dshmarket 1.51.0 → 1.52.0

package/client/client.js

@@ -374,6 +374,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			stateLive: "已生效",
 			stateRestart: "已安装，重启后生效",
 			stateInert: "已安装，未生效",
+			stateDependencyLibrary: "{0} 的依赖库",
 			stateBroken: "已安装，校验未通过",
 			stateDisabled: "已停用",
 			phaseResolving: "解析依赖",
@@ -909,6 +910,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			stateLive: "Active",
 			stateRestart: "Installed — restart to apply",
 			stateInert: "Installed, not active",
+			stateDependencyLibrary: "Library of {0}",
 			stateBroken: "Installed, verification failed",
 			stateDisabled: "Disabled",
 			phaseResolving: "Resolving dependencies",
@@ -2690,6 +2692,78 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			"warnLine": "nUhMVa_warnLine"
 		};
 		//#endregion
+		//#region src/client/market-mark.ts
+		/**
+		* The market's block mark as geometry rather than as a component.
+		*
+		* Two consumers draw this mark and they must not drift:
+		*
+		* - `MarketLogo` (MarketSection.tsx) renders it inside the section as an
+		*   ordinary React SVG in `currentColor`, including the animated variant;
+		* - `settings-nav-icon.ts` serialises it into a CSS mask for the settings
+		*   navigation glyph, which cannot use `currentColor` (a mask is an
+		*   independent image) and so needs it as standalone markup.
+		*
+		* Keeping the numbers here means a change to the mark is one edit, and the
+		* suite can hold both renderings to the same source.
+		*
+		* The mark is the brand asset in `assets/logo.svg`: an 8-cell grid plus the
+		* block being plugged into its empty corner, offset and tilted 9°.
+		*/
+		/** Side of one block, and its corner radius. */
+		const MARK_BLOCK_SIZE = 3.3;
+		const MARK_BLOCK_RADIUS = .53;
+		/** The eight grid cells, row-major. The ninth slot stays empty on purpose. */
+		const MARK_GRID_BLOCKS = [
+			{
+				x: 1.96,
+				y: 3.36
+			},
+			{
+				x: 5.71,
+				y: 3.36
+			},
+			{
+				x: 1.96,
+				y: 7.11
+			},
+			{
+				x: 5.71,
+				y: 7.11
+			},
+			{
+				x: 9.46,
+				y: 7.11
+			},
+			{
+				x: 1.96,
+				y: 10.86
+			},
+			{
+				x: 5.71,
+				y: 10.86
+			},
+			{
+				x: 9.46,
+				y: 10.86
+			}
+		];
+		/**
+		* The block being plugged in: OUTSIDE the grid's empty corner, offset
+		* (+1.28, -1.27) and tilted 9deg, exactly as in assets/logo.svg. The earlier
+		* icon sat it neatly in the empty slot, which reads as one crooked tile
+		* rather than a block arriving — the whole idea of the mark, and the reason
+		* it no longer matched the GitHub logo.
+		*/
+		const MARK_PLUG_BLOCK = {
+			x: 10.74,
+			y: 2.09,
+			degrees: 9,
+			/** Rotation origin: the plug block's own centre. */
+			originX: 12.39,
+			originY: 3.74
+		};
+		//#endregion
 		//#region src/client/comments.ts
 		/**
 		* giscus wiring for the in-market comment thread.
@@ -2863,6 +2937,64 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				]
 			});
 		}
+		/** Keep keystrokes out of the market's large render tree, not just its filter.
+		* Only settled queries reach the parent. Explicit navigation remains immediate.
