dsh-crate-web 0.1.2-preview.3 → 0.1.2-preview.5

package/README.md

@@ -1,11 +1,11 @@
 # DSH Crate — Preview
 
-DSH Crate 为 DeepSeek Harness 的设置页提供环境包导出、检查、恢复、验证和历史记录。正式 npm 包名是 `dsh-crate-web`；本候选为 `0.1.2-preview.3`，使用 `preview` 标签，保留既有 `latest`。
+DSH Crate 为 DeepSeek Harness 的设置页提供环境包导出、检查、恢复、验证和历史记录。正式 npm 包名是 `dsh-crate-web`；本候选为 `0.1.2-preview.5`，使用 `preview` 标签，保留既有 `latest`。
 
 可通过官方插件入口安装明确版本：
 
 ```powershell
-dsh plugin --profile web add dsh-crate-web@0.1.2-preview.3
+dsh plugin --profile web add dsh-crate-web@0.1.2-preview.5
 ```
 
 重启后打开 Settings → DSH Crate。离线环境可从同版本 tgz 安装。Windows x64 随包保留 Python 3.14.6，无需另外安装系统 Python。其他系统未完成本轮桌面验收。
@@ -23,3 +23,5 @@ Import 默认恢复到新 Profile，先执行 Preflight 和计划检查。覆盖
 工作流先扫描提交与实际 tgz，再让发布任务复用同一 tgz 并核对 SHA-256。新代码必须升 prerelease 版本；同版本不同内容会停止。现有 npm Trusted Publisher 对应本仓库和 `publish-dsh-crate-web.yml`，无需把长期 npm Token 写入仓库。
 
 宿主依赖：DSH 模块与 React 由目标 DSH 宿主提供，npm 将这些 peer 标记为 optional，避免在空 Profile 中自动安装另一套旧 DSH。这不表示插件可以脱离 DSH 运行，也不跳过实际宿主服务检查；客户端 UI 组件仍须由 DSH 模块加载器提供。发布流程对最终 tgz 执行普通干净安装，不使用 legacy-peer-deps 或 force。官方 CLI 与真实桌面的覆盖以对应版本的验证报告为准。
+
+本候选修复了两个实际入口问题：无系统 npm 时，Export 可以复用桌面提供的 pnpm，禁用打包脚本与钩子并保留源清单；默认 Verify 根据完整的运行插件清单判断 Inspector 端点是否适用，清单不完整或已启用的 Inspector 缺监听时仍失败。Windows x64 / 原装 DSH 0.2.1-rc.5 下，前一候选的页面导出、下载、检查和新 Profile 恢复真实通过；本候选使用同一配置、仅更新 Crate 制品的诊断包，真实通过恢复、默认 Verify 的组合、启动、页面就绪、空白会话动作和清理。会话动作遵循官方行为，复用了已有空白会话，没有制造新的会话文件。默认 Verify 总结果仍为 UNTESTED：零模型，没有覆盖模型、原生工具、计划重启和其后的插件测试；本轮也没有覆盖启用 Inspector 的真实运行或历史 Worker 取消故障。诊断包不是本候选重新完成的页面 Export，不能将两轮证据合称为完整候选验收。

package/core/dsh_pack/_version.py

@@ -1 +1 @@
-__version__ = "0.1.2-preview.3"
+__version__ = "0.1.2-preview.5"

package/core/dsh_pack/cli.py

@@ -8,7 +8,7 @@ import os
 from pathlib import Path
 from typing import Sequence
 
-from .errors import DshPackError, PackImportError
+from .errors import DshPackError, ExportError, PackImportError
 from .export import EMBEDDED, REFERENCE_ONLY, ExportOptions, PluginExportOptions, export_profile
 from .importer import ImportOptions, create_import_plan, delete_profile, import_pack
 from .preflight import PreflightContext, inspect_pack, render_text
@@ -250,7 +250,7 @@ def _run_export(args: argparse.Namespace) -> int:
             return 0
         result = export_profile(args.profile, args.output, options=options)
     except (DshPackError, OSError, ValueError, json.JSONDecodeError) as error:
-        payload = {"status": "failed", "error": {"message": str(error)}}
+        payload = {"status": "failed", "error": error.as_dict() if isinstance(error, ExportError) else {"message": str(error)}}
         if args.json:
             _emit(payload, args.command)
         else:

