dshmarket 1.46.1 → 1.48.0

package/README.md

@@ -123,6 +123,10 @@ DSHM_REGISTRY_URL=https://your-mirror.example/plugins.json dsh web
 
 [local-dsh](https://github.com/liangchen-harold/local-dsh) — a DeepSeek Harness desktop client that can run the model on your own machine: it bundles llama.cpp next to Node, pnpm and DSH, so a downloaded GGUF model answers without any external API. Built on Tauri; Apple Silicon Macs for now. [localdsh.com](https://localdsh.com)
 
+### dsh desktop (MochiNek0)
+
+[dsh-desktop](https://github.com/MochiNek0/dsh-desktop) — a cross-platform DeepSeek Harness desktop client built on Tauri (Windows, macOS, Linux). It uses the system webview, so the installer is a few megabytes: 2.3 MB on Windows, 5.8 MB on macOS. It starts `dsh web` in the background on launch and embeds it in a native window, sharing sessions and config with the CLI. This market sits first in the recommended list of its built-in plugin panel, one click to install. A Runtime panel enumerates and switches the machine's Node installs and installs or upgrades dsh, no administrator privileges required, and native notifications fire when a turn ends or dsh is waiting on you. [dsh-desktop.cc.cd](https://dsh-desktop.cc.cd/)
+
 ### DSH Get
 
 [DSH Get](https://www.dshget.com/) — a searchable web directory for discovering DeepSeek Harness plugins: category filters, bilingual descriptions, install commands and per-plugin detail pages. Its normalized catalog snapshot is public at [bobby-sheng/dshget-data](https://github.com/bobby-sheng/dshget-data).

package/README.zh.md

@@ -120,6 +120,10 @@ DSHM_REGISTRY_URL=https://your-mirror.example/plugins.json dsh web
 
 [local-dsh](https://github.com/liangchen-harold/local-dsh)——可以把模型跑在本机的 DeepSeek Harness 桌面客户端：发行包内置 llama.cpp 与 Node、pnpm、DSH，下载一个 GGUF 模型就能对话，不必接外部 API。基于 Tauri 构建；目前支持 Apple 芯片的 Mac。[localdsh.com](https://localdsh.com)
 
+### dsh desktop（MochiNek0）
+
+[dsh-desktop](https://github.com/MochiNek0/dsh-desktop)——基于 Tauri 构建的跨平台 DeepSeek Harness 桌面客户端（Windows / macOS / Linux），界面走系统 webview，安装包只有几 MB（Windows 2.3 MB、macOS 5.8 MB）。启动时自动在后台拉起 `dsh web` 并嵌入原生窗口，会话与配置和 CLI 共享；内置插件面板的推荐位第一条就是本市场，点一下即可装上。另有「运行环境」面板枚举与切换本机 Node、安装或升级 dsh，全程无需管理员权限；回合结束或 dsh 等待你确认时发出系统通知。[dsh-desktop.cc.cd](https://dsh-desktop.cc.cd/)
+
 ### DSH Get
 
 [DSH Get](https://www.dshget.com/)——DeepSeek Harness 插件的网页检索目录：分类筛选、中英描述、安装命令与插件详情页；其规范化的目录快照公开在 [bobby-sheng/dshget-data](https://github.com/bobby-sheng/dshget-data)。

package/UPDATE-API-V1.md

@@ -33,6 +33,37 @@ supported features, restart owner and endpoint paths. A client must hide its
 restart button when `restart.supported` is false. Desktop and supervised hosts
 normally delegate restart to their owning shell or operator.
 
+## Count what can be updated
+
+```http
+GET /dsh-market/api/v1/updates/summary
+```
+
+```json
+{
+  "schema": "dsh-market/update-api/v1",
+  "checked": 12,
+  "updatable": 3,
+  "packages": [
+    { "name": "dsh-mcp-connector", "source": "npm", "installedVersion": "1.1.0", "latestVersion": "1.2.0" }
+  ]
+}
+```
+
+`checked` is the denominator — how many installed plugins the answer looked
+at. Read it, or a badge cannot tell "nothing to update" from "nothing was
+looked at". The two are different answers and only one of them means the
+profile is up to date.
