dsh-plugin 2.1.0 → 2.2.1

package/src/client/locales.ts

@@ -22,6 +22,7 @@ export const zh = {
   sortAria: '插件排序方式',
   openHint: '打开 dsh-plugin.org',
   toggleLangHint: '切换界面语言',
+  githubHint: '在 GitHub 查看源码',
   fork: 'Fork',
   loading: '正在加载插件数据…',
   failed: '插件数据加载失败',
@@ -289,6 +290,7 @@ export const zh = {
   queuedUninstallTitle: '已加入卸载排队',
   queuedHint: '已加入排队，前序任务完成后将自动开始，可关闭本窗口继续浏览。',
   cancelTask: '取消任务',
+  cancel: '取消',
   cancelling: '正在取消…',
   errorTitle: '操作失败',
   errorTitleInstall: '安装失败',
@@ -350,6 +352,8 @@ export const zh = {
   bundleDeselectedHint: '注意：插件市场在当前 profile 的 bundle 列表中被取消勾选，重启宿主后它不会出现。请到「设置 → 插件」重新勾选 dsh-plugin。',
   failPnpmStoreHint: '安装器调用 pnpm 时报「store 位置不匹配」（ERR_PNPM_UNEXPECTED_STORE）：你的 profile 目录里旧插件依赖是用另一个大版本的 pnpm 生成的，当前 pnpm 出于安全不认旧目录，导致任何插件装进该 profile 都会失败。请删除该 profile 目录下的 node_modules 与 pnpm-lock.yaml（可先到「系统日志」或 ~/.dsh/profiles/<profile>/hub.log 查看完整报错），再重新安装。这不是插件本身的问题。',
   failPnpmUnusedPatchHint: '安装器调用 pnpm 时报「有些补丁没有被使用」（ERR_PNPM_UNUSED_PATCH）：你的 profile 里留着一条指向旧版本 dsh-plugin 的补丁声明（例如 dsh-plugin@1.4.2），而本次安装解析到的版本已经不是它，pnpm 出于安全直接中止整次安装，因此任何插件都装不进来。这不是插件本身的问题——请在 profile 目录（~/.dsh/profiles/<profile>）的 pnpm-workspace.yaml（pnpm 11 及以上）或 package.json 的 pnpm.patchedDependencies（pnpm 10）里删除该 dsh-plugin 补丁条目后重试。',
+  failProfileStateHint: '安装器调用 pnpm 时报 profile 的元数据与当前环境对不上（如 ERR_PNPM_OUTDATED_LOCKFILE / ERR_PNPM_NO_IMPORTER_MANIFEST_FOUND / ERR_PNPM_BAD_PM_VERSION / ERR_PNPM_PATCH_NOT_APPLIED）：profile 里的 pnpm-lock.yaml、package.json 或补丁声明与当前 pnpm 版本不一致，pnpm 在真正装插件之前就中止了，所以这个 profile 里装任何插件都会失败。这不是插件本身的问题——请在 profile 目录（~/.dsh/profiles/<profile>）里删除 pnpm-lock.yaml 后重试（pnpm 会按当前依赖重新生成）；若报的是 packageManager 版本不符，把 package.json 里的 packageManager 字段改成当前 pnpm 的大版本或直接删掉该字段；仍不行请重建该 profile 的依赖。',
+  failNodeEngineHint: '这个插件（或它的某个依赖）声明了更高的 Node / pnpm 版本要求（ERR_PNPM_UNSUPPORTED_ENGINE / EBADENGINE），当前版本不满足，pnpm 在安装阶段直接拒绝。这不是插件本身的问题——请把 Node 升级到要求的版本（nvm / fnm 切换，或安装新版 Node.js），确认 node -v 与 pnpm -v 都满足要求后重试。',
   // 404 依赖：点名 registry 上不存在的那个包（取不到包名时跳过这行），再给删除条目的指引
   failPnpmMissingDepTarget: '{pkg} 在 npm registry 上不存在（404）',
   failPnpmMissingDepHint: '安装器调用 pnpm 时报「包不存在」（ERR_PNPM_FETCH_404）：你的 profile 里留着一条指向 registry 上未发布包的依赖，pnpm 每次解析依赖都会先卡在它上面，因此任何插件都装不进来。这不是插件本身的问题——请在 profile 目录（~/.dsh/profiles/<profile>）的 package.json 里删除该依赖条目（同时删掉对应的 pnpm-lock.yaml 条目或整个锁文件）后重试。',
@@ -374,6 +378,9 @@ export const zh = {
   failReason_buildToolchainMissing: '这个插件依赖需要在本机编译的原生模块，但找不到可用的编译器。',
   failKind_pnpmStore: 'pnpm store 版本不匹配',
   failReason_pnpmStore: 'profile 里的依赖由另一大版本的 pnpm 生成，当前 pnpm 不认。',
+  failKind_pnpmModulesMismatch: 'profile 的依赖目录与当前 pnpm 配置不一致',
+  failReason_pnpmModulesMismatch: 'node_modules 是用另一套 pnpm 配置（hoist / 虚拟目录长度等）创建的，pnpm 拒绝复用。',
+  failPnpmModulesMismatchHint: '安装器调用 pnpm 时报「modules 目录与当前配置不一致」（`ERR_PNPM_*_DIFF`，例如 virtual-store-dir-max-length、public-hoist-pattern、hoist 规则、node-linker）：profile 里的 node_modules 是在另一套 pnpm 配置下生成的（常见于改过 .npmrc、换过 pnpm 大版本，或桌面端内置 pnpm 与 PATH 上的 pnpm 不是同一个），当前 pnpm 出于安全拒绝在它上面继续操作 —— 所以这个 profile 里的安装/卸载都会失败。修复（任选其一，在 profile 目录 ~/.dsh/profiles/<profile> 下操作）：① 执行一次 pnpm install，让它按当前配置重建 modules 目录；② 删掉该目录下的 node_modules，下次安装/卸载会自动重建；③ 如果你在 .npmrc 里设过这些配置项，把它们统一成同一个值（或删掉自定义、回到默认）。这不是插件本身的问题。',
   failKind_pnpmWorkspace: 'workspace 根校验阻止了安装',
   failReason_pnpmWorkspace: 'profile 被当作 workspace 根，但没有声明根操作，pnpm 中止了安装。',
   failKind_originRejected: '本地服务的来源校验未通过',
@@ -382,6 +389,10 @@ export const zh = {
   failReason_pnpmPolicy: '版本未满最小发布年龄，或缺完整性校验 / 来源不可信。',
   failKind_pnpmUnusedPatch: 'profile 残留旧补丁声明',
   failReason_pnpmUnusedPatch: 'profile 里留着指向旧版本 dsh-plugin 的补丁，pnpm 出于安全中止了安装。',
+  failKind_profileState: 'profile 的 pnpm 元数据与本机不一致',
+  failReason_profileState: 'profile 的 lockfile / package.json / packageManager 版本与当前 pnpm 对不上，安装没开始就被中止。',
+  failKind_nodeEngine: '本机 Node / pnpm 版本不满足要求',
+  failReason_nodeEngine: '这个插件（或其依赖）要求更高的 Node / pnpm 版本，当前版本被 pnpm 拒绝。',
   failKind_pnpmMissingDep: '依赖包在 registry 上不存在',
   failReason_pnpmMissingDep: 'profile 里有一条指向未发布包的依赖，pnpm 每次解析都卡在它上面。',
   failKind_pluginMissingDep: '插件依赖未发布',
@@ -390,6 +401,8 @@ export const zh = {
   failReason_registryVersionStale: '实际安装用的源还没同步到这个版本，或版本号写错。',
   failKind_registryAuth: 'npm 源拒绝了访问',
   failReason_registryAuth: 'registry 返回 401/403：这个源需要登录凭据，或当前网络不被允许。',
+  failKind_profileExclusive: 'profile 由桌面应用独占管理',
+  failReason_profileExclusive: '命令行 dsh 无权管理桌面应用的 profile，安装前就被宿主拒绝。',
   failKind_pnpmLinkedDirMissing: 'profile 里有失效的本地依赖',
   failReason_pnpmLinkedDirMissing: '有一条指向本机不存在目录的 link/file 依赖，pnpm 每次解析都卡住。',
   failKind_fileLocked: '文件被其他程序占用',
@@ -406,20 +419,36 @@ export const zh = {
   failReason_hostIncompatible: '插件声明的兼容清单里没有你正在运行的 DSH 版本。',
   failKind_network: '网络连接失败',
   failReason_network: '安装过程中连不上 npm 源或代理，请求没有完成。',
+  failKind_tlsTrust: 'HTTPS 证书校验失败',
+  failReason_tlsTrust: '本机有程序替换了 HTTPS 证书，Node / pnpm 不信任它的根证书。',
+  failTlsTrustHint: '安装器访问 npm 源时 TLS 证书校验失败（`ERR_PNPM_META_FETCH_FAIL` / unable to verify the first certificate）：本机有程序在替换 HTTPS 证书 —— 公司网络的 SSL 审计、杀毒软件的网页防护、Fiddler / Charles 这类抓包工具，或本机代理的 HTTPS 解密 —— 而 Node / pnpm 不信任它的根证书。这不是插件本身的问题，任何插件都会一样失败。按顺序处理：① 如果公司网络有 SSL 审计，找 IT 要根证书（.cer / .pem），把环境变量 NODE_EXTRA_CA_CERTS 指向该文件后重试；② Node ≥ 22.15 可以设置 NODE_OPTIONS=--use-system-ca，让 Node 直接信任系统证书库；③ 如果只是本机代理开了 HTTPS 解密，把 registry.npmjs.org 加进直连（跳过 MITM）；④ 也可以先临时切到公共镜像源 https://registry.npmmirror.com 重试。不建议直接关闭 strict-ssl：那等于放弃校验，会把你暴露在中间人攻击下。',
   failKind_hostCliSpawn: '无法启动 DSH 宿主',
   failReason_hostCliSpawn: '解析到的宿主入口起不来，安装命令没有真正执行。',
   failKind_hubState: '插件中心状态不同步',
   failReason_hubState: '本地记录的安装状态与实际不一致，这次操作没有生效。',
+  failKind_profileBundleMissing: 'profile 的依赖没装全',
+  failReason_profileBundleMissing: '宿主找不到 profile 里声明的某个 bundle，安装命令还没执行就失败了。',
+  failProfileBundleMissingHint: '宿主在启动插件管理时找不到 profile 依赖「{pkg}」—— 说明这个 profile 里声明的依赖没有装全（node_modules 被删过、上次安装中断，或桌面应用升级不完整）。这与你要装的插件无关，换任何插件都会一样失败。修复：① 让宿主把这个 profile 的依赖装回来（在桌面应用内重新打开插件中心，或执行 `dsh plugin --profile {profile} install`；桌面 profile 需在应用内执行，外部 CLI 无权管理）；② 仍然报同样的错，说明是应用本体不完整，请重装或升级 DeepSeek Harness 桌面端。',
   failKind_timeout: '操作超时',
   failReason_timeout: '安装耗时超过上限仍未完成，已经中止。',
   failKind_profileLock: 'profile 被其他进程占用',
   failReason_profileLock: '另一个 dsh 进程正在使用这个 profile。',
   failKind_hub: '出现未知错误',
   failReason_hub: '我们还没能识别这条报错，你可以一键反馈给我们。',
+  failKind_localEnv: '本机环境异常',
+  failReason_localEnv: '报错特征指向你的本机环境（系统错误码 / 证书代理 / 本地配置），没有发现插件侧原因。',
+  failKind_dshTooOld: 'DSH 版本低于插件要求',
+  failReason_dshTooOld: '插件声明的最低 DSH 版本高于你当前运行的宿主版本。',
+  failDshTooOldHint: '插件「{pkg}」声明需要 DSH {floor} 或更高，而你当前运行的是 {current} —— 版本不够时装不上（或装上后无法正常加载），这不是插件本身的问题，也不是插件市场的误判。请先把 DeepSeek Harness 升级到 {floor} 以上，再回到插件中心重试。如果升级后仍然失败，把新的报错发给我们。',
+  failLocalEnvHint: '从日志能确认的只有一点：没有插件侧的失败证据；报错特征落在本机环境（系统调用错误码、证书/代理校验、本地配置文件损坏等），但还不足以精确到某一类。这类问题装别的插件同样会失败，不是插件本身的问题。请按顺序自查：① 点下面的「运行系统诊断」看本机检查项；② 确认 profile 目录（~/.dsh/profiles/<profile>）可写、磁盘有空间、杀毒软件没拦截；③ 若在用代理或公司镜像源，先临时切回官方源 https://registry.npmjs.org 重试；④ 完全退出 DeepSeek Harness 后重试。排查后仍然失败、且你确信环境没问题，再用下面的链接反馈给我们，并附上通知中心里复制的完整日志。',
