benchgo-plugin 0.0.0-stage → 0.0.2

package/package.json

@@ -1,6 +1,106 @@
 {
   "name": "benchgo-plugin",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "displayName": "BenchGo",
+  "version": "0.0.2",
+  "private": false,
+  "repository": { "type": "git", "url": "https://github.com/zhuogo/BenchGo.git" },
+  "publishConfig": { "access": "public" },
+  "description": "BenchGo native coding agents, shared projects, voice and enhanced Harness UI",
+  "license": "MIT",
+  "main": "src/plugin.mjs",
+  "exports": {
+    ".": "./src/plugin.mjs",
+    "./link-plugin": "./src/link-plugin.mjs",
+    "./runtime": "./src/runtime.mjs",
+    "./client": "./lib/client.js",
+    "./package.json": "./package.json",
+    "./icon": "./assets/icon.svg",
+    "./locale/*.json": "./locale/*.json"
+  },
+  "bin": {
+    "commander": "src/cli.mjs",
+    "benchgo": "src/cli.mjs"
+  },
+  "files": [
+    "src",
+    "shared",
+    "cordis.patch.yml",
+    "config.example.json",
+    "config/routergo-deepseek.example.yml",
+    "README.md",
+    "TOOL-CONFIG.md",
+    "openapi.json",
+    "VERIFICATION.md",
+    "lib",
+    "assets/fonts/web",
+    "assets/fonts/manifest.json",
+    "assets/fonts/README.md",
+    "NOTICE",
+    "PASEO-LICENSE",
+    "DEEPSEEK-LICENSE",
+    "client/assets/iconsax/LICENSE",
+    "client/assets/iconsax/SOURCE.md",
+    "locale",
+    "voice/src",
+    "voice/client/audio-worklet.js",
+    "voice/README.md",
+    "voice/VERIFICATION.md",
+    "voice/locale",
+    "voice/STREAMING.md"
+  ],
+  "engines": {
+    "node": ">=22.19.0"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mjs",
+    "test:native": "node --test test/native.mjs",
+    "start": "node src/cli.mjs",
+    "pack:check": "npm pack --dry-run --ignore-scripts",
+    "build:client": "node scripts/build-client.mjs"
+  },
+  "optionalDependencies": {
+    "@anthropic-ai/claude-agent-sdk": "0.3.300"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.5-alpha.2",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-scope": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-tools": "^0.2.1-alpha.3",
+    "esbuild": "^0.27.0"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.5-alpha.2"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-sidebar",
+        "@deepseek-ai/dsh-client-ui-workspace",
+        "@deepseek-ai/dsh-client-ui-session",
+        "@deepseek-ai/dsh-client-ui-layout",
+        "@deepseek-ai/dsh-api-session-controller",
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-model-selection",
+        "@deepseek-ai/dsh-client-ui-conversation",
+        "@deepseek-ai/dsh-client-ui-settings",
+        "@deepseek-ai/dsh-client-ui-theme",
+        "@deepseek-ai/dsh-client-ui-settings-models"
+      ],
+      "platform": "web"
+    }
+  },
+  "dependencies": {
+    "@deepseek-ai/dsh-atomic-write": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-llm": "0.2.1-alpha.3",
+    "json5": "2.2.3",
+    "jsonc-parser": "3.3.1",
+    "smol-toml": "1.9.0",
+    "tar": "7.5.22",
+    "ws": "8.19.0",
+    "yaml": "2.9.0",
+    "ssh2": "1.17.0"
+  }
+}

package/shared/plugin-install.mjs

@@ -0,0 +1,198 @@
+/** Immutable profile-local plugin releases. The profile manifest is the only activation pointer. */
+import { createHash, randomUUID } from 'node:crypto';
+import { cp, lstat, mkdir, readFile, rename, rm, symlink, realpath } from 'node:fs/promises';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { compareVersions } from './update-feed.mjs';
+
+export const PLUS_PACKAGE = 'benchgo';
+export const LEGACY_BUNDLES = ['@dowork/benchgo-desktop', '@dowork/commander', 'benchgo'];
+export const releaseBundleName = version => `@benchgo/desktop-${createHash('sha256').update(version).digest('hex').slice(0, 16)}`;
