@noob-stupid/dsh-plugin-console 0.5.28 → 0.5.30

package/lib/server/routes/framework-preflight.js

@@ -7,17 +7,20 @@
 // 「一发消息就报错、会话整体不可用」。包级适配门（peerDependencies / 版本号）看不见这类
 // 运行期契约破坏，所以必须在**升级前**单独预检、先把本地适配好再装。
 
-import { readFileSync } from 'node:fs'
+import { existsSync, readFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { isFrameworkOwnedPackage } from '../domain/compat.js'
+import { classifyTargetAvailability, frameworkPackageRows, parsePatchRows } from '../domain/patch-composition-audit.js'
+import { collectPresetAudit } from '../domain/preset-audit.js'
 import { loadContractRules, summarizeContractRules } from '../domain/contract-rules.js'
 import { discoverFormatContract, summarizeContract } from '../domain/format-contract.js'
 import { applyFormatPatch, collectProducerTargets, scanProducerFiles } from '../domain/format-scan.js'
 import { currentFrameworkVersion } from '../domain/framework.js'
 import { listEntries } from '../domain/runtime.js'
 import { curlText, fetchJsonUrl } from '../infra/http.js'
+import { checkPublishedVersions, makeVersionProbe } from '../infra/registry-versions.js'
 import { sendError, sendJson } from '../infra/httpd.js'
-import { baseDirOf, dshHome, pluginRoot, profileDirOf, resolvePackageJson } from '../infra/paths.js'
+import { baseDirOf, dshHome, findPatchPath, pluginRoot, profileDirOf, resolvePackageJson } from '../infra/paths.js'
 
 const REGISTRY = 'https://registry.npmmirror.com'
 
@@ -109,6 +112,42 @@ async function routeFrameworkPreflight(req, res, rc) {
   const rules = contract?.rules ?? { producerKindRequired: false, forbiddenKinds: ['plugin'], pluginPrefix: 'plugin:', renames: {} }
   const scan = scanProducerFiles({ targets, rules, targetVersion })
 
+  // 补丁 ↔ 目标版本核对（2026-09-28 加法；真机事故：0.2.0-rc.1 移除了
+  // `@deepseek-ai/dsh-workflow-worker-thread`，补丁三处仍引用 → 升级后 `workflowEngine`
+  // 没有提供方 → `dsh-tool-workflow`/`dsh-tool-ralph` 永久 waiting → 老会话 resume 失败）。
+  // 只核对**随框架版本走**的包（`@deepseek-ai/*`）：目标版本还没装到本机，只有 registry 元数据能提前看见。
+  // 网络不可用/查询失败一律记 `unknown`，**绝不判死**。
+  let patchTarget = { checked: 0, missing: [], unknown: [], skipped: null, patchPath: null }
+  try {
+    const patchPath = findPatchPath(rc.ctx)
+    patchTarget.patchPath = patchPath
+    if (patchPath === null || !existsSync(patchPath)) {
+      patchTarget.skipped = '找不到 profile 补丁文件（cordis.patch.yml）'
+    } else {
+      const rows = parsePatchRows(readFileSync(patchPath, 'utf8'))
+      const fwRows = frameworkPackageRows(rows)
+      if (fwRows.length === 0) patchTarget.skipped = '补丁里没有随框架版本走的包（@deepseek-ai/*）'
+      else if (!networkAllowed()) patchTarget.skipped = '已跳过网络（DSH_TEST_SKIP_NETWORK=1）'
+      else {
+        const probe = makeVersionProbe({ registry: REGISTRY, fetchJson: (url, timeoutMs) => fetchJsonUrl(url, timeoutMs) })
+        const results = await checkPublishedVersions(fwRows, { probe, version: targetVersion })
+        const publishedBy = new Map(results.map((row) => [row.name, row.published]))
+        const classified = classifyTargetAvailability(fwRows, { publishedBy, targetVersion })
+        patchTarget = { ...patchTarget, checked: results.length, missing: classified.missing, unknown: classified.unknown, skipped: null }
+      }
+    }
+  } catch (error) {
+    patchTarget.skipped = '核对失败：' + String(error?.message ?? error)
+  }
+  // 预设声明行体检（2026-09-28 加法）：升级前就能看见"补丁里的声明行已陈旧/缺失"。
+  // 真机事故：预设自身被改成 v10、补丁行还指向 v1 → 老会话 resume 到错的模块，且没有任何地方会报。
+  // 只读、不阻塞：作为 presetAudit 字段随预检一起下发（blockers>0 时由面板提示先修再升）。
+  let presetAudit = null
+  try {
+    presetAudit = collectPresetAudit({ presetsRoot: join(dshHome(), '.agent-presets'), patchPath: findPatchPath(rc.ctx) })
+  } catch (error) {
+    presetAudit = { ok: false, error: String(error?.message ?? error), blockers: 0, stale: [], missing: [], orphan: [], targetMissing: [] }
+  }
   sendJson(res, 200, {
     ok: true,
     targetVersion,
@@ -122,6 +161,8 @@ async function routeFrameworkPreflight(req, res, rc) {
     rules: summarizeContractRules(loadContractRules()),
     roots: roots.map((r) => ({ root: r.root, kind: r.kind, moduleName: r.moduleName ?? null })),
     scan,
+    patchTarget,
+    presetAudit,
   })
 }
 

