dsh-opencode-palette 1.7.1 → 2.0.1

package/lib/event-list.json

@@ -0,0 +1,42 @@
+{
+  "version": 1,
+  "pluginId": "dsh-opencode-palette",
+  "counts": { "resident": 7, "ondemand": 0, "selfmon": 0 },
+  "events": {
+    "host.call": {
+      "level": "info",
+      "kind": "resident",
+      "fields": ["method", "latencyMs", "ok", "kind", "pluginId"]
+    },
+    "host.call.fail": {
+      "level": "warn",
+      "kind": "resident",
+      "fields": ["method", "kind", "errorHash", "pluginId"]
+    },
+    "update.install.exec": {
+      "level": "info",
+      "kind": "resident",
+      "fields": ["route", "ok", "exitCode", "durationMs", "pluginId"]
+    },
+    "log.forward.summary": {
+      "level": "warn",
+      "kind": "resident",
+      "fields": ["droppedDelta", "totalDropped", "reason", "windowMs"]
+    },
+    "log.switch.watchdog": {
+      "level": "warn",
+      "kind": "resident",
+      "fields": ["op", "timeoutMs", "stage"]
+    },
+    "log.export.fail": {
+      "level": "warn",
+      "kind": "resident",
+      "fields": ["op", "reason", "errorHash"]
+    },
+    "host.channel.fail": {
+      "level": "error",
+      "kind": "resident",
+      "fields": ["stage", "path", "reason"]
+    }
+  }
+}

package/lib/index.js

@@ -1,13 +1,161 @@
 /**
- * dsh-opencode-palette v1.7.1 — 宿主半（no-op）
+ * runtime/host.mjs — dsh-opencode-palette 宿主半（构建产物为 package/lib/index.js）
  *
- * 主题的全部工作在浏览器端（./client.js）完成：
- *   - 38 个 opencode 主题（37 内置 JSON：33 TUI + 4 桌面 2.0，另加 system）经数据驱动管线解析
- *   - theme.overrideTokens 覆盖注册 token + <style> 层 CSS 变量/元素规则
- * 宿主半只保证 loader 条目可解析、可挂载。
+ * 三件事：
+ *   1. 日志落盘：dsh-log 的宿主引擎，落 <DSH_HOME>/logs/dsh-opencode-palette/YYYY-MM-DD.log；
+ *   2. 更新三电话：dsh-plugin-update 的 createHostUpdate（查状态 / 查新版 / 装更新）；
+ *   3. 面板通道：自注册精确 HTTP 路由 /api/opencode-palette，把电话分发给浏览器半。
+ *
+ * 通道为什么不用 harness.handle / host.call：那套是 cordis_define 动态包专属的沙箱方言，
+ * 已安装插件的宿主半拿不到 harness、浏览器半拿不到 host（证据见地图 #14 的 #16 票结论）。
+ * 走 DSH 公开的 /api 载体：宿主 connection.fetch.register 注册精确路由，客户端
+ * connection.rpc.call('/api', 'opencode-palette', { method, payload })——与 deck、im-companion 同构。
+ *
+ * 更新包为什么走 ./vendor/ 相对路径而不是 import 'dsh-plugin-update'：
+ * 更新包的读取器用 containingPackage(import.meta.url, 目标包名) 从【自己的文件位置】往上找目标包。
+ * 以 npm 依赖形态安装时它住在 <profile>/node_modules/dsh-plugin-update，往上永远找不到
+ * dsh-opencode-palette，于是：运行版本读不到（host 入口直接抛 unknown-profile），且环境判定里的
+ * sameLoadedPackage 恒为假 → blockedReason 恒为 installation-changed → 一键升级永远不可用。
+ * 把它的 dist 原样放进本包 lib/vendor/ 下，import.meta.url 就落在本包内，两条判定都成立。
+ * vendor 副本由构建从 npm 包复制（见 scripts/build-client.mjs），门禁断言与 npm 包逐字节一致。
  */
-export const name = "dsh-opencode-palette"
+import { readFileSync } from 'node:fs'
+import { mkdir, readdir, readFile, unlink, writeFile } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { createHostLog, registerHostLogPhones } from 'dsh-log/host'
+import { createHostUpdate } from './vendor/dsh-plugin-update/host.js'
+import { PLUGIN_ID, PHONE_PREFIX, ROUTE_PATH, TARGET_PACKAGE_NAME } from './channel.mjs'
+
+export const name = PLUGIN_ID
+// 通道要 connection；subprocess / desktopProfiles / desktopPnpm 由更新包自己按需取（它内部注入），
+// 不写进顶层 inject：普通 DSH 没有 desktop* 服务，写进顶层会让插件在普通宿主里装配失败。
+export const inject = ['connection']
+
+// 落点：<DSH_HOME>/logs/dsh-opencode-palette/YYYY-MM-DD.log，开关 <DSH_HOME>/logs/log-switch-dsh-opencode-palette.json
