dsh-plugin 2.3.5 → 2.3.7

package/lib/http/diagnostics.js

@@ -10,6 +10,7 @@ import { join } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { loadSettings } from '../services/settings.js';
 import { hostDshVersion, toolVersion } from '../services/host-version.js';
+import { normalizeRegistry } from '../services/install/registry-fallback.js';
 import { gitLsRemote, probeUrl, systemProxy } from '../services/probe.js';
 import { appendLog } from '../services/log.js';
 import { readJsonBody, requireTrustedPost, sendJson } from './shared.js';
@@ -39,12 +40,16 @@ function configuredNpmRegistry(profile) {
 }
 /** 宿主环境快照：提交 bug 时随 issue 附上，便于作者复现（前端 /env 端点返回）。 */
 export function hostEnv(profile) {
+    const settings = loadSettings(profile);
     return {
         dshVersion: hostDshVersion(),
         nodeVersion: process.version,
         pnpmVersion: toolVersion('pnpm', ['--version']),
         npmVersion: toolVersion('npm', ['--version']),
         gitVersion: toolVersion('git', ['--version']),
+        // 安装实际会用的 npm 源（设置里的镜像 → 本机 npm 配置 → 官方）：装不上时第一嫌疑就是它，
+        // 上报正文带上它，作者不必再猜「用户到底连的哪个源」（#6118 就卡在这里）
+        npmRegistry: normalizeRegistry(settings.npmRegistry) || configuredNpmRegistry(profile),
         platform: process.platform,
         arch: process.arch,
         release: release(),

package/lib/http/install.js

@@ -133,7 +133,7 @@ export function registerInstallRoutes(webServer, profile, loader) {
                     // 命中则记录 repo → 包名映射，客户端据此把依赖 key 匹配回仓库、列表立即显示「已安装」。
                     const catalogRepo = source === 'catalog' ? githubRepoOf(displayRepo) : null;
                     if (catalogRepo !== null) {
-                        const catalogTargetIsDsh = await isDshNpmPackageForRepo(rawRepo, catalogRepo, settings.npmRegistry, effectiveProxy);
+                        const catalogTargetIsDsh = await isDshNpmPackageForRepo(rawRepo, catalogRepo, settings.npmRegistry, effectiveProxy, pinVersion);
                         if (catalogTargetIsDsh)
                             recordResolvedNpmPackage(profile, catalogRepo, rawRepo);
                     }

package/lib/services/install/npm-resolve.js

@@ -25,6 +25,12 @@ function repositoryUrlOf(pkg) {
     }
     return String(pkg.links?.repository ?? '');
 }
+/** registry 路径：指定版本时取该版本的 manifest，否则取 latest。 */
+export function npmMetadataPath(packageName, version = '') {
+    const normalized = version.trim().replace(/^v/i, '');
+    const encoded = encodeURIComponent(packageName);
+    return normalized === '' ? `${encoded}/latest` : `${encoded}/${encodeURIComponent(normalized)}`;
+}
 export function isDshPackageMetadataForRepo(pkg, repo) {
     if (githubRepoOf(repositoryUrlOf(pkg))?.toLowerCase() !== repo.toLowerCase())
         return false;
@@ -34,14 +40,14 @@ export function isDshPackageMetadataForRepo(pkg, repo) {
     return keywordMarked || manifestMarked;
 }
 /**
- * 校验包名对应的 npm 包确实属于该仓库且声明为 DSH 插件：取 registry 上的 `latest`
- * 元数据比对 repository 与插件标记。网络异常、超时、非 200 一律返回 false，不阻塞调用方。
+ * 校验包名对应的 npm 包确实属于该仓库且声明为 DSH 插件：取 registry 上指定版本（缺省 `latest`）
+ * 的元数据比对 repository 与插件标记。网络异常、超时、非 200 一律返回 false，不阻塞调用方。
  */
-export function isDshNpmPackageForRepo(packageName, repo, registry = '', proxy = '') {
+export function isDshNpmPackageForRepo(packageName, repo, registry = '', proxy = '', version = '') {
     if (packageName === '' || repo === '')
         return Promise.resolve(false);
     const base = registry === '' ? 'https://registry.npmjs.org' : registry.replace(/\/+$/, '');
-    const url = `${base}/${encodeURIComponent(packageName)}/latest`;
+    const url = `${base}/${npmMetadataPath(packageName, version)}`;
     return new Promise((resolve) => {
         const req = get(url, { timeout: REQUEST_TIMEOUT_MS }, (res) => {
             if (res.statusCode !== 200) {

