@pandablessing/dsh-user-sync 1.0.7 → 1.0.10

package/README.md

@@ -87,6 +87,8 @@ powershell -File scripts/smoke.ps1  # 真实 DSH 路由冒烟
 
 ## 发布
 
+> **发布时机由维护者决定**：`scripts/publish.mjs` 只在手动执行时发布，agent 不自动发布（改版本、构建、dry-run 可以提前做，发布等确认）。
+
 token 只放本地文件，绝不进仓库（`.env.local` 已在 `.gitignore`）：
 
 ```bash
@@ -99,6 +101,12 @@ node scripts/publish.mjs --otp=123456                      # 账号开 2FA 时
 - CI 用 secret 注入 `NPM_TOKEN` 环境变量即可，优先级高于 `.env.local`。
 - 发布前记得先 `pnpm run build && pnpm run build:server`，产物与源码不一致时 tarball 里会是旧代码。
 
+## 开发与真实环境
+
+- **日常开发（junction）**：`scripts/install-dev.ps1` 把仓库 link 进 profile，改源码 → `pnpm run build` → 热重载即生效；调试最快。
+- **真实安装（npm 包）**：`node scripts/verify-npm-install.mjs` 在临时 profile 里 `pnpm add` 当前发布版本，校验 patch name、宿主/client 两个入口、locale 与 patch 资源，用完自动删目录，不影响开发 profile。
+- 为什么分开：npm 安装的是 `lib/*.js` 编译产物副本，改仓库源码不会生效；所以开发用 link，验证真实安装路径用临时 profile。
+
 ## 仓库结构
 
 ```text

package/lib/client.js

@@ -162,24 +162,12 @@ if (typeof window !== 'undefined' && window.__ModuleLoader__) {
                     }
                     return parts.length > 0 ? parts.join(' · ') : '尚未同步';
                 }
-                function ResultCard({ notice, onApply, onConfirmModules, onDismiss, onInstallPlugins, onForceUpload }) {
+                function ResultCard({ notice, onConfirmModules, onDismiss, onForceUpload }) {
                     if (!notice)
                         return null;
                     const { kind, data } = notice;
                     if (kind === 'check') {
                         const decision = data.decision ?? {};
-                        if (decision.action === 'pull' || decision.action === 'confirm') {
-                            const plan = data.plan ?? { added: [], overwritten: [], skipped: [] };
-                            const missing = data.plugins?.missing ?? [];
-                            const linkDeps = data.plugins?.linkDeps ?? [];
-                            return R.createElement('div', { style: styles.card }, R.createElement('strong', null, decision.action === 'confirm' ? '两侧都有更新，需要你决定' : '远端有更新'), R.createElement('p', { style: styles.muted }, `远端包 ${data.latest?.name ?? ''}（${data.meta?.createdAt ?? '时间未知'}），新增 ${(plan.added ?? []).length} / 覆盖 ${(plan.overwritten ?? []).length} / 跳过 ${(plan.skipped ?? []).length} 个文件。`), missing.length > 0
-                                ? R.createElement('p', { style: styles.muted }, `缺失插件：${missing.map((item) => `${item.name}@${item.spec}`).join('、')}`)
-                                : null, linkDeps.length > 0
-                                ? R.createElement('p', { style: styles.muted }, `本地包需手动放回：${linkDeps.map((item) => item.name).join('、')}`)
-                                : null, R.createElement('div', { style: styles.actions }, missing.length > 0
-                                ? R.createElement('button', { style: styles.primary, onClick: () => onInstallPlugins(missing) }, '先安装缺失插件')
-                                : null, R.createElement('button', { style: styles.secondary, onClick: () => onDismiss() }, '取消')), R.createElement('p', { style: styles.muted }, '覆盖动作会在弹窗中确认。'));
-                        }
                         return R.createElement('div', { style: styles.card }, R.createElement('strong', null, decision.action === 'skip' ? '本机已是最新' : '本机有改动'), R.createElement('p', { style: styles.muted }, `判定：${decision.reason ?? decision.action}`));
                     }
                     if (kind === 'error') {
@@ -225,6 +213,8 @@ if (typeof window !== 'undefined' && window.__ModuleLoader__) {
                     const [confirmDialog, setConfirmDialog] = R.useState(null);
                     // 覆盖确认弹窗：上传发现远端更新 / 从远端同步发现远端更新时弹出（不再用结果卡按钮）
                     const [overwriteDialog, setOverwriteDialog] = R.useState(null);
+                    // 版本检查结果：有新版本时在面板顶部提示（不自动安装）
+                    const [updateInfo, setUpdateInfo] = R.useState(null);
                     // 当前展开文件清单的模块（null 表示都收起）
                     const [expandedModule, setExpandedModule] = R.useState(null);
                     // 设置改动后自动保存（600ms 防抖），不再提供「保存设置」按钮
@@ -270,6 +260,10 @@ if (typeof window !== 'undefined' && window.__ModuleLoader__) {
