dsh-multi-provider-usage 0.7.2 → 0.7.3

package/README.md

@@ -41,14 +41,16 @@ panel settings page — extended from one provider to three.
   Code's tooltip breaks its amount into purchased + free credits; a credits
   response without either pool renders a muted **No top-up** badge.
 - **Auto-update** — on boot and every configured interval the host checks the
-  GitHub release feed. A local `link:`/`file:` checkout is fast-forwarded when it
-  is on `main`, clean, and a strict fast-forward. An npm / market / tarball copy
-  updates itself: the release tarball is unpacked and each packaged file
-  (`lib/`, `package.json`, `cordis.patch.yml`, `docs/`) is written to a temp file
-  and renamed over the target, so pnpm's hardlinked store is never edited in
-  place. Either way the running Host keeps the old module graph, so the
-  widget/settings show "updated — restart DSH". The plugin never restarts DSH by
-  itself.
+  npm registry, the npmmirror mirror and the GitHub release feed together and
+  trusts the newest version any of them reports. A local `link:`/`file:` checkout
+  is fast-forwarded when it is on `main`, clean, and a strict fast-forward. An
+  npm / market / tarball copy updates itself: the release tarball is downloaded
+  from the first source that serves it (registry → mirror → GitHub, in turn) and
+  each packaged file (`lib/`, `package.json`, `cordis.patch.yml`, `docs/`) is
+  written to a temp file and renamed over the target, so pnpm's hardlinked store
+  is never edited in place. Either way the running Host keeps the old module
+  graph, so the widget/settings show "updated — restart DSH". The plugin never
+  restarts DSH by itself.
 - **Balance-change animation** — the widget polls on its normal interval; when
   a provider's balance differs from the previous poll, the number counts from
   the old value to the refreshed one while a red/green delta chip (for example
@@ -267,7 +269,7 @@ the settings page and the auto-generated form hot-apply.
 | `glmRegion` | `"auto"` | `auto`, `zai`, `bigmodel`, `custom` |
 | `cacheMs` | `30000` | Per-provider host cache TTL |
 | `updateCheck` | `true` | npm update check (24 h) |
-| `autoUpdate` | `true` | Check GitHub releases; fast-forward a clean checkout, otherwise replace an installed package |
+| `autoUpdate` | `true` | Check npm, npmmirror and GitHub together; fast-forward a clean checkout, otherwise replace an installed package from the first source that serves the tarball |
 | `autoUpdateCheckHours` | `6` | Hours between auto-update checks (1–168) |
 | `injectSessionHeader` | `true` | OpenCode GO session-header fix |
 | `providerOrder` | all three ids | Provider display order in the widget; drag the cards in the plugin settings to reorder |

package/README.zh.md

@@ -34,11 +34,12 @@
   设置页内为分步引导：可复制的登录命令、控制台网页链接与「重新检测」按钮。
   Command Code 的悬停提示会拆成「购买 + 免费」；credits 响应没有这两个池时显示
   灰色「无充值额度」。
-- **自动更新** — 宿主启动后以及按配置的间隔检查 GitHub Release。本地
-  `link:`/`file:` 目录检出在「main 分支、工作区干净、可严格 fast-forward」时直接
-  `git pull`；npm / 市场 / tarball 安装的副本则下载该 Release 的 tarball，先写临时
-  文件再 `rename` 覆盖 `lib/`、`package.json`、`cordis.patch.yml` 等打包文件——不会
-  就地改写 pnpm store 的硬链接。两种方式完成后，运行中的宿主仍持有旧模块，所以
+- **自动更新** — 宿主启动后以及按配置的间隔，同时向 npm registry、npmmirror 镜像与
+  GitHub Release 查询，以其中报告的最新版本为准。本地 `link:`/`file:` 目录检出在
+  「main 分支、工作区干净、可严格 fast-forward」时直接 `git pull`；npm / 市场 / tarball
+  安装的副本按「npm → npmmirror → GitHub」依次尝试下载 tarball，先写临时文件再
+  `rename` 覆盖 `lib/`、`package.json`、`cordis.patch.yml` 等打包文件——不会就地
+  改写 pnpm store 的硬链接。两种方式完成后，运行中的宿主仍持有旧模块，所以
   组件/设置页显示“已更新到 vX，重启 DSH 生效”；插件不会自行重启 DSH。
 - **余额变化动画** — 组件按正常轮询周期刷新；某个服务商的余额相比上一次轮询
   发生变化时，数字会从旧值滚动到新值，同时一个红色/绿色差值（例如 `-0.1`）
@@ -225,7 +226,7 @@ Loader 直接读取导出的 `Config` schema；所有字段都是 `.volatile()`
 | `glmRegion` | `"auto"` | `auto`、`zai`、`bigmodel`、`custom` |
 | `cacheMs` | `30000` | 单个服务商的宿主缓存 TTL |
 | `updateCheck` | `true` | npm 新版本检查（24 小时） |
-| `autoUpdate` | `true` | 检查 GitHub Release；干净 checkout 快进，安装包用 Release tarball 原地替换 |
+| `autoUpdate` | `true` | 同时查询 npm / npmmirror / GitHub Release；干净 checkout 快进，安装包按可达的源依次下载 tarball 原地替换 |
 | `autoUpdateCheckHours` | `6` | 自动更新检查间隔（1–168 小时） |
 | `injectSessionHeader` | `true` | OpenCode GO 会话头修复 |
 | `providerOrder` | 三个 id 全集 | 组件中的显示顺序；在插件设置里拖动卡片调整 |

