dshmarket 1.19.0 → 1.19.1

package/lib/install.js

@@ -6,8 +6,8 @@
  */
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
-import { classifyPnpmFailure } from './pnpm-compat.js';
-import { conflictingEntryIds, hasDshManifest, hasLoadableEntry, pluginSubdirs, profileDir, readInstalled, readProfileBundles } from './profile.js';
+import { classifyPnpmFailure, HOST_NAMESPACE_RE } from './pnpm-compat.js';
+import { conflictingEntryIds, hasDshManifest, hasLoadableEntry, pluginSubdirs, profileDir, readInstalled, readManifestDeps, readProfileBundles } from './profile.js';
 import { logEvent } from './log.js';
 import { cleanOrphanedStore } from './store.js';
 /** One-shot bypass for pnpm's fresh-release hold; scoped to a single command. */
@@ -20,6 +20,44 @@ export const RELEASE_AGE_OVERRIDE = '--config.minimumReleaseAge=0';
  * this override once. Scoped to a single command like RELEASE_AGE_OVERRIDE.
  */
 export const FETCH_TIMEOUT_OVERRIDE = '--config.fetchTimeout=600000';
+/**
+ * Stop pnpm downloading a plugin's peer dependencies (#289 by @00080000).
+ *
+ * The last resort for a peer that cannot be downloaded because it does not
+ * exist on any registry: the dsh runtime injects several `@deepseek-ai/*`
+ * packages and never publishes them, and since pnpm 8 `auto-install-peers`
+ * defaults on, so pnpm walks the peer list and 404s on one.
+ *
+ * Only on the retry, never by default. Turning it off wholesale would also
+ * stop pnpm installing the peers a plugin legitimately needs from npm, and
+ * that failure would surface much later — as a missing module at runtime
+ * rather than a clear error at install time. Narrow beats early here.
+ *
+ * Verified against pnpm 10.29.3: `peerDependencyRules.ignoreMissing` does
+ * NOT prevent the fetch (it only silences the warning), so this flag is the
+ * only lever that actually works.
+ */
+export const AUTO_INSTALL_PEERS_OFF = '--config.auto-install-peers=false';
+/**
+ * Whether an unresolvable package is a host peer pnpm went looking for on
+ * its own, rather than something the profile actually asks for.
+ *
+ * The same 404 means two different things and wants two different answers.
+ * A `@deepseek-ai/*` package that IS in the profile manifest is a ghost
+ * entry — left by an earlier failed operation, or hand-added — and the user
+ * has to remove that line; retrying would only fail again. One that is NOT
+ * in the manifest was never asked for by anybody: pnpm reached it by walking
+ * an installed plugin's peerDependencies, which in this ecosystem name what
+ * the runtime provides rather than what npm carries.
+ *
+ * Reading the manifest is what separates them, so this cannot live in the
+ * pure classifier.
+ */
+export function isUnpublishedHostPeer(pkg, profile, explicitDir) {
+    if (pkg === undefined || !HOST_NAMESPACE_RE.test(pkg))
+        return false;
+    return !Object.hasOwn(readManifestDeps(profile, explicitDir), pkg);
+}
 /**
  * Run one plugin command with automatic recovery from three known pnpm traps:
  *
@@ -40,7 +78,7 @@ export const FETCH_TIMEOUT_OVERRIDE = '--config.fetchTimeout=600000';
  * appended to stderr so the UI shows an actionable message instead of a
  * wall of text (#20 bug 3). Cancelled runs are never recovered.
  */
-export async function withHoistRecovery(run, profile, pluginArgs) {
+export async function withHoistRecovery(run, profile, pluginArgs, profileDirectory) {
     let result = await run(profile, pluginArgs);
     const ok = (r) => r.exitCode === 0 && !r.timedOut && !r.cancelled;
     if (!ok(result) && !result.cancelled) {
@@ -59,6 +97,17 @@ export async function withHoistRecovery(run, profile, pluginArgs) {
             logEvent('warn', 'install', `a too-young release blocks pnpm's lockfile verification (#39) — retrying once with ${RELEASE_AGE_OVERRIDE}`);
             result = await run(profile, [pluginArgs[0], RELEASE_AGE_OVERRIDE, ...pluginArgs.slice(1)]);
         }
+        else if (failure?.code === 'fetch-404'
+            && isUnpublishedHostPeer(failure.pkg, profile, profileDirectory)
+            && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')
+            && !pluginArgs.includes(AUTO_INSTALL_PEERS_OFF)) {
+            // The plugin is fine; pnpm went looking for a package the host injects
+            // and npm has never carried. Every fresh profile hits this, whatever
+            // the plugin, so failing here would be failing for something the user
+            // cannot fix and did not cause.
+            logEvent('warn', 'install', `${failure.pkg ?? 'a host package'} is a peer the runtime provides and npm does not carry (#289) — retrying once with ${AUTO_INSTALL_PEERS_OFF}`);
+            result = await run(profile, [pluginArgs[0], AUTO_INSTALL_PEERS_OFF, ...pluginArgs.slice(1)]);
+        }
         else if (failure?.code === 'transient-network'
             && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')) {
             // #83: pnpm replays the whole tree, so any existing dependency's

