dshmarket 1.48.0 → 1.49.0

package/client/client.js

@@ -105,7 +105,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			installing: "安装中…",
 			installedBadge: "✓ 已安装",
 			alreadyInstalled: "✓ 已安装",
-			restartBanner: "项变更完成，重启 DeepSeek Harness 后生效",
+			restartBanner: "项变更需重启 DeepSeek Harness 后生效",
 			uninstall: "卸载",
 			confirmRemove: "确认卸载？",
 			uninstalling: "卸载中…",
@@ -638,7 +638,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			installing: "Installing…",
 			installedBadge: "✓ Installed",
 			alreadyInstalled: "✓ Installed",
-			restartBanner: "change(s) done — restart DeepSeek Harness to apply",
+			restartBanner: "change(s) pending restart — restart DeepSeek Harness to apply",
 			uninstall: "Uninstall",
 			confirmRemove: "Uninstall?",
 			uninstalling: "Uninstalling…",
@@ -6348,6 +6348,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			const [buildsSkipped, setBuildsSkipped] = (0, react.useState)(null);
 			const [updatingAll, setUpdatingAll] = (0, react.useState)(false);
 			const [updatedNames, setUpdatedNames] = (0, react.useState)([]);
+			const [restartNames, setRestartNames] = (0, react.useState)([]);
 			const [hotUrls, setHotUrls] = (0, react.useState)([]);
 			const [hotNames, setHotNames] = (0, react.useState)([]);
 			const [progressLine, setProgressLine] = (0, react.useState)(null);
@@ -6667,12 +6668,13 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				}
 				if (Array.isArray(saved.doneUrls) && saved.doneUrls.length > 0) setDoneUrls(saved.doneUrls);
 				if (Array.isArray(saved.updated) && saved.updated.length > 0) setUpdatedNames(saved.updated);
+				if (Array.isArray(saved.restartNames) && saved.restartNames.length > 0) setRestartNames(saved.restartNames);
 				if (typeof saved.removed === "number" && saved.removed > 0) setRemovedCount(saved.removed);
 				if (typeof saved.toggled === "number" && saved.toggled > 0) setToggleRestart(saved.toggled);
 			}, [bootId]);
 			(0, react.useEffect)(() => {
 				if (bootId === null) return;
-				if (doneUrls.length === 0 && updatedNames.length === 0 && removedCount === 0 && toggleRestart === 0) {
+				if (doneUrls.length === 0 && updatedNames.length === 0 && restartNames.length === 0 && removedCount === 0 && toggleRestart === 0) {
 					sessionStorage.removeItem("dshm-restart");
 					return;
 				}
@@ -6680,6 +6682,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 					boot: bootId,
 					doneUrls,
 					updated: updatedNames,
+					restartNames,
 					removed: removedCount,
 					toggled: toggleRestart
 				}));
@@ -6687,6 +6690,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				bootId,
 				doneUrls,
 				updatedNames,
+				restartNames,
 				removedCount,
 				toggleRestart
 			]);
@@ -7307,6 +7311,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 					if (status === 200 && body.ok) {
 						setRecords((list) => patch(list, updateRecordId, { state: "done" }));
 						setUpdatedNames((names) => names.concat(name));
+						const activation = body.activation && typeof body.activation === "object" ? body.activation[name] : void 0;
+						if (!activation || activation.state === "restart") setRestartNames((names) => names.includes(name) ? names : names.concat(name));
 						if (body.activation && typeof body.activation === "object") setActivations((prev) => ({
 							...prev,
 							...body.activation
@@ -7854,7 +7860,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				});
 			}, [doGroupAction, groups]);
 			const selfName = installed["dshmarket"] !== void 0 ? "dshmarket" : "dsh-market";
-			const updatableNames = Object.keys(installed).filter((name) => name !== selfName && !updatedNames.includes(name) && updates[name] && updates[name].updateAvailable);
+			const updatableNames = Object.keys(installed).filter((name) => name !== selfName && !updatedNames.includes(name) && !effectiveDisabledSet.has(name) && updates[name] && updates[name].updateAvailable);
 			const batchUpdatableNames = updatableNames.filter((name) => updates[name]?.restoreRequired !== true);
 			const ignoredUpdateSet = (0, react.useMemo)(() => new Set(ignoredUpdateNames), [ignoredUpdateNames]);
 			const reminderUpdatableNames = updatableNames.filter((name) => !ignoredUpdateSet.has(name));
@@ -8102,7 +8108,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				webdavUrl,
 				webdavUser
 			]);
-			const sessionPendingRestart = doneUrls.length + updatedNames.length + removedCount + toggleRestart + (backupRestored ? 1 : 0);
+			const sessionPendingRestart = doneUrls.length + restartNames.length + removedCount + toggleRestart + (backupRestored ? 1 : 0);
 			/**
 			* Plugins the HOST reports as restart-pending, independent of what this
 			* browser session happens to remember. Installing and then reloading the

