dsh-wisp 1.25.0 → 1.26.0

package/README.md

@@ -404,6 +404,13 @@ node tools/audit-log.mjs --confirm <manifest>     # 生成后：并入代理登
 - **宿主半包**跑在 **vm 沙箱**里：`harness` 只有 `defineTool / registerTool / handle`，
   沙箱里还有 `nodeApiTraps()` 把 Node API 全挡了，允许的 `ctx` 动词白名单里**没有网络与文件系统**。
 
+**为什么要读两个源（npm + GitHub）取更高版本**：npm 的注册表是权威源，但发布可能长时间卡在它的
+**暂存区**里 —— 实测：`PUT 202`（已受理）之后等了 18 分钟，注册表和 tarball **仍然 404**，
+而同版本号重发被拒（`409 Cannot publish over previously staged version`）；
+同期 GitHub 的 `package.json` 是**立刻**更新的。
+所以检查同时读两个源、**取版本号更高的那个** —— 这样无论 npm 有没有追上都是对的。
+「npm 优先、GitHub 兜底」在这里是错的 ✗：它会读到 npm 那个旧号，然后告诉你"已经是最新的"。
+
 所以网络只能走**服务**：宿主半包 `inject: { optional: ['web'] }`，用 `ctx.web.fetch(...)` 抓远端
 `package.json`，再用 `harness.handle('checkUpdate', …)` 注册；浏览器半包 `host.call('checkUpdate')` 调。
 **客户端那边一点网络都没碰** —— `fetch` 陷阱原样留着。
@@ -441,6 +448,29 @@ node tools/audit-log.mjs --confirm <manifest>     # 生成后：并入代理登
 
 ## 变更
 
+### 1.26.0
+
+- **检查更新改为同时读两个源，取版本号更高的那个**（npm 注册表 + GitHub 的 package.json）。
+
+  起因是这次发布踩到的事：`npm publish` 返回 `PUT 202`（已受理）却**长时间不进注册表** ——
+  等了 18 分钟，`dsh-wisp/1.25.0` 与 tarball 都还是 404；同号重发被拒
+  （`409 Cannot publish over previously staged version`）；npm 状态页一切正常。
+  而 GitHub 上的 `package.json` 是立刻更新的。
+
+  于是设计成**取更高版本**而不是「npm 优先、GitHub 兜底」：
+  后者会读到 npm 那个旧号（当时是 0.6.0），然后告诉你「已经是最新的」✗。
+  取更高则无论 npm 有没有追上都是对的 ✓
+
+  - 宿主半包：`readVersion()` 单源 → `readPublishedVersion()` 多源并发，返回
+    `{ ok, latest, from, sources }`；每个源的成败**分别上报**，一个挂了不影响另一个；
+  - 客户端：把 `from` / `sources` 一起记进 `doctor().update.lastCheck` ——
+    两个源不一致时，「这个数字来自哪」比数字本身更需要能查；
+  - 预检 377 → **383 项**，含四种组合：两源一致 / npm 旧 GitHub 新 / npm 新 GitHub 旧 / 一个挂一个活。
+
+- 上一版 1.25.1 只是换号重发（内容与 1.25.0 完全一致），代码无改动。
+
+### 1.25.1
+
 ### 1.25.0
 
 - **她真的会检查更新了。** 上一版只说"我做不到" —— 那一版没找对通道，这一版找到了：

package/lib/client.js

@@ -51,7 +51,7 @@ window.__ModuleLoader__.load({
     var exports = module.exports
     Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' })
 
-    const VERSION = '1.25.0'
+    const VERSION = '1.26.0'
 
 /* 每一版一句话。**必须写当前版本** —— 预检里有一条断言盯着它，
    忘了更新就会红，不会静默过期。 */
@@ -65,6 +65,8 @@ const WHATS_NEW = {
   '1.23.0': '滚轮调大小、方向键挪位置、躲起来也能开菜单。',
   '1.24.0': '她会报自己的版本，更新过会告诉你，还能把包名复制给你。',
   '1.25.0': '她真的会去查有没有新版本了。',
+  '1.25.1': '内容与 1.25.0 相同，重新发布以修好安装源。',
+  '1.26.0': '检查更新同时读 npm 和 GitHub，取更高的那个版本。',
 }
 
