@noob-stupid/dsh-plugin-console 0.3.9 → 0.3.12

package/README.md

@@ -70,14 +70,18 @@ static plugin & skill index** refreshed by CI every 6 hours.
 The plugin declares a `dsh.bundle` manifest, so a single command installs and enables it:
 
 ```sh
+# npm release (recommended: prebuilt, no git / build authorization needed)
+dsh plugin --profile web add @noob-stupid/dsh-plugin-console
+
+# or install from GitHub source (needs git; allowBuilds authorization on first add)
 dsh plugin --profile web add github:Noob-stupid/dsh-plugin-hub
 ```
 
 Uninstall / reinstall (update):
 
 ```sh
-dsh plugin --profile web remove github:Noob-stupid/dsh-plugin-hub
-dsh plugin --profile web add github:Noob-stupid/dsh-plugin-hub
+dsh plugin --profile web remove @noob-stupid/dsh-plugin-console
+dsh plugin --profile web add @noob-stupid/dsh-plugin-console
 ```
 
 Then restart the dsh service → refresh the page → Settings → Plugins → Plugin Console.
@@ -105,7 +109,7 @@ idempotently appends an enable entry to `cordis.patch.yml`. Afterwards:
 
 ### Option 3: hand it to an AI in one sentence
 
-> Install the DSH plugin hub (dsh-plugin-hub): run `dsh plugin --profile web add github:Noob-stupid/dsh-plugin-hub`; if there is no dsh CLI, clone https://github.com/Noob-stupid/dsh-plugin-hub to `~/.dsh/profiles/web/node_modules/` and register it in `cordis.patch.yml` (id: plugin-console, name: @deepseek-ai/dsh-plugin-console). Restart dsh web afterwards.
+> Install the DSH plugin hub (dsh-plugin-hub): run `dsh plugin --profile web add @noob-stupid/dsh-plugin-console` (npm release); if there is no dsh CLI, clone https://github.com/Noob-stupid/dsh-plugin-hub to `~/.dsh/profiles/web/node_modules/` and register it in `cordis.patch.yml` (id: plugin-console, name: @noob-stupid/dsh-plugin-console). Restart dsh web afterwards.
 
 Requires: DSH ≥ 0.1.0-rc.6 (web profile, with `dsh-client-modules` / `dsh-host-plugin-inventory`).
 

package/README.zh.md

@@ -64,14 +64,18 @@
 插件声明了 `dsh.bundle` 官方清单，一条命令装好并自动启用：
 
 ```sh
+# npm 发布版（推荐：预构建产物，无需 git / 构建授权）
+dsh plugin --profile web add @noob-stupid/dsh-plugin-console
+
+# 或直接装 GitHub 源码（需 git，首次需 allowBuilds 授权）
 dsh plugin --profile web add github:Noob-stupid/dsh-plugin-hub
 ```
 
 卸载 / 重装（即更新）：
 
 ```sh
-dsh plugin --profile web remove github:Noob-stupid/dsh-plugin-hub
-dsh plugin --profile web add github:Noob-stupid/dsh-plugin-hub
+dsh plugin --profile web remove @noob-stupid/dsh-plugin-console
+dsh plugin --profile web add @noob-stupid/dsh-plugin-console
 ```
 
 然后重启 dsh 服务 → 刷新页面 → 设置 → 插件 → 插件管理。
@@ -98,7 +102,7 @@ git clone https://github.com/Noob-stupid/dsh-plugin-hub /tmp/dsh-plugin-console
 
