dshmarket 1.45.1 → 1.46.1

package/client/client.js

@@ -40,6 +40,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			setSelfUpdateReady: "有新版本",
 			setSelfUpdateHint: "更新会下载新版本，重启后生效。",
 			setSelfUpToDateHint: "",
+			setSelfHostManagedHint: "这份市场由桌面宿主安装，新版本请在桌面端更新。",
 			setSelfUpdate: "更新",
 			setSelfUpdatedHint: "已下载完成。重启 DeepSeek Harness 后新版本才会生效——前端页面会立即更新，服务端不会。",
 			setRegion: "下载区域",
@@ -154,6 +155,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			updateFail: "更新失败",
 			upToDate: "已是最新",
 			linkedDev: "本地开发",
+			hostUpdateReady: "有新版本 {0}",
+			hostUpdateHint: "这份由桌面宿主安装和更新，市场只提醒，不在这里更新",
 			notesLink: "更新内容",
 			notesRelease: "版本说明",
 			notesCommits: "提交记录",
@@ -570,6 +573,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			setSelfUpdateReady: "New version available:",
 			setSelfUpdateHint: "Updating downloads the new version; it takes effect after a restart.",
 			setSelfUpToDateHint: "",
+			setSelfHostManagedHint: "This copy was installed by the desktop host; update it from the desktop app.",
 			setSelfUpdate: "Update",
 			setSelfUpdatedHint: "Downloaded. Restart DeepSeek Harness for it to take effect — the frontend updates at once, the server does not.",
 			setRegion: "Download region",
@@ -684,6 +688,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			updateFail: "Update failed",
 			upToDate: "Up to date",
 			linkedDev: "local",
+			hostUpdateReady: "New version {0}",
+			hostUpdateHint: "Installed and updated by the desktop host; the market only reports it",
 			notesLink: "What changed",
 			notesRelease: "Release notes",
 			notesCommits: "Commits",
@@ -1268,6 +1274,14 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 		function installedForCatalog(installed, bundles) {
 			return Object.fromEntries([...bundles.map((name) => [name, "*"]), ...Object.entries(installed)]);
 		}
+		/**
+		* A `link:` the desktop host wrote for one of its generations (#497). The
+		* test the server applies (`isGenerationLink` in sources.ts), repeated here
+		* because the client bundle cannot import server modules.
+		*/
+		function isGenerationSpec(spec) {
+			return /^link:/i.test(spec) && /(?:^|[\\/])\.generations[\\/]live[\\/]/i.test(spec);
+		}
 		function groupSwitchState(members, disabled) {
 			const list = members ?? [];
 			if (list.length === 0) return "empty";
@@ -6440,6 +6454,14 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			const [visibleCatsOneRow, setVisibleCatsOneRow] = (0, react.useState)(null);
 			const catsWrapRef = (0, react.useRef)(null);
 			const [catsStuck, setCatsStuck] = (0, react.useState)(false);
+			/** While the sticky header is pinned, expansion is this flag — not
+			* `catsOpen`. Becoming stuck collapses on the SAME render (stuckExpanded
+			* starts false) instead of a follow-up `useLayoutEffect` that flipped
+			* `catsOpen` and forced a second commit; that delayed height change is
+			* what lined up with the host Settings dialog hitching after tab 收放.
+			* An explicit chevron click while stuck sets this true and keeps
+			* `catsOpen` in sync so unstuck restores the user's choice. */
+			const [stuckExpanded, setStuckExpanded] = (0, react.useState)(false);
 			const [catsSentinel, setCatsSentinel] = (0, react.useState)(null);
 			const refreshInstalled = (0, react.useCallback)((force) => {
 				fetch(api("/dsh-market/installed"), { cache: "no-store" }).then((res) => res.json()).then((body) => {
@@ -8496,7 +8518,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 					if (leftView && root !== null && wrap !== null) {
 						if (root.scrollHeight - root.clientHeight <= wrap.offsetHeight) return;
 					}
-					setCatsStuck(leftView);
+					setCatsStuck((prev) => prev === leftView ? prev : leftView);
 				}, {
 					root: bodyRef.current,
 					threshold: 0
@@ -8504,28 +8526,14 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				observer.observe(catsSentinel);
 				return () => observer.disconnect();
 			}, [catsSentinel]);
-			/**
-			* Becoming stuck auto-collapses an open row — a REAL `catsOpen` flip, not
-			* a display-only override. An earlier version faked this by computing a
-			* separate "effectively open" value for rendering while leaving `catsOpen`
-			* itself true; the chevron's own click handler only ever toggled the real
-			* `catsOpen`, so while stuck it flipped a value the render path had
-			* already stopped consulting — clicking "expand" did nothing visible
-			* (reported: "吸顶滚动了之后，展开没反应了"). Driving the same state the
-			* chevron drives means the chevron always works, stuck or not.
-			*/
-			const catsAutoCollapsedRef = (0, react.useRef)(false);
-			(0, react.useLayoutEffect)(() => {
-				if (catsStuck) {
-					if (catsOpen) {
-						setCatsOpen(false);
-						catsAutoCollapsedRef.current = true;
-					}
-				} else if (catsAutoCollapsedRef.current) {
-					setCatsOpen(true);
-					catsAutoCollapsedRef.current = false;
-				}
+			(0, react.useEffect)(() => {
+				if (!catsStuck) setStuckExpanded(false);
 			}, [catsStuck]);
+			/** Expanded chips + chevron share one value. Stuck uses `stuckExpanded`
+			* so pinning collapses without rewriting `catsOpen` in a layout effect
+			* (see stuckExpanded state). Leaving stuck falls back to `catsOpen`,
+			* which still holds the pre-pin / in-pin user choice. */
+			const catsExpanded = catsStuck ? stuckExpanded : catsOpen;
 			/**
 			* A fresh install (hotUrls/hotNames) and a toggle/group action
 			* (refreshNames) both end in the same place — "reload the page" — and
@@ -8975,7 +8983,10 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 						className: Market_module_css_default.body,
 						ref: bodyRef,
-						onScroll: (e) => setShowTop(e.currentTarget.scrollTop > 400),
+						onScroll: (e) => {
+							const show = e.currentTarget.scrollTop > 400;
+							setShowTop((prev) => prev === show ? prev : show);
+						},
 						children: tab === "backup" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 							className: Market_module_css_default.backupGrid,
 							children: [
@@ -9257,8 +9268,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 											className: visibleCats === null ? `${Market_module_css_default.catsWrap} ${Market_module_css_default.catsCollapsed}` : Market_module_css_default.catsWrap,
 											children: (() => {
 												const budget = catsStuck ? visibleCatsOneRow : visibleCats;
-												const ordered = orderedCategories(categories, cat, catsOpen, budget);
-												const shown = catsOpen || budget === null ? ordered : ordered.slice(0, Math.max(0, budget - 1));
+												const ordered = orderedCategories(categories, cat, catsExpanded, budget);
+												const shown = catsExpanded || budget === null ? ordered : ordered.slice(0, Math.max(0, budget - 1));
 												return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
 													/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Pill, {
 														"data-chip": "1",
@@ -9276,11 +9287,12 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 														variant: "ghost",
 														size: "sm",
 														className: Market_module_css_default.catsToggle,
-														icon: catsOpen ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconChevronUpOutline14, { size: 14 }) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconChevronDownOutline14, { size: 14 }),
-														"aria-label": catsOpen ? t("catsLess") : t("catsMore"),
+														icon: catsExpanded ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconChevronUpOutline14, { size: 14 }) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconChevronDownOutline14, { size: 14 }),
+														"aria-label": catsExpanded ? t("catsLess") : t("catsMore"),
 														onClick: () => {
-															catsAutoCollapsedRef.current = false;
-															setCatsOpen((o) => !o);
+															const next = !catsExpanded;
+															if (catsStuck) setStuckExpanded(next);
+															setCatsOpen(next);
 														}
 													})
 												] });
@@ -9828,7 +9840,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 									const missing = pendingBackup !== null && !installedFiles.includes(name);
 									const entry = data === null ? void 0 : catalogEntryForInstalled(data.plugins, name, String(spec), repoIdentities[name], repoHints[name]);
 									const status = updates[name];
-									const localDev = /^(?:link|file):/i.test(String(spec)) || status?.kind === "linked";
+									const generation = status?.kind === "generation" || isGenerationSpec(String(spec));
+									const localDev = !generation && (/^(?:link|file):/i.test(String(spec)) || status?.kind === "linked");
 									const act = activations[name];
 									const meta = act !== void 0 ? activationMeta(act.state, t) : null;
 									const version = status && status.version ? "v" + status.version : "";
@@ -9949,7 +9962,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 														]
 													});
 												})(),
-												status !== void 0 && status.updateAvailable && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+												status !== void 0 && (status.updateAvailable || generation && status.latest != null) && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 													className: Market_module_css_default.noteRow,
 													children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 														type: "button",
@@ -10095,6 +10108,10 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 															className: Market_module_css_default.warnBtn,
 															disabled: true,
 															children: t("updating")
+														}) : status !== void 0 && generation && status.latest != null ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+															className: Market_module_css_default.metaTag,
+															title: t("hostUpdateHint"),
+															children: t("hostUpdateReady").replace("{0}", status.latest)
 														}) : status && status.updateAvailable ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
 															variant: "primary",
 															size: "sm",
@@ -10734,7 +10751,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				updateAvailable: own.updateAvailable === true,
 				latest: own.latest ?? null,
 				channelSwitch: own.channelSwitch ?? null,
-				restoreRequired: own.restoreRequired === true
+				restoreRequired: own.restoreRequired === true,
+				hostManaged: own.kind === "generation"
 			};
 		}
 		/**
@@ -10960,7 +10978,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			}, [post, t]);
 			/** One label + hint block with an optional action, the host's row shape. */
 			const row = (label, hint, action) => (0, react.createElement)("div", { className: Market_module_css_default.setRow }, (0, react.createElement)("div", { className: Market_module_css_default.setLabelBox }, (0, react.createElement)("div", { className: Market_module_css_default.setLabel }, label), (0, react.createElement)("div", { className: Market_module_css_default.setHint }, hint)), action);
-			const body = phase === "removed" ? row(t("setSelfRemoved"), t("setSelfRemovedHint"), null) : (0, react.createElement)(react.Fragment, null, status?.selfManaged === true ? row(update?.updateAvailable === true && update.latest !== null ? `${t("setSelfUpdateReady")} ${update.latest}` : update?.channelSwitch != null ? `${t("setChannelSwitch")} ${update.channelSwitch}` : t("setSelfUpToDate"), phase === "updated" ? t("setSelfUpdatedHint") : update?.channelSwitch != null ? t("setChannelSwitchHint") : update?.updateAvailable === true ? t("setSelfUpdateHint") : t("setSelfUpToDateHint"), phase === "updated" ? null : update?.updateAvailable === true ? (0, react.createElement)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+			const body = phase === "removed" ? row(t("setSelfRemoved"), t("setSelfRemovedHint"), null) : (0, react.createElement)(react.Fragment, null, status?.selfManaged === true ? row((update?.updateAvailable === true || update?.hostManaged === true) && update.latest !== null ? `${t("setSelfUpdateReady")} ${update.latest}` : update?.channelSwitch != null ? `${t("setChannelSwitch")} ${update.channelSwitch}` : t("setSelfUpToDate"), phase === "updated" ? t("setSelfUpdatedHint") : update?.channelSwitch != null ? t("setChannelSwitchHint") : update?.updateAvailable === true ? t("setSelfUpdateHint") : update?.hostManaged === true && update.latest !== null ? t("setSelfHostManagedHint") : t("setSelfUpToDateHint"), phase === "updated" ? null : update?.updateAvailable === true ? (0, react.createElement)(_deepseek_ai_dsh_client_ui_primitives.Button, {
 				variant: "primary",
 				size: "sm",
 				disabled: busy,

