dsh-plugin 1.6.12 → 2.0.1

package/src/server/services/npm-release-age.ts

@@ -0,0 +1,107 @@
+/**
+ * DSH Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
+ * npm 包最新版本的发布时间查询：为「已安装插件是否有更新」提供供应链门禁依据。
+ * pnpm 对发布不满 24h（dsh profile minimumReleaseAge=1440）的版本会静默回退到旧版本，
+ * 因此发布未满门槛的版本不该提示更新（否则用户点了也装不上）。
+ * 结果按包名内存缓存，同一次会话内不重复请求；失败/超时/响应过大一律返回 null，绝不抛错、绝不阻塞。
+ */
+import { get as httpsGet } from 'node:https'
+import { validPackageName } from './profile/profile.ts'
+import { fetchViaCurl } from './probe.ts'
+
+export interface NpmRelease {
+  version: string
+  publishedAt: string
+}
+
+/** 请求体包名数量上限：只为已安装插件按需查询，几十个足矣，封顶防滥用。 */
+export const MAX_RELEASE_AGE_PACKAGES = 50
+/** 单包查询超时（ms）：慢网络下失败即返回 null，不拖住整个响应。 */
+export const RELEASE_AGE_TIMEOUT_MS = 8000
+/** 响应体上限：完整 packument 可能达数 MB，超限直接放弃，避免异常大包拖垮服务。 */
+const MAX_PACKUMENT_BYTES = 10 * 1024 * 1024
+export const DEFAULT_NPM_REGISTRY = 'https://registry.npmjs.org'
+
+/** 会话内缓存（包名 → 版本与发布时间）：只存成功结果，一次网络抖动不会把判断永久粘住。 */
+const releaseCache = new Map<string, NpmRelease>()
+
+/** 从完整 packument 取 dist-tags.latest 对应版本及其发布时间；缺任一字段返回 null。 */
+export function latestReleaseOf(packument: unknown): NpmRelease | null {
+  if (packument === null || typeof packument !== 'object') return null
+  const doc = packument as { 'dist-tags'?: unknown; time?: unknown }
+  const tags = doc['dist-tags']
+  const version = tags !== null && typeof tags === 'object' ? (tags as { latest?: unknown }).latest : undefined
+  if (typeof version !== 'string' || version === '') return null
+  const time = doc.time
+  const publishedAt = time !== null && typeof time === 'object' ? (time as Record<string, unknown>)[version] : undefined
+  if (typeof publishedAt !== 'string' || publishedAt === '') return null
+  return { version, publishedAt }
+}
+
+/** 请求体 → 去重后的合法包名列表；非数组 / 超量 / 含非法包名一律 null（拒绝非法输入）。 */
+export function parseReleaseAgeRequest(body: unknown): string[] | null {
+  if (body === null || typeof body !== 'object') return null
+  const raw = (body as { packages?: unknown }).packages
+  if (!Array.isArray(raw) || raw.length > MAX_RELEASE_AGE_PACKAGES) return null
+  const names = new Set<string>()
+  for (const item of raw) {
+    if (typeof item !== 'string' || item === '' || item.startsWith('-') || !validPackageName(item)) return null
+    names.add(item)
+  }
+  return [...names]
+}
+
+/** node:https 直连 GET，仅接受 200；超时/超限/网络失败返回 null。 */
+function getJson(url: string, timeoutMs: number): Promise<string | null> {
+  return new Promise((resolve) => {
+    let done = false
+    const finish = (value: string | null) => { if (!done) { done = true; resolve(value) } }
+    const req = httpsGet(url, { timeout: timeoutMs, headers: { accept: 'application/json' } }, (res) => {
+      if (res.statusCode !== 200) { res.resume(); finish(null); return }
+      const declared = Number(res.headers['content-length'])
+      if (Number.isFinite(declared) && declared > MAX_PACKUMENT_BYTES) { res.destroy(); finish(null); return }
+      let body = ''
+      let bytes = 0
+      res.on('data', (chunk: Buffer) => {
+        bytes += chunk.length
+        if (bytes > MAX_PACKUMENT_BYTES) { res.destroy(); finish(null); return }
+        body += chunk.toString()
+      })
+      res.on('end', () => finish(body))
+      res.on('error', () => finish(null))
+    })
+    req.on('timeout', () => req.destroy())
+    req.on('error', () => finish(null))
+  })
+}
+
+/** 拉取一个包的完整 packument 正文；配了代理时复用与安装/目录同一套代理口径（curl 子进程注入 proxy env）。 */
+async function fetchPackument(url: string, proxy: string, timeoutMs: number): Promise<string | null> {
+  if (proxy !== '') {
+    const r = await fetchViaCurl(url, proxy, timeoutMs)
+    return r.ok && r.body !== '' && Buffer.byteLength(r.body) <= MAX_PACKUMENT_BYTES ? r.body : null
+  }
+  return getJson(url, timeoutMs)
+}
+
+/** 查询一个包的最新版本与发布时间（成功结果缓存，同会话内同包不重复请求）；registry 为空回退官方源，失败返回 null。 */
+export async function lookupReleaseAge(
+  packageName: string,
+  registry: string,
+  proxy: string,
+  timeoutMs = RELEASE_AGE_TIMEOUT_MS,
+): Promise<NpmRelease | null> {
+  const cached = releaseCache.get(packageName)
+  if (cached !== undefined) return cached
+  const base = registry.replace(/\/+$/, '') || DEFAULT_NPM_REGISTRY
+  const body = await fetchPackument(`${base}/${encodeURIComponent(packageName)}`, proxy, timeoutMs)
+  if (body === null) return null
+  let parsed: unknown
+  try { parsed = JSON.parse(body) } catch { return null }
+  const release = latestReleaseOf(parsed)
+  if (release !== null) releaseCache.set(packageName, release)
+  return release
+}

