dshmarket 1.2.2 → 1.2.3

package/src/client/MarketSection.tsx

@@ -7,7 +7,8 @@ import { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState, use
 import { Button, IconChevronDownOutline14, IconChevronUpOutline14, IconSearchOutline16, Input, Modal, Pill, StateDot } from '@deepseek-ai/dsh-client-ui-primitives'
 import css from './Market.module.css'
 import {
-  avatarColor, entryForDep, isInstalled, LOGO_URI, looksTerminal, matchInstalledName, readSession, repoOf, themeSwatch,
+  avatarColor, entryForDep, isInstalled, LOGO_URI, looksTerminal, matchInstalledName, orderedCategories,
+  readSession, repoOf, themePlugins as themePluginsOf, themeSwatch, visiblePlugins,
 } from './market-data.ts'
 import type {
   InstalledMap, Registry, RegistryPlugin, ThemeSnapshot, Translate, UpdateStatus,
@@ -79,6 +80,8 @@ export function MarketSection(props: MarketSectionProps) {
   const [installError, setInstallError] = useState<string | null>(null)
   const [updates, setUpdates] = useState<Record<string, UpdateStatus>>({})
   const [updatingName, setUpdatingName] = useState<string | null>(null)
+  // Plugin blocked by pnpm's fresh-release safety wait; arms the update-now button.
+  const [staleName, setStaleName] = useState<string | null>(null)
   const [updatingAll, setUpdatingAll] = useState(false)
   const [updatedNames, setUpdatedNames] = useState<string[]>([])
   const [hotUrls, setHotUrls] = useState<string[]>([])
@@ -209,25 +212,9 @@ export function MarketSection(props: MarketSectionProps) {
     return () => clearInterval(timer)
   }, [busyUrl, updatingName, data])
 
-  const plugins = useMemo(() => {
-    if (data === null) return []
-    const query = q.trim().toLowerCase()
-    const list = data.plugins.filter(p => {
-      if (cat !== 'all' && p.category !== cat) return false
-      if (query === '') return true
-      const desc = (p.description && (p.description[lang] || p.description.en)) || ''
-      return p.name.toLowerCase().includes(query)
-        || p.owner.toLowerCase().includes(query)
-        || desc.toLowerCase().includes(query)
-    })
-    if (sort === 'hot') {
-      return [...list].sort((a, b) => (b.stars ?? -1) - (a.stars ?? -1))
-    }
-    if (sort === 'new') {
-      return [...list].sort((a, b) => String(b.added).localeCompare(String(a.added)))
-    }
-    return list
-  }, [data, q, cat, lang, sort])
+  const plugins = useMemo(
+    () => (data === null ? [] : visiblePlugins(data.plugins, { category: cat, query: q, lang, sort })),
+    [data, q, cat, lang, sort])
 
   const doInstall = useCallback((plugin: RegistryPlugin) => {
     setConfirming(null)
@@ -272,13 +259,14 @@ export function MarketSection(props: MarketSectionProps) {
       .finally(() => setBusyUrl(null))
   }, [refreshInstalled, t])
 
-  const doUpdate = useCallback((name: string) => {
+  const doUpdate = useCallback((name: string, force = false) => {
     setInstallError(null)
+    setStaleName(null)
     setUpdatingName(name)
     return fetch('/dsh-market/update', {
       method: 'POST',
       headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ name }),
+      body: JSON.stringify(force ? { name, force: true } : { name }),
     })
       .then(res => res.json().then(body => ({ status: res.status, body })))
       .then(({ status, body }) => {
@@ -286,6 +274,7 @@ export function MarketSection(props: MarketSectionProps) {
           setUpdatedNames(names => names.concat(name))
           refreshInstalled()
         } else {
+          if (body.stale === true) setStaleName(name)
           const text = (v: unknown) => typeof v === 'string' ? v : (v && typeof (v as any).text === 'string') ? (v as any).text : v == null ? '' : JSON.stringify(v)
           const detail = text(body.error) || [text(body.stderr), text(body.stdout)].filter(Boolean).join('\n').trim() || ('exit ' + body.exitCode)
           setInstallError(t('updateFail') + ': ' + name + ' — ' + detail.trim().slice(-600))
@@ -365,9 +354,7 @@ export function MarketSection(props: MarketSectionProps) {
     name => !updatedNames.includes(name) && updates[name] && updates[name].updateAvailable,
   )
 