+
+`packages` carries the same objects the single-package endpoint below
+returns, and lists only plugins that can be updated. A badge needs
+`updatable`; a panel needs the rows; neither should have to filter the whole
+profile itself.
+
+`GET /dsh-market/api/v1/capabilities` reports this endpoint at
+`endpoints.updatesSummary` and sets `features.updatesSummary`. Check that
+rather than probing for the path.
+
 ## Check one installed package
 
 ```http
@@ -123,6 +154,37 @@ same-origin, no forwarding headers, no package mutation in progress, and a Host
 whose lifecycle is not owned by Desktop or a supervisor. Clients must feature
 detect it; they must not invent an alternative process-control path.
 
+## Rendering the market's panel elsewhere (client-side)
+
+A host shell that wants the market inside its own container — rather than in
+the settings page — reads the client service this package publishes:
+
+```ts
+const market = ctx.reflect.get('market')
+const element = market.render({ preferredSubsectionId: 'installed' })
+```
+
+`render()` returns the market's own panel wrapped in its error boundary, as a
+React element. Same page, same React instance: this package's client bundle
+resolves react through the host's module table, so the element mounts
+anywhere in that tree.
+
+| member | |
+|---|---|
+| `version` | `1` |
+| `render(props?)` | the panel element; `preferredSubsectionId` is optional |
+| `setSettingsVisible(visible)` | register or retract the market's own `settings.section` entry |
+| `settingsVisible()` | whether that entry is registered right now |
+
+`ctx.provide(name, value)` and `ctx.reflect.provide(name, value)` are the
+same call — cordis's `Service.provide` delegates to the reflect layer — so
+either idiom reaches this service.
+
+What `render()` is **not**: a way to rearrange the market. It hands over the
+whole panel, chrome included. Cutting the market into host-fillable regions
+is a different design, and one host asking is not yet evidence that it fits
+anyone else.
+
 ## Compatibility policy
 
 - New optional response fields may be added within v1.

package/client/client.js

@@ -1591,10 +1591,20 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 		* dependency's spec pins a github repo AND the entry states one, the repos
 		* decide — the loose name/npm identities only apply when at least one side
 		* carries no repo evidence (npm installs, non-github entries).
+		*
+		* Repo evidence only ever decides by repository ROOT. A monorepo catalog
+		* entry states `owner/repo#path:/pkg` while an npm-installed manifest
+		* usually states the bare `owner/repo` (it rarely declares
+		* `repository.directory`), and reading that asymmetry as a source conflict
+		* kept a genuinely installed subpackage from ever reading as installed.
 		*/
+		/** Repository root: the part before any `#path:/…` subpath selection. */
+		function repoRoots(ids) {
+			return new Set([...ids].map((id) => id.split("#path:/")[0]));
+		}
 		function sameSourceConflict(plugin, spec, repoIdentities = []) {
-			const entry = entryRepoIds(plugin);
-			const dep = depRepoIds(spec, repoIdentities);
+			const entry = repoRoots(entryRepoIds(plugin));
+			const dep = repoRoots(depRepoIds(spec, repoIdentities));
 			if (entry.size === 0 || dep.size === 0) return false;
 			for (const id of dep) if (entry.has(id)) return false;
 			return true;
@@ -1645,6 +1655,56 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			for (const id of entryIdentities(plugin)) if (dep.has(id)) return true;
 			return false;
 		}
+		/**
+		* The same memo, for the branch #262 left behind (#589).