package/lib/services/install/operation-log.js

@@ -87,6 +87,11 @@ export function backfillOperationLog(output, profileDir) {
         return null;
     }
 }
+/** 本队列自己打的标记行（退出、渠道、超时、回捞…）：不含任何可排查信息。 */
+const SELF_MARKER_RE = /^\[(?:exit\b|timed out\]|install-channel\]|stale pipe\]|error\]|pnpm log\]|registry-fallback\]|allow build\])/;
+/** 外层包装行：`Command failed with exit code 1: pnpm add x` 只说明「子进程非零退出」，不含 pnpm 原因。
+ *  宿主摘要（`dsh: plugin command failed; diagnostics: <path>`）另算：带路径的那行是回捞证据，不是噪音。 */
+const WRAPPER_LINE_RE = /^Command failed with exit code \d+/i;
 /**
  * 输出里是否有 dsh 自己的内容 —— 只有 `[exit N]`、`[install-channel]`、`[timed out]`
  * 这类本队列自己打的标记时返回 false。用于把「宿主什么都没回显」的失败显式留痕，
@@ -95,7 +100,19 @@ export function backfillOperationLog(output, profileDir) {
 export function hasSubstantiveOutput(output) {
     return output.split(/\r?\n/).some((raw) => {
         const line = raw.trim();
-        return line !== '' && !/^\[(?:exit\b|timed out\]|install-channel\]|stale pipe\]|error\]|pnpm log\]|registry-fallback\]|allow build\])/.test(line);
+        return line !== '' && !SELF_MARKER_RE.test(line);
+    });
+}
+/**
+ * 失败输出里除包装噪声外没有任何可排查内容：只剩本队列标记，和
+ * `Command failed with exit code N: pnpm add …` 这类外层包装（#6118 的形态 ——
+ * pnpm 以 1 退出、operation 日志里只有这一行）。此时上报正文只会写出「安装失败」，
+ * 作者与维护者都无从判断，调用方据此补一条带启动参数的诊断标记。
+ */
+export function lacksDiagnosticContent(output) {
+    return output.split(/\r?\n/).every((raw) => {
+        const line = raw.trim();
+        return line === '' || SELF_MARKER_RE.test(line) || WRAPPER_LINE_RE.test(line);
     });
 }
 /**

