dshmarket 1.2.2 → 1.2.4

package/src/client/MarketSection.tsx

@@ -7,7 +7,8 @@ import { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState, use
 import { Button, IconChevronDownOutline14, IconChevronUpOutline14, IconSearchOutline16, Input, Modal, Pill, StateDot } from '@deepseek-ai/dsh-client-ui-primitives'
 import css from './Market.module.css'
 import {
-  avatarColor, entryForDep, isInstalled, LOGO_URI, looksTerminal, matchInstalledName, readSession, repoOf, themeSwatch,
+  avatarColor, entryForDep, isInstalled, LOGO_URI, looksTerminal, matchInstalledName, orderedCategories,
+  readSession, repoOf, themePlugins as themePluginsOf, themeSwatch, visiblePlugins,
 } from './market-data.ts'
 import type {
   InstalledMap, Registry, RegistryPlugin, ThemeSnapshot, Translate, UpdateStatus,
@@ -37,6 +38,14 @@ function OwnerAvatar({ name, owner }: { name: string; owner: string }) {
   )
 }
 
+/**
+ * Module-scope caches so re-entering the section renders instantly instead
+ * of refetching and rebuilding from a spinner (#30 by @StarsTom). Module
+ * state survives section switches; a background refetch keeps it current.
+ */
+let cachedRegistry: Registry | null = null
+let cachedInstalled: InstalledMap | null = null
+
 export interface MarketSectionProps {
   t: Translate
   locale: {
@@ -62,9 +71,10 @@ export function MarketSection(props: MarketSectionProps) {
     props.themeStore.subscribe,
     props.themeStore.getSnapshot,
   )
-  const [data, setData] = useState<Registry | null>(null)
+  const [data, setData] = useState<Registry | null>(cachedRegistry)
   const [loadError, setLoadError] = useState(false)
-  const [installed, setInstalled] = useState<InstalledMap>({})
+  const [installed, setInstalledState] = useState<InstalledMap>(cachedInstalled ?? {})
+  const setInstalled = useCallback((value: InstalledMap) => { cachedInstalled = value; setInstalledState(value) }, [])
   const [skins, setSkins] = useState<string[]>([])
   const [tab, setTab] = useState(() => {
     const saved = sessionStorage.getItem('dshm-tab')
@@ -79,6 +89,28 @@ export function MarketSection(props: MarketSectionProps) {
   const [installError, setInstallError] = useState<string | null>(null)
   const [updates, setUpdates] = useState<Record<string, UpdateStatus>>({})
   const [updatingName, setUpdatingName] = useState<string | null>(null)
+  // Plugin blocked by pnpm's fresh-release safety wait; arms the update-now button.
+  const [staleName, setStaleName] = useState<string | null>(null)
+  /**
+   * Cards rendered so far — the discover grid renders incrementally (60,
+   * then +120 as the sentinel scrolls into view) instead of all 400+ at
+   * once, which built a ~70k px DOM and made section switches lag (#30).
+   */
+  const [visibleCount, setVisibleCount] = useState(60)
+  const sentinelRef = useCallback((node: HTMLDivElement | null) => {
+    if (node === null) return
+    const observer = new IntersectionObserver((entries) => {
+      if (entries.some(entry => entry.isIntersecting)) setVisibleCount(count => count + 120)
+    }, { rootMargin: '600px' })
+    observer.observe(node)
+    // Cleanup runs when React detaches the node and calls back with null;
+    // the observer dies with the node, so a one-shot observe suffices.
+  }, [])
+
+  /** Determinate percent parsed from pnpm's Progress line, when available. */
+  const [progressPct, setProgressPct] = useState<number | null>(null)
+  /** Blocked build scripts from the last install: enables approve-and-retry (#6). */
+  const [buildsSkipped, setBuildsSkipped] = useState<{ plugin: RegistryPlugin; names: string[] } | null>(null)
   const [updatingAll, setUpdatingAll] = useState(false)
   const [updatedNames, setUpdatedNames] = useState<string[]>([])
   const [hotUrls, setHotUrls] = useState<string[]>([])
@@ -118,7 +150,7 @@ export function MarketSection(props: MarketSectionProps) {
   useEffect(() => {
     fetch('/dsh-market/registry', { cache: 'no-store' })
       .then(res => { if (!res.ok) throw new Error('HTTP ' + res.status); return res.json() })
-      .then(body => setData(body.registry))
+      .then(body => { cachedRegistry = body.registry; setData(body.registry) })
       .catch(() => setLoadError(true))
     fetch('/dsh-market/status', { cache: 'no-store' })
       .then(res => res.json())
@@ -189,8 +221,14 @@ export function MarketSection(props: MarketSectionProps) {
         .then(status => {
           if (status.active) {
             setProgressLine((status.lastLine || '…') + '  (' + status.seconds + 's)')
+            const m = /resolved (\d+), reused (\d+), downloaded (\d+), added (\d+)/.exec(status.lastLine || '')
+            if (m !== null && Number(m[1]) > 0) {
+              const done = Number(m[2]) + Number(m[3]) + Number(m[4])
+              setProgressPct(Math.max(4, Math.min(96, Math.round(done / Number(m[1]) * 100))))
+            }
           } else {
             setProgressLine(null)
+            setProgressPct(null)
             setInstalled(status.installed || {})
             const pending = readSession('dshm-pending')
             if (pending !== null && busyUrl !== null) {
@@ -209,27 +247,14 @@ export function MarketSection(props: MarketSectionProps) {
     return () => clearInterval(timer)
   }, [busyUrl, updatingName, data])
 
