dsh-plugin-upgrader 1.4.3 → 1.6.0

package/CHANGELOG.md

@@ -1,5 +1,66 @@
 # Changelog
 
+## 1.6.0 — 2026-10-30
+
+- **The install source is now a setting, not a file edit.** The Versions tab header
+  carries a registry control: the official registry, the mainland mirror, whatever
+  `pluginManager` is configured with, sources the user added, or an address typed in.
+  The choice is written to the profile through the host's settings service, so it
+  survives a restart and is the same in every browser — which is the part the plugin
+  page's per-install registry choice never did (issue #1). The version list is re-read
+  from the chosen source and every install passes it to the manager, so the list and the
+  click cannot disagree about where a package comes from. "Follow pnpm's config" keeps
+  the previous behaviour and is the default.
+- **The control opens a dialog that manages sources, not just picks one.** It lists
+  every source the tab can use — the two built-in addresses, the ones `pluginManager`
+  is configured with, and the ones the user added — and each row can be tested against
+  the host (`/-/ping`, falling back to the registry root, 1500 ms — the same endpoint
+  and deadline the harness's own registry probe uses) and switched to with one click,
+  so "is this mirror actually up" is answered in the place the user picks it instead of
+  by a failed install.
+- **The built-in sources have no edit and no delete, by construction.** They are
+  compiled in (`src/client/registry.ts` `WELL_KNOWN_REGISTRIES`) and never written
+  into the saved list, so there is no row to edit or remove — not a disabled button
+  that a later refactor could re-enable.
+- **The settings are volatile `Config` fields**, which is the only shape the host
+  exposes a form for: a plain field is invisible to the settings service, and a
+  non-volatile write would restart the plugin. `src/host/config.ts` declares `registry`
+  and `customRegistries`, `src/client/registry.ts` reads and writes them through
+  `configForms`. A host without that service still renders the tab, with the source
+  shown but not editable.
+- **Custom sources are the second field**, `customRegistries`, so the list persists
+  through the same settings write as the choice and is the same in every browser.
+  Adding, editing and deleting all send the whole array: one bad element fails the
+  write, so validating the list before saving and storing it verbatim afterwards keeps
+  a click from half-applying. Deleting or editing the source in use also moves the
+  choice, so an install can never be redirected to an address the list no longer holds.
+- **`@deepseek-ai/schemastery` is a real dependency now.** It was already present
+  transitively through `dsh-plugin-manager`, but a `Config` schema must be built by the
+  same library the loader validates with, so it is declared rather than borrowed.
+
+## 1.5.0 — 2026-10-30
+
+- **The package now passes the DSH Store's fixed-commit review on everything a
+  package can control.** The store reviews one commit's file tree, looks for the
+  runtime files named by `files`, and refuses to run `prepare` to fill them in.
+  Three changes follow from that: `lib/` is committed instead of ignored, the
+  build moved from `prepare` to `prepack` (so installing no longer executes
+  anything), and `engines` now declares `dsh` as well as `node`. Re-running the
+  store's own review code against the staged tree drops the reasons from seven to
+  three: the missing artifacts, the `prepare` lifecycle script, the undeclared
+  DSH range and the incomplete scan are all gone.
+- **A guard keeps the committed output honest.** `scripts/verify-build-committed.mjs`
+  compares `lib/` on disk against the index and runs from `pnpm run check`, CI and
+  the publish workflow — so a source change that forgets to rebuild cannot reach
+  the registry. It needs the build to be reproducible to mean anything, which it
+  is: two consecutive builds produce byte-identical output.
+- **The three remaining reasons are the plugin's actual capabilities**, and the
+  store routes those to its review lane rather than rejecting them: it reads and
+  writes the profile manifest (`files`), it fetches packuments (`network`), and
+  it reads the environment to find the profile (`credentials` — `DSH_PROFILE_DIR`
+  and `DSH_PROFILE`, neither of which is a secret; the store's benign-variable
+  allow-list names `DSH_HOME` but not those two).
+
 ## 1.4.3 — 2026-10-28
 
 - **`AGENTS.md` records the behaviour that must not regress.** Eleven rules, each

package/README.en.md

@@ -30,6 +30,14 @@ English · [中文](./README.md)
   version number opens that version's GitHub release page.
 - **A lagging mirror is named** — versions published upstream but not yet mirrored
   are listed separately instead of the row pretending to be current.
+- **Pick your own source** — switch the npm registry from the top of the Versions tab
+  (official, the mainland mirror, or an address you type). The version list is re-read
+  from the new source immediately and installs follow it; the choice is written to the
+  profile, so it survives a restart and is the same in every browser.
+- **Manage sources in a dialog** — the Registry button opens a dialog listing the
+  built-in sources, the ones `pluginManager` is configured with, and the ones you added.
+  Built-ins cannot be edited or deleted; your own can. Every row can be tested on its
+  own, and so can the source currently in use.
 
