dsh-m 0.9.46 → 0.9.48

package/CHANGELOG.md

@@ -8,6 +8,21 @@ The full release history of dsh-m, maintained bilingually: **Chinese first, Engl
 
 ## 中文
 
+### 0.9.48 变更：README 实体解码 + 相对路径仓库基址锚定（0.9.47 实装反馈两连修）
+
+- **HTML 实体解码**：0.9.47 解析了标签但未解码实体——dsh-task-board 类 README 徽章间独立成行的 ` ` 按字面漏出。现命名实体（nbsp/amp/lt/gt/quot/copy/mdash/箭头/分数等 60+ 高频集）与数字实体（十进制/十六进制）均解码；文本段与 HTML 属性值都解（徽章 src 里 `&labelColor` → `&labelColor`，shields 参数不再丢失）；`code`/`pre` 内不解码；未知实体与裸 `&` 原样保留；单趟解码不回炉（`<` → `<` 文本，与浏览器一致），解码结果只作为文本节点、绝不重新参与标签解析，无注入面。
+- **行内优先判定**：包裹标签（`<p align="center">` 等）剥壳后，若内部无空行分段、无 markdown 块结构、且行首标签均为行内/void 标签，则整块按行内 token 流渲染——徽章 + `&nbsp;` 连排在同一居中行（GitHub 语义），不再每行拆成独立段落；含块级结构（`tr/td/ul/li` 开头等）仍走 markdown 递归保结构。
+- **相对路径仓库基址锚定**：`[README.md](README.md)` 这类相对链接此前被 safeUrl 归 `#`（点击无反应——既有安全归化，非 0.9.47 回归）。现 README 预览可携带仓库基址：相对链接锚 `github.com/<o>/<r>/blob/HEAD/<path>`、相对图片锚 `raw.githubusercontent.com/<o>/<r>/HEAD/<path>`（`./`/`../` 前缀归一）；绝对 URL 与页内锚点不受影响；无基址时保持归 `#` 旧行为。数据链路：npm packument 兜底时顺带提取 `repository` 归一为 `owner/repo`（仅 GitHub，git+https/git@/.git 形态归一，host-api 透传 `repo` 字段）；客户端以卡片 `github` 字段兜底；渲染基址为 renderMarkdown 级同步设置、进出恢复，不跨渲染泄漏。
+- **测试**：client-markdown 净增 6 例（实体四类、独立 `&nbsp;` 徽章块、code 不解码与属性解码、基址锚定七断言、无基址回归与跨渲染泄漏）；versions 净增 1 例（repository 两形态归一 + 非 GitHub 归空）；全量 1181/1181、typecheck 零错误；真实数据端到端——dsh-TUI 25926 字符零泄漏零回归、task-board 真实徽章块三徽章一行居中 + `&amp;` 解码、相对链接正确锚 blob/HEAD。纯客户端变更，刷新页面即生效。
+
+### 0.9.47 变更：README 预览内嵌 HTML 子集渲染（GitHub 风 README 不再满屏标签）
+
+- **问题**：市场/收藏/已装详情 Modal 的 README 折叠页，遇到 GitHub 风重度内嵌 HTML 的 README（`<p align="center">` 徽章墙、`<img>` Logo、`<details>` 折叠等——npm packument 兜底与本地读取都常见）会把标签按字面整屏显示，观感如「乱码」。根因是渲染端自研 markdown 渲染器此前完全不解析 HTML 标签（原始内容本身没有问题，GitHub 上渲染正常）。
+- **渲染子集（`src/client/markdown.js`）**：块级包裹标签（`p/div/center/blockquote/details/ul/ol/li/table/thead/tbody/tr/td/th/h1-6/figure/section/dl` 等）剥壳后按完整 markdown 递归渲染，内部标题/列表/表格/围栏结构全保留；行内标签（`a/img/strong/em/del/code/kbd/mark/sub/sup/u/small/span/br/hr` 等）token 化构造元素；`align` 属性映射 `textAlign`，`<img width/height>` 映射显式尺寸并放开徽章 20px 高度帽（无 width 的徽章仍走小图帽）；`<details>/<summary>` 原生折叠；文本含标签的普通段落/标题/表格单元格也走行内 token 流（`Press <kbd>Ctrl</kbd>` 类可渲染）。
+- **安全模型（不变式）**：绝不向 DOM 注入原始 HTML 字符串——只解析出白名单标签与白名单属性，全部经 `h()` 构造 React 元素，URL 一律过 `safeUrl` 闸门（`javascript:` 等归 `#`）；未知标签剥壳留文本，`script/style/svg/iframe` 等容器连同内容整体丢弃；递归深度护栏（>8 层降级纯文本）。无 `dangerouslySetInnerHTML`，不存在 XSS 注入面。
+- **已知边界**：npm packument 兜底的 README 不携带仓库基址，相对路径图片（如 `docs/assets/logo.svg`）按 safeUrl 归 `#` 后由 onError 隐藏（徽章等外链图片不受影响）；`<picture><source>` 的 source 分支丢弃、保 `img` 回退。
+- **测试**：`client-markdown.test.mjs` 净增 10 例（块级剥壳递归、徽章行连排、行内混排、script 丢弃与 javascript: 归化、未知标签剥壳、details/summary、整篇 div 包裹、HTML 表格、HTML 标题与行内元素、未闭合标签降级与深度护栏）；真实 dsh-TUI README（25926 字符）渲染验证零标签泄漏、64 个徽章链接正常构造；全量测试 1175/1175，typecheck 零错误。纯客户端变更，刷新页面即生效。
+
 ### 0.9.46 变更：双语 README 精简重构＋实拍 WebP 截图集（文档版）
 
