source-code-mgmt 1.11.0 → 1.14.0

package/lib/index.js

@@ -25,10 +25,62 @@ import { join, dirname } from 'node:path'
 import { homedir } from 'node:os'
 
 import { AsyncLocalStorage } from 'node:async_hooks'
+import { fileURLToPath } from 'node:url'
 
 // ---------- i18n: host messages follow the client’s language (?lang= query param, per request) ----------
 const HOST_EN = {"尚未配置 Gitee 私人令牌（请打开 ③ 代码管理输入令牌）":"No Gitee personal token configured (enter one in ③ Code Management)","Gitee API 请求失败（需要 curl）":"Gitee API request failed (curl required)","not a git repository（尚未 git init，可用「新建仓库并推送」初始化为 git 仓库并上传）":"not a git repository (run \"Create repo & push\" to init one and upload)","超过 GitHub 100MB 单文件限制（${}），已被 .gitignore 的 \"${}\" 排除":"Exceeds GitHub's 100MB file limit (${}) — already excluded by .gitignore entry \"${}\"","超过 GitHub 100MB 单文件限制（${}），${} 所在的一级目录「${}」整体忽略（该文件夹为一整体）":"Exceeds GitHub's 100MB file limit (${}) — the whole first-level folder \"${}\" of ${} is ignored (the folder is one unit)","超过 GitHub 100MB 单文件限制（${}），已忽略单个文件「${}」":"Exceeds GitHub's 100MB file limit (${}) — the file \"${}\" was ignored individually","尚未配置远程仓库 origin，请使用「新建仓库」创建远程仓库。":"No origin remote configured — use \"Create repo\" to create a remote repo.","not a git repository（尚未 git init，无法拉取）":"not a git repository (no git init yet — cannot pull)","尚未配置远程仓库 origin，无法拉取。":"No origin remote configured — cannot pull.","拉取存在冲突：本地有未合并改动或与远程冲突，请手动 git pull 处理合并。":"Pull conflicts: you have unmerged local changes or conflicts with the remote — resolve them manually with git pull.","git pull 失败":"git pull failed","not a git repository（尚未 git init）":"not a git repository (run git init first)","拉取并推送失败：合并存在冲突，请手动解决后重试。":"Pull-and-push failed: merge conflicts — resolve them manually and retry.","pull --rebase 失败":"pull --rebase failed","push 失败":"push failed","push --force 失败":"push --force failed","强制拉取存在冲突，请手动处理。":"Force-pull conflicts — handle them manually.","git pull --force 失败":"git pull --force failed","缺少仓库名称":"Repo name required","仓库名称包含非法字符（仅允许字母、数字、点、下划线、横线）":"Repo name contains invalid characters (only letters, digits, dots, underscores, dashes)","git add 失败：${}":"git add failed: ${}","需要先配置 Gitee 私人令牌":"Configure the Gitee personal token first","Gitee 创建仓库失败":"Failed to create the Gitee repo","缺少文件路径":"File path required","无法识别当前分支":"Cannot determine the current branch","尚未配置远程仓库 origin，无法对齐。":"No origin remote configured — cannot align.","git fetch 失败":"git fetch failed","git reset --hard 失败":"git reset --hard failed","git init 失败":"git init failed","git add 失败":"git add failed","git reset 失败":"git reset failed","提交信息不能为空":"Commit message cannot be empty","没有已暂存（staged）的改动可提交":"Nothing staged to commit","git commit 失败":"git commit failed","缺少分支名":"Branch name required","切换分支失败":"Failed to switch branch","git log 失败":"git log failed","缺少 commit hash":"Commit hash required","revert 失败（可能有冲突，请手动处理）":"revert failed (possible conflicts — handle manually)","cherry-pick 失败（可能有冲突，请手动处理）":"cherry-pick failed (possible conflicts — handle manually)","读取提交 diff 失败":"Failed to read the commit diff","未知工具：":"Unknown tool: ","未找到可用的包管理器（":"No usable package manager found (","）。请手动安装。":"). Please install manually.","安装成功":"Installed successfully","安装失败":"Installation failed","$dlg.Description = '选择本地目录';":"$dlg.Description = 'Choose a local folder';","Gitee 修改可见性失败":"Failed to change Gitee visibility","需要先登录 GitHub CLI（gh）":"Log in to the GitHub CLI (gh) first","修改可见性失败：${}":"Failed to change visibility: ${}","gh repo edit 失败":"gh repo edit failed","缺少目录路径":"Folder path required","未选择目录":"No folder selected","目录不存在或不是文件夹：":"Folder does not exist or is not a directory: ","令牌不能为空":"Token cannot be empty","Gitee 令牌无效，请检查（需有 projects 权限）":"Invalid Gitee token — check it (needs projects permission)"};
