@pandablessing/dsh-user-sync 1.0.6 → 1.0.8

package/README.md

@@ -87,6 +87,8 @@ powershell -File scripts/smoke.ps1  # 真实 DSH 路由冒烟
 
 ## 发布
 
+> **发布时机由维护者决定**：`scripts/publish.mjs` 只在手动执行时发布，agent 不自动发布（改版本、构建、dry-run 可以提前做，发布等确认）。
+
 token 只放本地文件，绝不进仓库（`.env.local` 已在 `.gitignore`）：
 
 ```bash
@@ -99,6 +101,12 @@ node scripts/publish.mjs --otp=123456                      # 账号开 2FA 时
 - CI 用 secret 注入 `NPM_TOKEN` 环境变量即可，优先级高于 `.env.local`。
 - 发布前记得先 `pnpm run build && pnpm run build:server`，产物与源码不一致时 tarball 里会是旧代码。
 
+## 开发与真实环境
+
+- **日常开发（junction）**：`scripts/install-dev.ps1` 把仓库 link 进 profile，改源码 → `pnpm run build` → 热重载即生效；调试最快。
+- **真实安装（npm 包）**：`node scripts/verify-npm-install.mjs` 在临时 profile 里 `pnpm add` 当前发布版本，校验 patch name、宿主/client 两个入口、locale 与 patch 资源，用完自动删目录，不影响开发 profile。
+- 为什么分开：npm 安装的是 `lib/*.js` 编译产物副本，改仓库源码不会生效；所以开发用 link，验证真实安装路径用临时 profile。
+
 ## 仓库结构
 
 ```text

package/lib/client.js

@@ -178,7 +178,7 @@ if (typeof window !== 'undefined' && window.__ModuleLoader__) {
                                 ? R.createElement('p', { style: styles.muted }, `本地包需手动放回：${linkDeps.map((item) => item.name).join('、')}`)
                                 : null, R.createElement('div', { style: styles.actions }, missing.length > 0
                                 ? R.createElement('button', { style: styles.primary, onClick: () => onInstallPlugins(missing) }, '先安装缺失插件')
-                                : null, R.createElement('button', { style: styles.primary, onClick: () => onApply(data.latest?.name ?? '') }, '用远端覆盖本机'), R.createElement('button', { style: styles.secondary, onClick: () => onDismiss() }, '取消')));
+                                : null, R.createElement('button', { style: styles.secondary, onClick: () => onDismiss() }, '取消')), R.createElement('p', { style: styles.muted }, '覆盖动作会在弹窗中确认。'));
                         }
                         return R.createElement('div', { style: styles.card }, R.createElement('strong', null, decision.action === 'skip' ? '本机已是最新' : '本机有改动'), R.createElement('p', { style: styles.muted }, `判定：${decision.reason ?? decision.action}`));
                     }
@@ -187,10 +187,8 @@ if (typeof window !== 'undefined' && window.__ModuleLoader__) {
                         return R.createElement('div', { style: styles.card }, R.createElement('strong', { style: styles.error }, remoteNewer ? '远端有更新的包' : '操作失败'), R.createElement('p', { style: styles.muted }, data.detail ?? data.error ?? '未知错误'), data.hits
                             ? R.createElement('p', { style: styles.error }, `敏感扫描命中 ${data.hits.length} 处：${data.hits.map((h) => `${h.file}:${h.line}（${h.pattern}）`).join('；')}`)
                             : null, 
-                        // 上传前发现远端更新：默认不覆盖，用户确认后才用本机覆盖远端（G2）
-                        remoteNewer
-                            ? R.createElement('div', { style: styles.actions }, R.createElement('button', { style: styles.primary, onClick: () => onForceUpload() }, '用本机覆盖远端'), R.createElement('button', { style: styles.secondary, onClick: () => onDismiss() }, '取消'))
-                            : null);
+                        // 覆盖确认已改为弹窗；卡片只提示
+                        remoteNewer ? R.createElement('p', { style: styles.muted }, '覆盖动作会在弹窗中确认。') : null);
                     }
                     // 同步后自动安装的结果：优先展示「装了哪些插件 / 哪些失败 / 哪些需手动放回」
                     const pluginSummary = (() => {
@@ -225,6 +223,8 @@ if (typeof window !== 'undefined' && window.__ModuleLoader__) {
                     const [notice, setNotice] = R.useState(null);
                     // 非用户级模块确认走弹窗（dialog），不再用底部结果卡
                     const [confirmDialog, setConfirmDialog] = R.useState(null);
+                    // 覆盖确认弹窗：上传发现远端更新 / 从远端同步发现远端更新时弹出（不再用结果卡按钮）
+                    const [overwriteDialog, setOverwriteDialog] = R.useState(null);
                     // 当前展开文件清单的模块（null 表示都收起）
                     const [expandedModule, setExpandedModule] = R.useState(null);
                     // 设置改动后自动保存（600ms 防抖），不再提供「保存设置」按钮
@@ -389,7 +389,19 @@ if (typeof window !== 'undefined' && window.__ModuleLoader__) {
                                 headers: { 'content-type': 'application/json' },
                                 body: JSON.stringify({ force }),
                             });
-                            setNotice({ kind: result.ok ? 'result' : 'error', data: result });
