dsh-plugin-shop 0.4.14 → 0.5.0

package/lib/types/host/index.d.ts

@@ -5,6 +5,7 @@ import { loadCatalog, type LoadCatalogOptions } from './catalog.ts';
 import type { CatalogEntry, DeniedEntry } from './types.ts';
 import { type InstallArgs, type InstallRejectionCode } from './install.ts';
 import { type InstallStatus } from './executor.ts';
+import { hotMount, hotUnmount } from './hot.ts';
 import { type RestartOutcome } from './restart.ts';
 import { type RepoPinFs } from './repo-pins.ts';
 export type { InstallArgs, InstallRejectionCode } from './install.ts';
@@ -16,6 +17,18 @@ export interface InventoryEntry {
     moduleName: string;
     enabled: boolean;
 }
+/** One boot-layer Loader entry, structurally — the surface `liveDisable`
+ * consumes. `fiber` is the entry's live activation (present while the plugin
+ * is up); `update` flips its options. */
+export interface LoaderEntryLike {
+    options: {
+        name?: string;
+    };
+    fiber?: unknown;
+    update(options: {
+        disabled: boolean | null;
+    }, create?: boolean, force?: boolean): Promise<void>;
+}
 /** Test-only injection points; production callers pass nothing. */
 export interface ShopGatewayOptions {
     catalogUrl?: string;
@@ -30,6 +43,15 @@ export interface ShopGatewayOptions {
     inventory?: {
         list(): InventoryEntry[];
     };
+    /** Test-only injection: the hot-mount functions; production uses the real
+     * hotMount/hotUnmount. */
+    hot?: {
+        mount: typeof hotMount;
+        unmount: typeof hotUnmount;
+    };
+    /** Test-only injection: the Loader's boot-layer entries; production reads
+     * them from `ctx.loader`. */
+    loaderEntries?: () => Array<LoaderEntryLike>;
     dshBin?: string;
     /** The dsh argv this process was launched with, for `shop/restart`;
      * defaults to the real `process.argv` minus node and the script path. */
@@ -52,6 +74,17 @@ export interface ShopGatewayOptions {
     hasGit?: () => boolean;
     /** Test-only injection: the pins file's filesystem; production uses node:fs. */
     pinFs?: RepoPinFs;
+    /** Test-only injection: the explicit `allowRestart` override; production
+     * reads the loader row's `config.allowRestart`. */
+    allowRestart?: boolean;
+    /** The environment `detectSupervisor` reads; production uses process.env. */
+    env?: NodeJS.ProcessEnv;
+    /** The pid `detectSupervisor` inspects; production uses process.ppid —
+     * the PARENT pid (a systemd unit's main process has ppid 1). */
+    ppid?: number;
+    /** Test-only injection: how the release-tarball integrity check fetches
+     * the release asset; production uses global fetch. */
+    fetchTarball?: (url: string) => Promise<Response>;
 }
 /** `shop/installStart` result (§7.3): rejections are typed wire values with an
  * author-readable `detail`, not thrown RPC errors. */
@@ -93,6 +126,10 @@ export interface ShopVersionResult {
     installed: string;
     latest: string | null;
     outdated: boolean;
+    /** Whether `shop/restart` is usable: false when a supervisor owns this
+     * process and no `allowRestart` override is set. The client hides the
+     * restart offer on false but keeps the pending-change notice. */
+    restartSupported: boolean;
 }
 /** `shop/updateStart` result (§7.3): the self-update spawn, or a typed
  * refusal (a version that is not plain semver). */
@@ -116,6 +153,20 @@ export interface ShopInstalledEntry {
     outdated: boolean;
     enabled: boolean;
 }
+/** How many bytes a release tarball may be at the integrity check. The
+ * registry already refuses to publish a tarball over 32 MiB, so 64 MiB is
+ * headroom, not a gate of its own. */
+export declare const MAX_TARBALL_BYTES: number;
+/**
+ * Fetch a release tarball and verify its sha256 against the catalog record
+ * (market borrowings §3.1). Returns a rejection detail, or null when the
+ * bytes match. The read streams through the byte cap, so an oversized or