+		*
+		* `looseMatchCount` above covers dependencies installed by version. A
+		* `link:` or `file:` dependency takes the other branch, into
+		* `findCatalogEntryForLocal`, which walks the whole catalog at least twice
+		* per call — once to filter by name, once to collect `/tree/` repos — and
+		* up to twice more when there are identities to probe. Both callers below
+		* run once per rendered card. The reporter profiled ~300ms per repaint at
+		* 24 cards against a 3,627-entry catalog where a version-pinned dependency
+		* paid 1.1ms; a local benchmark measured ~38ms per render at that shape,
+		* and ~1.4s at 96 cards with eight local dependencies.
+		*
+		* The inner key carries the EVIDENCE, not just the name. Installing a plugin
+		* hands the next render a fresh identities array while the catalog array
+		* stays the same, so a name-only key would answer the post-install question
+		* with the pre-install result — which is the same-named-fork confusion #485
+		* asked this matcher to stop making, reintroduced as a cache bug.
+		*
+		* A miss is cached as `null`, which is why the "not cached yet" sentinel
+		* has to be `undefined`: `null` is a real answer here, and it costs the
+		* same full scan to establish as a hit does. It is also the common case —
+		* a checkout you are developing is usually not in the catalog at all.
+		*
+		* The invariant this rests on, stated because the WeakMap cannot enforce it:
+		* the catalog array and the entries inside it are frozen once handed here. A
+		* refetch replaces the array — which is what the outer key is for — but an
+		* in-place `push`, `sort` or `reverse`, or editing a row's `url`, would keep
+		* the key and change the answer. Order is load-bearing too: the matcher
+		* returns the FIRST row that fits. Nothing in the client does any of this
+		* today; `visiblePlugins` and `themePlugins` both sort copies.
+		*/
+		const localMatchCache = /* @__PURE__ */ new WeakMap();
+		function cachedEntryForLocal(plugins, name, identities, hints) {
+			let byKey = localMatchCache.get(plugins);
+			if (byKey === void 0) {
+				byKey = /* @__PURE__ */ new Map();
+				localMatchCache.set(plugins, byKey);
+			}
+			const key = JSON.stringify([
+				name,
+				identities,
+				hints
+			]);
+			const hit = byKey.get(key);
+			if (hit !== void 0) return hit;
+			const entry = findCatalogEntryForLocal(plugins, name, identities, hints);
+			byKey.set(key, entry);
+			return entry;
+		}
 		/** The installed dependency name a registry entry corresponds to, or null. */
 		function matchInstalledName(plugin, installed, repoIdentities = {}, plugins, repoHints = {}) {
 			const ids = entryIdentities(plugin);
@@ -1653,7 +1713,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				const repos = repoIdentities[name] ?? [];
 				if (/^(?:link|file):/i.test(specStr)) {
 					if (plugins === void 0) continue;
-					const entry = findCatalogEntryForLocal(plugins, name, repos, repoHints[name] ?? []);
+					const entry = cachedEntryForLocal(plugins, name, repos, repoHints[name] ?? []);
 					if (entry !== null && entry.url === plugin.url) return name;
 					continue;
 				}
@@ -2055,7 +2115,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 		}
 		/** Catalog row for an installed dependency — strict for local link:/file: specs. */
 		function catalogEntryForInstalled(plugins, name, spec, repoIdentities = [], repoHints = []) {
-			if (/^(?:link|file):/i.test(spec)) return findCatalogEntryForLocal(plugins, name, repoIdentities, repoHints) ?? void 0;
+			if (/^(?:link|file):/i.test(spec)) return cachedEntryForLocal(plugins, name, repoIdentities, repoHints) ?? void 0;
 			return entryForDep(plugins, name, spec, repoIdentities, repoHints);
 		}
 		//#endregion
@@ -8614,7 +8674,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 											children: updatingName === self ? t("updating") : status.restoreRequired === true ? t("restoreOnline") : t("marketUpdate")
 										});
 									})(),
-									reminderBatchUpdatableNames.length >= 2 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+									reminderBatchUpdatableNames.length >= 1 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
 										variant: "primary",
 										size: "sm",
 										disabled: updatingAll || updatingName !== null || busyUrl !== null || removingName !== null,
@@ -10660,6 +10720,86 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			});
 		}
 		//#endregion
+		//#region src/client/market-element.ts
+		/**
+		* The market's panel, as an element, built from explicit dependencies.