+                            if (result.ok) {
+                                setNotice({ kind: 'result', data: result });
+                                refresh();
+                            }
+                            else if (result.code === 'E_REMOTE_NEWER') {
+                                setOverwriteDialog({
+                                    kind: 'upload',
+                                    detail: `远端已有更新的包 ${result.latest?.name ?? ''}；继续会用本机配置覆盖它。`,
+                                });
+                            }
+                            else {
+                                setNotice({ kind: 'error', data: result });
+                            }
                             refresh();
                         }
                         catch (error) {
@@ -427,7 +439,22 @@ if (typeof window !== 'undefined' && window.__ModuleLoader__) {
                         setNotice(null);
                         try {
                             const result = await fetchJson(`${API}/check`);
-                            setNotice(result.error ? { kind: 'error', data: result } : { kind: 'check', data: result });
+                            if (result.error) {
+                                setNotice({ kind: 'error', data: result });
+                            }
+                            else {
+                                // 详情仍用结果卡展示；覆盖动作改为弹窗确认
+                                setNotice({ kind: 'check', data: result });
+                                const action = result.decision?.action;
+                                if ((action === 'pull' || action === 'confirm') && result.latest?.name) {
+                                    const overwritten = (result.plan?.overwritten ?? []).length;
+                                    setOverwriteDialog({
+                                        kind: 'pull',
+                                        name: result.latest.name,
+                                        detail: `远端包 ${result.latest.name}（${result.meta?.createdAt ?? '时间未知'}），将覆盖本机 ${overwritten} 个文件。`,
+                                    });
+                                }
+                            }
                         }
                         catch (error) {
                             setNotice({ kind: 'error', data: { detail: String(error) } });
@@ -532,6 +559,20 @@ if (typeof window !== 'undefined' && window.__ModuleLoader__) {
                         onForceUpload: () => upload(true),
                     }), confirmDialog
                         ? R.createElement('div', { style: styles.overlay, onClick: () => setConfirmDialog(null) }, R.createElement('div', { style: styles.dialog, onClick: (event) => event.stopPropagation?.() }, R.createElement('strong', null, '同步项目/会话内容？'), R.createElement('p', { style: styles.muted }, `${confirmDialog.warning.map((id) => MODULE_LABELS[id] ?? id).join('、')} 属于项目/会话级，可能包含具体工作内容。确认要跨机器同步吗？`), R.createElement('div', { style: styles.actions }, R.createElement('button', { style: styles.primary, onClick: () => confirmModules(confirmDialog.modules) }, '仍要同步'), R.createElement('button', { style: styles.secondary, onClick: () => setConfirmDialog(null) }, '取消'))))
+                        : null, overwriteDialog
+                        ? R.createElement('div', { style: styles.overlay, onClick: () => setOverwriteDialog(null) }, R.createElement('div', { style: styles.dialog, onClick: (event) => event.stopPropagation?.() }, R.createElement('strong', null, overwriteDialog.kind === 'upload' ? '用本机覆盖远端？' : '用远端覆盖本机？'), R.createElement('p', { style: styles.muted }, overwriteDialog.detail), R.createElement('p', { style: styles.muted }, overwriteDialog.kind === 'upload'
+                            ? '远端已有的包会被本机内容替换（远端只保留 1 份）。'
+                            : '本机会先做快照，再用远端包覆盖同步范围内的文件。'), R.createElement('div', { style: styles.actions }, R.createElement('button', {
+                            style: styles.primary,
+                            onClick: () => {
+                                const target = overwriteDialog;
+                                setOverwriteDialog(null);
+                                if (target.kind === 'upload')
+                                    void upload(true);
+                                else if (target.name)
