dsh-m 0.2.1 → 0.2.3

package/docs/DESIGN.md

@@ -66,7 +66,7 @@
 - **安装（npm 源）**：装最新版并以**精确版本锁定**（不用 `^` 范围；用户指定版本必须为精确 semver，经该精确版本 endpoint 查询）。安装前对 profile 的 `package.json` / `pnpm-lock.yaml` / `pnpm-workspace.yaml` 做字节快照；安装后核验 importer 依赖为该精确版本，并在 lockfile `packages` 条目中比对与 npm dist 一致的 `resolution.integrity`——缺失或不一致 **fail closed** 并执行 **best-effort dependency rollback**（原子恢复快照 + `pnpm install --frozen-lockfile`；恢复失败同时报告两类错误并提示人工修复）。不声称 node_modules 与间接依赖已字节级回滚。
 - **安装（GitHub 源）**：解析并**锁定 commit SHA**（`github:owner/repo#sha`），skillhub 同款。
 - **已装识别**：读 profile `package.json` dependencies，与 registry 匹配 → 标注「市场安装」；不匹配的也列出，标注「非市场安装 / 来源未知」。卸载/升级对两类都可用。
-- **卸载**：live-disable（先让 client bundle 下线，避免 404）→ `dsh plugin remove`。**不清理插件产生的数据/配置**，但把检测到的疑似残留路径（如 `~/.dsh/<plugin>.json`）列出报告。
+- **卸载**：live-disable（先让 client bundle 下线，避免 404）→ 摘除该包在 profile 的补丁条目（`pnpm-workspace.yaml` 顶层 `patchedDependencies` 与 `package.json#pnpm.patchedDependencies`；依赖移除后残留条目会令 pnpm 以 `ERR_PNPM_UNUSED_PATCH` 整单失败，只精确匹配 `pkg` / `pkg@ver`，补丁文件本体保留并计入残留报告）→ `dsh plugin remove`。**不清理插件产生的数据/配置**，但把检测到的疑似残留路径（如 `~/.dsh/<plugin>.json`）列出报告。
 - **升级**：**按需检查**（`dshm_outdated` / `dshm_list` 时实时比对本地版本 vs npm latest / GitHub main），半自动——展示升级计划，确认后执行。**不做后台定时器**。
 - **自更新**：dsh-m 对自己同样做版本比对 + 提示升级（设置页呈现）。
 - **重启**：内置**一键重启**，复用 skillhub 验证过的重启路径（本机 `dsh-web.service` 是转发 shim，不新建 systemd 单元、不监听 3080）。安装/卸载/升级完成后 GUI 弹「需重启生效 [一键重启]」横幅，工具返回重启提示。

package/lib/cli.js

@@ -82,7 +82,7 @@ const HELP = `dshm — DSH Marketplace（个人自用 DSH 插件市场）
 用法：dshm <命令> [参数]
 
 只读命令：
-  dshm search [--query 关键词] [--category market|tools|ui|search|media|other] [--limit N]
+  dshm search [--query 关键词] [--category market|tools|ui|search|other] [--limit N]
   dshm list                          列出 web profile 已装插件（含市场标注/可升级）
   dshm outdated                      检查已装插件的最新版本
   dshm registry                      查看收录清单来源与条目

