dshmarket 1.26.0 → 1.27.0

package/lib/check.js

@@ -18,15 +18,17 @@
  *     version (tool calls die, minimal preset fails to mount)?
  *  4. Are there multiple versions of one core package in the lockfile, and
  *     do plugin peerDependencies ranges match the resolved core version?
+ *  5. Do effective user/home patch entries reference npm package roots that
+ *     are installed in the profile-visible node_modules ancestry?
  *
  * The composition step mirrors @deepseek-ai/dsh-app-boot's applyEntryPatches
  * (same js-yaml dialect incl. `!!js` scalars), so the rows reported here are
  * what actually mounts at boot.
  */
-import { existsSync, readdirSync, readFileSync } from 'node:fs';
-import { createRequire } from 'node:module';
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { createRequire, isBuiltin } from 'node:module';
 import { homedir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { JSON_SCHEMA, Type, load } from 'js-yaml';
 import { INBOX_BUNDLES, readBundleRules, suggestOrder, validateOrder } from './order.js';
 /** js-yaml dialect for `!!js` scalars — identical to dsh-app-boot's entryListSchema. */
@@ -39,23 +41,75 @@ const entrySchema = JSON_SCHEMA.extend(jsExpr);
 function isRecord(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value);
 }
-/** Parse one entry-list patch file with the dsh dialect; null when unreadable. */
-export function parsePatchFile(path) {
-    let text;
+/** Parse entry-list source with the DSH dialect; null when it is not a list. */
+export function parsePatchText(text) {
     try {
-        text = readFileSync(path, 'utf8');
+        const value = load(text, { schema: entrySchema });
+        return Array.isArray(value) ? value : null;
     }
     catch {
         return null;
     }
+}
+/** Parse one entry-list patch file with the DSH dialect; null when unreadable. */
+export function parsePatchFile(path) {
     try {
-        const value = load(text, { schema: entrySchema });
-        return Array.isArray(value) ? value : null;
+        return parsePatchText(readFileSync(path, 'utf8'));
     }
     catch {
         return null;
     }
 }
+/** Whether `name` goes through the Loader's bare-module resolver. */
+function isBareLoaderSpecifier(name) {
+    return !name.startsWith('.')
+        && !name.startsWith('#')
+        && !isAbsolute(name)
+        && !/^[a-z][a-z\d+.-]*:/i.test(name);
+}
+/** Npm package root owning one bare Loader specifier. */
+function packageRoot(specifier) {
+    const parts = specifier.split('/');
+    const segments = specifier.startsWith('@') ? parts.slice(0, 2) : parts.slice(0, 1);
+    if (segments.length !== (specifier.startsWith('@') ? 2 : 1))
+        return null;
+    if (segments.some(segment => segment === '' || segment === '.' || segment === '..'
+        || segment.includes('%') || segment.includes('\\')))
+        return null;
+    if (specifier.startsWith('@') && (segments[0]?.length ?? 0) <= 1)
+        return null;
+    return segments.join('/');
+}
+/**
+ * Package-root presence from the Loader-visible profile ancestry only.
+ * An explicit walk avoids CommonJS global lookup directories that
+ * `createRequire(...).resolve.paths()` appends but Node ESM does not search.
+ */
+function profilePackageInstalled(profileDirectory, name) {
+    try {
+        const profile = JSON.parse(readFileSync(join(profileDirectory, 'package.json'), 'utf8'));
+        if (isRecord(profile) && profile.name === name
+            && profile.exports !== undefined && profile.exports !== null)
+            return true;
+    }
+    catch { /* not a self-referencing profile package */ }
+    let directory = resolve(profileDirectory);
+    while (true) {
+        const packageDirectory = join(directory, 'node_modules', name);
+        // Node stops at the nearest matching package directory. A partial install
+        // there shadows any healthy parent copy and must not be accepted.
+        try {
+            if (statSync(packageDirectory).isDirectory()) {
+                return existsSync(join(packageDirectory, 'package.json'));
+            }
+        }
+        catch { /* keep walking */ }
+        const parent = dirname(directory);
+        if (parent === directory)
+            return false;
+        directory = parent;
+    }
+}
 /** Every id in one patch row's insert list, recursively (group configs included). */
 function collectInsertIds(rows) {
     const ids = [];
@@ -160,14 +214,14 @@ function readNodeModulesVersion(base, name) {
     }
 }
 /**
- * Resolve one bundle package's directory the way the dsh boot does
+ * Resolve one package's directory the way the dsh boot does
  * (dsh-app-boot's resolveBundleDir): probe Node's own node_modules search
  * paths from the installation anchor first, then the profile directory.
  * Node resolution walks upward, so this also finds pnpm's workspace-root
  * hoisting (`<profiles>/node_modules/…` when the profile lives under
- * `<profiles>/<name>`) and matches exactly what the Loader would import.
+ * `<profiles>/<name>`) and mirrors the Loader's package search roots.
  */
-function resolveBundleDir(anchorPackageJson, name) {
+function resolvePackageDir(anchorPackageJson, name) {
     let paths = [];
     try {
         paths = createRequire(anchorPackageJson).resolve.paths(name) ?? [];
@@ -308,6 +362,26 @@ export function satisfiesRange(version, range) {
     if (v === null)
         return null;
     const versionHasPre = v.pre.length > 0;
+    // Mirror pnpm's peer-dependency publish transform. Unlike ordinary
+    // dependency specs, a workspace token may sit inside a larger peer range.
+    // Operator-only (or bare) tokens receive the linked sibling's version;
+    // explicit versions only lose the protocol prefix. Unsupported alias/path
+    // forms become an unknown range below rather than a definite mismatch.
+    const workspaceSemver = /workspace:([\^~*]|>=|>|<=|<)?((\d+|[xX*])(\.(\d+|[xX*])){0,2})?/;
+    let normalizedRange = range;
+    if (range.includes('workspace:')) {
+        const match = workspaceSemver.exec(range);
+        if (match === null) {
+            normalizedRange = range.replace('workspace:', '');
+        }
+        else if (match[2] !== undefined) {
+            normalizedRange = range.replace('workspace:', '');
+        }
+        else {
+            const operator = match[1] === '*' ? '' : (match[1] ?? '');
+            normalizedRange = range.replace(workspaceSemver, `${operator}${semverStr(v)}`);
+        }
+    }
     const single = (part) => {
         const p = part.trim();
         if (p === '' || p === '*' || p === 'x' || p === 'X')
@@ -358,7 +432,14 @@ export function satisfiesRange(version, range) {
         const m = /^(\^|~|>=|<=|>|<)?(.*)$/.exec(p);
         if (m === null)
             return null;
-        return { op: m[1] ?? '', target: (m[2] ?? '').trim() };
+        const target = (m[2] ?? '').trim();
+        // Enforce this function's documented unknown-range contract before the
+        // prerelease admission gate. Otherwise an unknown protocol such as
+        // `workspace:^` or `catalog:default` is misreported as a definite false
+        // whenever the resolved version happens to carry a prerelease tag.
+        if (parseSemver(target) === null)
+            return null;
+        return { op: m[1] ?? '', target };
     };
     /** Evaluate ONE comparator set (a `||` alternative) as a conjunction. */
     const evaluateSet = (set) => {
@@ -386,22 +467,74 @@ export function satisfiesRange(version, range) {
             return null;
         return results.every(r => r === true);
     };
-    if (range.includes('||')) {
-        const outcomes = range.split('||').map(part => evaluateSet(part));
+    if (normalizedRange.includes('||')) {
