dsh-m 0.8.5 → 0.9.1

package/lib/core/registry.js

@@ -8,7 +8,7 @@ import { createRequire } from 'node:module';
 import { isAbsolute, join, normalize } from 'node:path';
 import { constants as fsConstants, mkdirSync } from 'node:fs';
 import { lstat, mkdir, open, readFile, readdir, realpath, rename, rm } from 'node:fs/promises';
-import { cacheDir } from './env.js';
+import { WEB_PROFILE, cacheRoot } from './env.js';
 import { decodeUtf8Fatal, fetchJsonLimitedMeta, describeFetchFailure } from './httpx.js';
 export const CATEGORIES = ['market', 'tools', 'ui', 'search', 'other'];
 /** 容量上限：2 MiB 是原始 UTF-8 bytes（不是字符数）；条目超限拒绝整份清单。 */
@@ -367,14 +367,14 @@ export async function readRegistryFile(path, hooks = {}) {
 const CACHE_FILE_VERSION = 2;
 const DEFAULT_CACHE_KEY = 'default';
 const ACTIVE_SOURCE_FILE = 'active-source.json';
-function nsDir(namespace) {
-    return join(cacheDir(), namespace);
+function nsDir(namespace, profile = WEB_PROFILE) {
+    return join(cacheRoot(profile), namespace);
 }
-function cacheFilePath(namespace, cacheKey) {
-    return join(nsDir(namespace), `${cacheKey}.json`);
+function cacheFilePath(namespace, cacheKey, profile = WEB_PROFILE) {
+    return join(nsDir(namespace, profile), `${cacheKey}.json`);
 }
-function cacheDirSyncMode() {
-    mkdirSync(cacheDir(), { recursive: true, mode: 0o700 });
+function cacheDirSyncMode(profile = WEB_PROFILE) {
+    mkdirSync(cacheRoot(profile), { recursive: true, mode: 0o700 });
 }
 /** 同 key 写锁：进程内串行化同一 cache 文件的写入。 */
 const writeLocks = new Map();
@@ -390,11 +390,11 @@ function withKeyLock(key, task) {
     return next;
 }
 /** 原子写：0600 临时文件（O_CREAT|O_EXCL）→ fsync → rename。目标为 symlink 时拒绝。 */
-async function atomicWriteJson(target, dir, value) {
+async function atomicWriteJson(target, dir, value, profile = WEB_PROFILE) {
     return withKeyLock(target, async () => {
         try {
             await mkdir(dir, { recursive: true, mode: 0o700 });
-            cacheDirSyncMode();
+            cacheDirSyncMode(profile);
             let existing = null;
             try {
                 existing = await lstat(target);
@@ -421,12 +421,12 @@ async function atomicWriteJson(target, dir, value) {
         }
     });
 }
-async function writeCacheFile(file) {
-    return atomicWriteJson(cacheFilePath(file.namespace, file.cacheKey), nsDir(file.namespace), file);
+async function writeCacheFile(file, profile = WEB_PROFILE) {
+    return atomicWriteJson(cacheFilePath(file.namespace, file.cacheKey, profile), nsDir(file.namespace, profile), file, profile);
 }
-async function readCacheFile(namespace, cacheKey) {
+async function readCacheFile(namespace, cacheKey, profile = WEB_PROFILE) {
     try {
-        const raw = JSON.parse(await readFile(cacheFilePath(namespace, cacheKey), 'utf8'));
+        const raw = JSON.parse(await readFile(cacheFilePath(namespace, cacheKey, profile), 'utf8'));
         if (!raw || typeof raw !== 'object')
             return null;
         if (raw.version !== CACHE_FILE_VERSION || raw.namespace !== namespace || raw.cacheKey !== cacheKey)
@@ -449,9 +449,9 @@ function cacheFresh(file, ttlMin) {
     return Date.now() - t < ttlMin * 60_000;
 }
 /** 清理 namespace 内非 default、非当前 custom 的 cache 文件（不动 metadata）。 */
-async function pruneCaches(namespace, keepCustomKey) {
+async function pruneCaches(namespace, keepCustomKey, profile = WEB_PROFILE) {
     try {
-        const dir = nsDir(namespace);
+        const dir = nsDir(namespace, profile);
         const entries = await readdir(dir).catch(() => []);
         const keep = new Set([`${DEFAULT_CACHE_KEY}.json`, ACTIVE_SOURCE_FILE]);
         if (keepCustomKey)
@@ -474,7 +474,7 @@ async function pruneCaches(namespace, keepCustomKey) {
  * 再 prune 非当前 custom cache。metadata 失败 → 不 prune；prune 失败 → 保留旧 cache；
  * 都只返回 warning，不反向撤销已成功的 settings update。
  */
-export async function commitActiveSource(address, namespace) {