-  const plugins = useMemo(() => {
-    if (data === null) return []
-    const query = q.trim().toLowerCase()
-    const list = data.plugins.filter(p => {
-      if (cat !== 'all' && p.category !== cat) return false
-      if (query === '') return true
-      const desc = (p.description && (p.description[lang] || p.description.en)) || ''
-      return p.name.toLowerCase().includes(query)
-        || p.owner.toLowerCase().includes(query)
-        || desc.toLowerCase().includes(query)
-    })
-    if (sort === 'hot') {
-      return [...list].sort((a, b) => (b.stars ?? -1) - (a.stars ?? -1))
-    }
-    if (sort === 'new') {
-      return [...list].sort((a, b) => String(b.added).localeCompare(String(a.added)))
-    }
-    return list
-  }, [data, q, cat, lang, sort])
+  const plugins = useMemo(
+    () => (data === null ? [] : visiblePlugins(data.plugins, { category: cat, query: q, lang, sort })),
+    [data, q, cat, lang, sort])
+
+  useEffect(() => { setVisibleCount(60) }, [q, cat, sort])
 
   const doInstall = useCallback((plugin: RegistryPlugin) => {
+    setBuildsSkipped(null)
     setConfirming(null)
     setInstallError(null)
     setBusyUrl(plugin.url)
@@ -250,6 +275,11 @@ export function MarketSection(props: MarketSectionProps) {
           location.reload()
           return
         }
+        if (body.cancelled === true) {
+          // User-cancelled: quiet reset, nothing to report.
+          refreshInstalled()
+          return
+        }
         if (status === 200 && body.ok) {
           sessionStorage.setItem('dshm-tab', 'installed')
           if (body.hot) {
@@ -260,6 +290,13 @@ export function MarketSection(props: MarketSectionProps) {
           }
           refreshInstalled()
         } else {
+          if (status === 409) {
+            setInstallError(t('busyWait'))
+            return
+          }
+          if (Array.isArray(body.ignoredBuilds) && body.ignoredBuilds.length > 0) {
+            setBuildsSkipped({ plugin, names: body.ignoredBuilds.map(String) })
+          }
           const text = (v: unknown) => typeof v === 'string' ? v : (v && typeof (v as any).text === 'string') ? (v as any).text : v == null ? '' : JSON.stringify(v)
           const detail = text(body.error) || [text(body.stderr), text(body.stdout)].filter(Boolean).join('\n').trim() || ('exit ' + body.exitCode)
           setInstallError(t('installFail') + ': ' + plugin.name + ' — ' + detail.trim().slice(-600))
@@ -272,20 +309,33 @@ export function MarketSection(props: MarketSectionProps) {
       .finally(() => setBusyUrl(null))
   }, [refreshInstalled, t])
 