+        const outcomes = normalizedRange.split('||').map(part => evaluateSet(part));
         if (outcomes.some(out => out === true))
             return true;
-        return outcomes.every(out => out === null) ? null : false;
+        if (outcomes.some(out => out === null))
+            return null;
+        return false;
     }
-    return evaluateSet(range);
+    return evaluateSet(normalizedRange);
 }
 /** Flatten a tree of entries (group configs included) into row records. */
 function flattenEntries(nodes) {
     const rows = [];
-    const walk = (list) => {
+    const walk = (list, inheritedLayer) => {
         for (const node of list) {
-            rows.push({ id: node.id, layer: node.layer, kind: 'insert', name: node.name });
-            if (node.group === true && Array.isArray(node.config))
-                walk(node.config);
+            // Nested group configs come straight from the parsed patch and do not
+            // carry the synthetic layer metadata attached to their parent insert.
+            const layer = typeof node.layer === 'string' ? node.layer : inheritedLayer;
+            if (layer === undefined)
+                continue;
+            rows.push({ id: node.id, layer, kind: 'insert', name: node.name });
+            if (node.group === true && Array.isArray(node.config)) {
+                walk(node.config, layer);
+            }
+        }
+    };
+    walk(nodes);
+    return rows;
+}
+/** Literal values use Loader Boolean semantics; `!!js` stays indeterminate. */
+function disabledState(value) {
+    if (isRecord(value) && typeof value.__jsExpr === 'string')
+        return 'conditional';
+    return Boolean(value) ? 'disabled' : 'active';
+}
+function combineDisabled(parent, own) {
+    if (parent === 'disabled' || own === 'disabled')
+        return 'disabled';
+    if (parent === 'conditional' || own === 'conditional')
+        return 'conditional';
+    return 'active';
+}
+/**
+ * Rows whose specifiers the Loader can attempt to import. Group rows are
+ * always imported even when disabled (their disabled state gates children),
+ * while expression-gated non-group rows are retained as conditional.
+ */
+function resolvableEntries(nodes) {
+    const rows = [];
+    const walk = (list, inheritedLayer, parentDisabled = 'active') => {
+        for (const node of list) {
+            const layer = typeof node.layer === 'string' ? node.layer : inheritedLayer;
+            if (layer === undefined)
+                continue;
+            const descendantsDisabled = combineDisabled(parentDisabled, disabledState(node.disabled));
+            const activation = node.group === true ? 'required' : descendantsDisabled;
+            if (activation !== 'disabled') {
+                rows.push({
+                    id: node.id,
+                    layer,
+                    kind: 'insert',
+                    name: node.name,
+                    activation: activation === 'conditional' ? 'conditional' : 'required',
+                });
+            }
+            if (node.group === true && Array.isArray(node.config)) {
+                walk(node.config, layer, descendantsDisabled);
+            }
         }
     };
     walk(nodes);
@@ -457,6 +590,7 @@ export function composeLayers(layers) {
                         layer: layer.label,
                         group: entry.group === true,
                         config: Array.isArray(entry.config) ? entry.config : undefined,
+                        disabled: entry.disabled,
                     };
                 }).filter((n) => n !== null);
                 if (hasId) {
@@ -512,6 +646,7 @@ export function composeLayers(layers) {
         }
     }
     const rows = flattenEntries(tree);
+    const resolvableRows = resolvableEntries(tree);
     const byId = new Map();
     for (const row of rows) {
         const layers = byId.get(row.id) ?? [];
@@ -529,7 +664,7 @@ export function composeLayers(layers) {
         duplicates.push({ id, layers: byId.get(id) ?? [], count });
     }
     duplicates.sort((a, b) => a.id.localeCompare(b.id));
-    return { rows, duplicates, overrides, orphans };
+    return { rows, resolvableRows, duplicates, overrides, orphans };
 }
 /** Distinct versions of `@deepseek-ai/{dsh,cordis}*` packages in the lockfile. */
 function lockfileCoreVersions(profileDir) {
@@ -582,7 +717,7 @@ export function buildBundleLayers(profileDirectory, bundleNames, specs, dshInsta
         for (const anchor of anchors) {
             if (anchor === null)
                 continue;
-            directory = resolveBundleDir(anchor, name);
+            directory = resolvePackageDir(anchor, name);
             if (directory !== null)
                 break;
         }
@@ -747,6 +882,56 @@ export function analyzeProfile(profileDirectory, options = {}) {
         if (layer.parseError !== null && layer.kind !== 'bundle')
             errors.push(`${layer.label}: ${layer.parseError}`);
     }
+    // User and home patches can insert packages independently of a bundle.
+    // Only check rows that survived composition: an insert targeting a missing
+    // group is skipped by the boot and therefore cannot cause module loading to
+    // fail. Normalize package subpaths to their npm root and check the profile's
+    // node_modules ancestry; exact exports/subpath validation and relative,
+    // absolute, URL, builtin, package-import (#), or cordis: specifiers are
+    // outside this check.
+    const userLayerLabels = new Set(layers
+        .filter(layer => layer.kind === 'user' || layer.kind === 'home')
+        .map(layer => layer.label));
+    const candidates = new Map();
+    for (const row of composed.resolvableRows) {
+        if (row.kind !== 'insert' || !userLayerLabels.has(row.layer))
+            continue;
+        if (row.name === undefined || row.name === '') {
+            const message = `${row.layer}: loader entry ${JSON.stringify(row.id)} has no module name`;
+            if (row.activation === 'required')
+                errors.push(`${message} — the profile will fail to boot`);
+            else
+                warnings.push(`${message} — boot will fail if its disabled expression enables the entry`);
+            continue;
+        }
+        if (!isBareLoaderSpecifier(row.name))
+            continue;
+        if (isBuiltin(row.name))
+            continue;
+        const packageName = packageRoot(row.name);
+        if (packageName === null) {
+            const message = `${row.layer}: loader specifier ${JSON.stringify(row.name)} is not a valid bare package name`;
+            if (row.activation === 'required')
+                errors.push(`${message} — the profile will fail to boot`);
+            else
+                warnings.push(`${message} — boot will fail if its disabled expression enables the entry`);
+            continue;
+        }
+        const key = `${row.layer}\u0000${packageName}`;
+        const previous = candidates.get(key);
+        if (previous === undefined || previous.row.activation === 'conditional' && row.activation === 'required') {
+            candidates.set(key, { row, packageName });
+        }
+    }
+    for (const { row, packageName } of candidates.values()) {
+        if (profilePackageInstalled(profileDirectory, packageName))
+            continue;
+        const message = `${row.layer}: loader package ${packageName} is not installed in the profile`;
+        if (row.activation === 'required')
+            errors.push(`${message} — the profile will fail to boot`);
+        else
+            warnings.push(`${message} — boot will fail if its disabled expression enables the entry`);
+    }
     for (const dup of composed.duplicates) {
         errors.push(`duplicate loader entry id ${JSON.stringify(dup.id)} (${dup.count} rows: ${dup.layers.join(', ')})`);
     }