+const json = async file => JSON.parse(await readFile(file, 'utf8'));
+const present = async file => { try { await lstat(file); return true; } catch (error) { if (error.code === 'ENOENT') return false; throw error; } };
+
+export function assertReleaseVersion(version) {
+  compareVersions(version, version);
+  if (version.length > 100 || !/^[a-zA-Z0-9][a-zA-Z0-9.+-]*$/.test(version)) throw new Error('插件版本号无效');
+  return version;
+}
+
+function assertArchivePath(name) {
+  if (typeof name !== 'string' || name.length > 2048 || name.includes('\\') || isAbsolute(name)) throw new Error('更新包包含不安全路径');
+  const parts = name.replace(/\/$/, '').split('/');
+  if (parts.some(part => !part || part === '.' || part === '..' || /[<>:"|?*\x00-\x1f]/.test(part) || /[. ]$/.test(part) || /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(part))) throw new Error('更新包包含不安全路径');
+  if (parts[0] !== 'node_modules' && name !== 'release.json') throw new Error('更新包包含非插件文件');
+}
+
+async function describeRelease(directory, version) {
+  const metadata = await json(join(directory, 'release.json'));
+  const pluginPath = join(directory, 'node_modules', PLUS_PACKAGE);
+  const bundleName = releaseBundleName(version), bundlePath = join(directory, 'node_modules', bundleName);
+  const plugin = await json(join(pluginPath, 'package.json'));
+  const bundle = await json(join(bundlePath, 'package.json'));
+  if (metadata.schemaVersion !== 1 || metadata.version !== version || plugin.name !== PLUS_PACKAGE || plugin.version !== version || bundle.name !== bundleName || bundle.version !== version || bundle.dependencies?.[PLUS_PACKAGE] !== version)
+    throw new Error('插件版本目录信息不一致');
+  if (metadata.platform && metadata.platform !== process.platform) throw new Error(`此插件包适用于 ${metadata.platform}，当前系统为 ${process.platform}`);
+  if (metadata.arch && metadata.arch !== process.arch) throw new Error(`此插件包适用于 ${metadata.arch}，当前架构为 ${process.arch}`);
+  for (const file of ['src/plugin.mjs', 'lib/client.js', 'lib/link.mjs', 'lib/link-web/index.html', 'voice/src/plugin.mjs', 'cordis.patch.yml']) {
+    const stat = await lstat(join(pluginPath, file));
+    if (!stat.isFile() || stat.isSymbolicLink()) throw new Error('插件更新包缺少必要文件');
+  }
+  return { directory, version, pluginPath, bundlePath, bundleName, root: dirname(directory), shared: metadata.shared ?? [] };
+}
+
+async function attachOfficialPackages(release, runtime) {
+  if (!runtime) {
+    if (release.shared.length) throw new Error('未找到官方引擎目录，无法校验插件共享服务');
+    return;
+  }
+  runtime = await realpath(runtime);
+  const findPackage = async name => {
+    for (let current = runtime; ; current = dirname(current)) {
+      const candidate = join(current, 'node_modules', name);
+      if (await present(join(candidate, 'package.json'))) return candidate;
+      if (dirname(current) === current) return null;
+    }
+  };
+  if (await findPackage(PLUS_PACKAGE)) throw new Error('此桌面版本仍内置锁定插件，请先安装支持独立插件更新的新版应用');
+  for (const item of release.shared) {
+    const name = typeof item === 'string' ? item : item.name;
+    if (typeof name !== 'string' || !/^@deepseek-ai\/[a-z0-9][a-z0-9-]*$/.test(name)) throw new Error('插件声明了不受支持的共享服务');
+    const source = await findPackage(name), target = join(release.directory, 'node_modules', name);
+    if (!source) throw new Error(`官方引擎缺少共享服务 ${name}`);
+    const manifest = await json(join(source, 'package.json'));
+    if (typeof item === 'object' && item.version !== manifest.version) throw new Error(`共享服务 ${name} 版本不兼容，请更新应用`);
+    if (await present(target)) {
+      let current;
+      try { current = await realpath(target); } catch (error) { if (error.code !== 'ENOENT') throw error; }
