dshmarket 1.64.0 → 1.65.0

package/README.md

@@ -31,15 +31,17 @@ its own dsh: it may be older than the one `npm` would give you (#139).
 
 ## What you get
 
-- **Browse & search** the full community catalog (2300+ plugins, growing daily) — category filters, star counts, top/new sorting, bilingual descriptions that follow your UI language
+- **Browse & search** the full community catalog (4200+ plugins, growing daily) — category filters, star counts, top/new sorting, bilingual descriptions that follow your UI language
 - **Host-aware discovery** — cards show the DSH requirement declared by `engines.dsh` or lockstep `@deepseek-ai/dsh-*` peers; an opt-in filter hides only confirmed mismatches with the running host. Undeclared, malformed, unavailable, and GitHub-only entries remain visible rather than being guessed incompatible
 - **Screenshots** — AppStore-style screenshots, auto-carousel when there's more than one, click to preview full-size: author-curated shots show right on the card (zero extra requests); plugins without curated shots fall back to automatic README extraction once you open the install dialog. Images load from GitHub hosting only
 - **Comments** — every card opens the plugin's discussion thread in place. It is the same thread its pages on [dshmarket.com](https://dshmarket.com) and the [catalog](https://awesome-dsh-plugin.com) show, so a plugin has one conversation rather than three. Backed by GitHub Discussions through giscus: it loads when you open it, needs a GitHub account only to post, and the note above it says plainly that opening it contacts giscus.app and GitHub. On local dsh web, reading stays embedded while a dedicated GitHub action opens the exact discussion in a new tab for sign-in and posting, so the cross-site return never carries or depends on the host session
 - **Favorites** — bookmark plugins and themes from Discover or the Themes tab; a dedicated Favorites tab lists them with search, sort, and install actions. Bookmarks persist in the profile's market state (`state.json`); entries that leave the catalog can be cleared in one click
+- **Groups** — organise installed plugins into named groups (rename, delete, and per-group search); a plugin lives in one group and ungrouped is the default. Purely organisational: the panel says so, and nothing about enable state changes. The grouping itself is local state in the profile's `state.json`
+- **Notes** — write your own one-line description for any installed plugin and it replaces the author's on that row, so a shelf of forty plugins answers "why did I install this" in your words. Stored locally beside groups and favorites, never sent anywhere
 - **Themes** — a dedicated tab for community themes and skins: install → active immediately, switch with one click (themes are mutually exclusive, your choice survives restarts), uninstall to revert
 - **One-click install** — confirm the source, watch live progress; most plugins go live after a page refresh, no restart
 - **Backup & restore** — export your profile's plugin list and configuration as readable JSON, import it on another machine, store it on WebDAV with daily auto-backup, or sync through a private GitHub Gist; restores **merge** (plugins installed after the backup are kept), validate before writing, and roll back on failure
-- **Updates** — per-plugin update checks (npm version or pinned commit vs HEAD), one-click update, or update everything at once; the market updates itself the same way
+- **Updates** — per-plugin update checks (npm version or pinned commit vs HEAD), one-click update, or update everything at once; the market updates itself the same way. Each row with an update pending carries a **What changed** link — the release notes, or the commits when the version cannot be aligned to one. A notice you are not acting on can be ignored for the rest of the boot instead of being dismissed again on every reload — scoped to the running host, so a restart brings the reminder back and ignoring it is never the same as turning it off
 - **Resilient GitHub routes** — in the China download region, Git refs, README content, and avatars each keep their own fallback order. The market remembers the last working route, switches only after transport/HTTP/payload validation fails, and rejects proxy error pages disguised as HTTP 200. If every built-in route fails, **Settings → Plugins → Plugin configuration → GitHub acceleration** accepts one persistent custom HTTPS prefix; `DSHM_GITHUB_PROXY` remains the operator-owned override
 - **Public update API** — plugin-owned settings pages can use the versioned, capability-gated [update API v1](UPDATE-API-V1.md) (beta) instead of copying package-manager logic or depending on private Market UI responses
 - **Uninstall** — two-step confirm; plugins installed this session are removed live
@@ -49,7 +51,7 @@ its own dsh: it may be older than the one `npm` would give you (#139).
 - **Zero jargon** — if a component is missing (pnpm), the market detects it and offers a one-click automatic setup
 - **Log export** — one click produces a sanitized plain-text log for bug reports (home paths and credential shapes are masked; nothing is ever sent anywhere). The market's version sits next to the page heading, so a screenshot of a problem already carries it
 - **Settings card** — on dsh 0.1.0-rc.7 and newer the market manages *itself* from **Settings → Plugins → Plugin configuration**, next to every other plugin: see the running version, pick a **release channel** (stable, or beta to try builds still being verified — the market only, never your other plugins; a third *dev* channel appears once developer mode is switched on, and carries builds published straight off a branch), update, or remove the market — with an opt-in cleanup that also drops the disable rows it wrote, so plugins it switched off start running again rather than staying off with no UI left to switch them back on
-- **Diagnostics** — the plugin load order and conflict surface, one page: bundle stack with official/community badges, duplicate loader entries, dependency version mismatches, multi-version core packages, overrides and invalid config entries. Plain-language terms, problem blocks highlighted, everything collapsible
+- **Diagnostics** — the plugin load order and conflict surface, one page: bundle stack with official/community badges, duplicate loader entries, dependency version mismatches, multi-version core packages, overrides and invalid config entries, and leftover directories — a package directory an interrupted update left without its `package.json`, and pnpm's own `*_tmp_*` staging directories. Nothing there stops a start, so it is listed rather than warned about, and it is the only place that names what is on disk. Plain-language terms, problem blocks highlighted, everything collapsible
 
