dsh-code-server-app 0.3.52 → 0.3.54

package/README.md

@@ -481,6 +481,8 @@ pnpm test:client-seat        # 设置卡住哪个座位:插件页 plugins.bundle
 pnpm test:fullscreen         # 打开标签即全屏
 pnpm test:vendored           # 重打包表 ↔ 插件依赖表一致(无 npm: 别名 / 无聚合包 / vendored.json 进了 files)
 pnpm test:dsh-resolve        # 部署位置表:各平台全局装布局(npm --prefix / nvm / pnpm global / %APPDATA%)都能找到 DSH 部署
+pnpm test:child-node         # Electron 宿主(桌面版)下给 IDE 子进程挑真 Node:候选顺序 / 剥离 ELECTRON_RUN_AS_NODE / 找不到时如实退回
+pnpm test:package-files      # 发布物白名单守卫:files 里的模块**递归**import 到的本地文件也必须在 files 里(0.3.53 漏 lib/child-node.mjs 的事故)
 pnpm test:installed          # 安装冒烟:对**已装进 profile 的产物**做断言(默认 <DSH_HOME>/profiles/web)
                              # files 白名单每条都在 / 重打包包在当前平台齐全 / 原生模块无缺失 /
                              # 已安装副本能 import / 树在位 —— 仓库回归看不出这一类
@@ -962,6 +964,21 @@ desktop profile 由 `apps/desktop-host` 把 `/api/*` 交给同一个 `createShar
 
 ## DSH Desktop(无 webServer)
 
+- **IDE 子进程必须用真 Node 跑(0.3.53 起;桌面版特有的硬约束)**:DSH Desktop 的宿主进程是
+  **Electron 的 Node 模式**(`ELECTRON_RUN_AS_NODE=1`,`process.execPath` = Electron 二进制)。VS Code 的
+  `server-main.js` 会注册一段**只在 Electron / `ELECTRON_RUN_AS_NODE` 下生效**的 asar 解析钩子:凡是解析结果
+  落在"应用根"之外的包,它就去 `node_modules.asar` 里找,找不到直接抛
+  `Cannot find package 'X' within the application resources`。本插件的原生包都是**树外**的 pnpm 目录,
+  所以启动路径上的 `@vscode/spdlog` / `@vscode/deviceid` / `@vscode/windows-registry` 三个 ESM import 必被拒
+  ⇒ launcher 打 `FATAL 加载 VS Code server 失败` ⇒ 面板显示「**code-server 意外退出(exit 2)**」(界面上的
+  报错只有栈尾,首行被日志尾部截断,所以看不出是哪个包)。修法:`lib/child-node.mjs` 检测到 Electron 宿主时,
+  改用**应用自带的真 Node**(`resources/runtime/primary-runtime/dependencies/node/bin/node.exe`,实测 v24.21.0),
+  并把 `ELECTRON_RUN_AS_NODE` 从子进程环境里剥掉;web/CLI 的普通 node 宿主行为一字不变。
+  - 试过但不能用的兜底:`VSCODE_DEV=1`(绕过了钩子,却切到 dev 引导路径 → 报 `<树>/lib/vscode/out/bootstrap-import.js` 缺失);
+    往树里补 junction(Node 的 ESM 解析会 realpath,链接建在树里也仍被判为"应用根之外")。
+  - 回归:`pnpm test:child-node`(9 项)。
+  - **与端口冲突的区别**:端口冲突的签名是 `FATAL 监听失败({...}): listen EADDRINUSE`(发生在**加载成功之后**
+    绑端口阶段),而上面这个是加载阶段就死 —— 用随机端口(随机端口也会炸)即可区分。
 - host 半部 `inject = ['connection', 'settings']`(**不含 `webServer`**)——desktop profile 关掉了 webserver/web-runtime,
   本插件照常工作;`/api/*` 请求由 Electron `dsh-app://` 协议处理器 → IPC 帧管道 → `createSharedFetchHandler('/api')`。
 - 右侧栏标签、guide 入口框、文件地址认领、设置卡片在 desktop 下与 web 相同(code-server 仍是本机 `http://127.0.0.1:<port>` 的 iframe;

