dsh-m 0.9.47 → 0.9.48

package/CHANGELOG.md

@@ -8,6 +8,13 @@ The full release history of dsh-m, maintained bilingually: **Chinese first, Engl
 
 ## 中文
 
+### 0.9.48 变更：README 实体解码 + 相对路径仓库基址锚定（0.9.47 实装反馈两连修）
+
+- **HTML 实体解码**：0.9.47 解析了标签但未解码实体——dsh-task-board 类 README 徽章间独立成行的 ` ` 按字面漏出。现命名实体（nbsp/amp/lt/gt/quot/copy/mdash/箭头/分数等 60+ 高频集）与数字实体（十进制/十六进制）均解码；文本段与 HTML 属性值都解（徽章 src 里 `&labelColor` → `&labelColor`，shields 参数不再丢失）；`code`/`pre` 内不解码；未知实体与裸 `&` 原样保留；单趟解码不回炉（`<` → `<` 文本，与浏览器一致），解码结果只作为文本节点、绝不重新参与标签解析，无注入面。
+- **行内优先判定**：包裹标签（`<p align="center">` 等）剥壳后，若内部无空行分段、无 markdown 块结构、且行首标签均为行内/void 标签，则整块按行内 token 流渲染——徽章 + `&nbsp;` 连排在同一居中行（GitHub 语义），不再每行拆成独立段落；含块级结构（`tr/td/ul/li` 开头等）仍走 markdown 递归保结构。
+- **相对路径仓库基址锚定**：`[README.md](README.md)` 这类相对链接此前被 safeUrl 归 `#`（点击无反应——既有安全归化，非 0.9.47 回归）。现 README 预览可携带仓库基址：相对链接锚 `github.com/<o>/<r>/blob/HEAD/<path>`、相对图片锚 `raw.githubusercontent.com/<o>/<r>/HEAD/<path>`（`./`/`../` 前缀归一）；绝对 URL 与页内锚点不受影响；无基址时保持归 `#` 旧行为。数据链路：npm packument 兜底时顺带提取 `repository` 归一为 `owner/repo`（仅 GitHub，git+https/git@/.git 形态归一，host-api 透传 `repo` 字段）；客户端以卡片 `github` 字段兜底；渲染基址为 renderMarkdown 级同步设置、进出恢复，不跨渲染泄漏。
+- **测试**：client-markdown 净增 6 例（实体四类、独立 `&nbsp;` 徽章块、code 不解码与属性解码、基址锚定七断言、无基址回归与跨渲染泄漏）；versions 净增 1 例（repository 两形态归一 + 非 GitHub 归空）；全量 1181/1181、typecheck 零错误；真实数据端到端——dsh-TUI 25926 字符零泄漏零回归、task-board 真实徽章块三徽章一行居中 + `&amp;` 解码、相对链接正确锚 blob/HEAD。纯客户端变更，刷新页面即生效。
+
 ### 0.9.47 变更：README 预览内嵌 HTML 子集渲染（GitHub 风 README 不再满屏标签）
 
 - **问题**：市场/收藏/已装详情 Modal 的 README 折叠页，遇到 GitHub 风重度内嵌 HTML 的 README（`<p align="center">` 徽章墙、`<img>` Logo、`<details>` 折叠等——npm packument 兜底与本地读取都常见）会把标签按字面整屏显示，观感如「乱码」。根因是渲染端自研 markdown 渲染器此前完全不解析 HTML 标签（原始内容本身没有问题，GitHub 上渲染正常）。
@@ -357,6 +364,13 @@ The full release history of dsh-m, maintained bilingually: **Chinese first, Engl
 
