@1e0zj/dsh-plugin-mall 0.1.12 → 0.1.15

package/src/github.js

@@ -116,25 +116,50 @@ export async function searchPlugins({ query, sort = "stars", perPage = 10, page
 // points back at that GitHub repo, which doubles as an anti-squatting check
 // (an unrelated package squatting the name never matches, install falls back
 // to the explicit github: spec).
+//
+// The registry to query is the CALLER's business (see resolveRegistry in
+// installer.js): it has to be the one pnpm installs from. Querying npmjs while
+// pnpm installs from a mirror fails three ways at once and all of them are
+// silent — anti-squatting never matches (every install degrades to a whole-repo
+// GitHub clone plus a prepare build), `latest` comes back null (the update
+// button disappears), and assertSafeToInstall sees no manifest, so the
+// host-shadow guard stops guarding.
+
+export const DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org";
+// `${registry}|${name}` -> {info, at}. Keyed by registry so a config change
+// cannot serve answers from a different registry.
+const npmCache = new Map();
+// Success and failure expire alike. A never-expiring success cache means
+// `hasUpdate` is frozen for the process lifetime: the author publishes, and no
+// amount of "刷新已装" shows it until dsh restarts — self-defeating for a
+// marketplace whose selling point is update management.
+const NPM_CACHE_TTL = 300000;
 
-const NPM_REGISTRY = "https://registry.npmjs.org";
-const npmCache = new Map(); // name -> {info, at} — null misses expire after 5 min
+/** Strip trailing slashes so `${base}/${name}` never doubles up. */
+function normalizeRegistry(registry) {
+  const value = String(registry ?? "").trim();
+  return (value.length > 0 ? value : DEFAULT_NPM_REGISTRY).replace(/\/+$/, "");
+}
 
 /**
- * Look up a package on the npm registry (abbreviated metadata). Successful
- * lookups cache for the process lifetime; "not found / unreachable" (null)
- * expires after 5 minutes so a transient registry failure self-heals.
+ * Look up a package's `latest` manifest on an npm registry.
+ * @param name - the npm package name.
+ * @param options - `registry` defaults to npmjs; pass what pnpm installs from.
+ * @returns `{latest, repositoryUrl, hostDeps}`, or null when unknown/unreachable.
  */
-export async function npmPackageInfo(name) {
+export async function npmPackageInfo(name, { registry } = {}) {
   const clean = String(name ?? "").trim();
   if (clean.length === 0 || !/^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/i.test(clean)) return null;
-  const cached = npmCache.get(clean);
-  if (cached !== undefined && (cached.info !== null || Date.now() - cached.at < 300000)) return cached.info;
+  const base = normalizeRegistry(registry);
+  const key = `${base}|${clean}`;
+  const cached = npmCache.get(key);
+  if (cached !== undefined && Date.now() - cached.at < NPM_CACHE_TTL) return cached.info;
   let info = null;
   try {
     // 单版本端点返回 latest 的完整 manifest（dependencies + repository 都在）。
     // abbreviated packument 不含 repository，防抢注比对会永远落空。
-    const response = await fetch(`${NPM_REGISTRY}/${clean.replace("/", "%2F")}/latest`, {
+    // 镜像（npmmirror 等）的同名端点响应格式一致，两个字段都保留。
+    const response = await fetch(`${base}/${clean.replace("/", "%2F")}/latest`, {
       headers: { "User-Agent": "dsh-plugin-mall", Accept: "application/json" },
     });
     if (response.ok) {
@@ -152,7 +177,7 @@ export async function npmPackageInfo(name) {
   } catch {
     info = null; // registry unreachable — caller falls back
   }
-  npmCache.set(clean, { info, at: Date.now() });
+  npmCache.set(key, { info, at: Date.now() });
   return info;
 }
 
