dshmarket 1.2.3 → 1.2.4

package/lib/install.js

@@ -19,7 +19,7 @@ import { logEvent } from './log.js';
  */
 export async function withHoistRecovery(run, profile, pluginArgs) {
     let result = await run(profile, pluginArgs);
-    const ok = (r) => r.exitCode === 0 && !r.timedOut;
+    const ok = (r) => r.exitCode === 0 && !r.timedOut && !r.cancelled;
     if (!ok(result) && classifyPnpmFailure(`${result.stderr}\n${result.stdout}`)?.code === 'hoist-pattern-diff') {
         logEvent('warn', 'install', `modules dir was built by a different pnpm major — rebuilding (pnpm install) and retrying once`);
         // --no-frozen-lockfile: the market runs pnpm with CI=true (TTY hangs),
@@ -28,7 +28,7 @@ export async function withHoistRecovery(run, profile, pluginArgs) {
         if (ok(rebuild))
             result = await run(profile, pluginArgs);
     }
-    if (!ok(result)) {
+    if (!ok(result) && !result.cancelled) {
         const failure = classifyPnpmFailure(`${result.stderr}\n${result.stdout}`);
         if (failure !== null)
             result = { ...result, stderr: `${result.stderr}\n\n${failure.message}` };
@@ -108,3 +108,25 @@ export function isStaleUpdate(check) {
         ? check.beforeCommit !== null && check.afterCommit === check.beforeCommit
         : check.beforeVersion !== null && check.afterVersion === check.beforeVersion;
 }
+/**
+ * Package names pnpm reported as having their build scripts ignored
+ * ("Ignored build scripts: esbuild, koffi."). Empty when none.
+ * (#6 by @qichuang321.)
+ */
+export function parseIgnoredBuilds(stdout, stderr) {
+    const m = /Ignored build scripts:?\s*([^\n]+)/i.exec(`${stdout}\n${stderr}`);
+    if (m === null)
+        return [];
+    const found = [];
+    for (const chunk of m[1].split(',')) {
+        // Entries may carry a version suffix and the sentence's final period.
+        const trimmed = chunk.trim().replace(/\.$/, '');
+        if (trimmed === '')
+            continue;
+        const at = trimmed.lastIndexOf('@');
+        const name = at > 0 ? trimmed.slice(0, at) : trimmed;
+        if (name !== '' && !found.includes(name))
+            found.push(name);
+    }
+    return found;
+}