 - **Load order** — drag community bundles into the order you want, or take the suggested one derived from the plugins' own before/after rules. Nothing is written until a trial composition passes, and the panel tells you what the new order would change (overrides, invalid or duplicate entries) before you apply it
 - **AI fix** — one click copies a diagnostics-driven fix prompt (errors/warnings/order conflicts + conservative scope instructions) to the clipboard; you paste it into a new conversation and decide whether to send. The prompt first asks the agent to detect whether it is itself the harness running this profile — if so it hard-forbids mutating the live composition, upgrading/restarting the harness or core packages, or reinstalling deps, and instead has it write an idempotent `apply` script plus a `rollback` script, have you run them in an external terminal, and paste the output back
@@ -76,6 +78,8 @@ Installs prefer repo-verified npm packages, then author-supplied prebuilt GitHub
       allowRestart: false   # NOT at the top level beside `name:`
   ```
 
+  **On dsh 0.1.7 and newer there is no switch to flip**: the host derives a plugin's settings from its own Config schema and no longer serves a plugin-registered settings namespace, so the market has no control there. The profile patch below is the way on every host.
+
   `GET /dsh-market/status` reports `"restart": false` once it has taken effect.
 - For terminal-attached launches, the detached replacement keeps running after the original terminal closes
 - Listing ≠ endorsement: plugins are third-party code, install sources you trust
@@ -96,7 +100,9 @@ Fetched live on every open from [awesome-dsh-plugin.com/plugins.json](https://aw
 
 There is deliberately no bundled snapshot to fall back on: for a catalog that grows daily, a stale answer is not a degraded one but a wrong one — a plugin published this morning would read as "does not exist".
 
-**If that host is unreachable from your network**, point the market at a mirror instead. Set `DSHM_REGISTRY_URL` in the environment dsh runs in, to anything serving the same `plugins.json` shape:
+In the China download region the same catalog is read from npm first, through the same region-aware routes the plugins themselves arrive on: every China mirror already carries it, it comes off the mirror rather than bouncing back to the origin registry, and it carries a version, so a bad catalog build can be rolled back instead of only being fixed forwards. The origin stays last in the list as the route that has always worked. Region detection happens once and the answer is remembered; **Settings → Plugins → Plugin configuration** can override it.
+
+**If that host is unreachable from your network**, point the market at a mirror. Set `DSHM_REGISTRY_URL` in the environment dsh runs in, to anything serving the same `plugins.json` shape:
 
