dsh-lark-agent 0.3.1 → 0.3.2

package/README.md

@@ -53,7 +53,7 @@ Then restart `dsh web`.
 
 ### Update
 
-When a new version is out, the Feishu settings page shows a notice with these steps (in the desktop app it also opens the plugin list for you).
+When a new version has been out for a day, the Feishu settings page shows a notice with these steps (in the desktop app it also opens the plugin list for you). Until then the desktop app and `dsh plugin` still install the previous version, because pnpm 11 skips releases less than 24 hours old. If an install picks an older version that your DeepSeek Harness rejects as incompatible, see [Troubleshooting](https://github.com/Nirvana-Jie/dsh-lark-agent/blob/main/DEVELOPMENT.md#排障).
 
 1. On the Feishu settings page, click **暂停连接** (pause) and back up as described in [Upgrade](https://github.com/Nirvana-Jie/dsh-lark-agent/blob/main/DEVELOPMENT.md#升级).
 2. Desktop app: the Add plugin dialog says third-party plugins must be uninstalled before a new version is installed, so uninstall `dsh-lark-agent` on the Plugins page and add it again (this in-app upgrade hasn't been tested end to end yet; an earlier source build is listed as `dsh-larkbot`). CLI: run `dsh plugin --profile web update dsh-lark-agent@latest`, then restart `dsh web`.

package/dist/onboarding/host.d.ts

@@ -1,6 +1,7 @@
 import type { Context } from '@deepseek-ai/cordis';
 import { ConnectionController } from './controller.js';
 import type { ConnectionResult } from './protocol.js';
+import { type Release } from './updates.js';
 interface Peer {
     principal?: {
         kind?: string;
@@ -29,11 +30,11 @@ export declare function registerConnectionRpc(rpc: RpcHost, controller: Connecti
 export declare function findLarkExecutable(explicit?: string): Promise<string>;
 /**
  * Attach the control plane without requiring any user-written team configuration.
- * `latestVersion` replaces the npm lookup behind the upgrade notice (tests use it to stay offline).
+ * `latestRelease` replaces the npm lookup behind the upgrade notice (tests use it to stay offline).
  */
 export declare function applyOnboarding(ctx: Context, options?: {
     dataDir?: string;
     executable?: string;
-    latestVersion?: (signal: AbortSignal) => Promise<string | undefined>;
+    latestRelease?: (signal: AbortSignal) => Promise<Release | undefined>;
 }): Promise<void>;
 export {};

package/dist/onboarding/host.js

@@ -203,7 +203,7 @@ async function waitReady(service, signal) {
 }
 /**
  * Attach the control plane without requiring any user-written team configuration.
- * `latestVersion` replaces the npm lookup behind the upgrade notice (tests use it to stay offline).
+ * `latestRelease` replaces the npm lookup behind the upgrade notice (tests use it to stay offline).
  */
 export async function applyOnboarding(ctx, options = {}) {
     const connection = ctx.get('connection');
@@ -260,7 +260,7 @@ export async function applyOnboarding(ctx, options = {}) {
             }
         }, });
     const installed = installedPackage();
-    const updates = new UpdateCheck(installed?.version, options.latestVersion
+    const updates = new UpdateCheck(installed?.version, options.latestRelease
         ?? (signal => installed ? npmLatest(installed.name, signal) : Promise.resolve(undefined)));
     const control = {
         snapshot: () => withUpdate(controller.snapshot(), updates),

package/dist/onboarding/updates.d.ts

@@ -1,11 +1,21 @@
+/** A published release and when npm says it was published (epoch milliseconds). */
+export interface Release {
+    version: string;
+    publishedAt: number;
+}
 /** True when `next` is a later release than `current`; a prerelease comes before its release. */
 export declare function newerVersion(next: string, current: string): boolean;
-/** npm's `latest` tag for a package, when it names a stable release. Sends only the package name. */
-export declare function npmLatest(name: string, signal: AbortSignal): Promise<string | undefined>;
+/**
+ * npm's `latest` release of a package and its publish time, when it names a stable release.
+ * Only the full package document carries publish times. Sends only the package name.
+ */
+export declare function npmLatest(name: string, signal: AbortSignal): Promise<Release | undefined>;
 /**
  * Whether a newer release of this plugin is available, for the settings page.
  * A status read never waits for the registry: it returns what is known and
  * starts a background check when one is due. Failures just show no notice.
+ * A release younger than a day is not offered yet, since installing it would
+ * still pick an older one; it shows up once it ages, without another check.
  */
 export declare class UpdateCheck {
     private readonly current;
@@ -14,7 +24,7 @@ export declare class UpdateCheck {
     private latest?;
     private nextCheck;
     private running;
-    constructor(current: string | undefined, lookup: (signal: AbortSignal) => Promise<string | undefined>, now?: () => number);
+    constructor(current: string | undefined, lookup: (signal: AbortSignal) => Promise<Release | undefined>, now?: () => number);
     status(): {
         current: string;
         latest: string;