package/lib/server/routes/index.js

@@ -15,7 +15,9 @@ import { readBody, sendError } from '../infra/httpd.js'
 import { routeAiConsent, routeAiEmpowerCancel, routeAiEmpowerList, routeAiEmpowerPlan, routeAiEmpowerRun, routeAiEmpowerStatus } from './ai.js'
 import { routeRunSuggested } from './actions.js'
 import { routeComponentAutostart, routeComponentStart, routeComponentStatus, routeComponentStop, routeComponents, routeRepoClone, routeRepoLandConfig, routeRepoList, routeRepoOpen, routeRepoRemove } from './components.js'
-import { routeCompatMode, routeCompatStamp, routeCompatStatusGet, routeDeclareInstalled } from './compat.js'
+import { routeCompatAck, routeCompatMode, routeCompatStamp, routeCompatStatusGet, routeDeclareInstalled } from './compat.js'
+import { routePatchAuditGet } from './patch-audit.js'
+import { routePresetAuditGet } from './preset-audit.js'
 import { routeFrameworkUpgrade } from './framework-upgrade.js'
 import { routeFrameworkPreflight, routeFrameworkPreflightPatch } from './framework-preflight.js'
 import { routeCheckUpdate, routeCompatGate, routeFrameworkCheck, routeFrameworkRelaunch, routeFrameworkRollback, routeFrameworkStatusClear, routeFrameworkUpgradeStatusGet, routeRestart } from './framework.js'
@@ -37,6 +39,15 @@ const ROUTES_EARLY = [
   { methods: ['GET'], path: `${ROUTE_PREFIX}/gitee-oauth-callback`, handler: routeGiteeOauthCallbackGet },
   { methods: ['GET'], path: `${ROUTE_PREFIX}/skills-installed`, handler: routeSkillsInstalledGet },  { methods: ['GET'], path: `${ROUTE_PREFIX}/framework-upgrade-status`, handler: routeFrameworkUpgradeStatusGet },
   { methods: ['GET'], path: `${ROUTE_PREFIX}/compat-status`, handler: routeCompatStatusGet },
+  // 只读体检（2026-09-30 改错：这两条**必须**住在守卫之前）。
+  // 原实现把它们登记在守卫之后的 ROUTES 表里 → GET 在守卫处就被 405 掉，永远到不了 handler。
+  // 真机现场（0.5.29 活体实例）：`GET /plugin-console/preset-audit` → 405「不支持的方法」，
+  //   `POST` 同路径 → 404「未知接口」—— 两句都由 handle() 自己发出，说明**查表根本没参与**。
+  // 判据：405 守卫 `if (method !== 'POST' && !(method === 'GET' && GET_COMPAT.has(pathname)))`
+  //   跑在 ROUTES 查表之前，只放行 POST（外加 GET_COMPAT 白名单）→
+  //   **任何声明 GET 的路由都必须登记在 ROUTES_EARLY**。该判据已固化进 tests/test-route-inventory.mjs。
+  { methods: ['GET'], path: `${ROUTE_PREFIX}/patch-audit`, handler: routePatchAuditGet },
+  { methods: ['GET'], path: `${ROUTE_PREFIX}/preset-audit`, handler: routePresetAuditGet },
   { methods: ['POST'], path: `${ROUTE_PREFIX}/framework-relaunch`, handler: routeFrameworkRelaunch },
 