 ### 方式三：一句话交给 AI
 
-> 安装 DSH 插件中心（dsh-plugin-hub）：运行 `dsh plugin --profile web add github:Noob-stupid/dsh-plugin-hub`；若没有 dsh CLI，则克隆 https://github.com/Noob-stupid/dsh-plugin-hub 到 `~/.dsh/profiles/web/node_modules/`，在 `cordis.patch.yml` 注册（id: plugin-console，name: @deepseek-ai/dsh-plugin-console）。完成后重启 dsh web。
+> 安装 DSH 插件中心（dsh-plugin-hub）：运行 `dsh plugin --profile web add @noob-stupid/dsh-plugin-console`（npm 发布版）；若没有 dsh CLI，则克隆 https://github.com/Noob-stupid/dsh-plugin-hub 到 `~/.dsh/profiles/web/node_modules/`，在 `cordis.patch.yml` 注册（id: plugin-console，name: @noob-stupid/dsh-plugin-console）。完成后重启 dsh web。
 
 要求：DSH ≥ 0.1.0-rc.6（web profile，含 `dsh-client-modules` / `dsh-host-plugin-inventory`）。
 

package/lib/client.js

@@ -947,7 +947,7 @@ window.__ModuleLoader__.load({
 			const [giteeClientSecret, setGiteeClientSecret] = react.useState("");
 			// 派生：Gitee 登录状态
 			const giteeStatus = sourcesData !== null
-				? { clientConfigured: !!sourcesData.gitee?.clientId, hasToken: !!sourcesData.gitee?.token, login: sourcesData.gitee?.login ?? "" }
+				? { clientConfigured: !!sourcesData.gitee?.clientConfigured, hasToken: !!sourcesData.gitee?.hasToken, login: sourcesData.gitee?.login ?? "" }
 				: null;
 			// 搜索源（默认 GitHub；点击登录标切换），localStorage 持久化
 			const [searchSource, setSearchSource] = react.useState(() => {
@@ -1487,17 +1487,25 @@ window.__ModuleLoader__.load({
 						setSourcesData(data.sources);
 						setSearchSourcesList(data.sources.searchSources ?? []);
 						setGiteeClientId(data.sources.gitee?.clientId ?? "");
-						setGiteeClientSecret(data.sources.gitee?.clientSecret ?? "");
+						// 安全：secret 永不回传（服务端已脱敏）；已配置时留空、保存需重新输入，
+						// 未配置时为空表单引导首次填写
+						setGiteeClientSecret("");
 					},
 					(error) => { setSourcesOpen(false); setMessage(t("failed") + "：" + friendlyGithubError(error).message); },
 				);
 			};
 			const saveGiteeSetup = () => {
-				if (!giteeClientId.trim() || !giteeClientSecret.trim()) {
+				// clientId 打码回显（如 abc12345…）：用户未修改时原样传回服务端，服务端识别打码标记保留原配置
+				const idValue = giteeClientId.trim();
+				if (!idValue || !giteeClientSecret.trim()) {
 					setMessage(t("failed") + "：client_id / client_secret 不能为空");
 					return;
 				}
-				sourcesAction({ action: "gitee-setup", clientId: giteeClientId.trim(), clientSecret: giteeClientSecret.trim() });
+				if (idValue.endsWith("…")) {
+					sourcesAction({ action: "gitee-setup", clientId: "", clientSecret: giteeClientSecret.trim(), keepClientId: true });
+				} else {
+					sourcesAction({ action: "gitee-setup", clientId: idValue, clientSecret: giteeClientSecret.trim() });
+				}
 			};
 			const startGiteeOauth = () => {
 				call("/plugin-console/gitee-oauth-url").then(

