@deepseek-ai/dsh-client-ui-plugin-manager 0.1.7-alpha.1 → 0.1.7-alpha.2

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/ui-plugin-manager/README.md
-README.md: a281f00df4544564a324b4e7da10a1bc59debf10
-README.zh.md: 0287090cd70f2a95c058cc14197769b6f8ad8bd8
+README.md: a7e212adfc0b0ee03e4e8aa77fdf12cfa52205bf
+README.zh.md: be30b1af3624e6c5fa40fa6caf98f6d3e5bee323

package/README.md

@@ -31,7 +31,11 @@ Installed bundles and their plugin rows display their own title and description
 
 ### Installing a bundle
 
-**Add plugin** takes a package name with an optional version, a Git address, a tarball, or an absolute local path; the dialog says a package name is what follows `dsh plugin add` in a README. **Install guide and examples** under the field opens a guide that shows the three common forms with an example each; **Use example** drops one into the field. **Registry** beside it names the registry the install asks first and unfolds the choice: the default registry, pnpm's own, titled with the host the machine's pnpm configuration names; each mirror the Host configured (`pluginManager.registries`), npmmirror as the mainland China mirror; and a typed http(s) address. The options float over the dialog from the control, so unfolding them never lengthens the card, and the card's content scrolls when the guide makes it taller than the viewport. The registry the Host asks first is the choice until one is remembered; the choice is then remembered in this browser (`localStorage`) and starts the next dialog, and a remembered address the Host no longer offers stays as a typed one. **Install** first asks the Host to read what the spec names (`pluginManager.inspect`) at the chosen registry: a name the list already shows, a name no registry has, a path without a package, a package without a bundle patch, or a spec pnpm would refuse comes back under the field as one sentence, with the spec kept for editing; when no registry could be reached, the sentence names every one asked. The install then starts at the registry that answered. An accepted spec opens the installing screen, which shows the package's name, one-liner, and version as the Host read them and folds pnpm's command and output behind **Show install details**. A finished install offers **Enable now**, which switches the new bundle on, closes the dialog, and scrolls the list to it; closing instead leaves it installed and off. While the Host moves on to another registry, the installing screen says which registry could not serve the package and which is asked now, and each pnpm run behind the details carries a badge naming its registry. A failed install says what went wrong in one line, as the Host attributed it — no registry could be reached, naming every one asked; the host a GitHub address or a tarball link is fetched from could not be reached, which no registry helps; the package was not found, the disk is full, the profile is not writable, pnpm blocked a build script — with pnpm's output behind the details and **Retry** at hand, and **Change registry** beside it when the Host laid the failure at the registry it asked, which returns to the spec with the registry options open; the Host has already put the profile files back. When pnpm blocked a dependency's install scripts, the failed screen lists the packages whose scripts wait for permission and offers **Allow these scripts and retry** in place of **Retry**; the Host saves the permission in the profile's `pnpm-workspace.yaml`, which a failed run leaves as pnpm wrote it, then runs pnpm again, and the installed screen names what was allowed. A successful installation does not certify that a module can activate.
+On first use, when pnpm uses the unconfigured official npm registry and npmmirror is offered, the Host probes both registries in parallel. The first successful HTTPS ping response selects the initial source. The dialog preserves remembered choices, manual selections, explicit manager configuration, and custom or unknown pnpm registries. An install clicked during initial probing waits for that bounded operation; a late result cannot overwrite a manual choice or reopen a closed dialog.
+
+The Host sends GET requests to `https://registry.npmjs.org/-/ping` and `https://registry.npmmirror.com/-/ping` through its normal fetch proxy. A 2xx response wins; redirects and failures do not. The remaining request is cancelled, both response bodies are discarded, and cleanup completes before the result returns. The default deadline is 1500 ms and results, including unavailable results, are cached for five minutes. Configure `registryProbeTimeoutMs` and `registryProbeCacheTtlMs` on `ui-plugin-manager`; `registryProbeEnabled: false` disables probing. If both requests fail or time out, the existing default remains selected. No IP-location service or Session content is involved.
+
+**Add plugin** takes a package name with an optional version, a Git address, a tarball, or an absolute local path; the dialog says a package name is what follows `dsh plugin add` in a README. **Install guide and examples** under the field opens a guide that shows the three common forms with an example each; **Use example** drops one into the field. **Registry** beside it names the registry the install asks first and unfolds the choice: the default registry, pnpm's own, titled with the host the machine's pnpm configuration names; each mirror the Host configured (`pluginManager.registries`), npmmirror as the mainland China mirror; and a typed http(s) address. The options float over the dialog from the control, so unfolding them never lengthens the card, and the card's content scrolls when the guide makes it taller than the viewport. The initial choice follows the response comparison above; the choice is then remembered in this browser (`localStorage`) and starts the next dialog, and a remembered address the Host no longer offers stays as a typed one and remains the requested address when installation starts before the registry list returns. **Install** first asks the Host to read what the spec names (`pluginManager.inspect`) at the chosen registry: a name the list already shows, a name no registry has, a path without a package, a package without a bundle patch, or a spec pnpm would refuse comes back under the field as one sentence, with the spec kept for editing; when no registry could be reached, the sentence names every one asked. The install then starts at the registry that answered. An accepted spec opens the installing screen, which shows the package's name, one-liner, and version as the Host read them and folds pnpm's command and output behind **Show install details**. A finished install offers **Enable now**, which switches the new bundle on, closes the dialog, and scrolls the list to it; closing instead leaves it installed and off. While the Host moves on to another registry, the installing screen says which registry could not serve the package and which is asked now, and each pnpm run behind the details carries a badge naming its registry. A failed install says what went wrong in one line, as the Host attributed it — no registry could be reached, naming every one asked; the host a GitHub address or a tarball link is fetched from could not be reached, which no registry helps; the package was not found, the disk is full, the profile is not writable, pnpm blocked a build script — with pnpm's output behind the details and **Retry** at hand, and **Change registry** beside it when the Host laid the failure at the registry it asked, which returns to the spec with the registry options open; the Host has already put the profile files back. When pnpm blocked a dependency's install scripts, the failed screen lists the packages whose scripts wait for permission and offers **Allow these scripts and retry** in place of **Retry**; the Host saves the permission in the profile's `pnpm-workspace.yaml`, which a failed run leaves as pnpm wrote it, then runs pnpm again, and the installed screen names what was allowed. A successful installation does not certify that a module can activate.
 