+// （与同机 dsh-prompt 的既成落点同构；DSH 不提供 cache 目录 API，缓存根只有 <DSH_HOME>）
+const LOG_DIR_NAME = PLUGIN_ID
+const SWITCH_FILE_NAME = 'log-switch-' + PLUGIN_ID + '.json'
+const RPC_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/
+const ENDPOINT_PATTERN = /^[A-Za-z0-9_$.-]+$/
+
+const PACKAGE_DIR = dirname(dirname(fileURLToPath(import.meta.url)))
+
+/** 本进程正在跑的版本：启动那一刻读自己的 package.json（= 加载进内存的那份代码的版本）。
+ *  不能用「每次调用现读磁盘」的写法：装完新版后磁盘版本会变，进程里跑的却还是旧的，
+ *  现读会让 pending-restart 永远判不出来（更新包据此决定是否提示「待重启」）。 */
+export const runningVersion = readRunningVersion()
+function readRunningVersion() {
+  try {
+    const manifest = JSON.parse(readFileSync(join(PACKAGE_DIR, 'package.json'), 'utf8'))
+    return typeof manifest.version === 'string' ? manifest.version : '0.0.0'
+  } catch {
+    return '0.0.0'
+  }
+}
+
+/** 事件清单：随包落 lib/event-list.json（构建从 runtime/event-list.json 复制）。读不到就用 null（日志照记，只是没有白名单元数据）。 */
+export function readEventList() {
+  try {
+    return JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), 'event-list.json'), 'utf8'))
+  } catch {
+    return null
+  }
+}
+
+/** DSH 家目录：$DSH_HOME（去空白后非空）否则 ~/.dsh，与 @deepseek-ai/dsh-home-paths 同一规则
+ *  （更新包的 defaultHomeDir 也是同一条；tests/update-integration.test.mjs 里有两边一致的断言）。 */
+export function dshHomeDir(env, osHome) {
+  const raw = env && typeof env.DSH_HOME === 'string' && env.DSH_HOME.trim() ? env.DSH_HOME : join(osHome, '.dsh')
+  return raw === '~' ? osHome : raw.replace(/^~[\\/]/, osHome + '/')
+}
+
+/** 给日志包的文件服务（INTEGRATION.md 步骤 2 的形状表）：六个方法全走 node:fs/promises。
+ *  为什么不直接传 ctx.get('fs')：DSH 的 fs 服务没有 mkdir / unlink，且部署的是沙箱实现
+ *  （workspace-write 只允许写 workspace 内），写用户家目录会被 FS_SANDBOX_DENIED 拒掉。 */
+export function createLogFileService(readTextImpl, writeTextImpl, mkdirImpl, unlinkImpl, listDirImpl) {
+  return {
+    resolve: function (pathStr) { return String(pathStr) },
+    readText: function (target) { return readTextImpl(String(target), 'utf8') },
+    writeText: function (target, text) { return writeTextImpl(String(target), String(text), 'utf8') },
+    mkdir: function (dir) { return mkdirImpl(String(dir), { recursive: true }) },
+    unlink: function (target) { return unlinkImpl(String(target)) },
+    listDir: function (dirTarget) { return listDirImpl(String(dirTarget)) },
+  }
+}
+
+/** 宿主半装配入口：建日志库 → 建更新电话 → 合成电话表 → 注册通道。 */
+export function apply(ctx) {
+  const homeDir = dshHomeDir(process.env, homedir())
+  const eventList = readEventList()
+
+  const hostLog = createHostLog(
+    {
+      fs: createLogFileService(readFile, writeFile, mkdir, unlink, readdir),
+      timer: ctx.get('timer'),
+      getCacheDir: function () { return join(homeDir, 'logs') },
+      getPlatform: function () { return { os: process.platform, path: { join: join }, fs: null } },
+      DEFAULT_CWD: process.cwd(),
+    },
+    { pluginId: PLUGIN_ID, prefix: PHONE_PREFIX, logDirName: LOG_DIR_NAME, switchFileName: SWITCH_FILE_NAME, eventList: eventList }
+  )
+
+  const registry = new Map()
+  registerHostLogPhones(registry, hostLog)
+
+  const update = createHostUpdate(
+    { ctx: ctx, logCtx: { fire: function (level, event, fields) { return hostLog.store.log(level, event, fields) } }, readerOverrides: { runningVersion: runningVersion } },
+    { pluginId: PLUGIN_ID, prefix: PHONE_PREFIX, targetPackageName: TARGET_PACKAGE_NAME }
+  )
