dsh-multi-router 0.4.0 → 0.4.1

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 本项目遵循 [语义化版本](https://semver.org/lang/zh-CN/)。版本号从 `0.1` 起以功能迭代为主，接口在 `1.0` 前可能变化。
 
+## 0.4.1
+
+- 修复 GitHub 来源再次安装时 pnpm 复用旧锁文件：改走官方包管理更新路径刷新原分支，保留安装来源与启用状态。
+- 更新完成后核验实际 Git 提交，旧提交或检查结果不一致不会误报成功；更新失败恢复原 manifest / 锁文件，支持取消与 registry 回退。
+
 ## 0.4.0
 
 - 首次启用自动获取并保存 WorkBuddy / Trae 本机登录，首页明确显示检测与保存结果，增加一键重试和下一步引导。

package/README.md

@@ -6,7 +6,7 @@
 
 一个插件内置 WorkBuddy、Trae、Qoder 的认证、模型发现和聊天传输，提供三家的多账号池及集中路由。运行不依赖原来三个 DSH 插件；三家代码随安装包一起打包。基于 MIT 上游，固定版本见 `upstream-lock.json`，许可见 `THIRD_PARTY_NOTICES.md`。
 
-版本：0.4.0。适配 DSH Desktop / Web 0.2.0-rc.2，Node.js ^22.19.0 或 >=24。
+版本：0.4.1。适配 DSH Desktop / Web 0.2.0-rc.2，Node.js ^22.19.0 或 >=24。
 
 ## 在 DSH 里管理
 
@@ -98,7 +98,7 @@ Qoder 的 `dfmodel` 在真实目录里显示为 DeepSeek-Flash，未声明具体
 在本插件配置面板打开 **插件更新**，管理当前 DSH 配置中的全部已安装插件，包括其它插件和已停用插件。首次打开自动检查，后续超过 24 小时重新打开时再检查，也可随时点击「检查全部更新」。
 
 - **npm 来源**：比较 SemVer，保留 `latest` / `next` 等频道；固定版本和版本范围在用户确认更新后升级到最新正式版本。查询沿用 DSH 的 registry、网络、认证与镜像回退设置。
-- **GitHub 来源**：比较原分支 / 标签的 Git 提交，版本号未变化也能发现更新。支持 `github:用户/仓库`、GitHub HTTPS / SSH 地址及锁文件中的提交；固定 Git 提交不自动解除。GitHub 查询需要能够访问仓库公开元数据，私有仓库或限流会显示原因，不会猜测最新提交。
+- **GitHub 来源**：比较原分支 / 标签的 Git 提交，版本号未变化也能发现更新；安装时使用官方 `pnpm update` 路径刷新原分支，并核验实际锁文件提交，避免 `pnpm add` 复用旧锁文件。支持 `github:用户/仓库`、GitHub HTTPS / SSH 地址及锁文件中的提交；固定 Git 提交不自动解除。GitHub 查询需要能够访问仓库公开元数据，私有仓库或限流会显示原因，不会猜测最新提交。
 - 可按名称、来源和可更新状态筛选；支持单个更新、勾选批量更新、取消以及失败后重试。更新前显示目标，并保留每个插件原有启用 / 停用状态。
 - 可直接输入 npm 包名 / 指定版本，或 `github:用户/仓库` 安装新插件。实际安装由 DSH 官方插件管理服务执行兼容检查、镜像重试、配置锁及失败回滚；依赖构建脚本仍在 DSH 原安装页授权，不自动绕过。
 - 结果显示实际安装是否成功及是否需要重启。npm 镜像尚未同步、网络超时、版本不兼容会明确提示。GitHub 下载不会由 npm 镜像代替。
@@ -124,7 +124,7 @@ dsh plugin --profile desktop add dsh-multi-router
 dsh plugin --profile web add dsh-multi-router
 ```
 
-包地址：[dsh-multi-router · npm](https://www.npmjs.com/package/dsh-multi-router)。正式版本由 GitHub Release 自动测试、打包并发布到 npm `latest`，包中已包含编译产物，用户无需自行构建。需要固定版本时可安装 `dsh-multi-router@0.4.0`。
+包地址：[dsh-multi-router · npm](https://www.npmjs.com/package/dsh-multi-router)。正式版本由 GitHub Release 自动测试、打包并发布到 npm `latest`，包中已包含编译产物，用户无需自行构建。需要固定版本时可安装 `dsh-multi-router@0.4.1`。
 
 已使用 npm 来源的用户更新：
 
@@ -181,7 +181,7 @@ cd dsh-multi-router
 npm ci
 npm run check
 npm run pack:release
-dsh plugin --profile desktop add ./dsh-multi-router-0.4.0.tgz
+dsh plugin --profile desktop add ./dsh-multi-router-0.4.1.tgz
 ```
 
