dshmarket 1.10.0 → 1.10.1

package/client/client.js

@@ -668,7 +668,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			});
 		}
 		//#endregion
-		//#region \0dsh-css:/home/runner/work/dsh-market/dsh-market/src/client/Market.module.css.mjs
+		//#region \0dsh-css:src/client/Market.module.css.mjs
 		const css = ".eGUBIq_root{min-width:0;height:100%;color:var(--dsw-alias-label-primary,#1f2328);flex-direction:column;display:flex;position:relative}.eGUBIq_head{flex-direction:column;gap:12px;padding:4px 4px 12px;display:flex}.eGUBIq_title{margin:0;font-size:16px;font-weight:500;line-height:24px}.eGUBIq_sub{color:var(--dsw-alias-label-tertiary,#8b93a1);align-items:center;gap:8px;margin:0;font-size:14px;line-height:22px;display:flex}.eGUBIq_tabs{border-bottom:1px solid var(--dsw-alias-border-l2,#e5e7eb);align-items:flex-end;gap:2px;display:flex}.eGUBIq_tab{font:inherit;color:var(--dsw-alias-label-secondary,#6b7280);cursor:pointer;white-space:nowrap;background:0 0;border:none;border-bottom:2px solid #0000;padding:7px 12px;font-size:13px}.eGUBIq_tab.eGUBIq_on{color:var(--dsw-alias-brand-primary,#4f6ef7);border-bottom-color:var(--dsw-alias-brand-primary,#4f6ef7);font-weight:600}.eGUBIq_banner{background:var(--dsw-alias-bg-layer-2,#fdf3e3);border:1px solid var(--dsw-alias-border-l2,#f3e3c3);border-radius:8px;align-items:center;gap:8px;margin:0;padding:8px 12px;font-size:12px;display:flex}.eGUBIq_bannerIcon{color:var(--dsw-alias-label-secondary,#6b7280);flex-shrink:0}.eGUBIq_bannerHint{color:var(--dsw-alias-label-tertiary,#8b93a1);cursor:help;display:inline-flex}.eGUBIq_body{flex:1;padding:12px 4px 24px;overflow-x:hidden;overflow-y:auto}.eGUBIq_cats{z-index:5;background:var(--dsw-alias-bg-layer-2,#f7f8fa);margin:-12px -4px 2px;padding:12px 4px 4px;position:sticky;top:-13px}.eGUBIq_catsRow{align-items:flex-start;gap:8px;display:flex;position:relative}.eGUBIq_star{color:var(--dsw-alias-label-secondary,#9ca3af);font-size:11px}.eGUBIq_top{z-index:20;display:inline-flex;position:absolute;bottom:18px;right:18px}.eGUBIq_topBtn{border-radius:99px;width:38px;height:38px;padding:0}.eGUBIq_tag{border:1px solid var(--dsw-alias-border-l3,#d9dde3);color:var(--dsw-alias-label-secondary,#6b7280);border-radius:4px;flex-shrink:0;padding:1px 6px;font-size:11px;line-height:16px}.eGUBIq_okState{color:var(--dsw-alias-state-success-primary,#16a34a);white-space:nowrap;font-size:12px;font-weight:600}.eGUBIq_catsWrap{flex-wrap:wrap;flex:1;align-items:center;gap:6px;min-width:0;display:flex}.eGUBIq_catsCollapsed{max-height:62px;overflow:hidden}.eGUBIq_catsToggle.eGUBIq_catsToggle{height:26px;min-height:26px;color:var(--dsw-alias-label-secondary,#6b7280);padding:0 6px}.eGUBIq_shots{-webkit-overflow-scrolling:touch;scrollbar-width:thin;gap:8px;margin:0 0 8px;padding:2px 0 6px;display:flex;overflow-x:auto}.eGUBIq_shot{object-fit:cover;border:1px solid var(--dsw-alias-border-default,#e5e7eb);background:var(--dsw-alias-bg-layer-2,#f3f4f6);border-radius:8px;flex:none;max-width:260px;height:150px}.eGUBIq_cmd{background:var(--dsw-alias-bg-layer-2,#f3f4f6);word-break:break-all;border-radius:6px;margin:8px 0 0;padding:8px 10px;font-family:ui-monospace,Menlo,monospace;font-size:11px;line-height:18px}.eGUBIq_warnLine{color:var(--dsw-alias-state-warn-primary,#b45309);align-items:center;gap:4px;margin:0;font-size:12px;font-weight:600;line-height:18px;display:flex}.eGUBIq_modalNote{color:var(--dsw-alias-label-tertiary,#8b93a1);align-items:center;gap:4px;margin:12px 0 0;font-size:12px;line-height:18px;display:flex}.eGUBIq_grid{grid-template-columns:repeat(auto-fill,minmax(280px,1fr));gap:12px;display:grid}.eGUBIq_swatches{border:1px solid var(--dsw-alias-border-l2,#e5e7eb);border-radius:8px;gap:0;height:34px;display:flex;overflow:hidden}.eGUBIq_themesGrid{margin-bottom:12px}.eGUBIq_swatches i{flex:1}.eGUBIq_card{background:var(--dsw-alias-bg-layer-1,#fff);border:1px solid var(--dsw-alias-border-l2,#e5e7eb);border-radius:12px;flex-direction:column;gap:12px;padding:12px 14px;display:flex}.eGUBIq_row1{align-items:center;gap:10px;min-width:0;display:flex}.eGUBIq_srcBtn{flex-shrink:0;align-self:flex-start}.eGUBIq_av{color:#fff;object-fit:cover;background:var(--dsw-alias-bg-layer-2,#f3f4f6);border-radius:8px;flex-shrink:0;place-items:center;width:32px;height:32px;font-size:14px;font-weight:700;display:grid}.eGUBIq_nm{text-overflow:ellipsis;white-space:nowrap;font-size:14px;font-weight:500;line-height:22px;overflow:hidden}.eGUBIq_owner{color:var(--dsw-alias-label-secondary,#9ca3af);font-size:11px}.eGUBIq_desc{color:var(--dsw-alias-label-tertiary,#8b93a1);min-height:36px;margin:0;font-size:12px;line-height:18px}.eGUBIq_foot{align-items:center;gap:8px;margin-top:auto;display:flex}.eGUBIq_grow{flex:1}.eGUBIq_titleRow{align-items:center;gap:10px;display:flex}.eGUBIq_descTight{min-height:0}.eGUBIq_src{color:var(--dsw-alias-label-secondary,#9ca3af);font-size:11px;text-decoration:none}.eGUBIq_src:hover{color:var(--dsw-alias-brand-primary,#4f6ef7)}.eGUBIq_dot{vertical-align:2px;margin-left:5px}.eGUBIq_act{flex-wrap:wrap;align-items:center;gap:6px;margin-top:6px;font-size:11px;display:flex}.eGUBIq_actLive{color:var(--dsw-alias-state-success-primary,#16a34a);align-items:center;gap:4px;font-weight:600;display:inline-flex}.eGUBIq_actWarn{color:var(--dsw-alias-state-warn-primary,#b45309);align-items:center;gap:4px;font-weight:600;display:inline-flex}.eGUBIq_actBroken{color:var(--dsw-alias-state-error-primary,#dc2626);align-items:center;gap:4px;font-weight:600;display:inline-flex}.eGUBIq_actWhy{color:var(--dsw-alias-label-secondary,#6b7280);margin-top:2px}.eGUBIq_loading{color:var(--dsw-alias-label-secondary,#9ca3af);flex-direction:column;align-items:center;gap:12px;padding:48px;font-size:13px;display:flex}.eGUBIq_spin{color:var(--dsw-alias-brand-primary,#4f6ef7);flex-shrink:0;animation:.8s linear infinite eGUBIq_sp;display:inline-flex}@keyframes eGUBIq_sp{to{transform:rotate(360deg)}}.eGUBIq_progress{background:var(--dsw-alias-bg-layer-2,#f3f4f6);border:1px solid var(--dsw-alias-border-l2,#e5e7eb);color:var(--dsw-alias-label-secondary,#6b7280);border-radius:8px;flex-wrap:wrap;align-items:center;gap:9px;margin:0;padding:8px 12px;font-size:12px;display:flex}.eGUBIq_bar{background:var(--dsw-alias-border-l1,#e5e7eb);border-radius:99px;width:100%;height:4px;overflow:hidden}.eGUBIq_barFill{background:var(--dsw-alias-brand-primary,#4f6ef7);border-radius:99px;height:100%;transition:width .6s}.eGUBIq_barWave{width:30%;animation:1.2s ease-in-out infinite eGUBIq_dshmSlide}@keyframes eGUBIq_dshmSlide{0%{margin-left:-30%}to{margin-left:100%}}.eGUBIq_irow .eGUBIq_progress{margin-top:8px}.eGUBIq_progress code{text-overflow:ellipsis;white-space:nowrap;font-family:ui-monospace,Menlo,monospace;font-size:11px;overflow:hidden}.eGUBIq_empty{color:var(--dsw-alias-label-secondary,#9ca3af);text-align:center;padding:32px;font-size:13px}.eGUBIq_err{color:var(--dsw-alias-state-error-primary,#dc2626);white-space:pre-wrap;word-break:break-all;margin:8px 0;font-size:12px}.eGUBIq_irow{background:var(--dsw-alias-bg-layer-1,#fff);border:1px solid var(--dsw-alias-border-l2,#e5e7eb);border-radius:12px;align-items:center;gap:10px;margin-bottom:8px;padding:12px 14px;display:flex}.eGUBIq_irowMissing{filter:grayscale();opacity:.5}.eGUBIq_irow>.eGUBIq_src,.eGUBIq_irow>.eGUBIq_owner,.eGUBIq_irow button{white-space:nowrap;flex-shrink:0}.eGUBIq_tabSearchRow{padding:0 4px 10px;display:flex}.eGUBIq_tabSearch{width:260px}.eGUBIq_spec{color:var(--dsw-alias-label-secondary,#9ca3af);font-family:ui-monospace,Menlo,monospace;font-size:11px}.eGUBIq_staleAction{margin-top:8px}.eGUBIq_pct{color:var(--dsw-alias-label-secondary,#6b7280);flex-shrink:0;font-size:11px;font-weight:600}.eGUBIq_pager{flex-wrap:wrap;justify-content:space-between;align-items:center;gap:12px;margin:16px 0 4px;display:flex}.eGUBIq_pagerPages{flex-wrap:wrap;flex:1;justify-content:center;align-items:center;gap:6px;min-width:0;display:flex}.eGUBIq_pageEllipsis{color:var(--dsw-alias-label-secondary,#9ca3af);padding:0 2px;font-size:12px}.eGUBIq_pageInfo{color:var(--dsw-alias-label-secondary,#6b7280);white-space:nowrap;font-size:12px}.eGUBIq_depBadge{border:1px solid var(--dsw-alias-state-warn-primary,#b45309);color:var(--dsw-alias-state-warn-primary,#b45309);white-space:nowrap;border-radius:4px;flex-shrink:0;margin-left:6px;padding:1px 6px;font-size:11px;font-weight:600;line-height:16px}.eGUBIq_deprecate{color:var(--dsw-alias-state-warn-primary,#b45309);background:var(--dsw-alias-bg-layer-2,#fdf3e3);border:1px solid var(--dsw-alias-border-l2,#f3e3c3);border-radius:8px;margin:0;padding:8px 10px;font-size:12px;line-height:18px}.eGUBIq_deprecate a{color:var(--dsw-alias-state-warn-primary,#b45309);text-decoration:underline}.eGUBIq_deprecate .eGUBIq_src{margin-left:8px}.eGUBIq_depLine{flex-wrap:wrap;align-items:center;gap:8px;display:flex}.eGUBIq_switch{border:1px solid var(--dsw-alias-border-l2,#d9dde3);background:var(--dsw-alias-bg-layer-2,#e5e7eb);cursor:pointer;border-radius:99px;flex-shrink:0;width:38px;height:22px;padding:0;transition:background .15s,border-color .15s;position:relative}.eGUBIq_switchOn{background:var(--dsw-alias-state-success-primary,#16a34a);border-color:var(--dsw-alias-state-success-primary,#16a34a)}.eGUBIq_switchMixed{background:var(--dsw-alias-state-warn-primary,#b45309);border-color:var(--dsw-alias-state-warn-primary,#b45309)}.eGUBIq_switchKnob{background:#fff;border-radius:99px;width:16px;height:16px;transition:left .15s;position:absolute;top:2px;left:2px;box-shadow:0 1px 2px #00000040}.eGUBIq_switchOn .eGUBIq_switchKnob,.eGUBIq_switchMixed .eGUBIq_switchKnob{left:18px}.eGUBIq_switch:disabled{opacity:.5;cursor:default}.eGUBIq_viewBar{border:1px solid var(--dsw-alias-border-l2,#e5e7eb);border-radius:8px;align-items:center;gap:2px;width:fit-content;margin-bottom:12px;padding:2px;display:flex}.eGUBIq_viewBtn{font:inherit;color:var(--dsw-alias-label-secondary,#6b7280);cursor:pointer;white-space:nowrap;background:0 0;border:none;border-radius:6px;padding:4px 10px;font-size:12px;line-height:18px}.eGUBIq_viewBtn:hover{color:var(--dsw-alias-brand-primary,#4f6ef7)}.eGUBIq_viewOn{background:var(--dsw-alias-bg-layer-2,#eef0f4);color:var(--dsw-alias-label-primary,#1f2328);font-weight:600}.eGUBIq_groupRow{background:var(--dsw-alias-bg-layer-1,#fff);border:1px solid var(--dsw-alias-border-l2,#e5e7eb);border-radius:12px;margin-bottom:10px;padding:12px 14px}.eGUBIq_groupHead{align-items:center;gap:10px;min-width:0;display:flex}.eGUBIq_groupName{text-overflow:ellipsis;white-space:nowrap;font-size:13px;font-weight:600;line-height:20px;overflow:hidden}.eGUBIq_groupActions{flex-shrink:0;align-items:center;gap:6px;display:flex}.eGUBIq_groupMembers{flex-direction:column;gap:6px;margin-top:10px;display:flex}.eGUBIq_groupMember{background:var(--dsw-alias-bg-layer-2,#f7f8fa);border-radius:8px;align-items:center;gap:8px;padding:6px 8px;font-size:12px;line-height:18px;display:flex}.eGUBIq_groupMember .eGUBIq_nm{flex:1;min-width:0;font-size:12px}.eGUBIq_groupAddPanel{border-top:1px dashed var(--dsw-alias-border-l2,#e5e7eb);flex-direction:column;gap:6px;margin-top:10px;padding-top:10px;display:flex}.eGUBIq_groupCreate{align-items:center;gap:8px;margin-bottom:10px;display:flex}.eGUBIq_inlineInput{flex:1;min-width:120px}.eGUBIq_assignRow{flex-wrap:wrap;align-items:center;gap:8px;display:flex}.eGUBIq_assignSelect{border:1px solid var(--dsw-alias-border-l2,#e5e7eb);background:var(--dsw-alias-bg-layer-1,#fff);color:var(--dsw-alias-label-primary,#1f2328);font:inherit;border-radius:6px;padding:3px 6px;font-size:12px;line-height:18px}.eGUBIq_groupHint{color:var(--dsw-alias-label-tertiary,#8b93a1);font-size:11px}.eGUBIq_sectAction{color:var(--dsw-alias-label-secondary,#6b7280);align-items:center;gap:8px;margin:14px 2px 8px;font-size:12px;font-weight:600;display:flex}.eGUBIq_backupGrid{grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:12px;display:grid}.eGUBIq_backupCard{background:var(--dsw-alias-bg-layer-1,#fff);border:1px solid var(--dsw-alias-border-l2,#e5e7eb);border-radius:12px;flex-direction:column;gap:10px;padding:16px;display:flex}.eGUBIq_backupCard h3{margin:0;font-size:14px}.eGUBIq_backupCard p{color:var(--dsw-alias-label-secondary,#6b7280);margin:0;font-size:12px;line-height:18px}.eGUBIq_backupActions{flex-wrap:wrap;gap:8px;display:flex;position:relative}.eGUBIq_hiddenFile{opacity:0;pointer-events:none;width:1px;height:1px;position:absolute}.eGUBIq_backupInput{box-sizing:border-box;width:100%}.eGUBIq_backupCheck{cursor:pointer;align-items:center;gap:6px;font-size:12px;display:flex}.eGUBIq_backupWarn{margin:0;font-size:12px;line-height:18px;color:var(--dsw-alias-state-warn-primary,#b45309)!important}.eGUBIq_backupMessage{color:var(--dsw-alias-label-secondary,#6b7280);grid-column:1/-1;font-size:12px}";
 		const tagId = "dshmarket/Market.module.css";
