dsh-plugin 0.1.1 → 1.1.0

package/lib/services/npm-resolve.js

@@ -0,0 +1,67 @@
+/**
+ * npm 包反查：git 分发不完整（缺构建产物/子模块）导致安装失败时，用 npm
+ * registry 的搜索接口按 repository 地址反查该仓库对应的官方 npm 包。
+ *
+ * 这是通用机制，不针对任何具体插件：只要作者发布了 repository 指向该
+ * GitHub 仓库的 npm 包（scope 名与 GitHub 用户名是否一致无所谓），就能命中，
+ * 从而把「git 直装必败」的插件切换到 npm 通道安装。命中结果带内存缓存，
+ * 避免同一会话内重复查询 registry。
+ */
+import { get } from 'node:https';
+/** 反查缓存：repo 小写 → npm 包名（null 表示已确认无对应 npm 包）。 */
+const cache = new Map();
+/** 单次 registry 查询超时（ms）：慢网络下失败返回 null，不阻塞安装流程。 */
+const REQUEST_TIMEOUT_MS = 8000;
+/**
+ * 反查 repo（`owner/repo`）对应的官方 npm 包名；未命中、网络异常或超时返回 null。
+ * 返回 null 不代表仓库一定没有 npm 包，只代表本次未能确认 —— 调用方应保留
+ * 原有错误路径，反查只是额外的一次尝试。
+ */
+export function resolveNpmPackage(repo) {
+    const key = repo.toLowerCase();
+    if (cache.has(key))
+        return Promise.resolve(cache.get(key) ?? null);
+    const name = searchRepo(repo);
+    name.then((found) => cache.set(key, found)).catch(() => cache.set(key, null));
+    return name;
+}
+/** 用 npm search 接口按 repository 地址反查，并做铁证校验（包元数据必须指向该仓库）。 */
+function searchRepo(repo) {
+    const [owner, name] = repo.split('/');
+    if (owner === undefined || name === undefined || name === '')
+        return Promise.resolve(null);
+    const url = `https://registry.npmjs.org/-/v1/search?text=${encodeURIComponent(`repository:${owner}/${name}`)}&size=10`;
+    return new Promise((resolve) => {
+        const req = get(url, { timeout: REQUEST_TIMEOUT_MS }, (res) => {
+            if (res.statusCode !== 200) {
+                res.resume();
+                resolve(null);
+                return;
+            }
+            let body = '';
+            res.on('data', (chunk) => { body += chunk.toString(); });
+            res.on('end', () => {
+                try {
+                    const data = JSON.parse(body);
+                    const needle = `github.com/${owner}/${name}`.toLowerCase();
+                    for (const obj of data.objects ?? []) {
+                        const pkg = obj.package;
+                        if (typeof pkg?.name !== 'string' || pkg.name === '')
+                            continue;
+                        const repoUrl = String(pkg.repository?.url ?? pkg.links?.repository ?? '');
+                        if (repoUrl.toLowerCase().includes(needle)) {
+                            resolve(pkg.name);
+                            return;
+                        }
+                    }
+                    resolve(null);
+                }
+                catch {
+                    resolve(null);
+                }
+            });
+        });
+        req.on('timeout', () => req.destroy());
+        req.on('error', () => resolve(null));
+    });
+}