+      if (current === await realpath(source)) continue;
+      if (!(await lstat(target)).isSymbolicLink()) throw new Error('插件包不得覆盖官方共享服务');
+      await rm(target, { recursive: true, force: true });
+    }
+    await mkdir(dirname(target), { recursive: true });
+    await symlink(source, target, process.platform === 'win32' ? 'junction' : 'dir');
+  }
+}
+
+/** Prepare and validate without changing the running profile. No lifecycle scripts are executed. */
+export async function prepareRelease({ archive, directory, root, version, runtime }) {
+  assertReleaseVersion(version);
+  root = resolve(root);
+  await mkdir(root, { recursive: true, mode: 0o700 });
+  const destination = join(root, version);
+  if (await present(destination)) {
+    const release = await describeRelease(destination, version);
+    await attachOfficialPackages(release, runtime);
+    return release;
+  }
+  const temporary = join(root, `.prepare-${randomUUID()}`);
+  await mkdir(temporary, { mode: 0o700 });
+  try {
+    if (directory && !archive) {
+      await cp(resolve(directory), temporary, { recursive: true, dereference: false, filter: async source => {
+        if ((await lstat(source)).isSymbolicLink()) throw new Error('离线种子不得包含符号链接');
+        return true;
+      } });
+    } else {
+      const tar = await import('tar');
+      let total = 0, count = 0;
+      let validationError;
+      const seen = new Set();
+      await tar.t({ file: archive, strict: true, onReadEntry: entry => {
+        try {
+          assertArchivePath(entry.path);
+          if (!['File', 'Directory'].includes(entry.type)) throw new Error('插件更新包不得包含链接或设备文件');
+          const normalized = entry.path.replace(/\/$/, '').toLowerCase();
+          if (seen.has(normalized)) throw new Error('插件更新包包含重复路径');
+          seen.add(normalized);
+          total += entry.size;
+          if (++count > 60_000 || total > 1024 * 1024 * 1024 || entry.size < 0) throw new Error('插件更新包解压大小超出限制');
+        } catch (error) { validationError ??= error; }
+      } });
+      if (validationError) throw validationError;
+      await tar.x({ file: archive, cwd: temporary, strict: true, preservePaths: false, noMtime: true, noChmod: true,
+        filter: (name, entry) => { assertArchivePath(name); if (!['File', 'Directory'].includes(entry.type)) throw new Error('插件更新包不得包含链接'); return true; },
+      });
+    }
+    const prepared = await describeRelease(temporary, version);
+    await attachOfficialPackages(prepared, runtime);
+    await rename(temporary, destination);
+    return await describeRelease(destination, version);
+  } catch (error) { await rm(temporary, { recursive: true, force: true }); throw error; }
+}
+
+export async function getInstallState(profile) {
+  let manifest;
+  try { manifest = await json(join(profile, 'package.json')); }
+  catch (error) { if (error.code === 'ENOENT') return { managed: false, enabled: false }; throw error; }
+  const state = manifest.dsh?.plusInstall;
+  if (!state || state.schemaVersion !== 1) return { managed: false, enabled: (manifest.dsh?.profile?.bundles ?? []).some(name => LEGACY_BUNDLES.includes(name)) };
+  return { ...state, managed: true, enabled: (manifest.dsh?.profile?.bundles ?? []).includes(state.bundleName), previous: state.previous ?? null };
+}
+
+/** Unique immutable wrapper links are created first; one manifest rename activates the whole release. */
+export async function activateRelease(options) {
+  let atomic;
+  try { atomic = await import('@deepseek-ai/dsh-atomic-write'); }
+  catch (error) {
+    if (error.code !== 'ERR_MODULE_NOT_FOUND') throw error;
+    atomic = await import(pathToFileURL(join(options.release.directory, 'node_modules/@deepseek-ai/dsh-atomic-write/lib/index.js')).href);