 During preparation and download, **Cancel install** asks the Host to stop the run and waits for confirmation. Loading the bundle cannot be cancelled. Closing with ×, Escape, or the backdrop hides the dialog immediately and requests cancellation when possible. **View installation** reopens the same task with its output; another installation cannot start while its outcome is pending or unconfirmed. Confirmed cancellation returns to the spec and shows a toast; the manifest and lockfile are restored, while downloaded files can remain. A lost installation response triggers a request to recover the result; **Check installation status** and reconnect retry that request. If the Host has no active request, **Installation result unavailable** allows returning to editing after checking the plugin list. A cancellation sent before acceptance waits and retries automatically; a failed cancellation can be retried manually. Hidden tasks report their outcome through toasts without reopening the dialog.
 
@@ -83,6 +87,8 @@ Package management uses the profile's dependency records: installed bundles can
 
 ### Registration
 
+The Host entry exposes `pluginRegistryProbe.fastest()` through the generated Remote interface. It shares pending comparisons, expires cached results, and aborts and awaits outstanding probes on unload. Calls after unload return a rejected Promise.
+
 The browser plugin registers the `plugins` sidebar entry and its `main` panel through `ctx.slots.inject()`, so both follow late slot declaration, locale changes and teardown. The page is global and belongs to no Session. Display text comes from package metadata and the page's dictionary.
 
 ### The store
@@ -124,6 +130,8 @@ None; this package neither assembles nor sends a provider request.
 
 ## Known Limitations and Deferred Work
 
+- Ping response time does not measure package-download throughput. Probes use the Host fetch route, which pnpm-specific proxy settings can differ from; users can always choose the registry manually, and installation retains its existing fallback rules.
+
 <a id="known-limitations-and-deferred-work"></a>
 
 
@@ -134,7 +142,7 @@ These limits define the reach of the management view; they are current package c
 - **Rows show a phase, not a reason** — a failed row reads as failed without the Host's error text; the Host log has it.
 - **One install at a time** — the dialog runs one pnpm command; a second spec waits for the first to finish.
 - **No version picker** — the spec is typed as pnpm accepts it; the page neither lists registry versions nor offers upgrades.
-- **The registry choice is this browser's** — it lives in `localStorage`, so another browser, the `dsh plugin` command, and the agent tool start from the Host's configured registry.
+- **The registry choice is this browser's** — it lives in `localStorage`, so another browser applies its own initial recommendation; the `dsh plugin` command and the agent tool use the Host's configured registry.
 - **Every registry read runs pnpm** — opening the dialog, the check, and the install each ask pnpm what its own configuration names; a machine without pnpm reads it as unknown and is offered no fallback.
 
 <a id="dev-note"></a>
@@ -147,4 +155,4 @@ None.
 
 </details>
 
-**Runtime invariant:** No companion is published. This package owns a sidebar panel over Host-owned facts.
+**Runtime invariant:** No companion is published. The panel reads Host-owned facts, and the registry-probe cache stores one comparison result without an independently maintained projection.

package/README.zh.md

@@ -31,7 +31,11 @@ kind: "package-reference"
 
