dsh-wechat-remote 1.7.2 → 1.7.3

package/README.md

@@ -1,4 +1,6 @@
-# Agent远程管理助手 · DSH 插件安装器
+# Agent远程管理助手 · DSH 插件安装器
+
+当前安装器版本为 1.7.3，安装的正式插件仍为 1.7.2。已正常使用插件 1.7.2 的用户，无需因此重新安装。
 
 首次安装和升级旧插件使用同一个命令：
 
@@ -8,10 +10,12 @@ npx -y dsh-wechat-remote@latest
 
 需已安装 DSH，使用 Node.js 22.13 或更高版本。安装工具由包依赖自动提供，无需另装 pnpm 或 Git。
 
-安装器仅选择适配当前 DSH 和主机的正式插件，保留原配置、配对和会话，不会升级 DSH 本体。请先结束运行中的任务；安装完成后自动重启原 DSH 并尝试打开 WebUI。
-
-支持已验证的 DSH `0.1.1-rc.2`、`0.1.2-rc.1`、`0.1.5-rc.1`，Windows / macOS Intel / Linux x64。普通 Node 启动、独立的 macOS launchd 和 Linux 用户级 systemd 服务可自动恢复；无法确认启动方式时不自动停止主机。
+安装器安装正式插件，保留原配置、配对和会话，不会升级 DSH 本体。请先结束运行中的任务；安装完成后自动重启原 DSH 并尝试打开 WebUI。
 
-旧插件 1.7.1 在 DSH 0.1.5 上无法一键更新时，可用本安装命令过渡一次。从插件 1.7.2 起，后续已验证的兼容更新不再受旧的 DSH 版本列表限制；不需要因此降低 DSH 版本或删除节点。
+DSH 的新版本、预览版本或未登记的主机架构不会仅因缺少验证记录而被拒绝安装。安装器仍检查必要运行能力、安装包完整性和已知不兼容问题，安装失败会回退；这不代表所有宿主组合均已通过功能验证。
+
+支持已验证的 DSH `0.1.1-rc.2`、`0.1.2-rc.1`、`0.1.5-rc.1`，Windows / macOS Intel / Linux x64。普通 Node 启动、独立的 macOS launchd 和 Linux 用户级 systemd 服务可自动恢复；无法确认启动方式时不自动停止主机。
+
+旧插件 1.7.1 在 DSH 0.1.5 上无法一键更新时，可用本安装命令过渡一次。从插件 1.7.2 起，后续已验证的兼容更新不再受旧的 DSH 版本列表限制；不需要因此降低 DSH 版本或删除节点。
 
 使用其他配置时附加 `--profile 配置名称`。安装损坏需要重装时附加 `--repair`；不会自动降级。

package/assets/release.json

@@ -1,35 +1,35 @@
-{
-  "version": "1.7.2",
-  "catalog": {
-    "schemaVersion": 1,
-    "revision": "installer-1.7.2",
-    "issuedAt": 1789134534877,
-    "expiresAt": 1791553734877,
-    "releases": [
-      {
-        "version": "1.7.2",
-        "channel": "stable",
-        "dsh": [
-          "0.1.1-rc.2",
-          "0.1.2-rc.1",
-          "0.1.5-rc.1"
-        ],
-        "platforms": [
-          "windows",
-          "macos",
-          "linux"
-        ],
-        "architectures": [
-          "x64"
-        ],
-        "asset": {
-          "url": "https://github.com/martinbear1/dsh-wechat-remote/releases/download/v1.7.2/harness-remote-dsh-wechat-remote-1.7.2.tgz",
-          "sha256": "0eb296a3a0c84f080148280f9b9419516a9dc640c9e13aa8cf014120aea591ee",
-          "bytes": 9539789
-        }
-      }
-    ],
-    "blocked": [],
-    "retiredDsh": []
-  }
-}
+{
+  "version": "1.7.2",
+  "catalog": {
+    "schemaVersion": 1,
+    "revision": "installer-1.7.2",
+    "issuedAt": 1789134534877,
+    "expiresAt": 1791553734877,
+    "releases": [
+      {
+        "version": "1.7.2",
+        "channel": "stable",
+        "dsh": [
+          "0.1.1-rc.2",
+          "0.1.2-rc.1",
+          "0.1.5-rc.1"
+        ],
+        "platforms": [
+          "windows",
+          "macos",
+          "linux"
+        ],
+        "architectures": [
+          "x64"
+        ],
+        "asset": {
+          "url": "https://github.com/martinbear1/dsh-wechat-remote/releases/download/v1.7.2/harness-remote-dsh-wechat-remote-1.7.2.tgz",
+          "sha256": "0eb296a3a0c84f080148280f9b9419516a9dc640c9e13aa8cf014120aea591ee",
+          "bytes": 9539789
+        }
+      }
+    ],
+    "blocked": [],
+    "retiredDsh": []
+  }
+}