package/core/dsh_pack/desktop_verify.py

@@ -154,6 +154,9 @@ class DesktopVerifyAdapter:
 
     def _surface(self):
         value = self._rpc('surface')
+        inspector = value.get('inspector')
+        if not isinstance(inspector, dict) or inspector.get('inventoryComplete') is not True or type(inspector.get('applicable')) is not bool:
+            raise RuntimeError('Inspector applicability not confirmed: runtime inventory missing or incomplete')
         self.endpoints[f'web-{self.generation}'] = value['webPort']
         table = tcp_rows()
         with self.lock:
@@ -164,6 +167,9 @@ class DesktopVerifyAdapter:
         for name, port in self.endpoints.items():
             if not name.endswith('-' + str(self.generation)):
                 continue
+            if name.startswith('inspector-') and not inspector['applicable']:
+                evidence.append({'name': name, 'port': port, 'status': 'NOT_APPLICABLE', 'applicability': inspector})
+                continue
             listeners = [row for row in table if row['localPort'] == port and row['state'] == 'LISTEN']
             if not listeners or not all(row['pid'] in pids for row in listeners):
                 raise RuntimeError('Owned endpoint listener not confirmed: ' + name)

package/core/dsh_pack/errors.py

@@ -28,6 +28,20 @@ class IntegrityError(DshPackError):
 class ExportError(DshPackError):
     """A Profile cannot be exported into a valid DSH Pack."""
 
+    def __init__(self, message: str, *, stage: str | None = None, code: str | None = None, details: dict | None = None) -> None:
+        super().__init__(message)
+        self.stage, self.code, self.details = stage, code, details
+
+    def as_dict(self) -> dict:
+        result = {"message": str(self)}
+        if self.stage is not None:
+            result["stage"] = self.stage
+        if self.code is not None:
+            result["code"] = self.code
+        if self.details is not None:
+            result["details"] = self.details
+        return result
+
 
 class PackImportError(DshPackError):
     """A Pack cannot be prepared as a new Profile."""

package/core/dsh_pack/export.py

@@ -492,12 +492,22 @@ def _with_bundle_composition(profile_files: dict[str, bytes], bundles: Sequence[
     profile_files["package.json"] = (json.dumps(manifest, ensure_ascii=False, indent=2) + "\n").encode("utf-8")
 
 
-def _npm_command(configured: str | None) -> str:
+def _npm_command(configured: str | None) -> str | tuple[str, ...]:
     if configured:
         return configured
-    if os.name == "nt":
-        return shutil.which("npm.cmd") or shutil.which("npm") or "npm.cmd"
-    return shutil.which("npm") or "npm"
+    available = (shutil.which("npm.cmd") if os.name == "nt" else None) or shutil.which("npm")
+    if available:
+        return available
+    value = os.environ.get("DSH_PACK_PNPM_COMMAND")
+    if value:
+        try:
+            argv = json.loads(value)
+        except ValueError:
+            argv = None
+        if not isinstance(argv, list) or not argv or not all(isinstance(item, str) and item and "\x00" not in item for item in argv):
+            raise ExportError("DSH_PACK_PNPM_COMMAND must be a nonempty JSON argv array", stage="package-artifact", code="EXPORT_PACK_COMMAND_INVALID")
+        return tuple(argv)
+    return "npm.cmd" if os.name == "nt" else "npm"
 