+export async function commitActiveSource(address, namespace, profile = WEB_PROFILE) {
     let metadataCommitted = true;
     if (namespace === 'host') {
         const meta = {
@@ -484,12 +484,12 @@ export async function commitActiveSource(address, namespace) {
             cacheKey: address.cacheKey,
             savedAt: new Date().toISOString(),
         };
-        metadataCommitted = await atomicWriteJson(join(nsDir('host'), ACTIVE_SOURCE_FILE), nsDir('host'), meta);
+        metadataCommitted = await atomicWriteJson(join(nsDir('host', profile), ACTIVE_SOURCE_FILE), nsDir('host', profile), meta, profile);
     }
     if (!metadataCommitted) {
         return { metadataCommitted: false, pruned: false, warning: 'accepted-source 元数据写入失败，已跳过旧 cache 清理（新配置仍生效）' };
     }
-    const pruned = await pruneCaches(namespace, address.kind === 'default' ? null : address.cacheKey);
+    const pruned = await pruneCaches(namespace, address.kind === 'default' ? null : address.cacheKey, profile);
     if (!pruned) {
         return { metadataCommitted: true, pruned: false, warning: '旧来源 cache 清理失败（不影响新配置生效）' };
     }
@@ -588,7 +588,7 @@ async function loadDefaultChain(cfg, opts, chain) {
                 source: candidate.source,
                 fetchedAt,
                 registry,
-            });
+            }, chain.profile);
             return {
                 ...buildState({
                     configuredAddress: '',
@@ -606,7 +606,7 @@ async function loadDefaultChain(cfg, opts, chain) {
             errors.push(describeFetchFailure({ label: candidate.source, url: candidate.url, err, elapsedMs: Date.now() - startedAt }));
         }
     }
-    const cached = await readCacheFile(chain.namespace, DEFAULT_CACHE_KEY);
+    const cached = await readCacheFile(chain.namespace, DEFAULT_CACHE_KEY, chain.profile);
     if (cached)
         return loadedFromCacheFile(cached, '', errors);
     if (chain.includeBundled) {
@@ -656,7 +656,7 @@ async function loadCustomChain(address, cfg, opts, chain) {
             source,
             fetchedAt,
             registry: result.registry,
-        });
+        }, chain.profile);
         return {
             ...buildState({
                 configuredAddress: address.normalized,
@@ -674,7 +674,7 @@ async function loadCustomChain(address, cfg, opts, chain) {
         errors.push(describeFetchFailure({ label: source, url: address.normalized, err, elapsedMs: Date.now() - startedAt }));
     }
     if (chain.allowCacheFallback) {
-        const cached = await readCacheFile(chain.namespace, address.cacheKey);
+        const cached = await readCacheFile(chain.namespace, address.cacheKey, chain.profile);
         if (cached)
             return loadedFromCacheFile(cached, address.normalized, errors);
     }
@@ -694,42 +694,45 @@ async function loadCustomChain(address, cfg, opts, chain) {
 /** active 读取：default/custom 各自 fallback；网络成功后可在本 namespace 内 prune。 */
 export async function loadRegistry(cfg = {}, opts = {}) {
     const namespace = opts.namespace ?? 'host';
+    const profile = opts.profile ?? WEB_PROFILE;
     const address = parseRegistryAddress(cfg.registryUrl);
     const ttlMin = Math.max(0, cfg.cacheTtlMin ?? 60);
     if (!opts.force) {
         const cacheKey = address.kind === 'default' ? DEFAULT_CACHE_KEY : address.cacheKey;
-        const cached = await readCacheFile(namespace, cacheKey);
+        const cached = await readCacheFile(namespace, cacheKey, profile);
         if (cached && cacheFresh(cached, ttlMin))
             return loadedFromCacheFile(cached, address.normalized, []);
     }
     if (address.kind === 'default') {
-        const loaded = await loadDefaultChain(cfg, opts, { namespace, includeBundled: true });
+        const loaded = await loadDefaultChain(cfg, opts, { namespace, profile, includeBundled: true });
         if (opts.prune !== false && loaded.status === 'ready')
