dsh-m 0.2.9 → 0.2.10

package/lib/client.js

@@ -112,6 +112,299 @@ var init_market_state = __esm({
   }
 });
 
+// src/client/markdown.js
+var markdown_exports = {};
+__export(markdown_exports, {
+  createMarkdown: () => createMarkdown,
+  safeUrl: () => safeUrl
+});
+function safeUrl(u) {
+  const t = String(u || "").trim();
+  if (/^(https?:\/\/|mailto:)/i.test(t)) return t;
+  if (/^[/#]/.test(t)) return t;
+  return "#";
+}
+function createMarkdown(h2) {
+  function ExtLink2({ href, className, children }) {
+    return h2(
+      "a",
+      {
+        className: className || "dshm-md-a",
+        href: safeUrl(href),
+        target: "_blank",
+        rel: "noopener noreferrer",
+        onClick: (e) => e.stopPropagation()
+      },
+      children
+    );
+  }
+  function MdImg2({ src, alt }) {
+    return h2("img", {
+      className: "dshm-md-img",
+      src: safeUrl(src),
+      alt: alt || "",
+      referrerPolicy: "no-referrer",
+      onError: (e) => {
+        e.currentTarget.style.display = "none";
+      }
+    });
+  }
+  function mdInline(text, kb) {
+    const re = /(\[!\[[^\]]*\]\([^)]*\)\]\([^)]*\))|(!\[[^\]]*\]\([^)]*\))|(\[[^\]]*\]\([^)]*\))|(`[^`]+`)|(\*\*[^*]+\*\*)|(~~[^~]+~~)|(\*[^*\s][^*]*\*)|(<https?:\/\/[^>\s]+>)|(https?:\/\/[^\s<>()\[\]{}"'「」【】]+[^\s<>()\[\]{}"'「」【】.,;:!?…，。；：！？）】」"')])/g;
+    const src = String(text);
+    const nodes = [];
+    let last = 0;
+    let m;
+    let i = 0;
+    while (m = re.exec(src)) {
+      if (m.index > last) nodes.push(src.slice(last, m.index));
+      const tok = m[0];
+      const k = `${kb}-${i++}`;
+      if (tok.startsWith("[![")) {
+        const im = /^!\[([^\]]*)\]\(([^)]*)\)/.exec(tok.slice(1));
+        const lm = /\]\(([^)]*)\)\s*$/.exec(tok);
+        const img = h2(MdImg2, { src: im && im[2], alt: im && im[1] });
+        const href = lm && lm[1];
+        nodes.push(href && safeUrl(href) !== "#" ? h2(ExtLink2, { key: k, href }, img) : h2("span", { key: k }, img));
+      } else if (tok.startsWith("![") || tok.startsWith("<![")) {
+        const im = /^!\[([^\]]*)\]\(([^)]*)\)$/.exec(tok);
+        nodes.push(h2(MdImg2, { key: k, src: im && im[2], alt: im && im[1] }));
+      } else if (tok.startsWith("[")) {
+        const lm = /^\[([^\]]*)\]\(([^)]*)\)$/.exec(tok);
+        nodes.push(h2(ExtLink2, { key: k, href: lm && lm[2] }, mdInline(lm ? lm[1] : tok, k)));
+      } else if (tok.startsWith("`")) {
+        nodes.push(h2("code", { key: k }, tok.slice(1, -1)));
+      } else if (tok.startsWith("**")) {
+        nodes.push(h2("strong", { key: k }, mdInline(tok.slice(2, -2), k)));
+      } else if (tok.startsWith("~~")) {
+        nodes.push(h2("del", { key: k }, mdInline(tok.slice(2, -2), k)));
+      } else if (tok.startsWith("*")) {
+        nodes.push(h2("em", { key: k }, mdInline(tok.slice(1, -1), k)));
+      } else if (tok.startsWith("<")) {
+        const u = tok.slice(1, -1);
+        nodes.push(h2(ExtLink2, { key: k, href: u }, u));
+      } else {
+        nodes.push(h2(ExtLink2, { key: k, href: tok }, tok.length > 72 ? `${tok.slice(0, 69)}\u2026` : tok));
+      }
+      last = m.index + tok.length;
+    }
+    if (last < src.length) nodes.push(src.slice(last));
+    return nodes;
+  }
+  function mdBlocks(lines, kb) {
+    const out = [];
+    let i = 0;
+    let n = 0;
+    const isFence = (s) => /^\s*```/.test(s);
+    const isHeading = (s) => /^#{1,6}\s+/.test(s);
+    const isHr = (s) => /^\s*(-{3,}|\*{3,}|_{3,})\s*$/.test(s);
+    const isQuote = (s) => /^\s*>/.test(s);
+    const isUl = (s) => /^\s*[-*+]\s+/.test(s);
+    const isOl = (s) => /^\s*\d+[.)]\s+/.test(s);
+    const isTableRow = (s) => s.includes("|") && /^\s*\|/.test(s);
+    while (i < lines.length) {
+      const line = lines[i];
+      if (!line.trim()) {
+        i++;
+        continue;
+      }
+      const k = `${kb}-b${n++}`;
+      if (isFence(line)) {
+        const buf2 = [];
+        i++;
+        while (i < lines.length && !/^\s*```\s*$/.test(lines[i])) buf2.push(lines[i++]);
+        i++;
+        out.push(h2("pre", { key: k }, h2("code", null, buf2.join("\n"))));
+        continue;
+      }
+      if (isHeading(line)) {
+        const hm = /^(#{1,6})\s+(.*)$/.exec(line);
+        out.push(h2(`h${hm[1].length}`, { key: k }, mdInline(hm[2], k)));
+        i++;
+        continue;
+      }
+      if (isHr(line)) {
+        out.push(h2("hr", { key: k }));
+        i++;
+        continue;
+      }
+      if (isQuote(line)) {
+        const buf2 = [];
+        while (i < lines.length && isQuote(lines[i])) buf2.push(lines[i++].replace(/^\s*>\s?/, ""));
+        out.push(h2("blockquote", { key: k }, mdBlocks(buf2, k)));
+        continue;
+      }
+      if (isUl(line) || isOl(line)) {
+        const ordered = isOl(line);
