dshmarket 1.72.0 → 1.72.1

package/lib/profile.js

@@ -1491,6 +1491,11 @@ export function setAllowBuilds(profile, packages, explicitDir) {
     const SEG = '[A-Za-z0-9_-][A-Za-z0-9_.-]*';
     const NAME = '[A-Za-z0-9@/_.-]+';
     const SHA = '[0-9a-f]{40}';
+    // A dependency pnpm resolved from a BRANCH keys its decision by the ref,
+    // not by a commit: `name@https://codeload.github.com/o/r/tar.gz/refs/heads/main`
+    // (#1034). The ref is path segments only — no `.`/`..`, no empty piece —
+    // so it cannot walk out of the URL it is written into.
+    const REF = `refs/(?:heads|tags)/${SEG}(?:/${SEG})*`;
     // pnpm's exact monorepo key includes the selected directory; dropping it
     // makes approve-and-retry write only a bare name that git builds ignore.
     const DIR = '(?!\\.{1,2}(?:/|$))[A-Za-z0-9_.-]+';
@@ -1512,9 +1517,9 @@ export function setAllowBuilds(profile, packages, explicitDir) {
     // gitlab.com and bitbucket.org (#637). Each branch names its host and its
     // exact path shape.
     const ARCHIVE_KEY_RE = new RegExp(`^${NAME}@https://(?:`
-        + `codeload\\.github\\.com/${SEG}/${SEG}/tar\\.gz/${SHA}`
-        + `|bitbucket\\.org/${SEG}/${SEG}/get/${SHA}\\.tar\\.gz`
-        + `|gitlab\\.com/${SEG}(?:/${SEG})+/-/archive/${SHA}/${SEG}-${SHA}\\.tar\\.gz`
+        + `codeload\\.github\\.com/${SEG}/${SEG}/tar\\.gz/(?:${SHA}|${REF})`
+        + `|bitbucket\\.org/${SEG}/${SEG}/get/(?:${SHA}|${REF})\\.tar\\.gz`
+        + `|gitlab\\.com/${SEG}(?:/${SEG})+/-/archive/(?:${SHA}|${REF})/${SEG}-(?:${SHA}|${REF})\\.tar\\.gz`
         + `)(?:#${SUBPATH})?$`);
     for (const pkg of packages) {
         if (/^[A-Za-z0-9@/_.-]+$/.test(pkg) || GIT_KEY_RE.test(pkg) || ARCHIVE_KEY_RE.test(pkg))

package/lib/routes.js

@@ -6923,7 +6923,13 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                                             // where the button is not (#314). The panel now carries
                                             // the action on this very row, so the text can just say
                                             // what to press.
-                                            ? `构建脚本被 pnpm 默认拦截（${ignoredBuilds.join(', ')}），点击「放行构建脚本并重试」即可放行并重装 / build scripts are blocked by pnpm by default (${ignoredBuilds.join(', ')}); use "Allow build scripts and retry" to approve and reinstall`
+                                            // #1034: pnpm reports every undecided build in the
+                                            // workspace, not only the ones this operation needed — an
+                                            // entry left from an earlier install shows up here too, and
+                                            // saying "this install needs dsh-purge approved" was wrong
+                                            // for a plugin that never depended on it. Name them as
+                                            // decisions, with where the decision is written.
+                                            ? `pnpm 要求先决定这些依赖能否运行构建脚本（${ignoredBuilds.join(', ')}）：有的是这次安装带进来的，也可能是之前留下的未决定条目。点「放行构建脚本并重试」会把它们写进 pnpm-workspace.yaml 的 allowBuilds，然后重新安装 / pnpm wants a decision on these packages before it runs their build scripts (${ignoredBuilds.join(', ')}); some came in with this install, and some may be entries an earlier one left undecided. "Allow build scripts and retry" writes them into allowBuilds in pnpm-workspace.yaml and installs again`
                                             // Same last resort as the update route (#848), and on THIS
                                             // route too: a recognized failure like an expired
                                             // `patchedDependencies` key had no branch here either.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.72.0",
+  "version": "1.72.1",
   "icon": "assets/logo.svg",
   "type": "module",
   "main": "lib/index.js",
@@ -76,7 +76,6 @@
     "assets/logo.svg",
     "locale",
     "lib",
-    "src",
     "client",
     "UPDATE-API-V1.md",
     "cordis.patch.yml",

