dsh-plugin 1.1.0 → 1.1.2

package/src/server/http/routes.ts

@@ -1,4 +1,8 @@
 /**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
  * Local HTTP routes exposing real installs to the in-app Plugin Hub UI.
  * The client fetches the same-origin `/dsh-plugin-hub/*` endpoints; the
  * install handler validates the target, then spawns the official dsh CLI
@@ -9,7 +13,7 @@ import type { IncomingMessage, ServerResponse } from 'node:http'
 import { homedir, release } from 'node:os'
 import { dirname, join, resolve } from 'node:path'
 import { spawn } from 'node:child_process'
-import { activeTask, cancelTask, dumpLoaderEntries, getTask, githubTarget, hasQueuedTarget, listPendingRestarts, readProfileArg, startPluginMutation, validPackageName, type LoaderHandle } from '../services/install.ts'
+import { activeTask, cancelTask, dumpLoaderEntries, getTask, githubRepoOf, githubTarget, hasQueuedTarget, listPendingRestarts, readProfileArg, startPluginMutation, validPackageName, type LoaderHandle } from '../services/install.ts'
 import { recordInstalledVersion, recordResolvedNpmPackage, readInstalledVersions, removeInstalledVersion } from '../services/installed-versions.ts'
 import { resolveNpmPackage } from '../services/npm-resolve.ts'
 import { preflightTarget } from '../services/preflight.ts'
@@ -82,11 +86,13 @@ function hostEnv(profile: string): Record<string, string | null> {
   }
 }
 
-/** Match an install target (`github:<owner>/<repo>`) against the installed table; returns the package name when already installed. */
+/** Match a GitHub install target against the installed table; returns the package name when already installed. */
 function installedByRepo(installed: Record<string, string>, target: string): string | null {
-  const needle = target.toLowerCase()
+  const repo = githubRepoOf(target)
+  if (repo === null) return null
+  const needle = repo.toLowerCase()
   for (const [name, spec] of Object.entries(installed)) {
-    if (spec.toLowerCase().includes(needle)) return name
+    if (githubRepoOf(spec)?.toLowerCase() === needle) return name
   }
   return null
 }
@@ -178,7 +184,7 @@ export function mountPluginHubRoutes(webServer: WebServerService, profile: strin
           const displayRepo = typeof body === 'object' && body !== null && typeof (body as { display?: unknown }).display === 'string'
             ? (body as { display: string }).display.trim()
             : rawRepo
-          // 目标语法两态：owner/repo → github 源（走装前预检）；npm 包名（@scope/name 或 name）→ 信任 registry 直接安装
+          // 目标语法两态：owner/repo → 显式 HTTPS Git 源（走装前预检）；npm 包名（@scope/name 或 name）→ 信任 registry 直接安装
           const repoTarget = githubTarget(rawRepo)
           let target: string | null = repoTarget ?? (repoTarget === null && validPackageName(rawRepo) ? rawRepo : null)
           if (target === null) {
@@ -208,7 +214,7 @@ export function mountPluginHubRoutes(webServer: WebServerService, profile: strin
           // 重复安装防护：非更新请求命中已安装目标时直接拒绝，不重复跑 CLI
           // （否则 CLI 会因「已存在」失败，且用户看到的是莫名其妙的报错）；
           // 更新请求（mode: 'update'）放行，CLI 的 add 对已存在依赖是 pnpm 原位覆盖重装。
-          // 命中判定双通道：npm 包名按 dependencies 键直接命中，github: 目标按 spec 值匹配。
+          // 命中判定双通道：npm 包名按 dependencies 键直接命中，GitHub 目标按仓库身份匹配。
           const installed = readInstalled(profile)
           const already = installedByRepo(installed, target) ?? (installed[target] !== undefined ? target : null)
           if (already !== null && mode !== 'update') {
@@ -249,7 +255,7 @@ export function mountPluginHubRoutes(webServer: WebServerService, profile: strin
             profile,
             target,
             // npm 安装时 target 是包名：displayTarget 固定展示仓库名，待重启行/前端恢复不受通道变化影响
-            displayTarget: githubTarget(displayRepo) ?? undefined,
+            displayTarget: githubRepoOf(displayRepo) ?? undefined,
             // 已尝试的安装方式（npm 反查）：实际执行命令由 spawn 时追加，失败 issue 一并展示
             attempts,
             timeoutMs: COMMAND_TIMEOUT_MS,
@@ -294,7 +300,7 @@ export function mountPluginHubRoutes(webServer: WebServerService, profile: strin
             profile,
             target: name,
             // 卸载的 mutation 目标是 npm 包名；待重启行要显示 owner/repo（与安装行一致），非法/缺失时回退包名
-            displayTarget: githubTarget(repo) ?? undefined,
+            displayTarget: githubRepoOf(repo) ?? undefined,
             // 运行中 loader：卸载成功后主动移除条目，立即生效、无需重启
             uninstallLoader: loader,
             timeoutMs: COMMAND_TIMEOUT_MS,

