@chance722/dsh-inbox 0.2.1 → 0.2.3

package/README.md

@@ -60,14 +60,14 @@ Two questions in the same conversation, on a real machine:
 
 ## Install
 
-Requires Node ≥ 22 and a working `dsh` (`@deepseek-ai/dsh`).
+Needs Node ≥ 22 and a working `dsh`. `dsh plugin add` forwards to pnpm, so the installer brings pnpm along when your machine does not have it:
 
 **Platform**: fully accepted on **Windows** only so far; macOS and Linux are **not verified yet** (no platform-specific dependency in the code — try it and tell me how it goes).
 
 `dsh web` is just `dsh --profile web`, so install into the profile you already start:
 
 ```powershell
-npx @chance722/dsh-inbox init --profile web
+npx @chance722/dsh-inbox init --profile web --install-pnpm
 ```
 
 Then start dsh the way you always do — `dsh web`. The **Inbox** entry is in the left rail, and a new session's assistant can look things up for you ("what links in my inbox haven't I read yet?").
@@ -75,7 +75,7 @@ Then start dsh the way you always do — `dsh web`. The **Inbox** entry is in th
 On a machine that has never run dsh there is no `web` profile yet; `--create-profile` makes it first:
 
 ```powershell
-npx @chance722/dsh-inbox init --profile web --create-profile
+npx @chance722/dsh-inbox init --profile web --create-profile --install-pnpm
 ```
 
 `init` does three things, and running it twice is safe:
@@ -93,7 +93,7 @@ npx @chance722/dsh-inbox init --create-profile     # an isolated `inbox` profile
 dsh --profile inbox --no-open --port 3102          # start it there
 ```
 
-Other flags: `--profile <name>` installs elsewhere, `--no-default` leaves the default preset alone, `--help` lists everything. Which profile you install into only decides **where the panel runs** — the agent preset is shared by every profile (`~/.dsh/.agent-presets/inbox/`), so installing into a second one just fills in the missing row.
+Other flags: `--profile <name>` installs elsewhere, `--install-pnpm` installs pnpm first when it is missing (the two commands above already carry it), `--no-default` leaves the default preset alone, `--help` lists everything. Which profile you install into only decides **where the panel runs** — the agent preset is shared by every profile (`~/.dsh/.agent-presets/inbox/`), so installing into a second one just fills in the missing row.
 
 ### From a local checkout
 

package/README.zh.md

@@ -60,14 +60,14 @@
 
 ## 安装
 
-前置：Node ≥ 22，以及一个能用的 `dsh`（`@deepseek-ai/dsh`）。
+前置：Node ≥ 22，以及一个能用的 `dsh`。`dsh plugin add` 是转发给 pnpm 的，所以机器上没有 pnpm 时，安装命令会顺手替你装好：
 
 **平台**：目前只在 **Windows** 上做过完整验收；macOS / Linux **尚未验证**（代码里没有平台特定依赖，欢迎试用后反馈）。
 
 `dsh web` 就是 `dsh --profile web`，所以直接装进你日常启动的那个 profile：
 
 ```powershell
-npx @chance722/dsh-inbox init --profile web
+npx @chance722/dsh-inbox init --profile web --install-pnpm
 ```
 
 然后照旧启动——`dsh web`。左栏出现 **Inbox**；新会话里问「我的收件箱里有哪些还没看的链接」，助手就会去查。
@@ -75,7 +75,7 @@ npx @chance722/dsh-inbox init --profile web
 全新机器（从没跑过 dsh，还没有 `web` 这个 profile）加 `--create-profile` 让它先建：
 
 ```powershell
-npx @chance722/dsh-inbox init --profile web --create-profile
+npx @chance722/dsh-inbox init --profile web --create-profile --install-pnpm
 ```
 
 `init` 做三件事，重复运行是安全的：
@@ -93,7 +93,7 @@ npx @chance722/dsh-inbox init --create-profile     # 建一个隔离的 inbox pr
 dsh --profile inbox --no-open --port 3102          # 在那个 profile 里起
 ```
 
