dshmarket 1.2.3 → 1.3.0

package/lib/types/restart.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Self-restart: relaunch the exact DSH invocation that booted this host so
+ * pending (non-hot) plugin changes take effect without the user leaving the
+ * UI. Contributed in #14 by @ysyyhhh; ported onto the layered architecture.
+ *
+ * Safety model: the endpoint accepts only direct same-origin loopback
+ * requests (no forwarding headers), refuses while a plugin operation runs,
+ * and deployments under a supervisor (systemd/launchd/pm2) can disable the
+ * whole feature with `allowRestart: false` — the supervisor owns restarts.
+ */
+import type { IncomingMessage } from 'node:http';
+/** Self-restart is enabled by default and disabled only by an explicit false. */
+export declare function restartAllowed(config: {
+    allowRestart?: boolean;
+}): boolean;
+/** Whether a process-control request came from this Web host on loopback. */
+export declare function trustedRestartRequest(request: Pick<IncomingMessage, 'headers' | 'socket'>): boolean;
+/** The exact boot invocation the detached restart helper replays. */
+export declare function restartLaunch(): {
+    file: string;
+    args: string[];
+    cwd: string;
+    viaShell: boolean;
+};
+/** What scheduleRestart reports back to the caller for logging/response. */
+export interface RestartResult {
+    pid: number;
+    helperPid: number | undefined;
+    logOut: string;
+    logErr: string;
+}
+/**
+ * Relaunch this exact DSH entry after a short detached handoff, then stop
+ * this process. The helper outlives us (detached + unref), waits for our
+ * port to free up, and logs the replacement's output under tmpdir.
+ */
+export declare function scheduleRestart(): RestartResult;

package/lib/types/routes.d.ts

@@ -42,6 +42,8 @@ export interface MarketHost {
 export interface MarketConfig {
     /** Profile the market installs into; matches the profile serving this UI. */
     profile: string;
+    /** Detached self-restart is unsafe under systemd/launchd/pm2; operators can disable it (#14). */
+    allowRestart?: boolean;
 }
 /**
  * Register the market's HTTP routes.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.2.3",
+  "version": "1.3.0",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -24,7 +24,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.client.json --noEmit",
     "build": "tsc -p tsconfig.json && npm run build:client",
     "build:client": "tsdown && node scripts/normalize-client-banner.mjs",
-    "check": "npm run typecheck && npm run build",
+    "check": "npm run typecheck && npm run build && node scripts/restart-smoke.mjs",
     "test": "vitest run",
     "test:compat": "vitest run --config vitest.compat.config.ts",
     "prepack": "npm run build && node scripts/preflight.mjs",

package/src/client/Market.module.css

@@ -72,3 +72,7 @@
 .dangerBtn.dangerBtn,.warnBtn.warnBtn,.dangerArmed.dangerArmed{white-space:nowrap;flex-shrink:0}
 .spec{font-size:11px;color:var(--dsw-alias-label-secondary,#9ca3af);font-family:ui-monospace,Menlo,monospace}
 .staleAction{margin-top:8px}
+.pct{font-weight:600;font-size:11px;flex-shrink:0;color:var(--dsw-alias-label-secondary,#6b7280)}
+.cancelBtn{border:1px solid var(--dsw-alias-border-l2,#e5e7eb);background:var(--dsw-alias-bg-layer-1,#fff);color:var(--dsw-alias-label-secondary,#6b7280);border-radius:6px;padding:2px 10px;font:inherit;font-size:11px;line-height:16px;cursor:pointer;flex-shrink:0;white-space:nowrap}
+.cancelBtn:hover{color:var(--dsw-alias-state-error-primary,#dc2626);border-color:var(--dsw-alias-state-error-primary,#dc2626)}
+.sentinel{height:1px}

package/src/client/MarketSection.tsx

@@ -38,6 +38,14 @@ function OwnerAvatar({ name, owner }: { name: string; owner: string }) {
   )
 }
 