+		*/
+		function SearchInput({ value, onCommit, className, placeholder, resetToken }) {
+			const [draft, setDraft] = (0, react.useState)(value);
+			const timer = (0, react.useRef)(null);
+			const composing = (0, react.useRef)(false);
+			const cancel = (0, react.useCallback)(() => {
+				if (timer.current !== null) clearTimeout(timer.current);
+				timer.current = null;
+			}, []);
+			const commit = (next) => {
+				cancel();
+				onCommit(next);
+			};
+			const schedule = (next) => {
+				cancel();
+				if (composing.current) return;
+				if (next === "") commit(next);
+				else timer.current = setTimeout(() => commit(next), 250);
+			};
+			(0, react.useLayoutEffect)(() => {
+				cancel();
+				setDraft(value);
+			}, [
+				value,
+				resetToken,
+				cancel
+			]);
+			(0, react.useEffect)(() => cancel, [cancel]);
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Input, {
+				className,
+				icon: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconSearchOutline16, { size: 14 }),
+				placeholder,
+				value: draft,
+				onChange: (event) => {
+					const next = event.target.value;
+					setDraft(next);
+					schedule(next);
+				},
+				onCompositionStart: () => {
+					composing.current = true;
+					cancel();
+				},
+				onCompositionEnd: (event) => {
+					composing.current = false;
+					const next = event.currentTarget.value;
+					setDraft(next);
+					schedule(next);
+				},
+				onKeyDown: (event) => {
+					if (event.key === "Enter" && !composing.current && !event.nativeEvent.isComposing && event.keyCode !== 229) commit(event.currentTarget.value);
+				},
+				onBlur: (event) => {
+					if (!composing.current) commit(event.currentTarget.value);
+				}
+			});
+		}
 		//#endregion
 		//#region src/client/operations.ts
 		const BUCKETS = {
@@ -5191,7 +5323,11 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			});
 		}
 		/** The state label + dot for one activation result (P0-2). */
-		function activationMeta(state, t) {
+		function activationMeta(state, t, dependencyOf) {
+			if (state === "inert" && dependencyOf !== void 0) return {
+				label: t("stateDependencyLibrary").replace("{0}", dependencyOf),
+				dot: "done"
+			};
 			if (state === "live") return {
 				label: t("stateLive"),
 				dot: "done"
@@ -6073,86 +6209,36 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 		* Official-style market glyph: the shared block-grid brand mark converted to
 		* the official monochrome icon form (16×16, fill="currentColor") so it
 		* follows the active theme. Mirrors the settings-nav glyph used for the
-		* "market" section id.
+		* "market" section id — both now draw the geometry in market-mark.ts, so the
+		* nav entry and the section it opens cannot drift apart.
 		*/
 		function MarketLogo({ size = 16, style, animated = false }) {
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("svg", {
 				width: size,
 				height: size,
-				viewBox: "0 0 16 16",
+				viewBox: `0 0 16 16`,
 				fill: "none",
 				xmlns: "http://www.w3.org/2000/svg",
 				"aria-hidden": "true",
 				style,
-				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("g", {
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("g", {
 					fill: "currentColor",
-					children: [
-						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("rect", {
-							x: "1.96",
-							y: "3.36",
-							width: "3.3",
-							height: "3.3",
-							rx: "0.53"
-						}),
-						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("rect", {
-							x: "5.71",
-							y: "3.36",
-							width: "3.3",
-							height: "3.3",
-							rx: "0.53"
-						}),
-						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("rect", {
-							x: "1.96",
-							y: "7.11",
-							width: "3.3",
-							height: "3.3",
-							rx: "0.53"
-						}),
-						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("rect", {
-							x: "5.71",
-							y: "7.11",
-							width: "3.3",
-							height: "3.3",
-							rx: "0.53"
-						}),
-						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("rect", {
-							x: "9.46",
-							y: "7.11",
-							width: "3.3",
-							height: "3.3",
-							rx: "0.53"
-						}),
-						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("rect", {
-							x: "1.96",
-							y: "10.86",
-							width: "3.3",
-							height: "3.3",
-							rx: "0.53"
-						}),
-						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("rect", {
-							x: "5.71",
-							y: "10.86",
-							width: "3.3",
-							height: "3.3",
-							rx: "0.53"
-						}),
-						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("rect", {
-							x: "9.46",
-							y: "10.86",
-							width: "3.3",
-							height: "3.3",
-							rx: "0.53"
-						})
-					]