package/lib/discovery-compatibility.js

@@ -36,6 +36,12 @@ function record(value) {
 export function manifestFacts(value) {
     const manifest = record(value) ?? {};
     const engines = record(manifest.engines);
+    // #577: the ecosystem declares the host requirement in BOTH shapes —
+    // top-level `engines.dsh` and `dsh.engines.dsh` under the manifest's own
+    // `dsh` field (the natural home, and what e.g. @linxin666/dsh-web-all
+    // publishes). Neither position is authoritative, so read both; when a
+    // manifest carries both, the top-level declaration wins.
+    const dshEngines = record(record(manifest.dsh)?.engines);
     const peers = record(manifest.peerDependencies);
     const peerDependencies = {};
     for (const [name, raw] of Object.entries(peers ?? {})) {
@@ -47,7 +53,7 @@ export function manifestFacts(value) {
     }
     return {
         version: range(manifest.version),
-        enginesDsh: range(engines?.dsh),
+        enginesDsh: range(engines?.dsh) ?? range(dshEngines?.dsh),
         peerDependencies,
     };
 }

package/lib/install.js

@@ -97,7 +97,7 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
             logEvent('warn', 'install', `a too-young release blocks pnpm's lockfile verification (#39) — retrying once with ${RELEASE_AGE_OVERRIDE}`);
             result = await run(profile, [pluginArgs[0], RELEASE_AGE_OVERRIDE, ...pluginArgs.slice(1)]);
         }
-        else if (failure?.code === 'fetch-404'
+        else if ((failure?.code === 'fetch-404' || failure?.code === 'no-matching-version')
             && isUnpublishedHostPeer(failure.pkg, profile, profileDirectory)
             && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')
             && !pluginArgs.includes(AUTO_INSTALL_PEERS_OFF)) {

package/lib/pnpm-compat.js

@@ -341,6 +341,29 @@ export function classifyPnpmFailure(output, exitCode) {
             message: `有一个依赖在 registry 上不存在${zh}，pnpm 因此拒绝任何安装操作。它可能是之前失败操作残留在 profile package.json 里的幽灵依赖（可手动删除该行），也可能是需要登录的私有包 / a dependency cannot be resolved from the registry${en}; pnpm refuses every install while it is present. It may be a ghost entry left in the profile's package.json by an earlier failed operation (remove that line by hand), or a private package needing registry credentials`,
         };
     }
+    // #569: a host peer that only ever published pre-releases (e.g.
+    // `@deepseek-ai/dsh-tools` with nothing above `-rc.*`) resolves to NO
+    // stable version, and pnpm reports ERR_PNPM_NO_MATCHING_VERSION — the
+    // package exists, the requested range matches nothing. This is the same
+    // unpublished-host-peer shape #289 recovers from, just with a different
+    // error code, so the classifier names it separately and the #289 retry
+    // shares it via install.ts's gate. Real output (pnpm 12.4.1): see
+    // tests/pnpm-compat.spec.ts, which pins this wording.
+    if (output.includes('ERR_PNPM_NO_MATCHING_VERSION')) {
+        const pkg = /No matching version found for\s+((?:@[^/\s]+\/)?[^@\s]+)@/.exec(output)?.[1]
+            ?? /GET\s+\S*\/([^/\s]+):/.exec(output)?.[1].replace(/%2[Ff]/g, '/');
+        const zh = pkg === undefined ? '' : `（${pkg}）`;
+        const en = pkg === undefined ? '' : ` (${pkg})`;
+        const hostPeer = pkg !== undefined && HOST_NAMESPACE_RE.test(pkg);
+        return {
+            code: 'no-matching-version',
+            recoverable: false,
+            pkg,
+            message: hostPeer
+                ? `插件声明依赖的宿主包${zh}在 registry 上没有满足其版本范围的发布版（宿主运行时会自带它，npm 上不会出现这个版本）。市场会自动重试一次，放行这条 peer 依赖 / a plugin's declared host peer${en} has no published version satisfying its range — the runtime provides it, so npm carries no such version. The market retries once with that peer exempted from auto-install`
+                : `插件声明的一个依赖版本范围在 registry 上没有可满足的版本${zh}，通常是该版本被弃用或从未发布 / a dependency of this plugin declared a version range with no matching release on the registry${en} — the range resolves to nothing (withdrawn or never published)`,
+        };
+    }
     // #389 by @qq1054435284: on Windows, pnpm stages the new version in a
     // sibling `<name>_tmp_<pid>_<n>` directory and renames it over the old one.
     // Windows refuses that rename while any file underneath the target is open,

package/lib/profile.js

@@ -7,7 +7,7 @@ import { existsSync, readdirSync, readFileSync, realpathSync, renameSync, statSy
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 import { resolveDshHome } from './home-paths.js';
-import { githubRemoteIdentities, githubRepoIdentities } from './sources.js';
+import { githubRemoteIdentities, githubRepoIdentities, isGitHostedSpec } from './sources.js';
 /**
  * Whether a profile name follows DSH's own directory-name contract.
  *
@@ -408,12 +408,41 @@ export function readInstalledRepoIdentities(profile, name, spec, explicitDir) {
  * Discover declared repository identities and weaker local-origin hints. A
  * package.json repository declaration is authoritative; Git origin is only a
  * disambiguation hint because a checkout may legitimately point at a fork.
+ *
+ * Read for local AND registry specs, but never for a spec that already names
+ * its own source (#544 by @QinYupan; boundary from @bulingbuling688 in #548).
+ *
+ * The bug: two same-named catalog entries and an ordinary npm install. The
+ * manifest's `repository` — `git+https://github.com/MrmoLabs/dsh-mermaid.git`
+ * — is the one fact that says WHICH of the two is installed, and it sits in
+ * the same package.json for an npm install as for a local one. This returned
+ * empty for anything not `link:`/`file:`, so the client fell back to name
+ * matching, found two candidates, and matched NEITHER: the Discover card kept
+ * offering Install on a plugin that was running.
+ *
+ * Why a `github:`/URL install must NOT be read the same way: its spec already
+ * states the source, and the manifest can disagree with it. A fork installed
+ * as `github:myfork/plugin` usually still declares the UPSTREAM repository,
+ * because almost nobody edits that field when forking. Adding it as an
+ * identity made the upstream's card read as installed — measured, and the
+ * same mistake as #485: a weaker signal allowed to outvote a definite one.
+ * The first version of this fix widened to every spec kind and had exactly
+ * that hole.
+ *
+ * What stays local-only for the same reason it always was: the git-origin
+ * hint (there is no checkout to read for a registry install) and the local
+ * source directory walk.
  */
 export function readInstalledRepoEvidence(profile, name, spec, explicitDir) {
-    if (!PACKAGE_NAME_RE.test(name) || !/^(?:link|file):/i.test(spec))
+    if (!PACKAGE_NAME_RE.test(name))
+        return { identities: [], hints: [] };
+    const local = /^(?:link|file):/i.test(spec);
+    // A spec that names its own source is the authority on it; see above.
+    if (!local && (isGitHostedSpec(spec) || /^https?:/i.test(spec.trim()))) {
         return { identities: [], hints: [] };
+    }
     const root = profileDir(profile, explicitDir);
-    const sourceDir = localSpecDirectory(root, spec);
+    const sourceDir = local ? localSpecDirectory(root, spec) : null;
     const installedDir = installedPackageDirectory(root, name);
     const manifestDir = installedDir ?? sourceDir;
     const manifest = manifestDir === null ? readInstalledManifest(profile, name, explicitDir) : manifestAt(manifestDir);

