@deepseek-ai/dsh-plugin-manager 0.1.7-alpha.2 → 0.1.7-rc.2

package/lib/index.js

@@ -7,11 +7,206 @@ import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
 import z from "@deepseek-ai/schemastery";
 import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { pluginEntryId, readPluginInventory } from "@deepseek-ai/dsh-host-plugin-inventory";
-import { OPTIONAL_BUNDLES, bundlePatchPaths, composeEntries, loadOptionalPatches, loadOverlayPatches, readPluginMeta, readProfileManifest, readProfilePatches, reconcileProfilePatches, resolveBundleDir, resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
+import { OPTIONAL_BUNDLES, PROFILE_COMPATIBILITY_FILENAME, bundlePatchPaths, composeEntries, evaluatePluginCompatibility, loadOptionalPatches, loadOverlayPatches, pluginCompatibilityWarning, readPluginMeta, readProfileCompatibility, readProfileManifest, readProfilePatches, readProfileVersionExemptions, reconcileProfilePatches, resolveBundleDir, resolveProfileDir, setProfileVersionExemption } from "@deepseek-ai/dsh-app-boot";
+import { once } from "node:events";
 import { execa } from "execa";
 import { scrubbedParentEnv } from "@deepseek-ai/dsh-subprocess";
 import { isAlias, isMap, isNode, isScalar, isSeq, parseDocument, visit } from "yaml";
+//#region lib/types/install-spec.js
+/**
+* Reading an install spec before pnpm sees it: which of pnpm's spec forms it
+* takes, and for a registry name whether it is one the registry can accept.
+* @module @deepseek-ai/dsh-plugin-manager/install-spec
+*/
+/** The forms pnpm resolves through a git host: a host shorthand, a git URL, or a hosted repository URL. */
+const GIT_SHORTHAND = /^(?:github|gitlab|bitbucket|gist):/i;
+const GIT_URL = /^git(?:\+[a-z]+)?:\/\/|^git@[^:]+:/i;
+const HOSTED_REPOSITORY_URL = /^https?:\/\/[^/]+\/[^/]+\/[^/#]+(?:\.git)?(?:#.*)?$/i;
+/** The hosts pnpm's shorthands stand for. */
+const GIT_SHORTHAND_HOSTS = {
+	github: "github.com",
+	gitlab: "gitlab.com",
+	bitbucket: "bitbucket.org",
+	gist: "gist.github.com"
+};
+/** A tarball, on disk or over HTTP. */
+const TARBALL_SPEC = /\.(?:tgz|tar\.gz)(?:#.*)?$/i;
+/** An npm package name: lowercase URL-safe segments, an optional scope, no leading dot or underscore. */
+const PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*$/;
+const PACKAGE_NAME_MAX_LENGTH = 214;
+/** A spec neither pnpm nor the registry would take; `reason` is what the person reads. */
+var InvalidInstallSpecError = class extends Error {
+	spec;
+	reason;
+	/**
+	* @param spec - the spec as typed, trimmed.
+	* @param reason - why it is refused, as one sentence.
+	*/
+	constructor(spec, reason) {
+		super(`plugin-manager: ${reason}: ${spec}`);
+		this.spec = spec;
+		this.reason = reason;
+		this.name = "InvalidInstallSpecError";
+	}
+};
+function invalid(spec, reason) {
+	return new InvalidInstallSpecError(spec, reason);
+}
+/** The host a git spec is cloned from: the shorthand's host, the scp-like user@host, or the URL's host with its port. */
+function gitHost(spec) {
+	const shorthand = /^([a-z]+):/i.exec(spec)?.[1]?.toLowerCase();
+	if (shorthand !== void 0 && Object.hasOwn(GIT_SHORTHAND_HOSTS, shorthand)) return GIT_SHORTHAND_HOSTS[shorthand];
+	const scp = /^git@([^:]+):/i.exec(spec)?.[1];
+	if (scp !== void 0) return scp.toLowerCase();
+	return new URL(spec.replace(/^git\+/i, "")).host;
+}
+/**
+* Read a spec into its form. A path must be absolute: the Host's working
+* directory means nothing to the person typing into a browser, and a
+* relative path resolved against the profile would point inside it.
+* @param raw - the spec as typed.
+* @returns the parsed spec.
+* @throws {InvalidInstallSpecError} for an empty spec, a relative path, a name the
+* registry would refuse, or a URL that is neither a git host nor a tarball.
+*/
+function parseInstallSpec(raw) {
+	const spec = raw.trim();
+	if (spec === "") throw invalid(spec, "the package spec must not be empty");
+	const path = spec.replace(/^(?:file|link):/, "");
+	if (path !== spec || isAbsolute(path)) {
+		if (!isAbsolute(path)) throw invalid(spec, "a local path must be absolute");
+		return TARBALL_SPEC.test(path) ? {
+			kind: "tarball",
+			spec,
+			path
+		} : {
+			kind: "path",
+			spec,
+			path
+		};
+	}
+	if (/^\.{1,2}(?:[\\/]|$)/.test(spec)) throw invalid(spec, "a local path must be absolute");
+	if ((GIT_SHORTHAND.test(spec) || GIT_URL.test(spec) || HOSTED_REPOSITORY_URL.test(spec)) && !TARBALL_SPEC.test(spec)) return {
+		kind: "git",
+		spec,
+		host: gitHost(spec)
+	};
+	if (/^https?:\/\//i.test(spec)) {
+		if (TARBALL_SPEC.test(spec)) return {
+			kind: "tarball",
+			spec,
+			host: new URL(spec).host
+		};
+		throw invalid(spec, "a URL must point at a git repository or a tarball");
+	}
+	const at = spec.indexOf("@", 1);
+	const name = at === -1 ? spec : spec.slice(0, at);
+	const range = at === -1 ? void 0 : spec.slice(at + 1);
+	if (name.length > PACKAGE_NAME_MAX_LENGTH || !PACKAGE_NAME.test(name)) throw invalid(spec, "not a package name the registry accepts");
+	if (range === "") throw invalid(spec, "a version after @ must not be empty");
+	return range === void 0 ? {
+		kind: "registry",
+		spec,
+		name
+	} : {
+		kind: "registry",
+		spec,
+		name,
+		range
+	};
+}
+//#endregion
+//#region lib/types/run-tree.js
+/** Waiting for one package run's process tree to disappear before its caller touches the profile. */
+/** How long a terminated tree may take to disappear before the caller stops waiting. */
+const TREE_WAIT_MS = 5e3;
+/** Poll cadence while waiting for a terminated tree to disappear. */
+const TREE_POLL_MS = 15;
+/**
+* Whether one run leads its own process group, which is the target a POSIX
+* liveness probe addresses for the whole tree. A run that captures output is
+* spawned as its own group leader, because its tree is terminated as a unit; a
+* run that inherits the caller's descriptors keeps the caller's group, so an
+* interrupt still reaches it.