+/**
+ * Module-scope caches so re-entering the section renders instantly instead
+ * of refetching and rebuilding from a spinner (#30 by @StarsTom). Module
+ * state survives section switches; a background refetch keeps it current.
+ */
+let cachedRegistry: Registry | null = null
+let cachedInstalled: InstalledMap | null = null
+
 export interface MarketSectionProps {
   t: Translate
   locale: {
@@ -63,9 +71,10 @@ export function MarketSection(props: MarketSectionProps) {
     props.themeStore.subscribe,
     props.themeStore.getSnapshot,
   )
-  const [data, setData] = useState<Registry | null>(null)
+  const [data, setData] = useState<Registry | null>(cachedRegistry)
   const [loadError, setLoadError] = useState(false)
-  const [installed, setInstalled] = useState<InstalledMap>({})
+  const [installed, setInstalledState] = useState<InstalledMap>(cachedInstalled ?? {})
+  const setInstalled = useCallback((value: InstalledMap) => { cachedInstalled = value; setInstalledState(value) }, [])
   const [skins, setSkins] = useState<string[]>([])
   const [tab, setTab] = useState(() => {
     const saved = sessionStorage.getItem('dshm-tab')
@@ -82,6 +91,26 @@ export function MarketSection(props: MarketSectionProps) {
   const [updatingName, setUpdatingName] = useState<string | null>(null)
   // Plugin blocked by pnpm's fresh-release safety wait; arms the update-now button.
   const [staleName, setStaleName] = useState<string | null>(null)
+  /**
+   * Cards rendered so far — the discover grid renders incrementally (60,
+   * then +120 as the sentinel scrolls into view) instead of all 400+ at
+   * once, which built a ~70k px DOM and made section switches lag (#30).
+   */
+  const [visibleCount, setVisibleCount] = useState(60)
+  const sentinelRef = useCallback((node: HTMLDivElement | null) => {
+    if (node === null) return
+    const observer = new IntersectionObserver((entries) => {
+      if (entries.some(entry => entry.isIntersecting)) setVisibleCount(count => count + 120)
+    }, { rootMargin: '600px' })
+    observer.observe(node)
+    // Cleanup runs when React detaches the node and calls back with null;
+    // the observer dies with the node, so a one-shot observe suffices.
+  }, [])
+
+  /** Determinate percent parsed from pnpm's Progress line, when available. */
+  const [progressPct, setProgressPct] = useState<number | null>(null)
+  /** Blocked build scripts from the last install: enables approve-and-retry (#6). */
+  const [buildsSkipped, setBuildsSkipped] = useState<{ plugin: RegistryPlugin; names: string[] } | null>(null)
   const [updatingAll, setUpdatingAll] = useState(false)
   const [updatedNames, setUpdatedNames] = useState<string[]>([])
   const [hotUrls, setHotUrls] = useState<string[]>([])
@@ -94,6 +123,9 @@ export function MarketSection(props: MarketSectionProps) {
   const [envFixing, setEnvFixing] = useState(false)
   const [envFailed, setEnvFailed] = useState(false)
   const [bootId, setBootId] = useState<string | null>(null)
+  /** One-click restart (#14 by @ysyyhhh): server capability + in-flight state. */
+  const [restartEnabled, setRestartEnabled] = useState(false)
+  const [restarting, setRestarting] = useState(false)
   const [showTop, setShowTop] = useState(false)
   const bodyRef = useRef<HTMLDivElement | null>(null)
   const [sort, setSort] = useState('hot')
@@ -121,13 +153,14 @@ export function MarketSection(props: MarketSectionProps) {
   useEffect(() => {
     fetch('/dsh-market/registry', { cache: 'no-store' })
       .then(res => { if (!res.ok) throw new Error('HTTP ' + res.status); return res.json() })
-      .then(body => setData(body.registry))
+      .then(body => { cachedRegistry = body.registry; setData(body.registry) })
       .catch(() => setLoadError(true))
     fetch('/dsh-market/status', { cache: 'no-store' })
       .then(res => res.json())
       .then(status => {
         setEnvReady(status.pnpm !== false)
         if (typeof status.boot === 'string') setBootId(status.boot)
+        setRestartEnabled(status.restart === true)
       })
       .catch(() => {})
     refreshInstalled()
@@ -192,8 +225,14 @@ export function MarketSection(props: MarketSectionProps) {
         .then(status => {
           if (status.active) {
             setProgressLine((status.lastLine || '…') + '  (' + status.seconds + 's)')
+            const m = /resolved (\d+), reused (\d+), downloaded (\d+), added (\d+)/.exec(status.lastLine || '')
+            if (m !== null && Number(m[1]) > 0) {
+              const done = Number(m[2]) + Number(m[3]) + Number(m[4])
+              setProgressPct(Math.max(4, Math.min(96, Math.round(done / Number(m[1]) * 100))))
+            }
           } else {
             setProgressLine(null)
+            setProgressPct(null)
             setInstalled(status.installed || {})
             const pending = readSession('dshm-pending')
             if (pending !== null && busyUrl !== null) {
@@ -216,7 +255,10 @@ export function MarketSection(props: MarketSectionProps) {
     () => (data === null ? [] : visiblePlugins(data.plugins, { category: cat, query: q, lang, sort })),
     [data, q, cat, lang, sort])
 
