From f686c1413c2bed17280f3f915960b5515ec6e542 Mon Sep 17 00:00:00 2001
From: Coder <coder@byte-mate.ru>
Date: Wed, 26 Aug 2026 23:06:25 +0700
Subject: [PATCH] fix: install plugins via direct Gitea tarball URLs (core deps
 from npmjs)

---
 .gitignore                     | 14 ++++++++-
 README.md                      | 30 +++++++++++++-----
 pnpm-lock.yaml                 | 12 +++++++
 scripts/dsh-plugin-install.ps1 | 57 ++++++++++++++++------------------
 scripts/dsh-plugin-install.sh  | 45 +++++++++++++--------------
 5 files changed, 95 insertions(+), 63 deletions(-)

diff --git a/.gitignore b/.gitignore
index b919c2a..3d945b7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,4 +3,16 @@ lib/
 *.tsbuildinfo
 *.tgz
 .unpublished
-dist/
\ No newline at end of file
+dist/
+
+# Local caches and scratch (never commit)
+.npm-cache/
+.pnpm-cache/
+.pack-check/
+.publish-tmp/
+.test-dsh/
+iso-install/
+iso-install2/
+e2e-dsh/
+*.log
+pnpm-debug.log*
\ No newline at end of file
diff --git a/README.md b/README.md
index b1214a7..e25c3aa 100644
--- a/README.md
+++ b/README.md
@@ -27,21 +27,35 @@ pnpm -r pack          # контроль упаковки tarball
 
 ## Публикация
 
-Для публикации в Gitea npm-реестр:
+Пакеты публикуются в Gitea npm-реестр (`https://git.byte-mate.ru/api/packages/Coder/npm/`)
+под scope `@deepseek-ai/*`. Транзитивные core-зависимости (`@deepseek-ai/cordis`,
+`dsh-settings`, `dsh-web`, `schemastery` и т.д.) тянутся из публичного npmjs —
+реестр Gitea не проксирует npmjs, поэтому скоуп `@deepseek-ai` НЕ перенаправляется
+на Gitea при установке.
+
+### Через CI (рекомендуется)
 
 1. Убедись, что в настройках репозитория есть секрет `GITEA_NPM_TOKEN` (токен
-   пользователя `Coder` с правами на packages).
+   пользователя `Coder` с правами на packages) — Settings → Actions → Secrets.
 2. Создай git-тег с префиксом `v*` (например `v0.1.0-rc.7`) и запушь его.
-3. Gitea Actions запустит job `publish`: workflow проверяет `check-published.mjs`,
-   какие пакеты ещё не опубликованы (идемпотентно), и публикует их в реестр.
+3. Job `publish` в `.gitea/workflows/publish.yml` соберёт пакеты и опубликует те,
+   которых ещё нет (идемпотентно через `check-published.mjs`).
 
-Публикация только по тегу; пуш в `main` гоняет `build-test` без публикации.
+Пуш в `main` гоняет только `build-test` (сборка + тесты), публикация — по тегу.
+
+### Вручную
+
+```sh
+pnpm --filter @deepseek-ai/dsh-tool-lab publish --no-git-checks \
+  --registry https://git.byte-mate.ru/api/packages/Coder/npm/ \
+  "--//git.byte-mate.ru/api/packages/Coder/npm/:_authToken=$GITEA_NPM_TOKEN"
+```
 
 ## Установка плагина
 
-Скрипты-установщики ставят все три плагина в активный профиль DSH, пишут в
-`.npmrc` профиля scoped-registry `@deepseek-ai` → Gitea и идемпотентно
-дописывают insert-записи в `cordis.patch.yml`.
+Скрипты-установщики добавляют плагины в активный профиль DSH как **прямые tarball
+URL из Gitea-реестра** (не скоупят `@deepseek-ai` — транзитивные core-зависимости
+берутся из npmjs) и идемпотентно дописывают insert-записи в `cordis.patch.yml`.
 
 ### Windows
 
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 1323fab..21f59e7 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -8,6 +8,18 @@ importers:
 
   .: {}
 
+  .test-dsh/profiles/web:
+    dependencies:
+      '@deepseek-ai/dsh-telegram-remote':
+        specifier: workspace:*
+        version: link:../../../packages/telegram-remote
+      '@deepseek-ai/dsh-tool-lab':
+        specifier: workspace:*
+        version: link:../../../packages/tool-lab
+      '@deepseek-ai/dsh-web-search-searxng':
+        specifier: workspace:*
+        version: link:../../../packages/web-search-searxng
+
   packages/telegram-remote: {}
 
   packages/tool-lab:
diff --git a/scripts/dsh-plugin-install.ps1 b/scripts/dsh-plugin-install.ps1
index 10d5400..2c80f72 100644
--- a/scripts/dsh-plugin-install.ps1
+++ b/scripts/dsh-plugin-install.ps1
@@ -4,9 +4,11 @@
   DSH profile and wires them into cordis.patch.yml.
 
