@noob-stupid/dsh-plugin-console 0.3.25 → 0.3.26

package/README.md

@@ -20,13 +20,16 @@
 
 
 
-> ## 🎉 v0.3.24 — AI Empower released (2026-08-31)
+> ## 🎉 v0.3.25 released — framework-upgrade safety & plugin adapt gate (2026-09-04)
 >
-> Give the Plugin Console a package name or GitHub repo: the local AI reads its docs,
-> drafts a **deployment plan** (install / write config / start service / health check),
-> and — after your confirmation — executes it safely. Server-type components get an
-> automatic control card (start/stop/status/open + dropdown). An OpenViking template
-> deploys a local memory server in one flow.
+> **Upgrade safety trio**: framework root detection (fixes the `.pnpm` realpath
+> mixed-version root cause), a **full-tree checkpoint** before upgrade, and
+> **automatic full-tree rollback** on install/relaunch failure — plus a
+> **one-click rollback** button on the framework card.
+> **Plugin adapt gate**: plugins incompatible with the new framework are
+> force-disabled (enable locked); 「Check update → Update & adapt」auto-verifies
+> declarations/dependencies and unlocks on success; AI Empower pre-checks
+> framework compatibility during planning.
 >
 > **Install:**
 > ```bash
@@ -82,6 +85,7 @@ auto-rollback).
 | | Benefit | Detail |
 |---|---|---|
 | 🤖 | **AI Empower (v0.3.24)** | Give the console a package name or GitHub repo — the local AI reads docs, drafts a **deployment plan** (install / write config / start service / health check) and executes it safely after your confirmation; server-type components get an automatic control card |
+| 🛡️ | **Framework upgrade safety & adapt gate (v0.3.25)** | Force-disables plugins incompatible with the new framework (enable locked; 「Check update → Update & adapt」auto-verifies and unlocks); full-tree checkpoint before upgrade, automatic rollback on relaunch failure, one-click rollback to the previous version |
 | 🚀 | **Server component cards** | Left-side floating card auto-aligned to the main panel: start / stop / status / **open Web UI** buttons, multi-server dropdown, collapsible |
 | 🧩 | **Plugin & skill hub** | Auto-collected index of `dsh-plugin` topic repos (**500+** by stars) plus a **Skills tab** (`agent-skills` ∪ `claude-skills` ∪ `dsh-skill`, up to 300) — browse, search, one-click install, no GitHub API calls |
 | 🤖 | **Auto-collection CI** | GitHub Actions reruns `build-index` every 6 hours (manual trigger available); authors just add the `dsh-plugin` / `agent-skills` / `claude-skills` / `dsh-skill` topic — no application needed |
@@ -246,6 +250,47 @@ Requires: DSH ≥ 0.1.0-rc.6 (web profile, with `dsh-client-modules` / `dsh-host
 - **Card dismiss semantics**: terminal states (done/failed) are permanently dismissed on ✕
   (persisted); in-progress dismissal is session-only and the card returns after a refresh.
 
+### Framework upgrade safety & plugin adapt gate (v0.3.25)
+
+> Origin: the 2026-09-04 DSH `0.1.1-rc.2 → 0.1.2-rc.1` incident — the upgrade script ran in
+> the wrong working directory, overwrote the new CLI into the old `.pnpm` entry, left a
+> mixed-version tree, and the service could not start. This version makes upgrade safety
+> and plugin compatibility detection first-class console mechanisms.
+
+**Upgrade safety trio**
+
+1. **Framework root detection**: locates the real install root (the top-level `node_modules`
+   containing `.pnpm`), fixing the `require.resolve`-returns-`.pnpm`-realpath root cause
+   (relink no-op / new package overwriting the old tree); refuses to upgrade when the root
+   cannot be identified (service stays running);
+2. **Full-tree checkpoint before upgrade**: mirrors every `@deepseek-ai` version package in
+   `.pnpm` + the top-level scope + `lock.yaml`
+   (under `~/.dsh/plugin-console/framework-backups/<version>/fw-tree/`);
+3. **Automatic full-tree rollback + retry**: install failure or relaunch failure restores
+   the pre-upgrade tree and relaunches automatically — no more "please run it manually"
+   dead-ends; after rollback, relink/repair steps are skipped to avoid damaging the
+   restored tree a second time.