-  const doUpdate = useCallback((name: string) => {
+  /** Cancel the running plugin command (#6 by @qichuang321). */
+  const doCancel = useCallback(() => {
+    fetch('/dsh-market/cancel', { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}' })
+      .catch(() => {})
+  }, [])
+
+  const doUpdate = useCallback((name: string, force = false) => {
     setInstallError(null)
+    setStaleName(null)
     setUpdatingName(name)
     return fetch('/dsh-market/update', {
       method: 'POST',
       headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ name }),
+      body: JSON.stringify(force ? { name, force: true } : { name }),
     })
       .then(res => res.json().then(body => ({ status: res.status, body })))
       .then(({ status, body }) => {
+        if (body.cancelled === true) {
+          refreshInstalled()
+          return
+        }
         if (status === 200 && body.ok) {
           setUpdatedNames(names => names.concat(name))
           refreshInstalled()
         } else {
+          if (status === 409) { setInstallError(t('busyWait')); return }
+          if (body.stale === true) setStaleName(name)
           const text = (v: unknown) => typeof v === 'string' ? v : (v && typeof (v as any).text === 'string') ? (v as any).text : v == null ? '' : JSON.stringify(v)
           const detail = text(body.error) || [text(body.stderr), text(body.stdout)].filter(Boolean).join('\n').trim() || ('exit ' + body.exitCode)
           setInstallError(t('updateFail') + ': ' + name + ' — ' + detail.trim().slice(-600))
@@ -365,9 +415,7 @@ export function MarketSection(props: MarketSectionProps) {
     name => !updatedNames.includes(name) && updates[name] && updates[name].updateAvailable,
   )
 
-  const themePlugins = data === null ? [] : data.plugins
-    .filter(p => p.category === 'theme')
-    .sort((a, b) => (b.stars || 0) - (a.stars || 0))
+  const themePlugins = data === null ? [] : themePluginsOf(data.plugins)
 
   const pluginCard = (p: RegistryPlugin) => {
     const desc = (p.description && (p.description[lang] || p.description.en)) || ''
@@ -413,6 +461,8 @@ export function MarketSection(props: MarketSectionProps) {
           <div className={css.progress}>
             <span className={css.spin} />
             <code className={css.grow}>{progressLine || t('progressHint')}</code>
+            {progressPct !== null && <span className={css.pct}>{progressPct}%</span>}
+            <button type="button" className={css.cancelBtn} onClick={doCancel}>{t('cancelOp')}</button>
           </div>
         )}
       </div>
@@ -591,7 +641,40 @@ export function MarketSection(props: MarketSectionProps) {
           </div>
         )}
       </div>
-      {installError !== null && <div className={css.err}>{installError}</div>}
+      {buildsSkipped !== null && (
+        <div className={css.restart}>
+          <span className={css.grow}>{t('buildsSkipped')} {buildsSkipped.names.join(', ')}</span>
+          <Button
+            size="sm"
+            disabled={busyUrl !== null}
+            onClick={() => {
+              const { plugin, names } = buildsSkipped
+              setBuildsSkipped(null)
+              fetch('/dsh-market/approve-builds', {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ packages: names }),
+              })
+                .then(res => res.json())
+                .then((body) => {
+                  if (body.ok) doInstall(plugin)
+                  else setInstallError(String(body.error || 'approve failed'))
+                })
+                .catch(error => setInstallError(String(error)))
+            }}
+          >{t('approveBuilds')}</Button>
+        </div>
+      )}
+      {installError !== null && (
+        <div className={css.err}>
+          {installError}
+          {staleName !== null && (
+            <div className={css.staleAction}>
+              <Button size="sm" onClick={() => doUpdate(staleName, true)}>{t('updateNow')}</Button>
+            </div>
+          )}
+        </div>
+      )}
       <div
         className={css.body}
         ref={bodyRef}
@@ -609,7 +692,7 @@ export function MarketSection(props: MarketSectionProps) {
                       <div ref={catsWrapRef} className={catsOpen || visibleCats === null ? `${css.catsWrap} ${css.catsCollapsed}` : css.catsWrap}>
                         {(() => {
                           // Collapsed, the selected category is pulled to the front so it never hides.
-                          const ordered = catsOpen || cat === 'all' ? categories : [cat, ...categories.filter(id => id !== cat)]
+                          const ordered = orderedCategories(categories, cat, catsOpen)
                           const shown = catsOpen || visibleCats === null ? ordered : ordered.slice(0, Math.max(0, visibleCats - 1))
                           return (
                             <>
@@ -647,7 +730,12 @@ export function MarketSection(props: MarketSectionProps) {
                     </div>
                     {plugins.length === 0
                       ? <div className={css.empty}>{t('empty')}</div>
-                      : <div className={css.grid}>{plugins.map(pluginCard)}</div>}
+                      : (
+                          <>
+                            <div className={css.grid}>{plugins.slice(0, visibleCount).map(pluginCard)}</div>
+                            {plugins.length > visibleCount && <div ref={sentinelRef} className={css.sentinel} />}
+                          </>
+                        )}
                   </>
                 )
           : tab === 'themes' && themeSnap !== null
@@ -696,6 +784,8 @@ export function MarketSection(props: MarketSectionProps) {
                           <div className={css.progress}>
                             <span className={css.spin} />
                             <code className={css.grow}>{progressLine || t('progressHint')}</code>
+                            {progressPct !== null && <span className={css.pct}>{progressPct}%</span>}
+                            <button type="button" className={css.cancelBtn} onClick={doCancel}>{t('cancelOp')}</button>
                           </div>
                         )}
                       </div>