package/src/server/services/probe.ts

@@ -99,7 +99,7 @@ function macSystemProxy(): string | null {
  * `http=host:port;https=host:port`（按协议分别配置）。
  * 字符类必须同时排除 `/` 与 `=`：只排除 `=` 时，带 scheme 的值会让「主机名」吞掉 `//`，
  * 拼出 `http:////127.0.0.1:10793` 这种立刻失败的非法地址 —— 代理本来是通的，却把诊断、
- * 目录拉取、npm/git 预检全判成「不可达」。
+ * 目录拉取、安装前网络探测全判成「不可达」。
  */
 export function parseWinProxyServer(stdout: string): string | null {
   const m = /([^:\s=/]+):(\d+)/.exec(stdout)
@@ -220,13 +220,13 @@ export function probeUrl(url: string, proxy: string, timeoutMs: number): Promise
 }
 
 /**
- * git 通道真实克隆握手探测：spawn git ls-remote（https 传输，与 pnpm 克隆前的
+ * git 真实克隆握手探测：spawn git ls-remote（https 传输，与 pnpm 克隆前的
  * ref 握手一致），注入代理 env，GIT_TERMINAL_PROMPT=0 防凭据提示挂起。
  *
  * 为什么要真实 git 而非 curl 打网页：网页「能打开」和 git「能克隆」是两码事 ——
  * 防火墙/代理常按端口与协议区分，HTTP 页可达不代表 git 传输可达。这里测的就是
- * 克隆握手本身，回答「github:owner/repo 装不装得动」。
- * 供系统诊断 GitHub 通道使用；探测目标用 dshplugin/hello-dsh 小仓库（秒级完成，
+ * 克隆握手本身，回答「能不能连上 github.com」。
+ * 供系统诊断 GitHub 可达性使用；探测目标用 dshplugin/hello-dsh 小仓库（秒级完成，
  * 不打 17MB 的 dsh-plugin-hub 主页）。
  */
 export function gitLsRemote(url: string, proxy: string, timeoutMs: number): Promise<ProbeResult> {

