dsh-plugin-marketplace 0.2.5 → 0.2.7

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Scorp1o117
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 Scorp1o117
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -50,13 +50,10 @@ Manual mount in `$DSH_HOME/profiles/web/cordis.patch.yml`:
 Then restart `dsh web` (new client plugins require a process restart to be
 scanned into the browser roster) and open **Settings → Plugin Marketplace**.
 
-**If the install button answers `settings namespace "plugin-marketplace" is
-not exposed to configuration clients`**: the host apiproxy only lets a
-hard-coded allowlist through, and this plugin patches that allowlist on its
-first boot — the running process still answers `settings-not-exposed` until
-`dsh web` is restarted. Restart once; if the error persists, check the boot
-log for `[settings-expose]` lines (the fix line names the file to edit —
-`WEB_SETTINGS_NAMESPACES` in `dsh-host-apiproxy/lib/index.js`).
+DSH `0.1.1-rc.1` and newer expose every registered settings namespace, so the
+marketplace works without patching official files. Older hosts that return
+`settings-not-exposed` should be upgraded instead of modifying
+`dsh-host-apiproxy` in `node_modules`.
 
 ## How it works
 

package/README.zh.md

@@ -41,11 +41,9 @@ dsh plugin --profile web add dsh-plugin-marketplace
 
 然后重启 `dsh web`（新客户端插件需要重启进程才会被扫描进浏览器清单），打开 **设置 → 插件市场**。
 
-**如果点安装按钮报 `settings namespace "plugin-marketplace" is not exposed to
-configuration clients`**：宿主 apiproxy 只放行硬编码白名单里的命名空间，本插件会在
-首次启动时自动把命名空间补进白名单——但当前进程要到**重启 `dsh web`** 之后才会放行。
-重启一次即可；若重启后仍报错，看启动日志里的 `[settings-expose]` 提示（它会指出要手动
-编辑的文件：`dsh-host-apiproxy/lib/index.js` 的 `WEB_SETTINGS_NAMESPACES`）。
+DSH `0.1.1-rc.1` 起会公开全部已注册的 settings 命名空间，插件市场无需再修改官方文件。
+旧宿主若返回 `settings-not-exposed`，请升级 DSH，不要手动修改 `node_modules` 中的
+`dsh-host-apiproxy`。
 
 ## 实现方式
 

package/client.js

@@ -82,7 +82,7 @@ window.__ModuleLoader__.load({
       aiExplain: "🤖 AI 解释",
       aiExplaining: "AI 解释中，请稍候…",
       aiExplainErr: "AI 解释失败：{msg}",
-      notExposed: "设置通道未就绪：插件市场的命名空间还没被配置客户端放行。刚安装/升级过的话，请重启 dsh web；若重启后仍报错，请查看启动日志里的 [settings-expose] 提示（可能需要手动把 \"plugin-marketplace\" 加入 dsh-host-apiproxy 的 WEB_SETTINGS_NAMESPACES）。"
+      notExposed: "当前 DSH 版本没有公开插件市场的设置通道；请升级到 DSH 0.1.1-rc.1 或更高版本并重启 dsh web。"
     };
     var en = {
       nav: "Plugin Marketplace",
@@ -113,7 +113,7 @@ window.__ModuleLoader__.load({
       aiExplain: "🤖 AI Explain",
       aiExplaining: "AI is explaining…",
       aiExplainErr: "AI explain failed: {msg}",
-      notExposed: "Settings channel not ready: the plugin-marketplace namespace is not yet exposed to configuration clients. If you just installed/upgraded, restart dsh web; if it persists, check the [settings-expose] lines in the boot log (you may need to add \"plugin-marketplace\" to WEB_SETTINGS_NAMESPACES in dsh-host-apiproxy/lib/index.js manually)."
+      notExposed: "This DSH version does not expose the plugin-marketplace settings channel. Upgrade to DSH 0.1.1-rc.1 or newer and restart dsh web."
     };
 