package/lib/dsh-cli.js

@@ -230,6 +230,33 @@ export function gitEnvForPnpm(env = process.env) {
         return {};
     return { GIT_TERMINAL_PROMPT: '0' };
 }
+/**
+ * Every `--config.<key>=<value>` override in the argv, repeated as the
+ * `PNPM_CONFIG_<KEY>` environment variable that pnpm 12 still reads.
+ *
+ * pnpm 12 ignores some `--config.<key>` overrides on the command line, in
+ * either spelling, without a word: `fetchTimeout` (#615; measured on
+ * 12.2.1, 12.3.0 and 12.4.1) and `auto-install-peers` (12.4.1 auto-installs
+ * the peer with the flag present and not with the variable), so the retries
+ * that carry them ran exactly like the first attempt. `PNPM_CONFIG_*` is
+ * honoured by 11.8, 11.21 and 12.4 alike, so the argument stays for the
+ * versions that read it and the variable carries the same value for the
+ * ones that do not. Scoped to the run that carries the flag; nothing is set
+ * otherwise, so a user's own values are untouched on every other run. Keys
+ * are accepted in either spelling, so respelling a constant (as #600 did
+ * for the release-age one) cannot silently drop the variable.
+ */
+export function pnpmConfigEnvForArgs(pluginArgs) {
+    const env = {};
+    for (const arg of pluginArgs) {
+        const match = /^--config\.([A-Za-z][A-Za-z0-9-]*)=(\S+)$/.exec(arg);
+        if (match === null)
+            continue;
+        const key = match[1].replace(/([a-z0-9])([A-Z])/g, '$1_$2').replace(/-/g, '_').toUpperCase();
+        env[`PNPM_CONFIG_${key}`] = match[2];
+    }
+    return env;
+}
 function spawnEnv() {
     // pnpm v10+ blocks forever on a silent interactive prompt without a TTY;
     // CI mode forces it to act or fail instead of asking.
@@ -739,7 +766,7 @@ export function runDshPlugin(profile, pluginArgs) {
             // pnpm v10 blocks forever on a silent interactive prompt without a TTY
             // (observed on re-add over a pinned git spec); CI mode forces it to act
             // or fail instead of asking.
-            env: spawnEnv(),
+            env: { ...spawnEnv(), ...pnpmConfigEnvForArgs(pluginArgs) },
             stdio: ['ignore', 'pipe', 'pipe'],
             viaShell,
             // Own process group on POSIX so cancel/timeout can kill the whole