 - **README×2 重构**：中文 17.5KB → 8.3KB、英文 18.1KB → 9.4KB——以用户任务动线重组（30 秒上手 → 浏览/搜索/安装 → 已装与设置 → Agent 工具与 CLI → 兼容与 FAQ）；获取线路、缓存语义等实现细节不再展开，统一移交 [`docs/DESIGN.md`](docs/DESIGN.md) 与 ADR 承接；运行相位/生效时机表述与激活分桶语义对齐（不硬承诺「一定重启/一定刷新」，以操作返回为准）。
@@ -349,6 +364,21 @@ The full release history of dsh-m, maintained bilingually: **Chinese first, Engl
 
 ## English
 
+### Added in 0.9.48 — README entity decoding + repo-base anchoring for relative paths (two fixes from 0.9.47 field feedback)
+
+- **HTML entity decoding**: 0.9.47 parsed tags but left entities raw — standalone `&nbsp;` lines between badges (dsh-task-board-style READMEs) leaked literally. Named entities (nbsp/amp/lt/gt/quot/copy/mdash/arrows/fractions — 60+ common set) and numeric entities (decimal/hex) now decode; both text runs and HTML attribute values decode (badge src `&amp;labelColor` → `&labelColor`, shields params no longer dropped); `code`/`pre` content stays literal; unknown entities and bare `&` are preserved; single-pass decoding without re-processing (`&amp;lt;` → `&lt;` as text, matching browsers). Decoded output only ever becomes text nodes — never re-parsed as tags, no injection surface.
+- **Inline-first heuristic**: after unwrapping a block wrapper (`<p align="center">` etc.), if the inner content has no blank-line paragraph breaks, no markdown block structures, and every line starts with an inline/void tag, the whole block renders through the inline token stream — badges + `&nbsp;` flow on one centered line (GitHub semantics) instead of one paragraph per line; content with block structures (lines starting with `tr/td/ul/li` etc.) still goes through the markdown recursion to preserve structure.
+- **Repo-base anchoring for relative paths**: relative links like `[README.md](README.md)` previously collapsed to `#` via safeUrl (inert click — long-standing normalization, not a 0.9.47 regression). The README preview can now carry a repository base: relative links anchor to `github.com/<o>/<r>/blob/HEAD/<path>`, relative images anchor to `raw.githubusercontent.com/<o>/<r>/HEAD/<path>` (`./`/`../` prefixes normalized); absolute URLs and in-page anchors are untouched; without a base the old `#` behavior applies. Data flow: the npm packument fallback now also extracts `repository`, normalized to `owner/repo` (GitHub only; git+https/git@/.git forms normalized) and passed through host-api as `repo`; the client falls back to the card's `github` field; the render base is set per renderMarkdown call and restored on exit — no cross-render leakage.
+- **Testing**: 6 new cases in client-markdown (four entity classes, standalone-`&nbsp;` badge block, code no-decode + attribute decoding, seven anchoring assertions, no-base regression + cross-render leakage); 1 new versions case (repository normalization in both shapes + non-GitHub → empty); full suite 1181/1181, typecheck clean; real-data end-to-end — dsh-TUI 25,926 chars zero leaks zero regression, the real task-board badge block renders three badges on one centered line with `&amp;` decoded, relative links anchor to blob/HEAD correctly. Client-only change — a page refresh takes effect.
+
+### Added in 0.9.47 — embedded-HTML subset rendering for the README preview (GitHub-style READMEs no longer show raw tags)
+
+- **Problem**: the README fold in the detail Modal (market/curated/installed) showed GitHub-style HTML-heavy READMEs (`<p align="center">` badge walls, `<img>` logos, `<details>` blocks — common in both the npm packument fallback and local reads) with every tag rendered literally, looking like mojibake. Root cause: the in-house markdown renderer never parsed HTML tags at all. The source content itself was fine — GitHub renders it normally.
+- **Rendering subset (`src/client/markdown.js`)**: block-level wrapper tags (`p/div/center/blockquote/details/ul/ol/li/table/thead/tbody/tr/td/th/h1-6/figure/section/dl` etc.) are unwrapped and their inner content re-rendered as full markdown, preserving headings/lists/tables/fences; inline tags (`a/img/strong/em/del/code/kbd/mark/sub/sup/u/small/span/br/hr` etc.) are tokenized into React elements; `align` maps to `textAlign`; `<img width/height>` maps to explicit size and lifts the 20px badge height cap (badges without width keep the small-image cap); `<details>/<summary>` render as native disclosure; ordinary paragraphs/headings/table cells whose text contains tags also go through the inline token stream (`Press <kbd>Ctrl</kbd>` renders properly).
+- **Security model (invariant)**: raw HTML is never injected into the DOM — only whitelisted tags with whitelisted attributes are parsed, everything is built via `h()` React elements, and URLs pass the `safeUrl` gate (`javascript:` etc. collapse to `#`); unknown tags are unwrapped keeping their text, `script/style/svg/iframe` containers are dropped together with their content, and a recursion depth guard (>8) degrades to plain text. No `dangerouslySetInnerHTML` — no XSS surface.
+- **Known limits**: the npm packument fallback carries no repository base URL, so relative-path images (e.g. `docs/assets/logo.svg`) collapse to `#` via safeUrl and hide on error (externally hosted badge images are unaffected); inside `<picture><source>` the source branch is dropped and the `img` fallback kept.
+- **Testing**: 10 new cases in `client-markdown.test.mjs` (block unwrap recursion, badge rows, inline mix, script dropping + `javascript:` neutralization, unknown-tag unwrap, details/summary, whole-document div wrapper, HTML tables, HTML headings + inline elements, unclosed-tag degradation + depth guard); the real dsh-TUI README (25,926 chars) renders with zero tag leaks and 64 badge links constructed; full suite 1175/1175, typecheck clean. Client-only change — a page refresh takes effect.
+
 ### Added in 0.9.46 — bilingual README restructure + live-captured WebP screenshot set (docs release)
 