package/lib/services/install/task-queue.js

@@ -14,7 +14,7 @@ import { dirname, join, resolve } from 'node:path';
 import { CAPTURE_LIMIT_BYTES, MAX_TASKS, MAX_TASK_LINES } from './install-types.js';
 import { npmTooLowMarker } from './npm-check.js';
 import { registryMissingMarker } from './registry-check.js';
-import { backfillOperationLog, createOperationLogTap, hasSubstantiveOutput, operationLogPathOf } from './operation-log.js';
+import { backfillOperationLog, createOperationLogTap, lacksDiagnosticContent, operationLogPathOf } from './operation-log.js';
 import { cleanLine, estimateProgress } from '../profile/progress.js';
 import { hasClientUi, isDshPlugin, mountLoadedEntry, removeLoadedEntry } from '../loader.js';
 import { addPendingRestart, clearPendingRestart } from '../profile/pending-restart.js';
@@ -479,6 +479,7 @@ function spawnMutation(options) {
                 error: marker === null ? detail : `${detail}\n${marker}`,
                 stdout,
                 stderr,
+                spawn: { file: invocation.file, args: attemptArgs, cwd: invocation.cwd, shell: invocation.useShell },
             });
             return;
         }
@@ -504,7 +505,8 @@ function spawnMutation(options) {
                 clearTimeout(forceSettle);
             if (task)
                 runningChildren.delete(task.id);
-            resolveOnce(result);
+            // 附带本次实际启动参数：输出为空时，上报里至少能说明「跑了什么、在哪个目录」
+            resolveOnce({ ...result, spawn: { file: invocation.file, args: attemptArgs, cwd: invocation.cwd, shell: invocation.useShell } });
         };
         timer = setTimeout(() => {
             timedOut = true;
@@ -850,6 +852,24 @@ export function hostSpawnMarker(invocation, error) {
         return null;
     return `[host-spawn] the DSH host could not be launched (${invocation.file}: ENOENT)`;
 }
+/**
+ * 失败输出只剩外层包装时的诊断标记（导出供单测覆盖字段）。内容先后即上报正文里的优先级：
+ * 退出方式 → 实际生效的 registry → 实际 spawn 的命令与目录 → profile 位置。
+ * registry 用主机名展示，避免把带凭据的私有源地址写进公开 Issue。
+ */
+export function sparseFailureMarker(result, options) {
+    const verb = options.action === 'remove' ? 'uninstall' : options.action === 'update' ? 'update' : 'install';
+    const outcome = result.timedOut ? 'timed out' : `exited with code ${result.exitCode ?? '?'}`;
+    const registry = result.registry ?? options.registries?.[0] ?? 'unknown';
+    const spawn = result.spawn;
+    return [
+        `[no-output] the ${verb} command ${outcome} and printed nothing but its wrapper line`,
+        `registry: ${registryHost(registry)}`,
+        spawn === undefined ? '' : `spawn: ${spawn.file} ${spawn.args.join(' ')} (cwd ${spawn.cwd}, shell ${spawn.shell})`,
+        `profile: ${profileDirectory(options.profile)}`,
+        'no pnpm log under .plugin-manager/logs — attach hub.log when reporting',
+    ].filter((part) => part !== '').join(' | ');
+}
 /**
  * 执行插件变更，带一条恢复路径：当 `add` 因 pnpm 的 allowBuilds 限制拦下构建脚本而失败 ——
  * 或是 git 源包自己的 `prepare`（`ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED`，key 取自打印的
@@ -941,15 +961,17 @@ export async function runPluginMutation(options) {
                 // 诊断路径在、日志却取不到：留一行证据，否则下一次同类上报又只剩宿主那句摘要、看不出根因
                 pushLine(options.task, '[pnpm log] the host-reported diagnostics log could not be read from disk (missing, empty, or unreadable)');
             }
-            else if (!hasSubstantiveOutput(output)) {
-                // 宿主连 diagnostics 路径都没回显：显式留痕，避免上报正文只剩一个退出码
-                const what = result.timedOut
-                    ? 'printed nothing before the timeout'
-                    : `exited with code ${result.exitCode ?? '?'} without printing anything`;
-                pushLine(options.task, `[no-output] the dsh CLI ${what}, and no pnpm log was written under .plugin-manager/logs — attach ~/.dsh/profiles/${options.profile}/hub.log when reporting this`);
-            }
         }
     }
+    // 失败但输出里只剩外层包装（`Command failed with exit code 1: pnpm add …`）时，上报正文会退化成
+    // 一句「安装失败」：既看不出跑了什么，也看不出连的是哪个源（#6118 的形态）。补一条诊断标记，
+    // 把实际启动参数、profile 目录与生效的 registry 带进日志和上报正文。
+    if ((result.exitCode !== 0 || result.timedOut) && lacksDiagnosticContent(`${result.stderr}\n${result.stdout}`)) {
+        const line = sparseFailureMarker(result, options);
+        if (options.task && options.task.status !== 'cancelled')
+            pushLine(options.task, line);
+        result = { ...result, stderr: `${result.stderr}\n${line}` };
+    }
     // profile 里的 YAML 配置（pnpm-workspace.yaml / pnpm-lock.yaml）解析失败 → 追加 [profile-yaml]
     // 标记，前端给「修本机文件」的步骤，不引导向插件仓库提 Issue
     result = annotateProfileYaml(result, options);

package/lib/types/services/install/install-types.d.ts

@@ -14,6 +14,13 @@ export interface InstallResult {
     stderr: string;
     /** 实际执行安装用的 npm 源（换源重试后是最终那一个）：后续读元数据的注解要跟它同源 */
     registry?: string;
+    /** 最后一次 spawn 的实际启动参数：失败且无任何输出时，上报里要靠它说明「到底跑了什么、在哪个目录」 */
+    spawn?: {
+        file: string;
+        args: string[];
+        cwd: string;
+        shell: boolean;
+    };
 }
 export interface InstallTask {
     id: number;

