dsh-plugin-rack 0.1.2 → 0.1.3

package/index.js

@@ -63,10 +63,14 @@ import { request as httpsRequest } from 'node:https'
 import { connect as netConnect } from 'node:net'
 import { connect as tlsConnect } from 'node:tls'
 import { createRequire } from 'node:module'
+import { EXACT_VERSION, compareVersions, isVersionSpec, parseSpec, satisfiesSpec } from './lib/spec.js'
 
 const ROUTE_PREFIX = '/api/dsh-plugin-rack'
 const require = createRequire(import.meta.url)
-const VERSION = '0.1.0'
+// Read from package.json instead of a literal: the panel reports this number to
+// the user and to the update checker, and a hand-maintained copy drifted from
+// the published version the first time it mattered.
+const VERSION = require('./package.json').version
 // The package was called dsh-plugin-dashboard before the public release. Keep
 // the old name recognised so a half-migrated install still treats the panel as
 // itself — otherwise "turn everything off" would switch off the very route
@@ -1501,8 +1505,6 @@ async function readJsonBody(req) {
 
 /** Packages the runtime itself provides; those are never fetched from npm. */
 const HOST_SCOPE = /^@deepseek-ai\//
-/** A version pinned exactly — the profile's own convention for dsh bundles. */
-const EXACT_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/
 const REGISTRY_TIMEOUT = 12000
 const UPDATE_CONCURRENCY = 6
 
@@ -1522,44 +1524,6 @@ function profileFacts(ctx) {
   }
 }
 
-function versionParts(value) {
-  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+.*)?$/.exec(String(value).trim())
-  if (match === null) return null
-  return {
-    numbers: [Number(match[1]), Number(match[2]), Number(match[3])],
-    pre: match[4] === undefined ? null : match[4].split('.'),
-  }
-}
-
-/** Standard semver ordering; an unparsable side compares as equal. */
-function compareVersions(left, right) {
-  const a = versionParts(left)
-  const b = versionParts(right)
-  if (a === null || b === null) return 0
-  for (let index = 0; index < 3; index += 1) {
-    if (a.numbers[index] !== b.numbers[index]) return a.numbers[index] < b.numbers[index] ? -1 : 1
-  }
-  if (a.pre === null && b.pre === null) return 0
-  if (a.pre === null) return 1
-  if (b.pre === null) return -1
-  const length = Math.max(a.pre.length, b.pre.length)
-  for (let index = 0; index < length; index += 1) {
-    const x = a.pre[index]
-    const y = b.pre[index]
-    if (x === undefined) return -1
-    if (y === undefined) return 1
-    const xNumeric = /^\d+$/.test(x)
-    const yNumeric = /^\d+$/.test(y)
-    if (xNumeric && yNumeric) {
-      if (Number(x) !== Number(y)) return Number(x) < Number(y) ? -1 : 1
-      continue
-    }
-    if (xNumeric !== yNumeric) return xNumeric ? -1 : 1
-    if (x !== y) return x < y ? -1 : 1
-  }
-  return 0
-}
-
 /**
  * The registry answer for a package's `latest` dist-tag. The profile's own
  * registry is asked first — a user behind a mirror should not be forced through
@@ -1597,15 +1561,29 @@ async function npmLatest(name, base, signal) {
   throw new Error(errors.join('; '))
 }
 
