dsh-code-server-app 0.1.37 → 0.1.39

package/README.en.md

@@ -10,7 +10,7 @@
 > - Microsoft **open-source** extensions (Python, TypeScript debugger, ESLint, …) are mirrored on Open VSX and install normally by search;
 > - **If you need a proprietary Microsoft extension**: download the `.vsix` from the Marketplace page and install it manually with `code-server --install-extension <file>` (or drop it into `--extensions-dir`).
 
-A static profile plugin (npm package with host + client bundle) that **bundles** [code-server](https://github.com/coder/code-server) in the package itself (a pack-time artifact at `vendor/code-server`, with no install scripts and no postinstall) and runs it in place from the plugin directory. VS Code's inner dependencies and the prebuilt native modules are **all installed by the package manager together with the plugin** — no global npm install, no `bin` configuration, no profile config changes, no second install command.
+A static profile plugin (npm package with host + client bundle) that ships [code-server](https://github.com/coder/code-server) as a **platform-specific sub-package dependency** (a pack-time artifact at `vendor/code-server` → `@jinsiyu/dshcs-code-server-<platform>-<arch>`, with no install scripts and no postinstall) and runs it outside the plugin directory. VS Code's inner dependencies and the prebuilt native modules are **all installed by the package manager together with the plugin** — no global npm install, no `bin` configuration, no profile config changes, no second install command.
 
 ## UI carrier (chosen by the DSH version, feature-detected at runtime)
 
@@ -59,51 +59,56 @@ cd C:\Users\User\Desktop\dsh-code-server-app
 pnpm install             # dev deps (esbuild + motion); allowBuilds is explicit → no postinstall runs
 pnpm run build:client    # src/factory.js → lib/client.js (not committed; must be built first)
 pnpm run vendor:check    # optional: show the bundled code-server version vs npm latest
-pnpm run vendor:code-server                     # produce vendor/code-server (code-server + its own deps)
-node scripts/vendor-repacks.mjs --target win32-arm64,win32-x64 --pack   # build/repack prebuilt natives
-pnpm run publish:repacks                        # publish @jinsiyu/dshcs-* and the platform aggregators
-pnpm pack                                       # → dsh-code-server-app-<version>.tgz (~59MB)
-npm publish dsh-code-server-app-<version>.tgz --access public   # publish the plugin itself (same verified tarball)
+pnpm run vendor:code-server                     # ① produce vendor/code-server (code-server + its own deps)
+pnpm run repack:code-server -- --target win32-arm64,win32-x64 --pack   # ② platform sub-packages (incl. argon2)
+node scripts/vendor-repacks.mjs --target win32-arm64,win32-x64 --pack   # ③ build/repack the VS Code natives
+pnpm run publish:repacks                        # ④ publish every @jinsiyu/* sub-package
+pnpm pack                                       # ⑤ → dsh-code-server-app-<version>.tgz (~105KB)
+npm publish dsh-code-server-app-<version>.tgz --access public   # ⑥ publish the plugin itself (same verified tarball)
 ```
 
 | Goal | Command |
 |---|---|
-| **Build the latest code-server from npm** | `pnpm run vendor:latest` (= `--force`): snapshots `code-server@latest` into `vendor/code-server`; afterwards you **must** re-run `vendor-repacks.mjs` and republish the prebuilt natives |
+| **Build the latest code-server from npm** | `pnpm run vendor:latest` (= `--force`): snapshots `code-server@latest` into `vendor/code-server`; afterwards you **must** re-run `repack:code-server` (republish the sub-packages) and `vendor-repacks.mjs` (the inner dependency versions change) |
 | **Pin a version** | `pnpm run vendor:code-server -- --version 4.136.2` |
 | **Snapshot from an existing tree** | `pnpm run vendor:code-server -- --from <code-server dir>` (seconds) |
+| **Rebuild the code-server sub-packages** | `pnpm run repack:code-server -- --target win32-arm64,win32-x64 --pack` (x64 compiles argon2 and checks the PE machine type) |
 | **Rebuild prebuilt natives** | `node scripts/vendor-repacks.mjs [--from <existing full install>] --target win32-arm64,win32-x64 --pack` (without `--from` it npm-installs and compiles the source tree itself — slow) |
-| **Publish prebuilt natives** | `pnpm run publish:repacks` (`--dry-run` to preview; `--only <substr>` to filter; `--otp <code>` / `--limit N` for 2FA) |
+| **Publish sub-packages** | `pnpm run publish:repacks` (`--dry-run` to preview; `--only <substr>` to filter; `--otp <code>` / `--limit N` for 2FA) |
 | **Publish the plugin itself** | `npm publish dsh-code-server-app-<version>.tgz --access public` (publishes the exact tarball that was verified; no re-packing) |
 | **Just report versions** | `pnpm run vendor:check` |
 
 > `pnpm pack`'s `prepack` runs the vendor-code-server script once; when `vendor/code-server` already exists it is
 > a **no-op that takes seconds**, so after ordinary code changes you can just run `pnpm pack` (it will never
 > silently upgrade code-server). Upgrading code-server requires an explicit `pnpm run vendor:latest`
-> (or `--force` / `--version`) **plus** republishing the prebuilt natives.
+> (or `--force` / `--version`) **plus** republishing the sub-packages.
 
 ## Install the plugin (one command; all dependencies installed by the package manager)
 