+  useEffect(() => { setVisibleCount(60) }, [q, cat, sort])
+
   const doInstall = useCallback((plugin: RegistryPlugin) => {
+    setBuildsSkipped(null)
     setConfirming(null)
     setInstallError(null)
     setBusyUrl(plugin.url)
@@ -237,6 +279,11 @@ export function MarketSection(props: MarketSectionProps) {
           location.reload()
           return
         }
+        if (body.cancelled === true) {
+          // User-cancelled: quiet reset, nothing to report.
+          refreshInstalled()
+          return
+        }
         if (status === 200 && body.ok) {
           sessionStorage.setItem('dshm-tab', 'installed')
           if (body.hot) {
@@ -247,6 +294,13 @@ export function MarketSection(props: MarketSectionProps) {
           }
           refreshInstalled()
         } else {
+          if (status === 409) {
+            setInstallError(t('busyWait'))
+            return
+          }
+          if (Array.isArray(body.ignoredBuilds) && body.ignoredBuilds.length > 0) {
+            setBuildsSkipped({ plugin, names: body.ignoredBuilds.map(String) })
+          }
           const text = (v: unknown) => typeof v === 'string' ? v : (v && typeof (v as any).text === 'string') ? (v as any).text : v == null ? '' : JSON.stringify(v)
           const detail = text(body.error) || [text(body.stderr), text(body.stdout)].filter(Boolean).join('\n').trim() || ('exit ' + body.exitCode)
           setInstallError(t('installFail') + ': ' + plugin.name + ' — ' + detail.trim().slice(-600))
@@ -259,6 +313,59 @@ export function MarketSection(props: MarketSectionProps) {
       .finally(() => setBusyUrl(null))
   }, [refreshInstalled, t])
 
