dsh-m 0.9.76 → 0.9.78

package/CHANGELOG.md

@@ -8,6 +8,12 @@ The full release history of dsh-m, maintained bilingually: **Chinese first, Engl
 
 ## 中文
 
+### 0.9.78 性能：收藏 stale 检查零网络 + 市场页零增量提交守卫（钢人 C3）
+
+- **问题（钢人报告 C3 节）**：收藏 stale 判定只需要「id 还在不在目录」的成员布尔，却穿透富 market interface 的探测段——每次收藏区访问/切换（800ms debounce 合并后）仍是 N 条收藏 × full 查询，含每命中条 npm/github latest **网络扇出**且产物全部丢弃；叠加 toggle 后 refreshViews 四连响应无条件 `setData`——数据层精心维持的引用稳定性一次 setState 即蒸发。
+- **修复**：`lookupLive` 补 `probeMode:"cache-only"`（ADR-0013 第一段模式，零网络零探测；existence = items 成员判定，语义零变化）；`fetchPage` 增设**零增量提交守卫**——新增 `marketResponseEquivalent` 纯函数（JSON 值语义递归比较，ZoneChips setGeom 同款纪律），内容等价则跳过 `setData`（dataRef/loading 语义不动）。报告可选项「客户端 stale TTL 缓存」明确不做：C1 物化后 cache-only 查询已是内存级。
+- **验证**：1389 项测试全绿（执行基线 1382 + 新增 7）、typecheck 零错误；真机差分冒烟 5 组用例（npm 主清单/自身/社区条目/不存在 id）：cache-only 与 full 的 id 集合与 total 逐项一致（红点语义不变的充分条件），cache-only ~30ms vs full 冷跑 ~250ms（零探测指纹）；实施计划经独立评审两轮闭环（F1-1 计划基线勘误）。
+
 ### 0.9.76 修复：三项展示层退役与吸顶跳动根治——「对话」徽章/「版本无关」徽章退役 + 分类行滚动锚定自激断路
 
 - **① 「对话」来源徽章退役（主人实拍：界面全点按钮却全员误标「对话」）**：`meta.session` 是 0.7.0 终审·新伤1 的**泵所有权标记**（restore 跳过 / replaceAll 不回卷 / persist 时剥离），GUI 的 `runOp` 与对话区镜像两路无条件同打同一标——它区分不了来源，且重载后徽章整体蒸发。修复：opRowVm 删 session 派生、行渲染删徽章、CSS 与 i18n 键退役；`meta.session` 本职不动（数据模型零变更），来源区分留待未来 `meta.origin` 承载。
@@ -559,6 +565,12 @@ The full release history of dsh-m, maintained bilingually: **Chinese first, Engl
 
 ## English
 
+### Performance in 0.9.78 — favorites stale checks go cache-only: zero-network favorites access + zero-increment commit guard (steelman C3)
+
+- **Problem (steelman report, card C3)**: the favorites stale verdict only needs a "is this id still in the catalog" membership boolean, yet it pierces the rich market interface's probe segment - every favorites visit/toggle (after the 800ms debounce merge) still fires N favorites × full queries including a per-hit npm/github latest **network fan-out** whose products are entirely discarded. On top of that, the unconditional `setData` after refreshViews' four-in-a-row responses (the post-toggle norm) evaporates the reference stability the data layer carefully maintains.
+- **Fix**: `lookupLive` now passes `probeMode:"cache-only"` (ADR-0013 first-phase mode: zero network, zero probing; existence = items membership, semantics unchanged); `fetchPage` gains a **zero-increment commit guard** - a new `marketResponseEquivalent` pure function (recursive JSON-value comparison, ZoneChips setGeom discipline) skips `setData` when content is equivalent (dataRef/loading semantics untouched). The report's optional "client-side stale TTL cache" is explicitly not done: after C1 materialization, cache-only queries are already memory-grade.
+- **Verification**: 1389 tests green (execution baseline 1382 + 7 added), typecheck clean; live-instance differential smoke across 5 cases (npm primary / self / community entry / nonexistent id): id sets and totals identical between cache-only and full (the sufficient condition for unchanged red-dot semantics), cache-only ~30ms vs cold full ~250ms (the zero-probe fingerprint); the implementation plan was closed over two independent review rounds (F1-1 plan-baseline correction).
+
 ### Fix in 0.9.76 — three presentation-layer retirements and sticky-chips jitter fixed at the root: "Chat" badge / "Version-independent" badge retired + scroll-anchoring self-excitation cut on the category row
 