+* @param execution Whether the run captures output or inherits the caller's descriptors.
+* @param platform Host platform deciding how a tree is addressed.
+* @returns True when the run leads its own process group.
+*/
+function leadsOwnGroup(execution, platform = process.platform) {
+	return execution === "service" && platform !== "win32";
+}
+/** The target a tree probe addresses: a POSIX group when the run leads one, else the process itself. */
+function targetOf(pid, grouped, platform) {
+	return platform !== "win32" && grouped ? -pid : pid;
+}
+/**
+* Whether any member of a run's tree is still alive.
+* @param tree The run's process id and whether it leads its own group.
+* @param internals Injectable process operations.
+* @returns True while the probe finds the process or a group member.
+*/
+function treeAlive(tree, internals = {}) {
+	const pid = tree.pid;
+	if (pid === void 0) return false;
+	const platform = internals.platform ?? process.platform;
+	const alive = internals.alive ?? ((target) => {
+		process.kill(target, 0);
+		return true;
+	});
+	try {
+		return alive(targetOf(pid, tree.grouped, platform));
+	} catch {
+		return false;
+	}
+}
+/**
+* Wait until a terminated run's tree is gone, so the caller restores and
+* unlocks the profile only after the scripts it started stopped writing.
+* @param tree The run's process id and whether it leads its own group.
+* @param internals Injectable process operations.
+* @returns Fulfillment once no member remains, or the wait bound elapsed.
+*/
+async function awaitTreeGone(tree, internals = {}) {
+	const deadline = Date.now() + (internals.waitMs ?? TREE_WAIT_MS);
+	while (treeAlive(tree, internals)) {
+		if (Date.now() >= deadline) return;
+		await new Promise((resolve) => setTimeout(resolve, TREE_POLL_MS));
+	}
+}
+//#endregion
+//#region lib/types/failure.js
+/** Expected management rejection; presentation belongs to the caller's locale. */
+var ManagementFailure = class extends Error {
+	/** Code rendered by the caller's locale dictionary. */
+	code;
+	/** The packages an `incompatible-version` rejection names. */
+	incompatible;
+	/**
+	* @param code Localizable management rejection.
+	* @param incompatible Packages the running DSH version rejects, for `incompatible-version`.
+	*/
+	constructor(code, incompatible) {
+		super(code);
+		this.code = code;
+		this.incompatible = incompatible;
+	}
+};
+/**
+* Drop the exemption status from an unexempted compatibility result.
+* @param issue Result whose exemption is not active.
+* @returns The package, runtime, and rejected peer ranges.
+*/
+function incompatiblePlugin(issue) {
+	return {
+		name: issue.name,
+		version: issue.version,
+		runtimeVersion: issue.runtimeVersion,
+		peers: issue.peers
+	};
+}
+//#endregion
 //#region lib/types/operations.js
+/** Shared profile package operations used by dsh plugin and the running manager. */
 /** Resolve relative package specs against the caller's directory.
 * @param argument One pnpm argument.
 * @param cwd Invocation directory, never the profile directory.
@@ -69,15 +264,180 @@ async function reconcile(before, dir, anchor, options) {
 	};
 	await saveManifest(dir, after);
 }
+/**
+* How long the pipes keep draining after their process exited, as a fixed part of
+* finishing a run rather than a deployment knob: a descendant that inherited them
+* holds them open, and the tail a failure classification reads is written by then.
+*/
+const DRAIN_AFTER_EXIT_MS = 2e3;
+/** Whether every collector finished within `ms`.
+* @param collectors The pipe readers racing the bound.
+* @param ms The longest wait, in milliseconds.
+* @returns True when all collectors settled in time.
+*/
+async function drainWithin(collectors, ms) {
+	if (collectors.length === 0) return true;
+	let timer;
+	try {
+		return await Promise.race([Promise.allSettled(collectors).then(() => true), new Promise((resolve) => {
+			timer = setTimeout(() => {
+				resolve(false);
+			}, ms);
+		})]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+/** Install commands that take the packages to install as positionals. */
+const INSTALL_COMMANDS = new Set([
+	"add",
+	"install",
+	"i"
+]);
+/** Bound on a pre-install registry lookup when the caller names none. */
+const LOOKUP_TIMEOUT_MS = 2e4;
+/** Package specs an install command names explicitly, in order. */
+function namedSpecs(args) {
+	const index = args.findIndex((argument) => !argument.startsWith("-"));
+	const command = index < 0 ? void 0 : args[index];
+	if (command === void 0 || !INSTALL_COMMANDS.has(command)) return [];
+	return args.slice(index + 1).filter((argument) => !argument.startsWith("-"));
+}
+/** The manifest a named spec would install, read without installing it.
+* A path spec is read from disk. A registry spec asks pnpm's own configuration for the version the
+* range selects and its peer requirements. A git or tarball spec needs the fetch itself, so the
+* check after installation is what judges it.
+* @param dir Profile directory the lookup runs in.
+* @param spec Anchored install spec.
+* @param options Pnpm executable, prefix arguments, the caller's bound and signal.
+* @param environment Environment of the caller's pnpm invocations.
+* @param flags Flags of the run itself, so the lookup asks the registry that run will use.
+* @returns The package manifest, or undefined when reading it would need the installation itself.
+*/
+async function namedSpecManifest(dir, spec, options, environment, flags) {
+	const parsed = parseInstallSpec(spec);
+	if (parsed.kind === "path") {
+		const filename = join(parsed.path, "package.json");
+		return existsSync(filename) ? JSON.parse(readFileSync(filename, "utf8")) : void 0;
+	}
+	if (parsed.kind !== "registry") return void 0;
+	const viewed = await execa(options.command ?? "pnpm", [
+		...options.args ?? [],
+		"view",
+		parsed.spec,
+		"name",
+		"version",
+		"peerDependencies",
+		"--json",
+		...flags,
+		"--config.fetch-retries=0"
+	], {
+		cwd: dir,
+		env: environment,
+		extendEnv: false,
+		reject: false,
+		stdin: "ignore",
+		...options.signal === void 0 ? {} : { cancelSignal: options.signal },
+		timeout: options.lookupTimeoutMs ?? LOOKUP_TIMEOUT_MS
+	});
+	if (viewed.exitCode !== 0) return void 0;
+	const value = JSON.parse(viewed.stdout);
+	return Array.isArray(value) ? value.at(-1) : value;
+}
+/** Missing installed packages are repairable; their absence is part of the before/after comparison. */
+function optionalFile(path) {
+	try {
+		return readFileSync(path, "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") return void 0;
+		throw error;
+	}
+}
+/** Where an operation records the pnpm run it started, for a successor when the operation's own process ends first. */
+function runRecordPath(dir) {
+	return join(dir, ".plugin-manager", "run.json");
+}
+/** Record a started run; a successor that takes over the profile lock from an exited process waits for it. */
+async function recordRun(dir, tree) {
+	if (tree.pid === void 0) return;
+	await writeFileAtomic(runRecordPath(dir), `${JSON.stringify(tree)}\n`, {
+		mode: 384,
+		dirMode: 448
+	});
+}
+/**
+* Why this operation must not run: a record left by an operation whose process
+* ended mid-run names a run that is still writing the profile. The profile
+* lock is taken over once its holder exits, but its pnpm tree can outlive it.