package/src/client/locales.ts

@@ -29,6 +29,12 @@ export const zh = {
   update: '更新',
   updating: '更新中…',
   updated: '✓ 已更新，重启后生效',
+  cancelOp: '取消',
+  cancelled: '已取消',
+  busyWait: '已有操作正在进行，请等它结束（同一时间只执行一个安装/更新/卸载）',
+  approveBuilds: '放行构建脚本并重试',
+  buildsSkipped: '该插件需要运行构建脚本才能工作，出于安全默认被拦下。点击下方按钮为它放行并重装：',
+  updateNow: '立即更新',
   updateFail: '更新失败',
   upToDate: '已是最新',
   linkedDev: '本地开发链接',
@@ -91,6 +97,12 @@ export const en: Record<MarketKey, string> = {
   update: 'Update',
   updating: 'Updating…',
   updated: '✓ Updated — restart to apply',
+  cancelOp: 'Cancel',
+  cancelled: 'Cancelled',
+  busyWait: 'Another operation is already running — please wait for it to finish (one install/update/uninstall at a time)',
+  approveBuilds: 'Allow build scripts and retry',
+  buildsSkipped: 'This plugin needs its build scripts to run; they are blocked by default for safety. Click below to allow them and reinstall:',
+  updateNow: 'Update now',
   updateFail: 'Update failed',
   upToDate: 'Up to date',
   linkedDev: 'linked (dev)',

package/src/client/market-data.ts

@@ -84,6 +84,55 @@ export function looksTerminal(plugin: RegistryPlugin, lang: string): boolean {
   return /\b(tui|cli|tty|terminal)\b|终端|命令行/i.test(plugin.name + ' ' + desc)
 }
 