-/** Dependencies this panel is willing to touch: not host-provided, pinned exactly. */
+/**
+ * Dependencies this panel is willing to touch: host-provided ones are skipped,
+ * and every spec it understands becomes a target.
+ *
+ * This used to accept exact pins only, which quietly meant that a profile using
+ * `^1.2.3` — the normal way to write a dependency — had those packages invisible
+ * to "update everything". The range still matters though: it is kept on the
+ * target so the checker can refuse a registry version the user's own range
+ * excludes, instead of silently jumping a major.
+ */
 function eligibleDeps(facts) {
   const out = []
   for (const [name, spec] of Object.entries(facts.deps)) {
     if (HOST_SCOPE.test(name)) continue
     if (typeof spec !== 'string') continue
-    const pinned = spec.trim()
-    if (!EXACT_VERSION.test(pinned)) continue
-    out.push({ name, current: pinned })
+    const parsed = parseSpec(spec)
+    if (parsed.kind === 'unsupported') continue
+    // What is actually installed beats the range floor: with `^1.2.3` installed
+    // at 1.9.0, comparing against the floor would report an update to 1.9.0.
+    const installed = installedVersion(facts.dir, name)
+    const current = installed !== null ? installed : parsed.floor
+    if (current === null) continue
+    out.push({ name, current, spec: spec.trim(), kind: parsed.kind, floor: parsed.floor })
   }
   return out
 }
@@ -1625,11 +1603,18 @@ async function checkUpdates(ctx) {
       const target = targets[index]
       try {
         const latest = await npmLatest(target.name, base, activeJobAbort === null ? undefined : activeJobAbort.signal)
+        const ahead = compareVersions(latest, target.current) > 0
+        // An exact pin has no range to violate. Anything else does, and a
+        // major bump the user's own `^`/`~` excludes is not this panel's call.
+        const inRange = target.kind === 'exact' || satisfiesSpec(latest, target.spec)
         rows[index] = {
           name: target.name,
           current: target.current,
           latest,
-          hasUpdate: compareVersions(latest, target.current) > 0,
+          spec: target.spec,
+          kind: target.kind,
+          hasUpdate: ahead && inRange,
+          outOfRange: ahead && !inRange,
           error: null,
         }
       } catch (error) {
@@ -1637,7 +1622,10 @@ async function checkUpdates(ctx) {
           name: target.name,
           current: target.current,
           latest: null,
+          spec: target.spec,
+          kind: target.kind,
           hasUpdate: false,
+          outOfRange: false,
           error: error instanceof Error ? error.message : String(error),
         }
       }
@@ -2131,6 +2119,7 @@ async function applyUpdates(ctx, names, pinned = null, job = null) {
   if (targets.length === 0) return { ok: false, message: 'no eligible package to update' }
 
   const planned = []
+  const outOfRange = []
   const registryBase = await configuredRegistry(ctx)
   for (const target of targets) {
     // 每查一个都先看有没有被取消：registry 查询 + 代理重试是弱网下最长的一段，
@@ -2145,10 +2134,29 @@ async function applyUpdates(ctx, names, pinned = null, job = null) {
       }
     }
     if (compareVersions(latest, target.current) <= 0) continue
+    // The user's own range is a decision, not an obstacle: `^1.2.3` says 2.x is
+    // out of bounds, so installing it because the registry moved on would be
+    // this panel overriding them. Report it instead of applying it silently.
+    if (target.kind !== 'exact' && !satisfiesSpec(latest, target.spec)) {
+      outOfRange.push({ name: target.name, spec: target.spec, latest })
+      continue
+    }
     planned.push({ name: target.name, current: target.current, latest })
   }
   assertNotCancelled(job)
-  if (planned.length === 0) return { ok: true, updated: [], message: 'already current' }
+  if (planned.length === 0) {
+    if (outOfRange.length > 0) {
+      return {
+        ok: true,
+        updated: [],
+        outOfRange,
+        message: outOfRange
+          .map(one => `${one.name} ${one.latest} 超出了 package.json 写明的 ${one.spec}，没有安装`)
+          .join('；'),
+      }
+    }
+    return { ok: true, updated: [], message: 'already current' }
+  }
 