package/lib/index.js

@@ -52,6 +52,7 @@ const PROTECTED_MODULE_PATTERNS = [
   /^@deepseek-ai\/dsh-client-hmr$/u,
   /^@deepseek-ai\/dsh-client-runtime$/u,
   /^@deepseek-ai\/dsh-client-locale$/u,
+  /^@deepseek-ai\/dsh-client-ui-attachment$/u,
   /^@deepseek-ai\/dsh-client-web/u,
   /^@deepseek-ai\/dsh-web-frontend$/u,
   /^@deepseek-ai\/dsh-web-app$/u,
@@ -59,6 +60,7 @@ const PROTECTED_MODULE_PATTERNS = [
   /^@deepseek-ai\/dsh-credentials/u,
   /^@deepseek-ai\/dsh-session/u,
   /^@deepseek-ai\/dsh-storage/u,
+  /^@deepseek-ai\/dsh-attachment/u,
   /^@deepseek-ai\/dsh-typert/u,
   /^@deepseek-ai\/dsh-api-remotes$/u,
   /^@deepseek-ai\/dsh-tools$/u,
@@ -305,7 +307,7 @@ async function removeInsertRow(patchPath, rowId) {
     let next = text.replace(blockRe, '')
     const overrideRe = new RegExp(`^- id: ${escapeRegExp(rowId)}\\s*\\r?\\n {2}disabled: (true|false)\\s*\\r?\\n`, 'mu')
     next = next.replace(overrideRe, '')
-    if (next !== text) await writeFile(patchPath, next, 'utf8')
+    if (next !== text) await writeFile(patchPath, sanitizePatchText(next), 'utf8')
   })
 }
 
@@ -468,6 +470,42 @@ async function writeSources(sources) {
   await writeFile(SOURCES_FILE, JSON.stringify(sources, null, 2) + '\n', 'utf8')
 }
 
+/**
+ * 凭据脱敏（安全审查发现）：/sources 响应不得携带明文密钥——
+ * - Gitee clientSecret / token：绝不回传（clientId 打码保留前 8 位供识别）
+ * - 自定义搜索源的 headers（可能含 Authorization: Bearer xxx）：value 打码
+ * 前端需要"已配置"状态时用 giteeStatusView 的布尔字段。
+ */
+function maskSources(sources) {
+  const gitee = readGiteeConfig(sources)
+  const maskedGitee = {
+    clientId: gitee.clientId === '' ? '' : `${gitee.clientId.slice(0, 8)}…`,
+    clientConfigured: gitee.clientId !== '',
+    hasToken: gitee.token !== '',
+    login: gitee.login,
+  }
+  return {
+    registries: sources.registries,
+    searchSources: (sources.searchSources ?? []).map((s) => {
+      if (s && typeof s.headers === 'object' && Object.keys(s.headers).length > 0) {
+        const masked = {}
+        for (const [k, v] of Object.entries(s.headers)) {
+          masked[k] = typeof v === 'string' && v.length > 8 ? `${v.slice(0, 4)}…${v.slice(-4)}` : (v === '' ? '' : '••••')
+        }
+        return { ...s, headers: masked }
+      }
+      return s
+    }),
+    gitee: maskedGitee,
+  }
+}
+
+/** Gitee 配置状态视图（布尔 + login，无任何凭据）。 */
+function giteeStatusView(sources) {
+  const gitee = readGiteeConfig(sources)
+  return { clientConfigured: gitee.clientId !== '', hasToken: gitee.token !== '', login: gitee.login }
+}
+
 /** 按主→备顺序返回 registry URL 列表。 */
 function orderedRegistries(sources) {
   const list = [...sources.registries]
@@ -513,7 +551,8 @@ function readGithubAuth() {
  * 因此面板披露版本并给出提示，而不是默默失效。
  */
 const CONSOLE_VERSION = '0.1.0'
-const SUPPORTED_WEB_APP_PATTERN = /^0\.1\.0-/u
+// 支持 0.1.x 系列（0.1.0 / 0.1.1 等）；0.2 / 1.0 等破坏性大版本才标记不支持
+const SUPPORTED_WEB_APP_PATTERN = /^0\.1\.\d+/u
 
 async function detectCompat(baseUrl) {
   const result = { consoleVersion: CONSOLE_VERSION, webAppVersion: null, dshVersion: null, supported: true, notice: null }
@@ -539,7 +578,7 @@ async function detectCompat(baseUrl) {
   }
   if (result.webAppVersion !== null && !SUPPORTED_WEB_APP_PATTERN.test(result.webAppVersion)) {
     result.supported = false
-    result.notice = `当前 DSH web 包版本 ${result.webAppVersion} 不在受支持的 0.1.0 系列内，插件控制台的部分功能可能因官方破坏性更新而失效；请到 https://github.com/Noob-stupid/dsh-plugin-hub 获取匹配的更新`
+    result.notice = `当前 DSH web 包版本 ${result.webAppVersion} 不在受支持的 0.1.x 系列内，插件控制台的部分功能可能因官方破坏性更新而失效；请到 https://github.com/Noob-stupid/dsh-plugin-hub 获取匹配的更新`
   }
   return result
 }
@@ -758,12 +797,29 @@ function disableBlock(id) {
   return `- id: ${id}\n  disabled: true\n`
 }
 