 ## English
 
+### Added in 0.9.48 — README entity decoding + repo-base anchoring for relative paths (two fixes from 0.9.47 field feedback)
+
+- **HTML entity decoding**: 0.9.47 parsed tags but left entities raw — standalone `&nbsp;` lines between badges (dsh-task-board-style READMEs) leaked literally. Named entities (nbsp/amp/lt/gt/quot/copy/mdash/arrows/fractions — 60+ common set) and numeric entities (decimal/hex) now decode; both text runs and HTML attribute values decode (badge src `&amp;labelColor` → `&labelColor`, shields params no longer dropped); `code`/`pre` content stays literal; unknown entities and bare `&` are preserved; single-pass decoding without re-processing (`&amp;lt;` → `&lt;` as text, matching browsers). Decoded output only ever becomes text nodes — never re-parsed as tags, no injection surface.
+- **Inline-first heuristic**: after unwrapping a block wrapper (`<p align="center">` etc.), if the inner content has no blank-line paragraph breaks, no markdown block structures, and every line starts with an inline/void tag, the whole block renders through the inline token stream — badges + `&nbsp;` flow on one centered line (GitHub semantics) instead of one paragraph per line; content with block structures (lines starting with `tr/td/ul/li` etc.) still goes through the markdown recursion to preserve structure.
+- **Repo-base anchoring for relative paths**: relative links like `[README.md](README.md)` previously collapsed to `#` via safeUrl (inert click — long-standing normalization, not a 0.9.47 regression). The README preview can now carry a repository base: relative links anchor to `github.com/<o>/<r>/blob/HEAD/<path>`, relative images anchor to `raw.githubusercontent.com/<o>/<r>/HEAD/<path>` (`./`/`../` prefixes normalized); absolute URLs and in-page anchors are untouched; without a base the old `#` behavior applies. Data flow: the npm packument fallback now also extracts `repository`, normalized to `owner/repo` (GitHub only; git+https/git@/.git forms normalized) and passed through host-api as `repo`; the client falls back to the card's `github` field; the render base is set per renderMarkdown call and restored on exit — no cross-render leakage.
+- **Testing**: 6 new cases in client-markdown (four entity classes, standalone-`&nbsp;` badge block, code no-decode + attribute decoding, seven anchoring assertions, no-base regression + cross-render leakage); 1 new versions case (repository normalization in both shapes + non-GitHub → empty); full suite 1181/1181, typecheck clean; real-data end-to-end — dsh-TUI 25,926 chars zero leaks zero regression, the real task-board badge block renders three badges on one centered line with `&amp;` decoded, relative links anchor to blob/HEAD correctly. Client-only change — a page refresh takes effect.
+
 ### Added in 0.9.47 — embedded-HTML subset rendering for the README preview (GitHub-style READMEs no longer show raw tags)
 
 - **Problem**: the README fold in the detail Modal (market/curated/installed) showed GitHub-style HTML-heavy READMEs (`<p align="center">` badge walls, `<img>` logos, `<details>` blocks — common in both the npm packument fallback and local reads) with every tag rendered literally, looking like mojibake. Root cause: the in-house markdown renderer never parsed HTML tags at all. The source content itself was fine — GitHub renders it normally.

package/docs/DESIGN.md

@@ -182,7 +182,7 @@ npm 安装 / GitHub 安装 / 升级 / 自升级 / 卸载是**同一个事务模
 技术：`src/client.js` 经 **esbuild** 打包为 `lib/client.js`；`window.__ModuleLoader__.load({ id: "dsh-m", factory })` 注册；**React 从 module loader require**（零额外运行时依赖）；manifest 注入 `@deepseek-ai/dsh-client-runtime`、`@deepseek-ai/dsh-client-ui-slots`、`@deepseek-ai/dsh-client-ui-settings`。
 图标：GitHub 来源自动用 `https://github.com/<owner>.png?size=64`；`icon` 字段可覆盖；npm-only 条目首字母色块回退。
 
