dsh-plugin 1.4.10 → 1.4.12

package/client/client.js

@@ -698,42 +698,42 @@ window.__ModuleLoader__.load({ id: "dsh-plugin", factory: (require) => {
 			css: css$11
 		});
 		var Header_module_css_default = {
-			"title": "qikqja_title",
-			"segGroup": "qikqja_segGroup",
-			"tabActive": "qikqja_tabActive",
-			"search": "qikqja_search",
+			"adArrow": "qikqja_adArrow",
+			"aboutBtn": "qikqja_aboutBtn",
 			"copyIcon": "qikqja_copyIcon",
-			"headerTitleRow": "qikqja_headerTitleRow",
+			"segBtn": "qikqja_segBtn",
+			"header": "qikqja_header",
+			"version": "qikqja_version",
+			"logoIcon": "qikqja_logoIcon",
+			"headerRight": "qikqja_headerRight",
+			"adText": "qikqja_adText",
+			"githubIcon": "qikqja_githubIcon",
 			"taglineLink": "qikqja_taglineLink",
 			"resultSeg": "qikqja_resultSeg",
-			"aboutBtn": "qikqja_aboutBtn",
-			"adText": "qikqja_adText",
-			"tab": "qikqja_tab",
-			"tabCount": "qikqja_tabCount",
+			"search": "qikqja_search",
+			"searchRow": "qikqja_searchRow",
+			"controls": "qikqja_controls",
+			"resultCount": "qikqja_resultCount",
+			"segLabel": "qikqja_segLabel",
 			"adBadge": "qikqja_adBadge",
 			"githubLink": "qikqja_githubLink",
+			"headerTitleRow": "qikqja_headerTitleRow",
 			"sortGroup": "qikqja_sortGroup",
-			"segBtnActive": "qikqja_segBtnActive",
-			"versionBtn": "qikqja_versionBtn",
+			"tabActive": "qikqja_tabActive",
+			"segGroup": "qikqja_segGroup",
+			"title": "qikqja_title",
+			"tagline": "qikqja_tagline",
 			"tabsRow": "qikqja_tabsRow",
 			"root": "qikqja_root",
-			"searchRow": "qikqja_searchRow",
-			"version": "qikqja_version",
-			"logoIcon": "qikqja_logoIcon",
-			"resultCount": "qikqja_resultCount",
-			"brandTitle": "qikqja_brandTitle",
-			"hubUpdateBadge": "qikqja_hubUpdateBadge",
-			"tabs": "qikqja_tabs",
-			"adArrow": "qikqja_adArrow",
-			"tagline": "qikqja_tagline",
-			"segLabel": "qikqja_segLabel",
 			"langBtn": "qikqja_langBtn",
-			"headerRight": "qikqja_headerRight",
+			"versionBtn": "qikqja_versionBtn",
+			"segBtnActive": "qikqja_segBtnActive",
 			"adBanner": "qikqja_adBanner",
-			"header": "qikqja_header",
-			"githubIcon": "qikqja_githubIcon",
-			"controls": "qikqja_controls",
-			"segBtn": "qikqja_segBtn"
+			"brandTitle": "qikqja_brandTitle",
+			"tabs": "qikqja_tabs",
+			"hubUpdateBadge": "qikqja_hubUpdateBadge",
+			"tab": "qikqja_tab",
+			"tabCount": "qikqja_tabCount"
 		};
 		//#endregion
 		//#region \0dsh-css:src/client/styles/Modal.module.css.mjs
@@ -752,136 +752,136 @@ window.__ModuleLoader__.load({ id: "dsh-plugin", factory: (require) => {
 			css: css$10
 		});
 		var Modal_module_css_default = {
-			"noticeTime": "BiQ1zG_noticeTime",
-			"detailStatusText": "BiQ1zG_detailStatusText",
-			"modalCmd": "BiQ1zG_modalCmd",
-			"aboutModal": "BiQ1zG_aboutModal",
-			"modalCloseIcon": "BiQ1zG_modalCloseIcon",
-			"modalRow": "BiQ1zG_modalRow",
-			"aboutContent": "BiQ1zG_aboutContent",
-			"pendingRowActions": "BiQ1zG_pendingRowActions",
-			"detailDim": "BiQ1zG_detailDim",
-			"detailMono": "BiQ1zG_detailMono",
-			"noticeVersion": "BiQ1zG_noticeVersion",
-			"modalTitleBusy": "BiQ1zG_modalTitleBusy",
-			"toast": "BiQ1zG_toast",
-			"linkIcon": "BiQ1zG_linkIcon",
+			"detailPath": "BiQ1zG_detailPath",
+			"overlay": "BiQ1zG_overlay",
+			"queueRowDesc": "BiQ1zG_queueRowDesc",
+			"confirmIcon": "BiQ1zG_confirmIcon",
+			"resultDesc": "BiQ1zG_resultDesc",
+			"queueSection": "BiQ1zG_queueSection",
+			"modalLabel": "BiQ1zG_modalLabel",
+			"resultRestarting": "BiQ1zG_resultRestarting",
+			"restartLater": "BiQ1zG_restartLater",
+			"restartNowWarning": "BiQ1zG_restartNowWarning",
+			"resultCheck": "BiQ1zG_resultCheck",
+			"queueSectionTitle": "BiQ1zG_queueSectionTitle",
+			"noticeRowOk": "BiQ1zG_noticeRowOk",
+			"noticeRowUpdate": "BiQ1zG_noticeRowUpdate",
+			"failPrepareHint": "BiQ1zG_failPrepareHint",
+			"detailValue": "BiQ1zG_detailValue",
 			"failCopy": "BiQ1zG_failCopy",
-			"failedCopyHint": "BiQ1zG_failedCopyHint",
-			"modalLink": "BiQ1zG_modalLink",
-			"stripCancel": "BiQ1zG_stripCancel",
+			"modalCopy": "BiQ1zG_modalCopy",
+			"modalClose": "BiQ1zG_modalClose",
+			"modalIn": "BiQ1zG_modalIn",
+			"queueRowTarget": "BiQ1zG_queueRowTarget",
+			"restartNow": "BiQ1zG_restartNow",
+			"hubUpdateMetaItem": "BiQ1zG_hubUpdateMetaItem",
+			"detailGrid": "BiQ1zG_detailGrid",
+			"toastFail": "BiQ1zG_toastFail",
+			"progressText": "BiQ1zG_progressText",
+			"detailPathText": "BiQ1zG_detailPathText",
+			"failEmpty": "BiQ1zG_failEmpty",
 			"failKindInstall": "BiQ1zG_failKindInstall",
-			"trustHint": "BiQ1zG_trustHint",
-			"modalDesc": "BiQ1zG_modalDesc",
-			"pendingRowStatus": "BiQ1zG_pendingRowStatus",
+			"pendingRowActions": "BiQ1zG_pendingRowActions",
+			"noticeBadgeFail": "BiQ1zG_noticeBadgeFail",
+			"noticeHead": "BiQ1zG_noticeHead",
+			"modalTitleQueued": "BiQ1zG_modalTitleQueued",
+			"modalActions": "BiQ1zG_modalActions",
+			"progressFill": "BiQ1zG_progressFill",
+			"noticeIgnore": "BiQ1zG_noticeIgnore",
 			"cliOnlyHint": "BiQ1zG_cliOnlyHint",
-			"result": "BiQ1zG_result",
-			"confirmIcon": "BiQ1zG_confirmIcon",
+			"detailStatusPending": "BiQ1zG_detailStatusPending",
+			"modalCmd": "BiQ1zG_modalCmd",
+			"queueRowPct": "BiQ1zG_queueRowPct",
+			"progress": "BiQ1zG_progress",
+			"uninstallConfirm": "BiQ1zG_uninstallConfirm",
+			"noticeUpdateGo": "BiQ1zG_noticeUpdateGo",
+			"noticeTextFail": "BiQ1zG_noticeTextFail",
+			"aboutModal": "BiQ1zG_aboutModal",
+			"failKindUninstall": "BiQ1zG_failKindUninstall",
+			"modalRow": "BiQ1zG_modalRow",
+			"queueRowHead": "BiQ1zG_queueRowHead",
 			"failHead": "BiQ1zG_failHead",
-			"noticeRowOk": "BiQ1zG_noticeRowOk",
 			"detailModal": "BiQ1zG_detailModal",
-			"failPrepareHint": "BiQ1zG_failPrepareHint",
-			"modalCmdText": "BiQ1zG_modalCmdText",
+			"modalTitleBusy": "BiQ1zG_modalTitleBusy",
+			"modalCloseIcon": "BiQ1zG_modalCloseIcon",
+			"toastIn": "BiQ1zG_toastIn",
 			"hubUpdateMeta": "BiQ1zG_hubUpdateMeta",
-			"failNetworkTarget": "BiQ1zG_failNetworkTarget",
-			"modalInstall": "BiQ1zG_modalInstall",