+  /**
+   * Restart the host and reload once the boot id changes (#14 by @ysyyhhh).
+   * The 202 races the process's SIGTERM, so network errors on the initial
+   * request are expected and treated as "restart under way".
+   */
+  const doRestart = useCallback(() => {
+    if (bootId === null || restarting) return
+    const previousBoot = bootId
+    setRestarting(true)
+    setInstallError(null)
+    const awaitNewBoot = () => {
+      const deadline = Date.now() + 60000
+      const poll = () => {
+        fetch('/dsh-market/status', { cache: 'no-store' })
+          .then(res => res.json())
+          .then((next) => {
+            if (typeof next.boot === 'string' && next.boot !== previousBoot) {
+              location.reload()
+              return
+            }
+            retry()
+          })
+          .catch(retry)
+      }
+      const retry = () => {
+        if (Date.now() > deadline) {
+          setRestarting(false)
+          setInstallError(t('restartTimeout'))
+          return
+        }
+        setTimeout(poll, 1500)
+      }
+      poll()
+    }
+    fetch('/dsh-market/restart', { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}' })
+      .then(res => res.json().then(body => ({ status: res.status, body })))
+      .then(({ status, body }) => {
+        if (status !== 202 || body.ok !== true) {
+          setRestarting(false)
+          setInstallError(t('restartFail') + ': ' + String(body.error || ('HTTP ' + String(status))))
+          return
+        }
+        awaitNewBoot()
+      })
+      .catch(awaitNewBoot) // the host may die mid-response; keep polling
+  }, [bootId, restarting, t])
+
+  /** Cancel the running plugin command (#6 by @qichuang321). */
+  const doCancel = useCallback(() => {
+    fetch('/dsh-market/cancel', { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}' })
+      .catch(() => {})
+  }, [])
+
   const doUpdate = useCallback((name: string, force = false) => {
     setInstallError(null)
     setStaleName(null)
@@ -270,10 +377,15 @@ export function MarketSection(props: MarketSectionProps) {
     })
       .then(res => res.json().then(body => ({ status: res.status, body })))
       .then(({ status, body }) => {
+        if (body.cancelled === true) {
+          refreshInstalled()
+          return
+        }
         if (status === 200 && body.ok) {
           setUpdatedNames(names => names.concat(name))
           refreshInstalled()
         } else {
+          if (status === 409) { setInstallError(t('busyWait')); return }
           if (body.stale === true) setStaleName(name)
           const text = (v: unknown) => typeof v === 'string' ? v : (v && typeof (v as any).text === 'string') ? (v as any).text : v == null ? '' : JSON.stringify(v)
           const detail = text(body.error) || [text(body.stderr), text(body.stdout)].filter(Boolean).join('\n').trim() || ('exit ' + body.exitCode)
@@ -400,6 +512,8 @@ export function MarketSection(props: MarketSectionProps) {
           <div className={css.progress}>
             <span className={css.spin} />
             <code className={css.grow}>{progressLine || t('progressHint')}</code>
+            {progressPct !== null && <span className={css.pct}>{progressPct}%</span>}
+            <button type="button" className={css.cancelBtn} onClick={doCancel}>{t('cancelOp')}</button>
           </div>
         )}
       </div>
@@ -575,9 +689,41 @@ export function MarketSection(props: MarketSectionProps) {
             <span>🔄</span>
             <span className={css.grow}><b>{pendingRestart}</b> {t('restartBanner')}</span>
             <span title={t('restartHint')}>ℹ️</span>
+            {restartEnabled && (
+              <Button
+                variant="primary"
+                size="sm"
+                disabled={restarting || busyUrl !== null || updatingName !== null || removingName !== null}
+                onClick={doRestart}
+              >{restarting ? t('restarting') : t('restartNow')}</Button>
+            )}
           </div>
         )}
       </div>
+      {buildsSkipped !== null && (
+        <div className={css.restart}>
+          <span className={css.grow}>{t('buildsSkipped')} {buildsSkipped.names.join(', ')}</span>
+          <Button
+            size="sm"
+            disabled={busyUrl !== null}
+            onClick={() => {
+              const { plugin, names } = buildsSkipped
+              setBuildsSkipped(null)
+              fetch('/dsh-market/approve-builds', {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ packages: names }),
+              })
+                .then(res => res.json())
+                .then((body) => {
+                  if (body.ok) doInstall(plugin)
+                  else setInstallError(String(body.error || 'approve failed'))
+                })
+                .catch(error => setInstallError(String(error)))
+            }}
+          >{t('approveBuilds')}</Button>
+        </div>
+      )}
       {installError !== null && (
         <div className={css.err}>
           {installError}
@@ -643,7 +789,12 @@ export function MarketSection(props: MarketSectionProps) {
                     </div>
                     {plugins.length === 0
                       ? <div className={css.empty}>{t('empty')}</div>
-                      : <div className={css.grid}>{plugins.map(pluginCard)}</div>}
+                      : (
+                          <>
+                            <div className={css.grid}>{plugins.slice(0, visibleCount).map(pluginCard)}</div>
+                            {plugins.length > visibleCount && <div ref={sentinelRef} className={css.sentinel} />}
+                          </>
+                        )}
                   </>
                 )
           : tab === 'themes' && themeSnap !== null
@@ -692,6 +843,8 @@ export function MarketSection(props: MarketSectionProps) {
                           <div className={css.progress}>
                             <span className={css.spin} />
                             <code className={css.grow}>{progressLine || t('progressHint')}</code>
+                            {progressPct !== null && <span className={css.pct}>{progressPct}%</span>}
+                            <button type="button" className={css.cancelBtn} onClick={doCancel}>{t('cancelOp')}</button>
                           </div>
                         )}
                       </div>