package/lib/services/pending-restart.js

@@ -0,0 +1,34 @@
+const pendingRestarts = [];
+/**
+ * 登记一条待重启记录（同一目标去重）。
+ * - 卸载：目标刚装完未重启（已有待重启记录）→ 宿主从未加载过它，卸完磁盘已干净、
+ *   loader 无残留，无需再提醒重启，直接移除该条；否则（此前已被宿主加载过）登记「卸载后待重启清理」。
+ * - 安装：已有记录则刷新为安装语义（如卸载后未重启又重装），否则新登记。
+ */
+export function addPendingRestart(target, kind) {
+    const existing = pendingRestarts.find((p) => p.target === target);
+    if (kind === 'uninstall') {
+        if (existing)
+            pendingRestarts.splice(pendingRestarts.indexOf(existing), 1);
+        else
+            pendingRestarts.push({ target, kind, at: Date.now() });
+        return;
+    }
+    if (existing) {
+        existing.kind = 'install';
+        existing.at = Date.now();
+    }
+    else {
+        pendingRestarts.push({ target, kind, at: Date.now() });
+    }
+}
+/** 当前待重启列表快照（副本，消费方不会污染内部数组）。 */
+export function listPendingRestarts() {
+    return pendingRestarts.map((p) => ({ ...p }));
+}
+/** 清除某目标的待重启记录（卸载已即时生效、无需重启时调用）。 */
+export function clearPendingRestart(target) {
+    const index = pendingRestarts.findIndex((p) => p.target === target);
+    if (index >= 0)
+        pendingRestarts.splice(index, 1);
+}

package/lib/services/preflight.js

@@ -0,0 +1,94 @@
+/**
+ * 安装前预检：对 `github:` 源的插件，检查其分发（codeload tarball）里是否
+ * 真的包含 package.json 声明的入口文件（main / exports["."].default）。
+ * git 分发常不提交构建产物（lib/ 等），这类残缺包装完会让宿主重启加载插件树时
+ * ERR_MODULE_NOT_FOUND 直接崩溃 —— 预检在动手安装前就把它们拦下，避免白装一次。
+ * npm 包信任 registry 的完整性，直接放行；任何无法预检的情况也放行，交给装后
+ * 校验（verifyInstalledEntry）兜底，保证预检自身失败不会卡死安装流程。
+ */
+import { execFile } from 'node:child_process';
+import { createWriteStream, mkdtempSync, rmSync } from 'node:fs';
+import { get } from 'node:https';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { pipeline } from 'node:stream/promises';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+export async function preflightTarget(target) {
+    const m = /^github:([^/]+)\/([^/]+)$/.exec(target);
+    if (m === null)
+        return { ok: true, missing: null };
+    const [, owner, repo] = m;
+    let commit = '';
+    try {
+        const { stdout } = await execFileAsync('git', ['ls-remote', `https://github.com/${owner}/${repo}.git`, 'HEAD']);
+        commit = stdout.split(/\s+/)[0] ?? '';
+    }
+    catch {
+        return { ok: true, missing: null };
+    }
+    if (!commit)
+        return { ok: true, missing: null };
+    const dir = mkdtempSync(join(tmpdir(), 'dsh-preflight-'));
+    try {
+        const tar = join(dir, 'pkg.tar.gz');
+        await download(`https://codeload.github.com/${owner}/${repo}/tar.gz/${commit}`, tar);
+        const meta = await readTarJson(tar, 'package/package.json');
+        if (meta === null)
+            return { ok: true, missing: null };
+        const dot = meta.exports?.['.'];
+        const resolved = typeof dot === 'string'
+            ? dot
+            : dot !== null && typeof dot === 'object'
+                ? dot.default
+                : undefined;
+        const entry = typeof resolved === 'string' ? resolved : typeof meta.main === 'string' ? meta.main : 'index.js';
+        const inTar = await hasTarEntry(tar, `package/${entry}`);
+        return { ok: inTar, missing: inTar ? null : entry };
+    }
+    catch {
+        return { ok: true, missing: null };
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+function download(url, dest) {
+    return new Promise((resolve, reject) => {
+        get(url, (res) => {
+            if (res.statusCode === 301 || res.statusCode === 302 || res.statusCode === 303) {
+                res.resume();
+                if (res.headers.location) {
+                    void download(res.headers.location, dest).then(resolve, reject);
+                    return;
+                }
+            }
+            if (res.statusCode !== 200) {
+                res.resume();
+                reject(new Error(`download failed: HTTP ${res.statusCode ?? '?'}`));
+                return;
+            }
+            void pipeline(res, createWriteStream(dest)).then(resolve, reject);
+        }).on('error', reject);
+    });
+}
+/** 从 tarball 提取并解析一个 JSON 文件；文件不存在或解析失败返回 null。 */
+async function readTarJson(tar, entry) {
+    try {
+        const { stdout } = await execFileAsync('tar', ['-xzOf', tar, entry], { maxBuffer: 4 * 1024 * 1024 });
+        return JSON.parse(stdout);
+    }
+    catch {
+        return null;
+    }
+}
+/** 检查 tarball 内是否存在指定 entry。 */
+async function hasTarEntry(tar, entry) {
+    try {
+        const { stdout } = await execFileAsync('tar', ['-tzf', tar, entry], { maxBuffer: 1024 * 1024 });
+        return stdout.split(/\r?\n/).some((line) => line === entry);
+    }
+    catch {
+        return false;
+    }
+}