package/lib/types/services/install/npm-resolve.d.ts

@@ -7,10 +7,12 @@ type NpmSearchPackage = {
     repository?: unknown;
     dsh?: unknown;
 };
+/** registry 路径：指定版本时取该版本的 manifest，否则取 latest。 */
+export declare function npmMetadataPath(packageName: string, version?: string): string;
 export declare function isDshPackageMetadataForRepo(pkg: NpmSearchPackage, repo: string): boolean;
 /**
- * 校验包名对应的 npm 包确实属于该仓库且声明为 DSH 插件：取 registry 上的 `latest`
- * 元数据比对 repository 与插件标记。网络异常、超时、非 200 一律返回 false，不阻塞调用方。
+ * 校验包名对应的 npm 包确实属于该仓库且声明为 DSH 插件：取 registry 上指定版本（缺省 `latest`）
+ * 的元数据比对 repository 与插件标记。网络异常、超时、非 200 一律返回 false，不阻塞调用方。
  */
-export declare function isDshNpmPackageForRepo(packageName: string, repo: string, registry?: string, proxy?: string): Promise<boolean>;
+export declare function isDshNpmPackageForRepo(packageName: string, repo: string, registry?: string, proxy?: string, version?: string): Promise<boolean>;
 export {};

package/lib/types/services/install/operation-log.d.ts

@@ -15,6 +15,13 @@ export declare function backfillOperationLog(output: string, profileDir?: string
  * 否则上报正文只剩退出码，无从排查。
  */
 export declare function hasSubstantiveOutput(output: string): boolean;
+/**
+ * 失败输出里除包装噪声外没有任何可排查内容：只剩本队列标记，和
+ * `Command failed with exit code N: pnpm add …` 这类外层包装（#6118 的形态 ——
+ * pnpm 以 1 退出、operation 日志里只有这一行）。此时上报正文只会写出「安装失败」，
+ * 作者与维护者都无从判断，调用方据此补一条带启动参数的诊断标记。
+ */
+export declare function lacksDiagnosticContent(output: string): boolean;
 /**
  * 运行期抓取：宿主的 operation 日志只在命令运行期间存在，结束后可能被清理，
  * 退出后再按路径读往往已经拿不到。这里在安装过程中轮询 profile 下最新的

package/lib/types/services/install/task-queue.d.ts

@@ -104,6 +104,16 @@ export declare function verifyInstalledEntry(profile: string, target: string): {
  * 导出供单测覆盖判据。
  */
 export declare function hostSpawnMarker(invocation: Invocation, error: unknown): string | null;
+/**
+ * 失败输出只剩外层包装时的诊断标记（导出供单测覆盖字段）。内容先后即上报正文里的优先级：
+ * 退出方式 → 实际生效的 registry → 实际 spawn 的命令与目录 → profile 位置。
+ * registry 用主机名展示，避免把带凭据的私有源地址写进公开 Issue。
+ */
+export declare function sparseFailureMarker(result: InstallResult, options: {
+    action: 'add' | 'remove' | 'update';
+    profile: string;
+    registries?: string[];
+}): string;
 /**
  * 执行插件变更，带一条恢复路径：当 `add` 因 pnpm 的 allowBuilds 限制拦下构建脚本而失败 ——
  * 或是 git 源包自己的 `prepare`（`ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED`，key 取自打印的

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin",
-  "version": "2.3.5",
+  "version": "2.3.7",
   "description": "A community plugin marketplace for DeepSeek Harness, built to the official plugin spec — browse, search and install 20000+ human-curated community plugins without leaving the app. · DeepSeek Harness 社区插件市场（遵循官方开发规范）：20000+ 人工精选社区插件，每日更新。",
   "type": "module",
   "main": "lib/index.js",

package/src/client/components/views/DiagnosticsView.tsx

@@ -21,6 +21,7 @@ function formatEnv(env: EnvInfo): string {
     `DSH ${env.dshVersion ?? 'unknown'}`,
     `Node ${env.nodeVersion}`,
     `${env.platform} ${env.arch} (${env.release})`,
+    env.npmRegistry ? `npm registry ${env.npmRegistry}` : '',
     `Profile ${env.profile}`,
     env.dshHome ? `Home ${env.dshHome}` : '',
   ].filter(Boolean).join('\n')

