dsh-plugin 1.6.4 → 1.6.6

package/src/server/http/settings.ts

@@ -0,0 +1,73 @@
+/**
+ * DSH Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
+ * Settings routes: read/write the hub settings and reset them to defaults.
+ */
+import { mkdirSync } from 'node:fs'
+import { dirname } from 'node:path'
+import { loadSettings, saveSettings, resetSettings } from '../services/settings.ts'
+import { appendLog, customLogFile } from '../services/log.ts'
+import { readJsonBody, requireTrustedPost, sendJson, type WebRoute, type WebServerService } from './shared.ts'
+
+export function registerSettingsRoutes(webServer: WebServerService, profile: string): WebRoute[] {
+  return [
+    {
+      kind: 'exact',
+      path: '/dsh-plugin-hub/settings',
+      // GET 读 / POST 写：webServer.register 按 (kind, path) 唯一，多方法必须合并到同一个 handler 按 method 分派
+      handler: async (request, response) => {
+        if (request.method === 'GET') {
+          sendJson(response, 200, loadSettings(profile))
+          return
+        }
+        if (!requireTrustedPost(request, response)) return
+        try {
+          const body = await readJsonBody(request)
+          // 白名单字段：只接受已知设置项，防客户端把任意键写进文件
+          const patch: Record<string, unknown> = {}
+          const source = typeof body === 'object' && body !== null ? body as Record<string, unknown> : {}
+          for (const key of ['checkUpdatesOnStart', 'enableNpmInstall', 'enableGitInstall', 'enableDshInstall', 'npmRegistry', 'proxy', 'logPath'] as const) {
+            if (source[key] !== undefined) patch[key] = source[key]
+          }
+          // 日志位置：非空时预建目录验证可写，失败直接 400 拦截（默认位置永远合法，空串 = 回默认）
+          if (typeof patch.logPath === 'string' && patch.logPath.trim() !== '') {
+            try {
+              mkdirSync(dirname(customLogFile(patch.logPath)), { recursive: true })
+            } catch {
+              sendJson(response, 400, { error: 'log path is not writable' })
+              return
+            }
+          }
+          sendJson(response, 200, saveSettings(profile, patch))
+          // 系统日志：设置项变更
+          appendLog(profile, {
+            at: Date.now(),
+            level: 'info',
+            category: 'settings',
+            event: 'settings.update',
+            message: `更新设置：${Object.keys(patch).join(', ')}`,
+          })
+        } catch (error) {
+          sendJson(response, 500, { error: error instanceof Error ? error.message : String(error) })
+        }
+      },
+    },
+    {
+      kind: 'exact',
+      path: '/dsh-plugin-hub/settings/reset',
+      handler: async (request, response) => {
+        if (!requireTrustedPost(request, response)) return
+        sendJson(response, 200, resetSettings(profile))
+        appendLog(profile, {
+          at: Date.now(),
+          level: 'warn',
+          category: 'settings',
+          event: 'settings.reset',
+          message: '恢复全部默认设置',
+        })
+      },
+    },
+  ]
+}