 const requestLangStore = new AsyncLocalStorage();
+// 新增板块（④克隆 / ⑤npm）的 host 英文消息，追加进 HOST_EN。
+Object.assign(HOST_EN, {
+  "LLM 服务不可用（未加载 llm 服务）": "LLM service unavailable (llm service not loaded)",
+  "未找到默认模型配置（agent-default-model）": "No default model config found (agent-default-model)",
+  "目标目录不存在：": "Target directory does not exist: ",
+  "已存在同名目录：": "A directory with that name already exists: ",
+  "git clone 失败": "git clone failed",
+  "无法识别仓库地址：": "Cannot parse repo URL: ",
+  "没有可用的 PR 步骤（请先让 AI 分析规则）": "No PR steps available (run AI rule analysis first)",
+  "确保 fork": "Ensure fork",
+  "已 fork 或 fork 已存在": "Forked already, or fork exists",
+  "克隆 fork": "Clone fork",
+  "已存在本地副本：": "Local copy already exists: ",
+  "已克隆到 ": "Cloned to ",
+  "克隆 fork 失败": "Failed to clone fork",
+  "添加上游": "Add upstream",
+  "拉取上游": "Fetch upstream",
+  "拉取失败": "Fetch failed",
+  "新建分支": "Create branch",
+  "创建分支失败": "Failed to create branch",
+  "写入条目": "Write entry",
+  "缺少条目文件路径": "Missing entry file path",
+  "重生成 README": "Regenerate README",
+  "无命令，跳过": "No command, skipped",
+  "执行失败": "Command failed",
+  "提交": "Commit",
+  "推送": "Push",
+  "创建 PR": "Create PR",
+  "创建 PR 失败": "Failed to create PR",
+  "未知步骤": "Unknown step",
+  "未知步骤类型": "Unknown step type",
+  "缺少仓库地址": "Repo URL required",
+  "未登录 npm": "Not logged in to npm",
+  "npm publish 已执行": "npm publish executed",
+  "npm publish 失败": "npm publish failed",
+  "已提交": "Committed",
+  "已创建 PR": "PR created",
+  "推送上游失败": "Failed to push",
+  "AI 未输出有效规则": "AI produced no valid rules",
+  "AI 输出无法解析": "AI output could not be parsed",
+  "推送失败": "Push failed",
+  "条目文件路径不安全（已拦截）": "Entry file path unsafe (blocked)",
+  "重生成命令不安全（已拦截）": "Regenerate command unsafe (blocked)",
+  "创建分支失败（上游分支可能不存在，请检查规则 baseBranch）": "Failed to create branch (upstream base may not exist — check the rule's baseBranch)",
+  "已打开终端窗口，请完成 npm login 后回到面板点「重新检查」": "A terminal window has been opened — complete npm login, then click \"Re-check\" in the panel",
+  "未找到可用终端，请手动在目标目录运行：": "No usable terminal found — run this manually in the target directory: ",
+  "规则文件获取失败：": "Failed to fetch rules file: ",
+  "规则文件读取失败：": "Failed to read rules file: ",
+  "找不到规则文件：": "Rules file not found: ",
+  "未获取到规则内容（文件为空或无法读取）": "Could not read any rule content (file empty or unreadable)",
+})
 function langOf(req) { try { const l = new URL(req.url ?? "", "http://localhost").searchParams.get("lang"); return l === "en" ? "en" : "zh" } catch { return "zh" } }
 function lang() { return requestLangStore.getStore() ?? "zh" }
 function tr(key, params) {
@@ -83,6 +135,8 @@ const SSH = resolveBin('ssh', 'DSH_SCM_SSH')
 const SSH_KEYGEN = resolveBin('ssh-keygen', 'DSH_SCM_SSH_KEYGEN')
 /** Resolved path to curl (used to call the Gitee OpenAPI). */
 const CURL = resolveBin('curl', 'DSH_SCM_CURL')
+/** Resolved path to npm (used by the ⑤ publish-npm section). */
+const NPM = resolveBin('npm', 'DSH_SCM_NPM')
 
 /**
  * Preferred ssh for git remote operations (injected via GIT_SSH).