 		if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId) + "]") === null) {
@@ -679,105 +679,105 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			document.head.appendChild(tag);
 		}
 		var Market_module_css_default = {
-			"actLive": "eGUBIq_actLive",
-			"backupMessage": "eGUBIq_backupMessage",
-			"pct": "eGUBIq_pct",
-			"depLine": "eGUBIq_depLine",
-			"sub": "eGUBIq_sub",
+			"groupHead": "eGUBIq_groupHead",
+			"shot": "eGUBIq_shot",
+			"sp": "eGUBIq_sp",
+			"owner": "eGUBIq_owner",
+			"title": "eGUBIq_title",
+			"swatches": "eGUBIq_swatches",
 			"inlineInput": "eGUBIq_inlineInput",
-			"groupHint": "eGUBIq_groupHint",
-			"assignRow": "eGUBIq_assignRow",
-			"tab": "eGUBIq_tab",
+			"backupCheck": "eGUBIq_backupCheck",
+			"viewOn": "eGUBIq_viewOn",
+			"groupName": "eGUBIq_groupName",
+			"catsWrap": "eGUBIq_catsWrap",
+			"tag": "eGUBIq_tag",
+			"groupMembers": "eGUBIq_groupMembers",
+			"assignSelect": "eGUBIq_assignSelect",
+			"backupMessage": "eGUBIq_backupMessage",
+			"descTight": "eGUBIq_descTight",
 			"progress": "eGUBIq_progress",
-			"backupActions": "eGUBIq_backupActions",
-			"grow": "eGUBIq_grow",
-			"modalNote": "eGUBIq_modalNote",
-			"root": "eGUBIq_root",
-			"pager": "eGUBIq_pager",
+			"star": "eGUBIq_star",
 			"cmd": "eGUBIq_cmd",
-			"pageEllipsis": "eGUBIq_pageEllipsis",
-			"warnLine": "eGUBIq_warnLine",
-			"swatches": "eGUBIq_swatches",
-			"title": "eGUBIq_title",
-			"themesGrid": "eGUBIq_themesGrid",
-			"row1": "eGUBIq_row1",
-			"desc": "eGUBIq_desc",
-			"empty": "eGUBIq_empty",
+			"head": "eGUBIq_head",
+			"src": "eGUBIq_src",
+			"tabSearchRow": "eGUBIq_tabSearchRow",
+			"spin": "eGUBIq_spin",
+			"bar": "eGUBIq_bar",
 			"viewBtn": "eGUBIq_viewBtn",
-			"viewOn": "eGUBIq_viewOn",
-			"sectAction": "eGUBIq_sectAction",
-			"irowMissing": "eGUBIq_irowMissing",
-			"body": "eGUBIq_body",
 			"on": "eGUBIq_on",
-			"staleAction": "eGUBIq_staleAction",
-			"banner": "eGUBIq_banner",
-			"top": "eGUBIq_top",
-			"src": "eGUBIq_src",
-			"backupGrid": "eGUBIq_backupGrid",
-			"groupMembers": "eGUBIq_groupMembers",
+			"actLive": "eGUBIq_actLive",
+			"root": "eGUBIq_root",
+			"themesGrid": "eGUBIq_themesGrid",
 			"act": "eGUBIq_act",
-			"actWarn": "eGUBIq_actWarn",
-			"deprecate": "eGUBIq_deprecate",
-			"groupName": "eGUBIq_groupName",
+			"pagerPages": "eGUBIq_pagerPages",
+			"depLine": "eGUBIq_depLine",
+			"tab": "eGUBIq_tab",
+			"row1": "eGUBIq_row1",
+			"modalNote": "eGUBIq_modalNote",
+			"av": "eGUBIq_av",
+			"nm": "eGUBIq_nm",
+			"loading": "eGUBIq_loading",
+			"pct": "eGUBIq_pct",
+			"groupActions": "eGUBIq_groupActions",
+			"backupActions": "eGUBIq_backupActions",
+			"backupInput": "eGUBIq_backupInput",
+			"bannerHint": "eGUBIq_bannerHint",
+			"bannerIcon": "eGUBIq_bannerIcon",
+			"cats": "eGUBIq_cats",
 			"foot": "eGUBIq_foot",
-			"switchMixed": "eGUBIq_switchMixed",
-			"viewBar": "eGUBIq_viewBar",
-			"err": "eGUBIq_err",
-			"catsWrap": "eGUBIq_catsWrap",
+			"spec": "eGUBIq_spec",
+			"backupGrid": "eGUBIq_backupGrid",
 			"titleRow": "eGUBIq_titleRow",
-			"assignSelect": "eGUBIq_assignSelect",
+			"actWhy": "eGUBIq_actWhy",
+			"viewBar": "eGUBIq_viewBar",
+			"hiddenFile": "eGUBIq_hiddenFile",
+			"warnLine": "eGUBIq_warnLine",
+			"backupWarn": "eGUBIq_backupWarn",
+			"banner": "eGUBIq_banner",
+			"catsRow": "eGUBIq_catsRow",
 			"dot": "eGUBIq_dot",
 			"switch": "eGUBIq_switch",
-			"groupActions": "eGUBIq_groupActions",
-			"actWhy": "eGUBIq_actWhy",
-			"tabs": "eGUBIq_tabs",
-			"bannerIcon": "eGUBIq_bannerIcon",
-			"spin": "eGUBIq_spin",
-			"okState": "eGUBIq_okState",
-			"loading": "eGUBIq_loading",
-			"tabSearchRow": "eGUBIq_tabSearchRow",
-			"groupAddPanel": "eGUBIq_groupAddPanel",
-			"backupCard": "eGUBIq_backupCard",
-			"switchKnob": "eGUBIq_switchKnob",
-			"dshmSlide": "eGUBIq_dshmSlide",
-			"switchOn": "eGUBIq_switchOn",
-			"av": "eGUBIq_av",
-			"tag": "eGUBIq_tag",
-			"grid": "eGUBIq_grid",
-			"shot": "eGUBIq_shot",
-			"barFill": "eGUBIq_barFill",
-			"catsCollapsed": "eGUBIq_catsCollapsed",
 			"topBtn": "eGUBIq_topBtn",
-			"groupRow": "eGUBIq_groupRow",
-			"head": "eGUBIq_head",
-			"backupInput": "eGUBIq_backupInput",
-			"nm": "eGUBIq_nm",
+			"barFill": "eGUBIq_barFill",
+			"assignRow": "eGUBIq_assignRow",
+			"srcBtn": "eGUBIq_srcBtn",
 			"irow": "eGUBIq_irow",
+			"groupMember": "eGUBIq_groupMember",
+			"switchOn": "eGUBIq_switchOn",
+			"switchKnob": "eGUBIq_switchKnob",
+			"depBadge": "eGUBIq_depBadge",
+			"top": "eGUBIq_top",
+			"sub": "eGUBIq_sub",
+			"tabs": "eGUBIq_tabs",
+			"catsCollapsed": "eGUBIq_catsCollapsed",
+			"grow": "eGUBIq_grow",
+			"barWave": "eGUBIq_barWave",
+			"dshmSlide": "eGUBIq_dshmSlide",
 			"card": "eGUBIq_card",
-			"catsRow": "eGUBIq_catsRow",
-			"srcBtn": "eGUBIq_srcBtn",
-			"descTight": "eGUBIq_descTight",
-			"bar": "eGUBIq_bar",
-			"tabSearch": "eGUBIq_tabSearch",
+			"staleAction": "eGUBIq_staleAction",
+			"catsToggle": "eGUBIq_catsToggle",
+			"pager": "eGUBIq_pager",
 			"pageInfo": "eGUBIq_pageInfo",
-			"cats": "eGUBIq_cats",
+			"deprecate": "eGUBIq_deprecate",
+			"actWarn": "eGUBIq_actWarn",
+			"pageEllipsis": "eGUBIq_pageEllipsis",
 			"shots": "eGUBIq_shots",
-			"owner": "eGUBIq_owner",
+			"switchMixed": "eGUBIq_switchMixed",
+			"groupRow": "eGUBIq_groupRow",
+			"err": "eGUBIq_err",
+			"body": "eGUBIq_body",
+			"tabSearch": "eGUBIq_tabSearch",
+			"groupAddPanel": "eGUBIq_groupAddPanel",
 			"actBroken": "eGUBIq_actBroken",
-			"groupMember": "eGUBIq_groupMember",
-			"hiddenFile": "eGUBIq_hiddenFile",
-			"depBadge": "eGUBIq_depBadge",
-			"backupCheck": "eGUBIq_backupCheck",
-			"pagerPages": "eGUBIq_pagerPages",
-			"backupWarn": "eGUBIq_backupWarn",
-			"bannerHint": "eGUBIq_bannerHint",
-			"sp": "eGUBIq_sp",
-			"star": "eGUBIq_star",
-			"spec": "eGUBIq_spec",
-			"catsToggle": "eGUBIq_catsToggle",
-			"barWave": "eGUBIq_barWave",
-			"groupHead": "eGUBIq_groupHead",
-			"groupCreate": "eGUBIq_groupCreate"
+			"empty": "eGUBIq_empty",
+			"groupCreate": "eGUBIq_groupCreate",
+			"groupHint": "eGUBIq_groupHint",
+			"grid": "eGUBIq_grid",
+			"okState": "eGUBIq_okState",
+			"sectAction": "eGUBIq_sectAction",
+			"backupCard": "eGUBIq_backupCard",
+			"desc": "eGUBIq_desc",
+			"irowMissing": "eGUBIq_irowMissing"
 		};
 		//#endregion
 		//#region src/client/MarketSection.tsx

