + friendlyGithubError(error).message),
+);
+}
 }, "⬇ " + t("hubUpdateAvailable") + " v" + selfUpdate.latest) : null,
 						el("button", {
 							type: "button",

package/lib/index.js

@@ -35,6 +35,26 @@ const GITHUB_UA = 'dsh-plugin-console/0.1 (local dsh web instance)'
 /** Gitee OAuth 端点（第三方应用需在 gitee.com → 数据管理 → 第三方应用 创建）。 */
 const GITEE_AUTH_URL = 'https://gitee.com/oauth/authorize'
 const GITEE_TOKEN_URL = 'https://gitee.com/oauth/token'
+/** Gitee OAuth state 一次性凭证（防止登录 CSRF / token 替换）。 */
+const GITEE_OAUTH_STATES = new Map()
+function createGiteeOAuthState() {
+  const state = globalThis.crypto?.randomUUID?.() ?? `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`
+  const now = Date.now()
+  // 只保留最近 10 分钟内的 state
+  for (const [key, at] of GITEE_OAUTH_STATES) {
+    if (now - at > 10 * 60 * 1000) GITEE_OAUTH_STATES.delete(key)
+  }
+  GITEE_OAUTH_STATES.set(state, now)
+  return state
+}
+function consumeGiteeOAuthState(state) {
+  if (typeof state !== 'string' || state === '') return false
+  const at = GITEE_OAUTH_STATES.get(state)
+  if (at === undefined) return false
+  GITEE_OAUTH_STATES.delete(state)
+  return Date.now() - at <= 10 * 60 * 1000
+}
+
 const DEFAULT_SEARCH = 'dsh-plugin'
 /** 技能市场收录的 topic（/search skills 分支三 topic 并行合并）。 */
 const SKILL_TOPICS = ['agent-skills', 'claude-skills', 'dsh-skill']
@@ -1486,7 +1506,7 @@ async function pnpmInstall(profileDir, spec, registry = 'https://registry.npmmir
  * 零依赖包可完整安装；带依赖包记录未补齐列表（不阻塞，供面板提示）。
  * 返回 { version, missingDeps }；失败抛错由调用方落入 next 通道。
  */
-async function curlManualInstall(profileDir, packageName, registries, signal = null) {
+async function curlManualInstall(profileDir, packageName, registries, signal = null, exactVersion = null) {
   let meta = null
   let metaError = null
   for (const reg of registries) {
@@ -1501,7 +1521,7 @@ async function curlManualInstall(profileDir, packageName, registries, signal = n
     }
   }
   if (!meta || typeof meta !== 'object') throw new Error(`curl 通道：无法获取 registry 元数据（${metaError?.message ?? '未知'}）`)
-  const version = meta['dist-tags']?.latest ?? null
+  const version = exactVersion ?? meta['dist-tags']?.latest ?? null
   const tarball = version ? meta.versions?.[version]?.dist?.tarball ?? null : null
   if (!version || !tarball) throw new Error('curl 通道：registry 无 dist-tags.latest / tarball')
   const bin = process.platform === 'win32' ? 'curl.exe' : 'curl'
@@ -1511,7 +1531,14 @@ async function curlManualInstall(profileDir, packageName, registries, signal = n
     const tgz = join(tmp, 'pkg.tgz')
     await execFileAsync(bin, ['-s', '-L', '-m', '60', '-o', tgz, tarball], { timeout: 70000, windowsHide: true, ...(signal ? { signal } : {}) })
     await execFileAsync('tar', ['-xzf', tgz, '-C', tmp], { timeout: 30000, windowsHide: true, ...(signal ? { signal } : {}) })
-    const pkgPath = join(tmp, 'package')
+    let pkgPath = join(tmp, 'package')
+    if (!existsSync(join(pkgPath, 'package.json'))) {
+      const candidates = readdirSync(tmp, { withFileTypes: true })
+        .filter((d) => d.isDirectory())
+        .map((d) => join(tmp, d.name))
+      pkgPath = candidates.find((p) => existsSync(join(p, 'package.json'))) ?? pkgPath
+    }
+    if (!existsSync(join(pkgPath, 'package.json'))) throw new Error('curl 通道：解压后未找到含 package.json 的目录')
     // 盒子实验：解压后先验证，通过才覆盖正式位置（失败保留旧版本，服务不中断）
     const box = verifyPackageBox(pkgPath, profileDir, packageName)
     const pkg = JSON.parse(readFileSync(join(pkgPath, 'package.json'), 'utf8'))
@@ -1598,7 +1625,7 @@ function verifyPackageBox(pkgPath, profileDir, packageName, refCheckRoot = null)
         const refs = parseBundlePatchRefs(readFileSync(bundlePatch, 'utf8'))
         const missingRefs = refs.filter((r) => !existsSync(join(checkRoot, r.name)))
         if (missingRefs.length > 0) {
-          throw new Error(`盒子验证失败：bundle patch 引用的包缺失（${missingRefs.map((r) => r.name).join('、')}），已保留旧版本，请先补装后再更新`)
+          note.push(`bundle 引用缺失：${missingRefs.map((r) => r.name).join('、')}（安装后由聚合完整性检查补齐/禁用）`)
         }
         if (refs.length > 0) note.push(`bundle 引用 ${refs.length} 个已就位`)
       }
@@ -2386,6 +2413,36 @@ async function aiRepair(job, ctx, profileDir, candidates, lastError) {
   }
 }
 
