dshmarket 1.48.0 → 1.50.0

package/client/client.js

@@ -105,7 +105,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			installing: "安装中…",
 			installedBadge: "✓ 已安装",
 			alreadyInstalled: "✓ 已安装",
-			restartBanner: "项变更完成，重启 DeepSeek Harness 后生效",
+			restartBanner: "项变更需重启 DeepSeek Harness 后生效",
 			uninstall: "卸载",
 			confirmRemove: "确认卸载？",
 			uninstalling: "卸载中…",
@@ -638,7 +638,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			installing: "Installing…",
 			installedBadge: "✓ Installed",
 			alreadyInstalled: "✓ Installed",
-			restartBanner: "change(s) done — restart DeepSeek Harness to apply",
+			restartBanner: "change(s) pending restart — restart DeepSeek Harness to apply",
 			uninstall: "Uninstall",
 			confirmRemove: "Uninstall?",
 			uninstalling: "Uninstalling…",
@@ -1150,7 +1150,44 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 		* rather than guessing; declared repo evidence that matches nothing in the
 		* catalog must not fall back to a coincidental unique name.
 		*/
+		/**
+		* Memo for findCatalogEntryForLocal, keyed on the catalog array identity and
+		* then the full lookup input (#589).
+		*
+		* The market client calls this once per rendered card for every link:/file:
+		* dependency, and each call filtered the whole catalog and walked every URL —
+		* measured ~300ms per render at 24 cards against a 3,627-entry catalog, on
+		* every keystroke of the search box. The result is a pure function of the
+		* catalog, the name, the identities, and the hints, so caching by the array
+		* identity never serves a stale answer: a refetched catalog is a new array,
+		* and the old inner map becomes collectable. Null results are cached too —
+		* they are the common answer for same-named forks without evidence.
+		*
+		* The input key is the JSON form of the whole tuple, not a delimiter join:
+		* an empty array and an array holding one empty string serialize
+		* differently, and the matcher treats them differently (`identitySet.size >
+		* 0` chooses the evidence branch), so the key must not conflate them
+		* (#485's lesson: weak signals must never override strong ones).
+		*/
+		const localMatchCache = /* @__PURE__ */ new WeakMap();
 		function findCatalogEntryForLocal(plugins, name, identities = [], hints = []) {
+			const cacheKey = JSON.stringify([
+				name,
+				identities,
+				hints
+			]);
+			let byCatalog = localMatchCache.get(plugins);
+			if (byCatalog === void 0) {
+				byCatalog = /* @__PURE__ */ new Map();
+				localMatchCache.set(plugins, byCatalog);
+			}
+			const hit = byCatalog.get(cacheKey);
+			if (hit !== void 0) return hit;
+			const result = findCatalogEntryForLocalUncached(plugins, name, identities, hints);
+			byCatalog.set(cacheKey, result);
+			return result;
+		}
+		function findCatalogEntryForLocalUncached(plugins, name, identities, hints) {
 			const nameKey = name.toLowerCase();
 			const byName = plugins.filter((plugin) => plugin.name.toLowerCase() === nameKey || typeof plugin.npm === "string" && plugin.npm.toLowerCase() === nameKey);
 			const identitySet = new Set(identities.map((value) => value.toLowerCase()));
@@ -1655,56 +1692,6 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			for (const id of entryIdentities(plugin)) if (dep.has(id)) return true;
 			return false;
 		}
-		/**
-		* The same memo, for the branch #262 left behind (#589).
-		*
-		* `looseMatchCount` above covers dependencies installed by version. A
-		* `link:` or `file:` dependency takes the other branch, into
-		* `findCatalogEntryForLocal`, which walks the whole catalog at least twice
-		* per call — once to filter by name, once to collect `/tree/` repos — and
