dshmarket 1.49.0 → 1.50.0

package/client/client.js

@@ -1150,7 +1150,44 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 		* rather than guessing; declared repo evidence that matches nothing in the
 		* catalog must not fall back to a coincidental unique name.
 		*/
+		/**
+		* Memo for findCatalogEntryForLocal, keyed on the catalog array identity and
+		* then the full lookup input (#589).
+		*
+		* The market client calls this once per rendered card for every link:/file:
+		* dependency, and each call filtered the whole catalog and walked every URL —
+		* measured ~300ms per render at 24 cards against a 3,627-entry catalog, on
+		* every keystroke of the search box. The result is a pure function of the
+		* catalog, the name, the identities, and the hints, so caching by the array
+		* identity never serves a stale answer: a refetched catalog is a new array,
+		* and the old inner map becomes collectable. Null results are cached too —
+		* they are the common answer for same-named forks without evidence.
+		*
+		* The input key is the JSON form of the whole tuple, not a delimiter join:
+		* an empty array and an array holding one empty string serialize
+		* differently, and the matcher treats them differently (`identitySet.size >
+		* 0` chooses the evidence branch), so the key must not conflate them
+		* (#485's lesson: weak signals must never override strong ones).
+		*/
+		const localMatchCache = /* @__PURE__ */ new WeakMap();
 		function findCatalogEntryForLocal(plugins, name, identities = [], hints = []) {
+			const cacheKey = JSON.stringify([
+				name,
+				identities,
+				hints
+			]);
+			let byCatalog = localMatchCache.get(plugins);
+			if (byCatalog === void 0) {
+				byCatalog = /* @__PURE__ */ new Map();
+				localMatchCache.set(plugins, byCatalog);
+			}
+			const hit = byCatalog.get(cacheKey);
+			if (hit !== void 0) return hit;
+			const result = findCatalogEntryForLocalUncached(plugins, name, identities, hints);
+			byCatalog.set(cacheKey, result);
+			return result;
+		}
+		function findCatalogEntryForLocalUncached(plugins, name, identities, hints) {
 			const nameKey = name.toLowerCase();
 			const byName = plugins.filter((plugin) => plugin.name.toLowerCase() === nameKey || typeof plugin.npm === "string" && plugin.npm.toLowerCase() === nameKey);
 			const identitySet = new Set(identities.map((value) => value.toLowerCase()));
@@ -1655,56 +1692,6 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			for (const id of entryIdentities(plugin)) if (dep.has(id)) return true;
 			return false;
 		}
-		/**
-		* The same memo, for the branch #262 left behind (#589).
-		*
-		* `looseMatchCount` above covers dependencies installed by version. A
-		* `link:` or `file:` dependency takes the other branch, into
-		* `findCatalogEntryForLocal`, which walks the whole catalog at least twice
-		* per call — once to filter by name, once to collect `/tree/` repos — and
-		* up to twice more when there are identities to probe. Both callers below
-		* run once per rendered card. The reporter profiled ~300ms per repaint at
-		* 24 cards against a 3,627-entry catalog where a version-pinned dependency
-		* paid 1.1ms; a local benchmark measured ~38ms per render at that shape,
-		* and ~1.4s at 96 cards with eight local dependencies.
-		*
-		* The inner key carries the EVIDENCE, not just the name. Installing a plugin
-		* hands the next render a fresh identities array while the catalog array
-		* stays the same, so a name-only key would answer the post-install question
-		* with the pre-install result — which is the same-named-fork confusion #485
-		* asked this matcher to stop making, reintroduced as a cache bug.
-		*
-		* A miss is cached as `null`, which is why the "not cached yet" sentinel
-		* has to be `undefined`: `null` is a real answer here, and it costs the
-		* same full scan to establish as a hit does. It is also the common case —
-		* a checkout you are developing is usually not in the catalog at all.
-		*
-		* The invariant this rests on, stated because the WeakMap cannot enforce it:
-		* the catalog array and the entries inside it are frozen once handed here. A
-		* refetch replaces the array — which is what the outer key is for — but an
-		* in-place `push`, `sort` or `reverse`, or editing a row's `url`, would keep
-		* the key and change the answer. Order is load-bearing too: the matcher
-		* returns the FIRST row that fits. Nothing in the client does any of this
-		* today; `visiblePlugins` and `themePlugins` both sort copies.
-		*/
-		const localMatchCache = /* @__PURE__ */ new WeakMap();
-		function cachedEntryForLocal(plugins, name, identities, hints) {
-			let byKey = localMatchCache.get(plugins);
-			if (byKey === void 0) {
-				byKey = /* @__PURE__ */ new Map();
-				localMatchCache.set(plugins, byKey);
-			}
-			const key = JSON.stringify([
-				name,
-				identities,
-				hints
-			]);
-			const hit = byKey.get(key);
-			if (hit !== void 0) return hit;
-			const entry = findCatalogEntryForLocal(plugins, name, identities, hints);
-			byKey.set(key, entry);
-			return entry;
-		}
 		/** The installed dependency name a registry entry corresponds to, or null. */
 		function matchInstalledName(plugin, installed, repoIdentities = {}, plugins, repoHints = {}) {
 			const ids = entryIdentities(plugin);
@@ -1713,7 +1700,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				const repos = repoIdentities[name] ?? [];
 				if (/^(?:link|file):/i.test(specStr)) {
 					if (plugins === void 0) continue;
-					const entry = cachedEntryForLocal(plugins, name, repos, repoHints[name] ?? []);
+					const entry = findCatalogEntryForLocal(plugins, name, repos, repoHints[name] ?? []);
 					if (entry !== null && entry.url === plugin.url) return name;
 					continue;
 				}
@@ -2115,7 +2102,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 		}
 		/** Catalog row for an installed dependency — strict for local link:/file: specs. */
 		function catalogEntryForInstalled(plugins, name, spec, repoIdentities = [], repoHints = []) {
-			if (/^(?:link|file):/i.test(spec)) return cachedEntryForLocal(plugins, name, repoIdentities, repoHints) ?? void 0;
+			if (/^(?:link|file):/i.test(spec)) return findCatalogEntryForLocal(plugins, name, repoIdentities, repoHints) ?? void 0;
 			return entryForDep(plugins, name, spec, repoIdentities, repoHints);
 		}
 		//#endregion