+* A recorded run that stopped, within a bounded wait, has its record removed.
+* @param dir Profile directory.
+* @returns The diagnostic, or undefined when no recorded run is active.
+*/
+async function activeRecordedRun(dir) {
+	const path = runRecordPath(dir);
+	const text = optionalFile(path);
+	if (text === void 0) return void 0;
+	let tree;
+	try {
+		const value = JSON.parse(text);
+		const { pid, grouped } = typeof value === "object" && value !== null ? value : {};
+		if (Number.isSafeInteger(pid) && pid > 0 && typeof grouped === "boolean") tree = {
+			pid,
+			grouped
+		};
+	} catch (error) {}
+	if (tree === void 0) return `dsh: ${path} does not name a package run; delete it once no earlier package operation is still running in this profile\n`;
+	await awaitTreeGone(tree);
+	if (treeAlive(tree)) return `dsh: process ${String(tree.pid)}, started by an earlier package operation whose own process ended, is still running in this profile; wait for it or stop it, then retry. If process ${String(tree.pid)} is not that package run, delete ${path}.\n`;
+	await rm(path, { force: true });
+}
+/** pnpm can install plugins through any direct-dependency field. */
+function directDependencies(manifest) {
+	const extra = manifest;
+	return {
+		...extra.devDependencies,
+		...manifest.dependencies,
+		...extra.optionalDependencies
+	};
+}
+/** Inspect only plugin rows contributed by the changed bundle, not its dependency closure. */
+function bundleComponentManifests(manifest, dir, anchor) {
+	const bundle = manifest.dsh?.bundle;
+	if (bundle === void 0) return [];
+	const patches = bundlePatchPaths(dir, bundle).flatMap((file) => loadOverlayPatches("dsh", file));
+	const names = /* @__PURE__ */ new Set();
+	const visit = (rows) => {
+		for (const row of rows) {
+			if (row.group && Array.isArray(row.config)) visit(row.config);
+			if (typeof row.name !== "string" || row.name.startsWith(".") || row.name.startsWith("/") || row.name.includes(":")) continue;
+			const parts = row.name.split("/");
+			names.add(parts.slice(0, row.name.startsWith("@") ? 2 : 1).join("/"));
+		}
+	};
+	visit(composeEntries([patches.filter((patch) => patch.insert !== void 0)]));
+	return [...names].flatMap((name) => {
+		let packageDir;
+		try {
+			packageDir = resolveBundleDir("dsh", name, anchor, dir);
+		} catch (error) {
+			return [];
+		}
+		return [readProfileManifest("dsh", packageDir)];
+	});
+}
 /** Execute pnpm inside a profile whose caller already holds the profile write lock.
+* Newly installed or updated direct dependencies are checked even when activation is disabled;
+* an untouched dependency never blocks an unrelated operation and stays denied at startup.
+* Compatibility denial restores the profile manifest and lockfile, but leaves downloaded modules on disk.
 * @param context Launcher-owned profile and resolution locations.
 * @param args Pnpm arguments, before relative path anchoring.
 * @param options Output, activation and cancellation policy.
-* @returns Exit status and diagnostic path; service output is bounded, CLI output uses inherited descriptors.
+* @returns Exit status, whether the silence bound stopped the run, and the diagnostic path.
+* A compatibility denial returns exit code 1. Service output is bounded; CLI output uses inherited descriptors.
 */
 async function runProfilePnpm(context, args, options) {
 	const dir = context.dir ?? resolveProfileDir(context.profile, context.home);
-	const before = readProfileManifest("dsh", dir);
+	const active = await activeRecordedRun(dir);
 	const logRoot = join(dir, ".plugin-manager", "logs");
 	await mkdir(logRoot, {
 		recursive: true,
@@ -85,70 +445,242 @@ async function runProfilePnpm(context, args, options) {
 	});
 	const logPath = join(await mkdtemp(join(logRoot, "operation-")), "pnpm.log");
 	const log = await open(logPath, "wx", 384);
+	if (active !== void 0) {
+		await log.write(active);
+		await log.close();
+		options.onOutput?.(active, "stderr");
+		const bytes = Buffer.from(active);
+		return {
+			exitCode: 1,
+			output: bytes.subarray(Math.max(0, bytes.length - options.outputBytes)).toString("utf8"),
+			truncated: bytes.length > options.outputBytes,
+			logPath
+		};
+	}
+	const before = readProfileManifest("dsh", dir);
+	const savedFiles = ["package.json", "pnpm-lock.yaml"].map((name) => ({
+		path: join(dir, name),
+		text: optionalFile(join(dir, name))
+	}));
+	const beforeDependencies = directDependencies(before);
+	const installedBefore = new Map(Object.keys(beforeDependencies).map((name) => [name, optionalFile(join(dir, "node_modules", name, "package.json"))]));
 	let output = Buffer.alloc(0);
 	let truncated = false;
+	const append = (bytes) => {
+		output = Buffer.concat([output, bytes]);
+		if (output.length > options.outputBytes) {
+			truncated = true;
+			output = output.subarray(output.length - options.outputBytes);
+		}
+	};
+	const environment = {
+		...options.execution === "cli" ? process.env : scrubbedParentEnv(),
+		...options.env
+	};
+	const restore = async () => {
+		for (const file of savedFiles) if (file.text === void 0) await rm(file.path, { force: true });
+		else await writeFileAtomic(file.path, file.text, { mode: 384 });
+	};
+	/** Packages a compatibility check refused; callers render them for their own surface. */
+	const incompatible = [];
+	const rejected = async (warnings, restoration) => {
+		const diagnostic = `\ndsh: installation rejected: ${warnings.join("\n")}\ndsh: ${restoration}.\n`;
+		await log.write(diagnostic);
+		options.onOutput?.(diagnostic, "stderr");
+		append(Buffer.from(diagnostic));
+		await log.close();
+		return {
+			exitCode: 1,
+			output: output.toString("utf8"),
+			truncated,
+			logPath,
+			incompatible
+		};
+	};
+	const preflight = [];
+	const exemptions = readProfileVersionExemptions(dir);