package/src/server/index.ts

@@ -1,4 +1,8 @@
 /**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
  * dsh-plugin host entry: mounts the Plugin Hub HTTP routes once the host
  * web server service is available. The browser bundle (src/client) talks to
  * these same-origin routes to perform real installs from inside the app.

package/src/server/services/install-types.ts

@@ -1,4 +1,10 @@
-/** 安装/卸载运行时的公共类型与常量（无依赖，供各服务模块复用）。 */
+/**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
+ * 安装/卸载运行时的公共类型与常量（无依赖，供各服务模块复用）。
+ */
 
 /** 一个 pnpm 安装子进程的结果快照。 */
 export interface InstallResult {
@@ -11,7 +17,7 @@ export interface InstallResult {
 
 export interface InstallTask {
   id: number
-  /** 操作目标：`github:<owner>/<repo>`（安装）或 npm 包名（卸载），冲突/恢复时需要展示给用户 */
+  /** 操作目标：显式 HTTPS Git URL（安装）或 npm 包名（卸载），冲突/恢复时需要展示给用户 */
   target: string
   /** 展示用目标（owner/repo）：npm 安装时 target 是包名，前端恢复用此字段显示仓库名，保持用户无感知 */
   displayTarget?: string
@@ -28,6 +34,8 @@ export interface InstallTask {
   progress: number
   /** Newest output lines first (consumer shows the tail). */
   lines: string[]
+  /** 完成后是否仍需宿主重启才生效：卸载时 loader 已即时移除 → false；否则 true（弹窗据此给重启选项） */
+  needsRestart: boolean
 }
 
 /** 子进程启动参数（复用宿主 dsh 入口，或回退到 PATH 上的 `dsh`）。 */
@@ -49,7 +57,7 @@ export interface QueueItem {
  * 它自然清空，正好等于「重启后提醒消失」的语义，无需任何重启探测。
  */
 export interface PendingRestart {
-  /** `github:<owner>/<repo>` 安装目标（与任务一致；卸载时为展示用的 owner/repo） */
+  /** Git 安装目标（与任务一致；卸载时为展示用的 owner/repo） */
   target: string
   /** 待重启语义：install 装完等挂载生效 / uninstall 卸完等清理 loader 残留 */
   kind: 'install' | 'uninstall'
@@ -57,7 +65,7 @@ export interface PendingRestart {
   at: number
 }
 
-/** Grammar of an accepted `github:<owner>/<repo>` install target. */
+/** Grammar of a catalog GitHub repository identity (`owner/repo`). */
 export const REPO_RE = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/
 /** Grammar of an npm package name (used for uninstall targets). */
 export const PACKAGE_RE = /^(?:@[a-z0-9._-]+\/)?[A-Za-z0-9._-]+$/

