dshmarket 1.29.1 → 1.29.3

package/lib/dsh-cli.js

@@ -406,15 +406,41 @@ export function cancelActive() {
 }
 /** Whether `pnpm` resolves on PATH; success is cached, absence is re-probed. */
 let pnpmReady = false;
+/**
+ * Why the last probe said no.
+ *
+ * `missing` and `failed` are different problems with different fixes, and
+ * collapsing both into `false` made the market give one answer to both: it
+ * told a user whose pnpm ran perfectly from their shell to go set PNPM_HOME
+ * (#228). A binary that IS on the path and exits non-zero — a corepack shim
+ * that cannot reach the network to fetch pnpm itself is the common one —
+ * needs its own output shown, not a path to fix that is already right.
+ */
+let pnpmProbeFailure = null;
+/** Why `pnpm --version` last failed, or null when it has not failed. */
+export function lastPnpmProbeFailure() {
+    return pnpmProbeFailure;
+}
 /** Probe `pnpm --version` on PATH. */
 export function probePnpm() {
     if (pnpmReady)
         return Promise.resolve(true);
     return new Promise((resolvePromise) => {
-        const child = spawnShim('pnpm', ['--version'], { stdio: 'ignore', viaShell: winCmdShim, env: spawnEnv() });
-        child.on('error', () => resolvePromise(false));
+        // Piped, not ignored: the output of a pnpm that exists but will not run
+        // IS the explanation, and throwing it away is what left #228 with a
+        // failure nobody could act on.
+        const child = spawnShim('pnpm', ['--version'], { stdio: ['ignore', 'pipe', 'pipe'], viaShell: winCmdShim, env: spawnEnv() });
+        let output = '';
+        const collect = (chunk) => { output = (output + chunk.toString()).slice(-2000); };
+        child.stdout?.on('data', collect);
+        child.stderr?.on('data', collect);
+        child.on('error', (error) => {
+            pnpmProbeFailure = { kind: 'missing', output: error.message };
+            resolvePromise(false);
+        });
         child.on('close', (code) => {
             pnpmReady = code === 0;
+            pnpmProbeFailure = pnpmReady ? null : { kind: 'failed', output: output.trim() };
             resolvePromise(pnpmReady);
         });
     });
@@ -468,7 +494,7 @@ export async function provisionPnpm() {
     const npmFound = toolOnPath('npm');
     if (!npmFound)
         logEvent('warn', 'setup-pnpm', `npm is not on any searched path (node lives in ${nodeBinDir})`);
-    return { ok: false, hint: provisionHint(corepack.output, npm.output, npmFound) };
+    return { ok: false, hint: provisionHint(corepack.output, npm.output, npmFound, lastPnpmProbeFailure()) };
 }
 /** Executable suffixes a bare command name can carry on this platform. */
 const EXECUTABLE_SUFFIXES = process.platform === 'win32'
@@ -508,7 +534,7 @@ export function toolOnPath(name) {
  * a GUI launch with no Node on PATH at all).
  * @returns a bilingual, actionable hint, or undefined when unrecognized.
  */
-export function provisionHint(corepackOutput, npmOutput, npmFound = true) {
+export function provisionHint(corepackOutput, npmOutput, npmFound = true, probeFailure = null) {
     // Node itself unreachable: pointing the user back at this same button
     // would be a dead end (#32). `npmFound` answers this from disk, so it
     // holds on a Windows console that reports the same thing in a codepage we
@@ -543,6 +569,13 @@ export function provisionHint(corepackOutput, npmOutput, npmFound = true) {
     // they can see succeeded, and their complaint was exactly that — "又不告诉
     // 我怎么手动配置". Whatever the cause, the actionable question is the same
     // one, so ask it: where is pnpm, and is that anywhere this process looks?
+    // pnpm IS on the path and exits non-zero. Telling this user to fix PNPM_HOME
+    // would be advice for the opposite problem — theirs runs fine from a shell,
+    // which is exactly what #228 reported. Its own output is the explanation.
+    if (probeFailure?.kind === 'failed') {
+        const detail = probeFailure.output === '' ? '' : `\n\n${probeFailure.output}`;
+        return `找到 pnpm 了，但运行 \`pnpm --version\` 失败——所以问题不在路径上，设 PNPM_HOME 没有用。最常见的原因是 corepack 的 shim 需要联网下载 pnpm 本体，而这台机器下不到。请在终端执行一次 \`pnpm --version\`：如果同样失败，按它的提示修（受限网络可用 \`brew install pnpm\` 或 \`npm i -g pnpm --registry <你的镜像>\` 装一个完整的 pnpm，绕开 shim）；如果在终端里正常，说明 dsh 进程的环境和你的终端不同，请从该终端启动 dsh。pnpm 的原始输出：${detail} / pnpm was found, but \`pnpm --version\` fails — so this is not a path problem and PNPM_HOME will not help. The usual cause is a corepack shim that has to download pnpm itself and cannot reach the network. Run \`pnpm --version\` in a terminal: if it fails the same way, follow what it says (on a restricted network install a real pnpm with \`brew install pnpm\` or \`npm i -g pnpm --registry <your mirror>\` to bypass the shim); if it works there, the dsh process has a different environment than your shell — start dsh from that terminal. pnpm's own output:${detail}`;
+    }
     const searched = toolSearchDirs().join(process.platform === 'win32' ? ' ; ' : ' : ');
     const locate = process.platform === 'win32' ? 'where pnpm' : 'which pnpm';
     return `pnpm 装好了，但这个 dsh 进程仍然启动不了它——安装步骤都成功，只是装到的位置不在它搜索的范围内。已找过：${searched}。请在终端执行 \`${locate}\` 看 pnpm 实际在哪：如果它不在上面这些目录里，把该目录设为 PNPM_HOME 后重启 dsh（\`export PNPM_HOME=<那个目录>\`），或者干脆从一个能直接运行 pnpm 的终端里启动 dsh。注意必须重启——正在运行的进程读不到新设的环境变量 / pnpm is installed but this dsh process still cannot start it: every step succeeded, the binary just landed somewhere this process does not look. Searched: ${searched}. Run \`${locate}\` in a terminal to see where pnpm actually is; if that directory is not in the list above, set PNPM_HOME to it and restart dsh (\`export PNPM_HOME=<that directory>\`), or simply start dsh from a terminal where \`pnpm\` already runs. The restart matters — a running process cannot see a newly set variable`;

