dshmarket 1.2.2 → 1.2.4

package/src/install.ts

@@ -0,0 +1,141 @@
+/**
+ * Install orchestration: collection-repo retargeting, post-install
+ * validation that keeps broken pieces from bricking the next boot, and
+ * update staleness detection. Every function takes the plugin runner as a
+ * parameter so tests can substitute a recording fake.
+ */
+
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+import type { InstallResult, PluginRunner } from './dsh-cli.ts'
+import { classifyPnpmFailure } from './pnpm-compat.ts'
+import { entryArtifactExists, hasDshManifest, pluginSubdirs, profileDir, readInstalled } from './profile.ts'
+import { logEvent } from './log.ts'
+
+/**
+ * Run one plugin command with automatic recovery from the pnpm-major drift
+ * failure (#20 bug 2): when the modules directory was built by a different
+ * pnpm major, pnpm's documented remedy is one `install` to recreate it —
+ * do that silently and retry the original command once. Any recognized
+ * failure that survives gets its bilingual explanation appended to stderr
+ * so the UI shows an actionable message instead of a wall of text (#20 bug 3).
+ */
+export async function withHoistRecovery(run: PluginRunner, profile: string, pluginArgs: string[]): Promise<InstallResult> {
+  let result = await run(profile, pluginArgs)
+  const ok = (r: InstallResult): boolean => r.exitCode === 0 && !r.timedOut && !r.cancelled
+  if (!ok(result) && classifyPnpmFailure(`${result.stderr}\n${result.stdout}`)?.code === 'hoist-pattern-diff') {
+    logEvent('warn', 'install', `modules dir was built by a different pnpm major — rebuilding (pnpm install) and retrying once`)
+    // --no-frozen-lockfile: the market runs pnpm with CI=true (TTY hangs),
+    // where a lockfile written by the old major would otherwise be refused.
+    const rebuild = await run(profile, ['install', '--no-frozen-lockfile'])
+    if (ok(rebuild)) result = await run(profile, pluginArgs)
+  }
+  if (!ok(result) && !result.cancelled) {
+    const failure = classifyPnpmFailure(`${result.stderr}\n${result.stdout}`)
+    if (failure !== null) result = { ...result, stderr: `${result.stderr}\n\n${failure.message}` }
+  }
+  return result
+}
+
+/**
+ * Some registry entries point at collection repos whose actual plugin lives
+ * in a subdirectory — the root has no package.json (or a workspace root with
+ * no dsh surface), and pnpm installs the bare fileset with exit 0. Detect
+ * that junk install, drop it, and re-add each plugin subdirectory through
+ * pnpm's `#path:` selector (#18).
+ * @returns overall success (true when nothing needed retargeting).
+ */
+export async function retargetCollections(
+  run: PluginRunner, profile: string, before: Set<string>, target: string,
+): Promise<boolean> {
+  if (!target.startsWith('github:')) return true
+  const junk = Object.keys(readInstalled(profile)).filter((name) => {
+    if (before.has(name)) return false
+    const root = join(profileDir(profile), 'node_modules', name)
+    if (!existsSync(join(root, 'package.json'))) return true
+    return !hasDshManifest(root)
+  })
+  let allOk = true
+  for (const name of junk) {
+    const root = join(profileDir(profile), 'node_modules', name)
+    const candidates = pluginSubdirs(root)
+    logEvent('info', 'install', `${name}: collection repo (root declares no dsh manifest); plugins inside: ${candidates.join(', ') || 'none'}`)
+    await run(profile, ['remove', name])
+    if (candidates.length === 0) {
+      allOk = false
+      continue
+    }
+    for (const sub of candidates) {
+      const result = await run(profile, ['add', `${target}#path:/${sub}`])
+      if (result.exitCode !== 0 || result.timedOut) {
+        allOk = false
+        logEvent('error', 'install',
+          `${target}#path:/${sub}: exit=${String(result.exitCode)}${result.timedOut ? ' TIMEOUT' : ''} — ${(result.stderr || result.stdout).slice(-220)}`)
+      }
+    }
+  }
+  return allOk
+}
+
+/**
+ * Fake-success guard (#18): validate every package the install added. A
+ * piece without a dsh manifest or without its declared entry artifact
+ * (source-only checkout, build blocked by pnpm allowBuilds) would brick the
+ * next boot, so it is removed on the spot.
+ * @returns names kept and names removed as broken.