   // Everything pnpm may touch, kept for the rollback below.
   const backup = new Map()
@@ -2319,6 +2327,9 @@ async function applyUpdates(ctx, names, pinned = null, job = null) {
   return {
     ok: true,
     updated: planned.map(item => ({ name: item.name, from: item.current, to: item.latest })),
+    // Reported rather than swallowed: the user asked to update these, and the
+    // honest answer is "the range you wrote excludes the new version".
+    ...(outOfRange.length > 0 ? { outOfRange } : {}),
     hotSwap: swap,
     restart: swap.ok !== true,
     // 没有维护门时如实上报：用户有权知道这次是在会话可能正跑着的时候改了 node_modules。
@@ -2893,9 +2904,6 @@ async function pipeTo(part, response, signal, offset, deadline) {
   stream.on('error', error => {
     if (failure === null) failure = error
   })
-  const fail = error => {
-    if (failure === null) failure = error
-  }
 
   let idle = null
   const arm = () => {
@@ -3112,7 +3120,9 @@ async function listExtras(ctx) {
   for (const [name, raw] of Object.entries(facts.deps)) {
     if (HOST_SCOPE.test(name)) continue
     const spec = typeof raw === 'string' ? raw.trim() : ''
-    if (EXACT_VERSION.test(spec)) continue
+    // Everything the version updater understands is not an "other install kind":
+    // ranges used to land here as `other` rows that offered no action at all.
+    if (isVersionSpec(spec)) continue
     const current = installedVersion(facts.dir, name)
     if (spec.startsWith('link:')) {
       rows.push({ name, kind: 'link', spec, current, note: '本地软链' })

