terminal-bridge-setup 3.3.2 → 3.3.4

package/bin/setup.mjs

@@ -126,23 +126,38 @@ function installProxyDeps() {
   // 支持 --registry 透传（国内网络/公司内网常用）
   // 用法：npx terminal-bridge-setup --registry=https://registry.npmmirror.com
   const registryArg = process.argv.find(a => a.startsWith("--registry="));
-  const npmArgs = ["install", "--no-audit", "--no-fund"];
+  const baseArgs = ["install", "--no-audit", "--no-fund"];
+  const runNpm = (args) => {
+    // Windows 的 npm 是 npm.cmd 批处理，spawn 不带 shell 无法启动
+    // （表现为"运行 npm install ..."后无任何输出直接失败，实测踩过）。
+    // shell:true 下走 cmd 解析；registry 参数先过白名单校验防 shell 注入。
+    const safeArgs = args.filter(a =>
+      !a.startsWith("--registry=") || /^--registry=https?:\/\/[\w.\-/:]+$/.test(a));
+    console.log(c.dim(`  运行 npm ${safeArgs.join(" ")} ...`));
+    return spawnSync("npm", safeArgs, { cwd: proxyDir, stdio: "inherit", shell: true });
+  };
+
+  let result;
   if (registryArg) {
-    npmArgs.push(registryArg);
     console.log(c.dim(`  使用 registry: ${registryArg.split("=")[1]}`));
+    result = runNpm([...baseArgs, registryArg]);
   } else {
-    npmArgs.push("--silent");
+    // 不加 --silent：私有源缺包/认证失败等真实错误必须可见，不能吞掉
+    result = runNpm(baseArgs);
+    if (result.status !== 0) {
+      // 内网镜像未同步/缺包是高频原因（verdaccio 同步延迟实测踩过），
+      // 自动用官方源兜底重试一次再判失败
+      console.log(c.yellow("  默认 registry 安装失败，用官方源 npmjs.org 重试..."));
+      result = runNpm([...baseArgs, "--registry=https://registry.npmjs.org"]);
+    }
   }
 
-  console.log(c.dim("  运行 npm install ..."));
-  const result = spawnSync("npm", npmArgs, {
-    cwd: proxyDir,
-    stdio: "inherit",
-  });
-
-  if (result.status !== 0) {
-    // 失败时给出明确的排查建议
-    console.error("");
+  if (result.status !== 0 || result.error) {
+    if (result.error) {
+      console.error(c.red("  ✗ 无法启动 npm：" + result.error.message));
+      console.error(c.yellow(`  手动修复：cd "${join(INSTALL_DIR, "proxy")}" && npm install`));
+      fail("npm 无法启动");
+    }
     console.error(c.red("  ✗ npm install 失败"));
     console.error(c.yellow("  常见原因和解决方法："));
     console.error("");

package/files/extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "JumpServer 终端桥接",
-  "version": "3.3.2",
+  "version": "3.3.4",
   "description": "终端桥接：JumpServer / Arthas / Yearning，让 Agent 能通过浏览器执行命令、收结果与查数据",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtsnqR6PcFUueZwYria79tVbstvjk+tM7PpvIXILm5xbd6bAdjDIhzg3lsnKioVfvxjfvT+s6vJsiOYa9ojVZyJMFc5m/05TYqr770ovYwQmz0e88fmiy6dUoSulbtKvBCSLbN6OOL7u+ul8ixLZ/HautxSmou/eNgAFPmhE+4UueE7wfCqcgMYvjLvEzlqTVumMW+5LKw9YsRk6WhHPghY1a3MVUn3eQOWXBtQTEUy3wBM3v4wHxLwDeinVOR4f/P87IlUNo84C5DeimoFit0qCj3K04hS8MIYCLCYZc3v9ftRJDJBkAoah6Eaqj7JajbS3KvLR1ctOYfDhubgmURQIDAQAB",
   "permissions": ["debugger", "tabs", "alarms", "webNavigation", "nativeMessaging", "scripting", "downloads", "storage"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "terminal-bridge-setup",
-  "version": "3.3.2",
+  "version": "3.3.4",
   "description": "一次性安装器：释放终端桥接（JumpServer / Arthas / Yearning）的本地代理 + Chrome 插件，并注册 native messaging host。让 Agent 能通过浏览器 xterm 终端执行命令并拿回输出。",
   "license": "MIT",
   "author": "encorearon",