   failRegistryVersionStaleHint: '安装器调用 pnpm 时报「找不到匹配的版本」（ERR_PNPM_NO_MATCHING_VERSION）：要装的这个版本在实际执行安装的 npm 源里查不到。常见原因是你设置的 npmRegistry 与本机 ~/.npmrc 用的不是同一个源——官方源刚发布、镜像还没同步上来（快则几分钟、慢则几小时），也可能只是版本号写错了。这不是插件本身的问题。可在插件市场设置里把 npmRegistry 改成与本机 ~/.npmrc 一致（或反过来），或那一次显式走官方源（https://registry.npmjs.org）、改用离线包后重试；若该版本刚发布不久，等镜像同步后重试即可。',
   failRegistryAuthHint: '安装器访问 npm 源时被拒绝（HTTP 401/403）：这个源需要登录凭据，或不允许当前网络/IP 访问。如果你在用公司或私有源，请先配好认证（npm login，或在 ~/.npmrc 写入 //{host}/:_authToken=…）；如果不需要私有源，把 registry 换回官方源 https://registry.npmjs.org，或在插件市场设置里切换到公共镜像后重试。这不是插件本身的问题。',
   failRegistryAuthHintNoHost: '安装器访问 npm 源时被拒绝（HTTP 401/403）：这个源需要登录凭据，或不允许当前网络/IP 访问。如果你在用公司或私有源，请先配好认证（npm login，或在 ~/.npmrc 写入 //<registry>/:_authToken=…）；如果不需要私有源，把 registry 换回官方源 https://registry.npmjs.org，或在插件市场设置里切换到公共镜像后重试。这不是插件本身的问题。',
+  failProfileExclusiveHint: 'profile「{profile}」由桌面应用独占管理，命令行 dsh 无权安装 —— 这不是插件本身的问题。请在 DeepSeek Harness 桌面应用的「设置 → 插件市场」里安装；或改用非桌面独占的 profile（例如 web）后重试。如果你就是在桌面应用内看到这条错误，请到插件市场的「通知」里打开这条失败记录点「复制」，把完整日志发给我们。',
+  failProfileExclusiveHintNoProfile: '当前 profile 由桌面应用独占管理，命令行 dsh 无权安装 —— 这不是插件本身的问题。请在 DeepSeek Harness 桌面应用的「设置 → 插件市场」里安装；或改用非桌面独占的 profile（例如 web）后重试。如果你就是在桌面应用内看到这条错误，请到插件市场的「通知」里打开这条失败记录点「复制」，把完整日志发给我们。',
+  failDesktopCliFallbackHint: '这次是安装器没找到桌面应用内置的 CLI 引导脚本、退回命令行 dsh 才被拒绝 —— 属于插件中心自身的问题，不是你的环境问题。点下面的按钮把完整日志发给我们，我们会补上路径推导。',
   failPnpmLinkedDirMissingHint: '安装器调用 pnpm 时报「要安装的目录不存在」（ERR_PNPM_LINKED_PKG_DIR_NOT_FOUND）：你的 profile 里留着一条指向本机不存在目录的本地依赖（link: / file: 形式，例如用 dsh plugin add <本地路径> 装过开发中的插件，之后那个目录被删除或移动了）。pnpm 每次解析 profile 依赖都会先卡在它上面，因此任何插件都装不进来。这不是插件本身的问题——请在 profile 目录（~/.dsh/profiles/<profile>）的 package.json 里删除该本地依赖条目（同时删掉对应的 pnpm-lock.yaml 条目或整个锁文件），或把该目录恢复回原路径后重试。',
+  failLinkedDirTarget: '缺失的本地目录：{path}',
   failFileLockedHint: '安装过程中 pnpm 无法替换 profile 里的文件：有程序正占用着它（Windows 常见报错 os error 32「另一个程序正在使用此文件」）。通常是 DeepSeek Harness 自身或杀毒软件的实时扫描持有文件句柄。这不是插件本身的问题——请完全退出 DeepSeek Harness（Windows 可在任务管理器确认进程已结束，必要时临时关闭杀毒软件实时防护）后重试。',
   failAccessDeniedHint: '安装过程中 pnpm 写入 profile 里的文件被系统拒绝访问（Windows 常见报错 os error 5「拒绝访问」，英文为 Access is denied；Node 下的 EPERM / EACCES 同理）。常见原因是该文件或目录正被其他进程占用、文件带只读属性、目录权限受限，或杀毒软件实时防护拦截了写入——这与「文件正被占用」（os error 32）同属本机文件系统问题，任何插件装进该目录都会一样失败，不是插件本身的问题。请完全退出 DeepSeek Harness（Windows 可在任务管理器确认进程已结束，必要时临时关闭杀毒软件实时防护）后重试；若仍然失败，请检查 profile 目录及其文件是否被设为只读，并以管理员身份重新运行。',
   failFsUnavailableHint: '安装过程中 pnpm 无法把文件写进本机磁盘（这类报错与装哪个插件无关，任何插件装在同一目录都会失败，不是插件本身的问题）。请按报错对号入座：① 磁盘空间不足（ENOSPC / no space left on device，Windows 为 os error 112）——请清理 profile 所在磁盘的剩余空间后重试；② 磁盘或挂载点只读、带写保护（EROFS / read-only file system，Windows 为 os error 19）——请确认 profile 目录所在磁盘可写（外接盘/U 盘、带写保护的移动盘或只读挂载的分区都会触发），必要时把插件目录换到系统盘的可写位置；③ 进程可用的文件句柄被耗尽（EMFILE / ENFILE / too many open files）——请关闭占用大量文件的程序并重启 DeepSeek Harness 后重试。',
@@ -577,8 +606,6 @@ export const en = {
   settingsUpdateDesc: 'Update checks and the network channels used for installs',
   settingsCheckOnStart: 'Check for updates on startup',
   settingsCheckOnStartDesc: 'Check installed plugins for new versions when the hub opens; you will be notified when updates are found',
-  settingsAutoInstall: 'Auto-install updates',
-  settingsAutoInstallDesc: 'Install detected updates in the background without asking (a host restart applies them)',
   settingsProxy: 'HTTP proxy',
   settingsProxyDesc: 'Route npm, git and catalog requests through this proxy; leave empty to connect directly',
   // 代理连通性实时探测：输入停笔后提示检测结果（不通仍可保存，先填地址后开代理也合法）
@@ -820,6 +847,8 @@ export const en = {
   bundleDeselectedHint: 'Note: the marketplace is unchecked in this profile\'s bundle list, so it will not appear after the host restarts. Re-check dsh-plugin under Settings → Plugins.',
   failPnpmStoreHint: 'pnpm reported an unexpected store location (ERR_PNPM_UNEXPECTED_STORE): the profile directory was previously set up with a different major version of pnpm, and the current pnpm refuses to reuse it — no plugin can be installed into that profile. Delete node_modules and pnpm-lock.yaml under the profile directory (see System Logs or ~/.dsh/profiles/<profile>/hub.log for the full output), then reinstall. This is not a problem with the plugin itself.',
   failPnpmUnusedPatchHint: 'pnpm reported that some patches were not used (ERR_PNPM_UNUSED_PATCH): your profile still holds a patch entry for an older dsh-plugin version (for example dsh-plugin@1.4.2), while this install resolved a different version, so pnpm aborts the whole install for safety — no plugin can be installed into that profile. This is not a problem with the plugin itself. Remove that dsh-plugin patch entry from pnpm-workspace.yaml (pnpm 11+) or from pnpm.patchedDependencies in package.json (pnpm 10) inside the profile directory (~/.dsh/profiles/<profile>), then retry.',
+  failProfileStateHint: 'pnpm reported that the profile metadata does not match the current environment (e.g. ERR_PNPM_OUTDATED_LOCKFILE / ERR_PNPM_NO_IMPORTER_MANIFEST_FOUND / ERR_PNPM_BAD_PM_VERSION / ERR_PNPM_PATCH_NOT_APPLIED): pnpm-lock.yaml, package.json or the patch declarations inside the profile disagree with the pnpm version in use, so pnpm aborts before installing anything — every plugin install into this profile will fail. This is not a problem with the plugin itself. Delete pnpm-lock.yaml inside the profile directory (~/.dsh/profiles/<profile>) and retry (pnpm regenerates it from the declared dependencies); if the error is about packageManager, set that field in package.json to the current pnpm major or remove it; if it still fails, rebuild the profile dependencies.',
+  failNodeEngineHint: 'This plugin (or one of its dependencies) declares a higher Node / pnpm version (ERR_PNPM_UNSUPPORTED_ENGINE / EBADENGINE), which the current one does not satisfy, so pnpm refuses at install time. This is not a problem with the plugin itself. Upgrade Node to the required version (switch with nvm / fnm, or install a newer Node.js), confirm node -v and pnpm -v both satisfy it, then retry.',
   // 缺失依赖：点名 404 的包（解析不出时跳过该行），再给删除指引
   failPnpmMissingDepTarget: '{pkg} was not found on the npm registry (404)',
   failPnpmMissingDepHint: 'pnpm reported that a package does not exist on the npm registry (ERR_PNPM_FETCH_404): your profile keeps a dependency on a package that was never published, and pnpm hits it every time it resolves dependencies — no plugin can be installed into that profile. This is not a problem with the plugin itself. Remove that dependency from package.json inside the profile directory (~/.dsh/profiles/<profile>) — along with its entry in pnpm-lock.yaml, or the lockfile itself — then retry.',
@@ -844,6 +873,9 @@ export const en = {
   failReason_buildToolchainMissing: 'A dependency of this plugin must be compiled locally, but no usable compiler was found.',
   failKind_pnpmStore: 'pnpm store version mismatch',
   failReason_pnpmStore: 'The profile dependencies were written by a different pnpm major, which the current pnpm does not accept.',
+  failKind_pnpmModulesMismatch: 'profile dependency directory does not match the current pnpm config',
+  failReason_pnpmModulesMismatch: 'node_modules was created with a different pnpm config (hoisting / virtual store length), so pnpm refuses to reuse it.',