package/src/server/http/shared.ts

@@ -0,0 +1,191 @@
+/**
+ * DSH Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
+ * Shared HTTP utilities: route/service types, request validation helpers and
+ * the same-origin check guarding every POST mutation. Imported by the other
+ * route modules in this directory.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http'
+
+/**
+ * 跨平台宿主重启脚本（以 `node -e` 运行，独立于宿主进程）。
+ * 不用 `/bin/sh -c`：Windows 无 /bin/sh，且 lsof/nohup 仅 POSIX 存在。
+ * 由 `spawn(process.execPath, ['-e', SCRIPT, port], { detached, stdio:'ignore' })` 孵化，
+ * 宿主进程被 kill 后仍能完成「停旧 → 等端口释放 → 拉起新 dsh web」。
+ * 端口探测不到监听进程时不再假装重启（记一行日志后退出，见脚本内注释）。
+ */
+export const HOST_RESTART_SCRIPT = String.raw`const C = require('node:child_process')
+const F = require('node:fs')
+const P = require('node:path')
+const O = require('node:os')
+const win = process.platform === 'win32'
+const port = Number(process.argv[1])
+
+function findPids() {
+  if (win) {
+    const out = C.spawnSync('netstat', ['-ano', '-p', 'tcp'], { encoding: 'utf8' })
+    const found = []
+    for (const line of String(out.stdout || '').split(/\r?\n/)) {
+      if (!/LISTENING/i.test(line)) continue
+      const parts = line.trim().split(/\s+/)
+      const addr = parts[1] || ''
+      if (!addr.endsWith(':' + port)) continue
+      const pid = parts[parts.length - 1]
+      if (pid && /\d+/.test(pid)) found.push(pid)
+    }
+    return found
+  }
+  const out = C.spawnSync('lsof', ['-ti', 'tcp:' + port, '-sTCP:LISTEN'], { encoding: 'utf8' })
+  return String(out.stdout || '').split(/\s+/).filter(Boolean)
+}
+
+const targets = findPids()
+// 一个监听进程都没找到 = 端口探测本身就失败了（netstat 输出格式 / 本地化差异），
+// 旧宿主仍占着端口。此时再拉一个 dsh web 只会在日志里以 EADDRINUSE 静默退出，
+// 用户却看到「重启完成」——不制造这种假象，留一行可诊断的记录后退出。
+if (targets.length === 0) {
+  logLine('restart aborted: no listener found on port ' + port)
+  process.exit(0)
+}
+
+for (const pid of targets) {
+  try {
+    if (win) C.spawnSync('taskkill', ['/pid', pid, '/t', '/f'])
+    else process.kill(Number(pid), 'SIGTERM')
+  } catch {}
+}
+
+let tries = 0
+;(function waitForStop() {
+  if (findPids().length === 0 || ++tries > 20) return startHost()
+  setTimeout(waitForStop, 250)
+})()
+
+function logLine(msg) {
+  try {
+    const dir = P.join(O.homedir(), '.dsh', 'logs')
+    F.mkdirSync(dir, { recursive: true })
+    F.appendFileSync(P.join(dir, 'dsh-web-' + port + '.log'), '[' + new Date().toISOString() + '] ' + msg + '\n')
+  } catch {}
+}
+
+function startHost() {
+  const dir = P.join(O.homedir(), '.dsh', 'logs')
+  F.mkdirSync(dir, { recursive: true })
+  const fd = F.openSync(P.join(dir, 'dsh-web-' + port + '.log'), 'a')
+  const child = C.spawn('dsh', ['web', '--port', String(port)], {
+    detached: true,
+    shell: win,
+    stdio: ['ignore', fd, fd],
+  })
+  child.unref()
+}`
+
+/**
+ * 宿主是否由桌面应用壳托管（`ELECTRON_RUN_AS_NODE=1`：壳用 Electron 二进制以 Node 模式跑宿主）。
+ * 桌面端的宿主归应用壳管，插件重启不了它，也不该去 kill —— 详见 /restart 路由。
+ */
+export function isDesktopHost(): boolean {
+  return process.env.ELECTRON_RUN_AS_NODE === '1'
+}
+
+export interface WebRoute {
+  kind: 'exact'
+  path: string
+  handler: (request: IncomingMessage, response: ServerResponse) => void | Promise<void>
+}
+
+/** The subset of the host web-server service this plugin touches. */
+export interface WebServerService {
+  register(route: WebRoute): () => void
+}
+
+export const PROFILE_RE = /^[A-Za-z0-9_-]+$/
