dshmarket 1.59.0 → 1.60.0

package/client/client.js

@@ -7139,6 +7139,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			* real switch state so hand-edited cordis.patch.yml toggles are visible.
 			*/
 			const [patchDisabledNames, setPatchDisabledNames] = (0, react.useState)([]);
+			/** Bundle packages DSH's own plugin page turned off by leaving them out of dsh.profile.bundles (#696). */
+			const [unbundledNames, setUnbundledNames] = (0, react.useState)([]);
 			const [groups, setGroups] = (0, react.useState)({});
 			const [groupOrder, setGroupOrder] = (0, react.useState)([]);
 			/** Installed-tab sub-view: flat list or groups (All-plugins was removed —
@@ -7309,6 +7311,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 					}
 					if (body.notes !== null && typeof body.notes === "object" && !Array.isArray(body.notes)) setNotes(body.notes);
 					if (Array.isArray(body.patchDisabled)) setPatchDisabledNames(body.patchDisabled);
+					if (Array.isArray(body.unbundled)) setUnbundledNames(body.unbundled);
 					if (body.groups && typeof body.groups === "object") setGroups(body.groups);
 					if (Array.isArray(body.groupOrder)) setGroupOrder(body.groupOrder);
 					if (Array.isArray(body.favorites)) setFavoriteUrls(body.favorites.filter((url) => typeof url === "string"));
@@ -7324,7 +7327,15 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			(0, react.useMemo)(() => new Set(disabledNames), [disabledNames]);
 			const favoriteUrlSet = (0, react.useMemo)(() => new Set(favoriteUrls), [favoriteUrls]);
 			/** Effective switch state: market disable list ∪ user-patch-layer disables. */
-			const effectiveDisabledSet = (0, react.useMemo)(() => /* @__PURE__ */ new Set([...disabledNames, ...patchDisabledNames]), [disabledNames, patchDisabledNames]);
+			const effectiveDisabledSet = (0, react.useMemo)(() => /* @__PURE__ */ new Set([
+				...disabledNames,
+				...patchDisabledNames,
+				...unbundledNames
+			]), [
+				disabledNames,
+				patchDisabledNames,
+				unbundledNames
+			]);
 			(0, react.useEffect)(() => {
 				if (tab !== "themes" && themesFullscreen) setThemesFullscreen(false);
 			}, [tab, themesFullscreen]);

package/lib/check.js

@@ -759,7 +759,19 @@ export function buildBundleLayers(profileDirectory, bundleNames, specs, dshInsta
             // fatal verdict and rolled back a good update (#369) — while `dsh
             // --dump-config` on the same profile exited 0. Unknown has to read as
             // unknown; the profile's own bundles are still judged normally.
-            if (hostProvided) {
+            //
+            // The same holds for any official bundle while the installation itself
+            // cannot be located (#676): a desktop build ships more in-box bundles
+            // than the three named in INBOX_BUNDLES —
+            // `@deepseek-ai/dsh-experimental-agent-team-profile` among them — and a
+            // fixed list, or an install-path shape, cannot know which. Two
+            // reporters saw that bundle called "not installed — will fail to boot"
+            // while its three entries were active in the running host. Only
+            // DeepSeek publishes under `@deepseek-ai/`, so while the installation
+            // is out of sight such a bundle is unknown, not missing. When the
+            // installation IS located and the bundle is in neither it nor the
+            // profile, the fatal verdict below still applies.
+            if (hostProvided || (dshInstallDir === null && name.startsWith('@deepseek-ai/'))) {
                 layer.error = null;
                 layer.unresolvedInbox = true;
                 return layer;

