dshmarket 1.29.2 → 1.29.3

package/lib/profile.js

@@ -6,6 +6,7 @@
 import { existsSync, readdirSync, readFileSync, realpathSync, renameSync, statSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
 import { githubRemoteIdentities, githubRepoIdentities } from './sources.js';
 /**
  * Whether a profile name follows DSH's own directory-name contract.
@@ -78,18 +79,45 @@ export function readManifestDeps(profile, explicitDir) {
         return {};
     }
 }
+function objectRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+/** Read dependencies and the exact `dsh.profile.bundles` field before a package operation. */
+export function readProfileManifestSnapshot(profile, explicitDir) {
+    try {
+        const manifest = JSON.parse(readFileSync(join(profileDir(profile, explicitDir), 'package.json'), 'utf8'));
+        const profileManifest = objectRecord(manifest.dsh?.profile);
+        const present = profileManifest !== undefined && Object.hasOwn(profileManifest, 'bundles');
+        return {
+            dependencies: { ...manifest.dependencies },
+            profileBundles: present
+                ? { present: true, value: structuredClone(profileManifest.bundles) }
+                : { present: false },
+        };
+    }
+    catch {
+        return { dependencies: {}, profileBundles: { present: false } };
+    }
+}
+/** String package names carried by one valid bundle-list value. */
+function bundleNames(value) {
+    return Array.isArray(value) ? value.filter((name) => typeof name === 'string') : [];
+}
 /**
- * Restore the profile manifest's dependency map to a pre-operation snapshot,
- * leaving every other manifest field untouched. pnpm writes package.json
- * BEFORE it finishes installing (#65, #69: a 404/blocked-build failure lands
- * after the write), so a failed add leaves ghost dependencies that break
- * every later pnpm run — and pnpm itself can no longer remove them (the same
- * failure re-fires on any mutation). Direct manifest surgery is the only
- * reliable rollback; the lockfile is left as-is (pnpm reconciles it from the
- * manifest on the next run).
+ * Restore the profile manifest fields a package operation may mutate:
+ * `dependencies` and `dsh.profile.bundles`. pnpm and `dsh plugin add` can
+ * write both before a later fetch or build-script failure (#65, #69, #339),
+ * leaving either an unresolvable dependency or a bundle the next boot cannot
+ * activate. Every unrelated manifest field remains untouched. The lockfile is
+ * left as-is; pnpm reconciles it from the manifest on the next run.
+ *
+ * The write is atomic because rollback runs after another operation already
+ * failed; a partial repair must not turn a valid profile into invalid JSON.
  * @returns names whose entries were dropped or reverted, empty when nothing changed.
  */
-export function restoreManifestDeps(profile, snapshot, explicitDir) {
+export function restoreProfileManifest(profile, snapshot, explicitDir) {
     const file = join(profileDir(profile, explicitDir), 'package.json');
     let manifest;
     try {
@@ -100,21 +128,62 @@ export function restoreManifestDeps(profile, snapshot, explicitDir) {
     }
     const current = manifest.dependencies ?? {};
     const touched = new Set();
-    for (const name of Object.keys(current))
-        if (current[name] !== snapshot[name])
+    for (const name of Object.keys(current)) {
+        if (current[name] !== snapshot.dependencies[name])
             touched.add(name);
-    for (const name of Object.keys(snapshot))
-        if (current[name] !== snapshot[name])
+    }
+    for (const name of Object.keys(snapshot.dependencies)) {
+        if (current[name] !== snapshot.dependencies[name])
             touched.add(name);
+    }
+    const currentDsh = objectRecord(manifest.dsh);
+    const currentProfile = objectRecord(currentDsh?.profile);
+    const currentBundles = currentProfile !== undefined && Object.hasOwn(currentProfile, 'bundles')
+        ? { present: true, value: currentProfile.bundles }
+        : { present: false };
+    const bundlesChanged = currentBundles.present !== snapshot.profileBundles.present
+        || (currentBundles.present && snapshot.profileBundles.present
+            && !isDeepStrictEqual(currentBundles.value, snapshot.profileBundles.value));
+    if (bundlesChanged) {
+        const currentNames = new Set(currentBundles.present ? bundleNames(currentBundles.value) : []);
+        const snapshotNames = new Set(snapshot.profileBundles.present ? bundleNames(snapshot.profileBundles.value) : []);
+        let namedBundleChange = false;
+        for (const name of currentNames) {
+            if (!snapshotNames.has(name)) {
+                touched.add(name);
+                namedBundleChange = true;
+            }
+        }
+        for (const name of snapshotNames) {
+            if (!currentNames.has(name)) {
+                touched.add(name);
+                namedBundleChange = true;
+            }
+        }
+        // Presence, order, duplicates, or a malformed non-array value can differ
+        // without changing the set of package names. Still report that rollback.