package/src/server/services/install.ts

@@ -1,4 +1,8 @@
 /**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
  * Install runner 的统一出口：执行真实插件变更（spawn 官方 dsh CLI 子进程）。
  * 实现按职责拆分在同目录子模块，本文件只做公共 API 的 re-export，保持外部
  * import 面稳定（routes.ts / index.ts 仍从 `services/install.ts` 引入）。
@@ -14,5 +18,5 @@ export type { InstallResult, InstallTask, Invocation, PendingRestart, QueueItem
 export type { LoaderHandle } from './loader.ts'
 export { addPendingRestart, clearPendingRestart, listPendingRestarts } from './pending-restart.ts'
 export { dumpLoaderEntries, removeLoadedEntry } from './loader.ts'
-export { addAllowBuildsKey, githubTarget, parseAllowBuildsKey, readProfileArg, validPackageName } from './profile.ts'
+export { addAllowBuildsKey, githubRepoOf, githubTarget, parseAllowBuildsKey, readProfileArg, validPackageName } from './profile.ts'
 export { activeTask, cancelTask, getTask, hasQueuedTarget, hasRunningTask, runPluginMutation, startPluginMutation } from './task-queue.ts'

package/src/server/services/installed-versions.ts

@@ -1,8 +1,12 @@
 /**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
  * Installed-plugin version tracking.
  *
  * The installed table (`readInstalled` in routes.ts) only knows the manifest
- * spec of each dependency (`github:<owner>/<repo>`), which carries no version.
+ * spec of each Git dependency, which carries no version.
  * To let the Plugin Hub tell "an update is available", we record the catalog
  * signal present at install time into a small per-profile JSON file, then
  * compare it against the catalog's current signal later.

package/src/server/services/loader.ts

@@ -1,4 +1,8 @@
 /**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
  * 运行中 loader 的读取与停用：卸载成功后对匹配条目做 live-disable，
  * 使卸载立即生效（刷新页面不再加载已卸载的 client bundle，也无需重启）。
  */
@@ -60,13 +64,15 @@ function nameMatches(entryName: string | undefined, target: string): boolean {
 }
 
 /**
- * 卸载成功后从运行中 loader 停用指定包的条目，使卸载立即生效（刷新页面不再
- * 加载已卸载的 client bundle，也无需重启）。做法：按 name 扫描
+ * 卸载成功后从运行中 loader 停用指定包的条目。做法：按 name 扫描
  * `loader.entries()`（含嵌套子树），对每个匹配条目
  * `entry.update({ disabled: true })` 做 live-disable —— fiber 被 dispose，
  * client-modules 对账后不再把它写进 `__DSH_BOOT__`，页面刷新即恢复。
- * 返回 true = 无需重启（条目已停用，或本就没加载过）；false = 未能停用，
- * 需登记「待重启清理」兜底。宿主关键包（@deepseek-ai/* 与本插件自身）一律跳过。
+ * 返回 true = 无需重启（仅当宿主从未加载过它：磁盘已干净）；
+ * 其余一律 false = 需要重启：要么 disable 失败需「待重启清理」兜底，
+ * 要么 disable 成功但该插件曾在 loader 中存活——带 UI 的插件（侧边栏面板等
+ * 宿主启动时渲染的槽位）disable 后不会主动摘除，不重启面板一直残留。
+ * 宿主关键包（@deepseek-ai/* 与本插件自身）一律跳过。
  */
 export async function removeLoadedEntry(loader: LoaderHandle, name: string): Promise<boolean> {
   if (name === 'dsh-plugin' || name.startsWith('@deepseek-ai/')) return false
@@ -95,8 +101,13 @@ export async function removeLoadedEntry(loader: LoaderHandle, name: string): Pro
     if (!found) {
       // 运行中 loader 无该条目：宿主从未加载过它（装完未重启），磁盘已干净，无需重启
       console.log(`[hub-uninstall] no live entry for ${name}; nothing to disable`)
+      return true
     }
-    return true
+    // 找到并停用了 live entry：逻辑层已卸载（刷新页面不再加载其 client bundle），
+    // 但带 UI 的插件（侧边栏面板等）是宿主启动时渲染的槽位，disable 不会主动摘除，
+    // 不重启面板会一直残留 → 返回「需要重启」，弹窗给出「立即重启」，面板立即消失
+    console.log(`[hub-uninstall] disabled live entry for ${name}; UI may persist until restart`)
+    return false
   })()
   const result = await Promise.race([
     removal.catch((error) => {

