dshmarket 1.47.0 → 1.49.0

package/UPDATE-API-V1.md

@@ -33,6 +33,37 @@ supported features, restart owner and endpoint paths. A client must hide its
 restart button when `restart.supported` is false. Desktop and supervised hosts
 normally delegate restart to their owning shell or operator.
 
+## Count what can be updated
+
+```http
+GET /dsh-market/api/v1/updates/summary
+```
+
+```json
+{
+  "schema": "dsh-market/update-api/v1",
+  "checked": 12,
+  "updatable": 3,
+  "packages": [
+    { "name": "dsh-mcp-connector", "source": "npm", "installedVersion": "1.1.0", "latestVersion": "1.2.0" }
+  ]
+}
+```
+
+`checked` is the denominator — how many installed plugins the answer looked
+at. Read it, or a badge cannot tell "nothing to update" from "nothing was
+looked at". The two are different answers and only one of them means the
+profile is up to date.
+
+`packages` carries the same objects the single-package endpoint below
+returns, and lists only plugins that can be updated. A badge needs
+`updatable`; a panel needs the rows; neither should have to filter the whole
+profile itself.
+
+`GET /dsh-market/api/v1/capabilities` reports this endpoint at
+`endpoints.updatesSummary` and sets `features.updatesSummary`. Check that
+rather than probing for the path.
+
 ## Check one installed package
 
 ```http
@@ -123,6 +154,37 @@ same-origin, no forwarding headers, no package mutation in progress, and a Host
 whose lifecycle is not owned by Desktop or a supervisor. Clients must feature
 detect it; they must not invent an alternative process-control path.
 
+## Rendering the market's panel elsewhere (client-side)
+
+A host shell that wants the market inside its own container — rather than in
+the settings page — reads the client service this package publishes:
+
+```ts
+const market = ctx.reflect.get('market')
+const element = market.render({ preferredSubsectionId: 'installed' })
+```
+
+`render()` returns the market's own panel wrapped in its error boundary, as a
+React element. Same page, same React instance: this package's client bundle
+resolves react through the host's module table, so the element mounts
+anywhere in that tree.
+
+| member | |
+|---|---|
+| `version` | `1` |
+| `render(props?)` | the panel element; `preferredSubsectionId` is optional |
+| `setSettingsVisible(visible)` | register or retract the market's own `settings.section` entry |
+| `settingsVisible()` | whether that entry is registered right now |
+
+`ctx.provide(name, value)` and `ctx.reflect.provide(name, value)` are the
+same call — cordis's `Service.provide` delegates to the reflect layer — so
+either idiom reaches this service.
+
+What `render()` is **not**: a way to rearrange the market. It hands over the
+whole panel, chrome included. Cutting the market into host-fillable regions
+is a different design, and one host asking is not yet evidence that it fits
+anyone else.
+
 ## Compatibility policy
 
 - New optional response fields may be added within v1.

package/client/client.js

@@ -105,7 +105,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			installing: "安装中…",
 			installedBadge: "✓ 已安装",
 			alreadyInstalled: "✓ 已安装",
-			restartBanner: "项变更完成，重启 DeepSeek Harness 后生效",
+			restartBanner: "项变更需重启 DeepSeek Harness 后生效",
 			uninstall: "卸载",
 			confirmRemove: "确认卸载？",
 			uninstalling: "卸载中…",
@@ -638,7 +638,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			installing: "Installing…",
 			installedBadge: "✓ Installed",
 			alreadyInstalled: "✓ Installed",
-			restartBanner: "change(s) done — restart DeepSeek Harness to apply",
+			restartBanner: "change(s) pending restart — restart DeepSeek Harness to apply",
 			uninstall: "Uninstall",
 			confirmRemove: "Uninstall?",
 			uninstalling: "Uninstalling…",
@@ -6348,6 +6348,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			const [buildsSkipped, setBuildsSkipped] = (0, react.useState)(null);
 			const [updatingAll, setUpdatingAll] = (0, react.useState)(false);
 			const [updatedNames, setUpdatedNames] = (0, react.useState)([]);
+			const [restartNames, setRestartNames] = (0, react.useState)([]);
 			const [hotUrls, setHotUrls] = (0, react.useState)([]);
 			const [hotNames, setHotNames] = (0, react.useState)([]);
 			const [progressLine, setProgressLine] = (0, react.useState)(null);
@@ -6667,12 +6668,13 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				}