-			"overlay": "BiQ1zG_overlay",
-			"noticeRowUpdate": "BiQ1zG_noticeRowUpdate",
+			"modal": "BiQ1zG_modal",
+			"detailDim": "BiQ1zG_detailDim",
+			"modalCmdCopy": "BiQ1zG_modalCmdCopy",
+			"detailStatusRunning": "BiQ1zG_detailStatusRunning",
+			"errorModal": "BiQ1zG_errorModal",
+			"modalTitle": "BiQ1zG_modalTitle",
 			"overlayIn": "BiQ1zG_overlayIn",
-			"failEmpty": "BiQ1zG_failEmpty",
-			"queueSection": "BiQ1zG_queueSection",
-			"modalIn": "BiQ1zG_modalIn",
-			"queueRowHead": "BiQ1zG_queueRowHead",
-			"detailLabel": "BiQ1zG_detailLabel",
-			"queueRowPct": "BiQ1zG_queueRowPct",
-			"noticeRow": "BiQ1zG_noticeRow",
-			"resultRestarting": "BiQ1zG_resultRestarting",
+			"failedCopyHint": "BiQ1zG_failedCopyHint",
+			"errorHint": "BiQ1zG_errorHint",
 			"progressFillFail": "BiQ1zG_progressFillFail",
 			"failBigIssue": "BiQ1zG_failBigIssue",
-			"detailPathActions": "BiQ1zG_detailPathActions",
-			"detailPath": "BiQ1zG_detailPath",
-			"restartNowWarning": "BiQ1zG_restartNowWarning",
-			"noticeUpdateGo": "BiQ1zG_noticeUpdateGo",
-			"failDiagBtn": "BiQ1zG_failDiagBtn",
-			"failClear": "BiQ1zG_failClear",
-			"modalCmdCopy": "BiQ1zG_modalCmdCopy",
-			"noticeRowMain": "BiQ1zG_noticeRowMain",
-			"failRow": "BiQ1zG_failRow",
-			"noticeBadgeFail": "BiQ1zG_noticeBadgeFail",
-			"hubUpdateNotes": "BiQ1zG_hubUpdateNotes",
-			"progressTrack": "BiQ1zG_progressTrack",
-			"confirmPrimary": "BiQ1zG_confirmPrimary",
-			"logModal": "BiQ1zG_logModal",
-			"toastIn": "BiQ1zG_toastIn",
-			"modalCancel": "BiQ1zG_modalCancel",
-			"modalActions": "BiQ1zG_modalActions",
-			"confirmIconWrap": "BiQ1zG_confirmIconWrap",
-			"detailPathText": "BiQ1zG_detailPathText",
-			"modal": "BiQ1zG_modal",
-			"toastFail": "BiQ1zG_toastFail",
+			"aboutContent": "BiQ1zG_aboutContent",
 			"queueRowTrack": "BiQ1zG_queueRowTrack",
-			"detailUpdateHint": "BiQ1zG_detailUpdateHint",
+			"pendingRowStatus": "BiQ1zG_pendingRowStatus",
+			"detailStars": "BiQ1zG_detailStars",
+			"detailArrow": "BiQ1zG_detailArrow",
+			"queuedHint": "BiQ1zG_queuedHint",
+			"progressHead": "BiQ1zG_progressHead",
 			"errorTitle": "BiQ1zG_errorTitle",
 			"confirmIconDanger": "BiQ1zG_confirmIconDanger",
-			"queueRowBody": "BiQ1zG_queueRowBody",
-			"modalCopy": "BiQ1zG_modalCopy",
-			"restartLater": "BiQ1zG_restartLater",
-			"restartNow": "BiQ1zG_restartNow",
+			"queueRowStatus": "BiQ1zG_queueRowStatus",
+			"modalWide": "BiQ1zG_modalWide",
+			"linkIcon": "BiQ1zG_linkIcon",
+			"failClear": "BiQ1zG_failClear",
+			"detailLink": "BiQ1zG_detailLink",
+			"logModal": "BiQ1zG_logModal",
+			"failList": "BiQ1zG_failList",
 			"noticeBadgeIcon": "BiQ1zG_noticeBadgeIcon",
+			"aboutMeta": "BiQ1zG_aboutMeta",
+			"queueRow": "BiQ1zG_queueRow",
+			"modalCancel": "BiQ1zG_modalCancel",
+			"noticeRowMain": "BiQ1zG_noticeRowMain",
+			"hubUpdateNotes": "BiQ1zG_hubUpdateNotes",
+			"noticeVersion": "BiQ1zG_noticeVersion",
+			"noticeFoot": "BiQ1zG_noticeFoot",
+			"trustHint": "BiQ1zG_trustHint",
+			"failRow": "BiQ1zG_failRow",
 			"resultTitle": "BiQ1zG_resultTitle",
-			"helpModal": "BiQ1zG_helpModal",
-			"modalClose": "BiQ1zG_modalClose",
-			"failList": "BiQ1zG_failList",
+			"errorCopySoft": "BiQ1zG_errorCopySoft",
+			"detailPathBtn": "BiQ1zG_detailPathBtn",
+			"noticeTime": "BiQ1zG_noticeTime",
 			"noticeMain": "BiQ1zG_noticeMain",
-			"failKind": "BiQ1zG_failKind",
-			"detailGrid": "BiQ1zG_detailGrid",
-			"uninstallConfirm": "BiQ1zG_uninstallConfirm",
-			"queueRow": "BiQ1zG_queueRow",
-			"errorModal": "BiQ1zG_errorModal",
-			"progressFill": "BiQ1zG_progressFill",
-			"dangerConfirm": "BiQ1zG_dangerConfirm",
-			"queueRowDesc": "BiQ1zG_queueRowDesc",
+			"modalInstall": "BiQ1zG_modalInstall",
+			"noticeRow": "BiQ1zG_noticeRow",
+			"detailLabel": "BiQ1zG_detailLabel",
+			"noticeTextOk": "BiQ1zG_noticeTextOk",
+			"failDiagBtn": "BiQ1zG_failDiagBtn",
+			"failRepo": "BiQ1zG_failRepo",
+			"detailPathActions": "BiQ1zG_detailPathActions",
+			"progressTrack": "BiQ1zG_progressTrack",
+			"modalCmdText": "BiQ1zG_modalCmdText",
+			"confirmIconWrap": "BiQ1zG_confirmIconWrap",
+			"modalDesc": "BiQ1zG_modalDesc",
+			"queueRowBody": "BiQ1zG_queueRowBody",
+			"failNetworkTarget": "BiQ1zG_failNetworkTarget",
 			"hubUpdateModal": "BiQ1zG_hubUpdateModal",
-			"detailArrow": "BiQ1zG_detailArrow",
-			"detailStatusPending": "BiQ1zG_detailStatusPending",
-			"queueRowTarget": "BiQ1zG_queueRowTarget",
-			"errorCopySoft": "BiQ1zG_errorCopySoft",
-			"modalLabel": "BiQ1zG_modalLabel",
-			"modalWide": "BiQ1zG_modalWide",
-			"noticeList": "BiQ1zG_noticeList",
-			"noticeIgnore": "BiQ1zG_noticeIgnore",
-			"failKindUninstall": "BiQ1zG_failKindUninstall",
-			"detailStars": "BiQ1zG_detailStars",
-			"resultDesc": "BiQ1zG_resultDesc",
 			"detailRow": "BiQ1zG_detailRow",
+			"errorBox": "BiQ1zG_errorBox",
+			"stripCancel": "BiQ1zG_stripCancel",
 			"modalValue": "BiQ1zG_modalValue",
+			"helpModal": "BiQ1zG_helpModal",
+			"toast": "BiQ1zG_toast",
+			"noticeList": "BiQ1zG_noticeList",
+			"dangerConfirm": "BiQ1zG_dangerConfirm",
+			"modalBody": "BiQ1zG_modalBody",
+			"detailMono": "BiQ1zG_detailMono",
+			"resultCheckIcon": "BiQ1zG_resultCheckIcon",
+			"modalHead": "BiQ1zG_modalHead",
+			"detailUpdateHint": "BiQ1zG_detailUpdateHint",
+			"failKind": "BiQ1zG_failKind",
 			"noticeBadgeOk": "BiQ1zG_noticeBadgeOk",
-			"modalTitle": "BiQ1zG_modalTitle",
 			"noticeRemove": "BiQ1zG_noticeRemove",
-			"modalTitleQueued": "BiQ1zG_modalTitleQueued",
-			"queuedHint": "BiQ1zG_queuedHint",
-			"noticeTextFail": "BiQ1zG_noticeTextFail",
-			"detailStatusRunning": "BiQ1zG_detailStatusRunning",
-			"progressText": "BiQ1zG_progressText",
-			"noticeTextOk": "BiQ1zG_noticeTextOk",
-			"noticeHead": "BiQ1zG_noticeHead",
-			"progressHead": "BiQ1zG_progressHead",
-			"hubUpdateMetaItem": "BiQ1zG_hubUpdateMetaItem",
-			"detailLink": "BiQ1zG_detailLink",
-			"detailPathBtn": "BiQ1zG_detailPathBtn",
-			"detailValue": "BiQ1zG_detailValue",
-			"modalHead": "BiQ1zG_modalHead",
-			"errorBox": "BiQ1zG_errorBox",