+  for (const phoneName of Object.keys(update.handlers)) registry.set(phoneName, update.handlers[phoneName])
+
+  const fail = function (stage, reason) {
+    try { hostLog.store.log('error', 'host.channel.fail', { stage: stage, path: ROUTE_PATH, reason: String(reason).slice(0, 120) }) } catch (e) { /* 忽略 */ }
+  }
+
+  const dispatch = async function (phoneName, args) {
+    const handler = registry.get(phoneName)
+    if (typeof handler !== 'function') {
+      return { ok: false, error: { code: 'internal', message: 'unknown phone: ' + phoneName, details: {} } }
+    }
+    try {
+      return { ok: true, value: await handler(args === null || args === undefined ? {} : args) }
+    } catch (e) {
+      fail('dispatch', String((e && e.message) || e))
+      return { ok: false, error: { code: 'internal', message: String((e && e.message) || e), details: {} } }
+    }
+  }
+
+  const routeFetch = async function (request) {
+    if (!request || request.method !== 'POST') return new Response('method not allowed', { status: 405 })
+    let body = null
+    try { body = await request.json() } catch (e) { return new Response('body is not JSON', { status: 400 }) }
+    const rpcId = typeof (body && body.rpcId) === 'string' && RPC_ID_PATTERN.test(body.rpcId) ? body.rpcId : 'invalid-request'
+    const reply = function (result) { return Response.json({ type: 'server-response', rpcId: rpcId, result: result }) }
+    const reject = function (why) { return reply({ ok: false, error: { code: 'gateway/bad-request', message: why, details: {} } }) }
+    if (!body || body.type !== 'client-request') return reject('invalid client-request message')
+    const call = body.payload
+    if (call === null || typeof call !== 'object') return reject('missing call payload')
+    const phoneName = call.method
+    if (typeof phoneName !== 'string' || !ENDPOINT_PATTERN.test(phoneName)) return reject('invalid phone name')
+    const pathname = String((request.url && request.url.split('?')[0]) || '')
+    if (!pathname.endsWith(ROUTE_PATH)) return reject('request path is not on route ' + ROUTE_PATH)
+    return reply(await dispatch(phoneName, call.payload))
+  }
 
-export function apply() {
-  // no-op：客户端半负责一切
+  try {
+    const connection = ctx.get('connection')
+    const fetchRegistry = connection === undefined || connection === null ? undefined : connection.fetch
+    if (fetchRegistry === undefined || typeof fetchRegistry.register !== 'function') {
+      fail('register', 'connection.fetch.register-missing')
+      return
+    }
+    fetchRegistry.register({ path: ROUTE_PATH, methods: ['POST'], requestBody: 'buffered', fetch: routeFetch })
+  } catch (e) {
+    const message = String((e && e.message) || e)
+    // 重复注册（live patch reload / 回滚重放）算让位：那个实例继续服务即可，不当故障。
+    if (message.indexOf('already registered') >= 0 || message.indexOf('duplicate') >= 0) return
+    fail('register', message)
+  }
 }

package/lib/vendor/dsh-plugin-update/client.js

@@ -0,0 +1,30 @@
+// 派生文件（构建生成，人手不改）：由 npm 包 dsh-plugin-update@0.1.1 的 dist/ 原样复制。
+// 为什么必须放进本包：更新包的读取器用 containingPackage(import.meta.url, 目标包名) 从自己的文件位置
+// 往上找目标包；以 npm 依赖形态安装时它住在别的目录，会抛 unknown-profile 且环境判定恒为 installation-changed。
+// 门禁：tests/update-panel.test.mjs 断言本副本与 npm 包逐字节一致（除本头部）。
+// vendor-source: dsh-plugin-update@0.1.1 dist/client.js
+// AUTO-GENERATED by node packages/dsh-plugin-update/build.mjs — DO NOT EDIT. Source: packages/dsh-plugin-update/src/client.ts