+  failPnpmModulesMismatchHint: 'pnpm reported that the modules directory does not match the current configuration (`ERR_PNPM_*_DIFF`, e.g. virtual-store-dir-max-length, public-hoist-pattern, hoisting rules, node-linker): node_modules inside the profile was built under a different pnpm config (typically after editing .npmrc, switching pnpm majors, or when the pnpm bundled with the desktop app differs from the one on PATH), so the current pnpm refuses to operate on it — installs and removals in this profile will keep failing. Fix it (any one of these, run inside the profile directory ~/.dsh/profiles/<profile>): ① run pnpm install once so it recreates the modules directory with the current config; ② delete node_modules there — the next install/removal recreates it; ③ if you set these options in .npmrc, make the values consistent (or drop the overrides and go back to the defaults). This is not a problem with the plugin itself.',
   failKind_pnpmWorkspace: 'workspace-root check blocked the install',
   failReason_pnpmWorkspace: 'The profile is treated as a workspace root without a root operation declared, so pnpm aborted.',
   failKind_originRejected: 'request origin rejected by the local service',
@@ -852,6 +884,10 @@ export const en = {
   failReason_pnpmPolicy: 'The version is younger than the minimum release age, or an integrity / trust check failed.',
   failKind_pnpmUnusedPatch: 'stale patch entry in the profile',
   failReason_pnpmUnusedPatch: 'The profile keeps a patch for an older dsh-plugin version, so pnpm aborted for safety.',
+  failKind_profileState: 'profile pnpm metadata does not match this machine',
+  failReason_profileState: 'The profile lockfile / package.json / packageManager version disagrees with the current pnpm, so the install aborts before starting.',
+  failKind_nodeEngine: 'Node / pnpm on this machine is below the required version',
+  failReason_nodeEngine: 'This plugin (or a dependency) requires a newer Node / pnpm, so pnpm rejects the install.',
   failKind_pnpmMissingDep: 'a dependency does not exist on the registry',
   failReason_pnpmMissingDep: 'The profile keeps a dependency on an unpublished package, which pnpm hits on every resolve.',
   failKind_pluginMissingDep: 'plugin dependency is not published',
@@ -860,6 +896,8 @@ export const en = {
   failReason_registryVersionStale: 'The registry that actually performs the install has not synced this version yet, or the version is mistyped.',
   failKind_registryAuth: 'the npm registry rejected access',
   failReason_registryAuth: 'The registry returned 401/403: it needs credentials, or the current network is not allowed.',
+  failKind_profileExclusive: 'the profile is managed only by the desktop app',
+  failReason_profileExclusive: 'The dsh CLI may not manage the desktop profile, so the host refused before installing.',
   failKind_pnpmLinkedDirMissing: 'dangling local dependency in the profile',
   failReason_pnpmLinkedDirMissing: 'A link/file dependency points at a directory that no longer exists, so pnpm stalls on it.',
   failKind_fileLocked: 'a file is held by another program',
@@ -876,20 +914,36 @@ export const en = {
   failReason_hostIncompatible: 'The plugin\'s declared compatibility list does not include the DSH version you are running.',
   failKind_network: 'network connection failed',
   failReason_network: 'The install could not reach the npm registry or the proxy, so the request never completed.',
+  failKind_tlsTrust: 'HTTPS certificate verification failed',
+  failReason_tlsTrust: 'Something on this machine is replacing HTTPS certificates, and Node / pnpm does not trust its root CA.',
+  failTlsTrustHint: 'TLS certificate verification failed while reaching the npm registry (`ERR_PNPM_META_FETCH_FAIL` / unable to verify the first certificate): something on this machine is replacing HTTPS certificates — corporate SSL inspection, an antivirus web shield, a debugging proxy such as Fiddler / Charles, or HTTPS decryption in a local proxy — and Node / pnpm does not trust its root CA. This is not a problem with the plugin; every plugin would fail the same way. In order: ① if your network performs SSL inspection, ask IT for the root certificate (.cer / .pem) and point the NODE_EXTRA_CA_CERTS environment variable at it; ② on Node ≥ 22.15 you can set NODE_OPTIONS=--use-system-ca so Node trusts the system certificate store; ③ if only your local proxy decrypts HTTPS, add registry.npmjs.org to its direct (no-MITM) list; ④ as a temporary workaround, switch to a public mirror such as https://registry.npmmirror.com and retry. We do not recommend disabling strict-ssl: that gives up verification entirely and exposes you to man-in-the-middle attacks.',
   failKind_hostCliSpawn: 'the DSH host could not be launched',
   failReason_hostCliSpawn: 'The resolved host entry point would not start, so the install command never ran.',
   failKind_hubState: 'plugin hub state is out of sync',
   failReason_hubState: 'The locally recorded install state does not match reality, so this operation had no effect.',
+  failKind_profileBundleMissing: 'profile dependencies are incomplete',
+  failReason_profileBundleMissing: 'The host cannot find a bundle the profile declares, so the install failed before it even started.',
+  failProfileBundleMissingHint: 'The host could not resolve the profile dependency "{pkg}" while starting plugin management — the dependencies declared by this profile are not fully installed (node_modules was deleted, a previous install was interrupted, or the desktop app update was incomplete). This has nothing to do with the plugin you were installing; any plugin would fail the same way. Fix it: ① let the host install the profile dependencies again (reopen the Plugin Hub inside the desktop app, or run `dsh plugin --profile {profile} install`; a desktop-managed profile has to be handled from inside the app, an external CLI is not allowed); ② if the same error persists, the app installation itself is incomplete — reinstall or upgrade DeepSeek Harness Desktop.',
   failKind_timeout: 'operation timed out',
   failReason_timeout: 'The install exceeded the time limit and was aborted.',
   failKind_profileLock: 'profile is locked by another process',
   failReason_profileLock: 'Another dsh process is using this profile right now.',
   failKind_hub: 'unknown error',
   failReason_hub: 'We could not identify this error yet — you can report it to us in one click.',
+  failKind_localEnv: 'local environment failure',
+  failReason_localEnv: 'The error points at your local environment (system error codes, certificates/proxy, or local config), and no plugin-side cause was found.',
+  failKind_dshTooOld: 'DSH is older than the plugin requires',
+  failReason_dshTooOld: 'The plugin declares a minimum DSH version that is newer than the host you are running.',
+  failDshTooOldHint: 'The plugin "{pkg}" requires DSH {floor} or newer, but this host runs {current} — the install cannot succeed on an older host (or the plugin will not load properly). This is not a problem with the plugin itself, and not a mistake by the marketplace. Upgrade DeepSeek Harness to {floor} or newer, then retry from the Plugin Hub. If it still fails after upgrading, send us the new error.',