+/** Filters and sort order driving the discover list. */
+export interface ListQuery {
+  /** Active category id, or 'all'. */
+  category: string
+  /** Raw search input (trimmed and lowercased internally). */
+  query: string
+  /** UI language for description matching ('zh' / 'en'). */
+  lang: string
+  /** 'hot' (stars desc), 'new' (added desc), anything else keeps registry order. */
+  sort: string
+}
+
+/**
+ * The discover list: category filter, then search across name / owner /
+ * localized description, then the selected sort. Pure — the section renders
+ * exactly this.
+ */
+export function visiblePlugins(plugins: RegistryPlugin[], options: ListQuery): RegistryPlugin[] {
+  const query = options.query.trim().toLowerCase()
+  const list = plugins.filter((p) => {
+    if (options.category !== 'all' && p.category !== options.category) return false
+    if (query === '') return true
+    const desc = (p.description && (p.description[options.lang] || p.description.en)) || ''
+    return p.name.toLowerCase().includes(query)
+      || p.owner.toLowerCase().includes(query)
+      || desc.toLowerCase().includes(query)
+  })
+  if (options.sort === 'hot') {
+    return [...list].sort((a, b) => (b.stars ?? -1) - (a.stars ?? -1))
+  }
+  if (options.sort === 'new') {
+    return [...list].sort((a, b) => String(b.added).localeCompare(String(a.added)))
+  }
+  return list
+}
+
+/** The themes tab listing: theme category only, most-starred first. */
+export function themePlugins(plugins: RegistryPlugin[]): RegistryPlugin[] {
+  return plugins.filter(p => p.category === 'theme').sort((a, b) => (b.stars || 0) - (a.stars || 0))
+}
+
+/**
+ * Category chip order: collapsed with an active non-'all' chip, the active
+ * one moves to the front so it stays visible inside the two-row clip.
+ */
+export function orderedCategories(categories: string[], active: string, open: boolean): string[] {
+  return open || active === 'all' ? categories : [active, ...categories.filter(id => id !== active)]
+}
+
 /**
  * Unified installed-state matching (#15): both sides collapse to lowercase
  * identity sets — the registry entry contributes its bare name, npm name and
@@ -94,8 +143,12 @@ export function looksTerminal(plugin: RegistryPlugin, lang: string): boolean {
 function entryIdentities(plugin: RegistryPlugin): Set<string> {
   const ids = new Set<string>([plugin.name.toLowerCase()])
   if (plugin.npm) ids.add(plugin.npm.toLowerCase())
-  const repo = repoOf(plugin.url)
-  if (repo !== null) ids.add(repo.toLowerCase())
+  // Subpath-aware: a /tree/ entry identifies as repo#path:/sub, never the
+  // bare repo — two subpackages of one monorepo must not cross-match.
+  const m = /^https:\/\/github\.com\/([^/]+\/[^/]+?)(?:\/tree\/[^/]+\/(.+?))?\/?$/.exec(plugin.url)
+  if (m !== null) {
+    ids.add(m[2] !== undefined ? `${m[1]!.toLowerCase()}#path:/${m[2].toLowerCase()}` : m[1]!.toLowerCase())
+  }
   return ids
 }
 
@@ -105,8 +158,11 @@ function depIdentities(name: string, spec: string): Set<string> {
   // npm-installed plugin still matches an entry whose npm field is unset.
   const scoped = /^@([^/]+)\/(.+)$/.exec(name)
   if (scoped !== null) ids.add(`${scoped[1]!.toLowerCase()}/${scoped[2]!.toLowerCase()}`)
-  const match = /github:([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+)/i.exec(spec)
-  if (match !== null) ids.add(match[1]!.toLowerCase())
+  const match = /github:([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+)(?:#path:\/([A-Za-z0-9_./-]+))?/i.exec(spec)
+  if (match !== null) {
+    ids.add(match[1]!.toLowerCase())
+    if (match[2] !== undefined) ids.add(`${match[1]!.toLowerCase()}#path:/${match[2].toLowerCase()}`)
+  }
   return ids
 }
 