-其它选项：`--profile <名字>` 装到别处，`--no-default` 不动默认 preset，`--help` 列全。装进哪个 profile 只决定**面板跑在哪儿**——agent preset 是所有 profile 共享的（`~/.dsh/.agent-presets/inbox/`），装第二个 profile 只会补上缺的那行。
+其它选项：`--profile <名字>` 装到别处，`--install-pnpm` 在没有 pnpm 时先替你装（上面两条命令已经带上它），`--no-default` 不动默认 preset，`--help` 列全。装进哪个 profile 只决定**面板跑在哪儿**——agent preset 是所有 profile 共享的（`~/.dsh/.agent-presets/inbox/`），装第二个 profile 只会补上缺的那行。
 
 ### 从本地仓库装
 

package/lib/cli.js

@@ -36,6 +36,7 @@ function usage() {
   --create-profile   profile \u4E0D\u5B58\u5728\u65F6\u7528 dsh \u81EA\u5E26\u7684 web \u6A21\u677F\u5EFA\u4E00\u4E2A\uFF08\u9ED8\u8BA4\u4E0D\u5F00\uFF09
   --preset <id>      agent preset \u7684 id\uFF0C\u9ED8\u8BA4 inbox
   --package <\u6765\u6E90>   \u63D2\u4EF6\u6765\u6E90\uFF0C\u9ED8\u8BA4 ${PACKAGE_NAME}\uFF08\u672C\u5730\u5F00\u53D1\u4F20\u4ED3\u5E93\u8DEF\u5F84\uFF09
+  --install-pnpm     PATH \u4E0A\u6CA1\u6709 pnpm \u65F6\u66FF\u4F60\u88C5\uFF08\u5148 npm i -g pnpm\uFF0C\u4E0D\u884C\u518D\u8BD5 corepack\uFF09
   --no-default       \u4E0D\u628A\u9ED8\u8BA4 preset \u6307\u8FC7\u53BB\uFF08\u53EA\u88C5\uFF0C\u4E0D\u6539 dsh \u7684\u9ED8\u8BA4\u9009\u62E9\uFF09
   --help             \u8FD9\u4EFD\u8BF4\u660E
 
@@ -49,7 +50,8 @@ function parse(argv) {
     preset: "",
     source: PACKAGE_NAME,
     defaultPreset: true,
-    createProfile: false
+    createProfile: false,
+    installPnpm: false
   };
   const rest = argv[0] === "init" ? argv.slice(1) : argv;
   for (let index = 0; index < rest.length; index += 1) {
@@ -68,6 +70,7 @@ function parse(argv) {
     else if (flag === "--package") options.source = value();
     else if (flag === "--no-default") options.defaultPreset = false;
     else if (flag === "--create-profile") options.createProfile = true;
+    else if (flag === "--install-pnpm") options.installPnpm = true;
     else throw new Error(`\u770B\u4E0D\u61C2\u7684\u9009\u9879\uFF1A${String(flag)}`);
   }
   if (options.preset.length === 0) options.preset = "inbox";
@@ -222,6 +225,18 @@ function main(argv) {
   const profile = choice.profile;
   const chosen = choice.label.length === 0 ? "" : `\uFF08${choice.label}\uFF09`;
   const profileDir = join(home, "profiles", profile);
+  if (!hasPnpm()) {
+    if (!options.installPnpm) {
+      process.stderr.write(missingPnpmMessage(profile, options.source));
+      return 1;
+    }
+    process.stdout.write("\xB7 PATH \u4E0A\u6CA1\u6709 pnpm\uFF0C\u5148\u88C5\u4E00\u4E2A\uFF08--install-pnpm\uFF09\u2026\n");
+    if (!installPnpm()) {
+      process.stderr.write(missingPnpmMessage(profile, options.source));
+      return 1;
+    }
+    process.stdout.write("   pnpm \u88C5\u597D\u4E86\n");
+  }
   if (!existsSync(join(profileDir, "package.json"))) {
     const hint = `\u5148\u5EFA\u4E00\u4E2A\uFF1Adsh --profile ${profile} --from-default-profile web --dump-config
 \uFF08profile \u540D\u662F dsh \u81EA\u5E26\u6A21\u677F\u65F6\u7528\uFF1Adsh --profile ${profile} --dump-config\uFF09
@@ -322,6 +337,39 @@ function profileCreationAttempts(profile) {
     ["--profile", profile, "--dump-config"]
   ];
 }
+function hasPnpm() {
+  const probe = spawnSync("pnpm", ["--version"], {
+    shell: process.platform === "win32",
+    stdio: "ignore"
+  });
+  return probe.error === void 0 && probe.status === 0;
+}
+function pnpmInstallAttempts() {
+  return [
+    ["npm", "i", "-g", "pnpm"],
+    ["corepack", "enable", "pnpm"]
+  ];
+}
+function installPnpm() {
+  for (const args of pnpmInstallAttempts()) {
+    const command = args.join(" ");
+    process.stdout.write(`   ${command} \u2026
+`);
+    const run = spawnSync(args[0], [...args].slice(1), {
+      stdio: "inherit",
+      shell: process.platform === "win32"
+    });
+    if (run.error === void 0 && run.status === 0 && hasPnpm()) return true;
+  }
+  return false;
+}
+function missingPnpmMessage(profile, source) {
+  return `\u88C5\u63D2\u4EF6\u9700\u8981 pnpm\uFF1Adsh \u7684 \`plugin add\` \u662F\u8F6C\u53D1\u7ED9 pnpm \u7684\uFF08\u4E0D\u662F\u672C\u547D\u4EE4\u7684\u9009\u62E9\uFF09\u3002
+\u8981\u4E48\u81EA\u5DF1\u88C5\uFF1Anpm i -g pnpm    \uFF08\u6216\u8005\uFF1Acorepack enable pnpm\uFF09
+\u8981\u4E48\u91CD\u8DD1\u65F6\u52A0\u4E0A --install-pnpm\uFF0C\u8BA9\u672C\u547D\u4EE4\u66FF\u4F60\u88C5\u3002
+\u624B\u52A8\u7B49\u4EF7\u547D\u4EE4\uFF1Adsh plugin --profile ${profile} add ${source}
+`;
+}
 function createProfile(profile) {
   let output = "";
   for (const args of profileCreationAttempts(profile)) {
@@ -342,6 +390,8 @@ export {
   ensurePresetRow,
   isEntryPoint,
   listProfiles,
+  missingPnpmMessage,
   parse,
+  pnpmInstallAttempts,
   profileCreationAttempts
 };