-			"errorHint": "BiQ1zG_errorHint",
-			"queueSectionTitle": "BiQ1zG_queueSectionTitle",
-			"failRepo": "BiQ1zG_failRepo",
-			"aboutMeta": "BiQ1zG_aboutMeta",
-			"resultCheckIcon": "BiQ1zG_resultCheckIcon",
-			"queueRowStatus": "BiQ1zG_queueRowStatus",
-			"modalBody": "BiQ1zG_modalBody",
-			"progress": "BiQ1zG_progress",
-			"noticeFoot": "BiQ1zG_noticeFoot",
-			"resultCheck": "BiQ1zG_resultCheck"
+			"detailStatusText": "BiQ1zG_detailStatusText",
+			"confirmPrimary": "BiQ1zG_confirmPrimary",
+			"result": "BiQ1zG_result",
+			"modalLink": "BiQ1zG_modalLink"
 		};
 		//#endregion
 		//#region src/client/logic/install-command.ts
@@ -951,7 +951,7 @@ window.__ModuleLoader__.load({ id: "dsh-plugin", factory: (require) => {
 		* tsdown 构建时用 define 把 __PLUGIN_VERSION__ 替换成 package.json 的版本号；
 		* node --test 直接 import 本模块时该标识符不存在，typeof 守卫兜底为空串。
 		*/
-		const PLUGIN_VERSION = "1.4.10";
+		const PLUGIN_VERSION = "1.4.12";
 		const CATEGORY_ORDER = [
 			"interface",
 			"session",
@@ -1588,7 +1588,7 @@ window.__ModuleLoader__.load({ id: "dsh-plugin", factory: (require) => {
 			*/
 			const hubHasUpdate = (() => {
 				if (!hubUpdateInfo) return false;
-				if (hubUpdateInfo.version === "1.4.10") return false;
+				if (hubUpdateInfo.version === "1.4.12") return false;
 				const publishedAt = hubUpdateInfo.publishedAt;
 				if (publishedAt) {
 					const publishedMs = Date.parse(publishedAt);
@@ -4167,40 +4167,40 @@ window.__ModuleLoader__.load({ id: "dsh-plugin", factory: (require) => {
 			css: css$9
 		});
 		var List_module_css_default = {
-			"cardSide": "_3XaZHa_cardSide",
-			"updateBadge": "_3XaZHa_updateBadge",
-			"topic": "_3XaZHa_topic",
-			"retryBtn": "_3XaZHa_retryBtn",
+			"state": "_3XaZHa_state",
+			"desc": "_3XaZHa_desc",
+			"stats": "_3XaZHa_stats",
+			"star": "_3XaZHa_star",
+			"cardTitle": "_3XaZHa_cardTitle",
 			"stateActions": "_3XaZHa_stateActions",
+			"uninstallBtn": "_3XaZHa_uninstallBtn",
+			"body": "_3XaZHa_body",
 			"categoryBadge": "_3XaZHa_categoryBadge",
-			"stateTitle": "_3XaZHa_stateTitle",
-			"list": "_3XaZHa_list",
+			"fork": "_3XaZHa_fork",
+			"actions": "_3XaZHa_actions",
+			"retryBtn": "_3XaZHa_retryBtn",
+			"footLink": "_3XaZHa_footLink",
 			"installBtnUpdate": "_3XaZHa_installBtnUpdate",
-			"stateDesc": "_3XaZHa_stateDesc",
-			"diagBtn": "_3XaZHa_diagBtn",
-			"footer": "_3XaZHa_footer",
-			"uninstallBtn": "_3XaZHa_uninstallBtn",
-			"detailBtn": "_3XaZHa_detailBtn",
+			"list": "_3XaZHa_list",
+			"card": "_3XaZHa_card",
 			"cardMain": "_3XaZHa_cardMain",
-			"state": "_3XaZHa_state",
+			"versionBadge": "_3XaZHa_versionBadge",
+			"stateTitle": "_3XaZHa_stateTitle",
 			"date": "_3XaZHa_date",
-			"actions": "_3XaZHa_actions",
 			"installBtn": "_3XaZHa_installBtn",
-			"versionBadge": "_3XaZHa_versionBadge",
-			"card": "_3XaZHa_card",
+			"detailBtn": "_3XaZHa_detailBtn",
+			"updateBadge": "_3XaZHa_updateBadge",
+			"topic": "_3XaZHa_topic",
+			"cardSide": "_3XaZHa_cardSide",
+			"footer": "_3XaZHa_footer",
 			"verified": "_3XaZHa_verified",
-			"star": "_3XaZHa_star",
+			"stateDesc": "_3XaZHa_stateDesc",
+			"cardHead": "_3XaZHa_cardHead",
 			"installBtnCopied": "_3XaZHa_installBtnCopied",
-			"desc": "_3XaZHa_desc",
-			"body": "_3XaZHa_body",
+			"diagBtn": "_3XaZHa_diagBtn",
 			"topics": "_3XaZHa_topics",
-			"fork": "_3XaZHa_fork",
-			"footLink": "_3XaZHa_footLink",
-			"stats": "_3XaZHa_stats",
-			"cardHead": "_3XaZHa_cardHead",
-			"cardTitle": "_3XaZHa_cardTitle",
-			"installBtnInstalled": "_3XaZHa_installBtnInstalled",
-			"moreSentinel": "_3XaZHa_moreSentinel"
+			"moreSentinel": "_3XaZHa_moreSentinel",
+			"installBtnInstalled": "_3XaZHa_installBtnInstalled"
 		};
 		//#endregion
 		//#region src/client/hooks/useIncrementalList.ts
@@ -4407,15 +4407,15 @@ window.__ModuleLoader__.load({ id: "dsh-plugin", factory: (require) => {
 			css: css$8
 		});
 		var SectionTabs_module_css_default = {
-			"tabIcon": "_7tvizq_tabIcon",
-			"tab": "_7tvizq_tab",
-			"tabCount": "_7tvizq_tabCount",
-			"noticeIcon": "_7tvizq_noticeIcon",
 			"noticeBtn": "_7tvizq_noticeBtn",
+			"tabIcon": "_7tvizq_tabIcon",
+			"tabCountActive": "_7tvizq_tabCountActive",
 			"noticeCount": "_7tvizq_noticeCount",
 			"root": "_7tvizq_root",
-			"tabCountActive": "_7tvizq_tabCountActive",
-			"tabActive": "_7tvizq_tabActive"
+			"tab": "_7tvizq_tab",
+			"tabActive": "_7tvizq_tabActive",
+			"tabCount": "_7tvizq_tabCount",
+			"noticeIcon": "_7tvizq_noticeIcon"
 		};
 		//#endregion
 		//#region src/client/components/layout/SectionTabs.tsx
@@ -4492,42 +4492,42 @@ window.__ModuleLoader__.load({ id: "dsh-plugin", factory: (require) => {
 			css: css$7
 		});
 		var InstalledView_module_css_default = {
-			"segBtn": "_1nXeGW_segBtn",
-			"rowDetail": "_1nXeGW_rowDetail",
+			"rowTitle": "_1nXeGW_rowTitle",
+			"segRow": "_1nXeGW_segRow",
+			"segLabel": "_1nXeGW_segLabel",
+			"segGroup": "_1nXeGW_segGroup",
 			"rowUninstall": "_1nXeGW_rowUninstall",
-			"emptyTitle": "_1nXeGW_emptyTitle",
+			"rowMeta": "_1nXeGW_rowMeta",
+			"rowSourceTagManual": "_1nXeGW_rowSourceTagManual",
+			"list": "_1nXeGW_list",
+			"rowTitleLine": "_1nXeGW_rowTitleLine",
+			"exampleRow": "_1nXeGW_exampleRow",
+			"rowSourceTag": "_1nXeGW_rowSourceTag",
+			"statusPending": "_1nXeGW_statusPending",
+			"rowSourceTagHub": "_1nXeGW_rowSourceTagHub",
+			"segBtnActive": "_1nXeGW_segBtnActive",
 			"rowDesc": "_1nXeGW_rowDesc",
-			"rowMain": "_1nXeGW_rowMain",
 			"versionBadge": "_1nXeGW_versionBadge",
-			"rowTitle": "_1nXeGW_rowTitle",
-			"toolbar": "_1nXeGW_toolbar",
-			"rowRepo": "_1nXeGW_rowRepo",
-			"rowSourceTag": "_1nXeGW_rowSourceTag",
+			"segBtn": "_1nXeGW_segBtn",
 			"rowActions": "_1nXeGW_rowActions",
-			"list": "_1nXeGW_list",
-			"statusInactive": "_1nXeGW_statusInactive",
+			"rowDetail": "_1nXeGW_rowDetail",
 			"rowRestart": "_1nXeGW_rowRestart",
-			"searchInput": "_1nXeGW_searchInput",
-			"root": "_1nXeGW_root",
-			"row": "_1nXeGW_row",
-			"segBtnActive": "_1nXeGW_segBtnActive",
