@pandablessing/dsh-user-sync 1.0.2 → 1.0.4

package/lib/index.js

@@ -1,5 +1,5 @@
+import { spawn } from 'node:child_process';
 import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync } from 'node:fs';
-import { execFileSync } from 'node:child_process';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -16,6 +16,8 @@ import { createFolderTransport } from './transport/folder.js';
 export const name = 'dsh-user-sync';
 /** 不硬依赖任何服务：依赖缺失时降级，不把条目停在 pending。 */
 export const inject = [];
+/** 内置服务地址（运营方 API）。用户可在 state.baseUrl 覆盖；这里必须是可用的正式地址。 */
+export const DEFAULT_BASE_URL = 'https://dsh-user-sync-test.wenzhi.info';
 /** 非用户级模块：默认不选，首次勾选要提示一次。 */
 const NON_USER_LEVEL = ['projectMemory', 'sessions'];
 /**
@@ -23,6 +25,27 @@ const NON_USER_LEVEL = ['projectMemory', 'sessions'];
  * 日志落在 $DSH_HOME/user-sync/plugin-error.log（与状态文件同目录）。
  * base 可显式传入，测试用它隔离到临时目录，避免污染真实日志。
  */
+/** 异步执行外部命令：绝不阻塞宿主事件循环（Electron 主进程卡死会拖垮整个界面）。 */
+function runCommand(file, args, options) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(file, args, { cwd: options.cwd, stdio: 'ignore' });
+        const timer = setTimeout(() => {
+            child.kill();
+            reject(new Error(`命令超时（${options.timeout} ms）: ${file}`));
+        }, options.timeout);
+        child.on('error', (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+        child.on('close', (code) => {
+            clearTimeout(timer);
+            if (code === 0)
+                resolve();
+            else
+                reject(new Error(`命令退出码 ${code}: ${file}`));
+        });
+    });
+}
 /** 找 DSH 运行时自带的 node 可执行文件（Electron 的 process.execPath 不能用）。 */
 function findRuntimeNode() {
     const root = join(homedir(), '.dsh', 'dsh-runtimes');
@@ -87,18 +110,24 @@ export function apply(ctx) {
         const authPath = join(paths.dshHome, 'user-sync', 'auth.json');
         const folderDir = join(paths.dshHome, 'user-sync', 'remote');
         /**
-         * 传输选择：配了服务地址就用运营方 API，否则回退本地目录（无服务端调试）。
+         * 内置服务地址：用户未在 state 里覆盖时用它。
+         * 没有它，全新安装的机器会静默落到本地目录，既不配对也不连服务端（面板已不提供地址输入）。
+         */
+        const effectiveBaseUrl = () => {
+            const state = loadState(statePath);
+            const configured = typeof state.baseUrl === 'string' ? state.baseUrl.trim() : '';
+            return configured || DEFAULT_BASE_URL;
+        };
+        /**
+         * 传输选择：默认走运营方 API（内置地址），地址非法或用户显式清空时才回退本地目录。
          * 面板已隐藏「传输方式」，不再读 state.transport——避免历史设置把正式环境切成 folder。
          */
         const buildTransport = () => {
-            const state = loadState(statePath);
-            if (state.baseUrl) {
-                try {
-                    return createApiTransport({ baseUrl: state.baseUrl, authPath });
-                }
-                catch (error) {
-                    log('transport-api', error);
-                }
+            try {
+                return createApiTransport({ baseUrl: effectiveBaseUrl(), authPath });
+            }
+            catch (error) {
+                log('transport-api', error);
             }
             return createFolderTransport({ dir: folderDir });
         };
@@ -213,8 +242,10 @@ export function apply(ctx) {
                             resolvedBy: paths.resolvedBy,
                             probe,
                             transport: sync.getTransportId(),
-                            transportSetting: state.transport ?? 'folder',
-                            baseUrl: state.baseUrl ?? null,
+                            // 实际生效的传输方式（transport 已按内置地址解析，不再由 state.transport 决定）
+                            transportSetting: sync.getTransportId(),
+                            baseUrl: effectiveBaseUrl(),
+                            baseUrlSource: typeof state.baseUrl === 'string' && state.baseUrl.trim() ? 'user' : 'default',
                             account: { hint: state.accountKeyHint ?? null, paired: Boolean(state.pairedAt) },
                             deviceId: state.deviceId ?? null,
                             lastApplied: state.lastApplied ?? null,
@@ -284,8 +315,9 @@ export function apply(ctx) {