package/lib/patch.js

@@ -28,7 +28,7 @@ import { readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { logEvent } from './log.js';
-import { parsePatchFile } from './check.js';
+import { parsePatchFile, parsePatchText } from './check.js';
 import { bundlePatchInsertedIds, parsePatchRows } from './profile.js';
 /**
  * Host infrastructure rows: disabling any of these breaks the very chain
@@ -157,6 +157,81 @@ export function readUserPatchState(patchPath) {
     }
     return { disables, forced, inserts };
 }
+/**
+ * User-authored insert rows that still load `packageName` (or one of its
+ * exported subpaths). This evidence deliberately stays separate from the
+ * package's own bundle declaration: uninstall may clean market-owned rows,
+ * but it must never rewrite an insert the user owns.
+ *
+ * A missing patch is the ordinary empty-profile shape. `null` means the
+ * existing file could not be read as DSH's patch dialect; callers must treat
+ * that as indeterminate and refuse the destructive step.
+ */
+export function userPatchPackageReferences(patchPath, packageName) {
+    let source;
+    try {
+        source = readFileSync(patchPath, 'utf8');
+    }
+    catch (error) {
+        const code = error !== null && typeof error === 'object' && 'code' in error
+            ? error.code
+            : undefined;
+        if (code === 'ENOENT')
+            return [];
+        return null;
+    }
+    // Use the same schema as profile composition, including !!js scalars. A
+    // line scanner cannot distinguish flow-style entries or nested loader
+    // groups from arbitrary config keys in a hand-written user patch.
+    const rows = parsePatchText(source);
+    if (rows === null)
+        return null;
+    const insertedNames = new Set();
+    const visiting = new Set();
+    const visited = new Set();
+    const collect = (entries) => {
+        if (visited.has(entries))
+            return true;
+        if (visiting.has(entries))
+            return false;
+        visiting.add(entries);
+        for (const entry of entries) {
+            if (entry === null || typeof entry !== 'object' || Array.isArray(entry)) {
+                visiting.delete(entries);
+                return false;
+            }
+            const row = entry;
+            if ('name' in row && typeof row.name !== 'string') {
+                visiting.delete(entries);
+                return false;
+            }
+            if (typeof row.name === 'string')
+                insertedNames.add(row.name);
+            // Only group rows treat an array-valued config as child loader rows.
+            // Other plugins may use arrays of `{ name: ... }` as ordinary options,
+            // and those must not become false package references.
+            if (row.group === true && Array.isArray(row.config)) {
+                if (!collect(row.config)) {
+                    visiting.delete(entries);
+                    return false;
+                }
+            }
+        }
+        visiting.delete(entries);
+        visited.add(entries);
+        return true;
+    };
+    for (const patch of rows) {
+        if (patch === null || typeof patch !== 'object' || Array.isArray(patch))
+            return null;
+        const patchRow = patch;
+        if (!('insert' in patchRow))
+            continue;
+        if (!Array.isArray(patchRow.insert) || !collect(patchRow.insert))
+            return null;
+    }
+    return [...insertedNames].filter(reference => reference === packageName || reference.startsWith(`${packageName}/`));
+}
 /** The include entry's id prefix (loader entry ids look like `include:X`). */
 function includePrefix(host) {
     for (const entry of host.loader.entries()) {