package/lib/client.js

@@ -624,6 +624,14 @@ window.__ModuleLoader__.load({
 		var INBOX_ENDPOINT_TAGS = "tags";
 		var INBOX_ENDPOINT_SECRET = "secret";
 		var INBOX_ENDPOINT_PUSH = "push";
+		var DEFAULT_SYNC_DIRECTORY = "inbox";
+		function syncDirectory(raw) {
+		  const trimmed = (raw ?? "").trim().replace(/^\/+|\/+$/g, "");
+		  return trimmed.length === 0 ? DEFAULT_SYNC_DIRECTORY : trimmed;
+		}
+		function syncRootFor(raw) {
+		  return `${syncDirectory(raw)}/sync`;
+		}
 		function isSuccess(status) {
 		  return status >= 200 && status < 300;
 		}
@@ -816,6 +824,7 @@ window.__ModuleLoader__.load({
 		  "settings.save": "\u4FDD\u5B58",
 		  "settings.probe": "\u81EA\u68C0",
 		  "settings.details": "\u8BE6\u60C5\uFF08{count} \u6B21\u8BF7\u6C42\uFF09",
+		  "settings.syncRootNow": "\u540C\u6B65\u6839\uFF1A{root}",
 		  "settings.noServiceBody": "\u8FD9\u4E2A\u7EC4\u5408\u91CC\u6CA1\u6709\u8BBE\u7F6E\u670D\u52A1\uFF0C\u5730\u5740\u6539\u4E0D\u4E86\u2014\u2014\u4F60\u591A\u534A\u5728\u7528 headless \u5F62\u6001\u5F00\u53D1\u3002",
 		  "settings.bucketHint": "\u522B\u7684\u8BBE\u5907\u5F80\u8FD9\u91CC\u6254\u4E1C\u897F",
 		  // Notices (the one-line status under the toolbar).
@@ -858,7 +867,9 @@ window.__ModuleLoader__.load({
 		  "sync.pullMerged": "\u4ECE\u4E91\u7AEF\u5408\u5E76 {count} \u6761{attachments}",
 		  "sync.pullAttachments": " / {count} \u4E2A\u9644\u4EF6",
 		  "sync.pullDone": "\u62C9\u53D6\u5B8C\u6210\uFF1A\u8FDC\u7AEF\u5217\u51FA {listed} \u9879\uFF0C\u65B0\u5165\u5E93 {pulled} \u6761\uFF0C\u8DF3\u8FC7 {skipped} \u6761{tail}",
-		  "sync.pullFailedCount": " \xB7 \u5931\u8D25 {count} \u6761",
+		  "sync.pullSkipWhy": "\uFF08\u81EA\u5DF1\u7684\u540C\u6B65\u5BF9\u8C61 {sync} \u9879\u3001\u6BD4\u4E0A\u6B21\u62C9\u53D6\u66F4\u65E7 {older} \u9879\uFF09",
+		  "sync.pullForeignSync": " \xB7 \u26A0\uFE0F \u8FD8\u53D1\u73B0\u53E6\u4E00\u5957\u540C\u6B65\u524D\u7F00 {roots}\uFF08\u672C\u673A\u662F {ours}\uFF09\uFF1A\u4E24\u53F0\u673A\u5668\u7684\u300C\u76EE\u5F55\u300D\u8BBE\u7F6E\u4E0D\u4E00\u81F4\uFF0C\u5148\u628A\u4E24\u8FB9\u6539\u6210\u540C\u4E00\u4E2A",
+		  "sync.pullFailures": " \xB7 \u5931\u8D25 {count}\uFF1A{reason}",
 		  "sync.thisPage": " \xB7 \u672C\u9875 {count} \u6761",
 		  "settings.status": "{settings} \xB7 {webdav} \xB7 {s3}",
 		  "settings.statusOn": "\u8BBE\u7F6E\u670D\u52A1\u5728",
@@ -1072,6 +1083,7 @@ window.__ModuleLoader__.load({
 		  "settings.save": "Save",
 		  "settings.probe": "Test",
 		  "settings.details": "Details ({count} requests)",
+		  "settings.syncRootNow": "sync root: {root}",
 		  "settings.noServiceBody": "this composition has no settings service, so the address cannot be changed \u2014 you are most likely running the headless shape.",
 		  "settings.bucketHint": "other devices drop things here",
 		  "notice.listFailed": "Could not read the list: {reason}",
@@ -1112,7 +1124,9 @@ window.__ModuleLoader__.load({
 		  "sync.pullMerged": "Merged {count} from the cloud{attachments}",
 		  "sync.pullAttachments": " / {count} attachment(s)",
 		  "sync.pullDone": "Pull done: {listed} listed remotely, {pulled} filed, {skipped} skipped{tail}",
-		  "sync.pullFailedCount": " \xB7 {count} failed",
