dsh-code-server-app 0.1.41 → 0.1.42

package/README.en.md

@@ -61,11 +61,22 @@ pnpm run build:client    # src/factory.js → lib/client.js (not committed; must
 pnpm run vendor:check    # optional: show the bundled code-server version vs npm latest
 pnpm run vendor:code-server                      # ① produce vendor/code-server (the upstream tree)
 pnpm run repack:build -- --target win32-arm64,win32-x64 --pack   # ② one script builds every sub-package
-pnpm run publish:repacks                         # ③ publish every @jinsiyu/* sub-package
+pnpm run publish:repacks                         # ③ publish every @jinsiyu/* sub-package (default dist-tag: next)
 pnpm pack                                        # ④ → dsh-code-server-app-<version>.tgz (~107KB)
-npm publish dsh-code-server-app-<version>.tgz --access public   # ⑤ publish the plugin itself (same verified tarball)
+pnpm run publish:plugin                          # ⑤ publish the plugin itself (default dist-tag: next)
+# once the user has restarted dsh web and confirmed it works, promote latest:
+pnpm run promote -- <version>
 ```
 
+> **dist-tag policy (mandatory)**: every release goes to **`next`** and **never touches `latest`**;
+> `latest` always points at the most recent *confirmed bug-free* version and is only moved by
+> `pnpm run promote -- <version>` (= `npm dist-tag add dsh-code-server-app@<version> latest`)
+> **after the user restarts `dsh web` and confirms it works**. That way
+> `dsh plugin add dsh-code-server-app` (no version) — and anything else resolving `latest` — never picks up an
+> unverified build. Sub-packages (`@jinsiyu/dshcs-*`, the aggregators) are referenced by exact/caret versions,
+> so their dist-tags do not affect resolution, but they default to `next` as well.
+> Inspect the current tags with `npm dist-tag ls dsh-code-server-app`.
+
 `repack:build` (`scripts/vendor-repacks.mjs`) is the **single script that produces every sub-package**:
 
 | Sub-package | Content | os/cpu |
@@ -83,7 +94,8 @@ npm publish dsh-code-server-app-<version>.tgz --access public   # ⑤ publish th
 | **Rebuild every sub-package** | `pnpm run repack:build -- --target win32-arm64,win32-x64 --pack` (without `--from` it npm-installs and compiles the source tree itself — slow) |
 | **Rebuild only the code-server/argon2 packages** | `node scripts/vendor-repacks.mjs --reuse --target win32-arm64,win32-x64 --pack` (reuses the natives already in `repack/build`, no source-tree analysis) |
 | **Publish sub-packages** | `pnpm run publish:repacks` (`--dry-run` to preview; `--only <substr>` to filter; `--otp <code>` / `--limit N` for 2FA) |
-| **Publish the plugin itself** | `npm publish dsh-code-server-app-<version>.tgz --access public` (publishes the exact tarball that was verified; no re-packing) |
+| **Publish the plugin itself** | `pnpm run publish:plugin` (publishes the exact tarball that was verified; no re-packing; default dist-tag `next`) |
+| **Promote `latest`** | `pnpm run promote -- <version>` (only after the user restarted and confirmed; `--dry-run` shows the current tags first) |
 | **Just report versions** | `pnpm run vendor:check` |
 
 > `pnpm pack`'s `prepack` runs the vendor-code-server script once; when `vendor/code-server` already exists it is

package/README.md

@@ -70,11 +70,20 @@ pnpm run build:client    # src/factory.js → lib/client.js(不入库,必须先
 pnpm run vendor:check    # 可选:查看内置 code-server 版本 vs npm 最新版
 pnpm run vendor:code-server                      # ① 生成 vendor/code-server(上游 code-server 树)
 pnpm run repack:build -- --target win32-arm64,win32-x64 --pack   # ② 统一脚本产出全部子包(见下表)
-pnpm run publish:repacks                         # ③ 发布全部 @jinsiyu/* 子包(需 npm 登录)
+pnpm run publish:repacks                         # ③ 发布全部 @jinsiyu/* 子包(默认 dist-tag = next)
 pnpm pack                                        # ④ → dsh-code-server-app-<version>.tgz(约 107KB)
-npm publish dsh-code-server-app-<version>.tgz --access public   # ⑤ 发布插件本体(同一次验证的 tarball)
+pnpm run publish:plugin                          # ⑤ 发布插件本体(默认 dist-tag = next)
+# 用户重启 dsh web 确认无误后,再把 latest 推进到该版本:
+pnpm run promote -- <version>
 ```
 