package/lib/client.js

@@ -97,7 +97,7 @@ var init_market_state = __esm({
   "src/client/market-state.js"() {
     "use strict";
     MARKET_PAGE_SIZE = 50;
-    CATEGORIES = ["market", "tools", "ui", "search", "media", "other"];
+    CATEGORIES = ["market", "tools", "ui", "search", "other"];
     FALLBACK_REGISTRY_STATE = {
       configuredAddress: "",
       activeAddress: null,
@@ -130,7 +130,6 @@ var ZH = {
   "cat.tools": "\u5DE5\u5177",
   "cat.ui": "\u754C\u9762",
   "cat.search": "\u641C\u7D22",
-  "cat.media": "\u591A\u5A92\u4F53",
   "cat.other": "\u5176\u4ED6",
   "search.ph": "\u641C\u7D22\u540D\u79F0 / \u63CF\u8FF0 / \u6807\u7B7E\u2026",
   "common.refresh": "\u5237\u65B0",
@@ -299,7 +298,6 @@ var EN = {
   "cat.tools": "Tools",
   "cat.ui": "UI",
   "cat.search": "Search",
-  "cat.media": "Media",
   "cat.other": "Other",
   "search.ph": "Search name, description, tags\u2026",
   "common.refresh": "Refresh",
@@ -468,7 +466,7 @@ function lookup(key, params) {
   const dict = browserLang() === "en" ? EN : ZH;
   return interpolate(dict[key] ?? ZH[key] ?? key, params);
 }
-var CATEGORIES2 = ["market", "tools", "ui", "search", "media", "other"];
+var CATEGORIES2 = ["market", "tools", "ui", "search", "other"];
 var CSS = `
 .dshm-overlay{position:fixed;inset:0;z-index:2147483000;background:var(--dsw-alias-bg-mask-3,rgba(15,23,42,.48));display:flex;align-items:center;justify-content:center;padding:24px 16px;box-sizing:border-box}
 .dshm-panel{width:min(920px,100%);height:min(680px,86vh);display:flex;flex-direction:column;background:var(--dsw-alias-bg-overlay,var(--dsw-alias-bg-layer-3,#fff));border:1px solid var(--dsw-alias-border-l2,#e5e7eb);border-radius:14px;box-shadow:0 18px 48px rgba(2,6,23,.25);overflow:hidden;font-family:inherit;color:var(--dsw-alias-label-primary,inherit)}
@@ -514,7 +512,7 @@ var CSS = `
 .dshm-detail{margin-top:8px;border-top:1px dashed var(--dsw-alias-border-l2,#e5e7eb);padding-top:8px;display:flex;flex-direction:column;gap:6px;font-size:12px;color:var(--dsw-alias-label-secondary,#4b5563)}
 .dshm-actions{display:flex;gap:6px;flex-wrap:wrap;margin-top:4px}
 .dshm-banner{display:flex;align-items:center;gap:10px;padding:10px 14px;border-top:1px solid var(--dsw-alias-border-l2,#e5e7eb);background:var(--dsw-alias-state-warn-tertiary,#fffbeb);color:var(--dsw-alias-state-warn-primary,#b45309);font-size:12px}
-.dshm-banner .dshm-banner-text{flex:1}
+.dshm-banner .dshm-banner-text{flex:1;max-height:140px;overflow:auto;overscroll-behavior:contain;white-space:pre-wrap;word-break:break-word;line-height:18px}
 .dshm-row{display:flex;align-items:center;gap:8px}
 .dshm-kv{display:grid;grid-template-columns:96px 1fr;gap:6px 10px;font-size:12px;align-items:baseline}
 .dshm-kv .k{color:var(--dsw-alias-label-caption,#6b7280);font-size:11px}
@@ -560,6 +558,10 @@ var CSS = `
 .dshm-entry:hover{background:var(--dsw-alias-interactive-bg-hover,rgba(38,49,72,.06))}
 .dshm-entry svg{flex:none;width:16px;height:16px}
 .dshm-entry span{white-space:nowrap;overflow:hidden;text-overflow:ellipsis}
+/* \u6536\u8D77\uFF08rail\uFF09\u6001\uFF1A\u4E0E\u5BBF\u4E3B\u8BBE\u7F6E\u5165\u53E3 / dsh-skins \u540C\u51E0\u4F55\u2014\u201436\xD736 \u5706\u5F62\u3001margin 8/10\u3001
+   \u56FE\u6807 18\u3001\u5185\u5BB9\u6C34\u5E73\u5C45\u4E2D\u3002\u7F3A\u8FD9\u5957\u4F1A\u5BFC\u81F4\u6536\u8D77\u65F6\u56FE\u6807\u504F\u79BB\u8F74\u7EBF\u4E14\u884C\u8DDD\u4E0D\u9F50\uFF08\u5B9E\u6D4B\u5DE6\u504F ~4px\uFF09\u3002 */
+.dshm-entry.rail{width:36px;height:36px;margin:8px 0 10px;padding:0;justify-content:center;border-radius:50%;gap:0}
+.dshm-entry.rail svg{width:18px;height:18px}
 [data-slot="sidebar.footer.action"]{display:flex!important;flex-direction:column;width:100%;min-width:0}
 [data-slot="sidebar.footer.action"]>*{flex:none;min-width:0}
 .dshm-empty{text-align:center;color:var(--dsw-alias-label-caption,#6b7280);font-size:13px;padding:32px 0}
@@ -1619,10 +1621,11 @@ function MarketIcon() {
 }
 function MarketEntry(props) {
   useEffect(() => ensureCss(), []);
+  const rail = !(props && props.wide);
   return h(
     "button",
     {
-      className: "dshm-entry",
+      className: rail ? "dshm-entry rail" : "dshm-entry",
       onClick: () => {
         try {
           mountPanel();