package/lib/install.js

@@ -7,12 +7,21 @@
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { classifyPnpmFailure } from './pnpm-compat.js';
-import { hasDshManifest, hasLoadableEntry, pluginSubdirs, profileDir, readInstalled } from './profile.js';
+import { conflictingEntryIds, hasDshManifest, hasLoadableEntry, pluginSubdirs, profileDir, readInstalled, readProfileBundles } from './profile.js';
 import { logEvent } from './log.js';
+import { cleanOrphanedStore } from './store.js';
 /** One-shot bypass for pnpm's fresh-release hold; scoped to a single command. */
 export const RELEASE_AGE_OVERRIDE = '--config.minimumReleaseAge=0';
 /**
- * Run one plugin command with automatic recovery from two known pnpm traps:
+ * Longer per-request fetch timeout for one retried command. pnpm's default
+ * 60-second limit aborts large tarball downloads (github: sources fetch the
+ * WHOLE repo even for a `#path:` subdirectory plugin) on slow networks; a
+ * plain retry fails again at the same limit, so the recovery re-runs with
+ * this override once. Scoped to a single command like RELEASE_AGE_OVERRIDE.
+ */
+export const FETCH_TIMEOUT_OVERRIDE = '--config.fetchTimeout=600000';
+/**
+ * Run one plugin command with automatic recovery from three known pnpm traps:
  *
  * - pnpm-major drift (#20 bug 2): a modules directory built by a different
  *   pnpm major fails mutation; pnpm's documented remedy is one `install` to
@@ -22,6 +31,10 @@ export const RELEASE_AGE_OVERRIDE = '--config.minimumReleaseAge=0';
  *   retry once with the one-shot minimumReleaseAge bypass (safe: the young
  *   package is already installed; the bypass only lets pnpm touch the
  *   lockfile again).
+ * - per-request fetch timeout: large tarballs (github: sources fetch the
+ *   whole repo even for a `#path:` subdirectory) on slow networks blow
+ *   pnpm's default 60-second limit; a plain retry fails again at the same
+ *   limit, so retry once with a longer fetchTimeout.
  *
  * Any recognized failure that survives gets its bilingual explanation
  * appended to stderr so the UI shows an actionable message instead of a
@@ -54,8 +67,23 @@ export async function withHoistRecovery(run, profile, pluginArgs) {
             logEvent('warn', 'install', `transient network failure while pnpm replayed the dependency tree (#83) — retrying once`);
             result = await run(profile, pluginArgs);
         }
+        else if (failure?.code === 'fetch-timeout'
+            && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')
+            && !pluginArgs.includes(FETCH_TIMEOUT_OVERRIDE)) {
+            // Large tarball / slow network: pnpm's default 60s per-request limit
+            // aborted the download. A plain retry fails again at the same limit,
+            // so retry once with a longer fetchTimeout.
+            logEvent('warn', 'install', `pnpm's per-request fetch timeout aborted a large download — retrying once with ${FETCH_TIMEOUT_OVERRIDE}`);
+            result = await run(profile, [pluginArgs[0], FETCH_TIMEOUT_OVERRIDE, ...pluginArgs.slice(1)]);
+        }
     }
     if (!ok(result) && !result.cancelled) {
+        // A failed, timed-out, or killed run never finishes pnpm's staging, so
+        // its store tmp dirs (the WHOLE repo tarball for github: sources) are
+        // orphaned — reclaim them now that no pnpm is running. Safe by
+        // construction: directories are only removed when their owning pid is
+        // gone (the name carries it), so a live download is never touched.
+        await cleanOrphanedStore(run, profile);
         const failure = classifyPnpmFailure(`${result.stderr}\n${result.stdout}`);
         if (failure !== null)
             result = { ...result, stderr: `${result.stderr}\n\n${failure.message}` };
@@ -107,26 +135,44 @@ export async function retargetCollections(run, profile, before, target, explicit
  * piece without a dsh manifest or without its declared entry artifact
  * (source-only checkout, build blocked by pnpm allowBuilds) would brick the
  * next boot, so it is removed on the spot.
- * @returns names kept and names removed as broken.
+ *
+ * Since #122 this also covers duplicate loader entry ids: cordis refuses to
+ * load a tree containing two entries with one id, so a TUI bundle landing in
+ * a web profile (both declare `id: storage`) leaves DSH unable to START —
+ * an error naming neither plugin, from which the market's own page is
+ * unreachable. Such a package is removed like any other bricking piece.
+ * @returns names kept, names removed as broken, and the id conflicts found.
  */
 export async function validateAddedPlugins(run, profile, before, explicitDir) {
     const dir = profileDir(profile, explicitDir);
     const addedNow = Object.keys(readInstalled(profile, dir)).filter(n => !before.has(n));
     const keep = [];
     const removedBroken = [];
+    const conflicts = [];
+    // Compare against what the profile already loads, minus this install's own
+    // additions — two pieces of one plugin are not "already installed".
+    const existingBundles = readProfileBundles(dir).filter(name => !addedNow.includes(name));
     for (const n of addedNow) {
         const packageDir = join(dir, 'node_modules', n);
         // hasLoadableEntry, not entryArtifactExists: carrier bundles legitimately
         // ship no entry of their own (#103) and must not be uninstalled here.
-        if (hasDshManifest(packageDir) && hasLoadableEntry(dir, n)) {
-            keep.push(n);
+        if (!hasDshManifest(packageDir) || !hasLoadableEntry(dir, n)) {
+            removedBroken.push(n);
+            await run(profile, ['remove', n]);
+            continue;
         }
-        else {
+        const clash = conflictingEntryIds(dir, n, existingBundles);
+        if (clash.length > 0) {
+            // Keeping it would make the NEXT BOOT fail outright (#122).
+            conflicts.push(...clash.map(hit => ({ name: n, ...hit })));
             removedBroken.push(n);
+            logEvent('error', 'install', `${n}: loader entry id conflict with ${clash[0].owner} (${clash.map(hit => hit.id).join(', ')}) — removing, it would break the next boot`);
             await run(profile, ['remove', n]);
+            continue;
         }
+        keep.push(n);
     }
-    return { keep, removedBroken };
+    return { keep, removedBroken, conflicts };
 }
 /**
  * Whether a clean-exit update actually changed nothing — pnpm's

package/lib/pnpm-compat.js

@@ -40,6 +40,19 @@ export function pluginArgsFor(profileDir, pluginArgs) {
 export function isTransientPnpmFailure(output) {
     return /ERR_PNPM_FETCH_5\d\d|ERR_PNPM_META_FETCH_FAIL|FetchError|ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENETUNREACH|socket hang up|network timeout/i.test(output);
 }
+/**
+ * pnpm's per-request fetch timeout: the abort surfaces as a DOMException
+ * ("The operation was aborted due to timeout", code 23) through undici —
+ * pnpm logs it as `GET … error (23)` before giving up. This is the failure
+ * shape for large tarballs (github: sources download the WHOLE repo, even
+ * for a `#path:` subdirectory plugin) on slow networks: pnpm's default
+ * 60-second limit is simply not enough, so a plain retry fails again at the
+ * same limit. The market's recovery re-runs once with a longer
+ * fetchTimeout (see withHoistRecovery).
+ */
+export function isFetchTimeoutFailure(output) {
+    return /operation was aborted due to timeout|TimeoutError|error \(23\)/i.test(output);
+}
 /**
  * Map a failed pnpm run's combined output to a known failure mode.
  *
@@ -134,6 +147,17 @@ export function classifyPnpmFailure(output) {
             message: '拉取依赖时网络临时失败（不一定是你正在装的插件——安装会重放整个依赖树，任何一个既有依赖抖动都会中断）。已自动重试一次仍失败，请稍后再试 / a transient network failure while fetching dependencies (not necessarily the plugin you are installing — installs replay the whole dependency tree, so any existing dependency can hiccup); one automatic retry failed too — please try again shortly',
         };
     }
+    // pnpm's per-request fetch timeout (#…): large tarballs (github: sources
+    // fetch the whole repo even for a `#path:` subdirectory) on slow networks
+    // blow pnpm's default 60s limit. A plain retry fails again at the same
+    // limit, so withHoistRecovery retries with a longer fetchTimeout.
+    if (isFetchTimeoutFailure(output)) {
+        return {
+            code: 'fetch-timeout',
+            recoverable: false,
+            message: '下载超时：这个插件的安装包较大（github 源会下载整个仓库）或网络较慢，pnpm 默认的单次请求 60 秒限制不够用。市场已用更长的超时自动重试一次；若仍失败，请稍后再试或检查网络 / download timed out: this plugin ships a large tarball (github sources download the whole repository) or your network is slow, and pnpm\'s default 60-second per-request limit was not enough; the market retries once with a longer timeout — if it still fails, try again later or check the network',
+        };
+    }
     if (output.includes('pnpm not found on PATH')) {
         return {
             code: 'pnpm-missing',

package/lib/profile.js

@@ -161,27 +161,85 @@ export function entryArtifactExists(dir) {
  * bundle bring in" any name row counts.
  */
 export function bundlePatchTargets(dir) {
+    return readBundlePatchRows(dir).names;
+}
+/**
+ * Loader entry ids a bundle patch inserts. Cordis refuses to boot a tree
+ * with a duplicate entry id ("duplicate loader entry id: storage", #122), so
+ * these are what two bundles can collide on.
+ */
+export function bundlePatchEntryIds(dir) {
+    return readBundlePatchRows(dir).ids;
+}
+/**
+ * `name:` and `id:` rows of the package's declared bundle patch. Line-wise
+ * on purpose: the strict hot-mount parser rejects config/expression rows,
+ * but for "what does this bundle bring in" any row counts.
+ */
+function readBundlePatchRows(dir) {
     let patchPath;
     try {
         const manifest = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'));
         const declared = manifest.dsh?.bundle?.patch;
         if (typeof declared !== 'string' || declared === '')
-            return [];
+            return { names: [], ids: [] };
         patchPath = join(dir, declared);
     }
     catch {
-        return [];
+        return { names: [], ids: [] };
     }
     const names = [];
+    const ids = [];
     try {
         for (const line of readFileSync(patchPath, 'utf8').split('\n')) {
-            const m = /^\s*name:\s*['"]?([^'"\s]+)/.exec(line);
-            if (m !== null && !names.includes(m[1]))
-                names.push(m[1]);
+            const name = /^\s*-?\s*name:\s*['"]?([^'"\s]+)/.exec(line);
+            if (name !== null && !names.includes(name[1]))
+                names.push(name[1]);
+            const id = /^\s*-?\s*id:\s*['"]?([^'"\s]+)/.exec(line);
+            if (id !== null && !ids.includes(id[1]))
+                ids.push(id[1]);
+        }
+    }
+    catch { /* unreadable patch — nothing to report */ }
+    return { names, ids };
+}
+/** The profile manifest's `dsh.profile.bundles` — what the CLI reconciled. */
+export function readProfileBundles(profileDirectory) {
+    try {
+        const manifest = JSON.parse(readFileSync(join(profileDirectory, 'package.json'), 'utf8'));
+        const bundles = manifest.dsh?.profile?.bundles;
+        return Array.isArray(bundles) ? bundles.filter((name) => typeof name === 'string') : [];
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Loader entry ids a newly added package would collide on with bundles the
+ * profile ALREADY loads (#122).
+ *
+ * Cordis hard-fails the whole tree on a duplicate id, so this is not a
+ * cosmetic conflict: installing a TUI bundle into a web profile (both
+ * declare `id: storage`) leaves DSH unable to start at all, with an error
+ * naming neither plugin. Checked against the profile's own bundle list so a
+ * package is never compared with itself.
+ * @returns colliding ids mapped to the already-installed bundle that owns them.
+ */
+export function conflictingEntryIds(profileDirectory, candidate, installedBundles) {
+    const mine = bundlePatchEntryIds(join(profileDirectory, 'node_modules', candidate));
+    if (mine.length === 0)
+        return [];
+    const conflicts = [];
+    for (const bundle of installedBundles) {
+        if (bundle === candidate)
+            continue;
+        const theirs = new Set(bundlePatchEntryIds(join(profileDirectory, 'node_modules', bundle)));
+        for (const id of mine) {
+            if (theirs.has(id) && !conflicts.some(hit => hit.id === id))
+                conflicts.push({ id, owner: bundle });
         }
     }
-    catch { /* unreadable patch — no targets */ }
-    return names;
+    return conflicts;
 }
 /**
  * Whether the loader has anything to load for this package: its own entry