package/lib/pnpm-compat.js

@@ -313,6 +313,21 @@ export function classifyPnpmFailure(output, exitCode) {
     // pnpm's FETCHER, before anything lands in node_modules — so the package
     // the user must approve is not installed yet, and pnpm's own hint names a
     // commit-pinned codeload URL that changes on every push.
+    // #701: pnpm 12's native engine (pnpm-native) aborting on an allocation it
+    // cannot get — "memory allocation of 5368709120 bytes failed", Windows exit
+    // 3221226505 (0xC0000409, how a Rust abort ends there). Reported with an
+    // A/B: on pnpm 12.5.1 every run with `autoInstallPeers: false` in the
+    // workspace file (DSH writes it into every profile) aborted at ~5 GB peak
+    // RSS, every run without it passed at ~80 MB, with free memory to spare.
+    // Nothing about the plugin being installed; not something a retry of the
+    // same command changes on the reporter's data, so none is attempted.
+    if (/memory allocation of \d+ bytes failed/.test(output) || exitCode === 3221226505) {
+        return {
+            code: 'native-oom',
+            recoverable: false,
+            message: 'pnpm 12 的原生引擎在处理这个 profile 时耗尽了内存并中止——和要安装的插件无关。在 pnpm 修复之前，请改用 pnpm 11（npm install -g pnpm@11）后再试。 / pnpm 12\'s native engine ran out of memory on this profile and aborted — the plugin being installed is not the cause. Until pnpm fixes it, switch to pnpm 11 (npm install -g pnpm@11) and try again.',
+        };
+    }
     // #698: pnpm 10.26+ and 11.0–11.5 read an allowBuilds key as
     // `name@<version union>`, so a git or archive source there fails the WHOLE
     // workspace file — every pnpm command in the profile, not the one plugin.

