@noob-stupid/dsh-plugin-console 0.3.67 → 0.4.0

package/lib/server/routes/sources.js

@@ -0,0 +1,437 @@
+// L2 · routes —— 软件源与 Gitee 授权（GET|POST /sources · GET /gitee-oauth-url · GET /gitee-oauth-callback · POST /registry-scan）
+// 分层 Step 8b：从 lib/index.js 的 handle() 原样搬出（只搬移未改逻辑；缩进保持原样）
+
+import { webPort } from '../domain/runtime.js'
+import { DEFAULT_SOURCES, GITEE_AUTH_URL, GITEE_TOKEN_URL, consumeGiteeOAuthState, createGiteeOAuthState, giteeStatusView, isAllowedGitSourceUrl, isAllowedSourceUrl, maskSources, readGiteeConfig, readSources, writeSources } from '../domain/sources.js'
+import { fetchJsonUrl, postJsonUrl } from '../infra/http.js'
+import { sendError, sendJson } from '../infra/httpd.js'
+import { setMarketIndexCache } from '../state.js'
+
+async function routeSourcesGet(req, res, rc) {
+  const ctx = rc.ctx
+  const url = rc.url
+  const pathname = rc.pathname
+  const method = rc.method
+  const webPort = rc.deps.webPort
+    const sources = readSources()
+    sendJson(res, 200, { ok: true, sources: maskSources(sources), giteeStatus: giteeStatusView(sources) })
+    return
+}
+
+async function routeGiteeOauthUrlGet(req, res, rc) {
+  const ctx = rc.ctx
+  const pathname = rc.pathname
+  const method = rc.method
+  const webPort = rc.deps.webPort
+    const gitee = readGiteeConfig(readSources())
+    if (!gitee.clientId) {
+      sendError(res, 400, '请先在软件源管理中配置 Gitee 应用的 client_id / client_secret')
+      return
+    }
+    const port = webPort(ctx)
+    const redirect = `http://127.0.0.1:${port}/plugin-console/gitee-oauth-callback`
+    // scope 请求 user_info + projects：Gitee 会校验请求的 scope 必须在应用已勾选的权限范围内，
+    // 应用权限必须同步勾选 user_info、projects，否则报「请求范围无效、未知或格式不正确」
+    const state = createGiteeOAuthState()
+    const url = `${GITEE_AUTH_URL}?client_id=${encodeURIComponent(gitee.clientId)}&redirect_uri=${encodeURIComponent(redirect)}&response_type=code&scope=${encodeURIComponent('user_info projects')}&state=${encodeURIComponent(state)}`
+    sendJson(res, 200, { ok: true, url, redirect, state })
+    return
+}
+
+async function routeGiteeOauthCallbackGet(req, res, rc) {
+  const ctx = rc.ctx
+  const url = rc.url
+  const pathname = rc.pathname
+  const method = rc.method
+  const webPort = rc.deps.webPort
+    const code = new URL(req.url ?? '/', 'http://x').searchParams.get('code')
+    const state = new URL(req.url ?? '/', 'http://x').searchParams.get('state')
+    const sources = readSources()
+    const gitee = readGiteeConfig(sources)
+    const failPage = (text) => {
+      res.writeHead(400, { 'content-type': 'text/html; charset=utf-8' })
+      res.end(`<h3>${text}</h3>`)
+    }
+    if (!code) {
+      failPage('这是 Gitee 授权回调地址，不能直接访问。<br>正确流程：插件面板 → 软件源管理 → 填入 client_id / client_secret → 保存配置 → 点击「授权登录 Gitee」，授权完成后会自动跳回这里。')
+      return
+    }
+    if (!state || !consumeGiteeOAuthState(state)) {
+      failPage('Gitee OAuth state 校验失败，请重新发起授权。')
+      return
+    }
+    if (!gitee.clientId || !gitee.clientSecret) {
+      failPage('未配置 Gitee 应用：请先在 gitee.com 创建第三方应用（回调地址填本页完整地址），再在插件面板 → 软件源管理 中填入 client_id / client_secret 并保存。')
+      return
+    }
+    const port = webPort(ctx)
+    const redirect = `http://127.0.0.1:${port}/plugin-console/gitee-oauth-callback`
+    const result = await postJsonUrl(GITEE_TOKEN_URL, {
+      grant_type: 'authorization_code',
+      code,