                     };
                     R.useEffect(() => {
                         refresh();
+                        // 版本检查失败不影响面板（网络不可用时静默）
+                        fetchJson(`${API}/update-check`)
+                            .then((data) => setUpdateInfo(data))
+                            .catch(() => setUpdateInfo(null));
                     }, []);
                     // 设置改动后 600ms 自动保存（输入间隔时不会每敲一下都发请求）
                     R.useEffect(() => {
@@ -411,29 +405,6 @@ if (typeof window !== 'undefined' && window.__ModuleLoader__) {
                             setBusy(false);
                         }
                     };
-                    const installPlugins = async (packages) => {
-                        setBusy(true);
-                        try {
-                            const result = await fetchJson(`${API}/install`, {
-                                method: 'POST',
-                                headers: { 'content-type': 'application/json' },
-                                body: JSON.stringify({ packages }),
-                            });
-                            if (result.ok) {
-                                setNotice({ kind: 'result', data: { detail: `已安装 ${result.results?.length ?? 0} 个插件，重启 DSH 后生效` } });
-                            }
-                            else {
-                                setNotice({ kind: 'error', data: { detail: `安装失败：${(result.results ?? []).filter((item) => !item.ok).map((item) => `${item.name}（${item.error}）`).join('；') || result.error}` } });
-                            }
-                            refresh();
-                        }
-                        catch (error) {
-                            setNotice({ kind: 'error', data: { detail: String(error) } });
-                        }
-                        finally {
-                            setBusy(false);
-                        }
-                    };
                     const checkRemote = async () => {
                         setBusy(true);
                         setNotice(null);
@@ -488,8 +459,8 @@ if (typeof window !== 'undefined' && window.__ModuleLoader__) {
                     // 计数优先用 status 的宿主探针（与 /scan 同一条扫描路径），
                     // 这样 /scan 请求失败时面板仍能显示真实数量。
                     const counts = status?.probe?.counts ?? scan?.counts ?? {};
-                    return R.createElement('div', { style: styles.section }, R.createElement('h2', { style: styles.heading }, '设置同步'), status?.scheduler?.lastDecision?.action === 'pull' && consentGiven
-                        ? R.createElement('div', { style: styles.card }, R.createElement('strong', null, '远端有更新'), R.createElement('p', { style: styles.muted }, `检测到 ${fmtTime(status.scheduler.lastCheckAt)} 的远端更新（来自 ${status.scheduler.lastDecision.packageId ?? '远端'}）。`), R.createElement('div', { style: styles.actions }, R.createElement('button', { style: styles.secondary, disabled: busy, onClick: checkRemote }, '立即同步')))
+                    return R.createElement('div', { style: styles.section }, R.createElement('h2', { style: styles.heading }, '设置同步'), updateInfo?.available
+                        ? R.createElement('p', { style: styles.warn }, `插件有新版本 v${updateInfo.latest}（当前 v${updateInfo.current}）：pnpm add @pandablessing/dsh-user-sync@${updateInfo.latest}`)
                         : null, !consentGiven
                         ? R.createElement('div', { style: styles.card }, R.createElement('strong', null, '启用前请确认'), R.createElement('p', { style: styles.muted }, '上传内容：技能、插件清单、配置、用户记忆。数据经运营方服务中转并存放在运营方账号（非 DSH 官方服务器）；远端只保留 1 份，上传即覆盖。'), R.createElement('div', { style: styles.actions }, 
                         // 用普通按钮：主色按钮看起来像「已选中」，同意是主动作但不应暗示状态
@@ -552,10 +523,8 @@ if (typeof window !== 'undefined' && window.__ModuleLoader__) {
                     // 服务地址只读展示：默认内置，用户覆盖后标注来源（面板不再提供输入框）
                     R.createElement('p', { style: styles.muted }, `服务地址：${status?.baseUrl ?? '（未解析）'}${status?.baseUrlSource === 'user' ? '（自定义）' : '（内置）'}`), R.createElement(ResultCard, {
                         notice,
-                        onApply: applyRemote,
                         onConfirmModules: confirmModules,