 ### 配置账号

package/lib/{chunk-UQS7DNOQ.js → chunk-DZYRIZW2.js}

@@ -34,13 +34,13 @@ import {
 import { createHash, randomBytes as randomBytes2, timingSafeEqual } from "node:crypto";
 
 // package.json
-var version = "0.4.0";
+var version = "0.4.1";
 
 // src/manager.mjs
-import { readFile as readFile2, mkdir as mkdir2, mkdtemp as mkdtemp2, rm as rm2 } from "node:fs/promises";
+import { readFile as readFile2, mkdir as mkdir2, mkdtemp as mkdtemp2, rm as rm3 } from "node:fs/promises";
 import { watch } from "node:fs";
 import { dirname as dirname3, join as join4, relative as relative2, resolve } from "node:path";
-import { withFileLock } from "@deepseek-ai/dsh-atomic-write";
+import { withFileLock as withFileLock2 } from "@deepseek-ai/dsh-atomic-write";
 
 // upstream/qoder/src/status-paths.ts
 var QODER_STATUS_PATH = "/plugins/dsh-qoder-connect/status";
@@ -234,12 +234,13 @@ async function prepareMigration(manager, raw, portable, mode) {
 }
 
 // src/plugin-updates.mjs
-import { readFile, stat } from "node:fs/promises";
+import { readFile, stat, rm as rm2 } from "node:fs/promises";
 import { join as join3 } from "node:path";
 import { randomUUID } from "node:crypto";
 import { createRequire } from "node:module";
 import { pathToFileURL } from "node:url";
 import { parse as parseYaml } from "yaml";
+import { withFileLock, writeFileAtomic as writeFileAtomic2 } from "@deepseek-ai/dsh-atomic-write";
 