 ]
@@ -98,6 +109,7 @@ const ROUTES = [
   { methods: ['POST'], path: `${ROUTE_PREFIX}/framework-status-clear`, handler: routeFrameworkStatusClear },
   { methods: ['POST'], path: `${ROUTE_PREFIX}/compat-mode`, handler: routeCompatMode },
   { methods: ['POST'], path: `${ROUTE_PREFIX}/compat-stamp`, handler: routeCompatStamp },
+  { methods: ['POST'], path: `${ROUTE_PREFIX}/compat-ack`, handler: routeCompatAck },
   { methods: ['POST'], path: `${ROUTE_PREFIX}/declare-installed`, handler: routeDeclareInstalled },
   { methods: ['POST'], path: `${ROUTE_PREFIX}/framework-rollback`, handler: routeFrameworkRollback },
   { methods: ['POST'], path: `${ROUTE_PREFIX}/restart`, handler: routeRestart },

package/lib/server/routes/patch-audit.js

@@ -0,0 +1,59 @@
+// L2 · routes —— 补丁体检（GET /plugin-console/patch-audit；0.5.30 加法）
+//
+// 真机事故 2026-09-28：框架 0.2.0-rc.1 移除了 `@deepseek-ai/dsh-workflow-worker-thread`（引擎改为 ptc），
+// 而 profile 补丁三处行仍指向旧包 → 该行解析失败 → 隔离组里 `workflowEngine` 没有提供方 →
+// `dsh-tool-workflow` / `dsh-tool-ralph` 永久 waiting → 老会话 resume 失败
+//   （RemoteError: tool-workflow … waiting for workflowEngine）。
+//
+// 本路由把 domain/patch-composition-audit.js 的**纯判据**接到真实环境（真补丁文件 + 真 Node 解析器），
+// 并且**只报告、不代改**：改名建议来自「真机确证表」（KNOWN_RENAMES），猜不到的只列候选 ——
+// 绝不自动改写用户补丁（同 preset-rows.js 的判据文化：宁缺勿滥、不猜）。
+
+import { existsSync, readFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { auditPatchText } from '../domain/patch-composition-audit.js'
+import { frameworkBases } from '../infra/framework-root.js'
+import { sendError, sendJson } from '../infra/httpd.js'
+import { listAvailablePackages, makePackageResolver } from '../infra/package-resolve.js'
+import { baseDirOf, findPatchPath } from '../infra/paths.js'
+
+// 框架运行时根的取法已收敛到 infra/framework-root.js（0.5.30 改错：**同一份判据**必须同时供
+// 只读体检与本文件、以及 domain/patch.js 的自愈使用 —— 各写一份的话，框架下次再挪目录只会有一处被修好；
+// 2026-09-29 真机事故正是"自愈那处没跟上"）。
+
+/** profile 补丁 → 体检报告（只读；不写任何文件）。 */
+async function routePatchAuditGet(req, res, rc) {
+  const ctx = rc.ctx
+  let patchPath = null
+  try { patchPath = findPatchPath(ctx) } catch {}
+  if (patchPath === null || !existsSync(patchPath)) {
+    sendError(res, 404, '找不到 profile 补丁文件（cordis.patch.yml）—— 无法体检')
+    return
+  }
+  const profileDir = dirname(patchPath)
+  let baseDir = null
+  try { baseDir = baseDirOf(rc?.deps?.baseUrl ?? rc?.ctx?.baseUrl ?? 'file:///') } catch { baseDir = null }
+  const fwBases = frameworkBases(baseDir, profileDir)
+  const bases = [profileDir, ...fwBases]
+  const resolve = makePackageResolver(bases)
+  const candidates = listAvailablePackages([join(profileDir, 'node_modules'), ...fwBases])
+  const text = readFileSync(patchPath, 'utf8')
+  const report = auditPatchText(text, {
+    resolve,
+    existsFile: (url) => { try { return existsSync(fileURLToPath(url)) } catch { return false } },
+    candidates,
+  })
+  sendJson(res, 200, {
+    ok: true,
+    patchPath,
+    bases,
+    rows: report.rows,
+    blockerCount: report.blockers.length,
+    warningCount: report.warnings.length,
+    blockers: report.blockers,
+    warnings: report.warnings,
+  })
+}
+
+export { routePatchAuditGet }

