@noob-stupid/dsh-plugin-console 0.5.2 → 0.5.4

package/README.md

@@ -154,6 +154,29 @@ Requires: DSH ≥ 0.1.0-rc.6 (web profile, with `dsh-client-modules` / `dsh-host
 
 ---
 
+## Screenshots · 界面一览
+
+> 入口挂在**官方插件管理页自己的插槽**（`plugins.bundle.config`，key = 包名）：装完之后它出现在
+> 「设置 → 插件 → 已安装」里我们这一条下面，用的是官方容器与官方风格 —— 不是 DOM 注入，官方更新也不怕。
+
+**1 · 已安装列表里的入口**（官方页，点开我们这条即见）
+
+![Entry inside the official plugins page](docs/images/official-plugins-page.png)
+
+**2 · 「升级安全」面板**（就地展开：运行模式 / 框架版本 / 回滚点 / 环境指纹 / 补声明 / 契约预检 / 各功能入口）
+
+![Upgrade safety panel expanded in place](docs/images/upgrade-safety-panel.png)
+
+**3 · 框架升级 / 回滚**（可选目标版本、常驻的升级进度、一键回滚上一版）
+
+![Framework upgrade and rollback panel](docs/images/framework-upgrade-rollback.png)
+
+**4 · 门控明细**（谁被隔离、为什么：升级预扫 or 启动失败隔离，附来源与时间）
+
+![Compatibility gate detail list](docs/images/compat-gate-detail.png)
+
+---
+
 ## Features
 
 ### Installed plugins (one-click toggle + details)

package/lib/client.js

@@ -4962,14 +4962,19 @@ setMessage(t("failed") + "：" + (data?.reason ?? "未知"));
 				control === undefined || control === null ? null : control);
 			const sw = (on, onClick, title) => el("button", { type: "button", title: title, onClick: onClick, disabled: busy, style: { width: "40px", height: "22px", borderRadius: "999px", border: "none", padding: 0, cursor: busy ? "default" : "pointer", background: on ? "var(--dsw-alias-bg-accent, #4d6bfe)" : "var(--dsw-alias-bg-secondary, rgba(127,127,127,.35))", position: "relative", flex: "0 0 auto", marginTop: "2px" } },
 				el("span", { style: { position: "absolute", top: "3px", left: on ? "21px" : "3px", width: "16px", height: "16px", borderRadius: "50%", background: "#fff", transition: "left .18s cubic-bezier(.34,1.56,.64,1)" } }));
-			const jump = (id, label) => el("button", { key: id, type: "button", className: styles.toggle, style: { marginRight: "8px", marginBottom: "8px" }, onClick: () => setSection(id) }, label);
+			const jump = (id, label) => el("button", { key: id, type: "button", className: styles.toggle, style: { marginRight: "8px", marginBottom: "8px" }, onClick: () => setSection((prev) => (prev === id ? null : id)) }, label);
 			const mode = status !== null && status.mode === "observer" ? "observer" : status !== null && status.mode === "managed" ? "managed" : "observer";
 			const fp = status !== null && status.fingerprint !== null && status.fingerprint !== undefined ? status.fingerprint : {};
 			const rb = status !== null && status.rollback !== null && status.rollback !== undefined ? status.rollback : {};
 			const fw = status !== null && typeof status.frameworkVersion === "string" && status.frameworkVersion !== "" ? status.frameworkVersion : t("safetyUnknown");
 			const pending = backfill !== null && typeof backfill.count === "number" ? backfill.count : 0;
 			// 触发条：默认只看到这一行（点开在**原地**展开，功能包那种下拉，不走右侧固定抽屉）
-			const trigger = el("button", { type: "button", "aria-expanded": open ? "true" : "false", onClick: () => setOpen((prev) => !prev), style: { width: "100%", display: "flex", alignItems: "center", gap: "10px", padding: "12px 14px", borderRadius: "12px", border: "1px solid var(--dsw-alias-border-secondary, rgba(127,127,127,.18))", background: "var(--dsw-alias-bg-layer-4, rgba(127,127,127,.10))", cursor: "pointer", textAlign: "left", color: "inherit" } },
+			// 收起/展开：收起时**清掉就地分区**，否则再展开时内嵌控制台会重新挂载并把上次那个面板自动打开一遍
+			// （用户实测：点过「框架升级/回滚」→ 关掉弹窗 → 收起 → 再展开，弹窗又自己弹出来了）
+			const toggleOpen = () => {
+				if (open) { setOpen(false); setSection(null); } else { setOpen(true); }
+			};
+			const trigger = el("button", { type: "button", "aria-expanded": open ? "true" : "false", onClick: toggleOpen, style: { width: "100%", display: "flex", alignItems: "center", gap: "10px", padding: "12px 14px", borderRadius: "12px", border: "1px solid var(--dsw-alias-border-secondary, rgba(127,127,127,.18))", background: "var(--dsw-alias-bg-layer-4, rgba(127,127,127,.10))", cursor: "pointer", textAlign: "left", color: "inherit" } },
 				icon("shield"),
 				el("div", { style: { flex: "1 1 auto", minWidth: "0" } },
 					el("div", { style: { fontSize: "13px", fontWeight: 500 } }, t("safetyTab")),