package/lib/profile.js

@@ -6,6 +6,7 @@
 import { existsSync, readdirSync, readFileSync, realpathSync, renameSync, statSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
 import { githubRemoteIdentities, githubRepoIdentities } from './sources.js';
 /**
  * Whether a profile name follows DSH's own directory-name contract.
@@ -78,18 +79,45 @@ export function readManifestDeps(profile, explicitDir) {
         return {};
     }
 }
+function objectRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+/** Read dependencies and the exact `dsh.profile.bundles` field before a package operation. */
+export function readProfileManifestSnapshot(profile, explicitDir) {
+    try {
+        const manifest = JSON.parse(readFileSync(join(profileDir(profile, explicitDir), 'package.json'), 'utf8'));
+        const profileManifest = objectRecord(manifest.dsh?.profile);
+        const present = profileManifest !== undefined && Object.hasOwn(profileManifest, 'bundles');
+        return {
+            dependencies: { ...manifest.dependencies },
+            profileBundles: present
+                ? { present: true, value: structuredClone(profileManifest.bundles) }
+                : { present: false },
+        };
+    }
+    catch {
+        return { dependencies: {}, profileBundles: { present: false } };
+    }
+}
+/** String package names carried by one valid bundle-list value. */
+function bundleNames(value) {
+    return Array.isArray(value) ? value.filter((name) => typeof name === 'string') : [];
+}
 /**
- * Restore the profile manifest's dependency map to a pre-operation snapshot,
- * leaving every other manifest field untouched. pnpm writes package.json
- * BEFORE it finishes installing (#65, #69: a 404/blocked-build failure lands
- * after the write), so a failed add leaves ghost dependencies that break
- * every later pnpm run — and pnpm itself can no longer remove them (the same
- * failure re-fires on any mutation). Direct manifest surgery is the only
- * reliable rollback; the lockfile is left as-is (pnpm reconciles it from the
- * manifest on the next run).
+ * Restore the profile manifest fields a package operation may mutate:
+ * `dependencies` and `dsh.profile.bundles`. pnpm and `dsh plugin add` can
+ * write both before a later fetch or build-script failure (#65, #69, #339),
+ * leaving either an unresolvable dependency or a bundle the next boot cannot
+ * activate. Every unrelated manifest field remains untouched. The lockfile is
+ * left as-is; pnpm reconciles it from the manifest on the next run.
+ *
+ * The write is atomic because rollback runs after another operation already
+ * failed; a partial repair must not turn a valid profile into invalid JSON.
  * @returns names whose entries were dropped or reverted, empty when nothing changed.
  */
-export function restoreManifestDeps(profile, snapshot, explicitDir) {
+export function restoreProfileManifest(profile, snapshot, explicitDir) {
     const file = join(profileDir(profile, explicitDir), 'package.json');
     let manifest;
     try {
@@ -100,21 +128,62 @@ export function restoreManifestDeps(profile, snapshot, explicitDir) {
     }
     const current = manifest.dependencies ?? {};
     const touched = new Set();
-    for (const name of Object.keys(current))
-        if (current[name] !== snapshot[name])
+    for (const name of Object.keys(current)) {
+        if (current[name] !== snapshot.dependencies[name])
             touched.add(name);
-    for (const name of Object.keys(snapshot))
-        if (current[name] !== snapshot[name])
+    }
+    for (const name of Object.keys(snapshot.dependencies)) {
+        if (current[name] !== snapshot.dependencies[name])
             touched.add(name);
+    }
+    const currentDsh = objectRecord(manifest.dsh);
+    const currentProfile = objectRecord(currentDsh?.profile);
+    const currentBundles = currentProfile !== undefined && Object.hasOwn(currentProfile, 'bundles')
+        ? { present: true, value: currentProfile.bundles }
+        : { present: false };
+    const bundlesChanged = currentBundles.present !== snapshot.profileBundles.present
+        || (currentBundles.present && snapshot.profileBundles.present
+            && !isDeepStrictEqual(currentBundles.value, snapshot.profileBundles.value));
+    if (bundlesChanged) {
+        const currentNames = new Set(currentBundles.present ? bundleNames(currentBundles.value) : []);
+        const snapshotNames = new Set(snapshot.profileBundles.present ? bundleNames(snapshot.profileBundles.value) : []);
+        let namedBundleChange = false;
+        for (const name of currentNames) {
+            if (!snapshotNames.has(name)) {
+                touched.add(name);
+                namedBundleChange = true;
+            }
+        }
+        for (const name of snapshotNames) {
+            if (!currentNames.has(name)) {
+                touched.add(name);
+                namedBundleChange = true;
+            }
+        }
+        // Presence, order, duplicates, or a malformed non-array value can differ
+        // without changing the set of package names. Still report that rollback.
+        if (!namedBundleChange)
+            touched.add('dsh.profile.bundles');
+    }
     if (touched.size === 0)
         return [];
-    manifest.dependencies = { ...snapshot };
-    writeFileSync(file, `${JSON.stringify(manifest, null, 2)}\n`);
+    manifest.dependencies = { ...snapshot.dependencies };
+    if (snapshot.profileBundles.present) {
+        const dsh = currentDsh ?? {};
+        const profileManifest = currentProfile ?? {};
+        manifest.dsh = dsh;
+        dsh.profile = profileManifest;
+        profileManifest.bundles = structuredClone(snapshot.profileBundles.value);
+    }
+    else if (currentProfile !== undefined) {
+        delete currentProfile.bundles;
+    }
+    writeManifestAtomic(file, manifest);
     return [...touched];
 }
 /**
  * Remove a package from BOTH manifest lists — dependencies and
- * dsh.profile.bundles. The uninstall counterpart of restoreManifestDeps:
+ * dsh.profile.bundles. The uninstall counterpart of restoreProfileManifest:
  * pnpm can fail a remove after deleting node_modules but before saving
  * package.json (the #65 write-order's mirror image — a file locked mid-
  * unlink aborts the run), leaving the manifest pointing at a package that
@@ -122,10 +191,8 @@ export function restoreManifestDeps(profile, snapshot, explicitDir) {
  * dependency. When disk truth says the package is gone, this finishes the
  * removal the CLI could not. Every other manifest field is untouched.
  *
- * Written atomically, unlike restoreManifestDeps above. This one runs only
- * after something already went wrong mid-uninstall, so it is the worst place
- * in the codebase to leave a half-written package.json: the profile would go
- * from "one ghost dependency" to "will not parse".
+ * Written atomically because it runs only after something already went wrong
+ * mid-uninstall, so it is the worst place to leave a half-written manifest.
  * @returns true when either list still mentioned the package.
  */
 export function dropFromManifest(profile, name, explicitDir) {