package/assets/extensions/dshcs-editor-bridge/webview/THIRD-PARTY.md

@@ -12,7 +12,7 @@
 | react | 18.3.1 | MIT |
 | react-dom | 18.3.1 | MIT |
 
-生成时间:2026-09-18T13:40:53.909Z
+生成时间:2026-09-18T15:59:04.573Z
 渲染器:@deepseek-ai/dsh-client-ui-primitives@0.1.6-alpha.1(DSH 部署的界面版本:未知)
 设计令牌:@deepseek-ai/dsh-client-ui-theme@0.1.6-alpha.1(11 段)
 KaTeX:已打包(公式排版与 DSH 界面一致)

package/lib/child-node.mjs

@@ -0,0 +1,138 @@
+/**
+ * lib/child-node.mjs — 给「VS Code server 子进程」挑一个**真 Node**(0.3.53)。
+ *
+ * 为什么必须挑:DSH Desktop 的宿主进程是用 **Electron 的 Node 模式**跑的
+ * (`ELECTRON_RUN_AS_NODE=1`,`process.execPath` = Electron 二进制;见 harness 的
+ * `apps/desktop/src/node-environment.ts` 与 `host-process.ts`)。插件 spawn launcher 时若照旧用
+ * `process.execPath`,VS Code 的 server-main 会在启动时注册自己的 ESM 解析钩子,而那段钩子
+ * **只在 Electron / ELECTRON_RUN_AS_NODE 下生效**:
+ *
+ *   if (!process.env.ELECTRON_RUN_AS_NODE && !process.versions.electron) return;
+ *   ...
+ *   const L = <默认解析结果>;
+ *   if (!L.startsWith(<应用根>)) {  // 树外 → 去 node_modules.asar 找,找不到就抛
+ *     throw new Error(`Cannot find package '${name}' within the application resources`);
+ *   }
+ *
+ * 本插件的原生包是**树外**的 pnpm 目录(`<profile>/node_modules/.pnpm/…`),于是启动路径上的
+ * `@vscode/spdlog` / `@vscode/deviceid` / `@vscode/windows-registry` 三个 ESM import 被拒,
+ * launcher 打 `FATAL 加载 VS Code server 失败` 后退出 ⇒ 面板显示「code-server 意外退出(exit 2)」。
+ * 2026-09-18 实测(同一棵树、同一份 launcher):
+ *   · Electron(Node 模式)→ 必炸(首行 `Cannot find package '@vscode/spdlog' within the application resources`);
+ *   · 桌面版自带的 `resources/runtime/primary-runtime/dependencies/node/bin/node.exe`(v24.21.0)→
+ *     一次启动成功(`Extension host agent started` + `dshcs-ready`),stderr 全空。
+ *
+ * 所以这里只做一件事:宿主是 Electron 时**找一个真 Node** 给子进程用,并从子进程环境里删掉
+ * `ELECTRON_RUN_AS_NODE`(留着它,真 Node 也会被判成 Electron,钩子照样生效)。普通 node 宿主
+ * (web / CLI)原样返回 `process.execPath`,行为一字不变。找不到真 Node 时退回 Electron(与旧行为一致)
+ * 并由调用方**明确告警**,不再让人对着 exit 2 猜。
+ *
+ * 试过但**不能用**的兜底(2026-09-18 实测,别再走一遍):
+ *   · `VSCODE_DEV=1`:钩子确实被绕过(`s = process.env.VSCODE_DEV ? undefined : …`),但 VS Code 同时切到
+ *     dev 引导路径,转头就报 `Cannot find module '<树>/lib/vscode/out/bootstrap-import.js'` —— 精简树里没这文件。
+ *   · 往树内补 junction:Node 的 ESM 解析会 **realpath**(实测 `import.meta.resolve('@vscode/spdlog')` 返回的是
+ *     pnpm store 路径),所以链接建在树里也仍旧"落在应用根之外",钩子照样拒。
+ *
+ * 纯路径/环境判断,不碰进程 → 可离线单测(scripts/test-child-node.mjs)。
+ */
+
+import { existsSync } from 'node:fs';
+import { posix, win32 } from 'node:path';
+
+/** 宿主是不是 Electron(含 Node 模式的两个判据)。 */
+export function isElectronHost(versions = process.versions, env = process.env) {
+  const flag = env.ELECTRON_RUN_AS_NODE;
+  const flagged = typeof flag === 'string' && flag !== '' && flag !== '0' && flag !== 'false';
+  return Boolean(versions !== null && versions !== undefined && versions.electron) || flagged;
+}
+
+/** 真 Node 的文件名(平台惯例)。 */
+export function nodeBinaryName(platform = process.platform) {
+  return platform === 'win32' ? 'node.exe' : 'node';
+}
+
+/**
+ * 真 Node 候选表(按优先级)。每条都带 `source` 便于日志/断言。
+ * @param options.execPath - 宿主可执行文件(通常是 Electron)。
+ * @param options.resourcesPath - Electron 的 `process.resourcesPath`(可能 undefined)。
+ * @param options.env - 环境变量(PATH / DSH_DESKTOP_NODE_EXECUTABLE)。
+ */
+export function childNodeCandidates(options = {}) {
+  const execPath = typeof options.execPath === 'string' ? options.execPath : process.execPath;
+  const env = options.env ?? process.env;
+  const platform = options.platform ?? process.platform;
+  const resourcesPath = typeof options.resourcesPath === 'string' ? options.resourcesPath : undefined;
+  const bin = nodeBinaryName(platform);