+  failLocalEnvHint: 'The log only tells us one thing for sure: there is no evidence of a plugin-side failure — the signals point at your local environment (system call error codes, certificate/proxy validation, a broken local config file), but not precisely enough to name one. Any plugin would fail the same way on this machine, so it is not a problem with the plugin itself. Check in order: ① press "Run diagnostics" below; ② make sure the profile directory (~/.dsh/profiles/<profile>) is writable, the disk has free space, and antivirus is not blocking it; ③ if you use a proxy or a company mirror, switch back to the official registry (https://registry.npmjs.org) for one retry; ④ fully quit DeepSeek Harness and retry. If it still fails and you are sure your environment is fine, use the link below to report it with the full log copied from the Hub notifications.',
   failRegistryVersionStaleHint: 'pnpm reported that no matching version was found (ERR_PNPM_NO_MATCHING_VERSION): the version being installed does not exist in the npm registry that actually performs the install. This usually means the npmRegistry configured in the hub differs from the source in your local ~/.npmrc — the official registry has published it but the mirror has not synced yet (it can take minutes to hours) — or the version number was simply mistyped. This is not a problem with the plugin itself. Align the hub\'s npmRegistry with your local ~/.npmrc (or the other way round), or explicitly use the official registry (https://registry.npmjs.org) for that one install, or use an offline package, then retry; if the version was published only recently, waiting for the mirror to sync is enough.',
   failRegistryAuthHint: 'The installer was denied access to the npm registry (HTTP 401/403): that registry requires credentials, or it does not allow the current network/IP. If you are using a company or private registry, configure authentication first (npm login, or write //{host}/:_authToken=… into ~/.npmrc). If you do not need a private registry, point the registry back to the official one (https://registry.npmjs.org), or switch to a public mirror in the hub settings, then retry. This is not a problem with the plugin itself.',
   failRegistryAuthHintNoHost: 'The installer was denied access to the npm registry (HTTP 401/403): that registry requires credentials, or it does not allow the current network/IP. If you are using a company or private registry, configure authentication first (npm login, or write //<registry>/:_authToken=… into ~/.npmrc). If you do not need a private registry, point the registry back to the official one (https://registry.npmjs.org), or switch to a public mirror in the hub settings, then retry. This is not a problem with the plugin itself.',
+  failProfileExclusiveHint: 'Profile "{profile}" is managed exclusively by the desktop app, and the command-line dsh is not allowed to install into it — this is not a problem with the plugin itself. Install from "Settings → Plugin Hub" inside DeepSeek Harness Desktop, or retry with a profile that is not desktop-managed (for example web). If you hit this inside the desktop app, open the Hub notifications, select the failed record and press "Copy" so you can send us the full log.',
+  failProfileExclusiveHintNoProfile: 'The current profile is managed exclusively by the desktop app, and the command-line dsh is not allowed to install into it — this is not a problem with the plugin itself. Install from "Settings → Plugin Hub" inside DeepSeek Harness Desktop, or retry with a profile that is not desktop-managed (for example web). If you hit this inside the desktop app, open the Hub notifications, select the failed record and press "Copy" so you can send us the full log.',
+  failDesktopCliFallbackHint: 'This failed because the installer could not find the desktop app\'s bundled CLI bootstrap and fell back to the command-line dsh, which is then refused — that is a bug in the plugin hub, not your environment. Use the button below to send us the full log and we will fix the path detection.',
   failPnpmLinkedDirMissingHint: 'pnpm reported that a directory it needs to install from does not exist (ERR_PNPM_LINKED_PKG_DIR_NOT_FOUND): your profile keeps a local dependency (a link: / file: entry, e.g. from `dsh plugin add <local path>`) whose target directory has since been deleted or moved. pnpm hits it every time it resolves profile dependencies, so no plugin can be installed into that profile. This is not a problem with the plugin itself. Remove that local dependency from package.json inside the profile directory (~/.dsh/profiles/<profile>) — along with its entry in pnpm-lock.yaml, or the lockfile itself — or restore the directory to its original path, then retry.',
+  failLinkedDirTarget: 'Missing local directory: {path}',
   failFileLockedHint: 'During install, pnpm could not replace a file inside the profile because another program is holding it (on Windows this shows as os error 32, "the process cannot access the file because it is being used by another process"). Usually DeepSeek Harness itself or a real-time antivirus scan holds the handle. This is not a problem with the plugin itself — fully quit DeepSeek Harness (on Windows, confirm in Task Manager that the process has ended, and temporarily disable real-time antivirus protection if needed), then retry.',
   failAccessDeniedHint: 'During install, Windows denied pnpm access to a file inside the profile (this shows as os error 5, "Access is denied"; on Node the equivalent codes are EPERM / EACCES). Typical causes: the file or directory is held by another process, the file is marked read-only, the directory permissions are restricted, or a real-time antivirus scan blocked the write. This is the same class of local file-system problem as a locked file (os error 32) — no plugin can be installed into that directory, so it is not a problem with the plugin itself. Fully quit DeepSeek Harness (on Windows, confirm in Task Manager that the process has ended, and temporarily disable real-time antivirus protection if needed), then retry. If it still fails, check whether the profile directory or its files are read-only and run as administrator.',
   failFsUnavailableHint: 'During install, pnpm could not write files to the local disk — this has nothing to do with which plugin you are installing: any plugin installed into the same directory would fail the same way, so it is not a problem with the plugin itself. Match the error you see: ① Out of space (ENOSPC / no space left on device, os error 112 on Windows) — free up space on the drive that holds the profile and retry. ② Read-only or write-protected volume (EROFS / read-only file system, os error 19 on Windows) — make sure the drive holding the profile directory is writable (external or USB drives, write-protected media, and read-only mounts all trigger this); move the plugin directory to a writable location on the system drive if needed. ③ File handles exhausted (EMFILE / ENFILE / too many open files) — close programs that hold many files open, restart DeepSeek Harness, then retry.',

