dsh-code-server-app 0.1.40 → 0.1.42

package/README.en.md

@@ -10,7 +10,7 @@
 > - Microsoft **open-source** extensions (Python, TypeScript debugger, ESLint, …) are mirrored on Open VSX and install normally by search;
 > - **If you need a proprietary Microsoft extension**: download the `.vsix` from the Marketplace page and install it manually with `code-server --install-extension <file>` (or drop it into `--extensions-dir`).
 
-A static profile plugin (npm package with host + client bundle) that ships [code-server](https://github.com/coder/code-server) as a **platform-specific sub-package dependency** (a pack-time artifact at `vendor/code-server` → `@jinsiyu/dshcs-code-server-<platform>-<arch>`, with no install scripts and no postinstall) and runs it outside the plugin directory. VS Code's inner dependencies and the prebuilt native modules are **all installed by the package manager together with the plugin** — no global npm install, no `bin` configuration, no profile config changes, no second install command.
+A static profile plugin (npm package with host + client bundle) that ships [code-server](https://github.com/coder/code-server) as a **platform-independent dependency package** (a pack-time artifact at `vendor/code-server` → `@jinsiyu/dshcs-code-server`, with no install scripts and no postinstall); its binaries (argon2 plus 16 native modules) come from `@jinsiyu/dshcs-*-win32-<arch>` platform packages selected automatically per architecture by the platform aggregator. VS Code's inner dependencies and the prebuilt native modules are **all installed by the package manager together with the plugin** — no global npm install, no `bin` configuration, no profile config changes, no second install command.
 
 ## UI carrier (chosen by the DSH version, feature-detected at runtime)
 
@@ -59,23 +59,43 @@ cd C:\Users\User\Desktop\dsh-code-server-app
 pnpm install             # dev deps (esbuild + motion); allowBuilds is explicit → no postinstall runs
 pnpm run build:client    # src/factory.js → lib/client.js (not committed; must be built first)
 pnpm run vendor:check    # optional: show the bundled code-server version vs npm latest
-pnpm run vendor:code-server                     # ① produce vendor/code-server (code-server + its own deps)
-pnpm run repack:code-server -- --target win32-arm64,win32-x64 --pack   # ② platform sub-packages (incl. argon2)
-node scripts/vendor-repacks.mjs --target win32-arm64,win32-x64 --pack   # ③ build/repack the VS Code natives
-pnpm run publish:repacks                        # ④ publish every @jinsiyu/* sub-package
-pnpm pack                                       # ⑤ → dsh-code-server-app-<version>.tgz (~105KB)
-npm publish dsh-code-server-app-<version>.tgz --access public   # ⑥ publish the plugin itself (same verified tarball)
+pnpm run vendor:code-server                      # ① produce vendor/code-server (the upstream tree)
+pnpm run repack:build -- --target win32-arm64,win32-x64 --pack   # ② one script builds every sub-package
+pnpm run publish:repacks                         # ③ publish every @jinsiyu/* sub-package (default dist-tag: next)
+pnpm pack                                        # ④ → dsh-code-server-app-<version>.tgz (~107KB)
+pnpm run publish:plugin                          # ⑤ publish the plugin itself (default dist-tag: next)
+# once the user has restarted dsh web and confirmed it works, promote latest:
+pnpm run promote -- <version>
 ```
 
+> **dist-tag policy (mandatory)**: every release goes to **`next`** and **never touches `latest`**;
+> `latest` always points at the most recent *confirmed bug-free* version and is only moved by
+> `pnpm run promote -- <version>` (= `npm dist-tag add dsh-code-server-app@<version> latest`)
+> **after the user restarts `dsh web` and confirms it works**. That way
+> `dsh plugin add dsh-code-server-app` (no version) — and anything else resolving `latest` — never picks up an
+> unverified build. Sub-packages (`@jinsiyu/dshcs-*`, the aggregators) are referenced by exact/caret versions,
+> so their dist-tags do not affect resolution, but they default to `next` as well.
+> Inspect the current tags with `npm dist-tag ls dsh-code-server-app`.
+
+`repack:build` (`scripts/vendor-repacks.mjs`) is the **single script that produces every sub-package**:
+
+| Sub-package | Content | os/cpu |
+|---|---|---|
+| `@jinsiyu/dshcs-code-server@<code-server version>` | the code-server tree (`out/` + `lib/vscode` + its 136 runtime deps), **no machine-specific binary** | platform-independent |
+| `@jinsiyu/dshcs-argon2-win32-arm64` / `-x64` | the argon2 module plus its compiled `.node` for that architecture (arm64 0xaa64 / x64 0x8664) | win32-<arch> |
+| `@jinsiyu/dshcs-<name>[-win32-<arch>]` ×24 | the VS Code inner packages that need building (node-pty / @vscode/sqlite3 / kerberos / koffi / ssh2 / …) | gated when platform-specific |
+| `@jinsiyu/dsh-code-server-runtime-win32-<arch>` | platform aggregator: its `dependencies` map those 16 natives **plus argon2** back to their original names via `npm:` aliases | win32-<arch> |
+
 | Goal | Command |
 |---|---|
-| **Build the latest code-server from npm** | `pnpm run vendor:latest` (= `--force`): snapshots `code-server@latest` into `vendor/code-server`; afterwards you **must** re-run `repack:code-server` (republish the sub-packages) and `vendor-repacks.mjs` (the inner dependency versions change) |
+| **Build the latest code-server from npm** | `pnpm run vendor:latest` (= `--force`): snapshots `code-server@latest` into `vendor/code-server`; afterwards you **must** re-run `repack:build` and republish every sub-package |
 | **Pin a version** | `pnpm run vendor:code-server -- --version 4.136.2` |
 | **Snapshot from an existing tree** | `pnpm run vendor:code-server -- --from <code-server dir>` (seconds) |
-| **Rebuild the code-server sub-packages** | `pnpm run repack:code-server -- --target win32-arm64,win32-x64 --pack` (x64 compiles argon2 and checks the PE machine type) |
-| **Rebuild prebuilt natives** | `node scripts/vendor-repacks.mjs [--from <existing full install>] --target win32-arm64,win32-x64 --pack` (without `--from` it npm-installs and compiles the source tree itself — slow) |
+| **Rebuild every sub-package** | `pnpm run repack:build -- --target win32-arm64,win32-x64 --pack` (without `--from` it npm-installs and compiles the source tree itself — slow) |
+| **Rebuild only the code-server/argon2 packages** | `node scripts/vendor-repacks.mjs --reuse --target win32-arm64,win32-x64 --pack` (reuses the natives already in `repack/build`, no source-tree analysis) |
 | **Publish sub-packages** | `pnpm run publish:repacks` (`--dry-run` to preview; `--only <substr>` to filter; `--otp <code>` / `--limit N` for 2FA) |
-| **Publish the plugin itself** | `npm publish dsh-code-server-app-<version>.tgz --access public` (publishes the exact tarball that was verified; no re-packing) |
+| **Publish the plugin itself** | `pnpm run publish:plugin` (publishes the exact tarball that was verified; no re-packing; default dist-tag `next`) |
+| **Promote `latest`** | `pnpm run promote -- <version>` (only after the user restarted and confirmed; `--dry-run` shows the current tags first) |
 | **Just report versions** | `pnpm run vendor:check` |
 
 > `pnpm pack`'s `prepack` runs the vendor-code-server script once; when `vendor/code-server` already exists it is
@@ -87,28 +107,28 @@ npm publish dsh-code-server-app-<version>.tgz --access public   # ⑥ publish th
 