+/**
+ * 清理补丁文件中的顶层空数组占位符（issue #7 事故教训）：
+ * DSH profile 模板的 cordis.patch.yml 以注释 + 顶层 `[]` 占位符初始化（如 `# ...\n[]`）。
+ * 直接追加条目会生成 `[]` 后又跟 `- id: xxx` 的非法 YAML（同文档流里数组结束符 + 后续项），
+ * 导致 dsh 启动解析崩溃。写入前必须移除顶层独立的 `[]` / `[ ]` 占位行。
+ * 仅处理"整行就是空数组"的占位符；合法内容（如 `- insert:` 列表）不受影响。
+ */
+function sanitizePatchText(text) {
+  return text
+    .split(/\r?\n/u)
+    .filter((line) => !/^\s*\[\s*\]\s*$/u.test(line))
+    .join('\n')
+    .replace(/\n{3,}/gu, '\n\n')
+    .replace(/\s+$/u, '') + '\n'
+}
+
 /** 停用：追加 disabled:true 块（已存在则不动）。 */
 async function disableEntry(patchPath, id) {
   return queuedWrite(async () => {
     const { disables, text } = await readPatchState(patchPath)
     if (disables.includes(id)) return { changed: false }
-    const next = text.length === 0 || text.endsWith('\n') ? text : `${text}\n`
+    const clean = sanitizePatchText(text)
+    const next = clean.length === 0 || clean.endsWith('\n') ? clean : `${clean}\n`
     await writeFile(patchPath, `${next}${disableBlock(id)}`, 'utf8')
     return { changed: true }
   })
@@ -775,11 +831,12 @@ async function enableEntry(patchPath, id) {
     const { disables, forced, text } = await readPatchState(patchPath)
     const blockRe = new RegExp(`^- id: ${escapeRegExp(id)}\\r?\\n  disabled: true\\r?\\n`, 'mu')
     if (blockRe.test(text)) {
-      await writeFile(patchPath, text.replace(blockRe, ''), 'utf8')
+      await writeFile(patchPath, sanitizePatchText(text.replace(blockRe, '')), 'utf8')
       return { changed: true }
     }
     if (forced.includes(id)) return { changed: false }
-    const next = text.length === 0 || text.endsWith('\n') ? text : `${text}\n`
+    const clean = sanitizePatchText(text)
+    const next = clean.length === 0 || clean.endsWith('\n') ? clean : `${clean}\n`
     await writeFile(patchPath, `${next}- id: ${id}\n  disabled: false\n`, 'utf8')
     return { changed: true }
   })
@@ -790,7 +847,8 @@ async function appendInsert(patchPath, entryId, packageName) {
   return queuedWrite(async () => {
     const { inserts, text } = await readPatchState(patchPath)
     if (inserts.includes(entryId)) return { changed: false }
-    const next = text.length === 0 || text.endsWith('\n') ? text : `${text}\n`
+    const clean = sanitizePatchText(text)
+    const next = clean.length === 0 || clean.endsWith('\n') ? clean : `${clean}\n`
     const block = `- insert:\n    - id: ${entryId}\n      name: '${packageName}'\n`
     await writeFile(patchPath, `${next}${block}`, 'utf8')
     return { changed: true }
@@ -1241,31 +1299,44 @@ function githubRepoInfo(repo) {
 }
 