+const BODY_LIMIT_BYTES = 4 * 1024
+export const COMMAND_TIMEOUT_MS = 5 * 60 * 1000
+
+/** 目录/统计数据代理的本地缓存时长：1 小时内重复打开插件市场直接读盘，
+ *  不重复走 curl 拉远程 —— 重启宿主后首次打开同样秒开（缓存跨重启存活）。 */
+export const CATALOG_CACHE_TTL_MS = 60 * 60 * 1000
+
+export function sendJson(response: ServerResponse, status: number, value: unknown): void {
+  response.writeHead(status, {
+    'cache-control': 'no-store',
+    'content-type': 'application/json; charset=utf-8',
+  })
+  response.end(JSON.stringify(value))
+}
+
+/** 本机回环主机名：`localhost` / `127.0.0.1` / `[::1]` 指向同一台机器的同一个端口，
+ *  字符串不同但同源，必须按同一来源比较。 */
+const LOOPBACK_HOSTNAMES = new Set(['localhost', '127.0.0.1', '[::1]'])
+
+/** 把 `host[:port]` 形式的 authority 归一化成 `loopback:端口` —— 三个回环别名
+ *  映射成同一个身份，端口缺省按 http 的 80 补齐；非回环主机名、以及解析不出来的值
+ *  都返回 null。 */
+function loopbackAuthority(authority: string): string | null {
+  try {
+    const parsed = new URL(`http://${authority}`)
+    if (!LOOPBACK_HOSTNAMES.has(parsed.hostname.toLowerCase())) return null
+    return `loopback:${parsed.port === '' ? '80' : parsed.port}`
+  } catch {
+    return null
+  }
+}
+
+/** POST mutations are only accepted from the local web server origin or the desktop host page.
+ *  Exported for tests (tests/routes.test.ts) — the origin check is the whole CSRF defence. */
+export function isSameOrigin(request: IncomingMessage): boolean {
+  // 服务只绑定本机回环地址：Host 不是回环（局域网 IP、被改写的域名）一律拒绝，
+  // 顺带挡掉 DNS rebinding（Host 是攻击者域名，即便解析到 127.0.0.1）。
+  const host = request.headers.host
+  const hostKey = host === undefined ? null : loopbackAuthority(host)
+  if (hostKey === null) return false
+  const origin = request.headers.origin
+  // 桌面端宿主把 `/dsh-plugin-hub/*` 转发给本地 http server 时可能不带 Origin 头，
+  // 此时所有 POST 都会被判成 untrusted origin。浏览器对 POST 请求
+  // 必定携带 Origin（含同源 POST 与跨站表单），能省略该头的只有本机原生客户端，
+  // 而它们本来就能伪造任意 Origin，因此放行不扩大 CSRF 面。
+  if (origin === undefined || origin === '') return true
+  try {
+    const url = new URL(origin)
+    // 桌面端（Electron 宿主）的页面跑在宿主自定义协议下，origin 形如 `dsh-app://app`，
+    // 与 Host（如 localhost:3081）必然不等，因此必须显式放行该协议，否则桌面端全部 POST
+    // 都会被判成 untrusted origin。该协议只有宿主自身能产生，外部网页无法把 Origin
+    // 伪造成 `dsh-app://…`，放行不扩大 CSRF 面。
+    if (url.protocol === 'dsh-app:') return true
+    // 按归一化后的「主机名:端口」比较：`localhost` / `127.0.0.1` / `[::1]` 不再互相拒绝，
+    // 端口仍然必须一致（另一个本机进程不能被当成同一来源）。
+    return loopbackAuthority(url.host) === hostKey
+  } catch {
+    return false
+  }
+}
+
+export function requireMethod(request: IncomingMessage, response: ServerResponse, method: 'GET' | 'POST'): boolean {
+  if (request.method === method) return true
+  response.writeHead(405, { allow: method })
+  response.end()
+  return false
+}
+
+export function requireTrustedPost(request: IncomingMessage, response: ServerResponse): boolean {
+  if (!requireMethod(request, response, 'POST')) return false
+  if (isSameOrigin(request)) return true
+  sendJson(response, 403, { error: 'untrusted origin' })
+  return false
+}
+
+export async function readJsonBody(request: IncomingMessage): Promise<unknown> {
+  const chunks: Buffer[] = []
+  let size = 0
+  for await (const chunk of request) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    size += buffer.length
+    if (size > BODY_LIMIT_BYTES) throw new Error('request body too large')
+    chunks.push(buffer)
+  }
+  return JSON.parse(Buffer.concat(chunks).toString('utf8'))
+}