 
 def _bundle_patch_path(package_dir: Path, package_name: str, patch: str) -> str:
@@ -613,13 +623,14 @@ def _validate_tarball(content: bytes, package_name: str, required_file: str | Se
 def _npm_pack(
     package_dir: Path,
     package_name: str,
-    npm_command: str,
+    npm_command: str | tuple[str, ...],
     *,
     required_file: str | Sequence[str] | None = None,
 ) -> bytes:
     with tempfile.TemporaryDirectory(prefix="dsh-pack-npm-") as directory:
         cache_directory = Path(directory) / "npm-cache"
         cache_directory.mkdir()
+        is_pnpm = isinstance(npm_command, tuple)
         command = [
             npm_command,
             "pack",
@@ -630,24 +641,56 @@ def _npm_pack(
             "--cache",
             str(cache_directory),
         ]
-        completed = subprocess.run(
-            command,
-            cwd=package_dir,
-            capture_output=True,
-            text=True,
-            check=False,
-            timeout=120,
-        )
+        environment = None
+        if is_pnpm:
+            command = [*npm_command, "pack", "--pack-destination", directory,
+                       "--skip-manifest-obfuscation", "--config.ignore-scripts=true",
+                       "--config.ignore-pnpmfile=true", "--config.offline=true",
+                       "--config.pm-on-fail=ignore", "--config.runtime-on-fail=ignore"]
+            environment = dict(os.environ, ELECTRON_RUN_AS_NODE="1")
+        try:
+            completed = subprocess.run(
+                command, cwd=package_dir, capture_output=True, text=True,
+                check=False, timeout=120, **({"env": environment} if environment is not None else {}),
+            )
+        except (OSError, subprocess.TimeoutExpired) as error:
+            raise ExportError(
+                f"Cannot pack {package_name}: {error}. Install npm or use the desktop-provided pnpm entry.",
+                stage="package-artifact", code="EXPORT_PACK_START_FAILED",
+                details={"package": package_name, "command": command, "cwd": str(package_dir), "originalError": str(error)},
+            ) from error
         if completed.returncode != 0:
             raise ExportError(
                 f"npm pack failed for {package_name} with exit code {completed.returncode}: "
-                f"{completed.stderr.strip() or completed.stdout.strip()}"
+                f"{completed.stderr.strip() or completed.stdout.strip()}",
+                stage="package-artifact", code="EXPORT_PACK_FAILED",
+                details={"package": package_name, "command": command, "cwd": str(package_dir),
+                         "exitCode": completed.returncode, "stdout": completed.stdout, "stderr": completed.stderr},
             )
         tarballs = sorted(Path(directory).glob("*.tgz"))
         if len(tarballs) != 1:
             raise ExportError(f"npm pack produced {len(tarballs)} tarballs for {package_name}")
         content = tarballs[0].read_bytes()
     _validate_tarball(content, package_name, required_file)
+    if is_pnpm:
+        # pnpm strips fields even with --skip-manifest-obfuscation. Preserve the
+        # installed manifest exactly; the artifact is a snapshot, not a publish.
+        import io
+        manifest = (package_dir / "package.json").read_bytes()
+        output = io.BytesIO()
+        with tarfile.open(fileobj=io.BytesIO(content), mode="r:gz") as source:
+            manifests = [member for member in source.getmembers() if member.name == "package/package.json"]
+            if len(manifests) != 1 or not manifests[0].isfile():
+                raise ExportError(f"pnpm pack artifact has no unique regular package manifest: {package_name}")
+            with tarfile.open(fileobj=output, mode="w:gz") as target:
+                for member in source.getmembers():
+                    if member.name == "package/package.json":
+                        member.size = len(manifest)
+                        target.addfile(member, io.BytesIO(manifest))
+                    else:
+                        target.addfile(member, source.extractfile(member) if member.isfile() else None)
+        content = output.getvalue()
+        _validate_tarball(content, package_name, required_file)
     return content
 
 
@@ -663,7 +706,7 @@ def _plugin_lock_entry(
     specifier: str,
     bundle_order: int | None,
     options: PluginExportOptions,
-    npm_command: str,
+    npm_command: str | tuple[str, ...],
 ) -> tuple[dict[str, Any], dict[str, bytes]]:
     package_dir, package_manifest = _installed_package(profile_dir, package_name, bundle=bundle_order is not None)
     installed_name = _string(package_manifest.get("name", package_name), f"{package_name}.package.json.name")