package/lib/routes.js

@@ -177,6 +177,16 @@ function packageHasClientPart(profileDirectory, name) {
  * the package, and the key written is the one pnpm printed, never text from
  * the request.
  */
+/** Whether an installed package's manifest declares a bundle. */
+function declaresBundle(profileDirectory, name) {
+    try {
+        const manifest = JSON.parse(readFileSync(join(profileDirectory, 'node_modules', name, 'package.json'), 'utf8'));
+        return manifest.dsh?.bundle !== undefined;
+    }
+    catch {
+        return false;
+    }
+}
 const prepareRefusals = new Map();
 function blockedBuilds(result) {
     if (Array.isArray(result.ignoredBuilds) && result.ignoredBuilds.length > 0)
@@ -365,6 +375,34 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
         marketState.githubProxy = fresh.githubProxy;
         setCustomGithubProxy(fresh.githubProxy ?? null);
     }
+    /**
+     * Follow an enable made OUTSIDE the market (#696).
+     *
+     * The market keeps its own disable list in state.json, and the self-heal
+     * guard below and the boot replay put any plugin on that list back down.
+     * DSH's own Settings → Plugins page enables a row by flipping it to
+     * `disabled: false` in the shared patch layer — it has never heard of
+     * state.json — so its enable was silently undone within a second and again
+     * on every boot, and the official switch looked broken.
+     *
+     * The patch layer is the one truth both managers share. A row explicitly
+     * enabled there while no row of the same package is disabled can only be a
+     * newer decision than the market's list (the market removes a name from
+     * its list BEFORE writing its own enable row), so the list follows it.
+     *
+     * @returns true when the package was re-enabled elsewhere and has been
+     *   dropped from the market's disable list.
+     */
+    function followOutsideEnable(name) {
+        const patch = readUserPatchState(userPatchPath);
+        const flags = packagePatchFlags(host, activeProfileDir, [name], patch);
+        if (!flags.forced.includes(name) || flags.disabled.includes(name))
+            return false;
+        disabled.delete(name);
+        writeMarketState(activeProfileDir, { disabled, groups, groupOrder });
+        logEvent('info', 'toggle', `${name}: its rows were re-enabled outside the market (#696) — following that instead of switching it back off`);
+        return true;
+    }
     // Client-only packages (dsh.client without dsh.bundle) are invisible to the
     // bundle layer in every boot; the market shim-mounts them so their client
     // bundles are actually served.
@@ -375,7 +413,9 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
         // switched away from get live-disabled again (bundle trees are
         // in-memory, so the disable never persists on its own). Client-only
         // shims for disabled plugins were already skipped by mountClientOnlyDeps.
-        for (const name of disabled) {
+        for (const name of [...disabled]) {
+            if (followOutsideEnable(name))
+                continue;
             if (await themes.setEntryDisabled(name, true))
                 logEvent('info', 'boot', `plugin kept off: ${name}`);
         }
@@ -385,7 +425,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
     // up for a plugin the user switched off, put it back down.
     host.on?.('internal/plugin', (fiber) => {
         const name = fiber.entry?.options?.name;
-        if (name !== undefined && disabled.has(name))
+        if (name !== undefined && disabled.has(name) && !followOutsideEnable(name))
             void themes.setEntryDisabled(name, true);
     });
     let installing = false;
@@ -1806,8 +1846,20 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                     return typeof manifest === 'object' && manifest !== null
                         && manifest.dsh !== undefined;
                 };
+                // A package that declares a bundle but is not in dsh.profile.bundles
+                // is not composed at boot: DSH's own plugin page turns a package off
+                // by removing it from that list, and nothing the market recorded
+                // says so (#696). Reported as off, unless it is live right now — a
+                // hot mount from this session still runs until the next restart.
+                const composedBundles = new Set(readProfileBundles(activeProfileDir));
+                const unbundled = Object.keys(installed).filter(name => {
+                    if (INBOX_BUNDLES.has(name) || composedBundles.has(name) || live.has(name))
+                        return false;
+                    const manifest = installedManifests.get(name);
+                    return typeof manifest === 'object' && manifest !== null && manifest.dsh?.bundle !== undefined;
+                });
                 for (const name of Object.keys(installed)) {
-                    const result = activationAfterReplace(verifyActivation(config.profile, name, live, activeProfileDir, disabled.has(name) || patchFlags.disabled.includes(name)), replacedWhileLive.has(name));
+                    const result = activationAfterReplace(verifyActivation(config.profile, name, live, activeProfileDir, disabled.has(name) || patchFlags.disabled.includes(name) || unbundled.includes(name)), replacedWhileLive.has(name));
                     // A package with no dsh surface of its own, outside the bundle
                     // layer, that another installed package declares, is that package's
                     // library rather than a plugin that failed to start (#634). Saying
@@ -1843,6 +1895,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                     favorites: readMarketState(activeProfileDir).favorites ?? [],
                     patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts },
                     patchDisabled: patchFlags.disabled,
+                    unbundled,
                     patchForced: patchFlags.forced,
                     bundles: readProfileBundles(activeProfileDir).filter(name => !INBOX_BUNDLES.has(name)),
                 });
@@ -2257,15 +2310,25 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                         // disabled) is NOT dropped: #147 requires disabling it to leave the
                         // neighbour live, and the e2e fixture-cross re-enable breaks otherwise.
                         const disablesOthers = carrierDisableIds(activeProfileDir, name);
+                        // Turned off by DSH's own plugin page, which removes a package from
+                        // dsh.profile.bundles (#696): enabling it here has to put it back,
+                        // or the patch rows flip, the switch reads on, and nothing composes
+                        // it on the next boot. Unlike a carrier this does NOT force a
+                        // restart: the enable below still brings it up in this process, and
+                        // whether a restart is needed is whether it is live afterwards.
+                        const reBundle = enabled && disablesOthers.length === 0 && !INBOX_BUNDLES.has(name)
+                            && declaresBundle(activeProfileDir, name) && !readProfileBundles(activeProfileDir).includes(name);
                         const isCarrier = disablesOthers.length > 0;
                         let bundleSwitch = { ok: true, reason: null };
-                        if (isCarrier) {
+                        if (isCarrier || reBundle) {
                             try {
                                 if (enabled)
                                     addProfileBundle(activeProfileDir, name);
                                 else
                                     removeProfileBundle(activeProfileDir, name);
-                                logEvent('info', 'toggle', `${name}: disable-carrier ${enabled ? 're-added to' : 'removed from'} dsh.profile.bundles (disables: ${disablesOthers.join(', ')})`);
+                                logEvent('info', 'toggle', reBundle
+                                    ? `${name}: re-added to dsh.profile.bundles, which another manager had removed it from (#696)`
+                                    : `${name}: disable-carrier ${enabled ? 're-added to' : 'removed from'} dsh.profile.bundles (disables: ${disablesOthers.join(', ')})`);
                             }
                             catch (error) {
                                 bundleSwitch = { ok: false, reason: error instanceof Error ? error.message : String(error) };
@@ -4632,6 +4695,12 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                         // keep their partial state on purpose (the user sees the diff
                         // and decides).
                         const manifestBefore = readProfileManifestSnapshot(config.profile, activeProfileDir);
+                        // The lockfile too (#701): pnpm writes it before it links, so a
+                        // run that dies in between — a native crash, a kill — leaves a
+                        // lock that names a package the manifest never got. The update
+                        // route has always restored both; a fresh install restored only
+                        // the manifest and left the half for the next pnpm run to trip on.
+                        const lockfileBefore = captureProfileLockfile();
                         const pinned = target === pinnedTarget && pinnedTarget !== plainTarget;
                         let result = await (pinned ? runPluginKeepingReleaseAge : runPlugin)(config.profile, ['add', target]);
                         // Two ways a pinned add can fail that a bare add would not, and
@@ -4666,6 +4735,11 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                             const rolledBack = restoreProfileManifest(config.profile, manifestBefore, activeProfileDir);
                             if (rolledBack.length > 0)
                                 logEvent('warn', 'install', `${target}: rolled back manifest residue of the failed run: ${rolledBack.join(', ')}`);
+                            if (lockfileBefore.ok) {
+                                const lock = restoreProfileLockfile(lockfileBefore.snapshot);
+                                if (!lock.ok)
+                                    logEvent('warn', 'install', `${target}: could not restore pnpm-lock.yaml after the failed run: ${lock.detail ?? 'unknown'}`);
+                            }
                         }
                         let ok = result.exitCode === 0 && !result.timedOut && !cancelled;
                         const cancelDiff = cancelled ? changedSince(beforeSpecs) : null;