package/src/server/services/npm-resolve.ts

@@ -1,4 +1,8 @@
 /**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
  * npm 包反查：git 分发不完整（缺构建产物/子模块）导致安装失败时，用 npm
  * registry 的搜索接口按 repository 地址反查该仓库对应的官方 npm 包。
  *

package/src/server/services/pending-restart.ts

@@ -1,4 +1,10 @@
-/** 待重启列表的内存态管理（宿主进程一重启自然清空）。 */
+/**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
+ * 待重启列表的内存态管理（宿主进程一重启自然清空）。
+ */
 import type { PendingRestart } from './install-types.ts'
 
 const pendingRestarts: PendingRestart[] = []
@@ -6,7 +12,7 @@ const pendingRestarts: PendingRestart[] = []
 /**
  * 登记一条待重启记录（同一目标去重）。
  * - 卸载：目标刚装完未重启（已有待重启记录）→ 宿主从未加载过它，卸完磁盘已干净、
- *   loader 无残留，无需再提醒重启，直接移除该条；否则（此前已被宿主加载过）登记「卸载后待重启清理」。
+ *   loader 无残留，无需再提醒重启，直接移除该条；否则（已被宿主加载过）登记「卸载后待重启清理」。
  * - 安装：已有记录则刷新为安装语义（如卸载后未重启又重装），否则新登记。
  */
 export function addPendingRestart(target: string, kind: 'install' | 'uninstall'): void {

package/src/server/services/preflight.ts

@@ -1,5 +1,9 @@
 /**
- * 安装前预检：对 `github:` 源的插件，检查其分发（codeload tarball）里是否
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
+ * 安装前预检：对 GitHub 源的插件，检查其分发（codeload tarball）里是否
  * 真的包含 package.json 声明的入口文件（main / exports["."].default）。
  * git 分发常不提交构建产物（lib/ 等），这类残缺包装完会让宿主重启加载插件树时
  * ERR_MODULE_NOT_FOUND 直接崩溃 —— 预检在动手安装前就把它们拦下，避免白装一次。
@@ -13,6 +17,7 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { pipeline } from 'node:stream/promises'
 import { promisify } from 'node:util'
+import { githubRepoOf } from './profile.ts'
 
 const execFileAsync = promisify(execFile)
 
@@ -23,9 +28,9 @@ export interface PreflightResult {
 }
 
 export async function preflightTarget(target: string): Promise<PreflightResult> {
-  const m = /^github:([^/]+)\/([^/]+)$/.exec(target)
-  if (m === null) return { ok: true, missing: null }
-  const [, owner, repo] = m
+  const source = githubRepoOf(target)
+  if (source === null) return { ok: true, missing: null }
+  const [owner, repo] = source.split('/')
   let commit = ''
   try {
     const { stdout } = await execFileAsync('git', ['ls-remote', `https://github.com/${owner}/${repo}.git`, 'HEAD'])

package/src/server/services/profile.ts

@@ -1,4 +1,8 @@
 /**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
  * 宿主 profile 与目标校验工具：解析当前 profile、目录定位、安装目标语法校验，
  * 以及 pnpm allowBuilds 白名单的写入（失败恢复路径）。
  */
@@ -19,10 +23,30 @@ export function profileDirectory(profile: string): string {
   return join(process.env.DSH_HOME ?? join(homedir(), '.dsh'), 'profiles', profile)
 }
 