 > **Changing this repo? Read [AGENTS.md](./AGENTS.md) first.** It lists the behaviour
 > that already works and must keep working, with the code location and the test that
@@ -41,6 +49,15 @@ English · [中文](./README.md)
 A **Versions** tab appears next to *Installed* and *Discover* on the Plugins page:
 
 - Header counts: upgradable / installed / version count
+- The header **Registry** control opens the source dialog:
+  - built-in sources (official registry, mainland mirror): switch to and test, never edit
+    or delete
+  - sources from `pluginManager`: use one directly, or keep it in your own list
+  - sources you added: edit and delete; deleting the one in use falls back to
+    *Follow pnpm's config*
+  - **Test** on a row sends one `/-/ping` (falling back to the registry root) with a
+    1.5 s deadline and shows the verdict under that row
+  - the footer's *Follow pnpm's config* keeps pnpm's own registry (usually `.npmrc`)
 - **Upgrade all** handles every upgradable plugin; the selection bar below handles
   **Upgrade selected**
 - **Check for updates** bypasses the 5-minute registry cache
@@ -213,7 +230,7 @@ dsh-plugin-upgrader/
 │   │   └── manager.ts    the minimal host pluginManager type contract
 │   └── client/           browser side (modules, bundled into one file)
 │       ├── index.ts      createPlugin(require): slot registration entry
-│       ├── components/   Tab / PluginRow / VersionLine / JobPanel
+│       ├── components/   Tab / PluginRow / VersionLine / JobPanel / SourceDialog
 │       ├── copy.ts       zh / en strings
 │       ├── styles.ts     scoped CSS
 │       ├── hooks.ts      locale subscription, overview fetching
@@ -221,11 +238,13 @@ dsh-plugin-upgrader/
 │       ├── format.ts     versions / dates / external links
 │       ├── env.ts        minimal window typings
 │       └── types.ts      payload types
-├── lib/                  build output (git-ignored, produced by `pnpm run build`)
+├── lib/                  build output (**committed**, see AGENTS.md §13)
 │   ├── index.js          host entry (tsc output)
 │   ├── host/*.js         host modules plus .d.ts
 │   └── client.js         the browser bundle, wrapped in __ModuleLoader__
 ├── scripts/build.mjs     build: tsc for the host, esbuild for the client (--watch = dev)
+├── scripts/verify-pack.mjs            checks what the tarball would ship
+├── scripts/verify-build-committed.mjs checks lib/ matches src/ and is committed
 ├── test/                 node:test unit tests (.ts, stripped natively by Node 24)
 ├── locale/               (reserved) language files
 ├── assets/icon.svg       icon
@@ -244,27 +263,43 @@ Dependencies are managed with pnpm (`packageManager` is pinned in `package.json`
 and CI uses pnpm too):
 
 ```bash
-pnpm install       # installs dependencies (runs prepare → one build)
+pnpm install       # dependencies only — no build (see below)
 pnpm run dev       # watch src/, rebuild the host and the client on save
 pnpm run build     # tsc for the host + esbuild for the client → lib/
 pnpm run typecheck # tsc over src and test
 pnpm test          # node:test unit tests (.ts runs directly)
-pnpm run check     # all of the above (typecheck + build + test)
+pnpm run check     # all of the above, plus the pack check and the build-committed check
 ```
 
+`lib/` is **committed**, not build litter: the DSH Store reviews a fixed commit and
+will not run `prepare` to fill in missing runtime files. So `pnpm install` no longer
+builds (install-time scripts are an automatic rejection in that review) and the build
+hangs off `prepack`; after editing `src/` you must `pnpm run build` and commit `lib/`
+with it, which `pnpm run check` verifies. See [AGENTS.md](./AGENTS.md) §13.
+
 The host half lives in `src/index.ts` (a `webServer` prefix route at
 `/api/plugin-upgrader`), the browser half in `src/client/index.ts` (registering the
 `plugins.tab` slot).
 
+The user settings are `registry` (the source in use, empty for "follow pnpm") and
+`customRegistries` (the sources the user added), both declared in `src/host/config.ts`.
+Both are marked `.volatile()`, which is what makes the host's settings service expose a
+form for them and what lets a write reach the running plugin without a DSH restart. The
+browser reads and writes them through the `configForms` client service
+(`src/client/registry.ts`); a host without that service still renders the tab, with the
+source shown but not editable. The two built-in sources are constants, never entries in
+`customRegistries` — that is why no click can edit or delete them.
+
 `pnpm run dev` runs two watchers side by side: `tsc --watch` owns `lib/index.js`
 and `lib/host/**`, esbuild owns `lib/client.js`, so neither overwrites the other.
 esbuild only strips types, it does not check them — run `pnpm run typecheck` after
 editing the browser half.
 