+		  "sync.pullSkipWhy": " ({sync} of our own sync objects, {older} older than the last pull)",
+		  "sync.pullForeignSync": " \xB7 \u26A0\uFE0F another sync prefix exists: {roots} (this machine: {ours}) \u2014 two machines have different directory settings; make them match",
+		  "sync.pullFailures": " \xB7 {count} failed: {reason}",
 		  "sync.thisPage": " \xB7 {count} on this page",
 		  "settings.status": "{settings} \xB7 {webdav} \xB7 {s3}",
 		  "settings.statusOn": "settings service present",
@@ -3217,11 +3231,20 @@ window.__ModuleLoader__.load({
 		    attachments: attachments === 0 ? "" : t("sync.pullAttachments", { count: attachments })
 		  });
 		  if (result.pulled === 0 && result.skipped === 0 && result.failed === 0) return syncPart;
+		  const skippedWhy = result.skippedSync === void 0 ? "" : t("sync.pullSkipWhy", { sync: result.skippedSync, older: result.skippedOlder ?? 0 });
+		  const foreignWhy = result.foreignSyncRoots === void 0 || result.foreignSyncRoots.length === 0 ? "" : t("sync.pullForeignSync", {
+		    roots: result.foreignSyncRoots.join("\u3001"),
+		    ours: result.syncRoot ?? ""
+		  });
+		  const failedWhy = result.failed > 0 ? t("sync.pullFailures", {
+		    count: result.failed,
+		    reason: result.reason ?? t("sync.pushUnknown")
+		  }) : "";
 		  return t("sync.pullDone", {
 		    listed: result.listed,
 		    pulled: result.pulled,
 		    skipped: result.skipped,
-		    tail: `${syncPart}${result.failed > 0 ? t("sync.pullFailedCount", { count: result.failed }) : ""}`
+		    tail: `${skippedWhy}${syncPart}${foreignWhy}${failedWhy}`
 		  });
 		}
 		function EncryptionSettings({ call }) {
@@ -3581,12 +3604,19 @@ window.__ModuleLoader__.load({
 		          }
 		        )
 		      ] }),
-		      /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("p", { style: { margin: 0, opacity: 0.6 }, children: [
-		        t("settings.dirS3.lead"),
-		        /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("code", { children: "/inbox" }),
-		        t("settings.dirS3.mid"),
-		        /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("code", { children: "inbox/" }),
-		        t("settings.dirS3.tail")
+		      /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("label", { style: { display: "flex", gap: 8, alignItems: "center" }, children: [
+		        /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("span", { style: { opacity: 0.7, minWidth: 64 }, children: t("settings.bucketDir") }),
+		        /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(
+		          "input",
+		          {
+		            value: directory,
+		            disabled: busy,
+		            onChange: (event) => setDirectory(event.target.value),
+		            placeholder: "/inbox",
+		            style: { ...inputStyle, flex: 1 }
+		          }
+		        ),
+		        /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("span", { style: { opacity: 0.6 }, children: t("settings.syncRootNow", { root: syncRootFor(directory) }) })
 		      ] })
 		    ] }),
 		    /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("div", { style: { display: "flex", gap: 8, alignItems: "center", flexWrap: "wrap" }, children: [