+  }
+  return atomic.withFileLock(join(resolve(options.profile), 'package.json'), () => activateLocked(options, atomic));
+}
+
+async function activateLocked({ profile, release, enabled, appVersion, migrateLegacy = false }, atomic) {
+  profile = resolve(profile);
+  const checked = await describeRelease(resolve(release.directory), release.version);
+  const manifestPath = join(profile, 'package.json'), manifest = await json(manifestPath);
+  if (!Array.isArray(manifest.dsh?.profile?.bundles)) throw new Error('工作区插件配置无效，原配置已保留');
+  const before = await getInstallState(profile);
+  const target = join(profile, 'node_modules', checked.bundleName);
+  await mkdir(dirname(target), { recursive: true });
+  if (await present(target)) {
+    if (await realpath(target) !== await realpath(checked.bundlePath)) throw new Error('此插件版本的安装位置已被占用');
+  } else await symlink(checked.bundlePath, target, process.platform === 'win32' ? 'junction' : 'dir');
+  const selected = manifest.dsh.profile.bundles;
+  const wasEnabled = enabled ?? (before.managed ? before.enabled : selected.some(name => LEGACY_BUNDLES.includes(name)));
+  const isManagedName = name => LEGACY_BUNDLES.includes(name) || name.startsWith('@benchgo/desktop-');
+  manifest.dependencies ??= {};
+  for (const name of Object.keys(manifest.dependencies)) if (isManagedName(name)) delete manifest.dependencies[name];
+  manifest.dependencies[checked.bundleName] = `link:${checked.bundlePath.replaceAll('\\', '/')}`;
+  manifest.dsh.profile.bundles = selected.filter(name => !isManagedName(name));
+  if (wasEnabled) manifest.dsh.profile.bundles.push(checked.bundleName);
+  const previous = before.managed && before.version !== checked.version
+    ? { version: before.version, directory: before.directory, bundleName: before.bundleName }
+    : before.previous ?? null;
+  manifest.dsh.plusInstall = { schemaVersion: 1, version: checked.version, directory: checked.directory, bundleName: checked.bundleName, root: checked.root, previous, appVersion: appVersion ?? before.appVersion ?? null };
+  // Native lookup inside the profile wins over the selected bundle's fallback.
+  // Only the offline installer may move an old package a running Host can import.
+  const shadow = join(profile, 'node_modules', PLUS_PACKAGE);
+  let backup;
+  if (await present(shadow)) {
+    const legacy = await json(join(shadow, 'package.json'));
+    if (legacy.name !== PLUS_PACKAGE) throw new Error('插件安装位置被其他内容占用，原文件已保留');
+    assertReleaseVersion(legacy.version);
+    if (migrateLegacy || await realpath(shadow) !== await realpath(checked.pluginPath)) {
+      if (!migrateLegacy) throw new Error('检测到旧版插件残留，请关闭BenchGo并重新运行新版安装程序');
+      const migrationRoot = join(profile, '.benchgo');
+      await mkdir(migrationRoot, { recursive: true, mode: 0o700 });
+      backup = join(migrationRoot, `.legacy-${randomUUID()}`);
+      await rename(shadow, backup);
+    }
+  }
+  try {
+    await atomic.writeFileAtomic(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, { mode: 0o600, dirMode: 0o700 });
+  } catch (error) {
+    if (backup) await rename(backup, shadow);
+    throw error;
+  }
+  if (backup) await rm(backup, { recursive: true, force: true });
+  return getInstallState(profile);
+}
+
+export async function rollbackRelease({ profile, runtime }) {
+  const state = await getInstallState(profile);
+  if (!state.previous) throw new Error('没有可回退的插件版本');
+  const release = await prepareRelease({ root: state.root, version: state.previous.version, runtime });
+  return activateRelease({ profile, release });
+}

package/shared/tool-quick-settings.mjs

@@ -0,0 +1,70 @@
+// Explicit, credential-free settings shared by the editor and launch adapters.