package/src/accelerate.ts

@@ -1,222 +0,0 @@
-/**
- * Resolving a GitHub install through a region's proxy without proxying the
- * tarball pnpm records.
- *
- * pnpm does not fetch `github:owner/repo` with `git clone`; it resolves the
- * shortcut and downloads a tarball from codeload.github.com. That rules out
- * the usual `git config insteadOf` trick — there is no git command to
- * redirect.
- *
- * Prefix-proxying that tarball used to save substantial time, but pnpm 11's
- * fail-closed lockfile checks changed the safety boundary. A URL shaped like
- * `https://proxy/https://codeload.github.com/.../<commit>` no longer has the
- * codeload hostname, so pnpm treats it as an ordinary remote tarball and
- * requires an integrity hash that its GitHub resolver does not write. The
- * result is ERR_PNPM_MISSING_TARBALL_INTEGRITY on the install itself (#385).
- * Disabling that check or minting a checksum from whatever the proxy served
- * would weaken pnpm's supply-chain protection, so neither is acceptable.
- *
- * The safe middle ground is to resolve HEAD through the regional proxy, then
- * hand pnpm a commit-pinned `github:owner/repo#<sha>` target. The ref lookup
- * still avoids a slow or unreachable GitHub metadata request; pnpm itself
- * fetches the canonical codeload URL, records it as `gitHosted: true`, and
- * keeps its integrity policy intact.
- *
- * - **The commit has to be pinned.** The profile reads each plugin's
- *   installed commit back out of the lockfile by matching a codeload URL
- *   ending in a 40-character SHA (src/profile.ts). A `HEAD` tarball installs
- *   perfectly and then reports no version forever. So this resolves the SHA
- *   first, and a rewrite that cannot get one does not happen.
- * - **Build-script approval has to keep matching.** `gitAllowBuildsKey`
- *   (src/sources.ts) derives its stable key from the repo, and the pinned
- *   GitHub form preserves that identity.
- *
- * Catalog subpath entries are left alone: `#path:` identifies a different
- * package inside the repo, so the acceleration step never rewrites that
- * fragment. Collection roots discovered after install preserve the resolved
- * commit and add their subpath as pnpm's second `&path:` selector.
- *
- * Every SHA-lookup failure falls back to the original target. Acceleration
- * is an optimisation, and an optimisation that can fail an install is a bug.
- */
-
-import { logEvent } from './log.ts'
-import { marketFetch } from './net.ts'
-import {
-  githubRoutesFor, rememberGithubRoute, routesFor, throughProxy, type GithubRoute, type Region,
-} from './regions.ts'
-
-/** A bare repo shortcut whose HEAD can be replaced by one immutable ref. */
-const BARE_GITHUB_RE = /^github:([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+)$/
-
-/**
- * How long to wait for the SHA before giving up and installing directly.
- *
- * Short on purpose: this is spent BEFORE the download starts, and the whole
- * point is to avoid a slow or unreachable direct metadata lookup. A proxy
- * that cannot answer promptly should not delay pnpm's ordinary direct path.
- */
-const RESOLVE_TIMEOUT_MS = 6000
-
-/**
- * The commit `HEAD` points at, from git's own ref advertisement.
- *
- * This is the endpoint `git clone` reads before it fetches anything, and it
- * is the right one here for two measured reasons. It is not the REST API, so
- * it does not consume the 60-requests-per-hour unauthenticated quota that a
- * user installing a handful of plugins could plausibly exhaust. And it
- * survives the proxy: over five consecutive tries from an unproxied mainland
- * connection it answered 200 in ~1.2s every time, while the REST API through
- * the same proxy returned 200, 200, then 403 — a proxy that rate-limits the
- * API path would silently drop every install back to the slow route.
- *
- * The response is git's pkt-line format, whose first ref line carries
- * `<sha> HEAD\0<capabilities>`. Read with a pattern rather than a parser:
- * one 40-character hex string followed by `HEAD` is unambiguous in this
- * payload, and a length-prefix reader would be more code to get wrong.
- *
- * The same advertisement lists every branch and tag, which is what `ref`
- * uses. A plugin installed from `github:owner/repo#publish` is not asking
- * about the default branch at all, and answering with it made the market
- * report an update forever (#446) — the two SHAs simply never match. Both
- * namespaces are searched because pnpm accepts a tag there too, branches
- * first since that is what the reports are about.
- * @param ref - branch or tag to resolve, or undefined for the default branch.
- */
-export async function headCommit(
-  repo: string,
-  proxy: string | null,
-  signal?: AbortSignal,
-  ref?: string,
-): Promise<string | null> {
-  const result = await tryHeadCommit(repo, proxy, signal, ref)
-  return result.kind === 'valid' ? result.sha : null
-}
-
-type HeadAttempt =
-  | { kind: 'valid'; sha: string | null }
-  | { kind: 'failed' }
-
-/** One route attempt, preserving valid "ref is absent" from invalid payloads. */