+        if (!namedBundleChange)
+            touched.add('dsh.profile.bundles');
+    }
     if (touched.size === 0)
         return [];
-    manifest.dependencies = { ...snapshot };
-    writeFileSync(file, `${JSON.stringify(manifest, null, 2)}\n`);
+    manifest.dependencies = { ...snapshot.dependencies };
+    if (snapshot.profileBundles.present) {
+        const dsh = currentDsh ?? {};
+        const profileManifest = currentProfile ?? {};
+        manifest.dsh = dsh;
+        dsh.profile = profileManifest;
+        profileManifest.bundles = structuredClone(snapshot.profileBundles.value);
+    }
+    else if (currentProfile !== undefined) {
+        delete currentProfile.bundles;
+    }
+    writeManifestAtomic(file, manifest);
     return [...touched];
 }
 /**
  * Remove a package from BOTH manifest lists — dependencies and
- * dsh.profile.bundles. The uninstall counterpart of restoreManifestDeps:
+ * dsh.profile.bundles. The uninstall counterpart of restoreProfileManifest:
  * pnpm can fail a remove after deleting node_modules but before saving
  * package.json (the #65 write-order's mirror image — a file locked mid-
  * unlink aborts the run), leaving the manifest pointing at a package that
@@ -122,10 +191,8 @@ export function restoreManifestDeps(profile, snapshot, explicitDir) {
  * dependency. When disk truth says the package is gone, this finishes the
  * removal the CLI could not. Every other manifest field is untouched.
  *
- * Written atomically, unlike restoreManifestDeps above. This one runs only
- * after something already went wrong mid-uninstall, so it is the worst place
- * in the codebase to leave a half-written package.json: the profile would go
- * from "one ghost dependency" to "will not parse".
+ * Written atomically because it runs only after something already went wrong
+ * mid-uninstall, so it is the worst place to leave a half-written manifest.
  * @returns true when either list still mentioned the package.
  */
 export function dropFromManifest(profile, name, explicitDir) {

package/lib/routes.js

@@ -15,7 +15,7 @@ import { createGroup, deleteGroup, removeFromGroups, renameGroup, setGroupMember
 import { exportLogs, logEvent } from './log.js';
 import { diagnosePackageManifests } from './diagnostics.js';
 import { BOOT_ID, cancelActive, probePnpm, progress, provisionPnpm, runDshPlugin, } from './dsh-cli.js';
-import { addProfileBundle, dropFromManifest, hasLoadableEntry, INBOX_BUNDLES, isDshProfileName, profileDir, readInstalled, readInstalledManifest, readInstalledRepoEvidence, readInstalledVersion, readLockCommits, readManifestDeps, readProfileBundles, removeProfileBundle, restoreManifestDeps, setAllowBuilds } from './profile.js';
+import { addProfileBundle, dropFromManifest, hasLoadableEntry, INBOX_BUNDLES, isDshProfileName, profileDir, readInstalled, readInstalledManifest, readInstalledRepoEvidence, readInstalledVersion, readLockCommits, readProfileBundles, readProfileManifestSnapshot, removeProfileBundle, restoreProfileManifest, setAllowBuilds } from './profile.js';
 import { assessProfile, classifyPeer, introducedDuplicateNames, introducedRisks } from './compatibility.js';
 import { runningAgentIds } from './agents.js';
 import { analyzeProfile } from './check.js';
@@ -420,7 +420,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
      * manifest to rematerialize the previous build's files.
