fix: install plugins via direct Gitea tarball URLs (core deps from npmjs)

scripts/dsh-plugin-install.ps1

@@ -4,9 +4,11 @@
   DSH profile and wires them into cordis.patch.yml.
 
 .DESCRIPTION
-  Ensures the profile .npmrc maps the @deepseek-ai scope to the Gitea npm
-  registry, installs the three shared plugins into the profile, removes stale
-  link: dependencies, and idempotently appends insert rows to cordis.patch.yml.
+  Adds the three shared plugins to the profile's package.json as direct
+  tarball URLs pointing at the Gitea npm registry, installs them, removes
+  stale link: dependencies, and idempotently appends insert rows to
+  cordis.patch.yml. Transitive @deepseek-ai/* core dependencies resolve from
+  the public npmjs registry (NOT scoped to Gitea).
 
 .PARAMETER Profile
   Profile name (directory under $DshHome\profiles). Default: 'web'.
@@ -27,12 +29,13 @@ param(
   [string]$Token = $env:GITEA_NPM_TOKEN
 )
 
-$registry = 'https://git.byte-mate.ru/api/packages/Coder/npm/'
-$plugins = @(
-  @{ Name = '@deepseek-ai/dsh-tool-lab'; Version = '0.1.0-rc.7'; Id = 'tool-lab' },
-  @{ Name = '@deepseek-ai/dsh-web-search-searxng'; Version = '0.1.0-rc.7'; Id = 'web-search-searxng' },
-  @{ Name = '@deepseek-ai/dsh-telegram-remote'; Version = '0.1.0'; Id = 'telegram-remote' }
-)
+$baseUrl = 'https://git.byte-mate.ru/api/packages/Coder/npm'
+# Ordered: name → tarball path within the Gitea npm registry.
+$plugins = [ordered]@{
+  '@deepseek-ai/dsh-tool-lab'          = @{ Version = '0.1.0-rc.7'; Id = 'tool-lab' }
+  '@deepseek-ai/dsh-web-search-searxng' = @{ Version = '0.1.0-rc.7'; Id = 'web-search-searxng' }
+  '@deepseek-ai/dsh-telegram-remote'   = @{ Version = '0.1.0'; Id = 'telegram-remote' }
+}
 
 if (-not $DshHome) { $DshHome = if ($env:DSH_HOME) { $env:DSH_HOME } else { Join-Path $HOME '.dsh' } }
 $profileDir = Join-Path $DshHome "profiles\$Profile"
@@ -42,32 +45,26 @@ if (-not (Test-Path $profileDir)) {
 }
 Write-Host "Profile dir: $profileDir"
 
-# 1. Ensure .npmrc scoped registry + token.
-$npmrc = Join-Path $profileDir '.npmrc'
-$npmrcLines = if (Test-Path $npmrc) { Get-Content $npmrc } else { @() }
-$scopeLine = "@deepseek-ai:registry=$registry"
-$authLine = "//$($registry -replace 'https://','')/:_authToken=$token"
-if ($npmrcLines -notcontains $scopeLine) { $npmrcLines += $scopeLine }
-if ($Token) {
-  $npmrcLines = ($npmrcLines | Where-Object { $_ -notlike '//*:_authToken=*' })
-  $npmrcLines += $authLine
+# 1. Remove stale link: dependencies (installed under the old scoped registry).
+& pnpm --dir $profileDir remove @deepseek-ai/dsh-tool-lab @deepseek-ai/dsh-web-search-searxng @deepseek-ai/dsh-telegram-remote 2>$null | Out-Null
+Write-Host "Removed stale versions (if any)"
+
+# 2. Add plugins as direct tarball URLs from the Gitea npm registry.
+$specs = @()
+foreach ($pkg in $plugins.Keys) {
+  $esc = $pkg -replace '/', '%2F'
+  $basename = ($pkg -split '/')[-1]
+  $meta = $plugins[$pkg]
+  $tarball = "$baseUrl/$esc/-/$($meta.Version)/$basename-$($meta.Version).tgz"
+  $specs += "$pkg@$tarball"
 }
-Set-Content -Path $npmrc -Value $npmrcLines -Encoding ascii
-Write-Host "Wrote $npmrc"
-
-# 2. Remove stale link: dependencies.
-& pnpm --dir $profileDir remove @deepseek-ai/dsh-web-search-searxng dsh-telegram-remote 2>$null | Out-Null
-Write-Host "Removed stale link dependencies (if any)"
-
-# 3. Install the shared plugins from the Gitea registry.
-$specs = $plugins | ForEach-Object { "$($_.Name)@$($_.Version)" }
 & pnpm --dir $profileDir add $specs
 
-# 4. Idempotently append insert blocks to cordis.patch.yml.
+# 3. Idempotently append insert blocks to cordis.patch.yml.
 $patchFile = Join-Path $profileDir 'cordis.patch.yml'
 $scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
-foreach ($p in $plugins) {
-  & node (Join-Path $scriptDir 'patch-cordis.mjs') --file $patchFile --name $p.Name --id $p.Id
+foreach ($pkg in $plugins.Keys) {
+  & node (Join-Path $scriptDir 'patch-cordis.mjs') --file $patchFile --name $pkg --id $plugins[$pkg].Id
 }
 
 Write-Host "`nDone. Plugins installed into $Profile profile. Restart dsh to load them."