     // ── GitHub API ────────────────────────────────────────────────────────
@@ -207,7 +207,10 @@ window.__ModuleLoader__.load({
       var st = props.installState; // {status, message, pkg} from the settings scope
       var active = st && st.pkg === installName;
       var status = active ? st.status : "idle";
-      var explainState = props.explainState; // {status, text} from the settings scope
+      var explainState = props.explainState; // {status, text, repo} from the settings scope
+      // The settings field is namespace-global and persists across sessions,
+      // so only show it when it belongs to the plugin currently open.
+      var explainMine = !!explainState && explainState.repo === p.fullName;
       var [confirming, setConfirming] = react.useState(false);
       var statusNode = null;
       if (status === "running") {
@@ -264,14 +267,14 @@ window.__ModuleLoader__.load({
         h("div", { className: "__mp_translateRow" },
           h("button", { type: "button", className: "__mp_translateBtn",
             style: { marginTop: "8px", padding: "4px 10px", fontSize: "12px", cursor: "pointer", background: "var(--dsw-alias-bg-hover, #21262d)", color: "var(--dsw-alias-label-primary, #e6edf3)", border: "1px solid var(--dsw-alias-border, #30363d)", borderRadius: "6px" },
-            disabled: explainState && explainState.status === "running",
+            disabled: explainMine && explainState.status === "running",
             onClick: function () { props.onExplain(p.fullName, p.desc, props.readme || ""); }
           }, props.t("aiExplain")),
           h("div", { id: "__mp_translateOut", style: { fontSize: "12px", lineHeight: "1.6", color: "var(--dsw-alias-label-secondary, #8b949e)", whiteSpace: "pre-wrap", wordBreak: "break-word", marginTop: "8px", borderTop: "1px solid var(--dsw-alias-border, #21262d)", paddingTop: "8px" } },
-            props.explainError ? h("span", { style: { color: "var(--dsw-alias-state-danger-text, #f85149)" } }, props.explainError)
-              : explainState && explainState.status === "running" ? props.t("aiExplaining")
-              : explainState && explainState.status === "error" ? props.t("aiExplainErr").replace("{msg}", explainState.text || "unknown")
-              : explainState && explainState.status === "ok" ? explainState.text
+            explainMine && props.explainError ? h("span", { style: { color: "var(--dsw-alias-state-danger-text, #f85149)" } }, props.explainError)
+              : explainMine && explainState.status === "running" ? props.t("aiExplaining")
+              : explainMine && explainState.status === "error" ? props.t("aiExplainErr").replace("{msg}", explainState.text || "unknown")
+              : explainMine && explainState.status === "ok" ? explainState.text
               : ""
           )
         )
@@ -294,8 +297,8 @@ window.__ModuleLoader__.load({
         var un = typeof scope.subscribe === "function" ? scope.subscribe(sync) : null;
         return function () { alive = false; if (un) un(); if (scope.dispose) scope.dispose(); };
       }, [scope]);
-      // settings-not-exposed means the host allowlist gate refused the write:
-      // explain the restart/manual-fix path instead of showing the raw code.
+      // Older hosts can still return settings-not-exposed. Recommend upgrading
+      // instead of mutating the installed DSH package on disk.
       var mutateError = function (detail, fallback) {
         if (detail && detail.code === "settings-not-exposed") return t("notExposed");
         return String(detail && (detail.message || detail.code) || fallback);

package/index.js

@@ -17,7 +17,6 @@ import os from "node:os";
 import z from "@deepseek-ai/schemastery";
 import { BlockAssembler, createUserMessage } from "@deepseek-ai/dsh-llm";
 import { installSettingsSection, settingsNamespace } from "@deepseek-ai/dsh-settings";
-import { ensureSettingsNamespaceExposed } from "./vendor/dsh-settings-expose.js";
 