 ### 安装一个组合包
 
-**添加插件**接受包名（可带版本）、Git 地址、压缩包或本地绝对路径；对话框说明包名就是 README 里 `dsh plugin add` 后面的那一段。输入框下方的**插件安装引导和示例**展开一段引导，给出三种常见形式各一个示例；**填入示例**把示例填进输入框。旁边的**安装源**写着安装首先询问的注册表，展开后可选：默认安装源，即 pnpm 自身的注册表，标题带上本机 pnpm 配置指向的主机名；Host 配置的每个镜像（`pluginManager.registries`），npmmirror 显示为中国大陆镜像源；以及手动输入的 http(s) 地址。选项从控件上浮在对话框之上，展开不会拉长卡片；引导使卡片高过视口时，卡片内容可以滚动。Host 首先询问的注册表在记住选择之前就是当前选择；之后选择记在本浏览器（`localStorage`）里，下次打开对话框从它开始，Host 不再提供的已记住地址保留为手动输入的地址。**安装**先让 Host 在所选注册表读出 spec 指向什么（`pluginManager.inspect`）：列表中已有的名字、所有注册表都没有的名字、没有包的路径、没有组合包 patch 的包，或 pnpm 会拒绝的 spec，都以一句话回到输入框下方，spec 保留可继续编辑；所有注册表都连不上时，这句话列出问过的每一个。随后安装从作答的那个注册表开始。通过检查的 spec 打开安装中界面，展示 Host 读到的包名、一句话简介和版本，pnpm 的命令与输出折叠在**查看安装详情**之后。安装完成后提供**立即启用**：启用新组合包、关闭对话框并把列表滚动到它；直接关闭则让它保持已安装但关闭。Host 改问另一个注册表时，安装中界面会说明哪个源没能提供这个包、现在改问哪个，详情里每次 pnpm 运行都带一个写明所用源的标记。安装失败时按 Host 的归因用一行话说明原因——所有安装源都连不上，并列出问过的每一个；GitHub 地址或压缩包链接自身的主机连不上，换源无济于事；包不存在、磁盘已满、profile 不可写、pnpm 拦下了构建脚本——pnpm 输出在详情里，**重试**就在手边，Host 把失败归于所问注册表时还在旁边提供**更换安装源**，回到 spec 输入界面并展开安装源选项；Host 已经把 profile 文件放回原样。pnpm 拦下依赖的安装脚本时，失败界面列出等待允许的包，并以**允许这些脚本并重试**取代**重试**；Host 把授权写进 profile 的 `pnpm-workspace.yaml`（失败的运行保留 pnpm 写入的这个文件）再运行 pnpm，安装完成界面会说明允许了哪些脚本。安装成功不代表模块一定能够激活。
+首次使用时，如果未显式配置安装源、pnpm 使用官方 npm 源，且列表提供 npmmirror，Host 会并发探测这两个源，选择最先成功响应 HTTPS ping 的源。已记住的选择、用户手选、管理器显式配置，以及自定义或未知的 pnpm 源均保留。在初次探测期间点击安装会等待这次有时限的操作；迟到结果不会覆盖手选或重新打开已关闭的对话框。
+
+Host 通过普通 fetch 代理向 `https://registry.npmjs.org/-/ping` 和 `https://registry.npmmirror.com/-/ping` 发送 GET 请求，以最先返回 2xx 的源为结果；重定向和失败不参与选择。随后取消另一条请求、丢弃两个响应体，并在清理完成后返回。默认时限为 1500 毫秒，包括不可用结果在内的探测结果均缓存五分钟。在 `ui-plugin-manager` 上配置 `registryProbeTimeoutMs` 和 `registryProbeCacheTtlMs`；`registryProbeEnabled: false` 关闭探测。两条请求都失败或超时时保留现有默认源。不使用 IP 地区服务，也不发送 Session 内容。
+
+**添加插件**接受包名（可带版本）、Git 地址、压缩包或本地绝对路径；对话框说明包名就是 README 里 `dsh plugin add` 后面的那一段。输入框下方的**插件安装引导和示例**展开一段引导，给出三种常见形式各一个示例；**填入示例**把示例填进输入框。旁边的**安装源**写着安装首先询问的注册表，展开后可选：默认安装源，即 pnpm 自身的注册表，标题带上本机 pnpm 配置指向的主机名；Host 配置的每个镜像（`pluginManager.registries`），npmmirror 显示为中国大陆镜像源；以及手动输入的 http(s) 地址。选项从控件上浮在对话框之上，展开不会拉长卡片；引导使卡片高过视口时，卡片内容可以滚动。初始选择遵循上文的响应比较规则；之后选择记在本浏览器（`localStorage`）里，下次打开对话框从它开始，Host 不再提供的已记住地址保留为手动输入的地址；在安装源列表返回前开始安装，也仍请求该地址。**安装**先让 Host 在所选注册表读出 spec 指向什么（`pluginManager.inspect`）：列表中已有的名字、所有注册表都没有的名字、没有包的路径、没有组合包 patch 的包，或 pnpm 会拒绝的 spec，都以一句话回到输入框下方，spec 保留可继续编辑；所有注册表都连不上时，这句话列出问过的每一个。随后安装从作答的那个注册表开始。通过检查的 spec 打开安装中界面，展示 Host 读到的包名、一句话简介和版本，pnpm 的命令与输出折叠在**查看安装详情**之后。安装完成后提供**立即启用**：启用新组合包、关闭对话框并把列表滚动到它；直接关闭则让它保持已安装但关闭。Host 改问另一个注册表时，安装中界面会说明哪个源没能提供这个包、现在改问哪个，详情里每次 pnpm 运行都带一个写明所用源的标记。安装失败时按 Host 的归因用一行话说明原因——所有安装源都连不上，并列出问过的每一个；GitHub 地址或压缩包链接自身的主机连不上，换源无济于事；包不存在、磁盘已满、profile 不可写、pnpm 拦下了构建脚本——pnpm 输出在详情里，**重试**就在手边，Host 把失败归于所问注册表时还在旁边提供**更换安装源**，回到 spec 输入界面并展开安装源选项；Host 已经把 profile 文件放回原样。pnpm 拦下依赖的安装脚本时，失败界面列出等待允许的包，并以**允许这些脚本并重试**取代**重试**；Host 把授权写进 profile 的 `pnpm-workspace.yaml`（失败的运行保留 pnpm 写入的这个文件）再运行 pnpm，安装完成界面会说明允许了哪些脚本。安装成功不代表模块一定能够激活。
 