package/lib/spec.js

@@ -0,0 +1,285 @@
+/**
+ * Version specs, parsed and compared — the whole of what this plugin needs to
+ * understand about semver.
+ *
+ * These functions are pure and have no imports, so they can be unit-tested
+ * directly and type-checked without pulling the host into scope. Everything
+ * that decides "is there an update" goes through here, which is why they are
+ * the only part of the plugin covered by `tsc --checkJs`.
+ *
+ * The supported shapes are the ones a `package.json` in the wild actually uses:
+ * an exact pin, `^`, `~`, `>=`, `>`, `<`, `<=`, a bare or wildcard prefix
+ * (`1`, `1.x`, `1.2`, `1.2.x`), a hyphen range (`1.2.3 - 2.0.0`), and unions of
+ * those with `||`. Anything else — `link:`, `file:`, `github:`, a tarball URL,
+ * an npm alias — is `unsupported`, which is the signal to route it through the
+ * "其他安装方式" path instead of the version updater.
+ */
+
+/** A registry version: 1.2.3, optionally with a prerelease suffix. */
+export const EXACT_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/
+
+/**
+ * @typedef {'exact' | 'caret' | 'tilde' | 'xrange' | 'hyphen' | 'gt' | 'gte' | 'lt' | 'lte' | 'any' | 'union' | 'unsupported'} SpecKind
+ *
+ * @typedef {object} ParsedSpec
+ * @property {SpecKind} kind   how the range is written
+ * @property {string | null} floor  the lowest version the spec allows, zeros filled in
+ * @property {number} parts  how many components the user actually wrote (1, 2 or 3)
+ * @property {string | null} [ceiling]  inclusive or exclusive upper version (hyphen, lt, lte)
+ * @property {ParsedSpec[]} [ranges]  the alternatives of a union
+ *
+ * @typedef {object} VersionParts
+ * @property {number[]} numbers  always three entries
+ * @property {string[] | null} pre  prerelease identifiers, or null for a release
+ */
+
+/**
+ * Split a version into its numeric core and prerelease identifiers.
+ *
+ * @param {string} value
+ * @returns {VersionParts | null}
+ */
+export function versionParts(value) {
+  if (typeof value !== 'string') return null
+  const trimmed = value.trim().replace(/^v/, '')
+  const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(trimmed)
+  if (match === null) return null
+  const pre = match[4] === undefined ? null : match[4].split('.')
+  return { numbers: [Number(match[1]), Number(match[2]), Number(match[3])], pre }
+}
+
+/**
+ * Semver ordering, prerelease rules included: 1.0.0-rc.1 < 1.0.0, and a
+ * numeric prerelease identifier sorts below an alphanumeric one.
+ *
+ * @param {string} left
+ * @param {string} right
+ * @returns {number} -1, 0 or 1
+ */
+export function compareVersions(left, right) {
+  const a = versionParts(left)
+  const b = versionParts(right)
+  if (a === null || b === null) return 0
+  for (let index = 0; index < 3; index += 1) {
+    if (a.numbers[index] !== b.numbers[index]) return a.numbers[index] < b.numbers[index] ? -1 : 1
+  }
+  if (a.pre === null && b.pre === null) return 0
+  if (a.pre === null) return 1
+  if (b.pre === null) return -1
+  const length = Math.max(a.pre.length, b.pre.length)
+  for (let index = 0; index < length; index += 1) {
+    const x = a.pre[index]
+    const y = b.pre[index]
+    if (x === undefined) return -1
+    if (y === undefined) return 1
+    const xNumeric = /^\d+$/.test(x)
+    const yNumeric = /^\d+$/.test(y)
+    if (xNumeric && yNumeric) {
+      if (Number(x) !== Number(y)) return Number(x) < Number(y) ? -1 : 1
+      continue
+    }
+    if (xNumeric !== yNumeric) return xNumeric ? -1 : 1
+    if (x !== y) return x < y ? -1 : 1
+  }
+  return 0
+}
+
+/**
+ * Expand a partially written version to three components.
+ *
+ * `1` counts as one component, `1.2` as two — the count is what tells a caret
+ * or tilde range how wide it may go.
+ *
+ * @param {string} value  `1`, `1.2` or `1.2.3`, with an optional prerelease
+ * @returns {{floor: string | null, parts: number}}
+ */
+function expand(value) {
+  const trimmed = value.trim().replace(/^v/, '')
+  const core = /^(\d+)(?:\.(\d+))?(?:\.(\d+))?(-[0-9A-Za-z.-]+)?$/.exec(trimmed)
+  if (core === null) return { floor: null, parts: 0 }
+  const parts = core[3] !== undefined ? 3 : core[2] !== undefined ? 2 : 1
+  const floor = `${Number(core[1])}.${core[2] === undefined ? 0 : Number(core[2])}.${core[3] === undefined ? 0 : Number(core[3])}${core[4] === undefined ? '' : core[4]}`
+  return { floor, parts }
+}
+
+const UNSUPPORTED = /** @type {const} */ ({ kind: 'unsupported', floor: null, parts: 0 })
+
+/**
+ * Classify a dependency spec.
+ *
+ * @param {string} spec  the raw value from package.json
+ * @returns {ParsedSpec}
+ */
+export function parseSpec(spec) {
+  const raw = typeof spec === 'string' ? spec.trim() : ''
+  if (raw === '') return { kind: 'any', floor: null, parts: 0 }
+
+  // A union is only a union at the top level: `^1 || ^2` is two full specs.
+  if (raw.includes('||')) {
+    const ranges = raw
+      .split('||')
+      .map((part) => parseSpec(part))
+      .filter((part) => part.kind !== 'unsupported' && part.kind !== 'any')
+    if (ranges.length === 0) return { kind: 'any', floor: null, parts: 0 }
+    if (ranges.length === 1) return ranges[0]
+    return { kind: 'union', floor: null, parts: 0, ranges }
+  }
+
+  // `1.2.3 - 2.0.0`: hyphen ranges need the spaces, otherwise the dash is a
+  // prerelease separator (`1.2.3-rc.1`).
+  const hyphen = /^(\d[\w.-]*)\s+-\s+(\d[\w.-]*)$/.exec(raw)
+  if (hyphen !== null) {
+    const from = expand(hyphen[1])
+    const to = expand(hyphen[2])