+      client_id: gitee.clientId,
+      client_secret: gitee.clientSecret,
+      redirect_uri: redirect,
+    })
+    if (result.status < 200 || result.status >= 300 || !result.body || !result.body.access_token) {
+      failPage('Gitee 授权失败：token 交换错误，请检查 client_id / client_secret')
+      return
+    }
+    gitee.token = result.body.access_token
+    try {
+      const user = await fetchJsonUrl(`https://gitee.com/api/v5/user?access_token=${encodeURIComponent(gitee.token)}`)
+      gitee.login = user && typeof user.login === 'string' ? user.login : ''
+    } catch {}
+    sources.gitee = gitee
+    await writeSources(sources)
+    res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' })
+    res.end('<h3>Gitee 授权成功，可以关闭此页面并回到插件面板</h3>')
+    return
+}
+
+async function routeRegistryScan(req, res, rc) {
+  const ctx = rc.ctx
+  const url = rc.url
+  const pathname = rc.pathname
+  const method = rc.method
+  const webPort = rc.deps.webPort
+  const body = rc.body
+    const sources = readSources()
+    const scanPkg = '@noob-stupid/dsh-plugin-console'
+    const encoded = encodeURIComponent(scanPkg)
+    const scanOne = async (r) => {
+      const started = Date.now()
+      const base = { id: r.id, name: r.name, url: r.url, primary: r.primary === true }
+      try {
+        const response = await fetch(`${String(r.url).replace(/\/+$/u, '')}/${encoded}`, {
+          headers: { accept: 'application/vnd.npm.install-v1+json' },
+          signal: AbortSignal.timeout(8000),
+        })
+        const ms = Date.now() - started
+        if (!response.ok) return { ...base, ok: false, ms, status: response.status, latest: null, versions: null, error: `HTTP ${response.status}` }
+        const data = await response.json()
+        const latest = typeof data?.['dist-tags']?.latest === 'string' ? data['dist-tags'].latest : null
+        const versions = data?.versions !== undefined && data.versions !== null && typeof data.versions === 'object' ? Object.keys(data.versions).length : null
+        return { ...base, ok: true, ms, status: response.status, latest, versions, error: null }
+      } catch (error) {
+        const ms = Date.now() - started
+        const message = error?.name === 'TimeoutError'
+          ? '超时（8s）'
+          : (error instanceof Error ? error.message : String(error))
+        return { ...base, ok: false, ms, status: null, latest: null, versions: null, error: message }
+      }
+    }
+    const results = await Promise.all(sources.registries.map((r) => scanOne(r)))
+    sendJson(res, 200, { ok: true, pkg: scanPkg, scannedAt: Date.now(), results })
+    return
+}
+
+async function routeSources(req, res, rc) {
+  const ctx = rc.ctx
+  const pathname = rc.pathname
+  const method = rc.method
+  const webPort = rc.deps.webPort
+  const body = rc.body
+    const { action } = body
+    const sources = readSources()
+    if (action === 'add') {
+      const url = typeof body.url === 'string' ? body.url.trim() : ''
+      const name = typeof body.name === 'string' ? body.name.trim() : ''
+      if (!isAllowedSourceUrl(url)) {
+        sendError(res, 400, '软件源地址必须是 https:// 开头（或本机/私网 http://）的合法 URL')
+        return
+      }
+      if (sources.registries.some((r) => r.url === url)) {
+        sendError(res, 400, '该软件源已存在')
+        return
+      }
+      const entry = {