-		* up to twice more when there are identities to probe. Both callers below
-		* run once per rendered card. The reporter profiled ~300ms per repaint at
-		* 24 cards against a 3,627-entry catalog where a version-pinned dependency
-		* paid 1.1ms; a local benchmark measured ~38ms per render at that shape,
-		* and ~1.4s at 96 cards with eight local dependencies.
-		*
-		* The inner key carries the EVIDENCE, not just the name. Installing a plugin
-		* hands the next render a fresh identities array while the catalog array
-		* stays the same, so a name-only key would answer the post-install question
-		* with the pre-install result — which is the same-named-fork confusion #485
-		* asked this matcher to stop making, reintroduced as a cache bug.
-		*
-		* A miss is cached as `null`, which is why the "not cached yet" sentinel
-		* has to be `undefined`: `null` is a real answer here, and it costs the
-		* same full scan to establish as a hit does. It is also the common case —
-		* a checkout you are developing is usually not in the catalog at all.
-		*
-		* The invariant this rests on, stated because the WeakMap cannot enforce it:
-		* the catalog array and the entries inside it are frozen once handed here. A
-		* refetch replaces the array — which is what the outer key is for — but an
-		* in-place `push`, `sort` or `reverse`, or editing a row's `url`, would keep
-		* the key and change the answer. Order is load-bearing too: the matcher
-		* returns the FIRST row that fits. Nothing in the client does any of this
-		* today; `visiblePlugins` and `themePlugins` both sort copies.
-		*/
-		const localMatchCache = /* @__PURE__ */ new WeakMap();
-		function cachedEntryForLocal(plugins, name, identities, hints) {
-			let byKey = localMatchCache.get(plugins);
-			if (byKey === void 0) {
-				byKey = /* @__PURE__ */ new Map();
-				localMatchCache.set(plugins, byKey);
-			}
-			const key = JSON.stringify([
-				name,
-				identities,
-				hints
-			]);
-			const hit = byKey.get(key);
-			if (hit !== void 0) return hit;
-			const entry = findCatalogEntryForLocal(plugins, name, identities, hints);
-			byKey.set(key, entry);
-			return entry;
-		}
 		/** The installed dependency name a registry entry corresponds to, or null. */
 		function matchInstalledName(plugin, installed, repoIdentities = {}, plugins, repoHints = {}) {
 			const ids = entryIdentities(plugin);
@@ -1713,7 +1700,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				const repos = repoIdentities[name] ?? [];
 				if (/^(?:link|file):/i.test(specStr)) {
 					if (plugins === void 0) continue;
-					const entry = cachedEntryForLocal(plugins, name, repos, repoHints[name] ?? []);
+					const entry = findCatalogEntryForLocal(plugins, name, repos, repoHints[name] ?? []);
 					if (entry !== null && entry.url === plugin.url) return name;
 					continue;
 				}
@@ -2115,7 +2102,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 		}
 		/** Catalog row for an installed dependency — strict for local link:/file: specs. */
 		function catalogEntryForInstalled(plugins, name, spec, repoIdentities = [], repoHints = []) {
-			if (/^(?:link|file):/i.test(spec)) return cachedEntryForLocal(plugins, name, repoIdentities, repoHints) ?? void 0;
+			if (/^(?:link|file):/i.test(spec)) return findCatalogEntryForLocal(plugins, name, repoIdentities, repoHints) ?? void 0;
 			return entryForDep(plugins, name, spec, repoIdentities, repoHints);
 		}
 		//#endregion
@@ -6348,6 +6335,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			const [buildsSkipped, setBuildsSkipped] = (0, react.useState)(null);
 			const [updatingAll, setUpdatingAll] = (0, react.useState)(false);
 			const [updatedNames, setUpdatedNames] = (0, react.useState)([]);