package/src/server/services/profile/installed-versions.ts

@@ -3,23 +3,19 @@
  * Website: https://dsh-plugin.org
  * GitHub: https://github.com/dshplugin/dsh-plugin-hub
  *
- * Installed-plugin version tracking.
+ * 已安装插件版本追踪。
  *
- * The installed table (`readInstalled` in routes.ts) only knows the manifest
- * spec of each Git dependency, which carries no version.
- * To let the Plugin Hub tell "an update is available", we record the catalog
- * signal present at install time into a small per-profile JSON file, then
- * compare it against the catalog's current signal later.
+ * 已安装表（routes.ts 的 `readInstalled`）只知道每个 Git 依赖的 manifest spec，不含版本号。
+ * 为让插件中心能判断「有更新」，我们把安装时的目录信号记进一个 per-profile 的小 JSON 文件，
+ * 之后再与目录当前信号比对。
  *
- * Two signals cover every repo:
- *   - version:  the catalog's latest release tag (e.g. v1.2.3). Repos that
- *     publish releases are compared on this.
- *   - updatedAt: the repo's last push time (GitHub pushed_at, `repoUpdatedAt`).
- *     Repos that never publish a release fall back to this: a newer push time
- *     means new commits → an update is available.
+ * 两个信号覆盖所有仓库：
+ *   - version：目录最新 release tag（如 v1.2.3），发 release 的仓库按它比对。
+ *   - updatedAt：仓库最近 push 时间（GitHub pushed_at，即 `repoUpdatedAt`），
+ *     从不发 release 的仓库回退用它：push 时间变新即有新提交 → 有更新。
  *
- * Storage: `DSH_HOME/profiles/<profile>/gro.ngilp-hsd-versions.json`
- *   { "<owner>/<repo>" (lowercase): { version: string, updatedAt: string, installedAt: string } }
+ * 存储：`DSH_HOME/profiles/<profile>/gro.ngilp-hsd-versions.json`
+ *   { "<owner>/<repo>"（小写）: { version, updatedAt, installedAt } }
  */
 import { readFileSync, writeFileSync, mkdirSync } from 'node:fs'
 import { homedir } from 'node:os'
@@ -31,7 +27,7 @@ export interface InstalledVersionRecord {
   /** 安装时的仓库最近更新时间（ISO，GitHub pushed_at）；无 release 仓库的更新依据 */
   updatedAt: string
   installedAt: string
-  /** npm 优先通道反查命中的官方 npm 包名（repo → 包名映射）：目录数据可能未下发
+  /** 安装时记录在案的官方 npm 包名（repo → 包名映射）：目录数据可能未下发
    *  npmPackage（组织 scope 与 GitHub 用户名不一致），客户端据此把依赖 key 匹配回仓库 */
   npmPackage?: string
 }
@@ -51,21 +47,19 @@ export function readInstalledVersions(profile: string): InstalledVersionTable {
   }
 }
 
-/** Record the catalog signals (version + repo updated time) present at install time for one repo. */
+/** 记录某仓库安装时的目录信号（版本 + 仓库更新时间）。 */
 export function recordInstalledVersion(profile: string, repo: string, version: string, updatedAt: string): void {
   const table = readInstalledVersions(profile)
   const key = repo.toLowerCase()
-  // 合并写入：保留已记录的 npmPackage（npm 优先通道的 repo → 包名映射），
+  // 合并写入：保留已记录的 npmPackage（repo → 包名映射），
   // 客户端同步版本信号时不能把它覆盖掉
   table[key] = { ...table[key], version, updatedAt, installedAt: new Date().toISOString() }
   writeVersions(profile, table)
 }
 
 /**
- * Record the npm package name resolved for a repo (npm-first install channel).
- * Called at `/install` time so the mapping exists even before the task finishes;
- * harmless when the repo is not (yet) installed — the client only treats a repo
- * as installed when its dependency key actually exists.
+ * 记录某仓库解析出的 npm 包名。在 `/install` 时调用，让映射在任务完成前就存在；
+ * 仓库尚未安装时也无害 —— 客户端只在依赖 key 真实存在时才把仓库当作已安装。
  */
 export function recordResolvedNpmPackage(profile: string, repo: string, npmPackage: string): void {
   const table = readInstalledVersions(profile)
@@ -74,7 +68,7 @@ export function recordResolvedNpmPackage(profile: string, repo: string, npmPacka
   writeVersions(profile, table)
 }
 
-/** Forget the recorded version for one repo (called on uninstall). */
+/** 清除某仓库记录的版本（卸载时调用）。 */
 export function removeInstalledVersion(profile: string, repo: string): void {
   const table = readInstalledVersions(profile)
   delete table[repo.toLowerCase()]

package/src/server/services/profile/profile.ts

@@ -12,7 +12,7 @@ import { basename, dirname, join } from 'node:path'
 import { PACKAGE_RE, REPO_RE } from '../install/install-types.ts'
 import { githubReleaseTarget } from '../install/release-target.ts'
 