 ```powershell
 # no postinstall in the package → no pnpm approve-builds / allowBuilds; one command installs everything
-dsh plugin --profile web add dsh-code-server-app@0.1.37
+dsh plugin --profile web add dsh-code-server-app@0.1.40
 # a local tarball works the same way:
-dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app\dsh-code-server-app-0.1.37.tgz
+dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app\dsh-code-server-app-0.1.40.tgz
 ```
 
 Ready to use immediately — **no second step, no "Install environment", no install-guide modal**.
-Since 0.1.37 the main package is only **~105KB** (the plugin's own code); everything else is dependencies:
+Since 0.1.40 the main package is only **~107KB** (the plugin's own code); everything else is dependencies:
 
-- **the code-server tree** (`lib/vscode` 196.9MB + its own 136 runtime dependencies) ships as a **platform-specific
-  sub-package** `@jinsiyu/dshcs-code-server-<platform>-<arch>@<code-server version>` (gated by `os`/`cpu`, listed in
-  the plugin's `optionalDependencies`) → pnpm picks the right one for the architecture; it runs from
-  `<profile>\node_modules\@jinsiyu\dshcs-code-server-win32-arm64\code-server`;
+- **the code-server tree** (`lib/vscode` 196.9MB + its own 136 runtime dependencies) is a **platform-independent
+  package** `@jinsiyu/dshcs-code-server@<code-server version>` declared in the plugin's `dependencies`; it runs from
+  `<profile>\node_modules\@jinsiyu\dshcs-code-server\code-server`;
 - the **pure-JS part** of VS Code's inner dependencies (35 packages: xterm / katex / typescript / ws / tar …) is
   declared in the plugin's `dependencies` and installed by pnpm into the profile's `node_modules` (hoisted);
-- the **packages that need compiling** (node-pty / @vscode/sqlite3 / kerberos / koffi / ssh2 / cpu-features /
-  @parcel/watcher / @vscode/windows-* … 16 in total) are provided as prebuilt `@jinsiyu/dshcs-*` packages,
-  pulled back under their **original names** by the **platform aggregator**
-  `@jinsiyu/dsh-code-server-runtime-<platform>-<arch>` using `npm:` aliases;
+- the **binary part** comes entirely from `@jinsiyu/dshcs-*` platform packages (one per platform, `os`/`cpu` gated):
+  `@jinsiyu/dshcs-argon2-win32-<arch>` and 16 native packages, mapped back to their **original names**
+  (`argon2` / `node-pty` / `@vscode/sqlite3` / …) by the **platform aggregator**
+  `@jinsiyu/dsh-code-server-runtime-win32-<arch>` using `npm:` aliases; the aggregators sit in the plugin's
+  `optionalDependencies`, so pnpm auto-selects the right platform;
 - consequently the dependency graph contains **no package with pre/install/postinstall or a `binding.gyp`** →
   no profile `allowBuilds`, no build script ever runs, and **the user machine needs no C++ toolchain**;
-- **upgrading the plugin no longer re-downloads code-server**: the sub-package is cached by version, so only a
-  code-server version change pulls those ~58MB again.
+- **upgrading the plugin no longer re-downloads code-server**: the tree package is cached by version, so only a
+  code-server version change pulls those ~60MB again (the argon2 platform package is only ~1.5MB).
 
 ### Install mechanism (why it is built this way)
 
@@ -122,34 +142,41 @@ Since 0.1.37 the main package is only **~105KB** (the plugin's own code); everyt
   user agents, so it always fails under pnpm) → supply the argon2 native binary (no Windows prebuild exists;
   compile with `node-gyp-build`, or reuse an existing `argon2.node` via `DSHCS_ARGON2_BINARY`) → strip leftover
   install scripts → snapshot to `vendor/code-server/`;
-- `scripts/vendor-code-server-pkg.mjs` then turns it into **platform sub-packages**: the tree lives in an inner
-  `code-server/` directory (npm/pnpm packing **always excludes the package root's `node_modules`**; a subdirectory
-  covered by `files` is included), and the sub-package declares **no `dependencies`** (those 136 packages are
-  already files inside `code-server/node_modules`; declaring them would make pnpm install a second copy).
-  `os`/`cpu` gated, each with its own compiled argon2 (arm64 0xaa64 / x64 0x8664);
-- **packages that need compiling** are repacked by `scripts/vendor-repacks.mjs` into `@jinsiyu/dshcs-*`:
+- the same script then builds the **platform-independent tree package**: the tree lives in an inner `code-server/`
+  directory (npm/pnpm packing **always excludes the package root's `node_modules`**; a subdirectory covered by
+  `files` is included), the package declares **no `dependencies`** (those 136 packages are already files inside
+  `code-server/node_modules`; declaring them would make pnpm install a second copy) and its
+  `node_modules/argon2` is removed entirely;
+- **argon2** becomes two platform packages (`@jinsiyu/dshcs-argon2-win32-arm64` / `-x64`) built with the very same
+  rules as the other natives (delete `scripts`/`files`/`binding.gyp`, delete `prebuilds/` so both always load
+  `build/Release`), each compiled with `node-gyp rebuild --arch=<arch>` and PE-checked (0xaa64 / 0x8664);
+- **packages that need compiling** are repacked into `@jinsiyu/dshcs-*`:
   copy the already-compiled package directory → **delete `scripts` / `files` / `binding.gyp` / `.hooks` /
   `.npmignore`** (keeping the compiled `.node` and every runtime file) → rewrite dependencies that belong to the
   same set to `npm:` aliases → platform-specific ones get an `os`/`cpu` pair and a `-<platform>-<arch>` suffix;
-- **the platform aggregator** maps those repacks back to their original names (e.g.
-  `"node-pty": "npm:@jinsiyu/dshcs-node-pty@1.2.0-beta.15"`), so VS Code's `require('node-pty')` needs no change.
-  The aggregator itself is `os`/`cpu` gated, and the plugin declares both win32-arm64 and win32-x64 in
-  `optionalDependencies` → one command picks the right one automatically;
+- **the platform aggregator** maps those repacks and argon2 back to their original names (e.g.
+  `"node-pty": "npm:@jinsiyu/dshcs-node-pty@1.2.0-beta.15"`, `"argon2": "npm:@jinsiyu/dshcs-argon2-win32-arm64@0.44.0"`),
+  so code-server's and VS Code's `require(...)` calls need no change. The aggregator itself is `os`/`cpu` gated,
+  and the plugin declares both win32-arm64 and win32-x64 in `optionalDependencies` → one command picks the right one;
 - **resolution path**: the host resolves the runtime root with
-  `require.resolve('@jinsiyu/dshcs-code-server-<platform>-<arch>/package.json')` (then the inner `code-server/`
-  directory) and launches `code-server/out/node/entry.js`; VS Code's inner dependencies are resolved upward from
-  there: `code-server/node_modules` → the sub-package's `node_modules` → `<profile>/node_modules` (hoisted
-  layout), exactly what the runtime sees. The in-package `vendor/code-server` is only a development/legacy
-  fallback.
-
-> **Size note**: the plugin tarball is **~105KB**; each `@jinsiyu/dshcs-code-server-win32-*` sub-package is
-> **~58–60MB** (249MB unpacked); the inner dependencies and prebuilt natives add ~250MB. A full install downloads
-> roughly 310MB. Neither `vendor/` nor `repack/` is tracked by git (see `.gitignore`).
-
-> **Upgrading from ≤ 0.1.36**: the in-package `vendor/code-server/` moved into the platform sub-packages and the
-> main package shrank to ~105KB. The upgrade command is unchanged
-> (`dsh plugin --profile web add dsh-code-server-app@<version>`); the old `vendor/` disappears with the old
-> package directory.
+  `require.resolve('@jinsiyu/dshcs-code-server/package.json')` (then the inner `code-server/` directory) and
+  launches `code-server/out/node/entry.js`; inner dependencies resolve upward from there
+  (`code-server/node_modules` → the package's `node_modules` → `<profile>/node_modules`).
+- **pnpm's nesting gotcha and the safety net**: `os`/`cpu`-gated packages are often installed **nested inside the
+  aggregator** (e.g. `<profile>/node_modules/@jinsiyu/dsh-code-server-runtime-win32-arm64/node_modules/argon2`),