package/lib/routes.js

@@ -34,7 +34,7 @@ import { createThemeManager } from './themes.js';
 import { readJsonBody, sameOrigin, sendJson } from './http.js';
 import { detectedSupervisor, restartAllowed, scheduleRestart, servingPort, trustedRestartRequest, trustedDownloadRequest } from './restart.js';
 import { activationAfterReplace, brokenClientBundles, checkClientBundle, hasHostHalf, newlyBrokenBundles, verifyActivation } from './verify.js';
-import { carrierDisableIds, disableRow, enableRow, findUserPatchPath, isProtectedModule, packagePatchFlags, readUserPatchState, removeRowBlocks, rowIdsForPackage, } from './patch.js';
+import { carrierDisableIds, disableRow, enableRow, findUserPatchPath, isProtectedModule, packagePatchFlags, readUserPatchState, removeRowBlocks, rowIdsForPackage, userPatchPackageReferences, } from './patch.js';
 import { createProfileBackup, downloadWebdav, MAX_BACKUP_BYTES, mergeRestoreManifest, restoreProfileBackup, unportableDeps, uploadWebdav, } from './backup.js';
 import { createGist, fitsGistLimit, GistError, gistErrorCode, parseGistId, readGist, resolveGistTokenSource, updateGist, verifyGistToken, } from './gist.js';
 /**
@@ -2250,6 +2250,11 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                     await withMutationLock(response, 'install', async () => {
                         const body = (await readJsonBody(request));
                         const name = typeof body.name === 'string' ? body.name : '';
+                        // Only the INDETERMINATE patch case is forceable, below. A patch
+                        // that definitely names the package stays refused: there the user
+                        // has a concrete thing to go fix, so an override would only help
+                        // them break their next boot.
+                        const force = body.force === true;
                         if (name === 'dsh-market' || name === 'dshmarket') {
                             sendJson(response, 400, { error: 'the market cannot uninstall itself; use the dsh CLI' });
                             return;
@@ -2258,6 +2263,35 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                             sendJson(response, 400, { error: 'plugin is not installed' });
                             return;
                         }
+                        const userPatchReferences = userPatchPackageReferences(userPatchPath, name);
+                        if (userPatchReferences === null && !force) {
+                            // Refusing here is right — an unreadable patch might still load
+                            // the package, and removing it would break the next boot. But
+                            // refusing with NO way through is the wrong shape: the market
+                            // cannot say which row to fix, and the moment someone wants to
+                            // uninstall is usually the moment something is already broken.
+                            // So this one is forceable, and says so.
+                            logEvent('warn', 'uninstall-blocked', `${name}: user cordis.patch.yml could not be inspected safely`);
+                            sendJson(response, 409, {
+                                error: `无法安全卸载 ${name}：当前 profile 的 cordis.patch.yml 无法读取为有效的补丁列表，因此无法排除它仍在引用该包。请先检查补丁文件；确认无关后可强制卸载。 / Cannot safely uninstall ${name}: this profile's cordis.patch.yml could not be read as a valid patch list, so the market cannot rule out a remaining package reference. Check the patch file; you can force the uninstall once you are sure it is unrelated.`,
+                                userPatchInspectionFailed: true,
+                                forceable: true,
+                            });
+                            return;
+                        }
+                        if (userPatchReferences === null) {
+                            logEvent('warn', 'uninstall', `${name}: forced past an unreadable user cordis.patch.yml`);
+                        }
+                        if (userPatchReferences !== null && userPatchReferences.length > 0) {
+                            const listed = userPatchReferences.join(', ');
+                            logEvent('warn', 'uninstall-blocked', `${name}: user cordis.patch.yml still inserts ${listed}`);
+                            sendJson(response, 409, {
+                                error: `无法卸载 ${name}：当前 profile 的 cordis.patch.yml 仍通过 insert 引用 ${listed}。请先移除这些用户补丁引用再重试；市场不会自动改写用户补丁。 / Cannot uninstall ${name}: this profile's cordis.patch.yml still inserts ${listed}. Remove those user-owned patch references first and retry; the market will not rewrite the user patch automatically.`,
+                                userPatchReferenced: true,
+                                patchReferences: userPatchReferences,
+                            });
+                            return;
+                        }
                         const busyAgents = runningAgentsForGuard();
                         if (busyAgents.length > 0) {
                             logEvent('warn', 'uninstall-blocked', `${name}: refused while agents are running — ${busyAgents.join(', ')}`);

package/lib/types/check.d.ts

@@ -18,6 +18,8 @@
  *     version (tool calls die, minimal preset fails to mount)?
  *  4. Are there multiple versions of one core package in the lockfile, and
  *     do plugin peerDependencies ranges match the resolved core version?
+ *  5. Do effective user/home patch entries reference npm package roots that
+ *     are installed in the profile-visible node_modules ancestry?
  *
  * The composition step mirrors @deepseek-ai/dsh-app-boot's applyEntryPatches
  * (same js-yaml dialect incl. `!!js` scalars), so the rows reported here are
@@ -187,7 +189,9 @@ export interface CheckOptions {
     /** Harness home for the home-level patch layer; defaults to $DSH_HOME or ~/.dsh. */
     homeDir?: string;
 }
-/** Parse one entry-list patch file with the dsh dialect; null when unreadable. */
+/** Parse entry-list source with the DSH dialect; null when it is not a list. */
+export declare function parsePatchText(text: string): unknown[] | null;
+/** Parse one entry-list patch file with the DSH dialect; null when unreadable. */
 export declare function parsePatchFile(path: string): unknown[] | null;
 /** DSH host core packages: what the dsh installation ships under @deepseek-ai. */
 export declare function corePackageNames(dshInstallDir: string | null): Set<string>;
@@ -213,6 +217,9 @@ export declare function compareSemver(a: string, b: string): number;
  * `>=1.2.3-rc.1 <2.0.0` does match `1.2.3-rc.2` (issue #98 analysis).
  */
 export declare function satisfiesRange(version: string, range: string): boolean | null;
+interface ResolvableLoaderRow extends LoaderRow {
+    activation: 'required' | 'conditional';
+}
 export interface LayerInput {
     label: string;
     kind: 'bundle' | 'user' | 'home';
@@ -221,6 +228,7 @@ export interface LayerInput {
 }
 interface Composed {
     rows: LoaderRow[];
+    resolvableRows: ResolvableLoaderRow[];
     duplicates: DuplicateId[];
     overrides: OverrideRow[];
     orphans: OrphanRow[];

package/lib/types/patch.d.ts

@@ -63,6 +63,17 @@ export interface PatchState {
  * to know what the user patch layer says.
  */
 export declare function readUserPatchState(patchPath: string): PatchState;
+/**
+ * User-authored insert rows that still load `packageName` (or one of its
+ * exported subpaths). This evidence deliberately stays separate from the
+ * package's own bundle declaration: uninstall may clean market-owned rows,
+ * but it must never rewrite an insert the user owns.
+ *
+ * A missing patch is the ordinary empty-profile shape. `null` means the
+ * existing file could not be read as DSH's patch dialect; callers must treat
+ * that as indeterminate and refuse the destructive step.
+ */
+export declare function userPatchPackageReferences(patchPath: string, packageName: string): string[] | null;
 /**
  * The user-patch row ids one installed package owns: its bundle patch's
  * insert rows, plus the loader entries currently carrying its name.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.26.0",
+  "version": "1.27.0",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/check.ts