 ```sh
 DSHM_REGISTRY_URL=https://your-mirror.example/plugins.json dsh web

package/README.zh.md

@@ -29,15 +29,17 @@ dsh plugin --profile web add dshmarket
 
 ## 你会得到
 
-- **逛与搜**——完整社区目录（2300+ 插件，每天在涨），分类筛选、star 数、最热/最新排序，中英描述跟随界面语言
+- **逛与搜**——完整社区目录（4200+ 插件，每天在涨），分类筛选、star 数、最热/最新排序，中英描述跟随界面语言
 - **按宿主发现**——卡片展示插件通过 `engines.dsh` 或同版本线 `@deepseek-ai/dsh-*` peer 声明的 DSH 要求；可选筛选只隐藏与当前宿主明确不匹配的插件。未声明、格式异常、暂时取不到清单及仅 GitHub 发布的条目仍保持可见，不猜成不兼容
 - **截图展示**——App Store 式截图，多图自动轮播，点开还能看大图；作者在 registry 里策展的截图列表卡片就直接显示（零额外请求），没有策展的插件则在打开安装弹窗时自动从 README 抽取；图片仅从 GitHub 图床加载
 - **评论**——每张卡片都能就地打开该插件的讨论。它和插件在 [dshmarket.com](https://dshmarket.com) 与[目录站](https://awesome-dsh-plugin.com)上的页面共用同一条讨论，一个插件只有一处对话，而不是三处。底层是 GitHub Discussions（经由 giscus）：打开即加载，只有发表评论才需要 GitHub 账号；说明里也直说打开会连接 giscus.app 与 GitHub。本地 dsh web 继续内嵌评论供阅读，登录和发表则通过专用 GitHub 入口在新标签页打开当前插件的精确讨论，不让跨站回跳携带或依赖宿主会话
 - **收藏**——在「发现」或「主题」页点书签即可收藏插件/主题；「收藏」Tab 集中展示，支持搜索、排序与安装。书签写入 profile 的市场状态（`state.json`）；已下架条目可一键清除
+- **分组**——把已安装插件整理进具名分组（可重命名、删除，分组内单独搜索）；一个插件属于一个分组，默认是「未分组」。它只用于整理，面板上写明了这一点，不改变任何启用状态。分组本身是 profile `state.json` 里的本地状态
+- **备注**——给任何已安装插件写一行你自己的说明，它会在这行**代替作者简介**显示——四十个插件的列表因此能用你自己的话回答「我当初为什么装它」。和分组、收藏一样只存在本地，不上传
 - **主题**——独立主题页：装完立即生效，点一下切换（主题互斥、选择跨重启保留），卸载即恢复
 - **一键安装**——确认来源，实时进度；多数插件刷新页面即可用，无需重启
 - **备份与恢复**——把 profile 的插件清单与配置导出为可读 JSON，换机导入，存到 WebDAV 并每日自动备份，或通过私有 GitHub Gist 跨机器同步；恢复采用**合并**方式（备份之后新装的插件会保留），写入前校验、失败自动回滚
-- **更新**——逐插件检测（npm 版本或锁定 commit 对比 HEAD），一键更新或全部更新；市场自己也走同一通道升级
+- **更新**——逐插件检测（npm 版本或锁定 commit 对比 HEAD），一键更新或全部更新；市场自己也走同一通道升级。每个有待更新的行上都有「更新内容」链接——有版本说明就是版本说明，对不上版本时给提交记录。暂时不处理的提醒可以**本次不再提醒**（本次 = 当前宿主进程），重启后提醒会回来——「忽略」永远不等于「关闭」
 - **GitHub 多线路容错**——中国大陆下载区域会为 Git ref、README 与头像分别维护 fallback 顺序，记住上次可用线路，只在传输、HTTP 状态或响应内容校验失败后换线，并拒绝公共反代伪装成 HTTP 200 的 HTML 错误页。内置线路全部失效时，可到**设置 → 插件 → 插件配置 → GitHub 加速**填写一个持久化的自定义 HTTPS 前缀；运维设置的 `DSHM_GITHUB_PROXY` 始终优先
 - **公共更新接口**——插件自己的设置页可调用带版本号、能力探测和回滚状态的[更新 API v1](UPDATE-API-V1.md)（beta），无需复制包管理逻辑，也不依赖市场 UI 的私有响应字段
 - **卸载**——两步确认防误触；本次会话装的插件即点即卸
@@ -47,7 +49,7 @@ dsh plugin --profile web add dshmarket
 - **零术语**——缺组件（pnpm）时市场自己发现、一键自动装好，全程不见命令行
 - **导出日志**——一键生成脱敏纯文本日志方便反馈（home 路径与密钥形状已打码；任何数据都不会被上传）。市场版本号就在标题旁边，截图反馈时自带版本信息
 - **设置卡片**——dsh 0.1.0-rc.7 起，市场在 **设置 → 插件 → 插件配置** 里管理**它自己**，和其它插件并排：看当前版本、选择**更新通道**（稳定版，或 Beta 抢先试用还在验证中的版本——只影响市场自己，不影响你装的其它插件；打开开发者模式后还会多出「开发版」通道，直接取开发分支上的构建）、更新、或者移除市场。移除时可勾选一并清理——包括市场写进补丁层的停用行，被它关掉的插件会恢复运行，而不是保持停用却再没有界面能打开它们
-- **诊断**——插件加载顺序与冲突一页看全：bundle 栈（官方/社区徽标）、重复的 loader 条目、依赖版本不一致、核心包多版本共存、覆盖项与非法配置条目。术语说人话，问题块高亮，全部可折叠
+- **诊断**——插件加载顺序与冲突一页看全：bundle 栈（官方/社区徽标）、重复的 loader 条目、依赖版本不一致、核心包多版本共存、覆盖项与非法配置条目，以及残留目录——更新被打断后留下的、缺少 `package.json` 的包目录，和 pnpm 自己的 `*_tmp_*` 暂存目录。它们都不妨碍启动，所以只列出来而不报成警告，也是唯一会说清磁盘上到底有什么的地方。术语说人话，问题块高亮，全部可折叠
 - **加载顺序**——拖拽调整社区 bundle 的顺序，或直接采用按插件自身 before/after 规则推导出的建议顺序。写入前先跑一次静态组合校验，通过才落盘；应用之前面板会告诉你这个顺序会改变什么（多少处覆盖、多少无效或重复条目）
 - **AI 修复**——一键把诊断结果生成的修复 prompt（错误/警告/顺序冲突 + 保守的改动范围约束）复制到剪贴板，你粘进新对话，自己决定发不发。提示词会先让 Agent 判断自己是不是就是这个 profile 所在的 harness——若是，则严禁改动运行中组合、升级/重启 harness 或核心包、重装依赖，而是让它生成一份幂等的 `apply` 修改脚本和一份 `rollback` 回滚脚本，由你在外部终端执行并把输出拷回给它
 