package/lib/catalog-local-match.js

@@ -41,7 +41,41 @@ function catalogEntryMatchesHints(url, hintSet) {
  * rather than guessing; declared repo evidence that matches nothing in the
  * catalog must not fall back to a coincidental unique name.
  */
+/**
+ * Memo for findCatalogEntryForLocal, keyed on the catalog array identity and
+ * then the full lookup input (#589).
+ *
+ * The market client calls this once per rendered card for every link:/file:
+ * dependency, and each call filtered the whole catalog and walked every URL —
+ * measured ~300ms per render at 24 cards against a 3,627-entry catalog, on
+ * every keystroke of the search box. The result is a pure function of the
+ * catalog, the name, the identities, and the hints, so caching by the array
+ * identity never serves a stale answer: a refetched catalog is a new array,
+ * and the old inner map becomes collectable. Null results are cached too —
+ * they are the common answer for same-named forks without evidence.
+ *
+ * The input key is the JSON form of the whole tuple, not a delimiter join:
+ * an empty array and an array holding one empty string serialize
+ * differently, and the matcher treats them differently (`identitySet.size >
+ * 0` chooses the evidence branch), so the key must not conflate them
+ * (#485's lesson: weak signals must never override strong ones).
+ */
+const localMatchCache = new WeakMap();
 export function findCatalogEntryForLocal(plugins, name, identities = [], hints = []) {
+    const cacheKey = JSON.stringify([name, identities, hints]);
+    let byCatalog = localMatchCache.get(plugins);
+    if (byCatalog === undefined) {
+        byCatalog = new Map();
+        localMatchCache.set(plugins, byCatalog);
+    }
+    const hit = byCatalog.get(cacheKey);
+    if (hit !== undefined)
+        return hit;
+    const result = findCatalogEntryForLocalUncached(plugins, name, identities, hints);
+    byCatalog.set(cacheKey, result);
+    return result;
+}
+function findCatalogEntryForLocalUncached(plugins, name, identities, hints) {
     const nameKey = name.toLowerCase();
     const byName = plugins.filter(plugin => plugin.name.toLowerCase() === nameKey
         || (typeof plugin.npm === 'string' && plugin.npm.toLowerCase() === nameKey));

package/lib/dsh-cli.js

@@ -692,7 +692,7 @@ export const BOOT_ID = `${String(process.pid)}-${String(Date.now())}`;
  */
 export const TARGET_RE = /^[A-Za-z0-9@:./_#+~^=-]+$/;
 /** Mutating pnpm commands get the structured reporter appended. */
-const NDJSON_COMMANDS = new Set(['add', 'remove', 'install']);
+const NDJSON_COMMANDS = new Set(['add', 'remove', 'install', 'update']);
 /** Apply profile-specific pnpm compatibility and the structured reporter. */
 function preparePluginArgs(profileDirectory, pluginArgs) {
     let args = pluginArgsFor(profileDirectory, [...pluginArgs]);

