dsh-m 0.2.2 → 0.2.4

package/docs/DESIGN.md

@@ -63,7 +63,7 @@
 
 底层原语（本机实证）：`dsh plugin --profile web add|remove|update`（转发 pnpm，作用于 `$DSH_HOME/profiles/web`）。**profile 的 `package.json` 就是唯一事实源**——不引入任何额外状态文件。
 
-- **安装（npm 源）**：装最新版并以**精确版本锁定**（不用 `^` 范围；用户指定版本必须为精确 semver，经该精确版本 endpoint 查询）。安装前对 profile 的 `package.json` / `pnpm-lock.yaml` / `pnpm-workspace.yaml` 做字节快照；安装后核验 importer 依赖为该精确版本，并在 lockfile `packages` 条目中比对与 npm dist 一致的 `resolution.integrity`——缺失或不一致 **fail closed** 并执行 **best-effort dependency rollback**（原子恢复快照 + `pnpm install --frozen-lockfile`；恢复失败同时报告两类错误并提示人工修复）。不声称 node_modules 与间接依赖已字节级回滚。
+- **安装（npm 源）**：装最新版并以**精确版本锁定**（不用 `^` 范围；用户指定版本必须为精确 semver，经该精确版本 endpoint 查询）。安装前对 profile 的 `package.json` / `pnpm-lock.yaml` / `pnpm-workspace.yaml` 做**字节快照**；安装后核验 importer 依赖为该精确版本，并在 lockfile `packages` 条目中比对与 npm dist 一致的 `resolution.integrity`——缺失或不一致 **fail closed** 并执行 **best-effort dependency rollback**：原子恢复快照字节 + frozen 自愈阶梯（`pnpm install --frozen-lockfile` → 仍报 `CONFIG_MISMATCH` 时把 lockfile 记录的 overrides 对齐回 `package.json#pnpm.overrides` 再复验 → `CONFIG_MISMATCH` / `OUTDATED_LOCKFILE` 顽固失配才降级 `--no-frozen-lockfile` 重建并明确告知「lockfile 已重建」；全阶梯失败才报「可能需要人工修复」）。成功路径若发现安装链丢失了 manifest 顶层未知键（如 `pnpm.overrides`，2026-09-05 升级回滚事故），从快照找回并复验 frozen 一致性，输出带 `[dsh-m 自愈]` 报告。刚发布 ~1 分钟内的 `ERR_PNPM_NO_MATCHING_VERSION` 多为 packument CDN 滞后：退避重试 2 次（5s/15s），每次重试前拉一次完整 packument 预热。不声称 node_modules 与间接依赖已字节级回滚。
 - **安装（GitHub 源）**：解析并**锁定 commit SHA**（`github:owner/repo#sha`），skillhub 同款。
 - **已装识别**：读 profile `package.json` dependencies，与 registry 匹配 → 标注「市场安装」；不匹配的也列出，标注「非市场安装 / 来源未知」。卸载/升级对两类都可用。
 - **卸载**：live-disable（先让 client bundle 下线，避免 404）→ 摘除该包在 profile 的补丁条目（`pnpm-workspace.yaml` 顶层 `patchedDependencies` 与 `package.json#pnpm.patchedDependencies`；依赖移除后残留条目会令 pnpm 以 `ERR_PNPM_UNUSED_PATCH` 整单失败，只精确匹配 `pkg` / `pkg@ver`，补丁文件本体保留并计入残留报告）→ `dsh plugin remove`。**不清理插件产生的数据/配置**，但把检测到的疑似残留路径（如 `~/.dsh/<plugin>.json`）列出报告。

package/lib/cli.js

@@ -82,7 +82,7 @@ const HELP = `dshm — DSH Marketplace（个人自用 DSH 插件市场）
 用法：dshm <命令> [参数]
 