package/src/server/http/task.ts

@@ -0,0 +1,194 @@
+/**
+ * DSH Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
+ * Task/misc routes: task polling, host restart, loader-entry debugging, and
+ * the installed-plugin inventory the client uses to reconcile its list.
+ */
+import { spawn } from 'node:child_process'
+import { join } from 'node:path'
+import { activeTask, cancelTask, dumpLoaderEntries, getTask, githubTarget, listPendingRestarts, validPackageName, type LoaderHandle } from '../services/install/install.ts'
+import { readInstalledVersions, recordInstalledVersion, removeInstalledVersion } from '../services/profile/installed-versions.ts'
+import { isDshPlugin, isEntryLoaded } from '../services/loader.ts'
+import { profileDirectory, readInstalled } from './catalog.ts'
+import { hostEnv } from './diagnostics.ts'
+import { HOST_RESTART_SCRIPT, isDesktopHost, readJsonBody, requireMethod, requireTrustedPost, sendJson, type WebRoute, type WebServerService } from './shared.ts'
+
+export function registerTaskRoutes(webServer: WebServerService, profile: string, loader: LoaderHandle | undefined): WebRoute[] {
+  return [
+    {
+      kind: 'exact',
+      path: '/dsh-plugin-hub/debug/loader-entries',
+      handler: (request, response) => {
+        if (!requireMethod(request, response, 'GET')) return
+        sendJson(response, 200, { entries: dumpLoaderEntries(loader) })
+      },
+    },
+    {
+      kind: 'exact',
+      path: '/dsh-plugin-hub/status',
+      handler: (request, response) => {
+        if (!requireMethod(request, response, 'GET')) return
+        const url = new URL(request.url ?? '/', 'http://localhost')
+        const id = Number(url.searchParams.get('task'))
+        const task = Number.isInteger(id) ? getTask(id) : undefined
+        if (!task) {
+          sendJson(response, 404, { error: 'task not found' })
+          return
+        }
+        sendJson(response, 200, { task })
+      },
+    },
+    {
+      kind: 'exact',
+      path: '/dsh-plugin-hub/active',
+      handler: (request, response) => {
+        if (!requireMethod(request, response, 'GET')) return
+        // 整个任务队列（running 在前、pending 在后）+ 待重启列表：客户端刷新后据此恢复
+        // 进行中/排队任务与「装完没重启」的持久提醒
+        sendJson(response, 200, { tasks: activeTask(), pendingRestarts: listPendingRestarts() })
+      },
+    },
+    {
+      kind: 'exact',
+      path: '/dsh-plugin-hub/env',
+      handler: (request, response) => {
+        if (!requireMethod(request, response, 'GET')) return
+        // 宿主机器环境快照：提交 bug 的 issue 正文会带上，便于作者复现
+        sendJson(response, 200, hostEnv(profile))
+      },
+    },
+    {
+      kind: 'exact',
+      path: '/dsh-plugin-hub/cancel',
+      handler: async (request, response) => {
+        if (!requireTrustedPost(request, response)) return
+        try {
+          const body = await readJsonBody(request)
+          const id = typeof body === 'object' && body !== null && typeof (body as { id?: unknown }).id === 'number'
+            ? (body as { id: number }).id
+            : NaN
+          const ok = Number.isInteger(id) && cancelTask(id)
+          sendJson(response, 200, { ok })
+        } catch (error) {
+          sendJson(response, 500, { error: error instanceof Error ? error.message : String(error) })
+        }
+      },
+    },
+    {
+      kind: 'exact',
+      path: '/dsh-plugin-hub/restart',
+      handler: (request, response) => {
+        if (!requireTrustedPost(request, response)) return
+        // 桌面端：宿主由应用壳托管，插件重启不了它。Windows 上 `taskkill /T` 会把发起
+        // 重启的助手一起结束（助手是宿主的子进程），壳再把这次外部 kill 判成宿主崩溃
+        // 弹「应用无法启动或已意外停止」；退一步说，脱离壳拉起的 `dsh web` 也服务不了
+        // 桌面 UI（缺壳注入的 desktop:boot）。故不 kill、不拉新宿主，由客户端改提示
+        // 用户从菜单/托盘退出后重新打开。
+        if (isDesktopHost()) {
+          sendJson(response, 200, { ok: false, desktop: true })
+          return
+        }
+        // 当前宿主监听端口来自请求 Host 头（localhost:7923），解析失败回退 7923
+        const host = request.headers.host ?? ''
+        const portMatch = host.match(/:(\d+)$/)
+        const port = portMatch ? Number(portMatch[1]) : 7923
+        // detached 子进程完成「停旧进程 → 等端口释放 → 后台拉起 dsh web」，
+        // 即使当前宿主（即本插件所在进程）被 kill，重启仍会继续执行。
+        // 不用 /bin/sh：Windows 无此路径，且 lsof/nohup 等仅 POSIX 存在，
+        // 故孵化 node(process.execPath) 跑跨平台脚本 —— Windows 用