 				if (Array.isArray(saved.doneUrls) && saved.doneUrls.length > 0) setDoneUrls(saved.doneUrls);
 				if (Array.isArray(saved.updated) && saved.updated.length > 0) setUpdatedNames(saved.updated);
+				if (Array.isArray(saved.restartNames) && saved.restartNames.length > 0) setRestartNames(saved.restartNames);
 				if (typeof saved.removed === "number" && saved.removed > 0) setRemovedCount(saved.removed);
 				if (typeof saved.toggled === "number" && saved.toggled > 0) setToggleRestart(saved.toggled);
 			}, [bootId]);
 			(0, react.useEffect)(() => {
 				if (bootId === null) return;
-				if (doneUrls.length === 0 && updatedNames.length === 0 && removedCount === 0 && toggleRestart === 0) {
+				if (doneUrls.length === 0 && updatedNames.length === 0 && restartNames.length === 0 && removedCount === 0 && toggleRestart === 0) {
 					sessionStorage.removeItem("dshm-restart");
 					return;
 				}
@@ -6680,6 +6682,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 					boot: bootId,
 					doneUrls,
 					updated: updatedNames,
+					restartNames,
 					removed: removedCount,
 					toggled: toggleRestart
 				}));
@@ -6687,6 +6690,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				bootId,
 				doneUrls,
 				updatedNames,
+				restartNames,
 				removedCount,
 				toggleRestart
 			]);
@@ -7307,6 +7311,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 					if (status === 200 && body.ok) {
 						setRecords((list) => patch(list, updateRecordId, { state: "done" }));
 						setUpdatedNames((names) => names.concat(name));
+						const activation = body.activation && typeof body.activation === "object" ? body.activation[name] : void 0;
+						if (!activation || activation.state === "restart") setRestartNames((names) => names.includes(name) ? names : names.concat(name));
 						if (body.activation && typeof body.activation === "object") setActivations((prev) => ({
 							...prev,
 							...body.activation
@@ -7854,7 +7860,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				});
 			}, [doGroupAction, groups]);
 			const selfName = installed["dshmarket"] !== void 0 ? "dshmarket" : "dsh-market";
-			const updatableNames = Object.keys(installed).filter((name) => name !== selfName && !updatedNames.includes(name) && updates[name] && updates[name].updateAvailable);
+			const updatableNames = Object.keys(installed).filter((name) => name !== selfName && !updatedNames.includes(name) && !effectiveDisabledSet.has(name) && updates[name] && updates[name].updateAvailable);
 			const batchUpdatableNames = updatableNames.filter((name) => updates[name]?.restoreRequired !== true);
 			const ignoredUpdateSet = (0, react.useMemo)(() => new Set(ignoredUpdateNames), [ignoredUpdateNames]);
 			const reminderUpdatableNames = updatableNames.filter((name) => !ignoredUpdateSet.has(name));
@@ -8102,7 +8108,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				webdavUrl,
 				webdavUser
 			]);
-			const sessionPendingRestart = doneUrls.length + updatedNames.length + removedCount + toggleRestart + (backupRestored ? 1 : 0);
+			const sessionPendingRestart = doneUrls.length + restartNames.length + removedCount + toggleRestart + (backupRestored ? 1 : 0);
 			/**
 			* Plugins the HOST reports as restart-pending, independent of what this
 			* browser session happens to remember. Installing and then reloading the
@@ -10720,6 +10726,86 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			});
 		}
 		//#endregion
+		//#region src/client/market-element.ts
+		/**
+		* The market's panel, as an element, built from explicit dependencies.
+		*
+		* Two callers want the same thing and must not drift apart:
+		*
+		* - the `settings.section` this package registers, whose slot passes down a
+		*   host-chosen `preferredSubsectionId`;
+		* - `market.render()`, for a host shell that renders the market inside its
+		*   own container (#602, from the Tauri desktop).
+		*
+		* A module function taking its dependencies rather than a closure over the
+		* cordis context, so the wiring — which locale, which theme, which log
+		* exporter reaches the panel — is something a test can assert instead of
+		* something only a running host can reveal.
+		*/
+		/**
+		* @param props - see {@link MarketElementProps}.
+		* @returns the panel wrapped in its error boundary.