 准备和下载期间，**取消安装**会请求 Host 停止运行并等待确认。加载组合包的阶段不可取消。点击 ×、按 Escape 或点击遮罩会立即隐藏对话框，并在可以取消时请求取消。**查看安装任务**会重新打开同一任务并保留输出；结果待定或尚未确认时不能发起另一项安装。确认取消后回到 spec 输入界面并显示 toast；manifest 与 lockfile 已恢复，已下载文件可能保留。安装响应丢失后会请求恢复结果；**核对安装状态**和重连会重试该请求。Host 已无活动请求时，**未能获取安装结果**允许检查插件列表后返回编辑。早于接收确认的取消请求会等待并自动重试；取消失败可手动重试。隐藏的任务通过 toast 通知结果，不会重新弹出对话框。
 
@@ -83,6 +87,8 @@ ctx.slots.inject('plugins.detail.section', () => ctx.slots.register({
 
 ### 注册
 
+Host 入口通过生成的 Remote 接口暴露 `pluginRegistryProbe.fastest()`，共享进行中的比较、让缓存按时过期，并在卸载时中止和等待未完成探测。卸载后调用会返回拒绝的 Promise。
+
 浏览器插件通过 `ctx.slots.inject()` 注册 `plugins` 侧栏入口与它的 `main` 面板，使两者跟随 slot 延迟声明、本地化变化与销毁。页面为全局页面，不属于任何 Session。显示文本来自包元信息与页面字典。
 
 ### store
@@ -124,6 +130,8 @@ ctx.slots.inject('plugins.detail.section', () => ctx.slots.register({
 
 ## 已知限制与延期工作
 
+- Ping 响应时间不代表包下载吞吐量。探测使用 Host fetch 的网络路径，pnpm 专用代理设置可能使用不同路径；用户始终可以手动选择安装源，安装仍遵循现有回退规则。
+
 <a id="known-limitations-and-deferred-work"></a>
 
 
@@ -134,7 +142,7 @@ ctx.slots.inject('plugins.detail.section', () => ctx.slots.register({
 - **行只显示阶段，不显示原因**——失败的行只显示为失败，没有 Host 的错误文本；Host 日志里有。
 - **一次只能安装一个**——对话框一次运行一个 pnpm 命令；第二个 spec 要等前一个完成。
 - **没有版本选择器**——spec 按 pnpm 接受的写法输入；页面不列出注册表版本，也不提供升级。
-- **安装源选择只属于本浏览器**——它存在 `localStorage` 里，所以另一个浏览器、`dsh plugin` 命令和 agent 工具都从 Host 配置的注册表开始。
+- **安装源选择只属于本浏览器**——它存在 `localStorage` 里，所以另一个浏览器会独立计算初始推荐；`dsh plugin` 命令和 agent 工具使用 Host 配置的注册表。
 - **每次读注册表都要运行 pnpm**——打开对话框、检查、安装各问一次 pnpm 自身配置指向哪里；没有 pnpm 的机器读作未知，不提供备选。
 
 <a id="dev-note"></a>
@@ -147,4 +155,4 @@ ctx.slots.inject('plugins.detail.section', () => ctx.slots.register({
 
 </details>
 
-**运行时不变式：** 不发布伴生检查。本包只拥有一个基于 Host 事实的侧栏面板。
+**运行时不变式：** 不发布伴生检查。面板读取 Host 事实，安装源探测缓存只保存一次比较结果，没有独立维护的投影。

