@stofone/dsh-agent-roster 0.6.0 → 0.6.2

package/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 遵循 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/) 与 [SemVer](https://semver.org/lang/zh-CN/)。
 
+## [0.6.2] - 2026-10-30
+
+### Packaging
+
+- `peerDependencies` for `@deepseek-ai/dsh-tools` no longer uses the wildcard. node-semver only
+  admits a prerelease version when one comparator in the range shares its exact
+  `major.minor.patch` tuple and itself carries a prerelease tag, so `*` — like the broad
+  `>=0.0.1-rc.1 <0.2.0` form — silently excludes every prerelease harness build. The range is now
+  `^0.1.0-rc.1 || ^0.2.0-rc.1 || ^0.2.1-rc.1 || ^0.3.0-rc.1`, which admits the 0.1.x, 0.2.0-x,
+  0.2.1-x and 0.3.x prerelease lines while still refusing 0.4.x prereleases.
+- No runtime change; the peer stays optional because the host always provides the module.
+
+## [0.6.1] - 2026-10-30
+
+### Custom registry mirror
+
+- New config field `registryMirror`: type any npm registry URL in Settings (download section)
+  and index packages published as npm packages are fetched from there instead of the region
+  presets. Sub-paths are kept, so corporate Nexus layouts such as
+  `http://nexus.corp.local/repository/npm` work.
+- Precedence: a registry pinned inside a source wins, then `registryMirror`, then `region`.
+  A blank or malformed value is ignored instead of silently disabling downloads.
+- Tests: 195 passing (mirror normalisation, precedence, config-view passthrough).
+
 ## [0.6.0] - 2026-10-30
 
 ### Captain verification and applying a roster

package/README.md

@@ -191,7 +191,7 @@ pool is a filtered view only; it never writes tags back to files.
 Header actions follow the place they act on: **Import** and **New archive** sit in the archive tab
 next to the search box, **Refresh sources** sits in the sources tab (it bypasses the one-hour cache and
 re-reads the public index), and the header keeps a single **gear button** that opens the settings dialog.
-The dialog edits the language, the download region and the roster directories, and shows the resolved
+The dialog edits the language, the download region, the mirror address and the roster directories, and shows the resolved
 data directory, the team state directory and the version.
 
 A badge at the top summarises how many items need attention
@@ -249,7 +249,8 @@ All six are `exact` routes behind the host's `connection` fence and answer `405`
 | `agentTeamsStateDir` | `.agent-teams` | read only: where `roster_verify` and the Teams tab look for team state |
 | `language` | `"auto"` | panel language: `auto` follows DSH, or pin `zh` / `en` |
 | `indexes` | `[]` | public registry sources: an `https` `registry.json` or `npm:pkg`. Empty means the official source; `false` means local-only |
-| `region` | `"auto"` | download region: `china` reads npm-style index packages from the Tencent mirror; `auto` equals `global` (no probing, one less request) |
+| `region` | `"auto"` | download region: `china` reads npm-style index packages from the Tencent mirror; `auto` equals `global` (no probing, one less request) |
+| `registryMirror` | `""` | custom npm registry for download sources, e.g. `https://registry.npmmirror.com` or `http://nexus.corp.local/repository/npm`. Set it and it beats `region`; a registry pinned inside a source still beats both. Empty means no custom mirror |
 
 All six are `volatile`: changes apply immediately, no host restart.
 

package/README.zh.md

@@ -181,12 +181,10 @@ npx dsh-agent-roster list
 以及各标签的档案数，点标签即筛选——多选是「且」，一个按钮清除选择。标签池只影响视图，不会把
 标签写回文件。
 
-头部只留一个齿轮按钮打开**设置弹窗**：语言、下载区、档案库目录都能在这里改；解析出来的数据目录、
+头部只留一个齿轮按钮打开**设置弹窗**：语言、下载区、镜像地址、档案库目录都能在这里改；解析出来的数据目录、
 团队状态目录与版本号也列在同一处。导入与新建档案挪到档案页签的搜索框右侧，刷新只属于档案源页签
 （绕过一小时的缓存，直接回源读公共索引）。
 