-**README 预览渲染（`src/client/markdown.js`，0.9.47 起）**：自研轻量渲染器，安全模型 = 「白名单标签 + 白名单属性 + safeUrl 闸门 → 全部经 `h()` 构造 React 元素」，**绝不注入原始 HTML 字符串**（无 `dangerouslySetInnerHTML`，文本节点 React 转义兜底）。markdown 侧支持标题/列表/表格/围栏/引用/徽章链接等；HTML 侧支持 GitHub 风 README 常见内嵌子集——块级包裹标签（`p/div/center/details/table/tr/td/li/ul/ol/h1-6` 等）剥壳后按 markdown 递归（保内部结构），行内标签（`a/img/strong/em/code/kbd/mark/br/sub/sup` 等）token 化渲染，`align` 属性映射 `textAlign`、`<img width/height>` 映射显式尺寸（放开徽章 20px 高度帽）；未知标签剥壳留文本，`script/style/svg/iframe` 等容器连同内容丢弃，`javascript:` 等危险 URL 归 `#`。已知边界：npm packument 兜底的 README 不携带仓库基址，相对路径图片（如 `docs/assets/x.svg`）按 safeUrl 归 `#` 后由 onError 隐藏；行内文本含标签的解析粒度到段落级（`Press <kbd>Ctrl</kbd>` 类可渲染）。数据源：已装条目读 profile 本地 `README.md`（≤64KB 截断）；未装条目回源 npm packument 顶层 `readme` 字段（0.9.45 U10b）。
+**README 预览渲染（`src/client/markdown.js`，0.9.47 起）**：自研轻量渲染器，安全模型 = 「白名单标签 + 白名单属性 + safeUrl 闸门 → 全部经 `h()` 构造 React 元素」，**绝不注入原始 HTML 字符串**（无 `dangerouslySetInnerHTML`，文本节点 React 转义兜底）。markdown 侧支持标题/列表/表格/围栏/引用/徽章链接等；HTML 侧支持 GitHub 风 README 常见内嵌子集——块级包裹标签（`p/div/center/details/table/tr/td/li/ul/ol/h1-6` 等）剥壳后渲染：内容纯行内（无空行分段/无 markdown 块结构/行首均为行内标签）时整块行走内 token 流（徽章 + `&nbsp;` 连排一行，GitHub 语义，0.9.48），否则按 markdown 递归（保内部结构）；行内标签（`a/img/strong/em/code/kbd/mark/br/sub/sup` 等）token 化渲染，`align` 属性映射 `textAlign`、`<img width/height>` 映射显式尺寸（放开徽章 20px 高度帽）；未知标签剥壳留文本，`script/style/svg/iframe` 等容器连同内容丢弃，`javascript:` 等危险 URL 归 `#`。**HTML 实体解码（0.9.48）**：命名（60+ 高频集）+ 数字（十/十六进制），文本段与属性值都解、`code/pre` 不解、单趟不回炉、解码结果仅作文本节点。**仓库基址锚定（0.9.48）**：`renderMarkdown(src, { repo: "owner/repo" })` 后相对链接锚 `github.com/<o>/<r>/blob/HEAD/`、相对图片锚 `raw.githubusercontent.com/<o>/<r>/HEAD/`；基址来源 = npm packument `repository`（host-api readme 结果 `repo` 字段，仅 GitHub 归一）> 卡片 `github` 字段；无基址时相对路径归 `#`（0.9.47 前行为）。已知边界：monorepo 子目录 README 的相对路径锚到仓库根（packument 不携带子目录信息）；绝对 URL 与页内锚点不受锚定影响。数据源：已装条目读 profile 本地 `README.md`（≤64KB 截断）；未装条目回源 npm packument 顶层 `readme` 字段（0.9.45 U10b）。
 