package/lib/profile.js

@@ -3,7 +3,7 @@
  * profile directory (manifest, lockfile, installed package trees). Pure
  * functions of the directory contents; no processes, no network.
  */
-import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 /** Resolve a profile name to its directory under DSH_HOME (default ~/.dsh). */
@@ -11,13 +11,25 @@ export function profileDir(profile) {
     const home = process.env.DSH_HOME ?? join(homedir(), '.dsh');
     return join(home, 'profiles', profile);
 }
-/** Community dependencies of the profile (official in-box scope filtered out). */
+/**
+ * The in-box bundles dsh's profile templates install themselves — the ONLY
+ * names the market hides from the installed list. Community plugins may
+ * legitimately publish under the official scope (#28), so a whole-scope
+ * filter would make them invisible and fail install validation.
+ * (Diagnosis and fix proposed in #28 by @Lograthmic.)
+ */
+const INBOX_BUNDLES = new Set([
+    '@deepseek-ai/dsh-base',
+    '@deepseek-ai/dsh-web-app',
+    '@deepseek-ai/dsh-headless',
+]);
+/** Community dependencies of the profile (in-box bundles filtered out). */
 export function readInstalled(profile) {
     try {
         const manifest = JSON.parse(readFileSync(join(profileDir(profile), 'package.json'), 'utf8'));
         const installed = {};
         for (const [name, spec] of Object.entries(manifest.dependencies ?? {})) {
-            if (!name.startsWith('@deepseek-ai/'))
+            if (!INBOX_BUNDLES.has(name))
                 installed[name] = spec;
         }
         return installed;
@@ -119,3 +131,36 @@ export function pluginSubdirs(root) {
     }
     return found.slice(0, 8);
 }
+/**
+ * Allow the given packages' build scripts in the profile's
+ * pnpm-workspace.yaml `allowBuilds` block (the key dsh profiles use),
+ * merging with existing entries and leaving the rest of the yaml intact.
+ * (#6 by @qichuang321.)
+ * @returns every package now allowed.
+ */
+export function setAllowBuilds(profile, packages) {
+    const file = join(profileDir(profile), 'pnpm-workspace.yaml');
+    let yaml = '';
+    try {
+        yaml = readFileSync(file, 'utf8');
+    }
+    catch { /* created below */ }
+    const blockRe = /allowBuilds:\n((?:[ \t]+[^\n]*\n?)*)/;
+    const map = {};
+    const blockMatch = blockRe.exec(yaml);
+    if (blockMatch !== null) {
+        for (const line of blockMatch[1].split('\n')) {
+            const m = /^[ \t]+([^:\s]+(?:\/[^:\s]+)?)\s*:\s*(\S.*)?$/.exec(line);
+            if (m !== null)
+                map[m[1]] = m[2] ?? 'true';
+        }
+    }
+    for (const pkg of packages) {
+        if (/^[A-Za-z0-9@/_.-]+$/.test(pkg))
+            map[pkg] = 'true';
+    }
+    const block = Object.entries(map).map(([k, v]) => `  ${k}: ${v}`).join('\n');
+    const blockText = `allowBuilds:\n${block}\n`;
+    writeFileSync(file, blockMatch !== null ? yaml.replace(blockRe, blockText) : `${yaml.replace(/\n?$/, '\n')}${blockText}`);
+    return Object.keys(map);
+}