package/lib/routes.js

@@ -15,7 +15,7 @@ import { createGroup, deleteGroup, removeFromGroups, renameGroup, setGroupMember
 import { exportLogs, logEvent } from './log.js';
 import { diagnosePackageManifests } from './diagnostics.js';
 import { BOOT_ID, cancelActive, probePnpm, progress, provisionPnpm, runDshPlugin, } from './dsh-cli.js';
-import { addProfileBundle, dropFromManifest, hasLoadableEntry, INBOX_BUNDLES, isDshProfileName, profileDir, readInstalled, readInstalledManifest, readInstalledRepoEvidence, readInstalledVersion, readLockCommits, readManifestDeps, readProfileBundles, removeProfileBundle, restoreManifestDeps, setAllowBuilds } from './profile.js';
+import { addProfileBundle, dropFromManifest, hasLoadableEntry, INBOX_BUNDLES, isDshProfileName, profileDir, readInstalled, readInstalledManifest, readInstalledRepoEvidence, readInstalledVersion, readLockCommits, readProfileBundles, readProfileManifestSnapshot, removeProfileBundle, restoreProfileManifest, setAllowBuilds } from './profile.js';
 import { assessProfile, classifyPeer, introducedDuplicateNames, introducedRisks } from './compatibility.js';
 import { runningAgentIds } from './agents.js';
 import { analyzeProfile } from './check.js';
@@ -420,7 +420,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
      * manifest to rematerialize the previous build's files.
      */
     async function rollbackUpdateBuild(name, manifestBefore) {
-        const rolledBack = restoreManifestDeps(config.profile, manifestBefore, activeProfileDir);
+        const rolledBack = restoreProfileManifest(config.profile, manifestBefore, activeProfileDir);
         if (rolledBack.length === 0)
             return { ok: true, detail: null };
         // CI=true (the market always runs pnpm that way) turns frozen-lockfile
@@ -449,7 +449,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
         if (beforeCommit === null) {
             return { ok: false, detail: 'the previous commit is unknown; nothing to roll back to' };
         }
-        restoreManifestDeps(config.profile, manifestBefore, activeProfileDir);
+        restoreProfileManifest(config.profile, manifestBefore, activeProfileDir);
         const add = await runPlugin(config.profile, ['add', RELEASE_AGE_OVERRIDE, `${target}#${beforeCommit}`]);
         if (add.exitCode !== 0 || add.timedOut || add.cancelled) {
             return { ok: false, detail: failureDetail(add) };
@@ -457,7 +457,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
         // pnpm wrote a commit-pinned spec; the profile's durable spec must stay
         // the original `github:owner/repo` form. The lockfile keeps the restored
         // commit resolution for the next boot.
-        restoreManifestDeps(config.profile, manifestBefore, activeProfileDir);
+        restoreProfileManifest(config.profile, manifestBefore, activeProfileDir);
         logEvent('info', 'update-rollback', `${name}: restored github build at ${beforeCommit}`);
         return { ok: true, detail: null };
     }
@@ -1675,9 +1675,9 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                         // force: the user chose to install a fresh release without the
                         // default one-day safety wait; scoped to this single command.
                         const addArgs = force ? ['add', RELEASE_AGE_OVERRIDE, target] : ['add', target];
-                        // RAW manifest snapshot for failure rollback (#65) — pnpm writes
-                        // package.json before it finishes, so a hard-failed add leaves
-                        // ghost/bumped entries that break every later pnpm run.
+                        // Exact manifest snapshot for failure rollback (#65, #339) — the
+                        // host can write dependencies AND dsh.profile.bundles before a
+                        // hard-failed add, leaving residue that breaks the next boot.
                         pendingRollbacks.clear();
                         const compatibilityBefore = assessProfile(config.profile, activeProfileDir);
                         // pnpm re-extracts the whole tree on any operation, so a plugin
@@ -1686,11 +1686,11 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                         // broke is attributable to it, so the profile is swept before as
                         // well as after.
                         const bundlesBefore = brokenClientBundles(config.profile, activeProfileDir);
-                        const manifestBefore = readManifestDeps(config.profile, activeProfileDir);
+                        const manifestBefore = readProfileManifestSnapshot(config.profile, activeProfileDir);
                         const result = await runPlugin(config.profile, addArgs);
                         const cancelled = result.cancelled;
                         if ((result.exitCode !== 0 || result.timedOut) && !cancelled) {
-                            const rolledBack = restoreManifestDeps(config.profile, manifestBefore, activeProfileDir);
+                            const rolledBack = restoreProfileManifest(config.profile, manifestBefore, activeProfileDir);
                             if (rolledBack.length > 0)
                                 logEvent('warn', 'update', `${name}: rolled back manifest residue of the failed run: ${rolledBack.join(', ')}`);
                         }
@@ -2626,16 +2626,17 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                         // broke is attributable to it, so the profile is swept before as
                         // well as after.
                         const bundlesBefore = brokenClientBundles(config.profile, activeProfileDir);
-                        // RAW manifest snapshot for failure rollback (#65): pnpm writes
-                        // package.json before the build-script check / registry fetches
-                        // run, so a hard-failed add leaves ghost dependencies that break
-                        // every later pnpm run — of anything. Cancelled runs keep their
-                        // partial state on purpose (the user sees the diff and decides).
-                        const manifestBefore = readManifestDeps(config.profile, activeProfileDir);
+                        // Exact manifest snapshot for failure rollback (#65, #339): the
+                        // host writes dependencies and dsh.profile.bundles before the
+                        // build-script check / registry fetches run. Either residue can
+                        // break every later operation or the next boot. Cancelled runs
+                        // keep their partial state on purpose (the user sees the diff
+                        // and decides).
+                        const manifestBefore = readProfileManifestSnapshot(config.profile, activeProfileDir);
                         const result = await runPlugin(config.profile, ['add', target]);
                         const cancelled = result.cancelled;
                         if ((result.exitCode !== 0 || result.timedOut) && !cancelled) {
-                            const rolledBack = restoreManifestDeps(config.profile, manifestBefore, activeProfileDir);
+                            const rolledBack = restoreProfileManifest(config.profile, manifestBefore, activeProfileDir);
                             if (rolledBack.length > 0)
                                 logEvent('warn', 'install', `${target}: rolled back manifest residue of the failed run: ${rolledBack.join(', ')}`);
                         }