+  i.e. neither at the profile root nor inside the code-server tree → the host adds that directory to the child
+  process's **`NODE_PATH`**, and the environment check resolves against both anchors
+  (code-server root + aggregator directory) — see `lib/native.js`.
+
+> **Size note**: the plugin tarball is **~107KB**; `@jinsiyu/dshcs-code-server` is **~60.5MB** (242MB unpacked);
+> each argon2 platform package is **~1.5MB**; the 16 native packages add ~250MB. A full install downloads
+> roughly 315MB. Neither `vendor/` nor `repack/` is tracked by git (see `.gitignore`).
+
+> **Upgrading from ≤ 0.1.39**: code-server moved from a platform-specific sub-package to **one
+> platform-independent package plus two argon2 platform packages**, and every binary is now produced by the single
+> repack script. The upgrade command is unchanged
+> (`dsh plugin --profile web add dsh-code-server-app@<version>`); the old `dshcs-code-server-win32-*`
+> sub-packages are removed by pnpm.
 
 > **Upgrading from ≤ 0.1.35**: the old install root `<profile>\.code-server-app` (with ~1.4GB of inner
 > dependencies) and the "Install environment" step are gone. The new version detects the old root and logs that it
@@ -157,9 +184,9 @@ Since 0.1.37 the main package is only **~105KB** (the plugin's own code); everyt
 > `dsh-code-server-app: false` entries in the profile's `pnpm-workspace.yaml` can be removed too (no build
 > approval is needed any more).
 
-> **Uninstall**: `dsh plugin --profile web remove dsh-code-server-app` is enough; the code-server sub-package and
-> the natives are separate dependencies, so to remove everything run e.g.
-> `dsh plugin --profile web remove @jinsiyu/dshcs-code-server-win32-arm64` (or `pnpm remove` inside the profile);
+> **Uninstall**: `dsh plugin --profile web remove dsh-code-server-app` is enough; the tree package, argon2 and the
+> natives are separate dependencies, so to remove everything run e.g.
+> `dsh plugin --profile web remove @jinsiyu/dshcs-code-server` (or `pnpm remove` inside the profile);
 > if an old install root is still around, delete `<profile>\.code-server-app` manually.
 
 > After install/dependency changes, **restart `dsh web`** (the static plugin row and host probe paths load at startup).
@@ -214,18 +241,19 @@ dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app
   **latest** version; or use `pnpm run vendor:code-server -- --version 4.136.2` / `DSHCS_CODE_SERVER_VERSION`.
   With an existing `vendor/code-server`, a plain `pnpm pack` never upgrades (it is a no-op).
 - **Check first**: `pnpm run vendor:check` prints the bundled version / npm latest.
-- **A version bump requires republishing two kinds of sub-packages** (the inner dependency versions change with
-  code-server):
-  1. `pnpm run repack:code-server -- --target win32-arm64,win32-x64 --pack` → the new code-server sub-packages;
-  2. `node scripts/vendor-repacks.mjs --target win32-arm64,win32-x64 --pack` → the prebuilt natives (also rewrites
-     the plugin's pure-JS `dependencies` and both aggregator versions);
-  3. `pnpm run publish:repacks` → publish; then bump the plugin version → `pnpm pack` → publish the plugin.
+- **A version bump means rebuilding and republishing the sub-packages** (all with the same script):
+  1. `pnpm run repack:build -- --target win32-arm64,win32-x64 --pack` → the new tree package
+     (`@jinsiyu/dshcs-code-server@<new version>`), the new argon2 platform packages and the natives rebuilt
+     against the new inner dependencies (the script also rewrites the plugin's pure-JS `dependencies` and both
+     aggregator versions);
+  2. `pnpm run publish:repacks` → publish; then bump the plugin version → `pnpm pack` → publish the plugin.
 - **No runtime auto-upgrade anymore**: nothing fetches latest at startup; the version is fully determined by the bundled artifact.
 - Bundled locally right now: `code-server@4.136.2` (with Code 1.136.1).
 
 ### Compatibility with the old install locations
 
-Host probe order: `@jinsiyu/dshcs-code-server-<platform>-<arch>/code-server` (**the real layout since 0.1.37**) >
+Host probe order: `@jinsiyu/dshcs-code-server/code-server` (**the real layout since 0.1.40**) >
+`@jinsiyu/dshcs-code-server-<platform>-<arch>/code-server` (the 0.1.37 platform sub-packages) >
 the in-package `vendor/code-server` (0.1.36 and earlier / development) > the old install root
 `<profile>\.code-server-app\node_modules\code-server` (0.1.35 and earlier) > plugin-internal
 `node_modules/code-server` (development) > PATH/config `bin`. The old root is only mentioned in a startup log
@@ -254,7 +282,7 @@ package manager, and the card only reports the result.
 
 | Key | Default | Description |
 |---|---|---|
-| `bin` | `code-server` (placeholder) | Launch priority: explicit `bin` in config > the platform sub-package `@jinsiyu/dshcs-code-server-<platform>-<arch>/code-server/out/node/entry.js` > the in-package `vendor/code-server` > the old install root `.code-server-app` > plugin-internal `node_modules` > `code-server` on PATH. None present → startup error with troubleshooting hints |
+| `bin` | `code-server` (placeholder) | Launch priority: explicit `bin` in config > the tree package `@jinsiyu/dshcs-code-server/code-server/out/node/entry.js` > the old platform sub-packages `@jinsiyu/dshcs-code-server-<platform>-<arch>` > the in-package `vendor/code-server` > the old install root `.code-server-app` > plugin-internal `node_modules` > `code-server` on PATH. None present → startup error with troubleshooting hints |
 | `host` | `127.0.0.1` | Bind address; `auth: none` only allows loopback (localhost/127.0.0.1/::1) |
 | `port` | `8090` | Port; on conflict startup fails with diagnostics (no automatic port change) |
 | `auth` | `none` | `none` \| `password`; non-loopback host automatically requires password |

package/README.md

@@ -11,8 +11,8 @@
 > - **需要微软专有扩展时**:从 Marketplace 网页下载 `.vsix`,用 `code-server --install-extension <文件>`(或放入 `--extensions-dir`)手动安装,即可在插件列表使用。
 
 静态 profile 插件(npm 包形态,host + client bundle),把 [code-server](https://github.com/coder/code-server)
-**以平台专属子包的形式随插件依赖安装**(打包期产物 `vendor/code-server` → `@jinsiyu/dshcs-code-server-<平台>-<架构>`,
-无安装脚本、无 postinstall),插件目录外就地运行;
+**作为平台无关的依赖包随插件安装**(打包期产物 `vendor/code-server` → `@jinsiyu/dshcs-code-server`,无安装脚本、无 postinstall),
+二进制部分(argon2 + 16 个原生模块)由 `@jinsiyu/dshcs-*-win32-<架构>` 平台包经聚合包按架构自动选中;
 VS Code 内部依赖与预编译原生模块**全部由包管理器随插件一起装好** —— 无需全局 npm 安装、无需配置 `bin`、
 无需改 profile 配置、无需第二条安装命令。
 
@@ -68,23 +68,41 @@ cd C:\Users\User\Desktop\dsh-code-server-app
 pnpm install             # 开发依赖(esbuild + motion);allowBuilds 已显式声明 → 不执行任何 postinstall
 pnpm run build:client    # src/factory.js → lib/client.js(不入库,必须先构建)
 pnpm run vendor:check    # 可选:查看内置 code-server 版本 vs npm 最新版
-pnpm run vendor:code-server                      # ① 生成 vendor/code-server(code-server 本体 + 自身依赖)
-pnpm run repack:code-server -- --target win32-arm64,win32-x64 --pack   # ② 打成平台专属子包(含 argon2 原生)
-node scripts/vendor-repacks.mjs --target win32-arm64,win32-x64 --pack   # ③ 生成/重打包 VS Code 原生包
-pnpm run publish:repacks                         # ④ 发布全部 @jinsiyu/* 子包(需 npm 登录)
-pnpm pack                                        # ⑤ → dsh-code-server-app-<version>.tgz(约 105KB)
-npm publish dsh-code-server-app-<version>.tgz --access public   # ⑥ 发布插件本体(同一次验证的 tarball)
+pnpm run vendor:code-server                      # ① 生成 vendor/code-server(上游 code-server 树)
+pnpm run repack:build -- --target win32-arm64,win32-x64 --pack   # ② 统一脚本产出全部子包(见下表)
+pnpm run publish:repacks                         # ③ 发布全部 @jinsiyu/* 子包(默认 dist-tag = next)
+pnpm pack                                        # ④ → dsh-code-server-app-<version>.tgz(约 107KB)
+pnpm run publish:plugin                          # ⑤ 发布插件本体(默认 dist-tag = next)
+# 用户重启 dsh web 确认无误后,再把 latest 推进到该版本:
+pnpm run promote -- <version>
 ```
 