+const choices = values => values.map(value => ({ value, label: value }));
+const field = (key, label, type, path, options = {}) => ({ key, label, type, group: '快捷配置', role: 'config', path, ...options });
+const claude = [
+  field('agentTeams', '多 Agent 协作', 'boolean', ['env', 'CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS'], { role: 'settings', group: '通用配置', description: '开启 Claude Code 实验性 Agent Teams；由工具版本决定是否支持。' }),
+  field('agentWindow', 'Agent 窗口', 'select', ['teammateMode'], { role: 'settings', group: '通用配置', options: [{ value: 'in-process', label: '当前进程' }, { value: 'auto', label: '自动' }, { value: 'tmux', label: 'tmux 分屏' }, { value: 'iterm2', label: 'iTerm2 分屏' }], description: '分屏模式需要本机相应终端支持。' }),
+  field('thinking', '扩展思考', 'boolean', ['alwaysThinkingEnabled'], { role: 'settings' }),
+  field('effort', '推理强度', 'select', ['effortLevel'], { role: 'settings', options: choices(['low', 'medium', 'high', 'xhigh']) }),
+  field('disableHooks', '禁用 Hooks', 'boolean', ['disableAllHooks'], { role: 'settings' }),
+];
+const schema = {
+  claude,
+  codex: [
+    field('multiAgent', '多 Agent 协作', 'boolean', ['features', 'multi_agent'], { group: '通用配置' }),
+    field('agentThreads', '并发 Agent 数', 'number', ['agents', 'max_threads'], { group: '通用配置', min: 1, max: 32 }),
+    field('agentDepth', 'Agent 最大深度', 'number', ['agents', 'max_depth'], { group: '通用配置', min: 1, max: 8 }),
+    field('effort', '推理强度', 'select', ['model_reasoning_effort'], { options: choices(['minimal', 'low', 'medium', 'high', 'xhigh']) }),
+    field('contextWindow', '上下文窗口', 'number', ['model_context_window'], { min: 1024, max: 10000000 }),
+    field('compactLimit', '自动压缩阈值', 'number', ['model_auto_compact_token_limit'], { min: 1024, max: 10000000 }),
+  ],
+  gemini: [
+    field('previewFeatures', '预览功能', 'boolean', ['general', 'previewFeatures'], { role: 'settings' }),
+    field('promptCompletion', '提示词自动补全', 'boolean', ['general', 'enablePromptCompletion'], { role: 'settings' }),
+    field('maxTurns', '会话最大轮数', 'number', ['model', 'maxSessionTurns'], { role: 'settings', min: 1, max: 10000 }),
+  ],
+  opencode: [
+    field('autoUpdate', '自动更新', 'boolean', ['autoupdate']),
+    field('snapshot', '文件快照', 'boolean', ['snapshot']),
+    field('share', '会话分享', 'select', ['share'], { options: [{ value: 'disabled', label: '关闭' }, { value: 'manual', label: '手动' }, { value: 'auto', label: '自动' }] }),
+  ],
+  openclaw: [
+    field('concurrency', '并发 Agent 数', 'number', ['agents', 'defaults', 'maxConcurrent'], { group: '通用配置', min: 1, max: 32 }),
+    field('contextWindow', '上下文窗口', 'number', ['agents', 'defaults', 'contextTokens'], { min: 1024, max: 10000000 }),
+  ],
+  pi: [
+    field('thinking', '思考级别', 'select', ['defaultThinkingLevel'], { role: 'settings', options: choices(['off', 'minimal', 'low', 'medium', 'high', 'xhigh']) }),
+    field('compaction', '自动压缩', 'boolean', ['compaction', 'enabled'], { role: 'settings' }),
+    field('retry', '失败重试', 'boolean', ['retry', 'enabled'], { role: 'settings' }),
+  ],
+  hermes: [
+    field('maxTurns', 'Agent 最大轮数', 'number', ['agent', 'max_turns'], { min: 1, max: 10000 }),
+    field('effort', '推理强度', 'select', ['agent', 'reasoning_effort'], { options: choices(['low', 'medium', 'high']) }),
+  ],
+  grok: [
+    field('contextWindow', '上下文窗口', 'number', ['model', 'benchgo', 'context_window'], { min: 1024, max: 10000000 }),
+  ],
+};
+export function quickSettingsFor(tool) { return structuredClone(schema[tool] || []); }
+export function validateQuickSettings(tool, input = {}) {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('快捷配置必须为对象');
+  const fields = schema[tool] || [], result = {};
+  for (const [key, value] of Object.entries(input)) {
+    const spec = fields.find(item => item.key === key);
+    if (!spec) throw new Error('此工具不支持快捷配置：' + key);