 只读命令：
-  dshm search [--query 关键词] [--category market|tools|ui|search|media|other] [--limit N]
+  dshm search [--query 关键词] [--category market|tools|ui|search|other] [--limit N]
   dshm list                          列出 web profile 已装插件（含市场标注/可升级）
   dshm outdated                      检查已装插件的最新版本
   dshm registry                      查看收录清单来源与条目

package/lib/client.js

@@ -97,7 +97,7 @@ var init_market_state = __esm({
   "src/client/market-state.js"() {
     "use strict";
     MARKET_PAGE_SIZE = 50;
-    CATEGORIES = ["market", "tools", "ui", "search", "media", "other"];
+    CATEGORIES = ["market", "tools", "ui", "search", "other"];
     FALLBACK_REGISTRY_STATE = {
       configuredAddress: "",
       activeAddress: null,
@@ -130,7 +130,6 @@ var ZH = {
   "cat.tools": "\u5DE5\u5177",
   "cat.ui": "\u754C\u9762",
   "cat.search": "\u641C\u7D22",
-  "cat.media": "\u591A\u5A92\u4F53",
   "cat.other": "\u5176\u4ED6",
   "search.ph": "\u641C\u7D22\u540D\u79F0 / \u63CF\u8FF0 / \u6807\u7B7E\u2026",
   "common.refresh": "\u5237\u65B0",
@@ -299,7 +298,6 @@ var EN = {
   "cat.tools": "Tools",
   "cat.ui": "UI",
   "cat.search": "Search",
-  "cat.media": "Media",
   "cat.other": "Other",
   "search.ph": "Search name, description, tags\u2026",
   "common.refresh": "Refresh",
@@ -468,7 +466,7 @@ function lookup(key, params) {
   const dict = browserLang() === "en" ? EN : ZH;
   return interpolate(dict[key] ?? ZH[key] ?? key, params);
 }
-var CATEGORIES2 = ["market", "tools", "ui", "search", "media", "other"];
+var CATEGORIES2 = ["market", "tools", "ui", "search", "other"];
 var CSS = `
 .dshm-overlay{position:fixed;inset:0;z-index:2147483000;background:var(--dsw-alias-bg-mask-3,rgba(15,23,42,.48));display:flex;align-items:center;justify-content:center;padding:24px 16px;box-sizing:border-box}
 .dshm-panel{width:min(920px,100%);height:min(680px,86vh);display:flex;flex-direction:column;background:var(--dsw-alias-bg-overlay,var(--dsw-alias-bg-layer-3,#fff));border:1px solid var(--dsw-alias-border-l2,#e5e7eb);border-radius:14px;box-shadow:0 18px 48px rgba(2,6,23,.25);overflow:hidden;font-family:inherit;color:var(--dsw-alias-label-primary,inherit)}
@@ -560,6 +558,10 @@ var CSS = `
 .dshm-entry:hover{background:var(--dsw-alias-interactive-bg-hover,rgba(38,49,72,.06))}
 .dshm-entry svg{flex:none;width:16px;height:16px}
 .dshm-entry span{white-space:nowrap;overflow:hidden;text-overflow:ellipsis}
+/* \u6536\u8D77\uFF08rail\uFF09\u6001\uFF1A\u4E0E\u5BBF\u4E3B\u8BBE\u7F6E\u5165\u53E3 / dsh-skins \u540C\u51E0\u4F55\u2014\u201436\xD736 \u5706\u5F62\u3001margin 8/10\u3001
+   \u56FE\u6807 18\u3001\u5185\u5BB9\u6C34\u5E73\u5C45\u4E2D\u3002\u7F3A\u8FD9\u5957\u4F1A\u5BFC\u81F4\u6536\u8D77\u65F6\u56FE\u6807\u504F\u79BB\u8F74\u7EBF\u4E14\u884C\u8DDD\u4E0D\u9F50\uFF08\u5B9E\u6D4B\u5DE6\u504F ~4px\uFF09\u3002 */
+.dshm-entry.rail{width:36px;height:36px;margin:8px 0 10px;padding:0;justify-content:center;border-radius:50%;gap:0}
+.dshm-entry.rail svg{width:18px;height:18px}
 [data-slot="sidebar.footer.action"]{display:flex!important;flex-direction:column;width:100%;min-width:0}
 [data-slot="sidebar.footer.action"]>*{flex:none;min-width:0}
 .dshm-empty{text-align:center;color:var(--dsw-alias-label-caption,#6b7280);font-size:13px;padding:32px 0}
@@ -1619,10 +1621,11 @@ function MarketIcon() {
 }
 function MarketEntry(props) {
   useEffect(() => ensureCss(), []);
+  const rail = !(props && props.wide);
   return h(
     "button",
     {
-      className: "dshm-entry",
+      className: rail ? "dshm-entry rail" : "dshm-entry",
       onClick: () => {
         try {
           mountPanel();