package/lib/entry-identity.js

@@ -0,0 +1,85 @@
+/**
+ * Which loader entry belongs to which installed package (#646).
+ *
+ * The ecosystem does not require a bundle patch's row `name:` to be the
+ * package name. Two shapes are ordinary:
+ *
+ *     - id: aegis-method-pack
+ *       name: aegis/extensions/dsh/index.js     ← a SUBPATH inside the package
+ *     - id: filesystem
+ *       name: @deepseek-ai/dsh-skill-filesystem  ← another package entirely
+ *
+ * `dsh-chat-import`, `meow-memory` and `dsh-context` all name themselves, so
+ * the simple `name === packageName` comparison worked for years. `aegis`
+ * names an entry inside itself, and every site that compared the two
+ * directly concluded the plugin had no entry — the market reported "no
+ * bundle patch … nothing to hot-mount" on enable (#646) and could not see
+ * the entry was already live.
+ *
+ * Three such sites had grown independently (`src/themes.ts`, `src/verify.ts`,
+ * `src/routes.ts`), each restating the rule from memory. That is the shape
+ * the identity bugs #485→#605 came from: one assumption, several copies,
+ * each fixed at a different time. The rule lives here now, once.
+ *
+ * The carrier case (#156) is NOT decided here. A bundle that mounts someone
+ * else's package has no name relation at all, and is recognised by the entry
+ * ID its own patch inserts — see `bundlePatchInsertedIds`. The two rules
+ * compose; neither replaces the other.
+ */
+/**
+ * Whether a loader entry name refers to `packageName`.
+ *
+ * The `/` bound is load-bearing: without it `toolshrink` would match an
+ * entry named `toolshrink-extra`, a different installed package.
+ *
+ * @param name - an entry's `options.name`, in any shape.
+ * @param packageName - the installed package name to match against.
+ * @returns true for the bare name and for a subpath entry inside it.
+ */
+export function nameMatchesPackage(name, packageName) {
+    if (typeof name !== 'string' || name === '')
+        return false;
+    return name === packageName || name.startsWith(`${packageName}/`);
+}
+/**
+ * The same rule for a loader entry object.
+ *
+ * @param entry - anything with `options.name`, as the host's loader stores it.
+ * @param packageName - the installed package name to match against.
+ * @returns whether this entry is the one `packageName` refers to.
+ */
+export function entryMatchesPackage(entry, packageName) {
+    return nameMatchesPackage(entry.options?.name, packageName);
+}
+/**
+ * The package a subpath entry name belongs to — `aegis/x/y.js` → `aegis`.
+ *
+ * The inverse of {@link nameMatchesPackage}, for building a set of live
+ * packages from a set of live entry names: an entry that is up proves its
+ * package is up, and its name alone does not say so.
+ *
+ * Names that are not npm package names return null rather than a guess: a
+ * relative path, an absolute path, a URL or a cordis builtin would otherwise
+ * "belong to" a package that does not exist, which is worse than no answer.
+ * A scoped name needs three segments (`@scope/pkg/sub`) to have a subpath at
+ * all, and a lone `@scope/pkg` has no package to return.
+ *
+ * @param name - an entry's `options.name`.
+ * @returns the package name, or null when the name cannot imply one.
+ */
+export function packageOfEntryName(name) {
+    if (typeof name !== 'string' || name === '')
+        return null;
+    if (name.startsWith('.') || name.startsWith('/') || name.startsWith('cordis:'))
+        return null;
+    if (name.includes('://'))
+        return null;
+    if (!name.includes('/'))
+        return null;
+    const parts = name.split('/');
+    if (parts[0] === '')
+        return null;
+    if (parts[0].startsWith('@'))
+        return parts.length >= 3 ? `${parts[0]}/${parts[1]}` : null;
+    return parts[0];
+}

