dshmarket 1.2.2 → 1.2.3

package/lib/sources.js

@@ -0,0 +1,85 @@
+/**
+ * Registry-source knowledge: how a curated registry entry's URL maps to an
+ * installable pnpm target. Pure string logic, no I/O.
+ */
+const REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+/** Registry tarball names must be plain npm package names, nothing fancier. */
+const NPM_NAME_RE = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+/**
+ * Parse a registry source url: a github repo, optionally with a
+ * `/tree/<branch>/<subpath>` suffix (how the curated list links monorepo
+ * subpackages, e.g. dsh-plugins#theme-gallery).
+ */
+export function parseSourceUrl(url) {
+    const m = /^https:\/\/github\.com\/([^/]+\/[^/]+?)(?:\/tree\/[^/]+\/(.+?))?\/?$/.exec(url);
+    if (m === null || !REPO_RE.test(m[1]))
+        return null;
+    const subpath = m[2] ?? null;
+    if (subpath !== null) {
+        if (!/^[A-Za-z0-9_./-]+$/.test(subpath))
+            return null;
+        // No empty/dot segments: `..` would escape the repo in the #path: selector.
+        if (subpath.split('/').some(seg => seg === '' || seg === '.' || seg === '..'))
+            return null;
+    }
+    return { repo: m[1], subpath };
+}
+/** GitHub `owner/repo` for a registry URL, or null when it is not a GitHub repo URL. */
+export function repoOf(url) {
+    return parseSourceUrl(url)?.repo ?? null;
+}
+/**
+ * The pnpm install target for a registry entry. Registry tarballs beat
+ * full-repo GitHub downloads: smaller, prebuilt, and CDN/mirror served. The
+ * npm name comes from our curated registry, which only maps repo-verified
+ * packages (name-squatting protection).
+ * @returns the target spec, or null when the source url is unsupported.
+ */
+export function installTargetFor(entry) {
+    const source = parseSourceUrl(entry.url);
+    if (source === null)
+        return null;
+    if (typeof entry.npm === 'string' && NPM_NAME_RE.test(entry.npm))
+        return entry.npm;
+    return source.subpath !== null
+        ? `github:${source.repo}#path:/${source.subpath}`
+        : `github:${source.repo}`;
+}
+/**
+ * The name an entry is ALREADY installed under, or null — the server-side
+ * duplicate guard (#27): the same plugin listed under an alias entry must
+ * never install twice (two loader entries with one id brick the next boot).
+ *
+ * Identity is subpath-aware so monorepo siblings stay independent: an entry
+ * with a /tree/ subpath identifies as repo#path:/sub (never the bare repo),
+ * while an installed dependency contributes its bare repo AND its #path:
+ * form — so a collection root still matches the pieces it was retargeted
+ * into, but two different subpackages of one repo never cross-match.
+ */
+export function findInstalledAlias(entry, installed) {
+    const source = parseSourceUrl(entry.url);
+    const ids = new Set([entry.name.toLowerCase()]);
+    if (typeof entry.npm === 'string' && entry.npm !== '')
+        ids.add(entry.npm.toLowerCase());
+    if (source !== null) {
+        ids.add(source.subpath === null
+            ? source.repo.toLowerCase()
+            : `${source.repo.toLowerCase()}#path:/${source.subpath.toLowerCase()}`);
+    }
+    for (const [name, spec] of Object.entries(installed)) {
+        const dep = new Set([name.toLowerCase()]);
+        const scoped = /^@([^/]+)\/(.+)$/.exec(name);
+        if (scoped !== null)
+            dep.add(`${scoped[1]}/${scoped[2]}`.toLowerCase());
+        const m = /github:([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+)(?:#path:\/([A-Za-z0-9_./-]+))?/i.exec(spec);
+        if (m !== null) {
+            dep.add(m[1].toLowerCase());
+            if (m[2] !== undefined)
+                dep.add(`${m[1].toLowerCase()}#path:/${m[2].toLowerCase()}`);
+        }
+        for (const id of dep)
+            if (ids.has(id))
+                return name;
+    }
+    return null;
+}