package/lib/core/market.js

@@ -3,17 +3,21 @@
  * 安装 / 升级。安装语义见 DESIGN.md §3（npm 精确锁定、GitHub 锁 SHA）。
  * Task 3：服务端 query/category/offset/limit 过滤；只对当前页查 latest（并发 ≤8、
  * TTL cache、共享全局 deadline）；unavailable 返回结构化空页；host/cli namespace 贯穿。
+ * 2026-09-05 回滚缺陷加固：B1 成功路径保留 manifest 顶层未知键（如 pnpm.overrides）、
+ * 失败路径字节级回滚后 frozen 自愈阶梯（overrides 对齐 → no-frozen 重建，B2）、
+ * 新发布后 NO_MATCHING_VERSION 的退避重试 + packument 预热（B3）。
  */
 import { existsSync } from 'node:fs';
+import { Buffer } from 'node:buffer';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { addDshPlugin, removeDshPlugin, removePatchedDependencyEntries, runCommand } from './dsh-cli.js';
 import { dshHome, installTimeoutMs, webProfileDir } from './env.js';
-import { assertNpmIntegrity, readPnpmLockIntegrity, restoreSnapshots, snapshotFiles } from './npm-integrity.js';
+import { assertNpmIntegrity, atomicWriteFile, readPnpmLockIntegrity, readPnpmLockOverrides, restoreSnapshots, snapshotFiles, } from './npm-integrity.js';
 import { listInstalledPlugins as defaultListInstalledPlugins, readProfileDeps, removeInstalledPlugin, } from './installed.js';
 import { setLivePluginDisabled } from './live-plugin.js';
 import { loadRegistry as defaultLoadRegistry, } from './registry.js';
-import { githubLatestTag as defaultGithubLatestTag, isNewerVersion, npmLatest as defaultNpmLatest, npmVersion } from './versions.js';
+import { githubLatestTag as defaultGithubLatestTag, isNewerVersion, npmLatest as defaultNpmLatest, npmPackument as defaultNpmPackument, npmVersion, } from './versions.js';
 // ---------- 通用工具 ----------
 const DEFAULT_DEADLINE_MS = 60_000;
 const WITH_LATEST_MAX = 50;
@@ -42,7 +46,7 @@ export async function mapWithConcurrency(items, limit, worker) {
     return results;
 }
 function zeroCounts() {
-    return { market: 0, tools: 0, ui: 0, search: 0, media: 0, other: 0 };
+    return { market: 0, tools: 0, ui: 0, search: 0, other: 0 };
 }
 function clampLimit(raw, max) {
     const n = typeof raw === 'number' && Number.isFinite(raw) ? Math.floor(raw) : max;
@@ -400,6 +404,157 @@ export async function listInstalledWithMeta(cfg = {}, opts = {}, deps = {}) {
 async function defaultRestoreInstall(profileDir) {
     return runCommand('pnpm', ['--dir', profileDir, 'install', '--frozen-lockfile'], { timeoutMs: installTimeoutMs() });
 }
+async function defaultRebuildInstall(profileDir) {
+    return runCommand('pnpm', ['--dir', profileDir, 'install', '--no-frozen-lockfile'], { timeoutMs: installTimeoutMs() });
+}
+/** B3 默认退避：新发布 ~1 分钟内的升级失败多为 packument CDN 滞后（2026-09-05 实证）。 */
+const NO_MATCHING_VERSION_RETRY_DELAYS_MS = [5_000, 15_000];
+// ---------- B1/B2：manifest 保留与 frozen 自愈（2026-09-05 事故加固） ----------
+const LOCKFILE_CONFIG_MISMATCH_RE = /ERR_PNPM_LOCKFILE_CONFIG_MISMATCH/;
+const OUTDATED_LOCKFILE_RE = /ERR_PNPM_OUTDATED_LOCKFILE/;
+const NO_MATCHING_VERSION_RE = /ERR_PNPM_NO_MATCHING_VERSION/;
+function errText(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function readManifestDoc(profileDir) {
+    try {
+        const parsed = JSON.parse(await readFile(join(profileDir, 'package.json'), 'utf8'));
+        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * B1（成功路径）：安装链（pnpm / 宿主 CLI）若把升级前 manifest 的顶层键丢掉
+ * （如 `pnpm.overrides` 事故前态），从安装前字节快照里找回并原子写回。
+ * 只补「快照有、现在无」的键，绝不覆盖安装刚写入的 dependencies/dsh 变更。
+ * 返回找回的键名列表；无需修复返回 null。
+ */
+async function restoreManifestKeys(profileDir, snapshot) {
+    if (!snapshot?.existed || snapshot.bytes === null)
+        return null;
+    let prev;
+    try {
+        const parsed = JSON.parse(snapshot.bytes.toString('utf8'));
+        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+            return null;
+        prev = parsed;
+    }
+    catch {
+        return null;
+    }
+    const cur = await readManifestDoc(profileDir);
+    if (!cur)
+        return null;
+    const missing = Object.keys(prev).filter((k) => !(k in cur));
+    if (missing.length === 0)
+        return null;
+    for (const key of missing)
+        cur[key] = prev[key];
+    const bytes = Buffer.from(`${JSON.stringify(cur, null, 2)}\n`, 'utf8');
+    await atomicWriteFile(join(profileDir, 'package.json'), bytes);
+    return missing;
+}
+/**
+ * B2 第一层自愈：frozen 校验报 overrides 失配时，把 lockfile 记录的 overrides
+ * 并入 manifest 的 `pnpm.overrides`（manifest 已有条目优先，绝不删用户手写的键）。
+ * lockfile 的 overrides 是上一次解析实际生效的钉版，以此为准可让 frozen 直接通过
+ * 而无需重建依赖树（与 2026-09-05 人工修复路径等价）。未做任何修改返回 null。
+ */
+async function restoreOverridesFromLock(profileDir) {