+ * hostile body is refused without ever being buffered. Every failure — fetch
+ * throw, non-2xx, unreadable body, over-cap, hash mismatch — carries the same
+ * `tarball-integrity` code with a detail naming what happened, so the plugin
+ * author can read the cause.
+ */
+export declare function verifyTarballSha256(fetchTarball: (url: string) => Promise<Response>, url: string, recordedSha256: string, maxBytes?: number): Promise<string | null>;
 /** `shop/catalog` result (§7.3), plus the denied list for the install gate's UI. */
 export interface ShopCatalogResult {
     schemaVersion: number;
@@ -137,6 +188,8 @@ export declare class ShopGateway extends TypertRemoteService {
     private readonly profile;
     private readonly profileDir?;
     private readonly inventory?;
+    private readonly hot?;
+    private readonly loaderEntriesInjected?;
     private readonly dshBin;
     /** The argv `shop/restart` re-spawns: the real process argv minus node and
      * the CLI script path, or a test-provided substitute. */
@@ -149,6 +202,14 @@ export declare class ShopGateway extends TypertRemoteService {
     private readonly latestVersion;
     private readonly hasGit;
     private readonly pinFs;
+    private readonly allowRestart?;
+    private readonly env;
+    /** The parent pid `detectSupervisor` inspects; production defaults to
+     * process.ppid (a systemd unit's main process has ppid 1). */
+    private readonly ppid;
+    /** The release-tarball fetch for the install-time integrity check; global
+     * fetch in production, a fixture response in tests. */
+    private readonly fetchTarball;
     /** The install gate runs against the last loaded snapshot, never a fresh
      * fetch per request (§7.2: the Host's cached snapshot is the truth). */
     /** Finished install records retained, so a poll sees the true terminal
@@ -178,6 +239,16 @@ export declare class ShopGateway extends TypertRemoteService {
      * without requiring a real profile above this module. */
     private profileDirResolved;
     private listInventory;
+    /** The Loader's boot-layer entries; a harness without the loader answers
+     * with an empty list (there is then nothing to live-disable). */
+    private loaderEntries;
+    /** Live-disable one boot-layer entry, retrying until its fiber is actually
+     * down. A disable can land while the entry's init is still in flight: the
+     * options flip but the finishing init brings the fiber up anyway, and a
+     * plain re-update no-ops on the empty diff (dsh-market themes.ts:74-93).
+     * For an update swap this sequencing is mandatory, not defensive: two live
+     * instances of a service-providing plugin would collide at provision. */
+    private liveDisable;
     /** Enable or disable one installed plugin, hot (§8): a disable writes the
      * row to the user layer, an enable drops it again so the bundle default
      * rules — the CLI's watchUserPatches applies either through HMR. The shop's
@@ -188,12 +259,16 @@ export declare class ShopGateway extends TypertRemoteService {
         enabled: boolean;
     }): ShopSetEnabledResult;
     private rowConfig;
+    /** The explicit restart override. Only the row's `config:` sub-object is
+     * passed to a plugin — a top-level `allowRestart:` beside `name:` would be
+     * silently ignored by the loader (dsh-market README, #227). */
+    private allowRestartConfigured;
     /** Browse the catalog (§7.3): cached snapshot, refreshed on demand. */
     catalog(args?: {
         refresh?: boolean;
     }): Promise<ShopCatalogResult>;
     /**
-     * Install one cataloged version into the profile (§7.2). The four rejection
+     * Install one cataloged version into the profile (§7.2). The rejection
      * paths run against this Host's snapshot before anything is spawned; only a
      * passing request reaches the executor.
      */