+	const registryFlags = args.filter((argument) => argument.startsWith("--registry="));
+	for (const raw of namedSpecs(args)) try {
+		const manifest = await namedSpecManifest(dir, anchorPathSpec(raw, context.cwd), options, environment, registryFlags);
+		if (manifest === void 0) continue;
+		const issue = evaluatePluginCompatibility(manifest, exemptions);
+		if (issue !== void 0 && !issue.exempted) {
+			preflight.push(pluginCompatibilityWarning(issue));
+			incompatible.push(incompatiblePlugin(issue));
+		}
+	} catch (error) {
+		continue;
+	}
+	if (preflight.length > 0) return rejected(preflight, "nothing was installed");
 	const cancellation = new AbortController();
+	const grouped = leadsOwnGroup(options.execution);
 	const child = execa(options.command ?? "pnpm", [...options.args ?? [], ...args.map((arg) => anchorPathSpec(arg, context.cwd))], {
 		cwd: dir,
-		env: {
-			...options.execution === "cli" ? process.env : scrubbedParentEnv(),
-			...options.env
-		},
+		env: environment,
 		extendEnv: false,
 		reject: false,
 		stdout: options.execution === "cli" ? "inherit" : "pipe",
 		stderr: options.execution === "cli" ? "inherit" : "pipe",
+		killDescendants: options.execution === "service",
 		buffer: false,
 		stdin: options.execution === "cli" ? "inherit" : "ignore",
 		cancelSignal: options.signal === void 0 ? cancellation.signal : AbortSignal.any([cancellation.signal, options.signal])
 	});
+	const exited = once(child.nodeChildProcess, "exit").catch(() => void 0);
 	let writes = Promise.resolve();
+	/** `settled` records that the process outcome is known; `stalled` that the silence bound stopped the run. */
+	const control = {
+		settled: false,
+		stalled: false
+	};
+	/** Set once this call cuts the reading short itself, so the close it causes is not read as a run failure. */
+	let cut = false;
+	/** The first failure a reading hit before that cut, which the run still reports. */
+	let failure;
+	let idleTimer;
+	/** The silence bound: a captured run that stops printing without exiting is terminated, never awaited. */
+	const armIdle = () => {
+		if (control.settled || options.idleTimeoutMs === void 0) return;
+		clearTimeout(idleTimer);
+		idleTimer = setTimeout(() => {
+			control.stalled = true;
+			child.kill();
+		}, options.idleTimeoutMs);
+	};
 	const collect = async (stream, kind) => {
 		try {
 			for await (const chunk of stream) {
+				armIdle();
 				const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
 				writes = writes.then(async () => {
 					await log.write(bytes);
 				});
 				await writes;
 				options.onOutput?.(bytes.toString("utf8"), kind);
-				output = Buffer.concat([output, bytes]);
-				if (output.length > options.outputBytes) {
-					truncated = true;
-					output = output.subarray(output.length - options.outputBytes);
-				}
+				append(bytes);
 			}
 		} catch (error) {
-			cancellation.abort();
+			if (!cut) {
+				failure ??= error instanceof Error ? error : new Error(String(error));
+				cancellation.abort();
+			}
 			throw error;
 		}
 	};
+	const collectors = [...child.stdout === null ? [] : [collect(child.stdout, "stdout")], ...child.stderr === null ? [] : [collect(child.stderr, "stderr")]];
+	for (const collector of collectors) collector.catch(() => {});
+	if (collectors.length > 0) armIdle();
 	let exitCode;
 	try {
-		const [completion, ...streams] = await Promise.allSettled([
-			child,
-			...child.stdout === null ? [] : [collect(child.stdout, "stdout")],
-			...child.stderr === null ? [] : [collect(child.stderr, "stderr")]
-		]);
-		for (const stream of streams) if (stream.status === "rejected") throw stream.reason;
+		await recordRun(dir, {
+			pid: child.pid,
+			grouped
+		});
+		const settled = Promise.allSettled([child]);
+		await Promise.race([exited, settled]);
+		control.settled = true;
+		clearTimeout(idleTimer);
+		if (control.stalled) await awaitTreeGone({
+			pid: child.pid,
+			grouped
+		});
+		if (await drainWithin(collectors, DRAIN_AFTER_EXIT_MS)) {
+			for (const stream of await Promise.allSettled(collectors)) if (stream.status === "rejected") throw stream.reason;
+		} else {
+			cut = true;
+			child.stdout?.destroy();
+			child.stderr?.destroy();
+			const notice = "dsh: pnpm output was cut short after its process exited\n";
+			await log.write(notice);
+			if (failure !== void 0) throw failure;
+			options.onOutput?.(notice, "stderr");
+			append(Buffer.from(notice));
+		}
+		const [completion] = await settled;
 		if (completion.status === "rejected") throw completion.reason;
 		const result = completion.value;
 		exitCode = result.exitCode ?? (result.code === "ENOENT" ? 127 : 1);
+		if (control.stalled) {
+			const notice = `dsh: pnpm printed nothing for ${String(options.idleTimeoutMs)}ms and was terminated\n`;
+			await log.write(notice);
+			options.onOutput?.(notice, "stderr");
+			append(Buffer.from(notice));
+		}
 		if (result.failed && output.length === 0) {
 			const diagnostic = result.shortMessage ?? "pnpm failed";
 			await log.write(diagnostic);
 			truncated = Buffer.byteLength(diagnostic) > options.outputBytes;
 			output = Buffer.from(diagnostic).subarray(0, options.outputBytes);
 		}
-		if (exitCode === 0 && options.activateNewBundles !== false) await reconcile(before, dir, context.installAnchor, options);
+		if (exitCode === 0 && !control.stalled) {
+			const after = readProfileManifest("dsh", dir);
+			const warnings = [];
+			for (const [name, spec] of Object.entries(directDependencies(after))) {
+				const packageDir = join(dir, "node_modules", name);
+				const installed = optionalFile(join(packageDir, "package.json"));
+				if (installed === void 0) continue;
+				const untouched = beforeDependencies[name] === spec && installedBefore.get(name) === installed;
+				const found = [];
+				const issues = [];