+        const re = ordered ? /^\s*\d+[.)]\s+(.*)$/ : /^\s*[-*+]\s+(.*)$/;
+        const items = [];
+        while (i < lines.length && (ordered ? isOl(lines[i]) : isUl(lines[i]))) {
+          items.push(h2("li", { key: `li${items.length}` }, mdInline(re.exec(lines[i])[1], `${k}-${items.length}`)));
+          i++;
+        }
+        out.push(h2(ordered ? "ol" : "ul", { key: k }, items));
+        continue;
+      }
+      if (isTableRow(line) && i + 1 < lines.length && lines[i + 1].includes("-") && /^\s*\|?[\s:|-]+\|?\s*$/.test(lines[i + 1])) {
+        const cells = (s) => s.trim().replace(/^\|/, "").replace(/\|$/, "").split("|").map((c) => c.trim());
+        const head = cells(lines[i]);
+        i += 2;
+        const rows = [];
+        while (i < lines.length && isTableRow(lines[i])) {
+          rows.push(cells(lines[i]));
+          i++;
+        }
+        out.push(
+          h2(
+            "table",
+            { key: k },
+            h2("thead", null, h2("tr", null, head.map((c, x) => h2("th", { key: x }, mdInline(c, `${k}h${x}`))))),
+            h2("tbody", null, rows.map((r, y) => h2("tr", { key: y }, r.map((c, x) => h2("td", { key: x }, mdInline(c, `${k}${y}x${x}`))))))
+          )
+        );
+        continue;
+      }
+      const buf = [line];
+      i++;
+      while (i < lines.length && lines[i].trim() && !isFence(lines[i]) && !isHeading(lines[i]) && !isHr(lines[i]) && !isQuote(lines[i]) && !isUl(lines[i]) && !isOl(lines[i])) {
+        buf.push(lines[i]);
+        i++;
+      }
+      out.push(h2("p", { key: k }, mdInline(buf.join(" "), k)));
+    }
+    return out;
+  }
+  function renderMarkdown2(src) {
+    return mdBlocks(String(src || "").replace(/\r\n?/g, "\n").split("\n"), "md");
+  }
+  return { ExtLink: ExtLink2, MdImg: MdImg2, renderMarkdown: renderMarkdown2 };
+}
+var init_markdown = __esm({
+  "src/client/markdown.js"() {
+    "use strict";
+  }
+});
+
+// src/client/installed-view.js
+var installed_view_exports = {};
+__export(installed_view_exports, {
+  installedViewModel: () => installedViewModel,
+  registrySourceKey: () => registrySourceKey
+});
+function uninstallGuardKeys(it) {
+  if (it.source === "link") {
+    return { confirmKey: "confirm.unlink", warnKey: "warn.unlink", warnParams: { path: it.path } };
+  }
+  if (it.source === "file") {
+    return { confirmKey: "confirm.core", warnKey: "warn.core", warnParams: {} };
+  }
+  return { confirmKey: "confirm.uninstall", warnKey: null, warnParams: {} };
+}
+function installedViewModel(it) {
+  return {
+    githubRepo: it.registryGithub || it.githubRepo || (it.spec.startsWith("github:") ? it.spec.slice(7).split("#")[0] : null),
+    sourceLabelKey: { npm: "src.npm", github: "src.github", link: "src.link", file: "src.file", unknown: "src.unknown" }[it.source] || null,
+    guard: uninstallGuardKeys(it),
+    latestLabel: it.latestTag || (it.latestVersion ? `v${it.latestVersion}` : ""),
+    latestLabelDetail: it.latestTag || (it.latestVersion ? `v${it.latestVersion}` : "\u2014")
+  };
+}
+function registrySourceKey(data) {
+  if (!data) return null;
+  const map = {
+    "default-raw": "src.default.raw",
+    "default-jsdelivr": "src.default.jsdelivr",
+    "default-cache": "src.default.cache",
+    bundled: "src.bundled",
+    "custom-url": "src.custom.url",
+    "custom-file": "src.custom.file",
+    "custom-cache": "src.custom.cache",
+    "custom-unavailable": "src.custom.unavailable",
+    // 旧字段兼容
+    override: "src.override",
+    jsdelivr: "src.jsdelivr",
+    raw: "src.raw",
+    cache: "src.cache"
+  };
+  return map[data.source] || data.source;
+}
+var init_installed_view = __esm({
+  "src/client/installed-view.js"() {
+    "use strict";
+  }
+});
+
+// src/client/tool-view.js
+var tool_view_exports = {};
+__export(tool_view_exports, {
+  parseToolArgs: () => parseToolArgs,
+  pickPayload: () => pickPayload
+});
+function pickPayload(props) {
+  const found = [];
+  const visit = (node, depth) => {
+    if (!node || depth > 6) return;
+    if (typeof node === "string") {
+      const t = node.trim();
+      if ((t.startsWith("{") || t.startsWith("[")) && t.length > 8) {
+        try {
+          visit(JSON.parse(t), depth + 1);
+        } catch {
+        }
+      }
+      return;
+    }
+    if (typeof node !== "object") return;
+    if (Array.isArray(node)) {
+      for (const x of node) visit(x, depth + 1);
+      return;
+    }
+    if (Array.isArray(node.items)) found.push(node);
+    for (const key of ["block", "meta", "result", "resultView", "view", "data", "value", "payload", "content", "message"]) {
+      if (node[key] != null) visit(node[key], depth + 1);
+    }
+  };
+  visit(props, 0);
+  return found.find((x) => x && Array.isArray(x.items)) || null;
+}