package/lib/hot.js

@@ -30,7 +30,7 @@ import { pathToFileURL } from 'node:url';
 import { asChannel } from './channels.js';
 import { asRegion, normalizeGithubProxy } from './regions.js';
 import { logEvent } from './log.js';
-import { entryArtifactExists } from './profile.js';
+import { declaredBundlePatchFile, entryArtifactExists } from './profile.js';
 /**
  * Profile-scoped resolution for hot-mount rows: turn a bare package name into
  * the absolute `file://` entry URL of the package just installed into
@@ -409,12 +409,23 @@ export async function hotMount(ctx, profileDir, packageName) {
                 reason: '宿主不支持热挂载(include 插件不可导入),需重启 / the host cannot hot-mount (include plugin unavailable); restart required',
             };
         }
-        let patchText;
-        try {
-            patchText = readFileSync(join(profileDir, 'node_modules', packageName, 'cordis.patch.yml'), 'utf8');
-        }
-        catch {
-            patchText = null;
+        // Where the patch lives is the PACKAGE's decision, declared as
+        // `dsh.bundle.patch` — `aegis` keeps it in `./extensions/dsh/`. Reading
+        // only the package root made a plugin whose patch is declared elsewhere
+        // look like one with no bundle at all, and the user was told "no bundle
+        // patch … nothing to hot-mount" for a package that plainly has one
+        // (#646). The root file stays as the fallback: it is the long-standing
+        // convention, and `profile.ts` resolves the declared field for everything
+        // else, so the two now agree on where a patch is.
+        const packageRoot = join(profileDir, 'node_modules', packageName);
+        const declared = declaredBundlePatchFile(packageRoot);
+        let patchText = null;
+        for (const file of declared !== null ? [declared] : [join(packageRoot, 'cordis.patch.yml')]) {
+            try {
+                patchText = readFileSync(file, 'utf8');
+                break;
+            }
+            catch { /* try the next location */ }
         }
         let rows;
         if (patchText !== null) {

package/lib/index.js

@@ -4,7 +4,7 @@
  */
 import { createDesktopPluginRuntime } from './dsh-cli.js';
 import { mountMarketRoutes } from './routes.js';
-import { installMarketSettings } from './settings.js';
+import { installDesktopMarketSettings, installMarketSettings } from './settings.js';
 export const name = 'dsh-market';
 /**
  * Register the market against the host context.
@@ -46,10 +46,8 @@ export function apply(ctx, config) {
                 allowRestart: config?.allowRestart,
                 maxSnapshots: config?.maxSnapshots,
             };
-            // Offer allowRestart as a switch on the settings page. Deliberately
-            // NOT in the Desktop branch below: there the shell owns the process
-            // lifecycle and the value is forced false, so it is not the user's to
-            // choose. No-ops on a host without a settings service.
+            // Web settings may control restart; Desktop only registers the card's
+            // namespace below. Both no-op on a host without a settings service.
             installMarketSettings(ctx, resolved);
             host.effect(() => mountMarketRoutes(host, resolved, undefined, agentsLookupOf(ctx)), 'dsh-market: http routes');
             return;
@@ -72,6 +70,7 @@ export function apply(ctx, config) {
                 maxSnapshots: config?.maxSnapshots,
             };
             const desktopHost = desktopCtx;
+            installDesktopMarketSettings(desktopCtx);
             desktopHost.effect(() => {
                 const disposeRoutes = mountMarketRoutes(host, resolved, runtime, agentsLookupOf(ctx));
                 return async () => {