@@ -18,16 +18,18 @@
  *     version (tool calls die, minimal preset fails to mount)?
  *  4. Are there multiple versions of one core package in the lockfile, and
  *     do plugin peerDependencies ranges match the resolved core version?
+ *  5. Do effective user/home patch entries reference npm package roots that
+ *     are installed in the profile-visible node_modules ancestry?
  *
  * The composition step mirrors @deepseek-ai/dsh-app-boot's applyEntryPatches
  * (same js-yaml dialect incl. `!!js` scalars), so the rows reported here are
  * what actually mounts at boot.
  */
 
-import { existsSync, readdirSync, readFileSync } from 'node:fs'
-import { createRequire } from 'node:module'
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs'
+import { createRequire, isBuiltin } from 'node:module'
 import { homedir } from 'node:os'
-import { dirname, join, resolve } from 'node:path'
+import { dirname, isAbsolute, join, resolve } from 'node:path'
 import { JSON_SCHEMA, Type, load } from 'js-yaml'
 import { INBOX_BUNDLES, readBundleRules, suggestOrder, validateOrder } from './order.ts'
 
@@ -204,22 +206,71 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return value !== null && typeof value === 'object' && !Array.isArray(value)
 }
 
-/** Parse one entry-list patch file with the dsh dialect; null when unreadable. */
-export function parsePatchFile(path: string): unknown[] | null {
-  let text: string
+/** Parse entry-list source with the DSH dialect; null when it is not a list. */
+export function parsePatchText(text: string): unknown[] | null {
   try {
-    text = readFileSync(path, 'utf8')
+    const value = load(text, { schema: entrySchema })
+    return Array.isArray(value) ? value : null
   } catch {
     return null
   }
+}
+
+/** Parse one entry-list patch file with the DSH dialect; null when unreadable. */
+export function parsePatchFile(path: string): unknown[] | null {
   try {
-    const value = load(text, { schema: entrySchema })
-    return Array.isArray(value) ? value : null
+    return parsePatchText(readFileSync(path, 'utf8'))
   } catch {
     return null
   }
 }
 
+/** Whether `name` goes through the Loader's bare-module resolver. */
+function isBareLoaderSpecifier(name: string): boolean {
+  return !name.startsWith('.')
+    && !name.startsWith('#')
+    && !isAbsolute(name)
+    && !/^[a-z][a-z\d+.-]*:/i.test(name)
+}
+
+/** Npm package root owning one bare Loader specifier. */
+function packageRoot(specifier: string): string | null {
+  const parts = specifier.split('/')
+  const segments = specifier.startsWith('@') ? parts.slice(0, 2) : parts.slice(0, 1)
+  if (segments.length !== (specifier.startsWith('@') ? 2 : 1)) return null
+  if (segments.some(segment => segment === '' || segment === '.' || segment === '..'
+    || segment.includes('%') || segment.includes('\\'))) return null
+  if (specifier.startsWith('@') && (segments[0]?.length ?? 0) <= 1) return null
+  return segments.join('/')
+}
+
+/**
+ * Package-root presence from the Loader-visible profile ancestry only.
+ * An explicit walk avoids CommonJS global lookup directories that
+ * `createRequire(...).resolve.paths()` appends but Node ESM does not search.
+ */
+function profilePackageInstalled(profileDirectory: string, name: string): boolean {
+  try {
+    const profile = JSON.parse(readFileSync(join(profileDirectory, 'package.json'), 'utf8')) as unknown
+    if (isRecord(profile) && profile.name === name
+      && profile.exports !== undefined && profile.exports !== null) return true
+  } catch { /* not a self-referencing profile package */ }
+  let directory = resolve(profileDirectory)
+  while (true) {
+    const packageDirectory = join(directory, 'node_modules', name)
+    // Node stops at the nearest matching package directory. A partial install
+    // there shadows any healthy parent copy and must not be accepted.
+    try {
+      if (statSync(packageDirectory).isDirectory()) {
+        return existsSync(join(packageDirectory, 'package.json'))
+      }
+    } catch { /* keep walking */ }
+    const parent = dirname(directory)
+    if (parent === directory) return false
+    directory = parent
+  }
+}
+
 /** Every id in one patch row's insert list, recursively (group configs included). */
 function collectInsertIds(rows: unknown[]): string[] {
   const ids: string[] = []
@@ -315,14 +366,14 @@ function readNodeModulesVersion(base: string, name: string): string | null {
 }
 
 /**
- * Resolve one bundle package's directory the way the dsh boot does
+ * Resolve one package's directory the way the dsh boot does
  * (dsh-app-boot's resolveBundleDir): probe Node's own node_modules search
  * paths from the installation anchor first, then the profile directory.
  * Node resolution walks upward, so this also finds pnpm's workspace-root
  * hoisting (`<profiles>/node_modules/…` when the profile lives under
- * `<profiles>/<name>`) and matches exactly what the Loader would import.
+ * `<profiles>/<name>`) and mirrors the Loader's package search roots.
  */
-function resolveBundleDir(anchorPackageJson: string, name: string): string | null {
+function resolvePackageDir(anchorPackageJson: string, name: string): string | null {
   let paths: string[] = []
   try {
     paths = createRequire(anchorPackageJson).resolve.paths(name) ?? []
@@ -461,6 +512,25 @@ export function satisfiesRange(version: string, range: string): boolean | null {
   if (v === null) return null
   const versionHasPre = v.pre.length > 0
 