package/lib/routes.js

@@ -28,7 +28,7 @@ import { applyBundleOrder, mergeOrder, readBundleRules, readBundleStack, validat
 import { applyPreset, deletePreset, listPresets, previewPreset, savePreset } from './presets.js';
 import { createProfileSnapshot, DEFAULT_MAX_SNAPSHOTS, deleteSnapshot, listSnapshots, restoreSnapshot } from './snapshot.js';
 import { trialValidate } from './trial.js';
-import { codeloadAllowBuildsKey, findCatalogEntryForLocal, findInstalledAlias, githubCommitOfTarget, githubTargetAtCommit, gitAllowBuildsKey, gitUpdateTarget, installTargetFor, isLocalSpec, NPM_NAME_RE, repoOfTarget, restoreBlockedByWorkspace, restoreTargetForLocal, workspaceProtocolDeps } from './sources.js';
+import { codeloadAllowBuildsKey, findCatalogEntryForLocal, findInstalledAlias, githubCommitOfTarget, githubTargetAtCommit, gitAllowBuildsKey, gitUpdateTarget, installTargetFor, isGenerationLink, isLocalSpec, NPM_NAME_RE, repoOfTarget, restoreBlockedByWorkspace, restoreTargetForLocal, workspaceProtocolDeps } from './sources.js';
 import { failureDetail, groupConflictsByOwner, isStaleUpdate, parseIgnoredBuilds, parsePrepareNotAllowed, pnpmNeverStarted, RELEASE_AGE_OVERRIDE, retargetCollections, validateAddedPlugins, withHoistRecovery } from './install.js';
 import { asChannel, CHANNELS, DIST_TAG, resolveChannel } from './channels.js';
 import { asRegion, githubProxyManaged, normalizeGithubProxy, REGIONS, routesFor, setActiveRegion, setCustomGithubProxy, } from './regions.js';
@@ -433,14 +433,31 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
         return { changed: [...changed], partial: changed.size > 0 };
     }
     /**
-     * Apply one enable/disable request: persist the choice in state.json, then
-     * drive the live composition. Covers every mount form — hot mounts and
-     * client-only shims go through hotUnmount/hotMount, bundle-layer entries
-     * through setEntryDisabled. Enabling a THEME goes through the caller's
-     * activateTheme instead so the Themes tab's exclusivity stays intact.
+     * Apply one enable/disable request: drive the live composition, then
+     * persist the choice in state.json. Covers every mount form — hot mounts
+     * and client-only shims go through hotUnmount/hotMount, bundle-layer
+     * entries through setEntryDisabled. Enabling a THEME goes through the
+     * caller's activateTheme instead so the Themes tab's exclusivity stays
+     * intact.
+     *
+     * A FAILED ENABLE LEAVES EVERYTHING AS IT WAS (#575). The choice used to be
+     * recorded before the mount was attempted and persisted whatever happened,
+     * so enabling a plugin that crashes on import — deterministically, every
+     * time — wrote "enabled" into state.json anyway. The next boot tried the
+     * import again and died again; the reporter measured 24 restarts before
+     * restoring the disable by hand. The toggle route's patch-layer gate
+     * (@JINITAIMEI121 in #584) closed the same hole in cordis.patch.yml; this
+     * closes it in the market's own store, which is the ONLY durable state a
+     * client-only plugin has — that plugin kind has no bundle rows, so the
+     * patch gate never runs for it.
+     *
+     * A failed DISABLE still persists, and that asymmetry is deliberate: the
+     * user asked for OFF, and a failed unmount leaves the plugin live only for
+     * this session. There the durable disable is the contract, not an error.
      */
     async function setPluginEnabled(name, enabled) {
         const dir = activeProfileDir;
+        const wasDisabled = disabled.has(name);
         if (enabled)
             disabled.delete(name);
         else
@@ -474,6 +491,14 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                 ok = true;
             }
         }
+        if (!ok && enabled) {
+            // Put the in-memory view back before persisting: it is the same object
+            // the route reports as `disabled`, so restoring it keeps the reply, the
+            // store and the patch layer telling one story.
+            if (wasDisabled)
+                disabled.add(name);
+            logEvent('warn', 'toggle', `${name}: enable failed; leaving it disabled rather than persisting a state that crashes at boot (#575)`);
+        }
         writeMarketState(dir, { disabled, groups, groupOrder });
         return { ok, reason };
     }
@@ -1048,6 +1073,20 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
             return false;
         }
     };
+    /**
+     * The npm package an install with no registry spec of its own is compared
+     * against: a `file:` package matched to the catalog (#429), or a
+     * generation the desktop host linked in (#497). Null for everything else
+     * — a developer's own `link:` checkout is never compared online.
+     */
+    const onlineSourceOf = (plugins, name, spec) => {
+        if (!spec.toLowerCase().startsWith('file:') && !isGenerationLink(spec))
+            return null;
+        const evidence = readInstalledRepoEvidence(config.profile, name, spec, activeProfileDir);
+        const entry = findCatalogEntryForLocal(plugins, name, evidence.identities, evidence.hints);
+        const target = entry === null ? null : restoreTargetForLocal(entry, evidence.identities);
+        return target !== null && NPM_NAME_RE.test(target) ? target : null;
+    };
     const disposers = [
         host.webServer.register({
             kind: 'exact',
@@ -1109,7 +1148,22 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                         const force = forceCheckFrom(request);
                         const channel = activeChannel();
                         const channelFor = SELF_NAMES.has(name) ? new Map([[name, channel]]) : undefined;
-                        const update = (await checkUpdates(config.profile, force, activeProfileDir, channelFor))[name];
+                        // The same source lookup the market page makes, so a generation
+                        // (#497) or a catalog-matched local package answers here with the
+                        // release it can be compared against rather than with nothing.
+                        const spec = readInstalled(config.profile, activeProfileDir)[name];
+                        const onlineSourceFor = new Map();
+                        if (spec !== undefined && (spec.toLowerCase().startsWith('file:') || isGenerationLink(spec))) {
+                            try {
+                                const source = onlineSourceOf((await loadRegistry()).plugins, name, spec);
+                                if (source !== null)
+                                    onlineSourceFor.set(name, source);
+                            }
+                            catch (error) {
+                                logEvent('warn', 'updates', `package source lookup failed — ${error instanceof Error ? error.message : String(error)}`);
+                            }
+                        }
+                        const update = (await checkUpdates(config.profile, force, activeProfileDir, channelFor, onlineSourceFor))[name];
                         if (update === undefined) {
                             sendJson(response, 404, { schema: UPDATE_API_V1_SCHEMA, error: 'plugin is not installed' });
                             return;
@@ -1975,7 +2029,18 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                             }
                         }
                         let patchWrite = null;
-                        if (patchRows.length > 0) {
+                        // #575: a failed ENABLE must not flip the durable patch layer.
+                        // The hot-mount failure may be deterministic (a plugin that
+                        // crashes on import), and persisting "enabled" turns a transient
+                        // in-session error into a boot crash loop — the loader re-applies
+                        // the flipped rows on every start. The frontend already shows the
+                        // plugin as still disabled, and the next explicit enable retries
+                        // cleanly. Disables keep their unconditional write: a failed
+                        // unmount leaves the plugin live in-session, and the user asked
+                        // for it OFF — the durable disable is then the contract, not an
+                        // error.
+                        const patchGate = ok || !enabled;
+                        if (patchRows.length > 0 && patchGate) {
                             for (const rowId of patchRows) {
                                 const result = enabled ? await enableRow(userPatchPath, rowId) : await disableRow(userPatchPath, rowId);
                                 if (!result.ok && patchWrite === null)
@@ -2373,13 +2438,9 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                             const migration = findGitToNpmMigration(registry.plugins, spec);
                             if (migration !== null)
                                 sourceMigrationFor.set(name, migration);
-                            if (!spec.toLowerCase().startsWith('file:'))
-                                continue;
-                            const evidence = readInstalledRepoEvidence(config.profile, name, spec, activeProfileDir);
-                            const entry = findCatalogEntryForLocal(registry.plugins, name, evidence.identities, evidence.hints);
-                            const target = entry === null ? null : restoreTargetForLocal(entry, evidence.identities);
-                            if (target !== null && NPM_NAME_RE.test(target))
-                                onlineSourceFor.set(name, target);
+                            const source = onlineSourceOf(registry.plugins, name, spec);
+                            if (source !== null)
+                                onlineSourceFor.set(name, source);
                         }
                     }
                     catch (error) {

