@noob-stupid/dsh-plugin-console 0.3.67 → 0.4.0

package/lib/server/domain/skills.js

@@ -0,0 +1,234 @@
+// L1 · domain —— skills.js（分层 Step 从 lib/index.js 搬出，只搬移未改逻辑）
+// 分组见 D:\dsh\dsh-plugin-hub-plan\architecture.zh.md §三
+
+import { readFileSync, writeFileSync, existsSync, rmSync, readdirSync, mkdirSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { gitCloneUrls } from './sources.js'
+import { execFileAsync, gitEnv } from '../infra/exec.js'
+import { copyTree } from '../infra/fsx.js'
+import { GITHUB_RAW, curlJson, curlText, rawTextWithFallback } from '../infra/http.js'
+import { dshHome } from '../infra/paths.js'
+
+/** 探测仓库是否为技能仓库：根目录或第一层子目录存在 SKILL.md。
+ * 返回 { hasSkill, skillDir }（skillDir 为相对仓库根的目录，'' 表示根）。
+ * raw 双通道竞速，3 秒封顶，失败静默。 */
+async function detectSkillRepo(repo, branch = 'main') {
+  const branchEnc = encodeURIComponent(branch)
+  try {
+    const root = await Promise.any([
+      curlText(`${GITHUB_RAW}/${repo}/${branchEnc}/SKILL.md`, 3000),
+      curlText(`https://ghproxy.net/${GITHUB_RAW}/${repo}/${branchEnc}/SKILL.md`, 3000),
+      curlText(`https://cdn.jsdelivr.net/gh/${repo}@${branchEnc}/SKILL.md`, 3000),
+    ]).catch(() => null)
+    if (root !== null) return { hasSkill: true, skillDir: '' }
+    // 根没有时再查一层子目录（常用布局：skills/<name>/SKILL.md、<name>/SKILL.md）
+    const tree = await curlJson(`https://api.github.com/repos/${repo}/git/trees/${branchEnc}?recursive=1`, 5000).catch(() => null)
+    const skillPaths = (tree?.tree ?? [])
+      .filter((n) => n.type === 'blob' && /(?:^|\/)SKILL\.md$/u.test(n.path))
+      .map((n) => n.path)
+    if (skillPaths.length > 0) {
+      const dir = skillPaths[0].slice(0, -'SKILL.md'.length).replace(/\/$/u, '')
+      return { hasSkill: true, skillDir: dir }
+    }
+  } catch {}
+  return { hasSkill: false, skillDir: null }
+}
+
+/** 提取 SKILL.md frontmatter 摘要（name / description / whenToUse，与客户端 summarizeSkillFrontmatter 同规则）。 */
+function summarizeSkillFrontmatter(text) {
+  if (!text.startsWith('---')) return null
+  const fmEnd = text.indexOf('\n---', 3)
+  if (fmEnd === -1) return null
+  const fm = text.slice(3, fmEnd)
+  const pick = (key) => {
+    const re = new RegExp(`^${key}:\\s*(.*)$`, 'mu')
+    const m = fm.match(re)
+    if (!m) return ''
+    const first = m[1].trim()
+    if (first.startsWith('|')) {
+      const rest = fm.slice(m.index + m[0].length)
+      const lines = []
+      for (const line of rest.split('\n')) {
+        if (/^[a-zA-Z][\w-]*\s*:/u.test(line)) break
+        const v = line.trim()
+        if (v) lines.push(v)
+        if (lines.join(' ').length > 240) break
+      }
+      return lines.join(' ').slice(0, 500)
+    }
+    return first.slice(0, 200)
+  }
+  const name = pick('name')
+  const description = pick('description')
+  const whenToUse = pick('whenToUse')
+  if (!name && !description && !whenToUse) return null
+  return { name, description, whenToUse }
+}
+
+/** 读取仓库 SKILL.md 的 frontmatter 摘要（raw 双通道，失败静默返回 null）。 */
+async function fetchSkillMeta(repo, branch, skillDir) {
+  try {
+    const path = skillDir ? `${skillDir}/SKILL.md` : 'SKILL.md'
+    const body = await rawTextWithFallback(repo, branch, path)
+    if (body === null) return null
+    return summarizeSkillFrontmatter(body)
+  } catch {
+    return null
+  }
+}
+
+/** 技能安装：git clone 仓库 → 定位 SKILL.md（根或第一层子目录）→ 复制到 ~/.dsh/skills/<name>/。