+					children: MARK_GRID_BLOCKS.map((block) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("rect", {
+						x: block.x,
+						y: block.y,
+						width: MARK_BLOCK_SIZE,
+						height: MARK_BLOCK_SIZE,
+						rx: MARK_BLOCK_RADIUS
+					}, `${block.x},${block.y}`))
 				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("rect", {
 					className: animated ? Market_module_css_default.logoPlug : void 0,
-					x: "10.74",
-					y: "2.09",
-					width: "3.3",
-					height: "3.3",
-					rx: "0.53",
+					x: MARK_PLUG_BLOCK.x,
+					y: MARK_PLUG_BLOCK.y,
+					width: MARK_BLOCK_SIZE,
+					height: MARK_BLOCK_SIZE,
+					rx: MARK_BLOCK_RADIUS,
 					fill: "currentColor",
-					transform: animated ? void 0 : "rotate(9 12.39 3.74)"
+					transform: animated ? void 0 : `rotate(${MARK_PLUG_BLOCK.degrees} ${MARK_PLUG_BLOCK.originX} ${MARK_PLUG_BLOCK.originY})`
 				})]
 			});
 		}
@@ -6363,6 +6449,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				return saved || "discover";
 			});
 			const [q, setQ] = (0, react.useState)("");
+			const [discoverSearchReset, resetDiscoverSearch] = (0, react.useState)(0);
+			const [installedSearchReset, resetInstalledSearch] = (0, react.useState)(0);
 			/** Per-tab searches stay independent: discover / themes / installed. */
 			const [qThemes, setQThemes] = (0, react.useState)("");
 			const [qFavorites, setQFavorites] = (0, react.useState)("");
@@ -6377,10 +6465,12 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				if (kind === "installed") {
 					setTab("installed");
 					setQInstalled(value);
+					resetInstalledSearch((n) => n + 1);
 				} else if (kind === "discover") {
 					setTab("discover");
 					setCat("all");
 					setQ(value);
+					resetDiscoverSearch((n) => n + 1);
 				}
 			}, [props.preferredSubsectionId]);
 			const [confirming, setConfirming] = (0, react.useState)(null);
@@ -9097,7 +9187,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 									children: activationWarnings.map(({ name, info }) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [
 										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("b", { children: name }),
 										" — ",
-										activationMeta(info.state, t).label,
+										activationMeta(info.state, t, info.dependencyOf).label,
 										info.reasons.length > 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
 											className: Market_module_css_default.spec,
 											children: [
@@ -9476,13 +9566,13 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 								className: Market_module_css_default.stickyHead,
 								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 									className: Market_module_css_default.tabSearchRow,
-									children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Input, {
+									children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(SearchInput, {
+										resetToken: discoverSearchReset,
 										className: Market_module_css_default.tabSearch,
-										icon: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconSearchOutline16, { size: 14 }),
 										placeholder: t("searchPh"),
 										value: q,
-										onChange: (e) => setQ(e.target.value)
-									})
+										onCommit: setQ
+									}, "discover")
 								}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 									className: Market_module_css_default.cats,
 									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
@@ -9567,13 +9657,12 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 							children: t("favoritesEmpty")
 						}) : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 							className: Market_module_css_default.themeToolbar,
-							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Input, {
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(SearchInput, {
 								className: Market_module_css_default.themeSearch,
-								icon: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconSearchOutline16, { size: 14 }),
 								placeholder: t("searchFavoritesPh"),
 								value: qFavorites,
-								onChange: (e) => setQFavorites(e.target.value)
-							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+								onCommit: setQFavorites
+							}, "favorites"), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 								className: Market_module_css_default.themeToolbarActions,
 								children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(FilterMenu, {
 									sortField: favSortField,
@@ -9654,13 +9743,12 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 						] })] }) : tab === "themes" && themeSnap !== null ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
 							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 								className: Market_module_css_default.themeToolbar,