+import { buildPhoneNames, DEFAULT_PANEL_POLL_MS, MIN_PANEL_POLL_MS } from "./config.js";
+import { buildPhoneName, buildPhoneNames as buildPhoneNames2 } from "./config.js";
+import { manualCommand as manualCommand2 } from "./commands.js";
+const CLIENT_POLL = {
+  defaultMs: DEFAULT_PANEL_POLL_MS,
+  minMs: MIN_PANEL_POLL_MS
+};
+function buildClientPhoneNames(prefix) {
+  return buildPhoneNames(prefix);
+}
+function assertPollInterval(ms) {
+  if (typeof ms !== "number" || !Number.isFinite(ms) || ms < MIN_PANEL_POLL_MS) {
+    throw new Error("[dsh-plugin-update] \u9762\u677F\u8F6E\u8BE2\u95F4\u9694\u975E\u6CD5\uFF1A\u4E0D\u5F97\u5C0F\u4E8E 250 \u6BEB\u79D2\uFF08\u6536\u5230 " + JSON.stringify(ms) + "\uFF09");
+  }
+  return ms;
+}
+export {
+  CLIENT_POLL,
+  assertPollInterval,
+  buildClientPhoneNames,
+  buildPhoneName,
+  buildPhoneNames2 as buildPhoneNames,
+  manualCommand2 as manualCommand
+};

package/lib/vendor/dsh-plugin-update/commands.js

@@ -0,0 +1,85 @@
+// 派生文件（构建生成，人手不改）：由 npm 包 dsh-plugin-update@0.1.1 的 dist/ 原样复制。
+// 为什么必须放进本包：更新包的读取器用 containingPackage(import.meta.url, 目标包名) 从自己的文件位置
+// 往上找目标包；以 npm 依赖形态安装时它住在别的目录，会抛 unknown-profile 且环境判定恒为 installation-changed。
+// 门禁：tests/update-panel.test.mjs 断言本副本与 npm 包逐字节一致（除本头部）。
+// vendor-source: dsh-plugin-update@0.1.1 dist/commands.js
+// AUTO-GENERATED by node packages/dsh-plugin-update/build.mjs — DO NOT EDIT. Source: packages/dsh-plugin-update/src/commands.ts
+const PACKAGE_NAME = "dsh-mattpocock-skills-deck";
+const NPM_REGISTRY = "https://registry.npmjs.org/";
+const INSTALL_TIMEOUT_MS = 15 * 6e4;
+function validVersion(v) {
+  return typeof v === "string" && /^\d+\.\d+\.\d+$/.test(v);
+}
+function parseTriple(v) {
+  const parts = String(v).split(".");
+  if (parts.length > 3) return null;
+  const nums = [];
+  for (const p of parts) {
+    if (!/^\d+$/.test(p)) return null;
+    const n = Number(p);
+    if (!Number.isSafeInteger(n)) return null;
+    nums.push(n);
+  }
+  while (nums.length < 3) nums.push(0);
+  return [nums[0], nums[1], nums[2]];
+}
+function compareVersions(a, b) {
+  const pa = parseTriple(a);
+  const pb = parseTriple(b);
+  if (!pa || !pb) throw new Error("invalid-release");
+  for (let i = 0; i < 3; i++) {
+    if (pa[i] < pb[i]) return -1;
+    if (pa[i] > pb[i]) return 1;
+  }
+  return 0;
+}
+function usableProfileName(raw) {
+  const name = typeof raw === "string" ? raw.trim() : "";
+  if (!name || name.length > 255 || name.startsWith("-")) return null;
+  if ([".", "..", "node_modules"].includes(name)) return null;
+  return name;
+}
+function installRecipe(input) {
+  const name = usableProfileName(input?.profileName);
+  const version = input?.version;
+  if (!name || !validVersion(version)) return null;
+  const kind = input?.environmentKind;
+  if (kind !== "desktop" && kind !== "cli") return null;
+  const targetName = input?.targetPackageName ?? PACKAGE_NAME;
+  const registry = input?.registryUrl ?? NPM_REGISTRY;
+  const timeoutMs = input?.timeoutMs ?? INSTALL_TIMEOUT_MS;
+  if (!targetName || !registry) return null;
+  return {
+    route: kind === "desktop" ? "desktop-service" : "cli-process",
+    profileName: name,
+    version,
+    // 参数数组原样交给命令行工具：使用范围名不做引号包裹、不按空格拆分。
+    pluginArgs: ["add", "--save-exact", `${targetName}@${version}`, `--registry=${registry}`],