 /** Cordis plugin name. */
 const name = "plugin-marketplace";
@@ -49,6 +48,8 @@ const Config = z.object({
   aiExplainResult: z.object({
     status: z.string().default("idle"), // idle | running | ok | error
     text: z.string().default(""),
+    /** repo this result belongs to ("owner/name"); client gates display on it. */
+    repo: z.string().default(""),
     ts: z.number().default(0),
   }),
 });
@@ -76,8 +77,6 @@ function apply(ctx, config) {
 
   // dsh-host-apiproxy hard-codes which namespaces the Web client may touch;
   // patch the allowlist idempotently so the client can write install requests.
-  ensureSettingsNamespaceExposed(ctx, "plugin-marketplace", ctx.logger);
-
   /** Resolved current config (settings layer over the entry). */
   function current() {
     return sourceGetter ? sourceGetter() : config;
@@ -212,7 +211,10 @@ function apply(ctx, config) {
       await report("running", `installing ${pkg}…`, pkg);
       const result = await runInstall(pkg, profile);
       if (result.code !== 0) {
-        const tail = (result.stderr || result.stdout || "").trim().split("\n").slice(-3).join(" ");
+        const output = (result.stderr || result.stdout || "").trim();
+        const tail = output.includes("ERR_PNPM_IGNORED_BUILDS")
+          ? "dependency build scripts were blocked by pnpm; the plugin author must make native build dependencies opt-in"
+          : output.split("\n").slice(-3).join(" ");
         ctx.logger.warn(`[plugin-marketplace] install failed (${result.code}): ${tail}`);
         await report("error", `install failed: ${tail || "unknown error"}`, pkg);
         return;
@@ -227,12 +229,12 @@ function apply(ctx, config) {
   }
 
   /** Write the AI-explain result report (and clear the consumed request). */
-  async function reportExplain(status, text) {
+  async function reportExplain(status, text, repo) {
     const settings = ctx.get("settings");
     if (!settings) return;
     const ts = Date.now();
     await settings.update(NS, {
-      aiExplainResult: { status, text, ts },
+      aiExplainResult: { status, text, repo: repo || "", ts },
       aiExplain: { repo: "", desc: "", readme: "", ts: 0 },
     }).catch((error) => {
       ctx.logger.warn(`[plugin-marketplace] explain state write failed: ${String(error)}`);
@@ -245,14 +247,16 @@ function apply(ctx, config) {
    * settings-backed message channel as the install flow.
    */
   async function maybeRunExplain() {
+    let repo = "";
     try {
       const cfg = current();
       const req = cfg?.aiExplain;
       if (!req || !req.repo || req.ts === lastExplainTs || req.ts === 0) return;
       lastExplainTs = req.ts;
+      repo = String(req.repo);
       const llm = ctx.llm;
       if (!llm) {
-        await reportExplain("error", "LLM service unavailable; configure a model in Settings → Models.");
+        await reportExplain("error", "LLM service unavailable; configure a model in Settings → Models.", repo);
         return;
       }
       // Route through the deployment's default model when one is configured.
@@ -261,7 +265,6 @@ function apply(ctx, config) {
         const defaults = ctx.agentDefaultModel?.currentSelection?.();
         if (defaults?.provider && defaults?.model) route = defaults;
       } catch { /* no default model service; fall back to the adapter default */ }
-      const repo = String(req.repo);
       const desc = String(req.desc || "").trim();
       const readme = String(req.readme || "").trim().slice(0, 1500);
       const prompt =
@@ -269,7 +272,7 @@ function apply(ctx, config) {
         (desc ? `简介：${desc}\n` : "") +
         (readme ? `README 摘要：\n${readme}\n` : "") +
         `\n请用简体中文、3~5 句话直接告诉我这个插件大概是干嘛的（核心用途、解决什么问题、适合谁）。不要复述仓库名，不要罗列安装步骤。`;
-      await reportExplain("running", "");
+      await reportExplain("running", "", repo);
       ctx.logger.info(`[plugin-marketplace] explaining ${repo} (model=${route ? `${route.provider}/${route.model}` : "default"})…`);
       const messages = [createUserMessage({
         content: [{ type: "text", text: prompt }],
@@ -293,10 +296,10 @@ function apply(ctx, config) {
         .join(" ")
         .trim();
       if (!text) throw new Error("model produced no text");
-      await reportExplain("ok", text);
+      await reportExplain("ok", text, repo);
     } catch (error) {
       ctx.logger.warn(`[plugin-marketplace] explain flow failed: ${String(error)}`);
-      await reportExplain("error", String(error instanceof Error ? error.message : error));
+      await reportExplain("error", String(error instanceof Error ? error.message : error), repo);
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name":  "dsh-plugin-marketplace",
-    "version":  "0.2.5",
+    "version":  "0.2.7",
     "description":  "DeepSeek Harness Web UI 内置插件市场：在设置页直接浏览 github.com/topics/dsh-plugin，支持搜索、按 Star 排序、查看安装方式。",
     "type":  "module",
     "main":  "index.js",
@@ -47,10 +47,10 @@
              },
     "peerDependencies":  {
                              "react":  "^18.2.0",
-                             "@deepseek-ai/dsh-settings":  "^0.1.0-rc.6",
-                             "@deepseek-ai/dsh-llm":  "^0.1.0-rc.6"
+                             "@deepseek-ai/dsh-settings":  "^0.1.0-rc.6 || ^0.1.1-rc.1",
+                             "@deepseek-ai/dsh-llm":  "^0.1.0-rc.6 || ^0.1.1-rc.1"
                          },
     "dependencies":  {
                          "@deepseek-ai/schemastery":  "^3.18.1"
                      }
-}
+}