package/lib/index.js

@@ -3,7 +3,7 @@ import { defineTool as defineTool2 } from "@deepseek-ai/dsh-tools";
 
 // src/shared/constants.ts
 var PACKAGE_NAME = "@chance722/dsh-inbox";
-var VERSION = true ? "0.2.1" : "0.0.0-dev";
+var VERSION = true ? "0.2.3" : "0.0.0-dev";
 var DEFAULT_USER_AGENT = "dsh-inbox";
 
 // src/shared/vocabulary.ts
@@ -933,6 +933,42 @@ async function readFile(path, deps, absoluteUrl) {
   return { bytes, contentType: declared.split(";")[0] ?? "application/octet-stream" };
 }
 
+// src/shared/panel-wire.ts
+var INBOX_API_PREFIX = "/api/inbox";
+var INBOX_ENDPOINT_CAPTURE = "capture";
+var INBOX_ENDPOINT_LIST = "list";
+var INBOX_ENDPOINT_DETAIL = "detail";
+var INBOX_ENDPOINT_UPDATE = "update";
+var INBOX_ENDPOINT_DELETE = "delete";
+var INBOX_ENDPOINT_RESTORE = "restore";
+var INBOX_ENDPOINT_PURGE = "purge";
+var INBOX_ENDPOINT_ATTACHMENT = "attachment";
+var INBOX_ENDPOINT_WEBDAV = "webdav";
+var INBOX_ENDPOINT_PULL = "pull";
+var INBOX_ENDPOINT_PROBE = "probe";
+var INBOX_ENDPOINT_UI = "ui";
+var INBOX_ENDPOINT_TAGS = "tags";
+var INBOX_ENDPOINT_SECRET = "secret";
+var INBOX_ENDPOINT_PUSH = "push";
+var DEFAULT_SYNC_DIRECTORY = "inbox";
+function syncDirectory(raw) {
+  const trimmed = (raw ?? "").trim().replace(/^\/+|\/+$/g, "");
+  return trimmed.length === 0 ? DEFAULT_SYNC_DIRECTORY : trimmed;
+}
+function syncRootFor(raw) {
+  return `${syncDirectory(raw)}/sync`;
+}
+var INBOX_IMAGE_TYPES = ["image/png", "image/jpeg", "image/webp", "image/gif"];
+var LIST_LIMIT = 50;
+var UI_LIST_MODES = ["grid", "compact"];
+var PREVIEW_CHARS = 140;
+var MAX_ATTACHMENTS_PER_SUBMISSION = 20;
+var MAX_NOTE_CHARS = 2e3;
+var MAX_TAGS = 20;
+var MAX_TAG_CHARS = 40;
+var MAX_FILTER_CHARS = 200;
+var MAX_TITLE_CHARS = 300;
+
 // src/host/webdav/config.ts
 import z from "@deepseek-ai/schemastery";
 var SETTINGS_NAMESPACE = "dsh-inbox-webdav";
@@ -1070,36 +1106,6 @@ async function saveWebdav(ctx, vault, base, patch) {
 