+        // netstat + taskkill + shell:true 解析 dsh.cmd，POSIX 用 lsof + SIGTERM。
+        spawn(process.execPath, ['-e', HOST_RESTART_SCRIPT, String(port)], { detached: true, stdio: 'ignore' }).unref()
+        sendJson(response, 200, { ok: true, port })
+      },
+    },
+    {
+      kind: 'exact',
+      path: '/dsh-plugin-hub/installed-version',
+      handler: async (request, response) => {
+        if (!requireTrustedPost(request, response)) return
+        try {
+          const body = await readJsonBody(request)
+          const repo = typeof body === 'object' && body !== null && typeof (body as { repo?: unknown }).repo === 'string'
+            ? (body as { repo: string }).repo
+            : ''
+          if (githubTarget(repo) === null) {
+            sendJson(response, 400, { error: 'invalid install target' })
+            return
+          }
+          // version 为空 = 卸载清理记录；否则记录安装时的目录信号（最新版本 + 仓库更新时间），
+          // 供「有更新」比对：有版本比版本，无版本比更新时间
+          const version = body !== null && typeof (body as { version?: unknown }).version === 'string'
+            ? (body as { version: string }).version
+            : null
+          if (version === null) {
+            removeInstalledVersion(profile, repo)
+          } else {
+            const updatedAt = body !== null && typeof (body as { updatedAt?: unknown }).updatedAt === 'string'
+              ? (body as { updatedAt: string }).updatedAt
+              : ''
+            recordInstalledVersion(profile, repo, version, updatedAt)
+          }
+          sendJson(response, 200, { ok: true })
+        } catch (error) {
+          sendJson(response, 500, { error: error instanceof Error ? error.message : String(error) })
+        }
+      },
+    },
+    {
+      kind: 'exact',
+      path: '/dsh-plugin-hub/open-path',
+      handler: async (request, response) => {
+        if (!requireTrustedPost(request, response)) return
+        // 在系统文件管理器里定位并打开已安装插件目录（详情视图「在文件夹中显示」）。
+        // 只接受已安装依赖的包名、服务端自行拼接路径——杜绝任意路径注入
+        try {
+          const body = await readJsonBody(request)
+          const name = typeof body === 'object' && body !== null && typeof (body as { name?: unknown }).name === 'string'
+            ? (body as { name: string }).name
+            : ''
+          if (!validPackageName(name) || readInstalled(profile)[name] === undefined) {
+            sendJson(response, 400, { error: 'plugin is not installed' })
+            return
+          }
+          const dir = join(profileDirectory(profile), 'node_modules', name)
+          // macOS Finder 用 -R 定位选中；Windows explorer 用 /select,；Linux 打开目录（xdg-open）
+          const bin = process.platform === 'darwin' ? 'open'
+            : process.platform === 'win32' ? 'explorer'
+              : 'xdg-open'
+          const args = process.platform === 'darwin' ? ['-R', dir]
+            : process.platform === 'win32' ? ['/select,', dir]
+              : [dir]
+          spawn(bin, args, { detached: true, stdio: 'ignore' }).unref()
+          sendJson(response, 200, { ok: true })
+        } catch (error) {
+          sendJson(response, 500, { error: error instanceof Error ? error.message : String(error) })
+        }
+      },
+    },
+    {
+      kind: 'exact',
+      path: '/dsh-plugin-hub/installed',
+      handler: (request, response) => {
+        if (!requireMethod(request, response, 'GET')) return
+        // installed：依赖表（包名 → spec）；versions：安装时记录的目录版本（repo → 版本）；
+        // paths：每个依赖在系统上的安装目录（profile/node_modules/<包名>），详情视图展示用；
+        // loaded：已加载进运行中 loader 的包名（官方 ctx.loader.entries()，未重启装的新插件不在其中）；
+        // dshCapable：真正的 dsh 插件（包内声明 dsh 配置 / 在 profile bundles 清单）——
+        //   非 dsh 插件（如 GitHub 官方示例仓库）装上也不会被宿主加载，客户端据此不再提示「待重启」。
+        // 客户端合并这些判断「是否有更新」「运行状态」并展示安装路径/时间等运行时信息。
+        const installed = readInstalled(profile)
+        const paths: Record<string, string> = {}
+        const loaded: string[] = []
+        const dshCapable: string[] = []
+        for (const name of Object.keys(installed)) {
+          paths[name] = join(profileDirectory(profile), 'node_modules', name)
+          if (isEntryLoaded(loader, name)) loaded.push(name)
+          if (isDshPlugin(profile, name)) dshCapable.push(name)
+        }
+        sendJson(response, 200, { profile, installed, versions: readInstalledVersions(profile), paths, loaded, dshCapable })
+      },
+    },
+  ]
+}