+				try {
+					const manifest = readProfileManifest("dsh", packageDir);
+					for (const candidate of [manifest, ...bundleComponentManifests(manifest, packageDir, context.installAnchor)]) {
+						const issue = evaluatePluginCompatibility(candidate, readProfileVersionExemptions(dir));
+						if (issue !== void 0 && !issue.exempted) {
+							found.push(pluginCompatibilityWarning(issue));
+							issues.push(incompatiblePlugin(issue));
+						}
+					}
+				} catch (error) {
+					found.push(`Cannot validate installed package ${name}: ${String(error)}`);
+				}
+				if (found.length === 0) continue;
+				if (!untouched) {
+					warnings.push(...found);
+					incompatible.push(...issues);
+				} else {
+					const notice = `\ndsh: warning: ${found.join("\n")}\ndsh: it stays installed but profile startup denies it until you grant an exemption for those exact versions.\n`;
+					await log.write(notice);
+					options.onOutput?.(notice, "stderr");
+				}
+			}
+			if (warnings.length > 0) {
+				await restore();
+				const repair = ["install", savedFiles.some((file) => file.path.endsWith("pnpm-lock.yaml") && file.text !== void 0) ? "--frozen-lockfile" : "--config.lockfile=false"];
+				const repairing = execa(options.command ?? "pnpm", [...options.args ?? [], ...repair], {
+					cwd: dir,
+					env: environment,
+					extendEnv: false,
+					reject: false,
+					stdin: "ignore",
+					...options.idleTimeoutMs === void 0 ? {} : { timeout: options.idleTimeoutMs }
+				});
+				await recordRun(dir, {
+					pid: repairing.pid,
+					grouped: false
+				});
+				const repaired = await repairing;
+				exitCode = 1;
+				const restoration = repaired.exitCode === 0 ? "restored package.json, pnpm-lock.yaml, and node_modules" : "restored package.json and pnpm-lock.yaml, but node_modules could not be reinstalled; run 'dsh plugin install'";
+				const diagnostic = `\ndsh: installation rejected: ${warnings.join("\n")}\ndsh: ${restoration}.\n`;
+				await log.write(diagnostic);
+				options.onOutput?.(diagnostic, "stderr");
+				append(Buffer.from(diagnostic));
+			} else if (options.activateNewBundles !== false) await reconcile(before, dir, context.installAnchor, options);
+		}
 	} finally {
+		control.settled = true;
+		clearTimeout(idleTimer);
+		await rm(runRecordPath(dir), { force: true });
 		await log.close();
 	}
 	return {
 		exitCode,
 		output: output.toString("utf8"),
 		truncated,
-		logPath
+		logPath,
+		...control.stalled ? { timedOut: true } : {},
+		...incompatible.length > 0 ? { incompatible } : {}
 	};
 }
 /**
@@ -246,6 +778,7 @@ const LOG_KINDS = [
 	["disk-full", /\bENOSPC\b|no space left on device/i],
 	["permission", /\bEACCES\b|\bEPERM\b|permission denied/i],
 	["integrity", /ERR_PNPM_TARBALL_INTEGRITY|ERR_PNPM_BAD_TARBALL_SIZE|\bEINTEGRITY\b/],
+	["unknown", /The requested URL returned error: 40[134]\b/],
 	["network", /\bENOTFOUND\b|\bECONNRESET\b|\bETIMEDOUT\b|\bECONNREFUSED\b|\bEAI_AGAIN\b|ERR_PNPM_META_FETCH_FAIL|ERR_PNPM_FETCH_5\d\d|ERR_PNPM_FETCH_TIMEOUT|\bFETCH_ERROR\b|socket hang up|Could not resolve host|unable to access/]
 ];
 /**
@@ -259,110 +792,6 @@ function classifyInstallFailure(facts) {
 	for (const [kind, pattern] of LOG_KINDS) if (pattern.test(facts.log)) return kind;
 	return "unknown";
 }
-//#endregion
-//#region lib/types/install-spec.js
-/**
-* Reading an install spec before pnpm sees it: which of pnpm's spec forms it
-* takes, and for a registry name whether it is one the registry can accept.
-* @module @deepseek-ai/dsh-plugin-manager/install-spec
-*/
-/** The forms pnpm resolves through a git host: a host shorthand, a git URL, or a hosted repository URL. */
-const GIT_SHORTHAND = /^(?:github|gitlab|bitbucket|gist):/i;
-const GIT_URL = /^git(?:\+[a-z]+)?:\/\/|^git@[^:]+:/i;
-const HOSTED_REPOSITORY_URL = /^https?:\/\/[^/]+\/[^/]+\/[^/#]+(?:\.git)?(?:#.*)?$/i;
-/** The hosts pnpm's shorthands stand for. */
-const GIT_SHORTHAND_HOSTS = {
-	github: "github.com",
-	gitlab: "gitlab.com",
-	bitbucket: "bitbucket.org",
-	gist: "gist.github.com"
-};
-/** A tarball, on disk or over HTTP. */
-const TARBALL_SPEC = /\.(?:tgz|tar\.gz)(?:#.*)?$/i;
-/** An npm package name: lowercase URL-safe segments, an optional scope, no leading dot or underscore. */
-const PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*$/;
-const PACKAGE_NAME_MAX_LENGTH = 214;
-/** A spec neither pnpm nor the registry would take; `reason` is what the person reads. */
-var InvalidInstallSpecError = class extends Error {
-	spec;
-	reason;
-	/**
-	* @param spec - the spec as typed, trimmed.
-	* @param reason - why it is refused, as one sentence.
-	*/
-	constructor(spec, reason) {
-		super(`plugin-manager: ${reason}: ${spec}`);
-		this.spec = spec;
-		this.reason = reason;
-		this.name = "InvalidInstallSpecError";
-	}
-};
-function invalid(spec, reason) {
-	return new InvalidInstallSpecError(spec, reason);
-}
-/** The host a git spec is cloned from: the shorthand's host, the scp-like user@host, or the URL's host with its port. */
-function gitHost(spec) {
-	const shorthand = /^([a-z]+):/i.exec(spec)?.[1]?.toLowerCase();
-	if (shorthand !== void 0 && Object.hasOwn(GIT_SHORTHAND_HOSTS, shorthand)) return GIT_SHORTHAND_HOSTS[shorthand];
-	const scp = /^git@([^:]+):/i.exec(spec)?.[1];
-	if (scp !== void 0) return scp.toLowerCase();
-	return new URL(spec.replace(/^git\+/i, "")).host;
-}
-/**
-* Read a spec into its form. A path must be absolute: the Host's working
-* directory means nothing to the person typing into a browser, and a
-* relative path resolved against the profile would point inside it.
-* @param raw - the spec as typed.
-* @returns the parsed spec.
-* @throws {InvalidInstallSpecError} for an empty spec, a relative path, a name the
-* registry would refuse, or a URL that is neither a git host nor a tarball.
