dsh-plugin-update-checker 0.1.4 → 0.1.6

package/README.md

@@ -30,7 +30,19 @@ The check is on demand: click the button, the host scans, and the table fills in
 
 ## 📦 Install
 
-### Option A — from this GitHub repository (recommended)
+### Option A — from npm (recommended)
+
+```bash
+dsh install-plugin dsh-plugin-update-checker
+```
+
+Installing from the registry matters for this plugin in particular: a `github:`
+install is pinned to a commit in the profile lockfile, so re-running the same
+spec never picks up a newer release, and the panel reports it as *Unsupported*
+(it can only compare registry versions). From `0.1.4` on, plain version numbers
+resolve normally and the panel's own **Update** button works.
+
+### Option B — from this GitHub repository
 
 1. Open the sidebar **Plugins** page → **Add plugin**.
 2. In the source field, enter one of these install specs (the launcher resolves them through `installBundle`, the same primitive the GUI uses):

package/README.zh-CN.md

@@ -30,7 +30,17 @@
 
 ## 📦 安装
 
-### 方式 A —— 从本 GitHub 仓库直接安装（推荐）
+### 方式 A —— 从 npm 安装（推荐）
+
+```bash
+dsh install-plugin dsh-plugin-update-checker
+```
+
+从注册表安装对这个插件**尤其值得**：用 `github:` 安装会被 profile 锁文件钉在某个
+commit 上，重跑同样的 spec 不会拿到新版本，面板也只能把它报成 *不受支持*
+（它只会比对注册表版本）。`0.1.4` 之后按普通版本号解析，面板自带的「更新」按钮就能用。
+
+### 方式 B —— 从本 GitHub 仓库直接安装
 
 1. 打开右侧栏 **插件（Plugins）** 页面 → **添加插件**。
 2. 在来源框里填入下面任意一种安装描述符（启动器通过 `installBundle` 解析，和 GUI 用的是同一个原语）：

package/lib/client.js

@@ -59,6 +59,7 @@ window.__ModuleLoader__.load({
 			"updating": "更新中…",
 			"updated": "已更新",
 			"updateFailed": "更新失败",
+			"updateBlocked": "profile 未变更：很可能是发布年龄策略尚未放行该版本。请执行",
 			"linked": "源码链接（请从源码更新）",
 			"linkedHint": "该插件以源码软链方式安装，无法一键更新；请到源码目录拉取最新代码后重启 DSH。",
 			"sourceLink": "前往源码仓库",
@@ -102,6 +103,7 @@ window.__ModuleLoader__.load({
 			"updating": "Updating…",
 			"updated": "Updated",
 			"updateFailed": "Update failed",
+			"updateBlocked": "the profile was not modified. Most likely the release-age policy has not admitted that version yet — install it explicitly with",
 			"linked": "Source-linked (update from source)",
 			"linkedHint": "This plugin is installed as a source symlink and cannot be updated in one click. Pull the latest from its source repo, then restart DSH.",
 			"sourceLink": "Open source repository",
@@ -245,7 +247,17 @@ window.__ModuleLoader__.load({
 					// still report ok without changing anything (e.g. a bare spec
 					// against an already-pinned version), so surface that.
 					const changed = value.changed === true;
-					if (!changed) throw new Error("registry returned no newer version; profile unchanged");
+					if (!changed) {
+						// ok:false would mean the install failed; ok:true with changed:false
+						// means pnpm accepted the command but the profile already satisfied it.
+						// The common cause is the profile release-age policy: a version
+						// published minutes ago is not admitted until it is old enough, and
+						// installBundle does not register the exclusion the App CLI adds.
+						// "registry returned no newer version" was misleading: the registry
+						// did have it, the local policy refused it.
+						const target = typeof latest === "string" && latest !== "" ? `${name}@${latest}` : name;
+						throw new Error(`${t("updateBlocked")} dsh install-plugin ${target}`);
+					}
 					setOutcome((s) => ({ ...s, [name]: { ok: true, restartRequired: application === "restart-required", application } }));
 					// When the change is live immediately, re-scan so the row flips
 					// to "up to date" instead of still showing "update available".