                             modules: sync.getModules(),
                             autoCheck: settings.autoCheck,
                             intervalHours: settings.intervalHours,
-                            transport: state.transport ?? 'folder',
-                            baseUrl: state.baseUrl ?? null,
+                            transport: sync.getTransportId(),
+                            baseUrl: effectiveBaseUrl(),
+                            baseUrlSource: typeof state.baseUrl === 'string' && state.baseUrl.trim() ? 'user' : 'default',
                         });
                     }
                     const body = (await request.json());
@@ -333,8 +365,8 @@ export function apply(ctx) {
                         modules: Array.isArray(state.modules) ? state.modules : sync.getModules(),
                         autoCheck: state.autoCheck ?? true,
                         intervalHours: state.intervalHours ?? 6,
-                        transport: state.transport ?? 'folder',
-                        baseUrl: state.baseUrl ?? null,
+                        transport: sync.getTransportId(),
+                        baseUrl: effectiveBaseUrl(),
                         transportNow: sync.getTransportId(),
                     });
                 },
@@ -360,12 +392,21 @@ export function apply(ctx) {
                 path: '/api/dsh-user-sync/upload',
                 methods: ['POST'],
                 requestBody: 'buffered',
-                fetch: async () => {
+                fetch: async (request) => {
                     const state = loadState(statePath);
                     if (!state.consent?.acceptedAt) {
                         return json({ ok: false, code: 'E_CONSENT_REQUIRED', detail: '请先同意隐私说明再上传' }, 403);
                     }
-                    return json(await sync.upload());
+                    // force=true：用户已看到「远端有更新」并确认用本机覆盖远端（G2）
+                    let force = false;
+                    try {
+                        const body = (await request.json());
+                        force = body?.force === true;
+                    }
+                    catch {
+                        // 无 body（面板首次点击）时按未确认处理
+                    }
+                    return json(await sync.upload({ force }));
                 },
             },
             {
@@ -416,10 +457,10 @@ export function apply(ctx) {
                             const pnpmCjs = runtime ? join(dirname(runtime), '..', '..', 'pnpm', 'bin', 'pnpm.cjs') : '';
                             if (!runtime || !existsSync(pnpmCjs))
                                 throw new Error('runtime node/pnpm not found');
-                            execFileSync(runtime, [pnpmCjs, 'install', '--force'], {
+                            // 异步执行：pnpm 装插件可能要几十秒，同步调用会卡住宿主主线程
+                            await runCommand(runtime, [pnpmCjs, 'install', '--force'], {
                                 cwd: paths.profileDir,
-                                stdio: 'ignore',
-                                timeout: 300000,
+                                timeout: 300_000,
                             });
                             for (const item of missingDirs) {
                                 const ok = existsSync(join(paths.profileDir, 'node_modules', item.name));
@@ -546,13 +587,12 @@ export function apply(ctx) {
                         const state = loadState(statePath);
                         state.accountKeyHint = accountKey.slice(0, 6);
                         saveState(statePath, state);
-                        if (state.transport === 'api' && state.baseUrl) {
-                            const api = createApiTransport({ baseUrl: state.baseUrl, authPath });
-                            await api.register(accountKey);
-                            const next = loadState(statePath);
-                            next.pairedAt = new Date().toISOString();
-                            saveState(statePath, next);
-                        }
+                        // 传输固定走运营方 API（内置地址或用户覆盖），未登录/离线时只记日志、不阻塞启动