@@ -305,8 +359,13 @@ function run(cmd, args, opts = {}) {
   // `-c core.quotepath=false` 让 git 直接输出原始 UTF-8 路径，Node 以 utf8
   // 解码后即得到正确的中文文件名（git diff / git show 头部路径也一并修复）。
   const finalArgs = cmd === GIT ? ['-c', 'core.quotepath=false', ...args] : args
+  // Windows + shell 模式：execFileSync 把 cmd 与参数拼成一条命令行交给 cmd.exe。
+  // 若可执行文件路径含空格（如 "C:\Program Files\nodejs\npm.cmd"），不引号包裹会
+  // 被截断成 "'C:\Program' 不是内部命令"。这里只包裹可执行文件本身（参数保持数组，
+  // 由 execFileSync 逐个安全拼接），不触碰用户输入，无注入面。
+  const execCmd = (opts.shell && IS_WIN && /\s/.test(cmd)) ? '"' + cmd + '"' : cmd
   try {
-    const out = execFileSync(cmd, finalArgs, {
+    const out = execFileSync(execCmd, finalArgs, {
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'pipe'],
       timeout: opts.timeout ?? 30_000,
@@ -1799,6 +1858,326 @@ function installToolFlow(tool) {
   }
 }
 
+// ---------------------------------------------------------------------------
+// ④ 克隆远程仓库 / ⑤ 发布 npm 包 —— host 逻辑
+// ---------------------------------------------------------------------------
+
+// ---------- LLM 辅助：用 DSH 的 llm 服务 + 默认模型（当前对话/默认模型） ----------
+
+/**
+ * 读取 DSH 默认模型配置（agent-default-model）。优先走 settings 服务（ctx.settings
+ * 在 host 侧同进程可用），拿不到时兜底解析 ~/.dsh/settings.yaml 的该段。
+ * @returns {{provider: string, model: string}|undefined}
+ */
+function resolveDefaultModel(ctx) {
+  try {
+    if (ctx && typeof ctx.get === 'function') {
+      const settings = ctx.get('settings')
+      if (settings && typeof settings.get === 'function') {
+        const v = settings.get('agent-default-model')
+        if (v && typeof v === 'object' && typeof v.provider === 'string' && v.provider && typeof v.model === 'string' && v.model) {
+          return { provider: v.provider, model: v.model }
+        }
+      }
+    }
+  } catch { /* fall through */ }
+  try {
+    const file = join(homedir(), '.dsh', 'settings.yaml')
+    if (existsSync(file)) {
+      const raw = readFileSync(file, 'utf8')
+      // 捕获 `agent-default-model:` 后所有缩进（开头空白）的连续行，直到下一个顶格键。
+      const m = /^\s*agent-default-model\s*:\s*\n((?:[ \t]+[^\n]*(?:\n|$))*)/m.exec(raw)
+      if (m) {
+        const block = m[1]
+        const prov = /^\s*provider\s*:\s*"?([^\s"#]+)"?/m.exec(block)
+        const mod = /^\s*model\s*:\s*"?([^\s"#]+)"?/m.exec(block)
+        if (prov && mod) return { provider: prov[1], model: mod[1] }
+      }
+    }
+  } catch { /* ignore */ }
+  return undefined
+}
+
+/**
+ * 调用 DSH 的 LLM（默认模型），收集完整文本。messages 传 { role: 'user'|'assistant', text } 简写。
+ * @param {*} ctx - cordis context（apply 注入）。
+ * @param {{system?: string, messages: Array<{role:string,text:string}>, maxTokens?: number, temperature?: number}} opts
+ * @returns {Promise<{ok:boolean, text?:string, provider?:string, model?:string, error?:string}>}
+ */
+async function llmComplete(ctx, opts) {
+  let llm = null
+  try {
+    if (ctx && typeof ctx.get === 'function') llm = ctx.get('llm')
+    if (!llm && ctx && ctx.llm) llm = ctx.llm
+  } catch { llm = null }
+  if (!llm || typeof llm.stream !== 'function') {
+    return { ok: false, error: tr('LLM 服务不可用（未加载 llm 服务）') }
+  }
+  const cfg = resolveDefaultModel(ctx)
+  if (!cfg) return { ok: false, error: tr('未找到默认模型配置（agent-default-model）') }
+  const blocks = (Array.isArray(opts.messages) ? opts.messages : []).map((m) => ({
+    role: m.role === 'assistant' ? 'assistant' : 'user',
+    content: [{ type: 'text', text: String(m.text ?? '') }],
+  }))