package/lib/host/registry.js

@@ -95,41 +95,94 @@ function readRegistryFromNpmrc(file) {
  * @param {AbortSignal} signal - request deadline.
  * @returns {Promise<{ result: object, registry: string }>} the winning answer.
  */
-export async function probeAnyRegistry(name, registries, signal) {
+export async function probeAnyRegistry(name, registries, signal, installedVersion) {
   // Start every candidate at once and settle on the first *successful* answer,
   // in completion order rather than list order. Awaiting in list order would let
   // a slow first registry delay an already-finished mirror — exactly the case
   // this exists to fix.
   if (registries.length === 0) return { result: { error: 'no registry configured' }, registry: undefined }
-  return await new Promise((resolve) => {
+
+  const probes = registries.map((registry) =>
+    probeRegistry(name, registry, signal).then(
+      (result) => ({ result, registry }),
+      (err) => ({ result: { error: `registry unreachable: ${String(err?.message ?? err)}` }, registry }),
+    ),
+  )
+
+  // First success wins, so the common case stays as fast as the fastest mirror.
+  const first = await new Promise((resolve) => {
+    let done = false
     let failures = 0
-    let lastFailure = null
-    let settled = false
-    for (const registry of registries) {
-      probeRegistry(name, registry, signal).then((result) => {
-        if (settled) return
-        if (result.error === undefined) {
-          settled = true
-          resolve({ result, registry })
+    for (const probe of probes) {
+      probe.then((answer) => {
+        if (done) return
+        if (answer.result.error === undefined) {
+          done = true
+          resolve(answer)
           return
         }
-        lastFailure = { result, registry }
         failures += 1
-        if (failures === registries.length) {
-          settled = true
-          resolve(lastFailure)
-        }
-      }, (err) => {
-        if (settled) return
-        lastFailure = { result: { error: `registry unreachable: ${String(err?.message ?? err)}` }, registry }
-        failures += 1
-        if (failures === registries.length) {
-          settled = true
-          resolve(lastFailure)
+        if (failures === probes.length) {
+          done = true
+          resolve(undefined)
         }
       })
     }
   })
+
+  if (first === undefined) {
+    const all = await Promise.all(probes)
+    return all[all.length - 1]
+  }
+
+  // A fast mirror can be stale: it may still carry the placeholder version npm
+  // creates for a brand-new package, or lag behind the version we already have
+  // installed. Taking that at face value reports "up to date" for something a
+  // second registry knows better, which is the one verdict this plugin must not
+  // get wrong. When the first answer looks like that, wait for the rest (they
+  // are already in flight) and keep the highest real version.
+  if (!isSuspect(first.result, installedVersion)) return first
+  const all = await Promise.all(probes)
+  const best = bestAnswer(all.filter((answer) => answer.result.error === undefined))
+  return best ?? first
+}
+
+/** A placeholder version npm creates while a package has no real release yet. */
+function isPlaceholder(version, result) {
+  return result?.stubLatest === true && version !== undefined
+}
+
+/**
+ * Whether an answer should not be trusted as the final word.
+ * @param result - one registry's probe result.
+ * @param installedVersion - the version on disk, when known.
+ */
+function isSuspect(result, installedVersion) {
+  const latest = result?.latest
+  if (latest === undefined) return false
+  if (isPlaceholder(latest, result)) return true
+  // A registry claiming something older than what is installed is stale by
+  // definition; the installed version came from a registry in the first place.
+  return installedVersion !== undefined
+    && semver.valid(installedVersion) !== null
+    && semver.valid(latest) !== null
+    && semver.lt(latest, installedVersion)
+}
+
+/** Pick the highest real release among several answers, ignoring placeholders. */
+function bestAnswer(answers) {
+  const real = answers.filter((answer) => !isPlaceholder(answer.result.latest, answer.result))
+  const pool = real.length > 0 ? real : answers
+  let best
+  for (const answer of pool) {
+    const latest = answer.result.latest
+    if (latest === undefined) continue
+    if (best === undefined) { best = answer; continue }
+    if (semver.valid(latest) !== null && semver.valid(best.result.latest) !== null) {
+      if (semver.gt(latest, best.result.latest)) best = answer
+    }
+  }
+  return best
 }
 
 /** Probe one npm registry for a package's published versions. */
@@ -143,7 +196,10 @@ async function probeRegistry(name, registry, signal) {
     const distTags = data?.['dist-tags']
     const versions = Array.isArray(data?.versions) ? data.versions : Object.keys(data?.versions ?? {})
     if (distTags?.latest === undefined && versions.length === 0) return { error: 'package not found on registry' }
-    return { latest: distTags?.latest, versions }
+    // npm writes a stub version (0.0.0-stage) for a package whose first real
+    // release has not landed yet; it is a placeholder, not a release.
+    const stubLatest = distTags?.latest !== undefined && data?.versions?.[distTags.latest]?.stub === true
+    return { latest: distTags?.latest, versions, stubLatest }
   } catch (err) {
     if (err?.name === 'AbortError') return { error: 'request aborted' }
     return { error: `registry unreachable: ${String(err?.message ?? err)}` }

package/lib/host/scan.js

@@ -109,7 +109,10 @@ export async function scanBundle(bundle, profileDir, dshVersion, exemptions, sig
     // race the configured registries so a slow public registry cannot dominate.
     const declared = typeof bundle.registry === 'string' && bundle.registry !== '' ? bundle.registry : ''
     const candidates = declared !== '' ? [declared] : registries
-    const { result: remote, registry: usedRegistry } = await probeAnyRegistry(name, candidates, signal)
+    // The installed version lets the race spot a stale mirror instead of
+    // reporting "up to date" from an answer older than what is on disk.
+    const { result: remote, registry: usedRegistry } =
+      await probeAnyRegistry(name, candidates, signal, installedVersion ?? manifest?.version)
     row.update = classifyUpdate(installedVersion ?? manifest?.version, remote)
     // Surface the registry the answer came from so the one-click update installs
     // from the same place the version was read (the client passes it through).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-update-checker",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "A DeepSeek Harness plugin that adds a \"Check updates\" button to the Plugins settings section: it scans every installed plugin bundle for published updates and evaluates its peer-dependency compatibility against the running DSH runtime.",
   "keywords": [
     "deepseek",
@@ -59,6 +59,6 @@
     }
   },
   "scripts": {
-    "test": "node test/layering.test.mjs && node test/client-contract.test.mjs && node test/profile-argv.test.mjs && node test/registry-race.test.mjs && node test/runtime-check.test.mjs && node test/compat-parity.test.mjs && node test/scan-route.test.mjs && node test/host-load.test.mjs"
+    "test": "node test/layering.test.mjs && node test/client-contract.test.mjs && node test/profile-argv.test.mjs && node test/registry-race.test.mjs && node test/registry-staleness.test.mjs && node test/runtime-check.test.mjs && node test/compat-parity.test.mjs && node test/scan-route.test.mjs && node test/host-load.test.mjs"
   }
 }