package/lib/server/domain/install-job.js

@@ -7,8 +7,9 @@ import { readFile } from 'node:fs/promises'
 import { basename, dirname, join, resolve } from 'node:path'
 import { aiRepair } from './ai-run.js'
 import { maybeAutoAdaptCompat } from './compat.js'
-import { DEFAULT_BUNDLES, AI_CONSENT_TIMEOUT_MS, addBundleToManifest, backfillMissingDeps, curlManualInstall, declareProfileDependency, detectBundleOnly, ensureBundlePatchIntegrity, githubReleaseInstall, pnpmInstall, raceInstallChannels, readBundlePatchRefNames, readGithubAuth, syncAggregateSubpackageVersions } from './install.js'
+import { DEFAULT_BUNDLES, AI_CONSENT_TIMEOUT_MS, addBundleToManifest, backfillMissingDeps, curlManualInstall, detectBundleOnly, ensureBundlePatchIntegrity, githubReleaseInstall, pnpmInstall, raceInstallChannels, readBundlePatchRefNames, readGithubAuth, syncAggregateSubpackageVersions } from './install.js'
 import { fetchRepoPackage, fetchRepoPackageEx, fetchSubpackageNames, packageProbeErrorText, subpackageCandidates } from './market.js'
+import { declareProfileDependency } from './manifest.js'
 import { appendInsert, readPatchState, syncNameFromNote } from './patch.js'
 import { deriveEntryId, listEntries } from './runtime.js'
 import { detectSkillRepo, runSkillInstallJob } from './skills.js'
@@ -490,10 +491,13 @@ async function runInstallJob(job, ports) {
       } else {
         job.bundleNote = (job.bundleNote ? job.bundleNote + '；' : '') + `${installedName} 已由已安装聚合包提供，仅更新包本身，不再注册重复行`
       }
-      // 安装即声明：即便是「已由聚合包提供」的分支也要声明本轮真实安装的版本，
-      // 否则官方面板看不见它、pnpm 也会按旧清单把它还原回去（2026-09-24 根因）。
+      // 安装即声明（2026-09-24）：装到哪版就把它写进 profile 清单的 dependencies，
+      // **并立刻同步 pnpm-lock.yaml**（declareProfileDependency 内部已含对账）——只写清单不写 lock
+      // 会让之后任何 pnpm 操作硬失败（ERR_PNPM_CANNOT_REMOVE_MISSING_DEPS）。
+      // 对账失败只记 note，不让已经装好的包变成"安装失败"。
       const declaredBundle = await declareProfileDependency(profileDir, installedName)
       if (declaredBundle.changed) job.declared = declaredBundle.version
+      if (declaredBundle.lockSynced === false && declaredBundle.lockNote !== null) job.lockNote = declaredBundle.lockNote
       job.status = 'done'
       return
     }
@@ -501,15 +505,16 @@ async function runInstallJob(job, ports) {
       job.note = `${installedName} 已由已安装条目提供，仅更新包本身，不重复注册`
       const declaredServed = await declareProfileDependency(profileDir, installedName)
       if (declaredServed.changed) job.declared = declaredServed.version
+      if (declaredServed.lockSynced === false && declaredServed.lockNote !== null) job.lockNote = declaredServed.lockNote
       job.status = 'done'
       return
     }
     const entryId = deriveEntryId(installedName, taken)
     await appendInsert(patchPath, entryId, installedName)
     job.entryId = entryId
-    // 安装即声明（同上）：普通插件装完把依赖写进 profile 清单
     const declared = await declareProfileDependency(profileDir, installedName)
     if (declared.changed) job.declared = declared.version
+    if (declared.lockSynced === false && declared.lockNote !== null) job.lockNote = declared.lockNote
     job.status = 'done'
   } catch (error) {
     job.status = 'failed'