+    timeoutMs
+  };
+}
+function manualCommand(input) {
+  if (input.sourceInstall || input.blockedReason === "source-install" || input.blockedReason === "unknown-profile") return null;
+  const name = usableProfileName(input.profileName);
+  if (!name) return null;
+  const targetName = input.targetPackageName ?? PACKAGE_NAME;
+  const registry = input.registryUrl ?? NPM_REGISTRY;
+  if (!targetName || !registry) return null;
+  const arg = /^[A-Za-z0-9_.-]+$/.test(name) ? name : JSON.stringify(name);
+  const picks = [input.latestVersion, input.jobTargetVersion, input.installedVersion].filter(validVersion);
+  let version = picks.length > 0 ? picks[0] : "latest";
+  try {
+    const ranked = picks.filter((v) => compareVersions(v, input.runningVersion) >= 0);
+    if (ranked.length > 0) {
+      version = ranked[0];
+      for (const v of ranked) if (compareVersions(v, version) === 1) version = v;
+    }
+  } catch {
+  }
+  return `dsh plugin --profile ${arg} add --save-exact ${targetName}@${version} --registry=${registry}`;
+}
+export {
+  INSTALL_TIMEOUT_MS,
+  installRecipe,
+  manualCommand
+};

package/lib/vendor/dsh-plugin-update/config.js

@@ -0,0 +1,102 @@
+// 派生文件（构建生成，人手不改）：由 npm 包 dsh-plugin-update@0.1.1 的 dist/ 原样复制。
+// 为什么必须放进本包：更新包的读取器用 containingPackage(import.meta.url, 目标包名) 从自己的文件位置
+// 往上找目标包；以 npm 依赖形态安装时它住在别的目录，会抛 unknown-profile 且环境判定恒为 installation-changed。
+// 门禁：tests/update-panel.test.mjs 断言本副本与 npm 包逐字节一致（除本头部）。
+// vendor-source: dsh-plugin-update@0.1.1 dist/config.js
+// AUTO-GENERATED by node packages/dsh-plugin-update/build.mjs — DO NOT EDIT. Source: packages/dsh-plugin-update/src/config.ts
+const DEFAULT_PREFIX = "wf";
+const PHONE_ACTIONS = ["updateStatus", "updateCheck", "updateInstall"];
+const DEFAULT_TARGET_PACKAGE = "dsh-mattpocock-skills-deck";
+const DEFAULT_REGISTRY = "https://registry.npmjs.org/";
+const LEGACY_PLUGIN_ID = "dsh-mattpocock-skills-deck";
+const LEGACY_DIR_SEGMENT = "updates";
+const STATE_FILE = "state.json";
+const LOCK_FILE = "install.lock";
+const BACKUP_FILE = "before.json";
+const DEFAULT_CHECK_TIMEOUT_MS = 1e4;
+const DEFAULT_CONFIRMATION_TTL_MS = 10 * 6e4;
+const DEFAULT_INSTALL_TIMEOUT_MS = 15 * 6e4;
+const DEFAULT_PANEL_POLL_MS = 1e3;
+const RECHECK_WINDOW_MS = 2e3;
+const MIN_PANEL_POLL_MS = 250;
+function assertPluginId(value) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error("[dsh-plugin-update] \u63D2\u4EF6\u6807\u8BC6 pluginId \u5FC5\u586B\uFF1A\u987B\u4E3A\u975E\u7A7A\u5B57\u7B26\u4E32\uFF08\u6536\u5230 " + JSON.stringify(value) + "\uFF09");
+  }
+  if (value.includes("/") || value.includes("\\") || value.includes("\0")) {
+    throw new Error("[dsh-plugin-update] \u63D2\u4EF6\u6807\u8BC6 pluginId \u975E\u6CD5\uFF1A\u4E0D\u5F97\u542B\u6709\u8DEF\u5F84\u5206\u9694\u7B26\uFF08\u6536\u5230 " + JSON.stringify(value) + "\uFF09");
+  }
+  return value;
+}
+function assertPrefix(value, role) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error("[dsh-plugin-update] " + role + " \u975E\u6CD5\uFF1A\u987B\u4E3A\u975E\u7A7A\u5B57\u7B26\u4E32\uFF08\u6536\u5230 " + JSON.stringify(value) + "\uFF09");
+  }
+  if (value.includes(".") || value.includes("/") || value.includes("\\") || /\s/.test(value)) {
+    throw new Error("[dsh-plugin-update] " + role + " \u975E\u6CD5\uFF1A\u4E0D\u5F97\u542B\u6709\u70B9\u3001\u8DEF\u5F84\u5206\u9694\u7B26\u6216\u7A7A\u767D\uFF08\u6536\u5230 " + JSON.stringify(value) + "\uFF09");