@@ -161,15 +186,20 @@ export async function npmPackageInfo(name) {
  * that package exists on npm AND its repository URL points back at the repo
  * (anti-squatting). Anything else passes through untouched.
  */
-export async function preferNpmSpec({ spec }) {
+export async function preferNpmSpec({ spec, registry, sources }) {
   const raw = String(spec ?? "");
+  // A scoped npm name ("@scope/name", "@scope/name@1.2.3") is shaped exactly
+  // like owner/repo and matches the regex below, sending every such install
+  // off to verify a repository that cannot exist — two wasted CDN requests and
+  // a bogus cache entry. Same guard normalizeSpec already uses.
+  if (raw.startsWith("@")) return raw;
   const githubMatch = /^(?:github:)?([^/\s]+\/[^/\s]+?)(?:\.git)?$/i.exec(raw);
   if (githubMatch === null) return raw;
   const repo = githubMatch[1];
-  const { results } = await verifyPlugins({ repos: [repo] }); // cache hit after first verify
+  const { results } = await verifyPlugins({ repos: [repo], sources }); // cache hit after first verify
   const declaredName = results[repo]?.name;
   if (typeof declaredName !== "string") return raw;
-  const info = await npmPackageInfo(declaredName);
+  const info = await npmPackageInfo(declaredName, { registry });
   if (info === null || info.repositoryUrl === undefined) return raw;
   const pointsBack = new RegExp(`github\\.com[/:]${repo.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(/|\\.git|$)`, "i").test(info.repositoryUrl);
   return pointsBack ? declaredName : raw;
@@ -197,7 +227,7 @@ function npmNameOf(raw) {
   return match === null ? null : match[1];
 }
 
-export async function assertSafeToInstall({ spec }) {
+export async function assertSafeToInstall({ spec, registry, sources }) {
   const raw = String(spec ?? "");
   let hostDeps;
   if (/^(?:file:|link:)/i.test(raw)) {
@@ -211,7 +241,7 @@ export async function assertSafeToInstall({ spec }) {
     }
   } else if (/^github:([^/\s]+\/[^/\s]+?)(?:\.git)?(?:#.+)?$/i.test(raw)) {
     const repo = /^github:([^/\s]+\/[^/\s]+?)(?:\.git)?(?:#.+)?$/i.exec(raw)[1];
-    const { results } = await verifyPlugins({ repos: [repo] });
+    const { results } = await verifyPlugins({ repos: [repo], sources });
     hostDeps = results[repo]?.hostDeps;
   } else if (/^https?:\/\//i.test(raw)) {
     return; // 远程 tarball 下载前无法廉价检查；罕见路径，放行
@@ -222,7 +252,7 @@ export async function assertSafeToInstall({ spec }) {
       // 无法识别形状的 spec 一律拒绝，而不是静默跳过检查。
       throw new Error(`cannot analyze install spec ${JSON.stringify(raw)} for host-shadow dependencies — refusing to install`);
     }
-    const info = await npmPackageInfo(name);
+    const info = await npmPackageInfo(name, { registry });
     hostDeps = info?.hostDeps;
   }
   if (hostDeps !== undefined && hostDeps !== null && hostDeps.length > 0) {
@@ -257,25 +287,62 @@ export function compareVersions(a, b) {
 // for the process lifetime; a fetch failure caches "unknown" rather than
 // retrying forever.
 
-const RAW_BASE = "https://raw.githubusercontent.com";
-const VERIFY_CONCURRENCY = 8;
+/** Cap on concurrent outbound requests — shared by verification and update checks. */
+export const NETWORK_CONCURRENCY = 8;
+// repo -> {kind, name, version, hostDeps, ts}
 const verifyCache = new Map();
+// Verdicts expire. Caching a success for the process lifetime freezes the badge
+// on whatever the repo looked like the first time it was seen: when dsh-TUI
+// moved its @deepseek-ai/* deps to peerDependencies, the red "宿主依赖风险"
+// badge stayed up until dsh restarted, still accusing a repo that had been
+// fixed. Ten minutes keeps a browsing session on cache while letting a fix
+// surface on its own.
+const VERIFY_TTL = 600000;
+// Network failures retry sooner — "unknown" carries no information worth keeping.
+const VERIFY_TTL_UNKNOWN = 60000;
+
+/**
+ * Run `task` over `items` with at most `limit` workers in flight. The one
+ * fan-out primitive for this module's network work, so nothing accidentally
+ * bursts every item at once.
+ */
+export async function mapLimit(items, limit, task) {
+  const list = Array.isArray(items) ? items : [];
+  let cursor = 0;
+  const worker = async () => {
+    while (cursor < list.length) {
+      const index = cursor++;
+      await task(list[index], index);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(limit, list.length) }, worker));
+}
 