 - **① "Chat" source badge retired (owner screenshot: every row flagged despite all-UI clicks)**: `meta.session` is the **pump-ownership marker** from the 0.7.0 final review (restore skip / replaceAll no-rollback / stripped on persist) — both the GUI `runOp` path and the chat-mirror path set it unconditionally, so it cannot distinguish origins, and the badge vanishes entirely after a page reload. Fix: opRowVm drops the session derivation; the row badge, its CSS and i18n keys retire; `meta.session` keeps its day job (zero data-model change); a future `meta.origin` would be the honest carrier for source attribution.

package/lib/client.js

@@ -34,6 +34,7 @@ __export(market_state_exports, {
   countBeyondRows: () => countBeyondRows,
   createZoneState: () => createZoneState,
   marketNotice: () => marketNotice,
+  marketResponseEquivalent: () => marketResponseEquivalent,
   mergeLatestFields: () => mergeLatestFields,
   normalizeMarketQuery: () => normalizeMarketQuery,
   normalizeMarketResponse: () => normalizeMarketResponse,
@@ -235,6 +236,25 @@ function mergeLatestFields(nextItems, prevItems) {
   });
   return touched ? out : nextItems;
 }
+function marketResponseEquivalent(a, b) {
+  if (a === b) return true;
+  if (!a || !b || typeof a !== "object" || typeof b !== "object") return false;
+  if (Array.isArray(a) !== Array.isArray(b)) return false;
+  if (Array.isArray(a)) {
+    if (a.length !== b.length) return false;
+    for (let i = 0; i < a.length; i++) {
+      if (!marketResponseEquivalent(a[i], b[i])) return false;
+    }
+    return true;
+  }
+  const ka = Object.keys(a).filter((k) => a[k] !== void 0);
+  const kb = Object.keys(b).filter((k) => b[k] !== void 0);
+  if (ka.length !== kb.length) return false;
+  for (const k of ka) {
+    if (!Object.prototype.hasOwnProperty.call(b, k) || !marketResponseEquivalent(a[k], b[k])) return false;
+  }
+  return true;
+}
 function chipRows(offsets) {
   if (!Array.isArray(offsets)) return 0;
   let rows = 0;
@@ -1866,7 +1886,7 @@ var h = React.createElement;
 var { useState, useEffect, useLayoutEffect, useCallback, useMemo, useRef } = React;
 var PLUGIN_ID = "dsh-m";
 var API = "/dshm";
-var { DEFAULT_PAGE_SIZE: DEFAULT_PAGE_SIZE2, MARKET_PAGE_SIZES: MARKET_PAGE_SIZES2, pageItems: pageItems2, createZoneState: createZoneState2, normalizeMarketQuery: normalizeMarketQuery2, resetPageOnFilterChange: resetPageOnFilterChange2, normalizeMarketResponse: normalizeMarketResponse2, registryNotice: registryNotice2, zoneChips: zoneChips2, marketNotice: marketNotice2, searchSourceOf: searchSourceOf2, mergeLatestFields: mergeLatestFields2, chipRows: chipRows2, countBeyondRows: countBeyondRows2, clipTopOf: clipTopOf2, visibleRowTop: visibleRowTop2, autoExpandDecision: autoExpandDecision2 } = (init_market_state(), __toCommonJS(market_state_exports));