package/lib/profile.js

@@ -478,11 +478,18 @@ export function readLockCommits(profile, explicitDir) {
  * Commit recorded for a non-codeload git resolution (`type: git` in pnpm's
  * lockfile). Matched against the install spec so a Gitea/GitLab URL can
  * compare HEAD without mistaking a same-named npm package (#525).
+ *
+ * Two packages of one monorepo resolve from the SAME remote and differ only
+ * by pnpm's `path:` selector, so the spec's subpath has to match too — and
+ * when the spec names no subpath while several entries of that remote do,
+ * there is no answer rather than the first sibling's commit (#632).
  */
 export function readGitResolutionCommit(profile, spec, explicitDir) {
     const want = normalizeGitRepoKey(spec);
     if (want === null)
         return null;
+    const wantPath = gitSubpathSelector(spec);
+    const matches = [];
     try {
         const lock = readFileSync(join(profileDir(profile, explicitDir), 'pnpm-lock.yaml'), 'utf8');
         for (const m of lock.matchAll(/resolution:\s*\{([^}]*)\}/g)) {
@@ -491,12 +498,32 @@ export function readGitResolutionCommit(profile, spec, explicitDir) {
             const repo = /\brepo:\s*([^\s,}]+)/.exec(body);
             if (commit === null || repo === null)
                 continue;
-            if (normalizeGitRepoKey(repo[1]) === want)
-                return commit[1].toLowerCase();
+            if (normalizeGitRepoKey(repo[1]) !== want)
+                continue;
+            const entryPath = /\bpath:\s*([^\s,}]+)/.exec(body)?.[1]?.replace(/^\/+|\/+$/g, '').toLowerCase() ?? null;
+            if (wantPath !== null) {
+                if (entryPath === wantPath)
+                    return commit[1].toLowerCase();
+                continue;
+            }
+            matches.push(commit[1].toLowerCase());
         }
     }
     catch { /* no lockfile */ }
-    return null;
+    // Exactly one entry for this remote is an identity; several are siblings
+    // of one monorepo and none of them is THIS package's commit.
+    return matches.length === 1 ? matches[0] : null;
+}
+/** The `path:` selector of a git spec, normalized for comparison. */
+function gitSubpathSelector(spec) {
+    const hash = spec.indexOf('#');
+    if (hash === -1)
+        return null;
+    const selector = /(?:^|&)path:([^&]*)/.exec(spec.slice(hash + 1))?.[1];
+    if (selector === undefined)
+        return null;
+    const trimmed = selector.replace(/^\/+|\/+$/g, '').toLowerCase();
+    return trimmed === '' ? null : trimmed;
 }
 /** Lowercased transport-agnostic key for comparing two git remote spellings. */
 function normalizeGitRepoKey(spec) {
@@ -654,14 +681,38 @@ export function parsePatchRows(text) {
     return { names, ids, insertedIds };
 }
 /** Rows of the patch a package DECLARES through `dsh.bundle.patch`. */
-function readBundlePatchRows(dir) {
-    const empty = { names: [], ids: [], insertedIds: [] };
+/**
+ * Where a package's bundle patch lives, according to the package itself.
+ *
+ * `dsh.bundle.patch` is the package's own declaration and the only place the
+ * answer is written down: the path may be a subdirectory (`aegis` declares
+ * `./extensions/dsh/cordis.patch.yml`), not just the package root. Callers
+ * that assumed the root file made a plugin with a declared patch look like
+ * one with none (#646) — so the resolution rule lives here, once.
+ *
+ * @param dir - the installed package directory.
+ * @returns the declared patch file's path, or null when the manifest names
+ *   none (or the manifest cannot be read).
+ */
+export function declaredBundlePatchFile(dir) {
     try {
         const manifest = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'));
         const declared = manifest.dsh?.bundle?.patch;
         if (typeof declared !== 'string' || declared === '')
-            return empty;
-        return parsePatchRows(readFileSync(join(dir, declared), 'utf8'));
+            return null;
+        return join(dir, declared);
+    }
+    catch {
+        return null;
+    }
+}
+function readBundlePatchRows(dir) {
+    const empty = { names: [], ids: [], insertedIds: [] };
+    const file = declaredBundlePatchFile(dir);
+    if (file === null)
+        return empty;
+    try {
+        return parsePatchRows(readFileSync(file, 'utf8'));
     }
     catch {
         return empty;

