dshmarket 1.21.1 → 1.21.2

package/lib/routes.js

@@ -31,7 +31,7 @@ import { checkUpdates, fetchNpmLatest, invalidateUpdates, isUpgrade, latestPubli
 import { createThemeManager } from './themes.js';
 import { readJsonBody, sameOrigin, sendJson } from './http.js';
 import { detectedSupervisor, restartAllowed, scheduleRestart, servingPort, trustedRestartRequest, trustedDownloadRequest } from './restart.js';
-import { activationAfterReplace, checkClientBundle, hasHostHalf, verifyActivation } from './verify.js';
+import { activationAfterReplace, brokenClientBundles, checkClientBundle, hasHostHalf, newlyBrokenBundles, verifyActivation } from './verify.js';
 import { carrierDisableIds, disableRow, enableRow, findUserPatchPath, isProtectedModule, packagePatchFlags, readUserPatchState, removeRowBlocks, rowIdsForPackage, } from './patch.js';
 import { createProfileBackup, downloadWebdav, MAX_BACKUP_BYTES, mergeRestoreManifest, restoreProfileBackup, unportableDeps, uploadWebdav, } from './backup.js';
 import { createGist, fitsGistLimit, GistError, gistErrorCode, parseGistId, readGist, resolveGistTokenSource, updateGist, verifyGistToken, } from './gist.js';
@@ -1376,6 +1376,12 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                         // ghost/bumped entries that break every later pnpm run.
                         pendingRollbacks.clear();
                         const compatibilityBefore = assessProfile(config.profile, activeProfileDir);
+                        // pnpm re-extracts the whole tree on any operation, so a plugin
+                        // nobody touched can come back pristine-and-broken, or lose a
+                        // patch that was holding it together (#222). Only what THIS run
+                        // broke is attributable to it, so the profile is swept before as
+                        // well as after.
+                        const bundlesBefore = brokenClientBundles(config.profile, activeProfileDir);
                         const manifestBefore = readManifestDeps(config.profile, activeProfileDir);
                         const result = await runPlugin(config.profile, addArgs);
                         const cancelled = result.cancelled;
@@ -1458,7 +1464,10 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                             // See the install route: an update is the operation the #222
                             // report actually hit.
                             const bundleCheck = checkClientBundle(config.profile, name, activeProfileDir);
-                            const brokenBundles = bundleCheck.ok ? [] : [{ name, reason: bundleCheck.reason ?? 'parse failed' }];
+                            const brokenBundles = newlyBrokenBundles(bundlesBefore, [
+                                ...(bundleCheck.ok ? [] : [{ name, reason: bundleCheck.reason ?? 'parse failed' }]),
+                                ...brokenClientBundles(config.profile, activeProfileDir),
+                            ].filter((entry, index, all) => all.findIndex(other => other.name === entry.name) === index));
                             if (risks.length > 0 || shadowed.length > 0 || brokenBundles.length > 0) {
                                 compatibility = {
                                     code: 'soft-incompatible',
@@ -2240,6 +2249,12 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                             before.delete(retryAlias);
                         pendingRollbacks.clear();
                         const compatibilityBefore = assessProfile(config.profile, activeProfileDir);
+                        // pnpm re-extracts the whole tree on any operation, so a plugin
+                        // nobody touched can come back pristine-and-broken, or lose a
+                        // patch that was holding it together (#222). Only what THIS run
+                        // broke is attributable to it, so the profile is swept before as
+                        // well as after.
+                        const bundlesBefore = brokenClientBundles(config.profile, activeProfileDir);
                         // RAW manifest snapshot for failure rollback (#65): pnpm writes
                         // package.json before the build-script check / registry fetches
                         // run, so a hard-failed add leaves ghost dependencies that break
@@ -2337,10 +2352,13 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                             // one half-written or patch-mangled, and today that surfaces
                             // as a blank settings page long after the install reported
                             // success, with nothing connecting the two.
-                            const brokenBundles = addedPackages
-                                .map(pkg => ({ name: pkg, check: checkClientBundle(config.profile, pkg, activeProfileDir) }))
-                                .filter(entry => !entry.check.ok)
-                                .map(entry => ({ name: entry.name, reason: entry.check.reason ?? 'parse failed' }));
+                            const brokenBundles = newlyBrokenBundles(bundlesBefore, [
+                                ...addedPackages
+                                    .map(pkg => ({ name: pkg, check: checkClientBundle(config.profile, pkg, activeProfileDir) }))
+                                    .filter(entry => !entry.check.ok)
+                                    .map(entry => ({ name: entry.name, reason: entry.check.reason ?? 'parse failed' })),
+                                ...brokenClientBundles(config.profile, activeProfileDir),
+                            ].filter((entry, index, all) => all.findIndex(other => other.name === entry.name) === index));
                             if (risks.length > 0 || shadowed.length > 0 || brokenBundles.length > 0) {
                                 compatibility = {
                                     code: 'soft-incompatible',