package/lib/types/dsh-cli.d.ts

@@ -219,6 +219,11 @@ export declare function killChild(child: ChildProcess): void;
  * @returns true when there was one to cancel.
  */
 export declare function cancelActive(): boolean;
+/** Why `pnpm --version` last failed, or null when it has not failed. */
+export declare function lastPnpmProbeFailure(): {
+    kind: 'missing' | 'failed';
+    output: string;
+} | null;
 /** Probe `pnpm --version` on PATH. */
 export declare function probePnpm(): Promise<boolean>;
 /**
@@ -253,7 +258,10 @@ export declare function toolOnPath(name: string): boolean;
  * a GUI launch with no Node on PATH at all).
  * @returns a bilingual, actionable hint, or undefined when unrecognized.
  */
-export declare function provisionHint(corepackOutput: string, npmOutput: string, npmFound?: boolean): string | undefined;
+export declare function provisionHint(corepackOutput: string, npmOutput: string, npmFound?: boolean, probeFailure?: {
+    kind: 'missing' | 'failed';
+    output: string;
+} | null): string | undefined;
 /** Live progress of the running plugin command, for the status route. */
 export interface InstallProgress {
     active: boolean;

package/lib/types/profile.d.ts

@@ -34,21 +34,34 @@ export declare function readInstalled(profile: string, explicitDir?: string): Re
  * a filtered view would delete @deepseek-ai/dsh-base and friends.
  */
 export declare function readManifestDeps(profile: string, explicitDir?: string): Record<string, string>;
-/**
- * Restore the profile manifest's dependency map to a pre-operation snapshot,
- * leaving every other manifest field untouched. pnpm writes package.json
- * BEFORE it finishes installing (#65, #69: a 404/blocked-build failure lands
- * after the write), so a failed add leaves ghost dependencies that break
- * every later pnpm run — and pnpm itself can no longer remove them (the same
- * failure re-fires on any mutation). Direct manifest surgery is the only
- * reliable rollback; the lockfile is left as-is (pnpm reconciles it from the
- * manifest on the next run).
+/** Exact rollback state owned by one profile package operation. */
+export interface ProfileManifestSnapshot {
+    dependencies: Record<string, string>;
+    profileBundles: {
+        present: false;
+    } | {
+        present: true;
+        value: unknown;
+    };
+}
+/** Read dependencies and the exact `dsh.profile.bundles` field before a package operation. */
+export declare function readProfileManifestSnapshot(profile: string, explicitDir?: string): ProfileManifestSnapshot;
+/**
+ * Restore the profile manifest fields a package operation may mutate:
+ * `dependencies` and `dsh.profile.bundles`. pnpm and `dsh plugin add` can
+ * write both before a later fetch or build-script failure (#65, #69, #339),
+ * leaving either an unresolvable dependency or a bundle the next boot cannot
+ * activate. Every unrelated manifest field remains untouched. The lockfile is
+ * left as-is; pnpm reconciles it from the manifest on the next run.
+ *
+ * The write is atomic because rollback runs after another operation already
+ * failed; a partial repair must not turn a valid profile into invalid JSON.
  * @returns names whose entries were dropped or reverted, empty when nothing changed.
  */
-export declare function restoreManifestDeps(profile: string, snapshot: Record<string, string>, explicitDir?: string): string[];
+export declare function restoreProfileManifest(profile: string, snapshot: ProfileManifestSnapshot, explicitDir?: string): string[];
 /**
  * Remove a package from BOTH manifest lists — dependencies and
- * dsh.profile.bundles. The uninstall counterpart of restoreManifestDeps:
+ * dsh.profile.bundles. The uninstall counterpart of restoreProfileManifest:
  * pnpm can fail a remove after deleting node_modules but before saving
  * package.json (the #65 write-order's mirror image — a file locked mid-
  * unlink aborts the run), leaving the manifest pointing at a package that
@@ -56,10 +69,8 @@ export declare function restoreManifestDeps(profile: string, snapshot: Record<st
  * dependency. When disk truth says the package is gone, this finishes the
  * removal the CLI could not. Every other manifest field is untouched.
  *
- * Written atomically, unlike restoreManifestDeps above. This one runs only
- * after something already went wrong mid-uninstall, so it is the worst place
- * in the codebase to leave a half-written package.json: the profile would go
- * from "one ghost dependency" to "will not parse".
+ * Written atomically because it runs only after something already went wrong
+ * mid-uninstall, so it is the worst place to leave a half-written manifest.
  * @returns true when either list still mentioned the package.
  */
 export declare function dropFromManifest(profile: string, name: string, explicitDir?: string): boolean;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.29.1",
+  "version": "1.29.3",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/dsh-cli.ts