 - **README×2 restructured**: zh-CN 17.5KB → 8.3KB, en 18.1KB → 9.4KB — reorganized around the user's task flow (quick start → browse/search/install → installed & settings → agent tools & CLI → compatibility & FAQ). Fetch-chain and cache-semantics details no longer live here; they are delegated to [`docs/DESIGN.md`](docs/DESIGN.md) and the ADRs. Runtime-phase / takes-effect wording now matches the activation-bucket semantics (no hard promises of "always restart" or "always refresh" — follow the operation result).

package/docs/DESIGN.md

@@ -182,6 +182,8 @@ npm 安装 / GitHub 安装 / 升级 / 自升级 / 卸载是**同一个事务模
 技术：`src/client.js` 经 **esbuild** 打包为 `lib/client.js`；`window.__ModuleLoader__.load({ id: "dsh-m", factory })` 注册；**React 从 module loader require**（零额外运行时依赖）；manifest 注入 `@deepseek-ai/dsh-client-runtime`、`@deepseek-ai/dsh-client-ui-slots`、`@deepseek-ai/dsh-client-ui-settings`。
 图标：GitHub 来源自动用 `https://github.com/<owner>.png?size=64`；`icon` 字段可覆盖；npm-only 条目首字母色块回退。
 
+**README 预览渲染（`src/client/markdown.js`，0.9.47 起）**：自研轻量渲染器，安全模型 = 「白名单标签 + 白名单属性 + safeUrl 闸门 → 全部经 `h()` 构造 React 元素」，**绝不注入原始 HTML 字符串**（无 `dangerouslySetInnerHTML`，文本节点 React 转义兜底）。markdown 侧支持标题/列表/表格/围栏/引用/徽章链接等；HTML 侧支持 GitHub 风 README 常见内嵌子集——块级包裹标签（`p/div/center/details/table/tr/td/li/ul/ol/h1-6` 等）剥壳后渲染：内容纯行内（无空行分段/无 markdown 块结构/行首均为行内标签）时整块行走内 token 流（徽章 + `&nbsp;` 连排一行，GitHub 语义，0.9.48），否则按 markdown 递归（保内部结构）；行内标签（`a/img/strong/em/code/kbd/mark/br/sub/sup` 等）token 化渲染，`align` 属性映射 `textAlign`、`<img width/height>` 映射显式尺寸（放开徽章 20px 高度帽）；未知标签剥壳留文本，`script/style/svg/iframe` 等容器连同内容丢弃，`javascript:` 等危险 URL 归 `#`。**HTML 实体解码（0.9.48）**：命名（60+ 高频集）+ 数字（十/十六进制），文本段与属性值都解、`code/pre` 不解、单趟不回炉、解码结果仅作文本节点。**仓库基址锚定（0.9.48）**：`renderMarkdown(src, { repo: "owner/repo" })` 后相对链接锚 `github.com/<o>/<r>/blob/HEAD/`、相对图片锚 `raw.githubusercontent.com/<o>/<r>/HEAD/`；基址来源 = npm packument `repository`（host-api readme 结果 `repo` 字段，仅 GitHub 归一）> 卡片 `github` 字段；无基址时相对路径归 `#`（0.9.47 前行为）。已知边界：monorepo 子目录 README 的相对路径锚到仓库根（packument 不携带子目录信息）；绝对 URL 与页内锚点不受锚定影响。数据源：已装条目读 profile 本地 `README.md`（≤64KB 截断）；未装条目回源 npm packument 顶层 `readme` 字段（0.9.45 U10b）。
+
 ## 5. Agent 工具（host）与 CLI
 
 - 工具前缀 `dshm_`，共 7 个：`dshm_search` / `dshm_list` / `dshm_install` / `dshm_uninstall` / `dshm_outdated` / `dshm_upgrade` / `dshm_restart`。Agent tools 运行于 Host 进程，与 Web GUI **共用 `host` namespace 缓存与 active config**；`dshm_search` 走服务端过滤（metadata-only，`withLatest=false`、limit ≤80），返回不含本地路径的短 summary。