 // package.json is fetched from CDNs, not the REST API, so verification never
 // burns API quota. jsDelivr first (reachable where raw.githubusercontent.com
 // is blocked), raw as fallback; a 404 only means "no manifest" once EVERY
 // reachable source 404s (jsDelivr lags new pushes, so one 404 is not final).
-const RAW_SOURCES = [
-  (repo) => `https://cdn.jsdelivr.net/gh/${repo}@HEAD/package.json`,
-  (repo) => `${RAW_BASE}/${repo}/HEAD/package.json`,
+// URL templates, `{repo}` substituted with owner/name — overridable through
+// the `rawSources` config for self-hosted reverse proxies.
+export const DEFAULT_RAW_SOURCES = [
+  "https://cdn.jsdelivr.net/gh/{repo}@HEAD/package.json",
+  "https://raw.githubusercontent.com/{repo}/HEAD/package.json",
 ];
 
-async function fetchRawPackageJson(repo, signal) {
+/** The configured source templates, or the built-in pair. */
+function rawSourcesOf(sources) {
+  const list = (Array.isArray(sources) ? sources : [])
+    .map((entry) => String(entry ?? "").trim())
+    .filter((entry) => entry.length > 0 && entry.includes("{repo}"));
+  return list.length > 0 ? list : DEFAULT_RAW_SOURCES;
+}
+
+async function fetchRawPackageJson(repo, signal, sources) {
   let saw404 = false;
   let lastError;
-  for (const buildUrl of RAW_SOURCES) {
+  for (const template of rawSourcesOf(sources)) {
     try {
-      const response = await fetch(buildUrl(repo), {
+      const response = await fetch(template.replace("{repo}", repo), {
         headers: { "User-Agent": "dsh-plugin-mall", Accept: "application/json" },
         signal,
       });
@@ -297,10 +364,21 @@ async function fetchRawPackageJson(repo, signal) {
  * peerDependencies) installs real copies into the profile — the loader then
  * holds two module instances, symbol identities split, and every tool call
  * crashes with an undiagnosable "reading 'prepare'". See installer docs.
+ *
+ * ONLY the @deepseek-ai scope belongs here. This used to also match the bare
+ * upstream `cosmokit` and `schemastery` on the theory that dsh forked the
+ * cordis trio and therefore shipped those too. It does not: the host tree has
+ * no bare copy at any depth, and none of its 195 @deepseek-ai packages depends
+ * on one — the fork is complete and cut its ties to the upstream names. A
+ * plugin depending on bare `schemastery` shadows nothing, so flagging it was a
+ * pure false positive, and an expensive one: it hard-blocked 7 real plugins in
+ * the topic's top 300, `omdsh-dev/DSH-better-sidebar` (★1832) among them —
+ * every one of which declares its @deepseek-ai/* deps as peers correctly.
+ * Fixtures at the bottom of this file pin the distinction.
  */
-const HOST_PACKAGES = /^(@deepseek-ai\/|cosmokit$|schemastery$)/;
+const HOST_PACKAGES = /^@deepseek-ai\//;
 
-/** The @deepseek-ai/* (and cordis runtime) entries inside `dependencies`. */
+/** The @deepseek-ai/* entries inside `dependencies`. */
 function hostShadowDependencies(pkg) {
   if (pkg === undefined || typeof pkg !== "object") return undefined;
   const deps = Object.keys(pkg.dependencies ?? {});
@@ -310,42 +388,40 @@ function hostShadowDependencies(pkg) {
 