 /** raw 文件读取：https 主通道（含镜像）、gh CLI、curl 直连、curl jsDelivr CDN **四通道并行竞速**。
- * 黑洞期 https/ghproxy 全挂、gh 可能不在服务进程 PATH——jsDelivr CDN 走系统网络且国内可达，是最后兜底。 */
+ * 黑洞期 https/ghproxy 全挂、gh 可能不在服务进程 PATH——jsDelivr CDN 走系统网络且国内可达，是最后兜底。
+ * 关键语义：**404 是确定性结果**（文件不存在，探测 .gitmodules/SKILL.md 等时的正常答案），
+ * 必须立即返回 null，不能等其它分支（黑洞期 https 通道 20s+ 才失败会拖死整个请求）。 */
 async function rawTextWithFallback(repo, branch, path) {
   const url = `${GITHUB_RAW}/${repo}/${encodeURIComponent(branch)}/${path}`
-  const https = githubText(url)
+  // 404/4xx：确定性"不存在"，立即以 null 胜出（不等慢分支）
+  const notFound = (promise) => promise
+    .catch((error) => {
+      if (error instanceof Error && /HTTP 404|HTTP 400|Not Found|not found|非 2xx|HTTP 非 2xx/u.test(error.message)) return null
+      throw error
+    })
+  const https = notFound(githubText(url)
     .then((body) => {
       if (body === null) throw new Error('HTTP 非 2xx')
       return body
-    })
-  const gh = githubViaGh(`repos/${repo}/contents/${path}?ref=${encodeURIComponent(branch)}`)
+    }))
+  const gh = notFound(githubViaGh(`repos/${repo}/contents/${path}?ref=${encodeURIComponent(branch)}`)
     .then((data) => {
       if (data && typeof data.content === 'string') return Buffer.from(data.content, 'base64').toString('utf8')
       throw new Error('contents 无内容')
-    })
-  const curl = curlText(url, 10000)
+    }))
+  const curl = notFound(curlText(url, 6000)
     .then((body) => {
       if (body === null) throw new Error('HTTP 非 2xx')
       return body
-    })
-  const cdn = curlText(`https://cdn.jsdelivr.net/gh/${repo}@${encodeURIComponent(branch)}/${path}`, 10000)
+    }))
+  const cdn = notFound(curlText(`https://cdn.jsdelivr.net/gh/${repo}@${encodeURIComponent(branch)}/${path}`, 6000)
     .then((body) => {
       if (body === null) throw new Error('HTTP 非 2xx')
       return body
-    })
+    }))
   try {
-    return await Promise.any([https, gh, curl, cdn])
+    // 任一通道成功（含 404→null）立即返回；整体 5s 封顶（jsDelivr 正常 0.7s，
+    // 黑洞期快速失败优于等 12s），超时视为不可达（null）。
+    return await Promise.race([
+      Promise.any([https, gh, curl, cdn]),
+      new Promise((resolve) => setTimeout(() => resolve(null), 5000)),
+    ])
   } catch {
     return null
   }
@@ -1441,10 +1512,15 @@ function parseBundlePatchRefs(text) {
  * 捆绑依赖补装（事故教训：dsh-web-ui-all 更新后 17 个捆绑依赖缺失 → 服务加载崩溃）：
  * curl/GitHub 通道只解压主包，这里逐个补装直接依赖（pnpm → curl 依次尝试）。
  * 返回仍缺失的依赖列表。
+ * 安全护栏（事故教训）：@deepseek-ai/* 框架内部包**绝不补装**——它们由框架依赖树管理
+ * （正确版本随 @deepseek-ai/dsh 一起安装），npm 上这些内部包的 dist-tags.latest 是远古
+ * 版本（如 dsh-host-webserver@0.0.1-rc.1），无版本约束补装会覆盖框架正确版本，
+ * 导致 webServer 等服务起不来、整个 profile 启动崩溃。
  */
 async function backfillMissingDeps(profileDir, deps, registries) {
   const stillMissing = []
   for (const dep of deps) {