package/lib/client.js

@@ -74,7 +74,7 @@ window.__ModuleLoader__.load({
 			};
 		}
 		//#endregion
-		//#region ../../util/crypto/src/index.ts
+		//#region ../../util/crypto/lib/index.js
 		/**
 		* Random v4 UUID, minted from `crypto.getRandomValues`.
 		* @returns the UUID string.
@@ -86,10 +86,25 @@ window.__ModuleLoader__.load({
 			}).join("");
 			return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 		}
-		//#endregion
-		//#region ../../boot/plugin-manager/src/registry.ts
+		/** Public npmmirror URL shared by the fallback configuration and public-registry comparison. */
+		const NPMMIRROR_REGISTRY = "https://registry.npmmirror.com/";
 		/** An http(s) URL, as pnpm's `--registry` takes it. */
 		const REGISTRY_URL = /^https?:\/\/\S+$/;
+		/**
+		* Parse a registry URL into the form pnpm compares registries in: lower-case host, trailing slash.
+		* @param url - the registry as configured or requested.
+		* @returns the normalized URL.
+		* @throws {Error} for anything but an http(s) URL.
+		*/
+		function normalizeRegistry(url) {
+			let parsed;
+			try {
+				parsed = new URL(url);
+			} catch {}
+			if (parsed === void 0 || parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`a registry must be an http(s) URL: ${url}`);
+			if (!parsed.pathname.endsWith("/")) parsed.pathname += "/";
+			return parsed.href;
+		}
 		//#endregion
 		//#region lib/types/client/presentation.js
 		/** Display labels and toast sentences for global plugin management. */
@@ -382,6 +397,18 @@ window.__ModuleLoader__.load({
 				url: remembered.registry
 			} : remembered;
 		}
+		/** Only the shipped public mirror can replace an unconfigured official npm default. */
+		function eligibleMirror(registries) {
+			if (registries.registry !== null || registries.resolved === null) return void 0;
+			let resolved;
+			try {
+				resolved = normalizeRegistry(registries.resolved);
+			} catch (_error) {
+				return;
+			}
+			if (resolved !== "https://registry.npmjs.org/") return void 0;
+			return registries.fallbackRegistries.find((registry) => registry === NPMMIRROR_REGISTRY);
+		}
 		/** Reads and mutates the profile's plugins through the `pluginManager` Remote. */
 		var PluginManagerController = class {
 			ctx;
@@ -395,6 +422,7 @@ window.__ModuleLoader__.load({
 			inspectAbort;
 			request;
 			noticeSeq = 0;
+			registryRead;
 			/** The registry last used from this browser, kept across dialogs and page loads; null until one was used. */
 			registryMemory = (0, _deepseek_ai_dsh_client_store.createSnapshotStore)(null, { persist: { name: "dsh.plugin-manager.install-registry" } });
 			/**
@@ -422,6 +450,7 @@ window.__ModuleLoader__.load({
 			/** Stop publishing and drop every late settlement. */
 			dispose() {
 				this.disposed = true;
+				this.registryRead = void 0;
 				this.request = void 0;
 				this.generation += 1;
 			}
@@ -453,7 +482,11 @@ window.__ModuleLoader__.load({
 								open: true,
 								registry: this.registryMemory.getSnapshot() ?? OFFICIAL_REGISTRY
 							} });
-							this.readRegistries();
+							const read = { choice: this.getSnapshot().install.registry };
+							this.registryRead = read;
+							read.done = this.readRegistries(read).finally(() => {
+								delete read.done;
+							});
 						} else this.patchInstall({ open: true });
 						this.reconcileInstall();
 					},
@@ -464,6 +497,7 @@ window.__ModuleLoader__.load({
 							return;
 						}
 						this.abortInspect();
+						this.registryRead = void 0;
 						this.patch({ install: IDLE_INSTALL });
 					},
 					editInstallSpec: (text) => {
@@ -578,15 +612,31 @@ window.__ModuleLoader__.load({
 					} }
 				});
 			}
+			currentRegistryRead(read) {
+				return !this.disposed && this.registryRead === read;
+			}
 			/** Read the registries the Host offers, for the dialog just opened; a refused read leaves pnpm's own and a typed one. */
-			async readRegistries() {
+			async readRegistries(read) {
 				const answer = await this.ctx.remote.pluginManager.registries();
 				const install = this.getSnapshot().install;
-				if (this.disposed || !install.open || !answer.ok) return;
+				if (!this.currentRegistryRead(read) || !install.open || !answer.ok) return;
+				const remembered = this.registryMemory.getSnapshot();
+				const untouched = install.registry === read.choice && (install.phase === "idle" || install.phase === "checking");
+				if (untouched) read.choice = reconciled(remembered, answer.value);
 				this.patchInstall({
 					registries: answer.value,
-					registry: reconciled(this.registryMemory.getSnapshot(), answer.value)
+					...untouched ? { registry: read.choice } : {}
 				});
+				const mirror = eligibleMirror(answer.value);
+				if (!untouched || remembered !== null || mirror === void 0) return;
+				const fastest = await this.ctx.remote.pluginRegistryProbe.fastest();
+				const current = this.getSnapshot().install;
+				if (!this.currentRegistryRead(read) || !current.open || current.phase !== "idle" && current.phase !== "checking" || current.registry !== read.choice || !fastest.ok || fastest.value !== mirror) return;
+				read.choice = {
+					kind: "offered",
+					registry: mirror
+				};
+				this.patchInstall({ registry: read.choice });
 			}
 			/**
 			* Fold a chunk belonging to this installation into its pnpm command.
@@ -713,11 +763,6 @@ window.__ModuleLoader__.load({
 					});
 					return;
 				}
-				const registry = typed ?? choice.registry;
-				this.registryMemory.set(typed === void 0 ? choice : {
-					kind: "custom",
-					url: typed
-				});
 				this.abortInspect();
 				const controller = new AbortController();
 				this.inspectAbort = controller;
@@ -734,6 +779,18 @@ window.__ModuleLoader__.load({
 					failure: null,
 					approvedBuilds: []
 				});
+				const read = this.registryRead;
+				if (read !== void 0 && choice === read.choice && read.done !== void 0) {
+					await read.done;
+					if (this.gone(controller.signal) || this.registryRead !== read) return;
+				}
+				const currentChoice = this.getSnapshot().install.registry;
+				const selected = currentChoice.kind === "custom" ? {
+					...currentChoice,
+					url: currentChoice.url.trim()
+				} : currentChoice;
+				const registry = selected.kind === "custom" ? selected.url : selected.registry;
+				this.registryMemory.set(selected);
 				const inspected = await this.ctx.remote.pluginManager.inspect(spec, { registry }, controller.signal);
 				if (this.gone(controller.signal)) return;
 				this.inspectAbort = void 0;
@@ -3172,6 +3229,7 @@ window.__ModuleLoader__.load({
 			"remote",
 			"remote.pluginManager",
 			"remote.pluginInventory",
+			"remote.pluginRegistryProbe",
 			"configForms"
 		];
 		/**