package/lib/routes.js

@@ -20,7 +20,8 @@ import { configurePersistentLog, exportLogs, logEvent, readPersistentLog } from
 import { marketFetch } from './net.js';
 import { diagnosePackageManifests } from './diagnostics.js';
 import { BOOT_ID, cancelActive, probePnpm, progress, provisionPnpm, runDshPlugin, TARGET_RE, } from './dsh-cli.js';
-import { addProfileBundle, dropFromManifest, hasLoadableEntry, holdsNativeAddon, INBOX_BUNDLES, isDshProfileName, profileDir, readInstalled, readInstalledManifest, readInstalledRepoEvidence, readInstalledVersion, readLockCommits, readProfileBundles, readProfileManifestSnapshot, removeProfileBundle, restoreProfileManifest, setAllowBuilds } from './profile.js';
+import { packageOfEntryName } from './entry-identity.js';
+import { addProfileBundle, dropFromManifest, hasLoadableEntry, holdsNativeAddon, INBOX_BUNDLES, isDshProfileName, profileDir, readGitResolutionCommit, readInstalled, readInstalledManifest, readInstalledRepoEvidence, readInstalledVersion, readLockCommits, readProfileBundles, readProfileManifestSnapshot, removeProfileBundle, restoreProfileManifest, setAllowBuilds } from './profile.js';
 import { assessProfile, classifyPeer, introducedDuplicateNames, introducedRisks } from './compatibility.js';
 import { runningAgentIds } from './agents.js';
 import { analyzeProfile, corePackageNames } from './check.js';
@@ -28,7 +29,7 @@ import { applyBundleOrder, mergeOrder, readBundleRules, readBundleStack, validat
 import { applyPreset, deletePreset, listPresets, previewPreset, savePreset } from './presets.js';
 import { createProfileSnapshot, DEFAULT_MAX_SNAPSHOTS, deleteSnapshot, listSnapshots, restoreSnapshot } from './snapshot.js';
 import { trialValidate } from './trial.js';
-import { codeloadAllowBuildsKey, findCatalogEntryForLocal, findInstalledAlias, githubCommitOfTarget, githubTargetAtCommit, gitAllowBuildsKey, gitUpdateTarget, installTargetFor, isGenerationLink, isLocalSpec, NPM_NAME_RE, repoOfTarget, restoreBlockedByWorkspace, restoreTargetForLocal, workspaceProtocolDeps } from './sources.js';
+import { codeloadAllowBuildsKey, findCatalogEntryForLocal, findInstalledAlias, gitCommitOfTarget, githubCommitOfTarget, githubTargetAtCommit, gitAllowBuildsKey, gitTargetAtCommit, gitUpdateTarget, installTargetFor, isGenerationLink, isLocalSpec, parseGitHubRemote, NPM_NAME_RE, repoOfTarget, restoreBlockedByWorkspace, restoreTargetForLocal, workspaceProtocolDeps } from './sources.js';
 import { failureDetail, groupConflictsByOwner, isStaleUpdate, parseIgnoredBuilds, parsePrepareNotAllowed, pnpmBlockedByOpenFiles, pnpmNeverStarted, RELEASE_AGE_OVERRIDE, retargetCollections, validateAddedPlugins, withHoistRecovery } from './install.js';
 import { classifyPnpmFailure } from './pnpm-compat.js';
 import { asChannel, CHANNELS, DIST_TAG, resolveChannel } from './channels.js';
@@ -514,8 +515,16 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
         for (const entry of host.loader.entries()) {
             if (entry.fiber === undefined)
                 continue;
-            if (entry.options.name !== undefined)
+            if (entry.options.name !== undefined) {
                 live.add(entry.options.name);
+                // A SUBPATH entry is up, and its package is therefore up — but the
+                // package name never appears as an entry name (#646). Without this,
+                // a plugin mounted as `aegis/extensions/dsh/index.js` reads as "not
+                // enabled / needs restart" while its entry is visibly live.
+                const owner = packageOfEntryName(String(entry.options.name));
+                if (owner !== null)
+                    live.add(owner);
+            }
             // Entry IDS too, under a `#` prefix that cannot collide with a package
             // name. A CARRIER bundle's row names the package it mounts, not
             // itself (#156: @tt-a1i/archify-dsh inserts an entry named
@@ -736,12 +745,36 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
         logEvent('info', 'update-rollback', `${name}: restored npm build v${beforeVersion}`);
         return { ok: true, detail: null };
     }
+    /**
+     * The commit pnpm recorded for a git-sourced install, read the way pnpm
+     * wrote it: a `type: git` resolution for a plain remote, and the codeload
+     * tarball for a GitHub one — `git+https://github.com/o/r.git` resolves to
+     * a tarball, not a git entry, so reading only one of the two would report
+     * a rollback that really happened as unverified (#632).
+     */
+    function gitIdentityCommit(spec) {
+        const fromGit = readGitResolutionCommit(config.profile, spec, activeProfileDir);
+        if (fromGit !== null)
+            return fromGit;
+        const github = repoOfTarget(spec)?.split('#')[0] ?? parseGitHubRemote(spec)?.repo ?? null;
+        return github === null
+            ? null
+            : readLockCommits(config.profile, activeProfileDir).get(github.toLowerCase()) ?? null;
+    }
     function exactGitRollbackTarget(target, beforeCommit) {
-        return githubCommitOfTarget(target) === beforeCommit
+        if (repoOfTarget(target) !== null) {
+            return githubCommitOfTarget(target) === beforeCommit
+                ? target
+                : githubTargetAtCommit(target, beforeCommit);
+        }
+        // A non-GitHub remote (#632): the identity is the URL's own pin or the
+        // commit pnpm recorded for it, and the remote as spelled, pinned to that
+        // commit, is the exact target.
+        return gitCommitOfTarget(target) === beforeCommit
             ? target
-            : githubTargetAtCommit(target, beforeCommit);
+            : gitTargetAtCommit(target, beforeCommit);
     }
-    /** Restore a github: update by re-adding the commit captured before it. */