+
+**One-click rollback**: after an upgrade the framework card shows a **「回滚到上一版」** button
+(`/plugin-console/framework-rollback`): stop service → restore full tree → relaunch →
+health check, state visible throughout.
+
+**Plugin adapt gate (compatibility detection)**
+
+- After an upgrade, plugin entries recorded in `~/.dsh/plugin-console/compat-pending.json`
+  are **force-disabled**; the enable button is locked and the server rejects `/toggle` with
+  409 (unbypassable). The enabled-button label itself shows「待适配」as the state hint;
+- The **details** panel explains the flow: **Check update → Update & adapt**;
+- **Post-update auto-verification**: scans the latest `package.json` for an explicit
+  `dsh.engines.framework` / `engines.dsh` declaration plus `@deepseek-ai/*` dependency
+  ranges (built-in zero-dependency semver engine — strict npm prerelease rules for
+  dependencies, loose for explicit declarations); if the version changed and no
+  incompatibility was found, the `disabled` block is **removed automatically** and the row
+  unlocks; aggregator updates validate all synced subpackages too;
+- **AI Empower pre-check**: during planning the server pre-checks the registry's latest
+  declaration and adapt-gate hits, injects them into the subagent prompt (the plan must
+  explain the conclusion to the user) and marks it on the plan panel (red for incompatible).
+
 ### Marketplace (multi-source)
 
 - **Source switcher**: click the login pill to switch between **GitHub / Gitee / custom
@@ -349,6 +394,10 @@ GitHub Actions (every 6h, repo token)
 - Supports the **DSH 0.1.0 series** (`0.1.0-rc.6` and siblings).
 - The panel reads the running `@deepseek-ai/dsh-web-app` version: after a breaking upgrade
   (0.2 / 1.0) a compatibility warning appears instead of silent failure.
+- **Plugin adapt gate (v0.3.25)**: third-party plugins incompatible with the current
+  framework are force-disabled after an upgrade (enable locked); run 「Check update」to
+  upgrade the plugin first — it unlocks automatically after the auto-verification passes.
+  See 「Framework upgrade safety & plugin adapt gate」.
 - Likely breaking seams: patch semantics, `webServer.register`, loader entry shape,
   `dsh.client` bundle format, `settings.plugins.tab` slot.
 - Deploy scripts do not check versions; the in-panel warning is authoritative.
@@ -390,6 +439,11 @@ test-harness.mjs   Logic self-test (state/toggle/validation/loopback; search SKI
 | `/plugin-console/gitee-oauth-url` / `gitee-oauth-callback` | GET | Gitee OAuth flow |
 | `/plugin-console/ai-consent` | POST | Approve/cancel the AI-fallback step |
 | `/plugin-console/restart` | POST | Watchdog-safe self-restart (panel button equivalent) |
+| `/plugin-console/framework-upgrade` | POST | One-click framework upgrade (full-tree checkpoint → online install → rollback protection) |
+| `/plugin-console/framework-rollback` | POST | One-click rollback to the previous version (stop → full-tree restore → auto relaunch → health check) |
+| `/plugin-console/self-update` | POST | Update the console itself (latest npm tarball into the profile) |