package/vendor/dsh-settings-expose.js

@@ -1,106 +0,0 @@
-/**
- * dsh-host-apiproxy exposes only namespaces listed in its hard-coded
- * WEB_SETTINGS_NAMESPACES allowlist to the Web settings client. A namespace
- * registered by a third-party plugin answers `settings-not-exposed` even
- * though it is registered — upstream explicitly defers letting plugins
- * expose their own configuration.
- *
- * This module idempotently patches that allowlist in the dsh installation
- * actually loaded by the host process, so the plugin's settings section
- * becomes visible in the Web UI without manual edits. A dsh update
- * overwrites the file; the next plugin start re-patches it.
- *
- * NOTE: dsh-host-apiproxy is an ESM package, so it never appears in the
- * CommonJS `Module._cache` (lookup 1 only helps CJS hosts). Lookup 2 anchors
- * on the running dsh bin, which always resolves the apiproxy as the app's
- * own dependency; lookup 3 walks up from `@deepseek-ai/dsh-settings` for
- * other npm layouts. pnpm-installed hosts resolve into an immutable store —
- * the write then fails and the manual instruction below applies.
- *
- * Also note that patching the file only affects the NEXT process start: the
- * running apiproxy already evaluated its allowlist at module load, so a
- * settings channel opened mid-session still answers `settings-not-exposed`
- * until `dsh web` is restarted.
- */
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { createRequire } from "node:module";
-import { dirname, join, sep } from "node:path";
-
-/**
- * Ensure `nsName` is present in dsh-host-apiproxy's WEB_SETTINGS_NAMESPACES.
- * No-op when already exposed or when the file cannot be located/patched.
- * @param {import("cordis").Context} ctx
- * @param {string} nsName - settings namespace short name (e.g. "tdai-memory").
- * @param {{info?: Function, warn?: Function}} logger - dsh logger.
- */
-export function ensureSettingsNamespaceExposed(ctx, nsName, logger) {
-  void ctx;
-  try {
-    const target = findApiproxyIndex();
-    if (!target) {
-      logger?.warn?.(`[settings-expose] could not locate dsh-host-apiproxy in this dsh install; the "${nsName}" settings channel will answer "not exposed". Fix: add "${nsName}" to WEB_SETTINGS_NAMESPACES in <dsh>/node_modules/@deepseek-ai/dsh-host-apiproxy/lib/index.js and restart dsh web`);
-      return;
-    }
-    let src;
-    try {
-      src = readFileSync(target, "utf8");
-    } catch (error) {
-      logger?.warn?.(`[settings-expose] cannot read ${target}: ${String(error)}`);
-      return;
-    }
-    const body = src.match(/const WEB_SETTINGS_NAMESPACES = \[([\s\S]*?)\];/)?.[1] ?? "";
-    if (body.includes(`"${nsName}"`)) return; // already exposed (manual or previous patch)