package/lib/server/domain/install.js

@@ -6,7 +6,6 @@ import { readFile, writeFile } from 'node:fs/promises'
 import { execFile } from 'node:child_process'
 import { dirname, join, resolve } from 'node:path'
 import { tmpdir } from 'node:os'
-import { DEFAULT_BUNDLES, addBundleToManifest, declareProfileDependency, removeBundleFromManifest, undeclareProfileDependency } from './manifest.js'
 import { sanitizePatchText } from './patch.js'
 import { orderedRegistries, readSources } from './sources.js'
 import { execFileAsync, runPnpmWithFallback } from '../infra/exec.js'
@@ -30,6 +29,23 @@ async function detectBundleOnly(profileDir, packageName) {
   }
 }
 
+/** 把包追加进 profile 的 dsh.profile.bundles 层（与官方 dsh plugin add 的 reconcile 一致）。 */
+async function addBundleToManifest(profileDir, packageName) {
+  return queuedWrite(async () => {
+    const manifestPath = join(profileDir, 'package.json')
+    const manifest = JSON.parse(await readFile(manifestPath, 'utf8'))
+    const bundles = manifest.dsh?.profile?.bundles ?? []
+    if (!bundles.includes(packageName)) {
+      bundles.push(packageName)
+      manifest.dsh = { ...(manifest.dsh ?? {}), profile: { ...(manifest.dsh?.profile ?? {}), bundles } }
+      await writeFile(manifestPath, JSON.stringify(manifest, null, 2) + '\n', 'utf8')
+    }
+  })
+}
+
+/** 官方 profile 模板自带的 bundle（其余 bundle 视为用户额外添加）。 */
+const DEFAULT_BUNDLES = ['@deepseek-ai/dsh-base', '@deepseek-ai/dsh-web-app']
+
 /** 读取用户额外 bundle 的插入行归属表：行 id / 包名 → 所属 bundle 包名。 */
 async function readExtraBundleOwners(profileDir) {
   const owners = new Map()
@@ -64,6 +80,20 @@ async function readExtraBundleOwners(profileDir) {
   return owners
 }
 
+/** 从 profile manifest 移除一个 bundle。 */
+async function removeBundleFromManifest(profileDir, bundlePkg) {
+  return queuedWrite(async () => {
+    const manifestPath = join(profileDir, 'package.json')
+    const manifest = JSON.parse(await readFile(manifestPath, 'utf8'))
+    const bundles = manifest.dsh?.profile?.bundles ?? []
+    const next = bundles.filter((name) => name !== bundlePkg)
+    if (next.length !== bundles.length) {
+      manifest.dsh = { ...(manifest.dsh ?? {}), profile: { ...(manifest.dsh?.profile ?? {}), bundles: next } }
+      await writeFile(manifestPath, JSON.stringify(manifest, null, 2) + '\n', 'utf8')
+    }
+  })
+}
+
 /**
  * 读取 dsh-github-login（独立登录工具）写入的 GitHub 令牌文件。
  * 只对外暴露登录状态（login），绝不下发令牌本身。
@@ -566,4 +596,4 @@ async function syncAggregateSubpackageVersions(profileDir, packageName, registri
   return updated
 }
 
-export { AI_CONSENT_TIMEOUT_MS, DEFAULT_BUNDLES, detectBundleOnly, addBundleToManifest, removeBundleFromManifest, declareProfileDependency, undeclareProfileDependency, readExtraBundleOwners, readGithubAuth, pnpmInstall, curlManualInstall, raceInstallChannels, verifyPackageBox, parseBundlePatchRefs, backfillMissingDeps, githubReleaseInstall, readBundlePatchRefNames, ensureBundlePatchIntegrity, syncAggregateSubpackageVersions, installJobView }
+export { AI_CONSENT_TIMEOUT_MS, DEFAULT_BUNDLES, detectBundleOnly, addBundleToManifest, removeBundleFromManifest, readExtraBundleOwners, readGithubAuth, pnpmInstall, curlManualInstall, raceInstallChannels, verifyPackageBox, parseBundlePatchRefs, backfillMissingDeps, githubReleaseInstall, readBundlePatchRefNames, ensureBundlePatchIntegrity, syncAggregateSubpackageVersions, installJobView }

package/lib/server/domain/manifest.js

@@ -14,6 +14,7 @@ import { readFile, writeFile } from 'node:fs/promises'
 import { join } from 'node:path'
 import { queuedWrite } from '../infra/fsx.js'
 import { resolvePackageJson } from '../infra/paths.js'
+import { reconcileLockfile } from './selfupdate.js'
 