package/lib/core/dsh-cli.js

@@ -10,6 +10,119 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { installTimeoutMs, WEB_PROFILE, webProfileDir } from './env.js';
 import { createProgressTracker } from './progress.js';
+/** pnpm patchedDependencies 条目键与目标包匹配：`pkg` 或 `pkg@任意版本/区间`。 */
+function matchesPatchedKey(key, pkg) {
+    return key === pkg || key.startsWith(`${pkg}@`);
+}
+/**
+ * 摘除 profile 里目标包的 pnpm 补丁条目：pnpm-workspace.yaml 顶层
+ * `patchedDependencies` 与 package.json 的 `pnpm.patchedDependencies` 两处。
+ * 卸载场景下依赖被移除后，残留补丁条目会让 pnpm 以 ERR_PNPM_UNUSED_PATCH
+ * 拒绝整个 remove/install。只精确匹配目标包的键（`pkg` / `pkg@ver`），
+ * 其他包的补丁不动；补丁文件本体保留在磁盘（删包不删数据，DESIGN.md §3）。
+ */
+export function removePatchedDependencyEntries(profileDirectory, pkg, deps = {}) {
+    const target = String(pkg || '').trim();
+    if (!target || !isSafePluginTarget(target))
+        return { changed: false, orphanedPatchFiles: [] };
+    const exists = deps.existsSync ?? existsSync;
+    const read = deps.readFileSync ?? readFileSync;
+    const write = deps.writeFileSync ?? writeFileSync;
+    const orphanedPatchFiles = [];
+    let changed = false;
+    // --- pnpm-workspace.yaml（pnpm≥10 补丁配置落点；行级手术，只摘匹配键） ---
+    const wsFile = join(profileDirectory, 'pnpm-workspace.yaml');
+    let ws = '';
+    try {
+        ws = read(wsFile, 'utf8');
+    }
+    catch {
+        /* 无文件则跳过 */
+    }
+    if (ws) {
+        const srcLines = ws.split('\n');
+        let start = -1;
+        for (let i = 0; i < srcLines.length; i++) {
+            if (/^patchedDependencies:\s*$/.test(srcLines[i])) {
+                start = i;
+                break;
+            }
+        }
+        if (start >= 0) {
+            // 块边界：下一个顶层键（无缩进行）或文件尾
+            let end = srcLines.length;
+            for (let i = start + 1; i < srcLines.length; i++) {
+                if (/^\S/.test(srcLines[i])) {
+                    end = i;
+                    break;
+                }
+            }
+            const keptBlock = [];
+            for (const line of srcLines.slice(start + 1, end)) {
+                // 条目行：缩进键 + `:` + 补丁文件路径（键可带引号）
+                const m = /^\s+(["']?)([^"':]+?)\1\s*:\s*(.+?)\s*$/.exec(line);
+                if (m && matchesPatchedKey(m[2].trim(), target)) {
+                    changed = true;
+                    const file = resolve(profileDirectory, m[3].trim());
+                    if (exists(file))
+                        orphanedPatchFiles.push(file);
+                }
+                else {
+                    keptBlock.push(line);
+                }
+            }
+            if (changed) {
+                // 块内条目被摘空 → 连 `patchedDependencies:` 头一起移除，避免留下空映射