-            await pruneCaches(namespace, null);
+            await pruneCaches(namespace, null, profile);
         return loaded;
     }
-    const loaded = await loadCustomChain(address, cfg, opts, { namespace, allowCacheFallback: true });
+    const loaded = await loadCustomChain(address, cfg, opts, { namespace, allowCacheFallback: true, profile });
     if (opts.prune !== false && loaded.status === 'ready')
-        await pruneCaches(namespace, address.cacheKey);
+        await pruneCaches(namespace, address.cacheKey, profile);
     return loaded;
 }
 /** candidate 读取：apply 前校验专用。只写候选 cache、绝不 prune；default 不落 bundled。 */
 export async function loadRegistryCandidate(cfg, opts = {}) {
     const namespace = opts.namespace ?? 'host';
+    const profile = opts.profile ?? WEB_PROFILE;
     const address = parseRegistryAddress(cfg.registryUrl);
     if (address.kind === 'default') {
-        return loadDefaultChain(cfg, opts, { namespace, includeBundled: false });
+        return loadDefaultChain(cfg, opts, { namespace, profile, includeBundled: false });
     }
-    return loadCustomChain(address, cfg, opts, { namespace, allowCacheFallback: true });
+    return loadCustomChain(address, cfg, opts, { namespace, allowCacheFallback: true, profile });
 }
 /** default 显式加载（下载/主动刷新）。写 default cache，从不 prune。 */
 export async function loadDefaultRegistry(cfg = {}, opts = {}) {
     const namespace = opts.namespace ?? 'host';
+    const profile = opts.profile ?? WEB_PROFILE;
     const ttlMin = Math.max(0, cfg.cacheTtlMin ?? 60);
     if (!opts.force) {
-        const cached = await readCacheFile(namespace, DEFAULT_CACHE_KEY);
+        const cached = await readCacheFile(namespace, DEFAULT_CACHE_KEY, profile);
         if (cached && cacheFresh(cached, ttlMin))
             return loadedFromCacheFile(cached, '', []);
     }
-    return loadDefaultChain(cfg, opts, { namespace, includeBundled: true });
+    return loadDefaultChain(cfg, opts, { namespace, profile, includeBundled: true });
 }

package/lib/core/restart.js

@@ -32,17 +32,6 @@ function isLoopbackHost(host) {
         return false;
     return parsed.hostname === '127.0.0.1' || parsed.hostname === 'localhost' || parsed.hostname === '::1';
 }
-function hostsMatch(originHost, candidate) {
-    const a = parseHost(originHost);
-    const b = parseHost(candidate);
-    if (a === null || b === null)
-        return false;
-    if (a.hostname !== b.hostname)
-        return false;
-    if (a.port !== '' && b.port !== '' && a.port !== b.port)
-        return false;
-    return true;
-}
 export function servingPort(request) {
     const host = headerString(request.headers.host);
     if (host === undefined || !isLoopbackHost(host))
@@ -53,25 +42,9 @@ export function servingPort(request) {
     const port = Number(match[1]);
     return Number.isInteger(port) && port > 0 && port < 65536 ? port : null;
 }
-export function trustedRestartRequest(request) {
-    const origin = headerString(request.headers.origin);
-    if (origin === undefined)
-        return false;
-    let from;
-    try {
-        const parsed = new URL(origin);
-        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
-            return false;
-        from = parsed.host;
-    }
-    catch {
-        return false;
-    }
-    const host = headerString(request.headers.host);
-    const forwardedHost = headerString(request.headers['x-forwarded-host']);
-    const candidates = [host, forwardedHost].filter((value) => value !== undefined);
-    return candidates.some((candidate) => hostsMatch(from, candidate));
-}
+// 0.9.0 起trustedRestartRequest 已删除：/dshm 入口信任检查改委派官方
+// `connection.requestRejection()`（ADR-0005，语义含 trustedHosts/cross-site/Origin:null），
+// 本模块只剩 servingPort / 重启实现。
 export function readProcCgroup(readFile = (path, encoding) => readFileSync(path, encoding)) {
     try {
         return readFile('/proc/self/cgroup', 'utf8');

