dsh-plugin-update-checker 0.0.0-stage → 0.1.4

package/lib/host/scan.js

@@ -0,0 +1,123 @@
+/**
+ * dsh-plugin-update-checker — host/scan.js
+ *
+ * 由 lib/host/update-checker.js 按下述职责拆出（函数体逐字保留）：
+ *   scanBundle
+ */
+import { lstatSync } from 'node:fs'
+import { join } from 'node:path'
+import { isRuntimePackage, evaluatePluginCompatibility } from './dsh.js'
+import { readManifest, findBundleDir, KNOWN_REPOS, resolveSourceLink } from './profile.js'
+import { probeAnyRegistry, classifyUpdate } from './registry.js'
+
+export async function scanBundle(bundle, profileDir, dshVersion, exemptions, signal, repositories = {}, registries = ['https://registry.npmjs.org']) {
+  const name = bundle.name
+  const installedVersion = bundle.version ?? null
+
+  // The @deepseek-ai/dsh* packages are the runtime, symlinked into the shared
+  // tree from the runtime install. They are not user plugins and must not be
+  // treated as source-links or independently updatable bundles. The runtime is
+  // checked once, as a unit, by checkDshRuntime (which the route appends as the
+  // 'dsh-runtime' row). Report the runtime packages themselves as a thin,
+  // inert row so they neither blank the report nor invite a misleading
+  // "update from the repository" action.
+  if (isRuntimePackage(name)) {
+    return {
+      name,
+      installedVersion,
+      installed: bundle.installed === true,
+      linked: false,
+      description: bundle.description ?? bundle.meta?.description ?? null,
+      compatibility: { status: 'compatible' },
+      update: { status: 'part-of-runtime', error: 'part of the DSH runtime; checked as a unit' },
+    }
+  }
+  const row = {
+    name,
+    installedVersion,
+    installed: bundle.installed === true,
+    linked: false,
+    description: bundle.description ?? bundle.meta?.description ?? null,
+    compatibility: { status: 'compatible' },
+    update: { status: 'unknown', error: 'not scanned' },
+  }
+
+  // Compatibility (no network needed).
+  // describeBundle already resolved both, so reuse them when present: a
+  // scan of N bundles used to resolve every directory and parse every
+  // package.json twice.
+  const dir = bundle.dir !== undefined ? bundle.dir : findBundleDir(name, profileDir)
+  // A link:-installed bundle (symlink into a source tree) is not published to a
+  // registry, so installBundle would replace the developer's symlink with a
+  // published copy and break their live-edit loop. Flag it so the UI disables
+  // the one-click update and instead links to the source.
+  try { if (dir && lstatSync(dir).isSymbolicLink()) row.linked = true } catch { /* keep false */ }
+  const manifest = bundle.manifest !== undefined
+    ? bundle.manifest
+    : (dir ? await readManifest(join(dir, 'package.json')) : undefined)
+  // Always evaluate: the launcher does. Gating on peerDependencies meant a
+  // manifest that declares only engines.dsh was never evaluated here, so the
+  // row kept its default "compatible" even when the launcher would skip it.
+  if (manifest) {
+    try {
+      const issue = evaluatePluginCompatibility(manifest, exemptions, dshVersion)
+      if (issue) {
+        row.compatibility = {
+          status: issue.exempted ? 'compatible' : 'incompatible',
+          peers: issue.peers,
+          exempted: issue.exempted === true,
+        }
+      }
+    } catch {
+      row.compatibility = { status: 'unknown', error: 'could not evaluate compatibility' }
+    }
+  }
+
+  // Update availability.
+  if (!bundle.installed && bundle.optional) {
+    row.update = { status: 'unsupported', error: 'shipped by the installation' }
+    return row
+  }
+  // Listed in dsh.profile.bundles but absent from disk. Probing the registry
+  // would compare the published version against the 0.0.0 fallback and report
+  // "update available" for something that is not installed at all, so say so
+  // instead of inventing a phantom upgrade.
+  if (!bundle.installed) {
+    row.update = { status: 'unsupported', error: 'listed in the profile but not installed' }
+    row.compatibility = { status: 'unknown', error: 'no manifest to evaluate' }
+    return row
+  }
+  // Link:-installed bundles publish nothing to a registry; probing it only
+  // yields a misleading 404. Skip the network and point the user at the source.
+  if (row.linked && dir) {
+    const src = resolveSourceLink(dir, repositories[name] ?? KNOWN_REPOS[name])
+    const link = src.repoUrl
+      ? src.repoUrl + '/tree/' + src.ref + (src.subpath ? '/' + src.subpath : '')
+      : null
+    row.source = {
+      dir: src.dir,
+      repoUrl: src.repoUrl,
+      ref: src.ref,
+      subpath: src.subpath,
+      link,
+    }
+    row.update = { status: 'source', error: 'installed from source; update from the repository' }
+    return row
+  }
+  try {
+    // A manifest-declared registry is authoritative for that package; otherwise
+    // race the configured registries so a slow public registry cannot dominate.
+    const declared = typeof bundle.registry === 'string' && bundle.registry !== '' ? bundle.registry : ''
+    const candidates = declared !== '' ? [declared] : registries
+    const { result: remote, registry: usedRegistry } = await probeAnyRegistry(name, candidates, signal)
+    row.update = classifyUpdate(installedVersion ?? manifest?.version, remote)
+    // Surface the registry the answer came from so the one-click update installs
+    // from the same place the version was read (the client passes it through).
+    if (row.update.status !== 'unknown' && usedRegistry) row.update.registry = usedRegistry
+  } catch (err) {
+    row.update = { status: 'unknown', error: String(err?.message ?? err) }
+  }
+  return row
+}
+
+/** Read one manifest synchronously (used for lightweight bundle enumeration). */