package/lib/routes.js

@@ -1149,9 +1149,11 @@ export function mountMarketRoutes(host, config, commandRuntime) {
                         // must never survive to brick the next boot.
                         let notAPlugin = false;
                         let removedBroken = [];
+                        let conflicts = [];
                         if (result.exitCode === 0 && !result.timedOut && !cancelled) {
                             const validated = await validateAddedPlugins(runPlugin, config.profile, before, activeProfileDir);
                             removedBroken = validated.removedBroken;
+                            conflicts = validated.conflicts;
                             if (removedBroken.length > 0) {
                                 logEvent('warn', 'install', `${target}: removed uninstallable pieces (no dsh manifest or missing build artifacts): ${removedBroken.join(', ')}`);
                             }
@@ -1208,11 +1210,15 @@ export function mountMarketRoutes(host, config, commandRuntime) {
                             // Blocked build scripts are expected (pnpm >= 10 blocks them by
                             // default): surface the approve-builds banner instead of scaring
                             // the user with pnpm's raw stack.
-                            error: notAPlugin
-                                ? 'nothing installable: the plugin(s) need a build step (blocked by default, see allowBuilds) or ship no prebuilt artifacts / 没有可安装的内容：插件需要构建授权（allowBuilds，默认拦截）或未附带构建产物，详见导出日志'
-                                : Array.isArray(ignoredBuilds) && ignoredBuilds.length > 0
-                                    ? `构建脚本被 pnpm 默认拦截（${ignoredBuilds.join(', ')}），请点击上方按钮放行后重试 / build scripts are blocked by pnpm by default (${ignoredBuilds.join(', ')}); click "Allow build scripts and retry" above`
-                                    : undefined,
+                            // A loader-id clash is the most actionable failure of all: the
+                            // plugin is fine, it just cannot coexist with this profile (#122).
+                            error: conflicts.length > 0
+                                ? `「${conflicts[0].name}」与已安装的「${conflicts[0].owner}」使用了相同的 loader 条目 id（${[...new Set(conflicts.map(hit => hit.id))].join(', ')}），两者无法在同一个 profile 共存——装上会导致 DSH 下次启动失败，因此已自动移除。这类插件（例如终端 TUI 插件）请装到单独的 profile。 / "${conflicts[0].name}" declares the same loader entry id(s) as the installed "${conflicts[0].owner}" (${[...new Set(conflicts.map(hit => hit.id))].join(', ')}); they cannot coexist in one profile — keeping it would stop DSH from starting, so it was removed. Install this kind of plugin (e.g. a terminal TUI bundle) into its own profile.`
+                                : notAPlugin
+                                    ? 'nothing installable: the plugin(s) need a build step (blocked by default, see allowBuilds) or ship no prebuilt artifacts / 没有可安装的内容：插件需要构建授权（allowBuilds，默认拦截）或未附带构建产物，详见导出日志'
+                                    : Array.isArray(ignoredBuilds) && ignoredBuilds.length > 0
+                                        ? `构建脚本被 pnpm 默认拦截（${ignoredBuilds.join(', ')}），请点击上方按钮放行后重试 / build scripts are blocked by pnpm by default (${ignoredBuilds.join(', ')}); click "Allow build scripts and retry" above`
+                                        : undefined,
                             exitCode: result.exitCode,
                             timedOut: result.timedOut,
                             stdout: result.stdout,

package/lib/store.js

@@ -0,0 +1,91 @@
+/**
+ * pnpm store hygiene: reclaim staging directories orphaned by aborted runs.
+ *
+ * pnpm extracts every fetched tarball under the store's `tmp/` directory as
+ * `tmp/_tmp_<pid>_<hex>/`. A run that is killed, cancelled, or timed out —
+ * or one that hard-fails mid-fetch — never finishes that staging step, so
+ * the directory survives. For `github:` sources the staged payload is the
+ * WHOLE repository tarball, so a single aborted install can leave hundreds
+ * of megabytes behind (e.g. an OpenViking monorepo install killed at ~88MB).
+ *
+ * The directory name carries the owning pnpm process id, which makes
+ * reclamation safe by construction: when that pid is gone, no live download
+ * can be using the directory. Live pnpm tmp dirs are never touched.
+ */
+import { readdirSync, rmSync } from 'node:fs';
+import { isAbsolute, join } from 'node:path';
+import { logEvent } from './log.js';
+/** pnpm store tmp staging prefix: `_tmp_<pid>_<random-hex>/`. */
+const ORPHAN_TMP_RE = /^_tmp_(\d+)_/;
+/** True when the process with this pid is still running (EPERM = exists). */
+function pidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}
+/**
+ * Remove every orphaned staging directory under a pnpm store's `tmp/` whose
+ * owning pid is no longer alive. Directories that do not match the pnpm
+ * staging shape, and any that are locked or in use, are left alone.
+ * @param storePath - the pnpm store root (as printed by `pnpm store path`).
+ * @returns the removed directory names.
+ */
+export function cleanOrphanedStoreTmp(storePath) {
+    const tmp = join(storePath, 'tmp');
+    let entries;
+    try {
+        entries = readdirSync(tmp, { withFileTypes: true });
+    }
+    catch {
+        return []; // no store tmp dir — nothing to reclaim
+    }
+    const removed = [];
+    for (const entry of entries) {
+        if (!entry.isDirectory())
+            continue;
+        const m = ORPHAN_TMP_RE.exec(entry.name);
+        if (m === null)
+            continue;
+        const pid = Number(m[1]);
+        if (pid > 0 && pidAlive(pid))
+            continue;
+        try {
+            rmSync(join(tmp, entry.name), { recursive: true, force: true });
+            removed.push(entry.name);
+        }
+        catch {
+            // Locked or still being written — leave it for a later run.
+        }
+    }
+    return removed;
+}
+/**
+ * Resolve the active profile's pnpm store root through the same runner the
+ * market uses for installs (so both the web and Desktop pnpm paths agree)
+ * and reclaim its orphaned staging directories.
+ * @returns the removed directory names, empty when the store cannot be resolved.
+ */
+export async function cleanOrphanedStore(run, profile) {
+    let result;
+    try {
+        result = await run(profile, ['store', 'path']);
+    }
+    catch {
+        return [];
+    }
+    if (result.exitCode !== 0 || result.cancelled)
+        return [];
+    const lines = result.stdout.split('\n').map(line => line.trim()).filter(line => line !== '');
+    const storePath = lines[lines.length - 1] ?? '';
+    if (storePath === '' || !isAbsolute(storePath))
+        return [];
+    const removed = cleanOrphanedStoreTmp(storePath);
+    if (removed.length > 0) {
+        logEvent('info', 'install', `removed ${removed.length} orphaned pnpm store tmp dir(s) under ${storePath}: ${removed.slice(0, 3).join(', ')}${removed.length > 3 ? ', …' : ''}`);
+    }
+    return removed;
+}