package/lib/routes.js

@@ -7,14 +7,15 @@
  * Security: the install route executes a shell command, so it accepts only
  * same-origin POSTs and only sources present in the curated registry.
  */
-import { readFileSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { loadRegistry } from './registry.js';
 import { cleanHotDir, hotMount, hotUnmount, listHotMounts, mountClientOnlyDeps, readDisabledThemes, } from './hot.js';
 import { exportLogs, logEvent } from './log.js';
-import { BOOT_ID, probePnpm, progress, provisionPnpm, runDshPlugin } from './dsh-cli.js';
-import { profileDir, readInstalled, readInstalledVersion, readLockCommits } from './profile.js';
+import { BOOT_ID, cancelActive, probePnpm, progress, provisionPnpm, runDshPlugin } from './dsh-cli.js';
+import { profileDir, readInstalled, readInstalledVersion, readLockCommits, setAllowBuilds } from './profile.js';
 import { findInstalledAlias, installTargetFor } from './sources.js';
-import { isStaleUpdate, retargetCollections, validateAddedPlugins, withHoistRecovery } from './install.js';
+import { isStaleUpdate, parseIgnoredBuilds, retargetCollections, validateAddedPlugins, withHoistRecovery } from './install.js';
 import { checkUpdates, invalidateUpdates } from './updates.js';
 import { createThemeManager } from './themes.js';
 import { readJsonBody, sameOrigin, sendJson } from './http.js';
@@ -58,6 +59,20 @@ export function mountMarketRoutes(host, config) {
             void themes.setEntryDisabled(name, true);
     });
     let installing = false;
+    /**
+     * Drop live hot mounts whose package was removed outside the market
+     * (e.g. `dsh plugin remove` in a terminal): the stale mount would keep
+     * serving a client bundle that 404s after refresh, wedging the page
+     * until a restart (#29 by @SunYanbox).
+     */
+    async function dropStaleHotMounts() {
+        for (const name of listHotMounts()) {
+            if (existsSync(join(profileDir(config.profile), 'node_modules', name, 'package.json')))
+                continue;
+            await hotUnmount(name);
+            logEvent('warn', 'hot-sweep', `${name}: package removed outside the market — live mount dropped`);
+        }
+    }
     /** Every plugin command goes through the pnpm-drift recovery wrapper (#20). */
     const runPlugin = (profile, args) => withHoistRecovery(runDshPlugin, profile, args);
     const disposers = [
@@ -82,12 +97,13 @@ export function mountMarketRoutes(host, config) {
         host.webServer.register({
             kind: 'exact',
             path: '/dsh-market/installed',
-            handler: (request, response) => {
+            handler: async (request, response) => {
                 if (request.method !== 'GET') {
                     response.writeHead(405, { allow: 'GET' });
                     response.end();
                     return;
                 }
+                await dropStaleHotMounts();
                 sendJson(response, 200, {
                     profile: config.profile,
                     installed: readInstalled(config.profile),
@@ -137,6 +153,7 @@ export function mountMarketRoutes(host, config) {
                     response.end();
                     return;
                 }
+                await dropStaleHotMounts();
                 sendJson(response, 200, {
                     active: progress.active,
                     target: progress.target,
@@ -236,7 +253,8 @@ export function mountMarketRoutes(host, config) {
                         // default one-day safety wait; scoped to this single command.
                         const addArgs = force ? ['add', '--config.minimumReleaseAge=0', target] : ['add', target];
                         const result = await runPlugin(config.profile, addArgs);
-                        let ok = result.exitCode === 0 && !result.timedOut;
+                        const cancelled = result.cancelled;
+                        let ok = result.exitCode === 0 && !result.timedOut && !cancelled;
                         let stale = false;
                         if (ok) {
                             stale = isStaleUpdate({
@@ -254,9 +272,11 @@ export function mountMarketRoutes(host, config) {
                         const staleError = stale
                             ? '这个新版本刚发布不久。为了安全，系统默认会等它发布满一天后再安装——刚发布的版本偶尔会被发现问题然后撤回。可以明天再试，或点「立即更新」不再等待。 / This version was just released; for safety, installs normally wait about a day after a release. Try again tomorrow, or click "Update now" to install it right away.'
                             : null;
-                        logEvent(ok ? 'info' : 'error', 'update', `${name} -> ${target} exit=${String(result.exitCode)}${result.timedOut ? ' TIMEOUT' : ''}${stale ? ' STALE(minimumReleaseAge?)' : ''}${ok ? '' : ` stderr=${result.stderr.slice(-300)}`}`);
-                        sendJson(response, ok ? 200 : 502, {
+                        logEvent(ok || cancelled ? 'info' : 'error', 'update', `${name} -> ${target} exit=${String(result.exitCode)}${result.timedOut ? ' TIMEOUT' : ''}${cancelled ? ' CANCELLED' : ''}${stale ? ' STALE(minimumReleaseAge?)' : ''}${ok || cancelled ? '' : ` stderr=${result.stderr.slice(-300)}`}`);
+                        // A user-cancelled run is a quiet outcome, not an error.
+                        sendJson(response, ok || cancelled ? 200 : 502, {
                             ok,
+                            cancelled: cancelled || undefined,
                             stale: stale || undefined,
                             error: staleError ?? undefined,
                             exitCode: result.exitCode,
@@ -299,6 +319,64 @@ export function mountMarketRoutes(host, config) {
                 }
             },
         }),
+        host.webServer.register({
+            kind: 'exact',
+            path: '/dsh-market/approve-builds',
+            handler: async (request, response) => {
+                if (request.method !== 'POST') {
+                    response.writeHead(405, { allow: 'POST' });
+                    response.end();
+                    return;
+                }
+                if (!sameOrigin(request)) {
+                    sendJson(response, 403, { error: 'untrusted origin' });
+                    return;
+                }
+                try {
+                    // One-click build-script approval (#6 by @qichuang321): only
+                    // packages ALREADY installed in the profile can be allowed — the