package/lib/themes.js

@@ -0,0 +1,102 @@
+/**
+ * Theme lifecycle: classifying installed packages as themes (by the
+ * registry's theme category), live-toggling bundle-layer entries through
+ * the loader, and keeping exactly one theme active with the choice
+ * persisted across restarts.
+ */
+import { loadRegistry } from './registry.js';
+import { hotMount, hotUnmount, listHotMounts, writeDisabledThemes } from './hot.js';
+import { logEvent } from './log.js';
+import { profileDir, readInstalled } from './profile.js';
+import { repoOf } from './sources.js';
+/**
+ * Create the theme manager. `disabledThemes` is the live, shared set of
+ * themes the user switched off — the caller owns reading it at boot and
+ * replaying it; the manager mutates and persists it on switches.
+ */
+export function createThemeManager(host, profile, disabledThemes) {
+    /** Installed package names classified as themes by the registry's theme category. */
+    async function installedThemeNames() {
+        const names = new Set();
+        try {
+            const { registry } = await loadRegistry();
+            const themeEntries = registry.plugins.filter(p => p.category === 'theme');
+            const themeNames = new Set(themeEntries.map(p => p.name));
+            const themeRepos = new Set(themeEntries.map(p => repoOf(p.url)).filter((r) => r !== null).map(r => r.toLowerCase()));
+            for (const [name, spec] of Object.entries(readInstalled(profile))) {
+                if (themeNames.has(name)) {
+                    names.add(name);
+                    continue;
+                }
+                const match = /github:([^#\s]+)/.exec(String(spec).toLowerCase());
+                if (match !== null && themeRepos.has(match[1]))
+                    names.add(name);
+            }
+        }
+        catch { /* registry unavailable — nothing classifies as a theme */ }
+        return names;
+    }
+    /**
+     * Live-toggle a bundle-layer plugin through its loader entry. Bundle trees
+     * are in-memory (write is a no-op), so this never touches any file — the
+     * market persists the choice itself and replays it at boot.
+     * @returns true when a matching live entry was found and updated.
+     */
+    async function setEntryDisabled(name, disabledFlag) {
+        let found = false;
+        for (const entry of host.loader.entries()) {
+            if (entry.options.name !== name)
+                continue;
+            // A disable can land while the entry's init is still in flight: the
+            // options flip but the finishing init brings the fiber up anyway, and a
+            // plain re-update no-ops on the empty diff. Force the update and verify
+            // the live state, retrying until reality matches the flag.
+            for (let attempt = 0; attempt < 3; attempt++) {
+                try {
+                    await entry.update({ disabled: disabledFlag ? true : null }, false, true);
+                    found = true;
+                }
+                catch (error) {
+                    logEvent('warn', 'toggle', `${name}: entry update failed — ${error instanceof Error ? error.message : String(error)}`);
+                    break;
+                }
+                const live = entry.fiber !== undefined;
+                if (live !== disabledFlag)
+                    break;
+                await new Promise(resolvePromise => setTimeout(resolvePromise, 200));
+            }
+            logEvent('info', 'toggle', `${name} -> ${disabledFlag ? 'off' : 'on'}: fiber=${String(entry.fiber !== undefined)}`);
+        }
+        if (!found)
+            logEvent('info', 'toggle', `${name}: no loader entry matched`);
+        return found;
+    }
+    /**
+     * Make `name` the one active theme: deactivate every other installed theme
+     * (market hot mounts unmount; bundle-layer entries live-disable) and bring
+     * it up. The choice persists in state.json and is replayed at boot.
+     */
+    async function activateTheme(name) {
+        const dir = profileDir(profile);
+        const themes = await installedThemeNames();
+        for (const other of themes) {
+            if (other === name)
+                continue;
+            if (listHotMounts().includes(other)) {
+                await hotUnmount(other);
+                disabledThemes.add(other);
+            }
+            else if (await setEntryDisabled(other, true)) {
+                disabledThemes.add(other);
+            }
+        }
+        disabledThemes.delete(name);
+        writeDisabledThemes(dir, disabledThemes);
+        if (listHotMounts().includes(name))
+            return true;
+        if (await setEntryDisabled(name, false))
+            return true;
+        return hotMount(host, dir, name);
+    }
+    return { installedThemeNames, setEntryDisabled, activateTheme };
+}