package/lib/services/profile.js

@@ -0,0 +1,88 @@
+/**
+ * 宿主 profile 与目标校验工具：解析当前 profile、目录定位、安装目标语法校验，
+ * 以及 pnpm allowBuilds 白名单的写入（失败恢复路径）。
+ */
+import { readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { PACKAGE_RE, REPO_RE } from './install-types.js';
+/** Resolve the active profile from the booted CLI args, falling back to `web`. */
+export function readProfileArg(fallback = 'web') {
+    const index = process.argv.indexOf('--profile');
+    const candidate = index >= 0 ? process.argv[index + 1] : undefined;
+    return candidate !== undefined && !candidate.startsWith('-') ? candidate : fallback;
+}
+/** Resolve a profile directory (`DSH_HOME` or `~/.dsh`). */
+export function profileDirectory(profile) {
+    return join(process.env.DSH_HOME ?? join(homedir(), '.dsh'), 'profiles', profile);
+}
+/** Build a safe `github:<owner>/<repo>` target, or null when the repo is unsafe. */
+export function githubTarget(repo) {
+    if (typeof repo !== 'string' || !REPO_RE.test(repo))
+        return null;
+    return `github:${repo}`;
+}
+/** Validate an npm package name (uninstall target grammar). */
+export function validPackageName(name) {
+    return typeof name === 'string' && PACKAGE_RE.test(name);
+}
+/**
+ * The exact `allowBuilds` key pnpm printed in its
+ * `ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED` hint. For `github:` installs pnpm
+ * matches against `name@<resolved fetch URL>` — the URL it actually fetches,
+ * e.g. `https://codeload.github.com/<owner>/<repo>/tar.gz/<commit>` — not the
+ * `git+ssh://`/branch spec. A bare name or a `git+` spec does not match, so
+ * the only reliable key is the one pnpm prints verbatim. Null when absent.
+ */
+export function parseAllowBuildsKey(output) {
+    const m = /^[ \t]*(\S+@\S+):[ \t]*true[ \t]*$/m.exec(output);
+    return m === null ? null : m[1].trim();
+}
+/** Quote a YAML block-mapping key when a plain scalar would be invalid. */
+function quoteYamlKey(key) {
+    if (/^[-?:,[\]{}#&*!|>'"%@`]/.test(key) || /:(\s|$)/.test(key)) {
+        return `'${key.replace(/'/g, "''")}'`;
+    }
+    return key;
+}
+/**
+ * Add one `allowBuilds` entry to the profile's pnpm-workspace.yaml, merging
+ * with existing entries and leaving the rest of the yaml intact. Broken
+ * placeholder entries (pnpm's failed-install bug writes a literal
+ * `set this to true or false` value) are dropped on rewrite.
+ */
+export function addAllowBuildsKey(profile, key) {
+    const file = join(profileDirectory(profile), 'pnpm-workspace.yaml');
+    let yaml = '';
+    try {
+        yaml = readFileSync(file, 'utf8');
+    }
+    catch { /* created below */ }
+    const eol = /\r\n/.test(yaml) ? '\r\n' : '\n';
+    const blockRe = /allowBuilds:[ \t]*\r?\n((?:[ \t]+[^\r\n]*\r?\n?)*)/g;
+    const map = new Map();
+    for (const match of Array.from(yaml.matchAll(blockRe))) {
+        for (const line of match[1].split(/\r?\n/)) {
+            const m = /^[ \t]+(\S.*?)\s*:\s*(true|false)?\s*$/.exec(line);
+            if (m === null || m[1] === '')
+                continue;
+            let k = m[1];
+            if (k.length >= 2 && ((k[0] === "'" && k[k.length - 1] === "'") || (k[0] === '"' && k[k.length - 1] === '"'))) {
+                k = k.slice(1, -1);
+            }
+            map.set(k, m[2] ?? 'true');
+        }
+    }
+    map.set(key, 'true');
+    const block = Array.from(map).map(([k, v]) => `  ${quoteYamlKey(k)}: ${v}`).join(eol);
+    const blockText = `allowBuilds:${eol}${block}${eol}`;
+    let next;
+    if (/allowBuilds:[ \t]*\r?\n/.test(yaml)) {
+        let seen = 0;
+        next = yaml.replace(blockRe, () => (seen++ === 0 ? blockText : ''));
+    }
+    else {
+        next = `${yaml.replace(/\r?\n?$/, eol)}${blockText}`;
+    }
+    writeFileSync(file, next);
+}

