dsh-code-server-app 0.2.12 → 0.2.13

package/README.en.md

@@ -209,9 +209,12 @@ state preserved (no full reload). Full evidence and probe scripts: `docs/analysi
   "Install the plugin (script-free install; code-server bundled)" below — `pnpm install` → `pnpm run build:client` →
   `pnpm run vendor:vscode` → `pnpm pack` + `dsh plugin --profile web add`.
 
-> Verified locally (BM: Windows 11 ARM64): `code-server@4.136.2` (with Code 1.136.1) bundled in the plugin,
-> placed offline at activation → VS Code internal deps installed → started → healthz 200 →
-> cwd switch restart while running → stopped → fully recycled.
+> Verified locally (BM: Windows 11 ARM64): the whole tree/dependency chain is supplied by per-platform
+> sub-packages — the tree package `@jinsiyu/dshcs-vscode-server` (currently 4.137.0, a 50.8 MB tarball),
+> the pure-JS inner dependencies directly in the plugin's `dependencies`, and 16 prebuilt native modules
+> re-exported under their original names by the aggregator `@jinsiyu/dsh-code-server-runtime-win32-<arch>`
+> (picked by os/cpu) → healthz 200 → stopped → fully recycled.
+> (The 0.1.37-era "one big platform package" layout is gone — see "Upgrading the VS Code tree" below.)
 
 ## Packaging (how to build the tarball)
 
@@ -249,7 +252,7 @@ pnpm run promote -- <version>
 | Goal | Command |
 |---|---|
 | **Build from the latest upstream release** | `pnpm run vendor:latest` (= `--force`): pulls `code-server@latest`'s tree into `vendor/vscode`; afterwards you **must** re-run `repack:build` and republish every sub-package |
-| **Pin a version** | `pnpm run vendor:vscode -- --version 4.136.2` |
+| **Pin a version** | `pnpm run vendor:vscode -- --version 4.137.0` |
 | **Snapshot from an existing tree** | `pnpm run vendor:vscode -- --from <code-server dir>` (seconds) |
 | **Rebuild every sub-package** | `pnpm run repack:build -- --target win32-arm64,win32-x64 --pack` (without `--from` it npm-installs and compiles the source tree itself — slow) |
 | **Rebuild only the tree/aggregator packages** | `node scripts/vendor-repacks.mjs --reuse --target win32-arm64,win32-x64 --pack` (reuses the natives already in `repack/build`) |
@@ -381,8 +384,17 @@ dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app
 ### Upgrading the VS Code tree (upstream = a code-server release)
 
 - **The version is decided at pack time**: `pnpm run vendor:latest` (= `--force`) pulls the tree of the npm **latest**
-  release; or use `pnpm run vendor:vscode -- --version 4.136.2` / `DSHCS_CODE_SERVER_VERSION`.
+  release; or use `pnpm run vendor:vscode -- --version 4.137.0` / `DSHCS_CODE_SERVER_VERSION`.
   With an existing `vendor/vscode`, a plain `pnpm pack` never upgrades (it is a no-op).
+  **Source-tree precedence (fixed in 0.2.13)**: an explicit `--from` uses that tree, while an explicit
+  `--force`/`--version` now **always goes to the registry** — before the fix a local source tree won
+  (`defaultSourceTree()` hit `vendor/code-server` or an installed profile tree first), so the documented
+  "`vendor:latest` takes latest from the registry" silently kept the old version (hit while upgrading to 0.2.13:
+  the bundled tree stayed at 4.136.2). A run with neither flag still reuses a local tree to save the download.
+- **Sync the inner dependency pins when the tree changes**: in `--reuse` mode the pure-JS install set is read from
+  the **plugin's package.json**, so update those pins from the new tree's `lib/vscode/package.json` first
+  (this time: 10 `@xterm/*` beta bumps). The rule is "only move a pin that no longer satisfies the new range",
+  which keeps already-newer pins such as `cookie`/`ws`/`tar`/`node-addon-api` from being downgraded.
 - **Check first**: `pnpm run vendor:check` prints the bundled version / upstream latest.
 - **A version bump means rebuilding and republishing the sub-packages** (all with the same script):
   1. `pnpm run repack:build -- --target win32-arm64,win32-x64 --pack` → the new tree package
@@ -393,7 +405,7 @@ dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app
 - `productPath` (`<quality>-<commit>`, part of the client WebSocket path) is **computed from `lib/vscode/product.json`**,
   so upgrading the tree needs no code change — but the routes are registered at activation, so restart `dsh web` afterwards.
 - **No runtime auto-upgrade anymore**: nothing fetches latest at startup; the version is fully determined by the bundled artifact.
-- Bundled locally right now: the tree of `code-server@4.136.2` (VS Code 1.136.1, `productPath=stable-8d5f383f…`).
+- Bundled locally right now: the tree of `code-server@4.137.0` (VS Code 1.137.0, `productPath=stable-b11dabda…`).
 