package/lib/pnpm-compat.js

@@ -31,6 +31,14 @@ export function pluginArgsFor(profileDir, pluginArgs) {
         return pluginArgs;
     return [pluginArgs[0], '-w', ...pluginArgs.slice(1)];
 }
+/** One recognized pnpm failure, with a bilingual explanation for the UI. */
+/**
+ * The namespace whose packages the dsh runtime provides rather than npm.
+ *
+ * A peer dependency on one of these is a statement about the host, not a
+ * package to download — and several of them are never published at all.
+ */
+export const HOST_NAMESPACE_RE = /^@deepseek-ai\//;
 /**
  * Momentary network failures — worth exactly one automatic retry (#83).
  * pnpm 5xx fetch codes, its meta-fetch give-up, and the raw socket errors
@@ -159,6 +167,7 @@ export function classifyPnpmFailure(output) {
         return {
             code: 'fetch-404',
             recoverable: false,
+            pkg,
             message: `有一个依赖在 registry 上不存在${zh}，pnpm 因此拒绝任何安装操作。它可能是之前失败操作残留在 profile package.json 里的幽灵依赖（可手动删除该行），也可能是需要登录的私有包 / a dependency cannot be resolved from the registry${en}; pnpm refuses every install while it is present. It may be a ghost entry left in the profile's package.json by an earlier failed operation (remove that line by hand), or a private package needing registry credentials`,
         };
     }

package/lib/routes.js

@@ -384,7 +384,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
         }
     }
     /** Every plugin command goes through the pnpm-drift recovery wrapper (#20). */
-    const runPlugin = (profile, args) => withHoistRecovery(commands.runPlugin, profile, args);
+    const runPlugin = (profile, args) => withHoistRecovery(commands.runPlugin, profile, args, activeProfileDir);
     /**
      * Undo a clean-exit update whose new build cannot boot. Restoring only the
      * manifest pin (the original #159 behavior) leaves the bad package files