+                const stillHasEntry = keptBlock.some((l) => /^\s+\S/.test(l));
+                const next = stillHasEntry
+                    ? [...srcLines.slice(0, start + 1), ...keptBlock, ...srcLines.slice(end)]
+                    : [...srcLines.slice(0, start), ...srcLines.slice(end)];
+                write(wsFile, next.join('\n'));
+            }
+        }
+    }
+    // --- package.json#pnpm.patchedDependencies（pnpm<10 落点，兼容清理） ---
+    const pkgJsonFile = join(profileDirectory, 'package.json');
+    let raw = '';
+    try {
+        raw = read(pkgJsonFile, 'utf8');
+    }
+    catch {
+        /* 无文件则跳过 */
+    }
+    if (raw) {
+        try {
+            const doc = JSON.parse(raw);
+            const patched = doc?.pnpm?.patchedDependencies;
+            if (patched && typeof patched === 'object') {
+                let touched = false;
+                for (const [key, file] of Object.entries(patched)) {
+                    if (!matchesPatchedKey(key, target))
+                        continue;
+                    delete patched[key];
+                    touched = true;
+                    changed = true;
+                    if (typeof file === 'string') {
+                        const abs = resolve(profileDirectory, file);
+                        if (exists(abs))
+                            orphanedPatchFiles.push(abs);
+                    }
+                }
+                if (touched) {
+                    if (Object.keys(patched).length === 0)
+                        delete doc.pnpm.patchedDependencies;
+                    if (Object.keys(doc.pnpm).length === 0)
+                        delete doc.pnpm;
+                    write(pkgJsonFile, `${JSON.stringify(doc, null, 2)}\n`);
+                }
+            }
+        }
+        catch {
+            /* package.json 不是合法 JSON：不动 */
+        }
+    }
+    return { changed, orphanedPatchFiles };
+}
 const TARGET_RE = /^[A-Za-z0-9@:./_#+-]+$/;
 const NDJSON_COMMANDS = new Set(['add', 'remove', 'install']);
 export const BOOT_ID = `${String(process.pid)}-${String(Date.now())}`;
@@ -163,6 +276,9 @@ function writeDangerouslyAllowAllBuilds(profileDirectory) {
 }
 export function rewritePnpmError(err) {
     const text = err instanceof Error ? err.message : String(err);
+    if (/ERR_PNPM_UNUSED_PATCH/.test(text)) {
+        return new Error('profile 的补丁配置（patchedDependencies）里存在不再使用的条目，pnpm 拒绝执行。卸载时 dsh-m 会自动摘除目标包自己的补丁条目；仍报此错通常是其他包留有失效补丁，请手工清理 profile 的 pnpm-workspace.yaml。');
+    }
     if (isPrepareBlocked(text)) {
         return new Error('该插件需要执行构建脚本（prepare），pnpm 默认拦截。dsh-m 已写入 profile 的 dangerouslyAllowAllBuilds 并重试；若仍失败请检查 web profile 是否可写。');
     }