+		*
+		* Two callers want the same thing and must not drift apart:
+		*
+		* - the `settings.section` this package registers, whose slot passes down a
+		*   host-chosen `preferredSubsectionId`;
+		* - `market.render()`, for a host shell that renders the market inside its
+		*   own container (#602, from the Tauri desktop).
+		*
+		* A module function taking its dependencies rather than a closure over the
+		* cordis context, so the wiring — which locale, which theme, which log
+		* exporter reaches the panel — is something a test can assert instead of
+		* something only a running host can reveal.
+		*/
+		/**
+		* @param props - see {@link MarketElementProps}.
+		* @returns the panel wrapped in its error boundary.
+		*/
+		function marketElement(props) {
+			return (0, react.createElement)(MarketErrorBoundary, {
+				text: props.crashText,
+				actions: (0, react.createElement)("button", {
+					type: "button",
+					onClick: () => {
+						props.exportLog();
+					}
+				}, props.t("exportLog"))
+			}, (0, react.createElement)(MarketSection, {
+				t: props.t,
+				locale: props.locale,
+				theme: props.theme,
+				themeStore: props.themeStore,
+				preferredSubsectionId: props.preferredSubsectionId
+			}));
+		}
+		//#endregion
+		//#region src/client/section-gate.ts
+		/**
+		* @param register - registers the entry and returns its disposer. Called
+		*   only when the entry should be visible; may be called again after a
+		*   retraction, which is why the disposer is required rather than optional.
+		* @returns the gate.
+		*/
+		function createSectionGate(register) {
+			let ready = false;
+			let wanted = true;
+			let removed = false;
+			let dispose = null;
+			const apply = () => {
+				if (!ready) return;
+				const shouldShow = wanted && !removed;
+				if (shouldShow && dispose === null) {
+					dispose = register();
+					return;
+				}
+				if (!shouldShow && dispose !== null) {
+					const stop = dispose;
+					dispose = null;
+					stop();
+				}
+			};
+			return {
+				available: () => {
+					ready = true;
+					apply();
+				},
+				setVisible: (visible) => {
+					wanted = visible;
+					apply();
+				},
+				visible: () => dispose !== null,
+				retire: () => {
+					removed = true;
+					apply();
+				}
+			};
+		}
+		//#endregion
 		//#region src/client/SettingsCard.tsx
 		/**
 		* The market's card on the plugin configuration page (dsh >= 0.1.0-rc.7).
@@ -11150,8 +11290,32 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				en
 			}), "dsh-market: dictionaries");
 			const t = ctx.locale.bind(NS);
-			let retireSection = null;
-			ctx.slots.inject("settings.section", () => {
+			/**
+			* The market's own panel, as an element — one builder for the settings
+			* section this package registers and for `market.render()` (#602). Built
+			* per call: the props are live (locale, theme, the host's preferred
+			* subsection), and a cached element would freeze the first caller's.