+                                    void applyRemote(target.name);
+                            },
+                        }, overwriteDialog.kind === 'upload' ? '用本机覆盖远端' : '用远端覆盖本机'), R.createElement('button', { style: styles.secondary, onClick: () => setOverwriteDialog(null) }, '取消'))))
                         : null);
                 }
                 function apply(ctx) {

package/lib/index.js

@@ -1,5 +1,5 @@
 import { spawn } from 'node:child_process';
-import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { appendFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, symlinkSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -28,7 +28,13 @@ const NON_USER_LEVEL = ['projectMemory', 'sessions'];
 /** 异步执行外部命令：绝不阻塞宿主事件循环（Electron 主进程卡死会拖垮整个界面）。 */
 function runCommand(file, args, options) {
     return new Promise((resolve, reject) => {
-        const child = spawn(file, args, { cwd: options.cwd, stdio: 'ignore' });
+        // 保留 stderr：安装失败时把它写进 plugin-error.log，便于定位（此前只有退出码）
+        const child = spawn(file, args, { cwd: options.cwd, stdio: ['ignore', 'pipe', 'pipe'] });
+        let stderr = '';
+        child.stderr?.on('data', (chunk) => {
+            if (stderr.length < 4000)
+                stderr += chunk.toString('utf8');
+        });
         const timer = setTimeout(() => {
             child.kill();
             reject(new Error(`命令超时（${options.timeout} ms）: ${file}`));
@@ -42,7 +48,7 @@ function runCommand(file, args, options) {
             if (code === 0)
                 resolve();
             else
-                reject(new Error(`命令退出码 ${code}: ${file}`));
+                reject(new Error(`命令退出码 ${code}: ${file} ${args.join(' ')}\n${stderr.slice(-800)}`));
         });
     });
 }
@@ -211,8 +217,10 @@ export function apply(ctx) {
         };
         /**
          * 按 profile 的 package.json 安装依赖。
-         * `link:` / `file:` 指向不存在的本地路径时，pnpm install 会整体失败（连带普通包也装不上），
-         * 因此安装期间临时把这些坏 link 从 package.json 摘掉，装完原样恢复。
+         * 两类依赖会让 pnpm install 整体失败（连带普通包都装不上）：
+         * - `link:` / `file:` 指向不存在的本地路径
+         * - `node_modules` 里是 junction/符号链接（开发期 link 装的插件，pnpm 重装会 EPERM）
+         * 因此安装期间临时把这些依赖从 package.json 摘掉，装完原样恢复，并重建被 pnpm 移走的链接。
          */
         const installProfileDependencies = async () => {
             const rt = pnpmRuntime();
@@ -222,6 +230,7 @@ export function apply(ctx) {
             const workspacePath = join(paths.profileDir, 'pnpm-workspace.yaml');
             const raw = readFileSync(pkgPath, 'utf8');
             const removedLinks = [];
+            const linkTargets = new Map();
             let workspaceRaw = null;
             const missingPatchLines = [];
             try {
@@ -236,25 +245,44 @@ export function apply(ctx) {
                             missingPatchLines.push(line);
                     }
                     if (missingPatchLines.length > 0) {
-                        const patched = workspaceRaw
-                            .split('\n')
-                            .filter((line) => !missingPatchLines.includes(line))
-                            .join('\n');
-                        writeFileSync(workspacePath, patched, 'utf8');
+                        const kept = workspaceRaw.split('\n').filter((line) => !missingPatchLines.includes(line));
+                        // 段内条目全删光时，连 `patchedDependencies:` 键一起删：pnpm 不接受 null
+                        const keyIndex = kept.findIndex((line) => line.trim() === 'patchedDependencies:');
+                        if (keyIndex >= 0) {
+                            const next = kept[keyIndex + 1];
+                            if (next === undefined || !/^\s{2}\S/.test(next))
+                                kept.splice(keyIndex, 1);
+                        }
+                        writeFileSync(workspacePath, kept.join('\n'), 'utf8');
                     }
                 }
                 catch {
                     workspaceRaw = null;
                 }
-                const brokenLinks = Object.entries(dependencies).filter(([, spec]) => {
-                    if (!spec.startsWith('link:') && !spec.startsWith('file:'))
-                        return false;
-                    const target = join(paths.profileDir, spec.slice(5));
-                    return !existsSync(target);
+                // 需要临时摘除的依赖：坏 link / 文件依赖 + 已经是 junction 的已装包