package/lib/core/market.js

@@ -7,7 +7,7 @@
 import { existsSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { addDshPlugin, removeDshPlugin, runCommand } from './dsh-cli.js';
+import { addDshPlugin, removeDshPlugin, removePatchedDependencyEntries, runCommand } from './dsh-cli.js';
 import { dshHome, installTimeoutMs, webProfileDir } from './env.js';
 import { assertNpmIntegrity, readPnpmLockIntegrity, restoreSnapshots, snapshotFiles } from './npm-integrity.js';
 import { listInstalledPlugins as defaultListInstalledPlugins, readProfileDeps, removeInstalledPlugin, } from './installed.js';
@@ -42,7 +42,7 @@ export async function mapWithConcurrency(items, limit, worker) {
     return results;
 }
 function zeroCounts() {
-    return { market: 0, tools: 0, ui: 0, search: 0, media: 0, other: 0 };
+    return { market: 0, tools: 0, ui: 0, search: 0, other: 0 };
 }
 function clampLimit(raw, max) {
     const n = typeof raw === 'number' && Number.isFinite(raw) ? Math.floor(raw) : max;
@@ -528,11 +528,14 @@ export async function installEntry(entry, cfg = {}, opts = {}, deps) {
     }
     throw new Error(`条目 ${entry.id} 缺少可安装来源`);
 }
-/** 卸载：live-disable → pnpm remove → 报告疑似残留（DESIGN.md §3：删包不删数据）。 */
-export async function uninstallPlugin(pkg, _cfg = {}, _opts = {}) {
+/** 卸载：live-disable → 摘除该包补丁条目 → pnpm remove → 报告疑似残留（DESIGN.md §3：删包不删数据）。 */
+export async function uninstallPlugin(pkg, _cfg = {}, _opts = {}, deps = {}) {
     const liveDisabled = await setLivePluginDisabled(pkg, true);
-    await removeInstalledPlugin(pkg);
-    return { pkg, liveDisabled, needsRestart: true, leftovers: leftoverCandidates(pkg) };
+    // 依赖移除后残留的 patchedDependencies 条目会让 pnpm 以 ERR_PNPM_UNUSED_PATCH 整单失败，先摘掉
+    const patchCleanup = (deps.removePatchedEntries ?? removePatchedDependencyEntries)(webProfileDir(), pkg);
+    await (deps.removeInstalled ?? removeInstalledPlugin)(pkg);
+    const leftovers = [...new Set([...leftoverCandidates(pkg), ...patchCleanup.orphanedPatchFiles])];
+    return { pkg, liveDisabled, needsRestart: true, leftovers };
 }
 /** 升级 = 按最新重新安装（npm 拉最新精确版；github 重新锁 HEAD）。 */
 export async function upgradePlugin(pkg, cfg = {}, opts = {}, deps) {

package/lib/core/registry.js

@@ -10,7 +10,7 @@ import { constants as fsConstants, mkdirSync } from 'node:fs';
 import { lstat, mkdir, open, readFile, readdir, realpath, rename, rm } from 'node:fs/promises';
 import { cacheDir } from './env.js';
 import { decodeUtf8Fatal, fetchJsonLimitedMeta } from './httpx.js';
-export const CATEGORIES = ['market', 'tools', 'ui', 'search', 'media', 'other'];
+export const CATEGORIES = ['market', 'tools', 'ui', 'search', 'other'];
 /** 容量上限：2 MiB 是原始 UTF-8 bytes（不是字符数）；条目超限拒绝整份清单。 */
 export const MAX_REGISTRY_BYTES = 2 * 1024 * 1024;
 export const MAX_PLUGINS = 1000;

package/lib/tools.js

@@ -7,7 +7,6 @@ export const CATEGORY_LABELS = {
     tools: '工具',
     ui: '界面',
     search: '搜索',
-    media: '多媒体',
     other: '其他',
 };
 function cloneJson(value) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-m",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "DSH Marketplace — 个人自用的 DeepSeek Harness 插件市场：收录、安装、卸载、升级 DSH 插件",
   "license": "MIT",
   "type": "module",