+                    // list is not free input.
+                    const body = (await readJsonBody(request));
+                    const installed = readInstalled(config.profile);
+                    const packages = (Array.isArray(body.packages) ? body.packages.map(String) : [])
+                        .filter(name => installed[name] !== undefined);
+                    if (packages.length === 0) {
+                        sendJson(response, 400, { error: 'no installed packages given' });
+                        return;
+                    }
+                    const approved = setAllowBuilds(config.profile, packages);
+                    logEvent('info', 'approve-builds', `allowed build scripts: ${approved.join(', ')}`);
+                    sendJson(response, 200, { ok: true, approved });
+                }
+                catch (error) {
+                    const message = error instanceof Error ? error.message : String(error);
+                    logEvent('error', 'approve-builds', `route error: ${message}`);
+                    sendJson(response, 500, { error: message });
+                }
+            },
+        }),
+        host.webServer.register({
+            kind: 'exact',
+            path: '/dsh-market/cancel',
+            handler: async (request, response) => {
+                if (request.method !== 'POST') {
+                    response.writeHead(405, { allow: 'POST' });
+                    response.end();
+                    return;
+                }
+                if (!sameOrigin(request)) {
+                    sendJson(response, 403, { error: 'untrusted origin' });
+                    return;
+                }
+                // Cancel flow contributed in #6 by @qichuang321.
+                if (!cancelActive()) {
+                    sendJson(response, 400, { error: 'no operation is running' });
+                    return;
+                }
+                logEvent('info', 'cancel', `cancelled ${progress.target || 'operation'}`);
+                sendJson(response, 200, { ok: true, cancelled: true, target: progress.target });
+            },
+        }),
         host.webServer.register({
             kind: 'exact',
             path: '/dsh-market/uninstall',
@@ -330,15 +408,17 @@ export function mountMarketRoutes(host, config) {
                     installing = true;
                     try {
                         const result = await runPlugin(config.profile, ['remove', name]);
-                        const ok = result.exitCode === 0 && !result.timedOut;
+                        const cancelled = result.cancelled;
+                        const ok = result.exitCode === 0 && !result.timedOut && !cancelled;
                         let hot = false;
                         if (ok) {
                             invalidateUpdates();
                             hot = await hotUnmount(name);
                         }
-                        logEvent(ok ? 'info' : 'error', 'uninstall', `${name} exit=${String(result.exitCode)}${ok ? ` live-removed=${String(hot)}` : ` stderr=${result.stderr.slice(-300)}`}`);
-                        sendJson(response, ok ? 200 : 502, {
+                        logEvent(ok || cancelled ? 'info' : 'error', 'uninstall', `${name} exit=${String(result.exitCode)}${cancelled ? ' CANCELLED' : ''}${ok ? ` live-removed=${String(hot)}` : cancelled ? '' : ` stderr=${result.stderr.slice(-300)}`}`);
+                        sendJson(response, ok || cancelled ? 200 : 502, {
                             ok,
+                            cancelled: cancelled || undefined,
                             hot,
                             exitCode: result.exitCode,
                             stdout: result.stdout,
@@ -405,7 +485,8 @@ export function mountMarketRoutes(host, config) {
                     try {
                         const before = new Set(Object.keys(readInstalled(config.profile)));
                         const result = await runPlugin(config.profile, ['add', target]);
-                        let ok = result.exitCode === 0 && !result.timedOut;
+                        const cancelled = result.cancelled;
+                        let ok = result.exitCode === 0 && !result.timedOut && !cancelled;
                         if (ok)
                             invalidateUpdates();
                         if (ok) {
@@ -420,7 +501,7 @@ export function mountMarketRoutes(host, config) {
                         // must never survive to brick the next boot.
                         let notAPlugin = false;
                         let removedBroken = [];
-                        if (result.exitCode === 0 && !result.timedOut) {
+                        if (result.exitCode === 0 && !result.timedOut && !cancelled) {
                             const validated = await validateAddedPlugins(runPlugin, config.profile, before);
                             removedBroken = validated.removedBroken;
                             if (removedBroken.length > 0) {
@@ -453,10 +534,12 @@ export function mountMarketRoutes(host, config) {
                                 }
                             }
                         }
-                        logEvent(ok ? 'info' : 'error', 'install', `${target} exit=${String(result.exitCode)}${result.timedOut ? ' TIMEOUT' : ''}${ok ? ` hot=${String(hot)}` : ` stderr=${result.stderr.slice(-300)}`}`);
-                        sendJson(response, ok ? 200 : 502, {
+                        logEvent(ok || cancelled ? 'info' : 'error', 'install', `${target} exit=${String(result.exitCode)}${result.timedOut ? ' TIMEOUT' : ''}${cancelled ? ' CANCELLED' : ''}${ok ? ` hot=${String(hot)}` : cancelled ? '' : ` stderr=${result.stderr.slice(-300)}`}`);
+                        sendJson(response, ok || cancelled ? 200 : 502, {
                             ok,
+                            cancelled: cancelled || undefined,
                             hot,
+                            ignoredBuilds: (() => { const list = parseIgnoredBuilds(result.stdout, result.stderr); return list.length > 0 ? list : undefined; })(),
                             error: notAPlugin ? 'nothing installable: the plugin(s) need a build step (blocked by default, see allowBuilds) or ship no prebuilt artifacts / 没有可安装的内容：插件需要构建授权（allowBuilds，默认拦截）或未附带构建产物，详见导出日志' : undefined,
                             exitCode: result.exitCode,
                             timedOut: result.timedOut,