+                const detached = Object.entries(dependencies).filter(([name, spec]) => {
+                    if (spec.startsWith('link:') || spec.startsWith('file:')) {
+                        const target = join(paths.profileDir, spec.slice(5));
+                        if (!existsSync(target))
+                            return true;
+                        linkTargets.set(name, target);
+                        return true;
+                    }
+                    const abs = join(paths.profileDir, 'node_modules', name);
+                    try {
+                        if (lstatSync(abs).isSymbolicLink()) {
+                            linkTargets.set(name, realpathSync(abs));
+                            return true;
+                        }
+                    }
+                    catch {
+                        // 没装或读不到：交给 pnpm 正常安装
+                    }
+                    return false;
                 });
-                if (brokenLinks.length > 0) {
+                if (detached.length > 0) {
                     const patched = { ...pkg, dependencies: { ...dependencies } };
-                    for (const [name] of brokenLinks) {
+                    for (const [name] of detached) {
                         delete patched.dependencies[name];
                         removedLinks.push(name);
                     }
@@ -265,8 +293,21 @@ export function apply(ctx) {
             finally {
                 if (removedLinks.length > 0)
                     writeFileSync(pkgPath, raw, 'utf8');
-                if (workspaceRaw !== null && missingPatchLines?.length > 0)
-                    writeFileSync(join(paths.profileDir, 'pnpm-workspace.yaml'), workspaceRaw, 'utf8');
+                if (workspaceRaw !== null && missingPatchLines.length > 0)
+                    writeFileSync(workspacePath, workspaceRaw, 'utf8');
+                // pnpm 可能把不在依赖树里的链接移进 .ignored；装完重建，保证开发期 link 不断
+                for (const [name, target] of linkTargets) {
+                    const abs = join(paths.profileDir, 'node_modules', name);
+                    if (existsSync(abs))
+                        continue;
+                    try {
+                        mkdirSync(dirname(abs), { recursive: true });
+                        symlinkSync(target, abs, process.platform === 'win32' ? 'junction' : 'dir');
+                    }
+                    catch (error) {
+                        log('relink', error);
+                    }
+                }
             }
             return { removedLinks };
         };

package/lib/transport/api.js

@@ -1,175 +1,175 @@
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { dirname } from 'node:path';
-import { isPackageId } from '../archive.js';
-const OFFICIAL_HOST = /(^|\.)deepseek\.com$/i;
-export class ApiError extends Error {
-    code;
-    status;
-    constructor(code, message, status) {
-        super(message);
-        this.code = code;
-        this.status = status;
-    }
-}
-/**
- * 运营方 API 传输（B 模型）。插件侧只持有用户自己的 token，不接触存储凭据。
- * 认证：register 首次建账号，login 取回同一 token；token 存 auth.json（0600）。
- */
-export function createApiTransport({ baseUrl, authPath, token: initialToken, fetchImpl = globalThis.fetch, timeoutMs = 30_000, retries = 3, }) {
-    if (!baseUrl)
-        throw new Error('缺少 baseUrl');
-    const host = new URL(baseUrl).hostname;
-    if (OFFICIAL_HOST.test(host)) {
-        throw new ApiError('E_OFFICIAL_HOST', `拒绝官方域名: ${host}`);
-    }
-    let token = initialToken ?? null;
-    if (!token && authPath && existsSync(authPath)) {
-        try {
-            token = JSON.parse(readFileSync(authPath, 'utf8')).token ?? null;
-        }
-        catch {
-            token = null;
-        }
-    }
-    function persistAuth(next) {
-        token = next.token;
-        if (!authPath)
-            return;
-        mkdirSync(dirname(authPath), { recursive: true });
-        writeFileSync(authPath, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
-    }
-    function clearAuth() {
-        token = null;
-        if (authPath)
-            rmSync(authPath, { force: true });
-    }
-    const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-    async function request(method, path, { body, headers = {}, expectBytes = false } = {}) {
-        const url = `${baseUrl.replace(/\/$/, '')}${path}`;