package/src/client/logic/failures.ts

@@ -148,7 +148,7 @@ export function removeNotification(id: number): NotificationRecord[] {
   return next
 }
 
-export type FailureKind = 'npmTooOld' | 'dshMissing' | 'gitMissing' | 'pnpmMissing' | 'npmMissing' | 'pnpmStore' | 'pnpmWorkspace' | 'originRejected' | 'pnpmPolicy' | 'pnpmUnusedPatch' | 'pnpmMissingDep' | 'pluginMissingDep' | 'registryVersionStale' | 'registryAuth' | 'pnpmLinkedDirMissing' | 'fileLocked' | 'accessDenied' | 'fsUnavailable' | 'buildToolchainMissing' | 'pnpmIgnoredBuild' | 'pluginPrepare' | 'hostIncompatible' | 'network' | 'hostCliSpawn' | 'hubState' | 'timeout' | 'profileLock' | 'hub'
+export type FailureKind = 'npmTooOld' | 'nodeEngine' | 'dshMissing' | 'gitMissing' | 'pnpmMissing' | 'npmMissing' | 'pnpmStore' | 'pnpmModulesMismatch' | 'profileState' | 'pnpmWorkspace' | 'originRejected' | 'pnpmPolicy' | 'pnpmUnusedPatch' | 'pnpmMissingDep' | 'pluginMissingDep' | 'registryVersionStale' | 'registryAuth' | 'profileExclusive' | 'pnpmLinkedDirMissing' | 'fileLocked' | 'accessDenied' | 'fsUnavailable' | 'buildToolchainMissing' | 'pnpmIgnoredBuild' | 'pluginPrepare' | 'hostIncompatible' | 'tlsTrust' | 'network' | 'hostCliSpawn' | 'hubState' | 'profileBundleMissing' | 'timeout' | 'profileLock' | 'dshTooOld' | 'localEnv' | 'hub'
 
