dsh-m 0.5.0 → 0.5.1

package/lib/core/market.js

@@ -674,7 +674,10 @@ function lockResolutionOf(lockText, pkg) {
     for (const line of lines) {
         if (body !== null && /^\S/.test(line))
             break; // 顶层新段 → 收集结束
-        const keyMatch = /^  '?(?:[^'\n]*node_modules\/)?([^\s':]+):\s*$/.exec(line);
+        // 0.5.1 修复：收尾引号必须可选消耗——pnpm lockfile 对 scoped 包键恒带引号
+        //（`'@scope/name@1.2.3':`），旧正则匹配不到任何带引号键，导致 scoped 已装插件
+        // 的 lockResolution 恒为 null → derivePrior 误判 restorable:false → 升级被守卫硬拒。
+        const keyMatch = /^  '?(?:[^'\n]*node_modules\/)?([^\s':]+)'?:\s*$/.exec(line);
         if (keyMatch) {
             if (body)
                 break;
@@ -690,7 +693,9 @@ function lockResolutionOf(lockText, pkg) {
         return null;
     const text = body.join('\n');
     const version = /version:\s*'?([^'\n]+)/.exec(text)?.[1]?.trim();
-    const integrity = /integrity:\s*(\S+)/.exec(text)?.[1]?.trim();
+    // 0.5.1：integrity 捕获排除 flow 结尾（`,`/`}`/引号）——与 npm-integrity.ts parsePackagesSection
+    // 同口径；旧 `(\S+)` 会把 `{integrity: sha512-...}` 的收尾 `}` 一起带进 prior 证据。
+    const integrity = /integrity:\s*([^,}\s'"]+)/.exec(text)?.[1]?.trim();
     const commit = /commit:\s*'?([0-9a-f]{40})/.exec(text)?.[1]?.trim();
     if (!version && !integrity && !commit)
         return null;
@@ -915,7 +920,8 @@ function guardManualRequired(message, violations) {
 export async function installEntry(entry, cfg = {}, opts = {}, deps) {
     return withMutationSession(() => installEntryLocked(entry, cfg, opts, deps));
 }
-/** installEntry 主体（session 区间内；installEntry 是唯一外部入口——upgradePlugin 复用本 helper）。 */
+/** installEntry 主体（session 区间内）。入口约定：installFromRegistry 走 installEntry（获取 session）；
+ *  upgradePlugin 已持有 session，必须直调本函数——二次获取 session 会自死锁（session 非重入）。 */
 async function installEntryLocked(entry, cfg = {}, opts = {}, deps) {
     const timeoutMs = cfg.timeoutMs ?? 20_000;
     const profileDir = deps?.transaction?.profileDir ?? webProfileDir();
@@ -936,7 +942,7 @@ async function installEntryLocked(entry, cfg = {}, opts = {}, deps) {
             throw new Error(`prior 关联歧义：${prior.reason}；拒绝安装（fail-closed）`);
         }
         if (prior.kind === 'dependency' && !prior.state.restorable) {
-            throw guardManualRequired(`「${pkg}」的原安装形态（${prior.state.sourceKind === 'other' ? 'link/file 等非 registry 来源' : '缺少 integrity 的 npm 依赖'}）无法自动回退，请先手动处理（卸载或修复后重试）`, [{ pkg, code: 'NO_DSH_MARKER', detail: `prior restorable:false（sourceKind=${prior.state.sourceKind}）` }]);
+            throw guardManualRequired(`「${pkg}」的原安装形态（${prior.state.sourceKind === 'other' ? 'link/file 等非 registry 来源' : 'pnpm-lock.yaml 未解析出该依赖的 integrity（键缺失或为别名/URL 等非 registry 写法）'}）无法自动回退，请先手动处理（卸载或修复后重试）`, [{ pkg, code: 'NO_DSH_MARKER', detail: `prior restorable:false（sourceKind=${prior.state.sourceKind}）` }]);
         }
         // npm：无论 latest 还是用户指定 exact，都先读取该精确版本的 dist metadata（事务外解析）
         let version;
@@ -1051,7 +1057,7 @@ async function installEntryLocked(entry, cfg = {}, opts = {}, deps) {
             throw new Error(`prior 关联歧义：${candidatePrior.reason}；拒绝安装（fail-closed）`);
         }
         if (candidatePrior.kind === 'dependency' && !candidatePrior.state.restorable) {
-            throw guardManualRequired(`「${candidate}」的原安装形态（link/file 等非 registry 来源）无法自动回退，请先手动处理（卸载或修复后重试）`, [{ pkg: candidate, code: 'NO_DSH_MARKER', detail: 'candidate 命中 restorable:false prior（link/file）' }]);
+            throw guardManualRequired(`「${candidate}」的原安装形态（pnpm-lock.yaml 未解析出该依赖的可回退依据——integrity/commit 缺失，或 link/file/别名等非 registry 写法）无法自动回退，请先手动处理（卸载或修复后重试）`, [{ pkg: candidate, code: 'NO_DSH_MARKER', detail: 'candidate 命中 restorable:false prior（lockfile 依据缺失）' }]);
         }
         const result = await runProfileTransaction({ kind: 'install-github', repo: entry.github, sha, tag, signal: opts.signal }, deps?.transaction ?? {});
         if (!result.ok)
@@ -1168,12 +1174,33 @@ async function upgradePluginLocked(pkg, cfg = {}, opts = {}, deps) {
     const target = installed.find((it) => it.pkg === pkg);
     if (!target)
         throw new Error(`web profile 未安装该插件: ${pkg}`);
-    const entry = loaded.registry.plugins.find((e) => matchInstalledByEntry(e, [target]));
+    let entry = loaded.registry.plugins.find((e) => matchInstalledByEntry(e, [target]));
+    // 0.5.1：合并市场安装的社区条目同样可升级——主清单 miss 时查社区目录
+    if (!entry)
+        entry = await findCommunityUpgradeEntry(target, cfg, opts, deps);
     if (!entry)
         throw new Error(`「${pkg}」不是经 dsh-m 收录的插件；直接升级请用 dsh plugin update 或先在 registry 收录它`);
-    const result = await installEntry(entry, cfg, opts, deps);
+    // 0.5.1 修复：直调 installEntryLocked——upgradePlugin 已在 mutation session 区间内，
+    // 再经 installEntry 二次获取 session 会自死锁（session 非重入，见 withMutationSession 契约）。
+    const result = await installEntryLocked(entry, cfg, opts, deps);
     return { ...result, fromVersion: target.version };
 }
+/**
+ * 社区条目升级查找（0.5.1）：主清单 miss 时按同一 matchInstalledByEntry 语义查社区目录。
+ * 社区清单未启用/不可用/加载异常/未命中 → undefined，由调用方统一报「不是经 dsh-m 收录」。
+ */
+async function findCommunityUpgradeEntry(target, cfg, opts, deps) {
+    try {
+        const loaded = await (deps?.fetchCommunityCatalog ?? defaultFetchCommunityCatalog)(cfg, { namespace: opts.namespace ?? 'host', signal: opts.signal });
+        if (!loaded.catalog)
+            return undefined;
+        const adapted = adaptCommunityCatalog(loaded.catalog);
+        return adapted.entries.find((e) => matchInstalledByEntry(e, [target]));
+    }
+    catch {
+        return undefined;
+    }
+}
 /** 自升级（0.5.0 收编：host-api 直调事务的旁路封死）：npmLatest + integrity fail-closed + installEntryLocked（session/守卫经 installEntry）。 */
 export async function selfUpgrade(pkgName, currentVersion, cfg = {}, opts = {}, deps) {
     return withMutationSession(async () => {