+    let lockText;
+    try {
+        lockText = await readFile(join(profileDir, 'pnpm-lock.yaml'), 'utf8');
+    }
+    catch {
+        return null;
+    }
+    const lockOverrides = readPnpmLockOverrides(lockText);
+    const doc = await readManifestDoc(profileDir);
+    if (!doc)
+        return null;
+    const pnpm = doc.pnpm !== null && typeof doc.pnpm === 'object' && !Array.isArray(doc.pnpm)
+        ? doc.pnpm
+        : {};
+    const current = pnpm.overrides !== null && typeof pnpm.overrides === 'object' && !Array.isArray(pnpm.overrides)
+        ? pnpm.overrides
+        : {};
+    const merged = { ...lockOverrides, ...current };
+    if (JSON.stringify(merged) === JSON.stringify(current))
+        return null;
+    doc.pnpm = { ...pnpm, overrides: merged };
+    const bytes = Buffer.from(`${JSON.stringify(doc, null, 2)}\n`, 'utf8');
+    await atomicWriteFile(join(profileDir, 'package.json'), bytes);
+    const restored = Object.keys(lockOverrides).filter((k) => !(k in current));
+    return restored.length > 0 ? `（还原自 lockfile：${restored.join(', ')}）` : '（与 lockfile overrides 对齐）';
+}
+/**
+ * B2 frozen 自愈阶梯：frozen install → CONFIG_MISMATCH 时先 overrides 对齐再重试 →
+ * 仍失配（或 OUTDATED_LOCKFILE specifier 漂移，实机实证：override 钉直接依赖时回滚
+ * 快照本身即 specifier 不一致）则降级 `--no-frozen-lockfile` 重建一致性。自愈动作按序
+ * 记入 notes（最终呈现给用户）；阶梯走完仍失败时抛最后一个错误。
+ */
+async function frozenInstallWithHeal(profileDir, d, notes) {
+    try {
+        await d.restoreInstall(profileDir);
+        return;
+    }
+    catch (frozenErr) {
+        const text = errText(frozenErr);
+        const isConfigMismatch = LOCKFILE_CONFIG_MISMATCH_RE.test(text);
+        if (!isConfigMismatch && !OUTDATED_LOCKFILE_RE.test(text))
+            throw frozenErr;
+        if (isConfigMismatch) {
+            const merged = await restoreOverridesFromLock(profileDir);
+            if (merged !== null) {
+                notes.push(`已把 lockfile overrides 还原进 manifest ${merged}`);
+                try {
+                    await d.restoreInstall(profileDir);
+                    notes.push('frozen 校验通过');
+                    return;
+                }
+                catch {
+                    /* 对齐后仍失配 → 走重建降级 */
+                }
+            }
+        }
+        try {
+            await d.rebuildInstall(profileDir);
+        }
+        catch (rebuildErr) {
+            throw new Error(`${text}；lockfile 重建（--no-frozen-lockfile）也失败：${errText(rebuildErr)}`);
+        }
+        notes.push('lockfile 已重建（--no-frozen-lockfile 完成一致性安装）');
+    }
+}
+/**
+ * B3：ERR_PNPM_NO_MATCHING_VERSION 在刚发布的窗口内几乎都是 packument CDN 滞后
+ * （2026-09-05 实证：/latest 已新、完整 packument 仍旧）。按 retryDelaysMs 退避重试，
+ * 每次重试前拉一次完整 packument 预热/校验；其他错误与重试耗尽后原样抛出。
+ */
+async function addDshPluginWithRetry(spec, pkg, d, retryDelaysMs, timeoutMs, signal) {
+    let attempt = 0;
+    for (;;) {
+        try {
+            return await d.addDshPlugin(spec);
+        }
+        catch (err) {
+            if (!NO_MATCHING_VERSION_RE.test(errText(err)) || attempt >= retryDelaysMs.length)
+                throw err;
+            const delay = retryDelaysMs[attempt] ?? 0;
+            attempt += 1;
+            if (delay > 0)
+                await sleep(delay);
+            await d.npmPackument(pkg, timeoutMs, signal).catch(() => undefined);
+        }
+    }
+}
 /** 从 registry 收录条目安装（npm → 精确锁定最新版；github → 锁 HEAD SHA）。 */
 export async function installFromRegistry(id, cfg = {}, opts = {}, deps) {
     const loaded = await (deps?.loadRegistry ?? defaultLoadRegistry)(cfg, { namespace: opts.namespace ?? 'host' });
@@ -416,12 +571,15 @@ export async function installEntry(entry, cfg = {}, opts = {}, deps) {
     const d = {
         npmLatest: deps?.npmLatest ?? defaultNpmLatest,
         npmVersion: deps?.npmVersion ?? npmVersion,
+        npmPackument: deps?.npmPackument ?? defaultNpmPackument,
         addDshPlugin: deps?.addDshPlugin ?? addDshPlugin,
         removeDshPlugin: deps?.removeDshPlugin ?? removeDshPlugin,
         readProfileDeps: deps?.readProfileDeps ?? readProfileDeps,
         readLockIntegrity: deps?.readLockIntegrity ?? readPnpmLockIntegrity,
         restoreInstall: deps?.restoreInstall ?? defaultRestoreInstall,
+        rebuildInstall: deps?.rebuildInstall ?? defaultRebuildInstall,
     };
+    const retryDelaysMs = deps?.retryDelaysMs ?? NO_MATCHING_VERSION_RETRY_DELAYS_MS;
     const profileDir = deps?.profileDir ?? webProfileDir();