+ */
+export async function validateAddedPlugins(
+  run: PluginRunner, profile: string, before: Set<string>,
+): Promise<{ keep: string[]; removedBroken: string[] }> {
+  const addedNow = Object.keys(readInstalled(profile)).filter(n => !before.has(n))
+  const keep: string[] = []
+  const removedBroken: string[] = []
+  for (const n of addedNow) {
+    const dir = join(profileDir(profile), 'node_modules', n)
+    if (hasDshManifest(dir) && entryArtifactExists(dir)) {
+      keep.push(n)
+    } else {
+      removedBroken.push(n)
+      await run(profile, ['remove', n])
+    }
+  }
+  return { keep, removedBroken }
+}
+
+/**
+ * Whether a clean-exit update actually changed nothing — pnpm's
+ * minimumReleaseAge silently keeps the old version and exits 0 when the new
+ * release is "too young" (#13, #22), so a clean exit alone does not mean the
+ * update happened.
+ */
+export function isStaleUpdate(check: {
+  isGit: boolean
+  beforeVersion: string | null
+  afterVersion: string | null
+  beforeCommit: string | null
+  afterCommit: string | null
+}): boolean {
+  return check.isGit
+    ? check.beforeCommit !== null && check.afterCommit === check.beforeCommit
+    : check.beforeVersion !== null && check.afterVersion === check.beforeVersion
+}
+
+/**
+ * Package names pnpm reported as having their build scripts ignored
+ * ("Ignored build scripts: esbuild, koffi."). Empty when none.
+ * (#6 by @qichuang321.)
+ */
+export function parseIgnoredBuilds(stdout: string, stderr: string): string[] {
+  const m = /Ignored build scripts:?\s*([^\n]+)/i.exec(`${stdout}\n${stderr}`)
+  if (m === null) return []
+  const found: string[] = []
+  for (const chunk of m[1].split(',')) {
+    // Entries may carry a version suffix and the sentence's final period.
+    const trimmed = chunk.trim().replace(/\.$/, '')
+    if (trimmed === '') continue
+    const at = trimmed.lastIndexOf('@')
+    const name = at > 0 ? trimmed.slice(0, at) : trimmed
+    if (name !== '' && !found.includes(name)) found.push(name)
+  }
+  return found
+}

package/src/pnpm-compat.ts

@@ -0,0 +1,83 @@
+/**
+ * pnpm compatibility layer — everything the market needs to know about how
+ * different pnpm majors behave inside a dsh profile directory, kept pure and
+ * separately testable (test/unit + test/integration exercise this module
+ * against real pnpm 9/10/11).
+ *
+ * Verified behavior matrix (2026-08, pnpm 9.15.9 / 10.28.2 / 11.21.0):
+ * - workspace root, `add` without -w:  pnpm 9 fails ERR_PNPM_ADDING_TO_ROOT;
+ *   pnpm 10/11 succeed.
+ * - `add -w` where NO pnpm-workspace.yaml exists: ALL majors fail with
+ *   "--workspace-root may only be used inside a workspace".
+ * - modules dir built by pnpm 9, then pnpm 10/11 mutate it:
+ *   ERR_PNPM_PUBLIC_HOIST_PATTERN_DIFF (defaults drifted between majors).
+ */
+
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+
+
+/**
+ * Decide the argv for a `dsh plugin <add|remove> …` call in the given profile.
+ *
+ * pnpm 9 refuses to add at a workspace root without -w (#17, #20); every
+ * pnpm major refuses -w when the directory is NOT a workspace. So the flag
+ * is injected exactly when the profile has a pnpm-workspace.yaml.
+ * @param profileDir - resolved profile directory (owns pnpm-workspace.yaml, or not).
+ * @param pluginArgs - the raw args, e.g. ['add', 'dshmarket@latest'].
+ * @returns args with -w injected when — and only when — the profile is a workspace root.
+ */
+export function pluginArgsFor(profileDir: string, pluginArgs: string[]): string[] {
+  if (pluginArgs[0] !== 'add' && pluginArgs[0] !== 'remove') return pluginArgs
+  if (!existsSync(join(profileDir, 'pnpm-workspace.yaml'))) return pluginArgs
+  return [pluginArgs[0], '-w', ...pluginArgs.slice(1)]
+}
+
+/** One recognized pnpm failure, with a bilingual explanation for the UI. */
+export interface PnpmFailure {
+  code: 'adding-to-root' | 'not-a-workspace' | 'hoist-pattern-diff' | 'pnpm-missing'
+  /** Bilingual, actionable message shown to the user instead of the raw wall of text. */
+  message: string
+  /** True when re-running `pnpm install` in the profile is the documented recovery. */
+  recoverable: boolean
+}
+
+/**
+ * Map a failed pnpm run's combined output to a known failure mode.