package/lib/client.js

@@ -399,21 +399,110 @@ var init_backdrop = __esm({
 var markdown_exports = {};
 __export(markdown_exports, {
   createMarkdown: () => createMarkdown,
+  decodeEntities: () => decodeEntities,
   safeUrl: () => safeUrl
 });
-function safeUrl(u) {
+function normalizeRepoInput(v) {
+  const s = String(v || "").trim();
+  if (!s) return "";
+  if (/^[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+$/.test(s)) return s;
+  const m = /github\.com[/:]([a-zA-Z0-9._-]+)\/([a-zA-Z0-9._-]+?)(?:\.git)?(?:[/?#]|$)/i.exec(s);
+  return m ? `${m[1]}/${m[2]}` : "";
+}
+function safeUrl(u, kind) {
   const t = String(u || "").trim();
   if (/^(https?:\/\/|mailto:)/i.test(t)) return t;
-  if (/^[/#]/.test(t)) return t;
+  if (t.startsWith("#")) return t;
+  if (RENDER_REPO && (kind === "img" || kind === "link")) {
+    const path = t.replace(/^(?:\.\/|\.\.\/|\/)+/, "");
+    return kind === "img" ? `https://raw.githubusercontent.com/${RENDER_REPO}/HEAD/${path}` : `https://github.com/${RENDER_REPO}/blob/HEAD/${path}`;
+  }
+  if (t.startsWith("/")) return t;
   return "#";
 }
+function decodeEntities(s) {
+  const t = String(s || "");
+  if (!t.includes("&")) return t;
+  return t.replace(HTML_ENTITY_RE, (raw, body) => {
+    if (body.startsWith("#")) {
+      const code = body[1] === "x" || body[1] === "X" ? parseInt(body.slice(2), 16) : parseInt(body.slice(1), 10);
+      return Number.isInteger(code) && code > 0 && code <= 1114111 ? String.fromCodePoint(code) : raw;
+    }
+    const named = HTML_ENTITIES[body] !== void 0 ? HTML_ENTITIES[body] : HTML_ENTITIES[body.toLowerCase()];
+    return named !== void 0 ? named : raw;
+  });
+}
+function parseHtmlAttrs(s) {
+  const attrs = {};
+  if (!s) return attrs;
+  const re = /([a-zA-Z][a-zA-Z0-9-]*)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g;
+  let m;
+  while (m = re.exec(s)) {
+    const raw = m[2] !== void 0 ? m[2] : m[3] !== void 0 ? m[3] : m[4] !== void 0 ? m[4] : "";
+    attrs[m[1].toLowerCase()] = decodeEntities(raw);
+  }
+  return attrs;
+}
+function htmlAlignStyle(attrs) {
+  const a = String(attrs.align || "").toLowerCase();
+  return a === "center" || a === "left" || a === "right" || a === "justify" ? { textAlign: a } : void 0;
+}
+function htmlImgStyle(attrs) {
+  const size = (v) => /^\d+(\.\d+)?$/.test(v) ? Number(v) : /^\d+(\.\d+)?%$/.test(v) ? v : null;
+  const st = {};
+  const w = size(String(attrs.width || ""));
+  if (w !== null) {
+    st.width = w;
+    st.maxWidth = "100%";
+    st.height = "auto";
+    st.maxHeight = "none";
+  }
+  const hgt = size(String(attrs.height || ""));
+  if (hgt !== null) st.height = hgt;
+  return Object.keys(st).length ? st : void 0;
+}
+function htmlBlockEnd(lines, i) {
+  const om = /<([a-zA-Z][a-zA-Z0-9-]*)/.exec(lines[i]);
+  const tag = om ? om[1].toLowerCase() : "";
+  if (!tag || HTML_VOID_TAGS.has(tag)) return i;
+  if (new RegExp(`</${tag}\\s*>`, "i").test(lines[i].slice(om.index))) return i;
+  const closeRe = new RegExp(`</${tag}\\s*>`, "i");
+  let lastNonBlank = i;
+  for (let j = i + 1; j < lines.length; j++) {
+    if (!lines[j].trim()) {
+      if (!HTML_SPAN_BLANK.has(tag) || j - i > 400) return lastNonBlank;
+      continue;
+    }
+    lastNonBlank = j;
+    if (closeRe.test(lines[j])) return j;
+    if (j - i > 400) return j;
+  }
+  return lastNonBlank;
+}
+function decodeTextNodes(nodes) {
+  return nodes.map((n) => {
+    if (typeof n === "string") return decodeEntities(n);
+    if (Array.isArray(n)) return decodeTextNodes(n);
+    if (n && typeof n === "object" && n.type !== "code" && n.type !== "pre") {
+      const cur = n.props && n.props.children !== void 0 ? n.props.children : n.children;
+      if (cur !== void 0) {
+        const wasArr = Array.isArray(cur);
+        const decoded = decodeTextNodes(wasArr ? cur : [cur]);
+        const next = wasArr ? decoded : decoded[0];
+        if (n.props && n.props.children !== void 0) return { ...n, props: { ...n.props, children: next } };
+        return { ...n, children: next };
+      }
+    }
+    return n;
+  });
+}
 function createMarkdown(h2) {
   function ExtLink2({ href, className, children }) {
     return h2(
       "a",
       {
         className: className || "dshm-md-a",
-        href: safeUrl(href),
+        href: safeUrl(href, "link"),
         target: "_blank",
         rel: "noopener noreferrer",
         onClick: (e) => e.stopPropagation()
@@ -421,11 +510,13 @@ function createMarkdown(h2) {
       children
     );
   }
-  function MdImg2({ src, alt }) {
+  function MdImg2({ src, alt, style, title }) {
     return h2("img", {
       className: "dshm-md-img",
-      src: safeUrl(src),
+      src: safeUrl(src, "img"),
       alt: alt || "",
+      title: title || void 0,
+      style: style || void 0,
       referrerPolicy: "no-referrer",
       onError: (e) => {
         e.currentTarget.style.display = "none";
@@ -448,7 +539,7 @@ function createMarkdown(h2) {
         const lm = /\]\(([^)]*)\)\s*$/.exec(tok);
         const img = h2(MdImg2, { src: im && im[2], alt: im && im[1] });
         const href = lm && lm[1];
-        nodes.push(href && safeUrl(href) !== "#" ? h2(ExtLink2, { key: k, href }, img) : h2("span", { key: k }, img));
+        nodes.push(href && safeUrl(href, "link") !== "#" ? h2(ExtLink2, { key: k, href }, img) : h2("span", { key: k }, img));
       } else if (tok.startsWith("![") || tok.startsWith("<![")) {
         const im = /^!\[([^\]]*)\]\(([^)]*)\)$/.exec(tok);
         nodes.push(h2(MdImg2, { key: k, src: im && im[2], alt: im && im[1] }));
@@ -474,7 +565,7 @@ function createMarkdown(h2) {
     if (last < src.length) nodes.push(src.slice(last));
     return nodes;
   }
-  function mdBlocks(lines, kb) {
+  function mdBlocks(lines, kb, depth = 0) {
     const out = [];
     let i = 0;
     let n = 0;