package/lib/index.js

@@ -1,6 +1,142 @@
+import z from "@deepseek-ai/schemastery";
+import { MAX_TIMER_DELAY_MS } from "@deepseek-ai/dsh-timeout";
+import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 //#region lib/types/index.js
-/** Host loader entry for the plugin-manager tab's browser implementation exported from `./client`. */
-/** Host plugin body — no host-side behavior for the plugin manager tab. */
-function apply() {}
+/** Host registry-response probing for the plugin installation dialog. */
+var __runInitializers = function(thisArg, initializers, value) {
+	var useValue = arguments.length > 2;
+	for (var i = 0; i < initializers.length; i++) value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+	return useValue ? value : void 0;
+};
+var __esDecorate = function(ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+	function accept(f) {
+		if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected");
+		return f;
+	}
+	var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+	var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+	var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+	var _, done = false;
+	for (var i = decorators.length - 1; i >= 0; i--) {
+		var context = {};
+		for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+		for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+		context.addInitializer = function(f) {
+			if (done) throw new TypeError("Cannot add initializers after decoration has completed");
+			extraInitializers.push(accept(f || null));
+		};
+		var result = (0, decorators[i])(kind === "accessor" ? {
+			get: descriptor.get,
+			set: descriptor.set
+		} : descriptor[key], context);
+		if (kind === "accessor") {
+			if (result === void 0) continue;
+			if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+			if (_ = accept(result.get)) descriptor.get = _;
+			if (_ = accept(result.set)) descriptor.set = _;
+			if (_ = accept(result.init)) initializers.unshift(_);
+		} else if (_ = accept(result)) if (kind === "field") initializers.unshift(_);
+		else descriptor[key] = _;
+	}
+	if (target) Object.defineProperty(target, contextIn.name, descriptor);
+	done = true;
+};
+let PluginRegistryProbe = (() => {
+	let _classSuper = TypertRemoteService;
+	let _instanceExtraInitializers = [];
+	let _fastest_decorators;
+	return class PluginRegistryProbe extends _classSuper {
+		static {
+			const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+			_fastest_decorators = [Remote];
+			__esDecorate(this, null, _fastest_decorators, {
+				kind: "method",
+				name: "fastest",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "fastest" in obj,
+					get: (obj) => obj.fastest
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			if (_metadata) Object.defineProperty(this, Symbol.metadata, {
+				enumerable: true,
+				configurable: true,
+				writable: true,
+				value: _metadata
+			});
+		}
+		config = __runInitializers(this, _instanceExtraInitializers);
+		static Config = z.object({
+			registryProbeEnabled: z.boolean().default(true),
+			registryProbeTimeoutMs: z.natural().min(1).max(MAX_TIMER_DELAY_MS).default(1500),
+			registryProbeCacheTtlMs: z.natural().default(3e5)
+		});
+		lifetime = new AbortController();
+		pending;
+		cached;
+		constructor(ctx, config) {
+			super(ctx, "pluginRegistryProbe");
+			this.config = config;
+			ctx.effect(() => async () => {
+				this.lifetime.abort();
+				await this.pending;
+			});
+		}
+		/**
+		* Race npm and npmmirror HTTPS ping responses through the Host's fetch proxy.
+		* Concurrent readers share a probe; a winner cancels and awaits the other request.
+		* @returns the first registry with a successful response, or null when disabled or neither responds successfully; results are cached.
+		* @throws rejects when the service has been unloaded.
+		*/
+		async fastest() {
+			this.lifetime.signal.throwIfAborted();
+			if (!this.config.registryProbeEnabled) return null;
+			if (this.cached !== void 0 && this.cached.expiresAt > Date.now()) return this.cached.registry;
+			this.pending ??= this.probe().finally(() => {
+				this.pending = void 0;
+			});
+			return this.pending;
+		}
+		async probe() {
+			const finished = new AbortController();
+			const signal = AbortSignal.any([
+				this.lifetime.signal,
+				finished.signal,
+				AbortSignal.timeout(this.config.registryProbeTimeoutMs)
+			]);
+			const requests = ["https://registry.npmjs.org/-/ping", "https://registry.npmmirror.com/-/ping"].map(async (endpoint) => ({
+				registry: new URL("/", endpoint).href,
+				response: await fetch(endpoint, {
+					signal,
+					redirect: "error"
+				})
+			}));
+			const successful = requests.map(async (request) => {
+				const { registry, response } = await request;
+				if (!response.ok) throw new Error(`Registry ping returned HTTP ${response.status}`);
+				return registry;
+			});
+			let registry;
+			try {
+				registry = await Promise.any(successful);
+			} catch (_unavailableRegistries) {
+				registry = null;
+			} finally {
+				finished.abort();
+				const responses = await Promise.allSettled(requests);
+				await Promise.allSettled(responses.map(async (result) => {
+					if (result.status === "fulfilled") await result.value.response.body?.cancel();
+				}));
+			}
+			if (!this.lifetime.signal.aborted) this.cached = {
+				registry,
+				expiresAt: Date.now() + this.config.registryProbeCacheTtlMs
+			};
+			return registry;
+		}
+	};
+})();
 //#endregion
-export { apply };
+export { PluginRegistryProbe as default };