+  }
+  return value;
+}
+function assertPositiveFinite(value, role) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {
+    throw new Error("[dsh-plugin-update] " + role + " \u975E\u6CD5\uFF1A\u987B\u4E3A\u6709\u9650\u5927\u4E8E 0 \u7684\u6570\uFF08\u6536\u5230 " + JSON.stringify(value) + "\uFF09");
+  }
+  return value;
+}
+function resolveUpdateConfig(input) {
+  if (!input || typeof input !== "object") {
+    throw new Error("[dsh-plugin-update] \u5EFA\u66F4\u65B0\u80FD\u529B\u7F3A\u5C11\u914D\u7F6E\uFF1A\u63D2\u4EF6\u6807\u8BC6 pluginId \u5FC5\u586B");
+  }
+  const pluginId = assertPluginId(input.pluginId);
+  const prefix = input.prefix === void 0 ? DEFAULT_PREFIX : assertPrefix(input.prefix, "\u7535\u8BDD\u540D\u524D\u7F00 prefix");
+  const targetPackageName = input.targetPackageName === void 0 ? DEFAULT_TARGET_PACKAGE : String(input.targetPackageName);
+  if (!targetPackageName) {
+    throw new Error("[dsh-plugin-update] \u76EE\u6807\u5305\u540D targetPackageName \u975E\u6CD5\uFF1A\u987B\u4E3A\u975E\u7A7A\u5B57\u7B26\u4E32");
+  }
+  const registryUrl = input.registryUrl === void 0 ? DEFAULT_REGISTRY : String(input.registryUrl);
+  if (!registryUrl) {
+    throw new Error("[dsh-plugin-update] \u5B98\u65B9\u6E90 registryUrl \u975E\u6CD5\uFF1A\u987B\u4E3A\u975E\u7A7A\u5B57\u7B26\u4E32");
+  }
+  const homeDir = input.homeDir === void 0 ? null : String(input.homeDir);
+  const checkTimeoutMs = input.checkTimeoutMs === void 0 ? DEFAULT_CHECK_TIMEOUT_MS : assertPositiveFinite(input.checkTimeoutMs, "\u8054\u7F51\u8D85\u65F6 checkTimeoutMs");
+  const confirmationTtlMs = input.confirmationTtlMs === void 0 ? DEFAULT_CONFIRMATION_TTL_MS : assertPositiveFinite(input.confirmationTtlMs, "\u51ED\u8BC1\u6709\u6548\u671F confirmationTtlMs");
+  const installTimeoutMs = input.installTimeoutMs === void 0 ? DEFAULT_INSTALL_TIMEOUT_MS : assertPositiveFinite(input.installTimeoutMs, "\u5B89\u88C5\u65F6\u9650 installTimeoutMs");
+  const panelPollMs = input.panelPollMs === void 0 ? DEFAULT_PANEL_POLL_MS : assertPositiveFinite(input.panelPollMs, "\u9762\u677F\u8F6E\u8BE2 panelPollMs");
+  if (panelPollMs < MIN_PANEL_POLL_MS) {
+    throw new Error("[dsh-plugin-update] \u9762\u677F\u8F6E\u8BE2 panelPollMs \u975E\u6CD5\uFF1A\u4E0D\u5F97\u5C0F\u4E8E 250 \u6BEB\u79D2\uFF08\u6536\u5230 " + JSON.stringify(input.panelPollMs) + "\uFF09");
+  }
+  return { pluginId, prefix, targetPackageName, registryUrl, homeDir, checkTimeoutMs, confirmationTtlMs, installTimeoutMs, panelPollMs };
+}
+function buildPhoneNames(prefix) {
+  const checked = assertPrefix(prefix, "\u7535\u8BDD\u540D\u524D\u7F00 prefix");
+  return {
+    updateStatus: checked + ".updateStatus",
+    updateCheck: checked + ".updateCheck",
+    updateInstall: checked + ".updateInstall"
+  };
+}
+function buildPhoneName(prefix, action) {
+  return buildPhoneNames(prefix)[action];
+}
+export {
+  BACKUP_FILE,
+  DEFAULT_CHECK_TIMEOUT_MS,
+  DEFAULT_CONFIRMATION_TTL_MS,
+  DEFAULT_INSTALL_TIMEOUT_MS,
+  DEFAULT_PANEL_POLL_MS,
+  DEFAULT_PREFIX,
+  DEFAULT_REGISTRY,
+  DEFAULT_TARGET_PACKAGE,
+  LEGACY_DIR_SEGMENT,
+  LEGACY_PLUGIN_ID,
+  LOCK_FILE,
+  MIN_PANEL_POLL_MS,
+  PHONE_ACTIONS,
+  RECHECK_WINDOW_MS,
+  STATE_FILE,
+  assertPluginId,
+  assertPrefix,
+  buildPhoneName,