 /** 官方 profile 模板自带的 bundle（其余 bundle 视为用户额外添加）。 */
 const DEFAULT_BUNDLES = ['@deepseek-ai/dsh-base', '@deepseek-ai/dsh-web-app']
@@ -88,20 +89,36 @@ async function removeBundleFromManifest(profileDir, bundlePkg) {
  *   · 官方「设置 → 插件」的**已安装**分区只显示清单里声明过的包 —— 我们手铺的包在那里看不见；
  *   · 任何一次 pnpm 操作都会按清单 + lock 重装，未声明的包会被**还原/清掉**；
  *   · 连我们自己的「清理残余」也按「有没有被声明」判孤儿 —— 判据病根也在这里。
- * @returns {{ changed: boolean, version: string|null, reason: string|null }}
+ * @returns {{ changed: boolean, version: string|null, reason: string|null, lockSynced: boolean, lockNote: string|null }}
  */
-async function declareProfileDependency(profileDir, packageName, version = null) {
-  return queuedWrite(async () => {
+async function declareProfileDependency(profileDir, packageName, version = null, { syncLock = true } = {}) {
+  const result = await queuedWrite(async () => {
     const manifest = await readManifest(profileDir)
     const resolved = typeof version === 'string' && version !== '' ? version : await installedVersionOf(profileDir, packageName)
-    if (resolved === null) return { changed: false, version: null, reason: '读不到已安装版本' }
+    if (resolved === null) return { changed: false, version: null, reason: '读不到已安装版本', needsLockSync: false }
     const deps = { ...(manifest.dependencies ?? {}) }
-    if (deps[packageName] === resolved) return { changed: false, version: resolved, reason: null }
+    if (deps[packageName] === resolved) return { changed: false, version: resolved, reason: null, needsLockSync: false }
     deps[packageName] = resolved
     manifest.dependencies = deps
     await writeManifest(profileDir, manifest)
-    return { changed: true, version: resolved, reason: null }
+    return { changed: true, version: resolved, reason: null, needsLockSync: true }
   })
+  if (result.needsLockSync !== true || syncLock !== true) return { ...result, lockSynced: false, lockNote: null }
+  // **写完清单必须把 lock 拉齐**（2026-09-24 CI 实测）：只写清单不写 lock → 清单/lock 不一致 →
+  // 之后任何 pnpm 操作都会硬失败（ERR_PNPM_CANNOT_REMOVE_MISSING_DEPS）。
+  // 放在写队列**之外**执行（对账本身会跑 pnpm，不该占着清单写锁）；失败只记 note，不让安装失败。
+  return { ...(await syncLockFor(profileDir, [packageName])), changed: true, version: result.version, reason: null }
+}
+
+/** 声明之后同步 lock：用仓库既有的对账通道；失败如实回报，不假装成功。 */
+async function syncLockFor(profileDir, names) {
+  try {
+    const { reconcileLockfile } = await import('./selfupdate.js')
+    await reconcileLockfile({ profileDir, packages: names.map((name) => ({ name })) })
+    return { lockSynced: true, lockNote: null }
+  } catch (error) {
+    return { lockSynced: false, lockNote: `lock 对账失败：${error instanceof Error ? error.message : String(error)}` }
+  }
 }
 
 /** 卸载即撤销声明。 */
@@ -162,5 +179,5 @@ async function applyDependencyBackfill(profileDir) {
 
 export {
   DEFAULT_BUNDLES, addBundleToManifest, applyDependencyBackfill, declareProfileDependency,
-  installedVersionOf, planDependencyBackfill, removeBundleFromManifest, undeclareProfileDependency,
+  installedVersionOf, planDependencyBackfill, removeBundleFromManifest, syncLockFor, undeclareProfileDependency,
 }

package/lib/server/infra/exec.js

@@ -47,9 +47,19 @@ function resolvePnpmRunners({ platform = process.platform, execPath = process.ex
 }
 