      */
     async function rollbackUpdateBuild(name, manifestBefore) {
-        const rolledBack = restoreManifestDeps(config.profile, manifestBefore, activeProfileDir);
+        const rolledBack = restoreProfileManifest(config.profile, manifestBefore, activeProfileDir);
         if (rolledBack.length === 0)
             return { ok: true, detail: null };
         // CI=true (the market always runs pnpm that way) turns frozen-lockfile
@@ -449,7 +449,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
         if (beforeCommit === null) {
             return { ok: false, detail: 'the previous commit is unknown; nothing to roll back to' };
         }
-        restoreManifestDeps(config.profile, manifestBefore, activeProfileDir);
+        restoreProfileManifest(config.profile, manifestBefore, activeProfileDir);
         const add = await runPlugin(config.profile, ['add', RELEASE_AGE_OVERRIDE, `${target}#${beforeCommit}`]);
         if (add.exitCode !== 0 || add.timedOut || add.cancelled) {
             return { ok: false, detail: failureDetail(add) };
@@ -457,7 +457,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
         // pnpm wrote a commit-pinned spec; the profile's durable spec must stay
         // the original `github:owner/repo` form. The lockfile keeps the restored
         // commit resolution for the next boot.
-        restoreManifestDeps(config.profile, manifestBefore, activeProfileDir);
+        restoreProfileManifest(config.profile, manifestBefore, activeProfileDir);
         logEvent('info', 'update-rollback', `${name}: restored github build at ${beforeCommit}`);
         return { ok: true, detail: null };
     }
@@ -1675,9 +1675,9 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                         // force: the user chose to install a fresh release without the
                         // default one-day safety wait; scoped to this single command.
                         const addArgs = force ? ['add', RELEASE_AGE_OVERRIDE, target] : ['add', target];
-                        // RAW manifest snapshot for failure rollback (#65) — pnpm writes
-                        // package.json before it finishes, so a hard-failed add leaves
-                        // ghost/bumped entries that break every later pnpm run.
+                        // Exact manifest snapshot for failure rollback (#65, #339) — the
+                        // host can write dependencies AND dsh.profile.bundles before a
+                        // hard-failed add, leaving residue that breaks the next boot.
                         pendingRollbacks.clear();
                         const compatibilityBefore = assessProfile(config.profile, activeProfileDir);
                         // pnpm re-extracts the whole tree on any operation, so a plugin
@@ -1686,11 +1686,11 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                         // broke is attributable to it, so the profile is swept before as
                         // well as after.
                         const bundlesBefore = brokenClientBundles(config.profile, activeProfileDir);
-                        const manifestBefore = readManifestDeps(config.profile, activeProfileDir);
+                        const manifestBefore = readProfileManifestSnapshot(config.profile, activeProfileDir);
                         const result = await runPlugin(config.profile, addArgs);
                         const cancelled = result.cancelled;
                         if ((result.exitCode !== 0 || result.timedOut) && !cancelled) {
-                            const rolledBack = restoreManifestDeps(config.profile, manifestBefore, activeProfileDir);
+                            const rolledBack = restoreProfileManifest(config.profile, manifestBefore, activeProfileDir);
                             if (rolledBack.length > 0)
                                 logEvent('warn', 'update', `${name}: rolled back manifest residue of the failed run: ${rolledBack.join(', ')}`);
                         }
@@ -2626,16 +2626,17 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                         // broke is attributable to it, so the profile is swept before as
                         // well as after.
                         const bundlesBefore = brokenClientBundles(config.profile, activeProfileDir);
-                        // RAW manifest snapshot for failure rollback (#65): pnpm writes
-                        // package.json before the build-script check / registry fetches
-                        // run, so a hard-failed add leaves ghost dependencies that break
-                        // every later pnpm run — of anything. Cancelled runs keep their
-                        // partial state on purpose (the user sees the diff and decides).