+			*/
+			const buildMarketElement = (ownerProps = {}) => marketElement({
+				t,
+				locale: ctx.locale,
+				theme: ctx.theme,
+				themeStore: {
+					subscribe: (cb) => ctx.on("theme/change", cb),
+					getSnapshot: () => ctx.theme.getTheme()
+				},
+				crashText: {
+					title: t("crashTitle"),
+					hint: t("crashHint"),
+					reload: t("crashReload"),
+					details: t("crashDetails")
+				},
+				exportLog: () => {
+					exportMarketLog().catch(() => {});
+				},
+				preferredSubsectionId: ownerProps.preferredSubsectionId
+			});
+			const sectionGate = createSectionGate(() => {
 				const off = ctx.slots.register({
 					name: "settings.section",
 					id: "market",
@@ -11159,32 +11323,31 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 					label: () => t("nav"),
 					locale: NS,
 					inject: () => ({ t })
-				}, (ownerProps = {}) => (0, react.createElement)(MarketErrorBoundary, {
-					text: {
-						title: t("crashTitle"),
-						hint: t("crashHint"),
-						reload: t("crashReload"),
-						details: t("crashDetails")
-					},
-					actions: (0, react.createElement)("button", {
-						type: "button",
-						onClick: () => {
-							exportMarketLog().catch(() => {});
-						}
-					}, t("exportLog"))
-				}, (0, react.createElement)(MarketSection, {
-					t,
-					locale: ctx.locale,
-					theme: ctx.theme,
-					themeStore: {
-						subscribe: (cb) => ctx.on("theme/change", cb),
-						getSnapshot: () => ctx.theme.getTheme()
-					},
-					preferredSubsectionId: ownerProps.preferredSubsectionId
-				})));
-				if (typeof off === "function") retireSection = off;
-				return off;
+				}, (ownerProps = {}) => buildMarketElement(ownerProps));
+				return typeof off === "function" ? off : () => {};
 			});
+			ctx.slots.inject("settings.section", () => {
+				sectionGate.available();
+			});
+			const marketControl = {
+				version: 1,
+				setSettingsVisible: (visible) => {
+					sectionGate.setVisible(visible);
+				},
+				settingsVisible: () => sectionGate.visible(),
+				/**
+				* The market's panel as an element, for a host that renders it inside
+				* its own container. Same page, same React instance — this package's
+				* bundle resolves react through the host's module table, so an element
+				* returned here mounts anywhere in that tree.
+				*
+				* What it is NOT: a way to rearrange the market. It hands over the whole
+				* panel, chrome included. Cutting the market into host-fillable regions
+				* is a different design and has not been asked for by a second host yet.
+				*/
+				render: (props = {}) => buildMarketElement(props)
+			};
+			if (typeof ctx.provide === "function") ctx.provide("market", marketControl);
 			ctx.inject(["settingsScope"], (scoped) => {
 				scoped.slots.inject("settings.plugin.item", () => scoped.slots.register({
 					name: "settings.plugin.item",
@@ -11194,9 +11357,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				}, () => (0, react.createElement)(SettingsCard, {
 					t,
 					onRemoved: () => {
-						const off = retireSection;
-						retireSection = null;
-						off?.();
+						sectionGate.retire();
 					}
 				})));
 			});

package/lib/accelerate.js

@@ -112,6 +112,16 @@ async function tryHeadCommit(repo, proxy, signal, ref) {
         // metacharacters (`.` is legal in a branch name).
         const quoted = ref.replace(/[.*+?^${}()|[\]\\]/gu, String.raw `\$&`);
         for (const namespace of ['heads', 'tags']) {
+            // An annotated tag advertises two refs — the tag object and its
+            // peeled commit (`refs/tags/<ref>^{}`). pnpm resolves the tag to the
+            // peeled commit and codeload records that sha in the lockfile, so the
+            // peeled line is the one that must equal `current`; answering with
+            // the tag-object sha made annotated-tag installs report an update
+            // forever (#597). Lightweight tags have no peeled line and fall
+            // through to the direct one.