-async function tryHeadCommit(
-  repo: string,
-  proxy: GithubRoute,
-  signal?: AbortSignal,
-  ref?: string,
-): Promise<HeadAttempt> {
-  const base = `https://github.com/${repo}/info/refs?service=git-upload-pack`
-  try {
-    const res = await marketFetch(throughProxy(proxy, base), {
-      signal,
-      headers: { 'user-agent': 'git/2.40.0' },
-    })
-    if (!res.ok) return { kind: 'failed' }
-    const body = await res.text()
-    const contentType = (res as Response & { headers?: { get?(name: string): string | null } })
-      .headers?.get?.('content-type')?.toLowerCase() ?? ''
-    // Public mirrors often answer a failed upstream request with their own
-    // branded HTML and status 200. A git advertisement has both its service
-    // prelude and at least one advertised ref; accepting anything else would
-    // cache a route that never returned Git data in the first place.
-    if (contentType.includes('text/html')
-      || !body.includes('# service=git-upload-pack')
-      || !/[0-9a-f]{40} (?:HEAD|refs\/(?:heads|tags)\/)/u.test(body)) {
-      return { kind: 'failed' }
-    }
-    if (ref === undefined) {
-      const found = /([0-9a-f]{40}) HEAD/.exec(body)
-      return { kind: 'valid', sha: found === null ? null : found[1]! }
-    }
-    // Anchored to the ref's full name so `publish` cannot match a branch
-    // called `publish-old`, and escaped because a ref may contain regex
-    // metacharacters (`.` is legal in a branch name).
-    const quoted = ref.replace(/[.*+?^${}()|[\]\\]/gu, String.raw`\$&`)
-    for (const namespace of ['heads', 'tags']) {
-      // An annotated tag advertises two refs — the tag object and its
-      // peeled commit (`refs/tags/<ref>^{}`). pnpm resolves the tag to the
-      // peeled commit and codeload records that sha in the lockfile, so the
-      // peeled line is the one that must equal `current`; answering with
-      // the tag-object sha made annotated-tag installs report an update
-      // forever (#597). Lightweight tags have no peeled line and fall
-      // through to the direct one.
-      const peeled = new RegExp(String.raw`([0-9a-f]{40}) refs/${namespace}/${quoted}\^\{\}(?![^\s])`, 'u').exec(body)
-      if (peeled !== null) return { kind: 'valid', sha: peeled[1]! }
-      const found = new RegExp(String.raw`([0-9a-f]{40}) refs/${namespace}/${quoted}(?![^\s])`, 'u').exec(body)
-      if (found !== null) return { kind: 'valid', sha: found[1]! }
-    }
-    // The advertisement is authoritative for this repository. Asking another
-    // mirror cannot make a branch that is absent here appear.
-    return { kind: 'valid', sha: null }
-  } catch {
-    return { kind: 'failed' }
-  }
-}
-
-/** Run one candidate under its own budget, optionally linked to a caller signal. */
-async function timedHeadCommit(
-  repo: string,
-  route: GithubRoute,
-  ref?: string,
-  signal?: AbortSignal,
-): Promise<HeadAttempt> {
-  const controller = new AbortController()
-  const abort = (): void => { controller.abort() }
-  if (signal?.aborted === true) controller.abort()
-  else signal?.addEventListener('abort', abort, { once: true })
-  const timer = setTimeout(abort, RESOLVE_TIMEOUT_MS)
-  try {
-    return await tryHeadCommit(repo, route, controller.signal, ref)
-  } finally {
-    clearTimeout(timer)
-    signal?.removeEventListener('abort', abort)
-  }
-}
-
-/**
- * The current `HEAD` commit for a repo, on whichever route the region uses.
- *
- * Wraps the timeout so callers outside the install path — the build-script
- * approval below, which needs a commit-pinned key — do not each reinvent it.
- */
-export async function resolveHeadCommit(
-  repo: string,
-  region: Region,
-  env: NodeJS.ProcessEnv = process.env,
-  ref?: string,
-): Promise<string | null> {
-  for (const route of githubRoutesFor('git', region, env)) {
-    const result = await timedHeadCommit(repo, route, ref)
-    if (result.kind === 'failed') continue
-    rememberGithubRoute('git', route)
-    return result.sha
-  }
-  return null
-}
-
-/**
- * The install target to actually hand pnpm, given the region in force.
- *
- * @param target - what `installTargetFor` produced.
- * @param region - the download region.
- * @param env - environment, for the proxy override.
- * @returns a commit-pinned GitHub shortcut when one route resolves HEAD,
- *   otherwise `target` unchanged.
- */
-export async function acceleratedTarget(
-  target: string,
-  region: Region,
-  env: NodeJS.ProcessEnv = process.env,
-): Promise<string> {
-  // A plain global install lets pnpm do its ordinary GitHub resolution. A
-  // custom prefix makes even that region an accelerated one.
-  if (routesFor(region, env).githubProxy === null) return target
-  const bare = BARE_GITHUB_RE.exec(target)
-  if (bare === null) return target
-  const repo = bare[1]!
-  const sha = await resolveHeadCommit(repo, region, env)
-  if (sha === null) {
-    logEvent('info', 'region', `${repo}: could not resolve a commit through the available routes; installing directly`)
-    return target
-  }
-  return `github:${repo}#${sha}`
-}