@@ -526,14 +526,42 @@ export function cancelActive(): boolean {
 /** Whether `pnpm` resolves on PATH; success is cached, absence is re-probed. */
 let pnpmReady = false
 
+/**
+ * Why the last probe said no.
+ *
+ * `missing` and `failed` are different problems with different fixes, and
+ * collapsing both into `false` made the market give one answer to both: it
+ * told a user whose pnpm ran perfectly from their shell to go set PNPM_HOME
+ * (#228). A binary that IS on the path and exits non-zero — a corepack shim
+ * that cannot reach the network to fetch pnpm itself is the common one —
+ * needs its own output shown, not a path to fix that is already right.
+ */
+let pnpmProbeFailure: { kind: 'missing' | 'failed'; output: string } | null = null
+
+/** Why `pnpm --version` last failed, or null when it has not failed. */
+export function lastPnpmProbeFailure(): { kind: 'missing' | 'failed'; output: string } | null {
+  return pnpmProbeFailure
+}
+
 /** Probe `pnpm --version` on PATH. */
 export function probePnpm(): Promise<boolean> {
   if (pnpmReady) return Promise.resolve(true)
   return new Promise((resolvePromise) => {
-    const child = spawnShim('pnpm', ['--version'], { stdio: 'ignore', viaShell: winCmdShim, env: spawnEnv() })
-    child.on('error', () => resolvePromise(false))
+    // Piped, not ignored: the output of a pnpm that exists but will not run
+    // IS the explanation, and throwing it away is what left #228 with a
+    // failure nobody could act on.
+    const child = spawnShim('pnpm', ['--version'], { stdio: ['ignore', 'pipe', 'pipe'], viaShell: winCmdShim, env: spawnEnv() })
+    let output = ''
+    const collect = (chunk: Buffer): void => { output = (output + chunk.toString()).slice(-2000) }
+    child.stdout?.on('data', collect)
+    child.stderr?.on('data', collect)
+    child.on('error', (error) => {
+      pnpmProbeFailure = { kind: 'missing', output: error.message }
+      resolvePromise(false)
+    })
     child.on('close', (code) => {
       pnpmReady = code === 0
+      pnpmProbeFailure = pnpmReady ? null : { kind: 'failed', output: output.trim() }
       resolvePromise(pnpmReady)
     })
   })
@@ -585,7 +613,7 @@ export async function provisionPnpm(): Promise<{ ok: boolean; hint?: string }> {
   }
   const npmFound = toolOnPath('npm')
   if (!npmFound) logEvent('warn', 'setup-pnpm', `npm is not on any searched path (node lives in ${nodeBinDir})`)
-  return { ok: false, hint: provisionHint(corepack.output, npm.output, npmFound) }
+  return { ok: false, hint: provisionHint(corepack.output, npm.output, npmFound, lastPnpmProbeFailure()) }
 }
 