+    if (spec.type === 'boolean' && typeof value !== 'boolean' || spec.type === 'select' && !spec.options.some(option => option.value === value) || spec.type === 'number' && (!Number.isSafeInteger(value) || value < spec.min || value > spec.max)) throw new Error('无效的快捷配置：' + spec.label);
+    result[key] = value;
+  }
+  if (result.compactLimit && result.contextWindow && result.compactLimit > result.contextWindow) throw new Error('自动压缩阈值不能超过上下文窗口');
+  return result;
+}
+export function quickSettingsPatches(tool, input = {}) {
+  const values = validateQuickSettings(tool, input), result = {};
+  for (const spec of schema[tool] || []) {
+    if (!Object.hasOwn(values, spec.key)) continue;
+    let target = result[spec.role] ??= {};
+    for (const key of spec.path.slice(0, -1)) target = target[key] ??= {};
+    target[spec.path.at(-1)] = spec.key === 'agentTeams' ? (values[spec.key] ? '1' : '0') : values[spec.key];
+  }
+  return result;
+}

package/shared/update-feed.mjs

@@ -0,0 +1,191 @@
+import { createHash, createPublicKey, verify } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+
+export const UPDATE_REPOSITORY = 'zhuogo/BenchGo';
+export const DEFAULT_UPDATE_CONFIG = Object.freeze({ source: 'mirror', mirrorUrl: 'https://ghfast.top/' });
+export const MAX_PLUGIN_BYTES = 256 * 1024 * 1024;
+const releaseBase = `https://github.com/${UPDATE_REPOSITORY}/releases/`;
+const metadataUrl = `${releaseBase}download/plugin-updates/benchgo-update.json`;
+
+export class UpdateFeedError extends Error {
+  constructor(code, message, options) { super(message, options); this.name = 'UpdateFeedError'; this.code = code; }
+}
+const fail = (code, message) => { throw new UpdateFeedError(code, message); };
+
+function mirrorPrefix(value) {
+  let parsed;
+  try { parsed = new URL(value); } catch { fail('UPDATE_SOURCE', '更新镜像地址无效'); }
+  if (parsed.protocol !== 'https:' || parsed.username || parsed.password || parsed.search || parsed.hash)
+    fail('UPDATE_SOURCE', '更新镜像须使用不含凭据、查询参数和片段的 HTTPS 地址');
+  return `${parsed.href.replace(/\/+$/, '')}/`;
+}
+
+export function normalizeUpdateConfig(config = {}) {
+  const source = config.source ?? DEFAULT_UPDATE_CONFIG.source;
+  if (!['mirror', 'github', 'custom'].includes(source)) fail('UPDATE_SOURCE', '未知更新源');
+  if (source === 'custom' && !config.mirrorUrl) fail('UPDATE_SOURCE', '请填写自定义 HTTPS 镜像地址');
+  const mirrorUrl = source === 'custom' ? mirrorPrefix(config.mirrorUrl) : DEFAULT_UPDATE_CONFIG.mirrorUrl;
+  return { source, mirrorUrl };
+}
+
+export function releaseDownloadUrl(filename, tag = 'latest') {
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(filename) || !/^[a-zA-Z0-9][a-zA-Z0-9._+-]*$/.test(tag))
+    fail('UPDATE_URL', '更新文件名或版本标签无效');
+  return tag === 'latest' ? `${releaseBase}latest/download/${filename}` : `${releaseBase}download/${tag}/${filename}`;
+}
+
+export function filenameFromReleaseUrl(value, { metadata = false } = {}) {
+  if (typeof value !== 'string' || !value.startsWith(releaseBase)) fail('UPDATE_URL', '仅支持本仓库的 GitHub Release 下载地址');
+  const suffix = value.slice(releaseBase.length);
+  const match = suffix.match(/^download\/([a-zA-Z0-9][a-zA-Z0-9._+-]*)\/([a-zA-Z0-9][a-zA-Z0-9._-]*)$/)
+    || (metadata && suffix.match(/^(latest)\/download\/(benchgo-update\.json(?:\.sig)?)$/));
+  if (!match) fail('UPDATE_URL', '更新下载地址无效');
+  return match[2];
+}
+
+export function resolveUpdateUrl(url, config = DEFAULT_UPDATE_CONFIG) {
+  filenameFromReleaseUrl(url, { metadata: true });
+  const normalized = normalizeUpdateConfig(config);
+  return normalized.source === 'github' ? url : `${normalized.mirrorUrl}${url}`;
+}
+
+function parseVersion(value) {
+  if (typeof value !== 'string' || value.length > 128) fail('UPDATE_VERSION', '版本号无效');
+  const match = value.match(/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/);
+  if (!match) fail('UPDATE_VERSION', `版本号无效：${value}`);
+  const prerelease = match[4]?.split('.') ?? [];