                         onDismiss: () => setNotice(null),
-                        onInstallPlugins: installPlugins,
                         onForceUpload: () => upload(true),
                     }), confirmDialog
                         ? R.createElement('div', { style: styles.overlay, onClick: () => setConfirmDialog(null) }, R.createElement('div', { style: styles.dialog, onClick: (event) => event.stopPropagation?.() }, R.createElement('strong', null, '同步项目/会话内容？'), R.createElement('p', { style: styles.muted }, `${confirmDialog.warning.map((id) => MODULE_LABELS[id] ?? id).join('、')} 属于项目/会话级，可能包含具体工作内容。确认要跨机器同步吗？`), R.createElement('div', { style: styles.actions }, R.createElement('button', { style: styles.primary, onClick: () => confirmModules(confirmDialog.modules) }, '仍要同步'), R.createElement('button', { style: styles.secondary, onClick: () => setConfirmDialog(null) }, '取消'))))

package/lib/index.js

@@ -1,5 +1,5 @@
 import { spawn } from 'node:child_process';
-import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { appendFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, symlinkSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -28,7 +28,13 @@ const NON_USER_LEVEL = ['projectMemory', 'sessions'];
 /** 异步执行外部命令：绝不阻塞宿主事件循环（Electron 主进程卡死会拖垮整个界面）。 */
 function runCommand(file, args, options) {
     return new Promise((resolve, reject) => {
-        const child = spawn(file, args, { cwd: options.cwd, stdio: 'ignore' });
+        // 保留 stderr：安装失败时把它写进 plugin-error.log，便于定位（此前只有退出码）
+        const child = spawn(file, args, { cwd: options.cwd, stdio: ['ignore', 'pipe', 'pipe'] });
+        let stderr = '';
+        child.stderr?.on('data', (chunk) => {
+            if (stderr.length < 4000)
+                stderr += chunk.toString('utf8');
+        });
         const timer = setTimeout(() => {
             child.kill();
             reject(new Error(`命令超时（${options.timeout} ms）: ${file}`));
@@ -42,7 +48,7 @@ function runCommand(file, args, options) {
             if (code === 0)
                 resolve();
             else
-                reject(new Error(`命令退出码 ${code}: ${file}`));
+                reject(new Error(`命令退出码 ${code}: ${file} ${args.join(' ')}\n${stderr.slice(-800)}`));
         });
     });
 }
@@ -211,8 +217,10 @@ export function apply(ctx) {
         };
         /**
          * 按 profile 的 package.json 安装依赖。
-         * `link:` / `file:` 指向不存在的本地路径时，pnpm install 会整体失败（连带普通包也装不上），
-         * 因此安装期间临时把这些坏 link 从 package.json 摘掉，装完原样恢复。
+         * 两类依赖会让 pnpm install 整体失败（连带普通包都装不上）：
+         * - `link:` / `file:` 指向不存在的本地路径
+         * - `node_modules` 里是 junction/符号链接（开发期 link 装的插件，pnpm 重装会 EPERM）
+         * 因此安装期间临时把这些依赖从 package.json 摘掉，装完原样恢复，并重建被 pnpm 移走的链接。
          */
         const installProfileDependencies = async () => {
             const rt = pnpmRuntime();
@@ -222,6 +230,7 @@ export function apply(ctx) {
             const workspacePath = join(paths.profileDir, 'pnpm-workspace.yaml');
             const raw = readFileSync(pkgPath, 'utf8');
             const removedLinks = [];
+            const linkTargets = new Map();
             let workspaceRaw = null;
             const missingPatchLines = [];
             try {
@@ -236,25 +245,44 @@ export function apply(ctx) {
                             missingPatchLines.push(line);
                     }
                     if (missingPatchLines.length > 0) {
-                        const patched = workspaceRaw
-                            .split('\n')
-                            .filter((line) => !missingPatchLines.includes(line))
-                            .join('\n');
-                        writeFileSync(workspacePath, patched, 'utf8');
+                        const kept = workspaceRaw.split('\n').filter((line) => !missingPatchLines.includes(line));
+                        // 段内条目全删光时，连 `patchedDependencies:` 键一起删：pnpm 不接受 null
+                        const keyIndex = kept.findIndex((line) => line.trim() === 'patchedDependencies:');
+                        if (keyIndex >= 0) {
+                            const next = kept[keyIndex + 1];
+                            if (next === undefined || !/^\s{2}\S/.test(next))