     if (entry.source === 'npm' && entry.npm) {
         const pkg = entry.npm;
@@ -441,14 +599,18 @@ export async function installEntry(entry, cfg = {}, opts = {}, deps) {
         if (!expectedIntegrity)
             throw new Error(`npm metadata 缺少 dist integrity：${pkg}@${version}，拒绝安装`);
         const spec = `${pkg}@${version}`;
-        // 安装前快照：失败时 best-effort 依赖回滚的依据
+        // 安装前快照：失败时 best-effort 依赖回滚与 B1 键找回的依据
         const snapshots = await snapshotFiles([
             join(profileDir, 'package.json'),
             join(profileDir, 'pnpm-lock.yaml'),
             join(profileDir, 'pnpm-workspace.yaml'),
         ]);
+        const healNotes = [];
+        // 区分 add 阶段与校验阶段失败：回滚报错不再把 pnpm 安装失败误标成「integrity 校验失败」
+        let phase = 'install';
         try {
-            const res = await d.addDshPlugin(spec);
+            const res = await addDshPluginWithRetry(spec, pkg, d, retryDelaysMs, timeoutMs, opts.signal);
+            phase = 'verify';
             const depsNow = await d.readProfileDeps(profileDir);
             if (depsNow[pkg] === undefined)
                 throw new Error(`安装后未在 profile 依赖中找到 ${pkg}`);
@@ -463,6 +625,17 @@ export async function installEntry(entry, cfg = {}, opts = {}, deps) {
             }
             const actual = d.readLockIntegrity(lockText, pkg, version);
             assertNpmIntegrity(expectedIntegrity, actual, pkg, version);
+            // B1（成功路径）：安装链若丢了 manifest 顶层键（如 pnpm.overrides），从快照找回并复验 frozen 一致性
+            const restoredKeys = await restoreManifestKeys(profileDir, snapshots[0]);
+            if (restoredKeys) {
+                healNotes.push(`安装链丢失了 manifest 顶层键（${restoredKeys.join(', ')}），已从安装前快照找回`);
+                try {
+                    await frozenInstallWithHeal(profileDir, d, healNotes);
+                }
+                catch (healErr) {
+                    healNotes.push(`frozen 一致性自愈未完成，profile 可能需要人工检查：${errText(healErr)}`);
+                }
+            }
             return {
                 id: entry.id,
                 pkg,
@@ -470,18 +643,19 @@ export async function installEntry(entry, cfg = {}, opts = {}, deps) {
                 version,
                 usedAllowAllBuilds: res.usedAllowAllBuilds,
                 needsRestart: true,
-                output: res.output.slice(-800),
+                output: res.output.slice(-800) + (healNotes.length > 0 ? `\n[dsh-m 自愈] ${healNotes.join('；')}` : ''),
             };
         }
         catch (err) {
-            // best-effort rollback：原子恢复 manifest/lock/workspace 快照，再 frozen-lockfile 重装
+            // best-effort rollback：原子恢复 manifest/lock/workspace 快照字节，再按 frozen 自愈阶梯收敛
             let rollbackError = null;
+            const rollbackNotes = [];
             try {
                 await restoreSnapshots(snapshots);
-                await d.restoreInstall(profileDir);
+                await frozenInstallWithHeal(profileDir, d, rollbackNotes);
             }
             catch (rerr) {
-                rollbackError = rerr instanceof Error ? rerr.message : String(rerr);
+                rollbackError = errText(rerr);
                 // 原先不存在该依赖且恢复安装失败：尝试移除
                 const originallyAbsent = snapshots[0] && snapshots[0].existed && (() => {
                     try {
@@ -497,14 +671,16 @@ export async function installEntry(entry, cfg = {}, opts = {}, deps) {
                         rollbackError = null;
                     }
                     catch (rmErr) {
-                        rollbackError = `${rollbackError}；移除 ${pkg} 也失败（${rmErr instanceof Error ? rmErr.message : String(rmErr)}）`;
+                        rollbackError = `${rollbackError}；移除 ${pkg} 也失败（${errText(rmErr)}）`;
                     }
                 }
             }
+            const prefix = phase === 'install' ? '安装失败' : 'integrity 校验失败';
             if (rollbackError) {
-                throw new Error(`integrity 校验失败（${err instanceof Error ? err.message : String(err)}）；依赖回滚也失败（${rollbackError}），profile 可能需要人工修复`);
+                throw new Error(`${prefix}（${errText(err)}）；依赖回滚也失败（${rollbackError}），profile 可能需要人工修复`);
             }
-            throw new Error(`integrity 校验失败，已回滚到安装前状态：${err instanceof Error ? err.message : String(err)}`);
+            const suffix = rollbackNotes.length > 0 ? `（${rollbackNotes.join('；')}）` : '';
+            throw new Error(`${prefix}，已回滚到安装前状态${suffix}：${errText(err)}`);
         }
     }
     if (entry.github) {