+    if (/^@deepseek-ai\//u.test(dep)) continue // 框架内部包：跳过（宿主提供）
     if (existsSync(join(profileDir, 'node_modules', dep))) continue
     let ok = false
     try {
@@ -1453,8 +1529,10 @@ async function backfillMissingDeps(profileDir, deps, registries) {
     } catch {}
     if (!ok) {
       try {
-        const depInfo = await curlManualInstall(profileDir, dep, registries)
-        ok = depInfo.missingDeps.length === 0
+        await curlManualInstall(profileDir, dep, registries)
+        // 判断目标是否实际安装（修复：旧代码用 depInfo.missingDeps.length===0 判断
+        // "该依赖自身无依赖"，只要目标依赖带依赖就误报缺失——即使 curl 已成功安装）
+        ok = existsSync(join(profileDir, 'node_modules', dep))
       } catch {}
     }
     if (!ok) stillMissing.push(dep)
@@ -1503,7 +1581,8 @@ async function githubReleaseInstall(profileDir, repo, packageName) {
     // 盒子实验：静态验证通过才覆盖（失败保留旧版本）。引用检查根用目标目录（宿主插件在根层）
     const box = verifyPackageBox(pkgPath, profileDir, packageName, targetRoot)
     const pkg = JSON.parse(readFileSync(join(pkgPath, 'package.json'), 'utf8'))
-    const deps = { ...(pkg.dependencies ?? {}), ...(pkg.peerDependencies ?? {}) }
+    // 只统计 dependencies（peerDependencies 是宿主契约，不补装——见 curlManualInstall 注释）
+    const deps = { ...(pkg.dependencies ?? {}) }
     const missingDeps = Object.keys(deps).filter((d) => !existsSync(join(profileDir, 'node_modules', d)))
     const target = join(targetRoot, packageName)
     if (existsSync(target)) rmSync(target, { recursive: true, force: true })
@@ -1564,6 +1643,9 @@ async function ensureBundlePatchIntegrity(profileDir, pkgName, userPatchPath) {
     if (refs.length === 0) return report
     const registries = orderedRegistries(readSources())
     for (const ref of refs) {
+      // 框架内部包跳过（事故教训：npm 上 @deepseek-ai/* 的 dist-tags.latest 是远古版本，
+      // 无版本约束补装会覆盖框架正确版本导致服务崩溃——见 backfillMissingDeps 注释）
+      if (/^@deepseek-ai\//u.test(ref.name)) continue
       if (existsSync(join(profileDir, 'node_modules', ref.name))) continue
       let ok = false
       try {
@@ -1581,7 +1663,10 @@ async function ensureBundlePatchIntegrity(profileDir, pkgName, userPatchPath) {
         try {
           const userPatch = readFileSync(userPatchPath, 'utf8')
           if (!userPatch.includes(`id: ${ref.id}`)) {
-            appendFileSync(userPatchPath, `- id: ${ref.id}\n  disabled: true\n`, 'utf8')
+            // issue #7 防护：清理顶层 [] 占位符后再追加（模板初始文件直接追加会生成非法 YAML）
+            const clean = sanitizePatchText(userPatch)
+            const next = clean.length === 0 || clean.endsWith('\n') ? clean : `${clean}\n`
+            writeFileSync(userPatchPath, `${next}- id: ${ref.id}\n  disabled: true\n`, 'utf8')
             report.disabled.push(ref.id)
           }
         } catch {}
@@ -2495,8 +2580,7 @@ async function handle(ctx, req, res) {
 