 ```powershell
 # no postinstall in the package → no pnpm approve-builds / allowBuilds; one command installs everything
-dsh plugin --profile web add dsh-code-server-app@0.1.36
+dsh plugin --profile web add dsh-code-server-app@0.1.37
 # a local tarball works the same way:
-dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app\dsh-code-server-app-0.1.36.tgz
+dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app\dsh-code-server-app-0.1.37.tgz
 ```
 
-Ready to use immediately — **no second step, no "Install environment", no install-guide modal**:
+Ready to use immediately — **no second step, no "Install environment", no install-guide modal**.
+Since 0.1.37 the main package is only **~105KB** (the plugin's own code); everything else is dependencies:
 
-- the `code-server` tree (`vendor/code-server/`) ships inside the plugin package and **runs in place** from the
-  plugin directory (`<profile>\node_modules\dsh-code-server-app\vendor\code-server\out\node\entry.js`);
+- **the code-server tree** (`lib/vscode` 196.9MB + its own 136 runtime dependencies) ships as a **platform-specific
+  sub-package** `@jinsiyu/dshcs-code-server-<platform>-<arch>@<code-server version>` (gated by `os`/`cpu`, listed in
+  the plugin's `optionalDependencies`) → pnpm picks the right one for the architecture; it runs from
+  `<profile>\node_modules\@jinsiyu\dshcs-code-server-win32-arm64\code-server`;
 - the **pure-JS part** of VS Code's inner dependencies (35 packages: xterm / katex / typescript / ws / tar …) is
   declared in the plugin's `dependencies` and installed by pnpm into the profile's `node_modules` (hoisted);
 - the **packages that need compiling** (node-pty / @vscode/sqlite3 / kerberos / koffi / ssh2 / cpu-features /
   @parcel/watcher / @vscode/windows-* … 16 in total) are provided as prebuilt `@jinsiyu/dshcs-*` packages,
   pulled back under their **original names** by the **platform aggregator**
-  `@jinsiyu/dsh-code-server-runtime-<platform>-<arch>` using `npm:` aliases. The aggregators sit in the plugin's
-  `optionalDependencies` (gated by `os`/`cpu`), so pnpm **auto-selects the right one for the current
-  architecture**;
+  `@jinsiyu/dsh-code-server-runtime-<platform>-<arch>` using `npm:` aliases;
 - consequently the dependency graph contains **no package with pre/install/postinstall or a `binding.gyp`** →
-  no profile `allowBuilds`, no build script ever runs, and **the user machine needs no C++ toolchain**.
+  no profile `allowBuilds`, no build script ever runs, and **the user machine needs no C++ toolchain**;
+- **upgrading the plugin no longer re-downloads code-server**: the sub-package is cached by version, so only a
+  code-server version change pulls those ~58MB again.
 
 ### Install mechanism (why it is built this way)
 
@@ -112,11 +117,16 @@ Ready to use immediately — **no second step, no "Install environment", no inst
   "requires build" and must be approved through the **host profile's** `pnpm-workspace.yaml` (`allowBuilds`),
   otherwise `dsh plugin add` exits 1 with `[ERR_PNPM_IGNORED_BUILDS]`. A dependency's own `pnpm.allowBuilds`,
   `.npmrc`, the `patch:` protocol and `optionalDependencies` are all ineffective (measured 2026-09, pnpm 11.25);
-- **the code-server tree** therefore ships as plain files instead of a `dependencies` entry. At pack time
-  `npm install code-server@<version> --ignore-scripts` (skips the official `sh ./postinstall.sh` — there is no
-  `sh` on Windows and the script only accepts npm/yarn user agents, so it always fails under pnpm) → supply the
-  argon2 native binary (no Windows prebuild exists; compile with `node-gyp-build`, or reuse an existing
-  `argon2.node` via `DSHCS_ARGON2_BINARY`) → strip leftover install scripts → snapshot to `vendor/code-server/`;
+- **the code-server tree** is prepared at pack time with `npm install code-server@<version> --ignore-scripts`
+  (skips the official `sh ./postinstall.sh` — there is no `sh` on Windows and the script only accepts npm/yarn
+  user agents, so it always fails under pnpm) → supply the argon2 native binary (no Windows prebuild exists;
+  compile with `node-gyp-build`, or reuse an existing `argon2.node` via `DSHCS_ARGON2_BINARY`) → strip leftover
+  install scripts → snapshot to `vendor/code-server/`;
+- `scripts/vendor-code-server-pkg.mjs` then turns it into **platform sub-packages**: the tree lives in an inner
+  `code-server/` directory (npm/pnpm packing **always excludes the package root's `node_modules`**; a subdirectory
+  covered by `files` is included), and the sub-package declares **no `dependencies`** (those 136 packages are
+  already files inside `code-server/node_modules`; declaring them would make pnpm install a second copy).
+  `os`/`cpu` gated, each with its own compiled argon2 (arm64 0xaa64 / x64 0x8664);
 - **packages that need compiling** are repacked by `scripts/vendor-repacks.mjs` into `@jinsiyu/dshcs-*`:
   copy the already-compiled package directory → **delete `scripts` / `files` / `binding.gyp` / `.hooks` /
   `.npmignore`** (keeping the compiled `.node` and every runtime file) → rewrite dependencies that belong to the
@@ -125,14 +135,21 @@ Ready to use immediately — **no second step, no "Install environment", no inst
   `"node-pty": "npm:@jinsiyu/dshcs-node-pty@1.2.0-beta.15"`), so VS Code's `require('node-pty')` needs no change.
   The aggregator itself is `os`/`cpu` gated, and the plugin declares both win32-arm64 and win32-x64 in
   `optionalDependencies` → one command picks the right one automatically;
-- **resolution path**: from `vendor/code-server/out/node/entry.js` Node walks
-  `<plugin>/vendor/code-server/node_modules` → `<plugin>/node_modules` → `<profile>/node_modules`; the profile's
-  `nodeLinker: hoisted` puts every dependency into `<profile>/node_modules`, exactly what the runtime sees.
-
-> **Size note**: the plugin tarball is **~59MB** (bundled code-server is 232MB unpacked); the inner dependencies
-> and prebuilt natives are downloaded by pnpm (roughly 300–350MB, ~250MB of it native packages). Neither
-> `vendor/` nor `repack/` is tracked by git (see `.gitignore`), but `vendor/` **must** ship in the npm package
-> (the main `files` list includes it).
+- **resolution path**: the host resolves the runtime root with
+  `require.resolve('@jinsiyu/dshcs-code-server-<platform>-<arch>/package.json')` (then the inner `code-server/`
+  directory) and launches `code-server/out/node/entry.js`; VS Code's inner dependencies are resolved upward from
+  there: `code-server/node_modules` → the sub-package's `node_modules` → `<profile>/node_modules` (hoisted
+  layout), exactly what the runtime sees. The in-package `vendor/code-server` is only a development/legacy
+  fallback.
+
+> **Size note**: the plugin tarball is **~105KB**; each `@jinsiyu/dshcs-code-server-win32-*` sub-package is
+> **~58–60MB** (249MB unpacked); the inner dependencies and prebuilt natives add ~250MB. A full install downloads
+> roughly 310MB. Neither `vendor/` nor `repack/` is tracked by git (see `.gitignore`).
+
+> **Upgrading from ≤ 0.1.36**: the in-package `vendor/code-server/` moved into the platform sub-packages and the
+> main package shrank to ~105KB. The upgrade command is unchanged
+> (`dsh plugin --profile web add dsh-code-server-app@<version>`); the old `vendor/` disappears with the old
+> package directory.
 
 > **Upgrading from ≤ 0.1.35**: the old install root `<profile>\.code-server-app` (with ~1.4GB of inner
 > dependencies) and the "Install environment" step are gone. The new version detects the old root and logs that it
@@ -140,9 +157,10 @@ Ready to use immediately — **no second step, no "Install environment", no inst
 > `dsh-code-server-app: false` entries in the profile's `pnpm-workspace.yaml` can be removed too (no build
 > approval is needed any more).
 
-> **Uninstall**: `dsh plugin --profile web remove dsh-code-server-app` is enough (the plugin directory contains the
-> code-server tree and is deleted with it); if an old install root is still around, delete
-> `<profile>\.code-server-app` manually.
+> **Uninstall**: `dsh plugin --profile web remove dsh-code-server-app` is enough; the code-server sub-package and
+> the natives are separate dependencies, so to remove everything run e.g.
+> `dsh plugin --profile web remove @jinsiyu/dshcs-code-server-win32-arm64` (or `pnpm remove` inside the profile);
+> if an old install root is still around, delete `<profile>\.code-server-app` manually.
 
 > After install/dependency changes, **restart `dsh web`** (the static plugin row and host probe paths load at startup).
 
@@ -196,19 +214,22 @@ dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app
   **latest** version; or use `pnpm run vendor:code-server -- --version 4.136.2` / `DSHCS_CODE_SERVER_VERSION`.
   With an existing `vendor/code-server`, a plain `pnpm pack` never upgrades (it is a no-op).
 - **Check first**: `pnpm run vendor:check` prints the bundled version / npm latest.
-- **A version bump requires republishing the prebuilt natives** (the inner dependency versions change with
-  code-server): `node scripts/vendor-repacks.mjs --target win32-arm64,win32-x64 --pack` →
-  `pnpm run publish:repacks` → bump the plugin version → `pnpm pack`. The script rewrites the plugin's
-  `dependencies` (the pure-JS set) and both aggregator versions.
+- **A version bump requires republishing two kinds of sub-packages** (the inner dependency versions change with
+  code-server):
+  1. `pnpm run repack:code-server -- --target win32-arm64,win32-x64 --pack` → the new code-server sub-packages;
+  2. `node scripts/vendor-repacks.mjs --target win32-arm64,win32-x64 --pack` → the prebuilt natives (also rewrites
+     the plugin's pure-JS `dependencies` and both aggregator versions);
+  3. `pnpm run publish:repacks` → publish; then bump the plugin version → `pnpm pack` → publish the plugin.
 - **No runtime auto-upgrade anymore**: nothing fetches latest at startup; the version is fully determined by the bundled artifact.
 - Bundled locally right now: `code-server@4.136.2` (with Code 1.136.1).
 
 ### Compatibility with the old install locations
 
-Host probe order: `<plugin>/vendor/code-server` (**the real layout, runs in place**) > the old install root
-`<profile>\.code-server-app\node_modules\code-server` (0.1.35 and earlier, only when the in-package tree is
-missing) > plugin-internal `node_modules/code-server` (development) > PATH/config `bin`. The old root is only
-mentioned in a startup log line; nothing writes to it any more.
+Host probe order: `@jinsiyu/dshcs-code-server-<platform>-<arch>/code-server` (**the real layout since 0.1.37**) >
+the in-package `vendor/code-server` (0.1.36 and earlier / development) > the old install root
+`<profile>\.code-server-app\node_modules\code-server` (0.1.35 and earlier) > plugin-internal
+`node_modules/code-server` (development) > PATH/config `bin`. The old root is only mentioned in a startup log
+line; nothing writes to it any more.
 
 ## Settings card (Settings → Plugins → Code Server)
 
@@ -233,7 +254,7 @@ package manager, and the card only reports the result.
 
 | Key | Default | Description |
 |---|---|---|
-| `bin` | `code-server` (placeholder) | Launch priority: explicit `bin` in config > the in-package `vendor/code-server/out/node/entry.js` > the old install root `.code-server-app` > plugin-internal `node_modules` > `code-server` on PATH. None present → startup error with troubleshooting hints |
+| `bin` | `code-server` (placeholder) | Launch priority: explicit `bin` in config > the platform sub-package `@jinsiyu/dshcs-code-server-<platform>-<arch>/code-server/out/node/entry.js` > the in-package `vendor/code-server` > the old install root `.code-server-app` > plugin-internal `node_modules` > `code-server` on PATH. None present → startup error with troubleshooting hints |
 | `host` | `127.0.0.1` | Bind address; `auth: none` only allows loopback (localhost/127.0.0.1/::1) |
 | `port` | `8090` | Port; on conflict startup fails with diagnostics (no automatic port change) |
 | `auth` | `none` | `none` \| `password`; non-loopback host automatically requires password |

package/README.md

@@ -11,7 +11,8 @@
 > - **需要微软专有扩展时**:从 Marketplace 网页下载 `.vsix`,用 `code-server --install-extension <文件>`(或放入 `--extensions-dir`)手动安装,即可在插件列表使用。
 
 静态 profile 插件(npm 包形态,host + client bundle),把 [code-server](https://github.com/coder/code-server)
-**内置在插件包里**(打包期产物 `vendor/code-server`,无安装脚本、无 postinstall),插件目录里就地运行;
+**以平台专属子包的形式随插件依赖安装**(打包期产物 `vendor/code-server` → `@jinsiyu/dshcs-code-server-<平台>-<架构>`,
+无安装脚本、无 postinstall),插件目录外就地运行;
 VS Code 内部依赖与预编译原生模块**全部由包管理器随插件一起装好** —— 无需全局 npm 安装、无需配置 `bin`、
 无需改 profile 配置、无需第二条安装命令。
 
@@ -55,9 +56,10 @@ VS Code 内部依赖与预编译原生模块**全部由包管理器随插件一
   "打包(如何出包)"执行 `pnpm install` → `pnpm run build:client` → `pnpm run vendor:code-server` →
   (发布预编译原生包)→ `pnpm pack` + `dsh plugin --profile web add` 即可。
 
-> 本机(BM: Windows 11 ARM64)实测:`code-server@4.136.2`(with Code 1.136.1)随插件包内置、
-> 依赖(35 个纯 JS + 16 个预编译原生包,经平台聚合包装回原名)由 pnpm 一条命令装好 →
-> 插件就地运行 → healthz 200 → 运行中切换 cwd 重启 → 停止 → 回收全链路验证。
+> 本机(BM: Windows 11 ARM64)实测:`code-server@4.136.2`(with Code 1.136.1)由平台子包
+> `@jinsiyu/dshcs-code-server-win32-arm64` 提供(主包 0.1.37 仅 105KB),
+> 35 个纯 JS 内部依赖 + 16 个预编译原生包(经平台聚合包装回原名)由 pnpm 一条命令装好 →
+> healthz 200 → 运行中切换 cwd 重启 → 停止 → 回收全链路验证。
 
 ## 打包(如何出包)
 
@@ -66,48 +68,54 @@ cd C:\Users\User\Desktop\dsh-code-server-app
 pnpm install             # 开发依赖(esbuild + motion);allowBuilds 已显式声明 → 不执行任何 postinstall
 pnpm run build:client    # src/factory.js → lib/client.js(不入库,必须先构建)
 pnpm run vendor:check    # 可选:查看内置 code-server 版本 vs npm 最新版
-pnpm run vendor:code-server                      # 生成 vendor/code-server(code-server 本体 + 自身依赖)
-node scripts/vendor-repacks.mjs --target win32-arm64,win32-x64 --pack   # 生成/重打包预编译原生包
-pnpm run publish:repacks                         # 发布 @jinsiyu/dshcs-* 与平台聚合包(需 npm 登录)
-pnpm pack                                        # → dsh-code-server-app-<version>.tgz(约 59MB)
-npm publish dsh-code-server-app-<version>.tgz --access public   # 发布插件本体(同一次验证的 tarball)
+pnpm run vendor:code-server                      # ① 生成 vendor/code-server(code-server 本体 + 自身依赖)
+pnpm run repack:code-server -- --target win32-arm64,win32-x64 --pack   # ② 打成平台专属子包(含 argon2 原生)
+node scripts/vendor-repacks.mjs --target win32-arm64,win32-x64 --pack   # ③ 生成/重打包 VS Code 原生包
+pnpm run publish:repacks                         # ④ 发布全部 @jinsiyu/* 子包(需 npm 登录)
+pnpm pack                                        # ⑤ → dsh-code-server-app-<version>.tgz(约 105KB)
+npm publish dsh-code-server-app-<version>.tgz --access public   # ⑥ 发布插件本体(同一次验证的 tarball)
 ```
 