package/lib/server/routes/plugins.js

@@ -5,6 +5,8 @@ import { readFileSync, existsSync, readdirSync, statSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { createRequire } from 'node:module'
 import { checkPluginFrameworkCompat, probePluginImport, readCompatPending, rowIdModuleMap, writeCompatPending } from '../domain/compat.js'
+import { cleanFrameworkBackups, cleanFrameworkTopLevel, readRollbackReferenced, reportFrameworkEntities, resolveFrameworkLayout } from '../domain/framework-cleanup.js'
+import { currentFrameworkVersion } from '../domain/framework.js'
 import { pnpmRemove } from '../domain/install-job.js'
 import { curlManualInstall, readExtraBundleOwners } from '../domain/install.js'
 import { disableEntry, enableEntry, readPatchState, removeDisableBlock, removeInsertRow } from '../domain/patch.js'
@@ -17,7 +19,7 @@ import { orderedRegistries, readSources } from '../domain/sources.js'
 import { fetchJsonUrl } from '../infra/http.js'
 import { sendError, sendJson } from '../infra/httpd.js'
 import { removeDirVerifiedAsync } from '../infra/fsx.js'
-import { dshHome, findPatchPath, pluginRoot, resolvePackageJson, rowIdOf } from '../infra/paths.js'
+import { baseDirOf, dshHome, findPatchPath, pluginRoot, resolvePackageJson, rowIdOf } from '../infra/paths.js'
 import { installJobs } from '../state.js'
 
 /** 插件控制台自身的包名（撤销分支禁止删自己；@deepseek-ai/* 由通用护栏拒绝）。 */
@@ -504,7 +506,23 @@ async function routeCleanResiduals(req, res, rc) {
         }
       }
     } catch {}
-    const payload = { ok: failed.length === 0, removed, kept, failed, count: removed.length }
+    // ── scope 扩展（2026-09-28 加法）：framework / frameworkBackups / pnpmEntities ──
+  //    默认（不传 scope）与以前**完全一致**：只清插件侧残留。framework 两档必须显式 confirm:true，
+  //    否则只出报告（dryRun）—— 高风险动作不许"点一下全干"。
+  const scope = Array.isArray(body?.scope) ? body.scope.filter((s) => typeof s === 'string' && s !== '') : ['plugin']
+  const extra = {}
+  if (scope.some((s) => s !== 'plugin')) {
+    const dryRun = body?.confirm !== true
+    let runningVersion = null
+    try { runningVersion = currentFrameworkVersion(ctx) } catch {}
+    const layout = resolveFrameworkLayout({ baseDir: baseDirOf(ctx?.baseUrl ?? 'file:///'), profileDir })
+    if (scope.includes('framework')) extra.framework = await cleanFrameworkTopLevel({ topScopeDir: layout.topScopeDir, dshLinkPath: layout.dshLinkPath, runningVersion, relink: body?.relink !== false, dryRun, stamp: Date.now() })
+    if (scope.includes('frameworkBackups')) extra.frameworkBackups = await cleanFrameworkBackups({ backupsRoot: join(dshHome(), 'plugin-console', 'framework-backups'), referenced: readRollbackReferenced(), keep: Number.isFinite(body?.keep) ? body.keep : 1, dryRun })
+    if (scope.includes('pnpmEntities')) extra.pnpmEntities = reportFrameworkEntities({ pnpmDir: layout.pnpmDir, runningVersion })
+    extra.scope = scope
+    extra.dryRun = dryRun
+  }
+  const payload = { ok: failed.length === 0, removed, kept, failed, count: removed.length, ...extra }
     if (failed.length > 0) {
       const detail = failed.slice(0, 3).map((f) => `${f.name}（${f.error ?? '未知原因'}）`).join('；')
       const keptNote = kept.length > 0 ? `；已在用插件 ${kept.length} 个（保留不删）` : ''