+  if (blocks.length === 0) blocks.push({ role: 'user', content: [{ type: 'text', text: '' }] })
+  const chunks = []
+  try {
+    const stream = llm.stream({
+      provider: cfg.provider,
+      model: cfg.model,
+      system: opts.system ? String(opts.system) : undefined,
+      messages: blocks,
+      maxTokens: opts.maxTokens ?? 2048,
+      temperature: opts.temperature ?? 0.6,
+    })
+    for await (const chunk of stream) {
+      if (chunk && chunk.type === 'text-delta') chunks.push(chunk.text)
+    }
+  } catch (e) {
+    return { ok: false, error: String((e && e.message) || e) }
+  }
+  return { ok: true, text: chunks.join(''), provider: cfg.provider, model: cfg.model }
+}
+
+// ---------- ④ 克隆远程仓库（Clone） ----------
+
+/** 用户 home 目录（④ 克隆默认位置：Windows=C:\Users\xxx，Linux/macOS=/home/xxx）。 */
+function cloneHomeDir() {
+  return homedir()
+}
+
+/** 默认克隆位置（⑤ 等板块的工作目录兜底）：DSH 默认工作区。 */
+function cloneDefaultDir() {
+  return resolveDefaultDir(process.cwd())
+}
+
+
+/** 某仓库名在 baseDir 下是否已有同名 git 仓库（含 baseDir 本身就是同名仓库的情形，
+ *  如工作区 C:\Users\xxx\workspace 即对应仓库 workspace）。 */
+function localRepoExists(baseDir, name) {
+  try {
+    if (!baseDir || !name) return false
+    // baseDir/<name>/.git 存在
+    if (existsSync(join(baseDir, name)) && existsSync(join(baseDir, name, '.git'))) return true
+    // baseDir 本身就是同名仓库
+    if (baseName(baseDir) === name && existsSync(join(baseDir, '.git'))) return true
+    return false
+  } catch { return false }
+}
+
+/**
+ * 判断仓库在「当前选中的克隆目录」或「任何已登记的工作区/自定义目录」下是否已存在。
+ * 用于 ④ 克隆仓库的「本地已有」标记：不遍历全盘，只查 ③代码管理登记过的目录——
+ * 用户若把克隆目录选到其他（已登记）位置，那里的同名仓库同样算「本地已有」。
+ * @param {string} name - 仓库名
+ * @param {string} [chosenDir] - 当前下拉选中的克隆目标目录（可为空）
+ */
+function localRepoExistsAnywhere(name, chosenDir) {
+  try {
+    if (!name) return false
+    if (localRepoExists(String(chosenDir || '').trim(), name)) return true
+    for (const dir of listWorkspaces()) {
+      if (localRepoExists(dir, name)) return true
+    }
+    return false
+  } catch { return false }
+}
+
+/**
+ * 列出已登录账号（GitHub / Gitee）的所有远程仓库，并标记本地是否已存在。
+ * @param {string} [provider] - 'github' (default) | 'gitee'
+ * @param {string} [baseDir] - 用于「本地是否已有」判定的目录（默认克隆位置）。
+ */
+async function listRemoteRepos(provider, baseDir) {
+  const p = provider === 'gitee' ? 'gitee' : 'github'
+  const base = baseDir || cloneDefaultDir()
+  if (p === 'gitee') {
+    const owner = giteeOwner()
+    if (!owner) return { ok: true, provider: 'gitee', owner: undefined, repos: [], error: tr('需要先配置 Gitee 私人令牌') }
+    // 分页拉取账号下所有仓库（每页 100，避免 20/页的默认截断遗漏）。
+    const allRepos = []
+    let page = 1
+    while (page <= 10) {
+      const api = giteeApi('GET', 'user/repos?per_page=100&page=' + page)
+      if (!api.ok) {
+        if (allRepos.length === 0) {
+          return { ok: true, provider: 'gitee', owner, repos: [], error: api.error || tr('Gitee API 请求失败（需要 curl）') }
+        }
+        break
+      }
+      if (!Array.isArray(api.data)) break
+      allRepos.push(...api.data)
+      if (api.data.length < 100) break
+      page++
+    }
+    const repos = allRepos.map((r) => ({
+      name: String(r.name || ''),
+      fullName: String(r.full_name || ''),
+      owner,
+      visibility: r.private === true ? 'private' : (r.private === false ? 'public' : undefined),
+      description: typeof r.description === 'string' ? r.description : undefined,
+      sshUrl: typeof r.ssh_url === 'string' ? r.ssh_url : undefined,