+        id: `src-${Date.now().toString(36)}`,
+        name: name || url,
+        url,
+        primary: sources.registries.length === 0,
+      }
+      sources.registries.push(entry)
+      await writeSources(sources)
+      sendJson(res, 200, { ok: true, sources: maskSources(sources) })
+      return
+    }
+    if (action === 'remove') {
+      sendError(res, 400, '软件源不可删除（插件安装依赖的 npm 源，请使用编辑/设为主源）')
+      return
+    }
+    if (action === 'edit') {
+      const id = typeof body.id === 'string' ? body.id : ''
+      const target = sources.registries.find((r) => r.id === id)
+      if (!target) {
+        sendError(res, 404, '没有这个软件源')
+        return
+      }
+      const url = typeof body.url === 'string' ? body.url.trim() : target.url
+      const name = typeof body.name === 'string' ? body.name.trim() : target.name
+      if (!isAllowedSourceUrl(url)) {
+        sendError(res, 400, '软件源地址必须是 https:// 开头（或本机/私网 http://）的合法 URL')
+        return
+      }
+      if (sources.registries.some((r) => r.url === url && r.id !== id)) {
+        sendError(res, 400, '该软件源地址已存在')
+        return
+      }
+      target.url = url
+      target.name = name || url
+      await writeSources(sources)
+      sendJson(res, 200, { ok: true, sources: maskSources(sources) })
+      return
+    }
+    if (action === 'set-primary') {
+      const id = typeof body.id === 'string' ? body.id : ''
+      if (!sources.registries.some((r) => r.id === id)) {
+        sendError(res, 404, '没有这个软件源')
+        return
+      }
+      for (const r of sources.registries) r.primary = r.id === id
+      await writeSources(sources)
+      sendJson(res, 200, { ok: true, sources: maskSources(sources) })
+      return
+    }
+    if (action === 'add-search') {
+      const name = typeof body.name === 'string' ? body.name.trim() : ''
+      const url = typeof body.url === 'string' ? body.url.trim() : ''
+      if (!isAllowedSourceUrl(url)) {
+        sendError(res, 400, '搜索地址必须是 https:// 开头（或本机/私网 http://）的合法 URL')
+        return
+      }
+      if (!url.includes('{q}')) {
+        sendError(res, 400, '搜索 URL 模板必须包含 {q} 占位符')
+        return
+      }
+      if (sources.searchSources.some((s) => s.url === url)) {
+        sendError(res, 400, '该搜索源已存在')
+        return
+      }
+      // 可选请求头（认证等）：[{name, value}] 结构，仅服务端使用，不下发浏览器
+      const headers = Array.isArray(body.headers)
+        ? body.headers
+          .filter((h) => h && typeof h.name === 'string' && h.name.trim() !== '' && typeof h.value === 'string')
+          .map((h) => ({ name: h.name.trim().slice(0, 100), value: h.value.slice(0, 500) }))
+        : []
+      sources.searchSources.push({
+        id: `search-${Date.now().toString(36)}`,
+        name: name || url,
+        type: 'custom',
+        url,
+        ...(headers.length > 0 ? { headers } : {}),
+      })
+      await writeSources(sources)
+      sendJson(res, 200, { ok: true, sources: maskSources(sources) })
+      return
+    }
+    if (action === 'remove-search') {
+      const id = typeof body.id === 'string' ? body.id : ''
+      const target = sources.searchSources.find((s) => s.id === id)
+      if (!target) {
+        sendError(res, 404, '没有这个搜索源')
+        return
+      }
+      if (target.type === 'builtin') {
+        sendError(res, 400, '内置搜索源不可删除')
+        return
+      }
+      sources.searchSources = sources.searchSources.filter((s) => s.id !== id)