 ### Compatibility with the old install locations
 

package/README.md

@@ -205,10 +205,11 @@ DSH 用**资源地址**命名文件,`openFile` 只负责把地址交给右侧栏
   "打包(如何出包)"执行 `pnpm install` → `pnpm run build:client` → `pnpm run vendor:vscode` →
   (发布预编译原生包)→ `pnpm pack` + `dsh plugin --profile web add` 即可。
 
-> 本机(BM: Windows 11 ARM64)实测:`code-server@4.136.2`(with Code 1.136.1)由平台子包
-> `@jinsiyu/dshcs-code-server-win32-arm64` 提供(主包 0.1.37 仅 105KB),
-> 35 个纯 JS 内部依赖 + 16 个预编译原生包(经平台聚合包装回原名)由 pnpm 一条命令装好 →
-> healthz 200 → 运行中切换 cwd 重启 → 停止 → 回收全链路验证。
+> 本机(BM: Windows 11 ARM64)实测:树/依赖全链路是"平台子包 + 聚合包"供给 ——
+> 树包 `@jinsiyu/dshcs-vscode-server`(当前 4.137.0,50.8 MB tgz)、纯 JS 内部依赖直接进插件
+> `dependencies`、16 个预编译原生包经平台聚合包 `@jinsiyu/dsh-code-server-runtime-win32-<arch>`
+> (按 os/cpu 自动选)装回原名 → healthz 200 → 停止 → 回收全链路验证。
+> (0.1.37 时代的主包形态已废弃,见下方"升级 VS Code 树"。)
 
 ## 打包(如何出包)
 
@@ -246,7 +247,7 @@ pnpm run promote -- <version>
 | 目标 | 命令 |
 |---|---|
 | **打最新版(上游 code-server 发行版)** | `pnpm run vendor:latest`(= `--force`):从 registry 取 `code-server@latest` 的树到 `vendor/vscode`;之后**必须**重跑 `repack:build` 并重发全部子包 |
-| **指定版本** | `pnpm run vendor:vscode -- --version 4.136.2` |
+| **指定版本** | `pnpm run vendor:vscode -- --version 4.137.0` |
 | **从已装好的树快照** | `pnpm run vendor:vscode -- --from <code-server 目录>`(秒级) |
 | **开发期让树可直接跑** | `pnpm run vendor:vscode -- --dev-links`(额外把 `lib/vscode/node_modules` 用 junction 补上) |
 | **完整重打子包** | `pnpm run repack:build -- --target win32-arm64,win32-x64 --pack`(不给 `--from` 会自动 npm install 解包 + 编译,耗时) |
@@ -384,8 +385,15 @@ dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app
 ### 升级 VS Code 树(上游 = code-server 发行版)
 
