dshmarket 1.57.0 → 1.58.0

package/lib/check.js

@@ -732,6 +732,7 @@ export function buildBundleLayers(profileDirectory, bundleNames, specs, dshInsta
             kind: INBOX_BUNDLES.has(name) ? 'official' : 'community',
             directory,
             patchPath: null,
+            patchPaths: [],
             error: null,
             entries: [],
             parseError: null,
@@ -763,23 +764,34 @@ export function buildBundleLayers(profileDirectory, bundleNames, specs, dshInsta
             layer.error = 'bundle package.json is unreadable';
             return layer;
         }
+        // A bundle may declare ONE patch file or a LIST of them: dsh 0.1.7's own
+        // `@deepseek-ai/dsh-web-app` ships five (a base patch plus four presets),
+        // and the official headless template includes that bundle — so requiring
+        // a string reported "the profile will fail to boot" for the DEFAULT
+        // layout, while `dsh --dump-config` composed it fine (#676).
         const declared = bundleManifest.dsh?.bundle?.patch;
-        if (typeof declared !== 'string') {
+        const declaredList = typeof declared === 'string'
+            ? [declared]
+            : Array.isArray(declared) ? declared.filter((item) => typeof item === 'string') : [];
+        if (declaredList.length === 0) {
             layer.error = 'bundle declares no dsh.bundle.patch — the profile will fail to boot';
             return layer;
         }
-        const patchPath = join(directory, declared);
-        if (!existsSync(patchPath)) {
-            layer.error = `declared patch ${declared} is missing — the profile will fail to boot`;
+        const missing = declaredList.find(relative => !existsSync(join(directory, relative)));
+        if (missing !== undefined) {
+            layer.error = `declared patch ${missing} is missing — the profile will fail to boot`;
             return layer;
         }
-        layer.patchPath = patchPath;
-        const patches = parsePatchFile(patchPath);
-        if (patches === null) {
+        // The first declared file is the layer's patch for reporting; every one
+        // of them contributes entries, because the composer applies them all.
+        layer.patchPath = join(directory, declaredList[0]);
+        layer.patchPaths = declaredList.map(relative => join(directory, relative));
+        const parsed = declaredList.map(relative => parsePatchFile(join(directory, relative)));
+        if (parsed.some(patches => patches === null)) {
             layer.parseError = 'patch file is not a valid entry list';
             return layer;
         }
-        layer.entries = collectInsertIds(patches);
+        layer.entries = parsed.flatMap(patches => collectInsertIds(patches));
         const order = bundleManifest.dsh?.bundle?.order;
         if (order !== null && typeof order === 'object' && !Array.isArray(order)) {
             const listOf = (value) => Array.isArray(value)
@@ -796,7 +808,12 @@ export function buildBundleLayers(profileDirectory, bundleNames, specs, dshInsta
     const layers = bundles.map((bundle) => ({
         label: bundle.name,
         kind: 'bundle',
-        patches: bundle.patchPath !== null && bundle.parseError === null ? parsePatchFile(bundle.patchPath) ?? [] : [],
+        // EVERY declared file, not the first: the composer applies them all, and
+        // a composition built from one file would miss the preset rows — so a
+        // duplicate id or an orphan in a second file was invisible here (#688).
+        patches: bundle.parseError === null
+            ? bundle.patchPaths.flatMap(path => parsePatchFile(path) ?? [])
+            : [],
         parseError: bundle.parseError,
     }));
     return { bundles, layers };