-/** Build a safe `github:<owner>/<repo>` target, or null when the repo is unsafe. */
+/** Build a safe explicit HTTPS Git target, or null when the repo is unsafe. */
 export function githubTarget(repo: string): string | null {
   if (typeof repo !== 'string' || !REPO_RE.test(repo)) return null
-  return `github:${repo}`
+  return `git+https://github.com/${repo}.git`
+}
+
+/** Extract an owner/repo identity from a catalog value or an installed Git spec. */
+export function githubRepoOf(value: string): string | null {
+  if (typeof value !== 'string') return null
+  const input = value.trim()
+  if (REPO_RE.test(input)) return input
+  const patterns = [
+    /^github:([^/]+)\/([^/]+)$/i,
+    /^(?:git\+)?https:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?(?:[?#].*)?$/i,
+    /^(?:git\+)?ssh:\/\/(?:git@)?github\.com\/([^/]+)\/([^/]+?)(?:\.git)?(?:[?#].*)?$/i,
+    /^git@github\.com:([^/]+)\/([^/]+?)(?:\.git)?(?:[?#].*)?$/i,
+  ]
+  for (const pattern of patterns) {
+    const match = pattern.exec(input)
+    if (match === null) continue
+    const repo = `${match[1]}/${match[2]}`
+    if (REPO_RE.test(repo)) return repo
+  }
+  return null
 }
 
 /** Validate an npm package name (uninstall target grammar). */
@@ -32,7 +56,7 @@ export function validPackageName(name: string): boolean {
 
 /**
  * The exact `allowBuilds` key pnpm printed in its
- * `ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED` hint. For `github:` installs pnpm
+ * `ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED` hint. For Git installs pnpm
  * matches against `name@<resolved fetch URL>` — the URL it actually fetches,
  * e.g. `https://codeload.github.com/<owner>/<repo>/tar.gz/<commit>` — not the
  * `git+ssh://`/branch spec. A bare name or a `git+` spec does not match, so

package/src/server/services/progress.ts

@@ -1,4 +1,8 @@
 /**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
  * Pure progress-estimation helpers shared by the install runner.
  *
  * The dsh CLI wraps pnpm, which refreshes its `Progress: …` line in place

package/src/server/services/task-queue.ts

@@ -1,4 +1,8 @@
 /**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
  * 后台安装/卸载任务队列：内存任务注册表 + FIFO 串行 worker + 子进程生命周期管理。
  * 每个任务一次 `dsh plugin --profile <profile> <action> <target>` 子进程，
  * 输出流式收集到任务上；卸载成功时尝试从运行中 loader 即时停用（见 loader.ts）。
@@ -12,7 +16,7 @@ import { cleanLine, estimateProgress } from './progress.ts'
 import type { LoaderHandle } from './loader.ts'
 import { removeLoadedEntry } from './loader.ts'
 import { addPendingRestart, clearPendingRestart } from './pending-restart.ts'
-import { addAllowBuildsKey, parseAllowBuildsKey, profileDirectory } from './profile.ts'
+import { addAllowBuildsKey, githubRepoOf, parseAllowBuildsKey, profileDirectory } from './profile.ts'
 
 /** In-memory task registry, keyed by task id. */
 const tasks = new Map<number, InstallTask>()
@@ -170,7 +174,7 @@ export function startPluginMutation(options: {
   /** 入队前已尝试的安装方式（npm registry 反查等）：失败提 Issue 时如实展示；实际执行的命令由 spawn 时追加 */
   attempts?: string[]
 }): InstallTask {
-  const task: InstallTask = { id: nextTaskId, target: options.target, displayTarget: options.displayTarget, action: options.action, status: 'pending', timedOut: false, exitCode: null, progress: 0, lines: [], attempts: options.attempts ?? [] }
+  const task: InstallTask = { id: nextTaskId, target: options.target, displayTarget: options.displayTarget, action: options.action, status: 'pending', timedOut: false, exitCode: null, progress: 0, lines: [], attempts: options.attempts ?? [], needsRestart: false }
   nextTaskId = nextTaskId >= Number.MAX_SAFE_INTEGER ? 1 : nextTaskId + 1
   tasks.set(task.id, task)
   if (tasks.size > MAX_TASKS) {
@@ -223,7 +227,7 @@ function spawnMutation(options: {
   const { action, profile, target, timeoutMs = 5 * 60 * 1000, env, task, displayTarget, uninstallLoader } = options
   const invocation = cliInvocation()
   const args = [...invocation.prefixArgs, 'plugin', '--profile', profile, action, target]
-  // 记录实际执行的命令（npm 通道显示包名，git 通道显示 github: 源）：失败提 Issue 时
+  // 记录实际执行的命令（npm 通道显示包名，git 通道显示 HTTPS 源）：失败提 Issue 时
   // 「已尝试的安装方式」如实展示完整命令链，作者一眼看清我们跑过什么
   const executed = `dsh plugin --profile ${profile} ${action} ${target}`
   if (task && !task.attempts.includes(executed)) {
@@ -305,8 +309,7 @@ function spawnMutation(options: {
 
