dsh-m 0.9.2 → 0.9.4

package/README.en.md

@@ -48,6 +48,19 @@ The default registry includes DSH Skins, ModSearch, the Lark / QQ / Weixin / WeC
 
 The restart chain below applies to **Web only** (Desktop takes effect via the official app lifecycle: after installing, quit and reopen the Desktop app — see the 0.9.0 section). After any mutation, the already-open Market and Installed views refresh the profile state together, keeping badges and cards in sync without closing and reopening the marketplace; a "⚡ Restart" banner appears — under systemd, the DSH launcher's `appExit` hook hands the restart back to a unit configured with `Restart=on-failure` or `Restart=always`, avoiding a `systemctl` helper inside the unit cgroup that is about to stop; if `appExit` is unavailable, the fallback uses a manager-owned transient `systemd-run` service and only then a detached helper. The client confirms the replacement by boot id and dismisses the banner, leaving DSH Web's own background connection recovery in control; it does not force a full-page reload during the auth/route handoff. The restart chain has been live-verified on the current DSH Web `0.2.0-rc.2` (2026-10-01): dsh-m probes the unit's `Restart=` policy, hands the stop back via `appExit`, the `status=75/TEMPFAIL` exit is caught by the Restart policy and auto-started, and after recovery the page reconnects in the background with the panel fully functional. Historical scope: the `0.1.5-rc.1` era covered live `/dshm` ping and authenticated `303 → 200` checks; `0.1.2-rc.1` is covered by contract checks plus runtime shape-detection fallback (see the verified array) — with the deployment moved on, no live E2E is chased on retired generations; the transient `systemd-run` fallback only applies to hosts without `appExit` (all supported generations provide it) and stays a documented fallback rather than a release gate; repeated install/uninstall is covered by the profile-transaction test surface (compensation, post-install guard, 813 cases) plus the 0.4.0→0.4.2 consecutive-release evidence. Installs stream live pnpm progress (resolve → download → link → build).
 
+### Fixed in 0.9.4 — Fullscreen header eaten by the Windows Desktop titlebar (tabs / restore unreachable)
+
+- **Root cause**: on Windows Desktop the shell runs `titleBarStyle:hidden + titleBarOverlay` — the top 40px of the window is a full-width `-webkit-app-region:drag` band (drag hits are decided by layout and ignore z-index / paint order), and the OS-drawn — □ ✕ caption buttons float above everything. The maximized panel header landed inside that band: tab clicks were swallowed by window dragging and the restore/close buttons were covered by the system buttons — no way back.
+- **Fix**: the same approach the shell uses for its own overlays — consume the `--dsh-windows-titlebar-height` variable the shell sets on `html` (fullscreen `top:var(…)`; floating `padding-top:max(24px,var(…))`, which also fixes the short-window edge case where the floating panel's top edge sat under the band).
+- **Zero drift on Web**: browsers / DSH Web have no such variable — it falls back to 0px, byte-identical to 0.9.3.
+
+### Fixed in 0.9.3 — Windows native support (verified on a real Windows host)
+
+- **Registry atomic writes**: temp file names were derived with `split('/')`, but Windows paths separate with `\` — the "basename" came out as the entire path, the temp-file open always failed silently, and every cache / accepted-metadata write silently failed; now uses `basename()`, identical on all three platforms.
+- **Local-file registry address parsing**: `C:\…` drive paths and `\\server\share` UNC were misread as URL schemes (with a misleading "HTTPS only" error), and `file://C:/…` normalized to a drive-less dangling path that always failed with ENOENT; all three local forms (POSIX absolute / Windows drive / UNC) now parse correctly as file kind.
+- **Build**: `node_modules/.bin/tsc` is a POSIX sh shim; on Windows `spawnSync` failed with ENOENT — the build now runs TypeScript's JS entry with the current Node, identical on all platforms.
+- **Test surface**: on a real Windows host the full 829-case suite went from 41 failures to **0** (821 pass / 8 skipped); POSIX-only contracts (process-group/SIGTERM timing, symlink privileges, platform path assertions, fixed-sleep timing) are now labeled skips, platform-neutral, or poll-based — test contracts unchanged.
+
 ### Fixed in 0.9.2 — Header chip stuck on the old version after a service restart
 
 - **In-place refresh once the restart is confirmed**: the moment the boot id confirms DSH Web is back, the panel re-fetches ping — the `dsh-m vX.Y.Z` chip and the profile chip sync to the new process's data instead of lingering on the old version (observed on 0.9.1: chip upgrade + restart still showed v0.9.0).