package/dist/onboarding/updates.js

@@ -2,6 +2,9 @@
 const CHECK_EVERY_MS = 6 * 60 * 60_000;
 // A failed check (offline, blocked registry) waits this long before the next try.
 const RETRY_AFTER_MS = 30 * 60_000;
+// pnpm 11, which the App and `dsh plugin` install with, skips releases younger than a day
+// (`minimumReleaseAge`) and installs an older one instead, so a release is offered only after that.
+const INSTALLABLE_AFTER_MS = 24 * 60 * 60_000;
 const VERSION = /^(\d{1,9})\.(\d{1,9})\.(\d{1,9})(?:-([0-9A-Za-z.-]{1,40}))?$/;
 /** True when `next` is a later release than `current`; a prerelease comes before its release. */
 export function newerVersion(next, current) {
@@ -15,19 +18,29 @@ export function newerVersion(next, current) {
     }
     return !a[4] && Boolean(b[4]);
 }
-/** npm's `latest` tag for a package, when it names a stable release. Sends only the package name. */
+/**
+ * npm's `latest` release of a package and its publish time, when it names a stable release.
+ * Only the full package document carries publish times. Sends only the package name.
+ */
 export async function npmLatest(name, signal) {
-    const response = await fetch(`https://registry.npmjs.org/-/package/${name.replace('/', '%2f')}/dist-tags`, { signal, headers: { accept: 'application/json' } });
+    const response = await fetch(`https://registry.npmjs.org/${name.replace('/', '%2f')}`, { signal, headers: { accept: 'application/json' } });
     if (!response.ok)
         return;
-    const tags = await response.json();
-    const latest = tags?.latest;
-    return typeof latest === 'string' && VERSION.test(latest) && !latest.includes('-') ? latest : undefined;
+    const document = await response.json();
+    const latest = document?.['dist-tags']?.latest;
+    if (typeof latest !== 'string' || !VERSION.test(latest) || latest.includes('-'))
+        return;
+    const time = document?.time;
+    const stamp = time && typeof time === 'object' ? time[latest] : undefined;
+    const publishedAt = typeof stamp === 'string' ? Date.parse(stamp) : Number.NaN;
+    return Number.isFinite(publishedAt) ? { version: latest, publishedAt } : undefined;
 }
 /**
  * Whether a newer release of this plugin is available, for the settings page.
  * A status read never waits for the registry: it returns what is known and
  * starts a background check when one is due. Failures just show no notice.
+ * A release younger than a day is not offered yet, since installing it would
+ * still pick an older one; it shows up once it ages, without another check.
  */
 export class UpdateCheck {
     current;
@@ -46,15 +59,18 @@ export class UpdateCheck {
             return;
         if (!this.running && this.now() >= this.nextCheck)
             void this.refresh();
-        return this.latest && newerVersion(this.latest, this.current) ? { current: this.current, latest: this.latest } : undefined;
+        const latest = this.latest;
+        if (!latest || this.now() - latest.publishedAt < INSTALLABLE_AFTER_MS)
+            return;
+        return newerVersion(latest.version, this.current) ? { current: this.current, latest: latest.version } : undefined;
     }
     async refresh() {
         this.running = true;
         this.nextCheck = this.now() + RETRY_AFTER_MS;
         try {
             const latest = await this.lookup(AbortSignal.timeout(10_000));
-            if (latest && VERSION.test(latest)) {
-                this.latest = latest;
+            if (latest && VERSION.test(latest.version) && Number.isFinite(latest.publishedAt)) {
+                this.latest = { version: latest.version, publishedAt: latest.publishedAt };
                 this.nextCheck = this.now() + CHECK_EVERY_MS;
             }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-lark-agent",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Reach your DeepSeek Harness assistant from Feishu / Lark: a dsh plugin built on the official Lark CLI",
   "keywords": [
     "deepseek",