 ## 5. Agent 工具（host）与 CLI
 

package/lib/client.js

@@ -399,20 +399,48 @@ var init_backdrop = __esm({
 var markdown_exports = {};
 __export(markdown_exports, {
   createMarkdown: () => createMarkdown,
+  decodeEntities: () => decodeEntities,
   safeUrl: () => safeUrl
 });
-function safeUrl(u) {
+function normalizeRepoInput(v) {
+  const s = String(v || "").trim();
+  if (!s) return "";
+  if (/^[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+$/.test(s)) return s;
+  const m = /github\.com[/:]([a-zA-Z0-9._-]+)\/([a-zA-Z0-9._-]+?)(?:\.git)?(?:[/?#]|$)/i.exec(s);
+  return m ? `${m[1]}/${m[2]}` : "";
+}
+function safeUrl(u, kind) {
   const t = String(u || "").trim();
   if (/^(https?:\/\/|mailto:)/i.test(t)) return t;
-  if (/^[/#]/.test(t)) return t;
+  if (t.startsWith("#")) return t;
+  if (RENDER_REPO && (kind === "img" || kind === "link")) {
+    const path = t.replace(/^(?:\.\/|\.\.\/|\/)+/, "");
+    return kind === "img" ? `https://raw.githubusercontent.com/${RENDER_REPO}/HEAD/${path}` : `https://github.com/${RENDER_REPO}/blob/HEAD/${path}`;
+  }
+  if (t.startsWith("/")) return t;
   return "#";
 }
+function decodeEntities(s) {
+  const t = String(s || "");
+  if (!t.includes("&")) return t;
+  return t.replace(HTML_ENTITY_RE, (raw, body) => {
+    if (body.startsWith("#")) {
+      const code = body[1] === "x" || body[1] === "X" ? parseInt(body.slice(2), 16) : parseInt(body.slice(1), 10);
+      return Number.isInteger(code) && code > 0 && code <= 1114111 ? String.fromCodePoint(code) : raw;
+    }
+    const named = HTML_ENTITIES[body] !== void 0 ? HTML_ENTITIES[body] : HTML_ENTITIES[body.toLowerCase()];
+    return named !== void 0 ? named : raw;
+  });
+}
 function parseHtmlAttrs(s) {
   const attrs = {};
   if (!s) return attrs;
   const re = /([a-zA-Z][a-zA-Z0-9-]*)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g;
   let m;
-  while (m = re.exec(s)) attrs[m[1].toLowerCase()] = m[2] !== void 0 ? m[2] : m[3] !== void 0 ? m[3] : m[4] !== void 0 ? m[4] : "";
+  while (m = re.exec(s)) {
+    const raw = m[2] !== void 0 ? m[2] : m[3] !== void 0 ? m[3] : m[4] !== void 0 ? m[4] : "";
+    attrs[m[1].toLowerCase()] = decodeEntities(raw);
+  }
   return attrs;
 }
 function htmlAlignStyle(attrs) {
@@ -451,13 +479,30 @@ function htmlBlockEnd(lines, i) {
   }
   return lastNonBlank;
 }
+function decodeTextNodes(nodes) {
+  return nodes.map((n) => {
+    if (typeof n === "string") return decodeEntities(n);
+    if (Array.isArray(n)) return decodeTextNodes(n);
+    if (n && typeof n === "object" && n.type !== "code" && n.type !== "pre") {
+      const cur = n.props && n.props.children !== void 0 ? n.props.children : n.children;
+      if (cur !== void 0) {
+        const wasArr = Array.isArray(cur);
+        const decoded = decodeTextNodes(wasArr ? cur : [cur]);
+        const next = wasArr ? decoded : decoded[0];
+        if (n.props && n.props.children !== void 0) return { ...n, props: { ...n.props, children: next } };
+        return { ...n, children: next };
+      }
+    }
+    return n;
+  });
+}
 function createMarkdown(h2) {
   function ExtLink2({ href, className, children }) {
     return h2(
       "a",
       {
         className: className || "dshm-md-a",
-        href: safeUrl(href),
+        href: safeUrl(href, "link"),
         target: "_blank",
         rel: "noopener noreferrer",
         onClick: (e) => e.stopPropagation()
@@ -468,7 +513,7 @@ function createMarkdown(h2) {
   function MdImg2({ src, alt, style, title }) {
     return h2("img", {
       className: "dshm-md-img",
-      src: safeUrl(src),
+      src: safeUrl(src, "img"),
       alt: alt || "",
       title: title || void 0,
       style: style || void 0,
@@ -494,7 +539,7 @@ function createMarkdown(h2) {
         const lm = /\]\(([^)]*)\)\s*$/.exec(tok);
         const img = h2(MdImg2, { src: im && im[2], alt: im && im[1] });
         const href = lm && lm[1];
-        nodes.push(href && safeUrl(href) !== "#" ? h2(ExtLink2, { key: k, href }, img) : h2("span", { key: k }, img));
+        nodes.push(href && safeUrl(href, "link") !== "#" ? h2(ExtLink2, { key: k, href }, img) : h2("span", { key: k }, img));
       } else if (tok.startsWith("![") || tok.startsWith("<![")) {