+  // Mirror pnpm's peer-dependency publish transform. Unlike ordinary
+  // dependency specs, a workspace token may sit inside a larger peer range.
+  // Operator-only (or bare) tokens receive the linked sibling's version;
+  // explicit versions only lose the protocol prefix. Unsupported alias/path
+  // forms become an unknown range below rather than a definite mismatch.
+  const workspaceSemver = /workspace:([\^~*]|>=|>|<=|<)?((\d+|[xX*])(\.(\d+|[xX*])){0,2})?/
+  let normalizedRange = range
+  if (range.includes('workspace:')) {
+    const match = workspaceSemver.exec(range)
+    if (match === null) {
+      normalizedRange = range.replace('workspace:', '')
+    } else if (match[2] !== undefined) {
+      normalizedRange = range.replace('workspace:', '')
+    } else {
+      const operator = match[1] === '*' ? '' : (match[1] ?? '')
+      normalizedRange = range.replace(workspaceSemver, `${operator}${semverStr(v)}`)
+    }
+  }
+
   const single = (part: string): boolean | null => {
     const p = part.trim()
     if (p === '' || p === '*' || p === 'x' || p === 'X') return true
@@ -508,7 +578,13 @@ export function satisfiesRange(version: string, range: string): boolean | null {
     if (p === '' || p === '*' || p === 'x' || p === 'X') return { op: '', target: '' }
     const m = /^(\^|~|>=|<=|>|<)?(.*)$/.exec(p)
     if (m === null) return null
-    return { op: m[1] ?? '', target: (m[2] ?? '').trim() }
+    const target = (m[2] ?? '').trim()
+    // Enforce this function's documented unknown-range contract before the
+    // prerelease admission gate. Otherwise an unknown protocol such as
+    // `workspace:^` or `catalog:default` is misreported as a definite false
+    // whenever the resolved version happens to carry a prerelease tag.
+    if (parseSemver(target) === null) return null
+    return { op: m[1] ?? '', target }
   }
 
   /** Evaluate ONE comparator set (a `||` alternative) as a conjunction. */
@@ -533,12 +609,13 @@ export function satisfiesRange(version: string, range: string): boolean | null {
     return results.every(r => r === true)
   }
 
-  if (range.includes('||')) {
-    const outcomes = range.split('||').map(part => evaluateSet(part))
+  if (normalizedRange.includes('||')) {
+    const outcomes = normalizedRange.split('||').map(part => evaluateSet(part))
     if (outcomes.some(out => out === true)) return true
-    return outcomes.every(out => out === null) ? null : false
+    if (outcomes.some(out => out === null)) return null
+    return false
   }
-  return evaluateSet(range)
+  return evaluateSet(normalizedRange)
 }
 
 // --- composition (mirrors dsh-app-boot applyEntryPatches) ---
@@ -546,18 +623,78 @@ export function satisfiesRange(version: string, range: string): boolean | null {
 interface EntryNode {
   id: string
   name?: string
-  layer: string
+  layer?: string
   group?: boolean
   config?: unknown
+  disabled?: unknown
 }
 
 /** Flatten a tree of entries (group configs included) into row records. */
 function flattenEntries(nodes: EntryNode[]): LoaderRow[] {
   const rows: LoaderRow[] = []
-  const walk = (list: EntryNode[]): void => {
+  const walk = (list: EntryNode[], inheritedLayer?: string): void => {
+    for (const node of list) {
+      // Nested group configs come straight from the parsed patch and do not
+      // carry the synthetic layer metadata attached to their parent insert.
+      const layer = typeof node.layer === 'string' ? node.layer : inheritedLayer
+      if (layer === undefined) continue
+      rows.push({ id: node.id, layer, kind: 'insert', name: node.name })
+      if (node.group === true && Array.isArray(node.config)) {
+        walk(node.config as EntryNode[], layer)
+      }
+    }
+  }
+  walk(nodes)
+  return rows
+}
+
+type DisabledState = 'active' | 'disabled' | 'conditional'
+
+interface ResolvableLoaderRow extends LoaderRow {
+  activation: 'required' | 'conditional'
+}
+
+/** Literal values use Loader Boolean semantics; `!!js` stays indeterminate. */
+function disabledState(value: unknown): DisabledState {
+  if (isRecord(value) && typeof value.__jsExpr === 'string') return 'conditional'
+  return Boolean(value) ? 'disabled' : 'active'
+}
+
+function combineDisabled(parent: DisabledState, own: DisabledState): DisabledState {
+  if (parent === 'disabled' || own === 'disabled') return 'disabled'
+  if (parent === 'conditional' || own === 'conditional') return 'conditional'
+  return 'active'
+}
+
+/**
+ * Rows whose specifiers the Loader can attempt to import. Group rows are
+ * always imported even when disabled (their disabled state gates children),
+ * while expression-gated non-group rows are retained as conditional.
+ */
+function resolvableEntries(nodes: EntryNode[]): ResolvableLoaderRow[] {
+  const rows: ResolvableLoaderRow[] = []
+  const walk = (
+    list: EntryNode[],
+    inheritedLayer?: string,
+    parentDisabled: DisabledState = 'active',
+  ): void => {
     for (const node of list) {
-      rows.push({ id: node.id, layer: node.layer, kind: 'insert', name: node.name })
-      if (node.group === true && Array.isArray(node.config)) walk(node.config as EntryNode[])
+      const layer = typeof node.layer === 'string' ? node.layer : inheritedLayer
+      if (layer === undefined) continue
+      const descendantsDisabled = combineDisabled(parentDisabled, disabledState(node.disabled))
+      const activation = node.group === true ? 'required' : descendantsDisabled
+      if (activation !== 'disabled') {
+        rows.push({
+          id: node.id,
+          layer,
+          kind: 'insert',
+          name: node.name,
+          activation: activation === 'conditional' ? 'conditional' : 'required',
+        })
+      }
+      if (node.group === true && Array.isArray(node.config)) {
+        walk(node.config as EntryNode[], layer, descendantsDisabled)
+      }
     }
   }
   walk(nodes)
@@ -573,6 +710,7 @@ export interface LayerInput {
 