   if (method === 'GET' && pathname === `${ROUTE_PREFIX}/sources`) {
     const sources = readSources()
-    const gitee = readGiteeConfig(sources)
-    sendJson(res, 200, { ok: true, sources, giteeStatus: { clientConfigured: gitee.clientId !== '', hasToken: gitee.token !== '', login: gitee.login } })
+    sendJson(res, 200, { ok: true, sources: maskSources(sources), giteeStatus: giteeStatusView(sources) })
     return
   }
 
@@ -2958,7 +3042,7 @@ async function handle(ctx, req, res) {
       }
       sources.registries.push(entry)
       await writeSources(sources)
-      sendJson(res, 200, { ok: true, sources })
+      sendJson(res, 200, { ok: true, sources: maskSources(sources) })
       return
     }
     if (action === 'remove') {
@@ -2985,7 +3069,7 @@ async function handle(ctx, req, res) {
       target.url = url
       target.name = name || url
       await writeSources(sources)
-      sendJson(res, 200, { ok: true, sources })
+      sendJson(res, 200, { ok: true, sources: maskSources(sources) })
       return
     }
     if (action === 'set-primary') {
@@ -2996,7 +3080,7 @@ async function handle(ctx, req, res) {
       }
       for (const r of sources.registries) r.primary = r.id === id
       await writeSources(sources)
-      sendJson(res, 200, { ok: true, sources })
+      sendJson(res, 200, { ok: true, sources: maskSources(sources) })
       return
     }
     if (action === 'add-search') {
@@ -3028,7 +3112,7 @@ async function handle(ctx, req, res) {
         ...(headers.length > 0 ? { headers } : {}),
       })
       await writeSources(sources)
-      sendJson(res, 200, { ok: true, sources })
+      sendJson(res, 200, { ok: true, sources: maskSources(sources) })
       return
     }
     if (action === 'remove-search') {
@@ -3044,33 +3128,35 @@ async function handle(ctx, req, res) {
       }
       sources.searchSources = sources.searchSources.filter((s) => s.id !== id)
       await writeSources(sources)
-      sendJson(res, 200, { ok: true, sources })
+      sendJson(res, 200, { ok: true, sources: maskSources(sources) })
       return
     }
     if (action === 'reset') {
       const defaults = JSON.parse(JSON.stringify(DEFAULT_SOURCES))
       await writeSources(defaults)
-      sendJson(res, 200, { ok: true, sources: defaults })
+      sendJson(res, 200, { ok: true, sources: maskSources(defaults) })
       return
     }
     if (action === 'gitee-setup') {
       const clientId = typeof body.clientId === 'string' ? body.clientId.trim() : ''
       const clientSecret = typeof body.clientSecret === 'string' ? body.clientSecret.trim() : ''
-      if (!clientId || !clientSecret) {
+      const keepClientId = body.keepClientId === true
+      if ((!keepClientId && !clientId) || !clientSecret) {
         sendError(res, 400, 'client_id 与 client_secret 不能为空')
         return
       }
       const current = readGiteeConfig(sources)
-      sources.gitee = { ...current, clientId, clientSecret }
+      // keepClientId：前端回显的是打码 clientId（abc12345…），用户只改了 secret 时保留原配置
+      sources.gitee = { ...current, clientId: keepClientId ? current.clientId : clientId, clientSecret }
       await writeSources(sources)
-      sendJson(res, 200, { ok: true, sources })
+      sendJson(res, 200, { ok: true, sources: maskSources(sources) })
       return
     }
     if (action === 'gitee-clear') {
       const current = readGiteeConfig(sources)
       sources.gitee = { clientId: current.clientId, clientSecret: current.clientSecret, token: '', login: '' }
       await writeSources(sources)
-      sendJson(res, 200, { ok: true, sources })
+      sendJson(res, 200, { ok: true, sources: maskSources(sources) })
       return
     }
     sendError(res, 400, '未知操作（add / edit / set-primary / remove / add-search / remove-search / gitee-setup / gitee-clear / reset）')

package/package.json

@@ -1,6 +1,6 @@
 {
     "name":  "@noob-stupid/dsh-plugin-console",
-    "version":  "0.3.9",
+    "version":  "0.3.12",
     "description":  "DSH plugin management panel \u0026 marketplace: one-click enable/disable, multi-source market (GitHub/Gitee/custom), static-index market (500+ plugins / 300 skills), skills, suites, and one-click framework upgrade.",
     "repository":  {
                        "type":  "git",