+var { DEFAULT_PAGE_SIZE: DEFAULT_PAGE_SIZE2, MARKET_PAGE_SIZES: MARKET_PAGE_SIZES2, pageItems: pageItems2, createZoneState: createZoneState2, normalizeMarketQuery: normalizeMarketQuery2, resetPageOnFilterChange: resetPageOnFilterChange2, normalizeMarketResponse: normalizeMarketResponse2, registryNotice: registryNotice2, zoneChips: zoneChips2, marketNotice: marketNotice2, searchSourceOf: searchSourceOf2, mergeLatestFields: mergeLatestFields2, chipRows: chipRows2, countBeyondRows: countBeyondRows2, clipTopOf: clipTopOf2, visibleRowTop: visibleRowTop2, autoExpandDecision: autoExpandDecision2, marketResponseEquivalent: marketResponseEquivalent2 } = (init_market_state(), __toCommonJS(market_state_exports));
 var { readMarketSnapshot: readMarketSnapshot2, writeMarketSnapshot: writeMarketSnapshot2, isDefaultFirstPageQuery: isDefaultFirstPageQuery2 } = (init_market_snapshot(), __toCommonJS(market_snapshot_exports));
 var { backdropCloseHandlers: backdropCloseHandlers2 } = (init_backdrop(), __toCommonJS(backdrop_exports));
 var { lbStep: lbStep2, lbNeighbors: lbNeighbors2, swipeDir: swipeDir2 } = (init_lightbox(), __toCommonJS(lightbox_exports));
@@ -2944,11 +2964,12 @@ function useMarketData(zone = "community") {
     return api("market", params, ac.signal).then((raw) => {
       if (genRef.current !== gen || ac.signal.aborted) return;
       const next = normalizeMarketResponse2(raw);
-      const prevItems = dataRef.current && Array.isArray(dataRef.current.items) ? dataRef.current.items : null;
+      const prevData = dataRef.current;
+      const prevItems = prevData && Array.isArray(prevData.items) ? prevData.items : null;
       const mergedItems = mergeLatestFields2(next.items, prevItems);
       const merged = mergedItems === next.items ? next : { ...next, items: mergedItems };
       dataRef.current = merged;
-      setData(merged);
+      if (!marketResponseEquivalent2(prevData, merged)) setData(merged);
       setLoading(false);
       if (probeMode === "cache-only" && next.latestComplete === false) {
         return fetchPage(nextQuery, force, true, "full");
@@ -4730,7 +4751,7 @@ function FavoriteZone({ favorites, onOpen }) {
       void (async () => {
         const lookupLive = async (fav) => {
           try {
-            const res = await api("market", { query: fav.id, source: "all", limit: 8 });
+            const res = await api("market", { query: fav.id, source: "all", limit: 8, probeMode: "cache-only" });
             const items = res && Array.isArray(res.items) ? res.items : [];
             return items.some((x) => x && x.id === fav.id);
           } catch {

