dsh-wechat-remote 1.7.1 → 1.7.3

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 martinbear1
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 martinbear1
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,15 +1,21 @@
 # Agent远程管理助手 · DSH 插件安装器
 
-首次安装和升级旧插件使用同一个命令：
+当前安装器版本为 1.7.3，安装的正式插件仍为 1.7.2。已正常使用插件 1.7.2 的用户，无需因此重新安装。
+
+首次安装和升级旧插件使用同一个命令：
+
+```sh
+npx -y dsh-wechat-remote@latest
+```
+
+需已安装 DSH，使用 Node.js 22.13 或更高版本。安装工具由包依赖自动提供，无需另装 pnpm 或 Git。
+
+安装器安装正式插件，保留原配置、配对和会话，不会升级 DSH 本体。请先结束运行中的任务；安装完成后自动重启原 DSH 并尝试打开 WebUI。
 
-```sh
-npx -y dsh-wechat-remote@latest
-```
-
-需已安装 DSH，使用 Node.js 22.13 或更高版本。安装工具由包依赖自动提供，无需另装 pnpm 或 Git。
-
-安装器仅选择适配当前 DSH 和主机的正式插件，保留原配置、配对和会话，不会升级 DSH 本体。请先结束运行中的任务；安装完成后自动重启原 DSH 并尝试打开 WebUI。
-
-支持已验证的 DSH `0.1.1-rc.2`、`0.1.2-rc.1`，Windows / macOS Intel / Linux x64。普通 Node 启动、独立的 macOS launchd 和 Linux 用户级 systemd 服务可自动恢复；无法确认启动方式时不自动停止主机。
-
-使用其他配置时附加 `--profile 配置名称`。安装损坏需要重装时附加 `--repair`；不会自动降级。
+DSH 的新版本、预览版本或未登记的主机架构不会仅因缺少验证记录而被拒绝安装。安装器仍检查必要运行能力、安装包完整性和已知不兼容问题，安装失败会回退；这不代表所有宿主组合均已通过功能验证。
+
+支持已验证的 DSH `0.1.1-rc.2`、`0.1.2-rc.1`、`0.1.5-rc.1`，Windows / macOS Intel / Linux x64。普通 Node 启动、独立的 macOS launchd 和 Linux 用户级 systemd 服务可自动恢复；无法确认启动方式时不自动停止主机。
+
+旧插件 1.7.1 在 DSH 0.1.5 上无法一键更新时，可用本安装命令过渡一次。从插件 1.7.2 起，后续已验证的兼容更新不再受旧的 DSH 版本列表限制；不需要因此降低 DSH 版本或删除节点。
+
+使用其他配置时附加 `--profile 配置名称`。安装损坏需要重装时附加 `--repair`；不会自动降级。

package/assets/release.json

@@ -1,34 +1,35 @@
-{
-  "version": "1.7.1",
-  "catalog": {
-    "schemaVersion": 1,
-    "revision": "installer-1.7.1",
-    "issuedAt": 1788979000679,
-    "expiresAt": 1791398200679,
-    "releases": [
-      {
-        "version": "1.7.1",
-        "channel": "stable",
-        "dsh": [
-          "0.1.1-rc.2",
-          "0.1.2-rc.1"
-        ],
-        "platforms": [
-          "windows",
-          "macos",
-          "linux"
-        ],
-        "architectures": [
-          "x64"
-        ],
-        "asset": {
-          "url": "https://github.com/martinbear1/dsh-wechat-remote/releases/download/v1.7.1/harness-remote-dsh-wechat-remote-1.7.1.tgz",
-          "sha256": "5274a6d5beb513124a6d1a916ddd6df7d3e236a7a970e48515d902fa4d8c94d0",
-          "bytes": 9526754
-        }
-      }
-    ],
-    "blocked": [],
-    "retiredDsh": []
-  }
-}
+{
+  "version": "1.7.2",
+  "catalog": {
+    "schemaVersion": 1,
+    "revision": "installer-1.7.2",
+    "issuedAt": 1789134534877,
+    "expiresAt": 1791553734877,
+    "releases": [
+      {
+        "version": "1.7.2",
+        "channel": "stable",
+        "dsh": [
+          "0.1.1-rc.2",
+          "0.1.2-rc.1",
+          "0.1.5-rc.1"
+        ],
+        "platforms": [
+          "windows",
+          "macos",
+          "linux"
+        ],
+        "architectures": [
+          "x64"
+        ],
+        "asset": {
+          "url": "https://github.com/martinbear1/dsh-wechat-remote/releases/download/v1.7.2/harness-remote-dsh-wechat-remote-1.7.2.tgz",
+          "sha256": "0eb296a3a0c84f080148280f9b9419516a9dc640c9e13aa8cf014120aea591ee",
+          "bytes": 9539789
+        }
+      }
+    ],
+    "blocked": [],
+    "retiredDsh": []
+  }
+}