package/lib/install.js

@@ -29,6 +29,14 @@ export const RELEASE_AGE_OVERRIDE = '--config.minimum-release-age=0';
  * WHOLE repo even for a `#path:` subdirectory plugin) on slow networks; a
  * plain retry fails again at the same limit, so the recovery re-runs with
  * this override once. Scoped to a single command like RELEASE_AGE_OVERRIDE.
+ *
+ * pnpm 12 ignores this flag on the command line in either spelling (#615).
+ * On the CLI runner, runDshPlugin repeats every `--config.<key>` override
+ * as PNPM_CONFIG_<KEY>, which pnpm 11 and 12 both read, so the retried
+ * command really does get the longer limit there. The Desktop runtime hands
+ * its host argv only, so on a Desktop host the retry still depends on that
+ * host's pnpm reading the flag. The flag stays: pnpm 11 and earlier read
+ * it, and it costs nothing on the versions that do not.
  */
 export const FETCH_TIMEOUT_OVERRIDE = '--config.fetchTimeout=600000';
 /**
@@ -47,6 +55,10 @@ export const FETCH_TIMEOUT_OVERRIDE = '--config.fetchTimeout=600000';
  * Verified against pnpm 10.29.3: `peerDependencyRules.ignoreMissing` does
  * NOT prevent the fetch (it only silences the warning), so this flag is the
  * only lever that actually works.
+ *
+ * pnpm 12 ignores this flag on the command line too (12.4.1 auto-installs
+ * the peer regardless); runDshPlugin repeats it as
+ * PNPM_CONFIG_AUTO_INSTALL_PEERS, which 12 reads (#615).
  */
 export const AUTO_INSTALL_PEERS_OFF = '--config.auto-install-peers=false';
 /**

package/lib/restart.js

@@ -241,6 +241,10 @@ export function restartLaunch() {
  * DSH sandbox tool runners) pops a visible node window. Wrapping the launch
  * in `powershell -WindowStyle Hidden` gives the host a HIDDEN console that
  * children inherit instead. POSIX keeps the plain detached spawn.
+ *
+ * The helper that runs this invocation spawns it with `windowsHide`, because
+ * the helper has no console of its own to hand down and Windows would
+ * otherwise create a visible one for PowerShell (#624).
  */
 export function respawnInvocation(launch, platform = process.platform) {
     if (platform !== 'win32') {
@@ -325,7 +329,17 @@ export function restartHelperSource(spawned, launch, logs, port) {
         '  try {',
         '    const out = fs.openSync(logOut, "a")',
         '    const err = fs.openSync(logErr, "a")',
-        '    child = spawn(file, args, { cwd, detached, stdio: ["ignore", out, err], env: process.env, shell: viaShell })',
+        // windowsHide (#624 by @davidekingsss): this helper is itself detached,
+        // so on Windows it has no console, and a console program spawned from a
+        // console-less parent is given a NEW, visible one — the "Windows
+        // PowerShell" window that owns the replacement and takes it down when
+        // closed. `-WindowStyle Hidden` cannot hide it: that flag governs the
+        // window PowerShell would create, not the console the spawn handed it.
+        // CREATE_NO_WINDOW keeps the console but never shows it, and the host's
+        // own console children inherit that hidden console rather than popping
+        // windows of their own (measured by the reporter with a console-less
+        // launcher: one PseudoConsoleWindow without the flag, none with it).
+        '    child = spawn(file, args, { cwd, detached, stdio: ["ignore", out, err], env: process.env, shell: viaShell, windowsHide: true })',
         // spawn reports a missing or unexecutable file ASYNCHRONOUSLY; the
         // try/catch below only covers the synchronous throw, so without this
         // listener that failure is exactly as silent as the bug being fixed.