-/** Resolve the active profile from the booted CLI args, falling back to `web`. */
+/** 从启动参数解析当前 profile，取不到落回 `web`。 */
 export function readProfileArg(fallback = 'web'): string {
   return profileFromArgv(process.argv, fallback)
 }
@@ -44,43 +44,19 @@ export function profileFromArgv(argv: readonly string[], fallback = 'web'): stri
   return fallback
 }
 
-/** Resolve a profile directory (`DSH_HOME` or `~/.dsh`). */
+/** 解析 profile 目录（`DSH_HOME` 或 `~/.dsh`）。 */
 export function profileDirectory(profile: string): string {
   return join(process.env.DSH_HOME ?? join(homedir(), '.dsh'), 'profiles', profile)
 }
 
-/** Build a safe explicit HTTPS Git target, or null when the repo is unsafe.
- *  When `ref` is given it is appended as a Git ref (`#tag` / `#commit`) so an
- *  explicitly pinned revision reaches the installer instead of being dropped. */
+/** 把仓库身份转成规范的 GitHub 目标（git+https），仓库不合法时返回 null。
+ *  带 ref 时按 Git ref（`#tag` / `#commit`）拼接；安装通道已不再使用 git 目标，此函数仅做身份规范化。 */
 export function githubTarget(repo: string, ref?: string | null): string | null {
   if (typeof repo !== 'string' || !REPO_RE.test(repo)) return null
   const url = `git+https://github.com/${repo}.git`
   return ref === undefined || ref === null || ref === '' ? url : `${url}#${ref}`
 }
 
-/**
- * Extract a validated explicit Git ref (`#<ref>`) from a GitHub spec, or null.
- * Only the fragment of a Git-style address qualifies — a pinned tag/commit is
- * user intent and must survive target normalization, whereas `#…` on a plain
- * web URL (`https://github.com/o/r#readme`) is a page anchor, not a ref.
- * Git-style = `git+…` / `github:` / `git@…` / `…​.git` / bare `owner/repo`.
- * Grammar mirrors a Git ref: no leading `.`/`-`, no `#`/whitespace.
- */
-const GIT_REF_RE = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/
-
-export function githubRefOf(value: string): string | null {
-  if (typeof value !== 'string') return null
-  const input = value.trim()
-  const hash = input.indexOf('#')
-  if (hash <= 0) return null
-  const base = input.slice(0, hash)
-  if (githubRepoOf(base) === null) return null
-  const gitStyle = /^(?:git\+|github:|git@)/i.test(base) || /\.git$/i.test(base) || !base.includes('://')
-  if (!gitStyle) return null
-  const ref = input.slice(hash + 1)
-  return GIT_REF_RE.test(ref) ? ref : null
-}
-
 /**
  * DSH 命令行前缀（官方唯一形式 `dsh plugin --profile <name> <add|update> <target>`）—— 提取其中的安装目标；
  * 非命令输入原样返回。兼容「直接粘贴完整命令」（防用户输错）：--profile 必填且只有长选项
@@ -113,7 +89,7 @@ export function globalNpmPackagesOf(value: string): string[] | null {
   return packages
 }
 
-/** Extract an owner/repo identity from a catalog value or an installed Git spec. */
+/** 从目录值或已装 Git spec 中提取 owner/repo 身份。 */
 export function githubRepoOf(value: string): string | null {
   if (typeof value !== 'string') return null
   const input = value.trim()
@@ -137,25 +113,24 @@ export function githubRepoOf(value: string): string | null {
   return null
 }
 
-/** Validate an npm package name (uninstall target grammar). */
+/** 校验 npm 包名（卸载目标的语法）。 */
 export function validPackageName(name: string): boolean {
   return typeof name === 'string' && PACKAGE_RE.test(name)
 }
 