 | 目标 | 命令 |
 |---|---|
-| **打 npm 最新版 code-server** | `pnpm run vendor:latest`(= `--force`):从 registry 取 `code-server@latest` 快照到 `vendor/code-server`;之后**必须**重跑 `vendor-repacks.mjs` 更新预编译原生包并发布 |
+| **打 npm 最新版 code-server** | `pnpm run vendor:latest`(= `--force`):从 registry 取 `code-server@latest` 快照到 `vendor/code-server`;之后**必须**重跑 `repack:code-server`(重发子包)与 `vendor-repacks.mjs`(内部依赖版本会变) |
 | **指定版本** | `pnpm run vendor:code-server -- --version 4.136.2` |
 | **从已装好的树快照** | `pnpm run vendor:code-server -- --from <code-server 目录>`(秒级) |
+| **重打 code-server 子包** | `pnpm run repack:code-server -- --target win32-arm64,win32-x64 --pack`(x64 会现编 argon2 并校验 PE) |
 | **重建预编译原生包** | `node scripts/vendor-repacks.mjs [--from <已完整安装的树>] --target win32-arm64,win32-x64 --pack`(不给 `--from` 会自己 npm install 解包 + 编译,耗时) |
-| **发布预编译原生包** | `pnpm run publish:repacks`(`--dry-run` 预览;`--only <子串>` 过滤;`--otp <code>` / `--limit N` 应对 2FA) |
+| **发布子包** | `pnpm run publish:repacks`(`--dry-run` 预览;`--only <子串>` 过滤;`--otp <code>` / `--limit N` 应对 2FA) |
 | **发布插件本体** | `npm publish dsh-code-server-app-<version>.tgz --access public`(发布**已验证过的那份 tarball**,不会重新打包) |
 | **只报告版本** | `pnpm run vendor:check` |
 
 > `pnpm pack` 的 `prepack` 会自动跑一次 `vendor-code-server` 脚本;`vendor/code-server` 已存在时它是
 > **秒级 no-op**,所以日常只改插件代码的话直接 `pnpm pack` 即可(不会偷偷升级 code-server)。
-> 升级 code-server 必须显式 `pnpm run vendor:latest`(或 `--force`/`--version`),并重发预编译包。
+> 升级 code-server 必须显式 `pnpm run vendor:latest`(或 `--force`/`--version`),并重发子包。
 
 ## 安装插件(一条命令;依赖全部由包管理器装好)
 
 ```powershell
 # 包内无 postinstall → 无需 pnpm approve-builds / allowBuilds;一条命令装完
-dsh plugin --profile web add dsh-code-server-app@0.1.36
+dsh plugin --profile web add dsh-code-server-app@0.1.37
 # 本地 tarball 同理:
-dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app\dsh-code-server-app-0.1.36.tgz
+dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app\dsh-code-server-app-0.1.37.tgz
 ```
 
-装完即用,**没有第二步、没有「安装环境」、不弹安装指引**:
+装完即用,**没有第二步、没有「安装环境」、不弹安装指引**。0.1.37 起主包只有 **~105KB**(插件自身代码),
+其余全部是依赖:
 
-- `code-server` 本体(`vendor/code-server/`)随插件包发布,**就在插件目录里就地运行**
-  (`<profile>\node_modules\dsh-code-server-app\vendor\code-server\out\node\entry.js`);
+- **code-server 本体**(含 `lib/vscode` 196.9MB + 它自带的 136 个运行时依赖)打成**平台专属子包**
+  `@jinsiyu/dshcs-code-server-<platform>-<arch>@<code-server 版本>`(os/cpu 限定,
+  挂在插件 `optionalDependencies`)→ pnpm 按架构自动选中,运行根在
+  `<profile>\node_modules\@jinsiyu\dshcs-code-server-win32-arm64\code-server`;
 - VS Code 内部依赖里**纯 JS 的部分**(35 个:xterm / katex / typescript / ws / tar …)写在插件
-  `dependencies`,由 pnpm 随插件一起装到 profile 的 `node_modules`(hoisted);
+  `dependencies`,由 pnpm 装到 profile 的 `node_modules`(hoisted);
 - **需要编译的原生包**(node-pty / @vscode/sqlite3 / kerberos / koffi / ssh2 / cpu-features /
   @parcel/watcher / @vscode/windows-* …共 16 个)由 `@jinsiyu/dshcs-*` 预编译包提供,
   经**平台聚合包** `@jinsiyu/dsh-code-server-runtime-<platform>-<arch>` 用 `npm:` 别名装回**原始名字**;
-  聚合包挂在插件 `optionalDependencies` 上(os/cpu 限定)→ pnpm **按架构自动选中**当前平台那一份;
 - 因此依赖图里**没有任何带 pre/install/postinstall 或 binding.gyp 的包** →
-  不需要 profile 的 `allowBuilds`、不执行任何构建、**使用者机器不需要 C++ 工具链**。
+  不需要 profile 的 `allowBuilds`、不执行任何构建、**使用者机器不需要 C++ 工具链**;
+- **升级插件不再重下 code-server**:子包版本按 code-server 版本缓存,pnpm 会直接复用;
+  只有 code-server 版本变化时才重新下载那 ~58MB。
 
 ### 安装机制(为什么这样设计)
 
@@ -115,32 +123,43 @@ dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app\dsh-code-
   的包都被判定"需要构建",必须由**宿主 profile** 的 `pnpm-workspace.yaml` 用 `allowBuilds` 批准,
   否则 `dsh plugin add` 直接 `[ERR_PNPM_IGNORED_BUILDS]` exit 1。依赖包自己的 `pnpm.allowBuilds`、
   `.npmrc`、`patch:` 协议、`optionalDependencies` 全都不起作用(实测 2026-09,pnpm 11.25);
-- **code-server 本体**因此以普通文件随包发布(而不是写进 `dependencies`)。打包期
-  `npm install code-server@<版本> --ignore-scripts`(跳过官方 `sh ./postinstall.sh`:Windows 无 sh,
-  且它只认 npm/yarn 的 user-agent)→ 补齐 argon2 native(win32-arm64 无预编译;可复用本机已有
-  `argon2.node`,见 `DSHCS_ARGON2_BINARY`)→ 剥掉残留安装脚本 → 快照到 `vendor/code-server/`;
-- **需要编译的包**由 `scripts/vendor-repacks.mjs` 在打包期重打包成 `@jinsiyu/dshcs-*`:
+- **code-server 本体**打包期用 `npm install code-server@<版本> --ignore-scripts`(跳过官方
+  `sh ./postinstall.sh`:Windows 无 sh,且它只认 npm/yarn 的 user-agent)拿到树 → 补齐 argon2 native
+  (win32-arm64 上游无预编译;可复用本机已有 `argon2.node`,见 `DSHCS_ARGON2_BINARY`)→
+  剥掉残留安装脚本 → 快照到 `vendor/code-server/`;
+- 随后 `scripts/vendor-code-server-pkg.mjs` 把它打成**平台子包**:树放在包内子目录 `code-server/`
+  (npm/pnpm 打包**永远排除包根目录的 node_modules**,放在被 `files` 覆盖的子目录里才会随包发布),
+  子包**不写 `dependencies`**(那 136 个依赖已经作为文件打包在 `code-server/node_modules` 里,
+  写成 dependencies 会让 pnpm 再装一份);`os`/`cpu` 限定 + 各自编译好的 argon2(arm64 0xaa64 / x64 0x8664);
+- **需要编译的包**由 `scripts/vendor-repacks.mjs` 重打包成 `@jinsiyu/dshcs-*`:
   复制已编译的包目录 → **删除 `scripts` / `files` / `binding.gyp` / `.hooks` / `.npmignore`**
   (保留编译好的 `.node` 与全部运行时文件)→ 依赖里的同集包改成 `npm:` 别名 → 平台专属的加
   `os`/`cpu` 与 `-<platform>-<arch>` 后缀;
 - **平台聚合包**把重打包包按原始名字装回去(如 `"node-pty": "npm:@jinsiyu/dshcs-node-pty@1.2.0-beta.15"`),
   于是 VS Code 内部代码 `require('node-pty')` 不用改;聚合包本身 `os`/`cpu` 限定,
   插件 `optionalDependencies` 同时声明 win32-arm64 与 win32-x64 两份 → 一条命令自动选对;
-- **解析路径**:`vendor/code-server/out/node/entry.js` 向上查找 →
-  `<插件>/vendor/code-server/node_modules` → `<插件>/node_modules` → `<profile>/node_modules`,
-  profile 的 `nodeLinker: hoisted` 让所有依赖都落在 `<profile>/node_modules`,与运行时一致。
+- **解析路径**:host 用 `require.resolve('@jinsiyu/dshcs-code-server-<平台>-<架构>/package.json')`
+  找到运行根(子目录 `code-server/`),入口 `code-server/out/node/entry.js`;
+  VS Code 内部依赖从该运行根向上查找:`code-server/node_modules` → 子包 `node_modules` →
+  `<profile>/node_modules`(hoisted 布局),与运行时完全一致。包内 `vendor/code-server` 仅作
+  开发期/兼容回退。
 