 - **打包期决定版本**:`pnpm run vendor:latest`(= `--force`)取 npm **最新版 code-server** 的树并重建 `vendor/vscode`;
-  也可 `pnpm run vendor:vscode -- --version 4.136.2` 或设 `DSHCS_CODE_SERVER_VERSION`。
+  也可 `pnpm run vendor:vscode -- --version 4.137.0` 或设 `DSHCS_CODE_SERVER_VERSION`。
   已有 `vendor/vscode` 时,不带 `--force`/`--version` 不会升级(日常 `pnpm pack` 是 no-op)。
+  **源树优先级(0.2.13 修正)**:显式 `--from` 用给定树;显式 `--force`/`--version` **一定走 registry**
+  —— 修正前它们会被"本机已有源树"抢走(`defaultSourceTree()` 先命中 `vendor/code-server` 或 profile 里的旧树),
+  于是 README 写的"`vendor:latest` 从 registry 取 latest"实际拿不到新版本(0.2.13 升级时踩到:内置树一直停在 4.136.2);
+  只有既没 `--force` 也没 `--version` 时才复用本机源树省一次下载。
+- **换版本时同步树内依赖 pin**:`--reuse` 模式下纯 JS 直装集是从**插件 package.json 现读**的,
+  所以要先按新树的 `lib/vscode/package.json` 更新 pin(本次 10 个 `@xterm/*` 的 beta 跳号;
+  判定规则是"现有 pin 不满足新范围才动",避免把 `cookie`/`ws`/`tar`/`node-addon-api` 这类已有更高版本降级)。
 - **先查再升**:`pnpm run vendor:check` 打印「内置版本 / 上游 latest」。
 - **换版本后重新出子包并发布**(全部由同一个脚本):
   1. `pnpm run repack:build -- --target win32-arm64,win32-x64 --pack` → 新的树包
@@ -395,7 +403,7 @@ dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app
 - `productPath`(`<quality>-<commit>`,客户端 WS 路径的组成)**从 `lib/vscode/product.json` 现算**,
   升级树后无需改代码 —— 但也意味着切版本后必须重启 dsh web(路由在激活期注册)。
 - **不再有运行期自动升级**:不会在启动时联网取 latest;版本完全由内置产物决定。
-- 本机当前内置:`code-server@4.136.2` 的树(VS Code 1.136.1,`productPath=stable-8d5f383f…`)。
+- 本机当前内置:`code-server@4.137.0` 的树(VS Code 1.137.0,`productPath=stable-b11dabda…`)。
 
 ### 兼容旧安装位
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-code-server-app",
-  "version": "0.2.12",
+  "version": "0.2.13",
   "description": "VS Code (from a code-server release) inside DSH: a right-sidebar tab driven by the plugin's own launcher over the in-process VS Code server (lib/launcher.mjs). The tab claims DSH file addresses (dsh-resource://file/**) by file type (setting claimExtensions), so the product's own produced-file chips, delivered-file previews and inline prose mentions open in the workbench. The IDE is a resident surface moved with Element.moveBefore instead of being remounted, so switching sidebar tabs no longer reloads it. Opening the tab switches the right sidebar to fullscreen by default (setting fullscreenOnOpen). Following a workspace switch is lightweight: the workbench re-navigates with the new ?folder= and the IDE process is not restarted (since 0.2.12). Requires a DSH with the right-sidebar services (sidebarRightTabs/sidebarRight, >= 0.1.5-alpha.1); older DSH versions get a single upgrade notice on the settings page and no other UI. Two serving modes: loopback port (default) or same-origin mount on DSH's own webServer (/code-server, protected by ctx.connection.requestRejection). No code-server Node layer, no argon2, no C++ toolchain.",
   "homepage": "https://github.com/jinsiyu/dsh-code-server-app",
   "repository": {
@@ -62,7 +62,7 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@jinsiyu/dshcs-vscode-server": "4.136.2",
+    "@jinsiyu/dshcs-vscode-server": "4.137.0",
     "@microsoft/1ds-core-js": "3.2.13",
     "@microsoft/1ds-post-js": "3.2.13",
     "@vscode/iconv-lite-umd": "0.7.1",
@@ -70,16 +70,16 @@
     "@vscode/sandbox-runtime": "0.0.1",
     "@vscode/tree-sitter-wasm": "0.3.1",
     "@vscode/vscode-languagedetection": "1.0.23",
-    "@xterm/addon-clipboard": "0.3.0-beta.301",
-    "@xterm/addon-image": "0.10.0-beta.299",
-    "@xterm/addon-ligatures": "0.11.0-beta.299",
-    "@xterm/addon-progress": "0.3.0-beta.299",
-    "@xterm/addon-search": "0.17.0-beta.299",
-    "@xterm/addon-serialize": "0.15.0-beta.299",
-    "@xterm/addon-unicode11": "0.10.0-beta.299",
-    "@xterm/addon-webgl": "0.20.0-beta.298",
-    "@xterm/headless": "6.1.0-beta.301",
-    "@xterm/xterm": "6.1.0-beta.302",
+    "@xterm/addon-clipboard": "0.3.0-beta.302",
+    "@xterm/addon-image": "0.10.0-beta.300",
+    "@xterm/addon-ligatures": "0.11.0-beta.300",
+    "@xterm/addon-progress": "0.3.0-beta.300",
+    "@xterm/addon-search": "0.17.0-beta.300",
+    "@xterm/addon-serialize": "0.15.0-beta.300",
+    "@xterm/addon-unicode11": "0.10.0-beta.300",
+    "@xterm/addon-webgl": "0.20.0-beta.299",
+    "@xterm/headless": "6.1.0-beta.302",
+    "@xterm/xterm": "6.1.0-beta.303",
     "cookie": "0.7.2",
     "detect-libc": "2.1.2",
     "http-proxy-agent": "7.0.0",
@@ -100,8 +100,8 @@
     "zod": "4.4.3"
   },
   "optionalDependencies": {
-    "@jinsiyu/dsh-code-server-runtime-win32-arm64": "^0.2.0",
-    "@jinsiyu/dsh-code-server-runtime-win32-x64": "^0.2.0"
+    "@jinsiyu/dsh-code-server-runtime-win32-arm64": "^0.2.13",
+    "@jinsiyu/dsh-code-server-runtime-win32-x64": "^0.2.13"
   },
   "scripts": {
     "vendor:vscode": "node scripts/vendor-vscode-server.mjs",