package/lib/server/routes/preset-audit.js

@@ -0,0 +1,24 @@
+// L2 · routes —— 预设声明行体检（GET /plugin-console/preset-audit；0.5.30 加法）
+//
+// 真机背景：框架 0.1.7-rc.1 起预设靠 profile 补丁里的**声明行**发现；预设目录自身后来被改成 v10，
+// 而补丁里的行还指向 v1 → 老会话 resume 到错的模块（而且没有任何地方会报）。本路由**只读**出报告：
+// 陈旧（stale）/ 缺失（missing）/ 悬空（orphan）/ 目标不存在（targetMissing）。
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+import { collectPresetAudit } from '../domain/preset-audit.js'
+import { sendError, sendJson } from '../infra/httpd.js'
+import { dshHome, findPatchPath } from '../infra/paths.js'
+
+async function routePresetAuditGet(req, res, rc) {
+  let patchPath = null
+  try { patchPath = findPatchPath(rc.ctx) } catch {}
+  if (patchPath === null || !existsSync(patchPath)) {
+    sendError(res, 404, '找不到 profile 补丁文件（cordis.patch.yml）—— 无法体检')
+    return
+  }
+  const presetsRoot = join(dshHome(), '.agent-presets')
+  const report = collectPresetAudit({ presetsRoot, patchPath })
+  sendJson(res, 200, { ok: true, patchPath, presetsRoot, ...report })
+}
+
+export { routePresetAuditGet }