-*/
-function parseInstallSpec(raw) {
-	const spec = raw.trim();
-	if (spec === "") throw invalid(spec, "the package spec must not be empty");
-	const path = spec.replace(/^(?:file|link):/, "");
-	if (path !== spec || isAbsolute(path)) {
-		if (!isAbsolute(path)) throw invalid(spec, "a local path must be absolute");
-		return TARBALL_SPEC.test(path) ? {
-			kind: "tarball",
-			spec,
-			path
-		} : {
-			kind: "path",
-			spec,
-			path
-		};
-	}
-	if (/^\.{1,2}(?:[\\/]|$)/.test(spec)) throw invalid(spec, "a local path must be absolute");
-	if ((GIT_SHORTHAND.test(spec) || GIT_URL.test(spec) || HOSTED_REPOSITORY_URL.test(spec)) && !TARBALL_SPEC.test(spec)) return {
-		kind: "git",
-		spec,
-		host: gitHost(spec)
-	};
-	if (/^https?:\/\//i.test(spec)) {
-		if (TARBALL_SPEC.test(spec)) return {
-			kind: "tarball",
-			spec,
-			host: new URL(spec).host
-		};
-		throw invalid(spec, "a URL must point at a git repository or a tarball");
-	}
-	const at = spec.indexOf("@", 1);
-	const name = at === -1 ? spec : spec.slice(0, at);
-	const range = at === -1 ? void 0 : spec.slice(at + 1);
-	if (name.length > PACKAGE_NAME_MAX_LENGTH || !PACKAGE_NAME.test(name)) throw invalid(spec, "not a package name the registry accepts");
-	if (range === "") throw invalid(spec, "a version after @ must not be empty");
-	return range === void 0 ? {
-		kind: "registry",
-		spec,
-		name
-	} : {
-		kind: "registry",
-		spec,
-		name,
-		range
-	};
-}
 /** Public npmmirror URL shared by the fallback configuration and public-registry comparison. */
 const NPMMIRROR_REGISTRY = "https://registry.npmmirror.com/";
 /**
@@ -482,18 +911,6 @@ async function writePluginEnabled(filename, id, name, enabled) {
 	return true;
 }
 //#endregion
-//#region lib/types/failure.js
-/** Expected management rejection; presentation belongs to the caller's locale. */
-var ManagementFailure = class extends Error {
-	/** Code rendered by the caller's locale dictionary. */
-	code;
-	/** @param code Localizable management rejection. */
-	constructor(code) {
-		super(code);
-		this.code = code;
-	}
-};
-//#endregion
 //#region lib/types/build-approval.js
 /** Approve pnpm's pending dependency scripts in the current profile's workspace settings. */
 async function readPolicy(dir) {
@@ -537,6 +954,84 @@ async function approveBuilds(dir, names) {
 	await writeFileAtomic(join(dir, "pnpm-workspace.yaml"), String(document), { mode: 384 });
 }
 //#endregion
+//#region lib/types/github-connection.js
+/** Bounded GitHub repository checks using the installer's Git configuration and environment. */
+/**
+* Check a GitHub repository before pnpm starts, without downloading or building its package.
+* Git reads the profile's Git and proxy configuration without invoking credential helpers or prompting.
+* Timeout and cancellation terminate its descendants too; pnpm owns authentication and transport fallback.
+* @param spec The parsed installation address; npm packages, local paths and other hosts are not checked.
+* @param dir The profile directory where installation runs.
+* @param options The connection deadline, output bound and operation cancellation.
+* @returns A failed check with bounded output and a complete log at logPath, or undefined for a reachable repository or an unhandled spec.
+*/
+async function checkGithubConnection(spec, dir, options) {
+	if (spec.kind !== "git") return void 0;
+	const host = spec.host.toLowerCase().replace(/:.*$/, "");
+	if (host !== "github.com" && !host.endsWith(".github.com")) return void 0;
+	const repository = spec.spec.replace(/#.*$/s, "").replace(/^github:/i, "https://github.com/").replace(/^gist:/i, "https://gist.github.com/").replace(/^git\+/i, "");
+	const logRoot = join(dir, ".plugin-manager", "logs");
+	await mkdir(logRoot, {
+		recursive: true,
+		mode: 448
+	});
+	const logPath = join(await mkdtemp(join(logRoot, "github-connection-")), "git.log");
+	const log = await open(logPath, "ax+", 384);
+	try {
+		const result = await execa("git", [
+			"-c",
+			"credential.helper=",
+			"ls-remote",
+			"--",
+			repository,
+			"HEAD"
+		], {
+			cwd: dir,
+			env: {
+				...scrubbedParentEnv(),
+				...options.env,
+				LC_ALL: "C",
+				GIT_TERMINAL_PROMPT: "0",
+				GIT_ASKPASS: "",
+				SSH_ASKPASS: "",
+				SSH_ASKPASS_REQUIRE: "never"
+			},
+			extendEnv: false,
+			stdin: "ignore",
+			stdout: "ignore",
+			stderr: {
+				file: logPath,
+				append: true
+			},
+			buffer: false,
+			reject: false,
+			timeout: options.timeoutMs,
+			cancelSignal: options.signal,
+			killDescendants: true,
+			killSignal: "SIGKILL"
+		});
+		if (!result.failed) return void 0;
+		if (result.timedOut) await log.write(`dsh: connection to ${spec.host} timed out after ${String(options.timeoutMs)}ms\n`);
+		if ((await log.stat()).size === 0) await log.write(result.shortMessage ?? "GitHub connection check failed");
+		const { size } = await log.stat();
+		const bytes = Buffer.alloc(Math.min(size, options.outputBytes));
+		await log.read(bytes, 0, bytes.length, size - bytes.length);
+		const output = bytes.toString("utf8");
+		return {
+			exitCode: result.exitCode ?? (result.code === "ENOENT" ? 127 : 1),
+			output,
+			truncated: size > options.outputBytes,
+			logPath,
+			kind: classifyInstallFailure({
+				log: output,
+				timedOut: result.timedOut
+			})
+		};
+	} finally {
+		await log.close();
+	}
+}
+//#endregion
 //#region lib/types/index.js
 /** Current-profile plugin and bundle management over shared dsh plugin operations. */
 var __runInitializers = function(thisArg, initializers, value) {
@@ -611,10 +1106,14 @@ function messageOf(error) {
 }
 /** An expected refusal keeps its code; anything else becomes an operation error carrying its exact diagnostic. */
 function managementError(error) {
-	return error instanceof ManagementFailure ? { code: error.code } : {
+	if (!(error instanceof ManagementFailure)) return {
 		code: "operation-error",
 		diagnostic: messageOf(error)
 	};
+	return {
+		code: error.code,
+		...error.incompatible === void 0 ? {} : { incompatible: error.incompatible }
+	};
 }
 /** The caller stopped an installation; its files are restored before this is thrown. */
 var InstallCancelledError = class extends Error {