-			"rowMeta": "_1nXeGW_rowMeta",
-			"rowTitleLine": "_1nXeGW_rowTitleLine",
-			"segLabel": "_1nXeGW_segLabel",
+			"toolbar": "_1nXeGW_toolbar",
+			"updateBadge": "_1nXeGW_updateBadge",
+			"rowCategory": "_1nXeGW_rowCategory",
+			"statusInactive": "_1nXeGW_statusInactive",
 			"searchWrap": "_1nXeGW_searchWrap",
-			"rowSourceTagManual": "_1nXeGW_rowSourceTagManual",
-			"segRow": "_1nXeGW_segRow",
-			"exampleBadge": "_1nXeGW_exampleBadge",
-			"statusDot": "_1nXeGW_statusDot",
+			"rowMain": "_1nXeGW_rowMain",
 			"rowUpdate": "_1nXeGW_rowUpdate",
+			"statusDot": "_1nXeGW_statusDot",
 			"empty": "_1nXeGW_empty",
+			"emptyTitle": "_1nXeGW_emptyTitle",
+			"rowRepo": "_1nXeGW_rowRepo",
+			"exampleBadge": "_1nXeGW_exampleBadge",
+			"row": "_1nXeGW_row",
 			"emptyDesc": "_1nXeGW_emptyDesc",
-			"exampleRow": "_1nXeGW_exampleRow",
-			"segGroup": "_1nXeGW_segGroup",
-			"statusPending": "_1nXeGW_statusPending",
-			"rowCategory": "_1nXeGW_rowCategory",
-			"rowSourceTagHub": "_1nXeGW_rowSourceTagHub",
-			"updateBadge": "_1nXeGW_updateBadge"
+			"root": "_1nXeGW_root",
+			"searchInput": "_1nXeGW_searchInput"
 		};
 		//#endregion
 		//#region src/client/components/views/InstalledView.tsx
@@ -4773,28 +4773,28 @@ window.__ModuleLoader__.load({ id: "dsh-plugin", factory: (require) => {
 			css: css$6
 		});
 		var CustomInstallView_module_css_default = {
+			"helpNote": "zISxCG_helpNote",
 			"installCards": "zISxCG_installCards",
-			"installLabel": "zISxCG_installLabel",
 			"installInsertBtn": "zISxCG_installInsertBtn",
-			"installExample": "zISxCG_installExample",
-			"installRow": "zISxCG_installRow",
-			"channelOffBtn": "zISxCG_channelOffBtn",
-			"helpCmd": "zISxCG_helpCmd",
-			"channelOffText": "zISxCG_channelOffText",
 			"installInput": "zISxCG_installInput",
-			"channelOff": "zISxCG_channelOff",
+			"installInputError": "zISxCG_installInputError",
+			"installBtn": "zISxCG_installBtn",
 			"installCard": "zISxCG_installCard",
-			"root": "zISxCG_root",
-			"helpLine": "zISxCG_helpLine",
-			"installCardDisabled": "zISxCG_installCardDisabled",
+			"channelOffText": "zISxCG_channelOffText",
+			"installError": "zISxCG_installError",
+			"helpCmd": "zISxCG_helpCmd",
+			"channelOff": "zISxCG_channelOff",
+			"installHelpBtn": "zISxCG_installHelpBtn",
 			"desc": "zISxCG_desc",
-			"installInputError": "zISxCG_installInputError",
-			"installCardHead": "zISxCG_installCardHead",
+			"installLabel": "zISxCG_installLabel",
+			"channelOffBtn": "zISxCG_channelOffBtn",
 			"helpBody": "zISxCG_helpBody",
-			"helpNote": "zISxCG_helpNote",
-			"installError": "zISxCG_installError",
-			"installBtn": "zISxCG_installBtn",
-			"installHelpBtn": "zISxCG_installHelpBtn"
+			"installExample": "zISxCG_installExample",
+			"helpLine": "zISxCG_helpLine",
+			"root": "zISxCG_root",
+			"installRow": "zISxCG_installRow",
+			"installCardHead": "zISxCG_installCardHead",
+			"installCardDisabled": "zISxCG_installCardDisabled"
 		};
 		//#endregion
 		//#region src/client/components/views/CustomInstallView.tsx
@@ -5084,30 +5084,30 @@ window.__ModuleLoader__.load({ id: "dsh-plugin", factory: (require) => {
 			css: css$5
 		});
 		var SettingsView_module_css_default = {
-			"card": "_506LLG_card",
-			"pageHeader": "_506LLG_pageHeader",
-			"settingRowStack": "_506LLG_settingRowStack",
-			"textInput": "_506LLG_textInput",
+			"settingLabel": "_506LLG_settingLabel",
 			"navIcon": "_506LLG_navIcon",
-			"proxyControl": "_506LLG_proxyControl",
-			"pageTitle": "_506LLG_pageTitle",
 			"navItem": "_506LLG_navItem",
-			"root": "_506LLG_root",
-			"sidebar": "_506LLG_sidebar",
-			"settingTitle": "_506LLG_settingTitle",
-			"settingLabel": "_506LLG_settingLabel",
-			"settingRow": "_506LLG_settingRow",
+			"navItemActive": "_506LLG_navItemActive",
+			"content": "_506LLG_content",
+			"card": "_506LLG_card",
 			"settingControlStack": "_506LLG_settingControlStack",
 			"proxyHint": "_506LLG_proxyHint",
+			"proxyHintFail": "_506LLG_proxyHintFail",
+			"pageHeader": "_506LLG_pageHeader",
+			"settingTitle": "_506LLG_settingTitle",
+			"pageTitle": "_506LLG_pageTitle",
+			"sidebar": "_506LLG_sidebar",
 			"settingDesc": "_506LLG_settingDesc",
+			"settingControl": "_506LLG_settingControl",
+			"proxyControl": "_506LLG_proxyControl",
 			"proxyHintOk": "_506LLG_proxyHintOk",
 			"resetBtn": "_506LLG_resetBtn",
 			"pageDesc": "_506LLG_pageDesc",
-			"proxyHintFail": "_506LLG_proxyHintFail",
-			"navItemActive": "_506LLG_navItemActive",
-			"content": "_506LLG_content",
-			"settingControl": "_506LLG_settingControl",
-			"controlDropdown": "_506LLG_controlDropdown"
+			"textInput": "_506LLG_textInput",
+			"settingRow": "_506LLG_settingRow",
+			"settingRowStack": "_506LLG_settingRowStack",
+			"controlDropdown": "_506LLG_controlDropdown",
+			"root": "_506LLG_root"
 		};
 		//#endregion
 		//#region \0dsh-css:src/client/styles/Dropdown.module.css.mjs
@@ -5126,18 +5126,18 @@ window.__ModuleLoader__.load({ id: "dsh-plugin", factory: (require) => {
 			css: css$4
 		});
 		var Dropdown_module_css_default = {
-			"dropdownCountActive": "B_Gxsq_dropdownCountActive",
-			"dropdownPanel": "B_Gxsq_dropdownPanel",
+			"dropdownLabel": "B_Gxsq_dropdownLabel",
 			"dropdownItemActive": "B_Gxsq_dropdownItemActive",
-			"dropdownFill": "B_Gxsq_dropdownFill",
-			"dropdownCount": "B_Gxsq_dropdownCount",
-			"dropdownItemLabel": "B_Gxsq_dropdownItemLabel",
 			"dropdownArrowOpen": "B_Gxsq_dropdownArrowOpen",
 			"dropdownBtn": "B_Gxsq_dropdownBtn",
-			"dropdown": "B_Gxsq_dropdown",
-			"dropdownLabel": "B_Gxsq_dropdownLabel",
+			"dropdownArrow": "B_Gxsq_dropdownArrow",
+			"dropdownFill": "B_Gxsq_dropdownFill",
 			"dropdownItem": "B_Gxsq_dropdownItem",
-			"dropdownArrow": "B_Gxsq_dropdownArrow"
+			"dropdownItemLabel": "B_Gxsq_dropdownItemLabel",
+			"dropdownPanel": "B_Gxsq_dropdownPanel",
+			"dropdownCount": "B_Gxsq_dropdownCount",
+			"dropdownCountActive": "B_Gxsq_dropdownCountActive",
+			"dropdown": "B_Gxsq_dropdown"
 		};
 		//#endregion
 		//#region \0dsh-css:src/client/styles/Toggle.module.css.mjs