package/lib/types/verify.d.ts

@@ -102,19 +102,43 @@ export interface BundleCheck {
     reason: string | null;
 }
 /**
- * Whether a package's client bundle still parses as JavaScript (#222).
+ * Every installed plugin whose client bundle will not parse (#222 by
+ * @MicroMilo).
  *
- * pnpm can leave a half-written or patch-mangled bundle behind — the report
- * describes a profile whose client bundle was broken after an update. The
- * browser is where that surfaces today, as a blank settings page long after
- * the operation reported success, with nothing connecting the two.
+ * The per-package check above only ever looked at what an operation added,
+ * which misses the failure that was actually reported: pnpm re-extracts the
+ * WHOLE tree on any install, so updating one plugin can restore another
+ * plugin's pristine — and broken — bundle, or fail to re-apply a patch that
+ * was holding it together. The damage then surfaces at the next boot as
+ * "failed to load plugins", with nothing connecting it to the install that
+ * caused it.
  *
- * `vm.Script` COMPILES without executing: it catches the syntax damage this
- * is looking for and never runs plugin code, so a hostile bundle gains
- * nothing. A missing `dsh.client`, an unresolvable exports field, or a file
- * that is simply absent all return ok — this check only ever fires on a file
- * it actually read and actually failed to parse. Everything ambiguous stays
- * silent, because a false "your plugin is corrupt" is the one outcome worse
- * than not checking.
+ * Cheap enough to run on every operation: 0.40ms per plugin including the
+ * read (measured on a 385KB bundle), so a 30-plugin profile costs ~12ms
+ * against an install that takes seconds.
+ *
+ * Silent on ESM bundles, like the per-package check it calls — see there for
+ * why. Widening the sweep is exactly what would have turned that one false
+ * "corrupt" into one per ESM plugin in the profile.
+ *
+ * Callers compare a before-list with an after-list rather than reporting
+ * this one directly — a profile can carry a broken bundle indefinitely, and
+ * re-reporting a problem the user already had would put them in front of
+ * something this operation did not cause and cannot undo.
  */
+export declare function brokenClientBundles(profile: string, explicitDir?: string): {
+    name: string;
+    reason: string;
+}[];
+/** Bundles broken after an operation that were intact before it. */
+export declare function newlyBrokenBundles(before: readonly {
+    name: string;
+    reason: string;
+}[], after: readonly {
+    name: string;
+    reason: string;
+}[]): {
+    name: string;
+    reason: string;
+}[];
 export declare function checkClientBundle(profile: string, name: string, explicitDir?: string): BundleCheck;