package/lib/core/npm-integrity.js

@@ -99,6 +99,33 @@ export function assertNpmIntegrity(expected, actual, pkg, version) {
         throw new Error(`integrity 不一致：${pkg}@${version} 期望 ${expected}，lockfile 实际 ${actual}`);
     }
 }
+/**
+ * 解析 pnpm lockfile v9 顶层的 `overrides:` 映射（键可带引号，值为版本串）。
+ * 无该区块返回 {}。只认 pnpm 自己生成的两空格顶层缩进；单条目解析失败即停（宁可少配，
+ * 不可错配）。frozen 自愈用它把 lockfile 记录的 overrides 还原进 manifest（2026-09-05 事故）。
+ */
+export function readPnpmLockOverrides(lockText) {
+    const lines = lockText.split(/\r?\n/);
+    const start = lines.findIndex((l) => l.trim() === 'overrides:');
+    const result = {};
+    if (start === -1)
+        return result;
+    for (let i = start + 1; i < lines.length; i++) {
+        const line = lines[i];
+        if (line.trim() === '')
+            continue;
+        if (!/^\s{2}\S/.test(line))
+            break;
+        const m = /^\s{2}(?:'([^']+)'|"([^"]+)"|([^\s:][^:]*?))\s*:\s*(.+?)\s*$/.exec(line);
+        if (!m)
+            break;
+        const key = m[1] ?? m[2] ?? m[3];
+        if (key === undefined)
+            break;
+        result[key] = m[4];
+    }
+    return result;
+}
 async function atomicWriteFile(path, bytes) {
     await mkdir(dirname(path), { recursive: true });
     const tmp = `${path}.restore-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
@@ -113,6 +140,7 @@ async function atomicWriteFile(path, bytes) {
     await rm(path, { force: true });
     await rename(tmp, path);
 }
+export { atomicWriteFile };
 /** 记录 profile 关键文件的字节快照（package.json / pnpm-lock.yaml / pnpm-workspace.yaml）。 */
 export async function snapshotFiles(paths) {
     return Promise.all(paths.map(async (path) => {