+| `/plugin-console/ai-empower/plan` / `status` / `run` / `cancel` | POST | AI Empower: plan (with framework compat pre-check) → status polling → confirmed run → cancel |
+| `/plugin-console/components` / `component/start` / `stop` / `status` | GET/POST | Server component registry and start/stop/status |
 
 ---
 

package/README.zh.md

@@ -6,11 +6,12 @@
 
 # DSH 插件中心（dsh-plugin-hub）
 
-> ## 🎉 v0.3.24 正式发布 — AI 赋能一键部署（2026-08-31）
+> ## 🎉 v0.3.25 正式发布 — 框架升级安全与插件适配门（2026-09-04）
 >
-> 在插件控制台输入 npm 包名或 GitHub 仓库，本地 AI 读取文档自动生成**部署计划**，
-> 你确认后安全执行；服务器类组件自动生成控制卡片（启动/停止/状态/打开 + 下拉）。
-> 内置 OpenViking 模板，一条指令部署本地记忆服务器。
+> **升级安全三件套**：框架安装根识别（修复 `.pnpm` realpath 混版本根因）、升级前**全树 checkpoint**、
+> 拉起失败**自动全树回滚**；升级后框架卡片**一键回滚到上一版**。
+> **插件适配门**：升级后不兼容插件强制禁用（启用锁定），「检测更新 → 更新并适配」→
+> 自动校验声明/依赖，通过即解锁；AI 赋能规划时自动预检框架适配并给出说明。
 >
 > **安装：**
 > ```bash
@@ -75,6 +76,7 @@
 | | 优势 | 说明 |
 |---|---|---|
 | 🤖 | **AI 赋能（v0.3.24）** | 输入 npm 包名 / GitHub 仓库，本地 AI 读文档生成**部署计划**（安装/写配置/启动服务/健康检查），你确认后安全执行；服务器类组件自动生成控制卡片 |
+| 🛡️ | **框架升级适配门与安全（v0.3.25）** | 升级后不兼容插件强制禁用（适配门锁定，「检测更新 → 更新并适配 → 自动校验解锁」）；升级前全树 checkpoint、拉起失败自动全树回滚、框架卡片一键回滚到上一版 |
 | 🚀 | **服务器组件卡片** | 左侧浮卡与主面板顶边对齐：启动 / 停止 / 状态 / 【打开】直达 Web UI，多服务器下拉、可折叠（状态记忆） |
 | 🧩 | **插件 + 技能双市场** | 自动收录 `dsh-plugin` topic 仓库（按 star **500+**），另有**技能 tab**（`agent-skills` ∪ `claude-skills` ∪ `dsh-skill`，最多 300）——浏览、搜索、一键安装，零 GitHub API 调用；插件自带技能（如 openviking-memory）只读展示 |
 | 🤖 | **自动收录 CI** | GitHub Actions 每 6 小时自动重跑 `build-index`（也支持手动触发）；作者只需给自己的仓库打 `dsh-plugin` / `agent-skills` / `claude-skills` / `dsh-skill` 标签，**无需申请、无需审核** |
@@ -227,6 +229,37 @@ git clone https://github.com/Noob-stupid/dsh-plugin-hub /tmp/dsh-plugin-console
 - **卡片关闭语义**：终态（成功/失败）点叉号永久关闭（持久化）；进行中点叉号仅本次会话
   隐藏，刷新后恢复显示。
 
+### 框架升级适配门与升级安全（v0.3.25）
+
+> 缘起：2026-09-04 DSH `0.1.1-rc.2 → 0.1.2-rc.1` 升级事故——升级脚本在错误的工作目录执行，
+> 把新 CLI 原位覆盖进旧 `.pnpm` 目录、依赖树混版本，服务无法拉起。本版本把「升级安全」与
+> 「插件兼容检测」固化为控制台机制。
+
+**升级安全三件套**
+
+1. **框架安装根识别**：定位真正的框架安装根（含 `.pnpm` 的顶层 `node_modules`），修复
+   `require.resolve` 返回 `.pnpm` 内部 realpath 导致的「重链空转 / 新包覆盖旧目录」根因；
+   定位不到时**拒绝升级**（不 kill 服务、服务保持运行）；
+2. **升级前全树 checkpoint**：镜像 `.pnpm` 全部 `@deepseek-ai` 版本包 + 顶层 scope +
+   `lock.yaml`（写入 `~/.dsh/plugin-console/framework-backups/<版本>/fw-tree/`）；
+3. **拉起失败自动全树回滚并重试**：安装失败或服务拉起失败都会自动恢复升级前全树并再次拉起，
+   不再只留「请手动运行」提示；回滚后跳过重链/修复（避免对已恢复旧树二次破坏）。
+
+**一键回滚**：升级后框架卡片出现「回滚到上一版」按钮（`/plugin-console/framework-rollback`）：
+停服 → 全树恢复 → 自动拉起 → 健康检测，全程状态可见。
+
+**插件适配门（插件检测）**
+
+- 升级后写入 `~/.dsh/plugin-console/compat-pending.json` 的插件行被**强制禁用**，启用按钮
+  锁定（服务端 `/toggle` 直接 409，无法绕过）；行状态以按钮文案「待适配」提示；
+- 「详情」面板给出说明与入口：**检测更新 → 更新并适配**；
+- **更新后自动校验**：扫描最新版 `package.json` 的 `dsh.engines.framework` / `engines.dsh`
+  显式声明 + `@deepseek-ai/*` 依赖范围（内置零依赖 semver 判定器：依赖判定遵循 npm
+  prerelease 严格规则、声明判定宽松）；版本已变化且未判定不兼容 → **自动移除禁用块解锁**；
+  聚合包更新连带校验同步的子包；
+- **AI 赋能适配预检**：规划时服务端预检 registry 最新版声明与适配门命中情况，注入子代理
+  提示词（要求计划向用户解释适配结论），并在计划面板标注（不兼容标红）。
+
 ### 插件市场（多搜索源）
 
 - **搜索源切换**：点击顶部登录态标识弹出菜单，在 **GitHub / Gitee / 自定义源** 间切换（选择持久化）；
@@ -323,6 +356,9 @@ GitHub Actions（每 6 小时，仓库自带 token）
