dsh-code-server-app 0.3.45 → 0.3.46

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-code-server-app",
-  "version": "0.3.45",
+  "version": "0.3.46",
   "description": "VS Code (from a code-server release) inside DSH: a right-sidebar tab driven by the plugin's own launcher over the in-process VS Code server (lib/launcher.mjs). Since 0.3.0 the bundle also ships an editor bridge (assets/extensions/dshcs-editor-bridge): a read-only channel between the in-tree VS Code extension host and DSH, giving the agent what only the editor knows (unsaved buffers, language-server diagnostics, the active selection) and letting editor gestures drive the session. Since 0.3.22 the ask panel renders that session's new content with DSH's own Markdown renderer (pinned to the deployed DSH UI version); since 0.3.23 it is a full-width dialog with collapsible thinking rows and can answer approval requests in place — the bridge's only non-read-only route (POST /approve, constrained to pending in-process requests and the outcomes allowed-once/rejected; panel-first for 5 minutes, handed back to the official card the moment the panel closes). The tab claims DSH file addresses (dsh-resource://file/**) by file type (setting claimExtensions), so the product's own produced-file chips, delivered-file previews and inline prose mentions open in the workbench. The IDE is a resident surface moved with Element.moveBefore instead of being remounted, so switching sidebar tabs no longer reloads it. Opening the tab switches the right sidebar to fullscreen by default (setting fullscreenOnOpen). Following a workspace switch is lightweight: the workbench re-navigates with the new ?folder= and the IDE process is not restarted (since 0.2.12). Requires a DSH with the right-sidebar services (sidebarRightTabs/sidebarRight, >= 0.1.5-alpha.1); older DSH versions get a single upgrade notice on the settings page and no other UI. Two serving modes: loopback port (default) or same-origin mount on DSH's own webServer (/code-server, protected by ctx.connection.requestRejection). No code-server Node layer, no argon2, no C++ toolchain.",
   "homepage": "https://github.com/jinsiyu/dsh-code-server-app",
   "repository": {
@@ -138,17 +138,21 @@
     "@xterm/addon-webgl": "0.20.0-beta.299",
     "@xterm/headless": "6.1.0-beta.302",
     "@xterm/xterm": "6.1.0-beta.303",
+    "bindings": "1.5.0",
     "cookie": "0.7.2",
     "detect-libc": "2.1.2",
+    "fs-extra": "11.4.0",
     "http-proxy-agent": "7.0.0",
     "https-proxy-agent": "7.0.2",
     "jschardet": "3.1.4",
     "minimist": "1.2.8",
+    "mkdirp": "1.0.4",
     "node-addon-api": "6.1.0",
     "tar": "7.5.22",
     "tas-client": "0.4.3",
     "tslib": "2.8.1",
     "typescript": "6.0.3",
+    "uuid": "14.0.2",
     "vscode-oniguruma": "1.7.0",
     "vscode-regexpp": "3.1.0",
     "vscode-textmate": "9.3.2",