@@ -73,6 +75,8 @@ dsh plugin --profile web add dshmarket
       allowRestart: false   # 不要和 `name:` 并排写在顶层
   ```
 
+  **dsh 0.1.7 及更新版本上没有这个开关可关**：宿主改为从插件自己的 Config schema 派生设置，不再为插件注册的设置命名空间提供服务，市场在那里没有可用的控件。用下面的 profile patch，它在所有宿主上都有效。
+
   生效后 `GET /dsh-market/status` 会返回 `"restart": false`。
 - 从终端启动时，替代进程脱离原终端，关闭原终端后仍会继续运行
 - 收录 ≠ 背书:插件是第三方代码,请只安装你信任的来源
@@ -93,6 +97,8 @@ dsh plugin --profile web add dshmarket
 
 刻意不做本地快照兜底：目录每天都在增长，过期的答案不是「差一点」而是「错的」——今早刚发布的插件会显示成「不存在」。
 
+中国大陆下载区域**优先从 npm 读同一份目录**，走的是插件自己也在走的那套区域感知线路：国内镜像本来就带着它、下载落在镜像而不是绕回源站，而且它有版本号——一份有问题的目录构建可以回滚，而不是只能往前修。源站仍作为「一直能用的那条」排在最后。区域判断只做一次并记住结果，可在**设置 → 插件 → 插件配置**里改。
+
 **如果你的网络访问不了这个域名**，可以改指到镜像：在 dsh 运行的环境里设置 `DSHM_REGISTRY_URL`，指向任何提供相同 `plugins.json` 结构的地址：
 