+		*/
+		function marketElement(props) {
+			return (0, react.createElement)(MarketErrorBoundary, {
+				text: props.crashText,
+				actions: (0, react.createElement)("button", {
+					type: "button",
+					onClick: () => {
+						props.exportLog();
+					}
+				}, props.t("exportLog"))
+			}, (0, react.createElement)(MarketSection, {
+				t: props.t,
+				locale: props.locale,
+				theme: props.theme,
+				themeStore: props.themeStore,
+				preferredSubsectionId: props.preferredSubsectionId
+			}));
+		}
+		//#endregion
+		//#region src/client/section-gate.ts
+		/**
+		* @param register - registers the entry and returns its disposer. Called
+		*   only when the entry should be visible; may be called again after a
+		*   retraction, which is why the disposer is required rather than optional.
+		* @returns the gate.
+		*/
+		function createSectionGate(register) {
+			let ready = false;
+			let wanted = true;
+			let removed = false;
+			let dispose = null;
+			const apply = () => {
+				if (!ready) return;
+				const shouldShow = wanted && !removed;
+				if (shouldShow && dispose === null) {
+					dispose = register();
+					return;
+				}
+				if (!shouldShow && dispose !== null) {
+					const stop = dispose;
+					dispose = null;
+					stop();
+				}
+			};
+			return {
+				available: () => {
+					ready = true;
+					apply();
+				},
+				setVisible: (visible) => {
+					wanted = visible;
+					apply();
+				},
+				visible: () => dispose !== null,
+				retire: () => {
+					removed = true;
+					apply();
+				}
+			};
+		}
+		//#endregion
 		//#region src/client/SettingsCard.tsx
 		/**
 		* The market's card on the plugin configuration page (dsh >= 0.1.0-rc.7).
@@ -11210,8 +11296,32 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				en
 			}), "dsh-market: dictionaries");
 			const t = ctx.locale.bind(NS);
-			let retireSection = null;
-			ctx.slots.inject("settings.section", () => {
+			/**
+			* The market's own panel, as an element — one builder for the settings
+			* section this package registers and for `market.render()` (#602). Built
+			* per call: the props are live (locale, theme, the host's preferred
+			* subsection), and a cached element would freeze the first caller's.
+			*/
+			const buildMarketElement = (ownerProps = {}) => marketElement({
+				t,
+				locale: ctx.locale,
+				theme: ctx.theme,
+				themeStore: {
+					subscribe: (cb) => ctx.on("theme/change", cb),
+					getSnapshot: () => ctx.theme.getTheme()
+				},
+				crashText: {
+					title: t("crashTitle"),
+					hint: t("crashHint"),
+					reload: t("crashReload"),
+					details: t("crashDetails")
+				},
+				exportLog: () => {
+					exportMarketLog().catch(() => {});
+				},
+				preferredSubsectionId: ownerProps.preferredSubsectionId
+			});
+			const sectionGate = createSectionGate(() => {
 				const off = ctx.slots.register({
 					name: "settings.section",
 					id: "market",
@@ -11219,32 +11329,31 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 					label: () => t("nav"),
 					locale: NS,
 					inject: () => ({ t })
-				}, (ownerProps = {}) => (0, react.createElement)(MarketErrorBoundary, {
-					text: {
-						title: t("crashTitle"),
-						hint: t("crashHint"),
-						reload: t("crashReload"),
-						details: t("crashDetails")
-					},
-					actions: (0, react.createElement)("button", {
-						type: "button",
-						onClick: () => {
-							exportMarketLog().catch(() => {});
-						}
-					}, t("exportLog"))
-				}, (0, react.createElement)(MarketSection, {
-					t,
-					locale: ctx.locale,
-					theme: ctx.theme,
-					themeStore: {
-						subscribe: (cb) => ctx.on("theme/change", cb),
-						getSnapshot: () => ctx.theme.getTheme()
-					},
-					preferredSubsectionId: ownerProps.preferredSubsectionId
-				})));
-				if (typeof off === "function") retireSection = off;
-				return off;
+				}, (ownerProps = {}) => buildMarketElement(ownerProps));
+				return typeof off === "function" ? off : () => {};
+			});
+			ctx.slots.inject("settings.section", () => {
+				sectionGate.available();
 			});
+			const marketControl = {
+				version: 1,
+				setSettingsVisible: (visible) => {
+					sectionGate.setVisible(visible);
+				},
+				settingsVisible: () => sectionGate.visible(),
+				/**
+				* The market's panel as an element, for a host that renders it inside
+				* its own container. Same page, same React instance — this package's
+				* bundle resolves react through the host's module table, so an element
+				* returned here mounts anywhere in that tree.
