dsh-plugin 1.4.12 → 1.4.14

package/src/server/services/install/npm-resolve.ts

@@ -18,6 +18,8 @@ const cache = new Map<string, string | null>()
 
 /** 单次 registry 查询超时（ms）：慢网络下失败返回 null，不阻塞安装流程。 */
 const REQUEST_TIMEOUT_MS = 8000
+/** npm search 是相关性搜索而非 repository 精确索引；拉满单页结果后再本地做严格 repo 过滤。 */
+const SEARCH_RESULT_LIMIT = 250
 
 /**
  * 反查 repo（`owner/repo`）对应的官方 npm 包名；未命中、网络异常或超时返回 null。
@@ -39,13 +41,49 @@ export function resolveNpmPackage(repo: string, registry = ''): Promise<string |
   return name.then((found) => found ?? null)
 }
 
+type NpmSearchPackage = {
+  name?: unknown
+  keywords?: unknown
+  links?: { repository?: unknown }
+  repository?: { url?: unknown }
+}
+
+type NpmSearchObject = { package?: NpmSearchPackage }
+type NpmSearchResponse = { objects?: NpmSearchObject[] }
+
+/**
+ * Pick the installable npm package for one GitHub repository. npm search is a
+ * relevance-ranked text search, not an exact repository index, so first filter
+ * by repository URL. If a monorepo publishes both a CLI/helper package and a
+ * DSH plugin, prefer the package that explicitly advertises the `dsh-plugin`
+ * keyword instead of whichever result npm happened to rank first.
+ */
+export function selectNpmPackageForRepo(objects: NpmSearchObject[], repo: string): string | null {
+  const needle = `github.com/${repo}`.toLowerCase()
+  const matches: Array<{ name: string; isDshPlugin: boolean }> = []
+
+  for (const obj of objects) {
+    const pkg = obj.package
+    if (typeof pkg?.name !== 'string' || pkg.name === '') continue
+    const repoUrl = String(pkg.repository?.url ?? pkg.links?.repository ?? '')
+    if (!repoUrl.toLowerCase().includes(needle)) continue
+    const keywords = Array.isArray(pkg.keywords) ? pkg.keywords : []
+    matches.push({
+      name: pkg.name,
+      isDshPlugin: keywords.some((keyword) => typeof keyword === 'string' && keyword.toLowerCase() === 'dsh-plugin'),
+    })
+  }
+
+  return matches.find((candidate) => candidate.isDshPlugin)?.name ?? matches[0]?.name ?? null
+}
+
 /** 用 npm search 接口按 repository 地址反查，并做铁证校验（包元数据必须指向该仓库）。
  * 返回：包名 = 命中；null = 200 响应下确认无匹配；undefined = 本次未能确认（网络/超时/解析失败）。 */
 function searchRepo(repo: string, registry: string): Promise<string | null | undefined> {
   const [owner, name] = repo.split('/')
   if (owner === undefined || name === undefined || name === '') return Promise.resolve(null)
   const base = registry === '' ? 'https://registry.npmjs.org' : registry.replace(/\/+$/, '')
-  const url = `${base}/-/v1/search?text=${encodeURIComponent(`repository:${owner}/${name}`)}&size=10`
+  const url = `${base}/-/v1/search?text=${encodeURIComponent(`repository:${owner}/${name}`)}&size=${SEARCH_RESULT_LIMIT}`
   return new Promise((resolve) => {
     const req = get(url, { timeout: REQUEST_TIMEOUT_MS }, (res) => {
       if (res.statusCode !== 200) {
@@ -57,18 +95,8 @@ function searchRepo(repo: string, registry: string): Promise<string | null | und
       res.on('data', (chunk: Buffer) => { body += chunk.toString() })
       res.on('end', () => {
         try {
-          const data = JSON.parse(body) as { objects?: Array<{ package?: { name?: unknown; links?: { repository?: unknown }; repository?: { url?: unknown } } }> }
-          const needle = `github.com/${owner}/${name}`.toLowerCase()
-          for (const obj of data.objects ?? []) {
-            const pkg = obj.package
-            if (typeof pkg?.name !== 'string' || pkg.name === '') continue
-            const repoUrl = String(pkg.repository?.url ?? pkg.links?.repository ?? '')
-            if (repoUrl.toLowerCase().includes(needle)) {
-              resolve(pkg.name)
-              return
-            }
-          }
-          resolve(null)
+          const data = JSON.parse(body) as NpmSearchResponse
+          resolve(selectNpmPackageForRepo(data.objects ?? [], `${owner}/${name}`))
         } catch {
           resolve(undefined)
         }

package/src/server/services/install/preflight.ts

@@ -18,6 +18,7 @@ import { join } from 'node:path'
 import { pipeline } from 'node:stream/promises'
 import { promisify } from 'node:util'
 import { githubRepoOf } from '../profile/profile.ts'
+import { githubReleaseTarget } from './release-target.ts'
 import { resolvePackageEntry } from './package-entry.ts'
 
