@noob-stupid/dsh-plugin-console 0.3.56 → 0.3.58

package/README.md

@@ -308,7 +308,7 @@ MIT
 
 The layered-refactor preview lives in its **own repository**: [**`Noob-stupid/dsh-plugin-hub-refactor`**](https://github.com/Noob-stupid/dsh-plugin-hub-refactor)
 
-- **What it is**: the monolithic `lib/index.js` (8547 lines) split into layers — `lib/index.js` **141 lines** + `lib/server/**` **38 modules**; **feature-equivalent to `0.3.56`**, maintainability only;
+- **What it is**: the monolithic `lib/index.js` (8547 lines) split into layers — `lib/index.js` **141 lines** + `lib/server/**` **38 modules**; **feature-equivalent to `0.3.57`**, maintainability only;
 - **Verified**: 19 test suites green · 8 architecture-guard assertions · **route inventory identical** (`status` + response fields) against the stable build;
 - **Not yet exercised**: real framework upgrade / rollback, restart guardian, component start/stop, real AI run, Gitee OAuth (~10–25% long-tail risk, subjective);
-- **For everyday use** stick to npm `@noob-stupid/dsh-plugin-console@0.3.56`, or `main` of this repo.
+- **For everyday use** stick to npm `@noob-stupid/dsh-plugin-console@0.3.58`, or `main` of this repo.

package/README.zh.md

@@ -275,9 +275,9 @@ MIT
 
 分层重构预览线在**独立仓库**：[**`Noob-stupid/dsh-plugin-hub-refactor`**](https://github.com/Noob-stupid/dsh-plugin-hub-refactor)
 
-- **它是什么**：把单体 `lib/index.js`（8547 行）拆成分层结构 —— `lib/index.js` **141 行** + `lib/server/**` **38 个模块**，**功能与 `0.3.56` 等价**，只为可维护性；
+- **它是什么**：把单体 `lib/index.js`（8547 行）拆成分层结构 —— `lib/index.js` **141 行** + `lib/server/**` **38 个模块**，**功能与 `0.3.57` 等价**，只为可维护性；
 - **已验证**：19 套测试全绿 · 8 条架构守卫断言 · 与稳定版逐条对打**路由清单一致**（`status` + 响应字段）；
 - **已实测**（2026-09-20 真装真卸演练）：普通插件 / bundle 插件 / 无 npm 仓库 / 套装 / 技能 / 聚合仓库子包 / 仓库落地 / 服务器组件启停；
 - **尚未实测**：真框架升级 / 真回滚、重启守护链路、AI 真跑、Gitee OAuth 回调（长尾风险主观估计 **10%~25%**）；
-- **日常使用请继续用**：npm `@noob-stupid/dsh-plugin-console@0.3.56`，或本仓库 `main`。
+- **日常使用请继续用**：npm `@noob-stupid/dsh-plugin-console@0.3.58`，或本仓库 `main`。
 - 请多反馈问题

package/lib/client.js

@@ -2519,7 +2519,7 @@ window.__ModuleLoader__.load({
 									} else if (data.ai === true) {
 										setMessage(t("installed") + "：" + data.packageName + "。" + (data.aiNote ?? t("aiRepaired")));
 									} else {
-										setMessage(t("installed") + "：" + data.packageName + "（" + (data.entryId ?? "") + "）。" + (data.curlNote ?? (data.bundle ? t("bundleNote") : t("installNote"))) + (data.bundleNote ? "。" + data.bundleNote : ""));
+										setMessage(t("installed") + "：" + data.packageName + "（" + (data.entryId ?? "") + "）。" + (data.curlNote ?? (data.bundle ? t("bundleNote") : t("installNote"))) + (data.bundleNote ? "。" + data.bundleNote : "") + (data.lockNote ? "。⚠️ " + data.lockNote : ""));
 									}
 									if (data.kind === "skill") {
 										// 技能无需页面刷新