-顶部一条徽标汇总
-
 客户端插件在左侧全局栏新增一行 **Agent Roster** 图标（`sidebar.panellist` 列表槽），并在 `main` 槽用同一个面板 id 注册整页内容；点图标即在主区域打开，宽度与对话页一致。面板分三个页签，不只是看：
 
 | 页签 | 能做什么 |
@@ -239,6 +237,7 @@ npx dsh-agent-roster list
 | `language` | `"auto"` | 面板语言：`auto` 跟随 DSH，或固定 `zh` / `en` |
 | `indexes` | `[]` | 公共档案源：`https` 的 `registry.json` 或 `npm:pkg`。留空 = 官方源；显式 `false` = 只在本机库工作 |
 | `region` | `"auto"` | 下载区：`china` 时用腾讯 npm 镜像读 npm 形式的目录包；`auto` 等同 `global`（不自动探测，省一次出网） |
+| `registryMirror` | `""` | 自定义 npm 镜像地址（如 `https://registry.npmmirror.com`、`http://nexus.corp.local/repository/npm`）。填了它优先于 `region`；源里自己写死的 registry 又优先于它。留空 = 不用自定义镜像 |
 
 六项都是 `volatile`：改完立即生效，无需重启。
 

package/client.js

@@ -1846,6 +1846,7 @@ window.__ModuleLoader__.load({
       useTranslation();
       const [language, setLanguage] = useState(() => readLanguage(form));
       const [region, setRegion] = useState(() => readFormValue(form, "region", "auto"));
+      const [mirror, setMirror] = useState(() => readFormValue(form, "registryMirror", ""));
       const [dirs, setDirs] = useState(() => (library?.data?.config?.rosterDirs ?? []).join(", "));
       const [saved, setSaved] = useState("");
       const [version, setVersion] = useState("");
@@ -1855,6 +1856,7 @@ window.__ModuleLoader__.load({
         const off = form.subscribe(() => {
           setLanguage(readLanguage(form));
           setRegion(readFormValue(form, "region", "auto"));
+          setMirror(readFormValue(form, "registryMirror", ""));
         });
         return () => {
           if (typeof off === "function") off();
@@ -1891,6 +1893,12 @@ window.__ModuleLoader__.load({
         write("region", next);
       }
 
+      function saveMirror() {
+        // 镜像地址原样存：路径前缀（公司 Nexus 常带 /repository/npm）是它的一部分，
+        // 规整交给宿主（lib/remote.js 的 normalizeRegistryUrl），界面不在写盘前偷偷改写。
+        write("registryMirror", mirror.trim());
+      }
+
       function saveDirs() {
         // 逗号/分号/空白都当分隔符：用户从别处粘路径时不该因为分隔符被卡住。
         const list = dirs
@@ -1950,6 +1958,24 @@ window.__ModuleLoader__.load({
             ),
           ),
         ),
+        h(
+          "div",
+          { className: "rstr-settings-field" },
+          h("span", { className: "rstr-label" }, t("settings.mirror")),
+          h(
+            "div",
+            { className: "rstr-settings-inline" },
+            h("input", {
+              className: "rstr-input",
+              value: mirror,
+              placeholder: t("settings.mirrorPlaceholder"),
+              "aria-label": t("settings.mirror"),
+              onChange: (event) => setMirror(event.target.value),
+            }),
+            h("button", { type: "button", className: "rstr-btn rstr-btn-sm", onClick: saveMirror }, t("settings.save")),
+          ),
+          h("span", { className: "rstr-muted rstr-small" }, t("settings.mirrorHint")),
+        ),
         h(
           "div",
           { className: "rstr-settings-field" },

package/cordis.patch.yml

@@ -1,8 +1,8 @@
 # @stofone/dsh-agent-roster 的 Host 行。
 #
 # config 会被整体替换（不会深合并）：覆盖本行时请把需要的字段全部重述一遍。
-# 所有字段都有默认值，留空即可用「项目内 .dsh/agent-rosters/」与「用户级
-# <dshHome>/agent-rosters/」两个目录。
+# 所有字段都有默认值：rosterDirs 留空即用全局档案库 <dshHome>/agent-roster
+# （docker 下就是被挂载的数据卷），与工作区无关。
 - insert:
     - id: agent-roster
       name: '@stofone/dsh-agent-roster'