         const im = /^!\[([^\]]*)\]\(([^)]*)\)$/.exec(tok);
         nodes.push(h2(MdImg2, { key: k, src: im && im[2], alt: im && im[1] }));
@@ -532,7 +577,7 @@ function createMarkdown(h2) {
     const isOl = (s) => /^\s*\d+[.)]\s+/.test(s);
     const isTableRow = (s) => s.includes("|") && /^\s*\|/.test(s);
     const isHtmlBlock = (s) => /^\s*<\/?[a-zA-Z][a-zA-Z0-9-]*(?:\s[^>]*?)?\/?>/.test(s);
-    const inlineOf = (s, key) => /<[a-zA-Z]/.test(s) ? mdHtmlInline(s, key) : mdInline(s, key);
+    const inlineOf = (s, key) => decodeTextNodes(/<[a-zA-Z]/.test(s) ? mdHtmlInline(s, key) : mdInline(s, key));
     while (i < lines.length) {
       const line = lines[i];
       if (!line.trim()) {
@@ -620,13 +665,14 @@ function createMarkdown(h2) {
     const cur = () => stack.length ? stack[stack.length - 1].kids : out;
     const pushText = (t) => {
       if (!t) return;
-      if (!String(t).trim()) {
-        cur().push(" ");
+      const t2 = decodeEntities(t);
+      if (!t2.trim()) {
+        if (cur().length) cur().push(" ");
         return;
       }
-      const parts = String(t).split(/\n[ \t]*\n+/);
+      const parts = t2.split(/\n[ \t]*\n+/);
       parts.forEach((part, idx) => {
-        const nodes = mdInline(part.replace(/\s+/g, " "), `${kb}t${n++}`);
+        const nodes = decodeTextNodes(mdInline(part.replace(/\s+/g, " "), `${kb}t${n++}`));
         if (!nodes.length) return;
         if (idx === 0 || stack.length) cur().push(...nodes);
         else out.push(h2("p", { key: `${kb}tp${n++}` }, ...nodes));
@@ -686,6 +732,17 @@ function createMarkdown(h2) {
     while (stack.length) closeTop();
     return out;
   }
+  function isInlineOnlyHtml(inner) {
+    const lines = String(inner).split("\n");
+    if (lines.some((l) => l !== "" && !l.trim())) return false;
+    return !lines.some((l) => {
+      if (/^\s*(#{1,6}\s|[-*+]\s|\d+[.)]\s|>|`|\|)/.test(l)) return true;
+      const tm = /^\s*<\/?([a-zA-Z][a-zA-Z0-9-]*)/.exec(l);
+      if (!tm) return false;
+      const name = tm[1].toLowerCase();
+      return !(name === "img" || name === "br" || name === "hr" || HTML_INLINE_MAP[name]);
+    });
+  }
   function mdHtmlBlock(raw, kb, depth) {
     const s = String(raw).trim();
     if (depth > 8) return [s];
@@ -698,6 +755,7 @@ function createMarkdown(h2) {
     let inner = s.slice(om[0].length, om[0].length + cm.index);
     const attrs = parseHtmlAttrs(om[2] || "");
     const style = htmlAlignStyle(attrs);
+    const inlineKids = () => isInlineOnlyHtml(inner) ? mdHtmlInline(inner, kb) : renderMarkdown2(inner, depth + 1);
     if (tag === "details") {
       const sm = /<summary[^>]*>([\s\S]*?)<\/summary>/i.exec(inner);
       let sumNode = null;
@@ -705,21 +763,30 @@ function createMarkdown(h2) {
         inner = inner.slice(0, sm.index) + inner.slice(sm.index + sm[0].length);
         sumNode = h2("summary", { key: `${kb}sum` }, ...mdHtmlInline(sm[1], `${kb}sm`));
       }
-      const kids = sumNode ? [sumNode, ...renderMarkdown2(inner, depth + 1)] : renderMarkdown2(inner, depth + 1);
+      const kids = sumNode ? [sumNode, ...inlineKids()] : inlineKids();
       return [h2("details", attrs.open !== void 0 ? { key: kb, open: true } : { key: kb }, ...kids)];
     }
     if (/^h[1-6]$/.test(tag)) return [h2(tag, style ? { key: kb, style } : { key: kb }, ...mdHtmlInline(inner, kb))];
-    return [h2(tag, style ? { key: kb, style } : { key: kb }, ...renderMarkdown2(inner, depth + 1))];
+    return [h2(tag, style ? { key: kb, style } : { key: kb }, ...inlineKids())];
   }
-  function renderMarkdown2(src, depth = 0) {
-    return mdBlocks(String(src || "").replace(/\r\n?/g, "\n").split("\n"), "md", depth);
+  function renderMarkdown2(src, opts = {}, depth = 0) {
+    const prev = RENDER_REPO;
+    RENDER_REPO = normalizeRepoInput(opts && opts.repo);
+    try {
+      return mdBlocks(String(src || "").replace(/\r\n?/g, "\n").split("\n"), "md", depth);
+    } finally {
+      RENDER_REPO = prev;
+    }
   }
   return { ExtLink: ExtLink2, MdImg: MdImg2, renderMarkdown: renderMarkdown2 };
 }
-var HTML_TAG_RE, HTML_VOID_TAGS, HTML_SKIP_TAGS, HTML_BLOCK_WRAP, HTML_SPAN_BLANK, HTML_INLINE_MAP, HTML_UNWRAP_SEP;