 // upstream/workbuddy/src/update.ts
 var WORKBUDDY_REPOSITORY_URL = "https://github.com/corrinehu/dsh-workbuddy-connect";
@@ -360,14 +361,63 @@ async function registryVersion(service, profile, spec, signal) {
   }
   throw Error("npm \u67E5\u8BE2\u5931\u8D25\uFF1B\u8BF7\u68C0\u67E5 DSH \u7F51\u7EDC\u3001registry \u8BBE\u7F6E\u6216\u5305\u7684\u8BBF\u95EE\u6743\u9650");
 }
+async function refreshGitPlugin(service, profile, row, options2, signal) {
+  const require2 = createRequire(profile.installAnchor);
+  const { runProfilePnpm } = await import(pathToFileURL(require2.resolve("@deepseek-ai/dsh-plugin-manager/operations")).href);
+  const { registryPlan, attributeFailure } = await import(pathToFileURL(require2.resolve("@deepseek-ai/dsh-plugin-manager/registry")).href);
+  const { classifyInstallFailure } = await import(pathToFileURL(require2.resolve("@deepseek-ai/dsh-plugin-manager")).href);
+  const plan = registryPlan(options2.registry, await service.registries());
+  return withFileLock(join3(profile.dir, "package.json"), async () => {
+    const files = await Promise.all(["package.json", "pnpm-lock.yaml"].map(async (name) => {
+      const path = join3(profile.dir, name);
+      try {
+        return { path, content: await readFile(path, "utf8") };
+      } catch (e) {
+        if (e.code !== "ENOENT") throw e;
+        return { path };
+      }
+    }));
+    const restore = () => Promise.all(files.map((f) => f.content === void 0 ? rm2(f.path, { force: true }) : writeFileAtomic2(f.path, f.content, { mode: 384 })));
+    if (JSON.parse(files[0].content).dependencies?.[row.name] !== row.spec) throw Error("\u5B89\u88C5\u6765\u6E90\u5DF2\u6539\u53D8\uFF0C\u8BF7\u91CD\u65B0\u68C0\u67E5");
+    let result;
+    try {
+      for (const registry of plan) {
+        signal.throwIfAborted();
+        const run = await runProfilePnpm({ ...profile, profile: profile.name }, ["update", row.name, ...registry ? [`--registry=${registry}`] : []], {
+          execution: "service",
+          ...profile.packageManager,
+          signal,
+          outputBytes: 16384,
+          idleTimeoutMs: 6e5,
+          lookupTimeoutMs: 2e4,
+          activateNewBundles: false
+        });
+        if (run.exitCode === 0 && !run.timedOut && !signal.aborted) return { packageResult: run, application: "restart-required" };
+        const kind = classifyInstallFailure({ log: run.output, timedOut: run.timedOut });
+        result = {
+          packageResult: { ...run, kind },
+          application: signal.aborted ? "cancelled" : "failed",
+          ...run.incompatible?.length ? { error: { code: "incompatible-version" } } : {}
+        };
+        await restore();
+        if (signal.aborted || attributeFailure(kind, run.output, { kind: "git", host: "github.com" }) !== "registry") break;
+      }
+      return result;
+    } catch (e) {
+      await restore();
+      throw e;
+    }
+  }, { waitMs: 12e4 });
+}
 var PluginUpdates = class {
-  constructor({ service = () => void 0, profile = () => void 0, fetchImpl = (...args) => fetch(...args), lookup = registryVersion } = {}) {
+  constructor({ service = () => void 0, profile = () => void 0, fetchImpl = (...args) => fetch(...args), lookup = registryVersion, refreshGit = refreshGitPlugin } = {}) {
     this.service = service;
     this.profile = profile;
     this.fetchImpl = fetchImpl;
     this.rows = [];
     this.abort = new AbortController();
     this.lookup = lookup;
+    this.refreshGit = refreshGit;
   }
   state() {
     return {
@@ -475,11 +525,16 @@ var PluginUpdates = class {
     if (original?.dependencies?.[row.name] !== row.spec) throw Error("\u5B89\u88C5\u6765\u6E90\u5DF2\u6539\u53D8\uFF0C\u8BF7\u91CD\u65B0\u68C0\u67E5");
     const current = (await this.service().listBundles()).find((b) => b.name === row.name);
     if (!current || current.enabled !== row.checkedEnabled || current.version !== row.version) throw Error("\u63D2\u4EF6\u7248\u672C\u6216\u542F\u7528\u72B6\u6001\u5DF2\u6539\u53D8\uFF0C\u8BF7\u91CD\u65B0\u68C0\u67E5");
-    const result = await this.service().installBundle(row.target, {
-      enabled: row.enabled,
-      requestId: this.job.id,
-      ...registry ? { registry } : {}
-    });
+    const options2 = { enabled: row.enabled, requestId: this.job.id, ...registry ? { registry } : {} };
+    let result;
+    if (row.source.kind === "github") {
+      this.gitAbort = new AbortController();
+      try {
+        result = await this.refreshGit(this.service(), this.profile(), row, options2, AbortSignal.any([this.abort.signal, this.gitAbort.signal]));
+      } finally {
+        this.gitAbort = void 0;
+      }
+    } else result = await this.service().installBundle(row.target, options2);
     if (result.packageResult && result.packageResult.exitCode !== 0 || ["failed", "cancelled"].includes(result.application) || result.error) {
       return {
         name: row.name,
@@ -496,6 +551,16 @@ var PluginUpdates = class {
       status: "failed",
       message: `\u5B9E\u9645\u5B89\u88C5\u7248\u672C ${installed?.version ?? "\u672A\u77E5"} \u4E0E\u68C0\u67E5\u7248\u672C ${row.latestVersion} \u4E0D\u540C\uFF1B\u8BF7\u7A0D\u540E\u91CD\u65B0\u68C0\u67E5\uFF0C\u53EF\u80FD\u662F\u955C\u50CF\u5C1A\u672A\u540C\u6B65\u6216\u53D1\u884C\u65F6\u95F4\u9650\u5236`
     };
+    if (row.source.kind === "github") {
+      const lock = await locks(this.profile().dir);