+  // 路径风格跟着 platform 走(而不是跟着"跑测试的这台机器"),Linux/macOS 形态才测得到
+  const paths = platform === 'win32' ? win32 : posix;
+  const join = paths.join;
+  const out = [];
+  const push = (source, path) => {
+    if (typeof path !== 'string' || path === '' || path === execPath) return;
+    if (out.some((entry) => entry.path === path)) return;
+    out.push({ source, path });
+  };
+
+  if (resourcesPath !== undefined) {
+    // ① 桌面版当前布局:主运行时自带的 Node(实测 v24.21.0,唯一被验证可用的那条)
+    push('app-primary-runtime-node', join(resourcesPath, 'runtime', 'primary-runtime', 'dependencies', 'node', 'bin', bin));
+    // ② 旧布局(0.1.5 及更早):应用自带一份 node
+    push('app-runtime-node', join(resourcesPath, 'runtime', 'node', bin));
+    // ③ 通用布局
+    push('app-resources-node', join(resourcesPath, 'node', bin));
+  }
+  // ④ resourcesPath 拿不到时,从可执行文件旁边推
+  push('exec-side-runtime-node', join(paths.dirname(execPath), 'resources', 'runtime', 'primary-runtime', 'dependencies', 'node', 'bin', bin));
+  push('exec-side-node', join(paths.dirname(execPath), 'resources', 'runtime', 'node', bin));
+
+  // ⑤ 上游可能直接给了 node 的路径 —— 只有当它**看起来就是 node 二进制**时才认
+  //    (实测 `DSH_DESKTOP_NODE_EXECUTABLE` 指向的是 Electron 自身,不能用)
+  const hinted = env.DSH_DESKTOP_NODE_EXECUTABLE;
+  if (typeof hinted === 'string' && hinted !== '' && /^node(\.exe)?$/i.test(hinted.replace(/\\/g, '/').split('/').pop() ?? '')) {
+    push('env-dsh-desktop-node', hinted);
+  }
+
+  // ⑥ PATH 上的真 Node(跳过应用自己的 resources —— 那里的 `node`/`node.cmd` 是"再调 Electron"的 shim)
+  const pathValue = typeof env.PATH === 'string' ? env.PATH : (typeof env.Path === 'string' ? env.Path : '');
+  for (const dir of pathValue.split(paths.delimiter)) {
+    if (dir === '') continue;
+    if (resourcesPath !== undefined && dir.toLowerCase().startsWith(resourcesPath.toLowerCase())) continue;
+    push('path-node', join(dir, bin));
+  }
+  return out;
+}
+
+/**
+ * 给子进程挑解释器。
+ * @returns {{command:string, electronHost:boolean, swapped:boolean, source:string}}
+ *   · 非 Electron 宿主:`{ command: process.execPath, swapped: false, source: 'host-node' }`(行为不变);
+ *   · Electron 宿主且找到真 Node:`swapped: true`(调用方须用 childNodeEnv 剥掉 ELECTRON_RUN_AS_NODE);
+ *   · Electron 宿主但一个候选都不在:`source: 'electron-fallback'`(与旧行为一致,调用方应告警)。
+ */
+export function resolveChildNode(options = {}) {
+  const execPath = typeof options.execPath === 'string' ? options.execPath : process.execPath;
+  const versions = options.versions ?? process.versions;
+  const env = options.env ?? process.env;
+  const exists = typeof options.exists === 'function' ? options.exists : existsSync;
+  const electronHost = isElectronHost(versions, env);
+  if (!electronHost) return { command: execPath, electronHost: false, swapped: false, source: 'host-node' };
+  for (const candidate of childNodeCandidates({ execPath, resourcesPath: options.resourcesPath ?? process.resourcesPath, env, platform: options.platform })) {
+    try {
+      if (exists(candidate.path)) {
+        return { command: candidate.path, electronHost: true, swapped: true, source: candidate.source };
+      }
+    } catch { /* 下一个候选 */ }
+  }
+  return { command: execPath, electronHost: true, swapped: false, source: 'electron-fallback' };
+}
+
+/**
+ * 子进程环境:用真 Node 时**必须**删掉 `ELECTRON_RUN_AS_NODE`,否则 VS Code 的 asar 解析钩子照样生效
+ * (钩子的判据是"环境变量或 versions.electron 二者之一")。退回 Electron 时反而要留着它,否则
+ * Electron 会当 GUI 应用启动。
+ */
+export function childNodeEnv(resolved, env = process.env) {
+  const next = { ...env };
+  if (resolved !== null && resolved !== undefined && resolved.swapped === true) delete next.ELECTRON_RUN_AS_NODE;
+  return next;
+}