 Either way the profile's `link:` points at this directory but loads `lib/`, not
-`src/`, so the build has to run. `pnpm run dev` keeps the output current, but the
-plugin itself does **not** hot-reload — reload it without restarting the app by
-calling `pluginManager.setBundleEnabled(name, false)` and then
+`src/`, so the build has to run and the rebuilt `lib/` has to be committed with it.
+`pnpm run dev` keeps the output current, but the plugin itself does **not**
+hot-reload — reload it without restarting the app by calling
+`pluginManager.setBundleEnabled(name, false)` and then
 `setBundleEnabled(name, true)`.
 
 ## License

package/README.md

@@ -23,6 +23,11 @@ DSH 自带的插件页能装、能卸、能看已安装列表，但缺两件事
 - **一键跳 GitHub** —— 每行的 `GH` 按钮打开插件仓库主页；点版本号直接进该版本的 GitHub 发布页。
 - **镜像落后会标出来** —— 配置的镜像还没同步、但上游已经发布的版本会单独标一行，
   而不是假装已经是最新版。
+- **自己选安装源** —— 版本页顶部就能切换 npm 源（官方源 / 大陆镜像 / 自己填的私有源），
+  选完立刻按新源重读版本列表，升级也走这个源；选择写进 profile，重启和换浏览器都还在。
+- **安装源管理** —— 「注册表」按钮打开一个对话框，里面列出自带源、`pluginManager` 配的源
+  和用户自己加的源；自带源不能改也不能删，自己加的可以随时改/删。每一行都能单独
+  「测试」能不能连上，当前在用的那个也能一键测。
 
 > **要改这个仓库？先读 [AGENTS.md](./AGENTS.md)。** 那里逐条写了「已经实现并且必须继续成立」
 > 的行为、对应代码位置和守护它的测试。上面这些功能里，`GH` 链接和 in-place 升级都曾经
@@ -33,6 +38,12 @@ DSH 自带的插件页能装、能卸、能看已安装列表，但缺两件事
 插件页顶部标签栏多出一个「版本」标签，与「已安装」「发现」并列：
 
 - 顶部统计：可升级数量 / 已安装数量 / 每个插件的版本数
+- 顶部「注册表」按钮打开安装源对话框：
+  - 自带源（官方源、大陆镜像）：只能切过去和测试，不能改也不能删
+  - `pluginManager` 里配的源：可以「收进列表」变成自己的常用源，或直接用
+  - 自己加的源：可以改、可以删，删掉的如果正在用会自动退回「跟随 pnpm 配置」
+  - 每行「测试」发一次 `/-/ping`（连不上时退回根地址），1.5 秒超时，结果显示在那一行下面
+  - 底部「跟随 pnpm 配置」用 pnpm 自己的源（通常是 `~/.npmrc` 里的那个）
 - 「一键升级」升全部可升级插件；下面一条选择栏负责「升级选中」
 - 「检查更新」强制刷新 registry 缓存（默认缓存 5 分钟）
 - 搜索框按包名过滤
@@ -176,6 +187,7 @@ dsh-plugin-upgrader/
 ├── src/                  源码（TypeScript）
 │   ├── index.ts          宿主端入口：路由注册、job 调度、加载时恢复 manifest
 │   ├── host/             宿主端逻辑（Node，无 DOM）
+│   │   ├── config.ts     Config schema（volatile 的 registry / customRegistries）、读取用户选择
 │   │   ├── overview.ts   组装 overview 载荷（含并发上限）
 │   │   ├── registry.ts   registry packument 拉取 / 裁剪、GitHub tag 列表、镜像缺口
 │   │   ├── install.ts    单步安装：in-place 替换、remove 回退、enabled 状态恢复
@@ -189,7 +201,8 @@ dsh-plugin-upgrader/
 │   │   └── manager.ts    宿主 pluginManager 服务的最小类型契约
 │   └── client/           浏览器端（拆成模块，由 esbuild 打成一个文件）
 │       ├── index.ts      createPlugin(require)：槽位注册入口
-│       ├── components/   Tab / PluginRow / VersionLine / JobPanel
+│       ├── components/   Tab / PluginRow / VersionLine / JobPanel / SourceDialog
+│       ├── registry.ts   读写安装源设置、可选源列表的增删改
 │       ├── boot.ts       reload 前确认 boot 文档还有效（见 AGENTS.md 第 4 条）
 │       ├── copy.ts       zh / en 文案
 │       ├── styles.ts     作用域 CSS
@@ -198,11 +211,13 @@ dsh-plugin-upgrader/
 │       ├── format.ts     版本号 / 日期 / 外部链接
 │       ├── env.ts        window 上的最小类型声明
 │       └── types.ts      载荷类型
-├── lib/                  构建产物（git 忽略，`pnpm run build` 生成）
+├── lib/                  构建产物（**已提交**，见 AGENTS.md 第 13 条）
 │   ├── index.js          宿主端入口（tsc 输出）
 │   ├── host/*.js         宿主端模块 + .d.ts
 │   └── client.js         浏览器端单文件 bundle（含 __ModuleLoader__ 包装）
 ├── scripts/build.mjs     构建脚本：tsc 编译宿主端 + esbuild 打包 client（加 --watch 即 dev）
+├── scripts/verify-pack.mjs            发布前核对 tarball 里都有什么
+├── scripts/verify-build-committed.mjs 核对 `lib/` 与源码一致且已提交
 ├── test/                 node:test 单元测试（.ts，Node 24 直接剥离类型）
 ├── locale/               （保留）语言包
 ├── assets/icon.svg       图标
@@ -220,14 +235,19 @@ dsh-plugin-upgrader/
 本项目用 pnpm 管理依赖（`package.json` 里钉了 `packageManager`，CI 也用 pnpm）：
 
 ```bash
-pnpm install       # 安装依赖（会自动跑 prepare → 构建一次）
+pnpm install       # 只装依赖（不会构建，见下）
 pnpm run dev       # 监听 src/，宿主端和浏览器端改完即编译（Ctrl+C 停止）
 pnpm run build     # tsc 编译宿主端 + esbuild 打包 client → lib/
 pnpm run typecheck # tsc 检查 src 和 test
 pnpm test          # node:test 单元测试（.ts 直接运行）
-pnpm run check     # 以上全部（typecheck + build + test + pack 检查）
+pnpm run check     # 以上全部（typecheck + build + test + pack 检查 + 产物是否已提交）
 ```
 