package/lib/types/install.d.ts

@@ -8,7 +8,15 @@ import type { InstallResult, PluginRunner } from './dsh-cli.ts';
 /** One-shot bypass for pnpm's fresh-release hold; scoped to a single command. */
 export declare const RELEASE_AGE_OVERRIDE = "--config.minimumReleaseAge=0";
 /**
- * Run one plugin command with automatic recovery from two known pnpm traps:
+ * Longer per-request fetch timeout for one retried command. pnpm's default
+ * 60-second limit aborts large tarball downloads (github: sources fetch the
+ * WHOLE repo even for a `#path:` subdirectory plugin) on slow networks; a
+ * plain retry fails again at the same limit, so the recovery re-runs with
+ * this override once. Scoped to a single command like RELEASE_AGE_OVERRIDE.
+ */
+export declare const FETCH_TIMEOUT_OVERRIDE = "--config.fetchTimeout=600000";
+/**
+ * Run one plugin command with automatic recovery from three known pnpm traps:
  *
  * - pnpm-major drift (#20 bug 2): a modules directory built by a different
  *   pnpm major fails mutation; pnpm's documented remedy is one `install` to
@@ -18,6 +26,10 @@ export declare const RELEASE_AGE_OVERRIDE = "--config.minimumReleaseAge=0";
  *   retry once with the one-shot minimumReleaseAge bypass (safe: the young
  *   package is already installed; the bypass only lets pnpm touch the
  *   lockfile again).
+ * - per-request fetch timeout: large tarballs (github: sources fetch the
+ *   whole repo even for a `#path:` subdirectory) on slow networks blow
+ *   pnpm's default 60-second limit; a plain retry fails again at the same
+ *   limit, so retry once with a longer fetchTimeout.
  *
  * Any recognized failure that survives gets its bilingual explanation
  * appended to stderr so the UI shows an actionable message instead of a
@@ -38,11 +50,22 @@ export declare function retargetCollections(run: PluginRunner, profile: string,
  * piece without a dsh manifest or without its declared entry artifact
  * (source-only checkout, build blocked by pnpm allowBuilds) would brick the
  * next boot, so it is removed on the spot.
- * @returns names kept and names removed as broken.
+ *
+ * Since #122 this also covers duplicate loader entry ids: cordis refuses to
+ * load a tree containing two entries with one id, so a TUI bundle landing in
+ * a web profile (both declare `id: storage`) leaves DSH unable to START —
+ * an error naming neither plugin, from which the market's own page is
+ * unreachable. Such a package is removed like any other bricking piece.
+ * @returns names kept, names removed as broken, and the id conflicts found.
  */
 export declare function validateAddedPlugins(run: PluginRunner, profile: string, before: Set<string>, explicitDir?: string): Promise<{
     keep: string[];
     removedBroken: string[];
+    conflicts: {
+        name: string;
+        id: string;
+        owner: string;
+    }[];
 }>;
 /**
  * Whether a clean-exit update actually changed nothing — pnpm's

package/lib/types/pnpm-compat.d.ts

@@ -25,7 +25,7 @@
 export declare function pluginArgsFor(profileDir: string, pluginArgs: string[]): string[];
 /** One recognized pnpm failure, with a bilingual explanation for the UI. */
 export interface PnpmFailure {
-    code: 'adding-to-root' | 'not-a-workspace' | 'hoist-pattern-diff' | 'pnpm-missing' | 'release-age-violation' | 'ignored-builds' | 'git-prepare-not-allowed' | 'fetch-404' | 'transient-network';
+    code: 'adding-to-root' | 'not-a-workspace' | 'hoist-pattern-diff' | 'pnpm-missing' | 'release-age-violation' | 'ignored-builds' | 'git-prepare-not-allowed' | 'fetch-404' | 'transient-network' | 'fetch-timeout';
     /** Bilingual, actionable message shown to the user instead of the raw wall of text. */
     message: string;
     /** True when re-running `pnpm install` in the profile is the documented recovery. */
@@ -38,6 +38,17 @@ export interface PnpmFailure {
  * deliberately absent: retrying those just doubles the wait for bad news.
  */
 export declare function isTransientPnpmFailure(output: string): boolean;
+/**
+ * pnpm's per-request fetch timeout: the abort surfaces as a DOMException
+ * ("The operation was aborted due to timeout", code 23) through undici —
+ * pnpm logs it as `GET … error (23)` before giving up. This is the failure
+ * shape for large tarballs (github: sources download the WHOLE repo, even
+ * for a `#path:` subdirectory plugin) on slow networks: pnpm's default
+ * 60-second limit is simply not enough, so a plain retry fails again at the
+ * same limit. The market's recovery re-runs once with a longer
+ * fetchTimeout (see withHoistRecovery).
+ */
+export declare function isFetchTimeoutFailure(output: string): boolean;
 /**
  * Map a failed pnpm run's combined output to a known failure mode.
  *

package/lib/types/profile.d.ts

@@ -49,6 +49,29 @@ export declare function entryArtifactExists(dir: string): boolean;
  * bundle bring in" any name row counts.
  */
 export declare function bundlePatchTargets(dir: string): string[];
+/**
+ * Loader entry ids a bundle patch inserts. Cordis refuses to boot a tree
+ * with a duplicate entry id ("duplicate loader entry id: storage", #122), so
+ * these are what two bundles can collide on.
+ */
+export declare function bundlePatchEntryIds(dir: string): string[];
+/** The profile manifest's `dsh.profile.bundles` — what the CLI reconciled. */
+export declare function readProfileBundles(profileDirectory: string): string[];
+/**
+ * Loader entry ids a newly added package would collide on with bundles the
+ * profile ALREADY loads (#122).
+ *
+ * Cordis hard-fails the whole tree on a duplicate id, so this is not a
+ * cosmetic conflict: installing a TUI bundle into a web profile (both
+ * declare `id: storage`) leaves DSH unable to start at all, with an error
+ * naming neither plugin. Checked against the profile's own bundle list so a
+ * package is never compared with itself.
+ * @returns colliding ids mapped to the already-installed bundle that owns them.
+ */
+export declare function conflictingEntryIds(profileDirectory: string, candidate: string, installedBundles: readonly string[]): {
+    id: string;
+    owner: string;
+}[];
 /**
  * Whether the loader has anything to load for this package: its own entry
  * artifact, or — for CARRIER bundles — patch rows naming other packages that

package/lib/types/store.d.ts

@@ -0,0 +1,30 @@
+/**
+ * pnpm store hygiene: reclaim staging directories orphaned by aborted runs.
+ *
+ * pnpm extracts every fetched tarball under the store's `tmp/` directory as
+ * `tmp/_tmp_<pid>_<hex>/`. A run that is killed, cancelled, or timed out —
+ * or one that hard-fails mid-fetch — never finishes that staging step, so
+ * the directory survives. For `github:` sources the staged payload is the
+ * WHOLE repository tarball, so a single aborted install can leave hundreds
+ * of megabytes behind (e.g. an OpenViking monorepo install killed at ~88MB).
+ *
+ * The directory name carries the owning pnpm process id, which makes
+ * reclamation safe by construction: when that pid is gone, no live download
+ * can be using the directory. Live pnpm tmp dirs are never touched.
+ */
+import type { PluginRunner } from './dsh-cli.ts';
+/**
+ * Remove every orphaned staging directory under a pnpm store's `tmp/` whose
+ * owning pid is no longer alive. Directories that do not match the pnpm
+ * staging shape, and any that are locked or in use, are left alone.
+ * @param storePath - the pnpm store root (as printed by `pnpm store path`).
+ * @returns the removed directory names.
+ */
+export declare function cleanOrphanedStoreTmp(storePath: string): string[];
+/**
+ * Resolve the active profile's pnpm store root through the same runner the
+ * market uses for installs (so both the web and Desktop pnpm paths agree)
+ * and reclaim its orphaned staging directories.
+ * @returns the removed directory names, empty when the store cannot be resolved.
+ */
+export declare function cleanOrphanedStore(run: PluginRunner, profile: string): Promise<string[]>;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.10.0",
+  "version": "1.10.1",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/install.ts

@@ -9,14 +9,24 @@ import { existsSync } from 'node:fs'
 import { join } from 'node:path'
 import type { InstallResult, PluginRunner } from './dsh-cli.ts'
 import { classifyPnpmFailure, isTransientPnpmFailure } from './pnpm-compat.ts'
-import { hasDshManifest, hasLoadableEntry, pluginSubdirs, profileDir, readInstalled } from './profile.ts'
+import { conflictingEntryIds, hasDshManifest, hasLoadableEntry, pluginSubdirs, profileDir, readInstalled, readProfileBundles } from './profile.ts'
 import { logEvent } from './log.ts'
+import { cleanOrphanedStore } from './store.ts'
 
 /** One-shot bypass for pnpm's fresh-release hold; scoped to a single command. */
 export const RELEASE_AGE_OVERRIDE = '--config.minimumReleaseAge=0'
 