package/lib/types/pnpm-compat.d.ts

@@ -33,7 +33,7 @@ export declare function pluginArgsFor(profileDir: string, pluginArgs: string[]):
  */
 export declare const HOST_NAMESPACE_RE: RegExp;
 export interface PnpmFailure {
-    code: 'adding-to-root' | 'not-a-workspace' | 'hoist-pattern-diff' | 'pnpm-missing' | 'release-age-violation' | 'ignored-builds' | 'git-prepare-not-allowed' | 'git-prepare-failed' | 'tarball-url-mismatch' | 'fetch-404' | 'no-matching-version' | 'transient-network' | 'fetch-timeout' | 'unexpected-store' | 'patch-failed' | 'missing-tarball-integrity' | 'windows-file-locked' | 'pnpm-unusable' | 'missing-local-dependency' | 'unparseable-build-key';
+    code: 'adding-to-root' | 'not-a-workspace' | 'hoist-pattern-diff' | 'pnpm-missing' | 'release-age-violation' | 'ignored-builds' | 'git-prepare-not-allowed' | 'git-prepare-failed' | 'tarball-url-mismatch' | 'fetch-404' | 'no-matching-version' | 'transient-network' | 'fetch-timeout' | 'unexpected-store' | 'patch-failed' | 'missing-tarball-integrity' | 'windows-file-locked' | 'pnpm-unusable' | 'missing-local-dependency' | 'unparseable-build-key' | 'native-oom';
     /** Bilingual, actionable message shown to the user instead of the raw wall of text. */
     message: string;
     /** True when re-running `pnpm install` in the profile is the documented recovery. */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.59.0",
+  "version": "1.60.0",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/check.ts

@@ -947,7 +947,19 @@ export function buildBundleLayers(
       // fatal verdict and rolled back a good update (#369) — while `dsh
       // --dump-config` on the same profile exited 0. Unknown has to read as
       // unknown; the profile's own bundles are still judged normally.
-      if (hostProvided) {
+      //
+      // The same holds for any official bundle while the installation itself
+      // cannot be located (#676): a desktop build ships more in-box bundles
+      // than the three named in INBOX_BUNDLES —
+      // `@deepseek-ai/dsh-experimental-agent-team-profile` among them — and a
+      // fixed list, or an install-path shape, cannot know which. Two
+      // reporters saw that bundle called "not installed — will fail to boot"
+      // while its three entries were active in the running host. Only
+      // DeepSeek publishes under `@deepseek-ai/`, so while the installation
+      // is out of sight such a bundle is unknown, not missing. When the
+      // installation IS located and the bundle is in neither it nor the
+      // profile, the fatal verdict below still applies.
+      if (hostProvided || (dshInstallDir === null && name.startsWith('@deepseek-ai/'))) {
         layer.error = null
         layer.unresolvedInbox = true
         return layer