package/lib/types/dsh-cli.d.ts

@@ -29,6 +29,8 @@ export interface InstallResult {
     timedOut: boolean;
     stdout: string;
     stderr: string;
+    /** True when the run ended because the user cancelled it. */
+    cancelled: boolean;
 }
 /** The shape every orchestration function takes to run plugin commands (injectable in tests). */
 export type PluginRunner = (profile: string, pluginArgs: string[]) => Promise<InstallResult>;
@@ -38,6 +40,11 @@ export type PluginRunner = (profile: string, pluginArgs: string[]) => Promise<In
  * (Contributed in #7 by @mraing.)
  */
 export declare function killChild(child: ChildProcess): void;
+/**
+ * Cancel the plugin command currently running.
+ * @returns true when there was one to cancel.
+ */
+export declare function cancelActive(): boolean;
 /** Probe `pnpm --version` on PATH. */
 export declare function probePnpm(): Promise<boolean>;
 /**

package/lib/types/install.d.ts

@@ -47,3 +47,9 @@ export declare function isStaleUpdate(check: {
     beforeCommit: string | null;
     afterCommit: string | null;
 }): boolean;
+/**
+ * Package names pnpm reported as having their build scripts ignored
+ * ("Ignored build scripts: esbuild, koffi."). Empty when none.
+ * (#6 by @qichuang321.)
+ */
+export declare function parseIgnoredBuilds(stdout: string, stderr: string): string[];

package/lib/types/profile.d.ts

@@ -5,7 +5,7 @@
  */
 /** Resolve a profile name to its directory under DSH_HOME (default ~/.dsh). */
 export declare function profileDir(profile: string): string;
-/** Community dependencies of the profile (official in-box scope filtered out). */
+/** Community dependencies of the profile (in-box bundles filtered out). */
 export declare function readInstalled(profile: string): Record<string, string>;
 /** The version actually present in the profile's node_modules, or null. */
 export declare function readInstalledVersion(profile: string, name: string): string | null;
@@ -22,3 +22,11 @@ export declare function hasDshManifest(dir: string): boolean;
 export declare function entryArtifactExists(dir: string): boolean;
 /** Plugin subdirectories (depth 2) of a collection checkout, as relative paths. */
 export declare function pluginSubdirs(root: string): string[];
+/**
+ * Allow the given packages' build scripts in the profile's
+ * pnpm-workspace.yaml `allowBuilds` block (the key dsh profiles use),
+ * merging with existing entries and leaving the rest of the yaml intact.
+ * (#6 by @qichuang321.)
+ * @returns every package now allowed.
+ */
+export declare function setAllowBuilds(profile: string, packages: string[]): string[];

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.2.3",
+  "version": "1.2.4",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/client/Market.module.css