+var RENDER_REPO, HTML_ENTITIES, HTML_ENTITY_RE, HTML_TAG_RE, HTML_VOID_TAGS, HTML_SKIP_TAGS, HTML_BLOCK_WRAP, HTML_SPAN_BLANK, HTML_INLINE_MAP, HTML_UNWRAP_SEP;
 var init_markdown = __esm({
   "src/client/markdown.js"() {
     "use strict";
+    RENDER_REPO = "";
+    HTML_ENTITIES = { nbsp: "\xA0", amp: "&", lt: "<", gt: ">", quot: '"', apos: "'", copy: "\xA9", reg: "\xAE", trade: "\u2122", mdash: "\u2014", ndash: "\u2013", hellip: "\u2026", middot: "\xB7", laquo: "\xAB", raquo: "\xBB", times: "\xD7", divide: "\xF7", plusmn: "\xB1", deg: "\xB0", sup2: "\xB2", sup3: "\xB3", frac12: "\xBD", frac14: "\xBC", frac34: "\xBE", euro: "\u20AC", pound: "\xA3", yen: "\xA5", cent: "\xA2", sect: "\xA7", para: "\xB6", bull: "\u2022", dagger: "\u2020", Dagger: "\u2021", permil: "\u2030", prime: "\u2032", Prime: "\u2033", larr: "\u2190", uarr: "\u2191", rarr: "\u2192", darr: "\u2193", harr: "\u2194", minus: "\u2212", infin: "\u221E", ne: "\u2260", le: "\u2264", ge: "\u2265", asymp: "\u2248", equiv: "\u2261", check: "\u2713", cross: "\u2717", star: "\u2606", starf: "\u2605", hearts: "\u2665", alpha: "\u03B1", beta: "\u03B2", gamma: "\u03B3", delta: "\u03B4", pi: "\u03C0", Omega: "\u03A9", ldquo: "\u201C", rdquo: "\u201D", lsquo: "\u2018", rsquo: "\u2019" };
+    HTML_ENTITY_RE = /&(#[0-9]+|#x[0-9a-fA-F]+|[a-zA-Z][a-zA-Z0-9]*);/g;
     HTML_TAG_RE = /<(\/?)([a-zA-Z][a-zA-Z0-9-]*)((?:\s+[a-zA-Z][a-zA-Z0-9-]*(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s"'=<>`]+))?)*)\s*(\/?)>/g;
     HTML_VOID_TAGS = /* @__PURE__ */ new Set(["br", "hr", "img", "source", "input", "wbr", "area", "col", "link", "meta"]);
     HTML_SKIP_TAGS = /* @__PURE__ */ new Set(["script", "style", "iframe", "object", "embed", "noscript", "svg", "title", "textarea", "select", "video", "audio", "canvas", "template", "form", "button", "head"]);
@@ -2823,7 +2890,7 @@ function DetailModal({ it, labels, busy, onClose, onInstall, onUpgrade, upgradeB
           if (e.target.open) setRmOpen(true);
         } },
         h("summary", null, lookup("readme.show")),
-        rmOpen ? h(ReadmeBlock, { pkg: it.npm }) : h("div", { className: "dshm-hint" }, lookup("readme.loading"))
+        rmOpen ? h(ReadmeBlock, { pkg: it.npm, repo: it.github }) : h("div", { className: "dshm-hint" }, lookup("readme.loading"))
       ) : null,
       shots.length ? h(
         "div",
@@ -3337,11 +3404,11 @@ function ProgressLine() {
     st.currentPackage ? h("span", { className: "dshm-hint" }, String(st.currentPackage).slice(0, 44)) : null
   );
 }
-function ReadmeBlock({ pkg }) {
-  const [state, setState] = useState({ loading: true, text: "", err: "", truncated: false });
+function ReadmeBlock({ pkg, repo }) {
+  const [state, setState] = useState({ loading: true, text: "", err: "", truncated: false, repo: "" });
   useEffect(() => {
     let live = true;
-    api("readme", { pkg }).then((d) => live && setState({ loading: false, text: d.readme, err: "", truncated: d.truncated })).catch((e) => live && setState({ loading: false, text: "", err: String(e && e.message || e) }));
+    api("readme", { pkg }).then((d) => live && setState({ loading: false, text: d.readme, err: "", truncated: d.truncated, repo: d.repo || "" })).catch((e) => live && setState({ loading: false, text: "", err: String(e && e.message || e) }));
     return () => {
       live = false;
     };
@@ -3352,7 +3419,7 @@ function ReadmeBlock({ pkg }) {
   return h(
     "div",
     { className: "dshm-readme md", onClick: (e) => e.stopPropagation() },
-    renderMarkdown(state.text),
+    renderMarkdown(state.text, { repo: state.repo || repo }),
     state.truncated ? h("div", { className: "dshm-md-note" }, lookup("readme.truncated")) : null
   );
 }
@@ -3493,7 +3560,7 @@ function InstalledTab({ notify, installed, updates, onMutation, ops }) {
           }),
           open: openPkg === it.pkg,
           onToggle: () => setOpenPkg(openPkg === it.pkg ? null : it.pkg),
-          detail: readmePkg === it.pkg ? h(ReadmeBlock, { pkg: it.pkg }) : DetailRows([
+          detail: readmePkg === it.pkg ? h(ReadmeBlock, { pkg: it.pkg, repo: it.github }) : DetailRows([
             [lookup("detail.pkg"), it.pkg],
             [lookup("detail.spec"), it.spec],
             [lookup("detail.latest"), vm.latestLabelDetail],