package/lib/host.js

@@ -4,6 +4,7 @@ import { createApiDispatcher } from './core/host-api.js';
 import { bindLoaderHost } from './core/live-plugin.js';
 import { createRegistryController } from './core/registry-controller.js';
 import { wireRegistrySettings, unwrapConfig } from './core/settings-compat.js';
+import { resolveActiveProfile } from './core/active-profile.js';
 import { registerTools } from './tools.js';
 import { appExitFromContext, scheduleRestart } from './core/restart.js';
 const require = createRequire(import.meta.url);
@@ -30,17 +31,21 @@ export const Config = Schema.object({
 export function apply(ctx, config) {
     // 卸载前的 live-disable 依赖 loader（skillhub 同款）
     bindLoaderHost(ctx);
+    // 0.9.0 双 profile（ADR-0005）：宿主当前 profile 单一事实源——apply 期解析一次，
+    // host 生命周期内不可变；GUI/工具/HTTP/缓存分段全部消费同一对象。
+    const profile = resolveActiveProfile(ctx);
+    ctx.logger?.info?.('dsh-m: active profile %s (dir=%s, source=%s)', profile.name, profile.dir, profile.source);
     // registry controller：active config / configured / pending / rejected 分离 + generation fence；
     // tools 与 Host API 共用同一 active config object（apply 原地更新字段，live 生效）。
     // unwrapConfig：0.1.7 上 volatile 字段是 cosmokit Volatile 引用，先解包成 plain 值再进 controller。
-    const controller = createRegistryController(unwrapConfig(config));
+    const controller = createRegistryController(unwrapConfig(config), { profile: profile.name });
     // DSH 0.1.2-rc.1 / 0.1.5-rc.1 / 0.1.7-rc.1 / 0.1.7-rc.2 都经 dsh-cmdline 暴露 appExit；
     // using it avoids guessing the service unit from release-specific cgroups.
     const appExit = appExitFromContext(ctx);
     const restart = (port = null) => scheduleRestart(port, { appExit });
     // 开关委派的官方服务探测（ADR-0001）：运行时按服务存在性探测，不判 DSH 版本号
     const getService = () => ctx.get?.('pluginManager');
-    registerTools(ctx, controller.config, { restart });
+    registerTools(ctx, controller.config, { restart }, profile);
     // 设置页接线（双代兼容，详见 core/settings-compat.ts）：
     // - ≤0.1.5：settings.register('dshm', …) scope（get/update/watch）；
     // - 0.1.7-rc.1 / rc.2：Config `.volatile()` 字段自动生成设置页（autoGenerate 默认开，无需 configure），
@@ -67,15 +72,21 @@ export function apply(ctx, config) {
             ctx.logger?.warn?.(err);
         }
     });
-    // 本地 API：单路由 + method 分发（防护与状态映射在 core/host-api.ts）
+    // 本地 API：单路由 + method 分发（信任检查与状态映射在 core/host-api.ts）。
+    // 0.9.0（ADR-0005）：入口信任检查全量委派官方 connection.requestRejection——
+    // Desktop 桥剥 Origin 的请求按官方语义（trustedHosts/loopback/cross-site/Origin:null）判定，
+    // 服务缺席或抛错一律 fail-closed 403（warn 一次）。
     ctx.inject(['webServer'], (c) => {
         const server = c.webServer;
+        const rejectRequest = createRequestRejection(ctx);
         const handleApi = createApiDispatcher({
             controller,
             pkg,
+            profile,
             deps: {
                 scheduleRestart: restart,
                 getService,
+                rejectRequest,
             },
         });
         server.register({
@@ -87,3 +98,30 @@ export function apply(ctx, config) {
         });
     });
 }
+/** 守卫式官方 requestRejection 委派：缺席/抛错 fail-closed 403（warn 一次，不刷日志）。 */
+function createRequestRejection(ctx) {
+    let warned = false;
+    const warnOnce = (err) => {
+        if (warned)
+            return;
+        warned = true;
+        ctx.logger?.warn?.('dsh-m: 官方 connection.requestRejection 不可用，/dshm 全入口 fail-closed 403（ADR-0005）');
+        if (err)
+            ctx.logger?.warn?.(err);
+    };
+    return (req) => {
+        try {
+            const connection = ctx.get?.('connection');
+            const reject = connection?.requestRejection;
+            if (typeof reject !== 'function') {
+                warnOnce(undefined);
+                return 403;
+            }
+            return reject.call(connection, { headers: req.headers }) ?? undefined;
+        }
+        catch (err) {