 ```sh

package/client/client.js

@@ -336,6 +336,14 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			hostIncompatibleTitle: "这个新版本要求更新的 DSH",
 			hostIncompatibleBody: "{plugin} 声明它需要 DSH {requirement}，而你现在运行的是 {host}。装上去多半会直接报错，只能手动装回旧版。\n已经停下了，插件还是原来的版本。\n如果你确定这个版本号不准（例如桌面端捆绑的 DSH 不报告版本），也可以继续更新。",
 			hostIncompatibleUnknown: "未知版本",
+			hostIncompatibleSearching: "正在查找还兼容当前 DSH 的版本…",
+			hostIncompatibleFoundInstall: "可以装 {version}：它声明兼容当前 DSH。",
+			hostIncompatibleFoundUpdate: "可以更新到 {version}：它声明兼容当前 DSH。",
+			hostIncompatibleNoCompat: "没有找到声明兼容当前 DSH 的版本。",
+			hostIncompatibleSearchFailed: "暂时查不到兼容版本。",
+			hostIncompatibleInstallCompat: "安装 {version}",
+			hostIncompatibleUpdateCompat: "更新到 {version}",
+			hostIncompatibleRetry: "重试",
 			hostIncompatibleKeep: "保持现在的版本",
 			hostIncompatibleAnyway: "仍然更新",
 			hostStatusCompatible: "兼容性已满足（声明满足）",
@@ -457,6 +465,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			perPage: "每页",
 			marketUpdate: "更新插件市场",
 			updateAll: "全部更新",
+			heldReleaseNotice: "装好了，但不是最新的：这个 profile 的 minimumReleaseAge 把 {0} 按住了，装的是 {1}。",
+			heldReleaseAction: "装 {0}（不等）",
 			ignoreUpdateNotice: "本次不再提醒",
 			ignoreAllUpdateNotices: "本次全部忽略",
 			updateNoticeIgnored: "本次已忽略提醒",
@@ -665,6 +675,11 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			checkOverrides: "覆盖关系",
 			checkOverridesEmpty: "没有覆盖关系",
 			checkOverridden: "覆盖了",
+			checkResiduals: "残留目录",
+			checkResidualsEmpty: "没有发现残缺的包目录或 pnpm 临时目录。",
+			checkResidualsHint: "这些目录没有任何声明引用它们，也不妨碍启动；它们是更新被打断时留下的。退出 DSH 之后可以删除，或直接重新安装对应的插件。",
+			checkResidualTmp: "pnpm 临时目录",
+			checkResidualIncomplete: "残缺的包目录（缺少 package.json）",
 			checkOrphans: "无效的配置条目",
 			checkOrphansEmpty: "没有无效配置条目",
 			orphanInsertNotArray: "格式错误",
@@ -929,6 +944,14 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			hostIncompatibleTitle: "This release needs a newer DSH",
 			hostIncompatibleBody: "{plugin} declares that it needs DSH {requirement}, and you are running {host}. Installing it would most likely break the plugin, leaving a manual downgrade as the only way back.\nNothing was changed — the plugin is still on its current version.\nIf you know the version number is wrong (a bundled DSH that does not report one, for example), you can update anyway.",
 			hostIncompatibleUnknown: "an unknown version",
+			hostIncompatibleSearching: "Looking for a version that still supports this DSH…",
+			hostIncompatibleFoundInstall: "You can install {version} — it declares support for this DSH.",
+			hostIncompatibleFoundUpdate: "You can update to {version} — it declares support for this DSH.",
+			hostIncompatibleNoCompat: "No version declares support for this DSH.",
+			hostIncompatibleSearchFailed: "Could not look up compatible versions.",
+			hostIncompatibleInstallCompat: "Install {version}",
+			hostIncompatibleUpdateCompat: "Update to {version}",
+			hostIncompatibleRetry: "Retry",
 			hostIncompatibleKeep: "Keep the current version",
 			hostIncompatibleAnyway: "Update anyway",
 			hostStatusCompatible: "Host requirement satisfied (declared)",
@@ -1050,6 +1073,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			perPage: "Per page",
 			marketUpdate: "Update the plugin market",
 			updateAll: "Update all",
+			heldReleaseNotice: "Installed, but not the newest: this profile's minimumReleaseAge is holding {0} back, so {1} is what got installed.",
+			heldReleaseAction: "Install {0} anyway",
 			ignoreUpdateNotice: "Ignore for this boot",
 			ignoreAllUpdateNotices: "Ignore all for this boot",
 			updateNoticeIgnored: "Reminder ignored for this boot",
@@ -1258,6 +1283,11 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			checkOverrides: "Overrides",
 			checkOverridesEmpty: "No overrides",
 			checkOverridden: "overrides",
+			checkResiduals: "Leftover directories",
+			checkResidualsEmpty: "No incomplete package directories or pnpm temp directories.",
+			checkResidualsHint: "Nothing in the profile references these, and none of them stops a start: they are what an interrupted update leaves behind. Quit DSH and either delete them or install the plugin again.",
+			checkResidualTmp: "pnpm temp directory",
+			checkResidualIncomplete: "incomplete package (no package.json)",
 			checkOrphans: "Invalid config entries",
 			checkOrphansEmpty: "No invalid config entries",
 			orphanInsertNotArray: "malformed",
@@ -3762,6 +3792,12 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 												onClick: () => props.onRetry?.(record),
 												children: t("opRetry")
 											}),
+											record.state === "warned" && record.heldRelease !== void 0 && props.onForceInstall !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+												variant: "outline",
+												size: "sm",
+												onClick: () => props.onForceInstall?.(record),
+												children: t("heldReleaseAction").replace("{0}", record.heldRelease.latest)
+											}),
 											isSettled(record) && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
 												variant: "ghost",
 												size: "sm",
@@ -5498,6 +5534,36 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 							}, i))
 						})
 					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)(Section, {
+						title: t("checkResiduals"),
+						count: report.residuals?.length ?? 0,
+						empty: t("checkResidualsEmpty"),
+						problem: false,
+						overview: report.residuals?.[0]?.path,
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: Market_module_css_default.panelNote,
+							children: t("checkResidualsHint")
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: Market_module_css_default.diagList,
+							children: (report.residuals ?? []).map((residual) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: Market_module_css_default.diagRow,
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: Market_module_css_default.nm,
+										children: residual.name
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: Market_module_css_default.spec,
+										children: t(residual.kind === "tmp-directory" ? "checkResidualTmp" : "checkResidualIncomplete")
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("code", {
+										className: Market_module_css_default.diagVal,
+										children: residual.path
+									})