package/lib/host/update-checker.js

@@ -0,0 +1,90 @@
+/**
+ * dsh-plugin-update-checker — host half entry.
+ *
+ * 这里只做装配：解析运行时版本 → 枚举 profile 的 bundles → 逐包扫描 → 回一行 JSON。
+ * 具体职责见同目录：dsh.js（DSH 适配）、profile.js（目录与清单）、registry.js（源与探测）、
+ * runtime.js（运行时更新源）、scan.js（单包扫描）。
+ */
+import { getDshRuntimeVersion, readProfileVersionExemptions } from './dsh.js'
+import { activeProfileDir, KNOWN_REPOS, listBundles } from './profile.js'
+import { resolveRegistries } from './registry.js'
+import { checkDshRuntime } from './runtime.js'
+import { scanBundle } from './scan.js'
+
+// 对外导出面保持不变：evaluatePluginCompatibility 随拆分搬到了 dsh.js，
+// 但测试与外部调用方一直从入口取它，所以在这里再导出一次。
+export { evaluatePluginCompatibility } from './dsh.js'
+
+export function apply(ctx, _config = {}) {
+  const { webServer } = ctx
+  const dshVersion = getDshRuntimeVersion()
+  const repositories = { ...KNOWN_REPOS, ...(_config?.repositories ?? {}) }
+
+  ctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/api/plugin-update-checker/scan',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') {
+        res.statusCode = 405
+        res.setHeader('content-type', 'application/json')
+        res.end(JSON.stringify({ ok: false, error: 'method not allowed' }))
+        return
+      }
+      const profileDir = activeProfileDir()
+      const exemptions = (() => { try { return readProfileVersionExemptions(profileDir) } catch { return {} } })()
+      const controller = new AbortController()
+      const timeout = setTimeout(() => controller.abort(), 20000)
+
+      try {
+        // Enumerate from the profile's dsh.profile.bundles on disk. The host
+        // half used to try `ctx.remote.pluginManager.listBundles()` first, but
+        // `remote` is a browser-side service: on the host that access throws
+        // "cannot get property ... without inject", the catch swallowed it, and
+        // the disk scan ran anyway. The throw was dead weight, not a fallback.
+        const bundles = await listBundles(profileDir)
+
+        // Resolve registries once per scan, not once per bundle, and racing them
+        // keeps a slow public registry from dominating a mirror-served host.
+        // NOTE: reads configuration, never ctx.remote — that is a browser-side
+        // service, and touching it here throws "cannot get property ... without
+        // inject" (the host half declares only webServer).
+        const registries = resolveRegistries(profileDir)
+
+        const plugins = await Promise.all(
+          bundles.map((b) => scanBundle(b, profileDir, dshVersion, exemptions, controller.signal, repositories, registries)
+            .catch((err) => ({
+              name: b.name,
+              installedVersion: b.version ?? null,
+              compatibility: { status: 'unknown', error: String(err?.message ?? err) },
+              update: { status: 'unknown', error: String(err?.message ?? err) },
+            })))
+        )
+
+        // The runtime is not a bundle in the profile, so it is never in
+        // `bundles`. Check it explicitly as one unit so the panel can answer
+        // "is my DSH itself up to date?" — the question the old panel silently
+        // left unanswered. It is appended, never merged into a plugin row.
+        const runtimeRow = await checkDshRuntime(dshVersion, registries, controller.signal)
+          .catch((err) => ({ name: 'dsh-runtime', installedVersion: dshVersion, compatibility: { status: 'compatible' }, update: { status: 'unknown', error: String(err?.message ?? err) } }))
+        plugins.push(runtimeRow)
+
+        res.statusCode = 200
+        res.setHeader('content-type', 'application/json')
+        res.end(JSON.stringify({ ok: true, dshVersion, checkedAt: new Date().toISOString(), plugins }))
+      } catch (err) {
+        res.statusCode = 500
+        res.setHeader('content-type', 'application/json')
+        res.end(JSON.stringify({ ok: false, error: String(err?.message ?? err) }))
+      } finally {
+        clearTimeout(timeout)
+      }
+    },
+  }), 'plugin-update-checker: scan route')
+
+  // NOTE: There is deliberately NO restart route here. DSH's own plugin
+  // manager never restarts the app (a "restart-required" install result merely
+  // means "takes effect at next start"); restarting on this machine is a
+  // manual operator action (stop the :3080 listeners, then `dsh restart` or
+  // re-launch). The browser half surfaces that as a manual prompt instead of
+  // trying to detach-kill its own host process, which proved unreliable.
+}