-> **体积提示**:插件 tarball 约 **59MB**(内置 code-server 解包 232MB);内部依赖与预编译原生包
-> 由 pnpm 另行下载(约 300–350MB,其中原生包 ~250MB)。`vendor/` 与 `repack/` 都不入 git
-> (见 `.gitignore`),但 `vendor/` **必须**随 npm 包发布(`files` 已包含)。
+> **体积提示**:插件 tarball 约 **105KB**;`@jinsiyu/dshcs-code-server-win32-*` 子包各约 **58–60MB**
+> (解包 ~249MB);内部依赖与预编译原生包约 250MB。全部合计安装下载约 310MB。
+> `vendor/` 与 `repack/` 都不入 git(见 `.gitignore`)。
+
+> **从 ≤ 0.1.36 升级**:插件包内的 `vendor/code-server/` 已移出到平台子包,主包瘦身到 ~105KB;
+> 升级命令不变(一条 `dsh plugin --profile web add dsh-code-server-app@<版本>`),
+> 旧的 `vendor/` 会随旧版本包目录一起被 pnpm 清掉。
 
 > **从 ≤ 0.1.35 升级**:旧版的安装根 `<profile>\.code-server-app`(含约 1.4GB 内部依赖)与
 > 「安装环境」步骤都不再需要 —— 新版本会检测到它并打一条日志提示可安全删除:
 > `Remove-Item -Recurse -Force <profile>\.code-server-app`。profile 的 `pnpm-workspace.yaml` 里
 > 若还留着 `dsh-code-server-app: false` 之类的旧条目,也可以删掉(新版不再需要任何构建许可)。
 
-> **卸载**:`dsh plugin --profile web remove dsh-code-server-app` 即可(插件目录含 code-server 本体,
-> 一并删除);若还残留旧安装根,再手动删除 `<profile>\.code-server-app`。
+> **卸载**:`dsh plugin --profile web remove dsh-code-server-app` 即可;code-server 子包与原生包
+> 是独立依赖,若要彻底清干净可再 `dsh plugin --profile web remove @jinsiyu/dshcs-code-server-win32-arm64`
+> (或直接在 profile 里 `pnpm remove`);若还残留旧安装根,再手动删除 `<profile>\.code-server-app`。
 