+								]
+							}, residual.path))
+						})]
+					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)(CollapsibleSection, {
 						title: t("orderSection"),
 						count: order.length,
@@ -7119,6 +7185,44 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			const [restoreConfirm, setRestoreConfirm] = (0, react.useState)(null);
 			/** A release whose declared host requirement this host does not meet (#404). kind distinguishes the update dialog from the fresh-install dialog. */
 			const [hostIncompatible, setHostIncompatible] = (0, react.useState)(null);
+			/**
+			* The answer to "the newest release is too new for this host — what CAN I
+			* install?" (#581). The dialog asks as soon as it opens, because that
+			* question is the only way out it can offer: the alternative the route
+			* gives (install anyway) is a decision about breaking the host, and most
+			* users reaching this dialog have no way to weigh it.
+			*/
+			const [findingCompat, setFindingCompat] = (0, react.useState)({ status: "idle" });
+			const [compatRetry, setCompatRetry] = (0, react.useState)(0);
+			(0, react.useEffect)(() => {
+				if (hostIncompatible === null || hostIncompatible.npmName === null) {
+					setFindingCompat({ status: "idle" });
+					return;
+				}
+				const controller = new AbortController();
+				setFindingCompat({ status: "loading" });
+				fetch(api("/dsh-market/find-compatible"), {
+					method: "POST",
+					headers: { "content-type": "application/json" },
+					body: JSON.stringify({
+						npmName: hostIncompatible.npmName,
+						upgradeOnly: hostIncompatible.kind === "update"
+					}),
+					signal: controller.signal
+				}).then(async (response) => {
+					if (!response.ok) throw new Error(`HTTP ${response.status}`);
+					return await response.json();
+				}).then((data) => {
+					if (controller.signal.aborted) return;
+					setFindingCompat(typeof data.compatibleVersion === "string" && data.compatibleVersion !== "" ? {
+						status: "found",
+						version: data.compatibleVersion
+					} : { status: "not-found" });
+				}).catch(() => {
+					if (!controller.signal.aborted) setFindingCompat({ status: "error" });
+				});
+				return () => controller.abort();
+			}, [hostIncompatible, compatRetry]);
 			const [restoreBlocked, setRestoreBlocked] = (0, react.useState)(null);
 			const [migrationConfirm, setMigrationConfirm] = (0, react.useState)(null);
 			/** Determinate percent parsed from pnpm's Progress line, when available. */
@@ -7849,7 +7953,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				const rest = entries.length > 1 ? ` (+${entries.length - 1})` : "";
 				return `${first.name} — ${first.layers.join(" / ")}${rest}`;
 			};
-			const doInstall = (0, react.useCallback)((plugin, force = false) => {
+			const doInstall = (0, react.useCallback)((plugin, force = false, version) => {
 				setBuildsSkipped(null);
 				setConfirming(null);
 				setInstallError(null);
@@ -7872,7 +7976,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 					headers: { "content-type": "application/json" },
 					body: JSON.stringify({
 						url: plugin.url,
-						...force ? { force: true } : {}
+						...force ? { force: true } : {},
+						...version !== void 0 ? { version } : {}
 					})
 				}).then((res) => res.json().then((body) => ({
 					status: res.status,
@@ -7911,7 +8016,11 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 							setHotNames((names) => names.includes(plugin.name) ? names : names.concat(plugin.name));
 						} else setDoneUrls((urls) => urls.includes(plugin.url) ? urls : urls.concat(plugin.url));
 						if (body.compatibility?.code === "soft-incompatible") setCompatibilityNotice(body.compatibility);
-						setRecords((list) => patch(list, recordId, body.compatibility?.code === "soft-incompatible" ? {
+						setRecords((list) => patch(list, recordId, body.heldRelease !== void 0 ? {
+							state: "warned",
+							reason: t("heldReleaseNotice").replace("{0}", String(body.heldRelease.latest)).replace("{1}", String(body.heldRelease.installed ?? "")),
+							heldRelease: body.heldRelease
+						} : body.compatibility?.code === "soft-incompatible" ? {
 							state: "warned",
 							reason: t("compatRiskBanner")
 						} : {
@@ -7946,6 +8055,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 								version: String(notice.version ?? ""),
 								requirement: typeof notice.requirement === "string" ? notice.requirement : null,
 								hostVersion: typeof notice.hostVersion === "string" ? notice.hostVersion : null,
+								npmName: typeof notice.npmName === "string" ? notice.npmName : typeof plugin.npm === "string" ? plugin.npm : null,
 								plugin
 							});
 							return;
@@ -8188,7 +8298,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 					body: "{}"
 				}).catch(() => {});
 			}, []);
-			const doUpdate = (0, react.useCallback)((name, force = false, restore = false) => {
+			const doUpdate = (0, react.useCallback)((name, force = false, restore = false, compatVersion) => {
 				setInstallError(null);
 				setActivationWarnings([]);
 				setStaleName((prev) => prev === name ? null : prev);
@@ -8210,7 +8320,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 					body: JSON.stringify({
 						name,
 						...force ? { force: true } : {},
-						...restore ? { restore: true } : {}
+						...restore ? { restore: true } : {},
+						...compatVersion !== void 0 ? { compatVersion } : {}
 					})
 				}).then((res) => res.json().then((body) => ({
 					status: res.status,
@@ -8267,6 +8378,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 								version: String(notice.version ?? ""),
 								requirement: typeof notice.requirement === "string" ? notice.requirement : null,
 								hostVersion: typeof notice.hostVersion === "string" ? notice.hostVersion : null,
+								npmName: typeof notice.npmName === "string" ? notice.npmName : null,
 								plugin: null
 							});
 							return;
@@ -9790,6 +9902,12 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 										onDismiss: (record) => setRecords((list) => drop(list, record.id)),
 										onRefresh: () => location.reload(),
 										onResolveConflict: resolveConflict,
+										onForceInstall: (record) => {