+> **dist-tag 政策(必须遵守)**:发布一律发到 **`next`**,**不动 `latest`**;
+> `latest` 只保留「最近一个确认无 bug 的版本」,由 `pnpm run promote -- <version>`
+> (= `npm dist-tag add dsh-code-server-app@<version> latest`)在**用户重启 dsh web 确认无误后**才推进。
+> 这样 `dsh plugin add dsh-code-server-app`(不带版本)和任何按 latest 安装的流程都不会拿到未验证的版本。
+> 子包(`@jinsiyu/dshcs-*`、聚合包)被依赖以精确/插入符版本引用,dist-tag 不影响解析,但同样默认发 `next`。
+> 查看当前标签:`npm dist-tag ls dsh-code-server-app`。
+
+`repack:build`(`scripts/vendor-repacks.mjs`)是**唯一的子包产出脚本**,一次生成:
+
+| 子包 | 内容 | os/cpu |
+|---|---|---|
+| `@jinsiyu/dshcs-code-server@<code-server 版本>` | code-server 树(`out/` + `lib/vscode` + 自带 136 个运行时依赖),**不含任何本机二进制** | 平台无关 |
+| `@jinsiyu/dshcs-argon2-win32-arm64` / `-x64` | argon2 模块 + 该架构编译好的 `.node`(arm64 0xaa64 / x64 0x8664) | win32-<arch> |
+| `@jinsiyu/dshcs-<名字>[-win32-<arch>]` ×24 | VS Code 内部依赖里需要构建的原生包(node-pty / @vscode/sqlite3 / kerberos / koffi / ssh2 / …) | 平台专属带 os/cpu |
+| `@jinsiyu/dsh-code-server-runtime-win32-<arch>` | 平台聚合包:`dependencies` 用 `npm:` 别名把上面 16 个原生包 + **argon2** 装回原始名字 | win32-<arch> |
+
 | 目标 | 命令 |
 |---|---|
-| **打 npm 最新版 code-server** | `pnpm run vendor:latest`(= `--force`):从 registry 取 `code-server@latest` 快照到 `vendor/code-server`;之后**必须**重跑 `repack:code-server`(重发子包)与 `vendor-repacks.mjs`(内部依赖版本会变) |
+| **打 npm 最新版 code-server** | `pnpm run vendor:latest`(= `--force`):从 registry 取 `code-server@latest` 快照到 `vendor/code-server`;之后**必须**重跑 `repack:build` 并重发全部子包 |
 | **指定版本** | `pnpm run vendor:code-server -- --version 4.136.2` |
 | **从已装好的树快照** | `pnpm run vendor:code-server -- --from <code-server 目录>`(秒级) |
-| **重打 code-server 子包** | `pnpm run repack:code-server -- --target win32-arm64,win32-x64 --pack`(x64 会现编 argon2 并校验 PE) |
-| **重建预编译原生包** | `node scripts/vendor-repacks.mjs [--from <已完整安装的树>] --target win32-arm64,win32-x64 --pack`(不给 `--from` 会自己 npm install 解包 + 编译,耗时) |
+| **完整重打子包** | `pnpm run repack:build -- --target win32-arm64,win32-x64 --pack`(不给 `--from` 会自动 npm install 解包 + 编译,耗时) |
+| **只重打 code-server/argon2 包** | `node scripts/vendor-repacks.mjs --reuse --target win32-arm64,win32-x64 --pack`(复用 `repack/build` 里已有的原生包,不重新分析源树) |
 | **发布子包** | `pnpm run publish:repacks`(`--dry-run` 预览;`--only <子串>` 过滤;`--otp <code>` / `--limit N` 应对 2FA) |
-| **发布插件本体** | `npm publish dsh-code-server-app-<version>.tgz --access public`(发布**已验证过的那份 tarball**,不会重新打包) |
+| **发布插件本体** | `pnpm run publish:plugin`(发布**已验证过的那份 tarball**,不会重新打包;默认 dist-tag = `next`) |
+| **推进 latest** | `pnpm run promote -- <version>`(用户重启确认无误后;`--dry-run` 先看当前标签) |
 | **只报告版本** | `pnpm run vendor:check` |
 