+      await writeSources(sources)
+      sendJson(res, 200, { ok: true, sources: maskSources(sources) })
+      return
+    }
+    if (action === 'add-index') {
+      const name = typeof body.name === 'string' ? body.name.trim() : ''
+      const url = typeof body.url === 'string' ? body.url.trim() : ''
+      if (!isAllowedSourceUrl(url)) {
+        sendError(res, 400, '索引地址必须是 https:// 开头（或本机/私网 http://）的合法 URL')
+        return
+      }
+      if ((sources.indexSources ?? []).some((s) => s.url === url)) {
+        sendError(res, 400, '该索引源已存在')
+        return
+      }
+      sources.indexSources = [...(sources.indexSources ?? []), {
+        id: `idx-${Date.now().toString(36)}`,
+        name: name || url,
+        url,
+        primary: (sources.indexSources ?? []).length === 0,
+      }]
+      setMarketIndexCache(null)
+      await writeSources(sources)
+      sendJson(res, 200, { ok: true, sources: maskSources(sources) })
+      return
+    }
+    if (action === 'edit-index') {
+      const id = typeof body.id === 'string' ? body.id : ''
+      const name = typeof body.name === 'string' ? body.name.trim() : ''
+      const url = typeof body.url === 'string' ? body.url.trim() : ''
+      if (!isAllowedSourceUrl(url)) {
+        sendError(res, 400, '索引地址必须是 https:// 开头（或本机/私网 http://）的合法 URL')
+        return
+      }
+      const target = (sources.indexSources ?? []).find((s) => s.id === id)
+      if (!target) {
+        sendError(res, 404, '没有这个索引源')
+        return
+      }
+      target.name = name || url
+      target.url = url
+      setMarketIndexCache(null)
+      await writeSources(sources)
+      sendJson(res, 200, { ok: true, sources: maskSources(sources) })
+      return
+    }
+    if (action === 'set-index-primary') {
+      const id = typeof body.id === 'string' ? body.id : ''
+      const list = sources.indexSources ?? []
+      if (!list.some((s) => s.id === id)) {
+        sendError(res, 404, '没有这个索引源')
+        return
+      }
+      for (const s of list) s.primary = s.id === id
+      setMarketIndexCache(null)
+      await writeSources(sources)
+      sendJson(res, 200, { ok: true, sources: maskSources(sources) })
+      return
+    }
+    if (action === 'remove-index') {
+      const id = typeof body.id === 'string' ? body.id : ''
+      const list = sources.indexSources ?? []
+      if (!list.some((s) => s.id === id)) {
+        sendError(res, 404, '没有这个索引源')
+        return
+      }
+      const rest = list.filter((s) => s.id !== id)
+      if (rest.length === 0) {
+        sendError(res, 400, '至少保留一个索引源（可先添加自建镜像再删除默认源）')
+        return
+      }
+      if (!rest.some((s) => s.primary)) rest[0].primary = true
+      sources.indexSources = rest
+      setMarketIndexCache(null)
+      await writeSources(sources)
+      sendJson(res, 200, { ok: true, sources: maskSources(sources) })
+      return
+    }
+    if (action === 'set-index-merge') {
+      sources.indexMerge = body.merge === true
+      setMarketIndexCache(null)
+      await writeSources(sources)
+      sendJson(res, 200, { ok: true, sources: maskSources(sources) })
+      return
+    }
+    if (action === 'add-git') {
+      const name = typeof body.name === 'string' ? body.name.trim() : ''
+      const urlTemplate = typeof body.urlTemplate === 'string' ? body.urlTemplate.trim() : ''