package/lib/types/dsh-cli.d.ts

@@ -112,6 +112,23 @@ export declare function toolSearchDirs(platform?: string, env?: NodeJS.ProcessEn
  * reports needs Windows, where the spawn is not detached.
  */
 export declare function gitEnvForPnpm(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * Every `--config.<key>=<value>` override in the argv, repeated as the
+ * `PNPM_CONFIG_<KEY>` environment variable that pnpm 12 still reads.
+ *
+ * pnpm 12 ignores some `--config.<key>` overrides on the command line, in
+ * either spelling, without a word: `fetchTimeout` (#615; measured on
+ * 12.2.1, 12.3.0 and 12.4.1) and `auto-install-peers` (12.4.1 auto-installs
+ * the peer with the flag present and not with the variable), so the retries
+ * that carry them ran exactly like the first attempt. `PNPM_CONFIG_*` is
+ * honoured by 11.8, 11.21 and 12.4 alike, so the argument stays for the
+ * versions that read it and the variable carries the same value for the
+ * ones that do not. Scoped to the run that carries the flag; nothing is set
+ * otherwise, so a user's own values are untouched on every other run. Keys
+ * are accepted in either spelling, so respelling a constant (as #600 did
+ * for the release-age one) cannot silently drop the variable.
+ */
+export declare function pnpmConfigEnvForArgs(pluginArgs: readonly string[]): NodeJS.ProcessEnv;
 /**
  * Windows npm/corepack/pnpm are `.cmd` shims. Node's `spawn` without a shell
  * cannot start them (ENOENT / EINVAL). Same pattern as dsh's `plugin` forwarder.

package/lib/types/install.d.ts

@@ -24,6 +24,14 @@ export declare const RELEASE_AGE_OVERRIDE = "--config.minimum-release-age=0";
  * WHOLE repo even for a `#path:` subdirectory plugin) on slow networks; a
  * plain retry fails again at the same limit, so the recovery re-runs with
  * this override once. Scoped to a single command like RELEASE_AGE_OVERRIDE.
+ *
+ * pnpm 12 ignores this flag on the command line in either spelling (#615).
+ * On the CLI runner, runDshPlugin repeats every `--config.<key>` override
+ * as PNPM_CONFIG_<KEY>, which pnpm 11 and 12 both read, so the retried
+ * command really does get the longer limit there. The Desktop runtime hands
+ * its host argv only, so on a Desktop host the retry still depends on that
+ * host's pnpm reading the flag. The flag stays: pnpm 11 and earlier read
+ * it, and it costs nothing on the versions that do not.
  */
 export declare const FETCH_TIMEOUT_OVERRIDE = "--config.fetchTimeout=600000";
 /**
@@ -42,6 +50,10 @@ export declare const FETCH_TIMEOUT_OVERRIDE = "--config.fetchTimeout=600000";
  * Verified against pnpm 10.29.3: `peerDependencyRules.ignoreMissing` does
  * NOT prevent the fetch (it only silences the warning), so this flag is the
  * only lever that actually works.
+ *
+ * pnpm 12 ignores this flag on the command line too (12.4.1 auto-installs
+ * the peer regardless); runDshPlugin repeats it as
+ * PNPM_CONFIG_AUTO_INSTALL_PEERS, which 12 reads (#615).
  */
 export declare const AUTO_INSTALL_PEERS_OFF = "--config.auto-install-peers=false";
 /**

package/lib/types/restart.d.ts

@@ -132,6 +132,10 @@ export declare function restartLaunch(): {
  * DSH sandbox tool runners) pops a visible node window. Wrapping the launch
  * in `powershell -WindowStyle Hidden` gives the host a HIDDEN console that
  * children inherit instead. POSIX keeps the plain detached spawn.
+ *
+ * The helper that runs this invocation spawns it with `windowsHide`, because
+ * the helper has no console of its own to hand down and Windows would
+ * otherwise create a visible one for PowerShell (#624).
  */
 export declare function respawnInvocation(launch: {
     file: string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.48.0",
+  "version": "1.49.0",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/client/MarketSection.tsx