-  const themePlugins = data === null ? [] : data.plugins
-    .filter(p => p.category === 'theme')
-    .sort((a, b) => (b.stars || 0) - (a.stars || 0))
+  const themePlugins = data === null ? [] : themePluginsOf(data.plugins)
 
   const pluginCard = (p: RegistryPlugin) => {
     const desc = (p.description && (p.description[lang] || p.description.en)) || ''
@@ -591,7 +578,16 @@ export function MarketSection(props: MarketSectionProps) {
           </div>
         )}
       </div>
-      {installError !== null && <div className={css.err}>{installError}</div>}
+      {installError !== null && (
+        <div className={css.err}>
+          {installError}
+          {staleName !== null && (
+            <div className={css.staleAction}>
+              <Button size="sm" onClick={() => doUpdate(staleName, true)}>{t('updateNow')}</Button>
+            </div>
+          )}
+        </div>
+      )}
       <div
         className={css.body}
         ref={bodyRef}
@@ -609,7 +605,7 @@ export function MarketSection(props: MarketSectionProps) {
                       <div ref={catsWrapRef} className={catsOpen || visibleCats === null ? `${css.catsWrap} ${css.catsCollapsed}` : css.catsWrap}>
                         {(() => {
                           // Collapsed, the selected category is pulled to the front so it never hides.
-                          const ordered = catsOpen || cat === 'all' ? categories : [cat, ...categories.filter(id => id !== cat)]
+                          const ordered = orderedCategories(categories, cat, catsOpen)
                           const shown = catsOpen || visibleCats === null ? ordered : ordered.slice(0, Math.max(0, visibleCats - 1))
                           return (
                             <>

package/src/client/locales.ts

@@ -29,6 +29,7 @@ export const zh = {
   update: '更新',
   updating: '更新中…',
   updated: '✓ 已更新，重启后生效',
+  updateNow: '立即更新',
   updateFail: '更新失败',
   upToDate: '已是最新',
   linkedDev: '本地开发链接',
@@ -91,6 +92,7 @@ export const en: Record<MarketKey, string> = {
   update: 'Update',
   updating: 'Updating…',
   updated: '✓ Updated — restart to apply',
+  updateNow: 'Update now',
   updateFail: 'Update failed',
   upToDate: 'Up to date',
   linkedDev: 'linked (dev)',

package/src/client/market-data.ts

@@ -84,6 +84,55 @@ export function looksTerminal(plugin: RegistryPlugin, lang: string): boolean {
   return /\b(tui|cli|tty|terminal)\b|终端|命令行/i.test(plugin.name + ' ' + desc)
 }
 