package/src/client/locales.ts

@@ -29,6 +29,15 @@ export const zh = {
   update: '更新',
   updating: '更新中…',
   updated: '✓ 已更新，重启后生效',
+  cancelOp: '取消',
+  cancelled: '已取消',
+  busyWait: '已有操作正在进行，请等它结束（同一时间只执行一个安装/更新/卸载）',
+  approveBuilds: '放行构建脚本并重试',
+  buildsSkipped: '该插件需要运行构建脚本才能工作，出于安全默认被拦下。点击下方按钮为它放行并重装：',
+  restartNow: '立即重启',
+  restarting: '正在重启…',
+  restartFail: '重启失败',
+  restartTimeout: '等待 DeepSeek Harness 启动超时',
   updateNow: '立即更新',
   updateFail: '更新失败',
   upToDate: '已是最新',
@@ -92,6 +101,15 @@ export const en: Record<MarketKey, string> = {
   update: 'Update',
   updating: 'Updating…',
   updated: '✓ Updated — restart to apply',
+  cancelOp: 'Cancel',
+  cancelled: 'Cancelled',
+  busyWait: 'Another operation is already running — please wait for it to finish (one install/update/uninstall at a time)',
+  approveBuilds: 'Allow build scripts and retry',
+  buildsSkipped: 'This plugin needs its build scripts to run; they are blocked by default for safety. Click below to allow them and reinstall:',
+  restartNow: 'Restart now',
+  restarting: 'Restarting…',
+  restartFail: 'Restart failed',
+  restartTimeout: 'Timed out waiting for DeepSeek Harness to start',
   updateNow: 'Update now',
   updateFail: 'Update failed',
   upToDate: 'Up to date',

package/src/dsh-cli.ts

@@ -14,7 +14,9 @@ import { logEvent } from './log.ts'
 import { pluginArgsFor } from './pnpm-compat.ts'
 import { profileDir } from './profile.ts'
 
-const INSTALL_TIMEOUT_MS = 5 * 60 * 1000
+// 15 min default (slow networks + git installs), overridable for CI/tests.
+// (#6 by @qichuang321.)
+const INSTALL_TIMEOUT_MS = Number(process.env.DSH_MARKET_INSTALL_TIMEOUT_MS) || 15 * 60 * 1000
 
 /**
  * Windows npm/corepack/pnpm are `.cmd` shims. Node's `spawn` without a shell
@@ -47,6 +49,8 @@ export interface InstallResult {
   timedOut: boolean
   stdout: string
   stderr: string
+  /** True when the run ended because the user cancelled it. */
+  cancelled: boolean
 }
 
 /** The shape every orchestration function takes to run plugin commands (injectable in tests). */
@@ -67,6 +71,49 @@ export function killChild(child: ChildProcess): void {
   child.kill('SIGKILL')
 }
 
+/** The child of the operation currently running, for /dsh-market/cancel. */
+let activeChild: ChildProcess | null = null
+let cancelRequested = false
+
+/**
+ * Kill a child and its whole tree, gracefully where the platform allows:
+ * taskkill /T /F on Windows (plain kill() leaves pnpm children running),
+ * SIGTERM with a 5s SIGKILL escalation elsewhere so pnpm can clean up.
+ * (Cancel flow contributed in #6 by @qichuang321.)
+ */
+function killTree(child: ChildProcess): void {
+  if (process.platform === 'win32' && child.pid !== undefined) {
+    try {
+      spawn('taskkill', ['/pid', String(child.pid), '/t', '/f'], { stdio: 'ignore' })
+      return
+    } catch { /* fall through */ }
+  }
+  // POSIX: the dsh wrapper runs pnpm as a grandchild (spawnSync), which a
+  // plain child.kill() leaves running — it keeps our stdio pipes open, so
+  // the close event never fires and the market looks stuck "installing".
+  // The child is spawned detached as its own process GROUP; kill the group.
+  const signalTree = (signal: NodeJS.Signals): void => {
+    if (child.pid === undefined) return
+    try { process.kill(-child.pid, signal) } catch {
+      try { child.kill(signal) } catch { /* already gone */ }
+    }
+  }
+  signalTree('SIGTERM')
+  const escalate = setTimeout(() => signalTree('SIGKILL'), 5000)
+  escalate.unref?.()
+}
+
+/**
+ * Cancel the plugin command currently running.
+ * @returns true when there was one to cancel.
+ */
+export function cancelActive(): boolean {
+  if (activeChild === null) return false
+  cancelRequested = true
+  killTree(activeChild)
+  return true
+}
+
 /** Whether `pnpm` resolves on PATH; success is cached, absence is re-probed. */
 let pnpmReady = false
 