+function parseToolArgs(props) {
+  const block = props?.block;
+  const raw = (block && "kind" in block ? block.call?.argsRaw : block?.argsRaw) || "";
+  if (!raw || typeof raw !== "string") return {};
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
+var init_tool_view = __esm({
+  "src/client/tool-view.js"() {
+    "use strict";
+  }
+});
+
+// src/client/restart-wait.js
+var restart_wait_exports = {};
+__export(restart_wait_exports, {
+  RESTART_DEADLINE_MS: () => RESTART_DEADLINE_MS,
+  RESTART_POLL_MS: () => RESTART_POLL_MS,
+  nextRestartWait: () => nextRestartWait
+});
+function nextRestartWait({ phase, now = 0, deadlineAt = Infinity, bootChanged = false }) {
+  if (phase === "before-ping") {
+    return now > deadlineAt ? "timeout" : "continue";
+  }
+  return bootChanged ? "done" : "continue";
+}
+var RESTART_POLL_MS, RESTART_DEADLINE_MS;
+var init_restart_wait = __esm({
+  "src/client/restart-wait.js"() {
+    "use strict";
+    RESTART_POLL_MS = 2e3;
+    RESTART_DEADLINE_MS = 9e4;
+  }
+});
+
 // src/client/main.jsx
 var React = require("react");
 var rd = require("react-dom");
@@ -120,6 +413,11 @@ var { useState, useEffect, useCallback, useMemo, useRef } = React;
 var PLUGIN_ID = "dsh-m";
 var API = "/dshm";
 var { MARKET_PAGE_SIZE: MARKET_PAGE_SIZE2, normalizeMarketQuery: normalizeMarketQuery2, resetPageOnFilterChange: resetPageOnFilterChange2, normalizeMarketResponse: normalizeMarketResponse2, registryNotice: registryNotice2 } = (init_market_state(), __toCommonJS(market_state_exports));
+var { createMarkdown: createMarkdown2 } = (init_markdown(), __toCommonJS(markdown_exports));
+var { ExtLink, MdImg, renderMarkdown } = createMarkdown2(h);
+var { installedViewModel: installedViewModel2, registrySourceKey: registrySourceKey2 } = (init_installed_view(), __toCommonJS(installed_view_exports));
+var { pickPayload: pickPayload2, parseToolArgs: parseToolArgs2 } = (init_tool_view(), __toCommonJS(tool_view_exports));
+var { RESTART_POLL_MS: RESTART_POLL_MS2, RESTART_DEADLINE_MS: RESTART_DEADLINE_MS2, nextRestartWait: nextRestartWait2 } = (init_restart_wait(), __toCommonJS(restart_wait_exports));
 var ZH = {
   "market.title": "\u63D2\u4EF6\u5E02\u573A",
   "tab.market": "\u5E02\u573A",
@@ -664,164 +962,6 @@ function Icon({ entry }) {
 function Spin() {
   return h("span", { className: "dshm-spin" });
 }
-function safeUrl(u) {
-  const t = String(u || "").trim();
-  if (/^(https?:\/\/|mailto:)/i.test(t)) return t;
-  if (/^[/#]/.test(t)) return t;
-  return "#";
-}
-function ExtLink({ href, className, children }) {
-  return h(
-    "a",
-    {
-      className: className || "dshm-md-a",
-      href: safeUrl(href),
-      target: "_blank",
-      rel: "noopener noreferrer",
-      onClick: (e) => e.stopPropagation()
-    },
-    children
-  );
-}
-function MdImg({ src, alt }) {
-  return h("img", {
-    className: "dshm-md-img",
-    src: safeUrl(src),
-    alt: alt || "",
-    referrerPolicy: "no-referrer",
-    onError: (e) => {
-      e.currentTarget.style.display = "none";
-    }
-  });
-}
-function mdInline(text, kb) {
-  const re = /(\[!\[[^\]]*\]\([^)]*\)\]\([^)]*\))|(!\[[^\]]*\]\([^)]*\))|(\[[^\]]*\]\([^)]*\))|(`[^`]+`)|(\*\*[^*]+\*\*)|(~~[^~]+~~)|(\*[^*\s][^*]*\*)|(<https?:\/\/[^>\s]+>)|(https?:\/\/[^\s<>()\[\]{}"'「」【】]+[^\s<>()\[\]{}"'「」【】.,;:!?…，。；：！？）】」"')])/g;
-  const src = String(text);
-  const nodes = [];
-  let last = 0;
-  let m;
-  let i = 0;
-  while (m = re.exec(src)) {
-    if (m.index > last) nodes.push(src.slice(last, m.index));
-    const tok = m[0];
-    const k = `${kb}-${i++}`;
-    if (tok.startsWith("[![")) {
-      const im = /^!\[([^\]]*)\]\(([^)]*)\)/.exec(tok.slice(1));
-      const lm = /\]\(([^)]*)\)\s*$/.exec(tok);
-      const img = h(MdImg, { src: im && im[2], alt: im && im[1] });
-      const href = lm && lm[1];
-      nodes.push(href && safeUrl(href) !== "#" ? h(ExtLink, { key: k, href }, img) : h("span", { key: k }, img));
-    } else if (tok.startsWith("![") || tok.startsWith("<![")) {
-      const im = /^!\[([^\]]*)\]\(([^)]*)\)$/.exec(tok);
-      nodes.push(h(MdImg, { key: k, src: im && im[2], alt: im && im[1] }));
-    } else if (tok.startsWith("[")) {
-      const lm = /^\[([^\]]*)\]\(([^)]*)\)$/.exec(tok);
-      nodes.push(h(ExtLink, { key: k, href: lm && lm[2] }, mdInline(lm ? lm[1] : tok, k)));
-    } else if (tok.startsWith("`")) {
-      nodes.push(h("code", { key: k }, tok.slice(1, -1)));
-    } else if (tok.startsWith("**")) {
-      nodes.push(h("strong", { key: k }, mdInline(tok.slice(2, -2), k)));
-    } else if (tok.startsWith("~~")) {
-      nodes.push(h("del", { key: k }, mdInline(tok.slice(2, -2), k)));
-    } else if (tok.startsWith("*")) {
-      nodes.push(h("em", { key: k }, mdInline(tok.slice(1, -1), k)));