package/bin/native-control.mjs

@@ -1,70 +1,70 @@
-import fs from 'node:fs'
-import path from 'node:path'
-import { parseDocument, isSeq, isMap } from 'yaml'
-import { createHash, randomBytes } from 'node:crypto'
-import { pathToFileURL } from 'node:url'
-
-const digest = value => createHash('sha256').update(value).digest('hex')
-function writePatch(filename, text) {
-  const temporary = filename + '.wechat-' + randomBytes(8).toString('hex')
-  const mode = fs.existsSync(filename) ? fs.statSync(filename).mode : 0o600
-  try {
-    fs.writeFileSync(temporary, text, { mode, flag: 'wx' })
-    fs.renameSync(temporary, filename)
-  } finally {
-    try { fs.unlinkSync(temporary) } catch (error) { if (error.code !== 'ENOENT') throw error }
-  }
-}
-function document(text) {
-  const doc = parseDocument(text, { customTags: [{ tag: 'tag:yaml.org,2002:js', resolve: value => value }] })
-  if (doc.errors.length || !isSeq(doc.contents)) throw new Error('DSH 配置不是有效的原生插件列表，未修改配置。')
-  return doc
-}
-/** Native user-patch insertion; remove only our entry and retain concurrent edits. */
-export function attachControl(profile, helper, config) {
-  const filename = path.join(profile, 'cordis.patch.yml')
-  const original = fs.existsSync(filename) ? fs.readFileSync(filename, 'utf8') : '[]\n'
-  const doc = document(original), id = 'wechat-installer-' + path.basename(config.directory)
-  doc.contents.flow = false
-  doc.contents.add(doc.createNode({ insert: [{ id, name: pathToFileURL(helper).href, config }] }))
-  const patched = String(doc)
-  fs.writeFileSync(path.join(config.directory, 'user-patch-before.yml'), original, { mode: 0o600, flag: 'wx' })
-  writePatch(filename, patched)
-  return () => {
-    const current = fs.readFileSync(filename, 'utf8')
-    if (digest(current) === digest(patched)) { writePatch(filename, original); return }
-    const latest = document(current)
-    latest.contents.items = latest.contents.items.filter(item => {
-      if (!isMap(item)) return true
-      const entries = item.get('insert', true)
-      if (!isSeq(entries)) return true
-      entries.items = entries.items.filter(entry => !isMap(entry) || entry.get('id') !== id)
-      return entries.items.length > 0 || item.items.length !== 1
-    })
-    writePatch(filename, String(latest))
-  }
-}
-
-export async function waitForJson(filename, accept, timeout = 20000) {
-  const until = Date.now() + timeout
-  while (Date.now() < until) {
-    try { const value = JSON.parse(fs.readFileSync(filename, 'utf8')); if (accept(value)) return value } catch {}
-    await new Promise(resolve => setTimeout(resolve, 100))
-  }
-  throw new Error('DSH 没有完成安装握手；原插件未替换。请确认 DSH WebUI 正在运行且允许原生插件热加载。')
-}
-
-/** One bounded native handshake, including a possible offline host start.
- * A listening WebUI is not proof that the asynchronous profile reload finished.
- * Keep the same control entry/token while waiting; never restart a live host. */
-export async function waitForInstallControl(filename, {
-  accept, ensureRunning, onWaiting = () => {}, timeoutMs = 60000, initialWaitMs = 5000,
-}) {
-  const deadline = Date.now() + timeoutMs
-  try { return await waitForJson(filename, accept, Math.min(initialWaitMs, timeoutMs)) }
-  catch {
-    onWaiting()
-    if (Date.now() < deadline) await ensureRunning()
-    return await waitForJson(filename, accept, Math.max(0, deadline - Date.now()))
-  }
-}
+import fs from 'node:fs'
+import path from 'node:path'
+import { parseDocument, isSeq, isMap } from 'yaml'
+import { createHash, randomBytes } from 'node:crypto'
+import { pathToFileURL } from 'node:url'
+
+const digest = value => createHash('sha256').update(value).digest('hex')
+function writePatch(filename, text) {
+  const temporary = filename + '.wechat-' + randomBytes(8).toString('hex')
+  const mode = fs.existsSync(filename) ? fs.statSync(filename).mode : 0o600
+  try {
+    fs.writeFileSync(temporary, text, { mode, flag: 'wx' })
+    fs.renameSync(temporary, filename)
+  } finally {
+    try { fs.unlinkSync(temporary) } catch (error) { if (error.code !== 'ENOENT') throw error }
+  }
+}
+function document(text) {
+  const doc = parseDocument(text, { customTags: [{ tag: 'tag:yaml.org,2002:js', resolve: value => value }] })
+  if (doc.errors.length || !isSeq(doc.contents)) throw new Error('DSH 配置不是有效的原生插件列表，未修改配置。')
+  return doc
+}
+/** Native user-patch insertion; remove only our entry and retain concurrent edits. */
+export function attachControl(profile, helper, config) {
+  const filename = path.join(profile, 'cordis.patch.yml')
+  const original = fs.existsSync(filename) ? fs.readFileSync(filename, 'utf8') : '[]\n'
+  const doc = document(original), id = 'wechat-installer-' + path.basename(config.directory)
+  doc.contents.flow = false
+  doc.contents.add(doc.createNode({ insert: [{ id, name: pathToFileURL(helper).href, config }] }))
+  const patched = String(doc)
+  fs.writeFileSync(path.join(config.directory, 'user-patch-before.yml'), original, { mode: 0o600, flag: 'wx' })
+  writePatch(filename, patched)
+  return () => {
+    const current = fs.readFileSync(filename, 'utf8')
+    if (digest(current) === digest(patched)) { writePatch(filename, original); return }
+    const latest = document(current)
+    latest.contents.items = latest.contents.items.filter(item => {
+      if (!isMap(item)) return true
+      const entries = item.get('insert', true)
+      if (!isSeq(entries)) return true
+      entries.items = entries.items.filter(entry => !isMap(entry) || entry.get('id') !== id)
+      return entries.items.length > 0 || item.items.length !== 1
+    })
+    writePatch(filename, String(latest))
+  }
+}
+
+export async function waitForJson(filename, accept, timeout = 20000) {
+  const until = Date.now() + timeout
+  while (Date.now() < until) {
+    try { const value = JSON.parse(fs.readFileSync(filename, 'utf8')); if (accept(value)) return value } catch {}
+    await new Promise(resolve => setTimeout(resolve, 100))
+  }
+  throw new Error('DSH 没有完成安装握手；原插件未替换。请确认 DSH WebUI 正在运行且允许原生插件热加载。')
+}
+
+/** One bounded native handshake, including a possible offline host start.
+ * A listening WebUI is not proof that the asynchronous profile reload finished.
+ * Keep the same control entry/token while waiting; never restart a live host. */
+export async function waitForInstallControl(filename, {
+  accept, ensureRunning, onWaiting = () => {}, timeoutMs = 60000, initialWaitMs = 5000,
+}) {
+  const deadline = Date.now() + timeoutMs
+  try { return await waitForJson(filename, accept, Math.min(initialWaitMs, timeoutMs)) }
+  catch {
+    onWaiting()
+    if (Date.now() < deadline) await ensureRunning()
+    return await waitForJson(filename, accept, Math.max(0, deadline - Date.now()))
+  }
+}