+ * 技能由 dsh-skill-filesystem 插件扫描（发现根：<dshHome>/skills），与桌面版共享。 */
+async function runSkillInstallJob(job) {
+  const tmpDir = join(tmpdir(), `dsh-skill-${job.id}-${Date.now()}`)
+  try {
+    job.stage = 'preparing'
+    const shortName = String(job.repo).split('/').pop() || job.repo
+    mkdirSync(tmpDir, { recursive: true })
+    const urls = gitCloneUrls(job.repo, job.source)
+    let cloned = false
+    let lastError = null
+    for (const url of urls) {
+      try {
+        await execFileAsync('git', ['clone', '--depth', '1', '--quiet', url, tmpDir], {
+          timeout: 120000,
+          windowsHide: true,
+          env: gitEnv(),
+        })
+        cloned = true
+        break
+      } catch (error) {
+        lastError = error
+      }
+    }
+    if (!cloned) throw new Error(`git clone 失败：${lastError?.message ?? '未知'}`)
+    job.stage = 'detecting'
+    // 定位 SKILL.md：根目录优先，其次第一层子目录（常用布局 skills/<name>/SKILL.md）
+    let skillDir = ''
+    if (!existsSync(join(tmpDir, 'SKILL.md'))) {
+      const sub = readdirSync(tmpDir, { withFileTypes: true })
+        .filter((d) => d.isDirectory() && !d.name.startsWith('.'))
+        .find((d) => existsSync(join(tmpDir, d.name, 'SKILL.md')))
+      if (sub) skillDir = sub.name
+    }
+    if (!existsSync(join(tmpDir, skillDir, 'SKILL.md'))) {
+      // 根与第一层子目录都没有：区分「技能集合仓库」与「非技能仓库」，给出可操作提示
+      let collection = false
+      try {
+        const tree = await curlJson(`https://api.github.com/repos/${job.repo}/git/trees/${encodeURIComponent(job.source === 'gitee' ? 'master' : 'main')}?recursive=1`, 6000).catch(() => null)
+        collection = (tree?.tree ?? []).filter((n) => n.type === 'blob' && /(?:^|\/)SKILL\.md$/u.test(n.path)).length > 1
+      } catch {}
+      if (collection) {
+        throw new Error('这是技能集合仓库（含多个 SKILL.md），请安装其中单个技能仓库（根或第一层子目录含 SKILL.md 的仓库）')
+      }
+      throw new Error('仓库内未找到 SKILL.md（检查根目录或第一层子目录）')
+    }
+    // 技能名：SKILL.md frontmatter 的 name（kebab-case）优先，否则用仓库短名
+    let skillName = shortName
+    try {
+      const text = readFileSync(join(tmpDir, skillDir, 'SKILL.md'), 'utf8')
+      const m = text.match(/^name:\s*([a-z0-9][a-z0-9-]{0,63})/mu)
+      if (m) skillName = m[1]
+    } catch {}
+    const skillsRoot = join(dshHome(), 'skills')
+    const dest = join(skillsRoot, skillName)
+    mkdirSync(skillsRoot, { recursive: true })
+    if (existsSync(dest)) rmSync(dest, { recursive: true, force: true })
+    copyTree(join(tmpDir, skillDir), dest)
+    job.kind = 'skill'
+    job.skillName = skillName
+    job.skillDir = dest
+    job.status = 'done'
+    job.stage = 'done'
+    job.skillNote = `已安装技能「${skillName}」到 ${dest}。技能由 dsh-skill-filesystem 插件扫描发现（用户根 ~/.dsh/skills）；若当前 profile 未启用该插件，请在 profile 的 cordis.yml 启用 @deepseek-ai/dsh-skill-filesystem 后重启即可生效。`
+  } catch (error) {
+    job.status = 'failed'
+    job.error = error instanceof Error ? error.message : String(error)
+  } finally {
+    // 无论成败都清理克隆临时目录（cpSync EIO 时代曾泄漏在 TEMP）
+    try { rmSync(tmpDir, { recursive: true, force: true }) } catch {}
+    job.finishedAt = Date.now()
+  }
+}
+
+/** 返回 SKILL.md frontmatter 内容区间（不含首尾 --- 行）；无 frontmatter 时 { has: false }。 */
+function skillFrontmatterBounds(text) {
+  if (!text.startsWith('---')) return { has: false }
+  const nl = text.indexOf('\n')
+  if (nl === -1) return { has: false }