package/lib/types/dsh-cli.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Process layer: re-invoking the dsh CLI that launched this host, spawning
+ * `dsh plugin` commands with timeouts and live progress, and provisioning
+ * pnpm. This is the only module that starts child processes.
+ *
+ * Installs run through node:child_process, not ctx.shell: the shell service is
+ * the agent's sandboxed executor and denies writes to the profile directory.
+ */
+import type { ChildProcess } from 'node:child_process';
+/**
+ * Windows npm/corepack/pnpm are `.cmd` shims. Node's `spawn` without a shell
+ * cannot start them (ENOENT / EINVAL). Same pattern as dsh's `plugin` forwarder.
+ */
+export declare const winCmdShim: boolean;
+/**
+ * Argv re-invoking the CLI that launched this host process, so installs work
+ * whether dsh runs from a global bin, a local install, or repo source
+ * (`node --import tsx/esm .../bin.ts`). Falls back to a PATH `dsh`.
+ */
+export declare function dshArgv(): {
+    file: string;
+    args: string[];
+    cwd: string | undefined;
+    viaShell: boolean;
+};
+/** Outcome of one spawned plugin command. */
+export interface InstallResult {
+    exitCode: number | null;
+    timedOut: boolean;
+    stdout: string;
+    stderr: string;
+}
+/** The shape every orchestration function takes to run plugin commands (injectable in tests). */
+export type PluginRunner = (profile: string, pluginArgs: string[]) => Promise<InstallResult>;
+/**
+ * Kill a spawned child and, on Windows, its whole process tree — `kill()`
+ * there only terminates the wrapper, leaving pnpm children running.
+ * (Contributed in #7 by @mraing.)
+ */
+export declare function killChild(child: ChildProcess): void;
+/** Probe `pnpm --version` on PATH. */
+export declare function probePnpm(): Promise<boolean>;
+/**
+ * Provision pnpm without user involvement: corepack (ships with Node) first,
+ * a global npm install as fallback.
+ * @returns true when `pnpm --version` succeeds afterwards.
+ */
+export declare function provisionPnpm(): Promise<boolean>;
+/** Live progress of the running plugin command, for the status route. */
+export interface InstallProgress {
+    active: boolean;
+    target: string;
+    startedAt: number;
+    lastLine: string;
+}
+/** Singleton progress state; the status route reads it, runDshPlugin writes it. */
+export declare const progress: InstallProgress;
+/** Identifies this host process; the client scopes its pending-restart flags to it. */
+export declare const BOOT_ID: string;
+/** Run one `dsh plugin --profile <p> …` command with timeout and progress tracking. */
+export declare function runDshPlugin(profile: string, pluginArgs: string[]): Promise<InstallResult>;

package/lib/types/http.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Minimal HTTP helpers shared by every market route: JSON serialization,
+ * same-origin enforcement for mutating endpoints, and a size-capped JSON
+ * body reader.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+/** Write a JSON payload with no-store caching. */
+export declare function sendJson(response: ServerResponse, status: number, payload: unknown): void;
+/** True when the request's Origin matches its Host — required on every POST route. */
+export declare function sameOrigin(request: IncomingMessage): boolean;
+/** Read and parse a JSON request body, rejecting anything over 4 KiB. */
+export declare function readJsonBody(request: IncomingMessage): Promise<unknown>;