+  if (prerelease.some(part => /^\d+$/.test(part) && part.length > 1 && part.startsWith('0'))) fail('UPDATE_VERSION', '预发布版本号无效');
+  return { parts: match.slice(1, 4).map(BigInt), prerelease };
+}
+
+export function compareVersions(left, right) {
+  const a = parseVersion(left), b = parseVersion(right);
+  for (let index = 0; index < 3; index++) if (a.parts[index] !== b.parts[index]) return a.parts[index] > b.parts[index] ? 1 : -1;
+  if (!a.prerelease.length || !b.prerelease.length) return a.prerelease.length === b.prerelease.length ? 0 : a.prerelease.length ? -1 : 1;
+  for (let index = 0; index < Math.max(a.prerelease.length, b.prerelease.length); index++) {
+    const x = a.prerelease[index], y = b.prerelease[index];
+    if (x === undefined || y === undefined) return x === undefined ? -1 : 1;
+    if (x === y) continue;
+    const nx = /^\d+$/.test(x), ny = /^\d+$/.test(y);
+    if (nx && ny) return BigInt(x) > BigInt(y) ? 1 : -1;
+    if (nx !== ny) return nx ? -1 : 1;
+    return x > y ? 1 : -1;
+  }
+  return 0;
+}
+export const isNewerVersion = (candidate, current) => compareVersions(candidate, current) > 0;
+export function isEngineCompatible(version, range) {
+  if (!range || typeof range !== 'object' || !range.min) return false;
+  return compareVersions(version, range.min) >= 0 && (!range.max || compareVersions(version, range.max) <= 0);
+}
+
+function validateArtifact(artifact, { plugin = false } = {}) {
+  if (!artifact || typeof artifact !== 'object') fail('UPDATE_MANIFEST', '更新包信息缺失');
+  parseVersion(artifact.version);
+  const filename = filenameFromReleaseUrl(artifact.url);
+  if (plugin && !filename.endsWith('.tar.gz')) fail('UPDATE_MANIFEST', '插件更新包格式须为 tar.gz');
+  if (plugin || artifact.sha256 !== undefined) {
+    if (!/^[a-f0-9]{64}$/.test(artifact.sha256)) fail('UPDATE_MANIFEST', '更新包校验值无效');
+  }
+  if (plugin || artifact.size !== undefined) {
+    if (!Number.isSafeInteger(artifact.size) || artifact.size <= 0 || (plugin && artifact.size > MAX_PLUGIN_BYTES)) fail('UPDATE_MANIFEST', '更新包大小无效');
+  }
+}
+
+export function validateReleaseManifest(manifest) {
+  if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest) || manifest.schemaVersion !== 1)
+    fail('UPDATE_MANIFEST', '不支持的更新清单格式');
+  parseVersion(manifest.version);
+  if (!manifest.engine || typeof manifest.engine !== 'object') fail('UPDATE_MANIFEST', '缺少引擎兼容信息');
+  parseVersion(manifest.engine.min);
+  if (manifest.engine.max !== undefined && compareVersions(manifest.engine.max, manifest.engine.min) < 0) fail('UPDATE_MANIFEST', '引擎兼容范围无效');
+  validateArtifact(manifest.plugin, { plugin: true });
+  if (manifest.version !== manifest.plugin.version) fail('UPDATE_MANIFEST', '插件版本与清单版本不一致');
+  if (manifest.app !== undefined) validateArtifact(manifest.app);
+  if (manifest.notes !== undefined && (typeof manifest.notes !== 'string' || manifest.notes.length > 16_384)) fail('UPDATE_MANIFEST', '更新说明过长或格式无效');
+  return manifest;
+}
+
+function allowedRedirect(url, initial) {
+  const parsed = new URL(url);
+  const allowedHosts = new Set([new URL(initial).hostname, 'github.com', 'release-assets.githubusercontent.com', 'objects.githubusercontent.com']);
+  if (parsed.protocol !== 'https:' || parsed.username || parsed.password || parsed.hash || !allowedHosts.has(parsed.hostname) || (parsed.port && parsed.port !== '443'))
+    fail('UPDATE_REDIRECT', '更新源返回了不受信任的跳转地址');
+}
+
+export async function fetchUpdateBytes(url, { config = DEFAULT_UPDATE_CONFIG, fetcher = globalThis.fetch, maxBytes = 256 * 1024, timeoutMs = 20_000 } = {}) {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 1 || !Number.isFinite(timeoutMs) || timeoutMs < 1) fail('UPDATE_REQUEST', '更新请求限制无效');
+  const initial = resolveUpdateUrl(url, config), controller = new AbortController();
+  let timer;
+  try {
+    return await Promise.race([
+      (async () => {
+        let target = initial;