+/** 聚合包更新后的子包版本对齐：按新版聚合包声明的依赖版本，逐个对齐已存在的子包。 */
+async function syncAggregateSubpackageVersions(profileDir, packageName, registries) {
+  const pkgPath = join(profileDir, 'node_modules', packageName, 'package.json')
+  if (!existsSync(pkgPath)) return []
+  let pkg = null
+  try { pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) } catch { return [] }
+  const deps = { ...(pkg.dependencies ?? {}), ...(pkg.peerDependencies ?? {}) }
+  const updated = []
+  for (const dep of Object.keys(deps)) {
+    if (dep.startsWith('@deepseek-ai/')) continue
+    const spec = String(deps[dep] ?? '').replace(/^[\^~>=< ]+/u, '')
+    if (!spec) continue
+    const currentPath = join(profileDir, 'node_modules', dep, 'package.json')
+    if (!existsSync(currentPath)) {
+      try {
+        await curlManualInstall(profileDir, dep, registries, null, spec)
+        updated.push(`${dep}@${spec}（新装）`)
+      } catch {}
+      continue
+    }
+    try {
+      const current = JSON.parse(readFileSync(currentPath, 'utf8'))
+      if (current.version === spec) continue
+      await curlManualInstall(profileDir, dep, registries, null, spec)
+      updated.push(`${dep}@${spec}`)
+    } catch {}
+  }
+  return updated
+}
+
 async function runInstallJob(job, ctx) {
   try {
     job.stage = 'preparing'
@@ -2465,7 +2522,7 @@ async function runInstallJob(job, ctx) {
           if (existsSync(existingTarget)) {
             try {
               const existingPkg = JSON.parse(readFileSync(existingTarget, 'utf8'))
-              if (existingPkg && existingPkg.name === name) {
+              if (existingPkg && existingPkg.name === name && job.update !== true) {
                 installedName = name
                 job.curlNote = `已检测到本地已安装 ${name}@${existingPkg.version ?? '?'}，跳过重复下载`
               }
@@ -2615,6 +2672,13 @@ async function runInstallJob(job, ctx) {
       return
     }
     job.packageName = installedName
+    // 聚合包子包版本对齐（确保更新后所有子包也到新版声明版本）
+    try {
+      const synced = await syncAggregateSubpackageVersions(profileDir, installedName, registries)
+      if (synced.length > 0) {
+        job.bundleNote = (job.bundleNote ? job.bundleNote + '；' : '') + `子包版本对齐：更新 ${synced.length} 个（${synced.join('、')}）`
+      }
+    } catch {}
     // 聚合包完整性保障（防崩）：bundle patch 引用的包缺失 → 补装；仍缺自动禁用该行
     try {
       const integrity = await ensureBundlePatchIntegrity(profileDir, installedName, patchPath)
@@ -2757,13 +2821,15 @@ async function handle(ctx, req, res) {
     const redirect = `http://127.0.0.1:${port}/plugin-console/gitee-oauth-callback`
     // scope 请求 user_info + projects：Gitee 会校验请求的 scope 必须在应用已勾选的权限范围内，
     // 应用权限必须同步勾选 user_info、projects，否则报「请求范围无效、未知或格式不正确」
-    const url = `${GITEE_AUTH_URL}?client_id=${encodeURIComponent(gitee.clientId)}&redirect_uri=${encodeURIComponent(redirect)}&response_type=code&scope=${encodeURIComponent('user_info projects')}`
-    sendJson(res, 200, { ok: true, url, redirect })
+    const state = createGiteeOAuthState()
+    const url = `${GITEE_AUTH_URL}?client_id=${encodeURIComponent(gitee.clientId)}&redirect_uri=${encodeURIComponent(redirect)}&response_type=code&scope=${encodeURIComponent('user_info projects')}&state=${encodeURIComponent(state)}`
+    sendJson(res, 200, { ok: true, url, redirect, state })
     return
   }
 