 - 当前支持 **DSH 0.1.0 系列**（`0.1.0-rc.6` 及同系列版本）。
 - 面板会读取运行中的 `@deepseek-ai/dsh-web-app` 版本：官方发布破坏性升级
   （0.2 / 1.0 等）后，面板顶部会显示兼容性警告并给出本仓库地址，而不是默默失效。
+- **插件适配门（v0.3.25）**：框架升级后不兼容的第三方插件会被**强制禁用**（启用按钮锁定）；
+  请先「检测更新」升级该插件，更新并通过自动校验后才会解锁——详见
+  「框架升级适配门与升级安全」。
 - 官方破坏性更新可能改动的接口：补丁层语义、`webServer.register`、
   加载器条目结构、`dsh.client` bundle 格式、`settings.plugins.tab` 插槽。
   届时随官方版本更新本仓库即可（依赖面已收窄到上述几个点）。
@@ -341,6 +377,7 @@ scripts/apply-framework-patch.cjs   框架层补丁（issue #5，幂等，可重
 marketplace/index.json         生成的静态索引（jsDelivr CDN 分发）
 deploy.ps1 / deploy.sh   一键部署脚本（Windows / Linux·macOS）
 test-harness.mjs   逻辑自检（state/toggle/校验/环回保护；搜索视网络环境 SKIP）
+test-compat-gate.mjs   适配门单元测试（内置 semver 判定器：声明/依赖兼容规则）
 ```
 <img width="1878" height="945" alt="image" src="https://github.com/user-attachments/assets/b26f2f19-0ba4-4be7-9ca1-b3fd4c51a7a8" />
 
@@ -365,6 +402,11 @@ test-harness.mjs   逻辑自检（state/toggle/校验/环回保护；搜索视
 | `/plugin-console/gitee-oauth-url` / `gitee-oauth-callback` | GET | Gitee OAuth 流程 |
 | `/plugin-console/ai-consent` | POST | 同意/取消 AI 兜底步骤 |
 | `/plugin-console/restart` | POST | 自带守护的安全自重启（等同面板按钮） |
+| `/plugin-console/framework-upgrade` | POST | 框架一键升级（全树 checkpoint → 在线安装 → 全树回滚保护） |
+| `/plugin-console/framework-rollback` | POST | 一键回滚到升级前版本（停服 → 全树恢复 → 自动拉起 → 健康检测） |
+| `/plugin-console/self-update` | POST | 控制台自身一键更新（npm 最新 tarball 到当前 profile） |
+| `/plugin-console/ai-empower/plan` / `status` / `run` / `cancel` | POST | AI 赋能：规划（含框架适配预检）→ 状态轮询 → 确认执行 → 取消 |
+| `/plugin-console/components` / `component/start` / `stop` / `status` | GET/POST | 服务器组件清单与启动/停止/状态 |
 
 ---
 

package/lib/client.js

@@ -1396,7 +1396,29 @@ window.__ModuleLoader__.load({
 			// 挂载时加载静态插件索引（GitHub 源空查询时秒开浏览，零 API 调用）
 			react.useEffect(() => {
 				call("/plugin-console/market-index").then(
-					(data) => { if (data && Array.isArray(data.items)) setIndexData({ items: data.items, skills: Array.isArray(data.skills) ? data.skills : [], loaded: true }); },
+					(data) => {
+						if (data && Array.isArray(data.items)) {
+							setIndexData({ items: data.items, skills: Array.isArray(data.skills) ? data.skills : [], loaded: true });
+							// ★「只看官方」需要官方标记：索引条目补标（网络/服务端此前判定失败时不动已有标记，避免 null 覆盖）
+							// 服务端 /enrich 已带 24h 结果缓存时，此处仅兜底浏览器直连失败部分。
+							const base = data.items;
+							enrichOfficialBundle(base).then((enriched) => {
+								if (!Array.isArray(enriched)) return;
+								const merged = enriched.map((e, i) => {
+									const b = base[i] ?? {};
+									return {
+										...e,
+										official: e.official !== null ? e.official : (b.official ?? null),
+										aggregate: e.aggregate === true || b.aggregate === true,
+										aggregateInstallable: b.aggregateInstallable === true,
+										hasSkill: e.hasSkill === true || b.hasSkill === true,
+										hasSuite: e.hasSuite === true || b.hasSuite === true,
+									};
+								});
+								setIndexData((prev) => (prev !== null && prev.loaded === true ? { ...prev, items: merged } : prev));
+							});
+						}
+					},
 					() => {},
 				);