 /* 更新这件事**这个插件自己做不到**，如实写在代码里，免得以后有人以为能：
@@ -2050,9 +2052,11 @@ body[data-ds-dark-theme] .wisp-layer{--wisp-say-fg:#eaf2f8;--wisp-say-bg:rgba(20
             if (!res || res.ok !== true || typeof res.latest !== 'string') {
               updateCheck = { state: 'failed', reason: (res && res.reason) || 'no-result', at: nowMs() }
             } else if (compareVersions(VERSION, res.latest) < 0) {
-              updateCheck = { state: 'available', latest: res.latest, at: nowMs() }
+              /* from / sources 一起留着：两个源不一致时（npm 暂存、GitHub 已更新），
+                 "这个数字是哪儿来的"比数字本身更需要能查。 */
+              updateCheck = { state: 'available', latest: res.latest, from: res.from ?? null, sources: res.sources ?? null, at: nowMs() }
             } else {
-              updateCheck = { state: 'current', latest: res.latest, at: nowMs() }
+              updateCheck = { state: 'current', latest: res.latest, from: res.from ?? null, sources: res.sources ?? null, at: nowMs() }
             }
             return updateCheck
           })

package/lib/client.template.js

@@ -51,7 +51,7 @@ window.__ModuleLoader__.load({
     var exports = module.exports
     Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' })
 
-    const VERSION = '1.25.0'
+    const VERSION = '1.26.0'
 
 /* 每一版一句话。**必须写当前版本** —— 预检里有一条断言盯着它，
    忘了更新就会红，不会静默过期。 */
@@ -65,6 +65,8 @@ const WHATS_NEW = {
   '1.23.0': '滚轮调大小、方向键挪位置、躲起来也能开菜单。',
   '1.24.0': '她会报自己的版本，更新过会告诉你，还能把包名复制给你。',
   '1.25.0': '她真的会去查有没有新版本了。',
+  '1.25.1': '内容与 1.25.0 相同，重新发布以修好安装源。',
+  '1.26.0': '检查更新同时读 npm 和 GitHub，取更高的那个版本。',
 }
 
 /* 更新这件事**这个插件自己做不到**，如实写在代码里，免得以后有人以为能：
@@ -2004,9 +2006,11 @@ body[data-ds-dark-theme] .wisp-layer{--wisp-say-fg:#eaf2f8;--wisp-say-bg:rgba(20
             if (!res || res.ok !== true || typeof res.latest !== 'string') {
               updateCheck = { state: 'failed', reason: (res && res.reason) || 'no-result', at: nowMs() }
             } else if (compareVersions(VERSION, res.latest) < 0) {
-              updateCheck = { state: 'available', latest: res.latest, at: nowMs() }
+              /* from / sources 一起留着：两个源不一致时（npm 暂存、GitHub 已更新），
+                 "这个数字是哪儿来的"比数字本身更需要能查。 */
+              updateCheck = { state: 'available', latest: res.latest, from: res.from ?? null, sources: res.sources ?? null, at: nowMs() }
             } else {
-              updateCheck = { state: 'current', latest: res.latest, at: nowMs() }
+              updateCheck = { state: 'current', latest: res.latest, from: res.from ?? null, sources: res.sources ?? null, at: nowMs() }
             }
             return updateCheck
           })

package/lib/index.js

@@ -13,6 +13,14 @@
 //   2. Nothing else. `web` is declared as an OPTIONAL inject on purpose: a
 //      required inject that nothing provides would leave this fiber `waiting`
 //      forever, and the companion would simply disappear from the UI.
+//
+// WHY TWO SOURCES. npm's registry is the authoritative one, but a publish can sit
+// in npm's staging queue for a long time (observed: `PUT 202`, still 404 after 18
+// minutes, and re-publishing the same version is refused with 409). GitHub's raw
+// manifest updated immediately in the same situation. So the check reads BOTH and
+// reports the HIGHER version — which is correct whether or not npm has caught up.
+// "npm first, GitHub as fallback" would read the stale npm number and claim you
+// were up to date.
 
 /** Cordis plugin name used by loader diagnostics. */
 export const name = 'wisp'
@@ -23,42 +31,43 @@ export const name = 'wisp'
  */
 export const inject = { required: [], optional: ['web'] }
 
-/** Where the check reads the published version from. Overridable per install. */
-export const DEFAULT_UPDATE_URL = 'https://raw.githubusercontent.com/969246694/dsh-wisp/main/package.json'
+/** The two places a published version can be read from. Overridable per install. */
+export const DEFAULT_SOURCES = {
+  npm: 'https://registry.npmjs.org/dsh-wisp/latest',
+  github: 'https://raw.githubusercontent.com/969246694/dsh-wisp/main/package.json',
+}
 
-/** How long a check may take before it is reported as a timeout. */
+/** How long the whole check may take before it is reported as a timeout. */
 const CHECK_TIMEOUT_MS = 8000
 