+      if (!urlTemplate.includes('{owner}') || !urlTemplate.includes('{repo}')) {
+        sendError(res, 400, 'Git 源模板必须同时包含 {owner} 与 {repo} 占位符')
+        return
+      }
+      if (!isAllowedGitSourceUrl(urlTemplate)) {
+        sendError(res, 400, 'Git 源地址必须是 https://（或本机/私网 http://、file:// 本地裸仓库）的合法 URL')
+        return
+      }
+      if ((sources.gitSources ?? []).some((s) => s.urlTemplate === urlTemplate)) {
+        sendError(res, 400, '该 Git 源已存在')
+        return
+      }
+      sources.gitSources = [...(sources.gitSources ?? []), {
+        id: `git-${Date.now().toString(36)}`,
+        name: name || urlTemplate,
+        urlTemplate,
+        primary: (sources.gitSources ?? []).length === 0,
+      }]
+      await writeSources(sources)
+      sendJson(res, 200, { ok: true, sources: maskSources(sources) })
+      return
+    }
+    if (action === 'edit-git') {
+      const id = typeof body.id === 'string' ? body.id : ''
+      const name = typeof body.name === 'string' ? body.name.trim() : ''
+      const urlTemplate = typeof body.urlTemplate === 'string' ? body.urlTemplate.trim() : ''
+      if (!urlTemplate.includes('{owner}') || !urlTemplate.includes('{repo}')) {
+        sendError(res, 400, 'Git 源模板必须同时包含 {owner} 与 {repo} 占位符')
+        return
+      }
+      if (!isAllowedGitSourceUrl(urlTemplate)) {
+        sendError(res, 400, 'Git 源地址必须是 https://（或本机/私网 http://、file:// 本地裸仓库）的合法 URL')
+        return
+      }
+      const target = (sources.gitSources ?? []).find((s) => s.id === id)
+      if (!target) {
+        sendError(res, 404, '没有这个 Git 源')
+        return
+      }
+      target.name = name || urlTemplate
+      target.urlTemplate = urlTemplate
+      await writeSources(sources)
+      sendJson(res, 200, { ok: true, sources: maskSources(sources) })
+      return
+    }
+    if (action === 'set-git-primary') {
+      const id = typeof body.id === 'string' ? body.id : ''
+      const list = sources.gitSources ?? []
+      if (!list.some((s) => s.id === id)) {
+        sendError(res, 404, '没有这个 Git 源')
+        return
+      }
+      for (const s of list) s.primary = s.id === id
+      await writeSources(sources)
+      sendJson(res, 200, { ok: true, sources: maskSources(sources) })
+      return
+    }
+    if (action === 'remove-git') {
+      const id = typeof body.id === 'string' ? body.id : ''
+      const list = sources.gitSources ?? []
+      if (!list.some((s) => s.id === id)) {
+        sendError(res, 404, '没有这个 Git 源')
+        return
+      }
+      const rest = list.filter((s) => s.id !== id)
+      if (rest.length === 0) {
+        sendError(res, 400, '至少保留一个 Git 源（可先添加自建镜像再删除默认源）')
+        return
+      }
+      if (!rest.some((s) => s.primary)) rest[0].primary = true
+      sources.gitSources = rest
+      await writeSources(sources)
+      sendJson(res, 200, { ok: true, sources: maskSources(sources) })
+      return
+    }
+    if (action === 'reset') {
+      const defaults = JSON.parse(JSON.stringify(DEFAULT_SOURCES))
+      setMarketIndexCache(null)
+      await writeSources(defaults)
+      sendJson(res, 200, { ok: true, sources: maskSources(defaults) })
+      return
+    }
+    if (action === 'gitee-setup') {
+      const clientId = typeof body.clientId === 'string' ? body.clientId.trim() : ''
+      const clientSecret = typeof body.clientSecret === 'string' ? body.clientSecret.trim() : ''