-        let lastError;
-        for (let attempt = 0; attempt <= retries; attempt++) {
-            try {
-                const response = await fetchImpl(url, {
-                    method,
-                    headers: {
-                        ...(token ? { authorization: `Bearer ${token}` } : {}),
-                        ...(body && !expectBytes ? { 'content-type': 'application/json' } : {}),
-                        ...headers,
-                    },
-                    body: body,
-                    signal: AbortSignal.timeout(timeoutMs),
-                });
-                if (response.status === 401 || response.status === 403) {
-                    throw new ApiError('E_REMOTE_AUTH', `认证失败（${response.status}）`, response.status);
-                }
-                if (response.status >= 400 && response.status < 500) {
-                    const detail = await response.text().catch(() => '');
-                    throw new ApiError(`E_HTTP_${response.status}`, detail.slice(0, 200) || `HTTP ${response.status}`, response.status);
-                }
-                if (!response.ok) {
-                    throw new ApiError('E_REMOTE_5XX', `服务端错误（${response.status}）`, response.status);
-                }
-                return expectBytes ? Buffer.from(await response.arrayBuffer()) : response;
-            }
-            catch (error) {
-                lastError = error;
-                const retryable = !(error instanceof ApiError) || error.code === 'E_REMOTE_5XX';
-                if (!retryable || attempt === retries)
-                    throw error;
-                await sleep(200 * 2 ** attempt);
-            }
-        }
-        throw lastError;
-    }
-    const parseJson = async (response) => {
-        const text = await response.text();
-        return text ? JSON.parse(text) : null;
-    };
-    /**
-     * 用同一 accountKey 取回同一个 token（不签发新 token）。
-     * 抽成独立函数：register 里改走 login 时不依赖 `this`，解构调用也不会炸。
-     */
-    async function loginWith(accountKey) {
-        const response = await request('POST', '/v1/auth/login', { body: JSON.stringify({ accountKey }) });
-        const data = await parseJson(response);
-        const token = String(data?.token ?? '');
-        persistAuth({ token, accountKeyHint: accountKey.slice(0, 6), registeredAt: new Date().toISOString() });
-        return { ok: true, token };
-    }
-    return {
-        id: 'api',
-        baseUrl,
-        get token() {
-            return token;
-        },
-        /** 首次注册；已存在（409）时改走 login，取回同一个 token。 */
-        async register(accountKey) {
-            try {
-                const response = await request('POST', '/v1/auth/register', { body: JSON.stringify({ accountKey }) });
-                const data = await parseJson(response);
-                const token = String(data?.token ?? '');
-                persistAuth({ token, accountKeyHint: accountKey.slice(0, 6), registeredAt: new Date().toISOString() });
-                return { ok: true, token };
-            }
-            catch (error) {
-                if (error.code === 'E_HTTP_409')
-                    return loginWith(accountKey);
-                throw error;
-            }
-        },
-        login: loginWith,
-        async reset() {
-            await request('POST', '/v1/auth/reset');
-            clearAuth();
-            return { ok: true };
-        },
-        async test() {
-            try {
-                const response = await request('GET', '/v1/quota');
-                const data = await parseJson(response);
-                return { ok: true, detail: `配额 ${data?.used ?? 0}/${data?.limit ?? 0} 字节` };
-            }
-            catch (error) {
-                return { ok: false, detail: error.message };
-            }
-        },
-        async list() {
-            const response = await request('GET', '/v1/packages');
-            const data = await parseJson(response);
-            return (data?.packages ?? []).map((item) => ({
-                name: item.id,
-                size: item.size,
-                modifiedAt: item.createdAt,
-            }));
-        },
-        async meta(id) {
-            if (!isPackageId(id))
-                throw new ApiError('E_BAD_NAME', `非法包名: ${id}`);
-            const response = await request('GET', `/v1/packages/${encodeURIComponent(id)}/meta`);