package/lib/verify.js

@@ -27,7 +27,7 @@ import { readFileSync } from 'node:fs';
 import { Script } from 'node:vm';
 import { join } from 'node:path';
 import { listHotMounts, parseSimplePatch } from './hot.js';
-import { bundlePatchInsertedIds, hasDshManifest, hasLoadableEntry, profileDir } from './profile.js';
+import { bundlePatchInsertedIds, hasDshManifest, hasLoadableEntry, profileDir, readInstalled } from './profile.js';
 /** The profile manifest's `dsh.profile.bundles` — what the CLI reconciled. */
 function readBundles(profile, explicitDir) {
     try {
@@ -328,6 +328,55 @@ export function clientBundlePath(exportsField, depth = 0) {
  * silent, because a false "your plugin is corrupt" is the one outcome worse
  * than not checking.
  */
+/**
+ * V8's wording when a classic-script parse trips over module syntax.
+ *
+ * Matched on the message because there is no flag-free way to compile a
+ * module here (`SourceTextModule` needs --experimental-vm-modules, which the
+ * host process does not set). If V8 ever rewords these, the failure mode is
+ * the false positive we had before rather than a missed real break — the
+ * safer direction of the two.
+ */
+const MODULE_SYNTAX_ERROR = /Unexpected token 'export'|Cannot use import statement outside a module|await is only valid in async functions and the top level bodies of modules/;
+/**
+ * Every installed plugin whose client bundle will not parse (#222 by
+ * @MicroMilo).
+ *
+ * The per-package check above only ever looked at what an operation added,
+ * which misses the failure that was actually reported: pnpm re-extracts the
+ * WHOLE tree on any install, so updating one plugin can restore another
+ * plugin's pristine — and broken — bundle, or fail to re-apply a patch that
+ * was holding it together. The damage then surfaces at the next boot as
+ * "failed to load plugins", with nothing connecting it to the install that
+ * caused it.
+ *
+ * Cheap enough to run on every operation: 0.40ms per plugin including the
+ * read (measured on a 385KB bundle), so a 30-plugin profile costs ~12ms
+ * against an install that takes seconds.
+ *
+ * Silent on ESM bundles, like the per-package check it calls — see there for
+ * why. Widening the sweep is exactly what would have turned that one false
+ * "corrupt" into one per ESM plugin in the profile.
+ *
+ * Callers compare a before-list with an after-list rather than reporting
+ * this one directly — a profile can carry a broken bundle indefinitely, and
+ * re-reporting a problem the user already had would put them in front of
+ * something this operation did not cause and cannot undo.
+ */
+export function brokenClientBundles(profile, explicitDir) {
+    const broken = [];
+    for (const name of Object.keys(readInstalled(profile, explicitDir))) {
+        const check = checkClientBundle(profile, name, explicitDir);
+        if (!check.ok)
+            broken.push({ name, reason: check.reason ?? 'parse failed' });
+    }
+    return broken;
+}
+/** Bundles broken after an operation that were intact before it. */
+export function newlyBrokenBundles(before, after) {
+    const seen = new Set(before.map(entry => entry.name));
+    return after.filter(entry => !seen.has(entry.name));
+}
 export function checkClientBundle(profile, name, explicitDir) {
     const root = join(profileDir(profile, explicitDir), 'node_modules', name);
     let manifest;
@@ -360,6 +409,18 @@ export function checkClientBundle(profile, name, explicitDir) {
         return { ok: true, reason: null };
     }
     catch (error) {
-        return { ok: false, reason: error instanceof Error ? error.message : String(error) };
+        const message = error instanceof Error ? error.message : String(error);
+        // `new Script` compiles a CLASSIC script, so perfectly valid module
+        // syntax is a SyntaxError to it: `export`, `import`, and top-level
+        // `await` all throw. This package ships CJS, which is why nobody noticed
+        // — but a plugin whose client bundle is ESM was being told its file was
+        // corrupt, and offered a rollback for a file that is fine.
+        //
+        // That is the exact outcome this check's own contract forbids: a false
+        // "your plugin is corrupt" is worse than not checking. Module syntax
+        // means "cannot judge with this parser", not "broken".
+        if (MODULE_SYNTAX_ERROR.test(message))
+            return { ok: true, reason: null };
+        return { ok: false, reason: message };
     }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.21.1",
+  "version": "1.21.2",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/routes.ts