-								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Input, {
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(SearchInput, {
 									className: Market_module_css_default.themeSearch,
-									icon: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconSearchOutline16, { size: 14 }),
 									placeholder: t("searchPh"),
 									value: qThemes,
-									onChange: (e) => setQThemes(e.target.value)
-								}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+									onCommit: setQThemes
+								}, "themes"), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 									className: Market_module_css_default.themeToolbarActions,
 									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(FilterMenu, {
 										sortField: themeSortField,
@@ -9742,13 +9830,13 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 								className: Market_module_css_default.tabSearchRow,
-								children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Input, {
+								children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(SearchInput, {
+									resetToken: installedSearchReset,
 									className: Market_module_css_default.tabSearch,
-									icon: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconSearchOutline16, { size: 14 }),
 									placeholder: t("searchPh"),
 									value: qInstalled,
-									onChange: (e) => setQInstalled(e.target.value)
-								})
+									onCommit: setQInstalled
+								}, "installed")
 							}),
 							installedView === "groups" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
 								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
@@ -10067,7 +10155,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 									const generation = status?.kind === "generation" || isGenerationSpec(String(spec));
 									const localDev = !generation && (/^(?:link|file):/i.test(String(spec)) || status?.kind === "linked");
 									const act = activations[name];
-									const meta = act !== void 0 ? activationMeta(act.state, t) : null;
+									const meta = act !== void 0 ? activationMeta(act.state, t, act.dependencyOf) : null;
 									const version = status && status.version ? "v" + status.version : "";
 									const specText = String(spec);
 									const specRedundant = version !== "" && /^[\^~]?\d/.test(specText);
@@ -11417,6 +11505,141 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			}, (0, react.createElement)("div", { className: Market_module_css_default.setHeadText }, (0, react.createElement)("div", { className: Market_module_css_default.setName }, t("nav"), version !== null ? (0, react.createElement)("span", { className: Market_module_css_default.version }, ` v${version}`) : null, prerelease ? (0, react.createElement)("span", { className: Market_module_css_default.setBetaTag }, t("setChannelBeta")) : null), (0, react.createElement)("div", { className: Market_module_css_default.setDesc }, t("setCardDesc"))), (0, react.createElement)("span", { className: open ? `${Market_module_css_default.setChevron} ${Market_module_css_default.setChevronOpen}` : Market_module_css_default.setChevron }, (0, react.createElement)(_deepseek_ai_dsh_client_ui_primitives.IconChevronDownOutline14, { size: 14 }))), open ? (0, react.createElement)("div", { className: Market_module_css_default.setBody }, body) : null);
 		}
 		//#endregion
+		//#region src/client/settings-nav-icon.ts
+		/**
+		* The market's block mark in the settings navigation.
+		*
+		* The settings shell picks nav glyphs from a closed list of section ids
+		* (`models`, `agent-presets`, `plugins`) and falls back to its own gear for
+		* every other id; `settings.section` projects only `id` / `order` / `label`,
+		* so a registrant has no icon to pass — the slot contract in
+		* `@deepseek-ai/dsh-client-ui-settings` and the runtime slot inventory both
+		* list exactly those three options. Every third-party section therefore wears
+		* the gear, the market included.
+		*
+		* So the market claims its own row once the dialog is mounted and swaps the
+		* fallback gear for the block mark — the same mark `MarketLogo` draws inside
+		* the section (see market-mark.ts), which is what makes the nav entry read as
+		* the same thing as the page it opens. `dsh-better-sidebar` and
+		* `dsh-skill-mcp-panel` solve it the same way.
+		*
+		* Scope, deliberately narrow:
+		*
+		* - only the row whose visible text equals this plugin's own localized
+		*   section label is marked; no shell structure is touched;
+		* - the marker and the injected stylesheet belong to a `ctx.effect`, so they
+		*   are removed with the fiber;
+		* - a locale switch re-claims the row through the MutationObserver, so the
+		*   label and the glyph never disagree.