-            return parseJson(response);
-        },
-        async get(id) {
-            if (!isPackageId(id))
-                throw new ApiError('E_BAD_NAME', `非法包名: ${id}`);
-            return request('GET', `/v1/packages/${encodeURIComponent(id)}`, { expectBytes: true });
-        },
-        async put(id, data) {
-            if (!isPackageId(id))
-                throw new ApiError('E_BAD_NAME', `非法包名: ${id}`);
-            await request('PUT', `/v1/packages/${encodeURIComponent(id)}`, {
-                body: data,
-                expectBytes: true,
-                headers: { 'content-type': 'application/octet-stream' },
-            });
-        },
-        async remove(id) {
-            if (!isPackageId(id))
-                throw new ApiError('E_BAD_NAME', `非法包名: ${id}`);
-            await request('DELETE', `/v1/packages/${encodeURIComponent(id)}`);
-        },
-        /** 导出我的全部数据（服务端打包当前包 + 元数据）。 */
-        async exportPackage() {
-            return request('GET', '/v1/export', { expectBytes: true });
-        },
-    };
-}
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { isPackageId } from '../archive.js';
+const OFFICIAL_HOST = /(^|\.)deepseek\.com$/i;
+export class ApiError extends Error {
+    code;
+    status;
+    constructor(code, message, status) {
+        super(message);
+        this.code = code;
+        this.status = status;
+    }
+}
+/**
+ * 运营方 API 传输（B 模型）。插件侧只持有用户自己的 token，不接触存储凭据。
+ * 认证：register 首次建账号，login 取回同一 token；token 存 auth.json（0600）。
+ */
+export function createApiTransport({ baseUrl, authPath, token: initialToken, fetchImpl = globalThis.fetch, timeoutMs = 30_000, retries = 3, }) {
+    if (!baseUrl)
+        throw new Error('缺少 baseUrl');
+    const host = new URL(baseUrl).hostname;
+    if (OFFICIAL_HOST.test(host)) {
+        throw new ApiError('E_OFFICIAL_HOST', `拒绝官方域名: ${host}`);
+    }
+    let token = initialToken ?? null;
+    if (!token && authPath && existsSync(authPath)) {
+        try {
+            token = JSON.parse(readFileSync(authPath, 'utf8')).token ?? null;
+        }
+        catch {
+            token = null;
+        }
+    }
+    function persistAuth(next) {
+        token = next.token;
+        if (!authPath)
+            return;
+        mkdirSync(dirname(authPath), { recursive: true });
+        writeFileSync(authPath, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
+    }
+    function clearAuth() {
+        token = null;
+        if (authPath)
+            rmSync(authPath, { force: true });
+    }
+    const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+    async function request(method, path, { body, headers = {}, expectBytes = false } = {}) {
+        const url = `${baseUrl.replace(/\/$/, '')}${path}`;
+        let lastError;
+        for (let attempt = 0; attempt <= retries; attempt++) {
+            try {
+                const response = await fetchImpl(url, {
+                    method,
+                    headers: {
+                        ...(token ? { authorization: `Bearer ${token}` } : {}),
+                        ...(body && !expectBytes ? { 'content-type': 'application/json' } : {}),
+                        ...headers,
+                    },
+                    body: body,
+                    signal: AbortSignal.timeout(timeoutMs),
+                });
+                if (response.status === 401 || response.status === 403) {
+                    throw new ApiError('E_REMOTE_AUTH', `认证失败（${response.status}）`, response.status);
+                }
+                if (response.status >= 400 && response.status < 500) {
+                    const detail = await response.text().catch(() => '');
+                    throw new ApiError(`E_HTTP_${response.status}`, detail.slice(0, 200) || `HTTP ${response.status}`, response.status);
+                }
+                if (!response.ok) {
+                    throw new ApiError('E_REMOTE_5XX', `服务端错误（${response.status}）`, response.status);
+                }
+                return expectBytes ? Buffer.from(await response.arrayBuffer()) : response;
+            }
+            catch (error) {
+                lastError = error;
+                const retryable = !(error instanceof ApiError) || error.code === 'E_REMOTE_5XX';
+                if (!retryable || attempt === retries)
+                    throw error;