 /** Executable suffixes a bare command name can carry on this platform. */
@@ -626,7 +654,12 @@ export function toolOnPath(name: string): boolean {
  * a GUI launch with no Node on PATH at all).
  * @returns a bilingual, actionable hint, or undefined when unrecognized.
  */
-export function provisionHint(corepackOutput: string, npmOutput: string, npmFound = true): string | undefined {
+export function provisionHint(
+  corepackOutput: string,
+  npmOutput: string,
+  npmFound = true,
+  probeFailure: { kind: 'missing' | 'failed'; output: string } | null = null,
+): string | undefined {
   // Node itself unreachable: pointing the user back at this same button
   // would be a dead end (#32). `npmFound` answers this from disk, so it
   // holds on a Windows console that reports the same thing in a codepage we
@@ -661,6 +694,13 @@ export function provisionHint(corepackOutput: string, npmOutput: string, npmFoun
   // they can see succeeded, and their complaint was exactly that — "又不告诉
   // 我怎么手动配置". Whatever the cause, the actionable question is the same
   // one, so ask it: where is pnpm, and is that anywhere this process looks?
+  // pnpm IS on the path and exits non-zero. Telling this user to fix PNPM_HOME
+  // would be advice for the opposite problem — theirs runs fine from a shell,
+  // which is exactly what #228 reported. Its own output is the explanation.
+  if (probeFailure?.kind === 'failed') {
+    const detail = probeFailure.output === '' ? '' : `\n\n${probeFailure.output}`
+    return `找到 pnpm 了，但运行 \`pnpm --version\` 失败——所以问题不在路径上，设 PNPM_HOME 没有用。最常见的原因是 corepack 的 shim 需要联网下载 pnpm 本体，而这台机器下不到。请在终端执行一次 \`pnpm --version\`：如果同样失败，按它的提示修（受限网络可用 \`brew install pnpm\` 或 \`npm i -g pnpm --registry <你的镜像>\` 装一个完整的 pnpm，绕开 shim）；如果在终端里正常，说明 dsh 进程的环境和你的终端不同，请从该终端启动 dsh。pnpm 的原始输出：${detail} / pnpm was found, but \`pnpm --version\` fails — so this is not a path problem and PNPM_HOME will not help. The usual cause is a corepack shim that has to download pnpm itself and cannot reach the network. Run \`pnpm --version\` in a terminal: if it fails the same way, follow what it says (on a restricted network install a real pnpm with \`brew install pnpm\` or \`npm i -g pnpm --registry <your mirror>\` to bypass the shim); if it works there, the dsh process has a different environment than your shell — start dsh from that terminal. pnpm's own output:${detail}`
+  }
   const searched = toolSearchDirs().join(process.platform === 'win32' ? ' ; ' : ' : ')
   const locate = process.platform === 'win32' ? 'where pnpm' : 'which pnpm'
   return `pnpm 装好了，但这个 dsh 进程仍然启动不了它——安装步骤都成功，只是装到的位置不在它搜索的范围内。已找过：${searched}。请在终端执行 \`${locate}\` 看 pnpm 实际在哪：如果它不在上面这些目录里，把该目录设为 PNPM_HOME 后重启 dsh（\`export PNPM_HOME=<那个目录>\`），或者干脆从一个能直接运行 pnpm 的终端里启动 dsh。注意必须重启——正在运行的进程读不到新设的环境变量 / pnpm is installed but this dsh process still cannot start it: every step succeeded, the binary just landed somewhere this process does not look. Searched: ${searched}. Run \`${locate}\` in a terminal to see where pnpm actually is; if that directory is not in the list above, set PNPM_HOME to it and restart dsh (\`export PNPM_HOME=<that directory>\`), or simply start dsh from a terminal where \`pnpm\` already runs. The restart matters — a running process cannot see a newly set variable`

package/src/profile.ts

@@ -7,6 +7,7 @@
 import { existsSync, readdirSync, readFileSync, realpathSync, renameSync, statSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path'
+import { isDeepStrictEqual } from 'node:util'
 import { githubRemoteIdentities, githubRepoIdentities } from './sources.ts'
 
 /**
@@ -84,38 +85,125 @@ export function readManifestDeps(profile: string, explicitDir?: string): Record<
   }
 }
 
+/** Exact rollback state owned by one profile package operation. */
+export interface ProfileManifestSnapshot {
+  dependencies: Record<string, string>
+  profileBundles: { present: false } | { present: true; value: unknown }
+}
+
+function objectRecord(value: unknown): Record<string, unknown> | undefined {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : undefined
+}
+
+/** Read dependencies and the exact `dsh.profile.bundles` field before a package operation. */
+export function readProfileManifestSnapshot(profile: string, explicitDir?: string): ProfileManifestSnapshot {
+  try {
+    const manifest = JSON.parse(readFileSync(join(profileDir(profile, explicitDir), 'package.json'), 'utf8')) as {
+      dependencies?: Record<string, string>
+      dsh?: { profile?: unknown }
+    }
+    const profileManifest = objectRecord(manifest.dsh?.profile)
+    const present = profileManifest !== undefined && Object.hasOwn(profileManifest, 'bundles')
+    return {
+      dependencies: { ...manifest.dependencies },
+      profileBundles: present
+        ? { present: true, value: structuredClone(profileManifest.bundles) }