 interface Composed {
   rows: LoaderRow[]
+  resolvableRows: ResolvableLoaderRow[]
   duplicates: DuplicateId[]
   overrides: OverrideRow[]
   orphans: OrphanRow[]
@@ -624,6 +762,7 @@ export function composeLayers(layers: LayerInput[]): Composed {
             layer: layer.label,
             group: entry.group === true,
             config: Array.isArray(entry.config) ? entry.config : undefined,
+            disabled: entry.disabled,
           }
         }).filter((n): n is EntryNode => n !== null)
         if (hasId) {
@@ -675,6 +814,7 @@ export function composeLayers(layers: LayerInput[]): Composed {
     }
   }
   const rows = flattenEntries(tree)
+  const resolvableRows = resolvableEntries(tree)
   const byId = new Map<string, string[]>()
   for (const row of rows) {
     const layers = byId.get(row.id) ?? []
@@ -689,7 +829,7 @@ export function composeLayers(layers: LayerInput[]): Composed {
     duplicates.push({ id, layers: byId.get(id) ?? [], count })
   }
   duplicates.sort((a, b) => a.id.localeCompare(b.id))
-  return { rows, duplicates, overrides, orphans }
+  return { rows, resolvableRows, duplicates, overrides, orphans }
 }
 
 /** Distinct versions of `@deepseek-ai/{dsh,cordis}*` packages in the lockfile. */
@@ -745,7 +885,7 @@ export function buildBundleLayers(
     let directory: string | null = null
     for (const anchor of anchors) {
       if (anchor === null) continue
-      directory = resolveBundleDir(anchor, name)
+      directory = resolvePackageDir(anchor, name)
       if (directory !== null) break
     }
     const layer: BundleLayer = {
@@ -911,6 +1051,48 @@ export function analyzeProfile(profileDirectory: string, options: CheckOptions =
   for (const layer of layers) {
     if (layer.parseError !== null && layer.kind !== 'bundle') errors.push(`${layer.label}: ${layer.parseError}`)
   }
+  // User and home patches can insert packages independently of a bundle.
+  // Only check rows that survived composition: an insert targeting a missing
+  // group is skipped by the boot and therefore cannot cause module loading to
+  // fail. Normalize package subpaths to their npm root and check the profile's
+  // node_modules ancestry; exact exports/subpath validation and relative,
+  // absolute, URL, builtin, package-import (#), or cordis: specifiers are
+  // outside this check.
+  const userLayerLabels = new Set(
+    layers
+      .filter(layer => layer.kind === 'user' || layer.kind === 'home')
+      .map(layer => layer.label),
+  )
+  const candidates = new Map<string, { row: ResolvableLoaderRow, packageName: string }>()
+  for (const row of composed.resolvableRows) {
+    if (row.kind !== 'insert' || !userLayerLabels.has(row.layer)) continue
+    if (row.name === undefined || row.name === '') {
+      const message = `${row.layer}: loader entry ${JSON.stringify(row.id)} has no module name`
+      if (row.activation === 'required') errors.push(`${message} — the profile will fail to boot`)
+      else warnings.push(`${message} — boot will fail if its disabled expression enables the entry`)
+      continue
+    }
+    if (!isBareLoaderSpecifier(row.name)) continue
+    if (isBuiltin(row.name)) continue
+    const packageName = packageRoot(row.name)
+    if (packageName === null) {
+      const message = `${row.layer}: loader specifier ${JSON.stringify(row.name)} is not a valid bare package name`
+      if (row.activation === 'required') errors.push(`${message} — the profile will fail to boot`)
+      else warnings.push(`${message} — boot will fail if its disabled expression enables the entry`)
+      continue
+    }
+    const key = `${row.layer}\u0000${packageName}`
+    const previous = candidates.get(key)
+    if (previous === undefined || previous.row.activation === 'conditional' && row.activation === 'required') {
+      candidates.set(key, { row, packageName })
+    }
+  }
+  for (const { row, packageName } of candidates.values()) {
+    if (profilePackageInstalled(profileDirectory, packageName)) continue
+    const message = `${row.layer}: loader package ${packageName} is not installed in the profile`
+    if (row.activation === 'required') errors.push(`${message} — the profile will fail to boot`)
+    else warnings.push(`${message} — boot will fail if its disabled expression enables the entry`)
+  }
   for (const dup of composed.duplicates) {
     errors.push(`duplicate loader entry id ${JSON.stringify(dup.id)} (${dup.count} rows: ${dup.layers.join(', ')})`)
   }
@@ -1017,4 +1199,4 @@ export function analyzeProfile(profileDirectory: string, options: CheckOptions =
       warnings,
     },
   }
-}
+}

package/src/patch.ts

@@ -29,7 +29,7 @@ import { readFileSync, writeFileSync } from 'node:fs'
 import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { logEvent } from './log.ts'
-import { parsePatchFile } from './check.ts'
+import { parsePatchFile, parsePatchText } from './check.ts'
 import { bundlePatchInsertedIds, parsePatchRows } from './profile.ts'
 
 /** The slice of the loader tree this module needs. */
@@ -174,6 +174,76 @@ export function readUserPatchState(patchPath: string): PatchState {
   return { disables, forced, inserts }
 }
 