 .DESCRIPTION
-  Ensures the profile .npmrc maps the @deepseek-ai scope to the Gitea npm
-  registry, installs the three shared plugins into the profile, removes stale
-  link: dependencies, and idempotently appends insert rows to cordis.patch.yml.
+  Adds the three shared plugins to the profile's package.json as direct
+  tarball URLs pointing at the Gitea npm registry, installs them, removes
+  stale link: dependencies, and idempotently appends insert rows to
+  cordis.patch.yml. Transitive @deepseek-ai/* core dependencies resolve from
+  the public npmjs registry (NOT scoped to Gitea).
 
 .PARAMETER Profile
   Profile name (directory under $DshHome\profiles). Default: 'web'.
@@ -27,12 +29,13 @@ param(
   [string]$Token = $env:GITEA_NPM_TOKEN
 )
 
-$registry = 'https://git.byte-mate.ru/api/packages/Coder/npm/'
-$plugins = @(
-  @{ Name = '@deepseek-ai/dsh-tool-lab'; Version = '0.1.0-rc.7'; Id = 'tool-lab' },
-  @{ Name = '@deepseek-ai/dsh-web-search-searxng'; Version = '0.1.0-rc.7'; Id = 'web-search-searxng' },
-  @{ Name = '@deepseek-ai/dsh-telegram-remote'; Version = '0.1.0'; Id = 'telegram-remote' }
-)
+$baseUrl = 'https://git.byte-mate.ru/api/packages/Coder/npm'
+# Ordered: name → tarball path within the Gitea npm registry.
+$plugins = [ordered]@{
+  '@deepseek-ai/dsh-tool-lab'          = @{ Version = '0.1.0-rc.7'; Id = 'tool-lab' }
+  '@deepseek-ai/dsh-web-search-searxng' = @{ Version = '0.1.0-rc.7'; Id = 'web-search-searxng' }
+  '@deepseek-ai/dsh-telegram-remote'   = @{ Version = '0.1.0'; Id = 'telegram-remote' }
+}
 
 if (-not $DshHome) { $DshHome = if ($env:DSH_HOME) { $env:DSH_HOME } else { Join-Path $HOME '.dsh' } }
 $profileDir = Join-Path $DshHome "profiles\$Profile"
@@ -42,32 +45,26 @@ if (-not (Test-Path $profileDir)) {
 }
 Write-Host "Profile dir: $profileDir"
 
-# 1. Ensure .npmrc scoped registry + token.
-$npmrc = Join-Path $profileDir '.npmrc'
-$npmrcLines = if (Test-Path $npmrc) { Get-Content $npmrc } else { @() }
-$scopeLine = "@deepseek-ai:registry=$registry"
-$authLine = "//$($registry -replace 'https://','')/:_authToken=$token"
-if ($npmrcLines -notcontains $scopeLine) { $npmrcLines += $scopeLine }
-if ($Token) {
-  $npmrcLines = ($npmrcLines | Where-Object { $_ -notlike '//*:_authToken=*' })
-  $npmrcLines += $authLine
+# 1. Remove stale link: dependencies (installed under the old scoped registry).
+& pnpm --dir $profileDir remove @deepseek-ai/dsh-tool-lab @deepseek-ai/dsh-web-search-searxng @deepseek-ai/dsh-telegram-remote 2>$null | Out-Null
+Write-Host "Removed stale versions (if any)"
+
+# 2. Add plugins as direct tarball URLs from the Gitea npm registry.
+$specs = @()
+foreach ($pkg in $plugins.Keys) {
+  $esc = $pkg -replace '/', '%2F'
+  $basename = ($pkg -split '/')[-1]
+  $meta = $plugins[$pkg]
+  $tarball = "$baseUrl/$esc/-/$($meta.Version)/$basename-$($meta.Version).tgz"
+  $specs += "$pkg@$tarball"
 }
-Set-Content -Path $npmrc -Value $npmrcLines -Encoding ascii
-Write-Host "Wrote $npmrc"
-
-# 2. Remove stale link: dependencies.
-& pnpm --dir $profileDir remove @deepseek-ai/dsh-web-search-searxng dsh-telegram-remote 2>$null | Out-Null
-Write-Host "Removed stale link dependencies (if any)"
-
-# 3. Install the shared plugins from the Gitea registry.
-$specs = $plugins | ForEach-Object { "$($_.Name)@$($_.Version)" }
 & pnpm --dir $profileDir add $specs
 