package/registry.json

@@ -7,9 +7,43 @@
       "description": "DeepSeek Harness Web 界面主题/皮肤管理插件，可切换多种视觉风格。",
       "category": "ui",
       "tags": ["主题", "美化"],
-      "source": "github",
-      "github": "iasiv5/skins",
-      "homepage": "https://github.com/iasiv5/skins"
+      "source": "npm",
+      "npm": "@iasiv5/dsh-skins",
+      "github": "iasiv5/dsh-skins",
+      "homepage": "https://github.com/iasiv5/dsh-skins"
+    },
+    {
+      "id": "dsh-copilot-auth",
+      "name": "DSH Copilot Auth",
+      "description": "为 DSH 内置 GitHub Copilot 提供方补上设备码（device flow）登录/注销设置页，并预置开箱即用的 Copilot 路由；凭据托管 DSH 内置凭据库，模型目录自动同步。",
+      "category": "tools",
+      "tags": ["Copilot", "认证", "模型接入"],
+      "source": "npm",
+      "npm": "@inventec/dsh-copilot-auth",
+      "github": "iasiv5/dsh-copilot-auth",
+      "homepage": "https://github.com/iasiv5/dsh-copilot-auth"
+    },
+    {
+      "id": "dsh-m",
+      "name": "DSH Marketplace",
+      "description": "可自定义 Registry 内容的 DeepSeek Harness 插件市场：收录、安装、卸载、升级 DSH 插件，一站搞定。",
+      "category": "market",
+      "tags": ["市场", "插件管理"],
+      "source": "npm",
+      "npm": "dsh-m",
+      "github": "iasiv5/dsh-m",
+      "homepage": "https://github.com/iasiv5/dsh-m"
+    },
+    {
+      "id": "dsh-skip-browser-auth",
+      "name": "DSH Skip Browser Auth",
+      "description": "在已适配版本上替换官方 Connection 提供方，跳过 BrowserAuth，不再需要输入烦人的Token。（当前已适配：0.1.2-rc.1）",
+      "category": "tools",
+      "tags": ["BrowserAuth", "连接", "安全"],
+      "source": "npm",
+      "npm": "@iasiv5/dsh-skip-browser-auth",
+      "github": "iasiv5/dsh-skip-browser-auth",
+      "homepage": "https://github.com/iasiv5/dsh-skip-browser-auth"
     },
     {
       "id": "modsearch",
@@ -22,6 +56,17 @@
       "github": "liustack/modsearch",
       "homepage": "https://github.com/liustack/modsearch"
     },
+    {
+      "id": "dsh-auth",
+      "name": "DSH Auth",
+      "description": "DSH Web 管理员认证插件：Argon2id 口令、可撤销会话、双语界面，经 Caddy forward_auth 边缘保护页面/API/下载/SSE/WebSocket，Harness 保持仅回环监听。",
+      "category": "tools",
+      "tags": ["认证", "安全"],
+      "source": "npm",
+      "npm": "dsh-auth",
+      "github": "hxy91819/dsh-auth",
+      "homepage": "https://github.com/hxy91819/dsh-auth"
+    },
     {
       "id": "deepseek-harness-lark",
       "name": "DeepSeek Harness Lark",
@@ -76,39 +121,6 @@
       "npm": "deepseek-harness-dingtalk",
       "github": "sliverp/DeepSeek-harness-dingtalk",
       "homepage": "https://github.com/sliverp/DeepSeek-harness-dingtalk"
-    },
-    {
-      "id": "dsh-auth",
-      "name": "DSH Auth",
-      "description": "DSH Web 管理员认证插件：Argon2id 口令、可撤销会话、双语界面，经 Caddy forward_auth 边缘保护页面/API/下载/SSE/WebSocket，Harness 保持仅回环监听。",
-      "category": "tools",
-      "tags": ["认证", "安全"],
-      "source": "npm",
-      "npm": "dsh-auth",
-      "github": "hxy91819/dsh-auth",
-      "homepage": "https://github.com/hxy91819/dsh-auth"
-    },
-    {
-      "id": "dsh-copilot-auth",
-      "name": "DSH Copilot Auth",
-      "description": "为 DSH 内置 GitHub Copilot 提供方补上设备码（device flow）登录/注销设置页，并预置开箱即用的 Copilot 路由；凭据托管 DSH 内置凭据库，模型目录自动同步，中英双语。",
-      "category": "tools",
-      "tags": ["Copilot", "认证", "模型接入"],
-      "source": "npm",
-      "npm": "@inventec/dsh-copilot-auth",
-      "github": "iasiv5/dsh-copilot-auth",
-      "homepage": "https://github.com/iasiv5/dsh-copilot-auth"
-    },
-    {
-      "id": "dsh-m",
-      "name": "DSH Marketplace",
-      "description": "个人自用的 DeepSeek Harness 插件市场：收录、安装、卸载、升级 DSH 插件，含 Web 界面、agent 工具与 CLI。",
-      "category": "market",
-      "tags": ["市场", "插件管理"],
-      "source": "npm",
-      "npm": "dsh-m",
-      "github": "iasiv5/dsh-m",
-      "homepage": "https://github.com/iasiv5/dsh-m"
     }
   ]
 }