package/lib/sources.js

@@ -492,6 +492,18 @@ export function gitUploadPackUrl(spec) {
     const base = url.toString().replace(/\/+$/, '');
     return `${base}/info/refs?service=git-upload-pack`;
 }
+/**
+ * A `link:` that points into a generation the desktop host materialised
+ * (#497): `link:../.generations/live/<pkg>+<version>+<hash>/node_modules/<pkg>`.
+ * That is the host's production install, not a developer's checkout — it
+ * came from the registry and has releases to compare against. The host
+ * recognises its own installs by the `.generations/live/` segment, and no
+ * hand-written link ever lands under that directory, so the same test is
+ * enough here.
+ */
+export function isGenerationLink(spec) {
+    return /^link:/i.test(spec) && /(?:^|[\\/])\.generations[\\/]live[\\/]/i.test(spec);
+}
 export { findCatalogEntryForLocal, resolveCatalogRestore } from './catalog-local-match.js';
 /**
  * pnpm add target for restoring a local checkout onto a catalog entry.

package/lib/types/pnpm-compat.d.ts

@@ -33,7 +33,7 @@ export declare function pluginArgsFor(profileDir: string, pluginArgs: string[]):
  */
 export declare const HOST_NAMESPACE_RE: RegExp;
 export interface PnpmFailure {
-    code: 'adding-to-root' | 'not-a-workspace' | 'hoist-pattern-diff' | 'pnpm-missing' | 'release-age-violation' | 'ignored-builds' | 'git-prepare-not-allowed' | 'git-prepare-failed' | 'tarball-url-mismatch' | 'fetch-404' | 'transient-network' | 'fetch-timeout' | 'unexpected-store' | 'patch-failed' | 'missing-tarball-integrity' | 'windows-file-locked' | 'pnpm-unusable' | 'missing-local-dependency';
+    code: 'adding-to-root' | 'not-a-workspace' | 'hoist-pattern-diff' | 'pnpm-missing' | 'release-age-violation' | 'ignored-builds' | 'git-prepare-not-allowed' | 'git-prepare-failed' | 'tarball-url-mismatch' | 'fetch-404' | 'no-matching-version' | 'transient-network' | 'fetch-timeout' | 'unexpected-store' | 'patch-failed' | 'missing-tarball-integrity' | 'windows-file-locked' | 'pnpm-unusable' | 'missing-local-dependency';
     /** Bilingual, actionable message shown to the user instead of the raw wall of text. */
     message: string;
     /** True when re-running `pnpm install` in the profile is the documented recovery. */

package/lib/types/profile.d.ts

@@ -121,6 +121,30 @@ export interface InstalledRepoEvidence {
  * Discover declared repository identities and weaker local-origin hints. A
  * package.json repository declaration is authoritative; Git origin is only a
  * disambiguation hint because a checkout may legitimately point at a fork.
+ *
+ * Read for local AND registry specs, but never for a spec that already names
+ * its own source (#544 by @QinYupan; boundary from @bulingbuling688 in #548).
+ *
+ * The bug: two same-named catalog entries and an ordinary npm install. The
+ * manifest's `repository` — `git+https://github.com/MrmoLabs/dsh-mermaid.git`
+ * — is the one fact that says WHICH of the two is installed, and it sits in
+ * the same package.json for an npm install as for a local one. This returned
+ * empty for anything not `link:`/`file:`, so the client fell back to name
+ * matching, found two candidates, and matched NEITHER: the Discover card kept
+ * offering Install on a plugin that was running.
+ *
+ * Why a `github:`/URL install must NOT be read the same way: its spec already
+ * states the source, and the manifest can disagree with it. A fork installed
+ * as `github:myfork/plugin` usually still declares the UPSTREAM repository,
+ * because almost nobody edits that field when forking. Adding it as an
+ * identity made the upstream's card read as installed — measured, and the
+ * same mistake as #485: a weaker signal allowed to outvote a definite one.
+ * The first version of this fix widened to every spec kind and had exactly
+ * that hole.
+ *
+ * What stays local-only for the same reason it always was: the git-origin
+ * hint (there is no checkout to read for a registry install) and the local
+ * source directory walk.
  */
 export declare function readInstalledRepoEvidence(profile: string, name: string, spec: string, explicitDir?: string): InstalledRepoEvidence;
 /** Pinned commit per `owner/repo` from the profile lockfile's codeload tarball URLs. */

package/lib/types/sources.d.ts

@@ -177,6 +177,16 @@ export declare function gitUpdateTarget(spec: string): string | null;
  * Userinfo is stripped so update checks do not resend embedded credentials.
  */
 export declare function gitUploadPackUrl(spec: string): string | null;
+/**
+ * A `link:` that points into a generation the desktop host materialised
+ * (#497): `link:../.generations/live/<pkg>+<version>+<hash>/node_modules/<pkg>`.
+ * That is the host's production install, not a developer's checkout — it
+ * came from the registry and has releases to compare against. The host
+ * recognises its own installs by the `.generations/live/` segment, and no
+ * hand-written link ever lands under that directory, so the same test is
+ * enough here.
+ */
+export declare function isGenerationLink(spec: string): boolean;
 export { findCatalogEntryForLocal, resolveCatalogRestore } from './catalog-local-match.ts';
 /**
  * pnpm add target for restoring a local checkout onto a catalog entry.

package/lib/types/updates.d.ts

@@ -5,7 +5,14 @@
  */
 import { type Channel } from './channels.ts';
 export interface UpdateStatus {
-    kind: 'github' | 'npm' | 'linked';
+    /**
+     * `generation` is a `link:` the desktop host wrote (#497): the host
+     * installs it and reconciles it at startup, so the market names a newer
+     * release under `latest` and never offers to apply it. For that kind
+     * `latest` is null when the installed build is current or nothing newer
+     * can be confirmed.
+     */
+    kind: 'github' | 'npm' | 'linked' | 'generation';
     version: string | null;
     current: string | null;
     latest: string | null;
@@ -116,8 +123,9 @@ export declare function checkUpdates(profile: string, force?: boolean, explicitD
  */
 channelFor?: ReadonlyMap<string, Channel>, 
 /**
- * Curated npm sources for `file:` installs that were matched to the market
- * catalog. `link:` workspaces remain development sources and are never
- * opted into online updates.
+ * Curated npm sources for the installs that carry no registry spec of
+ * their own: `file:` packages matched to the market catalog (#429) and
+ * the generations the desktop host links in (#497). Any other `link:` is
+ * a development workspace and is never opted into online updates.
  */
 onlineSourceFor?: ReadonlyMap<string, string>): Promise<Record<string, UpdateStatus>>;

package/lib/updates.js

@@ -8,7 +8,7 @@ import { resolveHeadCommit } from './accelerate.js';
 import { marketFetch } from './net.js';
 import { activeRegion } from './regions.js';
 import { profileDir, readGitResolutionCommit, readInstalled, readInstalledVersion, readLockCommits } from './profile.js';
-import { gitCommitOfTarget, gitUploadPackUrl, githubCommitOfTarget, githubRefOfTarget, isGitHostedSpec, repoOfTarget } from './sources.js';
+import { gitCommitOfTarget, gitUploadPackUrl, githubCommitOfTarget, githubRefOfTarget, isGenerationLink, isGitHostedSpec, repoOfTarget } from './sources.js';
 const UPDATES_TTL_MS = 30 * 60 * 1000;
 const GIT_REMOTE_HEAD_TIMEOUT_MS = 6000;
 let updatesCache = null;
@@ -254,9 +254,10 @@ export async function checkUpdates(profile, force = false, explicitDir,
  */
 channelFor = new Map(), 
 /**
- * Curated npm sources for `file:` installs that were matched to the market
- * catalog. `link:` workspaces remain development sources and are never
- * opted into online updates.
+ * Curated npm sources for the installs that carry no registry spec of
+ * their own: `file:` packages matched to the market catalog (#429) and
+ * the generations the desktop host links in (#497). Any other `link:` is
+ * a development workspace and is never opted into online updates.
  */
 onlineSourceFor = new Map()) {
     const activeProfileDir = profileDir(profile, explicitDir);
@@ -289,6 +290,28 @@ onlineSourceFor = new Map()) {
             return;
         }
         if (normalizedSpec.startsWith('link:')) {
+            if (isGenerationLink(spec)) {
+                // The desktop host's production install, not a checkout (#497): it
+                // came from the registry and has a release history to compare
+                // against. Reported, never offered — the host reconciles `live/`
+                // against its own desired.json at startup, so an update applied
+                // here would appear to work and silently revert on the next boot.
+                // Only a release that is actually newer is named; current and
+                // unknown both read as null, so a lagging `latest` tag (#64) can't
+                // advertise a downgrade either.
+                const onlineSource = onlineSourceFor.get(name);
+                const stable = onlineSource === undefined ? null : await fetchNpmLatest(onlineSource);
+                const channel = channelFor.get(name);
+                const newest = channel === undefined || onlineSource === undefined
+                    ? stable
+                    : await versionOnChannel(onlineSource, channel, stable);
+                result[name] = {
+                    kind: 'generation', version, current: version,
+                    latest: isUpgrade(version, newest) ? newest : null,
+                    updateAvailable: false,
+                };
+                return;
+            }
             result[name] = { kind: 'linked', version, current: null, latest: null, updateAvailable: false };
             return;
         }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.45.1",
+  "version": "1.46.1",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/client/MarketSection.tsx