@@ -684,6 +1183,8 @@ function parsedForRegistry(spec) {
 let PluginManager = (() => {
 	let _classSuper = TypertRemoteService;
 	let _instanceExtraInitializers = [];
+	let _listVersionExemptions_decorators;
+	let _setVersionExemption_decorators;
 	let _listPlugins_decorators;
 	let _listBundles_decorators;
 	let _registries_decorators;
@@ -697,6 +1198,8 @@ let PluginManager = (() => {
 	return class PluginManager extends _classSuper {
 		static {
 			const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+			_listVersionExemptions_decorators = [Remote];
+			_setVersionExemption_decorators = [Remote];
 			_listPlugins_decorators = [Remote];
 			_listBundles_decorators = [Remote];
 			_registries_decorators = [Remote];
@@ -707,6 +1210,28 @@ let PluginManager = (() => {
 			_waitForInstall_decorators = [Remote];
 			_cancelInstall_decorators = [Remote];
 			_removeBundle_decorators = [Remote];
+			__esDecorate(this, null, _listVersionExemptions_decorators, {
+				kind: "method",
+				name: "listVersionExemptions",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "listVersionExemptions" in obj,
+					get: (obj) => obj.listVersionExemptions
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _setVersionExemption_decorators, {
+				kind: "method",
+				name: "setVersionExemption",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "setVersionExemption" in obj,
+					get: (obj) => obj.setVersionExemption
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
 			__esDecorate(this, null, _listPlugins_decorators, {
 				kind: "method",
 				name: "listPlugins",
@@ -830,6 +1355,8 @@ let PluginManager = (() => {
 			outputBytes: z.number().step(1).min(1).default(16384),
 			lockWaitMs: z.number().step(1).min(0).default(12e4),
 			inspectTimeoutMs: z.number().step(1).min(1e3).default(2e4),
+			githubConnectionTimeoutMs: z.number().step(1).min(1e3).default(5e3),
+			idleTimeoutMs: z.number().step(1).min(1e3).default(6e5),
 			registry: z.string().pattern(REGISTRY_URL),
 			fallbackRegistries: z.array(z.string().pattern(REGISTRY_URL)).default([NPMMIRROR_REGISTRY])
 		});
@@ -841,6 +1368,8 @@ let PluginManager = (() => {
 		outputBytes;
 		lockWaitMs;
 		inspectTimeoutMs;
+		githubConnectionTimeoutMs;
+		idleTimeoutMs;
 		pnpmCommand;
 		configuredRegistries;
 		ownerContext;
@@ -856,6 +1385,8 @@ let PluginManager = (() => {
 			this.outputBytes = config.outputBytes;
 			this.lockWaitMs = config.lockWaitMs;
 			this.inspectTimeoutMs = config.inspectTimeoutMs;
+			this.githubConnectionTimeoutMs = config.githubConnectionTimeoutMs;
+			this.idleTimeoutMs = config.idleTimeoutMs;
 			this.pnpmCommand = config.pnpmCommand;
 			this.configuredRegistries = {
 				registry: config.registry === void 0 ? null : normalizeRegistry(config.registry),
@@ -866,6 +1397,34 @@ let PluginManager = (() => {
 				await Promise.allSettled([...this.packageOperations]);
 			}, "plugin-manager: package cancellation");
 		}
+		/** Read exact plugin-version exemptions saved in this profile.
+		* @returns Accepted package-name@version keys with the runtime versions they may run on, and any
+		* record or file problem the reader rejected, which the caller reports instead of failing.
+		*/
+		listVersionExemptions() {
+			const { exemptions, warnings } = readProfileCompatibility(this.profile.dir);
+			return {
+				exemptions,
+				warnings
+			};
+		}
+		/** Grant or revoke one exact plugin/runtime exemption and reevaluate live plugins.
+		* @param packageVersion Exact manifest package name followed by @ and its version; never an installation spec or alias.
+		* @param runtimeVersion Exact current DSH version for grants; revocation may name a previous runtime.
+		* @param enabled Whether to grant rather than revoke the exemption.
+		* @param acceptRisk Required true for grants after the user accepts possible crashes and data loss.
+		* @returns Saved and runtime outcomes. Startup-only profiles require restart.
+		*/
+		setVersionExemption(packageVersion, runtimeVersion, enabled, acceptRisk) {
+			return this.change((result) => this.configure(async () => {
+				await setProfileVersionExemption(this.profile.dir, packageVersion, runtimeVersion, enabled, acceptRisk === true);
+				result.warnings = await this.reload();
+			}), {
+				stage: "enable",
+				target: packageVersion,
+				enabled
+			}, "bundle");
+		}
 		/** Read current plugins, including why a row cannot be changed through the profile patch.
 		* @returns Current runtime entries with persistent patch targets.
 		*/
@@ -896,6 +1455,7 @@ let PluginManager = (() => {
 		*/
 		listBundles() {
 			const manifest = readProfileManifest("dsh", this.profile.dir);
+			const exemptions = readProfileVersionExemptions(this.profile.dir);
 			const selected = manifest.dsh?.profile?.bundles ?? [];
 			const dependencies = Object.keys(manifest.dependencies ?? {});
 			const installation = JSON.parse(readFileSync(this.profile.installAnchor, "utf8"));
@@ -927,6 +1487,8 @@ let PluginManager = (() => {
 						});
 						continue;
 					}
+					const compatibility = evaluatePluginCompatibility(info, exemptions);
+					if (compatibility !== void 0 && !compatibility.exempted) throw new ManagementFailure("incompatible-version", [incompatiblePlugin(compatibility)]);
 					const dir = resolveBundleDir("dsh", name, this.profile.installAnchor, this.profile.dir);
 					const meta = readPluginMeta(info.name ?? name, pathToFileURL(join(dir, "package.json")).href);
 					bundles.push({
@@ -1116,7 +1678,9 @@ let PluginManager = (() => {
 			}, "bundle");
 		}
 		/**
-		* Install a package using the same pnpm implementation as dsh plugin. A run
+		* Install a package using the same pnpm implementation as dsh plugin. GitHub
+		* repositories get a connection check bounded by githubConnectionTimeoutMs before pnpm starts;
+		* only network failures or timeouts stop installation, while pnpm owns authentication and transport fallback. A run
 		* that fails, is cancelled, or adds a package without a bundle patch restores
 		* `package.json` and `pnpm-lock.yaml` as they were; downloaded files can stay.
 		* @param spec One package spec, including local paths relative to the invocation directory.