+		*
+		* Delete this module (and its call in index.ts) the day `settings.section`
+		* grows an `icon` field.
+		*/
+		/** Marks the one nav row this plugin owns. */
+		const NAV_ICON_MARKER = "data-dsh-market-nav-icon";
+		/**
+		* The nav rows of the settings dialog. The shell renders each
+		* `settings.section` entry as a `<button>` inside the panel's `<nav>`
+		* (SettingsPanel in dsh-client-ui-settings-general).
+		*/
+		const NAV_ROW_SELECTOR = "[role=\"dialog\"] nav button";
+		/**
+		* The mark as standalone SVG for a CSS `mask-image`.
+		*
+		* Painted pure black on purpose: a mask reads alpha only, and the visible
+		* colour comes from the element's `background-color: currentColor`. The
+		* plug block carries its tilt without the animated variant's transform
+		* classes — a mask cannot animate through CSS-module classes.
+		*/
+		function marketMaskSvg() {
+			const blocks = MARK_GRID_BLOCKS.map((block) => `<rect x="${block.x}" y="${block.y}" width="${MARK_BLOCK_SIZE}" height="${MARK_BLOCK_SIZE}" rx="${MARK_BLOCK_RADIUS}"/>`).join("");
+			const plug = MARK_PLUG_BLOCK;
+			return `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" fill="#000"><g>${blocks}</g><rect x="${plug.x}" y="${plug.y}" width="${MARK_BLOCK_SIZE}" height="${MARK_BLOCK_SIZE}" rx="${MARK_BLOCK_RADIUS}" transform="rotate(${plug.degrees} ${plug.originX} ${plug.originY})"/></svg>`;
+		}
+		/** The mask URL for the mark (encoded at runtime, never hand-escaped). */
+		function marketMaskUrl(svg = marketMaskSvg()) {
+			return `data:image/svg+xml,${encodeURIComponent(svg)}`;
+		}
+		/**
+		* Whether a nav row is this plugin's own.
+		*
+		* Pure, and the only decision this feature makes: the row whose visible text
+		* is the section label the shell is currently projecting. An empty label
+		* matches nothing — a locale that has not resolved yet must not mark the
+		* whole nav.
+		*/
+		function isOwnNavRow(rowText, wantedLabel) {
+			const wanted = String(wantedLabel ?? "").trim();
+			if (wanted.length === 0) return false;
+			return String(rowText ?? "").trim() === wanted;
+		}
+		/** Stylesheet for the marked row: hide the shell's gear, draw the mark. */
+		function navIconCss(maskUrl) {
+			return [
+				`[${NAV_ICON_MARKER}] > svg { display: none; }`,
+				`[${NAV_ICON_MARKER}]::before {`,
+				`  content: '';`,
+				`  flex: none;`,
+				`  width: 16px;`,
+				`  height: 16px;`,
+				`  background-color: currentColor;`,
+				`  -webkit-mask-image: url("${maskUrl}");`,
+				`  mask-image: url("${maskUrl}");`,
+				`  -webkit-mask-repeat: no-repeat;`,
+				`  mask-repeat: no-repeat;`,
+				`  -webkit-mask-position: center;`,
+				`  mask-position: center;`,
+				`  -webkit-mask-size: 16px 16px;`,
+				`  mask-size: 16px 16px;`,
+				`}`
+			].join("\n");
+		}
+		/**
+		* Install the nav glyph.
+		*
+		* @param ctx - client context, for effect ownership.
+		* @param resolveLabel - this plugin's current section label (the same thunk
+		*   the `settings.section` registration passes), re-read on every sync so a
+		*   locale switch is picked up without re-registering.