+      htmlUrl: typeof r.html_url === 'string' ? r.html_url : undefined,
+      local: localRepoExistsAnywhere(String(r.name || ''), base),
+    }))
+    return { ok: true, provider: 'gitee', owner, repos }
+  }
+  const owner = ghOwner()
+  if (!owner) return { ok: true, provider: 'github', owner: undefined, repos: [], error: tr('需要先登录 GitHub CLI（gh）') }
+  const r = run(GH, ['repo', 'list', owner, '--limit', '1000', '--json', 'name,owner,visibility,description,updatedAt,sshUrl'], { timeout: 60_000 })
+  let parsed = []
+  if (r.ok) {
+    try {
+      const arr = JSON.parse(r.stdout)
+      if (Array.isArray(arr)) {
+        parsed = arr.map((x) => ({
+          name: String(x.name || ''),
+          fullName: String((x.owner && x.owner.login ? x.owner.login + '/' : '') + (x.name || '')),
+          owner: x.owner && x.owner.login,
+          visibility: String(x.visibility || 'private').toLowerCase(),
+          description: typeof x.description === 'string' ? x.description : undefined,
+          sshUrl: typeof x.sshUrl === 'string' ? x.sshUrl : `git@github.com:${owner}/${x.name}.git`,
+          htmlUrl: `https://github.com/${owner}/${x.name}`,
+          updatedAt: typeof x.updatedAt === 'string' ? x.updatedAt : undefined,
+        }))
+      }
+    } catch { /* ignore */ }
+  }
+  return { ok: true, provider: 'github', owner, repos: parsed.map((x) => ({ ...x, local: localRepoExistsAnywhere(x.name, base) })) }
+}
+
+/**
+ * 执行 git clone：克隆到 dest（默认=默认工作区）下的 <name> 目录。成功后加入自定义目录列表。
+ * @param {string} url - 远程仓库 URL（SSH 或 HTTPS）。
+ * @param {string} [dest] - 目标父目录，空=默认克隆位置。
+ * @param {string} [name] - 本地目录名，空=从 URL 推导。
+ */
+function cloneFlow(url, dest, name) {
+  const target = String(dest || '').trim() || cloneDefaultDir()
+  const repoName = String(name || '').trim()
+  const full = repoName ? join(target, repoName) : ''
+  if (!repoName) return { ok: false, error: tr('缺少仓库名称') }
+  if (!existsSync(target) || !statSync(target).isDirectory()) {
+    return { ok: false, error: tr('目标目录不存在：') + target }
+  }
+  if (existsSync(full)) {
+    return { ok: false, error: tr('已存在同名目录：') + full }
+  }
+  const r = run(GIT, ['clone', String(url || '').trim(), full], { timeout: 600_000, env: { GIT_SSH: WORKING_SSH } })
+  if (!r.ok) {
+    return { ok: false, error: (r.stderr || r.stdout || '').trim() || tr('git clone 失败') }
+  }
+  saveCustomDir(full)
+  return { ok: true, dir: full, name: repoName }
+}
+
+
+// ---------- ⑤ 发布 npm 包（npm publish） ----------
+
+/** npm 状态：是否安装、registry、whoami、目标目录是否存在 package.json。 */
+function npmStatus(dir) {
+  const npm = NPM
+  const cwd = String(dir || '').trim() || cloneDefaultDir()
+  const installed = npm !== 'npm' && npm !== 'npm.cmd'
+  const registry = run(npm, ['config', 'get', 'registry'], { shell: IS_WIN })
+  const whoami = run(npm, ['whoami'], { shell: IS_WIN })
+  return {
+    ok: true,
+    installed,
+    npmPath: npm,
+    dir: cwd,
+    dirExists: existsSync(cwd),
+    hasPackageJson: existsSync(join(cwd, 'package.json')),
+    registry: registry.ok ? registry.stdout.trim() : undefined,
+    whoami: whoami.ok ? whoami.stdout.trim() : undefined,
+    whoamiError: whoami.ok ? undefined : ((whoami.stderr || whoami.stdout || '').trim() || tr('未登录 npm')),
+  }
+}
+
+/**
+ * 打开一个终端窗口，在目标目录运行 `npm login`（交互式登录无法非交互执行，
+ * 需要用户在弹出的终端里完成）。Windows 用 `start cmd /k`；macOS/Linux 探测常见终端。
+ * @param {string} [dir] - 目标目录。
+ * @returns {{ok:boolean, opened:boolean, command:string, detail:string}}
