dsh-m 0.2.1 → 0.2.2

package/docs/DESIGN.md

@@ -66,7 +66,7 @@
 - **安装（npm 源）**：装最新版并以**精确版本锁定**（不用 `^` 范围；用户指定版本必须为精确 semver，经该精确版本 endpoint 查询）。安装前对 profile 的 `package.json` / `pnpm-lock.yaml` / `pnpm-workspace.yaml` 做字节快照；安装后核验 importer 依赖为该精确版本，并在 lockfile `packages` 条目中比对与 npm dist 一致的 `resolution.integrity`——缺失或不一致 **fail closed** 并执行 **best-effort dependency rollback**（原子恢复快照 + `pnpm install --frozen-lockfile`；恢复失败同时报告两类错误并提示人工修复）。不声称 node_modules 与间接依赖已字节级回滚。
 - **安装（GitHub 源）**：解析并**锁定 commit SHA**（`github:owner/repo#sha`），skillhub 同款。
 - **已装识别**：读 profile `package.json` dependencies，与 registry 匹配 → 标注「市场安装」；不匹配的也列出，标注「非市场安装 / 来源未知」。卸载/升级对两类都可用。
-- **卸载**：live-disable（先让 client bundle 下线，避免 404）→ `dsh plugin remove`。**不清理插件产生的数据/配置**，但把检测到的疑似残留路径（如 `~/.dsh/<plugin>.json`）列出报告。
+- **卸载**：live-disable（先让 client bundle 下线，避免 404）→ 摘除该包在 profile 的补丁条目（`pnpm-workspace.yaml` 顶层 `patchedDependencies` 与 `package.json#pnpm.patchedDependencies`；依赖移除后残留条目会令 pnpm 以 `ERR_PNPM_UNUSED_PATCH` 整单失败，只精确匹配 `pkg` / `pkg@ver`，补丁文件本体保留并计入残留报告）→ `dsh plugin remove`。**不清理插件产生的数据/配置**，但把检测到的疑似残留路径（如 `~/.dsh/<plugin>.json`）列出报告。
 - **升级**：**按需检查**（`dshm_outdated` / `dshm_list` 时实时比对本地版本 vs npm latest / GitHub main），半自动——展示升级计划，确认后执行。**不做后台定时器**。
 - **自更新**：dsh-m 对自己同样做版本比对 + 提示升级（设置页呈现）。
 - **重启**：内置**一键重启**，复用 skillhub 验证过的重启路径（本机 `dsh-web.service` 是转发 shim，不新建 systemd 单元、不监听 3080）。安装/卸载/升级完成后 GUI 弹「需重启生效 [一键重启]」横幅，工具返回重启提示。

package/lib/client.js

@@ -514,7 +514,7 @@ var CSS = `
 .dshm-detail{margin-top:8px;border-top:1px dashed var(--dsw-alias-border-l2,#e5e7eb);padding-top:8px;display:flex;flex-direction:column;gap:6px;font-size:12px;color:var(--dsw-alias-label-secondary,#4b5563)}
 .dshm-actions{display:flex;gap:6px;flex-wrap:wrap;margin-top:4px}
 .dshm-banner{display:flex;align-items:center;gap:10px;padding:10px 14px;border-top:1px solid var(--dsw-alias-border-l2,#e5e7eb);background:var(--dsw-alias-state-warn-tertiary,#fffbeb);color:var(--dsw-alias-state-warn-primary,#b45309);font-size:12px}
-.dshm-banner .dshm-banner-text{flex:1}
+.dshm-banner .dshm-banner-text{flex:1;max-height:140px;overflow:auto;overscroll-behavior:contain;white-space:pre-wrap;word-break:break-word;line-height:18px}
 .dshm-row{display:flex;align-items:center;gap:8px}
 .dshm-kv{display:grid;grid-template-columns:96px 1fr;gap:6px 10px;font-size:12px;align-items:baseline}
 .dshm-kv .k{color:var(--dsw-alias-label-caption,#6b7280);font-size:11px}