@@ -5156,9 +5156,9 @@ window.__ModuleLoader__.load({ id: "dsh-plugin", factory: (require) => {
 			css: css$3
 		});
 		var Toggle_module_css_default = {
+			"toggle": "k-cD4G_toggle",
 			"toggleOn": "k-cD4G_toggleOn",
-			"knob": "k-cD4G_knob",
-			"toggle": "k-cD4G_toggle"
+			"knob": "k-cD4G_knob"
 		};
 		//#endregion
 		//#region src/client/components/ui/Toggle.tsx
@@ -5258,29 +5258,29 @@ window.__ModuleLoader__.load({ id: "dsh-plugin", factory: (require) => {
 			css: css$2
 		});
 		var DiagnosticsView_module_css_default = {
-			"envDesc": "k9eRya_envDesc",
-			"badgeIdle": "k9eRya_badgeIdle",
-			"summary": "k9eRya_summary",
-			"envTitle": "k9eRya_envTitle",
-			"badgeOk": "k9eRya_badgeOk",
-			"runBtn": "k9eRya_runBtn",
-			"head": "k9eRya_head",
-			"badgeRunning": "k9eRya_badgeRunning",
-			"summaryRunning": "k9eRya_summaryRunning",
-			"diagPulse": "k9eRya_diagPulse",
-			"badge": "k9eRya_badge",
 			"envCopyBtn": "k9eRya_envCopyBtn",
-			"badgeFail": "k9eRya_badgeFail",
-			"envLabel": "k9eRya_envLabel",
-			"summaryOk": "k9eRya_summaryOk",
-			"display": "k9eRya_display",
+			"head": "k9eRya_head",
 			"meta": "k9eRya_meta",
+			"diagPulse": "k9eRya_diagPulse",
 			"summaryFail": "k9eRya_summaryFail",
+			"runBtn": "k9eRya_runBtn",
+			"envLabel": "k9eRya_envLabel",
 			"headHint": "k9eRya_headHint",
-			"row": "k9eRya_row",
+			"badge": "k9eRya_badge",
+			"envTitle": "k9eRya_envTitle",
 			"panel": "k9eRya_panel",
+			"row": "k9eRya_row",
+			"envRow": "k9eRya_envRow",
+			"display": "k9eRya_display",
+			"badgeRunning": "k9eRya_badgeRunning",
+			"badgeIdle": "k9eRya_badgeIdle",
+			"badgeOk": "k9eRya_badgeOk",
+			"badgeFail": "k9eRya_badgeFail",
+			"summaryOk": "k9eRya_summaryOk",
+			"summary": "k9eRya_summary",
 			"name": "k9eRya_name",
-			"envRow": "k9eRya_envRow"
+			"envDesc": "k9eRya_envDesc",
+			"summaryRunning": "k9eRya_summaryRunning"
 		};
 		//#endregion
 		//#region src/client/components/views/DiagnosticsView.tsx
@@ -5458,57 +5458,57 @@ window.__ModuleLoader__.load({ id: "dsh-plugin", factory: (require) => {
 			css: css$1
 		});
 		var LogsView_module_css_default = {
-			"headHint": "_3j77BW_headHint",
-			"event": "_3j77BW_event",
-			"pathLabel": "_3j77BW_pathLabel",
-			"filterChip": "_3j77BW_filterChip",
-			"search": "_3j77BW_search",
-			"message": "_3j77BW_message",
-			"footFail": "_3j77BW_footFail",
-			"pathDialogRow": "_3j77BW_pathDialogRow",
-			"entry": "_3j77BW_entry",
-			"searchInput": "_3j77BW_searchInput",
-			"foot": "_3j77BW_foot",
+			"btn": "_3j77BW_btn",
+			"clearBtn": "_3j77BW_clearBtn",
+			"head": "_3j77BW_head",
+			"pathDialogDesc": "_3j77BW_pathDialogDesc",
 			"badgeError": "_3j77BW_badgeError",
-			"previewRow": "_3j77BW_previewRow",
+			"badgeWarn": "_3j77BW_badgeWarn",
 			"catInstall": "_3j77BW_catInstall",
-			"panel": "_3j77BW_panel",
-			"head": "_3j77BW_head",
-			"btn": "_3j77BW_btn",
+			"headHint": "_3j77BW_headHint",
 			"filterBar": "_3j77BW_filterBar",
-			"badgeDebug": "_3j77BW_badgeDebug",
-			"catUninstall": "_3j77BW_catUninstall",
-			"catSystem": "_3j77BW_catSystem",
-			"badge": "_3j77BW_badge",
-			"list": "_3j77BW_list",
-			"empty": "_3j77BW_empty",
-			"more": "_3j77BW_more",
-			"badgeInfo": "_3j77BW_badgeInfo",
-			"footPath": "_3j77BW_footPath",
-			"catDiagnostics": "_3j77BW_catDiagnostics",
+			"filterChip": "_3j77BW_filterChip",
+			"pathDialogRow": "_3j77BW_pathDialogRow",
+			"event": "_3j77BW_event",
 			"footActions": "_3j77BW_footActions",
-			"time": "_3j77BW_time",
+			"badgeSuccess": "_3j77BW_badgeSuccess",
+			"actions": "_3j77BW_actions",
+			"pathText": "_3j77BW_pathText",
+			"footPath": "_3j77BW_footPath",
 			"pathDraft": "_3j77BW_pathDraft",
-			"pathDialogDesc": "_3j77BW_pathDialogDesc",
-			"pathDialogHint": "_3j77BW_pathDialogHint",
 			"footCount": "_3j77BW_footCount",
+			"filterChipActive": "_3j77BW_filterChipActive",
+			"badge": "_3j77BW_badge",
+			"catUpdate": "_3j77BW_catUpdate",
+			"list": "_3j77BW_list",
 			"pathDialogReset": "_3j77BW_pathDialogReset",
-			"headActions": "_3j77BW_headActions",
+			"catBadge": "_3j77BW_catBadge",
+			"catUninstall": "_3j77BW_catUninstall",
 			"pathDialogFoot": "_3j77BW_pathDialogFoot",
-			"filterChipActive": "_3j77BW_filterChipActive",
-			"clearBtn": "_3j77BW_clearBtn",
-			"logList": "_3j77BW_logList",
+			"message": "_3j77BW_message",
+			"search": "_3j77BW_search",
+			"searchInput": "_3j77BW_searchInput",
+			"time": "_3j77BW_time",
 			"moreEnd": "_3j77BW_moreEnd",
-			"badgeSuccess": "_3j77BW_badgeSuccess",
-			"linkBtn": "_3j77BW_linkBtn",
-			"badgeWarn": "_3j77BW_badgeWarn",
-			"catBadge": "_3j77BW_catBadge",
-			"catUpdate": "_3j77BW_catUpdate",
-			"catSettings": "_3j77BW_catSettings",
-			"pathText": "_3j77BW_pathText",
+			"logList": "_3j77BW_logList",
+			"catDiagnostics": "_3j77BW_catDiagnostics",
+			"badgeInfo": "_3j77BW_badgeInfo",
+			"footFail": "_3j77BW_footFail",
+			"badgeDebug": "_3j77BW_badgeDebug",
 			"pathDialog": "_3j77BW_pathDialog",
-			"actions": "_3j77BW_actions",
-			"pathRow": "_3j77BW_pathRow"
+			"catSettings": "_3j77BW_catSettings",
+			"entry": "_3j77BW_entry",
+			"pathDialogHint": "_3j77BW_pathDialogHint",
+			"linkBtn": "_3j77BW_linkBtn",
+			"catSystem": "_3j77BW_catSystem",
+			"pathRow": "_3j77BW_pathRow",
+			"more": "_3j77BW_more",
+			"foot": "_3j77BW_foot",
+			"panel": "_3j77BW_panel",
+			"pathLabel": "_3j77BW_pathLabel",
+			"headActions": "_3j77BW_headActions",
+			"previewRow": "_3j77BW_previewRow",
+			"empty": "_3j77BW_empty"
 		};
 		//#endregion
 		//#region src/client/components/modals/LogsModal.tsx
@@ -6757,7 +6757,7 @@ window.__ModuleLoader__.load({ id: "dsh-plugin", factory: (require) => {
 				openSection: settingsSection,
 				onConsumedOpenSection: () => setSettingsSection(null)
 			}), showHubUpdate && (0, react.createElement)(HubUpdateModal, {
-				info: catalog.hubUpdateInfo ?? { version: "1.4.10" },
+				info: catalog.hubUpdateInfo ?? { version: "1.4.12" },
 				lang,
 				t,
 				hasUpdate: catalog.hubHasUpdate,