+ */
+function npmLoginTerminal(dir) {
+  const cwd = String(dir || '').trim() || cloneDefaultDir()
+  const command = 'npm login'
+  const cdCmd = IS_WIN
+    ? `cd /d "${cwd}" && ${command}`
+    : `cd "${cwd}" && ${command}`
+  try {
+    if (IS_WIN) {
+      // start cmd /k 打开独立窗口（第一引号段是窗口标题）；detached 不阻塞宿主。
+      const child = spawn('cmd', ['/c', 'start', '"npm-login"', 'cmd', '/k', cdCmd], { detached: true, stdio: 'ignore', windowsHide: false })
+      child.unref()
+      return { ok: true, opened: true, command, detail: tr('已打开终端窗口，请完成 npm login 后回到面板点「重新检查」') }
+    }
+    const terms = [
+      ['x-terminal-emulator', ['-e', 'sh', '-c', cdCmd]],
+      ['gnome-terminal', ['--', 'sh', '-c', cdCmd]],
+      ['konsole', ['-e', 'sh', '-c', cdCmd]],
+      ['xterm', ['-e', 'sh', '-c', cdCmd]],
+    ]
+    for (const [bin, args] of terms) {
+      try {
+        const child = spawn(bin, args, { detached: true, stdio: 'ignore' })
+        child.unref()
+        return { ok: true, opened: true, command, detail: tr('已打开终端窗口，请完成 npm login 后回到面板点「重新检查」') }
+      } catch { /* try next terminal */ }
+    }
+    return { ok: false, opened: false, command, detail: tr('未找到可用终端，请手动在目标目录运行：') + command }
+  } catch (e) {
+    return { ok: false, opened: false, command, detail: String((e && e.message) || e) }
+  }
+}
+
+/** 脱敏 npm config list 输出：隐藏 token / auth 等敏感值。 */
+function redactNpmList(output) {
+  return String(output || '').split(/\r?\n/).map((line) => {
+    if (/(token|_auth|authtoken|password|\bauth\b)/i.test(line)) {
+      return line.replace(/=.*$/, '=[REDACTED]')
+    }
+    return line
+  }).join('\n')
+}
+
+/**
+ * 执行 npm 流程的一步（registry / list / whoami / pack / publish）。
+ * @param {string} [dir] - 目标目录（package.json 所在处）。
+ * @param {string} step - 'registry'|'list'|'whoami'|'pack'|'publish'。
+ */
+function npmRunStep(dir, step) {
+  const npm = NPM
+  const cwd = String(dir || '').trim() || cloneDefaultDir()
+  const runNpm = (args, timeout) => run(npm, args, { shell: IS_WIN, cwd, timeout: timeout ?? 60_000 })
+  switch (step) {
+    case 'registry': {
+      const r = runNpm(['config', 'get', 'registry'])
+      return { ok: true, step, output: r.ok ? r.stdout.trim() : ((r.stderr || '') + (r.stdout || '')).trim() }
+    }
+    case 'list': {
+      const r = runNpm(['config', 'list'])
+      return { ok: true, step, output: redactNpmList((r.stdout || '') + (r.stderr || '')) }
+    }
+    case 'whoami': {
+      const r = runNpm(['whoami'])
+      return { ok: true, step, output: r.ok ? r.stdout.trim() : ((r.stderr || r.stdout || '').trim() || tr('未登录 npm')), loggedIn: r.ok }
+    }
+    case 'pack': {
+      const r = runNpm(['pack', '--dry-run'], 120_000)
+      return { ok: true, step, output: (r.stdout || '') + (r.stderr || '') }
+    }
+    case 'publish': {
+      const r = runNpm(['publish'], 180_000)
+      const blob = ((r.stdout || '') + (r.stderr || '')).trim()
+      return { ok: r.ok, step, output: blob || tr('npm publish 已执行'), error: r.ok ? undefined : (blob || tr('npm publish 失败')) }
+    }
+    default:
+      return { ok: false, step, output: tr('未知步骤') }
+  }
+}
+
 // ---------- route handlers ----------
 
 function json(res, status, payload) {
@@ -2379,6 +2758,57 @@ export function apply(ctx) {
         return methodNotAllowed(res, req.method)
       }
     },
+
+    // ---- ④ 克隆远程仓库 ----
+    // 默认工作区（⑤ 等板块兜底）。