+      const keepClientId = body.keepClientId === true
+      if ((!keepClientId && !clientId) || !clientSecret) {
+        sendError(res, 400, 'client_id 与 client_secret 不能为空')
+        return
+      }
+      const current = readGiteeConfig(sources)
+      // keepClientId：前端回显的是打码 clientId（abc12345…），用户只改了 secret 时保留原配置
+      sources.gitee = { ...current, clientId: keepClientId ? current.clientId : clientId, clientSecret }
+      await writeSources(sources)
+      sendJson(res, 200, { ok: true, sources: maskSources(sources) })
+      return
+    }
+    if (action === 'gitee-clear') {
+      const current = readGiteeConfig(sources)
+      sources.gitee = { clientId: current.clientId, clientSecret: current.clientSecret, token: '', login: '' }
+      await writeSources(sources)
+      sendJson(res, 200, { ok: true, sources: maskSources(sources) })
+      return
+    }
+    sendError(res, 400, '未知操作（add / edit / set-primary / remove / add-search / remove-search / add-index / edit-index / set-index-primary / remove-index / set-index-merge / add-git / edit-git / set-git-primary / remove-git / gitee-setup / gitee-clear / reset）')
+    return
+}
+
+export { routeSourcesGet, routeGiteeOauthUrlGet, routeGiteeOauthCallbackGet, routeRegistryScan, routeSources }

package/lib/server/routes/state.js

@@ -0,0 +1,125 @@
+// L2 · routes —— 状态与详情（GET /state · POST /details）
+// 分层 Step 8b：从 lib/index.js 的 handle() 原样搬出（只搬移未改逻辑；缩进保持原样）
+
+import { readFileSync, existsSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { detectAdoptablePending, detectCompat, gatingSummary, readCompatGate, readCompatPending } from '../domain/compat.js'
+import { compUiUrl, findComponents } from '../domain/components.js'
+import { detectFrameworkUpgrade } from '../domain/framework.js'
+import { readExtraBundleRows } from '../domain/install-job.js'
+import { installJobView, readGithubAuth } from '../domain/install.js'
+import { readPluginDetails } from '../domain/market.js'
+import { healPatchSafety, readPatchState } from '../domain/patch.js'
+import { pendingRestartJobs } from '../domain/revoke.js'
+import { listEntries } from '../domain/runtime.js'
+import { sendError, sendJson } from '../infra/httpd.js'
+import { dshHome, entryPkgMeta, findPatchPath, pluginRoot, profileDirOf, rowIdOf } from '../infra/paths.js'
+import { installJobs, patchHealAt, patchHealReport, setPatchHealAt, setPatchHealReport } from '../state.js'
+
+async function routeStateGet(req, res, rc) {
+  const ctx = rc.ctx
+  const url = rc.url
+  const pathname = rc.pathname
+  const method = rc.method
+  const detectFrameworkUpgrade = rc.deps.detectFrameworkUpgrade
+  const detectCompat = rc.deps.detectCompat
+  const listEntries = rc.deps.listEntries
+  const detectAdoptablePending = rc.deps.detectAdoptablePending
+  const readExtraBundleRows = rc.deps.readExtraBundleRows
+    const patchPath = findPatchPath(ctx)
+    const patch = await readPatchState(patchPath)
+    // 补丁安全自愈（核心行误禁用恢复 / 缺失模块行自动禁用）——每 2 分钟最多跑一次
+    let patchHeal = null
+    try {
+      if (patchHealAt === null || Date.now() - patchHealAt > 120000) {
+        setPatchHealAt(Date.now())
+        patchHeal = await healPatchSafety(patchPath)
+      } else {
+        patchHeal = patchHealReport
+      }
+      if (patchHeal !== null) setPatchHealReport(patchHeal)
