Repository navigation
企业插件市场改为在线席位快照，并支持导入 npm 包。 - #2502
Merged
Merged
Conversation
去掉独立签名租约。桌面员工凭席位访问目录和制品；上传的社区包按 package.json 校验。 Co-authored-by: Cursor <cursoragent@cursor.com>
zgqgit
added a commit
that referenced
this pull request
Oct 21, 2026
Port PR #2502 without merging its source branch history. Keep work-110 native sessions, installation switches and workbench APIs, without a Desktop seat gate. Preserve original artifact integrity checks and expose unsigned contract v2. Validate backend market tests (72), platform UI tests (16), client market tests (45) and cross-repository ZIP/tgz and snapshot contracts. Full frontend lint and typecheck have identical failures before and after this port. Source-PR: #2502 Ported-from: 29ab7fd
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
企业插件市场去掉单独的签名密钥。员工电脑上的桌面端定期调用
POST /api/v1/dsh/market/sync，上报本机已安装的插件，并取回当前企业允许使用的插件清单。以前这个接口不直接返回清单，而是返回一份租约。租约里有一段 base64 载荷和一段 Ed25519 签名。桌面端必须用部署时配置的公钥验签，验签通过并且租约未过期，插件才允许继续运行。签发这把签名需要服务端配置
BISHENG_DSH_MARKET_SIGNING_KEY。没配密钥时，市场直接显示为未启用。现在
/sync直接返回一份发布快照，里面没有payload，也没有signature。字段是：tenant_id、user_id、device_id：这份快照属于哪一个企业、哪一个员工、哪一台设备。桌面端只接受和当前登录身份一致的快照。synced_at：服务器生成这份快照的时间，单位是秒。桌面端拒绝过期或时钟偏差过大的快照，避免把旧响应当成当前授权。policies：当前企业已发布插件的状态。每条包含插件是否停用、当前版本、已发布过的版本号和文件摘要。桌面端不再保存公钥，也不再按租约到期时间停插件。能调用这个接口，是因为桌面登录换到的访问凭证仍然有效，并且网关确认这个员工占用着席位。席位被收回或登录会话过期时，接口返回明确错误码，桌面端停用插件。网络短暂中断时，桌面端停掉正在运行的插件，但保留安装记录，恢复连接后再按员工原来的开关决定是否启用。
/capabilities里的contract_version从 1 改为 2，用来标记上面这套返回格式。版本 1 的桌面端期待「公钥 + 签名租约」，版本 2 的服务端不再提供这两项，两边不能混用。新桌面端连到仍返回版本 1 的服务端时，会提示管理员升级服务端，而不会把旧租约当成新快照来用。管理员还可以导入带
package.json的 npm ZIP 或.tgz。没有 npm 元数据、只有根级manifest.json的企业离线包仍按原来的方式导入。Why
签名租约和员工身份是两套凭证。员工已经用桌面登录和席位证明了自己，再要求另一把只存在于部署配置里的签名密钥，密钥缺失时市场不可用，密钥轮换时已安装插件也会失效。社区下载的插件没有企业离线包清单，原先也无法导入。
How
lease.py。/sync在记录本机插件状态后，直接返回上述快照。/capabilities固定返回enabled: true和contract_version: 2，不再下发public_key和lease_seconds。/capabilities、/catalog、制品下载和/sync只允许已验证的桌面席位访问，并设置Cache-Control: no-store，避免代理缓存旧快照。data.code，供桌面端识别。平台管理员不能拿桌面凭证调用这些员工接口，管理导入和发布仍走/admin接口。package.json时按 npm 包校验；没有 npm 元数据且存在根级manifest.json时仍走企业离线包。gzip tarball 按 npm 包校验。Test
test/dsh_market48 项通过。另有 3 个桌面登录测试因本机缺少src/backend/bisheng/config.yaml未能运行，get_settings()这行调用本次未改。Related
feat/enterprise-market-online-seat，基线为V1.1.0