@@ -72,3 +72,7 @@
 .dangerBtn.dangerBtn,.warnBtn.warnBtn,.dangerArmed.dangerArmed{white-space:nowrap;flex-shrink:0}
 .spec{font-size:11px;color:var(--dsw-alias-label-secondary,#9ca3af);font-family:ui-monospace,Menlo,monospace}
 .staleAction{margin-top:8px}
+.pct{font-weight:600;font-size:11px;flex-shrink:0;color:var(--dsw-alias-label-secondary,#6b7280)}
+.cancelBtn{border:1px solid var(--dsw-alias-border-l2,#e5e7eb);background:var(--dsw-alias-bg-layer-1,#fff);color:var(--dsw-alias-label-secondary,#6b7280);border-radius:6px;padding:2px 10px;font:inherit;font-size:11px;line-height:16px;cursor:pointer;flex-shrink:0;white-space:nowrap}
+.cancelBtn:hover{color:var(--dsw-alias-state-error-primary,#dc2626);border-color:var(--dsw-alias-state-error-primary,#dc2626)}
+.sentinel{height:1px}

package/src/client/MarketSection.tsx

@@ -38,6 +38,14 @@ function OwnerAvatar({ name, owner }: { name: string; owner: string }) {
   )
 }
 
+/**
+ * Module-scope caches so re-entering the section renders instantly instead
+ * of refetching and rebuilding from a spinner (#30 by @StarsTom). Module
+ * state survives section switches; a background refetch keeps it current.
+ */
+let cachedRegistry: Registry | null = null
+let cachedInstalled: InstalledMap | null = null
+
 export interface MarketSectionProps {
   t: Translate
   locale: {
@@ -63,9 +71,10 @@ export function MarketSection(props: MarketSectionProps) {
     props.themeStore.subscribe,
     props.themeStore.getSnapshot,
   )
-  const [data, setData] = useState<Registry | null>(null)
+  const [data, setData] = useState<Registry | null>(cachedRegistry)
   const [loadError, setLoadError] = useState(false)
-  const [installed, setInstalled] = useState<InstalledMap>({})
+  const [installed, setInstalledState] = useState<InstalledMap>(cachedInstalled ?? {})
+  const setInstalled = useCallback((value: InstalledMap) => { cachedInstalled = value; setInstalledState(value) }, [])
   const [skins, setSkins] = useState<string[]>([])
   const [tab, setTab] = useState(() => {
     const saved = sessionStorage.getItem('dshm-tab')
@@ -82,6 +91,26 @@ export function MarketSection(props: MarketSectionProps) {
   const [updatingName, setUpdatingName] = useState<string | null>(null)
   // Plugin blocked by pnpm's fresh-release safety wait; arms the update-now button.
   const [staleName, setStaleName] = useState<string | null>(null)
+  /**
+   * Cards rendered so far — the discover grid renders incrementally (60,
+   * then +120 as the sentinel scrolls into view) instead of all 400+ at
+   * once, which built a ~70k px DOM and made section switches lag (#30).
+   */
+  const [visibleCount, setVisibleCount] = useState(60)
+  const sentinelRef = useCallback((node: HTMLDivElement | null) => {
+    if (node === null) return
+    const observer = new IntersectionObserver((entries) => {
+      if (entries.some(entry => entry.isIntersecting)) setVisibleCount(count => count + 120)
+    }, { rootMargin: '600px' })
+    observer.observe(node)
+    // Cleanup runs when React detaches the node and calls back with null;
+    // the observer dies with the node, so a one-shot observe suffices.
+  }, [])
+
+  /** Determinate percent parsed from pnpm's Progress line, when available. */
+  const [progressPct, setProgressPct] = useState<number | null>(null)
+  /** Blocked build scripts from the last install: enables approve-and-retry (#6). */
+  const [buildsSkipped, setBuildsSkipped] = useState<{ plugin: RegistryPlugin; names: string[] } | null>(null)
   const [updatingAll, setUpdatingAll] = useState(false)
   const [updatedNames, setUpdatedNames] = useState<string[]>([])
   const [hotUrls, setHotUrls] = useState<string[]>([])
@@ -121,7 +150,7 @@ export function MarketSection(props: MarketSectionProps) {
   useEffect(() => {
     fetch('/dsh-market/registry', { cache: 'no-store' })
       .then(res => { if (!res.ok) throw new Error('HTTP ' + res.status); return res.json() })
-      .then(body => setData(body.registry))
+      .then(body => { cachedRegistry = body.registry; setData(body.registry) })
       .catch(() => setLoadError(true))
     fetch('/dsh-market/status', { cache: 'no-store' })
       .then(res => res.json())
@@ -192,8 +221,14 @@ export function MarketSection(props: MarketSectionProps) {
         .then(status => {
           if (status.active) {
             setProgressLine((status.lastLine || '…') + '  (' + status.seconds + 's)')
+            const m = /resolved (\d+), reused (\d+), downloaded (\d+), added (\d+)/.exec(status.lastLine || '')
+            if (m !== null && Number(m[1]) > 0) {
+              const done = Number(m[2]) + Number(m[3]) + Number(m[4])
+              setProgressPct(Math.max(4, Math.min(96, Math.round(done / Number(m[1]) * 100))))
+            }
           } else {
             setProgressLine(null)
+            setProgressPct(null)
             setInstalled(status.installed || {})
             const pending = readSession('dshm-pending')
             if (pending !== null && busyUrl !== null) {
@@ -216,7 +251,10 @@ export function MarketSection(props: MarketSectionProps) {
     () => (data === null ? [] : visiblePlugins(data.plugins, { category: cat, query: q, lang, sort })),
     [data, q, cat, lang, sort])
 