 > `pnpm pack` 的 `prepack` 会自动跑一次 `vendor-code-server` 脚本;`vendor/code-server` 已存在时它是
@@ -95,27 +113,27 @@ npm publish dsh-code-server-app-<version>.tgz --access public   # ⑥ 发布插
 
 ```powershell
 # 包内无 postinstall → 无需 pnpm approve-builds / allowBuilds;一条命令装完
-dsh plugin --profile web add dsh-code-server-app@0.1.37
+dsh plugin --profile web add dsh-code-server-app@0.1.40
 # 本地 tarball 同理:
-dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app\dsh-code-server-app-0.1.37.tgz
+dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app\dsh-code-server-app-0.1.40.tgz
 ```
 
-装完即用,**没有第二步、没有「安装环境」、不弹安装指引**。0.1.37 起主包只有 **~105KB**(插件自身代码),
+装完即用,**没有第二步、没有「安装环境」、不弹安装指引**。0.1.40 起主包只有 **~107KB**(插件自身代码),
 其余全部是依赖:
 
-- **code-server 本体**(含 `lib/vscode` 196.9MB + 它自带的 136 个运行时依赖)打成**平台专属子包**
-  `@jinsiyu/dshcs-code-server-<platform>-<arch>@<code-server 版本>`(os/cpu 限定,
-  挂在插件 `optionalDependencies`)→ pnpm 按架构自动选中,运行根在
-  `<profile>\node_modules\@jinsiyu\dshcs-code-server-win32-arm64\code-server`;
-- VS Code 内部依赖里**纯 JS 的部分**(35 个:xterm / katex / typescript / ws / tar …)写在插件
+- **code-server 本体**(含 `lib/vscode` 196.9MB + 它自带的 136 个运行时依赖)是**一个平台无关的包**
+  `@jinsiyu/dshcs-code-server@<code-server 版本>`,写进插件 `dependencies`,运行根在
+  `<profile>\node_modules\@jinsiyu\dshcs-code-server\code-server`;
+- VS Code 内部依赖里**纯 JS 的部分**(35 个:xterm / katex / typescript / ws / tar …)也写在插件
   `dependencies`,由 pnpm 装到 profile 的 `node_modules`(hoisted);
-- **需要编译的原生包**(node-pty / @vscode/sqlite3 / kerberos / koffi / ssh2 / cpu-features /
-  @parcel/watcher / @vscode/windows-* …共 16 个)由 `@jinsiyu/dshcs-*` 预编译包提供,
-  经**平台聚合包** `@jinsiyu/dsh-code-server-runtime-<platform>-<arch>` 用 `npm:` 别名装回**原始名字**;
+- **二进制部分**全部由 `@jinsiyu/dshcs-*` 平台包提供(每个平台各一份,os/cpu 限定):
+  `@jinsiyu/dshcs-argon2-win32-<arch>` 与 16 个原生包,经**平台聚合包**
+  `@jinsiyu/dsh-code-server-runtime-win32-<arch>` 用 `npm:` 别名装回**原始名字**
+  (`argon2` / `node-pty` / `@vscode/sqlite3` / …),聚合包挂在插件 `optionalDependencies` → pnpm 按架构自动选;
 - 因此依赖图里**没有任何带 pre/install/postinstall 或 binding.gyp 的包** →
   不需要 profile 的 `allowBuilds`、不执行任何构建、**使用者机器不需要 C++ 工具链**;
-- **升级插件不再重下 code-server**:子包版本按 code-server 版本缓存,pnpm 会直接复用;
-  只有 code-server 版本变化时才重新下载那 ~58MB。
+- **升级插件不再重下 code-server**:本体包版本按 code-server 版本缓存,pnpm 直接复用;
+  只有 code-server 版本变化时才重新下载那 ~60MB,argon2 平台包只有 ~1.5MB。
 