+/** Filters and sort order driving the discover list. */
+export interface ListQuery {
+  /** Active category id, or 'all'. */
+  category: string
+  /** Raw search input (trimmed and lowercased internally). */
+  query: string
+  /** UI language for description matching ('zh' / 'en'). */
+  lang: string
+  /** 'hot' (stars desc), 'new' (added desc), anything else keeps registry order. */
+  sort: string
+}
+
+/**
+ * The discover list: category filter, then search across name / owner /
+ * localized description, then the selected sort. Pure — the section renders
+ * exactly this.
+ */
+export function visiblePlugins(plugins: RegistryPlugin[], options: ListQuery): RegistryPlugin[] {
+  const query = options.query.trim().toLowerCase()
+  const list = plugins.filter((p) => {
+    if (options.category !== 'all' && p.category !== options.category) return false
+    if (query === '') return true
+    const desc = (p.description && (p.description[options.lang] || p.description.en)) || ''
+    return p.name.toLowerCase().includes(query)
+      || p.owner.toLowerCase().includes(query)
+      || desc.toLowerCase().includes(query)
+  })
+  if (options.sort === 'hot') {
+    return [...list].sort((a, b) => (b.stars ?? -1) - (a.stars ?? -1))
+  }
+  if (options.sort === 'new') {
+    return [...list].sort((a, b) => String(b.added).localeCompare(String(a.added)))
+  }
+  return list
+}
+
+/** The themes tab listing: theme category only, most-starred first. */
+export function themePlugins(plugins: RegistryPlugin[]): RegistryPlugin[] {
+  return plugins.filter(p => p.category === 'theme').sort((a, b) => (b.stars || 0) - (a.stars || 0))
+}
+
+/**
+ * Category chip order: collapsed with an active non-'all' chip, the active
+ * one moves to the front so it stays visible inside the two-row clip.
+ */
+export function orderedCategories(categories: string[], active: string, open: boolean): string[] {
+  return open || active === 'all' ? categories : [active, ...categories.filter(id => id !== active)]
+}
+
 /**
  * Unified installed-state matching (#15): both sides collapse to lowercase
  * identity sets — the registry entry contributes its bare name, npm name and
@@ -94,8 +143,12 @@ export function looksTerminal(plugin: RegistryPlugin, lang: string): boolean {
 function entryIdentities(plugin: RegistryPlugin): Set<string> {
   const ids = new Set<string>([plugin.name.toLowerCase()])
   if (plugin.npm) ids.add(plugin.npm.toLowerCase())
-  const repo = repoOf(plugin.url)
-  if (repo !== null) ids.add(repo.toLowerCase())
+  // Subpath-aware: a /tree/ entry identifies as repo#path:/sub, never the
+  // bare repo — two subpackages of one monorepo must not cross-match.
+  const m = /^https:\/\/github\.com\/([^/]+\/[^/]+?)(?:\/tree\/[^/]+\/(.+?))?\/?$/.exec(plugin.url)
+  if (m !== null) {
+    ids.add(m[2] !== undefined ? `${m[1]!.toLowerCase()}#path:/${m[2].toLowerCase()}` : m[1]!.toLowerCase())
+  }
   return ids
 }
 
@@ -105,8 +158,11 @@ function depIdentities(name: string, spec: string): Set<string> {
   // npm-installed plugin still matches an entry whose npm field is unset.
   const scoped = /^@([^/]+)\/(.+)$/.exec(name)
   if (scoped !== null) ids.add(`${scoped[1]!.toLowerCase()}/${scoped[2]!.toLowerCase()}`)
-  const match = /github:([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+)/i.exec(spec)
-  if (match !== null) ids.add(match[1]!.toLowerCase())
+  const match = /github:([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+)(?:#path:\/([A-Za-z0-9_./-]+))?/i.exec(spec)
+  if (match !== null) {
+    ids.add(match[1]!.toLowerCase())
+    if (match[2] !== undefined) ids.add(`${match[1]!.toLowerCase()}#path:/${match[2].toLowerCase()}`)
+  }
   return ids
 }
 

