dsh-plugin-pack 1.0.19 → 1.0.20

package/lib/lockfile.js

@@ -22,25 +22,69 @@ import { spawnSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 
-/** 找 pnpm 可执行文件；找不到返回 null。 */
+/**
+ * 找 pnpm —— 优先用 dsh 自带的那个。
+ *
+ * 为什么不能随便用 PATH 上的：dsh 内置 pnpm 11（store/v11），
+ * 用户命令行可能是 pnpm 10（store/v10）。store 目录不同、锁文件格式也可能不同，
+ * 用错版本去同步等于又把 dsh 的安装/卸载搞坏。
+ *
+ * 探测顺序：DSH_PNPM 环境变量 → dsh 运行时里的 pnpm.cjs → PATH 上的 pnpm。
+ *
+ * @returns {{ command: string, args: string[], version: string|null, bundled: boolean } | null}
+ */
 function findPnpm() {
-  const candidates =
-    process.platform === 'win32'
-      ? ['pnpm.cmd', 'pnpm.exe', 'pnpm']
-      : ['pnpm'];
+  const candidates = [];
+
+  if (process.env.DSH_PNPM && fs.existsSync(process.env.DSH_PNPM)) {
+    candidates.push({ command: process.execPath, args: [process.env.DSH_PNPM], bundled: true });
+  }
+
+  // dsh 的 node 通常在 <runtime>/node.exe，pnpm 在 <runtime>/dependencies/pnpm/bin/pnpm.cjs
+  const exeDir = path.dirname(process.execPath);
+  for (const rel of [
+    ['dependencies', 'pnpm', 'bin', 'pnpm.cjs'],
+    ['..', 'dependencies', 'pnpm', 'bin', 'pnpm.cjs'],
+    ['runtime', 'primary-runtime', 'dependencies', 'pnpm', 'bin', 'pnpm.cjs'],
+  ]) {
+    const candidate = path.join(exeDir, ...rel);
+    if (fs.existsSync(candidate)) {
+      candidates.push({ command: process.execPath, args: [candidate], bundled: true });
+      break;
+    }
+  }
+
+  // 兜底：PATH 上的 pnpm
+  const names = process.platform === 'win32' ? ['pnpm.cmd', 'pnpm.exe', 'pnpm'] : ['pnpm'];
+  for (const name of names) candidates.push({ command: name, args: [], bundled: false });
 
-  for (const name of candidates) {
-    const result = spawnSync(name, ['--version'], {
+  for (const candidate of candidates) {
+    const result = spawnSync(candidate.command, [...candidate.args, '--version'], {
       encoding: 'utf8',
-      shell: process.platform === 'win32',
-      timeout: 15000,
+      // 自带 pnpm 是 node 直接跑 .cjs，不需要 shell；PATH 上的需要
+      shell: process.platform === 'win32' && !candidate.bundled,
+      timeout: 20000,
       windowsHide: true,
     });
-    if (!result.error && result.status === 0) return name;
+    if (!result.error && result.status === 0) {
+      const version = String(result.stdout ?? '').trim().split('\n')[0] || null;
+      return { ...candidate, version };
+    }
   }
   return null;
 }
 
+/** 用找到的 pnpm 跑一条命令。 */
+function runPnpm(pnpm, args, cwd, timeoutMs) {
+  return spawnSync(pnpm.command, [...pnpm.args, ...args], {
+    cwd,
+    encoding: 'utf8',
+    shell: process.platform === 'win32' && !pnpm.bundled,
+    timeout: timeoutMs,
+    windowsHide: true,
+  });
+}
+
 /**
  * 让 `pnpm-lock.yaml` 与 `package.json` 对齐。
  *
@@ -68,23 +112,21 @@ export function syncLockfile(profileDir, options = {}) {
     const pnpm = findPnpm();
     if (!pnpm) return { ok: false, skipped: true, reason: '没找到 pnpm' };
 
-    const result = spawnSync(pnpm, ['install', '--lockfile-only', '--reporter=silent'], {
-      cwd: profile,
-      encoding: 'utf8',
-      shell: process.platform === 'win32',
-      timeout: options.timeoutMs ?? 120000,
-      windowsHide: true,
-      env: { ...process.env, CI: '' },
-    });
+    const result = runPnpm(
+      pnpm,
+      ['install', '--lockfile-only', '--config.confirmModulesPurge=false'],
+      profile,
+      options.timeoutMs ?? 180000,
+    );
 
     if (result.error) {
-      return { ok: false, error: String(result.error.message ?? result.error) };
+      return { ok: false, error: String(result.error.message ?? result.error), pnpm: pnpm.version };
     }
     if (result.status !== 0) {
       const detail = `${result.stdout ?? ''}\n${result.stderr ?? ''}`.trim();
-      return { ok: false, error: detail.slice(0, 400) || `pnpm 退出码 ${result.status}` };
+      return { ok: false, error: detail.slice(0, 400) || `pnpm 退出码 ${result.status}`, pnpm: pnpm.version };
     }
-    return { ok: true };
+    return { ok: true, pnpm: pnpm.version };
   } catch (error) {
     return { ok: false, error: String(error?.message ?? error) };
   }
@@ -108,19 +150,17 @@ export function checkLockfile(profileDir) {
     const pnpm = findPnpm();
     if (!pnpm) return { ok: false, skipped: true, reason: '没找到 pnpm' };
 
-    const result = spawnSync(pnpm, ['install', '--frozen-lockfile', '--lockfile-only'], {
-      cwd: profile,
-      encoding: 'utf8',
-      shell: process.platform === 'win32',
-      timeout: 120000,
-      windowsHide: true,
-    });
+    const result = runPnpm(pnpm, ['install', '--frozen-lockfile', '--lockfile-only'], profile, 180000);
     // 注意：这里不能用 --reporter=silent —— 它会把 ERR_PNPM_OUTDATED_LOCKFILE
     // 这段错误文本一起吞掉，导致分不清"锁文件不一致"和"其它失败"。
     const detail = `${result.stdout ?? ''}\n${result.stderr ?? ''}`;
-    if (/ERR_PNPM_OUTDATED_LOCKFILE/.test(detail)) return { ok: true, outdated: true };
-    if (result.status === 0) return { ok: true, outdated: false };
-    return { ok: false, error: detail.trim().slice(0, 400) || `pnpm 退出码 ${result.status}` };
+    if (/ERR_PNPM_OUTDATED_LOCKFILE/.test(detail)) return { ok: true, outdated: true, pnpm: pnpm.version };
+    if (result.status === 0) return { ok: true, outdated: false, pnpm: pnpm.version };
+    // 其它错误里也可能带 store 不一致
+    if (/ERR_PNPM_UNEXPECTED_STORE/.test(detail)) {
+      return { ok: false, storeMismatch: true, pnpm: pnpm.version, error: detail.trim().slice(0, 400) };
+    }
+    return { ok: false, error: detail.trim().slice(0, 400) || `pnpm 退出码 ${result.status}`, pnpm: pnpm.version };
   } catch (error) {
     return { ok: false, error: String(error?.message ?? error) };
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-pack",
-  "version": "1.0.19",
+  "version": "1.0.20",
   "description": "DeepSeek Harness 插件整合包：一键把当前 profile 的第三方插件连依赖和配置导出成 zip（内部每个插件是标准 npm tgz），换机/换 profile 拖进去就能还原。",
   "type": "module",
   "main": "lib/index.js",