package/lib/types/install.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Install orchestration: collection-repo retargeting, post-install
+ * validation that keeps broken pieces from bricking the next boot, and
+ * update staleness detection. Every function takes the plugin runner as a
+ * parameter so tests can substitute a recording fake.
+ */
+import type { InstallResult, PluginRunner } from './dsh-cli.ts';
+/**
+ * Run one plugin command with automatic recovery from the pnpm-major drift
+ * failure (#20 bug 2): when the modules directory was built by a different
+ * pnpm major, pnpm's documented remedy is one `install` to recreate it —
+ * do that silently and retry the original command once. Any recognized
+ * failure that survives gets its bilingual explanation appended to stderr
+ * so the UI shows an actionable message instead of a wall of text (#20 bug 3).
+ */
+export declare function withHoistRecovery(run: PluginRunner, profile: string, pluginArgs: string[]): Promise<InstallResult>;
+/**
+ * Some registry entries point at collection repos whose actual plugin lives
+ * in a subdirectory — the root has no package.json (or a workspace root with
+ * no dsh surface), and pnpm installs the bare fileset with exit 0. Detect
+ * that junk install, drop it, and re-add each plugin subdirectory through
+ * pnpm's `#path:` selector (#18).
+ * @returns overall success (true when nothing needed retargeting).
+ */
+export declare function retargetCollections(run: PluginRunner, profile: string, before: Set<string>, target: string): Promise<boolean>;
+/**
+ * Fake-success guard (#18): validate every package the install added. A
+ * piece without a dsh manifest or without its declared entry artifact
+ * (source-only checkout, build blocked by pnpm allowBuilds) would brick the
+ * next boot, so it is removed on the spot.
+ * @returns names kept and names removed as broken.
+ */
+export declare function validateAddedPlugins(run: PluginRunner, profile: string, before: Set<string>): Promise<{
+    keep: string[];
+    removedBroken: string[];
+}>;
+/**
+ * Whether a clean-exit update actually changed nothing — pnpm's
+ * minimumReleaseAge silently keeps the old version and exits 0 when the new
+ * release is "too young" (#13, #22), so a clean exit alone does not mean the
+ * update happened.
+ */
+export declare function isStaleUpdate(check: {
+    isGit: boolean;
+    beforeVersion: string | null;
+    afterVersion: string | null;
+    beforeCommit: string | null;
+    afterCommit: string | null;
+}): boolean;

package/lib/types/pnpm-compat.d.ts

@@ -0,0 +1,42 @@
+/**
+ * pnpm compatibility layer — everything the market needs to know about how
+ * different pnpm majors behave inside a dsh profile directory, kept pure and
+ * separately testable (test/unit + test/integration exercise this module
+ * against real pnpm 9/10/11).
+ *
+ * Verified behavior matrix (2026-08, pnpm 9.15.9 / 10.28.2 / 11.21.0):
+ * - workspace root, `add` without -w:  pnpm 9 fails ERR_PNPM_ADDING_TO_ROOT;
+ *   pnpm 10/11 succeed.
+ * - `add -w` where NO pnpm-workspace.yaml exists: ALL majors fail with
+ *   "--workspace-root may only be used inside a workspace".
+ * - modules dir built by pnpm 9, then pnpm 10/11 mutate it:
+ *   ERR_PNPM_PUBLIC_HOIST_PATTERN_DIFF (defaults drifted between majors).
+ */
+/**
+ * Decide the argv for a `dsh plugin <add|remove> …` call in the given profile.
+ *
+ * pnpm 9 refuses to add at a workspace root without -w (#17, #20); every
+ * pnpm major refuses -w when the directory is NOT a workspace. So the flag
+ * is injected exactly when the profile has a pnpm-workspace.yaml.
+ * @param profileDir - resolved profile directory (owns pnpm-workspace.yaml, or not).
+ * @param pluginArgs - the raw args, e.g. ['add', 'dshmarket@latest'].
+ * @returns args with -w injected when — and only when — the profile is a workspace root.
+ */
+export declare function pluginArgsFor(profileDir: string, pluginArgs: string[]): string[];
+/** One recognized pnpm failure, with a bilingual explanation for the UI. */
+export interface PnpmFailure {
+    code: 'adding-to-root' | 'not-a-workspace' | 'hoist-pattern-diff' | 'pnpm-missing';
+    /** Bilingual, actionable message shown to the user instead of the raw wall of text. */
+    message: string;
+    /** True when re-running `pnpm install` in the profile is the documented recovery. */
+    recoverable: boolean;
+}
+/**
+ * Map a failed pnpm run's combined output to a known failure mode.
+ *
+ * dsh's own wrapper line ("dsh: pnpm failed in profile directory …") names no
+ * cause, so the market must recognize pnpm's real diagnostics itself (#20).
+ * @param output - stdout+stderr of the failed run.
+ * @returns the classified failure, or null when unrecognized (raw output is then shown as-is).
+ */
+export declare function classifyPnpmFailure(output: string): PnpmFailure | null;