 				// 市场状态记忆：关闭前搜索过 → 重开时自动恢复该搜索（query 已从 localStorage 初始化）

package/lib/index.js

@@ -293,19 +293,67 @@ function semverRangeMatchLoose(versionText, rangeText) {
   return semverRangeMatch(`${v.major}.${v.minor}.${v.patch}`, rangeText)
 }
 
+/**
+ * 扫描已安装包源码，检测对已删除的 dsh-settings API 的引用
+ * （2026-09-04 教训：0.1.2-rc.1 起 settingsNamespace / installSettingsSection 已删除，
+ * 静态声明检查判 pass 是假通过；真实兼容性只有模块 import 时见分晓，而 loader 单行失败
+ * = 整个服务启动崩溃）。返回命中的符号列表，空数组 = 干净。
+ */
+function scanSettingsApiUsage(pkgDir) {
+  const found = []
+  const seen = new Set()
+  const walk = (dir, depth) => {
+    if (depth > 3) return
+    let entries = []
+    try { entries = readdirSync(dir, { withFileTypes: true }) } catch { return }
+    for (const entry of entries) {
+      const full = join(dir, entry.name)
+      if (entry.isDirectory()) {
+        if (entry.name === 'node_modules' || entry.name.startsWith('.')) continue
+        walk(full, depth + 1)
+        continue
+      }
+      if (!entry.isFile() || !/\.(?:js|mjs|cjs)$/u.test(entry.name)) continue
+      if (seen.has(full)) continue
+      seen.add(full)
+      if (seen.size > 120) return
+      try {
+        const text = readFileSync(full, 'utf8').slice(0, 400000)
+        for (const sym of ['settingsNamespace', 'installSettingsSection']) {
+          if (text.includes(sym) && !found.includes(sym)) found.push(sym)
+        }
+      } catch {}
+    }
+  }
+  walk(pkgDir, 0)
+  return found
+}
+
 /**
  * 插件-框架兼容校验（框架升级适配门）：
  * 1) 显式兼容声明（dsh.engines.framework / dsh.compat.framework / engines.dsh）：以声明为准；
- * 2) 否则扫描依赖/peerDeps 的 @deepseek-ai/*：任一范围明确不含框架版本 → fail；
- * 3) 无声明且依赖全部满足 → unknown（新版变动不大；由调用方在「版本已变化」前提下降级为放行）。
+ * 2) 扫描依赖/peerDeps 的 @deepseek-ai/*：任一范围明确不含框架版本 → fail；
+ * 3) 【硬判据】提供 pkgDir 时扫描包源码：命中已删除的 dsh-settings API
+ *    （settingsNamespace / installSettingsSection）→ 直接 fail（2026-09-04 教训：
+ *    0.3.6 全家仍引用旧 API，静态声明/依赖检查判 pass 是假通过，loader 单行失败 = 服务崩溃）；
+ * 4) 无声明且依赖全部满足 → unknown（新版变动不大；由调用方在「版本已变化」前提下放行）。
  * 返回 { decision: 'pass'|'fail'|'unknown', reason }。
  */
-function checkPluginFrameworkCompat(pkg, frameworkVersion) {
+function checkPluginFrameworkCompat(pkg, frameworkVersion, pkgDir = null) {
   const declared = pkg?.dsh?.engines?.framework ?? pkg?.dsh?.compat?.framework ?? pkg?.engines?.dsh ?? null
   if (typeof declared === 'string' && declared !== '') {
-    return semverRangeMatchLoose(frameworkVersion, declared)
-      ? { decision: 'pass', reason: `声明兼容范围 ${declared} 满足框架 ${frameworkVersion}` }
-      : { decision: 'fail', reason: `声明兼容范围 ${declared} 不满足当前框架 ${frameworkVersion}` }
+    const ok = semverRangeMatchLoose(frameworkVersion, declared)
+    if (!ok) return { decision: 'fail', reason: `声明兼容范围 ${declared} 不满足当前框架 ${frameworkVersion}` }
+  }
+  // 硬判据：实际源码扫描（比声明/依赖更接近真实兼容性）
+  if (pkgDir !== null && typeof pkgDir === 'string' && semverRangeMatchLoose(frameworkVersion, '>=0.1.2')) {
+    const broken = scanSettingsApiUsage(pkgDir)
+    if (broken.length > 0) {
+      return { decision: 'fail', reason: `源码仍引用 0.1.2 起已删除的 dsh-settings API（${broken.join('、')}）——实际不兼容，启用会让整个服务启动崩溃` }