@@ -42,7 +42,7 @@ import type { OperationRecord } from './operations.ts'
 import { Diagnostics } from './Diagnostics.tsx'
 import { exportMarketLog } from './self-check.ts'
 import {
-  api, applyGithubRouting, avatarColor, catalogEntryForInstalled, entryForDep, githubRouteCandidates, groupSwitchState, humanOutput, installedForCatalog, isInstalled, looksTerminal, matchInstalledName, orderedCategories, pluginCategories,
+  api, applyGithubRouting, avatarColor, catalogEntryForInstalled, entryForDep, githubRouteCandidates, groupSwitchState, humanOutput, installedForCatalog, isGenerationSpec, isInstalled, looksTerminal, matchInstalledName, orderedCategories, pluginCategories,
   formatCount, pageItems, pluginName, pluginScreenshotCandidates, pluginScreenshots, pluginsForFavorites, rankThemeScreenshots, readSession, rememberGithubRoute, resetScreenshotsCache, resolveCatalogRestore, safeScreenshots, staleFavoriteUrls, themePlugins as themePluginsOf, themeSwatch, TIME_RANGE_DAYS, visiblePlugins,
 } from './market-data.ts'
 import type {
@@ -1542,6 +1542,14 @@ export function MarketSection(props: MarketSectionProps) {
   // (padding, sticky `top`), which drifts silently whenever that CSS
   // changes. The sentinel just reports what's actually true on screen.
   const [catsStuck, setCatsStuck] = useState(false)
+  /** While the sticky header is pinned, expansion is this flag — not
+   * `catsOpen`. Becoming stuck collapses on the SAME render (stuckExpanded
+   * starts false) instead of a follow-up `useLayoutEffect` that flipped
+   * `catsOpen` and forced a second commit; that delayed height change is
+   * what lined up with the host Settings dialog hitching after tab 收放.
+   * An explicit chevron click while stuck sets this true and keeps
+   * `catsOpen` in sync so unstuck restores the user's choice. */
+  const [stuckExpanded, setStuckExpanded] = useState(false)
   const [catsSentinel, setCatsSentinel] = useState<HTMLDivElement | null>(null)
 
   const refreshInstalled = useCallback((force?: boolean) => {
@@ -3638,32 +3646,23 @@ export function MarketSection(props: MarketSectionProps) {
           const overflow = root.scrollHeight - root.clientHeight
           if (overflow <= wrap.offsetHeight) return
         }
-        setCatsStuck(leftView)
+        setCatsStuck(prev => (prev === leftView ? prev : leftView))
       },
       { root: bodyRef.current, threshold: 0 },
     )
     observer.observe(catsSentinel)
     return () => observer.disconnect()
   }, [catsSentinel])
-  /**
-   * Becoming stuck auto-collapses an open row — a REAL `catsOpen` flip, not
-   * a display-only override. An earlier version faked this by computing a
-   * separate "effectively open" value for rendering while leaving `catsOpen`
-   * itself true; the chevron's own click handler only ever toggled the real
-   * `catsOpen`, so while stuck it flipped a value the render path had
-   * already stopped consulting — clicking "expand" did nothing visible
-   * (reported: "吸顶滚动了之后，展开没反应了"). Driving the same state the
-   * chevron drives means the chevron always works, stuck or not.
-   */
-  const catsAutoCollapsedRef = useRef(false)
-  useLayoutEffect(() => {
-    if (catsStuck) {
-      if (catsOpen) { setCatsOpen(false); catsAutoCollapsedRef.current = true }
-    } else if (catsAutoCollapsedRef.current) {
-      setCatsOpen(true)
-      catsAutoCollapsedRef.current = false
-    }
+  // Drop any in-pin expand once the header unpins, so the next pin starts
+  // collapsed without a rising-edge setState in the observer.
+  useEffect(() => {
+    if (!catsStuck) setStuckExpanded(false)
   }, [catsStuck])
+  /** Expanded chips + chevron share one value. Stuck uses `stuckExpanded`
+   * so pinning collapses without rewriting `catsOpen` in a layout effect
+   * (see stuckExpanded state). Leaving stuck falls back to `catsOpen`,
+   * which still holds the pre-pin / in-pin user choice. */
+  const catsExpanded = catsStuck ? stuckExpanded : catsOpen
 
   /**
    * A fresh install (hotUrls/hotNames) and a toggle/group action
@@ -4011,7 +4010,10 @@ export function MarketSection(props: MarketSectionProps) {
       <div
         className={css.body}
         ref={bodyRef}
-        onScroll={e => setShowTop(e.currentTarget.scrollTop > 400)}
+        onScroll={e => {
+          const show = e.currentTarget.scrollTop > 400
+          setShowTop(prev => (prev === show ? prev : show))
+        }}
       >
         {tab === 'backup'
           ? (
@@ -4168,12 +4170,12 @@ export function MarketSection(props: MarketSectionProps) {
                         {(() => {
                           // Collapsed, the selected category is pulled to the front so it never hides.
                           // Whenever collapsed (default, or auto-collapsed by the sticky
-                          // header going stuck — see catsAutoCollapsedRef above), a stuck
+                          // header going stuck — see catsExpanded / stuckExpanded), a stuck
                           // header uses the one-row budget instead of the two-row one so an
                           // already-open list that just got pinned shrinks further.
                           const budget = catsStuck ? visibleCatsOneRow : visibleCats
-                          const ordered = orderedCategories(categories, cat, catsOpen, budget)
-                          const shown = catsOpen || budget === null ? ordered : ordered.slice(0, Math.max(0, budget - 1))
+                          const ordered = orderedCategories(categories, cat, catsExpanded, budget)
+                          const shown = catsExpanded || budget === null ? ordered : ordered.slice(0, Math.max(0, budget - 1))
                           return (
                             <>
                               <Pill data-chip="1" active={cat === 'all'} onClick={() => setCat('all')}>{t('all') + ' (' + formatCount(data!.count) + ')'}</Pill>
@@ -4189,13 +4191,12 @@ export function MarketSection(props: MarketSectionProps) {
                                 variant="ghost"
                                 size="sm"
                                 className={css.catsToggle}
-                                icon={catsOpen ? <IconChevronUpOutline14 size={14} /> : <IconChevronDownOutline14 size={14} />}
-                                aria-label={catsOpen ? t('catsLess') : t('catsMore')}
+                                icon={catsExpanded ? <IconChevronUpOutline14 size={14} /> : <IconChevronDownOutline14 size={14} />}
+                                aria-label={catsExpanded ? t('catsLess') : t('catsMore')}
                                 onClick={() => {
-                                  // An explicit click always wins — don't let the next
-                                  // stuck/unstuck transition second-guess it.
-                                  catsAutoCollapsedRef.current = false
-                                  setCatsOpen(o => !o)
+                                  const next = !catsExpanded
+                                  if (catsStuck) setStuckExpanded(next)
+                                  setCatsOpen(next)
                                 }}
                               />
                             </>
@@ -4592,7 +4593,13 @@ export function MarketSection(props: MarketSectionProps) {
                             const missing = pendingBackup !== null && !installedFiles.includes(name)
                             const entry = data === null ? undefined : catalogEntryForInstalled(data.plugins, name, String(spec), repoIdentities[name], repoHints[name])
                             const status = updates[name]
-                            const localDev = /^(?:link|file):/i.test(String(spec)) || status?.kind === 'linked'
+                            // A generation is the desktop host's own install (#497):
+                            // the host updates it, the market only says a newer
+                            // release exists. Not a development checkout, so no
+                            // "local" tag and no restore — the host would put the
+                            // generation straight back.
+                            const generation = status?.kind === 'generation' || isGenerationSpec(String(spec))
+                            const localDev = !generation && (/^(?:link|file):/i.test(String(spec)) || status?.kind === 'linked')
                             const act = activations[name]
                             const meta = act !== undefined ? activationMeta(act.state, t) : null
                             const version = status && status.version ? 'v' + status.version : ''
@@ -4706,7 +4713,7 @@ export function MarketSection(props: MarketSectionProps) {
                                       one quiet line in the flow the row already
                                       reserves for conditional content, so rows
                                       without it are pixel-identical to before. */}
-                                  {status !== undefined && status.updateAvailable && (
+                                  {status !== undefined && (status.updateAvailable || (generation && status.latest != null)) && (
                                     <div className={css.noteRow}>
                                       <button
                                         type="button"
@@ -4848,6 +4855,8 @@ export function MarketSection(props: MarketSectionProps) {
                                     ? <span className={`${css.metaTag} ${css.metaTagOk}`}>{act?.state === 'live' ? t('updatedLive') : t('updated')}</span>
                                     : updatingName === name
                                       ? <Button variant="primary" size="sm" className={css.warnBtn} disabled>{t('updating')}</Button>
+                                      : status !== undefined && generation && status.latest != null
+                                        ? <span className={css.metaTag} title={t('hostUpdateHint')}>{t('hostUpdateReady').replace('{0}', status.latest)}</span>
                                       : status && status.updateAvailable
                                         ? (
                                             <Button

package/src/client/SettingsCard.tsx

@@ -105,12 +105,14 @@ interface SelfUpdate {
   channelSwitch: string | null
   /** The current build came from a local package and must switch to the online release. */
   restoreRequired: boolean
+  /** A generation the desktop host installed (#497): a newer release is named here, never applied from here. */
+  hostManaged: boolean
 }
 
 type Phase = 'idle' | 'confirming' | 'working' | 'removed' | 'updated' | 'failed'
 