-                        const manifestBefore = readManifestDeps(config.profile, activeProfileDir);
+                        // Exact manifest snapshot for failure rollback (#65, #339): the
+                        // host writes dependencies and dsh.profile.bundles before the
+                        // build-script check / registry fetches run. Either residue can
+                        // break every later operation or the next boot. Cancelled runs
+                        // keep their partial state on purpose (the user sees the diff
+                        // and decides).
+                        const manifestBefore = readProfileManifestSnapshot(config.profile, activeProfileDir);
                         const result = await runPlugin(config.profile, ['add', target]);
                         const cancelled = result.cancelled;
                         if ((result.exitCode !== 0 || result.timedOut) && !cancelled) {
-                            const rolledBack = restoreManifestDeps(config.profile, manifestBefore, activeProfileDir);
+                            const rolledBack = restoreProfileManifest(config.profile, manifestBefore, activeProfileDir);
                             if (rolledBack.length > 0)
                                 logEvent('warn', 'install', `${target}: rolled back manifest residue of the failed run: ${rolledBack.join(', ')}`);
                         }

package/lib/types/profile.d.ts

@@ -34,21 +34,34 @@ export declare function readInstalled(profile: string, explicitDir?: string): Re
  * a filtered view would delete @deepseek-ai/dsh-base and friends.
  */
 export declare function readManifestDeps(profile: string, explicitDir?: string): Record<string, string>;
-/**
- * Restore the profile manifest's dependency map to a pre-operation snapshot,
- * leaving every other manifest field untouched. pnpm writes package.json
- * BEFORE it finishes installing (#65, #69: a 404/blocked-build failure lands
- * after the write), so a failed add leaves ghost dependencies that break
- * every later pnpm run — and pnpm itself can no longer remove them (the same
- * failure re-fires on any mutation). Direct manifest surgery is the only
- * reliable rollback; the lockfile is left as-is (pnpm reconciles it from the
- * manifest on the next run).
+/** Exact rollback state owned by one profile package operation. */
+export interface ProfileManifestSnapshot {
+    dependencies: Record<string, string>;
+    profileBundles: {
+        present: false;
+    } | {
+        present: true;
+        value: unknown;
+    };
+}
+/** Read dependencies and the exact `dsh.profile.bundles` field before a package operation. */
+export declare function readProfileManifestSnapshot(profile: string, explicitDir?: string): ProfileManifestSnapshot;
+/**
+ * Restore the profile manifest fields a package operation may mutate:
+ * `dependencies` and `dsh.profile.bundles`. pnpm and `dsh plugin add` can
+ * write both before a later fetch or build-script failure (#65, #69, #339),
+ * leaving either an unresolvable dependency or a bundle the next boot cannot
+ * activate. Every unrelated manifest field remains untouched. The lockfile is
+ * left as-is; pnpm reconciles it from the manifest on the next run.
+ *
+ * The write is atomic because rollback runs after another operation already
+ * failed; a partial repair must not turn a valid profile into invalid JSON.
  * @returns names whose entries were dropped or reverted, empty when nothing changed.
  */
-export declare function restoreManifestDeps(profile: string, snapshot: Record<string, string>, explicitDir?: string): string[];
+export declare function restoreProfileManifest(profile: string, snapshot: ProfileManifestSnapshot, explicitDir?: string): string[];
 /**
  * Remove a package from BOTH manifest lists — dependencies and
- * dsh.profile.bundles. The uninstall counterpart of restoreManifestDeps:
+ * dsh.profile.bundles. The uninstall counterpart of restoreProfileManifest:
  * pnpm can fail a remove after deleting node_modules but before saving
  * package.json (the #65 write-order's mirror image — a file locked mid-
  * unlink aborts the run), leaving the manifest pointing at a package that
@@ -56,10 +69,8 @@ export declare function restoreManifestDeps(profile: string, snapshot: Record<st
  * dependency. When disk truth says the package is gone, this finishes the
  * removal the CLI could not. Every other manifest field is untouched.