package/src/client/MarketSection.tsx

@@ -1490,6 +1490,8 @@ export function MarketSection(props: MarketSectionProps) {
    * real switch state so hand-edited cordis.patch.yml toggles are visible.
    */
   const [patchDisabledNames, setPatchDisabledNames] = useState<string[]>([])
+  /** Bundle packages DSH's own plugin page turned off by leaving them out of dsh.profile.bundles (#696). */
+  const [unbundledNames, setUnbundledNames] = useState<string[]>([])
   const [groups, setGroups] = useState<Record<string, string[]>>({})
   const [groupOrder, setGroupOrder] = useState<string[]>([])
   /** Installed-tab sub-view: flat list or groups (All-plugins was removed —
@@ -1669,6 +1671,7 @@ export function MarketSection(props: MarketSectionProps) {
           setNotes(body.notes as Record<string, string>)
         }
         if (Array.isArray(body.patchDisabled)) setPatchDisabledNames(body.patchDisabled)
+        if (Array.isArray(body.unbundled)) setUnbundledNames(body.unbundled)
         if (body.groups && typeof body.groups === 'object') setGroups(body.groups)
         if (Array.isArray(body.groupOrder)) setGroupOrder(body.groupOrder)
         if (Array.isArray(body.favorites)) setFavoriteUrls(body.favorites.filter((url: unknown): url is string => typeof url === 'string'))
@@ -1697,8 +1700,8 @@ export function MarketSection(props: MarketSectionProps) {
   const favoriteUrlSet = useMemo(() => new Set(favoriteUrls), [favoriteUrls])
   /** Effective switch state: market disable list ∪ user-patch-layer disables. */
   const effectiveDisabledSet = useMemo(
-    () => new Set([...disabledNames, ...patchDisabledNames]),
-    [disabledNames, patchDisabledNames],
+    () => new Set([...disabledNames, ...patchDisabledNames, ...unbundledNames]),
+    [disabledNames, patchDisabledNames, unbundledNames],
   )
 
   useEffect(() => {

package/src/pnpm-compat.ts

@@ -48,7 +48,7 @@ export interface PnpmFailure {
     | 'ignored-builds' | 'git-prepare-not-allowed' | 'git-prepare-failed' | 'tarball-url-mismatch'
     | 'fetch-404' | 'no-matching-version' | 'transient-network' | 'fetch-timeout'
     | 'unexpected-store' | 'patch-failed' | 'missing-tarball-integrity' | 'windows-file-locked'
-    | 'pnpm-unusable' | 'missing-local-dependency' | 'unparseable-build-key'
+    | 'pnpm-unusable' | 'missing-local-dependency' | 'unparseable-build-key' | 'native-oom'
   /** Bilingual, actionable message shown to the user instead of the raw wall of text. */
   message: string
   /** True when re-running `pnpm install` in the profile is the documented recovery. */
@@ -350,6 +350,21 @@ export function classifyPnpmFailure(output: string, exitCode?: number | null): P
   // pnpm's FETCHER, before anything lands in node_modules — so the package
   // the user must approve is not installed yet, and pnpm's own hint names a
   // commit-pinned codeload URL that changes on every push.
+  // #701: pnpm 12's native engine (pnpm-native) aborting on an allocation it
+  // cannot get — "memory allocation of 5368709120 bytes failed", Windows exit
+  // 3221226505 (0xC0000409, how a Rust abort ends there). Reported with an
+  // A/B: on pnpm 12.5.1 every run with `autoInstallPeers: false` in the
+  // workspace file (DSH writes it into every profile) aborted at ~5 GB peak
+  // RSS, every run without it passed at ~80 MB, with free memory to spare.
+  // Nothing about the plugin being installed; not something a retry of the
+  // same command changes on the reporter's data, so none is attempted.
+  if (/memory allocation of \d+ bytes failed/.test(output) || exitCode === 3221226505) {
+    return {
+      code: 'native-oom',
+      recoverable: false,
+      message: 'pnpm 12 的原生引擎在处理这个 profile 时耗尽了内存并中止——和要安装的插件无关。在 pnpm 修复之前，请改用 pnpm 11（npm install -g pnpm@11）后再试。 / pnpm 12\'s native engine ran out of memory on this profile and aborted — the plugin being installed is not the cause. Until pnpm fixes it, switch to pnpm 11 (npm install -g pnpm@11) and try again.',
+    }
+  }
   // #698: pnpm 10.26+ and 11.0–11.5 read an allowBuilds key as
   // `name@<version union>`, so a git or archive source there fails the WHOLE
   // workspace file — every pnpm command in the profile, not the one plugin.