package/lib/core/dsh-cli.js

@@ -10,6 +10,119 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { installTimeoutMs, WEB_PROFILE, webProfileDir } from './env.js';
 import { createProgressTracker } from './progress.js';
+/** pnpm patchedDependencies 条目键与目标包匹配：`pkg` 或 `pkg@任意版本/区间`。 */
+function matchesPatchedKey(key, pkg) {
+    return key === pkg || key.startsWith(`${pkg}@`);
+}
+/**
+ * 摘除 profile 里目标包的 pnpm 补丁条目：pnpm-workspace.yaml 顶层
+ * `patchedDependencies` 与 package.json 的 `pnpm.patchedDependencies` 两处。
+ * 卸载场景下依赖被移除后，残留补丁条目会让 pnpm 以 ERR_PNPM_UNUSED_PATCH
+ * 拒绝整个 remove/install。只精确匹配目标包的键（`pkg` / `pkg@ver`），
+ * 其他包的补丁不动；补丁文件本体保留在磁盘（删包不删数据，DESIGN.md §3）。
+ */
+export function removePatchedDependencyEntries(profileDirectory, pkg, deps = {}) {
+    const target = String(pkg || '').trim();
+    if (!target || !isSafePluginTarget(target))
+        return { changed: false, orphanedPatchFiles: [] };
+    const exists = deps.existsSync ?? existsSync;
+    const read = deps.readFileSync ?? readFileSync;
+    const write = deps.writeFileSync ?? writeFileSync;
+    const orphanedPatchFiles = [];
+    let changed = false;
+    // --- pnpm-workspace.yaml（pnpm≥10 补丁配置落点；行级手术，只摘匹配键） ---
+    const wsFile = join(profileDirectory, 'pnpm-workspace.yaml');
+    let ws = '';
+    try {
+        ws = read(wsFile, 'utf8');
+    }
+    catch {
+        /* 无文件则跳过 */
+    }
+    if (ws) {
+        const srcLines = ws.split('\n');
+        let start = -1;
+        for (let i = 0; i < srcLines.length; i++) {
+            if (/^patchedDependencies:\s*$/.test(srcLines[i])) {
+                start = i;
+                break;
+            }
+        }
+        if (start >= 0) {
+            // 块边界：下一个顶层键（无缩进行）或文件尾
+            let end = srcLines.length;
+            for (let i = start + 1; i < srcLines.length; i++) {
+                if (/^\S/.test(srcLines[i])) {
+                    end = i;
+                    break;
+                }
+            }
+            const keptBlock = [];
+            for (const line of srcLines.slice(start + 1, end)) {
+                // 条目行：缩进键 + `:` + 补丁文件路径（键可带引号）
+                const m = /^\s+(["']?)([^"':]+?)\1\s*:\s*(.+?)\s*$/.exec(line);
+                if (m && matchesPatchedKey(m[2].trim(), target)) {
+                    changed = true;
+                    const file = resolve(profileDirectory, m[3].trim());
+                    if (exists(file))
+                        orphanedPatchFiles.push(file);
+                }
+                else {
+                    keptBlock.push(line);
+                }
+            }
+            if (changed) {
+                // 块内条目被摘空 → 连 `patchedDependencies:` 头一起移除，避免留下空映射
+                const stillHasEntry = keptBlock.some((l) => /^\s+\S/.test(l));
+                const next = stillHasEntry
+                    ? [...srcLines.slice(0, start + 1), ...keptBlock, ...srcLines.slice(end)]
+                    : [...srcLines.slice(0, start), ...srcLines.slice(end)];
+                write(wsFile, next.join('\n'));
+            }
+        }
+    }
+    // --- package.json#pnpm.patchedDependencies（pnpm<10 落点，兼容清理） ---
+    const pkgJsonFile = join(profileDirectory, 'package.json');
+    let raw = '';
+    try {
+        raw = read(pkgJsonFile, 'utf8');
+    }
+    catch {
+        /* 无文件则跳过 */
+    }
+    if (raw) {
+        try {
+            const doc = JSON.parse(raw);
+            const patched = doc?.pnpm?.patchedDependencies;
+            if (patched && typeof patched === 'object') {
+                let touched = false;
+                for (const [key, file] of Object.entries(patched)) {
+                    if (!matchesPatchedKey(key, target))
+                        continue;
+                    delete patched[key];
+                    touched = true;
+                    changed = true;
+                    if (typeof file === 'string') {
+                        const abs = resolve(profileDirectory, file);
+                        if (exists(abs))
+                            orphanedPatchFiles.push(abs);
+                    }
+                }
+                if (touched) {
+                    if (Object.keys(patched).length === 0)
+                        delete doc.pnpm.patchedDependencies;
+                    if (Object.keys(doc.pnpm).length === 0)
+                        delete doc.pnpm;
+                    write(pkgJsonFile, `${JSON.stringify(doc, null, 2)}\n`);
+                }
+            }
+        }
+        catch {
+            /* package.json 不是合法 JSON：不动 */
+        }
+    }
+    return { changed, orphanedPatchFiles };
+}
 const TARGET_RE = /^[A-Za-z0-9@:./_#+-]+$/;
 const NDJSON_COMMANDS = new Set(['add', 'remove', 'install']);
 export const BOOT_ID = `${String(process.pid)}-${String(Date.now())}`;
@@ -163,6 +276,9 @@ function writeDangerouslyAllowAllBuilds(profileDirectory) {
 }
 export function rewritePnpmError(err) {
     const text = err instanceof Error ? err.message : String(err);
+    if (/ERR_PNPM_UNUSED_PATCH/.test(text)) {
+        return new Error('profile 的补丁配置（patchedDependencies）里存在不再使用的条目，pnpm 拒绝执行。卸载时 dsh-m 会自动摘除目标包自己的补丁条目；仍报此错通常是其他包留有失效补丁，请手工清理 profile 的 pnpm-workspace.yaml。');
+    }
     if (isPrepareBlocked(text)) {
         return new Error('该插件需要执行构建脚本（prepare），pnpm 默认拦截。dsh-m 已写入 profile 的 dangerouslyAllowAllBuilds 并重试；若仍失败请检查 web profile 是否可写。');
     }