package/src/dsh-cli.ts

@@ -0,0 +1,248 @@
+/**
+ * Process layer: re-invoking the dsh CLI that launched this host, spawning
+ * `dsh plugin` commands with timeouts and live progress, and provisioning
+ * pnpm. This is the only module that starts child processes.
+ *
+ * Installs run through node:child_process, not ctx.shell: the shell service is
+ * the agent's sandboxed executor and denies writes to the profile directory.
+ */
+
+import { spawn } from 'node:child_process'
+import type { ChildProcess } from 'node:child_process'
+import { dirname, resolve } from 'node:path'
+import { logEvent } from './log.ts'
+import { pluginArgsFor } from './pnpm-compat.ts'
+import { profileDir } from './profile.ts'
+
+// 15 min default (slow networks + git installs), overridable for CI/tests.
+// (#6 by @qichuang321.)
+const INSTALL_TIMEOUT_MS = Number(process.env.DSH_MARKET_INSTALL_TIMEOUT_MS) || 15 * 60 * 1000
+
+/**
+ * Windows npm/corepack/pnpm are `.cmd` shims. Node's `spawn` without a shell
+ * cannot start them (ENOENT / EINVAL). Same pattern as dsh's `plugin` forwarder.
+ */
+export const winCmdShim = process.platform === 'win32'
+
+/**
+ * Argv re-invoking the CLI that launched this host process, so installs work
+ * whether dsh runs from a global bin, a local install, or repo source
+ * (`node --import tsx/esm .../bin.ts`). Falls back to a PATH `dsh`.
+ */
+export function dshArgv(): { file: string; args: string[]; cwd: string | undefined; viaShell: boolean } {
+  const entry = process.argv[1]
+  if (entry !== undefined && /[\\/](?:bin\.(?:js|ts)|dsh)$/.test(entry)) {
+    // Absolute paths are required: source launches (`pnpm dsh`) pass a
+    // relative entry, which the child resolves against its OWN cwd and dies
+    // with MODULE_NOT_FOUND (#13). cwd near the entry keeps execArgv imports
+    // (tsx/esm) resolvable on source launches.
+    const abs = resolve(entry)
+    return { file: process.execPath, args: [...process.execArgv, abs], cwd: dirname(abs), viaShell: false }
+  }
+  // Bare `dsh` is a .cmd shim on Windows that only a shell can start (#13).
+  return { file: 'dsh', args: [], cwd: undefined, viaShell: winCmdShim }
+}
+
+/** Outcome of one spawned plugin command. */
+export interface InstallResult {
+  exitCode: number | null
+  timedOut: boolean
+  stdout: string
+  stderr: string
+  /** True when the run ended because the user cancelled it. */
+  cancelled: boolean
+}
+
+/** The shape every orchestration function takes to run plugin commands (injectable in tests). */
+export type PluginRunner = (profile: string, pluginArgs: string[]) => Promise<InstallResult>
+
+/**
+ * Kill a spawned child and, on Windows, its whole process tree — `kill()`
+ * there only terminates the wrapper, leaving pnpm children running.
+ * (Contributed in #7 by @mraing.)
+ */
+export function killChild(child: ChildProcess): void {
+  if (process.platform === 'win32' && child.pid !== undefined) {
+    try {
+      spawn('taskkill', ['/pid', String(child.pid), '/t', '/f'], { stdio: 'ignore' })
+      return
+    } catch { /* fall through */ }
+  }
+  child.kill('SIGKILL')
+}
+
+/** The child of the operation currently running, for /dsh-market/cancel. */
+let activeChild: ChildProcess | null = null
+let cancelRequested = false
+
+/**
+ * Kill a child and its whole tree, gracefully where the platform allows:
+ * taskkill /T /F on Windows (plain kill() leaves pnpm children running),
+ * SIGTERM with a 5s SIGKILL escalation elsewhere so pnpm can clean up.
+ * (Cancel flow contributed in #6 by @qichuang321.)
+ */
+function killTree(child: ChildProcess): void {
+  if (process.platform === 'win32' && child.pid !== undefined) {
+    try {
+      spawn('taskkill', ['/pid', String(child.pid), '/t', '/f'], { stdio: 'ignore' })
+      return
+    } catch { /* fall through */ }
+  }
+  // POSIX: the dsh wrapper runs pnpm as a grandchild (spawnSync), which a
+  // plain child.kill() leaves running — it keeps our stdio pipes open, so
+  // the close event never fires and the market looks stuck "installing".
+  // The child is spawned detached as its own process GROUP; kill the group.
+  const signalTree = (signal: NodeJS.Signals): void => {
+    if (child.pid === undefined) return
+    try { process.kill(-child.pid, signal) } catch {
+      try { child.kill(signal) } catch { /* already gone */ }
+    }
+  }
+  signalTree('SIGTERM')
+  const escalate = setTimeout(() => signalTree('SIGKILL'), 5000)
+  escalate.unref?.()
+}
+
+/**
+ * Cancel the plugin command currently running.
+ * @returns true when there was one to cancel.
+ */
+export function cancelActive(): boolean {
+  if (activeChild === null) return false
+  cancelRequested = true
+  killTree(activeChild)
+  return true
+}
+
+/** Whether `pnpm` resolves on PATH; success is cached, absence is re-probed. */
+let pnpmReady = false
+
+/** Probe `pnpm --version` on PATH. */
+export function probePnpm(): Promise<boolean> {
+  if (pnpmReady) return Promise.resolve(true)
+  return new Promise((resolvePromise) => {
+    const child = spawn('pnpm', ['--version'], { stdio: 'ignore', shell: winCmdShim })
+    child.on('error', () => resolvePromise(false))
+    child.on('close', (code) => {