package/lib/index.js

@@ -1,3 +1,4 @@
+import { readRuntimeInventory } from "../runtime-inventory.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import { access, lstat, mkdir, readFile, readdir, realpath, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
@@ -951,33 +952,7 @@ const SAFE_PLUGIN_NAME = /^@?[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)?$/;
 const SAFE_OPERATION_ID = /^[0-9a-f-]{36}$/i;
 const CRATE_PACKAGE_NAME = "dsh-crate-web";
 /** Cordis FiberState enum values; mirrors dsh-host-plugin-inventory phases. */
-const RUNTIME_FIBER_PHASE = {
-	0: "pending",
-	1: "loading",
-	2: "active",
-	3: "failed",
-	4: null,
-	5: "unloading"
-};
-/** Read-only projection of the currently running Loader's non-group entries. */
-function listRuntimePlugins(ctx) {
-	const loader = ctx.loader;
-	if (!loader || typeof loader.entries !== "function") return [];
-	const rows = [];
-	try {
-		for (const entry of loader.entries()) {
-			if (entry.options.group) continue;
-			if (entry.options.name.startsWith("cordis:")) continue;
-			rows.push({
-				id: entry.id,
-				name: entry.options.name,
-				enabled: entry.disabled !== true,
-				phase: entry.fiber ? RUNTIME_FIBER_PHASE[entry.fiber.state] ?? null : null
-			});
-		}
-	} catch {}
-	return rows;
-}
+
 function json(res, status, body) {
 	const payload = JSON.stringify(body);
 	res.writeHead(status, {
@@ -1594,7 +1569,7 @@ async function createProfile(home, body, workspace) {
 		history: item
 	};
 }
-async function handleApi(home, body, runtimePlugins = []) {
+async function handleApi(home, body, runtimePlugins = [], runtimeInventoryComplete = false) {
 	const action = body.action;
 	const workspace = await ensureWorkspace(home);
 	if (action === "profiles") {
@@ -1608,6 +1583,7 @@ async function handleApi(home, body, runtimePlugins = []) {
 			status: "ok",
 			profiles: await listProfiles(home),
 			runtimePlugins: classifiedPlugins,
+			runtimeInventoryComplete,
 			runtime
 		};
 	}
@@ -2137,7 +2113,8 @@ function apply(ctx, config = {}) {
 					return;
 				}
 				try {
-					json(res, 200, await handleApi(home, await readRequest(req), listRuntimePlugins(ctx)));
+					const inventory = readRuntimeInventory(ctx);
+					json(res, 200, await handleApi(home, await readRequest(req), inventory.rows, inventory.complete));
 				} catch (error) {
 					json(res, 400, {
 						status: "failed",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-crate-web",
   "description": "DSH Web Settings surface for DSH Crate export, import, inspect, and history",
-  "version": "0.1.2-preview.3",
+  "version": "0.1.2-preview.5",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -29,7 +29,8 @@
     "skills/dsh-crate-troubleshooting/SKILL.md",
     "skills/dsh-crate-troubleshooting/compatibility.json",
     "skills/dsh-crate-troubleshooting/reference/*.md",
-    "THIRD-PARTY-LICENSE.txt"
+    "THIRD-PARTY-LICENSE.txt",
+    "runtime-inventory.mjs"
   ],
   "publishConfig": {
     "access": "public",