+        for (let redirects = 0; redirects <= 4; redirects++) {
+          const response = await fetcher(target, { signal: controller.signal, redirect: 'manual', credentials: 'omit', headers: { accept: 'application/octet-stream' } });
+          if ([301, 302, 303, 307, 308].includes(response.status)) {
+            const location = response.headers.get('location');
+            await response.body?.cancel();
+            if (!location || redirects === 4) fail('UPDATE_REDIRECT', '更新源跳转次数过多或地址缺失');
+            target = new URL(location, target).href;
+            allowedRedirect(target, initial);
+            continue;
+          }
+          if (!response.ok) {
+            await response.body?.cancel();
+            throw Object.assign(new UpdateFeedError('UPDATE_HTTP', `更新源请求失败（HTTP ${response.status}）`), { httpStatus: response.status });
+          }
+          const length = response.headers.get('content-length');
+          if (length && (!/^\d+$/.test(length) || Number(length) > maxBytes)) { await response.body?.cancel(); fail('UPDATE_SIZE', '更新文件超过允许大小'); }
+          if (!response.body) fail('UPDATE_BODY', '更新源返回空响应');
+          const reader = response.body.getReader(), chunks = [];
+          let size = 0;
+          try {
+            while (true) {
+              const { done, value } = await reader.read();
+              if (done) break;
+              size += value.byteLength;
+              if (size > maxBytes) { await reader.cancel(); fail('UPDATE_SIZE', '更新文件超过允许大小'); }
+              chunks.push(Buffer.from(value));
+            }
+          } finally { reader.releaseLock(); }
+          return Buffer.concat(chunks, size);
+        }
+      })(),
+      new Promise((_, reject) => { timer = setTimeout(() => { controller.abort(); reject(new UpdateFeedError('UPDATE_TIMEOUT', '更新源响应超时，请重试或切换更新源')); }, timeoutMs); }),
+    ]);
+  } catch (error) {
+    if (error instanceof UpdateFeedError) throw error;
+    throw new UpdateFeedError('UPDATE_NETWORK', '无法连接更新源，请检查网络或切换更新源', { cause: error });
+  } finally { clearTimeout(timer); }
+}
+
+export async function fetchVerifiedRelease({ config = DEFAULT_UPDATE_CONFIG, publicKey, fetcher = globalThis.fetch, timeoutMs = 20_000 } = {}) {
+  const downloaded = await Promise.allSettled([
+    fetchUpdateBytes(metadataUrl, { config, fetcher, timeoutMs }).catch(error => {
+      if (error.httpStatus === 404) throw new UpdateFeedError('UPDATE_UNPUBLISHED', '更新通道尚未就绪');
+      throw error;
+    }),
+    fetchUpdateBytes(`${metadataUrl}.sig`, { config, fetcher, timeoutMs, maxBytes: 4096 }),
+    publicKey || readFile(new URL('./update-public-key.pem', import.meta.url)),
+  ]);
+  for (const result of downloaded) if (result.status === 'rejected') throw result.reason;
+  const [bytes, signatureBytes, trustedKey] = downloaded.map(result => result.value);
+  const encoded = signatureBytes.toString('utf8').trim();
+  if (!/^[A-Za-z0-9+/]{86}==$/.test(encoded)) fail('UPDATE_SIGNATURE', '更新清单签名格式无效');
+  let valid = false;
+  try {
+    const key = createPublicKey(trustedKey);
+    valid = key.asymmetricKeyType === 'ed25519' && verify(null, bytes, key, Buffer.from(encoded, 'base64'));
+  } catch { fail('UPDATE_SIGNATURE', '更新公钥或签名无效'); }
+  if (!valid) fail('UPDATE_SIGNATURE', '更新清单签名校验失败');
+  let manifest;
+  try { manifest = JSON.parse(bytes.toString('utf8')); } catch { fail('UPDATE_MANIFEST', '更新清单不是有效 JSON'); }
+  return validateReleaseManifest(manifest);
+}
+
+export function verifyArtifact(bytes, artifact) {
+  if (bytes.byteLength !== artifact.size) fail('UPDATE_SIZE', '更新包大小与清单不一致');
+  if (createHash('sha256').update(bytes).digest('hex') !== artifact.sha256) fail('UPDATE_HASH', '更新包完整性校验失败');
+  return bytes;
+}

package/shared/update-public-key.pem

@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAYx5ksgw4EsLvIBRB/Ke2dbcpGdzgiRlNqkEhcD1ygs4=
+-----END PUBLIC KEY-----