@noob-stupid/dsh-plugin-console 0.5.21 → 0.5.22

package/lib/server/domain/plugin-actions.js

@@ -27,7 +27,7 @@ import { NPM_NAME_RE } from './dep-source.js'
 import { runLockfileRepair } from './lockfile-health.js'
 import { pinProfileDependency, specOf } from './manifest.js'
 import { lockVersion } from './selfupdate.js'
-import { buildPnpmEnv, pnpmAddArgs, runPnpmWithFallback } from '../infra/exec.js'
+import { buildPnpmEnv, pnpmAddArgs, runPnpmWithFallback, unknownPnpmOption } from '../infra/exec.js'
 
 const DEFAULT_REGISTRY = 'https://registry.npmmirror.com'
 /** 动作白名单（客户端只能给这些 kind；执行分支与 argv 全在服务端）。 */
@@ -91,14 +91,18 @@ function isReleaseAgeBlock(message) {
 }
 
 /** 跑一次 pnpm（原样），必要时**只对这一条命令**放宽供应链闸并如实标记。
- *  返回 { ok, exitCode, stdout, stderr, relaxedReleaseAge, error }。 */
+ *  返回 { ok, exitCode, stdout, stderr, relaxedReleaseAge, error }。
+ *
+ *  ★ 2026-09-27 CI 实测踩到（本函数的第一个版本）：这里直接拼 `pnpmAddArgs` 却没有 `runPnpmAdd` 的
+ *    **未知选项降级** —— 而 CI 的 corepack 解析到 pnpm 12，`--fetch-timeout/--fetch-retries` 在 pnpm 12
+ *    上是 `error: unexpected argument`（直接退出），于是"加固"变成了"动作跑不成"（真机 CI 红）。
+ *    现在与 `infra/exec.js#runPnpmAdd` 同一条规矩：认不出这两个选项就去掉加固选项重试一次。 */
 async function runAddWithReleaseAgeRetry({ profileDir, spec, registry, runAdd, timeoutMs = 180000 }) {
-  const argv = pnpmAddArgs(spec, registry)
   const execOpts = { cwd: profileDir, timeout: timeoutMs, windowsHide: true, maxBuffer: 4 * 1024 * 1024, env: buildPnpmEnv(registry) }
-  const attempt = async (args) => {
+  const once = async (args) => {
     try {
       const out = await runAdd(args, { execOpts })
-      return { ok: true, exitCode: 0, stdout: tail(out?.stdout), stderr: tail(out?.stderr), error: null }
+      return { ok: true, exitCode: 0, stdout: tail(out?.stdout), stderr: tail(out?.stderr), error: null, argv: args }
     } catch (error) {
       return {
         ok: false,
@@ -106,14 +110,21 @@ async function runAddWithReleaseAgeRetry({ profileDir, spec, registry, runAdd, t
         stdout: tail(error?.stdout),
         stderr: tail(error?.stderr ?? error?.message ?? String(error)),
         error: error instanceof Error ? error : new Error(String(error)),
+        argv: args,
       }
     }
   }
-  const first = await attempt(argv)
+  const attempt = async (extra) => {
+    const first = await once([...pnpmAddArgs(spec, registry), ...extra])
+    if (first.ok || !unknownPnpmOption(String(first.error?.message ?? ''))) return first
+    // 加固选项不被该版本 pnpm 认识 → 去掉它们重试一次（绝不让加固变成"跑不成"）
+    return once([...pnpmAddArgs(spec, registry, { fetchFlags: false }), ...extra])
+  }
+  const first = await attempt([])
   // 放宽条件**必须同时**成立：第一次真的失败了，且失败原因确定是供应链闸（文案/错误码认得出）
   const blocked = !first.ok && (isReleaseAgeBlock(first.stderr) || isReleaseAgeBlock(String(first.error?.message ?? '')))
   if (!blocked) return { ...first, relaxedReleaseAge: false }
-  const retried = await attempt([...argv, '--config.minimumReleaseAge=0'])
+  const retried = await attempt(['--config.minimumReleaseAge=0'])
   return { ...retried, relaxedReleaseAge: true }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noob-stupid/dsh-plugin-console",
-  "version": "0.5.21",
+  "version": "0.5.22",
   "description": "DSH 框架升级安全与插件升级门控：一键升级、失败自动回滚、升级后回滚上版、旧插件不适配自动禁用；内置多源插件市场为发现层，插件源全部可自定义，可指向公司内网私有源 / 私有索引 / 本地 Git 仓库，纯内网离线可用 | Framework upgrade safety & plugin version gating for DSH, with a customizable multi-source plugin market: point every source at internal mirrors or a local file:// repo for intranet-only, offline installs.",
   "repository": {
     "type": "git",