package/README.md

@@ -48,6 +48,19 @@
 
 以下重启链路仅适用于 **Web**（Desktop 的生效走官方应用生命周期：安装完成后退出并重新打开 Desktop 应用即可，见 0.9.0 节）。安装 / 卸载 / 升级完成后，当前已打开的市场页与已装页会一起重新读取 profile 状态并同步徽标/卡片，不需要关闭后重新打开插件市场；随后出现「⚡ 一键重启」横幅——受 systemd 管理时通过 DSH launcher 的 `appExit` 交给服务的 `Restart` 策略，避免在待停止 unit 的 cgroup 内启动 `systemctl` helper；无 `appExit` 的 systemd 兜底改用 manager-owned transient `systemd-run`，最后才退回 detached-helper。客户端按 boot id 确认新进程已恢复后关闭横幅，交由 DSH Web 自身的后台连接重试恢复页面，不强制整页刷新，避免认证/路由切换期间白屏。重启链路已在当前 DSH Web `0.2.0-rc.2` 实机核验（2026-10-01）：dsh-m 探测 unit `Restart=` 策略后经 `appExit` 交还 systemd，`status=75/TEMPFAIL` 退出由 Restart 策略接住自动拉起，服务恢复后页面后台重连、面板全功能可用。历史口径：`0.1.5-rc.1` 时代已核验 `/dshm` ping 与带认证 `303 → 200`；`0.1.2-rc.1` 按契约核对 + 形态探测兜底收录（verified 数组），部署面演进后不再追旧代 live E2E；transient `systemd-run` 兜底仅适用于无 `appExit` 的宿主（受支持代际均提供 `appExit`），保持设计兜底而非发布门槛；连续安装/卸载由 profile 事务测试面（补偿事务、装后守卫等 813 用例）与 0.4.0→0.4.2 连续发布实证覆盖。安装过程实时显示 pnpm 进度（解析 → 下载 → 链接 → 构建）。
 
+### 0.9.4 修复：Windows Desktop 全屏后头部不可点（tab / 还原键被系统标题栏吞掉）
+
+- **根因**：Desktop（Windows）以 `titleBarStyle:hidden + titleBarOverlay` 运行——窗口顶部 40px 是壳的全宽 `-webkit-app-region:drag` 拖拽带（按布局参与拖拽判定、无视 z-index 与绘制顺序），右上角另有系统绘制的 — □ ✕ 悬浮于一切内容之上。面板全屏后头部（tab、还原/关闭键）正好落进这条带：点击被窗口拖拽吞掉、还原键被系统键遮挡，全屏无法退出。
+- **修复**：与壳自家 overlay 同款对策——消费壳在 `html` 上设的 `--dsh-windows-titlebar-height` 让出该带（全屏态 `top:var(…)`；浮动态 `padding-top:max(24px,var(…))` 顺带修掉矮窗口下浮板顶边被带压住的边缘情况）。
+- **Web 零漂移**：DSH Web / 浏览器无此变量，回落 0px，行为与 0.9.3 完全一致。
+
+### 0.9.3 修复：Windows 原生适配（Windows 宿主实机回归）
+
+- **registry 原子写**：临时文件名此前用 `split('/')` 从绝对路径取尾段，而 Windows 路径分隔符是 `\`——取到的是整条路径（内嵌 `\` 即目录分隔符），临时文件 open 必败且被吞，cache 与 accepted metadata 写入**静默全失败**；改用 `basename()`，三平台一致。
+- **本地文件清单地址解析**：`C:\…` 盘符与 `\\server\share` UNC 此前被误当 URL scheme（报「只允许 HTTPS」的误导性错误），`file://C:/…` 会归一成无盘符悬空路径必 ENOENT；现 POSIX 绝对 / Windows 盘符 / UNC 三形态均正确解析为 file kind。
+- **构建**：`node_modules/.bin/tsc` 是 POSIX sh shim，Windows 下 `spawnSync ENOENT`；改用当前 Node 直跑 TypeScript 的 JS 入口，`npm run build` 三平台一致。
+- **测试面**：Windows 实机全量 829 用例 41 败 → **0**（821 pass / 8 skipped）；POSIX 进程组/SIGTERM 时序、symlink 权限、平台路径断言、固定 sleep 时序假设逐项标注 skip 或平台无关化/有界轮询，测试契约不变。
+
 ### 0.9.2 修复：跨服务重启后头部角标停留旧版本
 