 ### 安装机制(为什么这样设计)
 
@@ -127,38 +145,44 @@ dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app\dsh-code-
   `sh ./postinstall.sh`:Windows 无 sh,且它只认 npm/yarn 的 user-agent)拿到树 → 补齐 argon2 native
   (win32-arm64 上游无预编译;可复用本机已有 `argon2.node`,见 `DSHCS_ARGON2_BINARY`)→
   剥掉残留安装脚本 → 快照到 `vendor/code-server/`;
-- 随后 `scripts/vendor-code-server-pkg.mjs` 把它打成**平台子包**:树放在包内子目录 `code-server/`
+- 随后同一脚本把 `vendor/code-server` 打成**平台无关的本体包**:树放在包内子目录 `code-server/`
   (npm/pnpm 打包**永远排除包根目录的 node_modules**,放在被 `files` 覆盖的子目录里才会随包发布),
-  子包**不写 `dependencies`**(那 136 个依赖已经作为文件打包在 `code-server/node_modules` 里,
-  写成 dependencies 会让 pnpm 再装一份);`os`/`cpu` 限定 + 各自编译好的 argon2(arm64 0xaa64 / x64 0x8664);
-- **需要编译的包**由 `scripts/vendor-repacks.mjs` 重打包成 `@jinsiyu/dshcs-*`:
+  包**不写 `dependencies`**(那 136 个依赖已经作为文件打包在 `code-server/node_modules` 里,
+  写成 dependencies 会让 pnpm 再装一份),并把 `node_modules/argon2` 整个删掉;
+- **argon2** 单独打成两个平台包(`@jinsiyu/dshcs-argon2-win32-arm64` / `-x64`):与其它原生包同一套规则
+  (删 `scripts`/`files`/`binding.gyp`,删 `prebuilds/` 统一走 `build/Release`),各自用
+  `node-gyp rebuild --arch=<arch>` 现编并校验 PE machine(0xaa64 / 0x8664);
+- **需要编译的包**同样由该脚本重打包成 `@jinsiyu/dshcs-*`:
   复制已编译的包目录 → **删除 `scripts` / `files` / `binding.gyp` / `.hooks` / `.npmignore`**
   (保留编译好的 `.node` 与全部运行时文件)→ 依赖里的同集包改成 `npm:` 别名 → 平台专属的加
   `os`/`cpu` 与 `-<platform>-<arch>` 后缀;
-- **平台聚合包**把重打包包按原始名字装回去(如 `"node-pty": "npm:@jinsiyu/dshcs-node-pty@1.2.0-beta.15"`),
-  于是 VS Code 内部代码 `require('node-pty')` 不用改;聚合包本身 `os`/`cpu` 限定,
+- **平台聚合包**把重打包包与 argon2 按原始名字装回去(如 `"node-pty": "npm:@jinsiyu/dshcs-node-pty@1.2.0-beta.15"`、
+  `"argon2": "npm:@jinsiyu/dshcs-argon2-win32-arm64@0.44.0"`),于是 code-server 与 VS Code 的
+  `require('argon2')` / `require('node-pty')` 都不用改;聚合包本身 `os`/`cpu` 限定,
   插件 `optionalDependencies` 同时声明 win32-arm64 与 win32-x64 两份 → 一条命令自动选对;
-- **解析路径**:host 用 `require.resolve('@jinsiyu/dshcs-code-server-<平台>-<架构>/package.json')`
-  找到运行根(子目录 `code-server/`),入口 `code-server/out/node/entry.js`;
-  VS Code 内部依赖从该运行根向上查找:`code-server/node_modules` → 子包 `node_modules` →
-  `<profile>/node_modules`(hoisted 布局),与运行时完全一致。包内 `vendor/code-server` 仅作
-  开发期/兼容回退。
-
-> **体积提示**:插件 tarball 约 **105KB**;`@jinsiyu/dshcs-code-server-win32-*` 子包各约 **58–60MB**
-> (解包 ~249MB);内部依赖与预编译原生包约 250MB。全部合计安装下载约 310MB。
+- **解析路径**:host 用 `require.resolve('@jinsiyu/dshcs-code-server/package.json')` 找到运行根
+  (包内子目录 `code-server/`),入口 `code-server/out/node/entry.js`;VS Code 内部依赖从该运行根向上查找
+  (`code-server/node_modules` → 包 `node_modules` → `<profile>/node_modules`)。
+- **pnpm 的嵌套陷阱与兜底**:`os`/`cpu` 限定的包 pnpm 往往**嵌套装在聚合包自己的 `node_modules` 下**
+  (如 `<profile>/node_modules/@jinsiyu/dsh-code-server-runtime-win32-arm64/node_modules/argon2`),
+  既不在 profile 根也不在 code-server 树里 → host 在启动 code-server 时把该目录加进 **`NODE_PATH`**,
+  环境检测也按「code-server 运行根 + 聚合包目录」两个锚点解析(`lib/native.js`)。
+
+> **体积提示**:插件 tarball 约 **107KB**;`@jinsiyu/dshcs-code-server` 约 **60.5MB**(解包 ~242MB);
+> 两个 argon2 平台包各约 **1.5MB**;16 个原生包合计约 250MB。全部合计安装下载约 315MB。
 > `vendor/` 与 `repack/` 都不入 git(见 `.gitignore`)。
 
-> **从 ≤ 0.1.36 升级**:插件包内的 `vendor/code-server/` 已移出到平台子包,主包瘦身到 ~105KB;
-> 升级命令不变(一条 `dsh plugin --profile web add dsh-code-server-app@<版本>`),
-> 旧的 `vendor/` 会随旧版本包目录一起被 pnpm 清掉。
+> **从 ≤ 0.1.39 升级**:code-server 从「平台专属子包」改成「**一个平台无关本体包 + 两个 argon2 平台包**」,
+> 二进制部分全部并入统一的原生包脚本管理;升级命令不变(一条
+> `dsh plugin --profile web add dsh-code-server-app@<版本>`),旧的 `dshcs-code-server-win32-*` 子包会被 pnpm 清掉。
 
 > **从 ≤ 0.1.35 升级**:旧版的安装根 `<profile>\.code-server-app`(含约 1.4GB 内部依赖)与
 > 「安装环境」步骤都不再需要 —— 新版本会检测到它并打一条日志提示可安全删除:
 > `Remove-Item -Recurse -Force <profile>\.code-server-app`。profile 的 `pnpm-workspace.yaml` 里
 > 若还留着 `dsh-code-server-app: false` 之类的旧条目,也可以删掉(新版不再需要任何构建许可)。
 
-> **卸载**:`dsh plugin --profile web remove dsh-code-server-app` 即可;code-server 子包与原生包
-> 是独立依赖,若要彻底清干净可再 `dsh plugin --profile web remove @jinsiyu/dshcs-code-server-win32-arm64`
+> **卸载**:`dsh plugin --profile web remove dsh-code-server-app` 即可;本体包、argon2 与原生包
+> 是独立依赖,若要彻底清干净可再 `dsh plugin --profile web remove @jinsiyu/dshcs-code-server`
 > (或直接在 profile 里 `pnpm remove`);若还残留旧安装根,再手动删除 `<profile>\.code-server-app`。
 