package/src/dsh-cli.ts

@@ -0,0 +1,194 @@
+/**
+ * Process layer: re-invoking the dsh CLI that launched this host, spawning
+ * `dsh plugin` commands with timeouts and live progress, and provisioning
+ * pnpm. This is the only module that starts child processes.
+ *
+ * Installs run through node:child_process, not ctx.shell: the shell service is
+ * the agent's sandboxed executor and denies writes to the profile directory.
+ */
+
+import { spawn } from 'node:child_process'
+import type { ChildProcess } from 'node:child_process'
+import { dirname, resolve } from 'node:path'
+import { logEvent } from './log.ts'
+import { pluginArgsFor } from './pnpm-compat.ts'
+import { profileDir } from './profile.ts'
+
+const INSTALL_TIMEOUT_MS = 5 * 60 * 1000
+
+/**
+ * Windows npm/corepack/pnpm are `.cmd` shims. Node's `spawn` without a shell
+ * cannot start them (ENOENT / EINVAL). Same pattern as dsh's `plugin` forwarder.
+ */
+export const winCmdShim = process.platform === 'win32'
+
+/**
+ * Argv re-invoking the CLI that launched this host process, so installs work
+ * whether dsh runs from a global bin, a local install, or repo source
+ * (`node --import tsx/esm .../bin.ts`). Falls back to a PATH `dsh`.
+ */
+export function dshArgv(): { file: string; args: string[]; cwd: string | undefined; viaShell: boolean } {
+  const entry = process.argv[1]
+  if (entry !== undefined && /[\\/](?:bin\.(?:js|ts)|dsh)$/.test(entry)) {
+    // Absolute paths are required: source launches (`pnpm dsh`) pass a
+    // relative entry, which the child resolves against its OWN cwd and dies
+    // with MODULE_NOT_FOUND (#13). cwd near the entry keeps execArgv imports
+    // (tsx/esm) resolvable on source launches.
+    const abs = resolve(entry)
+    return { file: process.execPath, args: [...process.execArgv, abs], cwd: dirname(abs), viaShell: false }
+  }
+  // Bare `dsh` is a .cmd shim on Windows that only a shell can start (#13).
+  return { file: 'dsh', args: [], cwd: undefined, viaShell: winCmdShim }
+}
+
+/** Outcome of one spawned plugin command. */
+export interface InstallResult {
+  exitCode: number | null
+  timedOut: boolean
+  stdout: string
+  stderr: string
+}
+
+/** The shape every orchestration function takes to run plugin commands (injectable in tests). */
+export type PluginRunner = (profile: string, pluginArgs: string[]) => Promise<InstallResult>
+
+/**
+ * Kill a spawned child and, on Windows, its whole process tree — `kill()`
+ * there only terminates the wrapper, leaving pnpm children running.
+ * (Contributed in #7 by @mraing.)
+ */
+export function killChild(child: ChildProcess): void {
+  if (process.platform === 'win32' && child.pid !== undefined) {
+    try {
+      spawn('taskkill', ['/pid', String(child.pid), '/t', '/f'], { stdio: 'ignore' })
+      return
+    } catch { /* fall through */ }
+  }
+  child.kill('SIGKILL')
+}
+
+/** Whether `pnpm` resolves on PATH; success is cached, absence is re-probed. */
+let pnpmReady = false
+
+/** Probe `pnpm --version` on PATH. */
+export function probePnpm(): Promise<boolean> {
+  if (pnpmReady) return Promise.resolve(true)
+  return new Promise((resolvePromise) => {
+    const child = spawn('pnpm', ['--version'], { stdio: 'ignore', shell: winCmdShim })
+    child.on('error', () => resolvePromise(false))
+    child.on('close', (code) => {
+      pnpmReady = code === 0
+      resolvePromise(pnpmReady)
+    })
+  })
+}
+
+function runQuiet(file: string, args: string[], timeoutMs: number): Promise<{ code: number | null; output: string }> {
+  return new Promise((resolvePromise) => {
+    const child = spawn(file, args, {
+      env: { ...process.env, CI: 'true' },
+      stdio: ['ignore', 'pipe', 'pipe'],
+      shell: winCmdShim,
+    })
+    let output = ''
+    const timer = setTimeout(() => killChild(child), timeoutMs)
+    const collect = (chunk: Buffer): void => { output = (output + chunk.toString()).slice(-8 * 1024) }
+    child.stdout.on('data', collect)
+    child.stderr.on('data', collect)