+  const end = text.indexOf('\n---', nl + 1)
+  if (end === -1) return { has: false }
+  return { has: true, start: nl + 1, end }
+}
+
+/** 技能是否已停用（frontmatter 含 disable-model-invocation: true）。 */
+function isSkillDisabled(skillFile) {
+  try {
+    const text = readFileSync(skillFile, 'utf8')
+    const fm = skillFrontmatterBounds(text)
+    if (!fm.has) return false
+    return /^\s*disable-model-invocation:\s*(true|yes|on|1)\s*$/mu.test(text.slice(fm.start, fm.end))
+  } catch {
+    return false
+  }
+}
+
+/** 停用/启用技能（可逆）：停用 = 备份原始 SKILL.md 到同目录 .dsh-skill-fm.bak 后在
+ * frontmatter 注入调用策略行；启用 = 恢复备份（无备份则移除注入行）。 */
+function setSkillEnabled(skillFile, enabled) {
+  const backup = join(dirname(skillFile), '.dsh-skill-fm.bak')
+  const text = readFileSync(skillFile, 'utf8')
+  const fm = skillFrontmatterBounds(text)
+  if (!enabled) {
+    if (!existsSync(backup)) writeFileSync(backup, text, 'utf8')
+    const inject = `${SKILL_DISABLE_LINES.join('\n')}\n`
+    if (!fm.has) {
+      writeFileSync(skillFile, `---\n${inject}---\n\n${text}`, 'utf8')
+    } else {
+      writeFileSync(skillFile, `${text.slice(0, fm.start)}${inject}${text.slice(fm.start)}`, 'utf8')
+    }
+  } else if (existsSync(backup)) {
+    writeFileSync(skillFile, readFileSync(backup, 'utf8'), 'utf8')
+    rmSync(backup, { force: true })
+  } else if (fm.has) {
+    const content = text.slice(fm.start, fm.end)
+    const cleaned = content.split('\n')
+      .filter((l) => !/^\s*(disable-model-invocation|user-invocable)\s*:/u.test(l))
+      .join('\n')
+    writeFileSync(skillFile, `${text.slice(0, fm.start)}${cleaned}${text.slice(fm.end)}`, 'utf8')
+  }
+}
+
+/** 列出已安装技能（~/.dsh/skills 下一层含 SKILL.md 的目录 + 平铺 .md 文件）。
+ * 点号开头（如 .system）是系统技能根（dsh-skill-filesystem 保留目录），标记 system: true，
+ * 前端展示「系统」标签且不提供删除。disabled = 已按官方调用策略停用。 */
+function listInstalledSkills() {
+  const root = join(dshHome(), 'skills')
+  const skills = []
+  try {
+    if (!existsSync(root)) return skills
+    for (const entry of readdirSync(root, { withFileTypes: true })) {
+      const system = entry.name.startsWith('.')
+      if (entry.isDirectory()) {
+        const skillFile = join(root, entry.name, 'SKILL.md')
+        if (existsSync(skillFile)) {
+          skills.push({ name: entry.name, path: skillFile, system, disabled: isSkillDisabled(skillFile) })
+        }
+      } else if (entry.isFile() && entry.name.endsWith('.md') && entry.name !== 'SKILL.md') {
+        const skillFile = join(root, entry.name)
+        skills.push({ name: entry.name.slice(0, -3), path: skillFile, system, disabled: isSkillDisabled(skillFile) })
+      }
+    }
+  } catch {}
+  return skills
+}
+
+/** 技能市场收录的 topic（/search skills 分支三 topic 并行合并）。 */
+const SKILL_TOPICS = ['agent-skills', 'claude-skills', 'dsh-skill']
+
+/** 技能停用注入的 frontmatter 行（官方调用策略：disable-model-invocation 从模型目录/loader 排除，
+ * user-invocable 从用户命令排除；两者同设 = 完整停用）。 */
+const SKILL_DISABLE_LINES = ['disable-model-invocation: true', 'user-invocable: false']
+
+export { detectSkillRepo, summarizeSkillFrontmatter, fetchSkillMeta, runSkillInstallJob, skillFrontmatterBounds, isSkillDisabled, setSkillEnabled, listInstalledSkills, SKILL_TOPICS, SKILL_DISABLE_LINES }

package/lib/server/domain/sources.js

@@ -0,0 +1,297 @@
+// L1 · domain —— sources.js（分层 Step 从 lib/index.js 搬出，只搬移未改逻辑）