+                await sleep(200 * 2 ** attempt);
+            }
+        }
+        throw lastError;
+    }
+    const parseJson = async (response) => {
+        const text = await response.text();
+        return text ? JSON.parse(text) : null;
+    };
+    /**
+     * 用同一 accountKey 取回同一个 token（不签发新 token）。
+     * 抽成独立函数：register 里改走 login 时不依赖 `this`，解构调用也不会炸。
+     */
+    async function loginWith(accountKey) {
+        const response = await request('POST', '/v1/auth/login', { body: JSON.stringify({ accountKey }) });
+        const data = await parseJson(response);
+        const token = String(data?.token ?? '');
+        persistAuth({ token, accountKeyHint: accountKey.slice(0, 6), registeredAt: new Date().toISOString() });
+        return { ok: true, token };
+    }
+    return {
+        id: 'api',
+        baseUrl,
+        get token() {
+            return token;
+        },
+        /** 首次注册；已存在（409）时改走 login，取回同一个 token。 */
+        async register(accountKey) {
+            try {
+                const response = await request('POST', '/v1/auth/register', { body: JSON.stringify({ accountKey }) });
+                const data = await parseJson(response);
+                const token = String(data?.token ?? '');
+                persistAuth({ token, accountKeyHint: accountKey.slice(0, 6), registeredAt: new Date().toISOString() });
+                return { ok: true, token };
+            }
+            catch (error) {
+                if (error.code === 'E_HTTP_409')
+                    return loginWith(accountKey);
+                throw error;
+            }
+        },
+        login: loginWith,
+        async reset() {
+            await request('POST', '/v1/auth/reset');
+            clearAuth();
+            return { ok: true };
+        },
+        async test() {
+            try {
+                const response = await request('GET', '/v1/quota');
+                const data = await parseJson(response);
+                return { ok: true, detail: `配额 ${data?.used ?? 0}/${data?.limit ?? 0} 字节` };
+            }
+            catch (error) {
+                return { ok: false, detail: error.message };
+            }
+        },
+        async list() {
+            const response = await request('GET', '/v1/packages');
+            const data = await parseJson(response);
+            return (data?.packages ?? []).map((item) => ({
+                name: item.id,
+                size: item.size,
+                modifiedAt: item.createdAt,
+            }));
+        },
+        async meta(id) {
+            if (!isPackageId(id))
+                throw new ApiError('E_BAD_NAME', `非法包名: ${id}`);
+            const response = await request('GET', `/v1/packages/${encodeURIComponent(id)}/meta`);
+            return parseJson(response);
+        },
+        async get(id) {
+            if (!isPackageId(id))
+                throw new ApiError('E_BAD_NAME', `非法包名: ${id}`);
+            return request('GET', `/v1/packages/${encodeURIComponent(id)}`, { expectBytes: true });
+        },
+        async put(id, data) {
+            if (!isPackageId(id))
+                throw new ApiError('E_BAD_NAME', `非法包名: ${id}`);
+            await request('PUT', `/v1/packages/${encodeURIComponent(id)}`, {
+                body: data,
+                expectBytes: true,
+                headers: { 'content-type': 'application/octet-stream' },
+            });
+        },
+        async remove(id) {
+            if (!isPackageId(id))
+                throw new ApiError('E_BAD_NAME', `非法包名: ${id}`);
+            await request('DELETE', `/v1/packages/${encodeURIComponent(id)}`);
+        },
+        /** 导出我的全部数据（服务端打包当前包 + 元数据）。 */
+        async exportPackage() {
+            return request('GET', '/v1/export', { expectBytes: true });
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pandablessing/dsh-user-sync",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "description": "DeepSeek Harness 用户级配置同步插件",
   "type": "module",
   "main": "lib/index.js",
@@ -60,6 +60,7 @@
     "build:server": "tsc -p server/tsconfig.json",
     "test": "node --test test/*.test.js",
     "publish:npm": "node scripts/publish.mjs",
-    "publish:dry": "node scripts/publish.mjs --dry-run"
+    "publish:dry": "node scripts/publish.mjs --dry-run",
+    "smoke:npm": "node scripts/verify-npm-install.mjs"
   }
 }