+  buildPhoneNames,
+  resolveUpdateConfig
+};

package/lib/vendor/dsh-plugin-update/gate.js

@@ -0,0 +1,120 @@
+// 派生文件（构建生成，人手不改）：由 npm 包 dsh-plugin-update@0.1.1 的 dist/ 原样复制。
+// 为什么必须放进本包：更新包的读取器用 containingPackage(import.meta.url, 目标包名) 从自己的文件位置
+// 往上找目标包；以 npm 依赖形态安装时它住在别的目录，会抛 unknown-profile 且环境判定恒为 installation-changed。
+// 门禁：tests/update-panel.test.mjs 断言本副本与 npm 包逐字节一致（除本头部）。
+// vendor-source: dsh-plugin-update@0.1.1 dist/gate.js
+// AUTO-GENERATED by node packages/dsh-plugin-update/build.mjs — DO NOT EDIT. Source: packages/dsh-plugin-update/src/gate.ts
+import { assertPluginId } from "./config.js";
+const EVENT_LEVELS = ["error", "warn", "info", "debug"];
+const EVENT_KINDS = ["resident", "ondemand", "selfmon"];
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function assertStringArray(value, what) {
+  if (!Array.isArray(value)) throw new Error("[dsh-plugin-update] \u4E8B\u4EF6\u6E05\u5355 eventList \u975E\u6CD5\uFF1A" + what + " \u5FC5\u987B\u662F\u5B57\u7B26\u4E32\u6570\u7EC4");
+  const seen = [];
+  for (const item of value) {
+    if (!isNonEmptyString(item)) throw new Error("[dsh-plugin-update] \u4E8B\u4EF6\u6E05\u5355 eventList \u975E\u6CD5\uFF1A" + what + " \u91CC\u6709\u7A7A\u5B57\u6BB5\u540D");
+    if (seen.indexOf(item) >= 0) throw new Error("[dsh-plugin-update] \u4E8B\u4EF6\u6E05\u5355 eventList \u975E\u6CD5\uFF1A" + what + " \u91CC\u5B57\u6BB5\u540D\u91CD\u590D\uFF1A" + item);
+    seen.push(item);
+  }
+  return seen;
+}
+function parseEventListManifest(value) {
+  if (typeof value === "string") {
+    throw new Error("[dsh-plugin-update] \u4E8B\u4EF6\u6E05\u5355 eventList \u975E\u6CD5\uFF1A\u8DEF\u5F84\u5F62\u5F0F\u8BF7\u8C03\u7528\u65B9\u81EA\u5DF1\u8BFB\u6210\u5BF9\u8C61\u518D\u4F20\u5165\uFF0C\u66F4\u65B0\u5305\u4E0D\u8BFB\u76D8");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("[dsh-plugin-update] \u4E8B\u4EF6\u6E05\u5355 eventList \u975E\u6CD5\uFF1A\u53EA\u6536\u5BF9\u8C61\u5F62\u5F0F\uFF08\u7A7A\u6A21\u677F\u89C1\u5305\u5185\u7684 event-list.template.json\uFF09");
+  }
+  const input = value;
+  if (input["version"] !== 1) {
+    throw new Error("[dsh-plugin-update] \u4E8B\u4EF6\u6E05\u5355 eventList \u975E\u6CD5\uFF1Aversion \u73B0\u5728\u53EA\u8BA4 1\uFF08\u6536\u5230 " + JSON.stringify(input["version"]) + "\uFF09");
+  }
+  const pluginId = assertPluginId(input["pluginId"]);
+  const countsRaw = input["counts"];
+  if (!countsRaw || typeof countsRaw !== "object" || Array.isArray(countsRaw)) {
+    throw new Error("[dsh-plugin-update] \u4E8B\u4EF6\u6E05\u5355 eventList \u975E\u6CD5\uFF1Acounts \u5FC5\u987B\u662F\u542B\u4E09\u7C7B\u8BA1\u6570\u7684\u5BF9\u8C61");
+  }
+  const countsRecord = countsRaw;
+  const counts = { resident: 0, ondemand: 0, selfmon: 0 };
+  for (const kind of EVENT_KINDS) {
+    const n = countsRecord[kind];
+    if (typeof n !== "number" || !isFinite(n) || Math.floor(n) !== n || n < 0) {
+      throw new Error("[dsh-plugin-update] \u4E8B\u4EF6\u6E05\u5355 eventList \u975E\u6CD5\uFF1Acounts." + kind + " \u5FC5\u987B\u662F\u975E\u8D1F\u6574\u6570");
+    }
+    counts[kind] = n;
+  }
+  const eventsRaw = input["events"];
+  if (!eventsRaw || typeof eventsRaw !== "object" || Array.isArray(eventsRaw)) {
+    throw new Error("[dsh-plugin-update] \u4E8B\u4EF6\u6E05\u5355 eventList \u975E\u6CD5\uFF1Aevents \u5FC5\u987B\u662F\u4E8B\u4EF6\u540D\u5230\u6761\u76EE\u7684\u5BF9\u8C61");