+            warnOnce(err);
+            return 403;
+        }
+    };
+}

package/lib/tools.js

@@ -4,6 +4,8 @@ import { installFromRegistry, listInstalledWithMeta, listMarket, uninstallPlugin
 import { COMMUNITY_CATEGORY_LABELS } from './core/community.js';
 import { appExitFromContext, scheduleRestart } from './core/restart.js';
 import { togglePlugin as coreTogglePlugin } from './core/toggle.js';
+import { resolveActiveProfile, assertWriteAllowed } from './core/active-profile.js';
+import { desktopInstallFromRegistry, desktopToggle } from './core/profile-ops.js';
 export const CATEGORY_LABELS = {
     market: '市场',
     tools: '工具',
@@ -55,7 +57,7 @@ function cloneJson(value) {
 function summaryOf(state) {
     return { isDefault: state.isDefault, status: state.status, stale: state.stale };
 }
-export function registerTools(ctx, cfg, deps = {}) {
+export function registerTools(ctx, cfg, deps = {}, profile = resolveActiveProfile(ctx)) {
     const timeoutMs = cfg.timeoutMs ?? 20_000;
     const m = {
         listMarket: deps.listMarket ?? listMarket,
@@ -63,6 +65,8 @@ export function registerTools(ctx, cfg, deps = {}) {
         installFromRegistry: deps.installFromRegistry ?? installFromRegistry,
         uninstallPlugin: deps.uninstallPlugin ?? uninstallPlugin,
         upgradePlugin: deps.upgradePlugin ?? upgradePlugin,
+        desktopInstall: deps.desktopInstall ?? desktopInstallFromRegistry,
+        desktopToggle: deps.desktopToggle ?? desktopToggle,
     };
     const restart = deps.restart ?? ((port = null) => scheduleRestart(port, { appExit: appExitFromContext(ctx) }));
     const toggle = deps.togglePlugin ?? coreTogglePlugin;
@@ -132,6 +136,8 @@ export function registerTools(ctx, cfg, deps = {}) {
                 namespace: 'host',
                 deadlineMs: SEARCH_CORE_DEADLINE_MS,
                 signal: exec?.signal,
+                profileDir: profile.dir,
+                profile: profile.name,
             });
             // 安装标注唯一来源：listMarket 的单次 profile 快照。
             // 状态不完整且存在可被误标的条目时 fail-closed——不把未知安装状态呈现成未安装；
@@ -173,7 +179,7 @@ export function registerTools(ctx, cfg, deps = {}) {
     }));
     ctx.tools.register(defineTool({
         name: 'dshm_list',
-        description: 'List plugins installed in the DSH web profile, annotated with 市场安装/非市场安装, sources, and outdated flags. Use when the user asks what plugins are installed or wants to manage local plugins.',
+        description: 'List plugins installed in the current DSH profile (web or desktop), annotated with 市场安装/非市场安装, sources, and outdated flags. Use when the user asks what plugins are installed or wants to manage local plugins.',
         parameters: {},
         output: {
             schema: { type: 'object', additionalProperties: true },
@@ -192,6 +198,8 @@ export function registerTools(ctx, cfg, deps = {}) {
                 namespace: 'host',
                 deadlineMs: INSTALLED_CORE_DEADLINE_MS,
                 signal: exec?.signal,
+                profileDir: profile.dir,
+                profile: profile.name,
             });
             return cloneJson({
                 registry: summaryOf(result.registryState),
@@ -239,6 +247,11 @@ export function registerTools(ctx, cfg, deps = {}) {
                 throw new Error('缺少收录 id');
             const version = typeof args.version === 'string' && args.version.trim() ? args.version.trim() : undefined;
             const force = args.force === true;
+            // 0.9.0：desktop → 官方 pluginManager 委派（新包）；未知 profile → 结构化拒绝
+            if (profile.kind !== 'web') {
+                assertWriteAllowed(profile, 'install');
+                return cloneJson(await m.desktopInstall(id, cfg, { version, forceIncompatible: force, namespace: 'host', profile: profile.name }));
+            }
             try {
                 return cloneJson(await m.installFromRegistry(id, cfg, { version, forceIncompatible: force, namespace: 'host' }));