@@ -147,7 +194,7 @@ export function runDshPlugin(profile: string, pluginArgs: string[]): Promise<Ins
   const target = pluginArgs[pluginArgs.length - 1] ?? ''
   if (!TARGET_RE.test(target)) {
     logEvent('error', 'install', `unsafe plugin target rejected: ${JSON.stringify(target)}`)
-    return Promise.resolve({ exitCode: 1, timedOut: false, stdout: '', stderr: `unsafe plugin target rejected: ${JSON.stringify(target)}` })
+    return Promise.resolve({ exitCode: 1, timedOut: false, stdout: '', stderr: `unsafe plugin target rejected: ${JSON.stringify(target)}`, cancelled: false })
   }
   progress.active = true
   progress.target = target
@@ -162,13 +209,18 @@ export function runDshPlugin(profile: string, pluginArgs: string[]): Promise<Ins
       env: { ...process.env, CI: 'true' },
       stdio: ['ignore', 'pipe', 'pipe'],
       shell: viaShell,
+      // Own process group on POSIX so cancel/timeout can kill the whole
+      // tree (dsh wrapper + pnpm grandchild) with one group signal.
+      detached: process.platform !== 'win32',
     })
+    activeChild = child
+    cancelRequested = false
     let stdout = ''
     let stderr = ''
     let timedOut = false
     const timer = setTimeout(() => {
       timedOut = true
-      killChild(child)
+      killTree(child)
     }, INSTALL_TIMEOUT_MS)
     child.stdout.on('data', (chunk: Buffer) => {
       const text = chunk.toString()
@@ -183,12 +235,14 @@ export function runDshPlugin(profile: string, pluginArgs: string[]): Promise<Ins
     child.on('error', (error) => {
       clearTimeout(timer)
       progress.active = false
-      resolvePromise({ exitCode: 127, timedOut: false, stdout, stderr: `${stderr}\n${error.message}` })
+      if (activeChild === child) activeChild = null
+      resolvePromise({ exitCode: 127, timedOut: false, stdout, stderr: `${stderr}\n${error.message}`, cancelled: false })
     })
     child.on('close', (code) => {
       clearTimeout(timer)
       progress.active = false
-      resolvePromise({ exitCode: code, timedOut, stdout, stderr })
+      if (activeChild === child) activeChild = null
+      resolvePromise({ exitCode: code, timedOut, stdout, stderr, cancelled: cancelRequested })
     })
   })
 }

package/src/index.ts

@@ -29,7 +29,10 @@ function argvProfile(): string | undefined {
 }
 
 export function apply(ctx: Context, config?: Config): void {
-  const resolved: MarketConfig = { profile: config?.profile ?? argvProfile() ?? 'web' }
+  const resolved: MarketConfig = {
+    profile: config?.profile ?? argvProfile() ?? 'web',
+    allowRestart: config?.allowRestart ?? true,
+  }
   ctx.inject(['webServer', 'loader'], (hostCtx: Context) => {
     const host = hostCtx as unknown as MarketHost & {
       effect(callback: () => () => void, label: string): void

package/src/install.ts

@@ -22,7 +22,7 @@ import { logEvent } from './log.ts'
  */
 export async function withHoistRecovery(run: PluginRunner, profile: string, pluginArgs: string[]): Promise<InstallResult> {
   let result = await run(profile, pluginArgs)
-  const ok = (r: InstallResult): boolean => r.exitCode === 0 && !r.timedOut
+  const ok = (r: InstallResult): boolean => r.exitCode === 0 && !r.timedOut && !r.cancelled
   if (!ok(result) && classifyPnpmFailure(`${result.stderr}\n${result.stdout}`)?.code === 'hoist-pattern-diff') {
     logEvent('warn', 'install', `modules dir was built by a different pnpm major — rebuilding (pnpm install) and retrying once`)
     // --no-frozen-lockfile: the market runs pnpm with CI=true (TTY hangs),
@@ -30,7 +30,7 @@ export async function withHoistRecovery(run: PluginRunner, profile: string, plug
     const rebuild = await run(profile, ['install', '--no-frozen-lockfile'])
     if (ok(rebuild)) result = await run(profile, pluginArgs)
   }
-  if (!ok(result)) {
+  if (!ok(result) && !result.cancelled) {
     const failure = classifyPnpmFailure(`${result.stderr}\n${result.stdout}`)
     if (failure !== null) result = { ...result, stderr: `${result.stderr}\n\n${failure.message}` }
   }
@@ -119,3 +119,23 @@ export function isStaleUpdate(check: {
     ? check.beforeCommit !== null && check.afterCommit === check.beforeCommit
     : check.beforeVersion !== null && check.afterVersion === check.beforeVersion
 }
+
+/**
+ * Package names pnpm reported as having their build scripts ignored
+ * ("Ignored build scripts: esbuild, koffi."). Empty when none.
+ * (#6 by @qichuang321.)
+ */
+export function parseIgnoredBuilds(stdout: string, stderr: string): string[] {
+  const m = /Ignored build scripts:?\s*([^\n]+)/i.exec(`${stdout}\n${stderr}`)
+  if (m === null) return []
+  const found: string[] = []
+  for (const chunk of m[1].split(',')) {
+    // Entries may carry a version suffix and the sentence's final period.
+    const trimmed = chunk.trim().replace(/\.$/, '')
+    if (trimmed === '') continue
+    const at = trimmed.lastIndexOf('@')
+    const name = at > 0 ? trimmed.slice(0, at) : trimmed
+    if (name !== '' && !found.includes(name)) found.push(name)
+  }
+  return found
+}