+ *
+ * dsh's own wrapper line ("dsh: pnpm failed in profile directory …") names no
+ * cause, so the market must recognize pnpm's real diagnostics itself (#20).
+ * @param output - stdout+stderr of the failed run.
+ * @returns the classified failure, or null when unrecognized (raw output is then shown as-is).
+ */
+export function classifyPnpmFailure(output: string): PnpmFailure | null {
+  if (output.includes('ERR_PNPM_PUBLIC_HOIST_PATTERN_DIFF')) {
+    return {
+      code: 'hoist-pattern-diff',
+      recoverable: true,
+      message: 'profile 的 node_modules 是旧版 pnpm 创建的，与当前 pnpm 的默认配置不兼容，需要重建后重试 / this profile\'s node_modules was created by a different pnpm major; it must be rebuilt (pnpm install) before changes can be applied',
+    }
+  }
+  if (output.includes('ERR_PNPM_ADDING_TO_ROOT')) {
+    return {
+      code: 'adding-to-root',
+      recoverable: false,
+      message: 'pnpm 拒绝在 workspace 根目录安装（缺少 -w）。这是市场的 bug，请升级 dshmarket 到最新版 / pnpm refused to add at a workspace root (missing -w); this is a market bug — please update dshmarket',
+    }
+  }
+  if (/--workspace-root may only be used inside a workspace/i.test(output)) {
+    return {
+      code: 'not-a-workspace',
+      recoverable: false,
+      message: 'profile 目录不是 pnpm workspace，却传入了 -w。这是市场的 bug，请升级 dshmarket 到最新版 / -w was passed but the profile is not a pnpm workspace; this is a market bug — please update dshmarket',
+    }
+  }
+  if (output.includes('pnpm not found on PATH')) {
+    return {
+      code: 'pnpm-missing',
+      recoverable: false,
+      message: '找不到 pnpm，请先在市场页顶部一键安装组件 / pnpm is not on PATH — use the one-click setup at the top of the market page',
+    }
+  }
+  return null
+}

package/src/profile.ts

@@ -0,0 +1,162 @@
+/**
+ * Profile filesystem reads — everything the market learns from a dsh
+ * profile directory (manifest, lockfile, installed package trees). Pure
+ * functions of the directory contents; no processes, no network.
+ */
+
+import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+
+/** Resolve a profile name to its directory under DSH_HOME (default ~/.dsh). */
+export function profileDir(profile: string): string {
+  const home = process.env.DSH_HOME ?? join(homedir(), '.dsh')
+  return join(home, 'profiles', profile)
+}
+
+/**
+ * The in-box bundles dsh's profile templates install themselves — the ONLY
+ * names the market hides from the installed list. Community plugins may
+ * legitimately publish under the official scope (#28), so a whole-scope
+ * filter would make them invisible and fail install validation.
+ * (Diagnosis and fix proposed in #28 by @Lograthmic.)
+ */
+const INBOX_BUNDLES = new Set([
+  '@deepseek-ai/dsh-base',
+  '@deepseek-ai/dsh-web-app',
+  '@deepseek-ai/dsh-headless',
+])
+
+/** Community dependencies of the profile (in-box bundles filtered out). */
+export function readInstalled(profile: string): Record<string, string> {
+  try {
+    const manifest = JSON.parse(readFileSync(join(profileDir(profile), 'package.json'), 'utf8')) as {
+      dependencies?: Record<string, string>
+    }
+    const installed: Record<string, string> = {}
+    for (const [name, spec] of Object.entries(manifest.dependencies ?? {})) {
+      if (!INBOX_BUNDLES.has(name)) installed[name] = spec
+    }
+    return installed
+  } catch {
+    return {}
+  }
+}
+
+/** The version actually present in the profile's node_modules, or null. */
+export function readInstalledVersion(profile: string, name: string): string | null {
+  try {
+    const manifest = JSON.parse(
+      readFileSync(join(profileDir(profile), 'node_modules', name, 'package.json'), 'utf8'),
+    ) as { version?: string }
+    return manifest.version ?? null
+  } catch {
+    return null
+  }
+}
+
+/** Pinned commit per `owner/repo` from the profile lockfile's codeload tarball URLs. */
+export function readLockCommits(profile: string): Map<string, string> {
+  const commits = new Map<string, string>()
+  try {
+    const lock = readFileSync(join(profileDir(profile), 'pnpm-lock.yaml'), 'utf8')
+    for (const m of lock.matchAll(/codeload\.github\.com\/([^/\s]+\/[^/\s]+)\/tar\.gz\/([0-9a-f]{40})/g)) {
+      commits.set(m[1].toLowerCase(), m[2])
+    }
+  } catch { /* no lockfile — no git installs to report */ }
+  return commits
+}
+
+/** True when the installed package's manifest declares a dsh plugin surface. */
+export function hasDshManifest(dir: string): boolean {
+  try {
+    const manifest = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')) as { dsh?: unknown }
+    return manifest.dsh !== undefined
+  } catch {
+    return false
+  }
+}
+
+/**
+ * True when the package's declared entry artifact actually exists — github
+ * source checkouts of build-required plugins ship no lib/, and promoting one
+ * into the bundle layer bricks the next boot (ERR_MODULE_NOT_FOUND kills the
+ * whole profile, #18).