 - **一键重启确认新进程后就地刷新**：boot id 确认 DSH Web 已恢复的瞬间，面板立即重取 ping——`dsh-m vX.Y.Z` 角标与 profile chip 同步到新进程数据，不再停留旧版本（0.9.1 实测：芯片升级 + 重启后仍显 v0.9.0）。

package/lib/client.js

@@ -1591,9 +1591,15 @@ function communityLabels(data) {
   return { ...zh, ...en };
 }
 var CSS = `
-.dshm-overlay{position:fixed;inset:0;z-index:2147483000;background:var(--dsw-alias-bg-mask-3,rgba(15,23,42,.48));display:flex;align-items:center;justify-content:center;padding:24px 16px;box-sizing:border-box}
+.dshm-overlay{position:fixed;inset:0;z-index:2147483000;background:var(--dsw-alias-bg-mask-3,rgba(15,23,42,.48));display:flex;align-items:center;justify-content:center;padding:max(24px,var(--dsh-windows-titlebar-height,0px)) 16px 24px;box-sizing:border-box}
 .dshm-panel{width:min(920px,100%);height:min(680px,86vh);display:flex;flex-direction:column;background:var(--dsw-alias-bg-elevated,var(--dsw-alias-bg-base,#fff));background:color-mix(in srgb,var(--dsw-alias-bg-base,#fff) 86%,transparent);backdrop-filter:blur(14px) saturate(1.3);-webkit-backdrop-filter:blur(14px) saturate(1.3);border:1px solid var(--dsw-alias-border-l2,#e5e7eb);border-radius:14px;box-shadow:0 18px 48px rgba(2,6,23,.25);overflow:hidden;font-family:inherit;color:var(--dsw-alias-label-primary,inherit)}
-.dshm-overlay.full{padding:0}
+/* 0.9.4 Windows Desktop \u5168\u5C4F\u4FEE\u590D\uFF1A\u58F3\u5728 html \u4E0A\u8BBE --dsh-windows-titlebar-height\uFF0840px\uFF0C
+   titleBarStyle:hidden + titleBarOverlay:42 \u7CFB\u7EDF\u7ED8\u5236 \u2014 \u25A1 \u2715\uFF09\uFF0C\u5176\u4E0A\u8FD8\u6709\u5168\u5BBD
+   -webkit-app-region:drag \u62D6\u62FD\u5E26\u2014\u2014\u8BE5\u5E26\u6309\u5E03\u5C40\u53C2\u4E0E\u62D6\u62FD\u5224\u5B9A\u3001\u65E0\u89C6 z-index/\u7ED8\u5236\u987A\u5E8F\uFF0C
+   \u9762\u677F\u5934\u90E8\u843D\u8FDB\u53BB\u70B9\u51FB\u4F1A\u88AB\u7A97\u53E3\u62D6\u62FD\u541E\u6389\uFF0C\u8FD8\u539F/\u5173\u95ED\u952E\u66F4\u88AB\u7CFB\u7EDF\u952E\u60AC\u6D6E\u906E\u6321\u3002
+   \u4E0E\u58F3\u81EA\u5BB6 overlay \u540C\u6B3E\u5BF9\u7B56\uFF08padding/inset-top: var(--dsh-windows-titlebar-height)\uFF09\u8BA9\u51FA\u8BE5\u5E26\uFF1B
+   DSH Web / \u6D4F\u89C8\u5668\u65E0\u6B64\u53D8\u91CF \u2192 \u56DE\u843D 0px\uFF0C\u884C\u4E3A\u4E0E\u65E7\u7248\u9010\u5B57\u8282\u4E00\u81F4\u3002 */
+.dshm-overlay.full{padding:0;top:var(--dsh-windows-titlebar-height,0px)}
 .dshm-panel.full{width:100%;height:100%;border-radius:0}
 /* \u7A97\u53E3\u63A7\u5236\u7EC4\uFF080.7.7\uFF09\uFF1A\u6700\u5927\u5316/\u5173\u95ED\u8FDE\u4F53\u6309\u94AE\u7EC4\u2014\u2014\u7B49\u5BBD\u4E24\u683C + \u53D1\u4E1D\u5206\u9694\u7EBF\uFF0C\u7EDF\u4E00\u7EBF\u6761\u56FE\u6807 */
 /* \u7A97\u53E3\u63A7\u5236\u7EC4\uFF080.7.7/0.7.8\uFF09\uFF1A\u6700\u5927\u5316/\u5173\u95ED\u8FDE\u4F53\u6309\u94AE\u7EC4\u2014\u2014\u900F\u660E\u5E95 + \u53D1\u4E1D\u5916\u6846\uFF0C\u4E0E\u641C\u7D22\u6E05\u9664\u94AE\u540C\u4E00\u914D\u8272\u8BED\u8A00\uFF1B\u5BBD\u683C\u9632\u8BEF\u89E6 */