+											const plugin = record.url === void 0 ? void 0 : data?.plugins.find((p) => p.url === record.url);
+											if (plugin === void 0) return;
+											setRecords((list) => drop(list, record.id));
+											doInstall(plugin, true);
+										},
 										onApproveBuilds: (record) => {
 											const names = record.blockedBuilds ?? [];
 											if (names.length === 0) return;
@@ -11701,24 +11819,47 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 						open: true,
 						onClose: () => setHostIncompatible(null),
 						title: t("hostIncompatibleTitle"),
-						description: t(hostIncompatible.kind === "install" ? "hostIncompatibleBodyInstall" : "hostIncompatibleBody").replace("{plugin}", `${hostIncompatible.name} ${hostIncompatible.version}`.trim()).replace("{requirement}", hostIncompatible.requirement ?? t("hostIncompatibleUnknown")).replace("{host}", hostIncompatible.hostVersion ?? t("hostIncompatibleUnknown")),
-						footer: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
-							variant: "primary",
-							onClick: () => setHostIncompatible(null),
-							children: t(hostIncompatible.kind === "install" ? "hostIncompatibleCancel" : "hostIncompatibleKeep")
-						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
-							variant: "ghost",
-							disabled: hostIncompatible.kind === "install" ? busyUrl !== null : updatingName !== null,
-							onClick: () => {
-								const kind = hostIncompatible.kind;
-								const target = hostIncompatible.name;
-								const forcePlugin = hostIncompatible.plugin;
-								setHostIncompatible(null);
-								if (kind === "install" && forcePlugin !== null) doInstall(forcePlugin, true);
-								else doUpdate(target, true);
-							},
-							children: t(hostIncompatible.kind === "install" ? "hostIncompatibleInstallAnyway" : "hostIncompatibleAnyway")
-						})] })
+						description: [t(hostIncompatible.kind === "install" ? "hostIncompatibleBodyInstall" : "hostIncompatibleBody").replace("{plugin}", `${hostIncompatible.name} ${hostIncompatible.version}`.trim()).replace("{requirement}", hostIncompatible.requirement ?? t("hostIncompatibleUnknown")).replace("{host}", hostIncompatible.hostVersion ?? t("hostIncompatibleUnknown")), hostIncompatible.npmName === null ? null : findingCompat.status === "loading" ? t("hostIncompatibleSearching") : findingCompat.status === "found" ? t(hostIncompatible.kind === "install" ? "hostIncompatibleFoundInstall" : "hostIncompatibleFoundUpdate").replace("{version}", findingCompat.version) : findingCompat.status === "not-found" ? t("hostIncompatibleNoCompat") : findingCompat.status === "error" ? t("hostIncompatibleSearchFailed") : null].filter((line) => line !== null).join("\n"),
+						footer: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+								variant: findingCompat.status === "found" ? "outline" : "primary",
+								onClick: () => setHostIncompatible(null),
+								children: t(hostIncompatible.kind === "install" ? "hostIncompatibleCancel" : "hostIncompatibleKeep")
+							}),
+							findingCompat.status === "found" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+								variant: "primary",
+								disabled: hostIncompatible.kind === "install" ? busyUrl !== null : updatingName !== null,
+								onClick: () => {
+									const kind = hostIncompatible.kind;
+									const target = hostIncompatible.name;
+									const plugin = hostIncompatible.plugin;
+									const version = findingCompat.version;
+									setHostIncompatible(null);
+									if (kind === "install") {
+										if (plugin !== null) doInstall(plugin, false, version);
+									} else doUpdate(target, false, false, version);
+								},
+								children: t(hostIncompatible.kind === "install" ? "hostIncompatibleInstallCompat" : "hostIncompatibleUpdateCompat").replace("{version}", findingCompat.version)
+							}),
+							findingCompat.status === "error" && hostIncompatible.npmName !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+								variant: "outline",
+								onClick: () => setCompatRetry((n) => n + 1),
+								children: t("hostIncompatibleRetry")
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+								variant: "ghost",
+								disabled: hostIncompatible.kind === "install" ? busyUrl !== null : updatingName !== null,
+								onClick: () => {
+									const kind = hostIncompatible.kind;
+									const target = hostIncompatible.name;
+									const forcePlugin = hostIncompatible.plugin;
+									setHostIncompatible(null);
+									if (kind === "install" && forcePlugin !== null) doInstall(forcePlugin, true);
+									else doUpdate(target, true);
+								},
+								children: t(hostIncompatible.kind === "install" ? "hostIncompatibleInstallAnyway" : "hostIncompatibleAnyway")
+							})
+						] })
 					}),
 					restoreBlocked !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Modal, {
 						open: true,
@@ -12659,6 +12800,15 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 		function missingPrimitives(mod, required = REQUIRED_PRIMITIVES) {
 			return required.filter((name) => mod[name] === void 0);
 		}
+		/**
+		* The package name the host keys a bundle's own configuration by.
+		*
+		* `plugins.bundle.config` on dsh 0.1.7+ is keyed by the BUNDLE's package
+		* name. The market's is `dshmarket` — the name `dsh plugin add dshmarket`
+		* installs and the one its own `package.json` declares — which is not the
+		* same string as the locale namespace (`dsh-market`) this file uses for copy.
+		*/
+		const MARKET_PACKAGE_NAME = "dshmarket";
 		const name = "dsh-market";
 		const inject = [
 			"slots",
@@ -12751,6 +12901,18 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 					}
 				})));
 			});
+			const bundleConfigCtx = ctx;
+			bundleConfigCtx.slots.inject("plugins.bundle.config", () => bundleConfigCtx.slots.register({
+				name: "plugins.bundle.config",
+				key: MARKET_PACKAGE_NAME,
+				locale: NS,
+				inject: () => ({ t })
+			}, (ownerProps = {}) => ownerProps.view === "summary" ? null : (0, react.createElement)(SettingsCard, {
+				t,
+				onRemoved: () => {
+					sectionGate.retire();
+				}
+			})));
 			const Toast = () => (0, react.createElement)(InstallToast, { t });
 			ctx.slots.inject("shell.overlay", () => ctx.slots.register({
 				name: "shell.overlay",