+    child.on('error', (error) => { clearTimeout(timer); resolvePromise({ code: 127, output: error.message }) })
+    child.on('close', (code) => { clearTimeout(timer); resolvePromise({ code, output }) })
+  })
+}
+
+/**
+ * Provision pnpm without user involvement: corepack (ships with Node) first,
+ * a global npm install as fallback.
+ * @returns true when `pnpm --version` succeeds afterwards.
+ */
+export async function provisionPnpm(): Promise<boolean> {
+  const corepack = await runQuiet('corepack', ['enable', 'pnpm'], 60 * 1000)
+  logEvent(corepack.code === 0 ? 'info' : 'warn', 'setup-pnpm', `corepack enable: exit=${String(corepack.code)} ${corepack.output.slice(-200)}`)
+  if (await probePnpm()) return true
+  const npm = await runQuiet('npm', ['install', '-g', 'pnpm'], 3 * 60 * 1000)
+  logEvent(npm.code === 0 ? 'info' : 'error', 'setup-pnpm', `npm -g: exit=${String(npm.code)} ${npm.output.slice(-200)}`)
+  return probePnpm()
+}
+
+/** Live progress of the running plugin command, for the status route. */
+export interface InstallProgress {
+  active: boolean
+  target: string
+  startedAt: number
+  lastLine: string
+}
+
+/** Singleton progress state; the status route reads it, runDshPlugin writes it. */
+export const progress: InstallProgress = { active: false, target: '', startedAt: 0, lastLine: '' }
+
+/** Identifies this host process; the client scopes its pending-restart flags to it. */
+export const BOOT_ID = `${String(process.pid)}-${String(Date.now())}`
+
+function trackProgress(chunk: string): void {
+  const lines = chunk.split('\n').map(l => l.trim()).filter(l => l !== '')
+  if (lines.length > 0) progress.lastLine = lines[lines.length - 1].slice(0, 200)
+}
+
+/**
+ * Central allowlist for every spawn target, regardless of which route built
+ * it (defense in depth on top of per-route validation — the win32 bare-dsh
+ * fallback runs through a shell). Suggested in #16 by @anupamme.
+ */
+const TARGET_RE = /^[A-Za-z0-9@:./_#+-]+$/
+
+/** Run one `dsh plugin --profile <p> …` command with timeout and progress tracking. */
+export function runDshPlugin(profile: string, pluginArgs: string[]): Promise<InstallResult> {
+  const { file, args, cwd, viaShell } = dshArgv()
+  pluginArgs = pluginArgsFor(profileDir(profile), pluginArgs)
+  const target = pluginArgs[pluginArgs.length - 1] ?? ''
+  if (!TARGET_RE.test(target)) {
+    logEvent('error', 'install', `unsafe plugin target rejected: ${JSON.stringify(target)}`)
+    return Promise.resolve({ exitCode: 1, timedOut: false, stdout: '', stderr: `unsafe plugin target rejected: ${JSON.stringify(target)}` })
+  }
+  progress.active = true
+  progress.target = target
+  progress.startedAt = Date.now()
+  progress.lastLine = ''
+  return new Promise((resolvePromise) => {
+    const child = spawn(file, [...args, 'plugin', '--profile', profile, ...pluginArgs], {
+      cwd,
+      // pnpm v10 blocks forever on a silent interactive prompt without a TTY
+      // (observed on re-add over a pinned git spec); CI mode forces it to act
+      // or fail instead of asking.
+      env: { ...process.env, CI: 'true' },
+      stdio: ['ignore', 'pipe', 'pipe'],
+      shell: viaShell,
+    })
+    let stdout = ''
+    let stderr = ''
+    let timedOut = false
+    const timer = setTimeout(() => {
+      timedOut = true
+      killChild(child)
+    }, INSTALL_TIMEOUT_MS)
+    child.stdout.on('data', (chunk: Buffer) => {
+      const text = chunk.toString()
+      stdout = (stdout + text).slice(-256 * 1024)
+      trackProgress(text)
+    })
+    child.stderr.on('data', (chunk: Buffer) => {
+      const text = chunk.toString()
+      stderr = (stderr + text).slice(-64 * 1024)
+      trackProgress(text)
+    })
+    child.on('error', (error) => {
+      clearTimeout(timer)
+      progress.active = false
+      resolvePromise({ exitCode: 127, timedOut: false, stdout, stderr: `${stderr}\n${error.message}` })
+    })
+    child.on('close', (code) => {
+      clearTimeout(timer)
+      progress.active = false
+      resolvePromise({ exitCode: code, timedOut, stdout, stderr })
+    })
+  })
+}