+    /** Restore a git-sourced update by re-adding the commit captured before it. */
     async function rollbackGitBuild(name, manifestBefore, target, beforeCommit, lockfileBefore, keepRepairedLock) {
         // Preserve an already immutable durable spelling (including a pinned
         // codeload URL). Rewriting that source to github: while keeping the
@@ -749,26 +782,25 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
         // Floating shortcuts still need to be converted to an exact commit.
         const rollbackTarget = exactGitRollbackTarget(target, beforeCommit);
         if (rollbackTarget === null) {
-            return { ok: false, detail: 'the previous github target is invalid; nothing to roll back to' };
+            return { ok: false, detail: 'the previous git target is invalid; nothing to roll back to' };
         }
         const rollback = await rollbackExactTarget(name, manifestBefore, lockfileBefore, rollbackTarget, keepRepairedLock);
         if (!rollback.ok)
             return rollback;
-        const repoKey = repoOfTarget(rollbackTarget)?.split('#')[0] ?? null;
-        const restoredCommit = repoKey === null
-            ? null
-            : readLockCommits(config.profile, activeProfileDir).get(repoKey.toLowerCase()) ?? null;
+        // What pnpm actually resolved, read back the way the identity was
+        // captured: the codeload tarball for GitHub, the git resolution otherwise.
+        const restoredCommit = gitIdentityCommit(rollbackTarget);
         if (restoredCommit !== beforeCommit) {
             return { ok: false, detail: `expected commit ${beforeCommit} after rollback, found ${restoredCommit ?? 'unknown'}` };
         }
-        logEvent('info', 'update-rollback', `${name}: restored github build at ${beforeCommit}`);
+        logEvent('info', 'update-rollback', `${name}: restored git build at ${beforeCommit}`);
         return { ok: true, detail: null };
     }
     async function executeUpdateRollback(name, manifestBefore, source) {
         if (source.kind === 'npm') {
             return rollbackNpmBuild(name, manifestBefore, source.beforeVersion, source.lockfileBefore);
         }
-        if (source.kind === 'github') {
+        if (source.kind === 'git') {
             return rollbackGitBuild(name, manifestBefore, source.target, source.beforeCommit, source.lockfileBefore, source.keepRepairedLock);
         }
         return rollbackUpdateBuild(name, manifestBefore, true);
@@ -3032,11 +3064,17 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                                     : await acceleratedTarget(gitSpec, region);
                         const repoIdentity = isGit ? repoOfTarget(spec) : null;
                         const repoKey = repoIdentity?.split('#')[0] ?? null;
+                        // A non-GitHub remote (#632) has no repo key. Its identity is the
+                        // URL's own pin or the commit pnpm recorded for the remote, the
+                        // same two reads the update check already trusts for it.
+                        const genericGit = isGit && repoKey === null;
+                        const sourceKind = repoKey !== null ? 'GitHub' : 'git';
                         // dsh-cli's deliberately narrow target grammar rejects the `&`
                         // required to combine an exact commit and a monorepo path. Do not
                         // weaken that command boundary or offer a rollback action that
                         // the real host can never execute.
-                        const hasGitSubpath = repoIdentity?.includes('#path:/') ?? false;
+                        const hasGitSubpath = repoIdentity?.includes('#path:/')
+                            ?? (genericGit && /#(?:[^#]*&)?path:/.test(spec));
                         // Captured BEFORE pnpm replaces the files: afterwards the loader
                         // inventory reads exactly the same, because replacing a package
                         // on disk does not unload the module the process already imported.
@@ -3051,19 +3089,31 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                         // that lock and rollback must keep the repair. Floating Git specs
                         // still derive identity from the captured lock, so their exact
                         // importer bytes remain the authority after rematerialization.
-                        const manifestPinnedCommit = repoKey !== null ? githubCommitOfTarget(spec) : null;
-                        const capturedLockCommit = repoKey !== null
-                            ? readLockCommits(config.profile, activeProfileDir).get(repoKey) ?? null
-                            : null;
+                        const manifestPinnedCommit = repoKey !== null
+                            ? githubCommitOfTarget(spec)
+                            : genericGit ? gitCommitOfTarget(spec) : null;
+                        const capturedLockCommit = isGit ? gitIdentityCommit(spec) : null;
                         const beforeCommit = manifestPinnedCommit ?? capturedLockCommit;
                         const keepRepairedGitLock = manifestPinnedCommit !== null
                             && capturedLockCommit !== manifestPinnedCommit;
                         const gitRollbackTarget = beforeCommit === null
                             ? null
                             : exactGitRollbackTarget(spec, beforeCommit);
+                        // A floating git spec makes `add` a no-op: the target is
+                        // byte-identical to the specifier already in the manifest, so
+                        // pnpm answers "Lockfile is up to date, resolution step is
+                        // skipped" and the install never moves (#562). `update <name>`