  *
- * Written atomically, unlike restoreManifestDeps above. This one runs only
- * after something already went wrong mid-uninstall, so it is the worst place
- * in the codebase to leave a half-written package.json: the profile would go
- * from "one ghost dependency" to "will not parse".
+ * Written atomically because it runs only after something already went wrong
+ * mid-uninstall, so it is the worst place to leave a half-written manifest.
  * @returns true when either list still mentioned the package.
  */
 export declare function dropFromManifest(profile: string, name: string, explicitDir?: string): boolean;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.29.2",
+  "version": "1.29.3",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/profile.ts

@@ -7,6 +7,7 @@
 import { existsSync, readdirSync, readFileSync, realpathSync, renameSync, statSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path'
+import { isDeepStrictEqual } from 'node:util'
 import { githubRemoteIdentities, githubRepoIdentities } from './sources.ts'
 
 /**
@@ -84,38 +85,125 @@ export function readManifestDeps(profile: string, explicitDir?: string): Record<
   }
 }
 
+/** Exact rollback state owned by one profile package operation. */
+export interface ProfileManifestSnapshot {
+  dependencies: Record<string, string>
+  profileBundles: { present: false } | { present: true; value: unknown }
+}
+
+function objectRecord(value: unknown): Record<string, unknown> | undefined {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : undefined
+}
+
+/** Read dependencies and the exact `dsh.profile.bundles` field before a package operation. */
+export function readProfileManifestSnapshot(profile: string, explicitDir?: string): ProfileManifestSnapshot {
+  try {
+    const manifest = JSON.parse(readFileSync(join(profileDir(profile, explicitDir), 'package.json'), 'utf8')) as {
+      dependencies?: Record<string, string>
+      dsh?: { profile?: unknown }
+    }
+    const profileManifest = objectRecord(manifest.dsh?.profile)
+    const present = profileManifest !== undefined && Object.hasOwn(profileManifest, 'bundles')
+    return {
+      dependencies: { ...manifest.dependencies },
+      profileBundles: present
+        ? { present: true, value: structuredClone(profileManifest.bundles) }
+        : { present: false },
+    }
+  } catch {
+    return { dependencies: {}, profileBundles: { present: false } }
+  }
+}
+
+/** String package names carried by one valid bundle-list value. */
+function bundleNames(value: unknown): string[] {
+  return Array.isArray(value) ? value.filter((name): name is string => typeof name === 'string') : []
+}
+
 /**
- * Restore the profile manifest's dependency map to a pre-operation snapshot,
- * leaving every other manifest field untouched. pnpm writes package.json
- * BEFORE it finishes installing (#65, #69: a 404/blocked-build failure lands
- * after the write), so a failed add leaves ghost dependencies that break
- * every later pnpm run — and pnpm itself can no longer remove them (the same
- * failure re-fires on any mutation). Direct manifest surgery is the only
- * reliable rollback; the lockfile is left as-is (pnpm reconciles it from the
- * manifest on the next run).
+ * Restore the profile manifest fields a package operation may mutate:
+ * `dependencies` and `dsh.profile.bundles`. pnpm and `dsh plugin add` can
+ * write both before a later fetch or build-script failure (#65, #69, #339),
+ * leaving either an unresolvable dependency or a bundle the next boot cannot
+ * activate. Every unrelated manifest field remains untouched. The lockfile is
+ * left as-is; pnpm reconciles it from the manifest on the next run.
+ *
+ * The write is atomic because rollback runs after another operation already
+ * failed; a partial repair must not turn a valid profile into invalid JSON.
  * @returns names whose entries were dropped or reverted, empty when nothing changed.