+            const peeled = new RegExp(String.raw `([0-9a-f]{40}) refs/${namespace}/${quoted}\^\{\}(?![^\s])`, 'u').exec(body);
+            if (peeled !== null)
+                return { kind: 'valid', sha: peeled[1] };
             const found = new RegExp(String.raw `([0-9a-f]{40}) refs/${namespace}/${quoted}(?![^\s])`, 'u').exec(body);
             if (found !== null)
                 return { kind: 'valid', sha: found[1] };

package/lib/changelog.js

@@ -20,8 +20,8 @@
 import { fileFromTarball } from './catalog-npm.js';
 import { marketFetch } from './net.js';
 import { activeRegion, routesFor } from './regions.js';
-import { profileDir, readInstalled, readLockCommits } from './profile.js';
-import { lookupRepoFromUrl, repoOfTarget } from './sources.js';
+import { profileDir, readInstalled, readInstalledRepoEvidence, readLockCommits } from './profile.js';
+import { lookupRepoFromUrl, repoOf, repoOfTarget } from './sources.js';
 import { checkUpdates } from './updates.js';
 import { loadRegistry } from './registry.js';
 const UPDATES_PACKAGE = 'dsh-plugin-updates';
@@ -198,7 +198,24 @@ export async function updateNotesFor(profile, explicitDir, name) {
         if (key === null) {
             try {
                 const registry = await loadRegistry();
-                const plugin = registry.plugins.find(p => p.name === name);
+                const candidates = registry.plugins.filter(p => p.name === name);
+                let plugin;
+                if (candidates.length === 1) {
+                    plugin = candidates[0];
+                }
+                else if (candidates.length > 1) {
+                    // Same-named packages exist in the catalog; a bare name match can
+                    // pick someone else's repo and answer "no notes" for a plugin that
+                    // ships updates data under its own repository (#598). The installed
+                    // package declares its repository, so prefer the catalog entry that
+                    // agrees with it; only a unique agreement is trusted — an ambiguous
+                    // name falls through to npm publish times, which are honest for any
+                    // installed npm package.
+                    const evidence = readInstalledRepoEvidence(profile, name, spec, explicitDir);
+                    const matches = candidates.filter(p => evidence.identities.some(id => repoOf(p.url)?.toLowerCase() === id.split('#')[0].toLowerCase()));
+                    if (matches.length === 1)
+                        plugin = matches[0];
+                }
                 if (plugin !== undefined) {
                     key = plugin.url;
                 }

package/lib/dsh-cli.js

@@ -192,6 +192,44 @@ export function toolSearchDirs(platform = process.platform, env = process.env, h
     // one place a user goes looking for an answer.
     return [...new Set(dirs.filter(dir => dir.trim() !== ''))];
 }
+/**
+ * Stop git asking for credentials down a channel nobody is listening on
+ * (#587).
+ *
+ * `CI=true` below is the same defence one layer up, and pnpm reads it. git
+ * does not — it has its own switch, and it was not set. The gap only opens
+ * when a spec reaches pnpm's git fetcher instead of the codeload tarball
+ * path `accelerate.ts` describes: `github:owner/repo#path:/sub` is one, and
+ * pnpm really does shell out to `git` for it, trying HTTPS first.
+ *
+ * git's credential prompt opens the controlling terminal, not stdin. There
+ * is no terminal here, so the question is never seen and never answered:
+ * the reporter caught `git.exe` alive for eight minutes having burned 0.05s
+ * of CPU, and only the fifteen-minute install timeout ended it. Refusing
+ * the prompt turns that into a fast, readable failure.
+ *
+ * It is a default, not an override: a value the caller set wins, and blank
+ * counts as unset because an empty `GIT_TERMINAL_PROMPT` is not a setting
+ * git can parse either. Credential helpers and `GIT_ASKPASS` are untouched
+ * and still answer first — this closes only the terminal fallback, which is
+ * precisely the branch that cannot work from a spawned child.
+ *
+ * Scope, stated plainly because it is narrower than the issue title
+ * suggests: this is the HTTPS half. pnpm falls back to `git@github.com:`
+ * when HTTPS fails, and the ssh side needs `GIT_SSH_COMMAND`, which
+ * overrides `core.sshCommand` and `GIT_SSH` — the two ordinary ways to
+ * choose an identity — and whose `BatchMode=yes` would disable
+ * `SSH_ASKPASS`, breaking key-passphrase installs that work today. That
+ * half needs a policy decision, so it is not made here. Note also that on
+ * POSIX `runDshPlugin` spawns detached, so the subtree has no controlling
+ * terminal and the prompt already dies instantly; the hang the issue
+ * reports needs Windows, where the spawn is not detached.