package/lib/index.js

@@ -2692,7 +2692,7 @@ export async function searchSubpackageItems(query, token = null, signal = null)
     )
     for (const hit of (codeData.items ?? []).slice(0, 10)) {
       const hitPath = typeof hit.path === 'string' ? hit.path : ''
-      if (!/^(?:packages|examples|plugins|skills|apps|extensions|src|lib)\/[^/]+\/package\.json$/u.test(hitPath)) continue
+      if (!/^(?!node_modules\/)[^/]+(?:\/[^/]+)?\/package\.json$/u.test(hitPath)) continue
       const repoName = hit.repository?.full_name ?? ''
       if (!repoName) continue
       const dir = hitPath.split('/').slice(0, -1).join('/')
@@ -3211,7 +3211,10 @@ function installJobView(job) {
     subpackages: job.subpackages ?? null,
     source: job.source ?? 'github',
     curlNote: job.curlNote ?? null,
-    bundleNote: job.bundleNote ?? null,
+    bundleNote: job.bundleNote ?? null,
+    lockUpdated: job.lockUpdated ?? null,
+    lockVersion: job.lockVersion ?? null,
+    lockNote: job.lockNote ?? null,
     compatNote: job.compatNote ?? null,
     kind: job.kind ?? 'plugin',
     skillName: job.skillName ?? null,
@@ -3636,7 +3639,10 @@ export async function runSuiteInstallJob(job, ctx) {
         copyTree(subDir, target)
         const taken = new Set(listEntries(ctx).map((e) => e.rowId))
         const entryId = deriveEntryId(pkg.name, taken)
-        await appendInsert(patchPath, entryId, pkg.name)
+        await appendInsert(patchPath, entryId, pkg.name)
+        // 记下套装装配出的包名：它们是 copyTree 铺进去的、不在 pnpm-lock.yaml 里，交给调用方统一对账
+        if (!Array.isArray(job.suiteInstalled)) job.suiteInstalled = []
+        if (!job.suiteInstalled.includes(pkg.name)) job.suiteInstalled.push(pkg.name)
         report.push({ component: sub.name, type: 'plugin', ok: true, note: `已安装 ${pkg.name}（HMR 生效）` })
         handled = true
       }
@@ -3817,7 +3823,7 @@ async function fetchSubpackageNames(repo, branch, auth) {
   try {
     const data = await githubJson(`${GITHUB_API}/repos/${repo}/git/trees/${encodeURIComponent(branch)}?recursive=1`, undefined, auth)
     const paths = (data.tree ?? [])
-      .filter((node) => node.type === 'blob' && /^(?:packages|examples|plugins|skills|apps|extensions|src|lib)\/[^/]+\/package\.json$/u.test(node.path))
+      .filter((node) => node.type === 'blob' && /^(?!node_modules\/)[^/]+(?:\/[^/]+)?\/package\.json$/u.test(node.path))
       .map((node) => node.path)
     // 并行读取：黑洞期单条最坏 40s，24 条串行会拖到十几分钟
     const results = await Promise.all(paths.slice(0, 24).map(async (path) => {
@@ -5199,6 +5205,17 @@ async function runInstallJob(job, ctx) {
       if (resolveInstallKind(job.kind, await probeGitmodules(job.repo)) === 'suite') {
         job.kind = 'suite'
         const suiteResult = await runSuiteInstallJob(job, ctx)
+    // 套装装配出的普通插件同样对账，避免之后被 pnpm 还原/清理
+    if (Array.isArray(job.suiteInstalled) && job.suiteInstalled.length > 0) {
+      try {
+        const lock = await reconcileLockfile({ profileDir, packages: job.suiteInstalled.map((name) => ({ name })), registries })
+        job.lockUpdated = lock.lockUpdated
+        job.lockVersion = lock.lockVersion
+        job.lockMethod = lock.method
+        job.lockPackages = lock.packages
+        if (lock.lockNote !== null) job.lockNote = lock.lockNote
+      } catch {}
+    }
         // clone 后才发现没有 .gitmodules（探测假阳性 / 仓库已重构）→ 回落普通安装，不给用户一个失败
         if (suiteResult?.notASuite !== true) return
         job.kind = 'plugin'
@@ -5294,6 +5311,11 @@ async function runInstallJob(job, ctx) {
     job.candidateTotal = candidates.length
     job.candidateDone = false