package/lib/routes.js

@@ -477,12 +477,15 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                 const result = await hotMount(host, dir, name);
                 ok = result.ok;
                 reason = result.reason ?? undefined;
-                // A mount that succeeded imported the module as it is on disk NOW,
-                // so whatever was replaced under the old instance is no longer what
-                // this process is serving. Off-and-on is a real way out of the
-                // restart notice, and holding it after that would be wrong.
-                if (result.ok)
-                    replacedWhileLive.delete(name);
+                // Deliberately NOT clearing replacedWhileLive here (#685). This used
+                // to say "a mount that succeeded imported the module as it is on
+                // disk NOW", which is false exactly when the flag is set: it is only
+                // set when the host half was LIVE at update time, i.e. this process
+                // has already evaluated that module URL, and Node's ESM cache serves
+                // any later import of the same URL — the profile layout is hoisted,
+                // so an update rewrites the files in place and the URL never changes.
+                // Off-and-on re-creates the fiber around the OLD module. Only a
+                // restart ends the process that holds it, and the flag with it.
             }
         }
         else {
@@ -2287,7 +2290,14 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                         // A carrier toggle moves the bundle in/out of dsh.profile.bundles,
                         // which only takes effect on the next composition — always a restart.
                         // Non-carrier plugins keep the live-mount based decision.
-                        const restart = isCarrier ? true : enabled ? !liveAfter : liveAfter;
+                        // A plugin replaced on disk while its host half was running is
+                        // still serving the module this process imported, whatever the
+                        // loader's inventory says — re-enabling it re-creates the fiber
+                        // around the cached old build (#685, measured end to end with a
+                        // module-scope version marker). Enabling cannot make it current;
+                        // only a restart can.
+                        const staleModule = enabled && replacedWhileLive.has(name);
+                        const restart = isCarrier || staleModule ? true : enabled ? !liveAfter : liveAfter;
                         // A client-part plugin's UI is in the page already — toggling it
                         // needs a browser refresh to show the change (same signal the
                         // install flow uses for the hot banner).
@@ -2298,7 +2308,13 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                             enabled,
                             disabled: [...disabled],
                             live: listHotMounts(),
-                            activation: { [name]: verifyActivation(config.profile, name, liveNames(), activeProfileDir, offNow) },
+                            // The same verdict the listing gives (#685): the reply used the
+                            // loader inventory alone and said `live` for a plugin serving
+                            // its old build, while a refresh of the listing — which applies
+                            // activationAfterReplace — said `restart`. One moment, one story.
+                            activation: {
+                                [name]: activationAfterReplace(verifyActivation(config.profile, name, liveNames(), activeProfileDir, offNow), replacedWhileLive.has(name)),
+                            },
                             reason,
                             patchRows,
                             patchWrite: patchWrite ?? { ok: true, reason: null },
@@ -3504,7 +3520,15 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                             const trial = trialValidate(activeProfileDir, stack.community);
                             if (!trial.ok) {
                                 ok = false;
-                                const first = trial.errors[0]?.message ?? 'the composition would not boot';
+                                // Name the LAYER, not only the message: the first error is
+                                // often about a different bundle than the one being updated
+                                // (#688 — the official dsh-web-app's patch list, blamed on
+                                // whatever plugin the user happened to update), and a message
+                                // without the layer reads as an accusation of the wrong package.
+                                const firstIssue = trial.errors[0];
+                                const first = firstIssue === undefined
+                                    ? 'the composition would not boot'
+                                    : `${firstIssue.layer}: ${firstIssue.message}`;
                                 const rollback = await rollbackAttemptBuild();
                                 rollbackOk = rollback.ok;
                                 rollbackDetail = rollback.detail;

package/lib/types/check.d.ts

@@ -43,6 +43,8 @@ export interface BundleLayer {
     directory: string | null;
     /** Absolute path of the layer's patch file; null when undeclared/missing. */
     patchPath: string | null;
+    /** Every declared patch file, in declaration order; `patchPath` is the first (#688). */
+    patchPaths: string[];
     /**
      * An in-box bundle whose directory could not be located — a gap in what
      * this process can see, not a defect in the profile (#369). Distinct from

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.57.0",
+  "version": "1.58.0",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/check.ts

@@ -62,6 +62,8 @@ export interface BundleLayer {
   directory: string | null
   /** Absolute path of the layer's patch file; null when undeclared/missing. */
   patchPath: string | null
+  /** Every declared patch file, in declaration order; `patchPath` is the first (#688). */
+  patchPaths: string[]
   /**
    * An in-box bundle whose directory could not be located — a gap in what
    * this process can see, not a defect in the profile (#369). Distinct from
@@ -916,6 +918,7 @@ export function buildBundleLayers(
       kind: INBOX_BUNDLES.has(name) ? 'official' : 'community',
       directory,
       patchPath: null,
+      patchPaths: [],
       error: null,
       entries: [],
       parseError: null,
@@ -946,23 +949,34 @@ export function buildBundleLayers(
       layer.error = 'bundle package.json is unreadable'
       return layer
     }
+    // A bundle may declare ONE patch file or a LIST of them: dsh 0.1.7's own
+    // `@deepseek-ai/dsh-web-app` ships five (a base patch plus four presets),
+    // and the official headless template includes that bundle — so requiring
+    // a string reported "the profile will fail to boot" for the DEFAULT
+    // layout, while `dsh --dump-config` composed it fine (#676).
     const declared = bundleManifest.dsh?.bundle?.patch
-    if (typeof declared !== 'string') {
+    const declaredList = typeof declared === 'string'
+      ? [declared]
+      : Array.isArray(declared) ? declared.filter((item): item is string => typeof item === 'string') : []
+    if (declaredList.length === 0) {
       layer.error = 'bundle declares no dsh.bundle.patch — the profile will fail to boot'
       return layer
     }
-    const patchPath = join(directory, declared)
-    if (!existsSync(patchPath)) {
-      layer.error = `declared patch ${declared} is missing — the profile will fail to boot`
+    const missing = declaredList.find(relative => !existsSync(join(directory, relative)))
+    if (missing !== undefined) {
+      layer.error = `declared patch ${missing} is missing — the profile will fail to boot`
       return layer
     }
-    layer.patchPath = patchPath
-    const patches = parsePatchFile(patchPath)
-    if (patches === null) {
+    // The first declared file is the layer's patch for reporting; every one
+    // of them contributes entries, because the composer applies them all.
+    layer.patchPath = join(directory, declaredList[0]!)
+    layer.patchPaths = declaredList.map(relative => join(directory, relative))
+    const parsed = declaredList.map(relative => parsePatchFile(join(directory, relative)))
+    if (parsed.some(patches => patches === null)) {
       layer.parseError = 'patch file is not a valid entry list'
       return layer
     }
-    layer.entries = collectInsertIds(patches)
+    layer.entries = parsed.flatMap(patches => collectInsertIds(patches!))
     const order = bundleManifest.dsh?.bundle?.order
     if (order !== null && typeof order === 'object' && !Array.isArray(order)) {
       const listOf = (value: unknown): string[] | undefined => Array.isArray(value)
@@ -979,7 +993,12 @@ export function buildBundleLayers(
   const layers: LayerInput[] = bundles.map((bundle) => ({
     label: bundle.name,
     kind: 'bundle' as const,
-    patches: bundle.patchPath !== null && bundle.parseError === null ? parsePatchFile(bundle.patchPath) ?? [] : [],
+    // EVERY declared file, not the first: the composer applies them all, and
+    // a composition built from one file would miss the preset rows — so a
+    // duplicate id or an orphan in a second file was invisible here (#688).
+    patches: bundle.parseError === null
+      ? bundle.patchPaths.flatMap(path => parsePatchFile(path) ?? [])
+      : [],
     parseError: bundle.parseError,
   }))
   return { bundles, layers }