+// 分组见 D:\dsh\dsh-plugin-hub-plan\architecture.zh.md §三
+
+import { readFileSync, rmSync } from 'node:fs'
+import { writeFile } from 'node:fs/promises'
+import { sourcesFile, sourcesSecretsFile } from '../infra/paths.js'
+
+/** 读取软件源配置（损坏/缺失时回退默认）。 */
+function readSources() {
+  const defaults = JSON.parse(JSON.stringify(DEFAULT_SOURCES))
+  try {
+    const data = JSON.parse(readFileSync(sourcesFile(), 'utf8'))
+    const secrets = readSourceSecrets()
+    const registries = (Array.isArray(data.registries) ? data.registries : [])
+      .filter((r) => r && typeof r.url === 'string' && isAllowedSourceUrl(r.url))
+      .map((r) => ({
+        id: String(r.id ?? '').slice(0, 40) || `src-${Math.random().toString(36).slice(2, 8)}`,
+        name: String(r.name ?? r.url).slice(0, 60) || r.url,
+        url: r.url,
+        primary: r.primary === true,
+      }))
+    const searchSources = (Array.isArray(data.searchSources) ? data.searchSources : [])
+      .map((s) => {
+        if (s && (s.id === 'github' || s.id === 'gitee')) {
+          return { id: String(s.id), name: String(s.name ?? s.id), type: 'builtin' }
+        }
+        if (s && typeof s.url === 'string' && s.url.includes('{q}')) {
+          let headers = {}
+          const secretHeaders = secrets.headers?.[s.id]
+          if (secretHeaders && typeof secretHeaders === 'object') {
+            headers = { ...secretHeaders }
+          } else if (Array.isArray(s.headers)) {
+            for (const h of s.headers) {
+              if (h && typeof h.name === 'string' && h.name !== '' && typeof h.value === 'string') {
+                headers[h.name] = h.value
+              }
+            }
+          } else if (s.headers && typeof s.headers === 'object') {
+            headers = { ...s.headers }
+          }
+          return {
+            id: String(s.id ?? `search-${Math.random().toString(36).slice(2, 8)}`).slice(0, 40),
+            name: String(s.name ?? s.url).slice(0, 60),
+            type: 'custom',
+            url: s.url,
+            headers,
+          }
+        }
+        return null
+      })
+      .filter((s) => s !== null)
+    const giteeBase = readGiteeConfig(data)
+    // 索引源：老配置无该字段时用默认；URL 必须是合法 https 或本机/私网 http
+    const indexSources = (Array.isArray(data.indexSources) ? data.indexSources : [])
+      .filter((s) => s && typeof s.url === 'string' && isAllowedSourceUrl(s.url))
+      .map((s) => ({
+        id: String(s.id ?? '').slice(0, 40) || `idx-${Math.random().toString(36).slice(2, 8)}`,
+        name: String(s.name ?? s.url).slice(0, 60) || s.url,
+        url: s.url,
+        primary: s.primary === true,
+      }))
+    const indexFinal = indexSources.length > 0
+      ? (() => {
+        if (!indexSources.some((s) => s.primary)) indexSources[0].primary = true
+        return indexSources
+      })()
+      : defaults.indexSources
+    // Git 克隆源：模板必须同时含 {owner} 与 {repo}；老配置无该字段时用默认
+    const gitSources = (Array.isArray(data.gitSources) ? data.gitSources : [])
+      .filter((s) => s && typeof s.urlTemplate === 'string' && s.urlTemplate.includes('{owner}') && s.urlTemplate.includes('{repo}') && isAllowedGitSourceUrl(s.urlTemplate))
+      .map((s) => ({
+        id: String(s.id ?? '').slice(0, 40) || `git-${Math.random().toString(36).slice(2, 8)}`,
+        name: String(s.name ?? s.urlTemplate).slice(0, 60) || s.urlTemplate,