package/src/http.ts

@@ -0,0 +1,41 @@
+/**
+ * Minimal HTTP helpers shared by every market route: JSON serialization,
+ * same-origin enforcement for mutating endpoints, and a size-capped JSON
+ * body reader.
+ */
+
+import type { IncomingMessage, ServerResponse } from 'node:http'
+
+/** Write a JSON payload with no-store caching. */
+export function sendJson(response: ServerResponse, status: number, payload: unknown): void {
+  response.writeHead(status, {
+    'cache-control': 'no-store',
+    'content-type': 'application/json; charset=utf-8',
+  })
+  response.end(JSON.stringify(payload))
+}
+
+/** True when the request's Origin matches its Host — required on every POST route. */
+export function sameOrigin(request: IncomingMessage): boolean {
+  const origin = request.headers.origin
+  const host = request.headers.host
+  if (origin === undefined || host === undefined) return false
+  try {
+    return new URL(origin).host === host
+  } catch {
+    return false
+  }
+}
+
+/** Read and parse a JSON request body, rejecting anything over 4 KiB. */
+export async function readJsonBody(request: IncomingMessage): Promise<unknown> {
+  const chunks: Buffer[] = []
+  let size = 0
+  for await (const chunk of request) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    size += buffer.length
+    if (size > 4096) throw new Error('request body too large')
+    chunks.push(buffer)
+  }
+  return JSON.parse(Buffer.concat(chunks).toString('utf8')) as unknown
+}