package/lib/auto-update.js

@@ -6,10 +6,12 @@
  *
  *   - `checkout` (`link:` / `file:` directory): fast-forward the git checkout,
  *     but only when it is on `main`, clean, and can fast-forward `origin/main`.
- *   - `package` (npm / market / tarball install): download the GitHub release
- *     tarball and replace the packaged files in place. Every file is written
- *     to a temp file inside the package directory first and then renamed over
- *     the target, which keeps pnpm's hardlinked store untouched.
+ *   - `package` (npm / market / tarball install): pick the newest release
+ *     known to npm, the npmmirror mirror and GitHub together, then download
+ *     the release tarball from the first source that serves it and replace
+ *     the packaged files in place. Every file is written to a temp file
+ *     inside the package directory first and then renamed over the target,
+ *     which keeps pnpm's hardlinked store untouched.
  *
  * Neither strategy restarts the Host: the running module graph is stale once
  * the files land, so the UI reports `restartRequired`. The updater never
@@ -28,6 +30,10 @@ import { gunzipSync } from "node:zlib";
 
 export const AUTO_UPDATE_REPO = "wjw1-Evan/dsh-provider-usage";
 export const AUTO_UPDATE_RELEASE_URL = `https://api.github.com/repos/${AUTO_UPDATE_REPO}/releases/latest`;
+/** npm registry — the canonical published package (also the `updateCheck` source). */
+export const NPM_REGISTRY_URL = "https://registry.npmjs.org";
+/** npmmirror mirror of the registry; reachable where npm/GitHub are not. */
+export const NPM_MIRROR_URL = "https://registry.npmmirror.com";
 /** Delay before the first background check, so activation is never blocked. */
 const FIRST_CHECK_DELAY_MS = 15_000;
 /** Hourly tick; the configured check interval gates actual network calls. */
@@ -390,6 +396,124 @@ async function fetchLatestRelease(fetchImpl) {
 	};
 }
 