+        urlTemplate: s.urlTemplate,
+        primary: s.primary === true,
+      }))
+    const gitFinal = gitSources.length > 0
+      ? (() => {
+        if (!gitSources.some((s) => s.primary)) gitSources[0].primary = true
+        return gitSources
+      })()
+      : defaults.gitSources
+    const gitee = {
+      ...giteeBase,
+      clientSecret: secrets.gitee?.clientSecret ?? giteeBase.clientSecret,
+      token: secrets.gitee?.token ?? giteeBase.token,
+    }
+    if (registries.length > 0) {
+      if (!registries.some((r) => r.primary)) registries[0].primary = true
+      return { registries, searchSources, indexSources: indexFinal, gitSources: gitFinal, indexMerge: data.indexMerge === true, gitee }
+    }
+  } catch {}
+  return defaults
+}
+
+async function writeSources(sources) {
+  const secrets = { gitee: {}, headers: {} }
+  const cleanSearch = (sources.searchSources ?? []).map((s) => {
+    if (!s) return s
+    if (s.headers && typeof s.headers === 'object' && Object.keys(s.headers).length > 0) {
+      secrets.headers[s.id] = { ...s.headers }
+      const { headers, ...rest } = s
+      return rest
+    }
+    return s
+  })
+  const gitee = readGiteeConfig(sources)
+  if (typeof gitee.clientSecret === 'string' && gitee.clientSecret !== '') secrets.gitee.clientSecret = gitee.clientSecret
+  if (typeof gitee.token === 'string' && gitee.token !== '') secrets.gitee.token = gitee.token
+  const cleanGitee = { ...(sources.gitee ?? {}), clientSecret: undefined, token: undefined }
+  const main = { ...sources, searchSources: cleanSearch, gitee: cleanGitee }
+  await writeFile(sourcesFile(), JSON.stringify(main, null, 2) + '\n', 'utf8')
+  await writeSourceSecrets(secrets)
+}
+
+/**
+ * 凭据脱敏（安全审查发现）：/sources 响应不得携带明文密钥——
+ * - Gitee clientSecret / token：绝不回传（clientId 打码保留前 8 位供识别）
+ * - 自定义搜索源的 headers（可能含 Authorization: Bearer xxx）：value 打码
+ * 前端需要"已配置"状态时用 giteeStatusView 的布尔字段。
+ */
+function maskSources(sources) {
+  const gitee = readGiteeConfig(sources)
+  const maskedGitee = {
+    clientId: gitee.clientId === '' ? '' : `${gitee.clientId.slice(0, 8)}…`,
+    clientConfigured: gitee.clientId !== '',
+    hasToken: gitee.token !== '',
+    login: gitee.login,
+  }
+  return {
+    registries: sources.registries,
+    indexSources: sources.indexSources ?? DEFAULT_SOURCES.indexSources,
+    indexMerge: sources.indexMerge === true,
+    gitSources: sources.gitSources ?? DEFAULT_SOURCES.gitSources,
+    searchSources: (sources.searchSources ?? []).map((s) => {
+      if (s && typeof s.headers === 'object' && Object.keys(s.headers).length > 0) {
+        const masked = {}
+        for (const [k, v] of Object.entries(s.headers)) {
+          masked[k] = typeof v === 'string' && v.length > 8 ? `${v.slice(0, 4)}…${v.slice(-4)}` : (v === '' ? '' : '••••')
+        }
+        return { ...s, headers: masked }
+      }
+      return s
+    }),
+    gitee: maskedGitee,
+  }
+}
+
+function readSourceSecrets() {
+  try {
+    const data = JSON.parse(readFileSync(sourcesSecretsFile(), 'utf8'))
+    return data && typeof data === 'object' ? data : {}
+  } catch {
+    return {}
+  }
+}
+
+async function writeSourceSecrets(secrets) {
+  const gitee = secrets.gitee ?? {}
+  const headers = secrets.headers ?? {}