 /** 依次尝试各执行方式；只有"执行方式本身不可用"（ENOENT / MODULE_NOT_FOUND）才换下一个，
- * 真正的安装失败（网络、依赖冲突等）立即抛出，并附上已尝试的清单便于排查。 */
+ * 真正的安装失败（网络、依赖冲突等）立即抛出，并附上已尝试的清单便于排查。
+ *
+ * 2026-09-24：抛错时必须**带上 pnpm 的原始 stderr** —— 之前只留 `Command failed: <命令行>`，
+ * 界面与测试里都看不到真实原因（CI 的「真装真卸冒烟」就是这么红的：只知道失败、不知道为什么）。 */
 async function runPnpmWithFallback(args, { execOpts = {}, runners = resolvePnpmRunners() } = {}) {
   let lastError = null
+  const withStderr = (error) => {
+    const stderr = typeof error?.stderr === 'string' ? error.stderr.trim() : ''
+    const stdout = typeof error?.stdout === 'string' ? error.stdout.trim() : ''
+    if (stderr === '' && stdout === '') return error
+    const detail = [stderr, stdout].filter((s) => s !== '').join(' / ').split(/\r?\n/u).slice(-6).join(' ⏎ ').slice(0, 800)
+    return new Error(`${String(error?.message ?? 'pnpm 执行失败')}｜真实输出：${detail}`)
+  }
   for (const runner of runners) {
     const { bin, argv } = runner.run(args)
     try {
@@ -57,9 +67,9 @@ async function runPnpmWithFallback(args, { execOpts = {}, runners = resolvePnpmR
       await execFileAsync(bin, argv, execOpts)
       return { runner }
     } catch (error) {
-      lastError = error
+      lastError = withStderr(error)
       const message = String(error?.message ?? '')
-      if (!/ENOENT|Cannot find module/u.test(message)) throw error
+      if (!/ENOENT|Cannot find module/u.test(message)) throw lastError
     }
   }
   const tried = runners.map((r) => r.note).join(' → ')

package/lib/server/routes/compat.js

@@ -15,6 +15,7 @@ import { dirname } from 'node:path'
 import { compareFingerprint, computeFingerprint, readCompatMode, readFingerprint, readRollbackRecord, stampFingerprint, writeCompatMode } from '../domain/compat-state.js'
 import { currentFrameworkVersion } from '../domain/framework.js'
 import { applyDependencyBackfill, planDependencyBackfill } from '../domain/manifest.js'
+import { reconcileLockfile } from '../domain/selfupdate.js'
 import { sendError, sendJson } from '../infra/httpd.js'
 import { baseDirOf, profileDirOf, resolvePackageJson } from '../infra/paths.js'
 import { existsSync } from 'node:fs'
@@ -93,11 +94,15 @@ async function routeDeclareInstalled(req, res, rc) {
   try {
     if (mode === 'apply') {
       const result = await applyDependencyBackfill(profileDir)
+      // 关键：只写清单不写 lock → 之后任何 pnpm 操作都会因清单/lock 不一致失败（2026-09-24 CI 实测）
+      let lockNote = null
+      try { await reconcileLockfile({ profileDir }) } catch (error) { lockNote = `lock 对账失败：${error instanceof Error ? error.message : String(error)}` }
       sendJson(res, 200, {
         ok: true,
         mode,
         declared: result.declared,
         skipped: result.skipped,
+        lockNote,
         note: result.declared.length === 0
           ? '没有需要补声明的插件'
           : `已补声明 ${result.declared.length} 项 —— 它们现在会出现在官方/第三方插件页的「已安装」里，也不会再被 pnpm 还原`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noob-stupid/dsh-plugin-console",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "DSH 框架升级安全与插件升级门控：一键升级、失败自动回滚、升级后回滚上版、旧插件不适配自动禁用；内置多源插件市场为发现层，插件源全部可自定义，可指向公司内网私有源 / 私有索引 / 本地 Git 仓库，纯内网离线可用 | Framework upgrade safety & plugin version gating for DSH, with a customizable multi-source plugin market: point every source at internal mirrors or a local file:// repo for intranet-only, offline installs.",
   "repository": {
     "type": "git",