@@ -1375,6 +1375,11 @@ export function MarketSection(props: MarketSectionProps) {
   const [buildsSkipped, setBuildsSkipped] = useState<{ plugin?: RegistryPlugin; updateName?: string; names: string[]; restore?: boolean } | null>(null)
   const [updatingAll, setUpdatingAll] = useState(false)
   const [updatedNames, setUpdatedNames] = useState<string[]>([])
+  // #558: session-tracked updates the host actually parked behind a restart.
+  // Kept separate from `updatedNames`, which doubles as the row-level
+  // "updated" marker and therefore also records client-only updates that go
+  // live without a restart.
+  const [restartNames, setRestartNames] = useState<string[]>([])
   const [hotUrls, setHotUrls] = useState<string[]>([])
   const [hotNames, setHotNames] = useState<string[]>([])
   const [progressLine, setProgressLine] = useState<string | null>(null)
@@ -1748,13 +1753,14 @@ export function MarketSection(props: MarketSectionProps) {
     }
     if (Array.isArray(saved.doneUrls) && saved.doneUrls.length > 0) setDoneUrls(saved.doneUrls)
     if (Array.isArray(saved.updated) && saved.updated.length > 0) setUpdatedNames(saved.updated)
+    if (Array.isArray(saved.restartNames) && saved.restartNames.length > 0) setRestartNames(saved.restartNames)
     if (typeof saved.removed === 'number' && saved.removed > 0) setRemovedCount(saved.removed)
     if (typeof saved.toggled === 'number' && saved.toggled > 0) setToggleRestart(saved.toggled)
   }, [bootId])
 
   useEffect(() => {
     if (bootId === null) return
-    if (doneUrls.length === 0 && updatedNames.length === 0 && removedCount === 0 && toggleRestart === 0) {
+    if (doneUrls.length === 0 && updatedNames.length === 0 && restartNames.length === 0 && removedCount === 0 && toggleRestart === 0) {
       // Nothing pending: drop any stale entry (e.g. a hot mount cleared the
       // only doneUrl) so a same-boot remount cannot resurrect the banner (#73).
       sessionStorage.removeItem('dshm-restart')
@@ -1764,10 +1770,11 @@ export function MarketSection(props: MarketSectionProps) {
       boot: bootId,
       doneUrls,
       updated: updatedNames,
+      restartNames,
       removed: removedCount,
       toggled: toggleRestart,
     }))
-  }, [bootId, doneUrls, updatedNames, removedCount, toggleRestart])
+  }, [bootId, doneUrls, updatedNames, restartNames, removedCount, toggleRestart])
 
   const fixEnv = useCallback(() => {
     setEnvFixing(true)
@@ -2412,6 +2419,14 @@ export function MarketSection(props: MarketSectionProps) {
         if (status === 200 && body.ok) {
           setRecords(list => patchRecord(list, updateRecordId, { state: 'done' }))
           setUpdatedNames(names => names.concat(name))
+          // #558: the restart banner counts plugins the host parked behind a
+          // restart, not every completed change. A client-only plugin comes
+          // back 'inert'/'live' and goes live on refresh; when the host
+          // reports no activation at all, count it to stay on the safe side.
+          const activation = body.activation && typeof body.activation === 'object' ? body.activation[name] : undefined
+          if (!activation || activation.state === 'restart') {
+            setRestartNames(names => names.includes(name) ? names : names.concat(name))
+          }
           if (body.activation && typeof body.activation === 'object') {
             setActivations(prev => ({ ...prev, ...body.activation }))
           }
@@ -2972,7 +2987,11 @@ export function MarketSection(props: MarketSectionProps) {
   // mid-run, which would strand the remaining items.
   const selfName = installed['dshmarket'] !== undefined ? 'dshmarket' : 'dsh-market'
   const updatableNames = Object.keys(installed).filter(
-    name => name !== selfName && !updatedNames.includes(name) && updates[name] && updates[name].updateAvailable,
+    name => name !== selfName
+      && !updatedNames.includes(name)
+      && !effectiveDisabledSet.has(name)
+      && updates[name]
+      && updates[name].updateAvailable,
   )
   // Replacing a local source with its catalog source is deliberately not a
   // batch update: every such plugin has an existing, explicit confirmation
@@ -3233,7 +3252,10 @@ export function MarketSection(props: MarketSectionProps) {
     if (Date.now() - last >= 24 * 60 * 60 * 1000) runWebdav('backup')
   }, [autoBackup, runWebdav, webdavUrl, webdavUser])
 