+// ── package release sources ─────────────────────────────────────────────
+// An installed package updates by downloading a release tarball. GitHub is
+// the canonical source, but the registry serves the identical packaged
+// surface and is reachable where GitHub is not (and vice versa), so the
+// checker asks npm, the npmmirror mirror and GitHub together and trusts the
+// newest version any of them reports.
+
+/** Build the registry tarball URL for a version. */
+function registryTarballUrl(baseUrl, packageName, version) {
+	return `${baseUrl}/${packageName}/-/${packageName}-${version}.tgz`;
+}
+
+/** Fetch the latest published version from one npm registry endpoint. */
+async function fetchLatestFromRegistry(baseUrl, packageName, fetchImpl) {
+	const res = await fetchImpl(`${baseUrl}/${packageName}/latest`, {
+		headers: {
+			Accept: "application/vnd.npm.install-v1+json",
+			"User-Agent": "dsh-multi-provider-usage"
+		},
+		signal: AbortSignal.timeout(10_000)
+	});
+	if (!res.ok) throw new Error(`npm registry check ${res.status}`);
+	const doc = await res.json();
+	const version = typeof doc?.version === "string" ? doc.version : "";
+	if (parseVersion(version) === null) throw new Error("npm registry has no usable version");
+	const dist = doc?.dist?.tarball;
+	return {
+		version,
+		tarballUrl: typeof dist === "string" && dist.length > 0 ? dist : registryTarballUrl(baseUrl, packageName, version)
+	};
+}
+
+/**
+ * Pick the newest release known to any package source: npm registry, the
+ * npmmirror mirror and the GitHub release. One source lagging or failing is
+ * tolerated while any other answers; only when every source fails does the
+ * check itself fail. The winning source's tarball URL is the first download
+ * candidate.
+ */
+async function resolvePackageRelease({ packageName, fetchImpl }) {
+	const candidates = [
+		{ label: "npm", load: () => fetchLatestFromRegistry(NPM_REGISTRY_URL, packageName, fetchImpl) },
+		{ label: "npmmirror", load: () => fetchLatestFromRegistry(NPM_MIRROR_URL, packageName, fetchImpl) },
+		{ label: "GitHub", load: () => fetchLatestRelease(fetchImpl) }
+	];
+	const results = await Promise.allSettled(candidates.map((candidate) => candidate.load()));
+	/** @type {{ version: string, tarballUrl: string }[]} */
+	const successes = [];
+	/** @type {{ label: string, error: unknown }[]} */
+	const failures = [];
+	results.forEach((result, index) => {
+		if (result.status === "fulfilled") successes.push(result.value);
+		else failures.push({ label: candidates[index].label, error: result.reason });
+	});
+	if (successes.length === 0) {
+		throw new Error(`release check failed from all sources — ${describeFailures(failures)}`);
+	}
+	let best = successes[0];
+	for (const candidate of successes.slice(1)) {
+		if (isNewerVersion(candidate.version, best.version)) best = candidate;
+	}
+	return {
+		version: best.version,
+		// Each answering source's tarball URL, newest-version source first: a
+		// source that answered the check is also the likeliest download.
+		tarballUrls: [
+			best.tarballUrl,
+			...successes.filter((candidate) => candidate !== best).map((candidate) => candidate.tarballUrl)
+		]
+	};
+}
+
+/** Tarball URLs to try for a resolved release: answering sources first, then
+ * the canonical URLs for each source in case the check was partial. */
+function downloadCandidates(release, packageName) {
+	const urls = [];
+	const add = (url) => {
+		if (typeof url === "string" && url.length > 0 && !urls.includes(url)) urls.push(url);
+	};
+	for (const url of release.tarballUrls ?? []) add(url);
+	add(registryTarballUrl(NPM_REGISTRY_URL, packageName, release.version));
+	add(registryTarballUrl(NPM_MIRROR_URL, packageName, release.version));
+	add(`https://github.com/${AUTO_UPDATE_REPO}/archive/refs/tags/v${release.version}.tar.gz`);
+	return urls;
+}
+
+/** Short source label for a tarball URL, used in failure messages. */
+function sourceLabelOf(url) {
+	const text = String(url);
+	if (text.includes("registry.npmjs.org")) return "npm";
+	if (text.includes("registry.npmmirror.com")) return "npmmirror";
+	if (text.includes("github.com") || text.includes("githubusercontent.com") || text.includes("codeload")) return "GitHub";
+	return "release";
+}
+
+/** True when the failure is local, so another download source cannot help. */
+function isLocalWriteError(error) {
+	const code = typeof error?.code === "string" ? error.code : "";
+	if (/^(EACCES|EPERM|EROFS|EXDEV|EBUSY|ENOENT|ENOTDIR|EISDIR)$/.test(code)) return true;
+	return /is a symlink|permission denied|not writable/i.test(String(error?.message ?? error));
+}
+
+/** Attach an actionable hint to a filesystem-permission failure. */
+function withWriteHint(error) {
+	const message = String(error?.message ?? error);
+	if (!/^(EACCES|EPERM|EROFS)$/.test(typeof error?.code === "string" ? error.code : "")) return message;
+	return `${message} — the package directory is not writable; fix permissions or reinstall the package`;
+}
+
+/** Compact, bounded "source: error" summary for combined failure messages.
+ * Per-error bounds stay loose enough that an appended hint survives. */
+function describeFailures(failures) {