package/lib/types/install.d.ts

@@ -15,6 +15,40 @@ export declare const RELEASE_AGE_OVERRIDE = "--config.minimumReleaseAge=0";
  * this override once. Scoped to a single command like RELEASE_AGE_OVERRIDE.
  */
 export declare const FETCH_TIMEOUT_OVERRIDE = "--config.fetchTimeout=600000";
+/**
+ * Stop pnpm downloading a plugin's peer dependencies (#289 by @00080000).
+ *
+ * The last resort for a peer that cannot be downloaded because it does not
+ * exist on any registry: the dsh runtime injects several `@deepseek-ai/*`
+ * packages and never publishes them, and since pnpm 8 `auto-install-peers`
+ * defaults on, so pnpm walks the peer list and 404s on one.
+ *
+ * Only on the retry, never by default. Turning it off wholesale would also
+ * stop pnpm installing the peers a plugin legitimately needs from npm, and
+ * that failure would surface much later — as a missing module at runtime
+ * rather than a clear error at install time. Narrow beats early here.
+ *
+ * Verified against pnpm 10.29.3: `peerDependencyRules.ignoreMissing` does
+ * NOT prevent the fetch (it only silences the warning), so this flag is the
+ * only lever that actually works.
+ */
+export declare const AUTO_INSTALL_PEERS_OFF = "--config.auto-install-peers=false";
+/**
+ * Whether an unresolvable package is a host peer pnpm went looking for on
+ * its own, rather than something the profile actually asks for.
+ *
+ * The same 404 means two different things and wants two different answers.
+ * A `@deepseek-ai/*` package that IS in the profile manifest is a ghost
+ * entry — left by an earlier failed operation, or hand-added — and the user
+ * has to remove that line; retrying would only fail again. One that is NOT
+ * in the manifest was never asked for by anybody: pnpm reached it by walking
+ * an installed plugin's peerDependencies, which in this ecosystem name what
+ * the runtime provides rather than what npm carries.
+ *
+ * Reading the manifest is what separates them, so this cannot live in the
+ * pure classifier.
+ */
+export declare function isUnpublishedHostPeer(pkg: string | undefined, profile: string, explicitDir?: string): boolean;
 /**
  * Run one plugin command with automatic recovery from three known pnpm traps:
  *
@@ -35,7 +69,7 @@ export declare const FETCH_TIMEOUT_OVERRIDE = "--config.fetchTimeout=600000";
  * appended to stderr so the UI shows an actionable message instead of a
  * wall of text (#20 bug 3). Cancelled runs are never recovered.
  */
-export declare function withHoistRecovery(run: PluginRunner, profile: string, pluginArgs: string[]): Promise<InstallResult>;
+export declare function withHoistRecovery(run: PluginRunner, profile: string, pluginArgs: string[], profileDirectory?: string): Promise<InstallResult>;
 /**
  * The most specific description of a failed run available, for logs.
  *

package/lib/types/pnpm-compat.d.ts

@@ -24,12 +24,30 @@
  */
 export declare function pluginArgsFor(profileDir: string, pluginArgs: string[]): string[];
 /** One recognized pnpm failure, with a bilingual explanation for the UI. */
+/**
+ * The namespace whose packages the dsh runtime provides rather than npm.
+ *
+ * A peer dependency on one of these is a statement about the host, not a
+ * package to download — and several of them are never published at all.
+ */
+export declare const HOST_NAMESPACE_RE: RegExp;
 export interface PnpmFailure {
     code: 'adding-to-root' | 'not-a-workspace' | 'hoist-pattern-diff' | 'pnpm-missing' | 'release-age-violation' | 'ignored-builds' | 'git-prepare-not-allowed' | 'fetch-404' | 'transient-network' | 'fetch-timeout' | 'unexpected-store';
     /** Bilingual, actionable message shown to the user instead of the raw wall of text. */
     message: string;
     /** True when re-running `pnpm install` in the profile is the documented recovery. */
     recoverable: boolean;
+    /**
+     * The package pnpm could not resolve, when the failure names one.
+     *
+     * Exposed because the NAME alone does not say what went wrong: the same
+     * 404 is a ghost entry the user must delete when the package is a direct
+     * dependency of the profile, and an unpublished host peer the market can
+     * retry around when it is not (#289). Only a caller holding the profile
+     * manifest can tell those apart, so the classifier reports the fact and
+     * leaves the judgement to it.
+     */
+    pkg?: string;
 }
 /**
  * Momentary network failures — worth exactly one automatic retry (#83).