 const execFileAsync = promisify(execFile)
@@ -37,6 +38,9 @@ export interface PreflightResult {
 }
 
 export async function preflightTarget(target: string): Promise<PreflightResult> {
+  // release 包自带包根：拿 monorepo HEAD 的源码分发去校验它没有意义，会把完整产物
+  // 误判成缺入口文件而拦下。该包的真实性交给安装本身与装后 verifyInstalledEntry 兜底。
+  if (githubReleaseTarget(target) !== null) return { ok: true, missing: null, name: null }
   const source = githubRepoOf(target)
   if (source === null) return { ok: true, missing: null, name: null }
   const [owner, repo] = source.split('/')

package/src/server/services/install/release-target.ts

@@ -0,0 +1,46 @@
+/**
+ * DSH Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
+ * 预构建 GitHub release 安装目标（目录权威命令 → 可安装直链）。
+ * 部分插件（如 loopx）把构建产物发布成 GitHub release 的 .tgz，仓库 HEAD 反而是
+ * monorepo 根、走 git 直装会因缺入口文件失败；目录下发的权威安装命令直接指向该
+ * release 包。这里把「目录命令」解析成安全的 release 目标，供客户端选路与服务端
+ * 校验共用（单一事实来源，避免两端口径漂移）。
+ *
+ * 只接受固定形态的 HTTPS `github.com/<owner>/<repo>/releases/download/<tag>/<asset>.tgz`：
+ * 目录命令是展示数据、绝非 shell 代码，绝不执行命令文本；跨仓跳转、外部主机、凭据、
+ * 移动的 latest 链接、query/fragment、多余 CLI 参数与 shell 片段一律拒绝。
+ */
+
+/** release 包目标及其所属仓库身份（owner/repo）；非法返回 null。 */
+export interface GithubReleaseTarget {
+  /** 规范化后的安装目标（HTTPS 直链） */
+  target: string
+  /** 该直链所属仓库（owner/repo）：供已装态读回、队列去重与展示身份复用 */
+  repo: string
+}
+
+/** 目录权威命令：`dsh plugin --profile <p> add|update <target>`（与 profile.ts installTargetOf 同口径）。 */
+const DSH_PLUGIN_CMD_RE = /^dsh[ \t]+plugin[ \t]+--profile(?:[ \t]+|=)[A-Za-z0-9_-]+[ \t]+(?:add|update)[ \t]+(.+)$/i
+
+/** 固定形态的 release .tgz 直链：主机、路径段与扩展名全部锁死。 */
+const RELEASE_URL_RE = /^https:\/\/github\.com\/([A-Za-z0-9._-]+)\/([A-Za-z0-9._-]+)\/releases\/download\/([A-Za-z0-9._+-]+)\/([A-Za-z0-9._+-]+\.tgz)$/
+
+/**
+ * 解析一个 release 安装目标。
+ * @param value - 目录命令（`dsh plugin --profile web add <url>`）或裸直链。
+ * @returns 命中返回 `{ target, repo }`，否则 null。
+ */
+export function githubReleaseTarget(value: string): GithubReleaseTarget | null {
+  const input = typeof value === 'string' ? value.trim() : ''
+  if (input === '') return null
+  const command = DSH_PLUGIN_CMD_RE.exec(input)
+  const raw = command !== null ? command[1].trim() : input
+  const match = RELEASE_URL_RE.exec(raw)
+  if (match === null) return null
+  // 拒绝 `.` / `..` 路径段，杜绝借路径穿越跳出 release 目录
+  if (match.slice(1).some((part) => part === '.' || part === '..')) return null
+  return { target: raw, repo: `${match[1]}/${match[2]}` }
+}

package/src/server/services/profile/profile.ts

@@ -10,6 +10,7 @@ import { readFileSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { basename, dirname, join } from 'node:path'
 import { PACKAGE_RE, REPO_RE } from '../install/install-types.ts'
+import { githubReleaseTarget } from '../install/release-target.ts'
 
 /** Resolve the active profile from the booted CLI args, falling back to `web`. */
 export function readProfileArg(fallback = 'web'): string {
@@ -90,6 +91,10 @@ export function globalNpmPackagesOf(value: string): string[] | null {
 export function githubRepoOf(value: string): string | null {
   if (typeof value !== 'string') return null
   const input = value.trim()
+  // release 直链先归一到仓库身份：目录命令里的固定 HTTPS release 包不是 git 地址，
+  // 但它的所属仓库就是 owner/repo —— 已装态读回、去重、展示都要拿到这层身份。
+  const release = githubReleaseTarget(input)
+  if (release !== null) return release.repo
   if (REPO_RE.test(input)) return input
   const patterns = [
     /^github:([^/]+)\/([^/]+)$/i,