package/lib/core/market.js

@@ -7,7 +7,7 @@
 import { existsSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { addDshPlugin, removeDshPlugin, runCommand } from './dsh-cli.js';
+import { addDshPlugin, removeDshPlugin, removePatchedDependencyEntries, runCommand } from './dsh-cli.js';
 import { dshHome, installTimeoutMs, webProfileDir } from './env.js';
 import { assertNpmIntegrity, readPnpmLockIntegrity, restoreSnapshots, snapshotFiles } from './npm-integrity.js';
 import { listInstalledPlugins as defaultListInstalledPlugins, readProfileDeps, removeInstalledPlugin, } from './installed.js';
@@ -528,11 +528,14 @@ export async function installEntry(entry, cfg = {}, opts = {}, deps) {
     }
     throw new Error(`条目 ${entry.id} 缺少可安装来源`);
 }
-/** 卸载：live-disable → pnpm remove → 报告疑似残留（DESIGN.md §3：删包不删数据）。 */
-export async function uninstallPlugin(pkg, _cfg = {}, _opts = {}) {
+/** 卸载：live-disable → 摘除该包补丁条目 → pnpm remove → 报告疑似残留（DESIGN.md §3：删包不删数据）。 */
+export async function uninstallPlugin(pkg, _cfg = {}, _opts = {}, deps = {}) {
     const liveDisabled = await setLivePluginDisabled(pkg, true);
-    await removeInstalledPlugin(pkg);
-    return { pkg, liveDisabled, needsRestart: true, leftovers: leftoverCandidates(pkg) };
+    // 依赖移除后残留的 patchedDependencies 条目会让 pnpm 以 ERR_PNPM_UNUSED_PATCH 整单失败，先摘掉
+    const patchCleanup = (deps.removePatchedEntries ?? removePatchedDependencyEntries)(webProfileDir(), pkg);
+    await (deps.removeInstalled ?? removeInstalledPlugin)(pkg);
+    const leftovers = [...new Set([...leftoverCandidates(pkg), ...patchCleanup.orphanedPatchFiles])];
+    return { pkg, liveDisabled, needsRestart: true, leftovers };
 }
 /** 升级 = 按最新重新安装（npm 拉最新精确版；github 重新锁 HEAD）。 */
 export async function upgradePlugin(pkg, cfg = {}, opts = {}, deps) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-m",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "DSH Marketplace — 个人自用的 DeepSeek Harness 插件市场：收录、安装、卸载、升级 DSH 插件",
   "license": "MIT",
   "type": "module",

package/registry.json

@@ -7,9 +7,10 @@
       "description": "DeepSeek Harness Web 界面主题/皮肤管理插件，可切换多种视觉风格。",
       "category": "ui",
       "tags": ["主题", "美化"],
-      "source": "github",
-      "github": "iasiv5/skins",
-      "homepage": "https://github.com/iasiv5/skins"
+      "source": "npm",
+      "npm": "@iasiv5/dsh-skins",
+      "github": "iasiv5/dsh-skins",
+      "homepage": "https://github.com/iasiv5/dsh-skins"
     },
     {
       "id": "modsearch",