-    } else if (tok.startsWith("<")) {
-      const u = tok.slice(1, -1);
-      nodes.push(h(ExtLink, { key: k, href: u }, u));
-    } else {
-      nodes.push(h(ExtLink, { key: k, href: tok }, tok.length > 72 ? `${tok.slice(0, 69)}\u2026` : tok));
-    }
-    last = m.index + tok.length;
-  }
-  if (last < src.length) nodes.push(src.slice(last));
-  return nodes;
-}
-function mdBlocks(lines, kb) {
-  const out = [];
-  let i = 0;
-  let n = 0;
-  const isFence = (s) => /^\s*```/.test(s);
-  const isHeading = (s) => /^#{1,6}\s+/.test(s);
-  const isHr = (s) => /^\s*(-{3,}|\*{3,}|_{3,})\s*$/.test(s);
-  const isQuote = (s) => /^\s*>/.test(s);
-  const isUl = (s) => /^\s*[-*+]\s+/.test(s);
-  const isOl = (s) => /^\s*\d+[.)]\s+/.test(s);
-  const isTableRow = (s) => s.includes("|") && /^\s*\|/.test(s);
-  while (i < lines.length) {
-    const line = lines[i];
-    if (!line.trim()) {
-      i++;
-      continue;
-    }
-    const k = `${kb}-b${n++}`;
-    if (isFence(line)) {
-      const buf2 = [];
-      i++;
-      while (i < lines.length && !/^\s*```\s*$/.test(lines[i])) buf2.push(lines[i++]);
-      i++;
-      out.push(h("pre", { key: k }, h("code", null, buf2.join("\n"))));
-      continue;
-    }
-    if (isHeading(line)) {
-      const hm = /^(#{1,6})\s+(.*)$/.exec(line);
-      out.push(h(`h${hm[1].length}`, { key: k }, mdInline(hm[2], k)));
-      i++;
-      continue;
-    }
-    if (isHr(line)) {
-      out.push(h("hr", { key: k }));
-      i++;
-      continue;
-    }
-    if (isQuote(line)) {
-      const buf2 = [];
-      while (i < lines.length && isQuote(lines[i])) buf2.push(lines[i++].replace(/^\s*>\s?/, ""));
-      out.push(h("blockquote", { key: k }, mdBlocks(buf2, k)));
-      continue;
-    }
-    if (isUl(line) || isOl(line)) {
-      const ordered = isOl(line);
-      const re = ordered ? /^\s*\d+[.)]\s+(.*)$/ : /^\s*[-*+]\s+(.*)$/;
-      const items = [];
-      while (i < lines.length && (ordered ? isOl(lines[i]) : isUl(lines[i]))) {
-        items.push(h("li", { key: `li${items.length}` }, mdInline(re.exec(lines[i])[1], `${k}-${items.length}`)));
-        i++;
-      }
-      out.push(h(ordered ? "ol" : "ul", { key: k }, items));
-      continue;
-    }
-    if (isTableRow(line) && i + 1 < lines.length && lines[i + 1].includes("-") && /^\s*\|?[\s:|-]+\|?\s*$/.test(lines[i + 1])) {
-      const cells = (s) => s.trim().replace(/^\|/, "").replace(/\|$/, "").split("|").map((c) => c.trim());
-      const head = cells(lines[i]);
-      i += 2;
-      const rows = [];
-      while (i < lines.length && isTableRow(lines[i])) {
-        rows.push(cells(lines[i]));
-        i++;
-      }
-      out.push(
-        h(
-          "table",
-          { key: k },
-          h("thead", null, h("tr", null, head.map((c, x) => h("th", { key: x }, mdInline(c, `${k}h${x}`))))),
-          h("tbody", null, rows.map((r, y) => h("tr", { key: y }, r.map((c, x) => h("td", { key: x }, mdInline(c, `${k}${y}x${x}`))))))
-        )
-      );
-      continue;
-    }
-    const buf = [line];
-    i++;
-    while (i < lines.length && lines[i].trim() && !isFence(lines[i]) && !isHeading(lines[i]) && !isHr(lines[i]) && !isQuote(lines[i]) && !isUl(lines[i]) && !isOl(lines[i])) {
-      buf.push(lines[i]);
-      i++;
-    }
-    out.push(h("p", { key: k }, mdInline(buf.join(" "), k)));
-  }
-  return out;
-}
-function renderMarkdown(src) {
-  return mdBlocks(String(src || "").replace(/\r\n?/g, "\n").split("\n"), "md");
-}
 function officialLinks({ npm, github, homepage }) {
   const links = [];
   if (github) links.push(["GitHub", `https://github.com/${github}`]);
@@ -874,15 +1014,19 @@ function RestartBanner({ note, onDone }) {
       const ping0 = await api("ping");
       await api("restart");
       setPhase("waiting");
-      const deadline = Date.now() + 9e4;
+      const deadlineAt = Date.now() + RESTART_DEADLINE_MS2;
       for (; ; ) {
-        await new Promise((r) => setTimeout(r, 2e3));
-        if (Date.now() > deadline) throw new Error(lookup("restart.timeout"));
+        await new Promise((r) => setTimeout(r, RESTART_POLL_MS2));
+        if (nextRestartWait2({ phase: "before-ping", now: Date.now(), deadlineAt }) === "timeout") {
+          throw new Error(lookup("restart.timeout"));
+        }
+        let bootChanged = false;
         try {
           const ping = await api("ping");
-          if (ping.boot !== ping0.boot) break;
+          bootChanged = ping.boot !== ping0.boot;
         } catch {
         }
+        if (nextRestartWait2({ phase: "after-ping", bootChanged }) === "done") break;
       }
       setPhase("idle");
       onDone(true);
@@ -1091,18 +1235,6 @@ function ReadmeBlock({ pkg }) {
     state.truncated ? h("div", { className: "dshm-md-note" }, lookup("readme.truncated")) : null