 /**
  * Verify repositories as real dsh plugins by their package.json declaration.
- * @param {{repos: string[], signal?: AbortSignal}} options - "owner/name" list.
+ * @param {{repos: string[], signal?: AbortSignal, sources?: string[]}} options - "owner/name" list.
  * @returns the {results} map: fullName -> {kind: "bundle"|"client"|"plain"|"no-manifest"|"unknown", name?, version?, hostDeps?}.
  */
-export async function verifyPlugins({ repos, signal }) {
+export async function verifyPlugins({ repos, signal, sources }) {
+  // A GitHub owner never starts with "@", so rejecting that shape here keeps
+  // scoped npm names ("@scope/name") out of repository verification no matter
+  // which caller passes them in.
   const wanted = [...new Set((Array.isArray(repos) ? repos : []).map(String)
-    .filter((repo) => /^[^/\s]+\/[^/\s]+$/.test(repo) && !repo.includes("..")))];
-  // "unknown"（网络失败）60s 后过期重试；成功结果进程内永久缓存。
+    .filter((repo) => /^[^@/\s][^/\s]*\/[^/\s]+$/.test(repo) && !repo.includes("..")))];
+  // 每条判定都带时间戳：成功 10 分钟过期，网络失败 60 秒过期。
   const pending = wanted.filter((repo) => {
     const cached = verifyCache.get(repo);
     if (cached === undefined) return true;
-    return cached.kind === "unknown" && Date.now() - (cached.ts ?? 0) > 60000;
+    const ttl = cached.kind === "unknown" ? VERIFY_TTL_UNKNOWN : VERIFY_TTL;
+    return Date.now() - (cached.ts ?? 0) > ttl;
   });
-  let cursor = 0;
-  const worker = async () => {
-    while (cursor < pending.length) {
-      const repo = pending[cursor++];
-      try {
-        const pkg = await fetchRawPackageJson(repo, signal);
-        const kind = pkg === undefined ? "no-manifest"
-          : typeof pkg.dsh?.bundle?.patch === "string" ? "bundle"
-            : pkg.dsh?.client !== undefined ? "client"
-              : "plain";
-        verifyCache.set(repo, { kind, name: pkg?.name, version: pkg?.version, hostDeps: hostShadowDependencies(pkg) });
-      } catch (error) {
-        if (error?.name === "AbortError") throw error;
-        verifyCache.set(repo, { kind: "unknown", ts: Date.now() });
-      }
+  await mapLimit(pending, NETWORK_CONCURRENCY, async (repo) => {
+    try {
+      const pkg = await fetchRawPackageJson(repo, signal, sources);
+      const kind = pkg === undefined ? "no-manifest"
+        : typeof pkg.dsh?.bundle?.patch === "string" ? "bundle"
+          : pkg.dsh?.client !== undefined ? "client"
+            : "plain";
+      verifyCache.set(repo, { kind, name: pkg?.name, version: pkg?.version, hostDeps: hostShadowDependencies(pkg), ts: Date.now() });
+    } catch (error) {
+      if (error?.name === "AbortError") throw error;
+      verifyCache.set(repo, { kind: "unknown", ts: Date.now() });
     }
-  };
-  await Promise.all(Array.from({ length: Math.min(VERIFY_CONCURRENCY, pending.length) }, worker));
+  });
+  // 一律重建对象：内部的 ts 不该出现在发给浏览器的响应里。
   const results = {};
   for (const repo of wanted) {
     const cached = verifyCache.get(repo);
-    results[repo] = cached === undefined || cached.ts !== undefined
-      ? { kind: cached?.kind ?? "unknown", name: cached?.name, version: cached?.version, hostDeps: cached?.hostDeps }
-      : cached;
+    results[repo] = { kind: cached?.kind ?? "unknown", name: cached?.name, version: cached?.version, hostDeps: cached?.hostDeps };
   }
   return { results };
 }
@@ -390,8 +466,69 @@ export async function repoInfo({ repo, apiBase, token, signal }) {
   };
 }
 