+ */
+export function gitEnvForPnpm(env = process.env) {
+    if ((env.GIT_TERMINAL_PROMPT ?? '').trim() !== '')
+        return {};
+    return { GIT_TERMINAL_PROMPT: '0' };
+}
 function spawnEnv() {
     // pnpm v10+ blocks forever on a silent interactive prompt without a TTY;
     // CI mode forces it to act or fail instead of asking.
@@ -201,7 +239,13 @@ function spawnEnv() {
         if (!parts.includes(bin))
             parts.push(bin);
     }
-    return { ...process.env, ...proxyEnvForPnpm(process.env, activeRegion()), CI: 'true', PATH: parts.join(separator) };
+    return {
+        ...process.env,
+        ...proxyEnvForPnpm(process.env, activeRegion()),
+        ...gitEnvForPnpm(process.env),
+        CI: 'true',
+        PATH: parts.join(separator),
+    };
 }
 const INSTALL_TIMEOUT_MS = Number(process.env.DSH_MARKET_INSTALL_TIMEOUT_MS) || 15 * 60 * 1000;
 /**

package/lib/dsh-install.js

@@ -1,6 +1,6 @@
 /** Locate the DSH host package in CLI and packaged Desktop runtimes. */
 import { readFileSync, realpathSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 /** The entry with symlinks resolved, or unchanged when it cannot be read. */
 function realpathOf(entry) {
     try {
@@ -14,27 +14,77 @@ function realpathOf(entry) {
     }
 }
 const DSH_PACKAGE = '@deepseek-ai/dsh';
+const DESKTOP_PACKAGE = '@deepseek-ai/dsh-desktop';
+const APPLICATION_ROOTS = ['app.asar.unpacked', 'app.asar', 'app'];
+// The split runtime reported in #553. Only these local, identity-checked
+// packages corroborate the shell; never resolve witnesses from a profile.
+const DESKTOP_RUNTIME_PACKAGES = ['dsh-base', 'dsh-web-app', 'dsh-web', 'dsh-settings'];
 /**
- * The host package's own manifest, or null when `directory` is not it.
- * @returns the parsed manifest of `@deepseek-ai/dsh`, or null.
+ * A package's own manifest, or null when its identity cannot be confirmed.
  */
-function readDshManifest(directory) {
+function readDshManifest(directory, name = DSH_PACKAGE) {
     try {
         const manifest = JSON.parse(readFileSync(join(directory, 'package.json'), 'utf8'));
-        return manifest.name === DSH_PACKAGE ? { name: DSH_PACKAGE, version: manifest.version } : null;
+        return manifest.name === name ? { name, version: manifest.version } : null;
     }
     catch {
         return null;
     }
 }
-function isDshPackage(directory) {
-    return readDshManifest(directory) !== null;
+function entryDirectories(entry) {
+    if (entry === undefined)
+        return [];
+    const directories = [];
+    let directory = resolve(dirname(realpathOf(entry)));
+    for (let depth = 0; depth < 10; depth += 1) {
+        directories.push(directory);
+        const parent = dirname(directory);
+        if (parent === directory)
+            break;
+        directory = parent;
+    }
+    return directories;
+}
+function desktopDirectories() {
+    const { resourcesPath } = process;
+    if (typeof resourcesPath !== 'string' || resourcesPath.length === 0)
+        return [];
+    return APPLICATION_ROOTS.map(root => join(resourcesPath, root));
+}
+function declaredVersion(manifest) {
+    return typeof manifest?.version === 'string' && manifest.version !== '' ? manifest.version : 'unknown';
+}
+function flatDesktopHost(directory) {
+    const shell = readDshManifest(directory, DESKTOP_PACKAGE);
+    if (shell === null)
+        return null;
+    const runtime = DESKTOP_RUNTIME_PACKAGES.map(name => {
+        const candidate = join(directory, 'node_modules', '@deepseek-ai', name);
+        // Bundled pnpm links are fine; a link to a mutable profile/global package
+        // is not evidence about the version of the embedded runtime.