  */
-export function restoreManifestDeps(profile: string, snapshot: Record<string, string>, explicitDir?: string): string[] {
+export function restoreProfileManifest(
+  profile: string,
+  snapshot: ProfileManifestSnapshot,
+  explicitDir?: string,
+): string[] {
   const file = join(profileDir(profile, explicitDir), 'package.json')
-  let manifest: { dependencies?: Record<string, string> }
+  let manifest: {
+    dependencies?: Record<string, string>
+    dsh?: unknown
+  }
   try {
-    manifest = JSON.parse(readFileSync(file, 'utf8')) as { dependencies?: Record<string, string> }
+    manifest = JSON.parse(readFileSync(file, 'utf8')) as typeof manifest
   } catch {
     return []
   }
   const current = manifest.dependencies ?? {}
   const touched = new Set<string>()
-  for (const name of Object.keys(current)) if (current[name] !== snapshot[name]) touched.add(name)
-  for (const name of Object.keys(snapshot)) if (current[name] !== snapshot[name]) touched.add(name)
+  for (const name of Object.keys(current)) {
+    if (current[name] !== snapshot.dependencies[name]) touched.add(name)
+  }
+  for (const name of Object.keys(snapshot.dependencies)) {
+    if (current[name] !== snapshot.dependencies[name]) touched.add(name)
+  }
+
+  const currentDsh = objectRecord(manifest.dsh)
+  const currentProfile = objectRecord(currentDsh?.profile)
+  const currentBundles = currentProfile !== undefined && Object.hasOwn(currentProfile, 'bundles')
+    ? { present: true as const, value: currentProfile.bundles }
+    : { present: false as const }
+  const bundlesChanged = currentBundles.present !== snapshot.profileBundles.present
+    || (currentBundles.present && snapshot.profileBundles.present
+      && !isDeepStrictEqual(currentBundles.value, snapshot.profileBundles.value))
+  if (bundlesChanged) {
+    const currentNames = new Set(currentBundles.present ? bundleNames(currentBundles.value) : [])
+    const snapshotNames = new Set(snapshot.profileBundles.present ? bundleNames(snapshot.profileBundles.value) : [])
+    let namedBundleChange = false
+    for (const name of currentNames) {
+      if (!snapshotNames.has(name)) {
+        touched.add(name)
+        namedBundleChange = true
+      }
+    }
+    for (const name of snapshotNames) {
+      if (!currentNames.has(name)) {
+        touched.add(name)
+        namedBundleChange = true
+      }
+    }
+    // Presence, order, duplicates, or a malformed non-array value can differ
+    // without changing the set of package names. Still report that rollback.
+    if (!namedBundleChange) touched.add('dsh.profile.bundles')
+  }
   if (touched.size === 0) return []
-  manifest.dependencies = { ...snapshot }
-  writeFileSync(file, `${JSON.stringify(manifest, null, 2)}\n`)
+  manifest.dependencies = { ...snapshot.dependencies }
+  if (snapshot.profileBundles.present) {
+    const dsh = currentDsh ?? {}
+    const profileManifest = currentProfile ?? {}
+    manifest.dsh = dsh
+    dsh.profile = profileManifest
+    profileManifest.bundles = structuredClone(snapshot.profileBundles.value)
+  } else if (currentProfile !== undefined) {
+    delete currentProfile.bundles
+  }
+  writeManifestAtomic(file, manifest)
   return [...touched]
 }
 
 /**
  * Remove a package from BOTH manifest lists — dependencies and
- * dsh.profile.bundles. The uninstall counterpart of restoreManifestDeps:
+ * dsh.profile.bundles. The uninstall counterpart of restoreProfileManifest:
  * pnpm can fail a remove after deleting node_modules but before saving
  * package.json (the #65 write-order's mirror image — a file locked mid-
  * unlink aborts the run), leaving the manifest pointing at a package that
@@ -123,10 +211,8 @@ export function restoreManifestDeps(profile: string, snapshot: Record<string, st
  * dependency. When disk truth says the package is gone, this finishes the
  * removal the CLI could not. Every other manifest field is untouched.
  *
- * Written atomically, unlike restoreManifestDeps above. This one runs only
- * after something already went wrong mid-uninstall, so it is the worst place
- * in the codebase to leave a half-written package.json: the profile would go
- * from "one ghost dependency" to "will not parse".