+			const [restartNames, setRestartNames] = (0, react.useState)([]);
 			const [hotUrls, setHotUrls] = (0, react.useState)([]);
 			const [hotNames, setHotNames] = (0, react.useState)([]);
 			const [progressLine, setProgressLine] = (0, react.useState)(null);
@@ -6667,12 +6655,13 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				}
 				if (Array.isArray(saved.doneUrls) && saved.doneUrls.length > 0) setDoneUrls(saved.doneUrls);
 				if (Array.isArray(saved.updated) && saved.updated.length > 0) setUpdatedNames(saved.updated);
+				if (Array.isArray(saved.restartNames) && saved.restartNames.length > 0) setRestartNames(saved.restartNames);
 				if (typeof saved.removed === "number" && saved.removed > 0) setRemovedCount(saved.removed);
 				if (typeof saved.toggled === "number" && saved.toggled > 0) setToggleRestart(saved.toggled);
 			}, [bootId]);
 			(0, react.useEffect)(() => {
 				if (bootId === null) return;
-				if (doneUrls.length === 0 && updatedNames.length === 0 && removedCount === 0 && toggleRestart === 0) {
+				if (doneUrls.length === 0 && updatedNames.length === 0 && restartNames.length === 0 && removedCount === 0 && toggleRestart === 0) {
 					sessionStorage.removeItem("dshm-restart");
 					return;
 				}
@@ -6680,6 +6669,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 					boot: bootId,
 					doneUrls,
 					updated: updatedNames,
+					restartNames,
 					removed: removedCount,
 					toggled: toggleRestart
 				}));
@@ -6687,6 +6677,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				bootId,
 				doneUrls,
 				updatedNames,
+				restartNames,
 				removedCount,
 				toggleRestart
 			]);
@@ -7307,6 +7298,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 					if (status === 200 && body.ok) {
 						setRecords((list) => patch(list, updateRecordId, { state: "done" }));
 						setUpdatedNames((names) => names.concat(name));
+						const activation = body.activation && typeof body.activation === "object" ? body.activation[name] : void 0;
+						if (!activation || activation.state === "restart") setRestartNames((names) => names.includes(name) ? names : names.concat(name));
 						if (body.activation && typeof body.activation === "object") setActivations((prev) => ({
 							...prev,
 							...body.activation
@@ -7854,7 +7847,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				});
 			}, [doGroupAction, groups]);
 			const selfName = installed["dshmarket"] !== void 0 ? "dshmarket" : "dsh-market";
-			const updatableNames = Object.keys(installed).filter((name) => name !== selfName && !updatedNames.includes(name) && updates[name] && updates[name].updateAvailable);
+			const updatableNames = Object.keys(installed).filter((name) => name !== selfName && !updatedNames.includes(name) && !effectiveDisabledSet.has(name) && updates[name] && updates[name].updateAvailable);
 			const batchUpdatableNames = updatableNames.filter((name) => updates[name]?.restoreRequired !== true);
 			const ignoredUpdateSet = (0, react.useMemo)(() => new Set(ignoredUpdateNames), [ignoredUpdateNames]);
 			const reminderUpdatableNames = updatableNames.filter((name) => !ignoredUpdateSet.has(name));
@@ -8102,7 +8095,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				webdavUrl,
 				webdavUser
 			]);
-			const sessionPendingRestart = doneUrls.length + updatedNames.length + removedCount + toggleRestart + (backupRestored ? 1 : 0);
+			const sessionPendingRestart = doneUrls.length + restartNames.length + removedCount + toggleRestart + (backupRestored ? 1 : 0);
 			/**
 			* Plugins the HOST reports as restart-pending, independent of what this
 			* browser session happens to remember. Installing and then reloading the