package/src/server/services/install/install-types.ts

@@ -63,7 +63,15 @@ export interface Invocation {
 /** 排队中的变更任务及其启动参数。 */
 export interface QueueItem {
   task: InstallTask
-  options: { action: 'add' | 'remove' | 'update'; profile: string; target: string; timeoutMs?: number; env?: NodeJS.ProcessEnv; globalNpm?: string[]; installChannel?: 'npm' | 'git' | 'dsh' }
+  options: {
+    action: 'add' | 'remove' | 'update'
+    profile: string
+    target: string
+    timeoutMs?: number
+    env?: NodeJS.ProcessEnv
+    globalNpm?: string[]
+    installChannel?: 'npm' | 'git' | 'dsh'
+  }
 }
 
 /**

package/src/server/services/install/install.ts

@@ -18,5 +18,15 @@ export type { InstallResult, InstallTask, Invocation, PendingRestart, QueueItem
 export type { LoaderHandle } from '../loader.ts'
 export { addPendingRestart, clearPendingRestart, listPendingRestarts } from '../profile/pending-restart.ts'
 export { dumpLoaderEntries, removeLoadedEntry } from '../loader.ts'
-export { addAllowBuildsKey, githubRefOf, githubRepoOf, githubTarget, globalNpmPackagesOf, installTargetOf, parseAllowBuildsKey, readProfileArg, validPackageName } from '../profile/profile.ts'
+export {
+  addAllowBuildsKey,
+  githubRefOf,
+  githubRepoOf,
+  githubTarget,
+  globalNpmPackagesOf,
+  installTargetOf,
+  parseAllowBuildsKey,
+  readProfileArg,
+  validPackageName,
+} from '../profile/profile.ts'
 export { activeTask, cancelTask, getTask, hasQueuedTarget, hasRunningTask, runPluginMutation, startPluginMutation } from './task-queue.ts'

package/src/server/services/install/npm-resolve.ts

@@ -13,6 +13,7 @@
  */
 import { get } from 'node:https'
 import { githubRepoOf } from '../profile/profile.ts'
+import { finalUrl } from '../probe.ts'
 