package/src/profile.ts

@@ -4,7 +4,7 @@
  * functions of the directory contents; no processes, no network.
  */
 
-import { existsSync, readdirSync, readFileSync } from 'node:fs'
+import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
 
@@ -14,7 +14,20 @@ export function profileDir(profile: string): string {
   return join(home, 'profiles', profile)
 }
 
-/** Community dependencies of the profile (official in-box scope filtered out). */
+/**
+ * The in-box bundles dsh's profile templates install themselves — the ONLY
+ * names the market hides from the installed list. Community plugins may
+ * legitimately publish under the official scope (#28), so a whole-scope
+ * filter would make them invisible and fail install validation.
+ * (Diagnosis and fix proposed in #28 by @Lograthmic.)
+ */
+const INBOX_BUNDLES = new Set([
+  '@deepseek-ai/dsh-base',
+  '@deepseek-ai/dsh-web-app',
+  '@deepseek-ai/dsh-headless',
+])
+
+/** Community dependencies of the profile (in-box bundles filtered out). */
 export function readInstalled(profile: string): Record<string, string> {
   try {
     const manifest = JSON.parse(readFileSync(join(profileDir(profile), 'package.json'), 'utf8')) as {
@@ -22,7 +35,7 @@ export function readInstalled(profile: string): Record<string, string> {
     }
     const installed: Record<string, string> = {}
     for (const [name, spec] of Object.entries(manifest.dependencies ?? {})) {
-      if (!name.startsWith('@deepseek-ai/')) installed[name] = spec
+      if (!INBOX_BUNDLES.has(name)) installed[name] = spec
     }
     return installed
   } catch {
@@ -118,3 +131,32 @@ export function pluginSubdirs(root: string): string[] {
   }
   return found.slice(0, 8)
 }
+
+/**
+ * Allow the given packages' build scripts in the profile's
+ * pnpm-workspace.yaml `allowBuilds` block (the key dsh profiles use),
+ * merging with existing entries and leaving the rest of the yaml intact.
+ * (#6 by @qichuang321.)
+ * @returns every package now allowed.
+ */
+export function setAllowBuilds(profile: string, packages: string[]): string[] {
+  const file = join(profileDir(profile), 'pnpm-workspace.yaml')
+  let yaml = ''
+  try { yaml = readFileSync(file, 'utf8') } catch { /* created below */ }
+  const blockRe = /allowBuilds:\n((?:[ \t]+[^\n]*\n?)*)/
+  const map: Record<string, string> = {}
+  const blockMatch = blockRe.exec(yaml)
+  if (blockMatch !== null) {
+    for (const line of blockMatch[1].split('\n')) {
+      const m = /^[ \t]+([^:\s]+(?:\/[^:\s]+)?)\s*:\s*(\S.*)?$/.exec(line)
+      if (m !== null) map[m[1]] = m[2] ?? 'true'
+    }
+  }
+  for (const pkg of packages) {
+    if (/^[A-Za-z0-9@/_.-]+$/.test(pkg)) map[pkg] = 'true'
+  }
+  const block = Object.entries(map).map(([k, v]) => `  ${k}: ${v}`).join('\n')
+  const blockText = `allowBuilds:\n${block}\n`
+  writeFileSync(file, blockMatch !== null ? yaml.replace(blockRe, blockText) : `${yaml.replace(/\n?$/, '\n')}${blockText}`)
+  return Object.keys(map)
+}