+                                kept.splice(keyIndex, 1);
+                        }
+                        writeFileSync(workspacePath, kept.join('\n'), 'utf8');
                     }
                 }
                 catch {
                     workspaceRaw = null;
                 }
-                const brokenLinks = Object.entries(dependencies).filter(([, spec]) => {
-                    if (!spec.startsWith('link:') && !spec.startsWith('file:'))
-                        return false;
-                    const target = join(paths.profileDir, spec.slice(5));
-                    return !existsSync(target);
+                // 需要临时摘除的依赖：坏 link / 文件依赖 + 已经是 junction 的已装包
+                const detached = Object.entries(dependencies).filter(([name, spec]) => {
+                    if (spec.startsWith('link:') || spec.startsWith('file:')) {
+                        const target = join(paths.profileDir, spec.slice(5));
+                        if (!existsSync(target))
+                            return true;
+                        linkTargets.set(name, target);
+                        return true;
+                    }
+                    const abs = join(paths.profileDir, 'node_modules', name);
+                    try {
+                        if (lstatSync(abs).isSymbolicLink()) {
+                            linkTargets.set(name, realpathSync(abs));
+                            return true;
+                        }
+                    }
+                    catch {
+                        // 没装或读不到：交给 pnpm 正常安装
+                    }
+                    return false;
                 });
-                if (brokenLinks.length > 0) {
+                if (detached.length > 0) {
                     const patched = { ...pkg, dependencies: { ...dependencies } };
-                    for (const [name] of brokenLinks) {
+                    for (const [name] of detached) {
                         delete patched.dependencies[name];
                         removedLinks.push(name);
                     }
@@ -265,8 +293,21 @@ export function apply(ctx) {
             finally {
                 if (removedLinks.length > 0)
                     writeFileSync(pkgPath, raw, 'utf8');
-                if (workspaceRaw !== null && missingPatchLines?.length > 0)
-                    writeFileSync(join(paths.profileDir, 'pnpm-workspace.yaml'), workspaceRaw, 'utf8');
+                if (workspaceRaw !== null && missingPatchLines.length > 0)
+                    writeFileSync(workspacePath, workspaceRaw, 'utf8');
+                // pnpm 可能把不在依赖树里的链接移进 .ignored；装完重建，保证开发期 link 不断
+                for (const [name, target] of linkTargets) {
+                    const abs = join(paths.profileDir, 'node_modules', name);
+                    if (existsSync(abs))
+                        continue;
+                    try {
+                        mkdirSync(dirname(abs), { recursive: true });
+                        symlinkSync(target, abs, process.platform === 'win32' ? 'junction' : 'dir');
+                    }
+                    catch (error) {
+                        log('relink', error);
+                    }
+                }
             }
             return { removedLinks };
         };
@@ -312,7 +353,62 @@ export function apply(ctx) {
             }));
             return { installed, linkDeps: plan.linkDeps.map(({ name, spec }) => ({ name, spec })) };
         };
+        /** 判断 latest 是否比 current 新（只比较 x.y.z 数字段）。 */
+        const isNewerVersion = (latest, current) => {
+            const toParts = (value) => value.split('-')[0].split('.').map((part) => Number.parseInt(part, 10) || 0);
+            const a = toParts(latest);
+            const b = toParts(current);
+            for (let i = 0; i < Math.max(a.length, b.length); i++) {
+                const left = a[i] ?? 0;
+                const right = b[i] ?? 0;
+                if (left !== right)
+                    return left > right;
+            }
+            return false;
+        };
+        /** 版本检查：查 npm registry 的 dist-tags 与当前版本比对（30 分钟缓存，失败静默）。 */
+        let versionCache = null;
+        const checkLatestVersion = async () => {
+            const now = Date.now();