+    if (from.floor === null || to.floor === null) return UNSUPPORTED
+    return { kind: 'hyphen', floor: from.floor, parts: from.parts, ceiling: to.floor }
+  }
+
+  if (raw === '*' || raw === 'x' || raw === 'X' || raw === 'latest') {
+    return { kind: 'any', floor: null, parts: 0 }
+  }
+  if (EXACT_VERSION.test(raw)) return { kind: 'exact', floor: raw, parts: 3 }
+
+  const operators = [
+    ['^', 'caret'],
+    ['~', 'tilde'],
+    ['>=', 'gte'],
+    ['>', 'gt'],
+    ['<=', 'lte'],
+    ['<', 'lt'],
+  ]
+  for (const [prefix, kind] of operators) {
+    if (!raw.startsWith(prefix)) continue
+    const expanded = expand(raw.slice(prefix.length))
+    if (expanded.floor === null) return UNSUPPORTED
+    if (kind === 'lt' || kind === 'lte') {
+      // `<=1.2.3` and `<1.2.3` have no floor; the version itself is the bound.
+      return { kind: /** @type {SpecKind} */ (kind), floor: null, parts: expanded.parts, ceiling: expanded.floor }
+    }
+    return { kind: /** @type {SpecKind} */ (kind), floor: expanded.floor, parts: expanded.parts }
+  }
+
+  // A bare or wildcard prefix: `1`, `1.x`, `1.2`, `1.2.x`, `1.2.*`.
+  const wildcard = /^(\d+)(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?$/.exec(raw)
+  if (wildcard !== null) {
+    const major = Number(wildcard[1])
+    const minorToken = wildcard[2]
+    const patchToken = wildcard[3]
+    const minor = minorToken === undefined || !/^\d+$/.test(minorToken) ? null : Number(minorToken)
+    const patch = patchToken === undefined || !/^\d+$/.test(patchToken) ? null : Number(patchToken)
+    const parts = patch !== null ? 3 : minor !== null ? 2 : 1
+    const floor = `${major}.${minor === null ? 0 : minor}.${patch === null ? 0 : patch}`
+    return { kind: 'xrange', floor, parts }
+  }
+
+  return UNSUPPORTED
+}
+
+/**
+ * The first version outside a caret, tilde or wildcard range.
+ *
+ * @param {ParsedSpec} parsed
+ * @returns {number[] | null}
+ */
+function ceilingOf(parsed) {
+  if (parsed.floor === null) return null
+  const parts = versionParts(parsed.floor)
+  if (parts === null) return null
+  const [major, minor, patch] = parts.numbers
+  if (parsed.kind === 'caret') {
+    // ^0.2.3 means "0.2.x and up", not "0.x" — the zero-major rule.
+    if (major > 0) return [major + 1, 0, 0]
+    if (minor > 0) return [0, minor + 1, 0]
+    return [0, 0, patch + 1]
+  }
+  if (parsed.kind === 'tilde' || parsed.kind === 'xrange') {
+    // ~1.2.3 and ~1.2 both stay inside 1.2; only a bare ~1 (or `1.x`) widens
+    // to 2.0.0. `1.2` behaves like `~1.2`, which is what npm does.
+    if (parsed.parts === 1) return [major + 1, 0, 0]
+    if (parsed.parts === 2) return [major, minor + 1, 0]
+    return [major, minor + 1, 0]
+  }
+  return null
+}
+
+/**
+ * Is `version` below `ceiling` (exclusive)?
+ *
+ * @param {VersionParts} target
+ * @param {number[]} ceiling
+ * @returns {boolean}
+ */
+function below(target, ceiling) {
+  for (let index = 0; index < 3; index += 1) {
+    if (target.numbers[index] !== ceiling[index]) return target.numbers[index] < ceiling[index]
+  }
+  return false
+}
+
+/**
+ * The shared decision, on an already-parsed spec.
+ *
+ * @param {string} version
+ * @param {ParsedSpec} parsed
+ * @returns {boolean}
+ */
+function satisfiesParsed(version, parsed) {
+  if (parsed.kind === 'any') return true
+  if (parsed.kind === 'unsupported') return false
+  if (parsed.kind === 'union') {
+    return (parsed.ranges ?? []).some((one) => satisfiesParsed(version, one))
+  }
+  if (parsed.kind === 'exact') return parsed.floor !== null && compareVersions(version, parsed.floor) === 0
+
+  const target = versionParts(version)
+  if (target === null) return false
+
+  // A prerelease only passes when the spec itself asked for one. Without this,
+  // `^1.2.3` would quietly accept `2.0.0-rc.1` just because it sorts above the
+  // floor of a different range.
+  const floorParts = parsed.floor === null ? null : versionParts(parsed.floor)
+  const ceilingParts = parsed.ceiling === undefined || parsed.ceiling === null ? null : versionParts(parsed.ceiling)
+  const specHasPrerelease = (floorParts !== null && floorParts.pre !== null) || (ceilingParts !== null && ceilingParts.pre !== null)
+  if (target.pre !== null && !specHasPrerelease) return false
+
+  if (parsed.kind === 'lt' || parsed.kind === 'lte') {
+    if (ceilingParts === null) return false
+    const order = compareVersions(version, parsed.ceiling ?? '')
+    return parsed.kind === 'lte' ? order <= 0 : order < 0
+  }
+
+  if (parsed.kind === 'hyphen') {
+    if (floorParts === null || ceilingParts === null) return false
+    return compareVersions(version, parsed.floor ?? '') >= 0 && compareVersions(version, parsed.ceiling ?? '') <= 0
+  }
+
+  if (floorParts === null) return false
+  const order = compareVersions(version, parsed.floor ?? '')
+  if (parsed.kind === 'gte') return order >= 0
+  if (parsed.kind === 'gt') return order > 0
+  if (order < 0) return false
+  const ceiling = ceilingOf(parsed)
+  if (ceiling === null) return false
+  return below(target, ceiling)
+}
+
+/**
+ * Is `version` allowed by `spec`?
+ *
+ * @param {string} version
+ * @param {string} spec  the raw spec, parsed here
+ * @returns {boolean}
+ */
+export function satisfiesSpec(version, spec) {
+  return satisfiesParsed(version, parseSpec(spec))
+}
+
+/**
+ * A spec this plugin's version updater may rewrite.
+ *
+ * @param {string} spec
+ * @returns {boolean}
+ */
+export function isVersionSpec(spec) {
+  return parseSpec(spec).kind !== 'unsupported'
+}