package/runtime-inventory.mjs

@@ -0,0 +1,31 @@
+/** Read Loader metadata only; a partial enumeration never proves absence. */
+const phases = { 0: 'pending', 1: 'loading', 2: 'active', 3: 'failed', 4: null, 5: 'unloading' }
+export function readRuntimeInventory(ctx) {
+  const rows = []
+  const loader = ctx?.loader
+  if (!loader || typeof loader.entries !== 'function') return { rows, complete: false }
+  try {
+    for (const entry of loader.entries()) {
+      if (entry.options.group) continue
+      if (typeof entry.options.name !== 'string' || typeof entry.id !== 'string') throw new Error('invalid Loader row')
+      if (entry.options.name.startsWith('cordis:')) continue
+      rows.push({ id: entry.id, name: entry.options.name, enabled: entry.disabled !== true,
+        phase: entry.fiber ? (phases[entry.fiber.state] ?? null) : null })
+    }
+    return { rows, complete: true }
+  } catch {
+    return { rows, complete: false }
+  }
+}
+
+export function inspectorApplicability(rows, complete) {
+  if (complete !== true || !Array.isArray(rows) || !rows.length || rows.some(row => !row ||
+      typeof row.id !== 'string' || typeof row.name !== 'string' || typeof row.enabled !== 'boolean')) {
+    throw new Error('Inspector applicability not confirmed: runtime inventory missing or incomplete')
+  }
+  const matches = rows.filter(row => row.name === '@deepseek-ai/dsh-experimental-inspector')
+  const applicable = matches.some(row => row.enabled)
+  return { inventoryComplete: true, inventoryCount: rows.length, applicable,
+    reason: applicable ? 'enabled' : matches.length ? 'disabled' : 'not-declared',
+    plugins: matches.map(({ id, name, enabled, phase }) => ({ id, name, enabled, phase })) }
+}

package/skills/dsh-crate-troubleshooting/compatibility.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-crate-troubleshooting",
-  "skillVersion": "0.1.2-preview.3",
+  "skillVersion": "0.1.2-preview.5",
   "compatibility": {
     "dshCrate": ">=0.1.0 <0.1.3",
     "diagnosticSchema": [

package/skills/dsh-crate-troubleshooting/reference/diagnostics.generated.md

@@ -1,6 +1,6 @@
 # DSH Crate Diagnostic Codes
 
-> Generated from `core/dsh_pack/diagnostics.py` (schema v1, producer `dsh-crate`, crate 0.1.2-preview.3). Do not edit by hand.
+> Generated from `core/dsh_pack/diagnostics.py` (schema v1, producer `dsh-crate`, crate 0.1.2-preview.5). Do not edit by hand.
 
 Total codes: **79**. Stages: **16**.
 

package/verify-desktop.mjs

@@ -7,6 +7,7 @@ import { open, mkdir, readdir, lstat, readFile, writeFile } from 'node:fs/promis
 import { createServer } from 'node:net'
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path'
 import { pathToFileURL } from 'node:url'
+import { inspectorApplicability } from './runtime-inventory.mjs'
 
 const sleep = ms => new Promise(resolve => setTimeout(resolve, ms))
 const inside = (root, path) => { const part = relative(resolve(root), resolve(path)); return part === '' || (!part.startsWith('..') && !isAbsolute(part)) }
@@ -61,7 +62,9 @@ export function validateSurface(value, home, webPort) {
     throw new Error('Verification backend identity does not match its isolated desktop')
   }
   if (!Number.isInteger(webPort) || webPort < 1 || webPort > 65535) throw new Error('Owned backend Web port missing from startup log')
-  return { ...value, webPort, authenticationContext: 'official owned desktop protocol and authenticated profiles route; credentials not exported' }
+  const inspector = inspectorApplicability(value.runtimePlugins, value.runtimeInventoryComplete)
+  const { runtimePlugins, runtimeInventoryComplete, ...surface } = value
+  return { ...surface, inspector, webPort, authenticationContext: 'official owned desktop protocol and authenticated profiles route; credentials not exported' }
 }
 
 class Cdp {
@@ -247,7 +250,8 @@ export class DesktopController {
       let result; try { result = await backend.json() } catch { result = {} }
       return { accountMenu, httpStatus: response.status, origin: location.origin, protocol: location.protocol, hostname: location.hostname,
         backendHttpStatus: backend.status, backendStatus: result.status, runtimePid: result.runtime?.pid,
-        runtimeHome: result.runtime?.dshHome, runtimeProfile: result.runtime?.currentProfile };
+          runtimeHome: result.runtime?.dshHome, runtimeProfile: result.runtime?.currentProfile,
+          runtimePlugins: result.runtimePlugins, runtimeInventoryComplete: result.runtimeInventoryComplete };
     })()`)
     const log = join(this.config.job, `desktop-${this.generation}.stdout.log`)
     if ((await lstat(log)).size > 1024 * 1024) throw new Error('Owned desktop startup log exceeded observation limit')