+                        const api = createApiTransport({ baseUrl: effectiveBaseUrl(), authPath });
+                        await api.register(accountKey);
+                        const next = loadState(statePath);
+                        next.pairedAt = new Date().toISOString();
+                        saveState(statePath, next);
                     }
                     catch (error) {
                         log('pair', error);

package/lib/sync.js

@@ -1,3 +1,4 @@
+import { randomUUID } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { buildManifest, buildTarGz, MANIFEST_PATH, normalizeManifest, parseTarGz } from './archive.js';
@@ -21,8 +22,17 @@ export function createSync({ dshHome, userHome, profileName = 'desktop', transpo
         state: statePath ?? join(dshHome, 'user-sync', 'state.json'),
         history: historyPath ?? join(dshHome, 'user-sync', 'history.jsonl'),
         lock: lockPath ?? join(dshHome, 'user-sync', 'lock'),
-        preRestore: preRestoreRoot ?? join(dshHome, 'user-sync', `pre-restore-${Date.now()}`),
+        preRestoreBase: preRestoreRoot ?? join(dshHome, 'user-sync'),
     };
+    /**
+     * 每次应用都生成独立快照目录：同进程内多次恢复不会互相覆盖快照（§7.5）。
+     * 显式传入 preRestoreRoot 时它作为基目录，快照仍落在其下的时间戳子目录。
+     */
+    function nextPreRestoreRoot() {
+        // 精确到毫秒 + 随机后缀：同一秒内连续两次应用也不会撞目录
+        const stamp = `${new Date().toISOString().replace(/[:.]/g, '-')}-${randomUUID().slice(0, 6)}`;
+        return join(paths.preRestoreBase, `pre-restore-${stamp}`);
+    }
     /** 包内路径 → 绝对路径：skills/ 落到 userHome，其余落到 dshHome。 */
     const resolveTarget = (rel) => {
         if (rel.startsWith('skills/'))
@@ -110,13 +120,67 @@ export function createSync({ dshHome, userHome, profileName = 'desktop', transpo
         }
         return { ok: true, buffer: buildTarGz(tarEntries), manifest };
     }
-    /** 上传当前本地包；上传前必须由调用方完成覆盖确认。 */
-    async function upload() {
+    /**
+     * 只读远端最新包（list + meta），失败时返回 null。
+     * 用于上传前判断「远端是否已被别的设备更新」，离线时不影响上传。
+     */
+    async function latestRemote() {
+        let remoteList;
+        try {
+            remoteList = await activeTransport.list();
+        }
+        catch {
+            return null;
+        }
+        if (remoteList.length === 0)
+            return null;
+        const latest = [...remoteList].sort((a, b) => (Date.parse(b.modifiedAt) || 0) - (Date.parse(a.modifiedAt) || 0))[0];
+        let packageId = null;
+        let createdAt = latest.modifiedAt;
+        try {
+            const meta = await activeTransport.meta(latest.name);
+            if (meta?.packageId)
+                packageId = String(meta.packageId);
+            if (meta?.createdAt)
+                createdAt = String(meta.createdAt);
+        }
+        catch {
+            // 元数据不可读时退回列表时间；不阻塞上传
+        }
+        return { name: latest.name, packageId, createdAt };
+    }
+    /**
+     * 上传当前本地包。上传前先只读检查远端：
+     * 远端是另一份更新的包时返回 `E_REMOTE_NEWER`，由用户确认后带 `force` 重试（G2）。
+     */
+    async function upload({ force = false } = {}) {
         const lock = acquireLock({ lockPath: paths.lock });
         if (!lock.acquired)
             return { ok: false, code: 'E_LOCKED', holder: lock.holder };
         const started = Date.now();
         try {
+            if (!force) {
+                const state = loadState(paths.state);
+                const lastUploaded = state.lastUploaded;
+                const lastApplied = state.lastApplied;
+                const remote = await latestRemote();
+                // 远端就是本机上次上传/应用的包：不算「别人更新」，直接覆盖自己
+                const isMine = remote?.packageId
+                    ? remote.packageId === lastUploaded?.packageId || remote.packageId === lastApplied?.packageId
+                    : false;
+                if (remote && !isMine) {
+                    const remoteTime = Date.parse(remote.createdAt) || 0;
+                    const localTime = Math.max(Date.parse(lastUploaded?.createdAt ?? '') || 0, Date.parse(lastApplied?.createdAt ?? '') || 0);
+                    if (remoteTime > localTime) {
+                        return {
+                            ok: false,