+				*
+				* What it is NOT: a way to rearrange the market. It hands over the whole
+				* panel, chrome included. Cutting the market into host-fillable regions
+				* is a different design and has not been asked for by a second host yet.
+				*/
+				render: (props = {}) => buildMarketElement(props)
+			};
+			if (typeof ctx.provide === "function") ctx.provide("market", marketControl);
 			ctx.inject(["settingsScope"], (scoped) => {
 				scoped.slots.inject("settings.plugin.item", () => scoped.slots.register({
 					name: "settings.plugin.item",
@@ -11254,9 +11363,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				}, () => (0, react.createElement)(SettingsCard, {
 					t,
 					onRemoved: () => {
-						const off = retireSection;
-						retireSection = null;
-						off?.();
+						sectionGate.retire();
 					}
 				})));
 			});

package/lib/dsh-cli.js

@@ -192,6 +192,71 @@ export function toolSearchDirs(platform = process.platform, env = process.env, h
     // one place a user goes looking for an answer.
     return [...new Set(dirs.filter(dir => dir.trim() !== ''))];
 }
+/**
+ * Stop git asking for credentials down a channel nobody is listening on
+ * (#587).
+ *
+ * `CI=true` below is the same defence one layer up, and pnpm reads it. git
+ * does not — it has its own switch, and it was not set. The gap only opens
+ * when a spec reaches pnpm's git fetcher instead of the codeload tarball
+ * path `accelerate.ts` describes: `github:owner/repo#path:/sub` is one, and
+ * pnpm really does shell out to `git` for it, trying HTTPS first.
+ *
+ * git's credential prompt opens the controlling terminal, not stdin. There
+ * is no terminal here, so the question is never seen and never answered:
+ * the reporter caught `git.exe` alive for eight minutes having burned 0.05s
+ * of CPU, and only the fifteen-minute install timeout ended it. Refusing
+ * the prompt turns that into a fast, readable failure.
+ *
+ * It is a default, not an override: a value the caller set wins, and blank
+ * counts as unset because an empty `GIT_TERMINAL_PROMPT` is not a setting
+ * git can parse either. Credential helpers and `GIT_ASKPASS` are untouched
+ * and still answer first — this closes only the terminal fallback, which is
+ * precisely the branch that cannot work from a spawned child.
+ *
+ * Scope, stated plainly because it is narrower than the issue title
+ * suggests: this is the HTTPS half. pnpm falls back to `git@github.com:`
+ * when HTTPS fails, and the ssh side needs `GIT_SSH_COMMAND`, which
+ * overrides `core.sshCommand` and `GIT_SSH` — the two ordinary ways to
+ * choose an identity — and whose `BatchMode=yes` would disable
+ * `SSH_ASKPASS`, breaking key-passphrase installs that work today. That
+ * half needs a policy decision, so it is not made here. Note also that on
+ * POSIX `runDshPlugin` spawns detached, so the subtree has no controlling
+ * terminal and the prompt already dies instantly; the hang the issue
+ * reports needs Windows, where the spawn is not detached.
+ */
+export function gitEnvForPnpm(env = process.env) {
+    if ((env.GIT_TERMINAL_PROMPT ?? '').trim() !== '')
+        return {};
+    return { GIT_TERMINAL_PROMPT: '0' };
+}
+/**
+ * Every `--config.<key>=<value>` override in the argv, repeated as the
+ * `PNPM_CONFIG_<KEY>` environment variable that pnpm 12 still reads.
+ *
+ * pnpm 12 ignores some `--config.<key>` overrides on the command line, in
+ * either spelling, without a word: `fetchTimeout` (#615; measured on
+ * 12.2.1, 12.3.0 and 12.4.1) and `auto-install-peers` (12.4.1 auto-installs
+ * the peer with the flag present and not with the variable), so the retries
+ * that carry them ran exactly like the first attempt. `PNPM_CONFIG_*` is
+ * honoured by 11.8, 11.21 and 12.4 alike, so the argument stays for the
+ * versions that read it and the variable carries the same value for the
+ * ones that do not. Scoped to the run that carries the flag; nothing is set
+ * otherwise, so a user's own values are untouched on every other run. Keys
+ * are accepted in either spelling, so respelling a constant (as #600 did
+ * for the release-age one) cannot silently drop the variable.