@@ -485,6 +576,8 @@ function createMarkdown(h2) {
     const isUl = (s) => /^\s*[-*+]\s+/.test(s);
     const isOl = (s) => /^\s*\d+[.)]\s+/.test(s);
     const isTableRow = (s) => s.includes("|") && /^\s*\|/.test(s);
+    const isHtmlBlock = (s) => /^\s*<\/?[a-zA-Z][a-zA-Z0-9-]*(?:\s[^>]*?)?\/?>/.test(s);
+    const inlineOf = (s, key) => decodeTextNodes(/<[a-zA-Z]/.test(s) ? mdHtmlInline(s, key) : mdInline(s, key));
     while (i < lines.length) {
       const line = lines[i];
       if (!line.trim()) {
@@ -492,6 +585,12 @@ function createMarkdown(h2) {
         continue;
       }
       const k = `${kb}-b${n++}`;
+      if (isHtmlBlock(line)) {
+        const end = htmlBlockEnd(lines, i);
+        out.push(...mdHtmlBlock(lines.slice(i, end + 1).join("\n"), `${k}H`, depth));
+        i = end + 1;
+        continue;
+      }
       if (isFence(line)) {
         const buf2 = [];
         i++;
@@ -502,7 +601,7 @@ function createMarkdown(h2) {
       }
       if (isHeading(line)) {
         const hm = /^(#{1,6})\s+(.*)$/.exec(line);
-        out.push(h2(`h${hm[1].length}`, { key: k }, mdInline(hm[2], k)));
+        out.push(h2(`h${hm[1].length}`, { key: k }, inlineOf(hm[2], k)));
         i++;
         continue;
       }
@@ -514,7 +613,7 @@ function createMarkdown(h2) {
       if (isQuote(line)) {
         const buf2 = [];
         while (i < lines.length && isQuote(lines[i])) buf2.push(lines[i++].replace(/^\s*>\s?/, ""));
-        out.push(h2("blockquote", { key: k }, mdBlocks(buf2, k)));
+        out.push(h2("blockquote", { key: k }, mdBlocks(buf2, k, depth)));
         continue;
       }
       if (isUl(line) || isOl(line)) {
@@ -522,7 +621,7 @@ function createMarkdown(h2) {
         const re = ordered ? /^\s*\d+[.)]\s+(.*)$/ : /^\s*[-*+]\s+(.*)$/;
         const items = [];
         while (i < lines.length && (ordered ? isOl(lines[i]) : isUl(lines[i]))) {
-          items.push(h2("li", { key: `li${items.length}` }, mdInline(re.exec(lines[i])[1], `${k}-${items.length}`)));
+          items.push(h2("li", { key: `li${items.length}` }, inlineOf(re.exec(lines[i])[1], `${k}-${items.length}`)));
           i++;
         }
         out.push(h2(ordered ? "ol" : "ul", { key: k }, items));
@@ -541,30 +640,160 @@ function createMarkdown(h2) {
           h2(
             "table",
             { key: k },
-            h2("thead", null, h2("tr", null, head.map((c, x) => h2("th", { key: x }, mdInline(c, `${k}h${x}`))))),
-            h2("tbody", null, rows.map((r, y) => h2("tr", { key: y }, r.map((c, x) => h2("td", { key: x }, mdInline(c, `${k}${y}x${x}`))))))
+            h2("thead", null, h2("tr", null, head.map((c, x) => h2("th", { key: x }, inlineOf(c, `${k}h${x}`))))),
+            h2("tbody", null, rows.map((r, y) => h2("tr", { key: y }, r.map((c, x) => h2("td", { key: x }, inlineOf(c, `${k}${y}x${x}`))))))
           )
         );
         continue;
       }
       const buf = [line];
       i++;
-      while (i < lines.length && lines[i].trim() && !isFence(lines[i]) && !isHeading(lines[i]) && !isHr(lines[i]) && !isQuote(lines[i]) && !isUl(lines[i]) && !isOl(lines[i])) {
+      while (i < lines.length && lines[i].trim() && !isFence(lines[i]) && !isHeading(lines[i]) && !isHr(lines[i]) && !isQuote(lines[i]) && !isUl(lines[i]) && !isOl(lines[i]) && !isHtmlBlock(lines[i])) {
         buf.push(lines[i]);
         i++;
       }
-      out.push(h2("p", { key: k }, mdInline(buf.join(" "), k)));
+      out.push(h2("p", { key: k }, inlineOf(buf.join(" "), k)));
+    }
+    return out;
+  }
+  function mdHtmlInline(src, kb) {
+    const out = [];
+    const stack = [];
+    let last = 0;
+    let n = 0;
+    let m;
+    const cur = () => stack.length ? stack[stack.length - 1].kids : out;
+    const pushText = (t) => {
+      if (!t) return;
+      const t2 = decodeEntities(t);
+      if (!t2.trim()) {
+        if (cur().length) cur().push(" ");
+        return;
+      }
+      const parts = t2.split(/\n[ \t]*\n+/);
+      parts.forEach((part, idx) => {
+        const nodes = decodeTextNodes(mdInline(part.replace(/\s+/g, " "), `${kb}t${n++}`));
+        if (!nodes.length) return;
+        if (idx === 0 || stack.length) cur().push(...nodes);
+        else out.push(h2("p", { key: `${kb}tp${n++}` }, ...nodes));
+      });
+    };
+    const closeTop = () => {
+      const f = stack.pop();
+      cur().push(f.build(f.kids));
+    };
+    const sepNode = (name, key) => {
+      const sep = HTML_UNWRAP_SEP[name];
+      if (sep === "br") cur().push(h2("br", { key }));
+      else if (sep === "sp") cur().push(" ");
+    };
+    HTML_TAG_RE.lastIndex = 0;
+    while (m = HTML_TAG_RE.exec(src)) {
+      if (m.index > last) pushText(src.slice(last, m.index));
+      const full = m[0];
+      const name = m[2].toLowerCase();
+      const key = `${kb}h${n++}`;
+      if (m[1]) {
+        const idx = stack.map((f) => f.name).lastIndexOf(name);
+        if (idx >= 0) {
+          while (stack.length > idx + 1) closeTop();
+          closeTop();
+        } else sepNode(name, key);
+      } else if (HTML_SKIP_TAGS.has(name)) {
+        const cm = new RegExp(`</${name}\\s*>`, "i").exec(src.slice(m.index + full.length));
+        HTML_TAG_RE.lastIndex = cm ? m.index + full.length + cm.index + cm[0].length : src.length;
+        last = HTML_TAG_RE.lastIndex;
+        continue;
+      } else if (name === "img") {
+        const attrs = parseHtmlAttrs(m[3]);
+        cur().push(h2(MdImg2, { key, src: attrs.src, alt: attrs.alt, title: attrs.title, style: htmlImgStyle(attrs) }));
+      } else if (name === "br" || name === "hr") {
+        cur().push(h2(name, { key }));
+      } else if (HTML_VOID_TAGS.has(name) || m[4]) {
+      } else if (HTML_INLINE_MAP[name]) {
+        const attrs = parseHtmlAttrs(m[3]);
+        if (name === "a") {
+          stack.push({ name, kids: [], build: (kids) => h2(ExtLink2, { key, href: attrs.href, title: attrs.title }, kids) });