 /**
- * Fetch the published package.json and pull `version` out of it.
+ * Fetch one manifest and pull `version` out of it.
  * @param web - the `web` service, or undefined when it is not loaded.
  * @param url - the manifest URL.
  * @param signal - optional cancellation signal.
- * @returns a plain, JSON-serializable verdict (this crosses the sandbox boundary).
+ * @returns `{ ok, version }` or `{ ok: false, reason }` — never throws.
  */
-export async function readPublishedVersion(web, url, signal) {
-  if (!web || typeof web.fetch !== 'function') {
-    return { ok: false, reason: 'no-web-service', url }
-  }
+export async function readVersion(web, url, signal) {
+  if (!web || typeof web.fetch !== 'function') return { ok: false, reason: 'no-web-service' }
   try {
     const res = await web.fetch({ url }, signal)
-    if (!res || typeof res.statusCode !== 'number') return { ok: false, reason: 'bad-result', url }
+    if (!res || typeof res.statusCode !== 'number') return { ok: false, reason: 'bad-result' }
     /* Per the service contract a non-2xx response is a RESULT, not a throw —
        so the status must be checked here instead of caught below. */
-    if (res.statusCode !== 200) return { ok: false, reason: 'http-' + res.statusCode, url }
+    if (res.statusCode !== 200) return { ok: false, reason: 'http-' + res.statusCode }
     const text = res.body && typeof res.body.content === 'string' ? res.body.content : ''
-    let latest = null
+    let version = null
     try {
       const parsed = JSON.parse(text)
-      if (parsed && typeof parsed.version === 'string') latest = parsed.version
+      if (parsed && typeof parsed.version === 'string') version = parsed.version
     } catch (error) {
-      return { ok: false, reason: 'not-json', url }
+      return { ok: false, reason: 'not-json' }
     }
-    if (latest === null) return { ok: false, reason: 'no-version-field', url }
-    return { ok: true, url, latest }
+    if (version === null) return { ok: false, reason: 'no-version-field' }
+    return { ok: true, version }
   } catch (error) {
     const detail = error && error.message ? String(error.message) : String(error)
-    return { ok: false, reason: 'fetch-failed', detail, url }
+    return { ok: false, reason: 'fetch-failed', detail }
   }
 }
 
@@ -78,11 +87,41 @@ export function compareVersions(a, b) {
   return 0
 }
 
+/**
+ * Read every source and report the highest version found.
+ * @param web - the `web` service.
+ * @param urls - `{ npm, github }` (or any other set of named sources).
+ * @param signal - optional cancellation signal.
+ * @returns a plain, JSON-serializable verdict (it crosses the sandbox boundary).
+ */
+export async function readPublishedVersion(web, urls, signal) {
+  const names = Object.keys(urls ?? {})
+  const results = await Promise.all(names.map((key) => readVersion(web, urls[key], signal)))
+  const sources = {}
+  let best = null
+  let from = null
+  let anyOk = false
+  names.forEach((key, i) => {
+    const r = results[i]
+    sources[key] = r.ok ? { ok: true, version: r.version } : { ok: false, reason: r.reason, detail: r.detail }
+    if (!r.ok) return
+    anyOk = true
+    /* The HIGHER version wins, so a stale mirror cannot mask a newer release. */
+    if (best === null || compareVersions(best, r.version) < 0) {
+      best = r.version
+      from = key
+    }
+  })
+  if (!anyOk) {
+    const first = results.find((r) => r && !r.ok)
+    return { ok: false, reason: first ? first.reason : 'no-sources', sources }
+  }
+  return { ok: true, latest: best, from, sources }
+}
+
 /** Register the handler the browser half reaches through `host.call`. */
 export function registerHandlers(ctx, options = {}) {
-  const url = typeof options.updateUrl === 'string' && options.updateUrl !== ''
-    ? options.updateUrl
-    : DEFAULT_UPDATE_URL
+  const urls = options.urls && typeof options.urls === 'object' ? options.urls : DEFAULT_SOURCES
   /* `harness` is a sandbox global: the host half is evaluated inside a vm whose
      context carries it. Guard the reference so this module also loads — and is
      testable — outside that sandbox. */
@@ -99,13 +138,13 @@ export function registerHandlers(ctx, options = {}) {
       timer = setTimeout(() => controller.abort(), CHECK_TIMEOUT_MS)
     }
     try {
-      const verdict = await readPublishedVersion(ctx && ctx.web, url, controller ? controller.signal : undefined)
+      const verdict = await readPublishedVersion(ctx && ctx.web, urls, controller ? controller.signal : undefined)
       return { ...verdict, current, checkedAt: new Date().toISOString() }
     } finally {
       if (timer !== null && typeof clearTimeout === 'function') clearTimeout(timer)
     }
   })
-  return { registered: true, dispose, url }
+  return { registered: true, dispose, urls }
 }
 