package/index.js

@@ -80,6 +80,14 @@ export const Config = z.object({
     .default("auto")
     .description("下载区：china 用腾讯 npm 镜像读 npm 形式的目录包；auto 等同 global（不自动探测，避免额外的出网请求）。")
     .volatile(),
+  registryMirror: z
+    .string()
+    .default("")
+    .description(
+      "自定义 npm 镜像地址（如 https://registry.npmmirror.com 或公司 Nexus 的 /repository/npm 子路径）：" +
+        "填了就优先于下载区的预置，用于按 npm 包形式发布的公共档案源。留空 = 用下载区的预置。",
+    )
+    .volatile(),
 });
 
 /**
@@ -94,7 +102,7 @@ export function apply(ctx, config) {
   const settings = configView(config);
 
   registerRosterTools(ctx, settings, { version: pkg.version });
-  ctx.logger?.info?.(`dsh-agent-roster ${pkg.version}: registered 4 tools`);
+  ctx.logger?.info?.(`dsh-agent-roster ${pkg.version}: registered 5 tools`);
 
   // 面板路由：读快照 / 读单份档案原文 / 保存 / 删除 / 导入。
   // 没有 webServer 也不影响工具可用性。

package/lib/config-view.js

@@ -40,6 +40,7 @@ function read(cell, fallback) {
  *   agentTeamsStateDir: string,
  *   indexes: unknown,
  *   region: string,
+ *   registryMirror: string,
  * }}
  */
 export function configView(config) {
@@ -72,5 +73,10 @@ export function configView(config) {
       const region = read(source.region, "auto");
       return typeof region === "string" && region !== "" ? region : "auto";
     },
+    /** 自定义镜像：空串 = 没填，按 region 选预置。 */
+    get registryMirror() {
+      const mirror = read(source.registryMirror, "");
+      return typeof mirror === "string" ? mirror : "";
+    },
   };
 }

package/lib/remote.js

@@ -56,6 +56,40 @@ export const NPM_REGISTRIES = {
   china: "https://mirrors.cloud.tencent.com/npm",
 };
 
+/**
+ * 把用户填的镜像地址规整成可用的 registry 根。
+ *
+ * 只接受 http/https——下载区那两个预置之外，用户可能填 npmmirror、公司 Nexus、
+ * Verdaccio 之类。尾斜杠去掉（后面自己拼 `/pkg/latest`），但**路径前缀保留**：
+ * 内网镜像常常挂在 `/repository/npm` 这种子路径下，吃掉就等于换了个错地址。
+ *
+ * @param {unknown} value
+ * @returns {string | null}
+ */
+export function normalizeRegistryUrl(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim().replace(/\/+$/, "");
+  if (!/^https?:\/\/[^\s/]+/i.test(trimmed)) return null;
+  return trimmed;
+}
+
+/**
+ * 决定一个源用哪个 registry：源自己写死的 > 用户填的镜像 > 下载区预置。
+ *
+ * 顺序不能反：源里写 `registry` 是作者对自己包的明确声明；
+ * 用户填镜像是在"我这边怎么下"这一层做覆盖；预置只是兜底。
+ *
+ * @param {{ sourceRegistry?: unknown, mirror?: unknown, region?: unknown }} options
+ * @returns {string}
+ */
+export function resolveRegistryRoot(options = {}) {
+  return (
+    normalizeRegistryUrl(options.sourceRegistry) ??
+    normalizeRegistryUrl(options.mirror) ??
+    NPM_REGISTRIES[options.region === "china" ? "china" : "global"]
+  );
+}
+
 /** 网络单次请求的预算：够了，慢就换下一个源。 */
 const TIMEOUT_MS = 15_000;
 