+      pnpmReady = code === 0
+      resolvePromise(pnpmReady)
+    })
+  })
+}
+
+function runQuiet(file: string, args: string[], timeoutMs: number): Promise<{ code: number | null; output: string }> {
+  return new Promise((resolvePromise) => {
+    const child = spawn(file, args, {
+      env: { ...process.env, CI: 'true' },
+      stdio: ['ignore', 'pipe', 'pipe'],
+      shell: winCmdShim,
+    })
+    let output = ''
+    const timer = setTimeout(() => killChild(child), timeoutMs)
+    const collect = (chunk: Buffer): void => { output = (output + chunk.toString()).slice(-8 * 1024) }
+    child.stdout.on('data', collect)
+    child.stderr.on('data', collect)
+    child.on('error', (error) => { clearTimeout(timer); resolvePromise({ code: 127, output: error.message }) })
+    child.on('close', (code) => { clearTimeout(timer); resolvePromise({ code, output }) })
+  })
+}
+
+/**
+ * Provision pnpm without user involvement: corepack (ships with Node) first,
+ * a global npm install as fallback.
+ * @returns true when `pnpm --version` succeeds afterwards.
+ */
+export async function provisionPnpm(): Promise<boolean> {
+  const corepack = await runQuiet('corepack', ['enable', 'pnpm'], 60 * 1000)
+  logEvent(corepack.code === 0 ? 'info' : 'warn', 'setup-pnpm', `corepack enable: exit=${String(corepack.code)} ${corepack.output.slice(-200)}`)
+  if (await probePnpm()) return true
+  const npm = await runQuiet('npm', ['install', '-g', 'pnpm'], 3 * 60 * 1000)
+  logEvent(npm.code === 0 ? 'info' : 'error', 'setup-pnpm', `npm -g: exit=${String(npm.code)} ${npm.output.slice(-200)}`)
+  return probePnpm()
+}
+
+/** Live progress of the running plugin command, for the status route. */
+export interface InstallProgress {
+  active: boolean
+  target: string
+  startedAt: number
+  lastLine: string
+}
+
+/** Singleton progress state; the status route reads it, runDshPlugin writes it. */
+export const progress: InstallProgress = { active: false, target: '', startedAt: 0, lastLine: '' }
+
+/** Identifies this host process; the client scopes its pending-restart flags to it. */
+export const BOOT_ID = `${String(process.pid)}-${String(Date.now())}`
+
+function trackProgress(chunk: string): void {
+  const lines = chunk.split('\n').map(l => l.trim()).filter(l => l !== '')
+  if (lines.length > 0) progress.lastLine = lines[lines.length - 1].slice(0, 200)
+}
+
+/**
+ * Central allowlist for every spawn target, regardless of which route built
+ * it (defense in depth on top of per-route validation — the win32 bare-dsh
+ * fallback runs through a shell). Suggested in #16 by @anupamme.
+ */
+const TARGET_RE = /^[A-Za-z0-9@:./_#+-]+$/
+
+/** Run one `dsh plugin --profile <p> …` command with timeout and progress tracking. */
+export function runDshPlugin(profile: string, pluginArgs: string[]): Promise<InstallResult> {
+  const { file, args, cwd, viaShell } = dshArgv()
+  pluginArgs = pluginArgsFor(profileDir(profile), pluginArgs)
+  const target = pluginArgs[pluginArgs.length - 1] ?? ''
+  if (!TARGET_RE.test(target)) {
+    logEvent('error', 'install', `unsafe plugin target rejected: ${JSON.stringify(target)}`)
+    return Promise.resolve({ exitCode: 1, timedOut: false, stdout: '', stderr: `unsafe plugin target rejected: ${JSON.stringify(target)}`, cancelled: false })
+  }
+  progress.active = true
+  progress.target = target
+  progress.startedAt = Date.now()
+  progress.lastLine = ''
+  return new Promise((resolvePromise) => {
+    const child = spawn(file, [...args, 'plugin', '--profile', profile, ...pluginArgs], {
+      cwd,
+      // pnpm v10 blocks forever on a silent interactive prompt without a TTY
+      // (observed on re-add over a pinned git spec); CI mode forces it to act
+      // or fail instead of asking.
+      env: { ...process.env, CI: 'true' },
+      stdio: ['ignore', 'pipe', 'pipe'],
+      shell: viaShell,
+      // Own process group on POSIX so cancel/timeout can kill the whole
+      // tree (dsh wrapper + pnpm grandchild) with one group signal.
+      detached: process.platform !== 'win32',
+    })
+    activeChild = child
+    cancelRequested = false
+    let stdout = ''
+    let stderr = ''
+    let timedOut = false
+    const timer = setTimeout(() => {
+      timedOut = true
+      killTree(child)
+    }, INSTALL_TIMEOUT_MS)
+    child.stdout.on('data', (chunk: Buffer) => {
+      const text = chunk.toString()
+      stdout = (stdout + text).slice(-256 * 1024)
+      trackProgress(text)
+    })
+    child.stderr.on('data', (chunk: Buffer) => {
+      const text = chunk.toString()
+      stderr = (stderr + text).slice(-64 * 1024)
+      trackProgress(text)
+    })
+    child.on('error', (error) => {
+      clearTimeout(timer)
+      progress.active = false
+      if (activeChild === child) activeChild = null
+      resolvePromise({ exitCode: 127, timedOut: false, stdout, stderr: `${stderr}\n${error.message}`, cancelled: false })
+    })
+    child.on('close', (code) => {
+      clearTimeout(timer)
+      progress.active = false
+      if (activeChild === child) activeChild = null
+      resolvePromise({ exitCode: code, timedOut, stdout, stderr, cancelled: cancelRequested })
+    })
+  })
+}