 /**
- * The exact `allowBuilds` key pnpm printed in its
- * `ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED` hint. For Git installs pnpm
- * matches against `name@<resolved fetch URL>` — the URL it actually fetches,
- * e.g. `https://codeload.github.com/<owner>/<repo>/tar.gz/<commit>` — not the
- * `git+ssh://`/branch spec. A bare name or a `git+` spec does not match, so
- * the only reliable key is the one pnpm prints verbatim. Null when absent.
+ * 取 pnpm 在 `ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED` 提示里原样打印的 `allowBuilds` key。
+ * Git 安装时 pnpm 按 `name@<实际 fetch URL>`（如
+ * `https://codeload.github.com/<owner>/<repo>/tar.gz/<commit>`）匹配，而不是 `git+ssh://`
+ * 或分支 spec —— 裸包名与 `git+` spec 都匹配不上，唯一可靠的 key 就是 pnpm 原样输出的那个。
+ * 无则返回 null。
  */
 export function parseAllowBuildsKey(output: string): string | null {
   const m = /^[ \t]*(\S+@\S+):[ \t]*true[ \t]*$/m.exec(output)
   return m === null ? null : m[1].trim()
 }
 
-/** Quote a YAML block-mapping key when a plain scalar would be invalid. */
+/** 当裸标量非法时，为 YAML 块映射 key 加引号。 */
 function quoteYamlKey(key: string): string {
   if (/^[-?:,[\]{}#&*!|>'"%@`]/.test(key) || /:(\s|$)/.test(key)) {
     return `'${key.replace(/'/g, "''")}'`
@@ -164,15 +139,14 @@ function quoteYamlKey(key: string): string {
 }
 
 /**
- * Add one `allowBuilds` entry to the profile's pnpm-workspace.yaml, merging
- * with existing entries and leaving the rest of the yaml intact. Broken
- * placeholder entries (pnpm's failed-install bug writes a literal
- * `set this to true or false` value) are dropped on rewrite.
+ * 向 profile 的 pnpm-workspace.yaml 追加一条 `allowBuilds` 记录：与已有条目合并，
+ * 其余 yaml 保持不变；重写时丢弃损坏的占位条目（pnpm 安装失败的 bug 会写入
+ * 字面量 `set this to true or false`）。
  */
 export function addAllowBuildsKey(profile: string, key: string): void {
   const file = join(profileDirectory(profile), 'pnpm-workspace.yaml')
   let yaml = ''
-  try { yaml = readFileSync(file, 'utf8') } catch { /* created below */ }
+  try { yaml = readFileSync(file, 'utf8') } catch { /* 文件不存在，下方创建 */ }
   const eol = /\r\n/.test(yaml) ? '\r\n' : '\n'
   const blockRe = /allowBuilds:[ \t]*\r?\n((?:[ \t]+[^\r\n]*\r?\n?)*)/g
   const map = new Map<string, string>()

package/src/server/services/profile/progress.ts

@@ -3,24 +3,21 @@
  * Website: https://dsh-plugin.org
  * GitHub: https://github.com/dshplugin/dsh-plugin-hub
  *
- * Pure progress-estimation helpers shared by the install runner.
+ * 安装执行器共用的纯进度估算工具。
  *
- * The dsh CLI wraps pnpm, which refreshes its `Progress: …` line in place
- * with carriage returns, so raw output arrives as a stream of partial
- * fragments. These helpers normalize one fragment into a clean terminal
- * line and map it onto a 0-100 estimate; keeping them free of I/O makes the
- * estimation logic directly unit-testable (see tests/progress.test.ts).
+ * dsh CLI 包装了 pnpm，pnpm 用回车原地刷新 `Progress: …` 行，因此原始输出是一串碎片。
+ * 这些工具把单个碎片归一化成干净的终端行，并映射到 0-100 估算值；不碰 I/O
+ * 让估算逻辑可直接单测（见 tests/progress.test.ts）。
  */
 
-/** Strip the `[out]` / `[err]` source prefix and ANSI escape sequences. */
+/** 剥掉 `[out]` / `[err]` 来源前缀与 ANSI 转义序列。 */
 export function cleanLine(raw: string): string {
   return raw.replace(/^\[(?:err|out)\]\s*/, '').replace(/\x1b\[[0-9;]*[A-Za-z]/g, '').trim()
 }
 