+    }
+    if (typeof declared === 'string' && declared !== '') return { decision: 'pass', reason: `声明兼容范围 ${declared} 满足框架 ${frameworkVersion}，且源码无已删除 API 引用` }
+  } else if (typeof declared === 'string' && declared !== '') {
+    return { decision: 'pass', reason: `声明兼容范围 ${declared} 满足框架 ${frameworkVersion}` }
   }
   const deps = { ...(pkg?.dependencies ?? {}), ...(pkg?.peerDependencies ?? {}), ...(pkg?.optionalDependencies ?? {}) }
   const hits = Object.entries(deps).filter(([name]) => /^@deepseek-ai\//u.test(name))
@@ -1485,56 +1533,114 @@ async function fetchSkillMeta(repo, branch, skillDir) {
  * 全部条目并发 + raw 主站与镜像双通道竞速，单条 4 秒封顶。
  * 聚合仓库（根包 private+workspaces）额外检查子包是否有 dsh.bundle 清单：
  * 任一子包可 `dsh plugin add` 直装 → aggregateInstallable = true（★ 筛选会包含它）。 */
-async function enrichItems(items) {
-  return Promise.all(items.map(async (item) => {
-    let official = null
-    let aggregate = false
-    let aggregateInstallable = false
-    let hasSkill = false
-    let hasSuite = false
-    try {
-      const branch = item.defaultBranch ?? 'main'
-      const base = `https://raw.githubusercontent.com/${item.fullName}/${encodeURIComponent(branch)}/package.json`
-      const [pkgResult, skillResult, suiteResult] = await Promise.allSettled([
-        Promise.any([
-          curlText(base, 4000),
-          curlText(`https://ghproxy.net/${base}`, 4000),
-        ]),
-        detectSkillRepo(item.fullName, branch),
-        rawTextWithFallback(item.fullName, branch, '.gitmodules'),
-      ])
-      if (suiteResult.status === 'fulfilled' && suiteResult.value !== null) {
-        hasSuite = true
-      }
-      if (pkgResult.status === 'fulfilled') {
-        const pkg = JSON.parse(pkgResult.value)
-        if (typeof pkg.dsh?.bundle?.patch === 'string') {
-          official = true
-        } else if (pkg.private === true && (Array.isArray(pkg.workspaces) || /(^|-)dsh[-/]/u.test(String(pkg.name ?? '')))) {
-          aggregate = true
-          try {
-            const tree = await curlJson(`https://api.github.com/repos/${item.fullName}/git/trees/${encodeURIComponent(branch)}?recursive=1`, 6000)
-            const pkgPaths = (tree.tree ?? [])
-              .filter((n) => n.type === 'blob' && /^packages\/[^/]+\/package\.json$/u.test(n.path))
-              .map((n) => n.path)
-              .slice(0, 12)
-            if (pkgPaths.length > 0) {
-              const subs = await Promise.all(pkgPaths.map((p) => curlText(`https://raw.githubusercontent.com/${item.fullName}/${encodeURIComponent(branch)}/${p}`, 4000)
-                .then((t) => { try { return JSON.parse(t) } catch { return null } })
-                .catch(() => null)))
-              if (subs.some((sp) => sp && typeof sp.dsh?.bundle?.patch === 'string')) {
-                aggregateInstallable = true
-              }
+const ENRICH_CACHE_FILE = () => join(dshHome(), 'plugin-console', 'enrich-cache.json')
+const ENRICH_CACHE_TTL = 24 * 60 * 60 * 1000
+
+function readEnrichCache() {
+  try {
+    const j = JSON.parse(readFileSync(ENRICH_CACHE_FILE(), 'utf8'))