package/lib/catalog-local-match.js

@@ -41,7 +41,41 @@ function catalogEntryMatchesHints(url, hintSet) {
  * rather than guessing; declared repo evidence that matches nothing in the
  * catalog must not fall back to a coincidental unique name.
  */
+/**
+ * Memo for findCatalogEntryForLocal, keyed on the catalog array identity and
+ * then the full lookup input (#589).
+ *
+ * The market client calls this once per rendered card for every link:/file:
+ * dependency, and each call filtered the whole catalog and walked every URL —
+ * measured ~300ms per render at 24 cards against a 3,627-entry catalog, on
+ * every keystroke of the search box. The result is a pure function of the
+ * catalog, the name, the identities, and the hints, so caching by the array
+ * identity never serves a stale answer: a refetched catalog is a new array,
+ * and the old inner map becomes collectable. Null results are cached too —
+ * they are the common answer for same-named forks without evidence.
+ *
+ * The input key is the JSON form of the whole tuple, not a delimiter join:
+ * an empty array and an array holding one empty string serialize
+ * differently, and the matcher treats them differently (`identitySet.size >
+ * 0` chooses the evidence branch), so the key must not conflate them
+ * (#485's lesson: weak signals must never override strong ones).
+ */
+const localMatchCache = new WeakMap();
 export function findCatalogEntryForLocal(plugins, name, identities = [], hints = []) {
+    const cacheKey = JSON.stringify([name, identities, hints]);
+    let byCatalog = localMatchCache.get(plugins);
+    if (byCatalog === undefined) {
+        byCatalog = new Map();
+        localMatchCache.set(plugins, byCatalog);
+    }
+    const hit = byCatalog.get(cacheKey);
+    if (hit !== undefined)
+        return hit;
+    const result = findCatalogEntryForLocalUncached(plugins, name, identities, hints);
+    byCatalog.set(cacheKey, result);
+    return result;
+}
+function findCatalogEntryForLocalUncached(plugins, name, identities, hints) {
     const nameKey = name.toLowerCase();
     const byName = plugins.filter(plugin => plugin.name.toLowerCase() === nameKey
         || (typeof plugin.npm === 'string' && plugin.npm.toLowerCase() === nameKey));

package/lib/dsh-cli.js

@@ -230,6 +230,33 @@ export function gitEnvForPnpm(env = process.env) {
         return {};
     return { GIT_TERMINAL_PROMPT: '0' };
 }
+/**
+ * Every `--config.<key>=<value>` override in the argv, repeated as the
+ * `PNPM_CONFIG_<KEY>` environment variable that pnpm 12 still reads.
+ *
+ * pnpm 12 ignores some `--config.<key>` overrides on the command line, in
+ * either spelling, without a word: `fetchTimeout` (#615; measured on
+ * 12.2.1, 12.3.0 and 12.4.1) and `auto-install-peers` (12.4.1 auto-installs
+ * the peer with the flag present and not with the variable), so the retries
+ * that carry them ran exactly like the first attempt. `PNPM_CONFIG_*` is
+ * honoured by 11.8, 11.21 and 12.4 alike, so the argument stays for the
+ * versions that read it and the variable carries the same value for the
+ * ones that do not. Scoped to the run that carries the flag; nothing is set
+ * otherwise, so a user's own values are untouched on every other run. Keys
+ * are accepted in either spelling, so respelling a constant (as #600 did
+ * for the release-age one) cannot silently drop the variable.
+ */
+export function pnpmConfigEnvForArgs(pluginArgs) {
+    const env = {};
+    for (const arg of pluginArgs) {
+        const match = /^--config\.([A-Za-z][A-Za-z0-9-]*)=(\S+)$/.exec(arg);
+        if (match === null)
+            continue;
+        const key = match[1].replace(/([a-z0-9])([A-Z])/g, '$1_$2').replace(/-/g, '_').toUpperCase();
+        env[`PNPM_CONFIG_${key}`] = match[2];
+    }
+    return env;
+}
 function spawnEnv() {
     // pnpm v10+ blocks forever on a silent interactive prompt without a TTY;
     // CI mode forces it to act or fail instead of asking.
@@ -665,7 +692,7 @@ export const BOOT_ID = `${String(process.pid)}-${String(Date.now())}`;
  */
 export const TARGET_RE = /^[A-Za-z0-9@:./_#+~^=-]+$/;
 /** Mutating pnpm commands get the structured reporter appended. */
-const NDJSON_COMMANDS = new Set(['add', 'remove', 'install']);
+const NDJSON_COMMANDS = new Set(['add', 'remove', 'install', 'update']);
 /** Apply profile-specific pnpm compatibility and the structured reporter. */
 function preparePluginArgs(profileDirectory, pluginArgs) {
     let args = pluginArgsFor(profileDirectory, [...pluginArgs]);
@@ -739,7 +766,7 @@ export function runDshPlugin(profile, pluginArgs) {
             // pnpm v10 blocks forever on a silent interactive prompt without a TTY
             // (observed on re-add over a pinned git spec); CI mode forces it to act
             // or fail instead of asking.
-            env: spawnEnv(),
+            env: { ...spawnEnv(), ...pnpmConfigEnvForArgs(pluginArgs) },
             stdio: ['ignore', 'pipe', 'pipe'],
             viaShell,
             // Own process group on POSIX so cancel/timeout can kill the whole