package/src/routes.ts

@@ -244,6 +244,16 @@ function packageHasClientPart(profileDirectory: string, name: string): boolean {
  * the package, and the key written is the one pnpm printed, never text from
  * the request.
  */
+/** Whether an installed package's manifest declares a bundle. */
+function declaresBundle(profileDirectory: string, name: string): boolean {
+  try {
+    const manifest = JSON.parse(readFileSync(join(profileDirectory, 'node_modules', name, 'package.json'), 'utf8')) as { dsh?: { bundle?: unknown } }
+    return manifest.dsh?.bundle !== undefined
+  } catch {
+    return false
+  }
+}
+
 const prepareRefusals = new Map<string, string | null>()
 
 function blockedBuilds(result: { ignoredBuilds?: unknown; stdout: string; stderr: string }): string[] | undefined {
@@ -435,6 +445,34 @@ export function mountMarketRoutes(
     setCustomGithubProxy(fresh.githubProxy ?? null)
   }
 
+  /**
+   * Follow an enable made OUTSIDE the market (#696).
+   *
+   * The market keeps its own disable list in state.json, and the self-heal
+   * guard below and the boot replay put any plugin on that list back down.
+   * DSH's own Settings → Plugins page enables a row by flipping it to
+   * `disabled: false` in the shared patch layer — it has never heard of
+   * state.json — so its enable was silently undone within a second and again
+   * on every boot, and the official switch looked broken.
+   *
+   * The patch layer is the one truth both managers share. A row explicitly
+   * enabled there while no row of the same package is disabled can only be a
+   * newer decision than the market's list (the market removes a name from
+   * its list BEFORE writing its own enable row), so the list follows it.
+   *
+   * @returns true when the package was re-enabled elsewhere and has been
+   *   dropped from the market's disable list.
+   */
+  function followOutsideEnable(name: string): boolean {
+    const patch = readUserPatchState(userPatchPath)
+    const flags = packagePatchFlags(host, activeProfileDir, [name], patch)
+    if (!flags.forced.includes(name) || flags.disabled.includes(name)) return false
+    disabled.delete(name)
+    writeMarketState(activeProfileDir, { disabled, groups, groupOrder })
+    logEvent('info', 'toggle', `${name}: its rows were re-enabled outside the market (#696) — following that instead of switching it back off`)
+    return true
+  }
+
   // Client-only packages (dsh.client without dsh.bundle) are invisible to the
   // bundle layer in every boot; the market shim-mounts them so their client
   // bundles are actually served.
@@ -444,7 +482,8 @@ export function mountMarketRoutes(
     // switched away from get live-disabled again (bundle trees are
     // in-memory, so the disable never persists on its own). Client-only
     // shims for disabled plugins were already skipped by mountClientOnlyDeps.
-    for (const name of disabled) {
+    for (const name of [...disabled]) {
+      if (followOutsideEnable(name)) continue
       if (await themes.setEntryDisabled(name, true)) logEvent('info', 'boot', `plugin kept off: ${name}`)
     }
   })
@@ -454,7 +493,7 @@ export function mountMarketRoutes(
   // up for a plugin the user switched off, put it back down.
   host.on?.('internal/plugin', (fiber) => {
     const name = fiber.entry?.options?.name
-    if (name !== undefined && disabled.has(name)) void themes.setEntryDisabled(name, true)
+    if (name !== undefined && disabled.has(name) && !followOutsideEnable(name)) void themes.setEntryDisabled(name, true)
   })
   let installing = false
   let restarting = false
@@ -1948,10 +1987,21 @@ export function mountMarketRoutes(
           return typeof manifest === 'object' && manifest !== null
             && (manifest as { dsh?: unknown }).dsh !== undefined
         }
+        // A package that declares a bundle but is not in dsh.profile.bundles
+        // is not composed at boot: DSH's own plugin page turns a package off
+        // by removing it from that list, and nothing the market recorded
+        // says so (#696). Reported as off, unless it is live right now — a
+        // hot mount from this session still runs until the next restart.
+        const composedBundles = new Set(readProfileBundles(activeProfileDir))
+        const unbundled = Object.keys(installed).filter(name => {
+          if (INBOX_BUNDLES.has(name) || composedBundles.has(name) || live.has(name)) return false
+          const manifest = installedManifests.get(name) as { dsh?: { bundle?: unknown } } | null | undefined
+          return typeof manifest === 'object' && manifest !== null && manifest.dsh?.bundle !== undefined
+        })
         for (const name of Object.keys(installed)) {
           const result = activationAfterReplace(