package/src/client/logic/failures.ts

@@ -313,9 +313,10 @@ export function classifyFailure(message: string): FailureKind {
   // 原生模块需要本机编译，缺编译器/构建工具属于用户环境，不是插件的 prepare 失败。
   // 必须排在 pluginPrepare 之前：这类日志同样带 ELIFECYCLE，否则会被推给作者。
   if (/Unable to detect compiler type|gyp ERR!|Could not find any Visual Studio|No Xcode or CLT version detected|xcode-select|python(?:3)? is (?:not set|not found)|Could not find Python|\bmake: not found\b|\bgcc: not found\b|\bg\+\+: not found\b|\bMSB\d{4}\b/i.test(message)) return 'buildToolchainMissing'
-  // 构建脚本真的跑挂了才算插件问题。Command failed 区分大小写：只匹配 pnpm 的包装，
-  // 不匹配宿主那句小写 dsh: plugin command failed
-  if (/ERR_PNPM_PREPARE_PACKAGE|ELIFECYCLE|prepare-guard/i.test(message) || /Command failed/.test(message)) return 'pluginPrepare'
+  // 构建脚本真的跑挂了才算插件问题。必须带正向证据：`Command failed` 只是外层进程包装，
+  // 单凭它不能说明 prepare 失败（Electron 内置 pnpm 崩溃时日志里往往只剩这一句，
+  // 会把无关作者当成分发缺陷）。无证据的包装层失败交给 hub 分诊。
+  if (/ERR_PNPM_PREPARE_PACKAGE|ELIFECYCLE|prepare-guard|prepare script failed|Failed to prepare/i.test(message)) return 'pluginPrepare'
   // 安装器自身产生的状态类消息（未安装 / 不在此处卸载 / 已在队列中 / 已安装）：这几句由本服务的
   // 守卫发出，不是 CLI 输出、也不是插件问题，而是插件中心的已安装列表与实读快照不同步。
   // 单独归类，让前端给「刷新后重试」这类可行动提示，而不是当作未知失败引导去提 Issue。

package/src/client/logic/urls.ts

@@ -188,6 +188,8 @@ export function pluginIssueUrl(repo: string, message: string, env?: EnvInfo | nu
           // 这类环境问题，作者一眼就能对号入座；探测不到如实写 unknown
           `- pnpm: ${env.pnpmVersion ? `v${env.pnpmVersion}` : 'unknown'}`,
           `- npm: ${env.npmVersion ? `v${env.npmVersion}` : 'unknown'}`,
+          // 安装实际使用的源：网络/私有镜像类失败的第一嫌疑，作者据此判断是否「源不对/源不通」
+          `- npm registry: ${env.npmRegistry ? `\`${env.npmRegistry}\`` : 'unknown'}`,
           `- git: ${env.gitVersion ? `v${env.gitVersion}` : 'unknown'}`,
           `- OS: ${env.platform} ${env.arch} (${env.release})`,
           `- Profile: \`${env.profile}\``,
@@ -290,6 +292,8 @@ export function hubIssueUrl(
           `- Node: ${env.nodeVersion}`,
           `- pnpm: ${env.pnpmVersion ? `v${env.pnpmVersion}` : 'unknown'}`,
           `- npm: ${env.npmVersion ? `v${env.npmVersion}` : 'unknown'}`,
+          // 安装实际使用的源：网络/私有镜像类失败的第一嫌疑，作者据此判断是否「源不对/源不通」
+          `- npm registry: ${env.npmRegistry ? `\`${env.npmRegistry}\`` : 'unknown'}`,
           `- git: ${env.gitVersion ? `v${env.gitVersion}` : 'unknown'}`,
           `- OS: ${env.platform} ${env.arch} (${env.release})`,
           `- Profile: \`${env.profile}\``,

package/src/client/types.ts

@@ -95,6 +95,8 @@ export interface EnvInfo {
   npmVersion: string | null
   /** 本机 git 版本（git --version 首行；缺失返回 null） */
   gitVersion: string | null
+  /** 安装实际会用的 npm 源（设置镜像 → 本机 npm 配置 → 官方）：失败上报要带上它 */
+  npmRegistry?: string | null
   platform: string
   arch: string
   release: string

package/src/server/http/diagnostics.ts

@@ -10,6 +10,7 @@ import { join } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { loadSettings } from '../services/settings.ts'
 import { hostDshVersion, toolVersion } from '../services/host-version.ts'
+import { normalizeRegistry } from '../services/install/registry-fallback.ts'
 import { gitLsRemote, probeUrl, systemProxy } from '../services/probe.ts'
 import { appendLog } from '../services/log.ts'
 import { readJsonBody, requireTrustedPost, sendJson, type WebRoute, type WebServerService } from './shared.ts'
@@ -39,12 +40,16 @@ function configuredNpmRegistry(profile: string): string {
 