package/scripts/vendor-vscode-server.mjs

@@ -200,14 +200,19 @@ async function main() {
   }
 
   const skip = existing !== null && !FORCE && FROM === null && PINNED === null;
+  // 源树优先级(0.2.13 修正):显式 `--from` 用给定树;显式 `--force`/`--version` 表示"就是要换版本"
+  // → 只认 registry;其余情况才复用本机已有源树(省一次 53MB 下载)。
+  // 修正前:`--force`/`--version` 也会被本机源树抢先,导致 README 写的
+  // 「vendor:latest(= --force)从 registry 取 latest」实际拿不到新版本(本次升级踩到)。
+  const localSource = FROM === null && !FORCE && PINNED === null ? defaultSourceTree() : null;
   let codeServerVersion = existing;
   let sourceKind = 'registry';
   let sourceTree = null;
 
   if (skip) {
     console.log(`[vendor] vendor/vscode 已存在(code-server@${existing});跳过(用 --force 重建)`);
-  } else if (FROM !== null || (sourceTree = defaultSourceTree()) !== null) {
-    const src = FROM ?? sourceTree;
+  } else if (FROM !== null || localSource !== null) {
+    const src = FROM ?? localSource;
     codeServerVersion = readJson(join(src, 'package.json'))?.version ?? null;
     if (codeServerVersion === null) throw new Error(`--from ${src} 不是一棵 code-server 树`);
     console.log(`[vendor] 源树 ${src}(code-server@${codeServerVersion})→ vendor/vscode/`);

package/vendor/VENDOR.json

@@ -1,12 +1,12 @@
 {
-  "codeServerVersion": "4.136.2",
-  "vscodeVersion": "1.136.1",
-  "productPath": "stable-8d5f383f301ca20681f5b6606b8207d9dc87bdd8",
+  "codeServerVersion": "4.137.0",
+  "vscodeVersion": "1.137.0",
+  "productPath": "stable-b11dabdaca0d3369986975be285db92c8795cea5",
   "layout": "vscode-only",
-  "preparedAt": "2026-09-11T13:53:46.670Z",
+  "preparedAt": "2026-09-11T14:13:32.827Z",
   "source": "registry",
   "node": "v24.13.1",
   "platform": "win32",
   "arch": "arm64",
-  "sizeMB": 197.2
+  "sizeMB": 197.9
 }