package/src/http.ts

@@ -0,0 +1,41 @@
+/**
+ * Minimal HTTP helpers shared by every market route: JSON serialization,
+ * same-origin enforcement for mutating endpoints, and a size-capped JSON
+ * body reader.
+ */
+
+import type { IncomingMessage, ServerResponse } from 'node:http'
+
+/** Write a JSON payload with no-store caching. */
+export function sendJson(response: ServerResponse, status: number, payload: unknown): void {
+  response.writeHead(status, {
+    'cache-control': 'no-store',
+    'content-type': 'application/json; charset=utf-8',
+  })
+  response.end(JSON.stringify(payload))
+}
+
+/** True when the request's Origin matches its Host — required on every POST route. */
+export function sameOrigin(request: IncomingMessage): boolean {
+  const origin = request.headers.origin
+  const host = request.headers.host
+  if (origin === undefined || host === undefined) return false
+  try {
+    return new URL(origin).host === host
+  } catch {
+    return false
+  }
+}
+
+/** Read and parse a JSON request body, rejecting anything over 4 KiB. */
+export async function readJsonBody(request: IncomingMessage): Promise<unknown> {
+  const chunks: Buffer[] = []
+  let size = 0
+  for await (const chunk of request) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    size += buffer.length
+    if (size > 4096) throw new Error('request body too large')
+    chunks.push(buffer)
+  }
+  return JSON.parse(Buffer.concat(chunks).toString('utf8')) as unknown
+}