+  const hasGitee = typeof gitee.clientSecret === 'string' && gitee.clientSecret !== '' || typeof gitee.token === 'string' && gitee.token !== ''
+  const hasHeaders = Object.keys(headers).some((id) => { const h = headers[id]; return h && typeof h === 'object' && Object.keys(h).length > 0 })
+  if (!hasGitee && !hasHeaders) {
+    try { rmSync(sourcesSecretsFile(), { force: true }) } catch {}
+    return
+  }
+  await writeFile(sourcesSecretsFile(), JSON.stringify({ gitee, headers }, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 })
+}
+
+/** 源地址校验（模块顶层，readSources 与 sources 路由共用）：https 任意；http 仅限私网/本机地址（内网 npm registry、内网搜索服务常用 http）。 */
+function isAllowedSourceUrl(url) {
+  if (/^https:\/\/\S+$/u.test(url)) return true
+  if (!/^http:\/\/\S+$/u.test(url)) return false
+  try {
+    const host = new URL(url).hostname.toLowerCase()
+    if (host === 'localhost' || host === '::1' || host === '[::1]') return true
+    if (/^127\.\d+\.\d+\.\d+$/u.test(host)) return true
+    if (/^10\.\d+\.\d+\.\d+$/u.test(host)) return true
+    if (/^192\.168\.\d+\.\d+$/u.test(host)) return true
+    if (/^169\.254\.\d+\.\d+$/u.test(host)) return true
+    const m = host.match(/^172\.(\d+)\.\d+\.\d+$/u)
+    if (m && Number(m[1]) >= 16 && Number(m[1]) <= 31) return true
+    if (/^[0-9a-f]{1,4}(?::[0-9a-f]{1,4}){2,7}$/iu.test(host)) return true
+    return false
+  } catch {
+    return false
+  }
+}
+
+/** Git 源地址校验：在通用校验之上额外允许 file:// 本地裸仓库（完全离线/内网共享盘场景）。 */
+function isAllowedGitSourceUrl(url) {
+  if (/^file:\/\/\/\S+$/u.test(url)) return true
+  return isAllowedSourceUrl(url)
+}
+
+/** 读取 Gitee OAuth 配置（clientId/clientSecret/token/login）。 */
+function readGiteeConfig(data) {
+  const gitee = data && typeof data === 'object' && data.gitee && typeof data.gitee === 'object' ? data.gitee : {}
+  return {
+    clientId: typeof gitee.clientId === 'string' ? gitee.clientId : '',
+    clientSecret: typeof gitee.clientSecret === 'string' ? gitee.clientSecret : '',
+    token: typeof gitee.token === 'string' ? gitee.token : '',
+    login: typeof gitee.login === 'string' ? gitee.login : '',
+  }
+}
+
+/** Gitee 配置状态视图（布尔 + login，无任何凭据）。 */
+function giteeStatusView(sources) {
+  const gitee = readGiteeConfig(sources)
+  return { clientConfigured: gitee.clientId !== '', hasToken: gitee.token !== '', login: gitee.login }
+}
+
+/** 按主→备顺序返回 registry URL 列表。 */
+function orderedRegistries(sources) {
+  const list = [...sources.registries]
+  return [...list.filter((r) => r.primary), ...list.filter((r) => !r.primary)].map((r) => r.url)
+}
+
+function createGiteeOAuthState() {
+  const state = globalThis.crypto?.randomUUID?.() ?? `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`
+  const now = Date.now()
+  // 只保留最近 10 分钟内的 state
+  for (const [key, at] of GITEE_OAUTH_STATES) {
+    if (now - at > 10 * 60 * 1000) GITEE_OAUTH_STATES.delete(key)
+  }
+  GITEE_OAUTH_STATES.set(state, now)
+  return state
+}
+
+function consumeGiteeOAuthState(state) {
+  if (typeof state !== 'string' || state === '') return false
+  const at = GITEE_OAUTH_STATES.get(state)
+  if (at === undefined) return false
+  GITEE_OAUTH_STATES.delete(state)
+  return Date.now() - at <= 10 * 60 * 1000
+}
+
+const DEFAULT_SOURCES = {
+  registries: [
+    { id: 'npmmirror', name: 'npmmirror（国内镜像）', url: 'https://registry.npmmirror.com', primary: true },
+    { id: 'npmjs', name: 'npmjs（官方源）', url: 'https://registry.npmjs.org', primary: false },