   );
 }
-function uninstallGuard(it) {
-  if (it.source === "link") {
-    return {
-      confirm: lookup("confirm.unlink"),
-      warn: lookup("warn.unlink", { path: it.path })
-    };
-  }
-  if (it.source === "file") {
-    return { confirm: lookup("confirm.core"), warn: lookup("warn.core") };
-  }
-  return { confirm: lookup("confirm.uninstall"), warn: null };
-}
 function InstalledTab({ notify, installed }) {
   const { loading, data, error, reload } = installed;
   const [openPkg, setOpenPkg] = useState(null);
@@ -1158,33 +1290,33 @@ function InstalledTab({ notify, installed }) {
       "div",
       { className: "dshm-cards" },
       items.map((it) => {
-        const guard = uninstallGuard(it);
+        const vm = installedViewModel2(it);
         return Card({
           key: it.pkg,
-          icon: h(Icon, { entry: { name: it.name, github: it.registryGithub || it.githubRepo || (it.spec.startsWith("github:") ? it.spec.slice(7).split("#")[0] : null), icon: null } }),
+          icon: h(Icon, { entry: { name: it.name, github: vm.githubRepo, icon: null } }),
           name: it.name,
           badges: [
-            it.outdated ? h("span", { className: "dshm-badge warn", key: "u" }, `\u2B06 ${it.latestTag || (it.latestVersion ? `v${it.latestVersion}` : "")}`.trim()) : null,
+            it.outdated ? h("span", { className: "dshm-badge warn", key: "u" }, `\u2B06 ${vm.latestLabel}`.trim()) : null,
             it.registryId ? h("span", { className: "dshm-badge", key: "r" }, lookup("badge.market")) : h("span", { className: "dshm-badge info", key: "r" }, lookup("badge.nonmarket"))
           ],
           desc: it.description || "\uFF08\u65E0\u63CF\u8FF0\uFF09",
           sub: [
             `v${it.version || "?"}`,
-            { npm: lookup("src.npm"), github: lookup("src.github"), link: lookup("src.link"), file: lookup("src.file"), unknown: lookup("src.unknown") }[it.source] || it.source
+            vm.sourceLabelKey ? lookup(vm.sourceLabelKey) : it.source
           ].join(" \xB7 "),
           links: h(LinksRow, {
             npm: it.source === "npm" ? it.pkg : null,
-            github: it.registryGithub || it.githubRepo || (it.spec.startsWith("github:") ? it.spec.slice(7).split("#")[0] : null)
+            github: vm.githubRepo
           }),
           open: openPkg === it.pkg,
           onToggle: () => setOpenPkg(openPkg === it.pkg ? null : it.pkg),
           detail: readmePkg === it.pkg ? h(ReadmeBlock, { pkg: it.pkg }) : DetailRows([
             [lookup("detail.pkg"), it.pkg],
             [lookup("detail.spec"), it.spec],
-            [lookup("detail.latest"), it.latestTag || (it.latestVersion ? `v${it.latestVersion}` : "\u2014")],
+            [lookup("detail.latest"), vm.latestLabelDetail],
             [lookup("detail.listed"), it.registryId || lookup("detail.listed.no")],
             [lookup("detail.path"), it.path],
-            guard.warn ? [lookup("detail.note"), guard.warn] : null
+            vm.guard.warnKey ? [lookup("detail.note"), lookup(vm.guard.warnKey, vm.guard.warnParams)] : null
           ]),
           actions: [
             h("button", {
@@ -1211,7 +1343,7 @@ function InstalledTab({ notify, installed }) {
             h(TwoStepButton, {
               key: "un",
               label: lookup("action.uninstall"),
-              confirmLabel: guard.confirm,
+              confirmLabel: lookup(vm.guard.confirmKey),
               className: "dshm-btn sm",
               disabled: busyPkg === it.pkg,
               onConfirm: () => doUninstall(it)
@@ -1223,23 +1355,8 @@ function InstalledTab({ notify, installed }) {
   );
 }
 function regSourceLabel(data) {
-  if (!data) return "\u2014";
-  const map = {
-    "default-raw": "src.default.raw",
-    "default-jsdelivr": "src.default.jsdelivr",
-    "default-cache": "src.default.cache",
-    bundled: "src.bundled",
-    "custom-url": "src.custom.url",
-    "custom-file": "src.custom.file",
-    "custom-cache": "src.custom.cache",
-    "custom-unavailable": "src.custom.unavailable",
-    // 旧字段兼容
-    override: "src.override",
-    jsdelivr: "src.jsdelivr",
-    raw: "src.raw",
-    cache: "src.cache"
-  };
-  return lookup(map[data.source] || data.source);
+  const key = registrySourceKey2(data);
+  return key === null ? "\u2014" : lookup(key);
 }
 function configStatusLabel(status) {
   return lookup(`settings.status.${status || "loading"}` || "settings.status.loading");
@@ -1646,43 +1763,6 @@ function registerSlot(slots, options, component) {
   if (next.key == null && next.id != null) next.key = next.id;
   return slots.register(next, component);
 }
-function pickPayload(props) {
-  const found = [];
-  const visit = (node, depth) => {
-    if (!node || depth > 6) return;
-    if (typeof node === "string") {