 > 安装/依赖变化后请**重启 `dsh web`**(静态插件行与 host 探测路径在启动时加载)。
@@ -211,17 +235,18 @@ dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app
   也可 `pnpm run vendor:code-server -- --version 4.136.2` 或设 `DSHCS_CODE_SERVER_VERSION`。
   已有 `vendor/code-server` 时,不带 `--force`/`--version` 不会升级(日常 `pnpm pack` 是 no-op)。
 - **先查再升**:`pnpm run vendor:check` 打印「内置版本 / npm latest」。
-- **换版本后要重发两类子包**(内部依赖版本会跟着 code-server 变):
-  1. `pnpm run repack:code-server -- --target win32-arm64,win32-x64 --pack` → 新版本号的 code-server 平台子包;
-  2. `node scripts/vendor-repacks.mjs --target win32-arm64,win32-x64 --pack` → 预编译原生包(并把新的
-     「纯 JS 直装集」写进插件 `dependencies`、更新两个聚合包版本);
-  3. `pnpm run publish:repacks` → 发布;然后 bump 插件版本 → `pnpm pack` → 发布插件。
+- **换版本后重新出子包并发布**(全部由同一个脚本):
+  1. `pnpm run repack:build -- --target win32-arm64,win32-x64 --pack` → 新的本体包
+     (`@jinsiyu/dshcs-code-server@<新版本>`)、新的 argon2 平台包、以及按新内部依赖重建的原生包
+     (脚本会把新的「纯 JS 直装集」写进插件 `dependencies`、更新两个聚合包版本);
+  2. `pnpm run publish:repacks` → 发布;然后 bump 插件版本 → `pnpm pack` → 发布插件。
 - **不再有运行期自动升级**:不会在启动时联网取 latest;版本完全由内置产物决定。
 - 本机当前内置:`code-server@4.136.2`(with Code 1.136.1)。
 
 ### 兼容旧安装位
 
-host 探测顺序:`@jinsiyu/dshcs-code-server-<平台>-<架构>/code-server`(**0.1.37+ 正式布局**)> 插件包内
+host 探测顺序:`@jinsiyu/dshcs-code-server/code-server`(**0.1.40+ 正式布局**)>
+`@jinsiyu/dshcs-code-server-<平台>-<架构>/code-server`(0.1.37 平台专属子包)> 插件包内
 `vendor/code-server`(0.1.36 及更早 / 开发期)> 旧版安装根
 `<profile>\.code-server-app\node_modules\code-server`(兼容 0.1.35 及更早)> 插件包内
 `node_modules/code-server`(开发期)> PATH/配置 `bin`。旧安装根只在启动日志里提示可删除,不再被写入。
@@ -248,7 +273,7 @@ host 探测顺序:`@jinsiyu/dshcs-code-server-<平台>-<架构>/code-server`(**0
 
 | 键 | 默认 | 说明 |
 |---|---|---|
-| `bin` | `code-server`(占位) | 启动优先级:本配置显式 `bin` > 平台子包 `@jinsiyu/dshcs-code-server-<平台>-<架构>/code-server/out/node/entry.js` > 包内 `vendor/code-server` > 旧安装根 `.code-server-app` > 插件包内 `node_modules` > PATH 中的 `code-server`。都不存在时启动报错并给出排查提示 |
+| `bin` | `code-server`(占位) | 启动优先级:本配置显式 `bin` > 本体包 `@jinsiyu/dshcs-code-server/code-server/out/node/entry.js` > 旧平台子包 `@jinsiyu/dshcs-code-server-<平台>-<架构>` > 包内 `vendor/code-server` > 旧安装根 `.code-server-app` > 插件包内 `node_modules` > PATH 中的 `code-server`。都不存在时启动报错并给出排查提示 |
 | `host` | `127.0.0.1` | 绑定地址;`auth: none` 仅允许回环(localhost/127.0.0.1/::1) |
 | `port` | `8090` | 端口;被占用时启动失败并给出诊断(不自动换端口) |
 | `auth` | `none` | `none` \| `password`;非回环 host 自动要求 password |

package/lib/index.js

@@ -48,7 +48,7 @@ import {
   vendoredVersion,
   vendorReady,
 } from './vendor.js';
-import { aliasNodePathDirs, resolveNativeDir, resolveRuntime, runtimePackageName, verifyNatives } from './native.js';
+import { aliasNodePathDirs, ensureRuntimeLayout, resolveNativeDir, resolveRuntime, runtimePackageName, verifyNatives } from './native.js';
 
 // schemastery 由 DSH 部署自带(官方核心依赖),仿 auto-open-web 的解析策略:
 // 常规 import 优先,不可用时回退到全局 npm 布局的 DSH 部署副本。
@@ -645,6 +645,8 @@ export async function apply(ctx, config) {
 
     let proc;
     try {
+      // 启动前再自愈一次依赖布局(插件重装/树被替换后可能丢失;幂等且只做存在性检查)
+      ensureRuntimeLayout();
       const isCmd = launch.kind === 'bin' && win32() && /\.cmd$/i.test(launch.command);
       const command = launch.kind === 'node' ? process.execPath : launch.command;
       const spawnArgs = launch.kind === 'node' ? [launch.script, ...args] : args;
@@ -878,6 +880,18 @@ export async function apply(ctx, config) {
   }
 
   state.env = envCheck();
+  // 补齐 code-server 树里被"拍平"掉的依赖布局:
+  //   ① VS Code 内部依赖目录(lib/vscode/node_modules、lib/vscode/extensions/node_modules)
+  //      —— 老模型是 npm 装在树里的真实目录,新模型拍平在 profile 根;用显式路径找依赖的代码
+  //      (如内置 TS 扩展找 tsserver.js)否则会报 "tsserver was deleted …";
+  //   ② 聚合包带回的原生别名(ESM import 不认 NODE_PATH,只能靠目录链)。
+  const layout = ensureRuntimeLayout();
+  if (layout.created.length > 0) {
+    console.log(`[code-server] 已补齐 ${layout.created.length} 个依赖链接: ${layout.created.join(', ')}`);
+  }
+  if (layout.failed.length > 0) {
+    console.warn(`[code-server] 依赖链接创建失败: ${layout.failed.join('; ')}`);
+  }
   if (!vendorReady()) {
     console.warn(`[code-server] 找不到 code-server 运行树:平台子包 ${codeServerPackageName()} 未安装,`
       + '且包内 vendor/code-server 不存在(开发期请先 `npm run vendor:code-server`)');

package/lib/native.js

@@ -10,9 +10,10 @@
 //
 // 本模块只做两件事:
 //   1. 找到本平台聚合包(以及它的依赖清单 = 期望可解析的原生模块名);
-//   2. 从 code-server 运行位置出发校验这些模块是否真的能 require 到。
+//   2. 从 code-server 运行位置出发校验这些模块是否真的能 require 到;
+//   3. 必要时在 code-server 树里补齐别名 junction(ESM import 不认 NODE_PATH,只能靠目录链)。
 import { createRequire } from 'node:module';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, mkdirSync, symlinkSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { PACKAGE_ROOT, codeServerRoot, profileRootOf } from './vendor.js';
 