+ */
+export function pnpmConfigEnvForArgs(pluginArgs) {
+    const env = {};
+    for (const arg of pluginArgs) {
+        const match = /^--config\.([A-Za-z][A-Za-z0-9-]*)=(\S+)$/.exec(arg);
+        if (match === null)
+            continue;
+        const key = match[1].replace(/([a-z0-9])([A-Z])/g, '$1_$2').replace(/-/g, '_').toUpperCase();
+        env[`PNPM_CONFIG_${key}`] = match[2];
+    }
+    return env;
+}
 function spawnEnv() {
     // pnpm v10+ blocks forever on a silent interactive prompt without a TTY;
     // CI mode forces it to act or fail instead of asking.
@@ -201,7 +266,13 @@ function spawnEnv() {
         if (!parts.includes(bin))
             parts.push(bin);
     }
-    return { ...process.env, ...proxyEnvForPnpm(process.env, activeRegion()), CI: 'true', PATH: parts.join(separator) };
+    return {
+        ...process.env,
+        ...proxyEnvForPnpm(process.env, activeRegion()),
+        ...gitEnvForPnpm(process.env),
+        CI: 'true',
+        PATH: parts.join(separator),
+    };
 }
 const INSTALL_TIMEOUT_MS = Number(process.env.DSH_MARKET_INSTALL_TIMEOUT_MS) || 15 * 60 * 1000;
 /**
@@ -695,7 +766,7 @@ export function runDshPlugin(profile, pluginArgs) {
             // pnpm v10 blocks forever on a silent interactive prompt without a TTY
             // (observed on re-add over a pinned git spec); CI mode forces it to act
             // or fail instead of asking.
-            env: spawnEnv(),
+            env: { ...spawnEnv(), ...pnpmConfigEnvForArgs(pluginArgs) },
             stdio: ['ignore', 'pipe', 'pipe'],
             viaShell,
             // Own process group on POSIX so cancel/timeout can kill the whole

package/lib/dsh-install.js

@@ -1,6 +1,6 @@
 /** Locate the DSH host package in CLI and packaged Desktop runtimes. */
 import { readFileSync, realpathSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 /** The entry with symlinks resolved, or unchanged when it cannot be read. */
 function realpathOf(entry) {
     try {
@@ -14,27 +14,77 @@ function realpathOf(entry) {
     }
 }
 const DSH_PACKAGE = '@deepseek-ai/dsh';
+const DESKTOP_PACKAGE = '@deepseek-ai/dsh-desktop';
+const APPLICATION_ROOTS = ['app.asar.unpacked', 'app.asar', 'app'];
+// The split runtime reported in #553. Only these local, identity-checked
+// packages corroborate the shell; never resolve witnesses from a profile.
+const DESKTOP_RUNTIME_PACKAGES = ['dsh-base', 'dsh-web-app', 'dsh-web', 'dsh-settings'];
 /**
- * The host package's own manifest, or null when `directory` is not it.
- * @returns the parsed manifest of `@deepseek-ai/dsh`, or null.
+ * A package's own manifest, or null when its identity cannot be confirmed.
  */
-function readDshManifest(directory) {
+function readDshManifest(directory, name = DSH_PACKAGE) {
     try {
         const manifest = JSON.parse(readFileSync(join(directory, 'package.json'), 'utf8'));
-        return manifest.name === DSH_PACKAGE ? { name: DSH_PACKAGE, version: manifest.version } : null;
+        return manifest.name === name ? { name, version: manifest.version } : null;
     }
     catch {
         return null;
     }
 }
-function isDshPackage(directory) {
-    return readDshManifest(directory) !== null;
+function entryDirectories(entry) {
+    if (entry === undefined)
+        return [];
+    const directories = [];
+    let directory = resolve(dirname(realpathOf(entry)));
+    for (let depth = 0; depth < 10; depth += 1) {
+        directories.push(directory);
+        const parent = dirname(directory);
+        if (parent === directory)
+            break;
+        directory = parent;
+    }
+    return directories;
+}
+function desktopDirectories() {
+    const { resourcesPath } = process;
+    if (typeof resourcesPath !== 'string' || resourcesPath.length === 0)
+        return [];
+    return APPLICATION_ROOTS.map(root => join(resourcesPath, root));
+}
+function declaredVersion(manifest) {
+    return typeof manifest?.version === 'string' && manifest.version !== '' ? manifest.version : 'unknown';
+}
+function flatDesktopHost(directory) {
+    const shell = readDshManifest(directory, DESKTOP_PACKAGE);
+    if (shell === null)
+        return null;
+    const runtime = DESKTOP_RUNTIME_PACKAGES.map(name => {
+        const candidate = join(directory, 'node_modules', '@deepseek-ai', name);
+        // Bundled pnpm links are fine; a link to a mutable profile/global package
+        // is not evidence about the version of the embedded runtime.