     for (let index = 0; index < candidates.length && installedName === null; index += 1) {
+      // Issue（2026-09-21）：subpackageMode 只表达"优先装子包"，不该连坐禁用其它通道。
+      // curl 通道按 name 走 registry（与根包是否 private 无关）→ 子包候选也开放；
+      // release/git 通道是按 job.repo 说的 → 只在"候选就是被请求的那个包"时试，避免对 private 根做无意义尝试。
+      const repoChannelAllowed = !subpackageMode || job.packageName === null || name === job.packageName
+            // 明明 UI 推荐的 `dsh plugin add github:owner/repo` 和 release 通道都没被尝试过。现在：
       if (Date.now() > deadline) break
       const name = candidates[index]
       job.candidateIndex = index + 1
@@ -5312,7 +5334,7 @@ async function runInstallJob(job, ctx) {
           }
         }
         // 加法并行竞速：pnpm 与 curl 同时启动，先成功者生效；失败方 abort，不影响后续串行通道
-        if (installedName === null && !subpackageMode && !expanded) {
+        if (installedName === null && !expanded) {
           const raced = await raceInstallChannels(profileDir, name, registries)
           if (raced) {
             installedName = name
@@ -5337,7 +5359,7 @@ async function runInstallJob(job, ctx) {
       if (installedName === null) {
         // 通道 n+1：curl 手动安装（node 网络黑洞时 pnpm 下载卡死、curl 可用）——
         // 下载 registry tarball 解压到 node_modules，零依赖包可完整安装
-        if (!subpackageMode && !expanded) {
+        if (!expanded) {
           try {
             const info = await curlManualInstall(profileDir, name, registries)
             installedName = name
@@ -5353,7 +5375,7 @@ async function runInstallJob(job, ctx) {
         // 通道 n+1b：GitHub release 下载安装（npm 上不存在的包，例如面板自身
         // @deepseek-ai/dsh-plugin-console）——拉 latest release 源码 tarball → 盒子验证 → 覆盖。
         // 触发条件：curl 通道失败（registry 404/网络），且能从 job.repo 或已装包 repository 反查到 GitHub。
-        if (!subpackageMode && !expanded) {
+        if (repoChannelAllowed && !expanded) {
           let ghRepo = typeof job.repo === 'string' && job.repo !== '' && job.repo.includes('/') ? job.repo : null
           if (ghRepo === null) {
             try {
@@ -5378,7 +5400,7 @@ async function runInstallJob(job, ctx) {
       }
       if (installedName === null) {
         // 通道 n+2：git 通道（GitHub 走加速代理+直连；Gitee 走对应平台；各 60 秒封顶）
-        if (!subpackageMode && !expanded) {
+        if (repoChannelAllowed && !expanded) {
           const gitSpecs = job.source === 'gitee'
             ? [`git+https://gitee.com/${job.repo}.git`]
             : [
@@ -5492,6 +5514,20 @@ async function runInstallJob(job, ctx) {
       const adapt = await maybeAutoAdaptCompat({ profileDir, packageName: installedName, syncedNames, patchPath, ctx })
       if (adapt !== null && adapt.ran === true) job.compatNote = adapt.note
     } catch {}
+    // lock 对账（2026-09-21，用户报告的自更新缺陷同源）：主包 + 本次被补装/对齐的聚合子包一起核对，
+    // 一次 pnpm add 把漂移的包全写进 lock；对不上就留 lockNote，让面板如实告知（不假装成功）。
+    try {
+      const lock = await reconcileLockfile({
+        profileDir,
+        packages: [installedName, ...syncedNames].map((name) => ({ name })),
+        registries,
+      })
+      job.lockUpdated = lock.lockUpdated
+      job.lockVersion = lock.lockVersion
+      job.lockMethod = lock.method
+      job.lockPackages = lock.packages
+      if (lock.lockNote !== null) job.lockNote = lock.lockNote
+    } catch {}
     job.stage = 'configuring'
     // 2026-09-06 事故（i18n 更新变重复行）：@linxin666/dsh-i18n 声明了 dsh.bundle.patch，
     // 更新流程按「bundle 安装规则」把它追加进 bundles → 与全家桶内的 web-ui-i18n 行（同包）重复。
@@ -5694,6 +5730,63 @@ export async function selfUpdateToLatest({ profileDir, latest, registries, curlM
   return { method, spec, installedVersion: installed, lockVersion: lock, lockUpdated, lockNote, command, note: noteParts.join('；'), errors }
 }
 