+  }
+  const events = {};
+  for (const name of Object.keys(eventsRaw)) {
+    events[name] = parseEventEntry(name, eventsRaw[name]);
+  }
+  return { version: 1, pluginId, counts, events };
+}
+function parseEventEntry(name, value) {
+  if (!isNonEmptyString(name)) throw new Error("[dsh-plugin-update] \u4E8B\u4EF6\u6E05\u5355 eventList \u975E\u6CD5\uFF1A\u4E8B\u4EF6\u540D\u4E0D\u80FD\u4E3A\u7A7A");
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("[dsh-plugin-update] \u4E8B\u4EF6\u6E05\u5355 eventList \u975E\u6CD5\uFF1A\u4E8B\u4EF6 " + name + " \u5FC5\u987B\u662F\u5BF9\u8C61");
+  }
+  const input = value;
+  if (EVENT_LEVELS.indexOf(input["level"]) < 0) {
+    throw new Error("[dsh-plugin-update] \u4E8B\u4EF6\u6E05\u5355 eventList \u975E\u6CD5\uFF1A\u4E8B\u4EF6 " + name + " \u7684 level \u53EA\u8BB8 error\u3001warn\u3001info\u3001debug");
+  }
+  if (EVENT_KINDS.indexOf(input["kind"]) < 0) {
+    throw new Error("[dsh-plugin-update] \u4E8B\u4EF6\u6E05\u5355 eventList \u975E\u6CD5\uFF1A\u4E8B\u4EF6 " + name + " \u7684 kind \u53EA\u8BB8 resident\u3001ondemand\u3001selfmon");
+  }
+  for (const key of Object.keys(input)) {
+    if (["level", "kind", "fields", "codes", "rules", "guard"].indexOf(key) < 0) {
+      throw new Error("[dsh-plugin-update] \u4E8B\u4EF6\u6E05\u5355 eventList \u975E\u6CD5\uFF1A\u4E8B\u4EF6 " + name + " \u6709\u4E0D\u8BA4\u8BC6\u7684\u952E " + key);
+    }
+  }
+  const entry = {
+    level: input["level"],
+    kind: input["kind"],
+    fields: assertStringArray(input["fields"], "\u4E8B\u4EF6 " + name + " \u7684 fields")
+  };
+  if (input["codes"] !== void 0) entry.codes = assertStringArray(input["codes"], "\u4E8B\u4EF6 " + name + " \u7684 codes");
+  if (input["rules"] !== void 0) entry.rules = assertStringArray(input["rules"], "\u4E8B\u4EF6 " + name + " \u7684 rules");
+  if (input["guard"] !== void 0) {
+    if (typeof input["guard"] !== "string") {
+      throw new Error("[dsh-plugin-update] \u4E8B\u4EF6\u6E05\u5355 eventList \u975E\u6CD5\uFF1A\u4E8B\u4EF6 " + name + " \u7684 guard \u5FC5\u987B\u662F\u5B57\u7B26\u4E32");
+    }
+    entry.guard = input["guard"];
+  }
+  return entry;
+}
+function checkEventFields(manifest, eventName, fieldNames) {
+  const entry = manifest.events[eventName];
+  if (!entry) return { ok: false, unknownEvent: true, unknownFields: [] };
+  const allowed = new Set(entry.fields);
+  const unknownFields = (Array.isArray(fieldNames) ? fieldNames : []).filter(
+    (field) => !allowed.has(field)
+  );
+  return { ok: unknownFields.length === 0, unknownEvent: false, unknownFields };
+}
+function checkEventCounts(manifest) {
+  const actual = { resident: 0, ondemand: 0, selfmon: 0 };
+  for (const name of Object.keys(manifest.events)) {
+    actual[manifest.events[name].kind] += 1;
+  }
+  const problems = [];
+  for (const kind of EVENT_KINDS) {
+    if (actual[kind] !== manifest.counts[kind]) {
+      problems.push(
+        "[dsh-plugin-update] \u4E8B\u4EF6\u6E05\u5355\u8BA1\u6570\u5BF9\u4E0D\u4E0A\uFF1A" + kind + " \u7C7B\u5B9E\u9645 " + actual[kind] + " \u6761\uFF0C\u6E05\u5355\u81EA\u62A5 " + manifest.counts[kind] + " \u6761"
+      );
+    }
+  }
+  return { ok: problems.length === 0, problems };
+}
+export {
+  EVENT_KINDS,
+  EVENT_LEVELS,
+  checkEventCounts,
+  checkEventFields,
+  parseEventListManifest
+};