+        const path = relative(realpathOf(directory), realpathOf(join(candidate, 'package.json')));
+        if (isAbsolute(path) || path === '..' || path.startsWith(`..${sep}`))
+            return null;
+        return readDshManifest(candidate, `@deepseek-ai/${name}`);
+    });
+    // A shell alone is not a dependency anchor. Either in-box bundle can
+    // establish the directory even if the other version witnesses are broken.
+    if (runtime[0] === null && runtime[1] === null)
+        return null;
+    const version = declaredVersion(shell);
+    // DSH split packages share a release line, but a desktop shell need not.
+    // Require agreement from every witness; missing/conflicting evidence is
+    // unknown, not the shell version or a majority vote among split packages.
+    const parsed = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.exec(version);
+    const corroborated = parsed !== null && !(parsed[1]?.split('.').some(part => /^0\d+$/.test(part)) ?? false)
+        && runtime.every(manifest => manifest?.version === version);
+    return { directory, version: corroborated ? version : 'unknown' };
 }
 /**
  * The version of the DSH host this market is running inside.
  *
- * Read from the same manifest `findDshInstallDir` already parses to identify
- * the package — the version was sitting in that object and being discarded.
+ * CLI versions come from the host manifest. Flat Desktop shells additionally
+ * require agreement with their bundled split runtime, never profile packages.
  *
  * Worth reporting because the host version has repeatedly been the thing
  * neither side could see. #293 turned on it (the reporter was on
@@ -51,17 +101,20 @@ function isDshPackage(directory) {
  * legitimately land here).
  */
 export function dshHostInfo(entry = process.argv[1]) {
-    const directory = findDshInstallDir(entry);
-    if (directory === null)
-        return null;
-    const manifest = readDshManifest(directory);
-    // Located but unversioned: report the directory anyway. "The host is here
-    // and declares no version" is a fact worth carrying, and it is not the
-    // same fact as "no host found".
-    const version = typeof manifest?.version === 'string' && manifest.version !== ''
-        ? manifest.version
-        : 'unknown';
-    return { version, directory };
+    const ancestors = entryDirectories(entry);
+    const applications = desktopDirectories();
+    // Keep the entire legacy search order ahead of newly supported shells.
+    for (const directory of [...ancestors, ...applications.map(root => join(root, 'node_modules', '@deepseek-ai', 'dsh'))]) {
+        const manifest = readDshManifest(directory);
+        if (manifest !== null)
+            return { directory, version: declaredVersion(manifest) };
+    }
+    for (const directory of [...ancestors, ...applications]) {
+        const host = flatDesktopHost(directory);
+        if (host !== null)
+            return host;
+    }
+    return null;
 }
 /**
  * Walk up from the CLI entry first, then inspect Electron's authoritative
@@ -84,25 +137,5 @@ export function dshHostInfo(entry = process.argv[1]) {
  * why this survived: the case that worked is the one that gets tested.
  */
 export function findDshInstallDir(entry = process.argv[1]) {
-    if (entry !== undefined) {
-        let directory = resolve(dirname(realpathOf(entry)));
-        for (let depth = 0; depth < 10; depth += 1) {
-            if (isDshPackage(directory))
-                return directory;
-            const parent = dirname(directory);
-            if (parent === directory)
-                break;
-            directory = parent;
-        }
-    }
-    const electronProcess = process;
-    if (typeof electronProcess.resourcesPath !== 'string'
-        || electronProcess.resourcesPath.length === 0)
-        return null;
-    for (const applicationRoot of ['app.asar.unpacked', 'app.asar', 'app']) {
-        const candidate = join(electronProcess.resourcesPath, applicationRoot, 'node_modules', '@deepseek-ai', 'dsh');
-        if (isDshPackage(candidate))
-            return candidate;
-    }
-    return null;
+    return dshHostInfo(entry)?.directory ?? null;
 }