package/lib/core/registry.js

@@ -10,7 +10,7 @@ import { constants as fsConstants, mkdirSync } from 'node:fs';
 import { lstat, mkdir, open, readFile, readdir, realpath, rename, rm } from 'node:fs/promises';
 import { cacheDir } from './env.js';
 import { decodeUtf8Fatal, fetchJsonLimitedMeta } from './httpx.js';
-export const CATEGORIES = ['market', 'tools', 'ui', 'search', 'media', 'other'];
+export const CATEGORIES = ['market', 'tools', 'ui', 'search', 'other'];
 /** 容量上限：2 MiB 是原始 UTF-8 bytes（不是字符数）；条目超限拒绝整份清单。 */
 export const MAX_REGISTRY_BYTES = 2 * 1024 * 1024;
 export const MAX_PLUGINS = 1000;

package/lib/core/versions.js

@@ -39,6 +39,17 @@ export async function npmVersion(pkg, version, timeoutMs = 20_000, signal) {
         tarball: typeof data.dist?.tarball === 'string' ? data.dist.tarball : undefined,
     };
 }
+/**
+ * 拉取完整 packument（NO_MATCHING_VERSION 退避重试前的预热/校验原语）。
+ * 返回该包已知的全部版本号；解析不出 versions 时返回空列表（不抛）。
+ */
+export async function npmPackument(pkg, timeoutMs = 20_000, signal) {
+    if (!/^@?[A-Za-z0-9-._~]+(\/[A-Za-z0-9-._~]+)?$/.test(pkg))
+        throw new Error(`无效 npm 包名: ${pkg}`);
+    const data = await fetchJsonLimited(`https://registry.npmjs.org/${encodeURIComponent(pkg)}`, { timeoutMs, signal, maxBytes: 8 * 1024 * 1024 });
+    const versions = data?.versions !== null && typeof data?.versions === 'object' ? Object.keys(data.versions) : [];
+    return { versions };
+}
 export async function npmLatest(pkg, timeoutMs = 20_000, signal) {
     // 允许 scoped 包名：@scope/name（isSafePkgName 同款字符集）
     if (!/^@?[A-Za-z0-9-._~]+(\/[A-Za-z0-9-._~]+)?$/.test(pkg))

package/lib/tools.js

@@ -7,7 +7,6 @@ export const CATEGORY_LABELS = {
     tools: '工具',
     ui: '界面',
     search: '搜索',
-    media: '多媒体',
     other: '其他',
 };
 function cloneJson(value) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-m",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "DSH Marketplace — 个人自用的 DeepSeek Harness 插件市场：收录、安装、卸载、升级 DSH 插件",
   "license": "MIT",
   "type": "module",