+            if (versionCache && now - versionCache.at < 30 * 60_000) {
+                const latest = versionCache.latest;
+                return { current: PLUGIN_VERSION, latest, available: Boolean(latest && isNewerVersion(latest, PLUGIN_VERSION)) };
+            }
+            const registry = process.env.NPM_REGISTRY || 'https://registry.npmjs.org';
+            const encoded = encodeURIComponent('@pandablessing/dsh-user-sync').replace('%2F', '%2f');
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), 5000);
+            try {
+                const response = await fetch(`${registry}/-/package/${encoded}/dist-tags`, { signal: controller.signal });
+                const tags = (await response.json());
+                const latest = typeof tags.latest === 'string' ? tags.latest : null;
+                versionCache = { at: now, latest };
+                return { current: PLUGIN_VERSION, latest, available: Boolean(latest && isNewerVersion(latest, PLUGIN_VERSION)) };
+            }
+            catch {
+                versionCache = { at: now, latest: null };
+                return { current: PLUGIN_VERSION, latest: null, available: false };
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        };
         const routes = [
+            {
+                // 版本检查：面板据此提示「有新版本可升级」，不做自动安装
+                path: '/api/dsh-user-sync/update-check',
+                methods: ['GET'],
+                requestBody: 'buffered',
+                fetch: async () => {
+                    try {
+                        return json(await checkLatestVersion());
+                    }
+                    catch (error) {
+                        recordHandlerError('update-check', error);
+                        return json({ current: PLUGIN_VERSION, latest: null, available: false });
+                    }
+                },
+            },
             {
                 // 最小同步路由：用于区分「同步 handler 本身不可用」与「status/scan 具体逻辑抛错」
                 path: '/api/dsh-user-sync/ping',

package/lib/transport/api.js

@@ -1,175 +1,175 @@
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { dirname } from 'node:path';
-import { isPackageId } from '../archive.js';
-const OFFICIAL_HOST = /(^|\.)deepseek\.com$/i;
-export class ApiError extends Error {
-    code;
-    status;
-    constructor(code, message, status) {
-        super(message);
-        this.code = code;
-        this.status = status;
-    }
-}
-/**
- * 运营方 API 传输（B 模型）。插件侧只持有用户自己的 token，不接触存储凭据。
- * 认证：register 首次建账号，login 取回同一 token；token 存 auth.json（0600）。
- */
-export function createApiTransport({ baseUrl, authPath, token: initialToken, fetchImpl = globalThis.fetch, timeoutMs = 30_000, retries = 3, }) {
-    if (!baseUrl)
-        throw new Error('缺少 baseUrl');
-    const host = new URL(baseUrl).hostname;
-    if (OFFICIAL_HOST.test(host)) {
-        throw new ApiError('E_OFFICIAL_HOST', `拒绝官方域名: ${host}`);
-    }
-    let token = initialToken ?? null;
-    if (!token && authPath && existsSync(authPath)) {
-        try {
-            token = JSON.parse(readFileSync(authPath, 'utf8')).token ?? null;
-        }
-        catch {
-            token = null;
-        }
-    }
-    function persistAuth(next) {
-        token = next.token;
-        if (!authPath)
-            return;
-        mkdirSync(dirname(authPath), { recursive: true });
-        writeFileSync(authPath, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
-    }
-    function clearAuth() {
-        token = null;
-        if (authPath)
-            rmSync(authPath, { force: true });
-    }
-    const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-    async function request(method, path, { body, headers = {}, expectBytes = false } = {}) {
-        const url = `${baseUrl.replace(/\/$/, '')}${path}`;
-        let lastError;
-        for (let attempt = 0; attempt <= retries; attempt++) {
-            try {
-                const response = await fetchImpl(url, {
-                    method,
-                    headers: {
-                        ...(token ? { authorization: `Bearer ${token}` } : {}),
-                        ...(body && !expectBytes ? { 'content-type': 'application/json' } : {}),
-                        ...headers,