-      const t = node.trim();
-      if ((t.startsWith("{") || t.startsWith("[")) && t.length > 8) {
-        try {
-          visit(JSON.parse(t), depth + 1);
-        } catch {
-        }
-      }
-      return;
-    }
-    if (typeof node !== "object") return;
-    if (Array.isArray(node)) {
-      for (const x of node) visit(x, depth + 1);
-      return;
-    }
-    if (Array.isArray(node.items)) found.push(node);
-    for (const key of ["block", "meta", "result", "resultView", "view", "data", "value", "payload", "content", "message"]) {
-      if (node[key] != null) visit(node[key], depth + 1);
-    }
-  };
-  visit(props, 0);
-  return found.find((x) => x && Array.isArray(x.items)) || null;
-}
-function parseToolArgs(props) {
-  const block = props?.block;
-  const raw = (block && "kind" in block ? block.call?.argsRaw : block?.argsRaw) || "";
-  if (!raw || typeof raw !== "string") return {};
-  try {
-    return JSON.parse(raw);
-  } catch {
-    return {};
-  }
-}
 function ToolCardRow({ it, onInstalled }) {
   const [busy, setBusy] = useState(false);
   const install = async (e) => {
@@ -1723,8 +1803,8 @@ function ToolCardRow({ it, onInstalled }) {
 }
 function SearchToolView(props) {
   useEffect(() => ensureCss(), []);
-  const payload = pickPayload(props);
-  const args = parseToolArgs(props);
+  const payload = pickPayload2(props);
+  const args = parseToolArgs2(props);
   const query = String(payload?.query || args.query || "").trim();
   const fromTool = Array.isArray(payload?.items) && payload.items.length ? payload.items : null;
   const running = !!(props?.block && !("kind" in props.block));
@@ -1764,7 +1844,7 @@ function SearchToolView(props) {
 }
 function ListToolView(props) {
   useEffect(() => ensureCss(), []);
-  const payload = pickPayload(props);
+  const payload = pickPayload2(props);
   const items = Array.isArray(payload?.items) ? payload.items : [];
   if (!items.length) return null;
   return h(

package/lib/core/dsh-cli.js

@@ -314,19 +314,6 @@ function writeDangerouslyAllowAllBuilds(profileDirectory) {
     writeFileSync(file, next);
     return true;
 }
-export function rewritePnpmError(err) {
-    const text = err instanceof Error ? err.message : String(err);
-    if (/ERR_PNPM_UNUSED_PATCH/.test(text)) {
-        return new Error('profile 的补丁配置（patchedDependencies）里存在不再使用的条目，pnpm 拒绝执行。卸载时 dsh-m 会自动摘除目标包自己的补丁条目；仍报此错通常是其他包留有失效补丁，请手工清理 profile 的 pnpm-workspace.yaml。');
-    }
-    if (isPrepareBlocked(text)) {
-        return new Error('该插件需要执行构建脚本（prepare），pnpm 默认拦截。dsh-m 已写入 profile 的 dangerouslyAllowAllBuilds 并重试；若仍失败请检查 web profile 是否可写。');
-    }
-    if (/ERR_PNPM_PUBLIC_HOIST_PATTERN_DIFF/.test(text)) {
-        return new Error('当前 profile 的 node_modules 由不同主版本的 pnpm 生成，安装前需要先重建依赖。');
-    }
-    return err instanceof Error ? err : new Error(text);
-}
 /**
  * 失败摘要：命令失败时从完整输出里提取可诊断的行，而不是盲取末尾。
  * 2026-09-05 实证（dsh-better-sidebar 安装失败）：pnpm ndjson 错误行 ~1.2KB，
@@ -618,22 +605,6 @@ export function makeAddViaLadder(deps) {
 function errText(err) {
     return err instanceof Error ? err.message : String(err);
 }
-/**
- * 安装。返回 usedAllowAllBuilds 供 UI 明确报告「该插件执行了构建脚本」。
- * source 形如：`pkg@1.2.3`（npm 精确锁定）或 `github:owner/repo#sha`（锁 SHA）。
- * 薄包装：调 makeAddViaLadder，非 ok 时 throw（对 legacy 调用方保持现行报错形状）。
- */
-export async function addDshPlugin(source, deps = {}) {
-    const ladder = makeAddViaLadder({
-        runDshPlugin: deps.runDshPlugin ?? runDshPlugin,
-        allowAllBuilds: deps.allowAllBuilds,
-    });
-    const outcome = await ladder(source, deps.profileDir ?? webProfileDir());
-    if (outcome.class === 'ok') {
-        return { output: outcome.output, usedAllowAllBuilds: outcome.usedAllowAllBuilds === true };
-    }
-    throw rewritePnpmError(new Error(outcome.output));
-}
 /** 卸载（转发 pnpm remove；调用方须先做 live-disable）。 */
 export async function removeDshPlugin(pkg, deps = {}) {
     if (!isSafePluginTarget(pkg))

package/lib/core/installed.js

@@ -1,10 +1,16 @@
 /**
  * 已装插件识别（DESIGN.md §3）：profile 的 package.json 是唯一事实源，
  * 不引入额外状态文件。移植自 skillhub installed-plugins.ts（去 README 暂缓）。
+ *
+ * 完整性契约（2026-09-09）：枚举结果必含 `complete`——只有当顶层 manifest 与每个
+ * 依赖的 package.json 都可读、可解析为非数组对象、且每项都能归类（DSH 插件 → items /
+ * 确认非 DSH → others）时才为 true；任一项「无法判断」即 complete:false（partial 结果
+ * 保留，该依赖不计入 others）。当前 complete 仅被 listMarket → dshm_search 消费；
+ * 已装列表（listInstalledWithMeta）/ dshm_list / CLI list·outdated / 升级路径的
+ * incomplete 展示与处理为后续独立任务。
  */
 import { open, readFile } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
-import { isSafePluginTarget, removeDshPlugin } from './dsh-cli.js';
 import { webProfileDir } from './env.js';
 const PKG_NAME_RE = /^(@[A-Za-z0-9-*~][A-Za-z0-9-*._~]*\/)?[A-Za-z0-9-._~]+$/;
 export function isSafePkgName(raw) {