@@ -174,6 +208,7 @@ export function sourceLabel(source) {
  * @param {typeof fetch} [options.fetchImpl]
  * @param {boolean} [options.refresh] 忽略 TTL（但仍受 {@link MIN_REFRESH_MS} 约束）
  * @param {number} [options.region] 选择 npm registry
+ * @param {string} [options.mirror] 用户填写的镜像地址（优先于 region 预置）
  * @returns {Promise<object>} `{ source, ok, stale, fetchedAt, document, diagnostics, collections }`
  */
 export async function loadRegistry(source, options = {}) {
@@ -277,7 +312,7 @@ function buildResult(source, document, meta) {
  */
 async function fetchRegistry(source, options) {
   if (source.kind === "npm") {
-    const registry = source.registry ?? NPM_REGISTRIES[options.region === "china" ? "china" : "global"];
+    const registry = resolveRegistryRoot({ sourceRegistry: source.registry, mirror: options.mirror, region: options.region });
     return fetchFromPackage(source, { ...options, registry });
   }
 
@@ -551,6 +586,7 @@ export async function loadRegistryIndex(config, options = {}) {
     const loaded = await loadRegistry(source, {
       ...options,
       region: options.region ?? (config?.region === "china" ? "china" : "global"),
+      mirror: options.mirror ?? config?.registryMirror,
     });
     indexes.push({
       id: source.id,

package/lib/service.js

@@ -87,6 +87,8 @@ export function buildPanelSnapshot(ctx, config, meta, options = {}) {
       defaultRoot: globalRosterRoot(),
       knownToolPolicies: Array.isArray(config.knownToolPolicies) ? config.knownToolPolicies : [],
       stateDirSpec: config.agentTeamsStateDir,
+      region: config.region,
+      registryMirror: config.registryMirror ?? "",
     },
     workspaces: library.workspaces,
     teams,

package/lib/tools.js

@@ -1,5 +1,6 @@
 /**
- * 四个模型可见工具：列档案、看成员、生成桥接调用、核对运行时。
+ * 五个模型可见工具：列档案、看成员、生成桥接调用、核对运行时、读公共档案源。
+ * （roster_list / roster_show / roster_create / roster_verify / roster_index）
  *
  * 只读优先：`roster_list` / `roster_show` / `roster_verify` 只读文件系统；
  * `roster_create` 也不写任何东西——它输出的是**参数**，真正的成员创建仍由队长调用

package/locale/en.json

@@ -27,7 +27,10 @@
     "regionChina": "China mirror",
     "save": "Save",
     "saved": "Saved",
-    "saveFailed": "Could not save — the settings form is unavailable."
+    "saveFailed": "Could not save — the settings form is unavailable.",
+    "mirror": "Custom registry mirror",
+    "mirrorPlaceholder": "https://registry.npmmirror.com",
+    "mirrorHint": "When set, this replaces the region preset for index sources published as npm packages. Company mirrors with a sub-path (e.g. /repository/npm) work too; leave empty to use the region preset."
   },
   "panel": {
     "title": "Agent Roster",

package/locale/zh.json

@@ -27,7 +27,10 @@
     "regionChina": "国内镜像",
     "save": "保存",
     "saved": "已保存",
-    "saveFailed": "保存失败——设置表单当前不可用。"
+    "saveFailed": "保存失败——设置表单当前不可用。",
+    "mirror": "自定义镜像地址",
+    "mirrorPlaceholder": "https://registry.npmmirror.com",
+    "mirrorHint": "填了就用它代替下载区：按 npm 包形式发布的公共档案源从这里取。支持带子路径的公司镜像（如 /repository/npm）；留空用下载区的预置。"
   },
   "panel": {
     "title": "Agent 档案",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stofone/dsh-agent-roster",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "多 Agent 团队的静态成员档案定义与校验层：档案库在面板里看得见、改得动，团队成员的人设、模型与工具边界固化成可校验、可版本化的文件，并在 dsh-agent-teams 创建成员时把档案桥接给运行时。",
   "type": "module",
   "main": "index.js",
@@ -62,7 +62,7 @@
     "yaml": "^2.9.1"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh-tools": "*"
+    "@deepseek-ai/dsh-tools": "^0.1.0-rc.1 || ^0.2.0-rc.1 || ^0.2.1-rc.1 || ^0.3.0-rc.1"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-tools": {