package/registry.json

@@ -1,6 +1,17 @@
 {
   "version": 1,
   "plugins": [
+    {
+      "id": "dsh-m",
+      "name": "DSH Marketplace",
+      "description": "可自定义 Registry 内容的 DeepSeek Harness 插件市场：收录、安装、卸载、升级 DSH 插件，一站搞定。",
+      "category": "market",
+      "tags": ["市场", "插件管理"],
+      "source": "npm",
+      "npm": "dsh-m",
+      "github": "iasiv5/dsh-m",
+      "homepage": "https://github.com/iasiv5/dsh-m"
+    },
     {
       "id": "dsh-skins",
       "name": "DSH Skins",
@@ -12,6 +23,28 @@
       "github": "iasiv5/dsh-skins",
       "homepage": "https://github.com/iasiv5/dsh-skins"
     },
+    {
+      "id": "dsh-copilot-auth",
+      "name": "DSH Copilot Auth",
+      "description": "为 DSH 内置 GitHub Copilot 提供方补上设备码（device flow）登录/注销设置页，并预置开箱即用的 Copilot 路由；凭据托管 DSH 内置凭据库，模型目录自动同步。",
+      "category": "tools",
+      "tags": ["Copilot", "认证", "模型接入"],
+      "source": "npm",
+      "npm": "@inventec/dsh-copilot-auth",
+      "github": "iasiv5/dsh-copilot-auth",
+      "homepage": "https://github.com/iasiv5/dsh-copilot-auth"
+    },
+    {
+      "id": "dsh-skip-browser-auth",
+      "name": "DSH Skip Browser Auth",
+      "description": "在已适配版本上替换官方 Connection 提供方，跳过 BrowserAuth，不再需要输入烦人的Token。（当前已适配：0.1.2-rc.1）",
+      "category": "tools",
+      "tags": ["BrowserAuth", "连接", "安全"],
+      "source": "npm",
+      "npm": "@iasiv5/dsh-skip-browser-auth",
+      "github": "iasiv5/dsh-skip-browser-auth",
+      "homepage": "https://github.com/iasiv5/dsh-skip-browser-auth"
+    },
     {
       "id": "modsearch",
       "name": "ModSearch",
@@ -23,6 +56,17 @@
       "github": "liustack/modsearch",
       "homepage": "https://github.com/liustack/modsearch"
     },
+    {
+      "id": "dsh-auth",
+      "name": "DSH Auth",
+      "description": "DSH Web 管理员认证插件：Argon2id 口令、可撤销会话、双语界面，经 Caddy forward_auth 边缘保护页面/API/下载/SSE/WebSocket，Harness 保持仅回环监听。",
+      "category": "tools",
+      "tags": ["认证", "安全"],
+      "source": "npm",
+      "npm": "dsh-auth",
+      "github": "hxy91819/dsh-auth",
+      "homepage": "https://github.com/hxy91819/dsh-auth"
+    },
     {
       "id": "deepseek-harness-lark",
       "name": "DeepSeek Harness Lark",
@@ -77,39 +121,6 @@
       "npm": "deepseek-harness-dingtalk",
       "github": "sliverp/DeepSeek-harness-dingtalk",
       "homepage": "https://github.com/sliverp/DeepSeek-harness-dingtalk"
-    },
-    {
-      "id": "dsh-auth",
-      "name": "DSH Auth",
-      "description": "DSH Web 管理员认证插件：Argon2id 口令、可撤销会话、双语界面，经 Caddy forward_auth 边缘保护页面/API/下载/SSE/WebSocket，Harness 保持仅回环监听。",
-      "category": "tools",
-      "tags": ["认证", "安全"],
-      "source": "npm",
-      "npm": "dsh-auth",
-      "github": "hxy91819/dsh-auth",
-      "homepage": "https://github.com/hxy91819/dsh-auth"
-    },
-    {
-      "id": "dsh-copilot-auth",
-      "name": "DSH Copilot Auth",
-      "description": "为 DSH 内置 GitHub Copilot 提供方补上设备码（device flow）登录/注销设置页，并预置开箱即用的 Copilot 路由；凭据托管 DSH 内置凭据库，模型目录自动同步，中英双语。",
-      "category": "tools",
-      "tags": ["Copilot", "认证", "模型接入"],
-      "source": "npm",
-      "npm": "@inventec/dsh-copilot-auth",
-      "github": "iasiv5/dsh-copilot-auth",
-      "homepage": "https://github.com/iasiv5/dsh-copilot-auth"
-    },
-    {
-      "id": "dsh-m",
-      "name": "DSH Marketplace",
-      "description": "个人自用的 DeepSeek Harness 插件市场：收录、安装、卸载、升级 DSH 插件，含 Web 界面、agent 工具与 CLI。",
-      "category": "market",
-      "tags": ["市场", "插件管理"],
-      "source": "npm",
-      "npm": "dsh-m",
-      "github": "iasiv5/dsh-m",
-      "homepage": "https://github.com/iasiv5/dsh-m"
     }
   ]
 }