package/lib/index.js

@@ -0,0 +1,23 @@
+/**
+ * dsh-plugin-update-checker — Host half entry.
+ *
+ * Composes the scan route. The browser half (./client.js) registers the
+ * "Check updates" tab into the Plugins settings section and calls the route.
+ *
+ * `inject` lists exactly the services the host logic touches. NOTE: `remote`
+ * is a *browser*-side service (injected by dsh-client-ui-plugin-manager into
+ * the browser half) — it does NOT exist on the host, so the host half must
+ * never declare it. Updating is performed from the browser half via
+ * ctx.remote.pluginManager.installBundle, exactly like the GUI "Add plugin"
+ * dialog; the host half only serves the read-only scan route here.
+ */
+
+import { apply as applyUpdateChecker } from './host/update-checker.js'
+
+export const name = 'dsh-plugin-update-checker'
+
+export const inject = ['webServer']
+
+export function apply(ctx, config = {}) {
+  applyUpdateChecker(ctx, config)
+}

package/package.json

@@ -1,6 +1,64 @@
 {
   "name": "dsh-plugin-update-checker",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.4",
+  "description": "A DeepSeek Harness plugin that adds a \"Check updates\" button to the Plugins settings section: it scans every installed plugin bundle for published updates and evaluates its peer-dependency compatibility against the running DSH runtime.",
+  "keywords": [
+    "deepseek",
+    "deepseek-harness",
+    "dsh-plugin",
+    "dsh",
+    "plugin-manager",
+    "update-checker"
+  ],
+  "homepage": "https://github.com/windrover/dsh-plugin-update-checker#readme",
+  "bugs": {
+    "url": "https://github.com/windrover/dsh-plugin-update-checker/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/windrover/dsh-plugin-update-checker.git"
+  },
+  "license": "MIT",
+  "type": "module",
+  "main": "lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./client": "./lib/client.js",
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/client.js",
+    "lib/host/*.js",
+    "cordis.patch.yml",
+    "README.md",
+    "LICENSE",
+    "README.zh-CN.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "semver": "^7.6.0"
+  },
+  "engines": {
+    "dsh": ">=0.2.0-0 <0.3.0-0"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-settings",
+        "@deepseek-ai/dsh-client-modules"
+      ],
+      "platform": "web"
+    }
+  },
+  "scripts": {
+    "test": "node test/layering.test.mjs && node test/client-contract.test.mjs && node test/profile-argv.test.mjs && node test/registry-race.test.mjs && node test/runtime-check.test.mjs && node test/compat-parity.test.mjs && node test/scan-route.test.mjs && node test/host-load.test.mjs"
+  }
+}