 /**
- * Estimate 0-100 progress from one CLI output line. pnpm emits
- * `Progress: resolved N, reused X, downloaded Y, added Z` during the fetch
- * phase; resolution/install phase lines bump the estimate towards done.
+ * 从单行 CLI 输出估算 0-100 进度。pnpm 在 fetch 阶段输出
+ * `Progress: resolved N, reused X, downloaded Y, added Z`；解析/安装阶段的行把估算值推向完成。
  */
 export function estimateProgress(line: string): number {
   const progress = line.match(/Progress:\s*(.+)/)
@@ -28,7 +25,7 @@ export function estimateProgress(line: string): number {
     let resolved = 0
     let handled = 0
     for (const part of progress[1].split(',')) {
-      // pnpm emits `label count` tokens, e.g. `resolved 100, reused 40`
+      // pnpm 输出 `label count` 形式的 token，如 `resolved 100, reused 40`
       const [label, raw] = part.trim().split(/\s+/)
       const value = Number(raw)
       if (label === 'resolved') resolved = value

package/src/server/services/settings.ts

@@ -3,9 +3,8 @@
  * Website: https://dsh-plugin.org
  * GitHub: https://github.com/dshplugin/dsh-plugin-hub
  *
- * Hub settings persistence: one `hub-settings.json` per active profile
- * (next to pnpm-workspace.yaml). All fields optional; missing keys fall
- * back to DEFAULT_SETTINGS so old files stay readable as new options land.
+ * 插件中心设置持久化：每个活跃 profile 一个 `hub-settings.json`（与 pnpm-workspace.yaml 同目录）。
+ * 所有字段可选；缺失的 key 回退到 DEFAULT_SETTINGS，新选项上线后旧文件仍可读。
  */
 import { readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs'
 import { dirname, join } from 'node:path'
@@ -20,10 +19,6 @@ export interface HubSettings {
   npmRegistry: string
   /** 启用命令行安装 NPM 包（默认开；关掉后输入 npm 包名安装被拦截） */
   enableNpmInstall: boolean
-  /** 启用命令行安装 GitHub 源码（默认开；关掉后输入 GitHub 地址安装被拦截） */
-  enableGitInstall: boolean
-  /** 启用命令行粘贴 dsh plugin 命令安装（默认开；关掉后命令输入被禁用） */
-  enableDshInstall: boolean
   /** 日志存放位置覆盖（空串 = 默认 ~/.dsh/profiles/<profile>/hub.log；可填目录或 .log 文件路径） */
   logPath: string
 }
@@ -33,8 +28,6 @@ export const DEFAULT_SETTINGS: HubSettings = {
   proxy: '',
   npmRegistry: '',
   enableNpmInstall: true,
-  enableGitInstall: true,
-  enableDshInstall: true,
   logPath: '',
 }
 