package/lib/core/registry.js

@@ -5,7 +5,7 @@
  */
 import { createHash, randomUUID } from 'node:crypto';
 import { createRequire } from 'node:module';
-import { isAbsolute, join, normalize } from 'node:path';
+import { basename, isAbsolute, join, normalize } from 'node:path';
 import { constants as fsConstants, mkdirSync } from 'node:fs';
 import { lstat, mkdir, open, readFile, readdir, realpath, rename, rm } from 'node:fs/promises';
 import { WEB_PROFILE, cacheRoot } from './env.js';
@@ -44,7 +44,8 @@ function normalizeLocalPath(raw) {
     const p = normalize(raw);
     if (!isAbsolute(p))
         throw new Error('本地 registry 必须是绝对路径或 file:// URL');
-    if (p.endsWith('/'))
+    // Windows 原生分隔符是 \：只查 '/' 会把盘根 '\'、'C:\dir\' 误当文件放行
+    if (p.endsWith('/') || p.endsWith('\\'))
         throw new Error('本地 registry 不能指向目录');
     return p;
 }
@@ -67,6 +68,10 @@ function parseFileUrl(input) {
     catch {
         throw new Error('file:// registry 路径百分号编码无效');
     }
+    // Windows：WHATWG 把盘符路径统一表成 /C:/...（file://C:/x 同样归一到此前缀），
+    // 原生路径须剥掉这个前导斜杠，否则 normalize 出 '\C:\x' 悬空路径（无盘符）必 ENOENT
+    if (/^\/[a-zA-Z]:[/\\]/.test(pathname))
+        pathname = pathname.slice(1);
     if (CONTROL_RE.test(pathname))
         throw new Error('registry 路径包含控制字符');
     const normalized = normalizeLocalPath(pathname);
@@ -106,7 +111,10 @@ export function parseRegistryAddress(raw) {
         throw new Error('registry 地址包含控制字符');
     if (/^file:/i.test(input))
         return parseFileUrl(input);
-    if (input.startsWith('/')) {
+    // 本地路径三形态：POSIX 绝对（/…）、Windows 盘符（C:\… 或 C:/…）、Windows UNC（\\server\share…）。
+    // 盘符/UNC 判定必须先于 scheme 正则——'C:' 会被 /^[a-z][a-z0-9+.-]*:/i 误认成 URL scheme，
+    // 落进 parseHttpUrl 后抛误导性的「只允许 HTTPS」（Windows 下自定义文件清单的常规形态）。
+    if (input.startsWith('/') || input.startsWith('\\') || /^[a-zA-Z]:[/\\]/.test(input)) {
         const normalized = normalizeLocalPath(input);
         return { kind: 'file', input, normalized, cacheKey: stableKey(`file:${normalized}`) };
     }
@@ -404,7 +412,10 @@ async function atomicWriteJson(target, dir, value, profile = WEB_PROFILE) {
             }
             if (existing && existing.isSymbolicLink())
                 return false;
-            const tmp = join(dir, `.${target.split('/').pop() ?? 'cache'}.tmp-${process.pid}-${randomUUID().slice(0, 8)}`);
+            // 临时文件名必须取 basename：Windows 分隔符是 \，用 split('/') 解析绝对路径会得到
+            // 整条路径（内嵌 \ 即目录分隔符），open 必败且被下方 catch 吞掉——全部 cache/metadata
+            // 写入静默失败（Windows 实测 2026-10-01：cache 恒缺失、metadataCommitted 恒 false）。
+            const tmp = join(dir, `.${basename(target)}.tmp-${process.pid}-${randomUUID().slice(0, 8)}`);
             const fh = await open(tmp, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_NOFOLLOW, 0o600);
             try {
                 await fh.write(Buffer.from(JSON.stringify(value, null, 2), 'utf8'));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-m",
-  "version": "0.9.2",
+  "version": "0.9.4",
   "description": "可自定义收录清单的 DSH 插件市场：收录、安装、卸载、升级一站完成，附 agent 工具与 dshm CLI。",
   "license": "MIT",
   "type": "module",