 > 安装/依赖变化后请**重启 `dsh web`**(静态插件行与 host 探测路径在启动时加载)。
 
@@ -151,8 +170,9 @@ dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app
 ```
 
 > 源码路径以 `link:` 安装。开发机上没有 `vendor/code-server` 时先 `pnpm run vendor:code-server`;
-> 依赖(内部 JS 依赖 + 平台聚合包)同样由 pnpm 安装 —— 但本地未发布的 `@jinsiyu/*` 需要先发布,
-> 或把 `repack/tgz/*.tgz` 以 `file:` 依赖临时装进 profile。
+> 没有平台子包时 host 会回退到包内 `vendor/code-server`(两种布局都支持)。
+> 依赖(内部 JS 依赖 + 平台子包 + 聚合包)同样由 pnpm 安装 —— 本地未发布的 `@jinsiyu/*` 需先发布,
+> 或把 `repack/tgz/*.tgz` 以 `file:` 依赖临时装进 profile(见 `.tmp-verify.mjs`)。
 >
 > **改动 client bundle**:编辑 `src/factory.js` 后执行 `pnpm run build:client`
 > 重新生成 `lib/client.js`(仓库不跟踪该产物;浏览器刷新即生效,host 无需重启)。
@@ -191,17 +211,19 @@ dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app
   也可 `pnpm run vendor:code-server -- --version 4.136.2` 或设 `DSHCS_CODE_SERVER_VERSION`。
   已有 `vendor/code-server` 时,不带 `--force`/`--version` 不会升级(日常 `pnpm pack` 是 no-op)。
 - **先查再升**:`pnpm run vendor:check` 打印「内置版本 / npm latest」。
-- **换版本后必须重发预编译原生包**(内部依赖版本会跟着 code-server 变):
-  `node scripts/vendor-repacks.mjs --target win32-arm64,win32-x64 --pack` →
-  `pnpm run publish:repacks` → bump 插件版本 → `pnpm pack`。
-  脚本会把新的「纯 JS 直装集」写进插件 `dependencies`,并更新两个聚合包的版本号。
+- **换版本后要重发两类子包**(内部依赖版本会跟着 code-server 变):
+  1. `pnpm run repack:code-server -- --target win32-arm64,win32-x64 --pack` → 新版本号的 code-server 平台子包;
+  2. `node scripts/vendor-repacks.mjs --target win32-arm64,win32-x64 --pack` → 预编译原生包(并把新的
+     「纯 JS 直装集」写进插件 `dependencies`、更新两个聚合包版本);
+  3. `pnpm run publish:repacks` → 发布;然后 bump 插件版本 → `pnpm pack` → 发布插件。
 - **不再有运行期自动升级**:不会在启动时联网取 latest;版本完全由内置产物决定。
 - 本机当前内置:`code-server@4.136.2`(with Code 1.136.1)。
 
 ### 兼容旧安装位
 
-host 探测顺序:`<插件>/vendor/code-server`(**正式布局,就地运行**)> 旧版安装根
-`<profile>\.code-server-app\node_modules\code-server`(兼容 0.1.35 及更早,仅当插件包内缺失时)> 插件包内
+host 探测顺序:`@jinsiyu/dshcs-code-server-<平台>-<架构>/code-server`(**0.1.37+ 正式布局**)> 插件包内
+`vendor/code-server`(0.1.36 及更早 / 开发期)> 旧版安装根
+`<profile>\.code-server-app\node_modules\code-server`(兼容 0.1.35 及更早)> 插件包内
 `node_modules/code-server`(开发期)> PATH/配置 `bin`。旧安装根只在启动日志里提示可删除,不再被写入。
 
 ## 设置卡片(设置 → 插件 → Code Server)
@@ -226,7 +248,7 @@ host 探测顺序:`<插件>/vendor/code-server`(**正式布局,就地运行**)>
 
 | 键 | 默认 | 说明 |
 |---|---|---|
-| `bin` | `code-server`(占位) | 启动优先级:本配置显式 `bin` > 插件包内 `vendor/code-server/out/node/entry.js` > 旧安装根 `.code-server-app` > 插件包内 `node_modules` > PATH 中的 `code-server`。都不存在时启动报错并给出排查提示 |
+| `bin` | `code-server`(占位) | 启动优先级:本配置显式 `bin` > 平台子包 `@jinsiyu/dshcs-code-server-<平台>-<架构>/code-server/out/node/entry.js` > 包内 `vendor/code-server` > 旧安装根 `.code-server-app` > 插件包内 `node_modules` > PATH 中的 `code-server`。都不存在时启动报错并给出排查提示 |
 | `host` | `127.0.0.1` | 绑定地址;`auth: none` 仅允许回环(localhost/127.0.0.1/::1) |
 | `port` | `8090` | 端口;被占用时启动失败并给出诊断(不自动换端口) |
 | `auth` | `none` | `none` \| `password`;非回环 host 自动要求 password |

package/lib/index.js

@@ -213,7 +213,9 @@ function declaredInnerDeps() {
   }
 }
 
-/** 从 code-server 运行位置解析内部依赖(与运行时同一套向上查找规则)。 */
+/** 从 code-server 运行位置解析内部依赖(与运行时同一套向上查找规则)。
+ *  先试 `<name>/package.json`(code-server 本体包没有入口文件,ESM-only 包也没有 require 入口),
+ *  再退回 `<name>` 本身。 */
 function checkInnerDeps() {
   const declared = declaredInnerDeps();
   const root = codeServerRoot();
@@ -221,22 +223,42 @@ function checkInnerDeps() {
   const missing = [];
   let resolved = 0;
   for (const name of declared) {
-    try {
-      from.resolve(name);
-      resolved += 1;
-    } catch {
-      missing.push(name);
+    let ok = false;
+    for (const spec of [`${name}/package.json`, name]) {
+      try {
+        from.resolve(spec);
+        ok = true;
+        break;
+      } catch { /* 试下一个 */ }
     }
+    if (ok) resolved += 1;
+    else missing.push(name);
   }
   return { declared: declared.length, resolved, missing };
 }
 
+/** 从 code-server 运行位置解析某个模块的包目录(与运行时同一套向上查找规则)。
+ *  先试 `<name>/package.json`,再退回模块入口。找不到返回 null。 */
+function resolveModuleDir(fromDir, name) {
+  try {
+    const from = createRequire(path.join(fromDir ?? PACKAGE_ROOT, 'package.json'));
+    for (const spec of [`${name}/package.json`, name]) {
+      try {
+        return path.dirname(from.resolve(spec));
+      } catch { /* 试下一个 */ }
+    }
+  } catch { /* 解析器不可用 */ }
+  return null;
+}
+
 /** 环境检测:code-server 入口 + 原生模块(argon2) + 内部依赖 + 预编译原生包。
  * 返回 { ok, entry, native, vscodeInner, innerDeps, codeServer, vendored, upToDate, nativeRuntime, node, platform, arch }。 */
 function envCheck() {
   const entry = bundledRuntimeEntry();
   const csRoot = entry ? path.dirname(path.dirname(path.dirname(entry))) : null; // .../code-server
-  const argon2 = csRoot !== null ? path.join(csRoot, 'node_modules', 'argon2') : null;
+  // argon2 不在 code-server 本体包里(它由平台包 @<scope>/dshcs-argon2-<平台>-<架构> 提供,
+  // 经聚合包用 npm: 别名装回原名)→ 按运行时同一套规则解析它的真实位置。
+  const argon2 = resolveModuleDir(csRoot, 'argon2');
   // 必须按当前平台判定:argon2 的 prebuilds 目录存在不代表本平台有二进制(win32-arm64 就缺)。
   const nativeOk = argon2 !== null && (
     fs.existsSync(path.join(argon2, 'build', 'Release', 'argon2.node')) ||

package/lib/vendor.js

@@ -37,27 +37,37 @@ export function legacyInstallRoot() {
   return profileRoot !== null ? join(profileRoot, APP_DIR_NAME) : null;
 }
 
-/** 本平台 code-server 子包名:优先取插件 optionalDependencies 里匹配 <平台>-<架构> 的声明。 */
-export function codeServerPackageName(platform = process.platform, arch = process.arch) {
-  const key = `${platform}-${arch}`;
+/** code-server 本体包名(0.1.38+ 平台无关):取插件 dependencies 里的 @<scope>/dshcs-code-server。 */
+export function codeServerPackageName() {
   try {
     const manifest = JSON.parse(readFileSync(join(PACKAGE_ROOT, 'package.json'), 'utf8'));
-    const declared = { ...(manifest.optionalDependencies ?? {}), ...(manifest.dependencies ?? {}) };
-    const hit = Object.keys(declared).find((name) => /dshcs-code-server-/.test(name) && name.endsWith(`-${key}`));
+    const declared = { ...(manifest.dependencies ?? {}), ...(manifest.optionalDependencies ?? {}) };
+    const hit = Object.keys(declared).find((name) => /^@[^/]+\/dshcs-code-server$/.test(name));
     if (hit !== undefined) return hit;
   } catch { /* 回退默认 scope */ }
-  return `@jinsiyu/dshcs-code-server-${key}`;
+  return '@jinsiyu/dshcs-code-server';
 }
 
-/** code-server 运行根(优先依赖安装的平台子包,其次包内 vendor)。
- *  @returns {string|null} 绝对路径,如 <profile>\node_modules\@jinsiyu\dshcs-code-server-win32-arm64\code-server */
-export function codeServerRoot() {
-  const name = codeServerPackageName();
+/** 旧版(0.1.37)平台专属 code-server 子包名,仅作兼容回退。 */
+export function legacyCodeServerPackageName(platform = process.platform, arch = process.arch) {
+  return `@jinsiyu/dshcs-code-server-${platform}-${arch}`;
+}
+
+/** 解析某个包目录下的 code-server 运行根(包内布局:<pkg>/code-server/**)。 */
+function rootOfPackage(name) {
   try {
     const manifest = require_.resolve(`${name}/package.json`);
     const root = join(dirname(manifest), 'code-server');
     if (existsSync(join(root, 'out', 'node', 'entry.js'))) return root;
-  } catch { /* 子包未安装 */ }
+  } catch { /* 未安装 */ }
+  return null;
+}
+
+/** code-server 运行根:① 本体包(0.1.38+ 平台无关)> ② 旧平台子包(0.1.37)> ③ 包内 vendor(开发期)。
+ *  @returns {string|null} 绝对路径,如 <profile>\node_modules\@jinsiyu\dshcs-code-server\code-server */
+export function codeServerRoot() {
+  const root = rootOfPackage(codeServerPackageName()) ?? rootOfPackage(legacyCodeServerPackageName());
+  if (root !== null) return root;
   if (existsSync(join(VENDOR_TREE, 'out', 'node', 'entry.js'))) return VENDOR_TREE;
   return null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-code-server-app",
-  "version": "0.1.37",
+  "version": "0.1.39",
   "description": "Integrate code-server (VS Code in the browser) into DSH Web and Desktop: right-sidebar tab (DSH >= 0.1.5-alpha.1) with a floating-ball fallback for older hosts, over the Connection /api channel (ctx.connection.fetch; no webServer dependency) with host-side process lifecycle.",
   "homepage": "https://github.com/jinsiyu/dsh-code-server-app",
   "repository": {
@@ -46,7 +46,6 @@
     "assets/favicon.svg",
     "assets/extensions/dshcs-open-file",
     "scripts/vendor-code-server.mjs",
-    "scripts/vendor-code-server-pkg.mjs",
     "scripts/vendor-repacks.mjs",
     "vendor/VENDOR.json",
     "cordis.patch.yml",
@@ -60,6 +59,7 @@
   },
   "license": "MIT",
   "dependencies": {
+    "@jinsiyu/dshcs-code-server": "4.136.2",
     "@microsoft/1ds-core-js": "3.2.13",
     "@microsoft/1ds-post-js": "3.2.13",
     "@vscode/iconv-lite-umd": "0.7.1",
@@ -97,17 +97,14 @@
     "zod": "4.4.3"
   },
   "optionalDependencies": {
-    "@jinsiyu/dsh-code-server-runtime-win32-arm64": "^0.1.37",
-    "@jinsiyu/dsh-code-server-runtime-win32-x64": "^0.1.37",