package/lib/services/install/preflight.js

@@ -1,178 +0,0 @@
-/**
- * DSH Plugin Hub — the community plugin marketplace for DeepSeek Harness.
- * Website: https://dsh-plugin.org
- * GitHub: https://github.com/dshplugin/dsh-plugin-hub
- *
- * 安装前预检：对 GitHub 源的插件，检查其分发（codeload tarball）里是否真的包含
- * package.json 声明的文件（main / exports["."] / dsh.bundle.patch）。git 分发常不提交
- * 构建产物（lib/ 等），这类残缺包装完会让宿主重启加载插件树时 ERR_MODULE_NOT_FOUND
- * 直接崩溃 —— 预检在动手安装前就把它们拦下，避免白装一次。
- * npm 包信任 registry 的完整性，直接放行；任何无法预检的情况也放行，交给装后
- * 校验（verifyInstalledEntry）兜底，保证预检自身失败不会卡死安装流程。
- */
-import { execFile } from 'node:child_process';
-import { createWriteStream, mkdtempSync, rmSync } from 'node:fs';
-import { get } from 'node:https';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { pipeline } from 'node:stream/promises';
-import { promisify } from 'node:util';
-import { githubRefOf, githubRepoOf } from '../profile/profile.js';
-import { githubReleaseTarget } from './release-target.js';
-import { requiredDistributionFiles, resolveBundlePatchFiles } from './package-entry.js';
-const execFileAsync = promisify(execFile);
-/** 单次网络操作超时（ms）：git ls-remote / codeload 下载。网络不可达时不能无限挂起，
- *  否则 `/install` 请求永远不返回、任务不入队、前端进度卡 0%。超时后放行（交给装后校验）。 */
-const PREFLIGHT_TIMEOUT_MS = 15_000;
-export async function preflightTarget(target) {
-    // release 包自带包根：拿 monorepo HEAD 的源码分发去校验它没有意义，会把完整产物
-    // 误判成缺入口文件而拦下。该包的真实性交给安装本身与装后 verifyInstalledEntry 兜底。
-    if (githubReleaseTarget(target) !== null)
-        return { ok: true, missing: null, name: null };
-    const source = githubRepoOf(target);
-    if (source === null)
-        return { ok: true, missing: null, name: null };
-    const [owner, repo] = source.split('/');
-    // 显式 pin 的 Git ref 要在它自己的修订上预检：默认分支常是 monorepo 根，与 pin 的发布包
-    // 形态不同，拿 HEAD 校验会把完整产物误判成缺入口文件（或反之）。无 pin 时仍查 HEAD。
-    const commit = await remoteCommit(owner, repo, githubRefOf(target));
-    if (commit === null)
-        return { ok: true, missing: null, name: null };
-    const dir = mkdtempSync(join(tmpdir(), 'dsh-preflight-'));
-    try {
-        const tar = join(dir, 'pkg.tar.gz');
-        await download(`https://codeload.github.com/${owner}/${repo}/tar.gz/${commit}`, tar);
-        const rootPackage = await rootPackageEntry(tar);
-        if (rootPackage === null)
-            return { ok: true, missing: null, name: null };
-        const rootPrefix = rootPackage.slice(0, -'package.json'.length);
-        const meta = await readTarJson(tar, rootPackage);
-        if (meta === null)
-            return { ok: true, missing: null, name: null };
-        // 只校验作者声明过的文件：没声明入口的包（只挂技能的 bundle）没有可缺失的入口，
-        // 它的分发是否完整由 dsh.bundle.patch 是否在包里决定；补丁若按本包名 mount 自己，
-        // 入口又变成必须的（宿主会 import 本包）—— 所以判入口前先把补丁读出来。
-        const patchTexts = [];
-        for (const file of resolveBundlePatchFiles(meta)) {
-            const text = await readTarText(tar, `${rootPrefix}${file}`);
-            if (text !== null)
-                patchTexts.push(text);
-        }
-        const required = requiredDistributionFiles(meta, patchTexts).map((file) => `${rootPrefix}${file}`);
-        const missing = missingDistributionFileOfTarList(await tarListing(tar), required);
-        return { ok: missing === null, missing, name: typeof meta.name === 'string' ? meta.name : null };
-    }
-    catch {
-        return { ok: true, missing: null, name: null };
-    }
-    finally {
-        rmSync(dir, { recursive: true, force: true });
-    }
-}
-/**
- * Resolve the commit to inspect: the pinned `ref` when given, otherwise the
- * repository default branch (`HEAD`). A full commit SHA passes through as-is;
- * annotated tags are peeled to their commit. Any git/network failure returns
- * null and the caller falls back to "no preflight".
- */
-async function remoteCommit(owner, repo, ref) {
-    if (ref !== null && /^[0-9a-f]{40}$/i.test(ref))
-        return ref;
-    try {
-        const { stdout } = await execFileAsync('git', ['ls-remote', `https://github.com/${owner}/${repo}.git`, ref ?? 'HEAD'], {
-            timeout: PREFLIGHT_TIMEOUT_MS,
-            maxBuffer: 1024 * 1024,
-        });
-        const lines = stdout.split(/\r?\n/).filter((line) => line !== '');
-        // Annotated tags list the tag object and the peeled commit (`<ref>^{}`): prefer the peel.
-        const chosen = lines.find((line) => line.endsWith('^{}')) ?? lines[lines.length - 1];
-        return chosen?.split(/\s+/)[0] ?? null;
-    }
-    catch {
-        return null;
-    }
-}
-function download(url, dest) {
-    return new Promise((resolve, reject) => {
-        const req = get(url, { timeout: PREFLIGHT_TIMEOUT_MS }, (res) => {
-            if (res.statusCode === 301 || res.statusCode === 302 || res.statusCode === 303) {
-                res.resume();
-                if (res.headers.location) {
-                    void download(res.headers.location, dest).then(resolve, reject);
-                    return;
-                }
-                reject(new Error('download failed: redirect without location'));
-                return;
-            }
-            if (res.statusCode !== 200) {
-                res.resume();
-                reject(new Error(`download failed: HTTP ${res.statusCode ?? '?'}`));
-                return;
-            }
-            void pipeline(res, createWriteStream(dest)).then(resolve, reject);
-        });
-        // 网络不可达时 connect/响应可能无限挂起：超时销毁，避免预检卡死（放行交给装后校验）
-        req.on('timeout', () => req.destroy(new Error(`download timeout after ${PREFLIGHT_TIMEOUT_MS}ms`)));
-        req.on('error', reject);
-    });
-}
-/** GitHub codeload tarballs use a dynamic top-level directory (`repo-<sha>/`),
- * not npm's `package/` prefix. Pick only a package.json directly under that
- * single archive root; nested monorepo package manifests are intentionally
- * ignored. Exported for a small parser regression test. */
-export function rootPackageEntryOfTarList(listing) {
-    const candidates = listing
-        .split(/\r?\n/)
-        .filter((line) => /^[^/]+\/package\.json$/u.test(line));
-    return candidates.length === 1 ? candidates[0] : null;
-}
-/**
- * 清单里第一个缺失的必需文件（成员名带包根前缀，由调用方拼好），全部都在则为 null。
- * 清单不可读（tar 缺失/解压失败）时按第一个必需文件缺失处理：与逐文件查询时
- * 「查不到就是缺」的判定一致，宁可拦下一次可疑安装，也不放一个空包过去。
- * Exported for a small parser regression test.
- */
-export function missingDistributionFileOfTarList(listing, required) {
-    if (required.length === 0)
-        return null;
-    if (listing === null)
-        return required[0];
-    const present = new Set(listing.split(/\r?\n/));
-    return required.find((file) => !present.has(file)) ?? null;
-}
-async function rootPackageEntry(tar) {
-    const listing = await tarListing(tar);
-    return listing === null ? null : rootPackageEntryOfTarList(listing);
-}
-/** tar 成员清单；`tar` 执行失败时返回 null（调用方按无法判定处理）。 */
-async function tarListing(tar) {
-    try {
-        const { stdout } = await execFileAsync('tar', ['-tzf', tar], { maxBuffer: 16 * 1024 * 1024 });
-        return stdout;
-    }
-    catch {
-        return null;
-    }
-}
-/** 从 tarball 提取一个文件的内容；文件不存在或提取失败返回 null。 */
-async function readTarText(tar, entry) {
-    try {
-        const { stdout } = await execFileAsync('tar', ['-xzOf', tar, entry], { maxBuffer: 4 * 1024 * 1024 });
-        return stdout;
-    }
-    catch {
-        return null;
-    }
-}
-/** 从 tarball 提取并解析一个 JSON 文件；文件不存在或解析失败返回 null。 */
-async function readTarJson(tar, entry) {
-    const text = await readTarText(tar, entry);
-    if (text === null)
-        return null;
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        return null;
-    }
-}