package/lib/typert.host.d.ts

@@ -0,0 +1,3 @@
+/* Generated by @deepseek-ai/dsh-typert-generator from FaceModel — do not edit. */
+
+export declare const TYPERT: unknown

package/lib/typert.host.js

@@ -0,0 +1,53 @@
+/* Generated by @deepseek-ai/dsh-typert-generator from FaceModel — do not edit. */
+import { z } from 'zod'
+
+let _deepseek_ai_dsh_client_ui_plugin_manager_pluginRegistryProbe_fastest_result$schema$value
+const _deepseek_ai_dsh_client_ui_plugin_manager_pluginRegistryProbe_fastest_result$schema = () => (_deepseek_ai_dsh_client_ui_plugin_manager_pluginRegistryProbe_fastest_result$schema$value ??= z.union([z.literal(null), z.string()]))
+
+export const TYPERT = {
+  package: '@deepseek-ai/dsh-client-ui-plugin-manager',
+  face: 'host',
+  schemas: [
+  ],
+  invocations: [
+    {
+      id: '@deepseek-ai/dsh-client-ui-plugin-manager#pluginRegistryProbe/fastest',
+      service: 'pluginRegistryProbe',
+      namespace: 'pluginRegistryProbe',
+      method: 'fastest',
+      invocation: { kind: 'direct' },
+      parameters: [
+      ],
+      result: {
+        mode: 'strict',
+        typeSymbol: '@deepseek-ai/dsh-client-ui-plugin-manager#pluginRegistryProbe/fastest:result',
+        create: _deepseek_ai_dsh_client_ui_plugin_manager_pluginRegistryProbe_fastest_result$schema,
+      },
+      sourceLocation: {"file":"packages/client/ui-plugin-manager/src/index.ts","line":51,"column":9},
+    },
+  ],
+  model: {
+    "services": [
+      {
+        "description": "Compares public registry responses on the Host; the Client owns the initial selection.",
+        "summary": "Compares public registry responses on the Host; the Client owns the initial selection.",
+        "tags": [],
+        "jsDoc": "/** Compares public registry responses on the Host; the Client owns the initial selection. */",
+        "key": "pluginRegistryProbe",
+        "exportName": "default",
+        "members": [
+          {
+            "kind": "method",
+            "name": "fastest",
+            "signature": "@Remote async fastest(): Promise<string | null>",
+            "summary": "Race npm and npmmirror HTTPS ping responses through the Host's fetch proxy.",
+            "jsDoc": "/**\n * Race npm and npmmirror HTTPS ping responses through the Host's fetch proxy.\n * Concurrent readers share a probe; a winner cancels and awaits the other request.\n * @returns the first registry with a successful response, or null when disabled or neither responds successfully; results are cached.\n * @throws rejects when the service has been unloaded.\n */"
+          }
+        ],
+        "types": []
+      }
+    ],
+    "events": [],
+    "objects": []
+  },
+}

package/lib/typert.remote-client.d.ts

@@ -0,0 +1,21 @@
+/* Generated by @deepseek-ai/dsh-typert-generator from the Host FaceModel — do not edit. */
+import type {
+  RemoteResult,
+  TypertRemoteContribution,
+} from '@deepseek-ai/dsh-typert-protocol'
+
+declare module '@deepseek-ai/dsh-typert-protocol' {
+  interface TypertRemoteNamespace$706c7567696e526567697374727950726f6265 {
+    fastest: () => Promise<RemoteResult<string | null>>
+  }
+  interface TypertRemoteMap {
+    'pluginRegistryProbe/fastest': () => Promise<RemoteResult<string | null>>
+  }
+  interface TypertRemoteNamespaceMap {
+    'pluginRegistryProbe': TypertRemoteNamespace$706c7567696e526567697374727950726f6265
+  }
+}
+
+export declare const TYPERT_REMOTE: TypertRemoteContribution
+export default TYPERT_REMOTE
+//# sourceMappingURL=typert.remote-client.d.ts.map

package/lib/typert.remote-client.js

@@ -0,0 +1,28 @@
+/* Generated by @deepseek-ai/dsh-typert-generator from the Host FaceModel — do not edit. */
+import { z } from 'zod'
+
+let _deepseek_ai_dsh_client_ui_plugin_manager_pluginRegistryProbe_fastest_result$schema$value
+const _deepseek_ai_dsh_client_ui_plugin_manager_pluginRegistryProbe_fastest_result$schema = () => (_deepseek_ai_dsh_client_ui_plugin_manager_pluginRegistryProbe_fastest_result$schema$value ??= z.union([z.literal(null), z.string()]))
+
+export const TYPERT_REMOTE = {
+  package: '@deepseek-ai/dsh-client-ui-plugin-manager',
+  descriptors: [
+    {
+      id: '@deepseek-ai/dsh-client-ui-plugin-manager#pluginRegistryProbe/fastest',
+      service: 'pluginRegistryProbe',
+      namespace: 'pluginRegistryProbe',
+      method: 'fastest',
+      invocation: { kind: 'direct' },
+      parameters: [
+      ],
+      result: {
+        mode: 'strict',
+        typeSymbol: '@deepseek-ai/dsh-client-ui-plugin-manager#pluginRegistryProbe/fastest:result',
+        create: _deepseek_ai_dsh_client_ui_plugin_manager_pluginRegistryProbe_fastest_result$schema,
+      },
+      sourceLocation: {"file":"packages/client/ui-plugin-manager/src/index.ts","line":51,"column":9},
+    },
+  ],
+}
+
+export default TYPERT_REMOTE