+> **dist-tag 政策(必须遵守)**:发布一律发到 **`next`**,**不动 `latest`**;
+> `latest` 只保留「最近一个确认无 bug 的版本」,由 `pnpm run promote -- <version>`
+> (= `npm dist-tag add dsh-code-server-app@<version> latest`)在**用户重启 dsh web 确认无误后**才推进。
+> 这样 `dsh plugin add dsh-code-server-app`(不带版本)和任何按 latest 安装的流程都不会拿到未验证的版本。
+> 子包(`@jinsiyu/dshcs-*`、聚合包)被依赖以精确/插入符版本引用,dist-tag 不影响解析,但同样默认发 `next`。
+> 查看当前标签:`npm dist-tag ls dsh-code-server-app`。
+
 `repack:build`(`scripts/vendor-repacks.mjs`)是**唯一的子包产出脚本**,一次生成:
 
 | 子包 | 内容 | os/cpu |
@@ -92,7 +101,8 @@ npm publish dsh-code-server-app-<version>.tgz --access public   # ⑤ 发布插
 | **完整重打子包** | `pnpm run repack:build -- --target win32-arm64,win32-x64 --pack`(不给 `--from` 会自动 npm install 解包 + 编译,耗时) |
 | **只重打 code-server/argon2 包** | `node scripts/vendor-repacks.mjs --reuse --target win32-arm64,win32-x64 --pack`(复用 `repack/build` 里已有的原生包,不重新分析源树) |
 | **发布子包** | `pnpm run publish:repacks`(`--dry-run` 预览;`--only <子串>` 过滤;`--otp <code>` / `--limit N` 应对 2FA) |
-| **发布插件本体** | `npm publish dsh-code-server-app-<version>.tgz --access public`(发布**已验证过的那份 tarball**,不会重新打包) |
+| **发布插件本体** | `pnpm run publish:plugin`(发布**已验证过的那份 tarball**,不会重新打包;默认 dist-tag = `next`) |
+| **推进 latest** | `pnpm run promote -- <version>`(用户重启确认无误后;`--dry-run` 先看当前标签) |
 | **只报告版本** | `pnpm run vendor:check` |
 
 > `pnpm pack` 的 `prepack` 会自动跑一次 `vendor-code-server` 脚本;`vendor/code-server` 已存在时它是

package/lib/index.js

@@ -48,7 +48,7 @@ import {
   vendoredVersion,
   vendorReady,
 } from './vendor.js';
-import { aliasNodePathDirs, ensureAliasLinks, resolveNativeDir, resolveRuntime, runtimePackageName, verifyNatives } from './native.js';
+import { aliasNodePathDirs, ensureRuntimeLayout, resolveNativeDir, resolveRuntime, runtimePackageName, verifyNatives } from './native.js';
 
 // schemastery 由 DSH 部署自带(官方核心依赖),仿 auto-open-web 的解析策略:
 // 常规 import 优先,不可用时回退到全局 npm 布局的 DSH 部署副本。
@@ -645,8 +645,8 @@ export async function apply(ctx, config) {
 
     let proc;
     try {
-      // 启动前再自愈一次别名链接(插件重装/树被替换后可能丢失;幂等且只做存在性检查)
-      ensureAliasLinks();
+      // 启动前再自愈一次依赖布局(插件重装/树被替换后可能丢失;幂等且只做存在性检查)
+      ensureRuntimeLayout();
       const isCmd = launch.kind === 'bin' && win32() && /\.cmd$/i.test(launch.command);
       const command = launch.kind === 'node' ? process.execPath : launch.command;
       const spawnArgs = launch.kind === 'node' ? [launch.script, ...args] : args;
@@ -880,14 +880,17 @@ export async function apply(ctx, config) {
   }
 
   state.env = envCheck();
-  // pnpm 会把 os/cpu 限定的原生包嵌套装在聚合包下,而 VS Code 的 server-main.js 用 ESM import
-  // (不认 NODE_PATH)→ 在 code-server 树里补齐别名 junction,否则页面会 500。
-  const aliases = ensureAliasLinks();
-  if (aliases.created.length > 0) {
-    console.log(`[code-server] 已补齐 ${aliases.created.length} 个别名链接: ${aliases.created.join(', ')}`);
-  }
-  if (aliases.failed.length > 0) {
-    console.warn(`[code-server] 别名链接创建失败: ${aliases.failed.join('; ')}`);
+  // 补齐 code-server 树里被"拍平"掉的依赖布局:
+  //   ① VS Code 内部依赖目录(lib/vscode/node_modules、lib/vscode/extensions/node_modules)
+  //      —— 老模型是 npm 装在树里的真实目录,新模型拍平在 profile 根;用显式路径找依赖的代码
+  //      (如内置 TS 扩展找 tsserver.js)否则会报 "tsserver was deleted …";
+  //   ② 聚合包带回的原生别名(ESM import 不认 NODE_PATH,只能靠目录链)。
+  const layout = ensureRuntimeLayout();
+  if (layout.created.length > 0) {
+    console.log(`[code-server] 已补齐 ${layout.created.length} 个依赖链接: ${layout.created.join(', ')}`);
+  }
+  if (layout.failed.length > 0) {
+    console.warn(`[code-server] 依赖链接创建失败: ${layout.failed.join('; ')}`);
   }
   if (!vendorReady()) {
     console.warn(`[code-server] 找不到 code-server 运行树:平台子包 ${codeServerPackageName()} 未安装,`