package/lib/index.js

@@ -54,6 +54,7 @@ import { bridgeEndpointPath, startBridgeListener } from './bridge-ipc.mjs';
 import { registerEditorPrompt, registerEditorTools, setPromptLiveProbe } from './bridge-tools.mjs';
 import { deliverEditorPrompt } from './bridge-session.mjs';
 import { dshEntry, dshRequire } from './dsh-resolve.mjs';
+import { childNodeEnv, resolveChildNode } from './child-node.mjs';
 import { registerBridgeObserver } from './bridge-observe.mjs';
 import { createThreadRegistry } from './bridge-thread.mjs';
 import { createApprovalBoard, createApprovalInterceptor, DEFAULT_HOLD_MS, PANEL_OUTCOMES } from './bridge-approval.mjs';
@@ -1675,13 +1676,30 @@ export async function apply(ctx, config) {
       // 启动前再自愈一次依赖布局(插件重装/树被替换后可能丢失;幂等且只做存在性检查)
       ensureRuntimeLayout();
       const isCmd = launch.kind === 'bin' && win32() && /\.cmd$/i.test(launch.command);
-      const command = launch.kind === 'bin' ? launch.command : process.execPath;
+      // 解释器:显式 bin 用它的;其余(node 脚本 / 自带 launcher)默认 process.execPath —— 但**宿主是
+      // Electron(Node 模式)时必须换成真 Node**(0.3.53):VS Code 的 server-main 会注册一段只在
+      // Electron/ELECTRON_RUN_AS_NODE 下生效的 asar 解析钩子,它拒绝一切落在"应用根"之外的包,而
+      // 本插件的原生包都在树外的 pnpm 目录里 ⇒ 桌面版必然 `Cannot find package '@vscode/spdlog' …`
+      // ⇒ 面板显示「code-server 意外退出(exit 2)」。详见 lib/child-node.mjs。
+      const childNode = launch.kind === 'bin' ? null : resolveChildNode();
+      const command = launch.kind === 'bin' ? launch.command : childNode.command;
       const spawnArgs = launch.kind === 'bin' ? args : [launch.script, ...args];
+      if (childNode !== null && childNode.electronHost) {
+        if (childNode.swapped) {
+          console.log(`[code-server] 宿主是 Electron(Node 模式):改用真 Node 跑 IDE 子进程`
+            + `(${childNode.source}: ${childNode.command});已从子进程环境剥离 ELECTRON_RUN_AS_NODE`);
+        } else {
+          console.warn('[code-server] 宿主是 Electron(Node 模式),但没找到可用的真 Node —— VS Code 的 asar 解析钩子'
+            + '会拒绝树外的原生包(@vscode/spdlog / @vscode/deviceid / @vscode/windows-registry 等),'
+            + 'IDE 很可能以 exit 2 退出。修法:让应用自带的 resources/runtime/primary-runtime/dependencies/node/bin/'
+            + '或 PATH 上有一个真的 node。');
+        }
+      }
       // shell 仅对 .cmd shim(Windows npm 全局包)必要:它必须经 cmd.exe 解析。
       // 含空格路径由 spawn 数组传参,不再经 shell 拼接,避免 'C:\Program' 拆分。
       proc = spawn(isCmd ? `"${command}"` : command, spawnArgs, {
         cwd: cwd ?? process.cwd(),
-        env,
+        env: childNode === null ? env : childNodeEnv(childNode, env),
         shell: isCmd,
         windowsHide: true,
         detached: !win32() && !isCmd,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-code-server-app",
-  "version": "0.3.52",
+  "version": "0.3.54",