package/src/routes.ts

@@ -538,11 +538,15 @@ export function mountMarketRoutes(
         const result = await hotMount(host, dir, name)
         ok = result.ok
         reason = result.reason ?? undefined
-        // A mount that succeeded imported the module as it is on disk NOW,
-        // so whatever was replaced under the old instance is no longer what
-        // this process is serving. Off-and-on is a real way out of the
-        // restart notice, and holding it after that would be wrong.
-        if (result.ok) replacedWhileLive.delete(name)
+        // Deliberately NOT clearing replacedWhileLive here (#685). This used
+        // to say "a mount that succeeded imported the module as it is on
+        // disk NOW", which is false exactly when the flag is set: it is only
+        // set when the host half was LIVE at update time, i.e. this process
+        // has already evaluated that module URL, and Node's ESM cache serves
+        // any later import of the same URL — the profile layout is hoisted,
+        // so an update rewrites the files in place and the URL never changes.
+        // Off-and-on re-creates the fiber around the OLD module. Only a
+        // restart ends the process that holds it, and the flag with it.
       }
     } else {
       ok = await hotUnmount(name) || await themes.setEntryDisabled(name, true)
@@ -2421,7 +2425,14 @@ export function mountMarketRoutes(
           // A carrier toggle moves the bundle in/out of dsh.profile.bundles,
           // which only takes effect on the next composition — always a restart.
           // Non-carrier plugins keep the live-mount based decision.
-          const restart = isCarrier ? true : enabled ? !liveAfter : liveAfter
+          // A plugin replaced on disk while its host half was running is
+          // still serving the module this process imported, whatever the
+          // loader's inventory says — re-enabling it re-creates the fiber
+          // around the cached old build (#685, measured end to end with a
+          // module-scope version marker). Enabling cannot make it current;
+          // only a restart can.
+          const staleModule = enabled && replacedWhileLive.has(name)
+          const restart = isCarrier || staleModule ? true : enabled ? !liveAfter : liveAfter
           // A client-part plugin's UI is in the page already — toggling it
           // needs a browser refresh to show the change (same signal the
           // install flow uses for the hot banner).
@@ -2432,7 +2443,16 @@ export function mountMarketRoutes(
               enabled,
               disabled: [...disabled],
               live: listHotMounts(),
-              activation: { [name]: verifyActivation(config.profile, name, liveNames(), activeProfileDir, offNow) },
+              // The same verdict the listing gives (#685): the reply used the
+              // loader inventory alone and said `live` for a plugin serving
+              // its old build, while a refresh of the listing — which applies
+              // activationAfterReplace — said `restart`. One moment, one story.
+              activation: {
+                [name]: activationAfterReplace(
+                  verifyActivation(config.profile, name, liveNames(), activeProfileDir, offNow),
+                  replacedWhileLive.has(name),
+                ),
+              },
               reason,
               patchRows,
               patchWrite: patchWrite ?? { ok: true, reason: null },
@@ -3641,7 +3661,15 @@ sendJson(response, 200, { updates })
               const trial = trialValidate(activeProfileDir, stack.community)
               if (!trial.ok) {
                 ok = false
-                const first = trial.errors[0]?.message ?? 'the composition would not boot'
+                // Name the LAYER, not only the message: the first error is
+                // often about a different bundle than the one being updated
+                // (#688 — the official dsh-web-app's patch list, blamed on
+                // whatever plugin the user happened to update), and a message
+                // without the layer reads as an accusation of the wrong package.
+                const firstIssue = trial.errors[0]
+                const first = firstIssue === undefined
+                  ? 'the composition would not boot'
+                  : `${firstIssue.layer}: ${firstIssue.message}`
                 const rollback = await rollbackAttemptBuild()
                 rollbackOk = rollback.ok
                 rollbackDetail = rollback.detail