+	return failures
+		.map(({ label, error }) => `${label}: ${String(error?.message ?? error).slice(0, 240)}`)
+		.join("; ")
+		.slice(0, 800);
+}
+
 /**
  * Start the background checker.
  *
@@ -462,14 +586,20 @@ export function startAutoUpdate(options) {
 		lastCheckAt = now();
 		patch({ status: "checking", message: null });
 		inFlight = (async () => {
+			// A failed release check is an "error" (nothing new is known); a failed
+			// apply is "available" (the release is known, the download/write is
+			// not). The UI toasts only the latter.
+			let phase = "check";
 			try {
-				const release = await fetchLatestRelease(fetchImpl);
 				const install = detect({ packageDir, profileDir, packageName });
+				const release = install.kind === "checkout"
+					? await fetchLatestRelease(fetchImpl)
+					: await resolvePackageRelease({ packageName, fetchImpl });
 				patch({
 					latestVersion: release.version,
 					checkedAt: now(),
 					installKind: install.kind,
-					releaseUrl: release.url
+					releaseUrl: release.url ?? null
 				});
 				// `currentVersion` never changes in a running host, so a release
 				// this session already applied would be re-downloaded every cycle
@@ -510,29 +640,50 @@ export function startAutoUpdate(options) {
 						message: "checkout updated; restart DSH to apply"
 					});
 				}
+				phase = "apply";
 				// Installed package (npm / market / tarball): replace the packaged
-				// files in place. The running Host keeps the old module graph until
-				// it is restarted, which the UI reports.
-				const result = await applyPackageUpdate({
-					packageDir,
-					tarballUrl: release.tarballUrl,
-					fetchImpl,
-					packageName,
-					expectVersion: release.version,
-					logger
-				});
-				logger.info?.(`dsh-multi-provider-usage: self-updated package to ${result.version}; restart DSH to apply`);
-				return patch({
-					status: "updated",
-					version: result.version,
-					updatedAt: now(),
-					restartRequired: true,
-					message: "package files replaced; restart DSH to apply"
-				});
+				// files in place, trying each download source in turn. The running
+				// Host keeps the old module graph until it is restarted, which the
+				// UI reports.
+				/** @type {{ label: string, error: unknown }[]} */
+				const failures = [];
+				const candidates = downloadCandidates(release, packageName);
+				for (const url of candidates) {
+					const label = sourceLabelOf(url);
+					try {
+						const result = await applyPackageUpdate({
+							packageDir,
+							tarballUrl: url,
+							fetchImpl,
+							packageName,
+							expectVersion: release.version,
+							logger
+						});
+						logger.info?.(`dsh-multi-provider-usage: self-updated package to ${result.version} from ${label}; restart DSH to apply`);
+						return patch({
+							status: "updated",
+							version: result.version,
+							updatedAt: now(),
+							restartRequired: true,
+							message: `package files replaced from ${label}; restart DSH to apply`
+						});
+					} catch (error) {
+						if (isLocalWriteError(error)) {
+							// No other download source can fix a local filesystem problem.
+							failures.push({ label, error: withWriteHint(error) });
+							break;
+						}
+						failures.push({ label, error });
+					}
+				}
+				const prefix = failures.length === candidates.length
+					? "update download failed from all sources"
+					: "update failed";
+				throw new Error(`${prefix} — ${describeFailures(failures)}`);
 			} catch (error) {
 				const message = error instanceof Error ? error.message : String(error);
 				logger.warn?.(`dsh-multi-provider-usage: auto-update failed: ${message}`);
-				return patch({ status: "available", message, restartRequired: false });
+				return patch({ status: phase === "check" ? "error" : "available", message, restartRequired: false });
 			} finally {
 				inFlight = null;
 			}

package/lib/client.js

@@ -633,8 +633,10 @@ window.__ModuleLoader__.load({
 			if (state.status === "updated" && state.restartRequired === true) {
 				return t("autoUpdate.updated", { v: state.version || state.latestVersion || "?" });
 			}
-			if (state.status === "available") {
-				return t("autoUpdate.available", { v: state.latestVersion || "?" });
+			// The host only reports "available" after a successful check, so the
+			// version is real; the guard keeps a stale "v?" off the widget anyway.
+			if (state.status === "available" && typeof state.latestVersion === "string" && state.latestVersion.length > 0) {
+				return t("autoUpdate.available", { v: state.latestVersion });
 			}
 			return "";
 		}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-multi-provider-usage",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "description": "DSH (DeepSeek Harness) plugin: one collapsible sidebar widget for OpenCode GO, Command Code and GLM Code Plan quotas plus top-up balances, a periodic balance-change animation, automatic checkout and installed-package updates, same-origin usage proxies, a Plugins-panel settings page and a /provider-usage chat command (DSH 0.1.7+ and 0.2.0 compatible)",
   "type": "module",
   "main": "lib/index.js",