@@ -39,7 +39,7 @@ import { checkUpdates, fetchNpmLatest, invalidateUpdates, isUpgrade, latestPubli
 import { createThemeManager, type LoaderEntry } from './themes.ts'
 import { readJsonBody, sameOrigin, sendJson } from './http.ts'
 import { detectedSupervisor, restartAllowed, scheduleRestart, servingPort, trustedRestartRequest, trustedDownloadRequest } from './restart.ts'
-import { activationAfterReplace, checkClientBundle, hasHostHalf, verifyActivation } from './verify.ts'
+import { activationAfterReplace, brokenClientBundles, checkClientBundle, hasHostHalf, newlyBrokenBundles, verifyActivation } from './verify.ts'
 import {
   carrierDisableIds, disableRow, enableRow, findUserPatchPath, isProtectedModule, packagePatchFlags,
   readUserPatchState, removeRowBlocks, rowIdsForPackage,
@@ -1423,6 +1423,12 @@ export function mountMarketRoutes(
             // ghost/bumped entries that break every later pnpm run.
             pendingRollbacks.clear()
             const compatibilityBefore = assessProfile(config.profile, activeProfileDir)
+            // pnpm re-extracts the whole tree on any operation, so a plugin
+            // nobody touched can come back pristine-and-broken, or lose a
+            // patch that was holding it together (#222). Only what THIS run
+            // broke is attributable to it, so the profile is swept before as
+            // well as after.
+            const bundlesBefore = brokenClientBundles(config.profile, activeProfileDir)
             const manifestBefore = readManifestDeps(config.profile, activeProfileDir)
             const result = await runPlugin(config.profile, addArgs)
             const cancelled = result.cancelled
@@ -1508,7 +1514,13 @@ export function mountMarketRoutes(
               // See the install route: an update is the operation the #222
               // report actually hit.
               const bundleCheck = checkClientBundle(config.profile, name, activeProfileDir)
-              const brokenBundles = bundleCheck.ok ? [] : [{ name, reason: bundleCheck.reason ?? 'parse failed' }]
+              const brokenBundles = newlyBrokenBundles(
+                bundlesBefore,
+                [
+                  ...(bundleCheck.ok ? [] : [{ name, reason: bundleCheck.reason ?? 'parse failed' }]),
+                  ...brokenClientBundles(config.profile, activeProfileDir),
+                ].filter((entry, index, all) => all.findIndex(other => other.name === entry.name) === index),
+              )
               if (risks.length > 0 || shadowed.length > 0 || brokenBundles.length > 0) {
                 compatibility = {
                   code: 'soft-incompatible',
@@ -2294,6 +2306,12 @@ export function mountMarketRoutes(
             if (retryAlias !== null) before.delete(retryAlias)
             pendingRollbacks.clear()
             const compatibilityBefore = assessProfile(config.profile, activeProfileDir)
+            // pnpm re-extracts the whole tree on any operation, so a plugin
+            // nobody touched can come back pristine-and-broken, or lose a
+            // patch that was holding it together (#222). Only what THIS run
+            // broke is attributable to it, so the profile is swept before as
+            // well as after.
+            const bundlesBefore = brokenClientBundles(config.profile, activeProfileDir)
             // RAW manifest snapshot for failure rollback (#65): pnpm writes
             // package.json before the build-script check / registry fetches
             // run, so a hard-failed add leaves ghost dependencies that break
@@ -2386,10 +2404,16 @@ export function mountMarketRoutes(
               // one half-written or patch-mangled, and today that surfaces
               // as a blank settings page long after the install reported
               // success, with nothing connecting the two.
-              const brokenBundles = addedPackages
-                .map(pkg => ({ name: pkg, check: checkClientBundle(config.profile, pkg, activeProfileDir) }))
-                .filter(entry => !entry.check.ok)
-                .map(entry => ({ name: entry.name, reason: entry.check.reason ?? 'parse failed' }))
+              const brokenBundles = newlyBrokenBundles(
+                bundlesBefore,
+                [
+                  ...addedPackages
+                    .map(pkg => ({ name: pkg, check: checkClientBundle(config.profile, pkg, activeProfileDir) }))
+                    .filter(entry => !entry.check.ok)
+                    .map(entry => ({ name: entry.name, reason: entry.check.reason ?? 'parse failed' })),
+                  ...brokenClientBundles(config.profile, activeProfileDir),
+                ].filter((entry, index, all) => all.findIndex(other => other.name === entry.name) === index),
+              )
               if (risks.length > 0 || shadowed.length > 0 || brokenBundles.length > 0) {
                 compatibility = {
                   code: 'soft-incompatible',

package/src/verify.ts

@@ -28,7 +28,7 @@ import { readFileSync } from 'node:fs'
 import { Script } from 'node:vm'
 import { join } from 'node:path'
 import { listHotMounts, parseSimplePatch } from './hot.ts'
-import { bundlePatchInsertedIds, hasDshManifest, hasLoadableEntry, profileDir } from './profile.ts'
+import { bundlePatchInsertedIds, hasDshManifest, hasLoadableEntry, profileDir, readInstalled } from './profile.ts'
 
 export type ActivationState = 'live' | 'restart' | 'inert' | 'broken' | 'missing' | 'disabled'
 