package/lib/core/host-api.js

@@ -449,7 +449,7 @@ export function createApiDispatcher(ctx) {
                     catch (localErr) {
                         try {
                             const fallback = await d.npmPackumentReadme(target);
-                            result = { pkg: target, name: target, readme: fallback.readme, truncated: false };
+                            result = { pkg: target, name: target, readme: fallback.readme, truncated: false, repo: fallback.repo || undefined };
                         }
                         catch {
                             throw localErr;

package/lib/core/versions.js

@@ -113,11 +113,28 @@ export async function npmPackument(pkg, timeoutMs = 20_000, signal, registry, de
     const versions = data?.versions !== null && typeof data?.versions === 'object' ? Object.keys(data.versions) : [];
     return { versions };
 }
+/**
+ * packument repository → "owner/repo"（仅 github.com；git+https / git@ / .git / #frag 归一；
+ * 非 GitHub 返回空串——README 相对路径锚定只对 GitHub raw/blob 有意义）。0.9.48。
+ */
+export function extractGithubRepo(v) {
+    const url = typeof v === 'string'
+        ? v
+        : v && typeof v === 'object' && typeof v.url === 'string'
+            ? v.url
+            : '';
+    if (!url)
+        return '';
+    const m = /github\.com[/:]([A-Za-z0-9._-]+)\/([A-Za-z0-9._-]+?)(?:\.git)?(?:[/?#]|$)/i.exec(url);
+    return m ? `${m[1]}/${m[2]}` : '';
+}
 /**
  * npm packument readme 兜底（0.9.45 U10b 修复）：市场/收藏详情 Modal 的 README 折叠页对
  * 「未安装」条目无法走本地 profile 读取——回源 packument 顶层 readme 字段（publish 管线
  * 对多数包写入）。安全基线同 npmPackument：HTTPS、8MB 上限、超时；无 readme 字段返回空串
  * （不抛，客户端显示「没有 README」）；L1（ADR-0012）：显式 registry 参数 > 生效源。
+ * 0.9.48：随附 repo（packument repository 归一为 owner/repo，仅 GitHub），供 README
+ * 相对链接/图片锚定仓库基址；无 repository 或非 GitHub 时为空串。
  */
 export async function npmPackumentReadme(pkg, timeoutMs = 20_000, signal, registry, deps) {
     if (!/^@?[A-Za-z0-9-._~]+(\/[A-Za-z0-9-._~]+)?$/.test(pkg))
@@ -130,7 +147,7 @@ export async function npmPackumentReadme(pkg, timeoutMs = 20_000, signal, regist
         maxBytes: 8 * 1024 * 1024,
     });
     const readme = typeof data?.readme === 'string' && data.readme.trim() !== '' ? data.readme : '';
-    return { readme };
+    return { readme, repo: extractGithubRepo(data?.repository) };
 }
 /**
  * 升级探测（检测读）。L3 权威链（ADR-0012）：新鲜度敏感——npmjs 权威源优先

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-m",
-  "version": "0.9.47",
+  "version": "0.9.48",
   "description": "可自定义收录清单的 DSH 插件市场：收录、安装、卸载、升级一站完成，附 agent 工具与 dshm CLI。",
   "license": "MIT",
   "type": "module",