     child.once('exit', () => {
       // dsh 内部会 fork pnpm：pnpm 退出后仍攥着 stdout/stderr 管道时，
-      // close 事件永不到来（历史队列卡死根因——取消路径曾因此卡死，用整组 SIGKILL 解决；
-      // 自然失败路径没有兜底）。exit 后给 close 一段宽限，未按时触发则整组清理强制结束，
+      // close 事件不会到来。exit 后给 close 一段宽限，未按时触发则整组清理强制结束，
       // 保证任务必然进入终态、后续排队任务自动启动。
       exitWatch = setTimeout(() => {
         if (settled) return
@@ -345,14 +348,19 @@ function spawnMutation(options: {
             if (task.status === 'done') {
               task.progress = 100
               if (action === 'remove' && uninstallLoader) {
-                // 卸载成功 → 主动从运行中 loader 移除该包条目，立即生效、无需重启；
-                // 移除失败（或从未加载过但 loader 不可用）才登记「待重启清理」兜底
+                // 卸载成功 → 主动从运行中 loader 停用该包条目；
+                // 仅当宿主从未加载过它（磁盘已干净）才判「无需重启」；
+                // 只要曾在 loader 中存活（停用过 live entry）就仍要求重启——
+                // 带 UI 的插件（侧边栏面板等宿主启动时渲染的槽位）disable 后不会
+                // 主动消失，重启才能立即摘除面板
                 const removed = await removeLoadedEntry(uninstallLoader, target)
+                task.needsRestart = !removed
                 if (removed) clearPendingRestart(displayTarget ?? target)
                 else addPendingRestart(displayTarget ?? target, 'uninstall')
               } else {
                 // 安装成功（或卸载但无 loader 引用）→ 登记待重启：
                 // 插件要宿主重启才会挂载/卸载干净，重启前一直提醒；展示目标用 displayTarget（owner/repo）
+                task.needsRestart = true
                 addPendingRestart(displayTarget ?? target, action === 'add' ? 'install' : 'uninstall')
               }
             }
@@ -380,8 +388,11 @@ export function verifyInstalledEntry(profile: string, target: string): { name: s
     return { name: null, missing: null }
   }
   const deps = (profilePkg?.dependencies ?? {}) as Record<string, string>
-  // target 自身是依赖名（npm 包），或通过 github: specifier 反查依赖名
-  const name = deps[target] !== undefined ? target : Object.keys(deps).find((k) => deps[k] === target)
+  // target 自身是依赖名（npm 包），或通过 Git specifier 反查依赖名
+  const targetRepo = githubRepoOf(target)?.toLowerCase()
+  const name = targetRepo !== undefined
+    ? Object.keys(deps).find((k) => githubRepoOf(deps[k])?.toLowerCase() === targetRepo)
+    : deps[target] !== undefined ? target : Object.keys(deps).find((k) => deps[k] === target)
   if (!name) return { name: null, missing: null }
   const pkgDir = join(profileDirectory(profile), 'node_modules', name)
   let entry: string | null = null
@@ -460,7 +471,7 @@ export async function runPluginMutation(options: {
     // 输出解析不到时回退用目标名（插件自身构建脚本被拦的 npm 场景）。
     if (output.includes('ERR_PNPM_IGNORED_BUILDS')) {
       const keys = ignoredBuildKeys(output)
-      if (keys.length === 0 && !options.target.startsWith('github:')) keys.push(options.target)
+      if (keys.length === 0 && githubRepoOf(options.target) === null) keys.push(options.target)
       if (keys.length > 0) {
         if (options.task) {
           options.task.status = 'running'