 // src/host/remote/pull.ts
 import { admitEncodedFile, admitEncodedImages } from "@deepseek-ai/dsh-attachment";
-
-// src/shared/panel-wire.ts
-var INBOX_API_PREFIX = "/api/inbox";
-var INBOX_ENDPOINT_CAPTURE = "capture";
-var INBOX_ENDPOINT_LIST = "list";
-var INBOX_ENDPOINT_DETAIL = "detail";
-var INBOX_ENDPOINT_UPDATE = "update";
-var INBOX_ENDPOINT_DELETE = "delete";
-var INBOX_ENDPOINT_RESTORE = "restore";
-var INBOX_ENDPOINT_PURGE = "purge";
-var INBOX_ENDPOINT_ATTACHMENT = "attachment";
-var INBOX_ENDPOINT_WEBDAV = "webdav";
-var INBOX_ENDPOINT_PULL = "pull";
-var INBOX_ENDPOINT_PROBE = "probe";
-var INBOX_ENDPOINT_UI = "ui";
-var INBOX_ENDPOINT_TAGS = "tags";
-var INBOX_ENDPOINT_SECRET = "secret";
-var INBOX_ENDPOINT_PUSH = "push";
-var INBOX_IMAGE_TYPES = ["image/png", "image/jpeg", "image/webp", "image/gif"];
-var LIST_LIMIT = 50;
-var UI_LIST_MODES = ["grid", "compact"];
-var PREVIEW_CHARS = 140;
-var MAX_ATTACHMENTS_PER_SUBMISSION = 20;
-var MAX_NOTE_CHARS = 2e3;
-var MAX_TAGS = 20;
-var MAX_TAG_CHARS = 40;
-var MAX_FILTER_CHARS = 200;
-var MAX_TITLE_CHARS = 300;
-
-// src/host/remote/pull.ts
 var DEFAULT_DIRECTORY = "/inbox";
 var TEXT_TYPES = ["text/", "application/json"];
 var TEXT_SUFFIXES = [".txt", ".md", ".url", ".json"];
@@ -1108,8 +1114,11 @@ function looksTextual(name2, contentType) {
   if (TEXT_SUFFIXES.some((suffix) => lower.endsWith(suffix))) return true;
   return contentType !== void 0 && TEXT_TYPES.some((prefix) => contentType.startsWith(prefix));
 }
-function isSyncObject(path) {
-  return path.split("/").some((part) => part === "sync");
+function syncPrefixOf(path) {
+  const parts = path.split("/").filter((part) => part.length > 0);
+  const at = parts.lastIndexOf("sync");
+  if (at === -1) return void 0;
+  return parts.slice(0, at + 1).slice(-2).join("/");
 }
 function laterOf(current, candidate) {
   if (candidate === void 0) return current;
@@ -1128,7 +1137,7 @@ function isNewer(entry, lastPullAt) {
   if (Number.isNaN(seen) || Number.isNaN(remote)) return true;
   return remote > seen;
 }
-async function ingestFrom(vault, source, attachments) {
+async function ingestFrom(vault, source, attachments, syncRoot3 = syncRootFor(void 0)) {
   const lastPullAt = vault.global.sync.lastPullAt;
   let entries;
   try {
@@ -1141,15 +1150,28 @@ async function ingestFrom(vault, source, attachments) {
   let pulled = 0;
   let failed2 = 0;
   let skipped = 0;
+  let skippedSync = 0;
+  let skippedOlder = 0;
+  let skippedForeign = 0;
+  const foreignSyncRoots = /* @__PURE__ */ new Set();
   let newestSuccess;
   const failures = [];
   for (const entry of entries) {
-    if (isSyncObject(entry.path)) {
+    const prefix = syncPrefixOf(entry.path);
+    if (prefix !== void 0 && prefix !== syncRoot3) {
+      skipped += 1;
+      skippedForeign += 1;
+      foreignSyncRoots.add(prefix);
+      continue;
+    }
+    if (prefix !== void 0) {
       skipped += 1;
+      skippedSync += 1;
       continue;
     }
     if (!isNewer(entry, lastPullAt)) {
       skipped += 1;
+      skippedOlder += 1;
       continue;
     }
     const name2 = nameOf(entry.path);
@@ -1207,6 +1229,11 @@ async function ingestFrom(vault, source, attachments) {
     pulled,
     failed: failed2,
     skipped,
+    skippedSync,
+    skippedOlder,
+    skippedForeign,
+    syncRoot: syncRoot3,
+    ...foreignSyncRoots.size === 0 ? {} : { foreignSyncRoots: [...foreignSyncRoots] },
     listed,
     lastPullAt: cursor,
     ...failures.length === 0 ? {} : { reason: failures.slice(0, 3).join("\uFF1B") }
@@ -1224,7 +1251,7 @@ async function pullRemote(vault, config, deps) {
       listed: 0
     };
   }
-  const directory = config.directory ?? DEFAULT_DIRECTORY;
+  const directory = `/${syncDirectory(config.directory ?? DEFAULT_DIRECTORY)}`;
   return ingestFrom(
     vault,
     {
@@ -1235,7 +1262,9 @@ async function pullRemote(vault, config, deps) {
       })),
       read: async (entry) => readFile(entry.path, deps, entry.path.startsWith("http") ? entry.path : void 0)
     },
-    deps.attachments
+    deps.attachments,
+    // WebDAV resolves the sync root from the same directory rule the writer uses.
+    syncRootFor(config.directory)
   );
 }
 async function pullS3(vault, config, prefix, deps) {
@@ -1258,7 +1287,9 @@ async function pullS3(vault, config, prefix, deps) {
       })),
       read: async (entry) => readObject(config, entry.path, deps)
     },
-    deps.attachments
+    deps.attachments,
+    // S3 is handed the prefix by its caller — that prefix *is* the sync root.
+    prefix
   );
 }
 