+        } else {
+          const type = HTML_INLINE_MAP[name];
+          const style = htmlAlignStyle(attrs);
+          stack.push({ name, kids: [], build: (kids) => h2(type, style ? { key, style } : { key }, kids) });
+        }
+      } else if (/^h[1-6]$/.test(name)) {
+        const style = htmlAlignStyle(parseHtmlAttrs(m[3]));
+        const lvl = name;
+        stack.push({ name, kids: [], build: (kids) => h2(lvl, style ? { key, style } : { key }, kids) });
+      } else {
+        sepNode(name, key);
+      }
+      last = m.index + full.length;
     }
+    if (last < src.length) pushText(src.slice(last));
+    while (stack.length) closeTop();
     return out;
   }
-  function renderMarkdown2(src) {
-    return mdBlocks(String(src || "").replace(/\r\n?/g, "\n").split("\n"), "md");
+  function isInlineOnlyHtml(inner) {
+    const lines = String(inner).split("\n");
+    if (lines.some((l) => l !== "" && !l.trim())) return false;
+    return !lines.some((l) => {
+      if (/^\s*(#{1,6}\s|[-*+]\s|\d+[.)]\s|>|`|\|)/.test(l)) return true;
+      const tm = /^\s*<\/?([a-zA-Z][a-zA-Z0-9-]*)/.exec(l);
+      if (!tm) return false;
+      const name = tm[1].toLowerCase();
+      return !(name === "img" || name === "br" || name === "hr" || HTML_INLINE_MAP[name]);
+    });
+  }
+  function mdHtmlBlock(raw, kb, depth) {
+    const s = String(raw).trim();
+    if (depth > 8) return [s];
+    const om = /^<([a-zA-Z][a-zA-Z0-9-]*)((?:\s[^>]*)?)>/.exec(s);
+    if (!om) return mdHtmlInline(s, kb);
+    const tag = om[1].toLowerCase();
+    if (!HTML_BLOCK_WRAP.has(tag)) return mdHtmlInline(s, kb);
+    const cm = new RegExp(`</${tag}\\s*>\\s*$`, "i").exec(s.slice(om[0].length));
+    if (!cm) return mdHtmlInline(s, kb);
+    let inner = s.slice(om[0].length, om[0].length + cm.index);
+    const attrs = parseHtmlAttrs(om[2] || "");
+    const style = htmlAlignStyle(attrs);
+    const inlineKids = () => isInlineOnlyHtml(inner) ? mdHtmlInline(inner, kb) : renderMarkdown2(inner, depth + 1);
+    if (tag === "details") {
+      const sm = /<summary[^>]*>([\s\S]*?)<\/summary>/i.exec(inner);
+      let sumNode = null;
+      if (sm) {
+        inner = inner.slice(0, sm.index) + inner.slice(sm.index + sm[0].length);
+        sumNode = h2("summary", { key: `${kb}sum` }, ...mdHtmlInline(sm[1], `${kb}sm`));
+      }
+      const kids = sumNode ? [sumNode, ...inlineKids()] : inlineKids();
+      return [h2("details", attrs.open !== void 0 ? { key: kb, open: true } : { key: kb }, ...kids)];
+    }
+    if (/^h[1-6]$/.test(tag)) return [h2(tag, style ? { key: kb, style } : { key: kb }, ...mdHtmlInline(inner, kb))];
+    return [h2(tag, style ? { key: kb, style } : { key: kb }, ...inlineKids())];
+  }
+  function renderMarkdown2(src, opts = {}, depth = 0) {
+    const prev = RENDER_REPO;
+    RENDER_REPO = normalizeRepoInput(opts && opts.repo);
+    try {
+      return mdBlocks(String(src || "").replace(/\r\n?/g, "\n").split("\n"), "md", depth);
+    } finally {
+      RENDER_REPO = prev;
+    }
   }
   return { ExtLink: ExtLink2, MdImg: MdImg2, renderMarkdown: renderMarkdown2 };
 }
+var RENDER_REPO, HTML_ENTITIES, HTML_ENTITY_RE, HTML_TAG_RE, HTML_VOID_TAGS, HTML_SKIP_TAGS, HTML_BLOCK_WRAP, HTML_SPAN_BLANK, HTML_INLINE_MAP, HTML_UNWRAP_SEP;
 var init_markdown = __esm({
   "src/client/markdown.js"() {
     "use strict";
+    RENDER_REPO = "";
+    HTML_ENTITIES = { nbsp: "\xA0", amp: "&", lt: "<", gt: ">", quot: '"', apos: "'", copy: "\xA9", reg: "\xAE", trade: "\u2122", mdash: "\u2014", ndash: "\u2013", hellip: "\u2026", middot: "\xB7", laquo: "\xAB", raquo: "\xBB", times: "\xD7", divide: "\xF7", plusmn: "\xB1", deg: "\xB0", sup2: "\xB2", sup3: "\xB3", frac12: "\xBD", frac14: "\xBC", frac34: "\xBE", euro: "\u20AC", pound: "\xA3", yen: "\xA5", cent: "\xA2", sect: "\xA7", para: "\xB6", bull: "\u2022", dagger: "\u2020", Dagger: "\u2021", permil: "\u2030", prime: "\u2032", Prime: "\u2033", larr: "\u2190", uarr: "\u2191", rarr: "\u2192", darr: "\u2193", harr: "\u2194", minus: "\u2212", infin: "\u221E", ne: "\u2260", le: "\u2264", ge: "\u2265", asymp: "\u2248", equiv: "\u2261", check: "\u2713", cross: "\u2717", star: "\u2606", starf: "\u2605", hearts: "\u2665", alpha: "\u03B1", beta: "\u03B2", gamma: "\u03B3", delta: "\u03B4", pi: "\u03C0", Omega: "\u03A9", ldquo: "\u201C", rdquo: "\u201D", lsquo: "\u2018", rsquo: "\u2019" };
+    HTML_ENTITY_RE = /&(#[0-9]+|#x[0-9a-fA-F]+|[a-zA-Z][a-zA-Z0-9]*);/g;
+    HTML_TAG_RE = /<(\/?)([a-zA-Z][a-zA-Z0-9-]*)((?:\s+[a-zA-Z][a-zA-Z0-9-]*(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s"'=<>`]+))?)*)\s*(\/?)>/g;
+    HTML_VOID_TAGS = /* @__PURE__ */ new Set(["br", "hr", "img", "source", "input", "wbr", "area", "col", "link", "meta"]);
+    HTML_SKIP_TAGS = /* @__PURE__ */ new Set(["script", "style", "iframe", "object", "embed", "noscript", "svg", "title", "textarea", "select", "video", "audio", "canvas", "template", "form", "button", "head"]);
+    HTML_BLOCK_WRAP = /* @__PURE__ */ new Set(["p", "div", "center", "blockquote", "details", "ul", "ol", "li", "table", "thead", "tbody", "tr", "td", "th", "figure", "figcaption", "section", "article", "main", "header", "footer", "nav", "aside", "dl", "dt", "dd"]);
+    HTML_SPAN_BLANK = /* @__PURE__ */ new Set(["details", "div", "blockquote", "table", "thead", "tbody", "tr", "ul", "ol", "dl", "figure", "section", "article", "td", "th", "li"]);
+    HTML_INLINE_MAP = { a: "a", strong: "strong", b: "strong", em: "em", i: "em", del: "del", s: "del", strike: "del", code: "code", kbd: "kbd", sub: "sub", sup: "sup", u: "u", small: "small", mark: "mark", span: "span" };
+    HTML_UNWRAP_SEP = { tr: "br", li: "br", p: "br", h1: "br", h2: "br", h3: "br", h4: "br", h5: "br", h6: "br", table: "br", ul: "br", ol: "br", td: "sp", th: "sp" };
   }
 });
 