 /**
- * Run one plugin command with automatic recovery from two known pnpm traps:
+ * Longer per-request fetch timeout for one retried command. pnpm's default
+ * 60-second limit aborts large tarball downloads (github: sources fetch the
+ * WHOLE repo even for a `#path:` subdirectory plugin) on slow networks; a
+ * plain retry fails again at the same limit, so the recovery re-runs with
+ * this override once. Scoped to a single command like RELEASE_AGE_OVERRIDE.
+ */
+export const FETCH_TIMEOUT_OVERRIDE = '--config.fetchTimeout=600000'
+
+/**
+ * Run one plugin command with automatic recovery from three known pnpm traps:
  *
  * - pnpm-major drift (#20 bug 2): a modules directory built by a different
  *   pnpm major fails mutation; pnpm's documented remedy is one `install` to
@@ -26,6 +36,10 @@ export const RELEASE_AGE_OVERRIDE = '--config.minimumReleaseAge=0'
  *   retry once with the one-shot minimumReleaseAge bypass (safe: the young
  *   package is already installed; the bypass only lets pnpm touch the
  *   lockfile again).
+ * - per-request fetch timeout: large tarballs (github: sources fetch the
+ *   whole repo even for a `#path:` subdirectory) on slow networks blow
+ *   pnpm's default 60-second limit; a plain retry fails again at the same
+ *   limit, so retry once with a longer fetchTimeout.
  *
  * Any recognized failure that survives gets its bilingual explanation
  * appended to stderr so the UI shows an actionable message instead of a
@@ -58,9 +72,25 @@ export async function withHoistRecovery(run: PluginRunner, profile: string, plug
       // Do that retry ourselves instead of reporting a false failure.
       logEvent('warn', 'install', `transient network failure while pnpm replayed the dependency tree (#83) — retrying once`)
       result = await run(profile, pluginArgs)
+    } else if (
+      failure?.code === 'fetch-timeout'
+      && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')
+      && !pluginArgs.includes(FETCH_TIMEOUT_OVERRIDE)
+    ) {
+      // Large tarball / slow network: pnpm's default 60s per-request limit
+      // aborted the download. A plain retry fails again at the same limit,
+      // so retry once with a longer fetchTimeout.
+      logEvent('warn', 'install', `pnpm's per-request fetch timeout aborted a large download — retrying once with ${FETCH_TIMEOUT_OVERRIDE}`)
+      result = await run(profile, [pluginArgs[0], FETCH_TIMEOUT_OVERRIDE, ...pluginArgs.slice(1)])
     }
   }
   if (!ok(result) && !result.cancelled) {
+    // A failed, timed-out, or killed run never finishes pnpm's staging, so
+    // its store tmp dirs (the WHOLE repo tarball for github: sources) are
+    // orphaned — reclaim them now that no pnpm is running. Safe by
+    // construction: directories are only removed when their owning pid is
+    // gone (the name carries it), so a live download is never touched.
+    await cleanOrphanedStore(run, profile)
     const failure = classifyPnpmFailure(`${result.stderr}\n${result.stdout}`)
     if (failure !== null) result = { ...result, stderr: `${result.stderr}\n\n${failure.message}` }
   }
@@ -113,27 +143,47 @@ export async function retargetCollections(
  * piece without a dsh manifest or without its declared entry artifact
  * (source-only checkout, build blocked by pnpm allowBuilds) would brick the
  * next boot, so it is removed on the spot.
- * @returns names kept and names removed as broken.
+ *
+ * Since #122 this also covers duplicate loader entry ids: cordis refuses to
+ * load a tree containing two entries with one id, so a TUI bundle landing in
+ * a web profile (both declare `id: storage`) leaves DSH unable to START —
+ * an error naming neither plugin, from which the market's own page is
+ * unreachable. Such a package is removed like any other bricking piece.
+ * @returns names kept, names removed as broken, and the id conflicts found.
  */
 export async function validateAddedPlugins(
   run: PluginRunner, profile: string, before: Set<string>, explicitDir?: string,
-): Promise<{ keep: string[]; removedBroken: string[] }> {
+): Promise<{ keep: string[]; removedBroken: string[]; conflicts: { name: string; id: string; owner: string }[] }> {
   const dir = profileDir(profile, explicitDir)
   const addedNow = Object.keys(readInstalled(profile, dir)).filter(n => !before.has(n))
   const keep: string[] = []
   const removedBroken: string[] = []
+  const conflicts: { name: string; id: string; owner: string }[] = []
+  // Compare against what the profile already loads, minus this install's own
+  // additions — two pieces of one plugin are not "already installed".
+  const existingBundles = readProfileBundles(dir).filter(name => !addedNow.includes(name))
   for (const n of addedNow) {
     const packageDir = join(dir, 'node_modules', n)
     // hasLoadableEntry, not entryArtifactExists: carrier bundles legitimately
     // ship no entry of their own (#103) and must not be uninstalled here.
-    if (hasDshManifest(packageDir) && hasLoadableEntry(dir, n)) {
-      keep.push(n)
-    } else {
+    if (!hasDshManifest(packageDir) || !hasLoadableEntry(dir, n)) {
+      removedBroken.push(n)
+      await run(profile, ['remove', n])
+      continue
+    }
+    const clash = conflictingEntryIds(dir, n, existingBundles)
+    if (clash.length > 0) {
+      // Keeping it would make the NEXT BOOT fail outright (#122).
+      conflicts.push(...clash.map(hit => ({ name: n, ...hit })))
       removedBroken.push(n)
+      logEvent('error', 'install',
+        `${n}: loader entry id conflict with ${clash[0].owner} (${clash.map(hit => hit.id).join(', ')}) — removing, it would break the next boot`)
       await run(profile, ['remove', n])
+      continue
     }
+    keep.push(n)
   }
-  return { keep, removedBroken }
+  return { keep, removedBroken, conflicts }
 }
 
 /**

package/src/pnpm-compat.ts

@@ -36,7 +36,7 @@ export function pluginArgsFor(profileDir: string, pluginArgs: string[]): string[
 /** One recognized pnpm failure, with a bilingual explanation for the UI. */
 export interface PnpmFailure {
   code: 'adding-to-root' | 'not-a-workspace' | 'hoist-pattern-diff' | 'pnpm-missing' | 'release-age-violation'
-    | 'ignored-builds' | 'git-prepare-not-allowed' | 'fetch-404' | 'transient-network'
+    | 'ignored-builds' | 'git-prepare-not-allowed' | 'fetch-404' | 'transient-network' | 'fetch-timeout'
   /** Bilingual, actionable message shown to the user instead of the raw wall of text. */
   message: string
   /** True when re-running `pnpm install` in the profile is the documented recovery. */
@@ -53,6 +53,20 @@ export function isTransientPnpmFailure(output: string): boolean {
   return /ERR_PNPM_FETCH_5\d\d|ERR_PNPM_META_FETCH_FAIL|FetchError|ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENETUNREACH|socket hang up|network timeout/i.test(output)
 }
 
+/**
+ * pnpm's per-request fetch timeout: the abort surfaces as a DOMException
+ * ("The operation was aborted due to timeout", code 23) through undici —
+ * pnpm logs it as `GET … error (23)` before giving up. This is the failure
+ * shape for large tarballs (github: sources download the WHOLE repo, even
+ * for a `#path:` subdirectory plugin) on slow networks: pnpm's default
+ * 60-second limit is simply not enough, so a plain retry fails again at the
+ * same limit. The market's recovery re-runs once with a longer
+ * fetchTimeout (see withHoistRecovery).
+ */
+export function isFetchTimeoutFailure(output: string): boolean {
+  return /operation was aborted due to timeout|TimeoutError|error \(23\)/i.test(output)
+}
+
 /**
  * Map a failed pnpm run's combined output to a known failure mode.
  *
@@ -147,6 +161,17 @@ export function classifyPnpmFailure(output: string): PnpmFailure | null {
       message: '拉取依赖时网络临时失败（不一定是你正在装的插件——安装会重放整个依赖树，任何一个既有依赖抖动都会中断）。已自动重试一次仍失败，请稍后再试 / a transient network failure while fetching dependencies (not necessarily the plugin you are installing — installs replay the whole dependency tree, so any existing dependency can hiccup); one automatic retry failed too — please try again shortly',
     }
   }
+  // pnpm's per-request fetch timeout (#…): large tarballs (github: sources
+  // fetch the whole repo even for a `#path:` subdirectory) on slow networks
+  // blow pnpm's default 60s limit. A plain retry fails again at the same
+  // limit, so withHoistRecovery retries with a longer fetchTimeout.
+  if (isFetchTimeoutFailure(output)) {
+    return {
+      code: 'fetch-timeout',
+      recoverable: false,
+      message: '下载超时：这个插件的安装包较大（github 源会下载整个仓库）或网络较慢，pnpm 默认的单次请求 60 秒限制不够用。市场已用更长的超时自动重试一次；若仍失败，请稍后再试或检查网络 / download timed out: this plugin ships a large tarball (github sources download the whole repository) or your network is slow, and pnpm\'s default 60-second per-request limit was not enough; the market retries once with a longer timeout — if it still fails, try again later or check the network',
+    }
+  }
   if (output.includes('pnpm not found on PATH')) {
     return {
       code: 'pnpm-missing',