+                            code: 'E_REMOTE_NEWER',
+                            detail: `远端有更新的包（${remote.name}，${remote.createdAt}），确认后再用本机覆盖`,
+                            remote: { name: remote.name, createdAt: remote.createdAt },
+                        };
+                    }
+                }
+            }
             const packed = pack();
             if (!packed.ok)
                 return packed;
@@ -151,7 +215,8 @@ export function createSync({ dshHome, userHome, profileName = 'desktop', transpo
     /** 只读远端元数据，返回判定结果；不下载、不写盘。 */
     async function check() {
         const remoteList = await activeTransport.list();
-        const latest = remoteList[0] ?? null;
+        // 服务端按账号只留 1 份，但历史遗留多份时按时间取最新，不能依赖列表顺序
+        const latest = [...remoteList].sort((a, b) => (Date.parse(b.modifiedAt) || 0) - (Date.parse(a.modifiedAt) || 0))[0] ?? null;
         const meta = latest ? await activeTransport.meta(latest.name) : null;
         const state = loadState(paths.state);
         const { map: localFiles } = currentFiles();
@@ -210,7 +275,7 @@ export function createSync({ dshHome, userHome, profileName = 'desktop', transpo
             }
             const { map: localFiles } = currentFiles();
             const plan = planApply({ manifestFiles: manifest.files, localFiles });
-            const applied = applyEntries({ entries, resolveTarget, preRestoreRoot: paths.preRestore });
+            const applied = applyEntries({ entries, resolveTarget, preRestoreRoot: nextPreRestoreRoot() });
             // PLUG-06：包内 cordis.patch.yml 引用的环境变量在本机缺失时提示（「插件装了但用不了」）
             const missingEnv = [];
             for (const entry of entries) {

package/lib/transport/api.js

@@ -85,6 +85,17 @@ export function createApiTransport({ baseUrl, authPath, token: initialToken, fet
         const text = await response.text();
         return text ? JSON.parse(text) : null;
     };
+    /**
+     * 用同一 accountKey 取回同一个 token（不签发新 token）。
+     * 抽成独立函数：register 里改走 login 时不依赖 `this`，解构调用也不会炸。
+     */
+    async function loginWith(accountKey) {
+        const response = await request('POST', '/v1/auth/login', { body: JSON.stringify({ accountKey }) });
+        const data = await parseJson(response);
+        const token = String(data?.token ?? '');
+        persistAuth({ token, accountKeyHint: accountKey.slice(0, 6), registeredAt: new Date().toISOString() });
+        return { ok: true, token };
+    }
     return {
         id: 'api',
         baseUrl,
@@ -102,17 +113,11 @@ export function createApiTransport({ baseUrl, authPath, token: initialToken, fet
             }
             catch (error) {
                 if (error.code === 'E_HTTP_409')
-                    return this.login(accountKey);
+                    return loginWith(accountKey);
                 throw error;
             }
         },
-        async login(accountKey) {
-            const response = await request('POST', '/v1/auth/login', { body: JSON.stringify({ accountKey }) });
-            const data = await parseJson(response);
-            const token = String(data?.token ?? '');
-            persistAuth({ token, accountKeyHint: accountKey.slice(0, 6), registeredAt: new Date().toISOString() });
-            return { ok: true, token };
-        },
+        login: loginWith,
         async reset() {
             await request('POST', '/v1/auth/reset');
             clearAuth();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pandablessing/dsh-user-sync",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "DeepSeek Harness 用户级配置同步插件",
   "type": "module",
   "main": "lib/index.js",
@@ -31,6 +31,11 @@
       "platform": "web"
     }
   },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "build:server": "tsc -p server/tsconfig.json",
+    "test": "node --test test/*.test.js"
+  },
   "license": "MulanPSL-2.0",
   "keywords": [
     "dsh",
@@ -54,10 +59,5 @@
   },
   "publishConfig": {
     "access": "public"
-  },
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "build:server": "tsc -p server/tsconfig.json",
-    "test": "node --test test/*.test.js"
   }
-}
+}