-    "@jinsiyu/dshcs-code-server-win32-arm64": "4.136.2",
-    "@jinsiyu/dshcs-code-server-win32-x64": "4.136.2"
+    "@jinsiyu/dsh-code-server-runtime-win32-arm64": "^0.1.38",
+    "@jinsiyu/dsh-code-server-runtime-win32-x64": "^0.1.38"
   },
   "scripts": {
     "vendor:code-server": "node scripts/vendor-code-server.mjs",
     "vendor:latest": "node scripts/vendor-code-server.mjs --force",
     "vendor:check": "node scripts/vendor-code-server.mjs --check",
     "repack:build": "node scripts/vendor-repacks.mjs",
-    "repack:code-server": "node scripts/vendor-code-server-pkg.mjs",
     "publish:repacks": "node scripts/publish-repacks.mjs",
     "build:client": "node scripts/build-client.mjs"
   }

package/scripts/vendor-repacks.mjs

@@ -1,19 +1,20 @@
-// scripts/vendor-repacks.mjs — 打包期把「pnpm 拒绝安装」的包重打包成可安装的预编译包。
+// scripts/vendor-repacks.mjs — 打包期把 code-server 本体与「pnpm 拒绝安装」的原生包全部打成可安装的预编译包。
 //
 // 为什么:pnpm 认为「含安装脚本」或「含 binding.gyp / .hooks」的包需要构建,必须由宿主
-// pnpm-workspace.yaml 的 allowBuilds 批准,否则 dsh plugin add 直接 exit 1。VS Code 内部
-// 依赖里有一批这样的包(含原生模块),既不能在 profile 里声明为依赖,也不能靠 pnpm 装。
+// pnpm-workspace.yaml 的 allowBuilds 批准,否则 dsh plugin add 直接 exit 1。code-server 本体、
+// argon2 与 VS Code 内部依赖里的一批原生包都属于这一类。
 //
-// 做法(实测可行,见下):
-//   1. 从一棵**已完整安装**的 code-server 树出发,算出 needsRepack 闭包(带构建信号,以及依赖链
-//      上命中它们的包 —— 含 optionalDependencies,例如 @vscode/proxy-agent → @vscode/windows-ca-certs);
-//   2. 每个命中包重新打包成 @<scope>/dshcs-<名字>:
-//        - 删掉全部 scripts / files 字段、binding.gyp、.hooks、.npmignore(全量打包,保住 build/*.node);
-//        - 依赖里命中重打包集的,改成 npm: 别名;
-//        - 含「非 prebuilds 的 .node」的包视为平台专属 → 名字带 -<platform>-<arch>,并写入 os/cpu;
-//   3. 生成平台聚合包 @<scope>/dsh-code-server-runtime-<platform>-<arch>,dependencies 用 npm: 别名
-//      把重打包包装回**原始名字**(node-pty / @vscode/sqlite3 / …),这样 VS Code 的 require 不用改;
-//   4. 把「纯 JS 直装集」写进插件 package.json 的 dependencies,把两个平台聚合包写进 optionalDependencies。
+// 产物(全部由本脚本统一生成,再由 scripts/publish-repacks.mjs 统一发布):
+//   ① @<scope>/dshcs-code-server@<code-server 版本>          平台无关:vendor/code-server 的树
+//      (out/ + lib/vscode + 自带运行时依赖),**去掉 node_modules/argon2**;
+//   ② @<scope>/dshcs-argon2-<platform>-<arch>@<argon2 版本>   平台专属:argon2 + 该架构编译好的 .node
+//      (与其它原生包同一套规则:删 scripts/files/binding.gyp、删 prebuilds 统一走 build/Release);
+//   ③ @<scope>/dshcs-<名字>[-<platform>-<arch>]@<版本>        VS Code 内部依赖里需要构建的包
+//      (node-pty / @vscode/sqlite3 / kerberos / koffi / ssh2 / …),
+//      依赖链上命中它们的包也一并重打包(含 optionalDependencies,如 @vscode/proxy-agent → windows-ca-certs);
+//   ④ @<scope>/dsh-code-server-runtime-<platform>-<arch>@<插件版本>  平台聚合包:
+//      dependencies 用 npm: 别名把 ②③ 装回**原始名字**(argon2 / node-pty / @vscode/sqlite3 / …),
+//      这样 code-server 与 VS Code 的 require 不用改,插件只需按 os/cpu 声明 ①(常规依赖)+ ④(可选依赖)。
 //
 // 结果:pnpm install 不再遇到任何带构建信号的包 → 无需 allowBuilds、无需「安装环境」步骤。
 //
@@ -48,6 +49,10 @@ const argValue = (n) => { const a = argValues(n); return a.length > 0 ? a[a.leng
 const FROM = argValue('--from');
 const SCOPE = argValue('--scope') ?? '@jinsiyu';
 const DO_PACK = process.argv.includes('--pack');
+// --reuse:复用 repack/build 里已有的原生包(不重新 analyze/交叉编译),只重建
+//          code-server 本体包、argon2 平台包、平台聚合包与插件 package.json。
+//          适用于「原生包没变、只调整打包结构」的场景(本机已无可分析的完整源树时也用它)。
+const REUSE = process.argv.includes('--reuse');
 const TARGETS = argValues('--target');
 // Copilot 整树排除:620MB、依赖链里还有带脚本的包,且 code-server 里用不到。
 const EXCLUDE = [/^@github\//, /^@vscode\/copilot-api$/];
@@ -309,22 +314,233 @@ function prepareSourceTree() {
   return tree;
 }
 
+/** PE machine(0x8664=x64 / 0xaa64=arm64),用于交叉编译后的静态校验。 */
+function peMachine(file) {
+  try {
+    const b = readFileSync(file);
+    if (b[0] !== 0x4d || b[1] !== 0x5a) return null;
+    const off = b.readUInt32LE(0x3c);
+    if (b.toString('ascii', off, off + 4) !== 'PE\u0000\u0000') return null;
+    return `0x${b.readUInt16LE(off + 4).toString(16)}`;
+  } catch { return null; }
+}
+
+function nodeGypCli() {
+  const cli = join(process.env.APPDATA ?? '', 'npm', 'node_modules', 'node-gyp', 'bin', 'node-gyp.js');
+  if (!existsSync(cli)) throw new Error('找不到 node-gyp(需全局安装 node-gyp)');
+  return cli;
+}
+
+/** ① code-server 本体(平台无关):vendor/code-server → repack/build/code-server/。
+ *  去掉平台专属的 node_modules/argon2 —— 它由 @<scope>/dshcs-argon2-<platform>-<arch> 按架构提供。 */
+function buildCodeServerPackage() {
+  const vendorTree = join(pkgRoot, 'vendor', 'code-server');
+  if (!existsSync(join(vendorTree, 'out', 'node', 'entry.js'))) {
+    throw new Error('缺少 vendor/code-server;先运行 `node scripts/vendor-code-server.mjs`');
+  }
+  const version = readJson(join(vendorTree, 'package.json'))?.version;
+  if (typeof version !== 'string') throw new Error('读不到 code-server 版本');
+  const dir = join(OUT, 'build', 'code-server');
+  rmSync(dir, { recursive: true, force: true });
+  mkdirSync(dir, { recursive: true });
+  console.log(`[repack] code-server 本体(平台无关)→ ${relative(pkgRoot, join(dir, 'code-server'))}(argon2 由平台包提供)`);
+  cpSync(vendorTree, join(dir, 'code-server'), {
+    recursive: true,
+    dereference: false,
+    maxRetries: 6,
+    retryDelay: 250,
+  });
+  // 删掉平台专属的 argon2(整目录,避免嵌套解析遮蔽 <profile>/node_modules/argon2)
+  rmSync(join(dir, 'code-server', 'node_modules', 'argon2'), { recursive: true, force: true });
+  writeFileSync(join(dir, 'package.json'), JSON.stringify({
+    name: `${SCOPE}/dshcs-code-server`,
+    version,
+    description: `code-server ${version} (out/ + lib/vscode + its runtime dependencies), repacked so pnpm installs it `
+      + `without any build script. The platform-specific argon2 binary is provided by ${SCOPE}/dshcs-argon2-<platform>-<arch>.`,
+    files: ['code-server'],
+    license: 'MIT',
+    repository: readJson(join(pkgRoot, 'package.json'))?.repository ?? undefined,
+  }, null, 2) + '\n', 'utf8');
+  const name = `${SCOPE}/dshcs-code-server`;
+  return { dir, name, version, file: tgzName(name, version) };
+}
+
+/** ② argon2 平台二进制包(每个目标一个):@<scope>/dshcs-argon2-<target>@<argon2 版本>。
+ *  与其它原生包同一套规则:删 scripts/files/binding.gyp,保留 build/Release 里的 .node;
+ *  prebuilds/ 一律删掉(统一走 build/Release,避免 node-gyp-build 在 win32-x64 选到上游 .glibc 命名文件)。 */
+function buildArgon2Package(target) {
+  const [platform, arch] = target.split('-');
+  const src = join(pkgRoot, 'vendor', 'code-server', 'node_modules', 'argon2');
+  if (!existsSync(join(src, 'package.json'))) throw new Error('缺少 vendor/code-server/node_modules/argon2');
+  const version = readJson(join(src, 'package.json')).version;
+  const dir = join(OUT, 'build', `argon2-${target}`);
+  rmSync(dir, { recursive: true, force: true });
+  mkdirSync(dirname(dir), { recursive: true });
+  cpSync(src, dir, { recursive: true, maxRetries: 6, retryDelay: 250 }); // dest 不存在 → 内容平铺到 dir
+  rmSync(join(dir, 'build'), { recursive: true, force: true }); // 重新编译,避免带走 host 架构产物
+
+  console.log(`[repack] argon2 ${target}: node-gyp rebuild --arch=${arch} …`);
+  const res = spawnSync(process.execPath, [nodeGypCli(), 'rebuild', `--arch=${arch}`], { cwd: dir, stdio: 'inherit' });
+  if ((res.status ?? 1) !== 0) throw new Error(`argon2 ${target} 编译失败 (${res.status})`);
+  // 编译完成后才剥掉构建信号:删 prebuilds(统一走 build/Release)、binding.gyp、中间产物
+  rmSync(join(dir, 'prebuilds'), { recursive: true, force: true });
+  rmSync(join(dir, 'binding.gyp'), { force: true });
+  rmSync(join(dir, '.npmignore'), { force: true });
+  rmSync(join(dir, 'build', 'gyp'), { recursive: true, force: true }); // 中间产物,别进包
+  const bin = join(dir, 'build', 'Release', 'argon2.node');
+  if (!existsSync(bin)) throw new Error(`argon2 ${target} 缺 build/Release/argon2.node`);
+  const want = arch === 'x64' ? '0x8664' : arch === 'arm64' ? '0xaa64' : null;
+  const machine = peMachine(bin);
+  if (want !== null && machine !== want) throw new Error(`argon2 ${target} PE machine=${machine},期望 ${want}`);
+
+  const manifest = readJson(join(dir, 'package.json'));
+  delete manifest.scripts;
+  delete manifest.files;
+  manifest.name = `${SCOPE}/dshcs-argon2-${target}`;
+  manifest.version = version;
+  manifest.os = [platform];
+  manifest.cpu = [arch];
+  writeFileSync(join(dir, 'package.json'), JSON.stringify(manifest, null, 2) + '\n', 'utf8');
+  console.log(`  ✓ argon2 ${target} → ${machine} (${manifest.name}@${version})`);
+  return { dir, name: manifest.name, version, file: tgzName(manifest.name, version) };
+}
+
+/** 从已安装的 profile 的 node_modules 还原 host 平台映射(别名目录名 = 原始包名,清单名 = 重打包名)。
+ *  聚合包清单丢失时的兜底(例如上次构建中途失败)。 */
+function hostMapFromProfile() {
+  const dshHome = process.env.DSH_HOME || join(process.env.USERPROFILE ?? process.env.HOME ?? '', '.dsh');
+  const profiles = join(dshHome, 'profiles');
+  if (!existsSync(profiles)) return null;
+  let best = null;