package/lib/core/primary-screenshots.js

@@ -1,5 +1,13 @@
 import { fetchTextLimited } from './httpx.js';
 const MANIFEST_HOST = 'raw.githubusercontent.com';
+/**
+ * 0.9.77 兜底腿（桌面机 raw 被墙实录）：raw.githubusercontent.com 直连在部分网络下
+ * TLS 握手即被 reset，而 registry 清单自身早有 default-raw → default-jsdelivr 降级链、
+ * 社区目录有 jsdelivr/npmmirror/unpkg 三路由——截图 manifest 是全市场唯一单源抓取点，
+ * 症状为「列表/README/安装全正常，唯独精选详情无截图」。此处补齐同款第二腿：
+ * jsDelivr 的 GitHub 镜像，仅当 raw 抓取层失败（含 404/超时/host guard 拒绝）时启用。
+ */
+const MIRROR_HOST = 'cdn.jsdelivr.net';
 const MANIFEST_FILE = 'screenshots.json';
 const MAX_MANIFEST_BYTES = 64 * 1024;
 const MAX_SCREENSHOTS = 8;
@@ -9,7 +17,8 @@ const OWNER_MAX = 39;
 const REPO_MAX = 100;
 const GITHUB_REPO_RE = /^[A-Za-z0-9][A-Za-z0-9-]*\/[A-Za-z0-9._-]+$/;
 const CONTROL_RE = /[\u0000-\u001f\u007f]/;
-function manifestUrl(github) {
+/** owner/repo 校验与归一（GITHUB_REPO_RE 与 registry 同款）；非法输入返回 null（零抓取）。 */
+function repoSlug(github) {
     const value = typeof github === 'string' ? github.trim() : '';
     if (!GITHUB_REPO_RE.test(value))
         return null;
@@ -18,9 +27,25 @@ function manifestUrl(github) {
     const repo = value.slice(slash + 1);
     if (owner.length > OWNER_MAX || repo.length > REPO_MAX || repo === '.' || repo === '..')
         return null;
-    return `https://${MANIFEST_HOST}/${owner}/${repo}/HEAD/${MANIFEST_FILE}`;
+    return `${owner}/${repo}`;
+}
+/**
+ * raw 规范形（/HEAD/ = 默认分支）。它同时是 parseManifest 的路径解析基址：无论哪条腿供数，
+ * 返回的图片 URL 一律落在 *.githubusercontent.com——恰好通过客户端 safeScreenshots 图床白名单
+ * （main.jsx 只放行 github.com / *.githubusercontent.com），镜像腿若原样回 jsdelivr URL 会被
+ * 客户端整体过滤、白修。
+ */
+function rawManifestUrl(slug) {
+    return `https://${MANIFEST_HOST}/${slug}/HEAD/${MANIFEST_FILE}`;
 }
-function screenshotUrl(manifest, rawPath) {
+/**
+ * jsDelivr 镜像形（@HEAD 与 raw /HEAD/ 同义，默认分支，实测可用）。镜像存在 CDN 缓存滞后
+ * （registry default-jsdelivr 同款取舍，可用 purge.jsdelivr.net 手动清缓存），截图属低频变更元数据，可接受。
+ */
+function mirrorManifestUrl(slug) {
+    return `https://${MIRROR_HOST}/gh/${slug}@HEAD/${MANIFEST_FILE}`;
+}
+function screenshotUrl(baseUrl, rawPath) {
     if (typeof rawPath !== 'string')
         return null;
     const path = rawPath.trim();
@@ -35,10 +60,10 @@ function screenshotUrl(manifest, rawPath) {
     const segments = path.split('/');
     if (segments.some((part) => part === '' || part === '.' || part === '..'))
         return null;
-    const base = new URL('.', manifest);
+    const base = new URL('.', baseUrl);
     return new URL(segments.map((part) => encodeURIComponent(part)).join('/'), base).toString();
 }
-function parseManifest(text, manifestUrl) {
+function parseManifest(text, baseUrl) {
     let parsed;
     try {
         parsed = JSON.parse(text);
@@ -50,14 +75,14 @@ function parseManifest(text, manifestUrl) {
         return [];
     const result = [];
     for (const path of parsed) {
-        const url = screenshotUrl(manifestUrl, path);
+        const url = screenshotUrl(baseUrl, path);
         if (!url)
             return [];
         result.push(url);
     }
     return result;
 }
-function assertManifestHost(raw, isRedirectHop) {
+function assertManifestHost(raw, isRedirectHop, allowedHost) {
     let url;
     try {
         url = new URL(raw);
@@ -65,14 +90,31 @@ function assertManifestHost(raw, isRedirectHop) {
     catch {
         throw new Error(isRedirectHop ? 'screenshot manifest redirect URL is invalid' : 'invalid screenshot manifest request URL');
     }
-    if (url.protocol !== 'https:' || url.hostname !== MANIFEST_HOST || url.username || url.password || url.port) {
+    if (url.protocol !== 'https:' || url.hostname !== allowedHost || url.username || url.password || url.port) {
         throw new Error(isRedirectHop