package/lib/types/client/manager-store.d.ts

@@ -285,6 +285,7 @@ export declare class PluginManagerController {
     private inspectAbort;
     private request;
     private noticeSeq;
+    private registryRead;
     /** The registry last used from this browser, kept across dialogs and page loads; null until one was used. */
     private readonly registryMemory;
     /**
@@ -310,6 +311,7 @@ export declare class PluginManagerController {
      * @param progress - a request id and phase received from the Host.
      */
     installProgress(progress: PluginInstallProgress): void;
+    private currentRegistryRead;
     /** Read the registries the Host offers, for the dialog just opened; a refused read leaves pnpm's own and a typed one. */
     private readRegistries;
     /**

package/lib/types/index.d.ts

@@ -1,4 +1,36 @@
-/** Host loader entry for the plugin-manager tab's browser implementation exported from `./client`. */
-/** Host plugin body — no host-side behavior for the plugin manager tab. */
-export declare function apply(): void;
+/** Host registry-response probing for the plugin installation dialog. */
+import type { Context } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+import { TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        pluginRegistryProbe: PluginRegistryProbe;
+    }
+}
+/** Registry-probe deadline and process-local cache policy. */
+export interface Config {
+    /** Whether the dialog can compare the public npm registries. */
+    registryProbeEnabled: boolean;
+    /** Deadline for the parallel HTTPS probes, including response cleanup. */
+    registryProbeTimeoutMs: number;
+    /** Lifetime of a winning registry or unavailable result. */
+    registryProbeCacheTtlMs: number;
+}
+/** Compares public registry responses on the Host; the Client owns the initial selection. */
+export default class PluginRegistryProbe extends TypertRemoteService {
+    private readonly config;
+    static Config: z<Partial<Config>, Config>;
+    private readonly lifetime;
+    private pending;
+    private cached;
+    constructor(ctx: Context, config: Config);
+    /**
+     * Race npm and npmmirror HTTPS ping responses through the Host's fetch proxy.
+     * Concurrent readers share a probe; a winner cancels and awaits the other request.
+     * @returns the first registry with a successful response, or null when disabled or neither responds successfully; results are cached.
+     * @throws rejects when the service has been unloaded.
+     */
+    fastest(): Promise<string | null>;
+    private probe;
+}
 //# sourceMappingURL=index.d.ts.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-client-ui-plugin-manager",
   "description": "Plugin management for the dsh web client: the sidebar Plugins panel installs, enables, disables, retries, and composes installed plugin packages",
-  "version": "0.1.7-alpha.1",
+  "version": "0.1.7-alpha.2",
   "publishConfig": {
     "access": "public"
   },
@@ -23,7 +23,15 @@
       "default": "./lib/client.js"
     },
     "./src/*": "./src/*",
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./typert": {
+      "types": "./lib/typert.host.d.ts",
+      "default": "./lib/typert.host.js"
+    },
+    "./remote": {
+      "types": "./lib/typert.remote-client.d.ts",
+      "default": "./lib/typert.remote-client.js"
+    }
   },
   "dsh": {
     "client": {
@@ -38,7 +46,7 @@
   },
   "license": "MIT",
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.3"
+    "@deepseek-ai/cordis": "~4.0.4"
   },
   "devDependencies": {
     "@testing-library/react": "^16.1.0",
@@ -47,26 +55,36 @@
     "clsx": "^2.1.1",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",
-    "@deepseek-ai/cordis": "^4.0.3",
-    "@deepseek-ai/dsh-api-remotes": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-client-locale": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-client-store": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-client-test-runtime": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-client-ui-layout": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-client-ui-sidebar": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-plugin-manager": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-package-manifest": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-util-crypto": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-client-ui-settings": "^0.1.7-alpha.1"
+    "@deepseek-ai/cordis": "~4.0.4",
+    "@deepseek-ai/dsh-api-remotes": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-client-locale": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-client-store": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-client-test-runtime": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-client-ui-layout": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-client-ui-sidebar": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-package-manifest": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-util-crypto": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-plugin-manager": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.7-alpha.2"
   },
   "files": [
     "lib/index.js",
     "lib/client.js",
-    "lib/types/**/*.d.ts"
+    "lib/types/**/*.d.ts",
+    "lib/typert.host.js",
+    "lib/typert.host.d.ts",
+    "lib/typert.remote-client.js",
+    "lib/typert.remote-client.d.ts"
   ],
+  "dependencies": {
+    "zod": "^4.4.3",
+    "@deepseek-ai/dsh-timeout": "0.1.7-alpha.2",
+    "@deepseek-ai/schemastery": "~3.18.4",
+    "@deepseek-ai/dsh-typert-protocol": "0.1.7-alpha.2"
+  },
   "scripts": {
     "bundle": "tsdown",
     "watch": "tsdown --watch"