-// Self-test entry: node src/github.js
+// ── offline fixtures ────────────────────────────────────────────────────────
+//
+// The host-shadow check has no live regression case any more: dsh-TUI, the
+// plugin it was built against, moved its @deepseek-ai/* deps to
+// peerDependencies after being reported, and nothing else on the network pins
+// the bare-vs-scoped distinction. These manifests do. Shapes are taken from
+// real repositories in the dsh-plugin topic, trimmed to the relevant fields.
+const HOST_SHADOW_FIXTURES = [
+  {
+    label: "omdsh-dev/DSH-better-sidebar — 上游裸包，宿主不提供，放行",
+    pkg: {
+      dependencies: { schemastery: "^3.18.0", ws: "^8.18.0", clsx: "^2.1.1", "node-pty": "^1.1.0" },
+      peerDependencies: { "@deepseek-ai/dsh-tools": "^0.1.0-rc.6", "@deepseek-ai/cordis": "^4.0.1" },
+    },
+    expect: undefined,
+  },
+  {
+    label: "裸 cordis / cosmokit — fork 已与上游断开，放行",
+    pkg: { dependencies: { cordis: "^4.0.0-rc.7", cosmokit: "^1.6.3" } },
+    expect: undefined,
+  },
+  {
+    label: "作用域包写进 dependencies — 真·宿主重复，拦截",
+    pkg: { dependencies: { "@deepseek-ai/schemastery": "^1.0.0" } },
+    expect: ["@deepseek-ai/schemastery"],
+  },
+  {
+    label: "合法 peer + 非法 dep 混合 — 仍须拦截",
+    pkg: {
+      dependencies: { "@deepseek-ai/dsh-settings": "*", clsx: "^2" },
+      peerDependencies: { "@deepseek-ai/dsh-tools": "*" },
+    },
+    expect: ["@deepseek-ai/dsh-settings"],
+  },
+  {
+    label: "只在 peerDependencies 声明 — 正确写法，放行",
+    pkg: { peerDependencies: { "@deepseek-ai/dsh-tools": "*", "@deepseek-ai/cordis": "^4.0.1" } },
+    expect: undefined,
+  },
+  { label: "无 dependencies 字段", pkg: {}, expect: undefined },
+  { label: "非对象清单", pkg: undefined, expect: undefined },
+];
+
+/** Run the offline fixtures; returns the failure count. */
+function runHostShadowFixtures() {
+  let failed = 0;
+  for (const { label, pkg, expect } of HOST_SHADOW_FIXTURES) {
+    const actual = hostShadowDependencies(pkg);
+    const ok = JSON.stringify(actual ?? null) === JSON.stringify(expect ?? null);
+    if (!ok) failed++;
+    console.log(`  ${ok ? "PASS" : "FAIL"} ${label}${ok ? "" : `  期望 ${JSON.stringify(expect)}，实得 ${JSON.stringify(actual)}`}`);
+  }
+  return failed;
+}
+
+// Self-test entry: node src/github.js --self-test
+// Offline fixtures run first and gate the network smoke test below.
 if (process.argv[1]?.endsWith("github.js") && process.argv.includes("--self-test")) {
+  console.log("宿主依赖检测 fixtures:");
+  const failed = runHostShadowFixtures();
+  console.log(`${HOST_SHADOW_FIXTURES.length - failed}/${HOST_SHADOW_FIXTURES.length} passed\n`);
+  if (failed > 0) process.exit(1);
+  if (process.argv.includes("--offline")) process.exit(0);
   const apiBase = "https://api.github.com";
   const result = await searchPlugins({ query: "", perPage: 3, apiBase });
   console.log(`total=${result.total} page=${result.page} perPage=${result.perPage}`);

package/src/index.js

@@ -19,8 +19,8 @@ import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { spawn } from "node:child_process";
 import { resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
-import { repoInfo, searchPlugins, verifyPlugins, preferNpmSpec, npmPackageInfo, compareVersions, assertSafeToInstall } from "./github.js";
-import { ensureProfile, listInstalled, normalizeSpec, runInstall, runRemove, createJobTracker, assertSafeSpec } from "./installer.js";
+import { repoInfo, searchPlugins, verifyPlugins, preferNpmSpec, npmPackageInfo, compareVersions, assertSafeToInstall, mapLimit, NETWORK_CONCURRENCY } from "./github.js";
+import { ensureProfile, listInstalled, normalizeSpec, runInstall, runRemove, createJobTracker, assertSafeSpec, resolveRegistry } from "./installer.js";
 
 export const name = "@1e0zj/dsh-plugin-mall";
 export const inject = ["tools", "jobs", "systemPrompt"];
@@ -28,10 +28,23 @@ export const inject = ["tools", "jobs", "systemPrompt"];
 export const Config = z.object({
   defaultProfile: z.string().default("web"),
   apiBase: z.string().default("https://api.github.com"),
+  npmRegistry: z.string().default(""),
+  rawSources: z.array(z.string()).default([]),
   perPageMax: z.number().default(30),
   allowRestart: z.boolean().default(true),
 });
 