package/src/agents.ts

@@ -1,43 +0,0 @@
-/**
- * Optional host-provided agent inventory: lets the market refuse plugin
- * mutations while a live agent is mid-turn. Mutating `node_modules` under a
- * running agent replaces files the running plugin modules may still read or
- * lazily import — the update "succeeds" while old code and new files mix.
- */
-
-export interface RunningAgentLike {
-  id?: unknown
-  status?: unknown
-}
-
-export interface AgentsServiceLike {
-  list(): RunningAgentLike[]
-}
-
-export type AgentsLookup = () => AgentsServiceLike | undefined
-
-/**
- * Ids of the host's currently running agents, or [] when the host has no
- * agents service. Only a positive `status === 'running'` blocks an update —
- * unknown statuses are treated as not running, so a future agent
- * implementation with different wording fails open (the market stays
- * usable) instead of wedging the plugin page.
- */
-export function runningAgentIds(agents: AgentsServiceLike | undefined): string[] {
-  if (agents === undefined) return []
-  let listed: RunningAgentLike[]
-  try {
-    listed = agents.list()
-  } catch {
-    // A half-disposed registry must never take the market's routes down.
-    return []
-  }
-  if (!Array.isArray(listed)) return []
-  const ids: string[] = []
-  for (const agent of listed) {
-    if (agent === null || typeof agent !== 'object' || agent.status !== 'running') continue
-    const id = typeof agent.id === 'string' && agent.id !== '' ? agent.id : 'agent'
-    if (!ids.includes(id)) ids.push(id)
-  }
-  return ids
-}