fix: strip userinfo from git repos, render explicit error for empty manifest

- Normalize git+ssh://git@github.com/... to https://github.com/... so the
  git@ userinfo no longer leaks into the repo link
- Replace the bare return null for a nameless manifest with an explicit
  error alert and retry button

Author: thonatos

apps/web/app/lib/registry/parse.test.ts

@@ -95,7 +95,7 @@ describe("repoUrl", () => {
   it("规范化常见仓库地址", () => {
     expect(repoUrl("git+https://github.com/foo/bar.git")).toBe("https://github.com/foo/bar");
     expect(repoUrl("git+ssh://git@github.com/foo/bar.git")).toBe(
-      "https://git@github.com/foo/bar",
+      "https://github.com/foo/bar",
     );
     expect(repoUrl("git://github.com/foo/bar.git")).toBe("https://github.com/foo/bar");
     expect(repoUrl({ url: "https://github.com/foo/bar" })).toBe(

apps/web/app/lib/registry/parse.ts

@@ -12,11 +12,9 @@ export function repoUrl(repository: RegistryManifest["repository"]) {
   if (!repository) return undefined;
   const url = typeof repository === "string" ? repository : repository.url;
   if (!url) return undefined;
-  if (/^git(\+ssh)?:\/\//.test(url)) {
-    return url.replace(/^git(\+ssh)?:\/\//, "https://").replace(/\.git$/, "");
-  }
-  if (/^git\+https?:\/\//.test(url)) {
-    return url.replace(/^git\+https?:\/\//, "https://").replace(/\.git$/, "");
+  if (/^git(\+ssh|\+https?)?:\/\//.test(url)) {
+    const rest = url.replace(/^git(\+ssh|\+https?)?:\/\//, "").replace(/^[^@]+@/, "");
+    return `https://${rest}`.replace(/\.git$/, "");
   }
   if (/^git@github\.com:(.+)$/.test(url)) {
     return `https://github.com/${url.replace(/^git@github\.com:/, "").replace(/\.git$/, "")}`;

apps/web/app/routes/cnpm.pkg.tsx

@@ -98,7 +98,22 @@ function CnpmPkgInner({ rest }: { rest?: string }) {
     );
   }
 
-  if (!manifest?.name) return null;
+  if (!manifest?.name) {
+    return (
+      <Layout>
+        <PageContainer className="py-6">
+          <Alert variant="destructive">
+            <AlertDescription className="flex items-center justify-between gap-3">
+              未能读取到 {name} 的包信息
+              <Button type="button" variant="outline" size="sm" onClick={retry}>
+                重试
+              </Button>
+            </AlertDescription>
+          </Alert>
+        </PageContainer>
+      </Layout>
+    );
+  }
 
   const requestedVersion = params.get("version") || "";
   const fallbackVersion = sortVersions(manifest.versions)[0]?.version;