+  useEffect(() => { setVisibleCount(60) }, [q, cat, sort])
+
   const doInstall = useCallback((plugin: RegistryPlugin) => {
+    setBuildsSkipped(null)
     setConfirming(null)
     setInstallError(null)
     setBusyUrl(plugin.url)
@@ -237,6 +275,11 @@ export function MarketSection(props: MarketSectionProps) {
           location.reload()
           return
         }
+        if (body.cancelled === true) {
+          // User-cancelled: quiet reset, nothing to report.
+          refreshInstalled()
+          return
+        }
         if (status === 200 && body.ok) {
           sessionStorage.setItem('dshm-tab', 'installed')
           if (body.hot) {
@@ -247,6 +290,13 @@ export function MarketSection(props: MarketSectionProps) {
           }
           refreshInstalled()
         } else {
+          if (status === 409) {
+            setInstallError(t('busyWait'))
+            return
+          }
+          if (Array.isArray(body.ignoredBuilds) && body.ignoredBuilds.length > 0) {
+            setBuildsSkipped({ plugin, names: body.ignoredBuilds.map(String) })
+          }
           const text = (v: unknown) => typeof v === 'string' ? v : (v && typeof (v as any).text === 'string') ? (v as any).text : v == null ? '' : JSON.stringify(v)
           const detail = text(body.error) || [text(body.stderr), text(body.stdout)].filter(Boolean).join('\n').trim() || ('exit ' + body.exitCode)
           setInstallError(t('installFail') + ': ' + plugin.name + ' — ' + detail.trim().slice(-600))
@@ -259,6 +309,12 @@ export function MarketSection(props: MarketSectionProps) {
       .finally(() => setBusyUrl(null))
   }, [refreshInstalled, t])
 