package/bin/release-selection.mjs

@@ -0,0 +1,33 @@
+import { validateCatalog, compareVersions, trustedReleaseAsset } from '../lib/update-policy.js'
+
+/** Explicit CLI installation is not an automatic-update recommendation.
+ * Tested DSH/platform/architecture lists describe evidence, not admission.
+ * Keep trusted artifacts, explicit withdrawals and the no-downgrade floor.
+ */
+export function selectInstallTarget(pinned, remote, current, now = Date.now()) {
+  const local = validateCatalog(pinned.catalog)
+  const bundled = local.releases.find(r => r.version === pinned.version && r.channel === 'stable')
+  if (!bundled || !trustedReleaseAsset(bundled.asset, bundled.version)) {
+    throw new Error('安装包信息不完整，请重新获取官方安装器。')
+  }
+  let online
+  try {
+    const candidate = validateCatalog(remote)
+    if (candidate.issuedAt <= now + 300000 && candidate.expiresAt > now) online = candidate
+  } catch { /* The authenticated npm package remains usable without the catalog. */ }
+
+  // An installer never silently substitutes an older plugin than its own bundle.
+  // Keep the bundled bytes/hash for the same version even if remote metadata differs.
+  const candidates = [bundled, ...(online?.releases || []).filter(r => r.channel === 'stable'
+    && compareVersions(r.version, bundled.version) > 0 && trustedReleaseAsset(r.asset, r.version))]
+    .sort((a, b) => compareVersions(b.version, a.version))
+  const rules = [...local.blocked, ...(online?.blocked || [])]
+  const blocked = release => rules.find(b => b.pluginVersion === release.version
+    && (!b.dsh || b.dsh.includes(current.agentVersion))
+    && (!b.platforms || b.platforms.includes(current.platform)))
+  const release = candidates.find(r => !blocked(r))
+  if (!release) {
+    throw new Error(`当前插件存在已知不兼容问题：${blocked(bundled).reason}；未替换现有插件。`)
+  }
+  return release
+}