package/src/profile.ts

@@ -162,25 +162,88 @@ export function entryArtifactExists(dir: string): boolean {
  * bundle bring in" any name row counts.
  */
 export function bundlePatchTargets(dir: string): string[] {
+  return readBundlePatchRows(dir).names
+}
+
+/**
+ * Loader entry ids a bundle patch inserts. Cordis refuses to boot a tree
+ * with a duplicate entry id ("duplicate loader entry id: storage", #122), so
+ * these are what two bundles can collide on.
+ */
+export function bundlePatchEntryIds(dir: string): string[] {
+  return readBundlePatchRows(dir).ids
+}
+
+/**
+ * `name:` and `id:` rows of the package's declared bundle patch. Line-wise
+ * on purpose: the strict hot-mount parser rejects config/expression rows,
+ * but for "what does this bundle bring in" any row counts.
+ */
+function readBundlePatchRows(dir: string): { names: string[]; ids: string[] } {
   let patchPath: string
   try {
     const manifest = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')) as {
       dsh?: { bundle?: { patch?: unknown } }
     }
     const declared = manifest.dsh?.bundle?.patch
-    if (typeof declared !== 'string' || declared === '') return []
+    if (typeof declared !== 'string' || declared === '') return { names: [], ids: [] }
     patchPath = join(dir, declared)
   } catch {
-    return []
+    return { names: [], ids: [] }
   }
   const names: string[] = []
+  const ids: string[] = []
   try {
     for (const line of readFileSync(patchPath, 'utf8').split('\n')) {
-      const m = /^\s*name:\s*['"]?([^'"\s]+)/.exec(line)
-      if (m !== null && !names.includes(m[1])) names.push(m[1])
+      const name = /^\s*-?\s*name:\s*['"]?([^'"\s]+)/.exec(line)
+      if (name !== null && !names.includes(name[1])) names.push(name[1])
+      const id = /^\s*-?\s*id:\s*['"]?([^'"\s]+)/.exec(line)
+      if (id !== null && !ids.includes(id[1])) ids.push(id[1])
     }
-  } catch { /* unreadable patch — no targets */ }
-  return names
+  } catch { /* unreadable patch — nothing to report */ }
+  return { names, ids }
+}
+
+/** The profile manifest's `dsh.profile.bundles` — what the CLI reconciled. */
+export function readProfileBundles(profileDirectory: string): string[] {
+  try {
+    const manifest = JSON.parse(readFileSync(join(profileDirectory, 'package.json'), 'utf8')) as {
+      dsh?: { profile?: { bundles?: unknown } }
+    }
+    const bundles = manifest.dsh?.profile?.bundles
+    return Array.isArray(bundles) ? bundles.filter((name): name is string => typeof name === 'string') : []
+  } catch {
+    return []
+  }
+}
+
+/**
+ * Loader entry ids a newly added package would collide on with bundles the
+ * profile ALREADY loads (#122).
+ *
+ * Cordis hard-fails the whole tree on a duplicate id, so this is not a
+ * cosmetic conflict: installing a TUI bundle into a web profile (both
+ * declare `id: storage`) leaves DSH unable to start at all, with an error
+ * naming neither plugin. Checked against the profile's own bundle list so a
+ * package is never compared with itself.
+ * @returns colliding ids mapped to the already-installed bundle that owns them.
+ */
+export function conflictingEntryIds(
+  profileDirectory: string,
+  candidate: string,
+  installedBundles: readonly string[],
+): { id: string; owner: string }[] {
+  const mine = bundlePatchEntryIds(join(profileDirectory, 'node_modules', candidate))
+  if (mine.length === 0) return []
+  const conflicts: { id: string; owner: string }[] = []
+  for (const bundle of installedBundles) {
+    if (bundle === candidate) continue
+    const theirs = new Set(bundlePatchEntryIds(join(profileDirectory, 'node_modules', bundle)))
+    for (const id of mine) {
+      if (theirs.has(id) && !conflicts.some(hit => hit.id === id)) conflicts.push({ id, owner: bundle })
+    }
+  }
+  return conflicts
 }
 
 /**

package/src/routes.ts

@@ -1177,9 +1177,11 @@ export function mountMarketRoutes(
             // must never survive to brick the next boot.
             let notAPlugin = false
             let removedBroken: string[] = []
+            let conflicts: { name: string; id: string; owner: string }[] = []
             if (result.exitCode === 0 && !result.timedOut && !cancelled) {
               const validated = await validateAddedPlugins(runPlugin, config.profile, before, activeProfileDir)
               removedBroken = validated.removedBroken
+              conflicts = validated.conflicts
               if (removedBroken.length > 0) {
                 logEvent('warn', 'install', `${target}: removed uninstallable pieces (no dsh manifest or missing build artifacts): ${removedBroken.join(', ')}`)
               }
@@ -1234,9 +1236,13 @@ export function mountMarketRoutes(
               // Blocked build scripts are expected (pnpm >= 10 blocks them by
               // default): surface the approve-builds banner instead of scaring
               // the user with pnpm's raw stack.
-              error: notAPlugin
-                ? 'nothing installable: the plugin(s) need a build step (blocked by default, see allowBuilds) or ship no prebuilt artifacts / 没有可安装的内容：插件需要构建授权（allowBuilds，默认拦截）或未附带构建产物，详见导出日志'
-                : Array.isArray(ignoredBuilds) && ignoredBuilds.length > 0
+              // A loader-id clash is the most actionable failure of all: the
+              // plugin is fine, it just cannot coexist with this profile (#122).
+              error: conflicts.length > 0
+                ? `「${conflicts[0].name}」与已安装的「${conflicts[0].owner}」使用了相同的 loader 条目 id（${[...new Set(conflicts.map(hit => hit.id))].join(', ')}），两者无法在同一个 profile 共存——装上会导致 DSH 下次启动失败，因此已自动移除。这类插件（例如终端 TUI 插件）请装到单独的 profile。 / "${conflicts[0].name}" declares the same loader entry id(s) as the installed "${conflicts[0].owner}" (${[...new Set(conflicts.map(hit => hit.id))].join(', ')}); they cannot coexist in one profile — keeping it would stop DSH from starting, so it was removed. Install this kind of plugin (e.g. a terminal TUI bundle) into its own profile.`
+                : notAPlugin
+                  ? 'nothing installable: the plugin(s) need a build step (blocked by default, see allowBuilds) or ship no prebuilt artifacts / 没有可安装的内容：插件需要构建授权（allowBuilds，默认拦截）或未附带构建产物，详见导出日志'
+                  : Array.isArray(ignoredBuilds) && ignoredBuilds.length > 0
                   ? `构建脚本被 pnpm 默认拦截（${ignoredBuilds.join(', ')}），请点击上方按钮放行后重试 / build scripts are blocked by pnpm by default (${ignoredBuilds.join(', ')}); click "Allow build scripts and retry" above`
                   : undefined,
               exitCode: result.exitCode,

package/src/store.ts

@@ -0,0 +1,89 @@
+/**
+ * pnpm store hygiene: reclaim staging directories orphaned by aborted runs.
+ *
+ * pnpm extracts every fetched tarball under the store's `tmp/` directory as
+ * `tmp/_tmp_<pid>_<hex>/`. A run that is killed, cancelled, or timed out —
+ * or one that hard-fails mid-fetch — never finishes that staging step, so
+ * the directory survives. For `github:` sources the staged payload is the
+ * WHOLE repository tarball, so a single aborted install can leave hundreds
+ * of megabytes behind (e.g. an OpenViking monorepo install killed at ~88MB).
+ *
+ * The directory name carries the owning pnpm process id, which makes
+ * reclamation safe by construction: when that pid is gone, no live download
+ * can be using the directory. Live pnpm tmp dirs are never touched.
+ */
+
+import { readdirSync, rmSync, type Dirent } from 'node:fs'
+import { isAbsolute, join } from 'node:path'
+import type { InstallResult, PluginRunner } from './dsh-cli.ts'
+import { logEvent } from './log.ts'
+
+/** pnpm store tmp staging prefix: `_tmp_<pid>_<random-hex>/`. */
+const ORPHAN_TMP_RE = /^_tmp_(\d+)_/
+
+/** True when the process with this pid is still running (EPERM = exists). */
+function pidAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === 'EPERM'
+  }
+}
+
+/**
+ * Remove every orphaned staging directory under a pnpm store's `tmp/` whose
+ * owning pid is no longer alive. Directories that do not match the pnpm
+ * staging shape, and any that are locked or in use, are left alone.
+ * @param storePath - the pnpm store root (as printed by `pnpm store path`).
+ * @returns the removed directory names.
+ */
+export function cleanOrphanedStoreTmp(storePath: string): string[] {
+  const tmp = join(storePath, 'tmp')
+  let entries: Dirent[]
+  try {
+    entries = readdirSync(tmp, { withFileTypes: true })
+  } catch {
+    return [] // no store tmp dir — nothing to reclaim
+  }
+  const removed: string[] = []
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue
+    const m = ORPHAN_TMP_RE.exec(entry.name)
+    if (m === null) continue
+    const pid = Number(m[1])
+    if (pid > 0 && pidAlive(pid)) continue
+    try {
+      rmSync(join(tmp, entry.name), { recursive: true, force: true })
+      removed.push(entry.name)
+    } catch {
+      // Locked or still being written — leave it for a later run.
+    }
+  }
+  return removed
+}
+
+/**
+ * Resolve the active profile's pnpm store root through the same runner the
+ * market uses for installs (so both the web and Desktop pnpm paths agree)
+ * and reclaim its orphaned staging directories.
+ * @returns the removed directory names, empty when the store cannot be resolved.
+ */
+export async function cleanOrphanedStore(run: PluginRunner, profile: string): Promise<string[]> {
+  let result: InstallResult
+  try {
+    result = await run(profile, ['store', 'path'])
+  } catch {
+    return []
+  }
+  if (result.exitCode !== 0 || result.cancelled) return []
+  const lines = result.stdout.split('\n').map(line => line.trim()).filter(line => line !== '')
+  const storePath = lines[lines.length - 1] ?? ''
+  if (storePath === '' || !isAbsolute(storePath)) return []
+  const removed = cleanOrphanedStoreTmp(storePath)
+  if (removed.length > 0) {
+    logEvent('info', 'install',
+      `removed ${removed.length} orphaned pnpm store tmp dir(s) under ${storePath}: ${removed.slice(0, 3).join(', ')}${removed.length > 3 ? ', …' : ''}`)
+  }
+  return removed
+}