+      const pnpm = lock.pnpm?.importers?.["."]?.dependencies?.[row.name]?.version, npm = lock.npm?.packages?.[`node_modules/${row.name}`]?.resolved;
+      if (githubCommit(lock.preferNpm ? npm ?? pnpm : pnpm ?? npm) !== row.latestCommit) return {
+        name: row.name,
+        status: "failed",
+        restartRequired: true,
+        message: "\u5B9E\u9645 Git \u63D0\u4EA4\u4E0E\u68C0\u67E5\u7ED3\u679C\u4E0D\u4E00\u81F4\uFF0C\u8BF7\u91CD\u65B0\u68C0\u67E5\u540E\u91CD\u8BD5\uFF1B\u4E0D\u628A\u4ECD\u505C\u7559\u5728\u65E7\u9501\u6587\u4EF6\u7684\u5B89\u88C5\u62A5\u544A\u4E3A\u6210\u529F"
+      };
+    }
     return { name: row.name, status: "installed", application: result.application, message: result.application === "restart-required" ? "\u5DF2\u5B89\u88C5\uFF0C\u5B8C\u5168\u9000\u51FA\u5E76\u91CD\u65B0\u6253\u5F00 DSH \u540E\u751F\u6548" : "\u5B89\u88C5\u5B8C\u6210", restartRequired: result.application === "restart-required" };
   }
   update(names, registry) {
@@ -555,7 +620,8 @@ var PluginUpdates = class {
     else if (input.action === "plugins.cancel") {
       if (this.job?.state === "running") {
         this.job.cancelRequested = true;
-        if (this.job.kind !== "check") await this.service().cancelInstall?.(this.job.id);
+        if (this.gitAbort) this.gitAbort.abort();
+        else if (this.job.kind !== "check") await this.service().cancelInstall?.(this.job.id);
       }
     } else throw Error("\u672A\u77E5\u63D2\u4EF6\u64CD\u4F5C");
   }
@@ -668,7 +734,7 @@ var Manager = class {
         ...discovered.status.map((s) => ({ ...s, checkedAt: Date.now() }))
       ];
       if (this.closed || !discovered.accounts.length) return;
-      await withFileLock(this.file, async () => {
+      await withFileLock2(this.file, async () => {
         if (this.closed) return;
         let raw = JSON.parse(await readFile2(this.file, "utf8"));
         let changed = false;
@@ -735,7 +801,7 @@ var Manager = class {
             this.catalogs.delete(id);
             this.catalogErrors.delete(id);
           } catch (e) {
-            await rm2(staging, { recursive: true, force: true });
+            await rm3(staging, { recursive: true, force: true });
             this.localDiscovery = this.localDiscovery.map((s) => s.provider === item.provider ? { ...s, state: "unreadable", code: "import_failed" } : s);
           }
         }
@@ -754,7 +820,7 @@ var Manager = class {
   }
   async finishInitialSetup() {
     if (this.setup?.completedAt) return;
-    await withFileLock(this.setupFile, async () => {
+    await withFileLock2(this.setupFile, async () => {
       try {
         this.setup = JSON.parse(await readFile2(this.setupFile, "utf8"));
       } catch {
@@ -938,7 +1004,7 @@ var Manager = class {
         if (this.closed || !this.config.accounts.some((a) => a.id === account.id && a.credentialFile === account.credentialFile)) return;
         this.catalogs.set(account.id, { credentialFile: account.credentialFile, fetchedAt: Date.now(), pricingVersion: 1, models });
         this.catalogErrors.delete(account.id);
-        await withFileLock(this.catalogFile, () => writePrivateJson(this.catalogFile, Object.fromEntries(this.catalogs)));
+        await withFileLock2(this.catalogFile, () => writePrivateJson(this.catalogFile, Object.fromEntries(this.catalogs)));
       } catch (error) {
         if (this.closed || !this.config.accounts.some((a) => a.id === account.id)) return;
         this.catalogErrors.set(account.id, { status: Number(error.status ?? error.failure?.status) || 502, code: "catalog_fetch_failed", at: Date.now() });
@@ -999,7 +1065,7 @@ var Manager = class {
       return this.state();
     }
     if (input.action === "setup.dismiss") {
-      await withFileLock(this.setupFile, async () => {
+      await withFileLock2(this.setupFile, async () => {
         this.setup = { ...this.setup, completedAt: this.setup?.completedAt ?? Date.now(), dismissed: true };
         await writePrivateJson(this.setupFile, this.setup);
       });
@@ -1075,7 +1141,7 @@ var Manager = class {
       await this.checkFreeModels(true);
       return this.state();
     }
-    return withFileLock(this.file, async () => {
+    return withFileLock2(this.file, async () => {
       let raw = JSON.parse(await readFile2(this.file, "utf8"));
       if (input.revision !== revisionOf(raw)) throw new ManagementError(409, "\u914D\u7F6E\u5DF2\u66F4\u65B0\uFF0C\u8BF7\u5237\u65B0\u540E\u518D\u4FDD\u5B58");
       raw.routes ??= structuredClone(this.config.routes);
@@ -1262,7 +1328,7 @@ var Manager = class {
         this.publish();
         await this.telemetry.persist();
       } finally {
-        if (staging) await rm2(staging, { recursive: true, force: true });
+        if (staging) await rm3(staging, { recursive: true, force: true });
       }
       return this.state();
     }, { waitMs: 3e4 }).then(async (state) => {
@@ -1290,7 +1356,7 @@ var Manager = class {
       if (filename && String(filename) !== this.file.split(/[\\/]/).pop()) return;
       clearTimeout(timer);
       timer = setTimeout(() => {
-        void withFileLock(this.file, async () => {
+        void withFileLock2(this.file, async () => {
           const raw = JSON.parse(await readFile2(this.file, "utf8"));
           if (this.closed || revisionOf(raw) === this.revision) return;
           const config = validateConfig(raw, this.file);
@@ -1358,4 +1424,4 @@ export {
   Manager,
   managementHandler
 };
-//# sourceMappingURL=chunk-UQS7DNOQ.js.map
+//# sourceMappingURL=chunk-DZYRIZW2.js.map