-            ? 'screenshot manifest redirects must remain on raw.githubusercontent.com'
-            : 'screenshot manifest request URL must be https://raw.githubusercontent.com');
+            ? `screenshot manifest redirects must remain on ${allowedHost}`
+            : `screenshot manifest request URL must be https://${allowedHost}`);
     }
 }
+/** 单腿抓取：每腿独立逐跳 host guard（初始跳 + 重定向都不许离开本腿源），5s / 64KB 上限逐腿独立生效。 */
+async function fetchManifestLeg(fetchText, url, allowedHost) {
+    let hop = 0;
+    return fetchText(url, {
+        timeoutMs: 5_000,
+        maxBytes: MAX_MANIFEST_BYTES,
+        headers: { accept: 'application/json' },
+        onRequest: (hopUrl) => {
+            // 逐跳 host guard；错误文案区分初始跳与重定向跳，避免调试误导（评审建议落盘）。
+            const isRedirectHop = hop > 0;
+            hop += 1;
+            assertManifestHost(hopUrl, isRedirectHop, allowedHost);
+        },
+    });
+}
 /**
  * Read an author-owned root screenshots.json without consulting Community Catalog.
+ * 两腿链：raw 抓取层失败 → jsDelivr 镜像；两腿全败 → 空图库。解析层的「空」是权威结果
+ * （两腿读的是同一 repo 文件，镜像不会有不同内容），不再触发兜底。
  * All network access is bounded, and a rejected/empty manifest degrades to no gallery.
  */
 export function createPrimaryScreenshotReader(options = {}) {
@@ -81,10 +123,11 @@ export function createPrimaryScreenshotReader(options = {}) {
     const cache = new Map();
     const flights = new Map();
     return async (github) => {
-        const url = manifestUrl(github);
-        if (!url)
+        const slug = repoSlug(github);
+        if (!slug)
             return [];
-        const key = url.toLowerCase();
+        const rawUrl = rawManifestUrl(slug);
+        const key = rawUrl.toLowerCase();
         const timestamp = now();
         for (const [cachedKey, value] of cache) {
             if (value.expiresAt <= timestamp)
@@ -98,24 +141,20 @@ export function createPrimaryScreenshotReader(options = {}) {
             return [...(await pending)];
         const flight = (async () => {
             let screenshots = [];
-            let hop = 0;
             try {
-                const text = await fetchText(url, {
-                    timeoutMs: 5_000,
-                    maxBytes: MAX_MANIFEST_BYTES,
-                    headers: { accept: 'application/json' },
-                    onRequest: (hopUrl) => {
-                        // 逐跳 host guard；错误文案区分初始跳与重定向跳，避免调试误导（评审建议落盘）。
-                        const isRedirectHop = hop > 0;
-                        hop += 1;
-                        assertManifestHost(hopUrl, isRedirectHop);
-                    },
-                });
-                screenshots = parseManifest(text, url);
+                const text = await fetchManifestLeg(fetchText, rawUrl, MANIFEST_HOST);
+                screenshots = parseManifest(text, rawUrl);
             }
             catch {
-                // Images are optional metadata: a missing/unavailable manifest must not block detail/install.
-                screenshots = [];
+                try {
+                    const mirrorUrl = mirrorManifestUrl(slug);
+                    const text = await fetchManifestLeg(fetchText, mirrorUrl, MIRROR_HOST);
+                    screenshots = parseManifest(text, rawUrl);
+                }
+                catch {
+                    // Images are optional metadata: a missing/unavailable manifest must not block detail/install.
+                    screenshots = [];
+                }
             }
             cache.set(key, {
                 screenshots,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-m",
-  "version": "0.9.76",
+  "version": "0.9.78",
   "description": "可自定义收录清单的 DSH 插件市场：收录、安装、卸载、升级一站完成，附 agent 工具与 dshm CLI。",
   "license": "MIT",
   "type": "module",