+        const path = relative(realpathOf(directory), realpathOf(join(candidate, 'package.json')));
+        if (isAbsolute(path) || path === '..' || path.startsWith(`..${sep}`))
+            return null;
+        return readDshManifest(candidate, `@deepseek-ai/${name}`);
+    });
+    // A shell alone is not a dependency anchor. Either in-box bundle can
+    // establish the directory even if the other version witnesses are broken.
+    if (runtime[0] === null && runtime[1] === null)
+        return null;
+    const version = declaredVersion(shell);
+    // DSH split packages share a release line, but a desktop shell need not.
+    // Require agreement from every witness; missing/conflicting evidence is
+    // unknown, not the shell version or a majority vote among split packages.
+    const parsed = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.exec(version);
+    const corroborated = parsed !== null && !(parsed[1]?.split('.').some(part => /^0\d+$/.test(part)) ?? false)
+        && runtime.every(manifest => manifest?.version === version);
+    return { directory, version: corroborated ? version : 'unknown' };
 }
 /**
  * The version of the DSH host this market is running inside.
  *
- * Read from the same manifest `findDshInstallDir` already parses to identify
- * the package — the version was sitting in that object and being discarded.
+ * CLI versions come from the host manifest. Flat Desktop shells additionally
+ * require agreement with their bundled split runtime, never profile packages.
  *
  * Worth reporting because the host version has repeatedly been the thing
  * neither side could see. #293 turned on it (the reporter was on
@@ -51,17 +101,20 @@ function isDshPackage(directory) {
  * legitimately land here).
  */
 export function dshHostInfo(entry = process.argv[1]) {
-    const directory = findDshInstallDir(entry);
-    if (directory === null)
-        return null;
-    const manifest = readDshManifest(directory);
-    // Located but unversioned: report the directory anyway. "The host is here
-    // and declares no version" is a fact worth carrying, and it is not the
-    // same fact as "no host found".
-    const version = typeof manifest?.version === 'string' && manifest.version !== ''
-        ? manifest.version
-        : 'unknown';
-    return { version, directory };
+    const ancestors = entryDirectories(entry);
+    const applications = desktopDirectories();
+    // Keep the entire legacy search order ahead of newly supported shells.
+    for (const directory of [...ancestors, ...applications.map(root => join(root, 'node_modules', '@deepseek-ai', 'dsh'))]) {
+        const manifest = readDshManifest(directory);
+        if (manifest !== null)
+            return { directory, version: declaredVersion(manifest) };
+    }
+    for (const directory of [...ancestors, ...applications]) {
+        const host = flatDesktopHost(directory);
+        if (host !== null)
+            return host;
+    }
+    return null;
 }
 /**
  * Walk up from the CLI entry first, then inspect Electron's authoritative
@@ -84,25 +137,5 @@ export function dshHostInfo(entry = process.argv[1]) {
  * why this survived: the case that worked is the one that gets tested.
  */
 export function findDshInstallDir(entry = process.argv[1]) {
-    if (entry !== undefined) {
-        let directory = resolve(dirname(realpathOf(entry)));
-        for (let depth = 0; depth < 10; depth += 1) {
-            if (isDshPackage(directory))
-                return directory;
-            const parent = dirname(directory);
-            if (parent === directory)
-                break;
-            directory = parent;
-        }
-    }
-    const electronProcess = process;
-    if (typeof electronProcess.resourcesPath !== 'string'
-        || electronProcess.resourcesPath.length === 0)
-        return null;
-    for (const applicationRoot of ['app.asar.unpacked', 'app.asar', 'app']) {
-        const candidate = join(electronProcess.resourcesPath, applicationRoot, 'node_modules', '@deepseek-ai', 'dsh');
-        if (isDshPackage(candidate))
-            return candidate;
-    }
-    return null;
+    return dshHostInfo(entry)?.directory ?? null;
 }