-                    },
-                    body: body,
-                    signal: AbortSignal.timeout(timeoutMs),
-                });
-                if (response.status === 401 || response.status === 403) {
-                    throw new ApiError('E_REMOTE_AUTH', `认证失败（${response.status}）`, response.status);
-                }
-                if (response.status >= 400 && response.status < 500) {
-                    const detail = await response.text().catch(() => '');
-                    throw new ApiError(`E_HTTP_${response.status}`, detail.slice(0, 200) || `HTTP ${response.status}`, response.status);
-                }
-                if (!response.ok) {
-                    throw new ApiError('E_REMOTE_5XX', `服务端错误（${response.status}）`, response.status);
-                }
-                return expectBytes ? Buffer.from(await response.arrayBuffer()) : response;
-            }
-            catch (error) {
-                lastError = error;
-                const retryable = !(error instanceof ApiError) || error.code === 'E_REMOTE_5XX';
-                if (!retryable || attempt === retries)
-                    throw error;
-                await sleep(200 * 2 ** attempt);
-            }
-        }
-        throw lastError;
-    }
-    const parseJson = async (response) => {
-        const text = await response.text();
-        return text ? JSON.parse(text) : null;
-    };
-    /**
-     * 用同一 accountKey 取回同一个 token（不签发新 token）。
-     * 抽成独立函数：register 里改走 login 时不依赖 `this`，解构调用也不会炸。
-     */
-    async function loginWith(accountKey) {
-        const response = await request('POST', '/v1/auth/login', { body: JSON.stringify({ accountKey }) });
-        const data = await parseJson(response);
-        const token = String(data?.token ?? '');
-        persistAuth({ token, accountKeyHint: accountKey.slice(0, 6), registeredAt: new Date().toISOString() });
-        return { ok: true, token };
-    }
-    return {
-        id: 'api',
-        baseUrl,
-        get token() {
-            return token;
-        },
-        /** 首次注册；已存在（409）时改走 login，取回同一个 token。 */
-        async register(accountKey) {
-            try {
-                const response = await request('POST', '/v1/auth/register', { body: JSON.stringify({ accountKey }) });
-                const data = await parseJson(response);
-                const token = String(data?.token ?? '');
-                persistAuth({ token, accountKeyHint: accountKey.slice(0, 6), registeredAt: new Date().toISOString() });
-                return { ok: true, token };
-            }
-            catch (error) {
-                if (error.code === 'E_HTTP_409')
-                    return loginWith(accountKey);
-                throw error;
-            }
-        },
-        login: loginWith,
-        async reset() {
-            await request('POST', '/v1/auth/reset');
-            clearAuth();
-            return { ok: true };
-        },
-        async test() {
-            try {
-                const response = await request('GET', '/v1/quota');
-                const data = await parseJson(response);
-                return { ok: true, detail: `配额 ${data?.used ?? 0}/${data?.limit ?? 0} 字节` };
-            }
-            catch (error) {
-                return { ok: false, detail: error.message };
-            }
-        },
-        async list() {
-            const response = await request('GET', '/v1/packages');
-            const data = await parseJson(response);
-            return (data?.packages ?? []).map((item) => ({
-                name: item.id,
-                size: item.size,
-                modifiedAt: item.createdAt,
-            }));
-        },
-        async meta(id) {
-            if (!isPackageId(id))
-                throw new ApiError('E_BAD_NAME', `非法包名: ${id}`);
-            const response = await request('GET', `/v1/packages/${encodeURIComponent(id)}/meta`);
-            return parseJson(response);
-        },
-        async get(id) {
-            if (!isPackageId(id))
-                throw new ApiError('E_BAD_NAME', `非法包名: ${id}`);
-            return request('GET', `/v1/packages/${encodeURIComponent(id)}`, { expectBytes: true });