package/lib/types/host/install.d.ts

@@ -1,6 +1,6 @@
-/** Install gate: the four rejection paths of §7.2, as a pure function. */
+/** Install gate: the gate rejection paths of §7.2, as a pure function. */
 import type { CatalogSnapshot } from './catalog.ts';
-export type InstallRejectionCode = 'not-in-catalog' | 'denied' | 'version-mismatch' | 'needs-acknowledgement' | 'git-missing';
+export type InstallRejectionCode = 'not-in-catalog' | 'denied' | 'version-mismatch' | 'needs-acknowledgement' | 'git-missing' | 'tarball-integrity';
 export interface InstallArgs {
     name: string;
     version: string;

package/lib/types/host/supervisor.d.ts

@@ -0,0 +1,15 @@
+/** systemd-supervisor detection for `shop/restart` (design 2026-08-31
+ * market-borrowings C-1).
+ *
+ * Pure: the environment and the process snapshot are parameters, so the
+ * policy is fixture-driven. Two signals are required on purpose:
+ * `INVOCATION_ID` (and `JOURNAL_STREAM`) are inherited by every descendant
+ * of a unit — an ordinary terminal opened inside a service would carry them
+ * too. Only the unit's own main process has ppid 1; hiding the restart button
+ * for anything else would be the worse bug (dsh-market's restart.ts:31-44
+ * documents the same measured failure). */
+export type Supervisor = 'systemd' | null;
+export interface ProcessSnapshot {
+    ppid: number;
+}
+export declare function detectSupervisor(env: Record<string, string | undefined>, proc: ProcessSnapshot): Supervisor;

package/lib/types/host/types.d.ts

@@ -4,7 +4,7 @@ export interface CatalogSummary {
     zh?: string;
 }
 export interface CatalogSection {
-    category: 'tool' | 'provider' | 'ui' | 'workflow' | 'integration' | 'other';
+    category: 'tool' | 'provider' | 'ui' | 'workflow' | 'integration' | 'theme' | 'other';
     summary: CatalogSummary;
     capabilities: string[];
 }
@@ -20,6 +20,10 @@ export interface CatalogEntry {
     review?: {
         reviewedVersion?: string;
         reviewedCommit?: string;
+        /** For release-rescued entries, the review pin is the tarball sha256 —
+         * the content-addressed identity; the tag is display only, a mutable ref
+         * that must never carry the trust. */
+        reviewedSha256?: string;
         reviewer: string;
         reviewCommit: string;
         notes: string;
@@ -32,8 +36,18 @@ export interface CatalogEntry {
     /** Subpackage directory inside the repo; present exactly when the entry is
      * a monorepo subpackage rather than the repo root. */
     subdir?: string;
+    /** The prebuilt GitHub Release tarball, present exactly when the entry was
+     * rescued from `requires-build`. The Host installs this URL instead of the
+     * git form (market borrowings §3.1). */
+    tarball?: {
+        url: string;
+        sha256: string;
+    };
+    /** The date this entry first appeared in the catalog (YYYY-MM-DD). */
+    added: string;
 }
 export interface DeniedEntry {
     name: string;
     detail: string;
+    replacement?: string;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-shop",
-  "version": "0.4.14",
+  "version": "0.5.0",
   "description": "The DeepSeek Harness plugin shop: browse, install, enable, and update dsh plugins from a git-auditable catalog.",
   "repository": {
     "type": "git",
@@ -38,6 +38,7 @@
     "./package.json": "./package.json"
   },
   "files": [
+    "LICENSE",
     "lib/index.js",
     "lib/client.js",
     "lib/types/**/*.js",
@@ -48,7 +49,7 @@
     "lib/typert.remote-client.d.ts",
     "cordis.patch.yml"
   ],
-  "license": "MIT",
+  "license": "Apache-2.0",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"
   },
@@ -74,6 +75,7 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/cordis-plugin-include": "^1.0.6",
     "@deepseek-ai/dsh-app-boot": "^0.1.1-rc.2",
     "@deepseek-ai/dsh-home-paths": "^0.1.1-rc.2",
     "@deepseek-ai/dsh-typert-protocol": "^0.1.1-rc.2"
@@ -82,6 +84,9 @@
     "@deepseek-ai/cordis": {
       "optional": true
     },
+    "@deepseek-ai/cordis-plugin-include": {
+      "optional": true
+    },
     "@deepseek-ai/dsh-app-boot": {
       "optional": true
     },