+ * Written atomically because it runs only after something already went wrong
+ * mid-uninstall, so it is the worst place to leave a half-written manifest.
  * @returns true when either list still mentioned the package.
  */
 export function dropFromManifest(profile: string, name: string, explicitDir?: string): boolean {

package/src/routes.ts

@@ -23,7 +23,7 @@ import {
   BOOT_ID, cancelActive, probePnpm, progress, provisionPnpm, runDshPlugin,
   type PluginCommandRuntime,
 } from './dsh-cli.ts'
-import { addProfileBundle, dropFromManifest, hasLoadableEntry, INBOX_BUNDLES, isDshProfileName, profileDir, readInstalled, readInstalledManifest, readInstalledRepoEvidence, readInstalledVersion, readLockCommits, readManifestDeps, readProfileBundles, removeProfileBundle, restoreManifestDeps, setAllowBuilds } from './profile.ts'
+import { addProfileBundle, dropFromManifest, hasLoadableEntry, INBOX_BUNDLES, isDshProfileName, profileDir, readInstalled, readInstalledManifest, readInstalledRepoEvidence, readInstalledVersion, readLockCommits, readProfileBundles, readProfileManifestSnapshot, removeProfileBundle, restoreProfileManifest, setAllowBuilds, type ProfileManifestSnapshot } from './profile.ts'
 import { assessProfile, classifyPeer, introducedDuplicateNames, introducedRisks, type CompatibilityRisk } from './compatibility.ts'
 import { runningAgentIds, type AgentsLookup } from './agents.ts'
 import { analyzeProfile, type DuplicateName } from './check.ts'
@@ -462,8 +462,8 @@ export function mountMarketRoutes(
    * next start still fails. Re-run pnpm install against the restored
    * manifest to rematerialize the previous build's files.
    */
-  async function rollbackUpdateBuild(name: string, manifestBefore: Record<string, string>): Promise<{ ok: boolean; detail: string | null }> {
-    const rolledBack = restoreManifestDeps(config.profile, manifestBefore, activeProfileDir)
+  async function rollbackUpdateBuild(name: string, manifestBefore: ProfileManifestSnapshot): Promise<{ ok: boolean; detail: string | null }> {
+    const rolledBack = restoreProfileManifest(config.profile, manifestBefore, activeProfileDir)
     if (rolledBack.length === 0) return { ok: true, detail: null }
     // CI=true (the market always runs pnpm that way) turns frozen-lockfile
     // on, and the restored manifest pin now disagrees with the lockfile the
@@ -483,7 +483,7 @@ export function mountMarketRoutes(
     id: string
     kind: 'update' | 'install'
     names: string[]
-    manifestBefore?: Record<string, string>
+    manifestBefore?: ProfileManifestSnapshot
     /** github: updates must re-add the pre-update commit, not just reinstall. */
     gitTarget?: string
     beforeCommit?: string | null
@@ -501,14 +501,14 @@ export function mountMarketRoutes(
   /** Restore a github: update by re-adding the commit captured before the update. */
   async function rollbackGitBuild(
     name: string,
-    manifestBefore: Record<string, string>,
+    manifestBefore: ProfileManifestSnapshot,
     target: string,
     beforeCommit: string | null,
   ): Promise<{ ok: boolean; detail: string | null }> {
     if (beforeCommit === null) {
       return { ok: false, detail: 'the previous commit is unknown; nothing to roll back to' }
     }
-    restoreManifestDeps(config.profile, manifestBefore, activeProfileDir)
+    restoreProfileManifest(config.profile, manifestBefore, activeProfileDir)
     const add = await runPlugin(config.profile, ['add', RELEASE_AGE_OVERRIDE, `${target}#${beforeCommit}`])
     if (add.exitCode !== 0 || add.timedOut || add.cancelled) {
       return { ok: false, detail: failureDetail(add) }
@@ -516,7 +516,7 @@ export function mountMarketRoutes(
     // pnpm wrote a commit-pinned spec; the profile's durable spec must stay
     // the original `github:owner/repo` form. The lockfile keeps the restored
     // commit resolution for the next boot.