-        },
-        async put(id, data) {
-            if (!isPackageId(id))
-                throw new ApiError('E_BAD_NAME', `非法包名: ${id}`);
-            await request('PUT', `/v1/packages/${encodeURIComponent(id)}`, {
-                body: data,
-                expectBytes: true,
-                headers: { 'content-type': 'application/octet-stream' },
-            });
-        },
-        async remove(id) {
-            if (!isPackageId(id))
-                throw new ApiError('E_BAD_NAME', `非法包名: ${id}`);
-            await request('DELETE', `/v1/packages/${encodeURIComponent(id)}`);
-        },
-        /** 导出我的全部数据（服务端打包当前包 + 元数据）。 */
-        async exportPackage() {
-            return request('GET', '/v1/export', { expectBytes: true });
-        },
-    };
-}
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { isPackageId } from '../archive.js';
+const OFFICIAL_HOST = /(^|\.)deepseek\.com$/i;
+export class ApiError extends Error {
+    code;
+    status;
+    constructor(code, message, status) {
+        super(message);
+        this.code = code;
+        this.status = status;
+    }
+}
+/**
+ * 运营方 API 传输（B 模型）。插件侧只持有用户自己的 token，不接触存储凭据。
+ * 认证：register 首次建账号，login 取回同一 token；token 存 auth.json（0600）。
+ */
+export function createApiTransport({ baseUrl, authPath, token: initialToken, fetchImpl = globalThis.fetch, timeoutMs = 30_000, retries = 3, }) {
+    if (!baseUrl)
+        throw new Error('缺少 baseUrl');
+    const host = new URL(baseUrl).hostname;
+    if (OFFICIAL_HOST.test(host)) {
+        throw new ApiError('E_OFFICIAL_HOST', `拒绝官方域名: ${host}`);
+    }
+    let token = initialToken ?? null;
+    if (!token && authPath && existsSync(authPath)) {
+        try {
+            token = JSON.parse(readFileSync(authPath, 'utf8')).token ?? null;
+        }
+        catch {
+            token = null;
+        }
+    }
+    function persistAuth(next) {
+        token = next.token;
+        if (!authPath)
+            return;
+        mkdirSync(dirname(authPath), { recursive: true });
+        writeFileSync(authPath, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
+    }
+    function clearAuth() {
+        token = null;
+        if (authPath)
+            rmSync(authPath, { force: true });
+    }
+    const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+    async function request(method, path, { body, headers = {}, expectBytes = false } = {}) {
+        const url = `${baseUrl.replace(/\/$/, '')}${path}`;
+        let lastError;
+        for (let attempt = 0; attempt <= retries; attempt++) {
+            try {
+                const response = await fetchImpl(url, {
+                    method,
+                    headers: {
+                        ...(token ? { authorization: `Bearer ${token}` } : {}),
+                        ...(body && !expectBytes ? { 'content-type': 'application/json' } : {}),
+                        ...headers,
+                    },
+                    body: body,
+                    signal: AbortSignal.timeout(timeoutMs),
+                });
+                if (response.status === 401 || response.status === 403) {
+                    throw new ApiError('E_REMOTE_AUTH', `认证失败（${response.status}）`, response.status);
+                }
+                if (response.status >= 400 && response.status < 500) {
+                    const detail = await response.text().catch(() => '');
+                    throw new ApiError(`E_HTTP_${response.status}`, detail.slice(0, 200) || `HTTP ${response.status}`, response.status);
+                }
+                if (!response.ok) {
+                    throw new ApiError('E_REMOTE_5XX', `服务端错误（${response.status}）`, response.status);
+                }
+                return expectBytes ? Buffer.from(await response.arrayBuffer()) : response;
+            }
+            catch (error) {
+                lastError = error;
+                const retryable = !(error instanceof ApiError) || error.code === 'E_REMOTE_5XX';
+                if (!retryable || attempt === retries)
+                    throw error;
+                await sleep(200 * 2 ** attempt);
+            }
+        }
+        throw lastError;
+    }
+    const parseJson = async (response) => {