+  ],
+  searchSources: [
+    { id: 'github', name: 'GitHub', type: 'builtin' },
+    { id: 'gitee', name: 'Gitee', type: 'builtin' },
+  ],
+  // 市场静态索引源（按主→备依次尝试；内网可整体替换为自建镜像，实现完全离线的市场浏览）
+  // 2026-09-20 扩容 2 → 5：只有 jsDelivr + ghproxy 两个源时，两者同时不可达就会让整个市场退化成
+  // 「只能搜 GitHub 实时结果」——收录清单（含 ★7800 全家桶）与本地索引模糊匹配一起失效
+  // （另一位用户实测报「市场索引加载失败：网络不可达（2 个索引源全部失败）：GitHub 请求超时」）。
+  // jsDelivr 官方多入口互为主备：cdn（主）/ gcore / fastly；再加 ghproxy 与 raw 直连兜底。
+  indexSources: [
+    { id: 'jsdelivr', name: 'jsDelivr CDN', url: 'https://cdn.jsdelivr.net/gh/Noob-stupid/dsh-plugin-gating-hub@main/marketplace/index.json', primary: true },
+    { id: 'jsdelivr-gcore', name: 'jsDelivr (gcore)', url: 'https://gcore.jsdelivr.net/gh/Noob-stupid/dsh-plugin-gating-hub@main/marketplace/index.json', primary: false },
+    { id: 'jsdelivr-fastly', name: 'jsDelivr (fastly)', url: 'https://fastly.jsdelivr.net/gh/Noob-stupid/dsh-plugin-gating-hub@main/marketplace/index.json', primary: false },
+    { id: 'ghproxy', name: 'ghproxy 镜像', url: 'https://ghproxy.net/https://raw.githubusercontent.com/Noob-stupid/dsh-plugin-gating-hub/main/marketplace/index.json', primary: false },
+    { id: 'raw', name: 'GitHub raw 直连', url: 'https://raw.githubusercontent.com/Noob-stupid/dsh-plugin-gating-hub/main/marketplace/index.json', primary: false },
+  ],
+  // Git 克隆源（{owner}/{repo} 占位符；按主→备依次尝试）。
+  // 可替换为 Gitee / GitLab / 自建 Gitea / 任意镜像代理，实现「换一个网站下载仓库内容」。
+  gitSources: [
+    { id: 'ghproxy-git', name: 'ghproxy 镜像', urlTemplate: 'https://ghproxy.net/https://github.com/{owner}/{repo}.git', primary: true },
+    { id: 'github-git', name: 'GitHub 直连', urlTemplate: 'https://github.com/{owner}/{repo}.git', primary: false },
+  ],
+  // 索引合并模式：true = 所有索引源结果合并去重（公共索引 + 内网私有索引同时可见）；
+  // false = 主→备只用一个（内网优先，更快）
+  indexMerge: false,
+  gitee: { clientId: '', clientSecret: '', token: '', login: '' },
+}
+
+/** Gitee OAuth state 一次性凭证（防止登录 CSRF / token 替换）。 */
+const GITEE_OAUTH_STATES = new Map()
+
+/** Git 克隆 URL 列表（按主→备顺序）。来源在「功能包 → 软件源 → Git 源」中自定义，
+ * 可替换为 Gitee / GitLab / 自建 Gitea / 任意镜像代理，实现「换一个网站下载仓库内容」。 */
+function gitCloneUrls(repoFullName, source = 'github') {
+  if (source === 'gitee') return [`https://gitee.com/${repoFullName}.git`]
+  const [owner = '', repo = ''] = String(repoFullName).split('/')
+  let list = []
+  try {
+    list = readSources().gitSources ?? []
+  } catch {
+    list = DEFAULT_SOURCES.gitSources
+  }
+  const ordered = [...list].sort((a, b) => (b.primary === true ? 1 : 0) - (a.primary === true ? 1 : 0))
+  const urls = ordered
+    .map((s) => String(s.urlTemplate).replace(/\{owner\}/gu, owner).replace(/\{repo\}/gu, repo))
+    .filter((u) => u !== '')
+  return urls.length > 0 ? urls : [`https://github.com/${repoFullName}.git`]
+}
+
+/** Gitee OAuth 端点（第三方应用需在 gitee.com → 数据管理 → 第三方应用 创建）。 */
+const GITEE_AUTH_URL = 'https://gitee.com/oauth/authorize'
+
+const GITEE_TOKEN_URL = 'https://gitee.com/oauth/token'
+const DEFAULT_SEARCH = 'dsh-plugin'
+export { readSources, writeSources, maskSources, readSourceSecrets, writeSourceSecrets, isAllowedSourceUrl, isAllowedGitSourceUrl, readGiteeConfig, giteeStatusView, orderedRegistries, createGiteeOAuthState, consumeGiteeOAuthState, DEFAULT_SOURCES, GITEE_OAUTH_STATES, gitCloneUrls, GITEE_AUTH_URL, GITEE_TOKEN_URL, DEFAULT_SEARCH }