-  const sessionPendingRestart = doneUrls.length + updatedNames.length + removedCount + toggleRestart + (backupRestored ? 1 : 0)
+  // #558: count restart-pending session changes (restartNames), not every
+  // completed `updatedNames` entry (which would double-count a batch update
+  // that reports both a done URL and a name for the same plugin).
+  const sessionPendingRestart = doneUrls.length + restartNames.length + removedCount + toggleRestart + (backupRestored ? 1 : 0)
   /**
    * Plugins the HOST reports as restart-pending, independent of what this
    * browser session happens to remember. Installing and then reloading the

package/src/client/locales.ts

@@ -72,7 +72,7 @@ export const zh = {
   installing: '安装中…',
   installedBadge: '✓ 已安装',
   alreadyInstalled: '✓ 已安装',
-  restartBanner: '项变更完成，重启 DeepSeek Harness 后生效',
+  restartBanner: '项变更需重启 DeepSeek Harness 后生效',
   uninstall: '卸载',
   confirmRemove: '确认卸载？',
   uninstalling: '卸载中…',
@@ -613,7 +613,7 @@ export const en: Record<MarketKey, string> = {
   installing: 'Installing…',
   installedBadge: '✓ Installed',
   alreadyInstalled: '✓ Installed',
-  restartBanner: 'change(s) done — restart DeepSeek Harness to apply',
+  restartBanner: 'change(s) pending restart — restart DeepSeek Harness to apply',
   uninstall: 'Uninstall',
   confirmRemove: 'Uninstall?',
   uninstalling: 'Uninstalling…',

package/src/dsh-cli.ts

@@ -232,6 +232,33 @@ export function gitEnvForPnpm(env: NodeJS.ProcessEnv = process.env): NodeJS.Proc
   return { GIT_TERMINAL_PROMPT: '0' }
 }
 
+/**
+ * Every `--config.<key>=<value>` override in the argv, repeated as the
+ * `PNPM_CONFIG_<KEY>` environment variable that pnpm 12 still reads.
+ *
+ * pnpm 12 ignores some `--config.<key>` overrides on the command line, in
+ * either spelling, without a word: `fetchTimeout` (#615; measured on
+ * 12.2.1, 12.3.0 and 12.4.1) and `auto-install-peers` (12.4.1 auto-installs
+ * the peer with the flag present and not with the variable), so the retries
+ * that carry them ran exactly like the first attempt. `PNPM_CONFIG_*` is
+ * honoured by 11.8, 11.21 and 12.4 alike, so the argument stays for the
+ * versions that read it and the variable carries the same value for the
+ * ones that do not. Scoped to the run that carries the flag; nothing is set
+ * otherwise, so a user's own values are untouched on every other run. Keys
+ * are accepted in either spelling, so respelling a constant (as #600 did
+ * for the release-age one) cannot silently drop the variable.
+ */
+export function pnpmConfigEnvForArgs(pluginArgs: readonly string[]): NodeJS.ProcessEnv {
+  const env: NodeJS.ProcessEnv = {}
+  for (const arg of pluginArgs) {
+    const match = /^--config\.([A-Za-z][A-Za-z0-9-]*)=(\S+)$/.exec(arg)
+    if (match === null) continue
+    const key = match[1]!.replace(/([a-z0-9])([A-Z])/g, '$1_$2').replace(/-/g, '_').toUpperCase()
+    env[`PNPM_CONFIG_${key}`] = match[2]!
+  }
+  return env
+}
+
 function spawnEnv(): NodeJS.ProcessEnv {
   // pnpm v10+ blocks forever on a silent interactive prompt without a TTY;
   // CI mode forces it to act or fail instead of asking.
@@ -913,7 +940,7 @@ export function runDshPlugin(profile: string, pluginArgs: string[]): Promise<Ins
       // pnpm v10 blocks forever on a silent interactive prompt without a TTY
       // (observed on re-add over a pinned git spec); CI mode forces it to act
       // or fail instead of asking.
-      env: spawnEnv(),
+      env: { ...spawnEnv(), ...pnpmConfigEnvForArgs(pluginArgs) },
       stdio: ['ignore', 'pipe', 'pipe'],
       viaShell,
       // Own process group on POSIX so cancel/timeout can kill the whole