+ */
+export function entryArtifactExists(dir: string): boolean {
+  try {
+    const manifest = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')) as {
+      main?: string
+      exports?: Record<string, unknown> | string
+    }
+    const candidates: string[] = []
+    if (typeof manifest.main === 'string') candidates.push(manifest.main)
+    const rootExport = typeof manifest.exports === 'string'
+      ? manifest.exports
+      : (manifest.exports as Record<string, unknown> | undefined)?.['.']
+    if (typeof rootExport === 'string') candidates.push(rootExport)
+    else if (rootExport !== null && typeof rootExport === 'object') {
+      for (const value of Object.values(rootExport)) if (typeof value === 'string') candidates.push(value)
+    }
+    if (candidates.length === 0) candidates.push('index.js')
+    return candidates.some(rel => existsSync(join(dir, rel)))
+  } catch {
+    return false
+  }
+}
+
+/** Plugin subdirectories (depth 2) of a collection checkout, as relative paths. */
+export function pluginSubdirs(root: string): string[] {
+  const found: string[] = []
+  let level1: string[] = []
+  try {
+    level1 = readdirSync(root, { withFileTypes: true })
+      .filter(dirent => dirent.isDirectory() && /^[A-Za-z0-9_.-]+$/.test(dirent.name) && dirent.name !== 'node_modules')
+      .map(dirent => dirent.name)
+  } catch {
+    return found
+  }
+  for (const sub of level1) {
+    if (hasDshManifest(join(root, sub))) {
+      found.push(sub)
+      continue
+    }
+    try {
+      for (const inner of readdirSync(join(root, sub), { withFileTypes: true })) {
+        if (!inner.isDirectory() || !/^[A-Za-z0-9_.-]+$/.test(inner.name) || inner.name === 'node_modules') continue
+        if (hasDshManifest(join(root, sub, inner.name))) found.push(`${sub}/${inner.name}`)
+      }
+    } catch { /* unreadable level — skip */ }
+    if (found.length >= 8) break
+  }
+  return found.slice(0, 8)
+}
+
+/**
+ * Allow the given packages' build scripts in the profile's
+ * pnpm-workspace.yaml `allowBuilds` block (the key dsh profiles use),
+ * merging with existing entries and leaving the rest of the yaml intact.
+ * (#6 by @qichuang321.)
+ * @returns every package now allowed.
+ */
+export function setAllowBuilds(profile: string, packages: string[]): string[] {
+  const file = join(profileDir(profile), 'pnpm-workspace.yaml')
+  let yaml = ''
+  try { yaml = readFileSync(file, 'utf8') } catch { /* created below */ }
+  const blockRe = /allowBuilds:\n((?:[ \t]+[^\n]*\n?)*)/
+  const map: Record<string, string> = {}
+  const blockMatch = blockRe.exec(yaml)
+  if (blockMatch !== null) {
+    for (const line of blockMatch[1].split('\n')) {
+      const m = /^[ \t]+([^:\s]+(?:\/[^:\s]+)?)\s*:\s*(\S.*)?$/.exec(line)
+      if (m !== null) map[m[1]] = m[2] ?? 'true'
+    }
+  }
+  for (const pkg of packages) {
+    if (/^[A-Za-z0-9@/_.-]+$/.test(pkg)) map[pkg] = 'true'
+  }
+  const block = Object.entries(map).map(([k, v]) => `  ${k}: ${v}`).join('\n')
+  const blockText = `allowBuilds:\n${block}\n`
+  writeFileSync(file, blockMatch !== null ? yaml.replace(blockRe, blockText) : `${yaml.replace(/\n?$/, '\n')}${blockText}`)
+  return Object.keys(map)
+}