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.19.0",
+  "version": "1.19.1",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/install.ts

@@ -8,8 +8,8 @@
 import { existsSync } from 'node:fs'
 import { join } from 'node:path'
 import type { InstallResult, PluginRunner } from './dsh-cli.ts'
-import { classifyPnpmFailure, isTransientPnpmFailure } from './pnpm-compat.ts'
-import { conflictingEntryIds, hasDshManifest, hasLoadableEntry, pluginSubdirs, profileDir, readInstalled, readProfileBundles } from './profile.ts'
+import { classifyPnpmFailure, HOST_NAMESPACE_RE, isTransientPnpmFailure } from './pnpm-compat.ts'
+import { conflictingEntryIds, hasDshManifest, hasLoadableEntry, pluginSubdirs, profileDir, readInstalled, readManifestDeps, readProfileBundles } from './profile.ts'
 import { logEvent } from './log.ts'
 import { cleanOrphanedStore } from './store.ts'
 
@@ -25,6 +25,49 @@ export const RELEASE_AGE_OVERRIDE = '--config.minimumReleaseAge=0'
  */
 export const FETCH_TIMEOUT_OVERRIDE = '--config.fetchTimeout=600000'
 
+/**
+ * Stop pnpm downloading a plugin's peer dependencies (#289 by @00080000).
+ *
+ * The last resort for a peer that cannot be downloaded because it does not
+ * exist on any registry: the dsh runtime injects several `@deepseek-ai/*`
+ * packages and never publishes them, and since pnpm 8 `auto-install-peers`
+ * defaults on, so pnpm walks the peer list and 404s on one.
+ *
+ * Only on the retry, never by default. Turning it off wholesale would also
+ * stop pnpm installing the peers a plugin legitimately needs from npm, and
+ * that failure would surface much later — as a missing module at runtime
+ * rather than a clear error at install time. Narrow beats early here.
+ *
+ * Verified against pnpm 10.29.3: `peerDependencyRules.ignoreMissing` does
+ * NOT prevent the fetch (it only silences the warning), so this flag is the
+ * only lever that actually works.
+ */
+export const AUTO_INSTALL_PEERS_OFF = '--config.auto-install-peers=false'
+
+/**
+ * Whether an unresolvable package is a host peer pnpm went looking for on
+ * its own, rather than something the profile actually asks for.
+ *
+ * The same 404 means two different things and wants two different answers.
+ * A `@deepseek-ai/*` package that IS in the profile manifest is a ghost
+ * entry — left by an earlier failed operation, or hand-added — and the user
+ * has to remove that line; retrying would only fail again. One that is NOT
+ * in the manifest was never asked for by anybody: pnpm reached it by walking
+ * an installed plugin's peerDependencies, which in this ecosystem name what
+ * the runtime provides rather than what npm carries.
+ *
+ * Reading the manifest is what separates them, so this cannot live in the
+ * pure classifier.
+ */
+export function isUnpublishedHostPeer(
+  pkg: string | undefined,
+  profile: string,
+  explicitDir?: string,
+): boolean {
+  if (pkg === undefined || !HOST_NAMESPACE_RE.test(pkg)) return false
+  return !Object.hasOwn(readManifestDeps(profile, explicitDir), pkg)
+}
+
 /**
  * Run one plugin command with automatic recovery from three known pnpm traps:
  *
@@ -45,7 +88,12 @@ export const FETCH_TIMEOUT_OVERRIDE = '--config.fetchTimeout=600000'
  * appended to stderr so the UI shows an actionable message instead of a
  * wall of text (#20 bug 3). Cancelled runs are never recovered.
  */
-export async function withHoistRecovery(run: PluginRunner, profile: string, pluginArgs: string[]): Promise<InstallResult> {
+export async function withHoistRecovery(
+  run: PluginRunner,
+  profile: string,
+  pluginArgs: string[],
+  profileDirectory?: string,
+): Promise<InstallResult> {
   let result = await run(profile, pluginArgs)
   const ok = (r: InstallResult): boolean => r.exitCode === 0 && !r.timedOut && !r.cancelled
   if (!ok(result) && !result.cancelled) {
@@ -63,6 +111,18 @@ export async function withHoistRecovery(run: PluginRunner, profile: string, plug
     ) {
       logEvent('warn', 'install', `a too-young release blocks pnpm's lockfile verification (#39) — retrying once with ${RELEASE_AGE_OVERRIDE}`)
       result = await run(profile, [pluginArgs[0], RELEASE_AGE_OVERRIDE, ...pluginArgs.slice(1)])
+    } else if (
+      failure?.code === 'fetch-404'
+      && isUnpublishedHostPeer(failure.pkg, profile, profileDirectory)
+      && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')
+      && !pluginArgs.includes(AUTO_INSTALL_PEERS_OFF)
+    ) {
+      // The plugin is fine; pnpm went looking for a package the host injects
+      // and npm has never carried. Every fresh profile hits this, whatever
+      // the plugin, so failing here would be failing for something the user
+      // cannot fix and did not cause.
+      logEvent('warn', 'install', `${failure.pkg ?? 'a host package'} is a peer the runtime provides and npm does not carry (#289) — retrying once with ${AUTO_INSTALL_PEERS_OFF}`)
+      result = await run(profile, [pluginArgs[0], AUTO_INSTALL_PEERS_OFF, ...pluginArgs.slice(1)])
     } else if (
       failure?.code === 'transient-network'
       && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')