 export function apply(ctx, config) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-wisp",
-  "version": "1.25.0",
+  "version": "1.26.0",
   "description": "DeepSeek娘 — an unofficial floating desktop companion for the DeepSeek Harness UI. Zero dependencies; sprites inlined as data URIs; schedules on the Client timer service instead of the trapped browser timer globals.",
   "type": "module",
   "main": "lib/index.js",

package/verify-wisp.mjs

@@ -531,8 +531,10 @@ head('1b. the host half answers checkUpdate through the platform web service')
   check(Boolean(declaresWeb) && Array.isArray(inject.required) && !inject.required.includes('web'),
     'and not as a required one — a missing service must not hide her', JSON.stringify(inject))
 
-  const fakeWeb = (outcome) => ({
+  /* 每个 URL 一个态度：可以按 URL 给不同的结果，才能测"两个源"的组合。 */
+  const webWith = (byUrl) => ({
     fetch: async (request) => {
+      const outcome = byUrl[request.url] ?? { status: 404, body: 'nope' }
       if (outcome.throw) throw new Error(outcome.throw)
       return {
         url: request.url,
@@ -542,29 +544,69 @@ head('1b. the host half answers checkUpdate through the platform web service')
       }
     },
   })
+  const U = { npm: 'https://npm/x', github: 'https://gh/y' }
+  const only = (key, outcome) => webWith({ [U[key]]: outcome })
 
-  const good = await readPublishedVersion(fakeWeb({ body: '{"name":"dsh-wisp","version":"9.9.9"}' }), 'https://x/y')
-  check(good.ok === true && good.latest === '9.9.9', 'a 200 with a version field is read correctly', JSON.stringify(good))
+  const good = await readPublishedVersion(only('npm', { body: '{"name":"dsh-wisp","version":"9.9.9"}' }), U)
+  check(good.ok === true && good.latest === '9.9.9' && good.from === 'npm',
+    'a 200 with a version field is read correctly', JSON.stringify(good))
 
-  const notFound = await readPublishedVersion(fakeWeb({ status: 404, body: 'nope' }), 'https://x/y')
+  const notFound = await readPublishedVersion(only('npm', { status: 404, body: 'nope' }), U)
   check(notFound.ok === false && notFound.reason === 'http-404',
     'a non-2xx is a result, not a throw — and is reported as such', JSON.stringify(notFound))
 
-  const noWeb = await readPublishedVersion(undefined, 'https://x/y')
+  const noWeb = await readPublishedVersion(undefined, U)
   check(noWeb.ok === false && noWeb.reason === 'no-web-service',
     'without the web service it says so instead of throwing', JSON.stringify(noWeb))
 
-  const blewUp = await readPublishedVersion(fakeWeb({ throw: 'socket closed' }), 'https://x/y')
-  check(blewUp.ok === false && blewUp.reason === 'fetch-failed' && blewUp.detail === 'socket closed',
+  const blewUp = await readPublishedVersion(only('npm', { throw: 'socket closed' }), U)
+  check(blewUp.ok === false && blewUp.reason === 'fetch-failed',
     'a transport failure is caught and reported', JSON.stringify(blewUp))
 
-  const notJson = await readPublishedVersion(fakeWeb({ body: '<html>404</html>' }), 'https://x/y')
+  const notJson = await readPublishedVersion(only('npm', { body: '<html>404</html>' }), U)
   check(notJson.ok === false && notJson.reason === 'not-json', 'a non-JSON body is reported', JSON.stringify(notJson))
 
-  const noField = await readPublishedVersion(fakeWeb({ body: '{"name":"dsh-wisp"}' }), 'https://x/y')
+  const noField = await readPublishedVersion(only('npm', { body: '{"name":"dsh-wisp"}' }), U)
   check(noField.ok === false && noField.reason === 'no-version-field',
     'a manifest without a version is reported', JSON.stringify(noField))
 