   "description": "VS Code (from a code-server release) inside DSH: a right-sidebar tab driven by the plugin's own launcher over the in-process VS Code server (lib/launcher.mjs). Since 0.3.0 the bundle also ships an editor bridge (assets/extensions/dshcs-editor-bridge): a read-only channel between the in-tree VS Code extension host and DSH, giving the agent what only the editor knows (unsaved buffers, language-server diagnostics, the active selection) and letting editor gestures drive the session. Since 0.3.22 the ask panel renders that session's new content with DSH's own Markdown renderer (pinned to the deployed DSH UI version); since 0.3.23 it is a full-width dialog with collapsible thinking rows and can answer approval requests in place — the bridge's only non-read-only route (POST /approve, constrained to pending in-process requests and the outcomes allowed-once/rejected; panel-first for 5 minutes, handed back to the official card the moment the panel closes). The tab claims DSH file addresses (dsh-resource://file/**) by file type (setting claimExtensions), so the product's own produced-file chips, delivered-file previews and inline prose mentions open in the workbench. The IDE is a resident surface moved with Element.moveBefore instead of being remounted, so switching sidebar tabs no longer reloads it. Opening the tab switches the right sidebar to fullscreen by default (setting fullscreenOnOpen). Following a workspace switch is lightweight: the workbench re-navigates with the new ?folder= and the IDE process is not restarted (since 0.2.12). Requires a DSH with the right-sidebar services (sidebarRightTabs/sidebarRight, >= 0.1.5-alpha.1); older DSH versions get a single upgrade notice on the settings page and no other UI. Two serving modes: loopback port (default) or same-origin mount on DSH's own webServer (/code-server, protected by ctx.connection.requestRejection). No code-server Node layer, no argon2, no C++ toolchain.",
   "homepage": "https://github.com/jinsiyu/dsh-code-server-app",
   "repository": {
@@ -46,6 +46,7 @@
     "lib/bridge-thread.mjs",
     "lib/bridge-approval.mjs",
     "lib/dsh-resolve.mjs",
+    "lib/child-node.mjs",
     "lib/launcher.mjs",
     "lib/serve-dsh.mjs",
     "lib/vendor.js",
@@ -192,6 +193,8 @@
     "test:client-cwd": "node scripts/test-client-bundle-cwd.mjs",
     "test:client-seat": "node scripts/test-client-settings-seat.mjs",
     "test:dsh-resolve": "node scripts/test-dsh-resolve.mjs",
+    "test:child-node": "node scripts/test-child-node.mjs",
+    "test:package-files": "node scripts/test-package-files.mjs",
     "test:bridge-routes": "node scripts/test-bridge-routes.mjs",
     "test:bridge-extension": "node scripts/test-bridge-extension.mjs",
     "test:webview": "node scripts/test-webview-bundle.mjs",

package/vendor/VENDOR.json

@@ -3,7 +3,7 @@
   "vscodeVersion": "1.137.0",
   "productPath": "stable-b11dabdaca0d3369986975be285db92c8795cea5",
   "layout": "vscode-only",
-  "preparedAt": "2026-09-18T13:40:53.510Z",
+  "preparedAt": "2026-09-18T15:59:04.210Z",
   "source": "registry",
   "node": "v24.20.0",
   "platform": "linux",