package/lib/http/routes.js

@@ -228,26 +228,50 @@ function sendJson(response, status, value) {
     });
     response.end(JSON.stringify(value));
 }
+/** 本机回环主机名：`localhost` / `127.0.0.1` / `[::1]` 指向同一台机器的同一个端口，
+ *  字符串不同但同源，必须按同一来源比较（dsh-plugin-hub#72）。 */
+const LOOPBACK_HOSTNAMES = new Set(['localhost', '127.0.0.1', '[::1]']);
+/** 把 `host[:port]` 形式的 authority 归一化成 `loopback:端口` —— 三个回环别名
+ *  映射成同一个身份，端口缺省按 http 的 80 补齐；非回环主机名、以及解析不出来的值
+ *  都返回 null。 */
+function loopbackAuthority(authority) {
+    try {
+        const parsed = new URL(`http://${authority}`);
+        if (!LOOPBACK_HOSTNAMES.has(parsed.hostname.toLowerCase()))
+            return null;
+        return `loopback:${parsed.port === '' ? '80' : parsed.port}`;
+    }
+    catch {
+        return null;
+    }
+}
 /** POST mutations are only accepted from the local web server origin or the desktop host page.
  *  Exported for tests (tests/routes.test.ts) — the origin check is the whole CSRF defence. */
 export function isSameOrigin(request) {
-    const origin = request.headers.origin;
-    if (origin === undefined)
+    // 服务只绑定本机回环地址：Host 不是回环（局域网 IP、被改写的域名）一律拒绝，
+    // 顺带挡掉 DNS rebinding（Host 是攻击者域名，即便解析到 127.0.0.1）。
+    const host = request.headers.host;
+    const hostKey = host === undefined ? null : loopbackAuthority(host);
+    if (hostKey === null)
         return false;
+    const origin = request.headers.origin;
+    // 桌面端宿主把 `/dsh-plugin-hub/*` 转发给本地 http server 时可能不带 Origin 头，
+    // 此时所有 POST 都会被判成 untrusted origin（dsh-plugin-hub#72）。浏览器对 POST 请求
+    // 必定携带 Origin（含同源 POST 与跨站表单），能省略该头的只有本机原生客户端，
+    // 而它们本来就能伪造任意 Origin，因此放行不扩大 CSRF 面。
+    if (origin === undefined || origin === '')
+        return true;
     try {
         const url = new URL(origin);
-        // 桌面端（Electron 宿主）的页面跑在宿主自定义协议下，origin 形如 `dsh-app://app`。
-        // 客户端一律用相对路径请求，宿主把 `/dsh-plugin-hub/*` 转发给本地 http server 时
-        // Origin 头原样保留，与 Host（如 localhost:3081）不等，因此必须显式放行该协议，
-        // 否则桌面端全部 POST 都会被判成 untrusted origin。该协议只有宿主自身能产生，
-        // 外部网页无法把 Origin 伪造成 `dsh-app://…`，放行不扩大 CSRF 面。
+        // 桌面端（Electron 宿主）的页面跑在宿主自定义协议下，origin 形如 `dsh-app://app`，
+        // 与 Host（如 localhost:3081）必然不等，因此必须显式放行该协议，否则桌面端全部 POST
+        // 都会被判成 untrusted origin。该协议只有宿主自身能产生，外部网页无法把 Origin
+        // 伪造成 `dsh-app://…`，放行不扩大 CSRF 面。
         if (url.protocol === 'dsh-app:')
             return true;
-        const host = request.headers.host;
-        if (host === undefined)
-            return false;
-        const localHostnames = new Set(['localhost', '127.0.0.1', '[::1]']);
-        return url.host === host && localHostnames.has(url.hostname);
+        // 按归一化后的「主机名:端口」比较：`localhost` / `127.0.0.1` / `[::1]` 不再互相拒绝，
+        // 端口仍然必须一致（另一个本机进程不能被当成同一来源）。
+        return loopbackAuthority(url.host) === hostKey;
     }
     catch {
         return false;
@@ -851,10 +875,27 @@ export function mountPluginHubRoutes(webServer, profile, loader) {
                             ? settings.proxy
                             : (systemProxy() ?? process.env.HTTPS_PROXY ?? process.env.https_proxy ?? '');
                         const isGitChannel = repoTarget !== null && target === repoTarget;
-                        const probeTarget = isGitChannel
-                            ? 'https://github.com/'
-                            : `${(settings.npmRegistry.replace(/\/+$/, '') || 'https://registry.npmjs.org')}/`;
-                        const net = await probeUrl(probeTarget, effectiveProxy, 6000);
+                        const npmProbeTarget = `${(settings.npmRegistry.replace(/\/+$/, '') || 'https://registry.npmjs.org')}/`;
+                        // git 通道的探针换成克隆握手本身：git ls-remote 走的就是 pnpm 克隆前的同一套
+                        // https 传输。curl 打 github.com 主页会被按协议/端口区分的防火墙与 TLS 复检
+                        // 拦截（能 git 克隆、打不开网页），把可装的仓库误判成 [network] 而中止
+                        // （见 issue #71）。握手失败时再用 curl 复核一次主页连通性：只有两者都不通
+                        // 才判「网络不通」；仅握手失败（仓库不存在、私有仓库、需要凭据）放行，
+                        // 交给后续预检与真实安装给出准确原因。
+                        const gitProbeTarget = repoTarget === null ? null : repoTarget.replace(/^git\+/, '');
+                        let net;
+                        if (gitProbeTarget !== null) {
+                            net = await gitLsRemote(gitProbeTarget, effectiveProxy, 6000);
+                            if (!net.ok) {
+                                const reachable = await probeUrl('https://github.com/', effectiveProxy, 6000);
+                                if (reachable.ok)
+                                    net = reachable;
+                            }
+                        }
+                        else {
+                            net = await probeUrl(npmProbeTarget, effectiveProxy, 6000);
+                        }
+                        const probeTarget = gitProbeTarget ?? npmProbeTarget;
                         if (!net.ok) {
                             // 错误消息按客户端界面语言提示：中文界面给中文、英文界面给英文，
                             // 让用户一眼看懂是网络问题而非插件问题

package/lib/services/install/task-queue.js

@@ -9,7 +9,7 @@
  */
 import { spawn, spawnSync } from 'node:child_process';
 import { resolvePackageEntry } from './package-entry.js';
-import { readFileSync, statSync } from 'node:fs';
+import { existsSync, readFileSync, statSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { CAPTURE_LIMIT_BYTES, MAX_TASKS, MAX_TASK_LINES } from './install-types.js';
 import { npmTooLowMarker } from './npm-check.js';
@@ -112,19 +112,55 @@ function pushLine(task, line) {
         task.progress = Math.max(task.progress, 6 + Math.min(79, task.lines.length * 2));
     }
 }
-function cliInvocation() {
+function cliInvocation(profile) {
     const entry = process.argv[1];
-    if (entry !== undefined && /[\\/](?:bin\.(?:js|ts)|dsh)$/.test(entry)) {
-        const absoluteEntry = resolve(entry);
-        return {
-            file: process.execPath,
-            prefixArgs: [...process.execArgv, absoluteEntry],
-            cwd: dirname(absoluteEntry),
-            useShell: false,
-        };
+    if (entry !== undefined) {
+        // 打包桌面端（Electron）：宿主入口在 app.asar 内，机器上根本没有 `dsh` 可执行文件
+        //（Windows 那条 dsh.cmd shim 只存在于宿主进程自己的 PATH 里），直接回退 PATH 必然
+        // 报 [dsh-missing]（见 issue #71）。这里改用应用自己的 CLI 引导脚本调起同一份打包
+        // CLI：Electron 可执行文件 + --expose-internals + desktop-cli.js，与内置终端、
+        // 官方插件页安装完全同一条路径 —— desktop profile 由应用独占管理的授权也在其中。
+        const bootstrap = desktopCliBootstrap(entry);
+        if (bootstrap !== null) {
+            return {
+                file: process.execPath,
+                prefixArgs: ['--expose-internals', bootstrap],
+                // 工作目录用 profile 目录（真实存在的目录）：asar 内的路径不能作为 spawn 的 cwd
+                cwd: profileDirectory(profile),
+                useShell: false,
+                // Electron 可执行文件只有带这个变量才按 Node 运行引导脚本
+                env: { ELECTRON_RUN_AS_NODE: '1' },
+            };
+        }
+        if (/[\\/](?:bin\.(?:js|ts)|dsh)$/.test(entry)) {
+            const absoluteEntry = resolve(entry);
+            return {
+                file: process.execPath,
+                prefixArgs: [...process.execArgv, absoluteEntry],
+                cwd: dirname(absoluteEntry),
+                useShell: false,
+            };
+        }
     }
     return { file: 'dsh', prefixArgs: [], cwd: process.cwd(), useShell: process.platform === 'win32' };
 }
+/**
+ * 打包桌面端宿主的 CLI 引导脚本路径（`<asar 根>/lib/desktop-cli.js`，即应用内
+ * pnpm 服务的 dshBootstrapPath）。宿主入口落在 app.asar 内时按 asar 根反推候选路径，
+ * 命中存在的那个才采用；布局不认识（官方改版）时返回 null，调用方回退原逻辑。
+ * 导出供单测覆盖路径推导。
+ */
+export function desktopCliBootstrap(entry) {
+    const marker = /[\\/]app\.asar(?=[\\/]|$)/i.exec(entry);
+    if (marker === null)
+        return null;
+    const root = entry.slice(0, marker.index + marker[0].length);
+    for (const candidate of [join(root, 'lib', 'desktop-cli.js'), join(root, 'dsh', 'lib', 'desktop-cli.js')]) {
+        if (existsSync(candidate))
+            return candidate;
+    }
+    return null;
+}
 /**
  * dsh 命令存在性探测：which/where 找 PATH 里的 dsh。
  * Windows shell 模式命令缺失时 cmd 只输出 GBK 乱码「不是内部或外部命令」（UTF-8 解码后
@@ -286,7 +322,7 @@ function spawnMutation(options) {
     const isGlobalNpm = (globalNpm ?? []).length > 0;
     const invocation = isGlobalNpm
         ? { file: 'npm', prefixArgs: [], cwd: process.cwd(), useShell: process.platform === 'win32' }
-        : cliInvocation();
+        : cliInvocation(profile);
     // 更新已安装的 npm 包：显式指定 @latest。pnpm add <pkg>（无版本）对已存在依赖
     // （尤其精确 spec 如 "1.3.0"）是幂等的 —— 输出 "Already up to date" 且不改 package.json，
     // 导致「更新成功」但实际仍停留在旧版本；git 地址与全局安装不受此影响。
@@ -334,7 +370,9 @@ function spawnMutation(options) {
             }
             child = spawn(invocation.file, attemptArgs, {
                 cwd: invocation.cwd,
-                env,
+                // invocation.env 是「必须叠加」的变量（打包桌面端的 ELECTRON_RUN_AS_NODE）：
+                // 没有它时保持 env 原样透传，有它时必须基于完整环境叠加，否则子进程会丢掉 PATH。
+                env: invocation.env === undefined ? env : { ...(env ?? process.env), ...invocation.env },
                 shell: invocation.useShell,
                 // detached 使子进程成为独立进程组组长：取消时能整组清理（见 stopChild），
                 // 且宿主进程崩溃后安装任务不会被连带误杀