             verifyActivation(config.profile, name, live, activeProfileDir,
-              disabled.has(name) || patchFlags.disabled.includes(name)),
+              disabled.has(name) || patchFlags.disabled.includes(name) || unbundled.includes(name)),
             replacedWhileLive.has(name),
           )
           // A package with no dsh surface of its own, outside the bundle
@@ -1989,6 +2039,7 @@ export function mountMarketRoutes(
           favorites: readMarketState(activeProfileDir).favorites ?? [],
           patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts },
           patchDisabled: patchFlags.disabled,
+          unbundled,
           patchForced: patchFlags.forced,
           bundles: readProfileBundles(activeProfileDir).filter(name => !INBOX_BUNDLES.has(name)),
         })
@@ -2399,13 +2450,23 @@ export function mountMarketRoutes(
           // disabled) is NOT dropped: #147 requires disabling it to leave the
           // neighbour live, and the e2e fixture-cross re-enable breaks otherwise.
           const disablesOthers = carrierDisableIds(activeProfileDir, name)
+          // Turned off by DSH's own plugin page, which removes a package from
+          // dsh.profile.bundles (#696): enabling it here has to put it back,
+          // or the patch rows flip, the switch reads on, and nothing composes
+          // it on the next boot. Unlike a carrier this does NOT force a
+          // restart: the enable below still brings it up in this process, and
+          // whether a restart is needed is whether it is live afterwards.
+          const reBundle = enabled && disablesOthers.length === 0 && !INBOX_BUNDLES.has(name)
+            && declaresBundle(activeProfileDir, name) && !readProfileBundles(activeProfileDir).includes(name)
           const isCarrier = disablesOthers.length > 0
           let bundleSwitch: { ok: boolean; reason: string | null } = { ok: true, reason: null }
-          if (isCarrier) {
+          if (isCarrier || reBundle) {
             try {
               if (enabled) addProfileBundle(activeProfileDir, name)
               else removeProfileBundle(activeProfileDir, name)
-              logEvent('info', 'toggle', `${name}: disable-carrier ${enabled ? 're-added to' : 'removed from'} dsh.profile.bundles (disables: ${disablesOthers.join(', ')})`)
+              logEvent('info', 'toggle', reBundle
+                ? `${name}: re-added to dsh.profile.bundles, which another manager had removed it from (#696)`
+                : `${name}: disable-carrier ${enabled ? 're-added to' : 'removed from'} dsh.profile.bundles (disables: ${disablesOthers.join(', ')})`)
             } catch (error) {
               bundleSwitch = { ok: false, reason: error instanceof Error ? error.message : String(error) }
               logEvent('warn', 'toggle', `${name}: carrier bundle switch failed — ${bundleSwitch.reason}`)
@@ -4792,6 +4853,12 @@ sendJson(response, 200, { updates })
             // keep their partial state on purpose (the user sees the diff
             // and decides).
             const manifestBefore = readProfileManifestSnapshot(config.profile, activeProfileDir)
+            // The lockfile too (#701): pnpm writes it before it links, so a
+            // run that dies in between — a native crash, a kill — leaves a
+            // lock that names a package the manifest never got. The update
+            // route has always restored both; a fresh install restored only
+            // the manifest and left the half for the next pnpm run to trip on.
+            const lockfileBefore = captureProfileLockfile()
             const pinned = target === pinnedTarget && pinnedTarget !== plainTarget
             let result = await (pinned ? runPluginKeepingReleaseAge : runPlugin)(config.profile, ['add', target])
             // Two ways a pinned add can fail that a bare add would not, and
@@ -4825,6 +4892,10 @@ sendJson(response, 200, { updates })
             if ((result.exitCode !== 0 || result.timedOut) && !cancelled) {
               const rolledBack = restoreProfileManifest(config.profile, manifestBefore, activeProfileDir)
               if (rolledBack.length > 0) logEvent('warn', 'install', `${target}: rolled back manifest residue of the failed run: ${rolledBack.join(', ')}`)
+              if (lockfileBefore.ok) {
+                const lock = restoreProfileLockfile(lockfileBefore.snapshot)
+                if (!lock.ok) logEvent('warn', 'install', `${target}: could not restore pnpm-lock.yaml after the failed run: ${lock.detail ?? 'unknown'}`)
+              }
             }
             let ok = result.exitCode === 0 && !result.timedOut && !cancelled
             const cancelDiff = cancelled ? changedSince(beforeSpecs) : null