package/lib/types/profile.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Profile filesystem reads — everything the market learns from a dsh
+ * profile directory (manifest, lockfile, installed package trees). Pure
+ * functions of the directory contents; no processes, no network.
+ */
+/** Resolve a profile name to its directory under DSH_HOME (default ~/.dsh). */
+export declare function profileDir(profile: string): string;
+/** Community dependencies of the profile (official in-box scope filtered out). */
+export declare function readInstalled(profile: string): Record<string, string>;
+/** The version actually present in the profile's node_modules, or null. */
+export declare function readInstalledVersion(profile: string, name: string): string | null;
+/** Pinned commit per `owner/repo` from the profile lockfile's codeload tarball URLs. */
+export declare function readLockCommits(profile: string): Map<string, string>;
+/** True when the installed package's manifest declares a dsh plugin surface. */
+export declare function hasDshManifest(dir: string): boolean;
+/**
+ * True when the package's declared entry artifact actually exists — github
+ * source checkouts of build-required plugins ship no lib/, and promoting one
+ * into the bundle layer bricks the next boot (ERR_MODULE_NOT_FOUND kills the
+ * whole profile, #18).
+ */
+export declare function entryArtifactExists(dir: string): boolean;
+/** Plugin subdirectories (depth 2) of a collection checkout, as relative paths. */
+export declare function pluginSubdirs(root: string): string[];

package/lib/types/routes.d.ts

@@ -1,11 +1,16 @@
 /**
- * HTTP routes bridging the browser market UI to the host: registry fallback,
- * installed-plugin listing, and the install executor.
+ * HTTP routes bridging the browser market UI to the host. This layer only
+ * parses requests, calls the service modules, and serializes responses —
+ * process spawning lives in dsh-cli.ts, filesystem reads in profile.ts,
+ * orchestration in install.ts / themes.ts / updates.ts.
  *
  * Security: the install route executes a shell command, so it accepts only
  * same-origin POSTs and only sources present in the curated registry.
  */
 import type { IncomingMessage, ServerResponse } from 'node:http';
+import { type LoaderEntry } from './themes.ts';
+export type { LoaderEntry } from './themes.ts';
+export type { UpdateStatus } from './updates.ts';
 export interface WebServerService {
     register(route: {
         kind: 'exact' | 'prefix';
@@ -13,18 +18,6 @@ export interface WebServerService {
         handler: (request: IncomingMessage, response: ServerResponse) => void | Promise<void>;
     }): () => void;
 }
-/** The slice of a cordis loader entry the market needs for live enable/disable. */
-export interface LoaderEntry {
-    options: {
-        id?: string;
-        name?: string;
-        disabled?: boolean | null;
-    };
-    fiber?: unknown;
-    update(options: {
-        disabled: boolean | null;
-    }, create?: boolean, force?: boolean): Promise<void>;
-}
 export interface MarketHost {
     webServer: WebServerService;
     loader: {
@@ -50,13 +43,6 @@ export interface MarketConfig {
     /** Profile the market installs into; matches the profile serving this UI. */
     profile: string;
 }
-export interface UpdateStatus {
-    kind: 'github' | 'npm' | 'linked';
-    version: string | null;
-    current: string | null;
-    latest: string | null;
-    updateAvailable: boolean;
-}
 /**
  * Register the market's HTTP routes.
  * @param host - Acquired webServer + shell services.