   if (method === 'GET' && pathname === `${ROUTE_PREFIX}/gitee-oauth-callback`) {
     const code = new URL(req.url ?? '/', 'http://x').searchParams.get('code')
+    const state = new URL(req.url ?? '/', 'http://x').searchParams.get('state')
     const sources = readSources()
     const gitee = readGiteeConfig(sources)
     const failPage = (text) => {
@@ -2774,6 +2840,10 @@ async function handle(ctx, req, res) {
       failPage('这是 Gitee 授权回调地址，不能直接访问。<br>正确流程：插件面板 → 软件源管理 → 填入 client_id / client_secret → 保存配置 → 点击「授权登录 Gitee」，授权完成后会自动跳回这里。')
       return
     }
+    if (!state || !consumeGiteeOAuthState(state)) {
+      failPage('Gitee OAuth state 校验失败，请重新发起授权。')
+      return
+    }
     if (!gitee.clientId || !gitee.clientSecret) {
       failPage('未配置 Gitee 应用：请先在 gitee.com 创建第三方应用（回调地址填本页完整地址），再在插件面板 → 软件源管理 中填入 client_id / client_secret 并保存。')
       return
@@ -3179,10 +3249,10 @@ async function handle(ctx, req, res) {
       const short = repo.split('/')[1] ?? repo
       const hasInstallScript = (await rawTextWithFallback(repo, branch, 'install.ps1')) !== null
         || (await rawTextWithFallback(repo, branch, 'install.sh')) !== null
-      // 纯命令（无注释，CMD/PowerShell 通用）；sslVerify=false 兼容本机证书链问题；
+      // 纯命令（无注释，CMD/PowerShell 通用）；不再关闭 TLS 校验；
       // 脚本用 powershell -File 调用，CMD 里也能跑
       installCommand = [
-        `git -c http.sslVerify=false clone --recurse-submodules https://github.com/${repo}.git`,
+        `git clone --recurse-submodules https://github.com/${repo}.git`,
         `cd ${short}`,
         hasInstallScript
           ? `powershell -ExecutionPolicy Bypass -File install.ps1`
@@ -3912,6 +3982,33 @@ async function handle(ctx, req, res) {
     return
   }
 
+  if (pathname === `${ROUTE_PREFIX}/self-update`) {
+    // Hub 自身一键更新：下载 npm 最新 tarball 到当前 profile，成功后由前端重启生效
+    let selfVersion = null
+    try {
+      const selfPkg = JSON.parse(readFileSync(createRequire(import.meta.url).resolve('../package.json'), 'utf8'))
+      selfVersion = typeof selfPkg.version === 'string' ? selfPkg.version : null
+    } catch {}
+    let latest = null
+    try {
+      const data = await fetchJsonUrl('https://registry.npmmirror.com/@noob-stupid%2fdsh-plugin-console')
+      latest = data?.['dist-tags']?.latest ?? null
+    } catch {}
+    if (!latest || selfVersion === null || latest === selfVersion) {
+      sendJson(res, 200, { ok: false, current: selfVersion, latest, updated: false, reason: latest === selfVersion ? '已是最新版本' : '版本检测失败' })
+      return
+    }
+    const profileDir = dirname(findPatchPath(ctx))
+    const registries = orderedRegistries(readSources())
+    try {
+      const info = await curlManualInstall(profileDir, '@noob-stupid/dsh-plugin-console', registries)
+      sendJson(res, 200, { ok: true, current: selfVersion, latest, updated: true, version: info.version, note: '已下载最新代码，重启服务后生效' })
+    } catch (error) {
+      sendError(res, 500, `Hub 自动更新失败：${error instanceof Error ? error.message : String(error)}`)
+    }
+    return
+  }
+
   if (pathname === `${ROUTE_PREFIX}/install`) {
     // repo 允许为空：纯 registry 更新（已安装插件的"检测更新"走此路径，无 git 兜底）
     const rawRepo = typeof body.repo === 'string' ? body.repo.trim() : ''
@@ -3963,6 +4060,7 @@ async function handle(ctx, req, res) {
       aiNote: null,
       subpackages: null,
       lastError: null,
+        update: body.update === true,
       kind,
     }
     installJobs.set(job.id, job)

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@noob-stupid/dsh-plugin-console",
-    "version": "0.3.19",
+    "version": "0.3.20",
     "description": "DSH plugin management panel & marketplace: one-click enable/disable, multi-source market (GitHub/Gitee/custom), static-index market (500+ plugins / 300 skills), skills, suites, and one-click framework upgrade.",
     "repository": {
         "type": "git",