 /** The market's own row as api('/dsh-market/updates') sends it. */
-interface RawUpdate { updateAvailable?: boolean; latest?: string; channelSwitch?: string; restoreRequired?: boolean }
+interface RawUpdate { updateAvailable?: boolean; latest?: string; channelSwitch?: string; restoreRequired?: boolean; kind?: string }
 
 const CHANNELS: Channel[] = ['stable', 'beta', 'dev']
 const asChannel = (value: unknown): Channel | null =>
@@ -168,6 +170,7 @@ function readUpdate(own: RawUpdate): SelfUpdate {
     latest: own.latest ?? null,
     channelSwitch: own.channelSwitch ?? null,
     restoreRequired: own.restoreRequired === true,
+    hostManaged: own.kind === 'generation',
   }
 }
 
@@ -404,7 +407,7 @@ export function SettingsCard({ t, onRemoved }: SettingsCardProps): ReactElement
           // An older offer is not an update, and calling it one would have
           // the user click "更新" to go backwards. It IS what picking an
           // earlier channel asked for, so it is offered — under its own name.
-          update?.updateAvailable === true && update.latest !== null
+          (update?.updateAvailable === true || update?.hostManaged === true) && update.latest !== null
             ? `${t('setSelfUpdateReady')} ${update.latest}`
             : update?.channelSwitch != null
               ? `${t('setChannelSwitch')} ${update.channelSwitch}`
@@ -416,7 +419,10 @@ export function SettingsCard({ t, onRemoved }: SettingsCardProps): ReactElement
               // Explains what the Update button does — only worth saying
               // when that button is actually on screen. Already up to date,
               // it read as an instruction for an action that wasn't there.
-              : update?.updateAvailable === true ? t('setSelfUpdateHint') : t('setSelfUpToDateHint'),
+              : update?.updateAvailable === true ? t('setSelfUpdateHint')
+                // Named, not offered: the desktop host owns this install.
+                : update?.hostManaged === true && update.latest !== null ? t('setSelfHostManagedHint')
+                  : t('setSelfUpToDateHint'),
           phase === 'updated'
             ? null
             : update?.updateAvailable === true

package/src/client/locales.ts

@@ -7,6 +7,7 @@ export const zh = {
   setSelfUpdateReady: '有新版本',
   setSelfUpdateHint: '更新会下载新版本，重启后生效。',
   setSelfUpToDateHint: '',
+  setSelfHostManagedHint: '这份市场由桌面宿主安装，新版本请在桌面端更新。',
   setSelfUpdate: '更新',
   setSelfUpdatedHint: '已下载完成。重启 DeepSeek Harness 后新版本才会生效——前端页面会立即更新，服务端不会。',
   setRegion: '下载区域',
@@ -121,6 +122,8 @@ export const zh = {
   updateFail: '更新失败',
   upToDate: '已是最新',
   linkedDev: '本地开发',
+  hostUpdateReady: '有新版本 {0}',
+  hostUpdateHint: '这份由桌面宿主安装和更新，市场只提醒，不在这里更新',
   notesLink: '更新内容',
   notesRelease: '版本说明',
   notesCommits: '提交记录',
@@ -545,6 +548,7 @@ export const en: Record<MarketKey, string> = {
   setSelfUpdateReady: 'New version available:',
   setSelfUpdateHint: 'Updating downloads the new version; it takes effect after a restart.',
   setSelfUpToDateHint: '',
+  setSelfHostManagedHint: 'This copy was installed by the desktop host; update it from the desktop app.',
   setSelfUpdate: 'Update',
   setSelfUpdatedHint: 'Downloaded. Restart DeepSeek Harness for it to take effect — the frontend updates at once, the server does not.',
   setRegion: 'Download region',
@@ -659,6 +663,8 @@ export const en: Record<MarketKey, string> = {
   updateFail: 'Update failed',
   upToDate: 'Up to date',
   linkedDev: 'local',
+  hostUpdateReady: 'New version {0}',
+  hostUpdateHint: 'Installed and updated by the desktop host; the market only reports it',
   notesLink: 'What changed',
   notesRelease: 'Release notes',
   notesCommits: 'Commits',

package/src/client/market-data.ts

@@ -124,10 +124,21 @@ export interface GistExportResult {
   gistUrl: string
 }
 
+/**
+ * A `link:` the desktop host wrote for one of its generations (#497). The
+ * test the server applies (`isGenerationLink` in sources.ts), repeated here
+ * because the client bundle cannot import server modules.
+ */
+export function isGenerationSpec(spec: string): boolean {
+  return /^link:/i.test(spec) && /(?:^|[\\/])\.generations[\\/]live[\\/]/i.test(spec)
+}
+
 /** Per-package update status from /dsh-market/updates. */
 export interface UpdateStatus {
   updateAvailable?: boolean
   version?: string
+  /** `github` | `npm` | `linked` | `generation` — the last is a host-managed
+      install (#497): `latest` names a newer release, never an offer. */
   kind?: string
   /** What is installed and what the source of truth offers — versions for npm
       packages, commit shas for github installs; the notes dialog (#294) shows

package/src/discovery-compatibility.ts

@@ -79,6 +79,12 @@ function record(value: unknown): Record<string, unknown> | null {
 export function manifestFacts(value: unknown): NpmManifestFacts {
   const manifest = record(value) ?? {}
   const engines = record(manifest.engines)
+  // #577: the ecosystem declares the host requirement in BOTH shapes —
+  // top-level `engines.dsh` and `dsh.engines.dsh` under the manifest's own
+  // `dsh` field (the natural home, and what e.g. @linxin666/dsh-web-all
+  // publishes). Neither position is authoritative, so read both; when a
+  // manifest carries both, the top-level declaration wins.
+  const dshEngines = record(record(manifest.dsh)?.engines)
   const peers = record(manifest.peerDependencies)
   const peerDependencies: Record<string, string> = {}
   for (const [name, raw] of Object.entries(peers ?? {})) {
@@ -88,7 +94,7 @@ export function manifestFacts(value: unknown): NpmManifestFacts {
   }
   return {
     version: range(manifest.version),
-    enginesDsh: range(engines?.dsh),
+    enginesDsh: range(engines?.dsh) ?? range(dshEngines?.dsh),
     peerDependencies,
   }
 }

package/src/install.ts

@@ -112,7 +112,7 @@ export async function withHoistRecovery(
       logEvent('warn', 'install', `a too-young release blocks pnpm's lockfile verification (#39) — retrying once with ${RELEASE_AGE_OVERRIDE}`)
       result = await run(profile, [pluginArgs[0], RELEASE_AGE_OVERRIDE, ...pluginArgs.slice(1)])
     } else if (
-      failure?.code === 'fetch-404'
+      (failure?.code === 'fetch-404' || failure?.code === 'no-matching-version')
       && isUnpublishedHostPeer(failure.pkg, profile, profileDirectory)
       && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')
       && !pluginArgs.includes(AUTO_INSTALL_PEERS_OFF)

