ygc-dsh-sync 1.0.1 → 1.1.0

package/lib/plugins.js

@@ -380,6 +380,42 @@ function bytesOf(file) {
   }
 }
 
+/**
+ * 从 pnpm-lock.yaml 里读出某个包**实际装到的** commit。
+ *
+ * git 依赖的 lockfile 记录长这样：
+ *   dsh-purge-community:
+ *     specifier: github:owner/repo#v1.6.97
+ *     version: https://codeload.github.com/owner/repo/tar.gz/<40 位 commit>
+ *
+ * 为什么记 commit 而不只记 tag：tag 可以移动，commit 不会。只写 tag 的话，
+ * 将来对方重打 tag，别人按清单装出来的就不是同一份代码。
+ *
+ * 读不到就返回 undefined（比如用 file:/registry 装的、或 lockfile 不在），
+ * 上层会退化成只写 ref，不编造。
+ *
+ * @param {string} name 包名
+ * @returns {string|undefined}
+ */
+export function installedGitCommit(name) {
+  let text = '';
+  try {
+    text = fs.readFileSync(path.join(profileDir(), 'pnpm-lock.yaml'), 'utf8');
+  } catch {
+    return undefined;
+  }
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const directRe = new RegExp(
+    escaped +
+      '@https:\\/\\/codeload\\.github\\.com\\/[^/]+\\/[^/]+\\/tar\\.gz\\/([0-9a-f]{40})',
+  );
+  const hit = directRe.exec(text);
+  if (hit) return hit[1];
+  const looseRe = new RegExp(escaped + ':[\\s\\S]{0,400}?tar\\.gz\\/([0-9a-f]{40})');
+  const m = looseRe.exec(text);
+  return m ? m[1] : undefined;
+}
+
 /* ------------------------------------------------------------ 来源描述 */
 
 /**
@@ -428,6 +464,9 @@ export function describeSource(plugin) {
       repo: (parsed && parsed.repo) || undefined,
       // 原始写法照录：`github:o/r#v1` 与 `git+https://…` 归一后看不出区别
       raw: spec || undefined,
+      // 实际装到的 commit：ref 是 tag 时它可以被移动，commit 不会。
+      // 读不到就留空，不编造。
+      commit: installedGitCommit(name) || undefined,
       version,
     };
   }
@@ -785,7 +824,8 @@ export function writeAggregate({ config, machineId, publishedNames, log } = {})
     if (src.type === 'npm') return `npm · ${src.spec || src.package || ''}`;
     if (src.type === 'git') {
       const ref = src.ref ? `#${src.ref}` : '';
-      return src.url ? `git · ${src.url}${ref}` : `git · ${src.raw || '-'}`;
+      const commit = src.commit ? ` @${String(src.commit).slice(0, 12)}` : '';
+      return src.url ? `git · ${src.url}${ref}${commit}` : `git · ${src.raw || '-'}`;
     }
     if (src.type === 'local') return `local · ${src.form || ''} ${src.path || ''}`.trim();
     if (src.type === 'installation') return '随桌面端安装';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ygc-dsh-sync",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "type": "module",
   "description": "DSH 同步插件：会话按工作区落地、按机器隔离的跨机备份与拉取；技能本机↔母版双向同步（含记忆插件技能优化闭环）；插件清单共享（只存清单与来源，不存源码，只能联网装）。",
   "icon": "icon.svg",
@@ -58,4 +58,4 @@
       ]
     }
   }
-}
+}

package/tools/draft-live.mjs

@@ -14,6 +14,7 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 
 const args = process.argv.slice(2);
 const has = (f) => args.includes(f);
@@ -30,8 +31,11 @@ const REPLY = val('--reply');
 const LEDGER = path.join(process.env.USERPROFILE, '.mnemon', 'skills', 'ledger.json');
 const LOCAL = path.join(process.env.USERPROFILE, '.agents', 'skills');
 
+// 优先用源码仓（YGC_SYNC_SRC），否则用已装副本里的同一份 —— 两边逐字一致。
+const PKG_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SRC_ROOT = process.env.YGC_SYNC_SRC || PKG_ROOT;
 const P = await import(
-  'file:///C:/Users/DSH/Documents/deepseek-harness/default-workspace/projects/dsh-sync-backup/lib/mnemon-pipeline.js'
+  pathToFileURL(path.join(SRC_ROOT, 'lib', 'mnemon-pipeline.js')).href
 );
 const log = (m) => console.log(m);
 

package/tools/release-local.mjs

@@ -11,10 +11,18 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
+import os from 'node:os';
 import { execFileSync } from 'node:child_process';
 
-const ROOT = 'C:/Users/DSH/Documents/deepseek-harness/default-workspace/projects/dsh-sync-backup';
-const PROFILE = 'C:/Users/DSH/.dsh/profiles/desktop';
+// 源码根与 profile 都不写死：换机器只改环境变量。
+// ROOT 指向 ygc-dsh-sync 源码仓（有 package.json 的那层）。
+const ROOT = process.env.YGC_SYNC_SRC || process.argv[2] || process.cwd();
+const PROFILE = process.env.DSH_PROFILE_DIR
+  || path.join(process.env.DSH_HOME || path.join(os.homedir(), '.dsh'), 'profiles', process.env.DSH_PROFILE || 'desktop');
+if (!fs.existsSync(path.join(ROOT, 'package.json'))) {
+  console.error('找不到源码根：' + ROOT + '（设 YGC_SYNC_SRC 或在仓库根运行）');
+  process.exit(2);
+}
 const PKG = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
 const NAME = PKG.name;
 

package/tools/sync-lock.mjs

@@ -10,9 +10,11 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
+import os from 'node:os';
 
 const tgz = process.argv[2];
-const PROFILE = process.argv[3] || 'C:/Users/DSH/.dsh/profiles/desktop';
+const PROFILE = process.argv[3] || process.env.DSH_PROFILE_DIR
+  || path.join(process.env.DSH_HOME || path.join(os.homedir(), '.dsh'), 'profiles', process.env.DSH_PROFILE || 'desktop');
 if (!tgz || !fs.existsSync(tgz)) {
   console.error('usage: node tools/sync-lock.mjs <tgz> [profile]');
   process.exit(2);

package/tools/verify-installed.mjs

@@ -18,7 +18,8 @@ if (!HASH) {
   process.exit(2);
 }
 const NAME = 'ygc-dsh-sync-backup';
-const PROFILE = 'C:/Users/DSH/.dsh/profiles/desktop';
+const PROFILE = process.env.DSH_PROFILE_DIR
+  || path.join(process.env.DSH_HOME || path.join(os.homedir(), '.dsh'), 'profiles', process.env.DSH_PROFILE || 'desktop');
 
 const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'dsb-verify-'));
 process.env.DSH_SYNC_SKILLS_ROOT = path.join(tmp, 'skills');