+    return j !== null && typeof j === 'object' ? j : {}
+  } catch { return {} }
+}
+function writeEnrichCache(cache) {
+  try {
+    mkdirSync(dirname(ENRICH_CACHE_FILE()), { recursive: true })
+    const entries = Object.entries(cache).sort((a, b) => (b[1]?.at ?? 0) - (a[1]?.at ?? 0)).slice(0, 2000)
+    writeFileSync(ENRICH_CACHE_FILE(), JSON.stringify(Object.fromEntries(entries), null, 2), 'utf8')
+  } catch {}
+}
+
+/** 单项识别：官方通道 / 聚合仓库 / 技能 / 套装（失败返回 official=null）。 */
+async function enrichItemOne(item) {
+  let official = /^deepseek-ai\//u.test(item.fullName ?? '') ? true : null
+  let aggregate = false
+  let aggregateInstallable = false
+  let hasSkill = false
+  let hasSuite = false
+  try {
+    const branch = item.defaultBranch ?? 'main'
+    const base = `https://raw.githubusercontent.com/${item.fullName}/${encodeURIComponent(branch)}/package.json`
+    const [pkgResult, skillResult, suiteResult] = await Promise.allSettled([
+      Promise.any([
+        curlText(base, 4000),
+        curlText(`https://ghproxy.net/${base}`, 4000),
+      ]),
+      detectSkillRepo(item.fullName, branch),
+      rawTextWithFallback(item.fullName, branch, '.gitmodules'),
+    ])
+    if (suiteResult.status === 'fulfilled' && suiteResult.value !== null) {
+      hasSuite = true
+    }
+    if (pkgResult.status === 'fulfilled') {
+      const pkg = JSON.parse(pkgResult.value)
+      if (typeof pkg.dsh?.bundle?.patch === 'string') {
+        official = true
+      } else if (pkg.private === true && (Array.isArray(pkg.workspaces) || /(^|-)dsh[-/]/u.test(String(pkg.name ?? '')))) {
+        aggregate = true
+        try {
+          const tree = await curlJson(`https://api.github.com/repos/${item.fullName}/git/trees/${encodeURIComponent(branch)}?recursive=1`, 6000)
+          const pkgPaths = (tree.tree ?? [])
+            .filter((n) => n.type === 'blob' && /^packages\/[^/]+\/package\.json$/u.test(n.path))
+            .map((n) => n.path)
+            .slice(0, 12)
+          if (pkgPaths.length > 0) {
+            const subs = await Promise.all(pkgPaths.map((p) => curlText(`https://raw.githubusercontent.com/${item.fullName}/${encodeURIComponent(branch)}/${p}`, 4000)
+              .then((t) => { try { return JSON.parse(t) } catch { return null } })
+              .catch(() => null)))
+            if (subs.some((sp) => sp && typeof sp.dsh?.bundle?.patch === 'string')) {
+              aggregateInstallable = true
             }
-          } catch {}
-        }
+          }
+        } catch {}
       }
-      if (skillResult.status === 'fulfilled' && skillResult.value?.hasSkill === true) {
-        hasSkill = true
+    }
+    if (skillResult.status === 'fulfilled' && skillResult.value?.hasSkill === true) {
+      hasSkill = true
+    }
+  } catch {}
+  return { ...item, official, aggregate, aggregateInstallable, hasSkill, hasSuite }
+}
+
+/**
+ * 批量识别（★ 筛选数据源）：并发限流 + 24h 结果缓存。
+ * 网络黑洞期（raw.githubusercontent 大部分拉取失败）自动回退缓存中的上次判定，
+ * 保证「只看官方」不因瞬时网络而坍缩成 0/1 条。
+ */
+async function enrichItems(items) {