+  let bestProfile = null;
+  for (const name of readdirSync(profiles)) {
+    const nm = join(profiles, name, 'node_modules');
+    if (!existsSync(nm)) continue;
+    const map = new Map();
+    const visit = (dir, prefix) => {
+      let entries; try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return; }
+      for (const ent of entries) {
+        if (!ent.isDirectory() || ent.name === '.bin' || ent.name === '.pnpm') continue;
+        const full = join(dir, ent.name);
+        if (ent.name.startsWith('@')) { visit(full, prefix + ent.name + '/'); continue; }
+        const m = readJson(join(full, 'package.json'));
+        if (m === null || typeof m.name !== 'string') continue;
+        if (!/^@[^/]+\/dshcs-/.test(m.name) || /dshcs-code-server/.test(m.name)) continue;
+        map.set(`${prefix}${ent.name}`, { pkgName: m.name, version: m.version });
+      }
+    };
+    visit(nm, '');
+    if (map.size > 0 && (best === null || map.size > best.size)) { best = map; bestProfile = name; }
+  }
+  if (best !== null) {
+    console.log(`[repack] --reuse:从 profile ${bestProfile} 的别名还原 ${best.size} 个映射`);
+  }
+  return best;
+}
+
+/** --reuse:从现有 repack/build + 聚合包清单还原「重打包集」,不重新分析源树。
+ *  @returns {{repack: Map<string,{pkg:{version:string},platformSpecific:boolean}>, declare:{name:string,version:string}[], reusedItems:{dir:string,file:string}[]}} */
+function reuseExisting(targets, hostKey) {
+  const buildRoot = join(OUT, 'build');
+  if (!existsSync(buildRoot)) throw new Error('--reuse 需要 repack/build 已存在(先跑一次完整流程)');
+  const byTarget = new Map();
+  for (const target of targets) {
+    const agg = readJson(join(OUT, 'aggregator', target, 'package.json'));
+    if (agg === null) continue;
+    const map = new Map();
+    for (const [orig, spec] of Object.entries(agg.dependencies ?? {})) {
+      if (orig === 'argon2') continue; // argon2 由本脚本重建
+      const hit = /^npm:(.+)@([^@]+)$/.exec(spec);
+      if (hit === null) throw new Error(`无法解析聚合包依赖 ${orig}: ${spec}`);
+      map.set(orig, { pkgName: hit[1], version: hit[2] });
+    }
+    byTarget.set(target, map);
+  }
+  if (byTarget.size === 0) {
+    const base = hostMapFromProfile();
+    if (base === null) {
+      throw new Error('--reuse 需要 repack/aggregator/*/package.json 或一个已安装的 profile 用于还原映射');
+    }
+    byTarget.set(hostKey, base);
+  } else {
+    // 与已安装 profile 的别名取并集:聚合包清单可能在上一次失败的重建里丢过条目
+    const hostTarget = byTarget.has(hostKey) ? hostKey : targets[0];
+    const base = hostMapFromProfile();
+    if (base !== null) {
+      const merged = new Map(byTarget.get(hostTarget));
+      let added = 0;
+      for (const [orig, info] of base) {
+        if (!merged.has(orig)) { merged.set(orig, info); added += 1; }
+      }
+      if (added > 0) console.log(`[repack] --reuse:聚合包清单缺 ${added} 个条目 → 已用 profile 别名补齐`);
+      byTarget.set(hostTarget, merged);
+    }
+  }
+  const known = byTarget.get(hostKey) ?? byTarget.get(targets[0]);
+  // 其余目标:按后缀替换推导(平台专属包名只在结尾的 -<platform>-<arch> 上不同)
+  const knownTarget = byTarget.has(hostKey) ? hostKey : targets[0];
+  for (const target of targets) {
+    if (byTarget.has(target)) continue;
+    const map = new Map();
+    for (const [orig, info] of known) {
+      const pkgName = info.pkgName.endsWith(`-${knownTarget}`)
+        ? `${info.pkgName.slice(0, -knownTarget.length)}${target}`
+        : info.pkgName;
+      map.set(orig, { pkgName, version: info.version });
+    }
+    byTarget.set(target, map);
+  }
+  const hostSet = byTarget.get(knownTarget);
+  const repack = new Map();
+  for (const [orig, info] of hostSet) {
+    repack.set(orig, { pkg: { version: info.version }, platformSpecific: info.pkgName.endsWith(`-${knownTarget}`) });
+  }
+  // 已有原生包目录 → plan 项;顺带清掉将被重建的 code-server / argon2 目录
+  const reusedItems = [];
+  for (const ent of readdirSync(buildRoot)) {
+    if (/^code-server/.test(ent) || /^argon2-/.test(ent)) {
+      rmSync(join(buildRoot, ent), { recursive: true, force: true });
+      continue;
+    }
+    const m = readJson(join(buildRoot, ent, 'package.json'));
+    if (m === null) continue;
+    reusedItems.push({ dir: join(buildRoot, ent), file: tgzName(m.name, m.version) });
+  }
+  // 纯 JS 直装集:插件现有 dependencies 里非 @jinsiyu 的项
+  const pluginPkg = readJson(join(pkgRoot, 'package.json'));
+  const declare = Object.entries(pluginPkg.dependencies ?? {})
+    .filter(([name]) => !/^@jinsiyu\//.test(name))
+    .map(([name, version]) => ({ name, version }));
+  rmSync(join(OUT, 'aggregator'), { recursive: true, force: true });
+  console.log(`[repack] --reuse:复用 ${reusedItems.length} 个已打包目录、${repack.size} 个重打包条目、${declare.length} 个纯 JS 直装依赖`);
+  return { repack, declare, reusedItems };
+}
+
 function main() {
-  const autoSource = FROM === null;
-  const sourceTree = autoSource ? prepareSourceTree() : FROM;
   const hostKey = `${process.platform}-${process.arch}`;
   const targets = TARGETS.length > 0 ? TARGETS : [hostKey];
   const pluginVersion = readJson(join(pkgRoot, 'package.json'))?.version ?? '0.0.0';
 
-  const { repack, declare } = analyze(sourceTree);
+  let repack;
+  let declare;
+  let reusedItems = [];
+  let autoSourceTree = null;
+  if (REUSE) {
+    ({ repack, declare, reusedItems } = reuseExisting(targets, hostKey));
+  } else {
+    const autoSource = FROM === null;
+    const sourceTree = autoSource ? prepareSourceTree() : FROM;
+    if (autoSource) autoSourceTree = sourceTree;
+    ({ repack, declare } = analyze(sourceTree));
+    rmSync(OUT, { recursive: true, force: true });
+  }
   console.log(`\n重打包集(${repack.size}):`);
   for (const [name, r] of [...repack].sort()) {
     console.log(`  ${name}@${r.pkg.version} ${r.platformSpecific ? '[平台专属]' : '[全平台]'}`);
   }
   console.log(`\n直装集(${declare.length}): ${declare.map((d) => d.name).join(', ')}\n`);
 
-  rmSync(OUT, { recursive: true, force: true });
-  mkdirSync(OUT, { recursive: true });
+  mkdirSync(join(OUT, 'build'), { recursive: true });
 
   // 每个目标的包名映射
   const byTarget = new Map();
@@ -370,13 +586,27 @@ function main() {
   };
 
   const plan = [];
-  for (const [name, r] of repack) {
-    if (r.platformSpecific) continue; // 平台专属的按目标处理
-    const dir = writeRepack(r.dir, hostMap.get(name), flat(name));
-    plan.push({ dir, file: tgzName(hostMap.get(name).pkgName, r.pkg.version) });
-  }
-  // 2) 平台专属包:host 用现成树,其它目标用交叉安装树
+  // 0) 已打包的原生包(--reuse 模式)
+  for (const item of reusedItems) plan.push(item);
+  // 1) code-server 本体(平台无关,1 个包)+ argon2 平台二进制包(每目标 1 个,与其它原生包同一套规则)
+  const codeServerPkg = buildCodeServerPackage();
+  plan.push({ dir: codeServerPkg.dir, file: codeServerPkg.file });
+  const argon2ByTarget = new Map();
   for (const target of targets) {
+    const pkg = buildArgon2Package(target);
+    argon2ByTarget.set(target, pkg);
+    plan.push({ dir: pkg.dir, file: pkg.file });
+  }
+  // 2) 全平台重打包包(从 host 树;--reuse 时用已打包目录)
+  if (!REUSE) {
+    for (const [name, r] of repack) {
+      if (r.platformSpecific) continue; // 平台专属的按目标处理
+      const dir = writeRepack(r.dir, hostMap.get(name), flat(name));
+      plan.push({ dir, file: tgzName(hostMap.get(name).pkgName, r.pkg.version) });
+    }
+  }
+  // 3) 平台专属包:host 用现成树,其它目标用交叉安装树(--reuse 时用已打包目录)
+  if (!REUSE) for (const target of targets) {
     const map = byTarget.get(target);
     const specs = [...repack].filter(([, r]) => r.platformSpecific).map(([name, r]) => ({ name, version: r.pkg.version }));
     let crossTree = null;
@@ -394,7 +624,7 @@ function main() {
     }
     if (crossTree !== null) rmSync(crossTree, { recursive: true, force: true });
   }
-  // 3) 聚合包(每平台一个):dependencies 用 npm: 别名把重打包包装回原名
+  // 3) 聚合包(每平台一个):dependencies 用 npm: 别名把重打包包装回原名(含 argon2)
   for (const target of targets) {
     const map = byTarget.get(target);
     const aggName = `${SCOPE}/dsh-code-server-runtime-${target}`;
@@ -402,10 +632,13 @@ function main() {
     mkdirSync(aggDir, { recursive: true });
     const deps = {};
     for (const [name] of repack) deps[name] = `npm:${map.get(name).pkgName}@${map.get(name).version}`;
+    // argon2:code-server 本体包不带原生二进制,由这里按平台装回原名 "argon2"
+    const argon2 = argon2ByTarget.get(target);
+    if (argon2 !== undefined) deps.argon2 = `npm:${argon2.name}@${argon2.version}`;
     writeFileSync(join(aggDir, 'package.json'), JSON.stringify({
       name: aggName,
       version: pluginVersion,
-      description: `Prebuilt native modules for code-server on ${target} (node-pty, @vscode/sqlite3, kerberos, …), `
+      description: `Prebuilt native modules for code-server on ${target} (argon2, node-pty, @vscode/sqlite3, kerberos, …), `
         + 'so that installing the VS Code inner dependencies needs no build approval or C++ toolchain.',