+		*/
+		function installSettingsNavIcon(ctx, resolveLabel) {
+			if (typeof document === "undefined") return;
+			ctx.effect(() => {
+				const tag = document.createElement("style");
+				tag.dataset.plugin = "dshmarket";
+				tag.dataset.pluginCss = "dshmarket/settings-nav-icon";
+				tag.textContent = navIconCss(marketMaskUrl());
+				document.head.appendChild(tag);
+				let disposed = false;
+				let scheduled = false;
+				const sync = () => {
+					scheduled = false;
+					if (disposed) return;
+					const wanted = resolveLabel();
+					for (const row of document.querySelectorAll(NAV_ROW_SELECTOR)) if (isOwnNavRow(row.textContent, wanted)) row.setAttribute(NAV_ICON_MARKER, "");
+					else row.removeAttribute(NAV_ICON_MARKER);
+				};
+				const schedule = () => {
+					if (scheduled || disposed) return;
+					scheduled = true;
+					queueMicrotask(sync);
+				};
+				sync();
+				const observer = new MutationObserver(schedule);
+				observer.observe(document.body, {
+					childList: true,
+					subtree: true,
+					characterData: true
+				});
+				return () => {
+					disposed = true;
+					observer.disconnect();
+					for (const row of document.querySelectorAll(`[${NAV_ICON_MARKER}]`)) row.removeAttribute(NAV_ICON_MARKER);
+					tag.remove();
+				};
+			}, "dsh-market: settings nav icon");
+		}
+		//#endregion
 		//#region src/client/index.ts
 		/**
 		* dsh-market client: registers a "Market" settings section rendering the
@@ -11459,6 +11682,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				en
 			}), "dsh-market: dictionaries");
 			const t = ctx.locale.bind(NS);
+			installSettingsNavIcon(ctx, () => t("nav"));
 			/**
 			* The market's own panel, as an element — one builder for the settings
 			* section this package registers and for `market.render()` (#602). Built

package/lib/http.js

@@ -11,11 +11,43 @@ export function sendJson(response, status, payload) {
     });
     response.end(JSON.stringify(payload));
 }
-/** True when the request's Origin matches its Host — required on every POST route. */
+/**
+ * True when the request's Origin, IF IT HAS ONE, matches its Host — required
+ * on every POST route.
+ *
+ * An absent Origin is allowed (#648). The check exists to stop another web
+ * page from driving this loopback API, and the Fetch spec has browsers send
+ * `Origin` on every POST — including same-origin and cross-origin form
+ * submissions. A request that arrives WITHOUT it therefore did not come from
+ * a page at all, and a non-browser client can set any Origin it likes, so
+ * refusing the header's absence bought nothing while breaking a whole
+ * supported host: the Desktop app's own proxy strips `origin`, `host`,
+ * `cookie` and `sec-fetch-site` before forwarding to the in-process host and
+ * injects a cookie only that host can sign. Every mutating request from the
+ * Desktop build was answered 403 `untrusted origin`.
+ *
+ * What still holds after the change, and is the part worth keeping:
+ *
+ * - a cross-site page is refused — its Origin is present and different;
+ * - `Origin: null` (a sandboxed iframe, a `data:` document) is refused, because
+ *   `null` is a present-but-unparseable origin, not an absent one;
+ * - a same-host-but-different-port request is refused;
+ * - an EMPTY Origin is refused too: the header being present and unparseable
+ *   is not the same statement as its being absent, and only absence is what
+ *   a stripping proxy produces.
+ *
+ * The header's absence is a statement about the client, not about intent, and
+ * the intent is the only thing this can judge.
+ *
+ * @param request - the incoming request.
+ * @returns whether the request may mutate market state.
+ */
 export function sameOrigin(request) {
     const origin = request.headers.origin;
+    if (origin === undefined)
+        return true;
     const host = request.headers.host;
-    if (origin === undefined || host === undefined)
+    if (host === undefined)
         return false;
     try {
         return new URL(origin).host === host;

package/lib/index.js

@@ -3,6 +3,7 @@
  * composes the webServer and shell services.