package/bin/release-selection.mjs

@@ -0,0 +1,33 @@
+import { validateCatalog, compareVersions, trustedReleaseAsset } from '../lib/update-policy.js'
+
+/** Explicit CLI installation is not an automatic-update recommendation.
+ * Tested DSH/platform/architecture lists describe evidence, not admission.
+ * Keep trusted artifacts, explicit withdrawals and the no-downgrade floor.
+ */
+export function selectInstallTarget(pinned, remote, current, now = Date.now()) {
+  const local = validateCatalog(pinned.catalog)
+  const bundled = local.releases.find(r => r.version === pinned.version && r.channel === 'stable')
+  if (!bundled || !trustedReleaseAsset(bundled.asset, bundled.version)) {
+    throw new Error('安装包信息不完整，请重新获取官方安装器。')
+  }
+  let online
+  try {
+    const candidate = validateCatalog(remote)
+    if (candidate.issuedAt <= now + 300000 && candidate.expiresAt > now) online = candidate
+  } catch { /* The authenticated npm package remains usable without the catalog. */ }
+
+  // An installer never silently substitutes an older plugin than its own bundle.
+  // Keep the bundled bytes/hash for the same version even if remote metadata differs.
+  const candidates = [bundled, ...(online?.releases || []).filter(r => r.channel === 'stable'
+    && compareVersions(r.version, bundled.version) > 0 && trustedReleaseAsset(r.asset, r.version))]
+    .sort((a, b) => compareVersions(b.version, a.version))
+  const rules = [...local.blocked, ...(online?.blocked || [])]
+  const blocked = release => rules.find(b => b.pluginVersion === release.version
+    && (!b.dsh || b.dsh.includes(current.agentVersion))
+    && (!b.platforms || b.platforms.includes(current.platform)))
+  const release = candidates.find(r => !blocked(r))
+  if (!release) {
+    throw new Error(`当前插件存在已知不兼容问题：${blocked(bundled).reason}；未替换现有插件。`)
+  }
+  return release
+}