package/lib/tools.js

@@ -337,6 +337,7 @@ export function registerTools(ctx, cfg, deps = {}) {
         description: 'Upgrade an installed DSH plugin to the latest version (npm 拉最新精确版 / github 重新锁 HEAD)。pkg 来自 dshm_list 或 dshm_outdated。用户确认升级哪一个之后再调用。After success, tell the user it needs a restart, and offer dshm_restart.',
         parameters: {
             pkg: { type: 'string', required: true, description: '包名 from dshm_list / dshm_outdated' },
+            force: { type: 'boolean', description: 'peer 兼容预检不通过且用户已确认风险后置 true（等价 forceIncompatible，跳过 @deepseek-ai/dsh(-*) peer 拦截）；守卫拦截（guard）无 force 通道，不受此参数影响。' },
         },
         output: {
             schema: { type: 'object', additionalProperties: true },
@@ -355,8 +356,9 @@ export function registerTools(ctx, cfg, deps = {}) {
             const target = String(args.pkg || '').trim();
             if (!target)
                 throw new Error('缺少 pkg');
+            const force = args.force === true;
             try {
-                return cloneJson(await m.upgradePlugin(target, cfg, { namespace: 'host' }));
+                return cloneJson(await m.upgradePlugin(target, cfg, { forceIncompatible: force, namespace: 'host' }));
             }
             catch (err) {
                 if (err instanceof InstallGuardError) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-m",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "可自定义收录清单的 DSH 插件市场：收录、安装、卸载、升级一站完成，附 agent 工具与 dshm CLI。",
   "license": "MIT",
   "type": "module",

package/registry.json

@@ -138,6 +138,25 @@
       "github": "iasiv5/dsh-onetree-log",
       "homepage": "https://github.com/iasiv5/dsh-onetree-log"
     },
+    {
+      "id": "dsh-quota-watch",
+      "name": "DSH Quota Watch",
+      "description": "侧栏额度监控卡片：显示 GLM Coding Plan 窗口与 Copilot 额度快照，凭据宿主解析，不留存历史；已适配 0.1.7-rc.2，详见仓库。",
+      "category": "tools",
+      "tags": [
+        "配额",
+        "监控",
+        "GLM",
+        "Copilot"
+      ],
+      "verified": [
+        "0.1.7-rc.2"
+      ],
+      "source": "npm",
+      "npm": "@iasiv5/dsh-quota-watch",
+      "github": "iasiv5/dsh-quota-watch",
+      "homepage": "https://github.com/iasiv5/dsh-quota-watch"
+    },
     {
       "id": "dsh-better-sidebar",
       "name": "DSH Better Sidebar",