package/src/install.ts

@@ -0,0 +1,121 @@
+/**
+ * Install orchestration: collection-repo retargeting, post-install
+ * validation that keeps broken pieces from bricking the next boot, and
+ * update staleness detection. Every function takes the plugin runner as a
+ * parameter so tests can substitute a recording fake.
+ */
+
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+import type { InstallResult, PluginRunner } from './dsh-cli.ts'
+import { classifyPnpmFailure } from './pnpm-compat.ts'
+import { entryArtifactExists, hasDshManifest, pluginSubdirs, profileDir, readInstalled } from './profile.ts'
+import { logEvent } from './log.ts'
+
+/**
+ * Run one plugin command with automatic recovery from the pnpm-major drift
+ * failure (#20 bug 2): when the modules directory was built by a different
+ * pnpm major, pnpm's documented remedy is one `install` to recreate it —
+ * do that silently and retry the original command once. Any recognized
+ * failure that survives gets its bilingual explanation appended to stderr
+ * so the UI shows an actionable message instead of a wall of text (#20 bug 3).
+ */
+export async function withHoistRecovery(run: PluginRunner, profile: string, pluginArgs: string[]): Promise<InstallResult> {
+  let result = await run(profile, pluginArgs)
+  const ok = (r: InstallResult): boolean => r.exitCode === 0 && !r.timedOut
+  if (!ok(result) && classifyPnpmFailure(`${result.stderr}\n${result.stdout}`)?.code === 'hoist-pattern-diff') {
+    logEvent('warn', 'install', `modules dir was built by a different pnpm major — rebuilding (pnpm install) and retrying once`)
+    // --no-frozen-lockfile: the market runs pnpm with CI=true (TTY hangs),
+    // where a lockfile written by the old major would otherwise be refused.
+    const rebuild = await run(profile, ['install', '--no-frozen-lockfile'])
+    if (ok(rebuild)) result = await run(profile, pluginArgs)
+  }
+  if (!ok(result)) {
+    const failure = classifyPnpmFailure(`${result.stderr}\n${result.stdout}`)
+    if (failure !== null) result = { ...result, stderr: `${result.stderr}\n\n${failure.message}` }
+  }
+  return result
+}
+
+/**
+ * Some registry entries point at collection repos whose actual plugin lives
+ * in a subdirectory — the root has no package.json (or a workspace root with
+ * no dsh surface), and pnpm installs the bare fileset with exit 0. Detect
+ * that junk install, drop it, and re-add each plugin subdirectory through
+ * pnpm's `#path:` selector (#18).
+ * @returns overall success (true when nothing needed retargeting).
+ */
+export async function retargetCollections(
+  run: PluginRunner, profile: string, before: Set<string>, target: string,
+): Promise<boolean> {
+  if (!target.startsWith('github:')) return true
+  const junk = Object.keys(readInstalled(profile)).filter((name) => {
+    if (before.has(name)) return false
+    const root = join(profileDir(profile), 'node_modules', name)
+    if (!existsSync(join(root, 'package.json'))) return true
+    return !hasDshManifest(root)
+  })
+  let allOk = true
+  for (const name of junk) {
+    const root = join(profileDir(profile), 'node_modules', name)
+    const candidates = pluginSubdirs(root)
+    logEvent('info', 'install', `${name}: collection repo (root declares no dsh manifest); plugins inside: ${candidates.join(', ') || 'none'}`)
+    await run(profile, ['remove', name])
+    if (candidates.length === 0) {
+      allOk = false
+      continue
+    }
+    for (const sub of candidates) {
+      const result = await run(profile, ['add', `${target}#path:/${sub}`])
+      if (result.exitCode !== 0 || result.timedOut) {
+        allOk = false
+        logEvent('error', 'install',
+          `${target}#path:/${sub}: exit=${String(result.exitCode)}${result.timedOut ? ' TIMEOUT' : ''} — ${(result.stderr || result.stdout).slice(-220)}`)
+      }
+    }
+  }
+  return allOk
+}
+
+/**
+ * Fake-success guard (#18): validate every package the install added. A
+ * piece without a dsh manifest or without its declared entry artifact
+ * (source-only checkout, build blocked by pnpm allowBuilds) would brick the
+ * next boot, so it is removed on the spot.
+ * @returns names kept and names removed as broken.
+ */
+export async function validateAddedPlugins(
+  run: PluginRunner, profile: string, before: Set<string>,
+): Promise<{ keep: string[]; removedBroken: string[] }> {
+  const addedNow = Object.keys(readInstalled(profile)).filter(n => !before.has(n))
+  const keep: string[] = []
+  const removedBroken: string[] = []
+  for (const n of addedNow) {
+    const dir = join(profileDir(profile), 'node_modules', n)
+    if (hasDshManifest(dir) && entryArtifactExists(dir)) {
+      keep.push(n)
+    } else {
+      removedBroken.push(n)
+      await run(profile, ['remove', n])
+    }
+  }
+  return { keep, removedBroken }
+}
+
+/**
+ * Whether a clean-exit update actually changed nothing — pnpm's
+ * minimumReleaseAge silently keeps the old version and exits 0 when the new
+ * release is "too young" (#13, #22), so a clean exit alone does not mean the
+ * update happened.
+ */
+export function isStaleUpdate(check: {
+  isGit: boolean
+  beforeVersion: string | null
+  afterVersion: string | null
+  beforeCommit: string | null
+  afterCommit: string | null
+}): boolean {
+  return check.isGit
+    ? check.beforeCommit !== null && check.afterCommit === check.beforeCommit
+    : check.beforeVersion !== null && check.afterVersion === check.beforeVersion
+}