package/lib/entry-identity.js

@@ -0,0 +1,85 @@
+/**
+ * Which loader entry belongs to which installed package (#646).
+ *
+ * The ecosystem does not require a bundle patch's row `name:` to be the
+ * package name. Two shapes are ordinary:
+ *
+ *     - id: aegis-method-pack
+ *       name: aegis/extensions/dsh/index.js     ← a SUBPATH inside the package
+ *     - id: filesystem
+ *       name: @deepseek-ai/dsh-skill-filesystem  ← another package entirely
+ *
+ * `dsh-chat-import`, `meow-memory` and `dsh-context` all name themselves, so
+ * the simple `name === packageName` comparison worked for years. `aegis`
+ * names an entry inside itself, and every site that compared the two
+ * directly concluded the plugin had no entry — the market reported "no
+ * bundle patch … nothing to hot-mount" on enable (#646) and could not see
+ * the entry was already live.
+ *
+ * Three such sites had grown independently (`src/themes.ts`, `src/verify.ts`,
+ * `src/routes.ts`), each restating the rule from memory. That is the shape
+ * the identity bugs #485→#605 came from: one assumption, several copies,
+ * each fixed at a different time. The rule lives here now, once.
+ *
+ * The carrier case (#156) is NOT decided here. A bundle that mounts someone
+ * else's package has no name relation at all, and is recognised by the entry
+ * ID its own patch inserts — see `bundlePatchInsertedIds`. The two rules
+ * compose; neither replaces the other.
+ */
+/**
+ * Whether a loader entry name refers to `packageName`.
+ *
+ * The `/` bound is load-bearing: without it `toolshrink` would match an
+ * entry named `toolshrink-extra`, a different installed package.
+ *
+ * @param name - an entry's `options.name`, in any shape.
+ * @param packageName - the installed package name to match against.
+ * @returns true for the bare name and for a subpath entry inside it.
+ */
+export function nameMatchesPackage(name, packageName) {
+    if (typeof name !== 'string' || name === '')
+        return false;
+    return name === packageName || name.startsWith(`${packageName}/`);
+}
+/**
+ * The same rule for a loader entry object.
+ *
+ * @param entry - anything with `options.name`, as the host's loader stores it.
+ * @param packageName - the installed package name to match against.
+ * @returns whether this entry is the one `packageName` refers to.
+ */
+export function entryMatchesPackage(entry, packageName) {
+    return nameMatchesPackage(entry.options?.name, packageName);
+}
+/**
+ * The package a subpath entry name belongs to — `aegis/x/y.js` → `aegis`.
+ *
+ * The inverse of {@link nameMatchesPackage}, for building a set of live
+ * packages from a set of live entry names: an entry that is up proves its
+ * package is up, and its name alone does not say so.
+ *
+ * Names that are not npm package names return null rather than a guess: a
+ * relative path, an absolute path, a URL or a cordis builtin would otherwise
+ * "belong to" a package that does not exist, which is worse than no answer.
+ * A scoped name needs three segments (`@scope/pkg/sub`) to have a subpath at
+ * all, and a lone `@scope/pkg` has no package to return.
+ *
+ * @param name - an entry's `options.name`.
+ * @returns the package name, or null when the name cannot imply one.
+ */
+export function packageOfEntryName(name) {
+    if (typeof name !== 'string' || name === '')
+        return null;
+    if (name.startsWith('.') || name.startsWith('/') || name.startsWith('cordis:'))
+        return null;
+    if (name.includes('://'))
+        return null;
+    if (!name.includes('/'))
+        return null;
+    const parts = name.split('/');
+    if (parts[0] === '')
+        return null;
+    if (parts[0].startsWith('@'))
+        return parts.length >= 3 ? `${parts[0]}/${parts[1]}` : null;
+    return parts[0];
+}