package/lib/types/services/install/preflight.d.ts

@@ -1,23 +0,0 @@
-/** 预检结果：ok=false 表示分发改 package.json 声明的文件（入口或 bundle 补丁），
- *  missing 为该文件在包内的相对路径；
- *  name 为 git 分发包 package.json 声明的包名（非 git 目标/无法确定时为 null），
- *  供安装路由做「包名冲突」检测 —— 同名包名已被其他来源占用时，pnpm 装前必然撞车，
- *  需要把晦涩的 CLI 报错转成明确的拦截。 */
-export interface PreflightResult {
-    ok: boolean;
-    missing: string | null;
-    name: string | null;
-}
-export declare function preflightTarget(target: string): Promise<PreflightResult>;
-/** GitHub codeload tarballs use a dynamic top-level directory (`repo-<sha>/`),
- * not npm's `package/` prefix. Pick only a package.json directly under that
- * single archive root; nested monorepo package manifests are intentionally
- * ignored. Exported for a small parser regression test. */
-export declare function rootPackageEntryOfTarList(listing: string): string | null;
-/**
- * 清单里第一个缺失的必需文件（成员名带包根前缀，由调用方拼好），全部都在则为 null。
- * 清单不可读（tar 缺失/解压失败）时按第一个必需文件缺失处理：与逐文件查询时
- * 「查不到就是缺」的判定一致，宁可拦下一次可疑安装，也不放一个空包过去。
- * Exported for a small parser regression test.
- */
-export declare function missingDistributionFileOfTarList(listing: string | null, required: string[]): string | null;