package/lib/native.js

@@ -162,3 +162,69 @@ export function ensureAliasLinks() {
   }
   return { created, failed };
 }
+
+/** 从**插件依赖图**解析(插件 node_modules → <profile>/node_modules),即包管理器装出来的真实包目录。
+ *  与 `resolveNativeDir` 的区别:不走 code-server 树(树里可能有别的同名版本,例如 code-server 自带的
+ *  typescript 5.9.3,而 VS Code 要的是 inner deps 里那份 6.0.3)。 */
+function resolveFromPlugin(name) {
+  try {
+    const from = createRequire(join(PACKAGE_ROOT, 'package.json'));
+    for (const spec of [`${name}/package.json`, name]) {
+      try {
+        return dirname(from.resolve(spec));
+      } catch { /* 试下一个 */ }
+    }
+  } catch { /* 忽略 */ }
+  return null;
+}
+
+/** 把 VS Code 的「内部依赖目录」用 junction 补回老布局。
+ *
+ *  为什么需要:老模型里 `lib/vscode/node_modules` 与 `lib/vscode/extensions/node_modules` 是 npm 在树里
+ *  装出来的**真实目录**;新模型把同一批依赖拍平装在 `<profile>/node_modules`,靠模块解析往上层找没问题,
+ *  但**用显式路径拼依赖的代码会失效** —— 例如内置 TypeScript 扩展(1.136.1 实测):
+ *    `path.join(extensionPath, '..', 'node_modules', 'typescript', 'lib', 'tsserver.js')`
+ *  找不到就弹 "VS Code's tsserver was deleted by another application …"。
+ *  这里按两个 package.json 的 dependencies 逐个补 junction(指向插件依赖图里的真实包),幂等、可自愈。
+ *  @returns {{created:string[], failed:string[]}} */
+export function ensureInnerModuleLinks() {
+  const csRoot = codeServerRoot();
+  if (csRoot === null) return { created: [], failed: [] };
+  const vscode = join(csRoot, 'lib', 'vscode');
+  const targets = [
+    { manifest: join(vscode, 'package.json'), dir: join(vscode, 'node_modules') },
+    { manifest: join(vscode, 'extensions', 'package.json'), dir: join(vscode, 'extensions', 'node_modules') },
+  ];
+  const created = [];
+  const failed = [];
+  for (const { manifest, dir } of targets) {
+    let deps;
+    try {
+      deps = JSON.parse(readFileSync(manifest, 'utf8')).dependencies ?? {};
+    } catch { continue; }
+    for (const name of Object.keys(deps)) {
+      const link = join(dir, name);
+      if (existsSync(join(link, 'package.json'))) continue; // 已在位(真实目录或链接)
+      const target = resolveFromPlugin(name);
+      if (target === null) continue; // 该依赖没装(envCheck 会另行报告)
+      try {
+        mkdirSync(dirname(link), { recursive: true });
+        symlinkSync(target, link, process.platform === 'win32' ? 'junction' : 'dir');
+        created.push(name);
+      } catch (error) {
+        failed.push(`${name}: ${error && error.message ? error.message : String(error)}`);
+      }
+    }
+  }
+  return { created, failed };
+}
+
+/** 一次性补齐两类链接:VS Code 内部依赖目录 + 聚合包别名。 */
+export function ensureRuntimeLayout() {
+  const inner = ensureInnerModuleLinks();
+  const aliases = ensureAliasLinks();
+  return {
+    created: [...inner.created, ...aliases.created],
+    failed: [...inner.failed, ...aliases.failed],
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-code-server-app",
-  "version": "0.1.41",
+  "version": "0.1.42",
   "description": "Integrate code-server (VS Code in the browser) into DSH Web and Desktop: right-sidebar tab (DSH >= 0.1.5-alpha.1) with a floating-ball fallback for older hosts, over the Connection /api channel (ctx.connection.fetch; no webServer dependency) with host-side process lifecycle.",
   "homepage": "https://github.com/jinsiyu/dsh-code-server-app",
   "repository": {
@@ -106,6 +106,8 @@
     "vendor:check": "node scripts/vendor-code-server.mjs --check",
     "repack:build": "node scripts/vendor-repacks.mjs",
     "publish:repacks": "node scripts/publish-repacks.mjs",
+    "publish:plugin": "node scripts/publish-plugin.mjs",
+    "promote": "node scripts/promote.mjs",
     "build:client": "node scripts/build-client.mjs"
   }
 }

package/vendor/VENDOR.json

@@ -1,6 +1,6 @@
 {
   "codeServerVersion": "4.136.2",
-  "preparedAt": "2026-09-10T06:56:36.771Z",
+  "preparedAt": "2026-09-10T07:11:10.362Z",
   "source": "registry",
   "node": "v24.13.1",
   "platform": "win32",