@@ -58,30 +64,74 @@ export function githubRepoFromRepository(raw) {
     const m = /github\.com[/:]([A-Za-z0-9._-]+)\/([A-Za-z0-9._-]+?)(?:\.git)?$/i.exec(url.trim());
     return m ? `${m[1]}/${m[2]}` : null;
 }
-export async function readPkgJson(dir) {
+/** JSON 合法根：非 null、非数组的对象（typeof [] === 'object'，数组必须显式排除）。 */
+function isRecord(value) {
+    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+/** 单包 package.json 唯一读取实现：读不到 / 坏 JSON / 根非对象一律 ok:false。 */
+async function readPkgJsonResult(dir) {
+    let raw;
     try {
-        const raw = JSON.parse(await readFile(join(dir, 'package.json'), 'utf8'));
-        return raw && typeof raw === 'object' ? raw : null;
+        raw = JSON.parse(await readFile(join(dir, 'package.json'), 'utf8'));
     }
     catch {
-        return null;
+        return { ok: false };
     }
+    if (!isRecord(raw))
+        return { ok: false };
+    return { ok: true, value: raw };
 }
-export async function readProfileDeps(profileDir) {
+export async function readPkgJson(dir) {
+    const result = await readPkgJsonResult(dir);
+    return result.ok ? result.value ?? null : null;
+}
+/** 空 deps 统一无原型容器：与逐项解析产物保持同一原型语义，继承属性不得伪装成依赖成员。 */
+function emptyDeps() {
+    return Object.create(null);
+}
+/**
+ * 顶层 profile package.json 唯一读取实现（完整性 + partial 语义）：
+ * - 读不到 / 坏 JSON / 根非数组对象 → complete:false, deps:{}（manifest 缺失 ≠ 合法空 profile）；
+ * - 合法但无 dependencies 字段，或 dependencies 为空对象 → complete:true, deps:{}（唯一合法空形态）；
+ * - dependencies 存在但类型非法（null/数组/标量）→ complete:false, deps:{}；
+ * - 逐项：key 不安全（isSafePkgName 拒绝 `__proto__`、`_`/`.` 开头分段等）或 spec 非字符串/纯空白
+ *   → 该项计入 incomplete（complete:false）并跳过，其余合法项保留。
+ *   容器为无原型对象（Object.create(null)）——第二层防御：特殊属性名不受 Object.prototype
+ *   setter/继承语义影响，数据结构与早退路径的空容器保持一致。
+ */
+async function readProfileDepsResult(profileDir) {
+    let raw;
     try {
-        const raw = JSON.parse(await readFile(join(profileDir, 'package.json'), 'utf8'));
-        if (!raw || typeof raw !== 'object' || !raw.dependencies || typeof raw.dependencies !== 'object')
-            return {};
-        const out = {};
-        for (const [name, spec] of Object.entries(raw.dependencies)) {
-            if (typeof spec === 'string' && spec !== '')
-                out[name] = spec;
-        }
-        return out;
+        raw = JSON.parse(await readFile(join(profileDir, 'package.json'), 'utf8'));
     }
     catch {
-        return {};
+        return { complete: false, deps: emptyDeps() };
+    }
+    if (!isRecord(raw))
+        return { complete: false, deps: emptyDeps() };
+    if (!Object.prototype.hasOwnProperty.call(raw, 'dependencies'))
+        return { complete: true, deps: emptyDeps() };
+    const dependencies = raw.dependencies;
+    if (!isRecord(dependencies))
+        return { complete: false, deps: emptyDeps() };
+    let complete = true;
+    const deps = emptyDeps();
+    for (const [name, spec] of Object.entries(dependencies)) {
+        if (!isSafePkgName(name)) {
+            complete = false;
+            continue;
+        }
+        if (typeof spec !== 'string' || spec.trim() === '') {
+            complete = false;
+            continue;
+        }
+        deps[name] = spec;
     }
+    return { complete, deps };
+}
+/** 宽松读取（README 路径）：只返回可确认的依赖项，个别非法项被跳过而不是整体丢弃。 */
+export async function readProfileDeps(profileDir) {
+    return (await readProfileDepsResult(profileDir)).deps;
 }
 function sanitizePkgJson(raw, fallbackName) {
     return {
@@ -93,17 +143,31 @@ function sanitizePkgJson(raw, fallbackName) {
         githubRepo: githubRepoFromRepository(raw.repository),
     };
 }
-/** 枚举 web profile 已安装插件（只读）。 */
+/** 枚举 web profile 已安装插件（只读）。complete:false 时 items/others 为 partial 结果（已确认部分保留）。 */
 export async function listInstalledPlugins(profileDir = webProfileDir()) {
     const root = resolve(profileDir);
-    const deps = await readProfileDeps(root);
+    const result = await readProfileDepsResult(root);
+    let complete = result.complete;
+    const deps = result.deps;
     const items = [];
     let others = 0;
     for (const pkg of Object.keys(deps).sort()) {
         const spec = deps[pkg];
         const dir = resolvePluginDir(root, pkg, spec);
-        const raw = dir ? await readPkgJson(dir) : null;
-        if (!raw || !('dsh' in raw)) {
+        if (!dir) {
+            // 依赖键不安全、目录无法解析 → 无法判断（不冒充非 DSH）
+            complete = false;
+            continue;
+        }
+        const rawResult = await readPkgJsonResult(dir);
+        if (!rawResult.ok) {
+            // package.json 缺失/不可读/坏 JSON/根非对象 → 无法判断
+            complete = false;
+            continue;
+        }
+        const raw = rawResult.value;
+        if (!('dsh' in raw)) {
+            // 确认非 DSH 依赖
             others += 1;