package/src/pnpm-compat.ts

@@ -46,7 +46,7 @@ export const HOST_NAMESPACE_RE = /^@deepseek-ai\//
 export interface PnpmFailure {
   code: 'adding-to-root' | 'not-a-workspace' | 'hoist-pattern-diff' | 'pnpm-missing' | 'release-age-violation'
     | 'ignored-builds' | 'git-prepare-not-allowed' | 'git-prepare-failed' | 'tarball-url-mismatch'
-    | 'fetch-404' | 'transient-network' | 'fetch-timeout'
+    | 'fetch-404' | 'no-matching-version' | 'transient-network' | 'fetch-timeout'
     | 'unexpected-store' | 'patch-failed' | 'missing-tarball-integrity' | 'windows-file-locked'
     | 'pnpm-unusable' | 'missing-local-dependency'
   /** Bilingual, actionable message shown to the user instead of the raw wall of text. */
@@ -378,6 +378,29 @@ export function classifyPnpmFailure(output: string, exitCode?: number | null): P
       message: `有一个依赖在 registry 上不存在${zh}，pnpm 因此拒绝任何安装操作。它可能是之前失败操作残留在 profile package.json 里的幽灵依赖（可手动删除该行），也可能是需要登录的私有包 / a dependency cannot be resolved from the registry${en}; pnpm refuses every install while it is present. It may be a ghost entry left in the profile's package.json by an earlier failed operation (remove that line by hand), or a private package needing registry credentials`,
     }
   }
+  // #569: a host peer that only ever published pre-releases (e.g.
+  // `@deepseek-ai/dsh-tools` with nothing above `-rc.*`) resolves to NO
+  // stable version, and pnpm reports ERR_PNPM_NO_MATCHING_VERSION — the
+  // package exists, the requested range matches nothing. This is the same
+  // unpublished-host-peer shape #289 recovers from, just with a different
+  // error code, so the classifier names it separately and the #289 retry
+  // shares it via install.ts's gate. Real output (pnpm 12.4.1): see
+  // tests/pnpm-compat.spec.ts, which pins this wording.
+  if (output.includes('ERR_PNPM_NO_MATCHING_VERSION')) {
+    const pkg = /No matching version found for\s+((?:@[^/\s]+\/)?[^@\s]+)@/.exec(output)?.[1]
+      ?? /GET\s+\S*\/([^/\s]+):/.exec(output)?.[1].replace(/%2[Ff]/g, '/')
+    const zh = pkg === undefined ? '' : `（${pkg}）`
+    const en = pkg === undefined ? '' : ` (${pkg})`
+    const hostPeer = pkg !== undefined && HOST_NAMESPACE_RE.test(pkg)
+    return {
+      code: 'no-matching-version',
+      recoverable: false,
+      pkg,
+      message: hostPeer
+        ? `插件声明依赖的宿主包${zh}在 registry 上没有满足其版本范围的发布版（宿主运行时会自带它，npm 上不会出现这个版本）。市场会自动重试一次，放行这条 peer 依赖 / a plugin's declared host peer${en} has no published version satisfying its range — the runtime provides it, so npm carries no such version. The market retries once with that peer exempted from auto-install`
+        : `插件声明的一个依赖版本范围在 registry 上没有可满足的版本${zh}，通常是该版本被弃用或从未发布 / a dependency of this plugin declared a version range with no matching release on the registry${en} — the range resolves to nothing (withdrawn or never published)`,
+    }
+  }
   // #389 by @qq1054435284: on Windows, pnpm stages the new version in a
   // sibling `<name>_tmp_<pid>_<n>` directory and renames it over the old one.
   // Windows refuses that rename while any file underneath the target is open,

package/src/profile.ts

@@ -8,7 +8,7 @@ import { existsSync, readdirSync, readFileSync, realpathSync, renameSync, statSy
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path'
 import { isDeepStrictEqual } from 'node:util'
 import { resolveDshHome } from './home-paths.ts'
-import { githubRemoteIdentities, githubRepoIdentities } from './sources.ts'
+import { githubRemoteIdentities, githubRepoIdentities, isGitHostedSpec } from './sources.ts'
 
 /**
  * Whether a profile name follows DSH's own directory-name contract.
@@ -431,6 +431,30 @@ export interface InstalledRepoEvidence {
  * Discover declared repository identities and weaker local-origin hints. A
  * package.json repository declaration is authoritative; Git origin is only a
  * disambiguation hint because a checkout may legitimately point at a fork.
+ *
+ * Read for local AND registry specs, but never for a spec that already names
+ * its own source (#544 by @QinYupan; boundary from @bulingbuling688 in #548).
+ *
+ * The bug: two same-named catalog entries and an ordinary npm install. The
+ * manifest's `repository` — `git+https://github.com/MrmoLabs/dsh-mermaid.git`
+ * — is the one fact that says WHICH of the two is installed, and it sits in
+ * the same package.json for an npm install as for a local one. This returned
+ * empty for anything not `link:`/`file:`, so the client fell back to name
+ * matching, found two candidates, and matched NEITHER: the Discover card kept
+ * offering Install on a plugin that was running.
+ *
+ * Why a `github:`/URL install must NOT be read the same way: its spec already
+ * states the source, and the manifest can disagree with it. A fork installed
+ * as `github:myfork/plugin` usually still declares the UPSTREAM repository,
+ * because almost nobody edits that field when forking. Adding it as an
+ * identity made the upstream's card read as installed — measured, and the
+ * same mistake as #485: a weaker signal allowed to outvote a definite one.
+ * The first version of this fix widened to every spec kind and had exactly
+ * that hole.
+ *
+ * What stays local-only for the same reason it always was: the git-origin
+ * hint (there is no checkout to read for a registry install) and the local
+ * source directory walk.
  */
 export function readInstalledRepoEvidence(
   profile: string,
@@ -438,9 +462,14 @@ export function readInstalledRepoEvidence(
   spec: string,
   explicitDir?: string,
 ): InstalledRepoEvidence {
-  if (!PACKAGE_NAME_RE.test(name) || !/^(?:link|file):/i.test(spec)) return { identities: [], hints: [] }
+  if (!PACKAGE_NAME_RE.test(name)) return { identities: [], hints: [] }
+  const local = /^(?:link|file):/i.test(spec)
+  // A spec that names its own source is the authority on it; see above.
+  if (!local && (isGitHostedSpec(spec) || /^https?:/i.test(spec.trim()))) {
+    return { identities: [], hints: [] }
+  }
   const root = profileDir(profile, explicitDir)
-  const sourceDir = localSpecDirectory(root, spec)
+  const sourceDir = local ? localSpecDirectory(root, spec) : null
   const installedDir = installedPackageDirectory(root, name)
   const manifestDir = installedDir ?? sourceDir
   const manifest = manifestDir === null ? readInstalledManifest(profile, name, explicitDir) : manifestAt(manifestDir)

package/src/routes.ts

@@ -36,7 +36,7 @@ import { applyBundleOrder, mergeOrder, readBundleRules, readBundleStack, validat
 import { applyPreset, deletePreset, listPresets, previewPreset, savePreset } from './presets.ts'
 import { createProfileSnapshot, DEFAULT_MAX_SNAPSHOTS, deleteSnapshot, listSnapshots, restoreSnapshot } from './snapshot.ts'
 import { trialValidate } from './trial.ts'
-import { codeloadAllowBuildsKey, findCatalogEntryForLocal, findInstalledAlias, githubCommitOfTarget, githubTargetAtCommit, gitAllowBuildsKey, gitUpdateTarget, installTargetFor, isLocalSpec, NPM_NAME_RE, repoOfTarget, restoreBlockedByWorkspace, restoreTargetForLocal, workspaceProtocolDeps } from './sources.ts'
+import { codeloadAllowBuildsKey, findCatalogEntryForLocal, findInstalledAlias, githubCommitOfTarget, githubTargetAtCommit, gitAllowBuildsKey, gitUpdateTarget, installTargetFor, isGenerationLink, isLocalSpec, NPM_NAME_RE, repoOfTarget, restoreBlockedByWorkspace, restoreTargetForLocal, workspaceProtocolDeps } from './sources.ts'
 import { failureDetail, groupConflictsByOwner, isStaleUpdate, parseIgnoredBuilds, parsePrepareNotAllowed, pnpmNeverStarted, RELEASE_AGE_OVERRIDE, retargetCollections, validateAddedPlugins, withHoistRecovery } from './install.ts'
 import { asChannel, CHANNELS, DIST_TAG, resolveChannel, type Channel } from './channels.ts'
 import {
@@ -487,14 +487,31 @@ export function mountMarketRoutes(
   }
 
   /**
-   * Apply one enable/disable request: persist the choice in state.json, then
-   * drive the live composition. Covers every mount form — hot mounts and
-   * client-only shims go through hotUnmount/hotMount, bundle-layer entries
-   * through setEntryDisabled. Enabling a THEME goes through the caller's
-   * activateTheme instead so the Themes tab's exclusivity stays intact.
+   * Apply one enable/disable request: drive the live composition, then
+   * persist the choice in state.json. Covers every mount form — hot mounts
+   * and client-only shims go through hotUnmount/hotMount, bundle-layer
+   * entries through setEntryDisabled. Enabling a THEME goes through the
+   * caller's activateTheme instead so the Themes tab's exclusivity stays
+   * intact.
+   *
+   * A FAILED ENABLE LEAVES EVERYTHING AS IT WAS (#575). The choice used to be
+   * recorded before the mount was attempted and persisted whatever happened,
+   * so enabling a plugin that crashes on import — deterministically, every
+   * time — wrote "enabled" into state.json anyway. The next boot tried the
+   * import again and died again; the reporter measured 24 restarts before
+   * restoring the disable by hand. The toggle route's patch-layer gate
+   * (@JINITAIMEI121 in #584) closed the same hole in cordis.patch.yml; this
+   * closes it in the market's own store, which is the ONLY durable state a
+   * client-only plugin has — that plugin kind has no bundle rows, so the
+   * patch gate never runs for it.
+   *
+   * A failed DISABLE still persists, and that asymmetry is deliberate: the
+   * user asked for OFF, and a failed unmount leaves the plugin live only for
+   * this session. There the durable disable is the contract, not an error.
    */
   async function setPluginEnabled(name: string, enabled: boolean): Promise<{ ok: boolean; reason?: string }> {
     const dir = activeProfileDir
+    const wasDisabled = disabled.has(name)
     if (enabled) disabled.delete(name)
     else disabled.add(name)
     let ok: boolean
@@ -522,6 +539,13 @@ export function mountMarketRoutes(
         ok = true
       }
     }
+    if (!ok && enabled) {
+      // Put the in-memory view back before persisting: it is the same object
+      // the route reports as `disabled`, so restoring it keeps the reply, the
+      // store and the patch layer telling one story.
+      if (wasDisabled) disabled.add(name)
+      logEvent('warn', 'toggle', `${name}: enable failed; leaving it disabled rather than persisting a state that crashes at boot (#575)`)
+    }
     writeMarketState(dir, { disabled, groups, groupOrder })
     return { ok, reason }
   }
@@ -1156,6 +1180,24 @@ export function mountMarketRoutes(
     try { return new URL(request.url ?? '', 'http://localhost').searchParams.get('force') === '1' } catch { return false }
   }
 