+  const cache = readEnrichCache()
+  const out = new Array(items.length)
+  let next = 0
+  let cacheDirty = false
+  async function worker() {
+    while (true) {
+      const i = next
+      next += 1
+      if (i >= items.length) return
+      const item = items[i]
+      const key = `${item.fullName}@${item.defaultBranch ?? 'main'}`
+      const cached = cache[key]
+      try {
+        if (cached !== undefined && typeof cached?.at === 'number' && Date.now() - cached.at < ENRICH_CACHE_TTL && cached.data && (cached.data.official !== null || item.fullName.startsWith('deepseek-ai/'))) {
+          out[i] = { ...item, ...cached.data }
+          continue
+        }
+        let result = await enrichItemOne(item)
+        // 本次失败 → 回退缓存（哪怕已过期），避免「看天吃饭」
+        if ((result.official === null && !/^deepseek-ai\//u.test(item.fullName ?? '')) && cached?.data) {
+          result = { ...item, ...cached.data }
+        } else {
+          cache[key] = { at: Date.now(), data: { official: result.official, aggregate: result.aggregate, aggregateInstallable: result.aggregateInstallable, hasSkill: result.hasSkill, hasSuite: result.hasSuite } }
+          cacheDirty = true
+        }
+        out[i] = result
+      } catch {
+        out[i] = cached?.data ? { ...item, ...cached.data } : { ...item, official: null, aggregate: false, aggregateInstallable: false, hasSkill: false, hasSuite: false }
       }
-    } catch {}
-    return { ...item, official, aggregate, aggregateInstallable, hasSkill, hasSuite }
-  }))
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(12, items.length) }, worker))
+  if (cacheDirty) writeEnrichCache(cache)
+  return out
 }
 
 function githubRepoInfo(repo) {
@@ -3396,14 +3502,16 @@ async function maybeAutoAdaptCompat({ profileDir, packageName, syncedNames, patc
   const kept = []
   for (const p of targets) {
     let pkg = null
+    let pkgDir = null
     try {
       const require = createRequire(join(profileDir, 'package.json'))
       const pkgPath = require.resolve(`${p.moduleName}/package.json`)
       pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
+      pkgDir = dirname(pkgPath)
     } catch {}
     const version = typeof pkg?.version === 'string' ? pkg.version : null
     const changed = version !== null && version !== p.version
-    const check = pkg !== null ? checkPluginFrameworkCompat(pkg, fwVer) : { decision: 'unknown', reason: '无法读取包信息' }
+    const check = pkg !== null ? checkPluginFrameworkCompat(pkg, fwVer, pkgDir) : { decision: 'unknown', reason: '无法读取包信息' }
     if (changed && check.decision !== 'fail') {
       try { await removeDisableBlock(patchPath, p.rowId) } catch {}
       p.status = 'adopted'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noob-stupid/dsh-plugin-console",
-  "version": "0.3.25",
+  "version": "0.3.26",
   "description": "DSH plugin management panel & marketplace: one-click enable/disable, multi-source market (GitHub/Gitee/custom), static-index market (500+ plugins / 300 skills), skills, suites, and one-click framework upgrade.",
   "repository": {
     "type": "git",