@@ -2031,6 +2260,12 @@ button.dshm-badge:hover{filter:brightness(.95)}
 .dshm-readme.md th{background:var(--dsw-alias-bg-layer-2,rgba(127,127,127,.1))}
 .dshm-readme.md hr{border:0;border-top:1px solid var(--dsw-alias-border-l2,#cbd5e1);margin:8px 0}
 .dshm-readme.md .dshm-md-note{margin-top:8px;padding-top:6px;border-top:1px dashed var(--dsw-alias-border-l2,#cbd5e1);color:var(--dsw-alias-label-caption,#9ca3af);font-size:11px}
+/* 0.9.47 HTML \u5B50\u96C6\uFF1Adetails/summary/kbd/mark \u4E0E li\xB7td \u5185\u5C42 p \u95F4\u8DDD\u6536\u655B */
+.dshm-readme.md details{border:1px solid var(--dsw-alias-border-l2,#e5e7eb);border-radius:8px;padding:4px 10px;margin:6px 0}
+.dshm-readme.md summary{cursor:pointer;font-weight:600;margin:2px 0}
+.dshm-readme.md kbd{background:rgba(127,127,127,.16);border:1px solid var(--dsw-alias-border-l2,#cbd5e1);border-bottom-width:2px;border-radius:4px;padding:0 4px;font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:11px}
+.dshm-readme.md mark{background:rgba(255,213,0,.35);color:inherit;border-radius:2px;padding:0 2px}
+.dshm-readme.md li>p,.dshm-readme.md td>p,.dshm-readme.md th>p,.dshm-readme.md summary>p,.dshm-readme.md p>p{margin:2px 0}
 .dshm-links{display:flex;align-items:center;gap:6px;flex-wrap:wrap;margin-top:7px;padding-top:6px;border-top:1px solid var(--dsw-alias-border-l2,#e5e7eb);font-size:11px;color:var(--dsw-alias-label-caption,#6b7280)}
 .dshm-links-k,.dshm-links-sep{color:var(--dsw-alias-label-caption,#9ca3af)}
 .dshm-links a{color:var(--dsw-alias-state-business-primary,#4d6bfe);text-decoration:none;font-weight:500}
@@ -2655,7 +2890,7 @@ function DetailModal({ it, labels, busy, onClose, onInstall, onUpgrade, upgradeB
           if (e.target.open) setRmOpen(true);
         } },
         h("summary", null, lookup("readme.show")),
-        rmOpen ? h(ReadmeBlock, { pkg: it.npm }) : h("div", { className: "dshm-hint" }, lookup("readme.loading"))
+        rmOpen ? h(ReadmeBlock, { pkg: it.npm, repo: it.github }) : h("div", { className: "dshm-hint" }, lookup("readme.loading"))
       ) : null,
       shots.length ? h(
         "div",
@@ -3169,11 +3404,11 @@ function ProgressLine() {
     st.currentPackage ? h("span", { className: "dshm-hint" }, String(st.currentPackage).slice(0, 44)) : null
   );
 }
-function ReadmeBlock({ pkg }) {
-  const [state, setState] = useState({ loading: true, text: "", err: "", truncated: false });
+function ReadmeBlock({ pkg, repo }) {
+  const [state, setState] = useState({ loading: true, text: "", err: "", truncated: false, repo: "" });
   useEffect(() => {
     let live = true;
-    api("readme", { pkg }).then((d) => live && setState({ loading: false, text: d.readme, err: "", truncated: d.truncated })).catch((e) => live && setState({ loading: false, text: "", err: String(e && e.message || e) }));
+    api("readme", { pkg }).then((d) => live && setState({ loading: false, text: d.readme, err: "", truncated: d.truncated, repo: d.repo || "" })).catch((e) => live && setState({ loading: false, text: "", err: String(e && e.message || e) }));
     return () => {
       live = false;
     };
@@ -3184,7 +3419,7 @@ function ReadmeBlock({ pkg }) {
   return h(
     "div",
     { className: "dshm-readme md", onClick: (e) => e.stopPropagation() },
-    renderMarkdown(state.text),
+    renderMarkdown(state.text, { repo: state.repo || repo }),
     state.truncated ? h("div", { className: "dshm-md-note" }, lookup("readme.truncated")) : null
   );
 }
@@ -3325,7 +3560,7 @@ function InstalledTab({ notify, installed, updates, onMutation, ops }) {
           }),
           open: openPkg === it.pkg,
           onToggle: () => setOpenPkg(openPkg === it.pkg ? null : it.pkg),
-          detail: readmePkg === it.pkg ? h(ReadmeBlock, { pkg: it.pkg }) : DetailRows([
+          detail: readmePkg === it.pkg ? h(ReadmeBlock, { pkg: it.pkg, repo: it.github }) : DetailRows([
             [lookup("detail.pkg"), it.pkg],
             [lookup("detail.spec"), it.spec],
             [lookup("detail.latest"), vm.latestLabelDetail],

