@noob-stupid/dsh-plugin-console 0.3.57 → 0.3.58

package/README.md

@@ -311,4 +311,4 @@ The layered-refactor preview lives in its **own repository**: [**`Noob-stupid/ds
 - **What it is**: the monolithic `lib/index.js` (8547 lines) split into layers — `lib/index.js` **141 lines** + `lib/server/**` **38 modules**; **feature-equivalent to `0.3.57`**, maintainability only;
 - **Verified**: 19 test suites green · 8 architecture-guard assertions · **route inventory identical** (`status` + response fields) against the stable build;
 - **Not yet exercised**: real framework upgrade / rollback, restart guardian, component start/stop, real AI run, Gitee OAuth (~10–25% long-tail risk, subjective);
-- **For everyday use** stick to npm `@noob-stupid/dsh-plugin-console@0.3.57`, or `main` of this repo.
+- **For everyday use** stick to npm `@noob-stupid/dsh-plugin-console@0.3.58`, or `main` of this repo.

package/README.zh.md

@@ -279,5 +279,5 @@ MIT
 - **已验证**：19 套测试全绿 · 8 条架构守卫断言 · 与稳定版逐条对打**路由清单一致**（`status` + 响应字段）；
 - **已实测**（2026-09-20 真装真卸演练）：普通插件 / bundle 插件 / 无 npm 仓库 / 套装 / 技能 / 聚合仓库子包 / 仓库落地 / 服务器组件启停；
 - **尚未实测**：真框架升级 / 真回滚、重启守护链路、AI 真跑、Gitee OAuth 回调（长尾风险主观估计 **10%~25%**）；
-- **日常使用请继续用**：npm `@noob-stupid/dsh-plugin-console@0.3.57`，或本仓库 `main`。
+- **日常使用请继续用**：npm `@noob-stupid/dsh-plugin-console@0.3.58`，或本仓库 `main`。
 - 请多反馈问题

package/lib/index.js

@@ -2692,7 +2692,7 @@ export async function searchSubpackageItems(query, token = null, signal = null)
     )
     for (const hit of (codeData.items ?? []).slice(0, 10)) {
       const hitPath = typeof hit.path === 'string' ? hit.path : ''
-      if (!/^(?:packages|examples|plugins|skills|apps|extensions|src|lib)\/[^/]+\/package\.json$/u.test(hitPath)) continue
+      if (!/^(?!node_modules\/)[^/]+(?:\/[^/]+)?\/package\.json$/u.test(hitPath)) continue
       const repoName = hit.repository?.full_name ?? ''
       if (!repoName) continue
       const dir = hitPath.split('/').slice(0, -1).join('/')
@@ -3823,7 +3823,7 @@ async function fetchSubpackageNames(repo, branch, auth) {
   try {
     const data = await githubJson(`${GITHUB_API}/repos/${repo}/git/trees/${encodeURIComponent(branch)}?recursive=1`, undefined, auth)
     const paths = (data.tree ?? [])
-      .filter((node) => node.type === 'blob' && /^(?:packages|examples|plugins|skills|apps|extensions|src|lib)\/[^/]+\/package\.json$/u.test(node.path))
+      .filter((node) => node.type === 'blob' && /^(?!node_modules\/)[^/]+(?:\/[^/]+)?\/package\.json$/u.test(node.path))
       .map((node) => node.path)
     // 并行读取：黑洞期单条最坏 40s，24 条串行会拖到十几分钟
     const results = await Promise.all(paths.slice(0, 24).map(async (path) => {
@@ -5311,6 +5311,11 @@ async function runInstallJob(job, ctx) {
     job.candidateTotal = candidates.length
     job.candidateDone = false
     for (let index = 0; index < candidates.length && installedName === null; index += 1) {
+      // Issue（2026-09-21）：subpackageMode 只表达"优先装子包"，不该连坐禁用其它通道。
+      // curl 通道按 name 走 registry（与根包是否 private 无关）→ 子包候选也开放；
+      // release/git 通道是按 job.repo 说的 → 只在"候选就是被请求的那个包"时试，避免对 private 根做无意义尝试。
+      const repoChannelAllowed = !subpackageMode || job.packageName === null || name === job.packageName
+            // 明明 UI 推荐的 `dsh plugin add github:owner/repo` 和 release 通道都没被尝试过。现在：
       if (Date.now() > deadline) break
       const name = candidates[index]
       job.candidateIndex = index + 1
@@ -5329,7 +5334,7 @@ async function runInstallJob(job, ctx) {
           }
         }
         // 加法并行竞速：pnpm 与 curl 同时启动，先成功者生效；失败方 abort，不影响后续串行通道
-        if (installedName === null && !subpackageMode && !expanded) {
+        if (installedName === null && !expanded) {
           const raced = await raceInstallChannels(profileDir, name, registries)
           if (raced) {
             installedName = name
@@ -5354,7 +5359,7 @@ async function runInstallJob(job, ctx) {
       if (installedName === null) {
         // 通道 n+1：curl 手动安装（node 网络黑洞时 pnpm 下载卡死、curl 可用）——
         // 下载 registry tarball 解压到 node_modules，零依赖包可完整安装
-        if (!subpackageMode && !expanded) {
+        if (!expanded) {
           try {
             const info = await curlManualInstall(profileDir, name, registries)
             installedName = name
@@ -5370,7 +5375,7 @@ async function runInstallJob(job, ctx) {
         // 通道 n+1b：GitHub release 下载安装（npm 上不存在的包，例如面板自身
         // @deepseek-ai/dsh-plugin-console）——拉 latest release 源码 tarball → 盒子验证 → 覆盖。
         // 触发条件：curl 通道失败（registry 404/网络），且能从 job.repo 或已装包 repository 反查到 GitHub。
-        if (!subpackageMode && !expanded) {
+        if (repoChannelAllowed && !expanded) {
           let ghRepo = typeof job.repo === 'string' && job.repo !== '' && job.repo.includes('/') ? job.repo : null
           if (ghRepo === null) {
             try {
@@ -5395,7 +5400,7 @@ async function runInstallJob(job, ctx) {
       }
       if (installedName === null) {
         // 通道 n+2：git 通道（GitHub 走加速代理+直连；Gitee 走对应平台；各 60 秒封顶）
-        if (!subpackageMode && !expanded) {
+        if (repoChannelAllowed && !expanded) {
           const gitSpecs = job.source === 'gitee'
             ? [`git+https://gitee.com/${job.repo}.git`]
             : [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noob-stupid/dsh-plugin-console",
-  "version": "0.3.57",
+  "version": "0.3.58",
   "description": "DSH plugin management panel & marketplace: one-click enable/disable, multi-source market (GitHub/Gitee/custom), static-index market (500+ plugins / 300 skills), skills, suites, and one-click framework upgrade.",
   "repository": {
     "type": "git",