 /** 失败动作口径：标题、上报正文与提示文案按安装/更新/卸载取词，不写死「安装」。 */
 export type FailureAction = 'install' | 'update' | 'uninstall'
@@ -220,9 +220,15 @@ export function classifyFailure(message: string): FailureKind {
   // 宿主版本门禁：插件声明的兼容范围不含当前 dsh 版本，宿主在安装前直接拒绝。
   // 必须最先判 —— 这是宿主自己给的结论，不是 pnpm 的安装失败
   if (/installation rejected:.*incompatible with dsh/i.test(message)) return 'hostIncompatible'
+  // desktop profile 由桌面应用独占：外部 dsh CLI 无权管理，宿主在安装前直接拒绝。
+  // 属宿主/环境约束，不是插件问题；必须在所有 pnpm 分支之前判（日志里没有 pnpm 报错）。
+  if (/is managed exclusively by the Electron application|managed exclusively by the desktop app/i.test(message)) return 'profileExclusive'
   // npm 自身崩溃（edgesOut）或服务端标记的本机 npm 版本过低。必须最先判，否则会被外层
   // ERR_PNPM_PREPARE_PACKAGE 吞成「插件打包问题」
   if (/\[npm-too-low\]|edgesOut/i.test(message)) return 'npmTooOld'
+  // 本机 Node / pnpm 版本低于包声明的下限：装任何声明了同样 engine 的插件都会失败，属本机环境。
+  // 只认硬错误码 —— pnpm 的「WARN Unsupported Engine」只是告警，照着判会盖掉真实失败原因
+  if (/ERR_PNPM_UNSUPPORTED_ENGINE|ERR_PNPM_INVALID_NODE_VERSION|\bEBADENGINE\b/i.test(message)) return 'nodeEngine'
   // 本机缺 pnpm。必须在 dshMissing 之前 —— 后者的裸「command not found」会吞掉 pnpm 缺失
   if (/\[pnpm-missing\]|pnpm not found|pnpm: command not found|spawn pnpm ENOENT|'pnpm' 不是内部或外部命令|"pnpm" 不是内部或外部命令|pnpm['"]?\s*is not recognized/i.test(message)) return 'pnpmMissing'
   // 本机缺 git。必须在 dshMissing 之前，原因同上（裸「is not recognized」会吞掉 git 缺失）
@@ -231,9 +237,13 @@ export function classifyFailure(message: string): FailureKind {
   if (/\[npm-missing\]|spawn npm ENOENT|'npm' 不是内部或外部命令|"npm" 不是内部或外部命令|npm['"]?\s*is not recognized|npm: command not found/i.test(message)) return 'npmMissing'
   // 本机缺 dsh。服务端 [dsh-missing] 标记乱码免疫（Windows GBK 解码后无法匹配原文）
   if (/\[dsh-missing\]|不是内部或外部命令|is not recognized as an internal or external command|command not found|spawn dsh ENOENT/i.test(message)) return 'dshMissing'
+  // profile 的 modules 目录与当前 pnpm 配置不一致（pnpm 会把 virtual-store-dir-max-length /
+  // public-hoist-pattern / hoist 规则 / node-linker 等写进 node_modules/.modules.yaml，任一不一致就拒绝复用）。
+  // 必须在 pnpmStore 之前：两者处置方式不同（这里只需按当前配置重建 modules 目录）。
+  if (/ERR_PNPM_[A-Z0-9_]*DIFF\b|modules directory was created using a different/i.test(message)) return 'pnpmModulesMismatch'
   // store 版本不匹配：profile 依赖由另一大版本 pnpm 生成，当前 pnpm 不认。
   // 必须在 pnpmMissing 之后（pnpm 能跑起来报错，不是找不到命令）
-  if (/ERR_PNPM_UNEXPECTED_(VIRTUAL_)?STORE|Unexpected (virtual )?store location/i.test(message)) return 'pnpmStore'
+  if (/ERR_PNPM_UNEXPECTED_(VIRTUAL_)?STORE|ERR_PNPM_UNEXPECTED_PKG_CONTENT_IN_STORE|Unexpected (virtual )?store location/i.test(message)) return 'pnpmStore'
   // pnpm 拒绝往 workspace 根装依赖：profile 被视为 workspace 根但未声明根操作
   if (/ERR_PNPM_ADDING_TO_ROOT|add the dependency to the workspace root/i.test(message)) return 'pnpmWorkspace'
   // 本地服务来源校验拒绝（403 untrusted origin），请求没进安装流程。必须在 pnpmPolicy 之前
@@ -244,6 +254,10 @@ export function classifyFailure(message: string): FailureKind {
   if (missingTarballIntegrity(message) || mismatchedTarballIntegrity(message) || /ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION|ERR_PNPM_NO_MATURE_MATCHING_VERSION|Minimum release age|minimumReleaseAge|untrusted origin/i.test(message)) return 'pnpmPolicy'
   // profile 残留旧版本 patch 声明，pnpm 中止安装。必须在兜底之前
   if (/ERR_PNPM_UNUSED_PATCH|patches were not used/i.test(message)) return 'pnpmUnusedPatch'
+  // profile 的 pnpm 元数据与本机不一致（lockfile 过期 / 找不到可安装的 manifest / packageManager
+  // 版本不符 / 补丁未生效 / workspace 依赖缺失）：都是 profile 自身状态，这个 profile 里装任何
+  // 插件都会同样失败。必须在 pluginPrepare 之前 —— 这类错误常被 pnpm 包一层 Command failed
+  if (/ERR_PNPM_OUTDATED_LOCKFILE|ERR_PNPM_NO_IMPORTER_MANIFEST_FOUND|ERR_PNPM_NO_PKG_MANIFEST|ERR_PNPM_BAD_PM_VERSION|ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY|ERR_PNPM_PATCH_NOT_APPLIED|ERR_PNPM_WORKSPACE_PKG_NOT_FOUND|ERR_PNPM_JSON_PARSE|ERR_PNPM_PKG_MANIFEST_IS_NOT_OBJECT|ERR_PNPM_MISSING_HOIST_PATTERN|Cannot install with "frozen-lockfile"/i.test(message)) return 'profileState'
   // profile 文件被其他进程占用（os error 32 / EBUSY）。ASCII 特征免疫乱码
   if (/os error 32|EBUSY|resource busy or locked|being used by another process/i.test(message)) return 'fileLocked'
   // 系统拒绝写 profile（os error 5 / EPERM / EACCES）。ASCII 特征免疫乱码
@@ -256,9 +270,15 @@ export function classifyFailure(message: string): FailureKind {
   // npm 源拒绝了访问（401/403）：私有源要登录凭据，或当前网络/IP 不被源允许。
   // 必须在 network 之前判：pnpm 的 401/403 日志也常带 "fetch failed" 字样，先判网络会误报成「网络不通」
   if (/ERR_PNPM_FETCH_40[13]\b|\bE40[13]\b|(?:Unauthorized|Forbidden)\s*-\s*40[13]\b/i.test(message)) return 'registryAuth'
+  // profile 里指向已删除目录的本地依赖（file:/link:）：pnpm 直接 ENOENT（lstat），任何安装都会失败。
+  // 必须在 network 之前判 —— 同一份日志常混着 pnpm 重试产生的 UND_ERR_* 警告，先判网络会把根因盖掉。
+  if (/ERR_PNPM_LINKED_PKG_DIR_NOT_FOUND|Could not install from .+ as it does not exist|pnpm:\s*ENOENT: no such file or directory,\s*(?:lstat|scandir|readlink)/i.test(message)) return 'pnpmLinkedDirMissing'
+  // TLS 证书信任失败（公司 SSL 审计 / 杀软网页防护 / 本机代理替换证书）：属于本机证书链问题，
+  // 必须在 network 之前 —— 否则会被当成「网络不通」，给出的排查方向完全不对。
+  if (/unable to verify the first certificate|SELF_SIGNED_CERT_IN_CHAIN|UNABLE_TO_VERIFY_LEAF_SIGNATURE|ERR_TLS_CERT_ALTNAME_INVALID|CERT_HAS_EXPIRED|certificate has expired|UNABLE_TO_GET_ISSUER_CERT|CERT_UNTRUSTED|ERR_TLS_CERT/i.test(message)) return 'tlsTrust'
   // 网络/代理/源配置问题。必须在 prepare 之前判：git fetch 失败常被外层包成 "Command failed"
   // tarball 下载失败的括号里可能是数字码（pnpm 自己的）或符号码（undici 的 UND_ERR_*），两种都要认
-  if (/\[network\]|ERR_PNPM_GIT_FETCH_FAILED|ETIMEDOUT|ECONNREFUSED|ECONNRESET|ENOTFOUND|EAI_AGAIN|EPIPE|EHOSTUNREACH|ENETUNREACH|UND_ERR_[A-Z0-9_]+|getaddrinfo|Could not connect|Could not resolve host|Network unreachable|Failed to connect|socket hang up|CERT_HAS_EXPIRED|SSL certificate problem|\bTLS\b|\bSSL\b|fetch failed|failed to fetch|\bGET https?:\/\/\S+\.tgz\s+error \([A-Za-z0-9_]+\)/i.test(message)) return 'network'
+  if (/\[network\]|ERR_PNPM_GIT_FETCH_FAILED|ERR_PNPM_FETCH_5\d\d|ERR_PNPM_META_FETCH_FAIL|ERR_SOCKET_TIMEOUT|ETIMEDOUT|ECONNREFUSED|ECONNRESET|ENOTFOUND|EAI_AGAIN|EPIPE|EHOSTUNREACH|ENETUNREACH|UND_ERR_[A-Z0-9_]+|getaddrinfo|Could not connect|Could not resolve host|Network unreachable|Failed to connect|socket hang up|CERT_HAS_EXPIRED|SSL certificate problem|SSL routines|TLS handshake|SSL handshake|ERR_SSL_|ssl_error|fetch failed|failed to fetch|\bGET https?:\/\/\S+\.tgz\s+error \([A-Za-z0-9_]+\)/i.test(message)) return 'network'
   // 浏览器端请求超时（客户端 fetch 被 abort）：请求没到宿主，属于连不上网络，与插件无关
   if (/\[request-timeout\]/i.test(message)) return 'network'
   // 装后校验发现入口文件缺失（[packaging]）= 分发物缺构建产物
@@ -269,8 +289,6 @@ export function classifyFailure(message: string): FailureKind {
   if (/ERR_PNPM_FETCH_404|404 Not Found|Not Found - 404/i.test(message)) return 'pnpmMissingDep'
   // 要装的版本在实际安装源里没有（镜像滞后或版本写错）。必须在 pluginPrepare 之前判
   if (/\bERR_PNPM_NO_MATCHING_VERSION\b|\bETARGET\b|No matching version found/i.test(message)) return 'registryVersionStale'
-  // profile 残留指向不存在目录的本地依赖（link:/file:）。必须在 pluginPrepare 之前判
-  if (/\bERR_PNPM_LINKED_PKG_DIR_NOT_FOUND\b|Could not install from .+ as it does not exist/i.test(message)) return 'pnpmLinkedDirMissing'
   // 原生模块需要本机编译，缺编译器/构建工具属于用户环境，不是插件的 prepare 失败。
   // 必须排在 pluginPrepare 之前：这类日志同样带 ELIFECYCLE，否则会被推给作者。
   if (/Unable to detect compiler type|gyp ERR!|Could not find any Visual Studio|No Xcode or CLT version detected|xcode-select|python(?:3)? is (?:not set|not found)|Could not find Python|\bmake: not found\b|\bgcc: not found\b|\bg\+\+: not found\b|\bMSB\d{4}\b/i.test(message)) return 'buildToolchainMissing'
@@ -293,13 +311,33 @@ export function classifyFailure(message: string): FailureKind {
   if (/atomic-write: timed out waiting for the writer lock|timed out waiting for the writer lock/i.test(message)) return 'profileLock'
   // 宿主自己的 allowBuilds 摘要行（pnpm 原文只写进 diagnostics 日志文件，终端只剩这一句）
   if (/git-hosted plugins build on install via their prepare script|add the exact key pnpm printed above under allowBuilds/i.test(message)) return 'pnpmIgnoredBuild'
+  // 宿主启动插件管理时找不到某个 profile bundle（`cannot resolve profile bundle "<pkg>"`）：
+  // 该 profile 声明的依赖没装全（node_modules 被删过 / 上次安装中断 / 桌面端更新不完整），
+  // 与本次要装的插件无关 —— 必须在 hub 兜底之前，否则又会被当成未知错误丢给我们
+  if (/cannot resolve profile bundle/i.test(message)) return 'profileBundleMissing'
   // 宿主自身入口起不来（服务端 [host-spawn] 标记）：环境问题，给提示、不引导提 Issue。
   // 不匹配 `spawn … ENOENT` 文本 —— 那个形态任何 spawn（curl/git/taskkill…）都会产出
   if (/\[host-spawn\]/i.test(message)) return 'hostCliSpawn'
-  // 其余未知失败：引导到插件中心仓库排查
+  // 安装器读插件 npm 元数据得出的客观结论：插件声明的 DSH 下限高于本机宿主。
+  // 放在所有具体成因之后 —— 日志里有真实报错时仍以真实报错为准；但在「未分类」之前，
+  // 否则这类本来能说清的失败又会变成未知。
+  if (/\[dsh-too-old\]/i.test(message)) return 'dshTooOld'
+  // 裸 `spawn <cmd> ENOENT`（无 [host-spawn] 标记）：分不清是用户机器上缺这个可执行文件，
+  // 还是安装器解析错了路径 —— 不冒充环境问题，留给插件中心分诊
+  if (/spawn .+ ENOENT/i.test(message)) return 'hub'
+  // 未命中任何具体成因，但特征指向本机环境（系统调用错误码 / 证书代理 / 本地配置损坏）：
+  // 归「本机环境」给自助排查，而不是丢进未分类让用户等着我们分析 —— 装任何插件都会同样失败，
+  // 且这类误判代价低（用户自查重试即可）。位置必须在所有具体分支之后：能精确归因的优先精确。
+  if (LOCAL_ENV_RE.test(message)) return 'localEnv'
+  // 其余未知失败：没有任何环境/插件侧特征，可能是安装器或宿主的 bug —— 引导到插件中心仓库排查
   return 'hub'
 }
 