  */
 import { createDesktopPluginRuntime } from './dsh-cli.js';
+import { isDshProfileName } from './profile.js';
 import { mountMarketRoutes } from './routes.js';
 import { installDesktopMarketSettings, installMarketSettings } from './settings.js';
 export const name = 'dsh-market';
@@ -23,6 +24,30 @@ function argvProfile() {
         return argv[flag + 1];
     return undefined;
 }
+/**
+ * The profile this process was launched into, as the launcher itself reports
+ * it. `argvProfile` only sees a `--profile` flag on this process's argv, and
+ * the official desktop host starts a profile through the launcher's node
+ * entry rather than the CLI — no flag, no `desktopProfiles` service either,
+ * so the market fell back to `web` and every install, update and uninstall
+ * landed in the web profile instead of the one the user was looking at
+ * (#639).
+ *
+ * The launcher's `dir` is taken with the name rather than derived from it:
+ * the launcher owns where a profile lives, and deriving the path would
+ * disagree with it for any profile that does not sit in the default place.
+ * A name the market could not use as a directory segment is refused rather
+ * than joined into a path.
+ */
+function launchedProfile(context) {
+    if (context === undefined)
+        return undefined;
+    const name = typeof context.name === 'string' ? context.name.trim() : '';
+    const dir = typeof context.dir === 'string' ? context.dir.trim() : '';
+    if (!isDshProfileName(name) || dir === '')
+        return undefined;
+    return { name, dir };
+}
 /**
  * Resolve the host's `agents` inventory lazily — at request time, not at
  * market startup, so the guard sees whichever agents exist by the time an
@@ -37,8 +62,15 @@ export function apply(ctx, config) {
         const host = hostCtx;
         const desktopProfiles = ctx.get('desktopProfiles');
         if (desktopProfiles === undefined) {
+            // An explicit `profile:` in cordis.yml is the operator speaking and
+            // still wins; the launcher's own answer comes next, and only then the
+            // flag-and-default guesswork. The launcher's directory rides along with
+            // its name, and never with somebody else's.
+            const launched = launchedProfile(ctx.get('profileContext'));
+            const useLaunchedDir = config?.profile === undefined && launched !== undefined;
             const resolved = {
-                profile: config?.profile ?? argvProfile() ?? 'web',
+                profile: config?.profile ?? launched?.name ?? argvProfile() ?? 'web',
+                ...(useLaunchedDir ? { profileDirectory: launched.dir } : {}),
                 // Left UNDEFINED when unconfigured, deliberately: `?? true` here
                 // would turn "the operator said nothing" into "the operator said
                 // yes", and restartAllowed() could no longer tell them apart — which

package/lib/profile.js

@@ -78,6 +78,39 @@ export function readManifestDeps(profile, explicitDir) {
         return {};
     }
 }
+/**
+ * For each installed package, the OTHER installed package that declares it —
+ * as a dependency or a peer dependency — in its own manifest.
+ *
+ * pnpm's auto-install-peers writes a plugin's peers into the profile manifest
+ * as direct dependencies, so a native binding a plugin needs shows up in the
+ * installed list looking exactly like a plugin the user chose (#634). What
+ * separates them is that somebody else asked for it.
+ *
+ * Ownership is decided by the first owner in sorted order, so the answer does
+ * not depend on the manifest's key order. A package that declares itself is
+ * ignored, and so is a cycle's other half once one owner is chosen.
+ */
+export function readDependencyOwners(profile, names, explicitDir) {
+    const installed = new Set(names);
+    const owners = {};
+    for (const owner of [...names].sort()) {
+        const manifest = readInstalledManifest(profile, owner, explicitDir);
+        if (typeof manifest !== 'object' || manifest === null)
+            continue;
+        const declared = manifest;
+        for (const field of [declared.dependencies, declared.peerDependencies]) {
+            if (typeof field !== 'object' || field === null)
+                continue;
+            for (const dependency of Object.keys(field)) {
+                if (dependency === owner || !installed.has(dependency))
+                    continue;
+                owners[dependency] ??= owner;
+            }
+        }
+    }
+    return owners;
+}
 function objectRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value)
         ? value