+        const text = await response.text();
+        return text ? JSON.parse(text) : null;
+    };
+    /**
+     * 用同一 accountKey 取回同一个 token（不签发新 token）。
+     * 抽成独立函数：register 里改走 login 时不依赖 `this`，解构调用也不会炸。
+     */
+    async function loginWith(accountKey) {
+        const response = await request('POST', '/v1/auth/login', { body: JSON.stringify({ accountKey }) });
+        const data = await parseJson(response);
+        const token = String(data?.token ?? '');
+        persistAuth({ token, accountKeyHint: accountKey.slice(0, 6), registeredAt: new Date().toISOString() });
+        return { ok: true, token };
+    }
+    return {
+        id: 'api',
+        baseUrl,
+        get token() {
+            return token;
+        },
+        /** 首次注册；已存在（409）时改走 login，取回同一个 token。 */
+        async register(accountKey) {
+            try {
+                const response = await request('POST', '/v1/auth/register', { body: JSON.stringify({ accountKey }) });
+                const data = await parseJson(response);
+                const token = String(data?.token ?? '');
+                persistAuth({ token, accountKeyHint: accountKey.slice(0, 6), registeredAt: new Date().toISOString() });
+                return { ok: true, token };
+            }
+            catch (error) {
+                if (error.code === 'E_HTTP_409')
+                    return loginWith(accountKey);
+                throw error;
+            }
+        },
+        login: loginWith,
+        async reset() {
+            await request('POST', '/v1/auth/reset');
+            clearAuth();
+            return { ok: true };
+        },
+        async test() {
+            try {
+                const response = await request('GET', '/v1/quota');
+                const data = await parseJson(response);
+                return { ok: true, detail: `配额 ${data?.used ?? 0}/${data?.limit ?? 0} 字节` };
+            }
+            catch (error) {
+                return { ok: false, detail: error.message };
+            }
+        },
+        async list() {
+            const response = await request('GET', '/v1/packages');
+            const data = await parseJson(response);
+            return (data?.packages ?? []).map((item) => ({
+                name: item.id,
+                size: item.size,
+                modifiedAt: item.createdAt,
+            }));
+        },
+        async meta(id) {
+            if (!isPackageId(id))
+                throw new ApiError('E_BAD_NAME', `非法包名: ${id}`);
+            const response = await request('GET', `/v1/packages/${encodeURIComponent(id)}/meta`);
+            return parseJson(response);
+        },
+        async get(id) {
+            if (!isPackageId(id))
+                throw new ApiError('E_BAD_NAME', `非法包名: ${id}`);
+            return request('GET', `/v1/packages/${encodeURIComponent(id)}`, { expectBytes: true });
+        },
+        async put(id, data) {
+            if (!isPackageId(id))
+                throw new ApiError('E_BAD_NAME', `非法包名: ${id}`);
+            await request('PUT', `/v1/packages/${encodeURIComponent(id)}`, {
+                body: data,
+                expectBytes: true,
+                headers: { 'content-type': 'application/octet-stream' },
+            });
+        },
+        async remove(id) {
+            if (!isPackageId(id))
+                throw new ApiError('E_BAD_NAME', `非法包名: ${id}`);
+            await request('DELETE', `/v1/packages/${encodeURIComponent(id)}`);
+        },
+        /** 导出我的全部数据（服务端打包当前包 + 元数据）。 */
+        async exportPackage() {
+            return request('GET', '/v1/export', { expectBytes: true });
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pandablessing/dsh-user-sync",
-  "version": "1.0.7",
+  "version": "1.0.10",
   "description": "DeepSeek Harness 用户级配置同步插件",
   "type": "module",
   "main": "lib/index.js",
@@ -60,6 +60,7 @@
     "build:server": "tsc -p server/tsconfig.json",
     "test": "node --test test/*.test.js",
     "publish:npm": "node scripts/publish.mjs",
-    "publish:dry": "node scripts/publish.mjs --dry-run"
+    "publish:dry": "node scripts/publish.mjs --dry-run",
+    "smoke:npm": "node scripts/verify-npm-install.mjs"
   }
 }