package/scripts/vendor-repacks.mjs

@@ -493,6 +493,49 @@ function readModules(targets) {
   return modules;
 }
 
+/** 平台专属重打包包(写在插件 `optionalDependencies`)自带的**注册表依赖** —— 必须同时提成插件
+ *  自己的直接依赖。原因(0.3.46 实测,复现与证据见 docs/desktop-first-install-root-cause.md 第 5 节):
+ *  pnpm 的增量 hoisted 安装会把「optional 子树里 depth≥2」的依赖整支丢进 `node_modules/.modules.yaml`
+ *  的 `skipped`(`bindings` / `fs-extra` / `uuid` / `mkdirp` 全在内),而 dsh-desktop 在 `pnpm add`
+ *  之后**立刻**用 `require.resolve.paths()` 校验依赖图 ⇒ 首次安装报
+ *  `@jinsiyu/dshcs-kerberos-win32-arm64 requires missing bindings@^1.5.0`;
+ *  更糟的是 `pnpm install --frozen-lockfile` 会认为 «Already up to date»(锁文件本身也缺这些条目),
+ *  于是 profile 永远修不好,只能靠删 node_modules 重装。提到插件根依赖后它们落在 profile 根
+ *  `node_modules`,校验器与运行时都能解析到。这些都是纯 JS、无 ABI 约束,版本在此钉死;
+ *  将来平台专属包新增注册表依赖时 verifyOptionalSubtreeDeps() 会在构建期直接报错。 */
+const OPTIONAL_SUBTREE_DEPS = {
+  bindings: '1.5.0',
+  mkdirp: '1.0.4',
+  'fs-extra': '11.4.0',
+  uuid: '14.0.2',
+};
+
+/** 构建期闸门:平台专属重打包清单里的每个非别名依赖都必须在 OPTIONAL_SUBTREE_DEPS 里。
+ *  @param dirs - 已生成的平台专属重打包目录。 */
+function verifyOptionalSubtreeDeps(dirs) {
+  const seen = new Set();
+  for (const dir of dirs) {
+    const m = readJson(join(dir, 'package.json'));
+    if (m === null) continue;
+    for (const fld of ['dependencies', 'optionalDependencies']) {
+      for (const [name, spec] of Object.entries(m[fld] ?? {})) {
+        if (String(spec).startsWith('npm:')) continue; // 已重打包(真名子包),不走注册表
+        seen.add(name);
+        if (!Object.hasOwn(OPTIONAL_SUBTREE_DEPS, name)) {
+          throw new Error(`${m.name}: 注册表依赖 ${name}@${spec} 不在 OPTIONAL_SUBTREE_DEPS 里 ——`
+            + ' 它位于 optional 子树(depth≥2),pnpm 的增量 hoisted 安装会丢包,'
+            + ' dsh-desktop 安装后立刻校验必报 requires missing;请把它提为插件直接依赖'
+            + '(见 docs/desktop-first-install-root-cause.md 第 5 节)');
+        }
+      }
+    }
+  }
+  const unused = Object.keys(OPTIONAL_SUBTREE_DEPS).filter((name) => !seen.has(name));
+  if (unused.length > 0) {
+    console.warn(`  ⚠ OPTIONAL_SUBTREE_DEPS 里的 ${unused.join(', ')} 已不再被任何平台专属包需要,可以删掉`);
+  }
+}
+
 function main() {
   const hostKey = `${process.platform}-${process.arch}`;
   const targets = TARGETS.length > 0 ? TARGETS : [hostKey];
@@ -610,6 +653,7 @@ function main() {
     }
   }
   // 3) 平台专属包:host 用现成树,其它目标用交叉安装树(--reuse 时用已打包目录)
+  const platformDirs = [];
   if (!REUSE) for (const target of targets) {
     const map = byTarget.get(target);
     const specs = [...repack].filter(([, r]) => r.platformSpecific).map(([name, r]) => ({ name, version: r.pkg.version }));
@@ -624,10 +668,16 @@ function main() {
         continue;
       }
       const dir = writeRepack(srcDir, info, `${flat(name)}-${target}`);
+      platformDirs.push(dir);
       plan.push({ dir, file: tgzName(info.pkgName, r.pkg.version) });
     }
     if (crossTree !== null) rmSync(crossTree, { recursive: true, force: true });
   }
+  // 3b) --reuse 时平台专属目录已存在,就地复查闸门
+  if (REUSE) for (const item of reusedItems) {
+    if (PLATFORM_SUFFIX.test(String(readJson(join(item.dir, 'package.json'))?.name ?? ''))) platformDirs.push(item.dir);
+  }
+  verifyOptionalSubtreeDeps(platformDirs);
   // 3) 重打包表(lib/vendored.json,随插件发布):运行时用它把真名子包补成原始名字
   const vendoredDoc = {
     schemaVersion: 1,
@@ -649,7 +699,8 @@ function main() {
   console.log(`[repack] 生成 ${plan.length} 个待打包目录 → repack/ (计划:repack/pack-plan.json)`);
 
   // 4) 改写插件 package.json 的依赖:树 + 纯 JS 直装集 + **全平台**重打包包写 dependencies(真名);
-  //    平台专属的重打包包按目标写 optionalDependencies(真名 + 包自带 os/cpu,包管理器按架构自动选)。
+  //    平台专属的重打包包按目标写 optionalDependencies(真名 + 包自带 os/cpu,包管理器按架构自动选),
+  //    它们自己的注册表依赖再由 OPTIONAL_SUBTREE_DEPS 提到 dependencies(否则 pnpm 丢包,见该表注释)。
   //    这样每个包在依赖图里都是「根项目的直接依赖」,不依赖 pnpm 对可选子树别名的处理
   //    (见 docs/desktop-first-install-root-cause.md)。
   const pkgFile = join(pkgRoot, 'package.json');
@@ -658,13 +709,15 @@ function main() {
     [vscodePkg.name, vscodePkg.version],
     ...declare.map((d) => [d.name, d.version]),
     ...independent.map((m) => [m.package, m.version]),
+    ...Object.entries(OPTIONAL_SUBTREE_DEPS),
   ].sort(([a], [b]) => a.localeCompare(b)));
   pluginPkg.optionalDependencies = Object.fromEntries(targets
     .flatMap((t) => specific.map((m) => [`${m.package}-${t}`, m.version]))
     .sort(([a], [b]) => a.localeCompare(b)));
   writeFileSync(pkgFile, JSON.stringify(pluginPkg, null, 2) + '\n', 'utf8');
   console.log(`[repack] 已写入 package.json:dependencies ${Object.keys(pluginPkg.dependencies).length} 个`
-    + `(VS Code 树 + 纯 JS + ${independent.length} 个全平台重打包包),`
+    + `(VS Code 树 + 纯 JS + ${independent.length} 个全平台重打包包`
+    + ` + ${Object.keys(OPTIONAL_SUBTREE_DEPS).length} 个 optional 子树兜底依赖),`
     + `optionalDependencies ${Object.keys(pluginPkg.optionalDependencies).length} 个`
     + `(${specific.length} 个平台专属重打包包 × ${targets.length} 个目标)`);