+  /** Cancel the running plugin command (#6 by @qichuang321). */
+  const doCancel = useCallback(() => {
+    fetch('/dsh-market/cancel', { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}' })
+      .catch(() => {})
+  }, [])
+
   const doUpdate = useCallback((name: string, force = false) => {
     setInstallError(null)
     setStaleName(null)
@@ -270,10 +326,15 @@ export function MarketSection(props: MarketSectionProps) {
     })
       .then(res => res.json().then(body => ({ status: res.status, body })))
       .then(({ status, body }) => {
+        if (body.cancelled === true) {
+          refreshInstalled()
+          return
+        }
         if (status === 200 && body.ok) {
           setUpdatedNames(names => names.concat(name))
           refreshInstalled()
         } else {
+          if (status === 409) { setInstallError(t('busyWait')); return }
           if (body.stale === true) setStaleName(name)
           const text = (v: unknown) => typeof v === 'string' ? v : (v && typeof (v as any).text === 'string') ? (v as any).text : v == null ? '' : JSON.stringify(v)
           const detail = text(body.error) || [text(body.stderr), text(body.stdout)].filter(Boolean).join('\n').trim() || ('exit ' + body.exitCode)
@@ -400,6 +461,8 @@ export function MarketSection(props: MarketSectionProps) {
           <div className={css.progress}>
             <span className={css.spin} />
             <code className={css.grow}>{progressLine || t('progressHint')}</code>
+            {progressPct !== null && <span className={css.pct}>{progressPct}%</span>}
+            <button type="button" className={css.cancelBtn} onClick={doCancel}>{t('cancelOp')}</button>
           </div>
         )}
       </div>
@@ -578,6 +641,30 @@ export function MarketSection(props: MarketSectionProps) {
           </div>
         )}
       </div>
+      {buildsSkipped !== null && (
+        <div className={css.restart}>
+          <span className={css.grow}>{t('buildsSkipped')} {buildsSkipped.names.join(', ')}</span>
+          <Button
+            size="sm"
+            disabled={busyUrl !== null}
+            onClick={() => {
+              const { plugin, names } = buildsSkipped
+              setBuildsSkipped(null)
+              fetch('/dsh-market/approve-builds', {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ packages: names }),
+              })
+                .then(res => res.json())
+                .then((body) => {
+                  if (body.ok) doInstall(plugin)
+                  else setInstallError(String(body.error || 'approve failed'))
+                })
+                .catch(error => setInstallError(String(error)))
+            }}
+          >{t('approveBuilds')}</Button>
+        </div>
+      )}
       {installError !== null && (
         <div className={css.err}>
           {installError}
@@ -643,7 +730,12 @@ export function MarketSection(props: MarketSectionProps) {
                     </div>
                     {plugins.length === 0
                       ? <div className={css.empty}>{t('empty')}</div>
-                      : <div className={css.grid}>{plugins.map(pluginCard)}</div>}
+                      : (
+                          <>
+                            <div className={css.grid}>{plugins.slice(0, visibleCount).map(pluginCard)}</div>
+                            {plugins.length > visibleCount && <div ref={sentinelRef} className={css.sentinel} />}
+                          </>
+                        )}
                   </>
                 )
           : tab === 'themes' && themeSnap !== null
@@ -692,6 +784,8 @@ export function MarketSection(props: MarketSectionProps) {
                           <div className={css.progress}>
                             <span className={css.spin} />
                             <code className={css.grow}>{progressLine || t('progressHint')}</code>
+                            {progressPct !== null && <span className={css.pct}>{progressPct}%</span>}
+                            <button type="button" className={css.cancelBtn} onClick={doCancel}>{t('cancelOp')}</button>
                           </div>
                         )}
                       </div>

package/src/client/locales.ts

@@ -29,6 +29,11 @@ export const zh = {
   update: '更新',
   updating: '更新中…',
   updated: '✓ 已更新，重启后生效',
+  cancelOp: '取消',
+  cancelled: '已取消',
+  busyWait: '已有操作正在进行，请等它结束（同一时间只执行一个安装/更新/卸载）',
+  approveBuilds: '放行构建脚本并重试',
+  buildsSkipped: '该插件需要运行构建脚本才能工作，出于安全默认被拦下。点击下方按钮为它放行并重装：',
   updateNow: '立即更新',
   updateFail: '更新失败',
   upToDate: '已是最新',
@@ -92,6 +97,11 @@ export const en: Record<MarketKey, string> = {
   update: 'Update',
   updating: 'Updating…',
   updated: '✓ Updated — restart to apply',
+  cancelOp: 'Cancel',
+  cancelled: 'Cancelled',
+  busyWait: 'Another operation is already running — please wait for it to finish (one install/update/uninstall at a time)',
+  approveBuilds: 'Allow build scripts and retry',
+  buildsSkipped: 'This plugin needs its build scripts to run; they are blocked by default for safety. Click below to allow them and reinstall:',
   updateNow: 'Update now',
   updateFail: 'Update failed',
   upToDate: 'Up to date',