@@ -1570,8 +1601,7 @@ async function pullDropFolder(ctx, vault, attachments) {
 
 // src/host/remote/writer.ts
 function syncRoot(settings) {
-  const prefix = settings.directory.replace(/^\/+|\/+$/g, "");
-  return prefix.length === 0 ? "sync" : `${prefix}/sync`;
+  return syncRootFor(settings.directory);
 }
 async function remoteWriter(ctx) {
   const settings = readSettings(ctx);

package/lib/types/cli.d.ts

@@ -48,6 +48,8 @@ export interface Options {
     defaultPreset: boolean;
     /** Create the profile when it is missing, instead of refusing. */
     createProfile: boolean;
+    /** Install pnpm when it is missing, instead of stopping to explain it. */
+    installPnpm: boolean;
 }
 export declare function parse(argv: readonly string[]): Options | undefined;
 /**
@@ -118,3 +120,25 @@ export declare function isEntryPoint(moduleUrl: string, entry: string | undefine
  * @returns argv lists for `dsh`, most specific first.
  */
 export declare function profileCreationAttempts(profile: string): readonly (readonly string[])[];
+/**
+ * The commands that can put pnpm on PATH, in the order to try them.
+ *
+ * `npm i -g pnpm` first because whoever ran `npx` has npm by definition and
+ * knows where its global shims land. `corepack enable pnpm` is the fallback:
+ * no download, but it needs a Node that still ships corepack (Node ≥ 25 does
+ * not), so it cannot be the first choice.
+ *
+ * @returns argv lists, most likely to work first.
+ */
+export declare function pnpmInstallAttempts(): readonly (readonly string[])[];
+/**
+ * What to say when there is no pnpm to hand.
+ *
+ * Exported because the wording is the whole value here: the point is that the
+ * reader can act on it without knowing which part of the chain wanted pnpm.
+ *
+ * @param profile - the profile that was about to receive the plugin.
+ * @param source - the package (or path) that was about to be installed.
+ * @returns the message, ending in the command to run by hand.
+ */
+export declare function missingPnpmMessage(profile: string, source: string): string;