+                        // re-resolves inside the same specifier, which is exactly what a
+                        // mutable `github:owner/repo` (or `#branch` / `#semver:`) wants.
+                        // Anything whose target differs from the specifier — npm pins,
+                        // a de-pinned commit, a rebuilt codeload shortcut, a restore —
+                        // keeps `add`, because there the new target IS the change.
+                        const reresolveInPlace = isGit && !restore && target === spec;
                         // force: the user chose to install a fresh release without the
                         // default one-day safety wait; scoped to this single command.
-                        const addArgs = force ? ['add', RELEASE_AGE_OVERRIDE, target] : ['add', target];
+                        const addArgs = reresolveInPlace
+                            ? (force ? ['update', RELEASE_AGE_OVERRIDE, name] : ['update', name])
+                            : (force ? ['add', RELEASE_AGE_OVERRIDE, target] : ['add', target]);
                         // Exact manifest snapshot for failure rollback (#65, #339) — the
                         // host can write dependencies AND dsh.profile.bundles before a
                         // hard-failed add, leaving residue that breaks the next boot.
@@ -3087,25 +3137,25 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                                     ? hasGitSubpath
                                         ? {
                                             available: false,
-                                            detail: `更新前的 GitHub 来源使用 monorepo 子目录${beforeCommit === null ? '' : `（提交 ${beforeCommit}）`}，当前 DSH 命令无法表达该精确目标，因此自动回滚不可用；需要时请手工重新安装该提交。 / The previous GitHub source uses a monorepo subpath${beforeCommit === null ? '' : ` at commit ${beforeCommit}`}; the current DSH command cannot express that exact target, so automatic rollback is unavailable. Reinstall that commit manually if needed.`,
+                                            detail: `更新前的 ${sourceKind} 来源使用 monorepo 子目录${beforeCommit === null ? '' : `（提交 ${beforeCommit}）`}，当前 DSH 命令无法表达该精确目标，因此自动回滚不可用；需要时请手工重新安装该提交。 / The previous ${sourceKind} source uses a monorepo subpath${beforeCommit === null ? '' : ` at commit ${beforeCommit}`}; the current DSH command cannot express that exact target, so automatic rollback is unavailable. Reinstall that commit manually if needed.`,
                                             lockfileBefore: lockfileCapture.snapshot,
                                         }
                                         : beforeCommit === null
                                             ? {
                                                 available: false,
-                                                detail: '未能确认更新前的 GitHub 提交，因此自动回滚不可用；需要时请从可信来源手工重新安装先前版本。 / The previous GitHub commit could not be verified, so automatic rollback is unavailable. Reinstall the prior version manually from a trusted source if needed.',
+                                                detail: `未能确认更新前的 ${sourceKind} 提交，因此自动回滚不可用；需要时请从可信来源手工重新安装先前版本。 / The previous ${sourceKind} commit could not be verified, so automatic rollback is unavailable. Reinstall the prior version manually from a trusted source if needed.`,
                                                 lockfileBefore: lockfileCapture.snapshot,
                                             }
                                             : gitRollbackTarget === null || !supportsExactRollbackTarget(gitRollbackTarget)
                                                 ? {
                                                     available: false,
-                                                    detail: `当前宿主无法安装更新前的精确 GitHub 提交 ${beforeCommit}，因此自动回滚不可用；需要时请手工重新安装该提交。 / This host cannot install the exact previous GitHub commit ${beforeCommit}, so automatic rollback is unavailable. Reinstall that commit manually if needed.`,
+                                                    detail: `当前宿主无法安装更新前的精确 ${sourceKind} 提交 ${beforeCommit}，因此自动回滚不可用；需要时请手工重新安装该提交。 / This host cannot install the exact previous ${sourceKind} commit ${beforeCommit}, so automatic rollback is unavailable. Reinstall that commit manually if needed.`,
                                                     lockfileBefore: lockfileCapture.snapshot,
                                                 }
                                                 : {
                                                     available: true,
                                                     source: {
-                                                        kind: 'github',
+                                                        kind: 'git',
                                                         target: spec,
                                                         beforeCommit,
                                                         lockfileBefore: lockfileCapture.snapshot,
@@ -3252,9 +3302,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                                     beforeVersion,
                                     afterVersion: readInstalledVersion(config.profile, name, activeProfileDir),
                                     beforeCommit,
-                                    afterCommit: repoKey !== null
-                                        ? readLockCommits(config.profile, activeProfileDir).get(repoKey) ?? null
-                                        : null,
+                                    afterCommit: isGit ? gitIdentityCommit(spec) : null,
                                 });
                                 if (stale)
                                     ok = false;