+        : { present: false },
+    }
+  } catch {
+    return { dependencies: {}, profileBundles: { present: false } }
+  }
+}
+
+/** String package names carried by one valid bundle-list value. */
+function bundleNames(value: unknown): string[] {
+  return Array.isArray(value) ? value.filter((name): name is string => typeof name === 'string') : []
+}
+
 /**
- * Restore the profile manifest's dependency map to a pre-operation snapshot,
- * leaving every other manifest field untouched. pnpm writes package.json
- * BEFORE it finishes installing (#65, #69: a 404/blocked-build failure lands
- * after the write), so a failed add leaves ghost dependencies that break
- * every later pnpm run — and pnpm itself can no longer remove them (the same
- * failure re-fires on any mutation). Direct manifest surgery is the only
- * reliable rollback; the lockfile is left as-is (pnpm reconciles it from the
- * manifest on the next run).
+ * Restore the profile manifest fields a package operation may mutate:
+ * `dependencies` and `dsh.profile.bundles`. pnpm and `dsh plugin add` can
+ * write both before a later fetch or build-script failure (#65, #69, #339),
+ * leaving either an unresolvable dependency or a bundle the next boot cannot
+ * activate. Every unrelated manifest field remains untouched. The lockfile is
+ * left as-is; pnpm reconciles it from the manifest on the next run.
+ *
+ * The write is atomic because rollback runs after another operation already
+ * failed; a partial repair must not turn a valid profile into invalid JSON.
  * @returns names whose entries were dropped or reverted, empty when nothing changed.
  */
-export function restoreManifestDeps(profile: string, snapshot: Record<string, string>, explicitDir?: string): string[] {
+export function restoreProfileManifest(
+  profile: string,
+  snapshot: ProfileManifestSnapshot,
+  explicitDir?: string,
+): string[] {
   const file = join(profileDir(profile, explicitDir), 'package.json')
-  let manifest: { dependencies?: Record<string, string> }
+  let manifest: {
+    dependencies?: Record<string, string>
+    dsh?: unknown
+  }
   try {
-    manifest = JSON.parse(readFileSync(file, 'utf8')) as { dependencies?: Record<string, string> }
+    manifest = JSON.parse(readFileSync(file, 'utf8')) as typeof manifest
   } catch {
     return []
   }
   const current = manifest.dependencies ?? {}
   const touched = new Set<string>()
-  for (const name of Object.keys(current)) if (current[name] !== snapshot[name]) touched.add(name)
-  for (const name of Object.keys(snapshot)) if (current[name] !== snapshot[name]) touched.add(name)
+  for (const name of Object.keys(current)) {
+    if (current[name] !== snapshot.dependencies[name]) touched.add(name)
+  }
+  for (const name of Object.keys(snapshot.dependencies)) {
+    if (current[name] !== snapshot.dependencies[name]) touched.add(name)
+  }
+
+  const currentDsh = objectRecord(manifest.dsh)
+  const currentProfile = objectRecord(currentDsh?.profile)
+  const currentBundles = currentProfile !== undefined && Object.hasOwn(currentProfile, 'bundles')
+    ? { present: true as const, value: currentProfile.bundles }
+    : { present: false as const }
+  const bundlesChanged = currentBundles.present !== snapshot.profileBundles.present
+    || (currentBundles.present && snapshot.profileBundles.present
+      && !isDeepStrictEqual(currentBundles.value, snapshot.profileBundles.value))
+  if (bundlesChanged) {
+    const currentNames = new Set(currentBundles.present ? bundleNames(currentBundles.value) : [])
+    const snapshotNames = new Set(snapshot.profileBundles.present ? bundleNames(snapshot.profileBundles.value) : [])
+    let namedBundleChange = false
+    for (const name of currentNames) {
+      if (!snapshotNames.has(name)) {
+        touched.add(name)
+        namedBundleChange = true
+      }
+    }
+    for (const name of snapshotNames) {
+      if (!currentNames.has(name)) {
+        touched.add(name)
+        namedBundleChange = true
+      }
+    }
+    // Presence, order, duplicates, or a malformed non-array value can differ
+    // without changing the set of package names. Still report that rollback.
+    if (!namedBundleChange) touched.add('dsh.profile.bundles')
+  }
   if (touched.size === 0) return []
-  manifest.dependencies = { ...snapshot }
-  writeFileSync(file, `${JSON.stringify(manifest, null, 2)}\n`)
+  manifest.dependencies = { ...snapshot.dependencies }
+  if (snapshot.profileBundles.present) {
+    const dsh = currentDsh ?? {}
+    const profileManifest = currentProfile ?? {}
+    manifest.dsh = dsh
+    dsh.profile = profileManifest
+    profileManifest.bundles = structuredClone(snapshot.profileBundles.value)
+  } else if (currentProfile !== undefined) {
+    delete currentProfile.bundles
+  }
+  writeManifestAtomic(file, manifest)
   return [...touched]
 }
 