package/lib/hot.js

@@ -30,7 +30,7 @@ import { pathToFileURL } from 'node:url';
 import { asChannel } from './channels.js';
 import { asRegion, normalizeGithubProxy } from './regions.js';
 import { logEvent } from './log.js';
-import { entryArtifactExists } from './profile.js';
+import { declaredBundlePatchFile, entryArtifactExists } from './profile.js';
 /**
  * Profile-scoped resolution for hot-mount rows: turn a bare package name into
  * the absolute `file://` entry URL of the package just installed into
@@ -409,12 +409,23 @@ export async function hotMount(ctx, profileDir, packageName) {
                 reason: '宿主不支持热挂载(include 插件不可导入),需重启 / the host cannot hot-mount (include plugin unavailable); restart required',
             };
         }
-        let patchText;
-        try {
-            patchText = readFileSync(join(profileDir, 'node_modules', packageName, 'cordis.patch.yml'), 'utf8');
-        }
-        catch {
-            patchText = null;
+        // Where the patch lives is the PACKAGE's decision, declared as
+        // `dsh.bundle.patch` — `aegis` keeps it in `./extensions/dsh/`. Reading
+        // only the package root made a plugin whose patch is declared elsewhere
+        // look like one with no bundle at all, and the user was told "no bundle
+        // patch … nothing to hot-mount" for a package that plainly has one
+        // (#646). The root file stays as the fallback: it is the long-standing
+        // convention, and `profile.ts` resolves the declared field for everything
+        // else, so the two now agree on where a patch is.
+        const packageRoot = join(profileDir, 'node_modules', packageName);
+        const declared = declaredBundlePatchFile(packageRoot);
+        let patchText = null;
+        for (const file of declared !== null ? [declared] : [join(packageRoot, 'cordis.patch.yml')]) {
+            try {
+                patchText = readFileSync(file, 'utf8');
+                break;
+            }
+            catch { /* try the next location */ }
         }
         let rows;
         if (patchText !== null) {

package/lib/index.js

@@ -4,7 +4,7 @@
  */
 import { createDesktopPluginRuntime } from './dsh-cli.js';
 import { mountMarketRoutes } from './routes.js';
-import { installMarketSettings } from './settings.js';
+import { installDesktopMarketSettings, installMarketSettings } from './settings.js';
 export const name = 'dsh-market';
 /**
  * Register the market against the host context.
@@ -46,10 +46,8 @@ export function apply(ctx, config) {
                 allowRestart: config?.allowRestart,
                 maxSnapshots: config?.maxSnapshots,
             };
-            // Offer allowRestart as a switch on the settings page. Deliberately
-            // NOT in the Desktop branch below: there the shell owns the process
-            // lifecycle and the value is forced false, so it is not the user's to
-            // choose. No-ops on a host without a settings service.
+            // Web settings may control restart; Desktop only registers the card's
+            // namespace below. Both no-op on a host without a settings service.
             installMarketSettings(ctx, resolved);
             host.effect(() => mountMarketRoutes(host, resolved, undefined, agentsLookupOf(ctx)), 'dsh-market: http routes');
             return;
@@ -72,6 +70,7 @@ export function apply(ctx, config) {
                 maxSnapshots: config?.maxSnapshots,
             };
             const desktopHost = desktopCtx;
+            installDesktopMarketSettings(desktopCtx);
             desktopHost.effect(() => {
                 const disposeRoutes = mountMarketRoutes(host, resolved, runtime, agentsLookupOf(ctx));
                 return async () => {