package/src/install.ts

@@ -33,6 +33,14 @@ export const RELEASE_AGE_OVERRIDE = '--config.minimum-release-age=0'
  * WHOLE repo even for a `#path:` subdirectory plugin) on slow networks; a
  * plain retry fails again at the same limit, so the recovery re-runs with
  * this override once. Scoped to a single command like RELEASE_AGE_OVERRIDE.
+ *
+ * pnpm 12 ignores this flag on the command line in either spelling (#615).
+ * On the CLI runner, runDshPlugin repeats every `--config.<key>` override
+ * as PNPM_CONFIG_<KEY>, which pnpm 11 and 12 both read, so the retried
+ * command really does get the longer limit there. The Desktop runtime hands
+ * its host argv only, so on a Desktop host the retry still depends on that
+ * host's pnpm reading the flag. The flag stays: pnpm 11 and earlier read
+ * it, and it costs nothing on the versions that do not.
  */
 export const FETCH_TIMEOUT_OVERRIDE = '--config.fetchTimeout=600000'
 
@@ -52,6 +60,10 @@ export const FETCH_TIMEOUT_OVERRIDE = '--config.fetchTimeout=600000'
  * Verified against pnpm 10.29.3: `peerDependencyRules.ignoreMissing` does
  * NOT prevent the fetch (it only silences the warning), so this flag is the
  * only lever that actually works.
+ *
+ * pnpm 12 ignores this flag on the command line too (12.4.1 auto-installs
+ * the peer regardless); runDshPlugin repeats it as
+ * PNPM_CONFIG_AUTO_INSTALL_PEERS, which 12 reads (#615).
  */
 export const AUTO_INSTALL_PEERS_OFF = '--config.auto-install-peers=false'
 

package/src/restart.ts

@@ -246,6 +246,10 @@ export function restartLaunch(): { file: string; args: string[]; cwd: string; vi
  * DSH sandbox tool runners) pops a visible node window. Wrapping the launch
  * in `powershell -WindowStyle Hidden` gives the host a HIDDEN console that
  * children inherit instead. POSIX keeps the plain detached spawn.
+ *
+ * The helper that runs this invocation spawns it with `windowsHide`, because
+ * the helper has no console of its own to hand down and Windows would
+ * otherwise create a visible one for PowerShell (#624).
  */
 export function respawnInvocation(
   launch: { file: string; args: string[]; viaShell: boolean },
@@ -347,7 +351,17 @@ export function restartHelperSource(
     '  try {',
     '    const out = fs.openSync(logOut, "a")',
     '    const err = fs.openSync(logErr, "a")',
-    '    child = spawn(file, args, { cwd, detached, stdio: ["ignore", out, err], env: process.env, shell: viaShell })',
+    // windowsHide (#624 by @davidekingsss): this helper is itself detached,
+    // so on Windows it has no console, and a console program spawned from a
+    // console-less parent is given a NEW, visible one — the "Windows
+    // PowerShell" window that owns the replacement and takes it down when
+    // closed. `-WindowStyle Hidden` cannot hide it: that flag governs the
+    // window PowerShell would create, not the console the spawn handed it.
+    // CREATE_NO_WINDOW keeps the console but never shows it, and the host's
+    // own console children inherit that hidden console rather than popping
+    // windows of their own (measured by the reporter with a console-less
+    // launcher: one PseudoConsoleWindow without the flag, none with it).
+    '    child = spawn(file, args, { cwd, detached, stdio: ["ignore", out, err], env: process.env, shell: viaShell, windowsHide: true })',
     // spawn reports a missing or unexecutable file ASYNCHRONOUSLY; the
     // try/catch below only covers the synchronous throw, so without this
     // listener that failure is exactly as silent as the bug being fixed.