 /** 宿主环境快照：提交 bug 时随 issue 附上，便于作者复现（前端 /env 端点返回）。 */
 export function hostEnv(profile: string): Record<string, string | null> {
+  const settings = loadSettings(profile)
   return {
     dshVersion: hostDshVersion(),
     nodeVersion: process.version,
     pnpmVersion: toolVersion('pnpm', ['--version']),
     npmVersion: toolVersion('npm', ['--version']),
     gitVersion: toolVersion('git', ['--version']),
+    // 安装实际会用的 npm 源（设置里的镜像 → 本机 npm 配置 → 官方）：装不上时第一嫌疑就是它，
+    // 上报正文带上它，作者不必再猜「用户到底连的哪个源」（#6118 就卡在这里）
+    npmRegistry: normalizeRegistry(settings.npmRegistry) || configuredNpmRegistry(profile),
     platform: process.platform,
     arch: process.arch,
     release: release(),

package/src/server/http/install.ts

@@ -138,7 +138,7 @@ export function registerInstallRoutes(webServer: WebServerService, profile: stri
           // 命中则记录 repo → 包名映射，客户端据此把依赖 key 匹配回仓库、列表立即显示「已安装」。
           const catalogRepo = source === 'catalog' ? githubRepoOf(displayRepo) : null
           if (catalogRepo !== null) {
-            const catalogTargetIsDsh = await isDshNpmPackageForRepo(rawRepo, catalogRepo, settings.npmRegistry, effectiveProxy)
+            const catalogTargetIsDsh = await isDshNpmPackageForRepo(rawRepo, catalogRepo, settings.npmRegistry, effectiveProxy, pinVersion)
             if (catalogTargetIsDsh) recordResolvedNpmPackage(profile, catalogRepo, rawRepo)
           }
           // 命令行安装（目录外）受「启用 NPM 安装」开关控制；目录插件安装走目录白名单，不受开关影响。

package/src/server/services/install/install-types.ts

@@ -15,6 +15,8 @@ export interface InstallResult {
   stderr: string
   /** 实际执行安装用的 npm 源（换源重试后是最终那一个）：后续读元数据的注解要跟它同源 */
   registry?: string
+  /** 最后一次 spawn 的实际启动参数：失败且无任何输出时，上报里要靠它说明「到底跑了什么、在哪个目录」 */
+  spawn?: { file: string; args: string[]; cwd: string; shell: boolean }
 }
 
 export interface InstallTask {

package/src/server/services/install/npm-resolve.ts

@@ -34,6 +34,13 @@ function repositoryUrlOf(pkg: NpmSearchPackage): string {
   return String(pkg.links?.repository ?? '')
 }
 
+/** registry 路径：指定版本时取该版本的 manifest，否则取 latest。 */
+export function npmMetadataPath(packageName: string, version = ''): string {
+  const normalized = version.trim().replace(/^v/i, '')
+  const encoded = encodeURIComponent(packageName)
+  return normalized === '' ? `${encoded}/latest` : `${encoded}/${encodeURIComponent(normalized)}`
+}
+
 export function isDshPackageMetadataForRepo(pkg: NpmSearchPackage, repo: string): boolean {
   if (githubRepoOf(repositoryUrlOf(pkg))?.toLowerCase() !== repo.toLowerCase()) return false
   const keywords = Array.isArray(pkg.keywords) ? pkg.keywords : []
@@ -43,13 +50,13 @@ export function isDshPackageMetadataForRepo(pkg: NpmSearchPackage, repo: string)
 }
 