package/lib/install.js

@@ -29,6 +29,14 @@ export const RELEASE_AGE_OVERRIDE = '--config.minimum-release-age=0';
  * WHOLE repo even for a `#path:` subdirectory plugin) on slow networks; a
  * plain retry fails again at the same limit, so the recovery re-runs with
  * this override once. Scoped to a single command like RELEASE_AGE_OVERRIDE.
+ *
+ * pnpm 12 ignores this flag on the command line in either spelling (#615).
+ * On the CLI runner, runDshPlugin repeats every `--config.<key>` override
+ * as PNPM_CONFIG_<KEY>, which pnpm 11 and 12 both read, so the retried
+ * command really does get the longer limit there. The Desktop runtime hands
+ * its host argv only, so on a Desktop host the retry still depends on that
+ * host's pnpm reading the flag. The flag stays: pnpm 11 and earlier read
+ * it, and it costs nothing on the versions that do not.
  */
 export const FETCH_TIMEOUT_OVERRIDE = '--config.fetchTimeout=600000';
 /**
@@ -47,6 +55,10 @@ export const FETCH_TIMEOUT_OVERRIDE = '--config.fetchTimeout=600000';
  * Verified against pnpm 10.29.3: `peerDependencyRules.ignoreMissing` does
  * NOT prevent the fetch (it only silences the warning), so this flag is the
  * only lever that actually works.
+ *
+ * pnpm 12 ignores this flag on the command line too (12.4.1 auto-installs
+ * the peer regardless); runDshPlugin repeats it as
+ * PNPM_CONFIG_AUTO_INSTALL_PEERS, which 12 reads (#615).
  */
 export const AUTO_INSTALL_PEERS_OFF = '--config.auto-install-peers=false';
 /**

package/lib/profile.js

@@ -478,11 +478,18 @@ export function readLockCommits(profile, explicitDir) {
  * Commit recorded for a non-codeload git resolution (`type: git` in pnpm's
  * lockfile). Matched against the install spec so a Gitea/GitLab URL can
  * compare HEAD without mistaking a same-named npm package (#525).
+ *
+ * Two packages of one monorepo resolve from the SAME remote and differ only
+ * by pnpm's `path:` selector, so the spec's subpath has to match too — and
+ * when the spec names no subpath while several entries of that remote do,
+ * there is no answer rather than the first sibling's commit (#632).
  */
 export function readGitResolutionCommit(profile, spec, explicitDir) {
     const want = normalizeGitRepoKey(spec);
     if (want === null)
         return null;
+    const wantPath = gitSubpathSelector(spec);
+    const matches = [];
     try {
         const lock = readFileSync(join(profileDir(profile, explicitDir), 'pnpm-lock.yaml'), 'utf8');
         for (const m of lock.matchAll(/resolution:\s*\{([^}]*)\}/g)) {
@@ -491,12 +498,32 @@ export function readGitResolutionCommit(profile, spec, explicitDir) {
             const repo = /\brepo:\s*([^\s,}]+)/.exec(body);
             if (commit === null || repo === null)
                 continue;
-            if (normalizeGitRepoKey(repo[1]) === want)
-                return commit[1].toLowerCase();
+            if (normalizeGitRepoKey(repo[1]) !== want)
+                continue;
+            const entryPath = /\bpath:\s*([^\s,}]+)/.exec(body)?.[1]?.replace(/^\/+|\/+$/g, '').toLowerCase() ?? null;
+            if (wantPath !== null) {
+                if (entryPath === wantPath)
+                    return commit[1].toLowerCase();
+                continue;
+            }
+            matches.push(commit[1].toLowerCase());
         }
     }
     catch { /* no lockfile */ }
-    return null;
+    // Exactly one entry for this remote is an identity; several are siblings
+    // of one monorepo and none of them is THIS package's commit.
+    return matches.length === 1 ? matches[0] : null;
+}
+/** The `path:` selector of a git spec, normalized for comparison. */
+function gitSubpathSelector(spec) {
+    const hash = spec.indexOf('#');
+    if (hash === -1)
+        return null;
+    const selector = /(?:^|&)path:([^&]*)/.exec(spec.slice(hash + 1))?.[1];
+    if (selector === undefined)
+        return null;
+    const trimmed = selector.replace(/^\/+|\/+$/g, '').toLowerCase();
+    return trimmed === '' ? null : trimmed;
 }
 /** Lowercased transport-agnostic key for comparing two git remote spellings. */
 function normalizeGitRepoKey(spec) {
@@ -654,14 +681,38 @@ export function parsePatchRows(text) {
     return { names, ids, insertedIds };
 }
 /** Rows of the patch a package DECLARES through `dsh.bundle.patch`. */
-function readBundlePatchRows(dir) {
-    const empty = { names: [], ids: [], insertedIds: [] };
+/**
+ * Where a package's bundle patch lives, according to the package itself.
+ *
+ * `dsh.bundle.patch` is the package's own declaration and the only place the
+ * answer is written down: the path may be a subdirectory (`aegis` declares
+ * `./extensions/dsh/cordis.patch.yml`), not just the package root. Callers
+ * that assumed the root file made a plugin with a declared patch look like
+ * one with none (#646) — so the resolution rule lives here, once.
+ *
+ * @param dir - the installed package directory.
+ * @returns the declared patch file's path, or null when the manifest names
+ *   none (or the manifest cannot be read).
+ */
+export function declaredBundlePatchFile(dir) {
     try {
         const manifest = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'));
         const declared = manifest.dsh?.bundle?.patch;
         if (typeof declared !== 'string' || declared === '')
-            return empty;
-        return parsePatchRows(readFileSync(join(dir, declared), 'utf8'));
+            return null;
+        return join(dir, declared);
+    }
+    catch {
+        return null;
+    }
+}
+function readBundlePatchRows(dir) {
+    const empty = { names: [], ids: [], insertedIds: [] };
+    const file = declaredBundlePatchFile(dir);
+    if (file === null)
+        return empty;
+    try {
+        return parsePatchRows(readFileSync(file, 'utf8'));
     }
     catch {
         return empty;