package/lib/types/client/messages.d.ts

@@ -144,6 +144,7 @@ export declare const zh: {
     'settings.save': string;
     'settings.probe': string;
     'settings.details': string;
+    'settings.syncRootNow': string;
     'settings.noServiceBody': string;
     'settings.bucketHint': string;
     'notice.listFailed': string;
@@ -184,7 +185,9 @@ export declare const zh: {
     'sync.pullMerged': string;
     'sync.pullAttachments': string;
     'sync.pullDone': string;
-    'sync.pullFailedCount': string;
+    'sync.pullSkipWhy': string;
+    'sync.pullForeignSync': string;
+    'sync.pullFailures': string;
     'sync.thisPage': string;
     'settings.status': string;
     'settings.statusOn': string;
@@ -401,6 +404,7 @@ export declare const MESSAGES: {
         'settings.save': string;
         'settings.probe': string;
         'settings.details': string;
+        'settings.syncRootNow': string;
         'settings.noServiceBody': string;
         'settings.bucketHint': string;
         'notice.listFailed': string;
@@ -441,7 +445,9 @@ export declare const MESSAGES: {
         'sync.pullMerged': string;
         'sync.pullAttachments': string;
         'sync.pullDone': string;
-        'sync.pullFailedCount': string;
+        'sync.pullSkipWhy': string;
+        'sync.pullForeignSync': string;
+        'sync.pullFailures': string;
         'sync.thisPage': string;
         'settings.status': string;
         'settings.statusOn': string;

package/lib/types/host/remote/pull.d.ts

@@ -43,7 +43,9 @@ export interface RemoteSource {
  * @param attachments - the store that owns pulled bytes.
  * @returns what happened.
  */
-export declare function ingestFrom(vault: Vault, source: RemoteSource, attachments: AttachmentStore): Promise<PullResult>;
+export declare function ingestFrom(vault: Vault, source: RemoteSource, attachments: AttachmentStore, 
+/** This machine's own sync root; anything else under `sync/` is a stranger. */
+syncRoot?: string): Promise<PullResult>;
 /** What the user configures for WebDAV. */
 export interface WebdavConfig {
     baseUrl: string;

package/lib/types/shared/panel-wire.d.ts

@@ -123,6 +123,33 @@ export interface WebdavStatus {
     credentialsAvailable: boolean;
 }
 /** What one pull did, for the panel and for the log. */
+/** The directory a sync uses when the user never named one. */
+export declare const DEFAULT_SYNC_DIRECTORY = "inbox";
+/**
+ * The directory a sync actually uses, decided in one place.
+ *
+ * `/`, an empty string and "never named one" all mean the default. They used to
+ * mean different things depending on which path read them: `syncRoot()` turned a
+ * stripped-empty directory into the *bucket root* (`sync/`) while the
+ * drop-folder ingest defaulted to `/inbox`, so two machines set up through the
+ * same dialog could write to `sync/` and `inbox/sync/` respectively — and the
+ * merge, which reads its own prefix, then found nothing and reported nothing new
+ * (measured 2026-09-20).
+ *
+ * @param raw - whatever the settings hold, if anything.
+ * @returns the directory without leading or trailing slashes; never empty.
+ */
+export declare function syncDirectory(raw: string | undefined): string;
+/**
+ * Where the vault's own objects live: `<directory>/sync`.
+ *
+ * Shared by the writer, the drop-folder ingest and the display, so "which
+ * prefix is mine" has one answer on both sides of the wire.
+ *
+ * @param raw - the configured directory, if any.
+ * @returns the sync root, e.g. `inbox/sync`.
+ */
+export declare function syncRootFor(raw: string | undefined): string;
 export interface PullResult {
     status: 'ok' | 'unconfigured' | 'failed';
     reason?: string;
@@ -137,6 +164,24 @@ export interface PullResult {
     failed: number;
     /** Files the server listed but we skipped as already-seen. */
     skipped: number;
+    /**
+     * How many of {@link skipped} were the vault's own upload queue (`sync/…`).
+     *
+     * Optional because the older shape of this result (and every test that builds
+     * one by hand) predates the split.
+     */
+    skippedSync?: number;
+    /** How many of {@link skipped} were older than the last pull's cursor. */
+    skippedOlder?: number;
+    /**
+     * How many of {@link skipped} sat under a `…/sync/` prefix that is **not**
+     * ours — another machine syncing under a different directory.
+     */
+    skippedForeign?: number;
+    /** Those other prefixes, e.g. `['inbox/sync']`; the panel warns about them. */
+    foreignSyncRoots?: string[];
+    /** This machine's own sync root, so the warning can name both sides. */
+    syncRoot?: string;
     /** How many entries the remote listed at all: distinguishes "empty folder"
      * from "everything already ingested". */
     listed: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chance722/dsh-inbox",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "private": false,
   "description": "Personal paste inbox for DeepSeek Harness (dsh): capture, classify, browse and retrieve.",
   "keywords": [