turtle1999 6d1e12b237 fix(plugins): keep credentials and shadowed copies out of bundle sources ...

Address the first ds-review-bot round on the bundle Source section:

- strip the user information of http(s) and git+http(s) URLs so a private
  Git URL's token reaches neither the page nor the plugin_manager tool;
- expand `~` in file:/link: paths to the home directory as pnpm does;
- write jsr: aliases after the dependency name, like npm: aliases;
- give no source for a profile dependency the installation also supplies,
  whose installation copy is the one that loads;
- label the English row "Code source" to match the Chinese copy and hold
  for built-in bundles, and sync the subsystem page, READMEs, CSS comment,
  and tool test.

2026-09-29 12:07:56 +08:00

..

cli

release(dsh): 0.2.0-rc.1 (#5387)

2026-09-28 19:48:10 +08:00

desktop

release(dsh): 0.2.0-rc.1 (#5387)

2026-09-28 19:48:10 +08:00

desktop-host

release(dsh): 0.2.0-rc.1 (#5387)

2026-09-28 19:48:10 +08:00

web

fix(plugins): keep credentials and shadowed copies out of bundle sources

2026-09-29 12:07:56 +08:00