+`lib/` 是**提交进仓库**的，不是构建垃圾：DSH Store 审核固定 commit，不会为了补齐
+运行时文件去执行 `prepare`。所以 `pnpm install` 不再触发构建（安装期脚本会被审核
+直接否决），构建挂在 `prepack` 上；改完 `src/` 必须 `pnpm run build` 并把 `lib/`
+一起提交，`pnpm run check` 会替你核对。详见 [AGENTS.md](./AGENTS.md) 第 13 条。
+
 **改任何代码前先读 [AGENTS.md](./AGENTS.md)。** 那里列的是「已经实现、不能再退回」的行为，
 每条都附了代码位置和守护它的测试名；`pnpm run check` 全绿只说明没写坏，不说明没改坏
 （很多行为没有对应测试，比如「自己那一行不出现在批量升级里」之外的边界情形）。
@@ -238,14 +258,21 @@ pnpm run check     # 以上全部（typecheck + build + test + pack 检查）
 宿主端在 `src/index.ts`（`webServer` 前缀路由 `/api/plugin-upgrader`），
 浏览器端在 `src/client/index.ts`（注册 `plugins.tab` 槽位）。
 
+用户设置有两个：`registry`（当前在用的源，空 = 跟随 pnpm）和 `customRegistries`
+（用户自己加的源），都在 `src/host/config.ts` 里声明成 `.volatile()`——这是宿主
+设置服务愿意为它生成表单、并且写入能进到正在运行的插件里而不重启的唯一形状。
+浏览器端通过 `configForms` 服务读写（`src/client/registry.ts`）；没有那个服务的
+宿主照样能渲染这一页，只是源只能看不能改。两个自带源是常量，永远不写进
+`customRegistries`，所以没有任何点击能改它们或删它们。
+
 `pnpm run dev` 会并行跑两个监听器：`tsc --watch` 负责 `lib/index.js` 和
 `lib/host/**`，esbuild 负责 `lib/client.js`，两者输出互不覆盖。注意 esbuild
 打包时会直接剥掉类型而不做检查，所以改浏览器端时顺手跑一次 `pnpm run typecheck`。
 
 改完代码后必须重新构建（profile 里的 `link:` 指向本目录，但加载的是 `lib/`，
-不是 `src/`）。`pnpm run dev` 已经替你重建了产物，但**插件本身不会热更新**——
-要让宿主重新加载本插件，无需重启应用：先 `pluginManager.setBundleEnabled(name, false)`
-再 `setBundleEnabled(name, true)`。
+不是 `src/`），并把重建后的 `lib/` 一起提交。`pnpm run dev` 已经替你重建了产物，
+但**插件本身不会热更新**——要让宿主重新加载本插件，无需重启应用：先
+`pluginManager.setBundleEnabled(name, false)` 再 `setBundleEnabled(name, true)`。
 
 ## 发布