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "dsh-plugin-rack",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "type": "module",
   "description": "DSH 插件管理：所有插件一屏看完，一个开关直接开关，更新完自动热替换不用重启。/ Plugin rack for DSH: every plugin in one list with a power switch, an auto/manual flag that scopes the one-click bulk actions, and hot-swapped updates that need no restart.",
   "author": "Jaside (LZM-P)",
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/LZM-P/dsh-plugin-rack"
+    "url": "git+https://github.com/LZM-P/dsh-plugin-rack.git"
   },
   "homepage": "https://github.com/LZM-P/dsh-plugin-rack#readme",
   "bugs": "https://github.com/LZM-P/dsh-plugin-rack/issues",
@@ -35,16 +35,20 @@
   "files": [
     "index.js",
     "client.js",
+    "lib/*.js",
     "cordis.patch.yml",
     "locale/*.json",
     "icon.svg",
     "LICENSE",
-    "README.md",
-    "test/*.mjs"
+    "README.md"
   ],
   "scripts": {
-    "check": "node test/self-check.mjs && node test/behaviour.mjs",
-    "test": "node test/self-check.mjs && node test/behaviour.mjs && node test/job-background.mjs && node test/download.mjs && node test/pnpm-command.mjs"
+    "check": "node scripts/build-client.mjs --check && node test/self-check.mjs && node test/behaviour.mjs && node test/spec.mjs",
+    "test": "node scripts/build-client.mjs --check && node test/self-check.mjs && node test/behaviour.mjs && node test/spec.mjs && node test/client.mjs && node test/job-background.mjs && node test/download.mjs && node test/pnpm-command.mjs",
+    "lint": "eslint .",
+    "types": "tsc -p tsconfig.json",
+    "publish": "node scripts/publish.mjs",
+    "build": "node scripts/build-client.mjs"
   },
   "dsh": {
     "manifestVersion": 1,
@@ -72,5 +76,9 @@
         "0.2.2-rc.3": "compatible"
       }
     }
+  },
+  "devDependencies": {
+    "eslint": "^9.15.0",
+    "typescript": "^5.6.3"
   }
 }