fix: hotpack 包管理全面审计与加固（13 项根因修复） - #26
Merged
Merged
Conversation
- source.type 显式空串不再静默降级 npm（与空白被拒对齐），仅缺省(undefined/null)默认 npm - dshpackToHotpack 显式枚举 npm/github，path/未知类型显式报错，不再静默降级 npm 丢弃 path - 同步 3 份 vendor-shared 副本并重打包内嵌 dseam-skillmcp tgz - 新增回归测试
- store 键单射编码：name/ref 含 / 编码 %2F，消除层级目录与 rmSync 连删数据丢失 - activate 前一包 manifest 缺失仍移除旧 patch 块（与 deactivate 对齐，消除孤儿块） - marketDetail 改用 vendor-shared validateSourceRepo/validateSourceRef 单一真源 - buildGithubPluginPack 版本校验改严格 semver；packIdOf 追加短哈希消除碰撞 - raceFiles 404/403/410 白名单（429 限流不再丢弃镜像 200） - ensureNpm reused 判定补包名校验；退出 0 但版本不符不再误报 exit 0 - 挂载回滚只撤本次新装 npm 包（不误删 reused 预存依赖） - linkEntryIntoProfile 真实目录占用先移除再建 junction - writeTextSafe 迁移 writeFileAtomic（消除固定 .tmp 竞态） - ai-session sessionPath 严格校验拒绝（消除有损清洗 id 碰撞） - 新增 13 项回归测试（hotplug 173 / shared-core 176 / launcher 520 / memory-hub 51 全绿）
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概要
对热插拔包（hotpack）包管理与相关功能做了一次极端严格、进程隔离实测驱动的全面审查，定位并修复 13 项根因缺陷（另修正 1 处误导性报错），每项均以真实进程隔离测试复现并新增回归测试。
修复清单
解析与校验（shared-core）
source.type显式空串不再静默降级为 npm（与空白被拒对齐），仅缺省默认 npmdshpackToHotpack显式枚举 npm/github，path/未知类型显式报错，不再静默降级并丢弃 path 信息包管理生命周期（hotplug）
/编码为%2F，消除层级目录与rmSync连删兄弟 ref 缓存的数据丢失activate前一包 manifest 缺失时仍移除旧 patch 块（与deactivate对齐），消除孤儿块linkEntryIntoProfile真实目录占用 link 路径时先移除再建 junctionensureNpmreused 判定补包名校验；退出 0 但版本不符不再误报「exit 0」writeTextSafe迁移到writeFileAtomic，消除固定.tmp名多进程竞态市场与契约（market）
marketDetail改用 vendor-sharedvalidateSourceRepo/validateSourceRef单一真源（ref 允许/，拒绝非法 repo）buildGithubPluginPack版本校验改严格 semver，非法版本兜底0.0.0packIdOf追加 sha1 短哈希，消除/→-有损映射导致的 id 碰撞raceFiles404/403/410 白名单，429 限流不再丢弃镜像合法 200会话安全（ai-session）
sessionPath改为严格校验+拒绝，消除有损清洗导致的 id 碰撞（覆盖/误删/读不到）测试验证
vendor-shared 三份副本与 shared-core 逐字节一致；内嵌 dseam-skillmcp tgz 已重打包一致。
提交范围
本次提交：8 个源码文件 + 17 个测试/文档文件 + shared-core 解析器（含 3 份 vendor-shared 同步）+ 内嵌 tgz 重打包。
不提交（已由 .gitignore 排除）：node_modules、installer/runtime、coverage、sandbox/.sandbox、release/dist、本地备份与内部审查文档、启动器自动生成索引。
版本
项目版本号保持 1.0.1（不变）。第三方插件 dseam-skillmcp 0.8.1-pre、子包版本（shared-core 0.1.0 / launcher 0.3.0 / memory-hub 0.8.0-pre）与示例/测试夹具数据均按约定不随本 PR 变更。