-    restoreManifestDeps(config.profile, manifestBefore, activeProfileDir)
+    restoreProfileManifest(config.profile, manifestBefore, activeProfileDir)
     logEvent('info', 'update-rollback', `${name}: restored github build at ${beforeCommit}`)
     return { ok: true, detail: null }
   }
@@ -1722,9 +1722,9 @@ export function mountMarketRoutes(
             // force: the user chose to install a fresh release without the
             // default one-day safety wait; scoped to this single command.
             const addArgs = force ? ['add', RELEASE_AGE_OVERRIDE, target] : ['add', target]
-            // RAW manifest snapshot for failure rollback (#65) — pnpm writes
-            // package.json before it finishes, so a hard-failed add leaves
-            // ghost/bumped entries that break every later pnpm run.
+            // Exact manifest snapshot for failure rollback (#65, #339) — the
+            // host can write dependencies AND dsh.profile.bundles before a
+            // hard-failed add, leaving residue that breaks the next boot.
             pendingRollbacks.clear()
             const compatibilityBefore = assessProfile(config.profile, activeProfileDir)
             // pnpm re-extracts the whole tree on any operation, so a plugin
@@ -1733,11 +1733,11 @@ export function mountMarketRoutes(
             // broke is attributable to it, so the profile is swept before as
             // well as after.
             const bundlesBefore = brokenClientBundles(config.profile, activeProfileDir)
-            const manifestBefore = readManifestDeps(config.profile, activeProfileDir)
+            const manifestBefore = readProfileManifestSnapshot(config.profile, activeProfileDir)
             const result = await runPlugin(config.profile, addArgs)
             const cancelled = result.cancelled
             if ((result.exitCode !== 0 || result.timedOut) && !cancelled) {
-              const rolledBack = restoreManifestDeps(config.profile, manifestBefore, activeProfileDir)
+              const rolledBack = restoreProfileManifest(config.profile, manifestBefore, activeProfileDir)
               if (rolledBack.length > 0) logEvent('warn', 'update', `${name}: rolled back manifest residue of the failed run: ${rolledBack.join(', ')}`)
             }
             let ok = result.exitCode === 0 && !result.timedOut && !cancelled
@@ -2681,16 +2681,17 @@ export function mountMarketRoutes(
             // broke is attributable to it, so the profile is swept before as
             // well as after.
             const bundlesBefore = brokenClientBundles(config.profile, activeProfileDir)
-            // RAW manifest snapshot for failure rollback (#65): pnpm writes
-            // package.json before the build-script check / registry fetches
-            // run, so a hard-failed add leaves ghost dependencies that break
-            // every later pnpm run — of anything. Cancelled runs keep their
-            // partial state on purpose (the user sees the diff and decides).
-            const manifestBefore = readManifestDeps(config.profile, activeProfileDir)
+            // Exact manifest snapshot for failure rollback (#65, #339): the
+            // host writes dependencies and dsh.profile.bundles before the
+            // build-script check / registry fetches run. Either residue can
+            // break every later operation or the next boot. Cancelled runs
+            // keep their partial state on purpose (the user sees the diff
+            // and decides).
+            const manifestBefore = readProfileManifestSnapshot(config.profile, activeProfileDir)
             const result = await runPlugin(config.profile, ['add', target])
             const cancelled = result.cancelled
             if ((result.exitCode !== 0 || result.timedOut) && !cancelled) {
-              const rolledBack = restoreManifestDeps(config.profile, manifestBefore, activeProfileDir)
+              const rolledBack = restoreProfileManifest(config.profile, manifestBefore, activeProfileDir)
               if (rolledBack.length > 0) logEvent('warn', 'install', `${target}: rolled back manifest residue of the failed run: ${rolledBack.join(', ')}`)
             }
             let ok = result.exitCode === 0 && !result.timedOut && !cancelled