package/bin/setup.mjs

@@ -8,7 +8,8 @@ import { randomBytes, createHash } from 'node:crypto'
 import { fileURLToPath } from 'node:url'
 import { attachControl, waitForJson, waitForInstallControl } from './native-control.mjs'
 import { resolveInstallRuntime, verifyInstallRuntime } from '../lib/install-runtime.js'
-import { validateCatalog, releaseMatches, compareVersions } from '../lib/update-policy.js'
+import { compareVersions } from '../lib/update-policy.js'
+import { selectInstallTarget } from './release-selection.mjs'
 import { boundedFetch, downloadRelease, auditArchive } from '../lib/update-download.js'
 import { writePrivateJsonAtomic } from '../lib/secure-file.js'
 import { control, validateJob, releaseOwnedUpdateLock } from '../lib/update-worker.js'
@@ -38,21 +39,16 @@ function portBusy(port) {
     socket.setTimeout(500, () => end(false)); socket.once('connect', () => end(true)); socket.once('error', () => end(false))
   })
 }
-async function selectRelease(host, assetsRoot = path.join(root, 'assets'), repair = false) {
+export async function selectRelease(host, assetsRoot = path.join(root, 'assets'), repair = false,
+  fetchCatalog = () => boundedFetch('https://relay.xyxfood.xyz/v1/update-policy', 256 * 1024)) {
   const current = { agentKind: 'dsh', agentVersion: host.dshVersion, pluginVersion: host.pluginVersion,
     platform: { win32: 'windows', darwin: 'macos', linux: 'linux' }[host.platform], arch: host.arch }
   const pinned = JSON.parse(fs.readFileSync(path.join(assetsRoot, 'release.json'), 'utf8'))
-  const catalog = validateCatalog(pinned.catalog)
-  let releases = catalog.releases
-  try {
-    const remote = validateCatalog(JSON.parse((await boundedFetch('https://relay.xyxfood.xyz/v1/update-policy', 256 * 1024)).toString('utf8')))
-    if (remote.issuedAt <= Date.now() + 300000 && remote.expiresAt > Date.now()) {
-      releases = [...releases, ...remote.releases].filter(r => !remote.blocked.some(b => b.pluginVersion === r.version && (!b.dsh || b.dsh.includes(current.agentVersion)) && (!b.platforms || b.platforms.includes(current.platform))))
-    }
-  } catch { /* Authenticated npm package retains its explicitly tested release. */ }
-  const release = releases.filter(r => r.channel === 'stable' && releaseMatches(r, current))
-    .sort((a, b) => compareVersions(b.version, a.version))[0]
-  if (!release) throw new Error('当前 DSH 版本或系统尚无已验证的插件版本；没有修改现有安装。')
+  let remote
+  try {
+    remote = JSON.parse((await fetchCatalog()).toString('utf8'))
+  } catch { /* Authenticated npm package retains its bundled release. */ }
+  const release = selectInstallTarget(pinned, remote, current)
   if (host.pluginVersion !== '0.0.0' && (compareVersions(host.pluginVersion, release.version) > 0
     || (compareVersions(host.pluginVersion, release.version) === 0 && !repair))) return { release, archive: null }
   let archive
@@ -77,7 +73,7 @@ export async function install({ profileName = 'web', cli = findDsh(), assetsRoot
     // Initialize missing profiles through DSH itself, never synthesize a bundle list.
     if (!fs.existsSync(path.join(profile, 'package.json'))) {
       const log = fs.openSync(path.join(directory, 'startup.log'), 'a', 0o600)
-      launched = spawn(process.execPath, [cli, '--profile', profileName, '--no-open'], {
+      launched = spawn(process.execPath, [cli, '--profile', profileName, '--no-open'], {
         cwd: process.cwd(), env: process.env, detached: true, windowsHide: true, stdio: ['ignore', log, log] })
       fs.closeSync(log); launched.on('error', () => {}); launched.unref()
       for (let i = 0; i < 100 && !fs.existsSync(path.join(profile, 'package.json')); i++) await sleep(100)
@@ -97,7 +93,7 @@ export async function install({ profileName = 'web', cli = findDsh(), assetsRoot
         ensureRunning: async () => {
           if (launched || await portBusy(Number(process.env.DSH_PORT || 3080))) return
           const log = fs.openSync(path.join(directory, 'startup.log'), 'a', 0o600)
-          launched = spawn(process.execPath, [cli, '--profile', profileName, '--no-open'], {
+          launched = spawn(process.execPath, [cli, '--profile', profileName, '--no-open'], {
             cwd: process.cwd(), env: process.env, detached: true, windowsHide: true, stdio: ['ignore', log, log] })
           fs.closeSync(log); launched.on('error', () => {}); launched.unref()
         },