package/lib/types/sources.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Registry-source knowledge: how a curated registry entry's URL maps to an
+ * installable pnpm target. Pure string logic, no I/O.
+ */
+/**
+ * Parse a registry source url: a github repo, optionally with a
+ * `/tree/<branch>/<subpath>` suffix (how the curated list links monorepo
+ * subpackages, e.g. dsh-plugins#theme-gallery).
+ */
+export declare function parseSourceUrl(url: string): {
+    repo: string;
+    subpath: string | null;
+} | null;
+/** GitHub `owner/repo` for a registry URL, or null when it is not a GitHub repo URL. */
+export declare function repoOf(url: string): string | null;
+/**
+ * The pnpm install target for a registry entry. Registry tarballs beat
+ * full-repo GitHub downloads: smaller, prebuilt, and CDN/mirror served. The
+ * npm name comes from our curated registry, which only maps repo-verified
+ * packages (name-squatting protection).
+ * @returns the target spec, or null when the source url is unsupported.
+ */
+export declare function installTargetFor(entry: {
+    url: string;
+    npm?: unknown;
+}): string | null;
+/**
+ * The name an entry is ALREADY installed under, or null — the server-side
+ * duplicate guard (#27): the same plugin listed under an alias entry must
+ * never install twice (two loader entries with one id brick the next boot).
+ *
+ * Identity is subpath-aware so monorepo siblings stay independent: an entry
+ * with a /tree/ subpath identifies as repo#path:/sub (never the bare repo),
+ * while an installed dependency contributes its bare repo AND its #path:
+ * form — so a collection root still matches the pieces it was retargeted
+ * into, but two different subpackages of one repo never cross-match.
+ */
+export declare function findInstalledAlias(entry: {
+    name: string;
+    npm?: unknown;
+    url: string;
+}, installed: Record<string, string>): string | null;

package/lib/types/themes.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Theme lifecycle: classifying installed packages as themes (by the
+ * registry's theme category), live-toggling bundle-layer entries through
+ * the loader, and keeping exactly one theme active with the choice
+ * persisted across restarts.
+ */
+/** The slice of a cordis loader entry the market needs for live enable/disable. */
+export interface LoaderEntry {
+    options: {
+        id?: string;
+        name?: string;
+        disabled?: boolean | null;
+    };
+    fiber?: unknown;
+    update(options: {
+        disabled: boolean | null;
+    }, create?: boolean, force?: boolean): Promise<void>;
+}
+/** The host surface the theme manager needs (loader entries + hot-mount context). */
+export interface ThemeHost {
+    loader: {
+        entries(): Iterable<LoaderEntry>;
+    };
+    plugin(plugin: unknown, config: unknown): {
+        await(): Promise<unknown>;
+        dispose(): Promise<unknown> | void;
+    };
+}
+/** Manages theme exclusivity for one profile. */
+export interface ThemeManager {
+    installedThemeNames(): Promise<Set<string>>;
+    setEntryDisabled(name: string, disabledFlag: boolean): Promise<boolean>;
+    activateTheme(name: string): Promise<boolean>;
+}
+/**
+ * Create the theme manager. `disabledThemes` is the live, shared set of
+ * themes the user switched off — the caller owns reading it at boot and
+ * replaying it; the manager mutates and persists it on switches.
+ */
+export declare function createThemeManager(host: ThemeHost, profile: string, disabledThemes: Set<string>): ThemeManager;

package/lib/types/updates.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Update detection: per-plugin comparison of what the profile has against
+ * the source of truth — git HEAD for github installs, the npm latest
+ * dist-tag for registry installs — with a TTL cache.
+ */
+export interface UpdateStatus {
+    kind: 'github' | 'npm' | 'linked';
+    version: string | null;
+    current: string | null;
+    latest: string | null;
+    updateAvailable: boolean;
+}
+/** Drop the cached listing (after a successful install/update/uninstall). */
+export declare function invalidateUpdates(): void;
+/** Per-plugin update checks; a failed check reports no update rather than failing the listing. */
+export declare function checkUpdates(profile: string, force?: boolean): Promise<Record<string, UpdateStatus>>;