+    } catch {}
+    const extraRows = await readExtraBundleRows(dirname(patchPath))
+    const compatPending = readCompatPending()
+    const compatPendingRows = new Set((compatPending?.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => p.rowId))
+    // 兼容门总开关 + 自动检测（只提示不自动开）
+    const compatGate = readCompatGate()
+    const adoptable = compatGate.autoDetect ? detectAdoptablePending(ctx) : new Map()
+    let rollbackRec = null
+    try {
+      const rr = JSON.parse(readFileSync(join(dshHome(), 'plugin-console', 'framework-rollback.json'), 'utf8'))
+      if (rr !== null && typeof rr.checkpointDir === 'string' && existsSync(join(rr.checkpointDir, '.pnpm'))) {
+        rollbackRec = { from: rr.from ?? null, to: rr.to ?? null, at: rr.at ?? null, applicable: true }
+      }
+    } catch {}
+    const entries = listEntries(ctx).map((entry) => {
+      const meta = entryPkgMeta(entry.moduleName, ctx.baseUrl ?? 'file:///', profileDirOf(ctx))
+      return {
+        ...entry,
+        userDisabled: patch.disables.includes(entry.rowId),
+        userForced: patch.forced.includes(entry.rowId),
+        extra: patch.inserts.includes(entry.rowId) || extraRows.has(entry.moduleName) || extraRows.has(entry.rowId),
+        installDate: meta?.installDate ?? null,
+        version: meta?.version ?? null,
+        repository: meta?.repository ?? null,
+        // v0.3.45：只有"补丁里此刻确实还禁着它"的行才显示【待适配】——
+        // 记录与开关脱节时（用户手动启用过 / 补丁块被清掉）不能继续挂着「待适配」误导人
+        pendingCompat: compatPendingRows.has(entry.rowId) && patch.disables.includes(entry.rowId),
+        // 自动检测结果（只提示，不自动开）：该待适配行现在是否已适配（插件已更新 + 扫描通过）
+        adoptable: adoptable.get(entry.rowId) ?? null,
+      }
+    })
+    const compat = await detectCompat(ctx.baseUrl ?? 'file:///')
+    const auth = readGithubAuth()
+    const jobs = [...installJobs.values()].filter((job) => job.status === 'installing').map(installJobView)
+    const recentFailures = [...installJobs.values()].filter((job) => job.status === 'failed').slice(-3).map(installJobView)
+    // 已安装但尚未生效的任务（2026-09-20 真装真卸演练实测）：bundle 型插件要重启才被加载，
+    // 装完 /install 返回 entryId: null、/state 里新增 loader 条目 = 0 —— 面板过去完全看不出
+    // 「装了但还没生效」，也无法撤销。前端据此渲染「已安装·重启后生效」徽标 + 按 jobId 删除。
+    const pendingRestart = pendingRestartJobs([...installJobs.values()], listEntries(ctx))
+    // 框架升级检测与适配（备份快照 + 重打框架补丁），try 包裹不阻塞 state 返回
+    let framework = null
+    try { framework = detectFrameworkUpgrade(ctx) } catch {}
+    // 回滚可用性（2026-09-11 用户困惑：版本已经回滚了，回滚按钮还能点）——
+    // 当前版本已经等于记录里的 from 时，再点回滚等于"恢复到你现在这个版本"，无意义。
+    if (rollbackRec !== null) {
+      const currentVer = typeof framework?.version === 'string' ? framework.version : null
+      rollbackRec.applicable = !(currentVer !== null && rollbackRec.from !== null && currentVer === rollbackRec.from)
+    }
+    let selfVersion = null
+    try {
+      const selfPkg = JSON.parse(readFileSync(join(pluginRoot(), 'package.json'), 'utf8'))
+      selfVersion = typeof selfPkg.version === 'string' ? selfPkg.version : null
+    } catch {}