@@ -1131,7 +1695,7 @@ let PluginManager = (() => {
 				phase: "installing",
 				result: Promise.resolve(null)
 			};
-			const stopped = () => control.abort.signal.aborted;
+			const stopped = () => control.abort.signal.aborted || this.abort.signal.aborted;
 			if (requestId !== void 0) this.installs.set(requestId, control);
 			const announce = (phase, attempt) => {
 				if (requestId !== void 0) this.ownerContext.emit("plugin-manager/install-state", {
@@ -1149,11 +1713,30 @@ let PluginManager = (() => {
 				}
 				const files = await this.readRestoredFiles();
 				const before = readProfileManifest("dsh", this.profile.dir).dependencies ?? {};
-				const plan = registryPlan(options?.registry, await this.registries());
 				let name;
 				try {
-					let run;
 					result.registries = [];
+					const connection = checkGithubConnection(parsedForRegistry(spec), this.profile.dir, {
+						timeoutMs: this.githubConnectionTimeoutMs,
+						outputBytes: this.outputBytes,
+						signal: AbortSignal.any([this.abort.signal, control.abort.signal]),
+						...this.profile.packageManager?.env === void 0 ? {} : { env: this.profile.packageManager.env }
+					});
+					this.packageOperations.add(connection);
+					let connectionFailure;
+					try {
+						connectionFailure = await connection;
+					} finally {
+						this.packageOperations.delete(connection);
+					}
+					if (stopped()) throw new InstallCancelledError();
+					if (connectionFailure?.kind === "network" || connectionFailure?.kind === "timeout") {
+						result.packageResult = connectionFailure;
+						result.failedAt = "spec-host";
+						throw new Error(connectionFailure.output);
+					}
+					const plan = registryPlan(options?.registry, await this.registries());
+					let run;
 					for (const [index, registry] of plan.entries()) {
 						if (index > 0) await this.restoreFiles(files);
 						if (stopped()) throw new InstallCancelledError();
@@ -1170,17 +1753,21 @@ let PluginManager = (() => {
 						], control.abort.signal, requestId);
 						result.packageResult = run;
 						if (stopped()) throw new InstallCancelledError();
-						/* v8 ignore next 2 -- runPnpm classifies every failed run, so kind is never absent here */
-						if (run.exitCode === 0 || run.kind === void 0) break;
-						const failedAt = attributeFailure(run.kind, run.output, parsedForRegistry(spec));
+						if (run.incompatible !== void 0) throw new ManagementFailure("incompatible-version", run.incompatible);
+						if (run.exitCode === 0 && run.timedOut !== true) break;
+						/* v8 ignore next 2 -- runPnpm classifies every run it does not report as succeeded */
+						if (run.kind === void 0) break;
 						delete result.failedAt;
+						if (run.timedOut === true) break;
+						const failedAt = attributeFailure(run.kind, run.output, parsedForRegistry(spec));
 						if (failedAt !== "other") result.failedAt = failedAt;
 						if (failedAt !== "registry" || index === plan.length - 1) break;
 					}
 					/* v8 ignore next -- the plan is never empty, so a run always settled */
 					if (run === void 0) throw new Error("no registry was asked");
-					if (run.exitCode === 0) delete result.failedAt;
-					if (run.exitCode !== 0) {
+					const succeeded = run.exitCode === 0 && run.timedOut !== true;
+					if (succeeded) delete result.failedAt;
+					if (!succeeded) {
 						try {
 							result.pendingBuilds = await readPendingBuilds(this.profile.dir);
 						} catch (error) {
@@ -1197,6 +1784,8 @@ let PluginManager = (() => {
 					const dir = resolveBundleDir("dsh", name, this.profile.installAnchor, this.profile.dir);
 					const manifest = bundleManifest(name, this.profile.dir, this.profile.installAnchor);
 					if (manifest?.dsh?.bundle === void 0) throw new ManagementFailure("not-bundle");
+					const compatibility = evaluatePluginCompatibility(manifest, readProfileVersionExemptions(this.profile.dir));
+					if (compatibility !== void 0 && !compatibility.exempted) throw new ManagementFailure("incompatible-version", [incompatiblePlugin(compatibility)]);
 					for (const file of bundlePatchPaths(dir, manifest.dsh.bundle)) loadOverlayPatches("dsh", file);
 				} catch (error) {
 					await this.restoreFiles(files);
@@ -1232,7 +1821,7 @@ let PluginManager = (() => {
 		}
 		/** Stop an installation this manager owns and wait until its files are back.
 		* @param requestId The id the installation was started with.
-		* @returns `cancelled` once pnpm exited and the files are restored, `too-late` once the bundle is being
+		* @returns `cancelled` once the Git check or pnpm exited and the files are restored, `too-late` once the bundle is being
 		* applied, `not-running` for any other id.
 		*/
 		async cancelInstall(requestId) {
@@ -1266,7 +1855,7 @@ let PluginManager = (() => {
 					if ([...this.ctx.loader.entries()].some((entry) => entry.fiber?.uid != null && contributions.some((row) => row.id === entry.options.id && row.name === entry.options.name))) throw new ManagementFailure("bundle-in-use");
 				});
 				result.packageResult = await this.runPnpm(["remove", name]);
-				if (result.packageResult.exitCode !== 0) throw new Error(result.packageResult.output);
+				if (result.packageResult.exitCode !== 0 || result.packageResult.timedOut === true) throw new Error(result.packageResult.output);
 			}, {
 				stage: "remove",
 				target: name
@@ -1325,6 +1914,8 @@ let PluginManager = (() => {
 				signal: signal === void 0 ? this.abort.signal : AbortSignal.any([this.abort.signal, signal]),
 				outputBytes: this.outputBytes,
 				activateNewBundles: false,
+				idleTimeoutMs: this.idleTimeoutMs,
+				lookupTimeoutMs: this.inspectTimeoutMs,
 				onOutput: (text, stream) => {
 					this.ownerContext.emit("plugin-manager/install-log", {
 						...identity,
@@ -1348,9 +1939,13 @@ let PluginManager = (() => {
 					text: "",
 					exitCode: signal?.aborted === true ? null : result.exitCode
 				});
-				return result.exitCode === 0 ? result : {
+				if (result.exitCode === 0 && result.timedOut !== true) return result;
+				return {
 					...result,
-					kind: classifyInstallFailure({ log: result.output })
+					kind: classifyInstallFailure({
+						log: result.output,
+						...result.timedOut === true ? { timedOut: true } : {}
+					})
 				};
 			} catch (error) {
 				this.ownerContext.emit("plugin-manager/install-log", {
@@ -1384,8 +1979,15 @@ let PluginManager = (() => {
 		async selectBundle(name, enabled) {
 			const manifest = readProfileManifest("dsh", this.profile.dir);
 			const previous = manifest.dsh?.profile?.bundles ?? [];
-			if ((enabled || !previous.includes(name)) && bundleManifest(name, this.profile.dir, this.profile.installAnchor) === void 0) throw new ManagementFailure("not-bundle");
-			if (enabled) this.bundleRows(name);
+			if (enabled || !previous.includes(name)) {
+				const metadata = bundleManifest(name, this.profile.dir, this.profile.installAnchor);
+				if (metadata === void 0) throw new ManagementFailure("not-bundle");
+				if (enabled) {
+					const compatibility = evaluatePluginCompatibility(metadata, readProfileVersionExemptions(this.profile.dir));
+					if (compatibility !== void 0 && !compatibility.exempted) throw new ManagementFailure("incompatible-version", [incompatiblePlugin(compatibility)]);
+					this.bundleRows(name);
+				}
+			}
 			if (!enabled && previous.includes(name)) {
 				if (this.protectsManager(name)) throw new ManagementFailure("management-required");
 			}
@@ -1457,7 +2059,8 @@ let PluginManager = (() => {
 			return [
 				"package.json",
 				"cordis.patch.yml",
-				"pnpm-workspace.yaml"
+				"pnpm-workspace.yaml",
+				PROFILE_COMPATIBILITY_FILENAME
 			].map((file) => {
 				try {
 					return readFileSync(join(this.profile.dir, file), "utf8");