package/lib/services/probe.js

@@ -30,6 +30,8 @@ export function curlTlsArgs() {
 export function curlRevokeFlagUnsupported(code, stderr) {
     return code === 2 && /ssl-revoke-best-effort/i.test(stderr) && /unknown|unrecognized/i.test(stderr);
 }
+/** 彻底关闭证书吊销检查的兜底参数（curl ≥ 7.19），比降级参数覆盖更老的 Windows curl。 */
+const NO_REVOKE_ARG = '--ssl-no-revoke';
 /** stderr 是否指向 Schannel 取不到证书吊销信息（据此归因为环境 TLS 问题，而非网络不通）。 */
 export function tlsRevocationBlocked(stderr) {
     return /CRYPT_E_NO_REVOCATION_CHECK|CRYPT_E_REVOCATION_OFFLINE|0x80092012/i.test(stderr);
@@ -135,13 +137,24 @@ function runCurl(args, env, timeoutMs) {
     });
 }
 /** 带 TLS 兜底的 curl 调用：先按平台参数跑（Windows 带吊销检查降级），
- *  若本机 curl 不认这个参数（curl < 7.70）则去掉参数重跑一次，保证老版本不因此直接失败。 */
+ *  若本机 curl 不认这个参数（curl < 7.70）则去掉参数重跑一次，保证老版本不因此直接失败；
+ *  降级后仍被吊销检查拦死（CRYPT_E_NO_REVOCATION_CHECK）时，再用 --ssl-no-revoke
+ *  彻底关掉吊销检查跑一次 —— 该参数 curl ≥ 7.19 即存在，覆盖面比降级参数更广，
+ *  否则「能上网但取不到 CRL」的 Windows 机器会把所有通道误报成不可达（见 issue #71）。
+ *  吊销检查只影响本次探测自身的信任判断，不改变系统 TLS 配置。 */
 async function curlWithTlsFallback(args, env, timeoutMs) {
     const tlsArgs = curlTlsArgs();
-    const first = await runCurl([...tlsArgs, ...args], env, timeoutMs);
-    if (tlsArgs.length === 0 || !curlRevokeFlagUnsupported(first.code, first.stderr))
-        return first;
-    return runCurl(args, env, timeoutMs);
+    let run = await runCurl([...tlsArgs, ...args], env, timeoutMs);
+    if (tlsArgs.length > 0 && curlRevokeFlagUnsupported(run.code, run.stderr)) {
+        run = await runCurl(args, env, timeoutMs);
+    }
+    if (tlsArgs.length > 0 && tlsRevocationBlocked(run.stderr)) {
+        const retry = await runCurl([NO_REVOKE_ARG, ...args], env, timeoutMs);
+        // 只在兜底本身跑起来（非「不认识该参数」）时采用其结果，否则保留原始失败线索
+        if (retry.code !== null && !curlRevokeFlagUnsupported(retry.code, retry.stderr))
+            run = retry;
+    }
+    return run;
 }
 /**
  * curl 子进程探测：spawn curl -s -w '%{http_code}' 并注入代理 env。

package/lib/types/services/install/install-types.d.ts

@@ -46,6 +46,8 @@ export interface Invocation {
     prefixArgs: string[];
     cwd: string;
     useShell: boolean;
+    /** 必须叠加到子进程环境上的变量（打包桌面端要带 ELECTRON_RUN_AS_NODE） */
+    env?: NodeJS.ProcessEnv;
 }
 /** 排队中的变更任务及其启动参数。 */
 export interface QueueItem {

package/lib/types/services/install/task-queue.d.ts

@@ -33,6 +33,13 @@ export declare function hasQueuedTarget(target: string): boolean;
  * Returns false when the task is unknown or already finished.
  */
 export declare function cancelTask(id: number): boolean;
+/**
+ * 打包桌面端宿主的 CLI 引导脚本路径（`<asar 根>/lib/desktop-cli.js`，即应用内
+ * pnpm 服务的 dshBootstrapPath）。宿主入口落在 app.asar 内时按 asar 根反推候选路径，
+ * 命中存在的那个才采用；布局不认识（官方改版）时返回 null，调用方回退原逻辑。
+ * 导出供单测覆盖路径推导。
+ */
+export declare function desktopCliBootstrap(entry: string): string | null;
 /**
  * Enqueue a plugin mutation and return its task. Tasks run strictly serially:
  * the queue worker starts the next one only after the previous finishes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin",
-  "version": "1.4.10",
+  "version": "1.4.12",
   "description": "A community plugin marketplace for DeepSeek Harness, built to the official plugin spec — browse, search and install 10000+ human-curated community plugins without leaving the app. · DeepSeek Harness 社区插件市场（遵循官方开发规范）：10000+ 人工精选社区插件，每日更新。",
   "type": "module",
   "main": "lib/index.js",

package/src/server/http/routes.ts

@@ -256,23 +256,47 @@ function sendJson(response: ServerResponse, status: number, value: unknown): voi
   response.end(JSON.stringify(value))
 }
 
+/** 本机回环主机名：`localhost` / `127.0.0.1` / `[::1]` 指向同一台机器的同一个端口，
+ *  字符串不同但同源，必须按同一来源比较（dsh-plugin-hub#72）。 */
+const LOOPBACK_HOSTNAMES = new Set(['localhost', '127.0.0.1', '[::1]'])
+
+/** 把 `host[:port]` 形式的 authority 归一化成 `loopback:端口` —— 三个回环别名
+ *  映射成同一个身份，端口缺省按 http 的 80 补齐；非回环主机名、以及解析不出来的值
+ *  都返回 null。 */
+function loopbackAuthority(authority: string): string | null {
+  try {
+    const parsed = new URL(`http://${authority}`)
+    if (!LOOPBACK_HOSTNAMES.has(parsed.hostname.toLowerCase())) return null
+    return `loopback:${parsed.port === '' ? '80' : parsed.port}`
+  } catch {
+    return null
+  }
+}
+
 /** POST mutations are only accepted from the local web server origin or the desktop host page.
  *  Exported for tests (tests/routes.test.ts) — the origin check is the whole CSRF defence. */
 export function isSameOrigin(request: IncomingMessage): boolean {
+  // 服务只绑定本机回环地址：Host 不是回环（局域网 IP、被改写的域名）一律拒绝，
+  // 顺带挡掉 DNS rebinding（Host 是攻击者域名，即便解析到 127.0.0.1）。
+  const host = request.headers.host
+  const hostKey = host === undefined ? null : loopbackAuthority(host)
+  if (hostKey === null) return false
   const origin = request.headers.origin
-  if (origin === undefined) return false
+  // 桌面端宿主把 `/dsh-plugin-hub/*` 转发给本地 http server 时可能不带 Origin 头，
+  // 此时所有 POST 都会被判成 untrusted origin（dsh-plugin-hub#72）。浏览器对 POST 请求
+  // 必定携带 Origin（含同源 POST 与跨站表单），能省略该头的只有本机原生客户端，
+  // 而它们本来就能伪造任意 Origin，因此放行不扩大 CSRF 面。
+  if (origin === undefined || origin === '') return true
   try {
     const url = new URL(origin)
-    // 桌面端（Electron 宿主）的页面跑在宿主自定义协议下，origin 形如 `dsh-app://app`。
-    // 客户端一律用相对路径请求，宿主把 `/dsh-plugin-hub/*` 转发给本地 http server 时
-    // Origin 头原样保留，与 Host（如 localhost:3081）不等，因此必须显式放行该协议，
-    // 否则桌面端全部 POST 都会被判成 untrusted origin。该协议只有宿主自身能产生，
-    // 外部网页无法把 Origin 伪造成 `dsh-app://…`，放行不扩大 CSRF 面。
+    // 桌面端（Electron 宿主）的页面跑在宿主自定义协议下，origin 形如 `dsh-app://app`，
+    // 与 Host（如 localhost:3081）必然不等，因此必须显式放行该协议，否则桌面端全部 POST
+    // 都会被判成 untrusted origin。该协议只有宿主自身能产生，外部网页无法把 Origin
+    // 伪造成 `dsh-app://…`，放行不扩大 CSRF 面。
     if (url.protocol === 'dsh-app:') return true
-    const host = request.headers.host
-    if (host === undefined) return false
-    const localHostnames = new Set(['localhost', '127.0.0.1', '[::1]'])
-    return url.host === host && localHostnames.has(url.hostname)
+    // 按归一化后的「主机名:端口」比较：`localhost` / `127.0.0.1` / `[::1]` 不再互相拒绝，
+    // 端口仍然必须一致（另一个本机进程不能被当成同一来源）。
+    return loopbackAuthority(url.host) === hostKey
   } catch {
     return false
   }
@@ -840,10 +864,25 @@ export function mountPluginHubRoutes(webServer: WebServerService, profile: strin
               ? settings.proxy
               : (systemProxy() ?? process.env.HTTPS_PROXY ?? process.env.https_proxy ?? '')
             const isGitChannel = repoTarget !== null && target === repoTarget
-            const probeTarget = isGitChannel
-              ? 'https://github.com/'
-              : `${(settings.npmRegistry.replace(/\/+$/, '') || 'https://registry.npmjs.org')}/`
-            const net = await probeUrl(probeTarget, effectiveProxy, 6000)
+            const npmProbeTarget = `${(settings.npmRegistry.replace(/\/+$/, '') || 'https://registry.npmjs.org')}/`
+            // git 通道的探针换成克隆握手本身：git ls-remote 走的就是 pnpm 克隆前的同一套
+            // https 传输。curl 打 github.com 主页会被按协议/端口区分的防火墙与 TLS 复检
+            // 拦截（能 git 克隆、打不开网页），把可装的仓库误判成 [network] 而中止
+            // （见 issue #71）。握手失败时再用 curl 复核一次主页连通性：只有两者都不通
+            // 才判「网络不通」；仅握手失败（仓库不存在、私有仓库、需要凭据）放行，
+            // 交给后续预检与真实安装给出准确原因。
+            const gitProbeTarget = repoTarget === null ? null : repoTarget.replace(/^git\+/, '')
+            let net: Awaited<ReturnType<typeof probeUrl>>
+            if (gitProbeTarget !== null) {
+              net = await gitLsRemote(gitProbeTarget, effectiveProxy, 6000)
+              if (!net.ok) {
+                const reachable = await probeUrl('https://github.com/', effectiveProxy, 6000)
+                if (reachable.ok) net = reachable
+              }
+            } else {
+              net = await probeUrl(npmProbeTarget, effectiveProxy, 6000)
+            }
+            const probeTarget = gitProbeTarget ?? npmProbeTarget
             if (!net.ok) {
               // 错误消息按客户端界面语言提示：中文界面给中文、英文界面给英文，
               // 让用户一眼看懂是网络问题而非插件问题

package/src/server/services/install/install-types.ts

@@ -49,6 +49,8 @@ export interface Invocation {
   prefixArgs: string[]
   cwd: string
   useShell: boolean
+  /** 必须叠加到子进程环境上的变量（打包桌面端要带 ELECTRON_RUN_AS_NODE） */
+  env?: NodeJS.ProcessEnv
 }
 