+    '/clone/default-dir': (req, res) => handle(req, res, async () => {
+      const dir = cloneDefaultDir()
+      return { ok: true, dir, name: baseName(dir) }
+    }),
+    // home 目录（④ 克隆默认：Windows C:\Users\xxx，Linux/macOS /home/xxx）。
+    '/clone/home': (req, res) => handle(req, res, async () => {
+      const dir = cloneHomeDir()
+      return { ok: true, dir, name: baseName(dir) }
+    }),
+    '/clone/repos': async (req, res) => {
+      if (req.method !== 'GET') return methodNotAllowed(res, req.method)
+      await handle(req, res, async (req) => {
+        const q = new URL(req.url ?? '', 'http://localhost')
+        const provider = q.searchParams.get('provider') || 'github'
+        const baseDir = q.searchParams.get('dir') || cloneHomeDir()
+        return listRemoteRepos(provider, baseDir)
+      })
+    },
+    '/clone/run': async (req, res) => {
+      if (req.method !== 'POST') return methodNotAllowed(res, req.method)
+      await handle(req, res, async (req) => {
+        const body = JSON.parse((await readBody(req)) || '{}')
+        return cloneFlow(body.url, body.dest, body.name)
+      })
+    },
+
+    // ---- ⑤ 发布 npm 包 ----
+    '/npm/status': async (req, res) => {
+      if (req.method !== 'GET') return methodNotAllowed(res, req.method)
+      await handle(req, res, async (req) => {
+        const q = new URL(req.url ?? '', 'http://localhost')
+        return npmStatus(q.searchParams.get('dir') || '')
+      })
+    },
+    '/npm/login': async (req, res) => {
+      if (req.method !== 'POST') return methodNotAllowed(res, req.method)
+      await handle(req, res, async (req) => {
+        const body = JSON.parse((await readBody(req)) || '{}')
+        return npmLoginTerminal(body.dir)
+      })
+    },
+    '/npm/step': async (req, res) => {
+      if (req.method !== 'POST') return methodNotAllowed(res, req.method)
+      await handle(req, res, async (req) => {
+        const body = JSON.parse((await readBody(req)) || '{}')
+        return npmRunStep(body.dir, body.step)
+      })
+    },
   }
 
   ctx.effect(() => {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "source-code-mgmt",
-  "version": "1.11.0",
-  "description": "DSH plugin: source code management. Registers「代码管理」as a dsh-better-sidebar sidebar Tab when installed, otherwise a button in the DSH session header's right-aligned utilities (beside \"Session log\") opening a right-side integrated panel that pushes the main content — env checks (git/gh), SSH ed25519 key setup, GitHub/Gitee dual-platform (SSH config 443 + Gitee OpenAPI), connectivity test, push / new repo, and auto-ignore files over 100MB with per-file skipped reasons. Cross-platform (Windows / Linux / macOS).",
+  "version": "1.14.0",
+  "description": "DSH plugin: source code management. Registers「代码管理」as a dsh-better-sidebar sidebar Tab when installed, otherwise a button in the DSH session header's right-aligned utilities (beside \"Session log\") opening a right-side integrated panel that pushes the main content — env checks (git/gh), SSH ed25519 key setup, GitHub/Gitee dual-platform (SSH config 443 + Gitee OpenAPI), connectivity test, push / new repo, auto-ignore files over 100MB with per-file skipped reasons, a clone section (remote repos from your account with local-exists detection, plus clone any repo by URL into any location), and a five-step npm publish wizard. Cross-platform (Windows / Linux / macOS).",
   "type": "module",
   "main": "lib/index.js",
   "exports": {