package/lib/check.js

@@ -25,7 +25,7 @@
  * (same js-yaml dialect incl. `!!js` scalars), so the rows reported here are
  * what actually mounts at boot.
  */
-import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { existsSync, lstatSync, readdirSync, readFileSync, statSync } from 'node:fs';
 import { createRequire, isBuiltin } from 'node:module';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { JSON_SCHEMA, Type, load } from 'js-yaml';
@@ -323,6 +323,10 @@ function comparePre(a, b) {
     return 0;
 }
 /** Compare two semver strings: negative | zero | positive (prerelease < release of same base). */
+/** Whether a string is a well-formed semver `compareSemver` can order. */
+export function isSemver(value) {
+    return parseSemver(value) !== null;
+}
 export function compareSemver(a, b) {
     const av = parseSemver(a);
     const bv = parseSemver(b);
@@ -854,6 +858,89 @@ export function buildBundleLayers(profileDirectory, bundleNames, specs, dshInsta
     }));
     return { bundles, layers };
 }
+/**
+ * Which directories in `node_modules` are leftovers (#663).
+ *
+ * Two shapes, and both need to be VISIBLE rather than cleaned: a directory
+ * without a readable `package.json` (what a lock-blocked update leaves), and
+ * pnpm's `<name>_tmp_<pid>_<n>` staging directory (what an interrupted one
+ * leaves). Neither can be removed from in here in the case that produces
+ * them — the plugin's own process holds the directory open, so the rename
+ * and delete that would clear it are the operations that were just refused.
+ * Telling the user what is on disk, and which of it is merely junk, is the
+ * part this process can do.
+ *
+ * Bounded on purpose. The top level is scanned in full (that is where the
+ * profile's own packages live), plus one level inside the virtual store:
+ * pnpm stages a package's update in the `node_modules` beside it, so that is
+ * where a dependency's temp directory appears. It does NOT recurse through
+ * the whole virtual store: on a large Windows profile that is thousands of
+ * directories for a page the user opens by hand, and the store's OWN temp
+ * directories are already reclaimed by `cleanOrphanedStoreTmp`.
+ */
+export function findResidualDirectories(profileDirectory, declared) {
+    const out = [];
+    // pnpm's staging name, from its own rename: `<name>_tmp_<pid>_<n>`.
+    const tmpShape = /^(.+)_tmp_\d+_\w+$/;
+    const consider = (directory, entry, relative) => {
+        // pnpm's own bookkeeping lives in here beside the packages: `.pnpm` (the
+        // virtual store), `.bin`, `.modules.yaml`, `.ignored`. None of them is a
+        // package, so none of them is a broken one.
+        if (entry.startsWith('.'))
+            return;
+        let stats;
+        try {
+            stats = lstatSync(join(directory, entry));
+        }
+        catch {
+            return;
+        }
+        // A symlink is how pnpm links every installed package to its store
+        // entry. A DANGLING one is a different failure (and `#708` cleans the
+        // market's own); counting healthy links as leftovers would flag every
+        // profile in existence.
+        if (!stats.isDirectory())
+            return;
+        const tmp = tmpShape.exec(entry);
+        if (tmp !== null) {
+            out.push({ name: tmp[1], path: join(relative, entry), kind: 'tmp-directory', declared: declared.has(tmp[1]) });
+            return;
+        }
+        if (declared.has(entry))
+            return;
+        let readable = false;
+        try {
+            JSON.parse(readFileSync(join(directory, entry, 'package.json'), 'utf8'));
+            readable = true;
+        }
+        catch { /* missing or unparseable — that is the finding */ }
+        if (!readable)
+            out.push({ name: entry, path: join(relative, entry), kind: 'incomplete-package', declared: false });
+    };
+    const nodeModules = join(profileDirectory, 'node_modules');
+    try {
+        for (const entry of readdirSync(nodeModules))
+            consider(nodeModules, entry, 'node_modules');
+    }
+    catch { /* no node_modules: nothing to report */ }
+    const pnpmDirectory = join(nodeModules, '.pnpm');
+    let pnpmEntries = [];
+    try {
+        pnpmEntries = readdirSync(pnpmDirectory);
+    }
+    catch { /* no virtual store */ }
+    for (const entry of pnpmEntries) {
+        const nested = join(pnpmDirectory, entry, 'node_modules');
+        const relative = join('node_modules', '.pnpm', entry, 'node_modules');
+        try {
+            for (const name of readdirSync(nested))
+                consider(nested, name, relative);
+        }
+        catch { /* unreadable nested node_modules */ }
+    }
+    out.sort((left, right) => left.path.localeCompare(right.path));
+    return out;
+}
 /**
  * Analyze one profile directory (issue #98, phase 1). Pure function of the
  * directory contents — safe to call on every market open.
@@ -875,6 +962,11 @@ export function analyzeProfile(profileDirectory, options = {}) {
         ? manifest.dsh.profile.bundles.filter((name) => typeof name === 'string')
         : [];
     const specs = manifest?.dependencies ?? {};
+    // Declared = what the profile asks to load. A leftover directory under one
+    // of these names is a boot problem (the bundle layers above judge it), and
+    // an undeclared one is junk the user can clear — the distinction is the
+    // whole point of the listing (#663).
+    const declaredNames = new Set([...Object.keys(specs), ...bundleNames]);
     const built = buildBundleLayers(profileDirectory, bundleNames, specs, dshInstall);
     const bundles = built.bundles;
     const bundleLayers = built.layers;
@@ -1126,6 +1218,7 @@ export function analyzeProfile(profileDirectory, options = {}) {
         multiVersion,
         orderConflicts,
         suggestedOrder,
+        residuals: findResidualDirectories(profileDirectory, declaredNames),
         summary: {
             ok: errors.length === 0,
             errors,