package/lib/services/progress.js

@@ -0,0 +1,50 @@
+/**
+ * Pure progress-estimation helpers shared by the install runner.
+ *
+ * The dsh CLI wraps pnpm, which refreshes its `Progress: …` line in place
+ * with carriage returns, so raw output arrives as a stream of partial
+ * fragments. These helpers normalize one fragment into a clean terminal
+ * line and map it onto a 0-100 estimate; keeping them free of I/O makes the
+ * estimation logic directly unit-testable (see tests/progress.test.ts).
+ */
+/** Strip the `[out]` / `[err]` source prefix and ANSI escape sequences. */
+export function cleanLine(raw) {
+    return raw.replace(/^\[(?:err|out)\]\s*/, '').replace(/\x1b\[[0-9;]*[A-Za-z]/g, '').trim();
+}
+/**
+ * Estimate 0-100 progress from one CLI output line. pnpm emits
+ * `Progress: resolved N, reused X, downloaded Y, added Z` during the fetch
+ * phase; resolution/install phase lines bump the estimate towards done.
+ */
+export function estimateProgress(line) {
+    const progress = line.match(/Progress:\s*(.+)/);
+    if (progress) {
+        let resolved = 0;
+        let handled = 0;
+        for (const part of progress[1].split(',')) {
+            // pnpm emits `label count` tokens, e.g. `resolved 100, reused 40`
+            const [label, raw] = part.trim().split(/\s+/);
+            const value = Number(raw);
+            if (label === 'resolved')
+                resolved = value;
+            else if (label === 'reused' || label === 'downloaded' || label === 'added' || label === 'imported') {
+                handled += value;
+            }
+        }
+        // pnpm 的 resolved 是"解析出的包数"，reused/downloaded/added 是"已处理的包数"，
+        // 两者几乎总是相等，比值没有进度区分度（一出现就贴满 100%）。
+        // fetch 阶段只占安装总时长的一小部分（git 依赖之后还要 clone + 跑 prepare 构建），
+        // 因此按已处理量在低区间（8-30）缓步推进，把中段留给真正的安装/构建阶段。
+        if (resolved > 0 && handled > 0) {
+            return Math.min(30, 8 + Math.round((handled / resolved) * 20));
+        }
+        return resolved > 0 ? 8 : 0;
+    }
+    if (/^dependencies:|^Packages:/i.test(line))
+        return 85;
+    if (/^Running\b|prepare|build scripts/i.test(line))
+        return 60;
+    if (/^Done in\b/i.test(line))
+        return 96;
+    return 0;
+}