package/lib/restart.js

@@ -241,6 +241,10 @@ export function restartLaunch() {
  * DSH sandbox tool runners) pops a visible node window. Wrapping the launch
  * in `powershell -WindowStyle Hidden` gives the host a HIDDEN console that
  * children inherit instead. POSIX keeps the plain detached spawn.
+ *
+ * The helper that runs this invocation spawns it with `windowsHide`, because
+ * the helper has no console of its own to hand down and Windows would
+ * otherwise create a visible one for PowerShell (#624).
  */
 export function respawnInvocation(launch, platform = process.platform) {
     if (platform !== 'win32') {
@@ -325,7 +329,17 @@ export function restartHelperSource(spawned, launch, logs, port) {
         '  try {',
         '    const out = fs.openSync(logOut, "a")',
         '    const err = fs.openSync(logErr, "a")',
-        '    child = spawn(file, args, { cwd, detached, stdio: ["ignore", out, err], env: process.env, shell: viaShell })',
+        // windowsHide (#624 by @davidekingsss): this helper is itself detached,
+        // so on Windows it has no console, and a console program spawned from a
+        // console-less parent is given a NEW, visible one — the "Windows
+        // PowerShell" window that owns the replacement and takes it down when
+        // closed. `-WindowStyle Hidden` cannot hide it: that flag governs the
+        // window PowerShell would create, not the console the spawn handed it.
+        // CREATE_NO_WINDOW keeps the console but never shows it, and the host's
+        // own console children inherit that hidden console rather than popping
+        // windows of their own (measured by the reporter with a console-less
+        // launcher: one PseudoConsoleWindow without the flag, none with it).
+        '    child = spawn(file, args, { cwd, detached, stdio: ["ignore", out, err], env: process.env, shell: viaShell, windowsHide: true })',
         // spawn reports a missing or unexecutable file ASYNCHRONOUSLY; the
         // try/catch below only covers the synchronous throw, so without this
         // listener that failure is exactly as silent as the bug being fixed.