package/lib/updates.js

@@ -0,0 +1,61 @@
+/**
+ * Update detection: per-plugin comparison of what the profile has against
+ * the source of truth — git HEAD for github installs, the npm latest
+ * dist-tag for registry installs — with a TTL cache.
+ */
+import { readInstalled, readInstalledVersion, readLockCommits } from './profile.js';
+const UPDATES_TTL_MS = 30 * 60 * 1000;
+let updatesCache = null;
+/** Drop the cached listing (after a successful install/update/uninstall). */
+export function invalidateUpdates() {
+    updatesCache = null;
+}
+async function fetchJson(url) {
+    const res = await fetch(url, {
+        headers: { accept: 'application/json', 'user-agent': 'dsh-market' },
+        signal: AbortSignal.timeout(4000),
+    });
+    if (!res.ok)
+        throw new Error(`HTTP ${res.status}`);
+    return res.json();
+}
+/** Per-plugin update checks; a failed check reports no update rather than failing the listing. */
+export async function checkUpdates(profile, force = false) {
+    if (!force && updatesCache && Date.now() - updatesCache.at < UPDATES_TTL_MS)
+        return updatesCache.data;
+    const installed = readInstalled(profile);
+    const lockCommits = readLockCommits(profile);
+    const result = {};
+    await Promise.all(Object.entries(installed).map(async ([name, spec]) => {
+        const version = readInstalledVersion(profile, name);
+        if (spec.startsWith('link:') || spec.startsWith('file:')) {
+            result[name] = { kind: 'linked', version, current: null, latest: null, updateAvailable: false };
+            return;
+        }
+        const gh = /^(?:github:)?([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:#.*)?$/.exec(spec);
+        try {
+            if (spec.startsWith('github:') && gh !== null) {
+                const current = lockCommits.get(gh[1].toLowerCase()) ?? null;
+                const head = (await fetchJson(`https://api.github.com/repos/${gh[1]}/commits/HEAD`));
+                const latest = typeof head.sha === 'string' ? head.sha : null;
+                result[name] = {
+                    kind: 'github', version, current, latest,
+                    updateAvailable: current !== null && latest !== null && current !== latest,
+                };
+            }
+            else {
+                const meta = (await fetchJson(`https://registry.npmjs.org/${encodeURIComponent(name)}/latest`));
+                const latest = typeof meta.version === 'string' ? meta.version : null;
+                result[name] = {
+                    kind: 'npm', version, current: version, latest,
+                    updateAvailable: version !== null && latest !== null && version !== latest,
+                };
+            }
+        }
+        catch {
+            result[name] = { kind: spec.startsWith('github:') ? 'github' : 'npm', version, current: null, latest: null, updateAvailable: false };
+        }
+    }));
+    updatesCache = { at: Date.now(), data: result };
+    return result;
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -25,6 +25,8 @@
     "build": "tsc -p tsconfig.json && npm run build:client",
     "build:client": "tsdown && node scripts/normalize-client-banner.mjs",
     "check": "npm run typecheck && npm run build",
+    "test": "vitest run",
+    "test:compat": "vitest run --config vitest.compat.config.ts",
     "prepack": "npm run build && node scripts/preflight.mjs",
     "prepare": "npm run build",
     "snapshot": "curl -sf https://awesome-dsh-plugin.com/plugins.json -o data/registry-snapshot.json"
@@ -70,7 +72,8 @@
     "lightningcss": "^1.33.0",
     "react": "^18.3.1",
     "tsdown": "^0.22.14",
-    "typescript": "^7.0.2"
+    "typescript": "^7.0.2",
+    "vitest": "^4.1.10"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/"

package/src/client/Market.module.css

@@ -67,5 +67,8 @@
 .empty{color:var(--dsw-alias-label-secondary,#9ca3af);font-size:13px;padding:32px;text-align:center}
 .err{color:var(--dsw-alias-state-error-primary,#dc2626);font-size:12px;margin:8px 0;white-space:pre-wrap;word-break:break-all}
 .irow{background:var(--dsw-alias-bg-layer-1,#fff);border:1px solid var(--dsw-alias-border-l2,#e5e7eb);border-radius:12px;padding:12px 14px;display:flex;align-items:center;gap:10px;margin-bottom:8px}
-.irow>.src,.irow>.owner,.irow>.btn{white-space:nowrap;flex-shrink:0}
+.irow>.src,.irow>.owner{white-space:nowrap;flex-shrink:0}
+/* Buttons sharing the row with a description must keep one line (#26, thanks @yanshuai2002) */
+.dangerBtn.dangerBtn,.warnBtn.warnBtn,.dangerArmed.dangerArmed{white-space:nowrap;flex-shrink:0}
 .spec{font-size:11px;color:var(--dsw-alias-label-secondary,#9ca3af);font-family:ui-monospace,Menlo,monospace}
+.staleAction{margin-top:8px}