       os: [target.split('-')[0]],
       cpu: [target.split('-')[1]],
@@ -419,14 +652,19 @@ function main() {
   writeFileSync(join(OUT, 'pack-plan.json'), JSON.stringify(plan, null, 2) + '\n', 'utf8');
   console.log(`[repack] 生成 ${plan.length} 个待打包目录 → repack/ (计划:repack/pack-plan.json)`);
 
-  // 4) 改写插件 package.json 的依赖
+  // 4) 改写插件 package.json 的依赖:纯 JS 直装集 + code-server 本体包(平台无关);
+  //    平台专属的(16 个原生包 + argon2)通过聚合包按 os/cpu 自动选。
   const pkgFile = join(pkgRoot, 'package.json');
   const pluginPkg = readJson(pkgFile);
-  pluginPkg.dependencies = Object.fromEntries(declare.map((d) => [d.name, d.version]).sort(([a], [b]) => a.localeCompare(b)));
+  pluginPkg.dependencies = Object.fromEntries([
+    [codeServerPkg.name, codeServerPkg.version],
+    ...declare.map((d) => [d.name, d.version]),
+  ].sort(([a], [b]) => a.localeCompare(b)));
   pluginPkg.optionalDependencies = Object.fromEntries(targets
     .map((t) => [`${SCOPE}/dsh-code-server-runtime-${t}`, `^${pluginVersion}`]));
   writeFileSync(pkgFile, JSON.stringify(pluginPkg, null, 2) + '\n', 'utf8');
-  console.log(`[repack] 已写入 package.json:dependencies ${declare.length} 个(纯 JS),optionalDependencies ${targets.length} 个平台聚合包`);
+  console.log(`[repack] 已写入 package.json:dependencies ${pluginPkg.dependencies ? Object.keys(pluginPkg.dependencies).length : 0} 个`
+    + `(code-server 本体 + 纯 JS),optionalDependencies ${targets.length} 个平台聚合包`);
 
   // 5) 可选:直接打包
   if (DO_PACK) {
@@ -440,8 +678,8 @@ function main() {
     console.log('[repack] 未加 --pack;在普通终端里执行 `node scripts/vendor-repacks.mjs --pack` 生成 tarball');
   }
 
-  if (autoSource) {
-    rmSync(sourceTree, { recursive: true, force: true });
+  if (autoSourceTree !== null) {
+    rmSync(autoSourceTree, { recursive: true, force: true });
     console.log('[repack] 已清理自动准备的源树');
   }
 }

package/vendor/VENDOR.json

@@ -1,6 +1,6 @@
 {
   "codeServerVersion": "4.136.2",
-  "preparedAt": "2026-09-09T19:27:24.058Z",
+  "preparedAt": "2026-09-10T06:21:25.184Z",
   "source": "registry",
   "node": "v24.13.1",
   "platform": "win32",

package/scripts/vendor-code-server-pkg.mjs

@@ -1,137 +0,0 @@
-// scripts/vendor-code-server-pkg.mjs — 把内置 code-server 树打成**平台专属子包**。
-//
-// 产物(每个目标一个,os/cpu 限定):
-//   repack/build/code-server-<target>/
-//     package.json                  @jinsiyu/dshcs-code-server-<target>@<code-server 版本>
-//     code-server/**                完整 code-server 树(out/ + lib/vscode + 自带的 136 个依赖)
-//
-// 为什么要放在子目录 code-server/ 而不是包根:npm/pnpm 打包**永远排除包根目录的 node_modules**,
-// 放在被 files 覆盖的子目录里才会随包发布(主包 0.1.36 用的就是同一招)。
-//
-// 为什么子包不写 dependencies:那 136 个依赖已经作为文件打包在 code-server/node_modules 里,
-// 写成 dependencies 会让 pnpm 再去 registry 装一份。留着 `dependencies` 字段的是嵌套的
-// code-server/package.json(它只是普通文件,不被解析)。
-//
-// 平台差异只有 argon2 的原生二进制(win32-arm64 上游无预编译 → 打包期编译;
-// win32-x64 用 `node-gyp rebuild --arch=x64` 现编,并校验 PE machine)。
-//
-// 用法:
-//   node scripts/vendor-code-server-pkg.mjs [--target win32-arm64,win32-x64] [--pack]
-import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
-import { dirname, join, relative, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { spawnSync } from 'node:child_process';
-
-const here = dirname(fileURLToPath(import.meta.url));
-const pkgRoot = resolve(here, '..');
-const repackDir = join(pkgRoot, 'repack');
-const buildDir = join(repackDir, 'build');
-const tgzDir = join(repackDir, 'tgz');
-const vendorTree = join(pkgRoot, 'vendor', 'code-server');
-const npmCache = join(pkgRoot, '.npm-cache');
-
-const argv = process.argv.slice(2);
-const DO_PACK = argv.includes('--pack');
-const TARGETS = (() => {
-  const i = argv.indexOf('--target');
-  if (i < 0 || argv[i + 1] === undefined) return [`${process.platform}-${process.arch}`];
-  return argv[i + 1].split(',').map((s) => s.trim()).filter(Boolean);
-})();
-
-const readJson = (p) => { try { return JSON.parse(readFileSync(p, 'utf8')); } catch { return null; } };
-
-function npm(args, cwd) {
-  const cli = join(dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js');
-  const env = { ...process.env, npm_config_cache: npmCache, npm_config_update_notifier: 'false' };
-  const hasCli = existsSync(cli);
-  const cmd = hasCli ? process.execPath : (process.platform === 'win32' ? 'npm.cmd' : 'npm');
-  const full = hasCli ? [cli, ...args] : args;
-  const res = spawnSync(cmd, full, { cwd, shell: !hasCli && process.platform === 'win32', env, stdio: 'inherit' });
-  if ((res.status ?? 1) !== 0) throw new Error(`npm ${args.join(' ')} failed (${res.status})`);
-}
-
-/** PE machine(0x8664=x64 / 0xaa64=arm64),用于交叉编译后的静态校验。 */
-function peMachine(file) {
-  try {
-    const b = readFileSync(file);
-    if (b[0] !== 0x4d || b[1] !== 0x5a) return null;
-    const off = b.readUInt32LE(0x3c);
-    if (b.toString('ascii', off, off + 4) !== 'PE\u0000\u0000') return null;
-    return `0x${b.readUInt16LE(off + 4).toString(16)}`;
-  } catch { return null; }
-}
-
-/** 为某个目标编译 argon2 原生模块(就地覆盖包内 build/Release/argon2.node)。 */
-function buildArgon2(tree, arch) {
-  const argon2 = join(tree, 'node_modules', 'argon2');
-  if (!existsSync(join(argon2, 'binding.gyp'))) throw new Error(`argon2 不在位: ${argon2}`);
-  console.log(`[cs-pkg] 编译 argon2 (--arch=${arch}) …`);
-  const ng = join(process.env.APPDATA ?? '', 'npm', 'node_modules', 'node-gyp', 'bin', 'node-gyp.js');
-  const cli = existsSync(ng) ? ng : null;
-  if (cli === null) throw new Error('找不到 node-gyp(需全局安装 node-gyp)');
-  const res = spawnSync(process.execPath, [cli, 'rebuild', `--arch=${arch}`], { cwd: argon2, stdio: 'inherit' });
-  if ((res.status ?? 1) !== 0) throw new Error(`argon2 编译失败 (${res.status})`);
-  const bin = join(argon2, 'build', 'Release', 'argon2.node');
-  if (!existsSync(bin)) throw new Error(`argon2 编译产物缺失: ${bin}`);
-  return bin;
-}
-
-function main() {
-  if (!existsSync(join(vendorTree, 'out', 'node', 'entry.js'))) {
-    throw new Error('缺少 vendor/code-server;先运行 `node scripts/vendor-code-server.mjs`');
-  }
-  const csVersion = readJson(join(vendorTree, 'package.json'))?.version;
-  if (typeof csVersion !== 'string') throw new Error('读不到 code-server 版本');
-  const pluginPkg = readJson(join(pkgRoot, 'package.json'));
-  const scope = '@jinsiyu';
-  const hostKey = `${process.platform}-${process.arch}`;
-  const plan = [];
-
-  for (const target of TARGETS) {
-    const [platform, arch] = target.split('-');
-    if (platform === undefined || arch === undefined) throw new Error(`--target 需要 <platform>-<arch>,收到 ${target}`);
-    const outName = `code-server-${target}`;
-    const dir = join(buildDir, outName);
-    rmSync(dir, { recursive: true, force: true });
-    mkdirSync(dir, { recursive: true });
-    console.log(`[cs-pkg] 复制 vendor/code-server → ${relative(pkgRoot, join(dir, 'code-server'))}`);
-    cpSync(vendorTree, join(dir, 'code-server'), { recursive: true, dereference: false, maxRetries: 6, retryDelay: 250 });
-
-    const tree = join(dir, 'code-server');
-    // 目标架构的 argon2 原生二进制
-    const wantMachine = arch === 'x64' ? '0x8664' : arch === 'arm64' ? '0xaa64' : null;
-    const have = join(tree, 'node_modules', 'argon2', 'build', 'Release', 'argon2.node');
-    if (target !== hostKey) {
-      const bin = buildArgon2(tree, arch);
-      const m = peMachine(bin);
-      if (wantMachine !== null && m !== wantMachine) throw new Error(`argon2 PE machine=${m},期望 ${wantMachine}`);
-      console.log(`[cs-pkg] argon2 → ${relative(pkgRoot, bin)} (${m})`);
-    } else {
-      console.log(`[cs-pkg] argon2 沿用本机产物 (${peMachine(have) ?? '?'})`);
-    }
-
-    writeFileSync(join(dir, 'package.json'), JSON.stringify({
-      name: `${scope}/dshcs-code-server-${target}`,
-      version: csVersion,
-      description: `Bundled code-server ${csVersion} tree for ${target} (out/ + lib/vscode + its ${readdirSync(join(tree, 'node_modules')).length} runtime deps), repacked so pnpm installs it without any build script.`,
-      os: [platform],
-      cpu: [arch],
-      files: ['code-server'],
-      license: 'MIT',
-      repository: pluginPkg?.repository ?? undefined,
-    }, null, 2) + '\n', 'utf8');
-    plan.push({ dir, file: `${`${scope}/dshcs-code-server-${target}`.replace(/^@/, '').replaceAll('/', '-')}-${csVersion}.tgz` });
-  }
-
-  if (DO_PACK) {
-    mkdirSync(tgzDir, { recursive: true });
-    for (const item of plan) {
-      console.log(`[cs-pkg] npm pack ${item.file}`);
-      npm(['pack', '--pack-destination', tgzDir], item.dir);
-    }
-  }
-  console.log(`[cs-pkg] 完成:${plan.length} 个平台子包 → repack/build/${DO_PACK ? ' + repack/tgz/' : ''}`);
-  console.log('[cs-pkg] 下一步:`node scripts/publish-repacks.mjs --only dshcs-code-server` 发布(或用 --dry-run 预览)');
-}
-
-main();