 /** 排队中的变更任务及其启动参数。 */

package/src/server/services/install/task-queue.ts

@@ -9,7 +9,7 @@
  */
 import { spawn, spawnSync } from 'node:child_process'
 import { resolvePackageEntry } from './package-entry.ts'
-import { readFileSync, statSync } from 'node:fs'
+import { existsSync, readFileSync, statSync } from 'node:fs'
 import { dirname, join, resolve } from 'node:path'
 import type { InstallResult, InstallTask, Invocation, QueueItem } from './install-types.ts'
 import { CAPTURE_LIMIT_BYTES, MAX_TASKS, MAX_TASK_LINES } from './install-types.ts'
@@ -129,20 +129,55 @@ function pushLine(task: InstallTask, line: string): void {
   }
 }
 
-function cliInvocation(): Invocation {
+function cliInvocation(profile: string): Invocation {
   const entry = process.argv[1]
-  if (entry !== undefined && /[\\/](?:bin\.(?:js|ts)|dsh)$/.test(entry)) {
-    const absoluteEntry = resolve(entry)
-    return {
-      file: process.execPath,
-      prefixArgs: [...process.execArgv, absoluteEntry],
-      cwd: dirname(absoluteEntry),
-      useShell: false,
+  if (entry !== undefined) {
+    // 打包桌面端（Electron）：宿主入口在 app.asar 内，机器上根本没有 `dsh` 可执行文件
+    //（Windows 那条 dsh.cmd shim 只存在于宿主进程自己的 PATH 里），直接回退 PATH 必然
+    // 报 [dsh-missing]（见 issue #71）。这里改用应用自己的 CLI 引导脚本调起同一份打包
+    // CLI：Electron 可执行文件 + --expose-internals + desktop-cli.js，与内置终端、
+    // 官方插件页安装完全同一条路径 —— desktop profile 由应用独占管理的授权也在其中。
+    const bootstrap = desktopCliBootstrap(entry)
+    if (bootstrap !== null) {
+      return {
+        file: process.execPath,
+        prefixArgs: ['--expose-internals', bootstrap],
+        // 工作目录用 profile 目录（真实存在的目录）：asar 内的路径不能作为 spawn 的 cwd
+        cwd: profileDirectory(profile),
+        useShell: false,
+        // Electron 可执行文件只有带这个变量才按 Node 运行引导脚本
+        env: { ELECTRON_RUN_AS_NODE: '1' },
+      }
+    }
+    if (/[\\/](?:bin\.(?:js|ts)|dsh)$/.test(entry)) {
+      const absoluteEntry = resolve(entry)
+      return {
+        file: process.execPath,
+        prefixArgs: [...process.execArgv, absoluteEntry],
+        cwd: dirname(absoluteEntry),
+        useShell: false,
+      }
     }
   }
   return { file: 'dsh', prefixArgs: [], cwd: process.cwd(), useShell: process.platform === 'win32' }
 }
 
+/**
+ * 打包桌面端宿主的 CLI 引导脚本路径（`<asar 根>/lib/desktop-cli.js`，即应用内
+ * pnpm 服务的 dshBootstrapPath）。宿主入口落在 app.asar 内时按 asar 根反推候选路径，
+ * 命中存在的那个才采用；布局不认识（官方改版）时返回 null，调用方回退原逻辑。
+ * 导出供单测覆盖路径推导。
+ */
+export function desktopCliBootstrap(entry: string): string | null {
+  const marker = /[\\/]app\.asar(?=[\\/]|$)/i.exec(entry)
+  if (marker === null) return null
+  const root = entry.slice(0, marker.index + marker[0].length)
+  for (const candidate of [join(root, 'lib', 'desktop-cli.js'), join(root, 'dsh', 'lib', 'desktop-cli.js')]) {
+    if (existsSync(candidate)) return candidate
+  }
+  return null
+}
+
 /**
  * dsh 命令存在性探测：which/where 找 PATH 里的 dsh。
  * Windows shell 模式命令缺失时 cmd 只输出 GBK 乱码「不是内部或外部命令」（UTF-8 解码后
@@ -335,7 +370,7 @@ function spawnMutation(options: {
   const isGlobalNpm = (globalNpm ?? []).length > 0
   const invocation = isGlobalNpm
     ? { file: 'npm', prefixArgs: [], cwd: process.cwd(), useShell: process.platform === 'win32' }
-    : cliInvocation()
+    : cliInvocation(profile)
   // 更新已安装的 npm 包：显式指定 @latest。pnpm add <pkg>（无版本）对已存在依赖
   // （尤其精确 spec 如 "1.3.0"）是幂等的 —— 输出 "Already up to date" 且不改 package.json，
   // 导致「更新成功」但实际仍停留在旧版本；git 地址与全局安装不受此影响。
@@ -383,7 +418,9 @@ function spawnMutation(options: {
       }
       child = spawn(invocation.file, attemptArgs, {
         cwd: invocation.cwd,
-        env,
+        // invocation.env 是「必须叠加」的变量（打包桌面端的 ELECTRON_RUN_AS_NODE）：
+        // 没有它时保持 env 原样透传，有它时必须基于完整环境叠加，否则子进程会丢掉 PATH。
+        env: invocation.env === undefined ? env : { ...(env ?? process.env), ...invocation.env },
         shell: invocation.useShell,
         // detached 使子进程成为独立进程组组长：取消时能整组清理（见 stopChild），
         // 且宿主进程崩溃后安装任务不会被连带误杀

package/src/server/services/probe.ts

@@ -51,6 +51,9 @@ export function curlRevokeFlagUnsupported(code: number | null, stderr: string):
   return code === 2 && /ssl-revoke-best-effort/i.test(stderr) && /unknown|unrecognized/i.test(stderr)
 }
 
+/** 彻底关闭证书吊销检查的兜底参数（curl ≥ 7.19），比降级参数覆盖更老的 Windows curl。 */
+const NO_REVOKE_ARG = '--ssl-no-revoke'
+
 /** stderr 是否指向 Schannel 取不到证书吊销信息（据此归因为环境 TLS 问题，而非网络不通）。 */
 export function tlsRevocationBlocked(stderr: string): boolean {
   return /CRYPT_E_NO_REVOCATION_CHECK|CRYPT_E_REVOCATION_OFFLINE|0x80092012/i.test(stderr)
@@ -159,12 +162,23 @@ function runCurl(args: string[], env: NodeJS.ProcessEnv, timeoutMs: number): Pro
 }
 
 /** 带 TLS 兜底的 curl 调用：先按平台参数跑（Windows 带吊销检查降级），
- *  若本机 curl 不认这个参数（curl < 7.70）则去掉参数重跑一次，保证老版本不因此直接失败。 */
+ *  若本机 curl 不认这个参数（curl < 7.70）则去掉参数重跑一次，保证老版本不因此直接失败；
+ *  降级后仍被吊销检查拦死（CRYPT_E_NO_REVOCATION_CHECK）时，再用 --ssl-no-revoke
+ *  彻底关掉吊销检查跑一次 —— 该参数 curl ≥ 7.19 即存在，覆盖面比降级参数更广，
+ *  否则「能上网但取不到 CRL」的 Windows 机器会把所有通道误报成不可达（见 issue #71）。
+ *  吊销检查只影响本次探测自身的信任判断，不改变系统 TLS 配置。 */
 async function curlWithTlsFallback(args: string[], env: NodeJS.ProcessEnv, timeoutMs: number): Promise<CurlRun> {
   const tlsArgs = curlTlsArgs()
-  const first = await runCurl([...tlsArgs, ...args], env, timeoutMs)
-  if (tlsArgs.length === 0 || !curlRevokeFlagUnsupported(first.code, first.stderr)) return first
-  return runCurl(args, env, timeoutMs)
+  let run = await runCurl([...tlsArgs, ...args], env, timeoutMs)
+  if (tlsArgs.length > 0 && curlRevokeFlagUnsupported(run.code, run.stderr)) {
+    run = await runCurl(args, env, timeoutMs)
+  }
+  if (tlsArgs.length > 0 && tlsRevocationBlocked(run.stderr)) {
+    const retry = await runCurl([NO_REVOKE_ARG, ...args], env, timeoutMs)
+    // 只在兜底本身跑起来（非「不认识该参数」）时采用其结果，否则保留原始失败线索
+    if (retry.code !== null && !curlRevokeFlagUnsupported(retry.code, retry.stderr)) run = retry
+  }
+  return run
 }
 
 /**