             }
@@ -280,12 +293,17 @@ export function registerTools(ctx, cfg, deps = {}) {
                 throw new Error('缺少 pkg');
             if (typeof args.enabled !== 'boolean')
                 throw new Error('缺少 enabled（boolean）');
+            // 0.9.0：desktop → 官方管理器委派（服务缺席结构化拒绝）；web → 既有委派/降级
+            if (profile.kind !== 'web') {
+                assertWriteAllowed(profile, 'set-enabled');
+                return cloneJson(await m.desktopToggle(target, args.enabled, { getService: getService, profileDir: profile.dir }));
+            }
             return cloneJson(await toggle(target, args.enabled, { getService: getService }));
         },
     }));
     ctx.tools.register(defineTool({
         name: 'dshm_uninstall',
-        description: 'Uninstall a DSH plugin from the web profile by package name (pkg from dshm_list). Confirm with the user BEFORE calling. Does not delete plugin data; reports leftover paths instead.',
+        description: 'Uninstall a DSH plugin from the current DSH profile by package name (pkg from dshm_list). Confirm with the user BEFORE calling. Does not delete plugin data; reports leftover paths instead.',
         parameters: {
             pkg: { type: 'string', required: true, description: '包名 from dshm_list, e.g. dsh-web-search' },
         },
@@ -305,6 +323,7 @@ export function registerTools(ctx, cfg, deps = {}) {
             const target = String(args.pkg || '').trim();
             if (!target)
                 throw new Error('缺少 pkg');
+            assertWriteAllowed(profile, 'uninstall');
             return cloneJson(await m.uninstallPlugin(target, cfg, { namespace: 'host' }));
         },
     }));
@@ -338,6 +357,8 @@ export function registerTools(ctx, cfg, deps = {}) {
                 namespace: 'host',
                 deadlineMs: INSTALLED_CORE_DEADLINE_MS,
                 signal: exec?.signal,
+                profileDir: profile.dir,
+                profile: profile.name,
             });
             const items = result.items.map((it) => ({
                 pkg: it.pkg,
@@ -385,6 +406,7 @@ export function registerTools(ctx, cfg, deps = {}) {
             if (!target)
                 throw new Error('缺少 pkg');
             const force = args.force === true;
+            assertWriteAllowed(profile, 'upgrade');
             try {
                 return cloneJson(await m.upgradePlugin(target, cfg, { forceIncompatible: force, namespace: 'host' }));
             }
@@ -416,6 +438,7 @@ export function registerTools(ctx, cfg, deps = {}) {
         }),
         timeoutMs: 15_000,
         async execute() {
+            assertWriteAllowed(profile, 'restart');
             return cloneJson(restart(null));
         },
     }));
@@ -431,6 +454,7 @@ export function registerTools(ctx, cfg, deps = {}) {
                 'For installed plugins, call dshm_list / dshm_outdated. Upgrade only after the user confirms which one: dshm_upgrade. Uninstall only after confirmation: dshm_uninstall.',
                 'dshm_toggle switches a plugin on/off: confirm first unless the user already said it in the same message (把 skins 关掉 → execute directly); report live vs restart-required accordingly. ',
                 'dshm_restart only after the user agrees to restart; afterwards tell them to refresh once the page recovers.',
+                'dsh-m operates on the current host profile (web or desktop, per ping.profile): on desktop only read-only market + install-new-package + toggle work; upgrade/uninstall/self-upgrade/restart return structured refusals with guidance — relay them instead of retrying.',
             ].join(' '),
         });
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-m",
-  "version": "0.8.5",
+  "version": "0.9.1",
   "description": "可自定义收录清单的 DSH 插件市场：收录、安装、卸载、升级一站完成，附 agent 工具与 dshm CLI。",
   "license": "MIT",
   "type": "module",