 /** 反查缓存：repo 小写 → npm 包名（null 表示已确认无对应 npm 包；网络异常不缓存）。 */
 const cache = new Map<string, string | null>()
@@ -30,16 +31,21 @@ const SEARCH_RESULT_LIMIT = 250
  * 安装仍会重试反查，避免一次瞬时故障把整个会话锁死在 git 通道。
  * registry 参数：npm 镜像源地址，空串 = 官方源；与安装通道吃同一 registry，
  * 保证「配置了镜像」时反查和安装走同一个源（镜像节点同步完整时结果一致）。
+ * proxy 参数：GitHub 改名跳转探测走的代理（与安装/诊断同一口径）。
  * 慢网络下失败不阻塞安装。
  */
-export function resolveNpmPackage(repo: string, registry = ''): Promise<string | null> {
+export async function resolveNpmPackage(repo: string, registry = '', proxy = ''): Promise<string | null> {
   const key = repo.toLowerCase()
-  if (cache.has(key)) return Promise.resolve(cache.get(key) ?? null)
-  const name = searchRepo(repo, registry)
-  void name.then((found) => {
-    if (found !== undefined) cache.set(key, found)
-  })
-  return name.then((found) => found ?? null)
+  if (cache.has(key)) return cache.get(key) ?? null
+  let found = await searchRepo(repo, registry)
+  // 仓库改名后 npm 包的 repository 已指向新名，按旧名反查不到：跟随一次 GitHub 的
+  // 改名跳转拿到规范名再查一遍（旧地址本身仍可用，只是仓库名变了）。
+  if (found === null) {
+    const canonical = await canonicalRepo(repo, proxy)
+    if (canonical !== '' && canonical.toLowerCase() !== key) found = await searchRepo(canonical, registry)
+  }
+  if (found !== undefined) cache.set(key, found)
+  return found ?? null
 }
 
 type NpmSearchPackage = {
@@ -77,7 +83,7 @@ export function isDshPackageMetadataForRepo(pkg: NpmSearchPackage, repo: string)
   return keywordMarked || manifestMarked
 }
 
-export function isDshNpmPackageForRepo(packageName: string, repo: string, registry = ''): Promise<boolean> {
+export function isDshNpmPackageForRepo(packageName: string, repo: string, registry = '', proxy = ''): Promise<boolean> {
   if (packageName === '' || repo === '') return Promise.resolve(false)
   const base = registry === '' ? 'https://registry.npmjs.org' : registry.replace(/\/+$/, '')
   const url = `${base}/${encodeURIComponent(packageName)}/latest`
@@ -91,11 +97,20 @@ export function isDshNpmPackageForRepo(packageName: string, repo: string, regist
       let body = ''
       res.on('data', (chunk: Buffer) => { body += chunk.toString() })
       res.on('end', () => {
-        try {
-          resolve(isDshPackageMetadataForRepo(JSON.parse(body) as NpmSearchPackage, repo))
-        } catch {
-          resolve(false)
-        }
+        void (async () => {
+          try {
+            const pkg = JSON.parse(body) as NpmSearchPackage
+            if (isDshPackageMetadataForRepo(pkg, repo)) {
+              resolve(true)
+              return
+            }
+            // 仓库改名后包元数据指向新名：按原名不匹配时，用 GitHub 跳转后的规范名复核一次
+            const canonical = await canonicalRepo(repo, proxy)
+            resolve(canonical !== '' && isDshPackageMetadataForRepo(pkg, canonical))
+          } catch {
+            resolve(false)
+          }
+        })()
       })
     })
     req.on('timeout', () => req.destroy())
@@ -103,6 +118,19 @@ export function isDshNpmPackageForRepo(packageName: string, repo: string, regist
   })
 }
 
+/**
+ * 解析仓库改名后的规范 `owner/repo`：GitHub 对已改名仓库返回 301，跟随跳转取最终地址。
+ * 与其它 GitHub 访问同口径走 curl + 代理 env（Node 内置 https 读不到系统代理）。
+ * 未改名、仓库不存在、网络失败或 curl 不可用都返回 ''，调用方按原名继续。
+ */
+async function canonicalRepo(repo: string, proxy: string): Promise<string> {
+  if (githubRepoOf(repo) === null) return ''
+  const key = repo.toLowerCase()
+  const final = await finalUrl(`https://github.com/${repo}`, proxy, REQUEST_TIMEOUT_MS)
+  const canonical = final === null ? null : githubRepoOf(final)
+  return canonical !== null && canonical.toLowerCase() !== key ? canonical : ''
+}
+
 function matchingPackagesForRepo(objects: NpmSearchObject[], repo: string): Array<{ name: string; isDshPlugin: boolean }> {
   const matches: Array<{ name: string; isDshPlugin: boolean }> = []