package/lib/server/routes/state.js

@@ -28,7 +28,9 @@ async function routeStateGet(req, res, rc) {
   const readExtraBundleRows = rc.deps.readExtraBundleRows
     const patchPath = findPatchPath(ctx)
     const patch = await readPatchState(patchPath)
-    // 补丁安全自愈（核心行误禁用恢复 / 缺失模块行自动禁用）——每 2 分钟最多跑一次
+    // 补丁安全自愈（核心行误禁用恢复 / **确证**缺失模块行自动禁用）——每 2 分钟最多跑一次。
+    // 2026-09-30 改错：① 无真正需要修复的内容时零写盘（避免每 2 分钟无谓重写用户补丁）；
+    //   ② 写盘失败 / 解析不确定 / 框架自带包 → 如实回报（skipped / uncertain / writeError），不静默。
     let patchHeal = null
     try {
       if (patchHealAt === null || Date.now() - patchHealAt > 120000) {
@@ -38,7 +40,11 @@ async function routeStateGet(req, res, rc) {
         patchHeal = patchHealReport
       }
       if (patchHeal !== null) setPatchHealReport(patchHeal)
-    } catch {}
+    } catch (error) {
+      // 自愈本身抛异常也要如实进 patchHeal（过去这里 catch {} 静默吞掉，面板看不出任何异常）
+      patchHeal = { healed: [], autoDisabled: [], skipped: [], uncertain: [], healedAt: 0, written: false, writeError: String(error?.message ?? error) }
+      setPatchHealReport(patchHeal)
+    }
     const extraRows = await readExtraBundleRows(dirname(patchPath))
     const compatPending = readCompatPending()
     const compatPendingRows = new Set((compatPending?.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => p.rowId))
@@ -91,7 +97,7 @@ async function routeStateGet(req, res, rc) {
       const selfPkg = JSON.parse(readFileSync(join(pluginRoot(), 'package.json'), 'utf8'))
       selfVersion = typeof selfPkg.version === 'string' ? selfPkg.version : null
     } catch {}
-    sendJson(res, 200, { ok: true, entries, patchPath, compat, installJobs: jobs, recentFailures, pendingRestart, github: { loggedIn: auth.loggedIn, login: auth.login }, patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts }, framework, patchHeal: patchHeal === null ? null : { healed: patchHeal.healed ?? [], autoDisabled: patchHeal.autoDisabled ?? [], healedAt: patchHeal.healedAt ?? 0 }, gating: gatingSummary(ctx, compatPending, entries), compatPending: compatPending === null ? null : { frameworkVersion: compatPending.frameworkVersion ?? null, upgradeFrom: compatPending.upgradeFrom ?? null, pending: (compatPending.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => ({ rowId: p.rowId, moduleName: p.moduleName, version: p.version ?? null, checkNote: p.checkNote ?? null, check: p.check ?? null, riskyApprovedAt: p.riskyApprovedAt ?? null, adoptable: adoptable.get(p.rowId) ?? null })) }, compatGate, rollback: rollbackRec, selfVersion, components: findComponents().map((c) => ({ id: c.id, name: c.name, kind: c.kind ?? 'server', pid: c.pid ?? null, port: c.port ?? null, healthUrl: c.healthUrl ?? null, uiUrl: compUiUrl(c), autoStart: c.autoStart === true })) })
+    sendJson(res, 200, { ok: true, entries, patchPath, compat, installJobs: jobs, recentFailures, pendingRestart, github: { loggedIn: auth.loggedIn, login: auth.login }, patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts }, framework, patchHeal: patchHeal === null ? null : { healed: patchHeal.healed ?? [], autoDisabled: patchHeal.autoDisabled ?? [], healedAt: patchHeal.healedAt ?? 0, written: patchHeal.written === true, writeError: patchHeal.writeError ?? null, skippedFrameworkOwned: (patchHeal.skipped ?? []).map((s) => s.id ?? null), uncertain: (patchHeal.uncertain ?? []).map((u) => u.id ?? null) }, gating: gatingSummary(ctx, compatPending, entries), compatPending: compatPending === null ? null : { frameworkVersion: compatPending.frameworkVersion ?? null, upgradeFrom: compatPending.upgradeFrom ?? null, pending: (compatPending.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => ({ rowId: p.rowId, moduleName: p.moduleName, version: p.version ?? null, checkNote: p.checkNote ?? null, check: p.check ?? null, riskyApprovedAt: p.riskyApprovedAt ?? null, adoptable: adoptable.get(p.rowId) ?? null })) }, compatGate, rollback: rollbackRec, selfVersion, components: findComponents().map((c) => ({ id: c.id, name: c.name, kind: c.kind ?? 'server', pid: c.pid ?? null, port: c.port ?? null, healthUrl: c.healthUrl ?? null, uiUrl: compUiUrl(c), autoStart: c.autoStart === true })) })
     return
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noob-stupid/dsh-plugin-console",
-  "version": "0.5.28",
+  "version": "0.5.30",
   "description": "DSH 框架升级安全与插件升级门控：一键升级、失败自动回滚、升级后回滚上版、旧插件不适配自动禁用；内置多源插件市场为发现层，插件源全部可自定义，可指向公司内网私有源 / 私有索引 / 本地 Git 仓库，纯内网离线可用 | Framework upgrade safety & plugin version gating for DSH, with a customizable multi-source plugin market: point every source at internal mirrors or a local file:// repo for intranet-only, offline installs.",
   "repository": {
     "type": "git",