+/**
+ * User-authored insert rows that still load `packageName` (or one of its
+ * exported subpaths). This evidence deliberately stays separate from the
+ * package's own bundle declaration: uninstall may clean market-owned rows,
+ * but it must never rewrite an insert the user owns.
+ *
+ * A missing patch is the ordinary empty-profile shape. `null` means the
+ * existing file could not be read as DSH's patch dialect; callers must treat
+ * that as indeterminate and refuse the destructive step.
+ */
+export function userPatchPackageReferences(patchPath: string, packageName: string): string[] | null {
+  let source: string
+  try {
+    source = readFileSync(patchPath, 'utf8')
+  } catch (error) {
+    const code = error !== null && typeof error === 'object' && 'code' in error
+      ? (error as { code?: unknown }).code
+      : undefined
+    if (code === 'ENOENT') return []
+    return null
+  }
+
+  // Use the same schema as profile composition, including !!js scalars. A
+  // line scanner cannot distinguish flow-style entries or nested loader
+  // groups from arbitrary config keys in a hand-written user patch.
+  const rows = parsePatchText(source)
+  if (rows === null) return null
+  const insertedNames = new Set<string>()
+  const visiting = new Set<unknown[]>()
+  const visited = new Set<unknown[]>()
+  const collect = (entries: unknown[]): boolean => {
+    if (visited.has(entries)) return true
+    if (visiting.has(entries)) return false
+    visiting.add(entries)
+    for (const entry of entries) {
+      if (entry === null || typeof entry !== 'object' || Array.isArray(entry)) {
+        visiting.delete(entries)
+        return false
+      }
+      const row = entry as Record<string, unknown>
+      if ('name' in row && typeof row.name !== 'string') {
+        visiting.delete(entries)
+        return false
+      }
+      if (typeof row.name === 'string') insertedNames.add(row.name)
+      // Only group rows treat an array-valued config as child loader rows.
+      // Other plugins may use arrays of `{ name: ... }` as ordinary options,
+      // and those must not become false package references.
+      if (row.group === true && Array.isArray(row.config)) {
+        if (!collect(row.config)) {
+          visiting.delete(entries)
+          return false
+        }
+      }
+    }
+    visiting.delete(entries)
+    visited.add(entries)
+    return true
+  }
+  for (const patch of rows) {
+    if (patch === null || typeof patch !== 'object' || Array.isArray(patch)) return null
+    const patchRow = patch as Record<string, unknown>
+    if (!('insert' in patchRow)) continue
+    if (!Array.isArray(patchRow.insert) || !collect(patchRow.insert)) return null
+  }
+  return [...insertedNames].filter(
+    reference => reference === packageName || reference.startsWith(`${packageName}/`),
+  )
+}
+
 /** The include entry's id prefix (loader entry ids look like `include:X`). */
 function includePrefix(host: PatchHost): string {
   for (const entry of host.loader.entries()) {
@@ -449,4 +519,4 @@ export function removeRowBlocks(patchPath: string, rowIds: readonly string[]): v
     writeFileSync(patchPath, withPlaceholderRestored(next))
     logEvent('info', 'patch', `removed patch rows for ${rowIds.join(', ')}`)
   }
-}
+}

package/src/routes.ts

@@ -44,7 +44,7 @@ import { detectedSupervisor, restartAllowed, scheduleRestart, servingPort, trust
 import { activationAfterReplace, brokenClientBundles, checkClientBundle, hasHostHalf, newlyBrokenBundles, verifyActivation } from './verify.ts'
 import {
   carrierDisableIds, disableRow, enableRow, findUserPatchPath, isProtectedModule, packagePatchFlags,
-  readUserPatchState, removeRowBlocks, rowIdsForPackage,
+  readUserPatchState, removeRowBlocks, rowIdsForPackage, userPatchPackageReferences,
 } from './patch.ts'
 import {
   createProfileBackup, downloadWebdav, MAX_BACKUP_BYTES, mergeRestoreManifest, restoreProfileBackup, secretFileCount, unportableDeps, uploadWebdav,
@@ -2304,8 +2304,13 @@ export function mountMarketRoutes(
         }
         try {
           await withMutationLock(response, 'install', async () => {
-            const body = (await readJsonBody(request)) as { name?: unknown }
+            const body = (await readJsonBody(request)) as { name?: unknown; force?: unknown }
             const name = typeof body.name === 'string' ? body.name : ''
+            // Only the INDETERMINATE patch case is forceable, below. A patch
+            // that definitely names the package stays refused: there the user
+            // has a concrete thing to go fix, so an override would only help
+            // them break their next boot.
+            const force = body.force === true
             if (name === 'dsh-market' || name === 'dshmarket') {
               sendJson(response, 400, { error: 'the market cannot uninstall itself; use the dsh CLI' })
               return
@@ -2314,6 +2319,35 @@ export function mountMarketRoutes(
               sendJson(response, 400, { error: 'plugin is not installed' })
               return
             }
+            const userPatchReferences = userPatchPackageReferences(userPatchPath, name)
+            if (userPatchReferences === null && !force) {
+              // Refusing here is right — an unreadable patch might still load
+              // the package, and removing it would break the next boot. But
+              // refusing with NO way through is the wrong shape: the market
+              // cannot say which row to fix, and the moment someone wants to
+              // uninstall is usually the moment something is already broken.
+              // So this one is forceable, and says so.
+              logEvent('warn', 'uninstall-blocked', `${name}: user cordis.patch.yml could not be inspected safely`)
+              sendJson(response, 409, {
+                error: `无法安全卸载 ${name}：当前 profile 的 cordis.patch.yml 无法读取为有效的补丁列表，因此无法排除它仍在引用该包。请先检查补丁文件；确认无关后可强制卸载。 / Cannot safely uninstall ${name}: this profile's cordis.patch.yml could not be read as a valid patch list, so the market cannot rule out a remaining package reference. Check the patch file; you can force the uninstall once you are sure it is unrelated.`,
+                userPatchInspectionFailed: true,
+                forceable: true,
+              })
+              return
+            }
+            if (userPatchReferences === null) {
+              logEvent('warn', 'uninstall', `${name}: forced past an unreadable user cordis.patch.yml`)
+            }
+            if (userPatchReferences !== null && userPatchReferences.length > 0) {
+              const listed = userPatchReferences.join(', ')
+              logEvent('warn', 'uninstall-blocked', `${name}: user cordis.patch.yml still inserts ${listed}`)
+              sendJson(response, 409, {
+                error: `无法卸载 ${name}：当前 profile 的 cordis.patch.yml 仍通过 insert 引用 ${listed}。请先移除这些用户补丁引用再重试；市场不会自动改写用户补丁。 / Cannot uninstall ${name}: this profile's cordis.patch.yml still inserts ${listed}. Remove those user-owned patch references first and retry; the market will not rewrite the user patch automatically.`,
+                userPatchReferenced: true,
+                patchReferences: userPatchReferences,
+              })
+              return
+            }
             const busyAgents = runningAgentsForGuard()
             if (busyAgents.length > 0) {
               logEvent('warn', 'uninstall-blocked', `${name}: refused while agents are running — ${busyAgents.join(', ')}`)