+/** 「特征指向本机环境但说不清具体哪一类」的兜底判据：系统调用错误码（权限/路径过长/设备异常）、
+ *  证书与代理校验失败、本地配置文件（~/.npmrc、profile 的 package.json）损坏。
+ *  只做排除用：命中它表示「不是插件侧问题」，不代表我们已经定位到原因。 */
+const LOCAL_ENV_RE = /os error \d{1,3}\b|ERROR_[A-Z_]{4,}|\bE(?:ACCES|PERM|NOENT|NAMETOOLONG|INVAL|PROTO|ISDIR|NOTDIR|EXIST|BADF|NOTEMPTY|JSONPARSE|NOMEM)\b|JavaScript heap out of memory|Unexpected token .{0,60}in JSON|SELF_SIGNED_CERT_IN_CHAIN|UNABLE_TO_VERIFY_LEAF_SIGNATURE|ERR_TLS_CERT_ALTNAME_INVALID|unable to verify the first certificate|self[- ]signed certificate|ERR_INVALID_URL|invalid registry|proxy authentication|407 Proxy/i
+
 /** 从服务端 `[npm-too-low]` 标记行提取本机 npm 版本（如 `[npm-too-low] npm@11.3.0` → "11.3.0"）；
  *  历史记录无标记时返回 null，前端据此决定提示文案是否带具体版本。 */
 export function npmTooLowVersion(message: string): string | null {
@@ -315,6 +353,10 @@ const CORE_LINE_RE = /ERR_[A-Z_]+|ELIFECYCLE|Command failed|prepare-guard|Failed
  *  无关 —— 抓核心错误时必须跳过，否则会被 CORE_LINE_RE 的 `missing` 分支误抓、淹没真正的
  *  错误码（如 git 源的 ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED），让 issue 正文只剩一堆 peer WARN。 */
 const PEER_WARN_RE = /missing peer|issues with peer dependencies|peer dependencies that should be installed/i
+/** 安装器自己打的诊断标记行：它们本身就是「为什么没有日志 / 卡在哪一步」的证据，
+ *  不含 CORE_LINE_RE 的关键词，必须无条件保留 —— 否则上报正文会退回成只剩宿主那句摘要，
+ *  我们又拿不到任何可排查的信息（#382/#393 就是这样）。 */
+const MARKER_LINE_RE = /^\[(?:pnpm log|no-output|desktop-cli-fallback|dsh-too-old|host-spawn|npm-too-low|git-missing|npm-missing|pnpm-missing|dsh-missing|network|packaging|registry-missing|registry-mirror-lag|registry-fallback|allow build|stale pipe|install-channel|internal|exit\b|timed out)/i
 /** 提交 issue 时正文里错误摘要的上限字符数。GitHub 请求行上限 8192 字节，
  * 固定模板与 URL 编码开销约 1~2K，核心错误（以 ASCII 日志为主）可安全带到 ~5K；
  * 仍超长时 pluginIssueUrl 会逐档缩小核心预算，最终 URL 不会超限。 */
@@ -347,7 +389,8 @@ export function summarizeError(message: string, maxChars: number = MAX_CORE_CHAR
   const core: string[] = []
   for (const raw of message.split(/\r?\n/)) {
     const line = raw.trim()
-    if (!line || PEER_WARN_RE.test(line) || !CORE_LINE_RE.test(line)) continue
+    if (!line || PEER_WARN_RE.test(line)) continue
+    if (!MARKER_LINE_RE.test(line) && !CORE_LINE_RE.test(line)) continue
     const short = line.length > MAX_LINE_CHARS ? `${line.slice(0, MAX_LINE_CHARS)}…` : line
     if (!seen.has(short)) {
       seen.add(short)
@@ -438,6 +481,54 @@ export function registryHostOf(message: string): string | null {
   return PUBLIC_REGISTRY_HOSTS.has(host) ? null : host
 }
 
+/**
+ * 「本地依赖目录不存在」失败里缺失的路径：
+ * `pnpm: ENOENT: no such file or directory, lstat '<path>'`
+ * 或 `Could not install from "<path>" as it does not exist`。取不到返回 null。
+ */
+export function missingLocalDirOf(message: string): string | null {
+  const lstat = /ENOENT: no such file or directory,\s*(?:lstat|scandir|readlink)\s+'([^']+)'/i.exec(message)
+  if (lstat !== null) return lstat[1]
+  const quoted = /Could not install from\s+"([^"]+)"\s+as it does not exist/i.exec(message)
+    ?? /Could not install from\s+'([^']+)'\s+as it does not exist/i.exec(message)
+  return quoted === null ? null : quoted[1]
+}
+
+/**
+ * 「profile 由桌面应用独占」错误里的 profile 名：
+ * `error: profile "desktop" is managed exclusively by the Electron application`。
+ * 取不到返回 null（提示文案退回通用说法）。
+ */
+export function exclusiveProfileOf(message: string): string | null {
+  const m = /profile\s+"?([A-Za-z0-9_-]+)"?\s+is managed exclusively/i.exec(message)
+  return m === null ? null : m[1]
+}
+
+/**
+ * 日志里有安装器的 `[desktop-cli-fallback]` 标记：没找到桌面应用内置的 CLI 引导脚本，
+ * 退回 PATH 上的 dsh 才被「profile 独占」拒绝 —— 是我们的路径推导问题，不是用户环境问题。
+ */
+export function desktopCliFallbackOf(message: string): boolean {
+  return /\[desktop-cli-fallback\]/i.test(message)
+}
+
+/** `[dsh-too-old]` 标记里的三方信息（包名 / 插件要求的 DSH 下限 / 当前宿主版本）；取不到返回 null。 */
+export function dshTooOldInfoOf(message: string): { pkg: string; floor: string; current: string } | null {
+  const m = /\[dsh-too-old\]\s*(\S+)\s+requires DSH >= (\S+).*?runs (\S+)/i.exec(message)
+  return m === null ? null : { pkg: m[1]!, floor: m[2]!, current: m[3]! }
+}
+
+/**
+ * `cannot resolve profile bundle "<pkg>" from the dsh installation or <profileDir>` 里的
+ * 缺失包名与 profile 目录；只取到包名也算成功（profile 目录可能被换行截断）。
+ */
+export function unresolvedBundleOf(message: string): { pkg: string; profileDir: string } | null {
+  const m = /cannot resolve profile bundle\s+"([^"]+)"\s+from the dsh installation or\s+(.+?)\s*(?:;|$)/im.exec(message)
+  if (m !== null) return { pkg: m[1]!, profileDir: m[2]!.trim() }
+  const only = /cannot resolve profile bundle\s+"([^"]+)"/i.exec(message)
+  return only === null ? null : { pkg: only[1]!, profileDir: '' }
+}
+
 /**
  * 鉴权失败（401/403）时被拒绝的源主机名：从 `ERR_PNPM_FETCH_401 GET https://host/pkg: Unauthorized - 401`
  * 里取，取不到返回 null（提示文案退回通用说法，不拼出残缺句子）。

package/src/client/logic/installed.ts

@@ -12,6 +12,7 @@
 import type { HubPlugin } from '../types.ts'
 import { HUB_REPO } from './constants.ts'
 import { repoFromInstallTarget } from './install-command.ts'
+import { compareVersions } from './release-age.ts'
 
 /** 安装时记录的目录信号（versions 表项）。 */
 export interface InstalledVersionSignal {
@@ -104,6 +105,8 @@ export function npmPackageOf(plugin: HubPlugin, versions: Record<string, Install
  * 是否有更新：仅对已安装插件有意义。
  * 双信号判定——有 release 版本的比版本；无版本（repo 不打 tag）的比仓库最近更新时间
  * （repoUpdatedAt，ISO 字符串字典序 = 时间序），更新时间变新说明有新提交。
+ * 版本用「目录 > 已装」判断，不做 != 比较：目录可能滞后于 npm，若直接用不等，
+ * 会把「已装 1.1.10、目录还写 1.1.8」判成有更新，反而引导用户降级。
  */
 export function hasUpdateOf(
   plugin: HubPlugin,
@@ -115,7 +118,7 @@ export function hasUpdateOf(
   if (!repo) return false
   const rec = versions[repo.toLowerCase()]
   if (!rec) return false
-  if (plugin.version) return plugin.version !== rec.version
+  if (plugin.version) return compareVersions(plugin.version, rec.version) > 0
   const current = plugin.dates?.repoUpdatedAt
   return Boolean(current && rec.updatedAt && current > rec.updatedAt)
 }

package/src/client/logic/release-age.ts

@@ -19,19 +19,67 @@ export function isReleaseTooFresh(publishedAt: string | null | undefined, now: n
   return now - ms < MIN_RELEASE_AGE_MS
 }
 