@@ -114,3 +115,116 @@ export function verifyNatives(modules) {
   }
   return { resolved, missing };
 }
+
+/** 某个模块能否**只靠 code-server 运行根**(含其祖先 node_modules)解析。 */
+function resolvesFromRoot(root, name) {
+  try {
+    const from = createRequire(join(root, 'package.json'));
+    for (const spec of [`${name}/package.json`, name]) {
+      try {
+        from.resolve(spec);
+        return true;
+      } catch { /* 试下一个 */ }
+    }
+  } catch { /* 忽略 */ }
+  return false;
+}
+
+/** 确保聚合包带回的别名模块能被 **code-server 树**解析。
+ *
+ *  为什么必须做:pnpm 会把带 `os`/`cpu` 限定的包**嵌套装在聚合包自己的 node_modules 下**
+ *  (如 `<profile>/node_modules/@<scope>/dsh-code-server-runtime-win32-arm64/node_modules/@vscode/windows-registry`),
+ *  而 VS Code 的 `lib/vscode/out/server-main.js` 用 **ESM `import`** 加载这些包 —— ESM 不认
+ *  `NODE_PATH`(那是 CJS 的兜底),只认目录链。所以这里在 `<codeServerRoot>/node_modules` 下
+ *  为每个「从树里解析不到」的别名补一个 junction,指向聚合包内的真实目录。
+ *  幂等、可重复调用;插件重装后由下次激活/启动自愈。
+ *  @returns {{created:string[], failed:string[]}} */
+export function ensureAliasLinks() {
+  const runtime = resolveRuntime();
+  const csRoot = codeServerRoot();
+  if (runtime === null || csRoot === null) return { created: [], failed: [] };
+  const linkRoot = join(csRoot, 'node_modules');
+  const created = [];
+  const failed = [];
+  for (const alias of runtime.modules) {
+    if (resolvesFromRoot(csRoot, alias)) continue; // 目录链已能看到(profile 根或树内),无需补
+    const target = resolveNativeDir(alias);
+    if (target === null) continue; // 该平台包没装上 → 交给 envCheck 报缺
+    const link = join(linkRoot, alias);
+    try {
+      if (existsSync(link)) continue;
+      mkdirSync(dirname(link), { recursive: true });
+      symlinkSync(target, link, process.platform === 'win32' ? 'junction' : 'dir');
+      created.push(alias);
+    } catch (error) {
+      failed.push(`${alias}: ${error && error.message ? error.message : String(error)}`);
+    }
+  }
+  return { created, failed };
+}
+
+/** 从**插件依赖图**解析(插件 node_modules → <profile>/node_modules),即包管理器装出来的真实包目录。
+ *  与 `resolveNativeDir` 的区别:不走 code-server 树(树里可能有别的同名版本,例如 code-server 自带的
+ *  typescript 5.9.3,而 VS Code 要的是 inner deps 里那份 6.0.3)。 */
+function resolveFromPlugin(name) {
+  try {
+    const from = createRequire(join(PACKAGE_ROOT, 'package.json'));
+    for (const spec of [`${name}/package.json`, name]) {
+      try {
+        return dirname(from.resolve(spec));
+      } catch { /* 试下一个 */ }
+    }
+  } catch { /* 忽略 */ }
+  return null;
+}
+
+/** 把 VS Code 的「内部依赖目录」用 junction 补回老布局。
+ *
+ *  为什么需要:老模型里 `lib/vscode/node_modules` 与 `lib/vscode/extensions/node_modules` 是 npm 在树里
+ *  装出来的**真实目录**;新模型把同一批依赖拍平装在 `<profile>/node_modules`,靠模块解析往上层找没问题,
+ *  但**用显式路径拼依赖的代码会失效** —— 例如内置 TypeScript 扩展(1.136.1 实测):
+ *    `path.join(extensionPath, '..', 'node_modules', 'typescript', 'lib', 'tsserver.js')`
+ *  找不到就弹 "VS Code's tsserver was deleted by another application …"。
+ *  这里按两个 package.json 的 dependencies 逐个补 junction(指向插件依赖图里的真实包),幂等、可自愈。
+ *  @returns {{created:string[], failed:string[]}} */
+export function ensureInnerModuleLinks() {
+  const csRoot = codeServerRoot();
+  if (csRoot === null) return { created: [], failed: [] };
+  const vscode = join(csRoot, 'lib', 'vscode');
+  const targets = [
+    { manifest: join(vscode, 'package.json'), dir: join(vscode, 'node_modules') },
+    { manifest: join(vscode, 'extensions', 'package.json'), dir: join(vscode, 'extensions', 'node_modules') },
+  ];
+  const created = [];
+  const failed = [];
+  for (const { manifest, dir } of targets) {
+    let deps;
+    try {
+      deps = JSON.parse(readFileSync(manifest, 'utf8')).dependencies ?? {};
+    } catch { continue; }
+    for (const name of Object.keys(deps)) {
+      const link = join(dir, name);
+      if (existsSync(join(link, 'package.json'))) continue; // 已在位(真实目录或链接)
+      const target = resolveFromPlugin(name);
+      if (target === null) continue; // 该依赖没装(envCheck 会另行报告)
+      try {
+        mkdirSync(dirname(link), { recursive: true });
+        symlinkSync(target, link, process.platform === 'win32' ? 'junction' : 'dir');
+        created.push(name);
+      } catch (error) {
+        failed.push(`${name}: ${error && error.message ? error.message : String(error)}`);
+      }
+    }
+  }
+  return { created, failed };
+}
+
+/** 一次性补齐两类链接:VS Code 内部依赖目录 + 聚合包别名。 */
+export function ensureRuntimeLayout() {
+  const inner = ensureInnerModuleLinks();
+  const aliases = ensureAliasLinks();
+  return {
+    created: [...inner.created, ...aliases.created],
+    failed: [...inner.failed, ...aliases.failed],
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-code-server-app",
-  "version": "0.1.40",
+  "version": "0.1.42",
   "description": "Integrate code-server (VS Code in the browser) into DSH Web and Desktop: right-sidebar tab (DSH >= 0.1.5-alpha.1) with a floating-ball fallback for older hosts, over the Connection /api channel (ctx.connection.fetch; no webServer dependency) with host-side process lifecycle.",
   "homepage": "https://github.com/jinsiyu/dsh-code-server-app",
   "repository": {
@@ -106,6 +106,8 @@
     "vendor:check": "node scripts/vendor-code-server.mjs --check",
     "repack:build": "node scripts/vendor-repacks.mjs",
     "publish:repacks": "node scripts/publish-repacks.mjs",
+    "publish:plugin": "node scripts/publish-plugin.mjs",
+    "promote": "node scripts/promote.mjs",
     "build:client": "node scripts/build-client.mjs"
   }
 }

package/vendor/VENDOR.json

@@ -1,6 +1,6 @@
 {
   "codeServerVersion": "4.136.2",
-  "preparedAt": "2026-09-10T06:32:05.257Z",
+  "preparedAt": "2026-09-10T07:11:10.362Z",
   "source": "registry",
   "node": "v24.13.1",
   "platform": "win32",