 /**
  * Remove a package from BOTH manifest lists — dependencies and
- * dsh.profile.bundles. The uninstall counterpart of restoreManifestDeps:
+ * dsh.profile.bundles. The uninstall counterpart of restoreProfileManifest:
  * pnpm can fail a remove after deleting node_modules but before saving
  * package.json (the #65 write-order's mirror image — a file locked mid-
  * unlink aborts the run), leaving the manifest pointing at a package that
@@ -123,10 +211,8 @@ export function restoreManifestDeps(profile: string, snapshot: Record<string, st
  * dependency. When disk truth says the package is gone, this finishes the
  * removal the CLI could not. Every other manifest field is untouched.
  *
- * Written atomically, unlike restoreManifestDeps above. This one runs only
- * after something already went wrong mid-uninstall, so it is the worst place
- * in the codebase to leave a half-written package.json: the profile would go
- * from "one ghost dependency" to "will not parse".
+ * Written atomically because it runs only after something already went wrong
+ * mid-uninstall, so it is the worst place to leave a half-written manifest.
  * @returns true when either list still mentioned the package.
  */
 export function dropFromManifest(profile: string, name: string, explicitDir?: string): boolean {

package/src/routes.ts

@@ -23,7 +23,7 @@ import {
   BOOT_ID, cancelActive, probePnpm, progress, provisionPnpm, runDshPlugin,
   type PluginCommandRuntime,
 } from './dsh-cli.ts'
-import { addProfileBundle, dropFromManifest, hasLoadableEntry, INBOX_BUNDLES, isDshProfileName, profileDir, readInstalled, readInstalledManifest, readInstalledRepoEvidence, readInstalledVersion, readLockCommits, readManifestDeps, readProfileBundles, removeProfileBundle, restoreManifestDeps, setAllowBuilds } from './profile.ts'
+import { addProfileBundle, dropFromManifest, hasLoadableEntry, INBOX_BUNDLES, isDshProfileName, profileDir, readInstalled, readInstalledManifest, readInstalledRepoEvidence, readInstalledVersion, readLockCommits, readProfileBundles, readProfileManifestSnapshot, removeProfileBundle, restoreProfileManifest, setAllowBuilds, type ProfileManifestSnapshot } from './profile.ts'
 import { assessProfile, classifyPeer, introducedDuplicateNames, introducedRisks, type CompatibilityRisk } from './compatibility.ts'
 import { runningAgentIds, type AgentsLookup } from './agents.ts'
 import { analyzeProfile, type DuplicateName } from './check.ts'
@@ -462,8 +462,8 @@ export function mountMarketRoutes(
    * next start still fails. Re-run pnpm install against the restored
    * manifest to rematerialize the previous build's files.
    */
-  async function rollbackUpdateBuild(name: string, manifestBefore: Record<string, string>): Promise<{ ok: boolean; detail: string | null }> {
-    const rolledBack = restoreManifestDeps(config.profile, manifestBefore, activeProfileDir)
+  async function rollbackUpdateBuild(name: string, manifestBefore: ProfileManifestSnapshot): Promise<{ ok: boolean; detail: string | null }> {
+    const rolledBack = restoreProfileManifest(config.profile, manifestBefore, activeProfileDir)
     if (rolledBack.length === 0) return { ok: true, detail: null }
     // CI=true (the market always runs pnpm that way) turns frozen-lockfile
     // on, and the restored manifest pin now disagrees with the lockfile the
@@ -483,7 +483,7 @@ export function mountMarketRoutes(
     id: string
     kind: 'update' | 'install'
     names: string[]
-    manifestBefore?: Record<string, string>
+    manifestBefore?: ProfileManifestSnapshot
     /** github: updates must re-add the pre-update commit, not just reinstall. */
     gitTarget?: string
     beforeCommit?: string | null
@@ -501,14 +501,14 @@ export function mountMarketRoutes(
   /** Restore a github: update by re-adding the commit captured before the update. */
   async function rollbackGitBuild(
     name: string,
-    manifestBefore: Record<string, string>,
+    manifestBefore: ProfileManifestSnapshot,
     target: string,
     beforeCommit: string | null,
   ): Promise<{ ok: boolean; detail: string | null }> {
     if (beforeCommit === null) {
       return { ok: false, detail: 'the previous commit is unknown; nothing to roll back to' }
     }
-    restoreManifestDeps(config.profile, manifestBefore, activeProfileDir)
+    restoreProfileManifest(config.profile, manifestBefore, activeProfileDir)
     const add = await runPlugin(config.profile, ['add', RELEASE_AGE_OVERRIDE, `${target}#${beforeCommit}`])
     if (add.exitCode !== 0 || add.timedOut || add.cancelled) {
       return { ok: false, detail: failureDetail(add) }
@@ -516,7 +516,7 @@ export function mountMarketRoutes(
     // pnpm wrote a commit-pinned spec; the profile's durable spec must stay
     // the original `github:owner/repo` form. The lockfile keeps the restored
     // commit resolution for the next boot.
-    restoreManifestDeps(config.profile, manifestBefore, activeProfileDir)
+    restoreProfileManifest(config.profile, manifestBefore, activeProfileDir)
     logEvent('info', 'update-rollback', `${name}: restored github build at ${beforeCommit}`)
     return { ok: true, detail: null }
   }
@@ -1722,9 +1722,9 @@ export function mountMarketRoutes(
             // force: the user chose to install a fresh release without the
             // default one-day safety wait; scoped to this single command.
             const addArgs = force ? ['add', RELEASE_AGE_OVERRIDE, target] : ['add', target]
-            // RAW manifest snapshot for failure rollback (#65) — pnpm writes
-            // package.json before it finishes, so a hard-failed add leaves
-            // ghost/bumped entries that break every later pnpm run.
+            // Exact manifest snapshot for failure rollback (#65, #339) — the
+            // host can write dependencies AND dsh.profile.bundles before a
+            // hard-failed add, leaving residue that breaks the next boot.
             pendingRollbacks.clear()
             const compatibilityBefore = assessProfile(config.profile, activeProfileDir)
             // pnpm re-extracts the whole tree on any operation, so a plugin
@@ -1733,11 +1733,11 @@ export function mountMarketRoutes(
             // broke is attributable to it, so the profile is swept before as
             // well as after.
             const bundlesBefore = brokenClientBundles(config.profile, activeProfileDir)
-            const manifestBefore = readManifestDeps(config.profile, activeProfileDir)
+            const manifestBefore = readProfileManifestSnapshot(config.profile, activeProfileDir)
             const result = await runPlugin(config.profile, addArgs)
             const cancelled = result.cancelled
             if ((result.exitCode !== 0 || result.timedOut) && !cancelled) {
-              const rolledBack = restoreManifestDeps(config.profile, manifestBefore, activeProfileDir)
+              const rolledBack = restoreProfileManifest(config.profile, manifestBefore, activeProfileDir)
               if (rolledBack.length > 0) logEvent('warn', 'update', `${name}: rolled back manifest residue of the failed run: ${rolledBack.join(', ')}`)
             }
             let ok = result.exitCode === 0 && !result.timedOut && !cancelled
@@ -2681,16 +2681,17 @@ export function mountMarketRoutes(
             // broke is attributable to it, so the profile is swept before as
             // well as after.
             const bundlesBefore = brokenClientBundles(config.profile, activeProfileDir)
-            // RAW manifest snapshot for failure rollback (#65): pnpm writes
-            // package.json before the build-script check / registry fetches
-            // run, so a hard-failed add leaves ghost dependencies that break
-            // every later pnpm run — of anything. Cancelled runs keep their
-            // partial state on purpose (the user sees the diff and decides).
-            const manifestBefore = readManifestDeps(config.profile, activeProfileDir)
+            // Exact manifest snapshot for failure rollback (#65, #339): the
+            // host writes dependencies and dsh.profile.bundles before the
+            // build-script check / registry fetches run. Either residue can
+            // break every later operation or the next boot. Cancelled runs
+            // keep their partial state on purpose (the user sees the diff
+            // and decides).
+            const manifestBefore = readProfileManifestSnapshot(config.profile, activeProfileDir)
             const result = await runPlugin(config.profile, ['add', target])
             const cancelled = result.cancelled
             if ((result.exitCode !== 0 || result.timedOut) && !cancelled) {
-              const rolledBack = restoreManifestDeps(config.profile, manifestBefore, activeProfileDir)
+              const rolledBack = restoreProfileManifest(config.profile, manifestBefore, activeProfileDir)
               if (rolledBack.length > 0) logEvent('warn', 'install', `${target}: rolled back manifest residue of the failed run: ${rolledBack.join(', ')}`)
             }
             let ok = result.exitCode === 0 && !result.timedOut && !cancelled