package/src/pnpm-compat.ts

@@ -34,6 +34,14 @@ export function pluginArgsFor(profileDir: string, pluginArgs: string[]): string[
 }
 
 /** One recognized pnpm failure, with a bilingual explanation for the UI. */
+/**
+ * The namespace whose packages the dsh runtime provides rather than npm.
+ *
+ * A peer dependency on one of these is a statement about the host, not a
+ * package to download — and several of them are never published at all.
+ */
+export const HOST_NAMESPACE_RE = /^@deepseek-ai\//
+
 export interface PnpmFailure {
   code: 'adding-to-root' | 'not-a-workspace' | 'hoist-pattern-diff' | 'pnpm-missing' | 'release-age-violation'
     | 'ignored-builds' | 'git-prepare-not-allowed' | 'fetch-404' | 'transient-network' | 'fetch-timeout'
@@ -42,6 +50,17 @@ export interface PnpmFailure {
   message: string
   /** True when re-running `pnpm install` in the profile is the documented recovery. */
   recoverable: boolean
+  /**
+   * The package pnpm could not resolve, when the failure names one.
+   *
+   * Exposed because the NAME alone does not say what went wrong: the same
+   * 404 is a ghost entry the user must delete when the package is a direct
+   * dependency of the profile, and an unpublished host peer the market can
+   * retry around when it is not (#289). Only a caller holding the profile
+   * manifest can tell those apart, so the classifier reports the fact and
+   * leaves the judgement to it.
+   */
+  pkg?: string
 }
 
 /**
@@ -174,6 +193,7 @@ export function classifyPnpmFailure(output: string): PnpmFailure | null {
     return {
       code: 'fetch-404',
       recoverable: false,
+      pkg,
       message: `有一个依赖在 registry 上不存在${zh}，pnpm 因此拒绝任何安装操作。它可能是之前失败操作残留在 profile package.json 里的幽灵依赖（可手动删除该行），也可能是需要登录的私有包 / a dependency cannot be resolved from the registry${en}; pnpm refuses every install while it is present. It may be a ghost entry left in the profile's package.json by an earlier failed operation (remove that line by hand), or a private package needing registry credentials`,
     }
   }

package/src/routes.ts

@@ -425,7 +425,7 @@ export function mountMarketRoutes(
   }
 
   /** Every plugin command goes through the pnpm-drift recovery wrapper (#20). */
-  const runPlugin = (profile: string, args: string[]) => withHoistRecovery(commands.runPlugin, profile, args)
+  const runPlugin = (profile: string, args: string[]) => withHoistRecovery(commands.runPlugin, profile, args, activeProfileDir)
 
   /**
    * Undo a clean-exit update whose new build cannot boot. Restoring only the