 /**
- * 校验包名对应的 npm 包确实属于该仓库且声明为 DSH 插件：取 registry 上的 `latest`
- * 元数据比对 repository 与插件标记。网络异常、超时、非 200 一律返回 false，不阻塞调用方。
+ * 校验包名对应的 npm 包确实属于该仓库且声明为 DSH 插件：取 registry 上指定版本（缺省 `latest`）
+ * 的元数据比对 repository 与插件标记。网络异常、超时、非 200 一律返回 false，不阻塞调用方。
  */
-export function isDshNpmPackageForRepo(packageName: string, repo: string, registry = '', proxy = ''): Promise<boolean> {
+export function isDshNpmPackageForRepo(packageName: string, repo: string, registry = '', proxy = '', version = ''): Promise<boolean> {
   if (packageName === '' || repo === '') return Promise.resolve(false)
   const base = registry === '' ? 'https://registry.npmjs.org' : registry.replace(/\/+$/, '')
-  const url = `${base}/${encodeURIComponent(packageName)}/latest`
+  const url = `${base}/${npmMetadataPath(packageName, version)}`
   return new Promise((resolve) => {
     const req = get(url, { timeout: REQUEST_TIMEOUT_MS }, (res) => {
       if (res.statusCode !== 200) {

package/src/server/services/install/operation-log.ts

@@ -81,6 +81,12 @@ export function backfillOperationLog(output: string, profileDir?: string): strin
   }
 }
 
+/** 本队列自己打的标记行（退出、渠道、超时、回捞…）：不含任何可排查信息。 */
+const SELF_MARKER_RE = /^\[(?:exit\b|timed out\]|install-channel\]|stale pipe\]|error\]|pnpm log\]|registry-fallback\]|allow build\])/
+/** 外层包装行：`Command failed with exit code 1: pnpm add x` 只说明「子进程非零退出」，不含 pnpm 原因。
+ *  宿主摘要（`dsh: plugin command failed; diagnostics: <path>`）另算：带路径的那行是回捞证据，不是噪音。 */
+const WRAPPER_LINE_RE = /^Command failed with exit code \d+/i
+
 /**
  * 输出里是否有 dsh 自己的内容 —— 只有 `[exit N]`、`[install-channel]`、`[timed out]`
  * 这类本队列自己打的标记时返回 false。用于把「宿主什么都没回显」的失败显式留痕，
@@ -89,7 +95,20 @@ export function backfillOperationLog(output: string, profileDir?: string): strin
 export function hasSubstantiveOutput(output: string): boolean {
   return output.split(/\r?\n/).some((raw) => {
     const line = raw.trim()
-    return line !== '' && !/^\[(?:exit\b|timed out\]|install-channel\]|stale pipe\]|error\]|pnpm log\]|registry-fallback\]|allow build\])/.test(line)
+    return line !== '' && !SELF_MARKER_RE.test(line)
+  })
+}
+
+/**
+ * 失败输出里除包装噪声外没有任何可排查内容：只剩本队列标记，和
+ * `Command failed with exit code N: pnpm add …` 这类外层包装（#6118 的形态 ——
+ * pnpm 以 1 退出、operation 日志里只有这一行）。此时上报正文只会写出「安装失败」，
+ * 作者与维护者都无从判断，调用方据此补一条带启动参数的诊断标记。
+ */
+export function lacksDiagnosticContent(output: string): boolean {
+  return output.split(/\r?\n/).every((raw) => {
+    const line = raw.trim()
+    return line === '' || SELF_MARKER_RE.test(line) || WRAPPER_LINE_RE.test(line)
   })
 }
 

package/src/server/services/install/task-queue.ts

@@ -15,7 +15,7 @@ import type { InstallResult, InstallTask, Invocation, QueueItem } from './instal
 import { CAPTURE_LIMIT_BYTES, MAX_TASKS, MAX_TASK_LINES } from './install-types.ts'
 import { npmTooLowMarker } from './npm-check.ts'
 import { registryMissingMarker } from './registry-check.ts'
-import { backfillOperationLog, createOperationLogTap, hasSubstantiveOutput, operationLogPathOf } from './operation-log.ts'
+import { backfillOperationLog, createOperationLogTap, lacksDiagnosticContent, operationLogPathOf } from './operation-log.ts'
 import { cleanLine, estimateProgress } from '../profile/progress.ts'
 import type { LoaderHandle } from '../loader.ts'
 import { hasClientUi, isDshPlugin, mountLoadedEntry, removeLoadedEntry } from '../loader.ts'
@@ -536,6 +536,7 @@ function spawnMutation(options: {
         error: marker === null ? detail : `${detail}\n${marker}`,
         stdout,
         stderr,
+        spawn: { file: invocation.file, args: attemptArgs, cwd: invocation.cwd, shell: invocation.useShell },
       })
       return
     }
@@ -556,7 +557,8 @@ function spawnMutation(options: {
       if (exitWatch !== undefined) clearTimeout(exitWatch)
       if (forceSettle !== undefined) clearTimeout(forceSettle)
       if (task) runningChildren.delete(task.id)
-      resolveOnce(result)
+      // 附带本次实际启动参数：输出为空时，上报里至少能说明「跑了什么、在哪个目录」
+      resolveOnce({ ...result, spawn: { file: invocation.file, args: attemptArgs, cwd: invocation.cwd, shell: invocation.useShell } })
     }
 