-/** 版本号比较（逐段数字；缺失段按 0）。返回负数/0/正数，非法输入按相等处理。 */
+/** 版本号比较（逐段数字；缺失段按 0）。返回负数/0/正数，非法输入按相等处理。
+ *  兼容目录里的 `v1.1.8` 与 npm 的 `1.1.8`：每段先剥掉前导非数字，再取整。
+ *  预发布后缀单独处理：`1.0.0` 高于 `1.0.0-beta.1`，两个预发布版按标识符比较
+ *  （纯数字段按数值，数字段低于字母段）。 */
 export function compareVersions(a: string, b: string): number {
-  const parse = (v: string): number[] => v.split(/[.+-]/).map((part) => Number.parseInt(part, 10)).filter((n) => !Number.isNaN(n))
-  const va = parse(a)
-  const vb = parse(b)
+  const core = (v: string): number[] =>
+    (v.split('+')[0] ?? '').split('-')[0]!
+      .split('.')
+      .map((part) => Number.parseInt(part.replace(/^[^\d]+/, ''), 10))
+      .filter((n) => !Number.isNaN(n))
+  const pre = (v: string): string[] => {
+    const rest = (v.split('+')[0] ?? '').split('-').slice(1)
+    return rest.length === 0 ? [] : rest.join('-').split('.')
+  }
+  const va = core(a)
+  const vb = core(b)
   const len = Math.max(va.length, vb.length)
   for (let i = 0; i < len; i++) {
     const d = (va[i] ?? 0) - (vb[i] ?? 0)
     if (d !== 0) return d
   }
+  const pa = pre(a)
+  const pb = pre(b)
+  if (pa.length === 0 && pb.length === 0) return 0
+  if (pa.length === 0) return 1
+  if (pb.length === 0) return -1
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const x = pa[i]
+    const y = pb[i]
+    if (x === undefined) return -1
+    if (y === undefined) return 1
+    const nx = /^\d+$/.test(x) ? Number(x) : null
+    const ny = /^\d+$/.test(y) ? Number(y) : null
+    if (nx !== null && ny !== null) {
+      if (nx !== ny) return nx - ny
+    } else if (x !== y) {
+      return x < y ? -1 : 1
+    }
+  }
   return 0
 }
 
+/**
+ * 是否值得提示「可更新」：npm 上最新可安装版本确实比已装版本新，且已过供应链门禁。
+ *
+ * 更新命令执行的是 `pkg@latest`，所以「目录里标的版本」不是最终能装上的版本：
+ * 作者可能只打了 GitHub release 没发 npm —— 此时提示会变成永远点不掉的循环。
+ * 任一信息缺失（查不到发布信息 / 没有已装版本记录）返回 true，交回调用方原有判定：
+ * 宁可提示，也不因为一次查询失败把真实更新吃掉。
+ */
+export function isUpdateOffered(
+  release: { version: string; publishedAt: string } | null,
+  installedVersion: string | null,
+  now: number,
+): boolean {
+  if (release === null) return true
+  if (isReleaseTooFresh(release.publishedAt, now)) return false
+  if (installedVersion !== null && compareVersions(release.version, installedVersion) <= 0) return false
+  return true
+}
+
 /**
  * 选出本次真正该提示的更新版本。
  *

package/src/client/logic/urls.ts

@@ -46,9 +46,12 @@ function reasonTitleOf(kind: FailureKind, action: FailureAction): string {
   const word = actionWordEn(action)
   switch (kind) {
     case 'npmTooOld': return `npm too old for this ${word}`
+    case 'nodeEngine': return `Node / pnpm on the user machine is below the version this ${word} requires`
+    case 'profileState': return `the user profile's pnpm metadata does not match the local pnpm for this ${word}`
     case 'dshMissing': return 'dsh command not found on the user machine'
     case 'pnpmMissing': return 'pnpm command not found on the user machine'
     case 'pnpmStore': return 'pnpm store version mismatch on the user machine'
+    case 'pnpmModulesMismatch': return 'the profile modules directory was built with a different pnpm config on the user machine'
     case 'pnpmWorkspace': return `pnpm workspace-root check blocked the ${word} on the user machine`
     case 'originRejected': return 'request origin rejected by the local service on the user machine'
     case 'pnpmPolicy': return `pnpm supply-chain policy blocked the ${word} on the user machine`
@@ -56,6 +59,7 @@ function reasonTitleOf(kind: FailureKind, action: FailureAction): string {
     case 'pnpmMissingDep': return 'dependency not found on the npm registry on the user machine'
     case 'registryVersionStale': return `requested version not available on the npm registry in use on the user machine`
     case 'registryAuth': return `npm registry rejected the credentials for this ${word} on the user machine`
+    case 'profileExclusive': return `the desktop profile is managed only by the Electron app, so the CLI refused the ${word}`
     case 'pnpmLinkedDirMissing': return 'dangling local (link:) dependency in the user profile'
     case 'fileLocked': return 'file locked by another process on the user machine'
     case 'accessDenied': return 'file write access denied on the user machine'
@@ -64,11 +68,15 @@ function reasonTitleOf(kind: FailureKind, action: FailureAction): string {
     case 'pluginPrepare': return 'plugin distribution incomplete'
     case 'hostIncompatible': return 'plugin does not support the DSH version in use'
     case 'network': return 'network failure on the user side'
+    case 'tlsTrust': return `TLS certificate verification failed on the user machine during the ${word}`
     case 'hostCliSpawn': return 'the DSH host could not be launched on the user machine'
     case 'hubState': return `stale ${word} state in the plugin hub`
+    case 'profileBundleMissing': return 'the DSH profile is missing a bundle it declares'
     case 'timeout': return `${word} timed out`
     case 'profileLock': return 'DSH profile is locked by another process'
     case 'pluginMissingDep': return 'a dependency of the plugin is not published on npm'
+    case 'dshTooOld': return 'the plugin requires a newer DSH than the host runs'
+    case 'localEnv': return `no plugin-side cause found — the failure points at the local environment for this ${word}`
     case 'hub': return `${word} failed (cause unclassified)`
     default: return `plugin ${word} failed`
   }
@@ -102,8 +110,20 @@ export function pluginIssueUrl(repo: string, message: string, env?: EnvInfo | nu
         ? 'a dependency declared by the plugin is not published on the public npm registry (missing, removed, or never released); please publish or correct that dependency, or ship it with the plugin'
       : kind === 'network'
         ? 'network connectivity issue on the user side (DNS, proxy, firewall, or a blocked connection)'
+      : kind === 'tlsTrust'
+        ? 'the local certificate chain is not trusted by Node/pnpm (corporate SSL inspection, antivirus web shield, or a local MITM proxy) — local environment issue'
+      : kind === 'localEnv'
+        ? 'no evidence of a plugin-side cause; the log shows local-environment signals (system error codes, certificates/proxy, or a broken local config), so this is reported for triage of the classifier only'
+      : kind === 'dshTooOld'
+        ? 'the plugin declares a minimum DSH version this host does not meet — upgrade DSH first (local environment issue)'
+      : kind === 'pnpmModulesMismatch'
+        ? 'the profile node_modules was created with a different pnpm config (hoisting / virtual store settings), so pnpm refuses to reuse it (local environment issue)'
+      : kind === 'profileBundleMissing'
+        ? 'the profile declares a bundle that is not installed in it (interrupted install or incomplete app update), so the host aborts before installing anything (local environment issue)'
       : kind === 'registryAuth'
         ? 'the npm registry rejected the request with 401/403 — the configured registry needs credentials or blocks this network (local environment issue)'
+      : kind === 'profileExclusive'
+        ? 'the desktop profile can only be managed by the Electron app, and the install was attempted from an external CLI (local environment issue)'
         : kind === 'pluginPrepare'
           ? 'plugin prepare/build script failed during install (packaging/distribution issue)'
           : kind === 'pnpmIgnoredBuild'
@@ -166,8 +186,8 @@ export function pluginIssueUrl(repo: string, message: string, env?: EnvInfo | nu
           `- OS: ${env.platform} ${env.arch} (${env.release})`,
           `- Profile: \`${env.profile}\``,
           `- DSH Home: \`${env.dshHome}\``,
-          // 完整安装日志所在（正文受 URL 长度限制只能带摘要，完整日志在 hub.log，可复制/附加给作者）
-          `- Full log: \`~/.dsh/profiles/${env.profile}/hub.log\` (paste or attach for the full output)`,
+          // 完整安装日志在通知中心（hub.log 只有任务开始/结束，没有 pnpm 输出，别让用户白附）
+          '- Full log: open the Hub notifications, select the failed record and press "Copy"',
         ]
         : []),
       // 该插件在插件市场的收录位置（详情页链接）
@@ -268,7 +288,7 @@ export function hubIssueUrl(
           `- OS: ${env.platform} ${env.arch} (${env.release})`,
           `- Profile: \`${env.profile}\``,
           `- DSH Home: \`${env.dshHome}\``,
-          `- Full log: \`~/.dsh/profiles/${env.profile}/hub.log\` (paste or attach for the full output)`,
+          '- Full log: open the Hub notifications, select the failed record and press "Copy"',
         ]
         : []),
       ...(repo !== 'unknown' ? [`- Catalog: [${pluginSiteUrl(repo)}](${pluginSiteUrl(repo)})`] : []),