+
+/**
+ * 通用 lock 对账（**任何**安装通道装完都该调用，支持一次对账多个包）。
+ * 走非 pnpm 通道（并行 curl / curl tarball / GitHub Release / git 装配 / 套装 copyTree / 聚合子包补装）装的包，
+ * node_modules 里的版本与 `pnpm-lock.yaml` 记的版本可能不一致——之后任何 pnpm 操作（开关插件改
+ * `dsh.profile.bundles`、`dsh plugin add/remove`）都可能按 lock 把它还原或当外来物处理。这里：
+ *   ① 全部一致 → 直接返回（不跑 pnpm，零成本）；
+ *   ② 有漂移 → **一次** `pnpm add <pkg1>@<v1> <pkg2>@<v2> …` 把漂移包精确写进 lock；
+ *   ③ 仍对不上 → 返回 lockNote（逐包列出）+ 可复制命令，由调用方如实展示，绝不假装成功。
+ */
+export async function reconcileLockfile({ profileDir, packageName = null, packages = null, registries = [], pnpmAdd = pnpmInstall, execOpts = {} }) {
+  const targets = Array.isArray(packages)
+    ? packages.filter((p) => p && typeof p.name === 'string' && p.name !== '')
+    : (packageName === null ? [] : [{ name: packageName, version: null }])
+  const unique = []
+  for (const t of targets) if (!unique.some((u) => u.name === t.name)) unique.push(t)
+  const command = (name, version) => `dsh plugin --profile <你的profile> add ${name}@${version ?? '<版本>'}`
+  const snap = () => unique.map((t) => ({
+    name: t.name,
+    spec: profileSpecOf(profileDir, t.name),
+    installed: readInstalledVersion(profileDir, t.name),
+    lock: lockVersionOf(profileDir, t.name),
+  }))
+  const drift = (rows) => rows.filter((r) => r.installed === null || r.installed !== r.lock)
+  let rows = snap()
+  let drifted = drift(rows)
+  const errors = []
+  let method = null
+  if (drifted.length > 0) {
+    const specs = drifted.filter((r) => r.installed !== null).map((r) => `${r.name}@${r.installed}`)
+    if (specs.length > 0) {
+      try {
+        await pnpmAdd(profileDir, specs.length === 1 ? specs[0] : specs, registries?.[0])
+        method = 'pnpm-add'
+      } catch (error) {
+        errors.push(`pnpm add 对齐失败：${error instanceof Error ? error.message : String(error)}`)
+      }
+    }
+    rows = snap()
+    drifted = drift(rows)
+  }
+  const lockUpdated = drifted.length === 0
+  return {
+    method,
+    packages: rows.map((r) => ({ name: r.name, installedVersion: r.installed, lockVersion: r.lock, aligned: r.installed !== null && r.installed === r.lock })),
+    spec: rows.length === 1 ? rows[0].spec : null,
+    installedVersion: rows.length === 1 ? rows[0].installed : null,
+    lockVersion: rows.length === 1 ? rows[0].lock : null,
+    lockUpdated,
+    lockNote: lockUpdated
+      ? null
+      : `${drifted.length} 个包没写进 pnpm-lock.yaml（${drifted.map((r) => `${r.name}：装了 ${r.installed ?? '未知'}／lock 里是 ${r.lock ?? '未记录'}`).join('；')}）：之后任何 pnpm 操作（开关插件、dsh plugin add/remove）都可能把它们还原。要钉住请执行：${command(drifted[0].name, drifted[0].installed)}`,
+    command: drifted.length > 0 ? command(drifted[0].name, drifted[0].installed) : command(rows[0]?.name ?? '', rows[0]?.installed ?? null),
+    errors,
+  }
+}
+
 export function apply(ctx) {
   // 恢复 AI 赋能任务（restart 后 running 置失败，plan-ready/结果保留）
   loadAiJobs()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noob-stupid/dsh-plugin-console",
-  "version": "0.3.56",
+  "version": "0.3.58",
   "description": "DSH plugin management panel & marketplace: one-click enable/disable, multi-source market (GitHub/Gitee/custom), static-index market (500+ plugins / 300 skills), skills, suites, and one-click framework upgrade.",
   "repository": {
     "type": "git",