+    sendJson(res, 200, { ok: true, entries, patchPath, compat, installJobs: jobs, recentFailures, pendingRestart, github: { loggedIn: auth.loggedIn, login: auth.login }, patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts }, framework, patchHeal: patchHeal === null ? null : { healed: patchHeal.healed ?? [], autoDisabled: patchHeal.autoDisabled ?? [], healedAt: patchHeal.healedAt ?? 0 }, gating: gatingSummary(ctx, compatPending, entries), compatPending: compatPending === null ? null : { frameworkVersion: compatPending.frameworkVersion ?? null, upgradeFrom: compatPending.upgradeFrom ?? null, pending: (compatPending.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => ({ rowId: p.rowId, moduleName: p.moduleName, version: p.version ?? null, checkNote: p.checkNote ?? null, check: p.check ?? null, riskyApprovedAt: p.riskyApprovedAt ?? null, adoptable: adoptable.get(p.rowId) ?? null })) }, compatGate, rollback: rollbackRec, selfVersion, components: findComponents().map((c) => ({ id: c.id, name: c.name, kind: c.kind ?? 'server', pid: c.pid ?? null, port: c.port ?? null, healthUrl: c.healthUrl ?? null, uiUrl: compUiUrl(c), autoStart: c.autoStart === true })) })
+    return
+}
+
+async function routeDetails(req, res, rc) {
+  const ctx = rc.ctx
+  const url = rc.url
+  const pathname = rc.pathname
+  const method = rc.method
+  const detectFrameworkUpgrade = rc.deps.detectFrameworkUpgrade
+  const detectCompat = rc.deps.detectCompat
+  const listEntries = rc.deps.listEntries
+  const detectAdoptablePending = rc.deps.detectAdoptablePending
+  const readExtraBundleRows = rc.deps.readExtraBundleRows
+  const body = rc.body
+    const { entryId } = body
+    if (typeof entryId !== 'string' || !/^[A-Za-z0-9_:.-]{1,80}$/u.test(entryId)) {
+      sendError(res, 400, 'entryId 无效')
+      return
+    }
+    const entry = ctx.loader.entries().find((candidate) => candidate.id === entryId)
+    if (!entry) {
+      sendError(res, 404, `没有名为 ${entryId} 的插件条目`)
+      return
+    }
+    const moduleName = entry.options.name
+    const details = await readPluginDetails(moduleName, ctx.baseUrl ?? 'file:///', profileDirOf(ctx))
+    sendJson(res, 200, { ok: true, entryId, rowId: rowIdOf(ctx, entryId), moduleName, ...details })
+    return
+}
+
+export { routeStateGet, routeDetails }

package/lib/server/state.js

@@ -0,0 +1,22 @@
+// 跨请求共享的可变运行时状态（分层 Step 8a 从 lib/index.js 抽出）
+//
+// 为什么单独成模块：ESM 的导入绑定是**只读**的（守卫 ⑧ 会拦截"外部给导入绑定赋值"），
+// 而路由拆分后这些状态的写点会散落到 lib/server/routes/**。所以这里：
+//   · 只导出**读取绑定**（读没问题）+ setter / next 函数；
+//   · 所有赋值都发生在本模块内部（合法且可查）。
+
+
+export let marketIndexCache = null
+export let fwCheckCache = null
+export let patchHealAt = null
+export let patchHealReport = null
+export let installJobSeq = 0
+export let aiJobSeq = 0
+export const installJobs = new Map()
+
+export const setMarketIndexCache = (v) => { marketIndexCache = v }
+export const setFwCheckCache = (v) => { fwCheckCache = v }
+export const setPatchHealAt = (v) => { patchHealAt = v }
+export const setPatchHealReport = (v) => { patchHealReport = v }
+export const nextInstallJobSeq = () => (installJobSeq += 1)
+export const nextAiJobSeq = () => (aiJobSeq += 1)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noob-stupid/dsh-plugin-console",
-  "version": "0.3.67",
+  "version": "0.4.0",
   "description": "DSH 框架升级安全与插件升级门控：一键升级、失败自动回滚、升级后回滚上版、旧插件不适配自动禁用；内置多源插件市场为发现层，插件源全部可自定义，可指向公司内网私有源 / 私有索引 / 本地 Git 仓库，纯内网离线可用 | Framework upgrade safety & plugin version gating for DSH, with a customizable multi-source plugin market: point every source at internal mirrors or a local file:// repo for intranet-only, offline installs.",
   "repository": {
     "type": "git",