+/**
+ * The registry to query for a profile: an explicit `npmRegistry` config wins,
+ * otherwise follow whatever pnpm installs from (profile .npmrc → pnpm config →
+ * npmjs). Never npmjs-by-assumption: a mirror user would silently lose
+ * anti-squatting, update checks, and the host-shadow guard all at once.
+ */
+async function registryFor(profile, npmRegistry) {
+  const explicit = String(npmRegistry ?? "").trim();
+  return explicit.length > 0 ? explicit.replace(/\/+$/, "") : await resolveRegistry(profile);
+}
+
 /** Clip long strings for compact model-facing output. */
 function clip(text, max) {
   const trimmed = String(text ?? "").replace(/\s+/g, " ").trim();
@@ -150,7 +163,7 @@ function rpcFail(error) {
  * @returns the {ok, value|error} envelope.
  */
 async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
-  const { defaultProfile = "web", apiBase = "https://api.github.com", perPageMax = 30, allowRestart = true } = config;
+  const { defaultProfile = "web", apiBase = "https://api.github.com", perPageMax = 30, allowRestart = true, npmRegistry = "", rawSources = [] } = config;
   switch (endpoint) {
     case "search": {
       const perPage = Math.min(Math.max(Math.trunc(payload?.perPage ?? 10) || 10, 1), Math.trunc(perPageMax) || 30);
@@ -166,7 +179,7 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
       return rpcOk(result);
     }
     case "verify": {
-      const result = await verifyPlugins({ repos: payload?.repos });
+      const result = await verifyPlugins({ repos: payload?.repos, sources: rawSources });
       return rpcOk(result);
     }
     case "updates": {
@@ -178,14 +191,16 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
       } catch (error) {
         return rpcFail(new Error(`invalid profile: ${error.message}`));
       }
+      const registry = await registryFor(profile, npmRegistry);
       const results = {};
-      await Promise.all(deps.map(async (dep) => {
+      // 同 verifyPlugins 的 worker 池，而不是对所有依赖一次性扇出。
+      await mapLimit(deps, NETWORK_CONCURRENCY, async (dep) => {
         if (dep.kind === "missing") { results[dep.name] = { latest: null }; return; }
-        const info = await npmPackageInfo(dep.name);
+        const info = await npmPackageInfo(dep.name, { registry });
         results[dep.name] = info === null
           ? { latest: null }
           : { latest: info.latest, hasUpdate: compareVersions(info.latest, dep.version) > 0 };
-      }));
+      });
       return rpcOk(results);
     }
     case "info": {
@@ -211,12 +226,14 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
         return rpcFail(error);
       }
       // npm tarball 优先（小而快、带 integrity）；registry 条目不同源的包名
-      // 视为抢注，回退 github: 全仓库 spec。
-      spec = await preferNpmSpec({ spec });
+      // 视为抢注，回退 github: 全仓库 spec。查的 registry 必须是 pnpm 实际
+      // 安装用的那个，否则镜像用户这里永远比对不上、次次退化成全仓库克隆。
+      const registry = await registryFor(profile, npmRegistry);
+      spec = await preferNpmSpec({ spec, registry, sources: rawSources });
       // 宿主依赖硬拦：dependencies 里拖着 @deepseek-ai/* 的包装进 profile
       // 就是双模块实例 + 全工具调度崩溃（宿主无任何护栏，市场是最后防线）。
       try {
-        await assertSafeToInstall({ spec });
+        await assertSafeToInstall({ spec, registry, sources: rawSources });
       } catch (error) {
         return rpcFail(error);
       }
@@ -322,7 +339,7 @@ function registerRpcChannel(ctx, config, token) {
 }
 
 export function apply(ctx, config = {}) {
-  const { defaultProfile = "web", apiBase = "https://api.github.com", perPageMax = 30 } = config;
+  const { defaultProfile = "web", apiBase = "https://api.github.com", perPageMax = 30, npmRegistry = "", rawSources = [] } = config;
   const token = process.env.GITHUB_TOKEN ?? process.env.DSH_MARKET_GITHUB_TOKEN;
 
   ctx.systemPrompt.section({
@@ -433,8 +450,9 @@ export function apply(ctx, config = {}) {
       const profile = String(args.profile ?? defaultProfile).trim();
       const normalized = normalizeSpec(args.spec);
       assertSafeSpec(normalized);
-      const spec = await preferNpmSpec({ spec: normalized });
-      await assertSafeToInstall({ spec });
+      const registry = await registryFor(profile, npmRegistry);
+      const spec = await preferNpmSpec({ spec: normalized, registry, sources: rawSources });
+      await assertSafeToInstall({ spec, registry, sources: rawSources });
       let profileDir;
       try {
         profileDir = resolveProfileDir(profile);