+  /**
+   * The npm package an install with no registry spec of its own is compared
+   * against: a `file:` package matched to the catalog (#429), or a
+   * generation the desktop host linked in (#497). Null for everything else
+   * — a developer's own `link:` checkout is never compared online.
+   */
+  const onlineSourceOf = (
+    plugins: Awaited<ReturnType<typeof loadRegistry>>['plugins'],
+    name: string,
+    spec: string,
+  ): string | null => {
+    if (!spec.toLowerCase().startsWith('file:') && !isGenerationLink(spec)) return null
+    const evidence = readInstalledRepoEvidence(config.profile, name, spec, activeProfileDir)
+    const entry = findCatalogEntryForLocal(plugins, name, evidence.identities, evidence.hints)
+    const target = entry === null ? null : restoreTargetForLocal(entry, evidence.identities)
+    return target !== null && NPM_NAME_RE.test(target) ? target : null
+  }
+
   const disposers = [
     host.webServer.register({
       kind: 'exact',
@@ -1218,7 +1260,20 @@ export function mountMarketRoutes(
             const force = forceCheckFrom(request)
             const channel = activeChannel()
             const channelFor = SELF_NAMES.has(name) ? new Map([[name, channel]]) : undefined
-            const update = (await checkUpdates(config.profile, force, activeProfileDir, channelFor))[name]
+            // The same source lookup the market page makes, so a generation
+            // (#497) or a catalog-matched local package answers here with the
+            // release it can be compared against rather than with nothing.
+            const spec = readInstalled(config.profile, activeProfileDir)[name]
+            const onlineSourceFor = new Map<string, string>()
+            if (spec !== undefined && (spec.toLowerCase().startsWith('file:') || isGenerationLink(spec))) {
+              try {
+                const source = onlineSourceOf((await loadRegistry()).plugins, name, spec)
+                if (source !== null) onlineSourceFor.set(name, source)
+              } catch (error) {
+                logEvent('warn', 'updates', `package source lookup failed — ${error instanceof Error ? error.message : String(error)}`)
+              }
+            }
+            const update = (await checkUpdates(config.profile, force, activeProfileDir, channelFor, onlineSourceFor))[name]
             if (update === undefined) {
               sendJson(response, 404, { schema: UPDATE_API_V1_SCHEMA, error: 'plugin is not installed' })
               return
@@ -2078,7 +2133,18 @@ export function mountMarketRoutes(
             }
           }
           let patchWrite: { ok: boolean; reason: string | null } | null = null
-          if (patchRows.length > 0) {
+          // #575: a failed ENABLE must not flip the durable patch layer.
+          // The hot-mount failure may be deterministic (a plugin that
+          // crashes on import), and persisting "enabled" turns a transient
+          // in-session error into a boot crash loop — the loader re-applies
+          // the flipped rows on every start. The frontend already shows the
+          // plugin as still disabled, and the next explicit enable retries
+          // cleanly. Disables keep their unconditional write: a failed
+          // unmount leaves the plugin live in-session, and the user asked
+          // for it OFF — the durable disable is then the contract, not an
+          // error.
+          const patchGate = ok || !enabled
+          if (patchRows.length > 0 && patchGate) {
             for (const rowId of patchRows) {
               const result = enabled ? await enableRow(userPatchPath, rowId) : await disableRow(userPatchPath, rowId)
               if (!result.ok && patchWrite === null) patchWrite = result
@@ -2470,11 +2536,8 @@ export function mountMarketRoutes(
             for (const [name, spec] of Object.entries(installed)) {
               const migration = findGitToNpmMigration(registry.plugins, spec)
               if (migration !== null) sourceMigrationFor.set(name, migration)
-              if (!spec.toLowerCase().startsWith('file:')) continue
-              const evidence = readInstalledRepoEvidence(config.profile, name, spec, activeProfileDir)
-              const entry = findCatalogEntryForLocal(registry.plugins, name, evidence.identities, evidence.hints)
-              const target = entry === null ? null : restoreTargetForLocal(entry, evidence.identities)
-              if (target !== null && NPM_NAME_RE.test(target)) onlineSourceFor.set(name, target)
+              const source = onlineSourceOf(registry.plugins, name, spec)
+              if (source !== null) onlineSourceFor.set(name, source)
             }
           } catch (error) {
             logEvent('warn', 'updates', `package source lookup failed — ${error instanceof Error ? error.message : String(error)}`)

package/src/sources.ts

@@ -463,6 +463,19 @@ export function gitUploadPackUrl(spec: string): string | null {
   return `${base}/info/refs?service=git-upload-pack`
 }
 
+/**
+ * A `link:` that points into a generation the desktop host materialised
+ * (#497): `link:../.generations/live/<pkg>+<version>+<hash>/node_modules/<pkg>`.
+ * That is the host's production install, not a developer's checkout — it
+ * came from the registry and has releases to compare against. The host
+ * recognises its own installs by the `.generations/live/` segment, and no
+ * hand-written link ever lands under that directory, so the same test is
+ * enough here.
+ */
+export function isGenerationLink(spec: string): boolean {
+  return /^link:/i.test(spec) && /(?:^|[\\/])\.generations[\\/]live[\\/]/i.test(spec)
+}
+
 export { findCatalogEntryForLocal, resolveCatalogRestore } from './catalog-local-match.ts'
 
 /**

package/src/updates.ts

@@ -9,10 +9,17 @@ import { resolveHeadCommit } from './accelerate.ts'
 import { marketFetch } from './net.ts'
 import { activeRegion } from './regions.ts'
 import { profileDir, readGitResolutionCommit, readInstalled, readInstalledVersion, readLockCommits } from './profile.ts'
-import { gitCommitOfTarget, gitUploadPackUrl, githubCommitOfTarget, githubRefOfTarget, isGitHostedSpec, repoOfTarget } from './sources.ts'
+import { gitCommitOfTarget, gitUploadPackUrl, githubCommitOfTarget, githubRefOfTarget, isGenerationLink, isGitHostedSpec, repoOfTarget } from './sources.ts'
 
 export interface UpdateStatus {
-  kind: 'github' | 'npm' | 'linked'
+  /**
+   * `generation` is a `link:` the desktop host wrote (#497): the host
+   * installs it and reconciles it at startup, so the market names a newer
+   * release under `latest` and never offers to apply it. For that kind
+   * `latest` is null when the installed build is current or nothing newer
+   * can be confirmed.
+   */
+  kind: 'github' | 'npm' | 'linked' | 'generation'
   version: string | null
   current: string | null
   latest: string | null
@@ -293,9 +300,10 @@ export async function checkUpdates(
    */
   channelFor: ReadonlyMap<string, Channel> = new Map(),
   /**
-   * Curated npm sources for `file:` installs that were matched to the market
-   * catalog. `link:` workspaces remain development sources and are never
-   * opted into online updates.
+   * Curated npm sources for the installs that carry no registry spec of
+   * their own: `file:` packages matched to the market catalog (#429) and
+   * the generations the desktop host links in (#497). Any other `link:` is
+   * a development workspace and is never opted into online updates.
    */
   onlineSourceFor: ReadonlyMap<string, string> = new Map(),
 ): Promise<Record<string, UpdateStatus>> {
@@ -329,6 +337,28 @@ export async function checkUpdates(
       return
     }
     if (normalizedSpec.startsWith('link:')) {
+      if (isGenerationLink(spec)) {
+        // The desktop host's production install, not a checkout (#497): it
+        // came from the registry and has a release history to compare
+        // against. Reported, never offered — the host reconciles `live/`
+        // against its own desired.json at startup, so an update applied
+        // here would appear to work and silently revert on the next boot.
+        // Only a release that is actually newer is named; current and
+        // unknown both read as null, so a lagging `latest` tag (#64) can't
+        // advertise a downgrade either.
+        const onlineSource = onlineSourceFor.get(name)
+        const stable = onlineSource === undefined ? null : await fetchNpmLatest(onlineSource)
+        const channel = channelFor.get(name)
+        const newest = channel === undefined || onlineSource === undefined
+          ? stable
+          : await versionOnChannel(onlineSource, channel, stable)
+        result[name] = {
+          kind: 'generation', version, current: version,
+          latest: isUpgrade(version, newest) ? newest : null,
+          updateAvailable: false,
+        }
+        return
+      }
       result[name] = { kind: 'linked', version, current: null, latest: null, updateAvailable: false }
       return
     }