-# 4. Idempotently append insert blocks to cordis.patch.yml.
+# 3. Idempotently append insert blocks to cordis.patch.yml.
 $patchFile = Join-Path $profileDir 'cordis.patch.yml'
 $scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
-foreach ($p in $plugins) {
-  & node (Join-Path $scriptDir 'patch-cordis.mjs') --file $patchFile --name $p.Name --id $p.Id
+foreach ($pkg in $plugins.Keys) {
+  & node (Join-Path $scriptDir 'patch-cordis.mjs') --file $patchFile --name $pkg --id $plugins[$pkg].Id
 }
 
 Write-Host "`nDone. Plugins installed into $Profile profile. Restart dsh to load them."
diff --git a/scripts/dsh-plugin-install.sh b/scripts/dsh-plugin-install.sh
index a590082..9d66b7e 100644
--- a/scripts/dsh-plugin-install.sh
+++ b/scripts/dsh-plugin-install.sh
@@ -1,13 +1,25 @@
 #!/usr/bin/env bash
 # dsh-plugin-install.sh — install shared @deepseek-ai/* plugins from the Gitea
 # npm registry into a DSH profile and wire them into cordis.patch.yml.
+# Transitive @deepseek-ai/* core deps resolve from npmjs, not scoped to Gitea.
 set -euo pipefail
 
 PROFILE="${1:-web}"
 DSH_HOME="${DSH_HOME:-$HOME/.dsh}"
-TOKEN="${GITEA_NPM_TOKEN:-}"
 
-REGISTRY="https://git.byte-mate.ru/api/packages/Coder/npm/"
+BASE_URL="https://git.byte-mate.ru/api/packages/Coder/npm"
+declare -a SPECS=()
+
+add_plugin() {
+  local pkg="$1" version="$2"
+  local esc="${pkg//\//%2F}"
+  local basename="${pkg##*/}"
+  SPECS+=("$pkg@$BASE_URL/$esc/-/$version/$basename-$version.tgz")
+}
+
+add_plugin "@deepseek-ai/dsh-tool-lab"           "0.1.0-rc.7" tool-lab
+add_plugin "@deepseek-ai/dsh-web-search-searxng" "0.1.0-rc.7" web-search-searxng
+add_plugin "@deepseek-ai/dsh-telegram-remote"    "0.1.0"      telegram-remote
 
 PROFILE_DIR="$DSH_HOME/profiles/$PROFILE"
 if [ ! -d "$PROFILE_DIR" ]; then
@@ -18,30 +30,15 @@ echo "Profile dir: $PROFILE_DIR"
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
-# 1. Ensure .npmrc scoped registry + token.
-NPMRC="$PROFILE_DIR/.npmrc"
-touch "$NPMRC"
-SCOPE_LINE="@deepseek-ai:registry=$REGISTRY"
-if ! grep -qF "$SCOPE_LINE" "$NPMRC"; then
-  echo "$SCOPE_LINE" >> "$NPMRC"
-fi
-if [ -n "$TOKEN" ]; then
-  sed -i.bak "/^\/\/.*:_authToken=/d" "$NPMRC" && rm -f "$NPMRC.bak"
-  printf '//%s/:_authToken=%s\n' "$(printf '%s' "$REGISTRY" | sed 's#^https://##; s#/$##')" "$TOKEN" >> "$NPMRC"
-fi
-echo "Wrote $NPMRC"
+# 1. Remove stale versions.
+pnpm --dir "$PROFILE_DIR" remove \
+  @deepseek-ai/dsh-tool-lab @deepseek-ai/dsh-web-search-searxng @deepseek-ai/dsh-telegram-remote >/dev/null 2>&1 || true
+echo "Removed stale versions (if any)"
 
-# 2. Remove stale link: dependencies.
-pnpm --dir "$PROFILE_DIR" remove @deepseek-ai/dsh-web-search-searxng dsh-telegram-remote >/dev/null 2>&1 || true
-echo "Removed stale link dependencies (if any)"
+# 2. Add plugins as direct tarball URLs from the Gitea npm registry.
+pnpm --dir "$PROFILE_DIR" add "${SPECS[@]}"
 
-# 3. Install the shared plugins from the Gitea registry.
-pnpm --dir "$PROFILE_DIR" add \
-  "@deepseek-ai/dsh-tool-lab@0.1.0-rc.7" \
-  "@deepseek-ai/dsh-web-search-searxng@0.1.0-rc.7" \
-  "@deepseek-ai/dsh-telegram-remote@0.1.0"
-
-# 4. Idempotently append insert blocks to cordis.patch.yml.
+# 3. Idempotently append insert blocks to cordis.patch.yml.
 PATCH_FILE="$PROFILE_DIR/cordis.patch.yml"
 node "$SCRIPT_DIR/patch-cordis.mjs" --file "$PATCH_FILE" --name "@deepseek-ai/dsh-tool-lab" --id tool-lab
 node "$SCRIPT_DIR/patch-cordis.mjs" --file "$PATCH_FILE" --name "@deepseek-ai/dsh-web-search-searxng" --id web-search-searxng