package/src/pnpm-compat.ts

@@ -0,0 +1,83 @@
+/**
+ * pnpm compatibility layer — everything the market needs to know about how
+ * different pnpm majors behave inside a dsh profile directory, kept pure and
+ * separately testable (test/unit + test/integration exercise this module
+ * against real pnpm 9/10/11).
+ *
+ * Verified behavior matrix (2026-08, pnpm 9.15.9 / 10.28.2 / 11.21.0):
+ * - workspace root, `add` without -w:  pnpm 9 fails ERR_PNPM_ADDING_TO_ROOT;
+ *   pnpm 10/11 succeed.
+ * - `add -w` where NO pnpm-workspace.yaml exists: ALL majors fail with
+ *   "--workspace-root may only be used inside a workspace".
+ * - modules dir built by pnpm 9, then pnpm 10/11 mutate it:
+ *   ERR_PNPM_PUBLIC_HOIST_PATTERN_DIFF (defaults drifted between majors).
+ */
+
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+
+
+/**
+ * Decide the argv for a `dsh plugin <add|remove> …` call in the given profile.
+ *
+ * pnpm 9 refuses to add at a workspace root without -w (#17, #20); every
+ * pnpm major refuses -w when the directory is NOT a workspace. So the flag
+ * is injected exactly when the profile has a pnpm-workspace.yaml.
+ * @param profileDir - resolved profile directory (owns pnpm-workspace.yaml, or not).
+ * @param pluginArgs - the raw args, e.g. ['add', 'dshmarket@latest'].
+ * @returns args with -w injected when — and only when — the profile is a workspace root.
+ */
+export function pluginArgsFor(profileDir: string, pluginArgs: string[]): string[] {
+  if (pluginArgs[0] !== 'add' && pluginArgs[0] !== 'remove') return pluginArgs
+  if (!existsSync(join(profileDir, 'pnpm-workspace.yaml'))) return pluginArgs
+  return [pluginArgs[0], '-w', ...pluginArgs.slice(1)]
+}
+
+/** One recognized pnpm failure, with a bilingual explanation for the UI. */
+export interface PnpmFailure {
+  code: 'adding-to-root' | 'not-a-workspace' | 'hoist-pattern-diff' | 'pnpm-missing'
+  /** Bilingual, actionable message shown to the user instead of the raw wall of text. */
+  message: string
+  /** True when re-running `pnpm install` in the profile is the documented recovery. */
+  recoverable: boolean
+}
+
+/**
+ * Map a failed pnpm run's combined output to a known failure mode.
+ *
+ * dsh's own wrapper line ("dsh: pnpm failed in profile directory …") names no
+ * cause, so the market must recognize pnpm's real diagnostics itself (#20).
+ * @param output - stdout+stderr of the failed run.
+ * @returns the classified failure, or null when unrecognized (raw output is then shown as-is).
+ */
+export function classifyPnpmFailure(output: string): PnpmFailure | null {
+  if (output.includes('ERR_PNPM_PUBLIC_HOIST_PATTERN_DIFF')) {
+    return {
+      code: 'hoist-pattern-diff',
+      recoverable: true,
+      message: 'profile 的 node_modules 是旧版 pnpm 创建的，与当前 pnpm 的默认配置不兼容，需要重建后重试 / this profile\'s node_modules was created by a different pnpm major; it must be rebuilt (pnpm install) before changes can be applied',
+    }
+  }
+  if (output.includes('ERR_PNPM_ADDING_TO_ROOT')) {
+    return {
+      code: 'adding-to-root',
+      recoverable: false,
+      message: 'pnpm 拒绝在 workspace 根目录安装（缺少 -w）。这是市场的 bug，请升级 dshmarket 到最新版 / pnpm refused to add at a workspace root (missing -w); this is a market bug — please update dshmarket',
+    }
+  }
+  if (/--workspace-root may only be used inside a workspace/i.test(output)) {
+    return {
+      code: 'not-a-workspace',
+      recoverable: false,
+      message: 'profile 目录不是 pnpm workspace，却传入了 -w。这是市场的 bug，请升级 dshmarket 到最新版 / -w was passed but the profile is not a pnpm workspace; this is a market bug — please update dshmarket',
+    }
+  }
+  if (output.includes('pnpm not found on PATH')) {
+    return {
+      code: 'pnpm-missing',
+      recoverable: false,
+      message: '找不到 pnpm，请先在市场页顶部一键安装组件 / pnpm is not on PATH — use the one-click setup at the top of the market page',
+    }
+  }
+  return null
+}