     timer = setTimeout(() => {
@@ -886,6 +888,29 @@ export function hostSpawnMarker(invocation: Invocation, error: unknown): string
   return `[host-spawn] the DSH host could not be launched (${invocation.file}: ENOENT)`
 }
 
+/**
+ * 失败输出只剩外层包装时的诊断标记（导出供单测覆盖字段）。内容先后即上报正文里的优先级：
+ * 退出方式 → 实际生效的 registry → 实际 spawn 的命令与目录 → profile 位置。
+ * registry 用主机名展示，避免把带凭据的私有源地址写进公开 Issue。
+ */
+export function sparseFailureMarker(result: InstallResult, options: {
+  action: 'add' | 'remove' | 'update'
+  profile: string
+  registries?: string[]
+}): string {
+  const verb = options.action === 'remove' ? 'uninstall' : options.action === 'update' ? 'update' : 'install'
+  const outcome = result.timedOut ? 'timed out' : `exited with code ${result.exitCode ?? '?'}`
+  const registry = result.registry ?? options.registries?.[0] ?? 'unknown'
+  const spawn = result.spawn
+  return [
+    `[no-output] the ${verb} command ${outcome} and printed nothing but its wrapper line`,
+    `registry: ${registryHost(registry)}`,
+    spawn === undefined ? '' : `spawn: ${spawn.file} ${spawn.args.join(' ')} (cwd ${spawn.cwd}, shell ${spawn.shell})`,
+    `profile: ${profileDirectory(options.profile)}`,
+    'no pnpm log under .plugin-manager/logs — attach hub.log when reporting',
+  ].filter((part) => part !== '').join(' | ')
+}
+
 /**
  * 执行插件变更，带一条恢复路径：当 `add` 因 pnpm 的 allowBuilds 限制拦下构建脚本而失败 ——
  * 或是 git 源包自己的 `prepare`（`ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED`，key 取自打印的
@@ -988,15 +1013,17 @@ export async function runPluginMutation(options: {
       if (operationLogPathOf(output) !== null) {
         // 诊断路径在、日志却取不到：留一行证据，否则下一次同类上报又只剩宿主那句摘要、看不出根因
         pushLine(options.task, '[pnpm log] the host-reported diagnostics log could not be read from disk (missing, empty, or unreadable)')
-      } else if (!hasSubstantiveOutput(output)) {
-        // 宿主连 diagnostics 路径都没回显：显式留痕，避免上报正文只剩一个退出码
-        const what = result.timedOut
-          ? 'printed nothing before the timeout'
-          : `exited with code ${result.exitCode ?? '?'} without printing anything`
-        pushLine(options.task, `[no-output] the dsh CLI ${what}, and no pnpm log was written under .plugin-manager/logs — attach ~/.dsh/profiles/${options.profile}/hub.log when reporting this`)
       }
     }
   }
+  // 失败但输出里只剩外层包装（`Command failed with exit code 1: pnpm add …`）时，上报正文会退化成
+  // 一句「安装失败」：既看不出跑了什么，也看不出连的是哪个源（#6118 的形态）。补一条诊断标记，
+  // 把实际启动参数、profile 目录与生效的 registry 带进日志和上报正文。
+  if ((result.exitCode !== 0 || result.timedOut) && lacksDiagnosticContent(`${result.stderr}\n${result.stdout}`)) {
+    const line = sparseFailureMarker(result, options)
+    if (options.task && options.task.status !== 'cancelled') pushLine(options.task, line)
+    result = { ...result, stderr: `${result.stderr}\n${line}` }
+  }
   // profile 里的 YAML 配置（pnpm-workspace.yaml / pnpm-lock.yaml）解析失败 → 追加 [profile-yaml]
   // 标记，前端给「修本机文件」的步骤，不引导向插件仓库提 Issue
   result = annotateProfileYaml(result, options)