             continue;
         }
@@ -121,23 +185,7 @@ export async function listInstalledPlugins(profileDir = webProfileDir()) {
             githubRepo: githubRepoFromRepository(raw.repository),
         });
     }
-    return { items, others, profileDir: root };
-}
-/** 从 web profile 卸载已安装的 dsh 插件。pkg 必须来自 profile 依赖（先 live-disable，见 market.ts）。 */
-export async function removeInstalledPlugin(pkg, profileDir = webProfileDir(), deps = {}) {
-    const key = String(pkg || '').trim();
-    if (!isSafePkgName(key) || !isSafePluginTarget(key))
-        throw new Error(`无效插件包名: ${pkg}`);
-    const root = resolve(profileDir);
-    const listed = await readProfileDeps(root);
-    if (!(key in listed))
-        throw new Error(`web profile 未安装该插件: ${key}`);
-    const dir = resolvePluginDir(root, key, listed[key]);
-    const raw = dir ? await readPkgJson(dir) : null;
-    if (!raw || !('dsh' in raw))
-        throw new Error(`不是 dsh 插件: ${key}`);
-    await removeDshPlugin(key, deps);
-    return { pkg: key };
+    return { items, others, complete, profileDir: root };
 }
 // ---------- README 预览（借鉴 skillhub，64KB 截断） ----------
 const README_MAX_BYTES = 64 * 1024;
@@ -170,8 +218,11 @@ export async function readInstalledPluginReadme(pkg, profileDir = webProfileDir(
         throw new Error(`无效插件包名: ${pkg}`);
     const root = resolve(profileDir);
     const deps = await readProfileDeps(root);
-    if (!(key in deps))
+    // 授权边界必须用 own-property 判定：`in` 会沿原型链命中继承属性（如 'constructor'），
+    // 绕过「pkg 必须来自 profile dependencies」的成员约束
+    if (!Object.hasOwn(deps, key)) {
         throw new Error(`web profile 未安装该插件: ${key}`);
+    }
     const dir = resolvePluginDir(root, key, deps[key]);
     if (!dir)
         throw new Error(`无法解析插件目录: ${key}`);

package/lib/core/market.js

@@ -227,7 +227,8 @@ export async function listMarket(cfg = {}, opts = {}, deps = {}) {
         };
     }
     const installed = await installedTask;
-    const installedComplete = installed !== null;
+    // 完整性两层来源：枚举 throw → null；枚举 partial resolve → complete:false（installed.ts 完整性契约）
+    const installedComplete = installed !== null && installed.complete === true;
     const installedItems = installed?.items ?? [];
     // 全量统计 + query/category 过滤 + 分页（同步，极轻）
     const all = loaded.registry.plugins;

package/lib/tools.js

@@ -15,18 +15,6 @@ function cloneJson(value) {
 function summaryOf(state) {
     return { isDefault: state.isDefault, status: state.status, stale: state.stale };
 }
-function matchInstalledByEntry(entry, installed) {
-    return installed.find((it) => {
-        if (entry.npm && (it.pkg === entry.npm || it.name === entry.npm))
-            return true;
-        if (entry.github && it.source === 'github') {
-            const m = /^github:([^#]+)/.exec(it.spec);
-            if (m && m[1] === entry.github)
-                return true;
-        }
-        return false;
-    });
-}
 export function registerTools(ctx, cfg, deps = {}) {
     const timeoutMs = cfg.timeoutMs ?? 20_000;
     const m = {
@@ -77,18 +65,18 @@ export function registerTools(ctx, cfg, deps = {}) {
                 withLatest: false,
                 namespace: 'host',
             });
-            const installed = await import('./core/installed.js');
-            const inst = await installed.listInstalledPlugins();
-            const merged = result.items.map((e) => {
-                const i = matchInstalledByEntry(e, inst.items);
-                return { ...e, installed: Boolean(i), installedPkg: i?.pkg, installedVersion: i?.version };
-            });
+            // 安装标注唯一来源：listMarket 的单次 profile 快照。
+            // 状态不完整且存在可被误标的条目时 fail-closed——不把未知安装状态呈现成未安装；
+            // 空结果（registry 不可用/超时/无匹配）无可误标条目，维持优雅空结果。
+            if (!result.installedComplete && result.items.length > 0) {
+                throw new Error('读取 web profile 安装状态失败，安装标注不可用；请稍后重试');
+            }
             return cloneJson({
                 query: String(args.query || ''),
                 category,
                 total: result.total,
                 registry: summaryOf(result.registryState),
-                items: merged.map((e) => ({
+                items: result.items.map((e) => ({
                     id: e.id,
                     name: e.name,
                     description: e.description,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-m",
-  "version": "0.2.9",
+  "version": "0.2.10",
   "description": "DSH Marketplace — 个人自用的 DeepSeek Harness 插件市场：收录、安装、卸载、升级 DSH 插件",
   "license": "MIT",
   "type": "module",
@@ -45,6 +45,7 @@
     "build": "node scripts/build.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "node --test tests/*.test.mjs",
+    "pretest": "npm run build",
     "prepare": "npm run build"
   },
   "dsh": {