+  /* ---- 两个源：取更高的那个，而不是"谁先谁赢" ---- */
+  const bothAgree = await readPublishedVersion(webWith({
+    [U.npm]: { body: '{"version":"1.25.1"}' },
+    [U.github]: { body: '{"version":"1.25.1"}' },
+  }), U)
+  check(bothAgree.ok === true && bothAgree.latest === '1.25.1',
+    'when both sources agree the answer is that version', JSON.stringify(bothAgree))
+  check(bothAgree.sources.npm.ok === true && bothAgree.sources.github.ok === true,
+    'and both sources are reported individually', JSON.stringify(bothAgree.sources))
+
+  /* 真实情况：npm 卡在旧的 0.6.0，GitHub 已经是 1.25.1 —— 必须报 1.25.1 */
+  const staleNpm = await readPublishedVersion(webWith({
+    [U.npm]: { body: '{"version":"0.6.0"}' },
+    [U.github]: { body: '{"version":"1.25.1"}' },
+  }), U)
+  check(staleNpm.ok === true && staleNpm.latest === '1.25.1' && staleNpm.from === 'github',
+    'a stale npm cannot mask a newer GitHub release', JSON.stringify(staleNpm))
+
+  /* 反过来也一样：npm 更新时必须报 npm 那个 */
+  const newerNpm = await readPublishedVersion(webWith({
+    [U.npm]: { body: '{"version":"2.0.0"}' },
+    [U.github]: { body: '{"version":"1.25.1"}' },
+  }), U)
+  check(newerNpm.ok === true && newerNpm.latest === '2.0.0' && newerNpm.from === 'npm',
+    'and a newer npm wins over an older GitHub', JSON.stringify(newerNpm))
+
+  /* 一个挂了、另一个还在：仍然要有答案，并且说清哪个挂了 */
+  const oneDown = await readPublishedVersion(webWith({
+    [U.github]: { body: '{"version":"1.25.1"}' },
+  }), U)
+  check(oneDown.ok === true && oneDown.latest === '1.25.1' && oneDown.sources.npm.ok === false,
+    'one dead source does not break the check', JSON.stringify(oneDown))
+
+  const bothDown = await readPublishedVersion(webWith({ [U.npm]: { throw: 'x' } }), U)
+  check(bothDown.ok === false && bothDown.sources.npm.ok === false && bothDown.sources.github.ok === false,
+    'when every source fails the check fails — with per-source reasons', JSON.stringify(bothDown))
+
   check(compareVersions('1.2.3', '1.2.4') === -1 && compareVersions('1.2.3', '1.2.3') === 0
     && compareVersions('1.3.0', '1.2.9') === 1, 'version comparison is numeric, not lexicographic',
     `${compareVersions('1.10.0', '1.9.0')} for 1.10.0 vs 1.9.0`)
@@ -573,16 +615,17 @@ head('1b. the host half answers checkUpdate through the platform web service')
   const previousSeat = globalThis.harness
   const handlers = new Map()
   globalThis.harness = { handle: (method, fn) => { handlers.set(method, fn); return () => handlers.delete(method) } }
-  const registered = registerHandlers({ web: fakeWeb({ body: '{"version":"9.9.9"}' }) }, {})
+  const registered = registerHandlers({ web: only('npm', { body: '{"version":"9.9.9"}' }) }, { urls: U })
   check(registered.registered === true && handlers.has('checkUpdate'),
     'registerHandlers puts checkUpdate on the harness seat', JSON.stringify({ registered: registered.registered }))
   const answer = await handlers.get('checkUpdate')({ current: '1.0.0' })
   check(answer.ok === true && answer.latest === '9.9.9' && answer.current === '1.0.0'
     && typeof answer.checkedAt === 'string',
     'the handler returns a plain, serializable verdict', JSON.stringify(answer))
-  const injectedUrl = handlers.size > 0 ? registered.url : null
-  check(typeof injectedUrl === 'string' && injectedUrl.startsWith('https://'),
-    'and it reads from a real https manifest URL', String(injectedUrl))
+  const urls = registered.urls ?? {}
+  check(typeof urls.npm === 'string' && urls.npm.startsWith('https://')
+    && typeof urls.github === 'string' && urls.github.startsWith('https://'),
+    'and it reads from two real https sources', JSON.stringify(urls))
 
   /* 座位不在时不许抛：宿主半包在别的运行时里也要能 import */
   delete globalThis.harness
@@ -596,7 +639,7 @@ head('1b. the host half answers checkUpdate through the platform web service')
   const effects = []
   let appliedThrew = false
   try {
-    mod.apply({ web: fakeWeb({ body: '{"version":"9.9.9"}' }), effect: (fn, label) => { effects.push(label); return () => {} } }, {})
+    mod.apply({ web: only('npm', { body: '{"version":"9.9.9"}' }), effect: (fn, label) => { effects.push(label); return () => {} } }, {})
   } catch (error) { appliedThrew = true }
   check(appliedThrew === false && handlers.has('checkUpdate') && effects.length === 1,
     'apply() registers the handler and keeps its disposer on the fiber', effects.join(', '))