-    const patched = src.replace(/(const WEB_SETTINGS_NAMESPACES = \[[\s\S]*?)(\n\s*\];)/, (_, pre, post) => {
-      const trailingComma = /,\s*$/.test(pre) ? "" : ",";
-      const sep2 = pre.trimEnd().endsWith("[") ? "" : trailingComma;
-      return `${pre}${sep2}\n\t"${nsName}"${post}`;
-    });
-    if (patched === src) {
-      logger?.warn?.(`[settings-expose] allowlist pattern not found in ${target}; add "${nsName}" to WEB_SETTINGS_NAMESPACES manually`);
-      return;
-    }
-    writeFileSync(target, patched, "utf8");
-    logger?.info?.(`[settings-expose] added "${nsName}" to WEB_SETTINGS_NAMESPACES (${target}) — restart dsh web: the settings channel opens only in the NEXT process start`);
-  } catch (error) {
-    logger?.warn?.(`[settings-expose] failed to expose "${nsName}" (${String(error)}); add it to WEB_SETTINGS_NAMESPACES in dsh-host-apiproxy/lib/index.js manually, then restart dsh web`);
-  }
-}
-
-function findApiproxyIndex() {
-  // 1) The host process has already loaded dsh-host-apiproxy: read the real
-  //    module path from the CommonJS module cache (any install layout; ESM
-  //    hosts — every modern dsh — skip this).
-  try {
-    const Module = createRequire(import.meta.url)("module");
-    const cache = Module._cache ?? {};
-    for (const key of Object.keys(cache)) {
-      if (key.includes(`${sep}dsh-host-apiproxy${sep}`) && key.endsWith(`${sep}index.js`)) return key;
-    }
-  } catch { /* fall through */ }
-  // 2) Resolve the apiproxy as a dependency of the running dsh app: the bin
-  //    (`node <dsh>/lib/bin.js`) anchors the app root in both shipped and
-  //    source layouts, and dsh-host-apiproxy is always one of its deps.
-  try {
-    const appRoot = dirname(dirname(process.argv[1] ?? ""));
-    const requireFromApp = createRequire(join(appRoot, "package.json"));
-    const entry = requireFromApp.resolve("@deepseek-ai/dsh-host-apiproxy");
-    if (entry.endsWith(`${sep}index.js`)) return entry;
-  } catch { /* fall through */ }
-  // 3) Walk up from @deepseek-ai/dsh-settings: the apiproxy is a scoped
-  //    sibling in the same dependency tree (flat/global and nested layouts).
-  try {
-    const require = createRequire(import.meta.url);
-    const settingsEntry = require.resolve("@deepseek-ai/dsh-settings");
-    let dir = dirname(settingsEntry);
-    while (true) {
-      const scoped = join(dir, "@deepseek-ai", "dsh-host-apiproxy", "lib", "index.js");
-      if (existsSync(scoped)) return scoped;
-      const bare = join(dir, "dsh-host-apiproxy", "lib", "index.js");
-      if (existsSync(bare)) return bare;
-      const parent = dirname(dir);
-      if (parent === dir) break;
-      dir = parent;
-    }
-  } catch { /* fall through */ }
-  return "";
-}