package/lib/core/host-api.js

@@ -449,7 +449,7 @@ export function createApiDispatcher(ctx) {
                     catch (localErr) {
                         try {
                             const fallback = await d.npmPackumentReadme(target);
-                            result = { pkg: target, name: target, readme: fallback.readme, truncated: false };
+                            result = { pkg: target, name: target, readme: fallback.readme, truncated: false, repo: fallback.repo || undefined };
                         }
                         catch {
                             throw localErr;

package/lib/core/versions.js

@@ -113,11 +113,28 @@ export async function npmPackument(pkg, timeoutMs = 20_000, signal, registry, de
     const versions = data?.versions !== null && typeof data?.versions === 'object' ? Object.keys(data.versions) : [];
     return { versions };
 }
+/**
+ * packument repository → "owner/repo"（仅 github.com；git+https / git@ / .git / #frag 归一；
+ * 非 GitHub 返回空串——README 相对路径锚定只对 GitHub raw/blob 有意义）。0.9.48。
+ */
+export function extractGithubRepo(v) {
+    const url = typeof v === 'string'
+        ? v
+        : v && typeof v === 'object' && typeof v.url === 'string'
+            ? v.url
+            : '';
+    if (!url)
+        return '';
+    const m = /github\.com[/:]([A-Za-z0-9._-]+)\/([A-Za-z0-9._-]+?)(?:\.git)?(?:[/?#]|$)/i.exec(url);
+    return m ? `${m[1]}/${m[2]}` : '';
+}
 /**
  * npm packument readme 兜底（0.9.45 U10b 修复）：市场/收藏详情 Modal 的 README 折叠页对
  * 「未安装」条目无法走本地 profile 读取——回源 packument 顶层 readme 字段（publish 管线
  * 对多数包写入）。安全基线同 npmPackument：HTTPS、8MB 上限、超时；无 readme 字段返回空串
  * （不抛，客户端显示「没有 README」）；L1（ADR-0012）：显式 registry 参数 > 生效源。
+ * 0.9.48：随附 repo（packument repository 归一为 owner/repo，仅 GitHub），供 README
+ * 相对链接/图片锚定仓库基址；无 repository 或非 GitHub 时为空串。
  */
 export async function npmPackumentReadme(pkg, timeoutMs = 20_000, signal, registry, deps) {
     if (!/^@?[A-Za-z0-9-._~]+(\/[A-Za-z0-9-._~]+)?$/.test(pkg))
@@ -130,7 +147,7 @@ export async function npmPackumentReadme(pkg, timeoutMs = 20_000, signal, regist
         maxBytes: 8 * 1024 * 1024,
     });
     const readme = typeof data?.readme === 'string' && data.readme.trim() !== '' ? data.readme : '';
-    return { readme };
+    return { readme, repo: extractGithubRepo(data?.repository) };
 }
 /**
  * 升级探测（检测读）。L3 权威链（ADR-0012）：新鲜度敏感——npmjs 权威源优先

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-m",
-  "version": "0.9.46",
+  "version": "0.9.48",
   "description": "可自定义收录清单的 DSH 插件市场：收录、安装、卸载、升级一站完成，附 agent 工具与 dshm CLI。",
   "license": "MIT",
   "type": "module",