@@ -367,6 +367,60 @@ export interface BundleCheck {
  * silent, because a false "your plugin is corrupt" is the one outcome worse
  * than not checking.
  */
+/**
+ * V8's wording when a classic-script parse trips over module syntax.
+ *
+ * Matched on the message because there is no flag-free way to compile a
+ * module here (`SourceTextModule` needs --experimental-vm-modules, which the
+ * host process does not set). If V8 ever rewords these, the failure mode is
+ * the false positive we had before rather than a missed real break — the
+ * safer direction of the two.
+ */
+const MODULE_SYNTAX_ERROR = /Unexpected token 'export'|Cannot use import statement outside a module|await is only valid in async functions and the top level bodies of modules/
+
+/**
+ * Every installed plugin whose client bundle will not parse (#222 by
+ * @MicroMilo).
+ *
+ * The per-package check above only ever looked at what an operation added,
+ * which misses the failure that was actually reported: pnpm re-extracts the
+ * WHOLE tree on any install, so updating one plugin can restore another
+ * plugin's pristine — and broken — bundle, or fail to re-apply a patch that
+ * was holding it together. The damage then surfaces at the next boot as
+ * "failed to load plugins", with nothing connecting it to the install that
+ * caused it.
+ *
+ * Cheap enough to run on every operation: 0.40ms per plugin including the
+ * read (measured on a 385KB bundle), so a 30-plugin profile costs ~12ms
+ * against an install that takes seconds.
+ *
+ * Silent on ESM bundles, like the per-package check it calls — see there for
+ * why. Widening the sweep is exactly what would have turned that one false
+ * "corrupt" into one per ESM plugin in the profile.
+ *
+ * Callers compare a before-list with an after-list rather than reporting
+ * this one directly — a profile can carry a broken bundle indefinitely, and
+ * re-reporting a problem the user already had would put them in front of
+ * something this operation did not cause and cannot undo.
+ */
+export function brokenClientBundles(profile: string, explicitDir?: string): { name: string; reason: string }[] {
+  const broken: { name: string; reason: string }[] = []
+  for (const name of Object.keys(readInstalled(profile, explicitDir))) {
+    const check = checkClientBundle(profile, name, explicitDir)
+    if (!check.ok) broken.push({ name, reason: check.reason ?? 'parse failed' })
+  }
+  return broken
+}
+
+/** Bundles broken after an operation that were intact before it. */
+export function newlyBrokenBundles(
+  before: readonly { name: string; reason: string }[],
+  after: readonly { name: string; reason: string }[],
+): { name: string; reason: string }[] {
+  const seen = new Set(before.map(entry => entry.name))
+  return after.filter(entry => !seen.has(entry.name))
+}
+
 export function checkClientBundle(profile: string, name: string, explicitDir?: string): BundleCheck {
   const root = join(profileDir(profile, explicitDir), 'node_modules', name)
   let manifest: { dsh?: { client?: unknown }; exports?: unknown }
@@ -394,6 +448,17 @@ export function checkClientBundle(profile: string, name: string, explicitDir?: s
     new Script(source, { filename: relative })
     return { ok: true, reason: null }
   } catch (error) {
-    return { ok: false, reason: error instanceof Error ? error.message : String(error) }
+    const message = error instanceof Error ? error.message : String(error)
+    // `new Script` compiles a CLASSIC script, so perfectly valid module
+    // syntax is a SyntaxError to it: `export`, `import`, and top-level
+    // `await` all throw. This package ships CJS, which is why nobody noticed
+    // — but a plugin whose client bundle is ESM was being told its file was
+    // corrupt, and offered a rollback for a file that is fine.
+    //
+    // That is the exact outcome this check's own contract forbids: a false
+    // "your plugin is corrupt" is worse than not checking. Module syntax
+    // means "cannot judge with this parser", not "broken".
+    if (MODULE_SYNTAX_ERROR.test(message)) return { ok: true, reason: null }
+    return { ok: false, reason: message }
   }
 }