dshmarket 1.66.0 → 1.66.1

package/lib/install.js

@@ -8,7 +8,7 @@ import { closeSync, existsSync, lstatSync, openSync, readlinkSync, readSync, rmS
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { findDshInstallDir } from './dsh-install.js';
 import { classifyPnpmFailure, HOST_NAMESPACE_RE } from './pnpm-compat.js';
-import { conflictingEntryIds, dropFromManifest, hasDshManifest, hasLoadableEntry, pluginSubdirs, profileDir, readInstalled, readManifestDeps, readProfileBundles, dropUnparseableBuildKeys } from './profile.js';
+import { conflictingEntryIds, dropFromManifest, hasDshManifest, hasLoadableEntry, mergeDuplicateReleaseAgeExcludes, pluginSubdirs, profileDir, readInstalled, readManifestDeps, readProfileBundles, dropUnparseableBuildKeys } from './profile.js';
 import { logEvent } from './log.js';
 import { cleanOrphanedStore } from './store.js';
 /**
@@ -108,8 +108,17 @@ export function isUnpublishedHostPeer(pkg, profile, explicitDir) {
  * where it is not — there the bypass would be what installs the young
  * version, over a minimumReleaseAge the profile set on purpose — so the
  * install route declines it and falls back to the bare name instead.
+ *
+ * `marketFlags: false` says the host runs pnpm itself and takes no options
+ * from us (the official Desktop bridge, #732). The four recoveries below
+ * each decorate a command with an option, so on such a host they are skipped
+ * rather than sent and refused — and because their classifier messages say
+ * the market retried, the note appended at the end says it did not.
  */
 export async function withHoistRecovery(run, profile, pluginArgs, profileDirectory, options = {}) {
+    const marketFlags = options.marketFlags !== false;
+    /** The option a recovery step needed and this host does not accept (#732). */
+    let unavailableOption = null;
     let result = await run(profile, pluginArgs);
     const ok = (r) => r.exitCode === 0 && !r.timedOut && !r.cancelled;
     if (!ok(result) && !result.cancelled) {
@@ -127,19 +136,40 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
             }
         }
         else if (failure?.code === 'hoist-pattern-diff') {
-            logEvent('warn', 'install', `modules dir was built by a different pnpm major — rebuilding (pnpm install) and retrying once`);
-            // --no-frozen-lockfile: the market runs pnpm with CI=true (TTY hangs),
-            // where a lockfile written by the old major would otherwise be refused.
-            const rebuild = await run(profile, ['install', '--no-frozen-lockfile']);
-            if (ok(rebuild))
-                result = await run(profile, pluginArgs);
+            if (!marketFlags) {
+                unavailableOption = '--no-frozen-lockfile';
+            }
+            else {
+                logEvent('warn', 'install', `modules dir was built by a different pnpm major — rebuilding (pnpm install) and retrying once`);
+                // --no-frozen-lockfile: the market runs pnpm with CI=true (TTY hangs),
+                // where a lockfile written by the old major would otherwise be refused.
+                const rebuild = await run(profile, ['install', '--no-frozen-lockfile']);
+                if (ok(rebuild))
+                    result = await run(profile, pluginArgs);
+            }
         }
         else if (failure?.code === 'release-age-violation'
             && options.releaseAgeBypass !== false
             && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')
             && !pluginArgs.includes(RELEASE_AGE_OVERRIDE)) {
-            logEvent('warn', 'install', `a too-young release blocks pnpm's lockfile verification (#39) — retrying once with ${RELEASE_AGE_OVERRIDE}`);
-            result = await run(profile, [pluginArgs[0], RELEASE_AGE_OVERRIDE, ...pluginArgs.slice(1)]);
+            // #732 first, because it is the breakage itself: pnpm appends a second
+            // `minimumReleaseAgeExclude` rule for a package that already has one and
+            // then honours only the FIRST per name, so its own new entry is shadowed
+            // and verification fails for every later command in that profile.
+            // Merging the duplicates repairs the file and needs no option at all, so
+            // it is the one recovery that also works on the desktop bridge.
+            const mergedDuplicates = mergeDuplicateReleaseAgeExcludes(profile, profileDirectory);
+            if (mergedDuplicates.length > 0) {
+                logEvent('warn', 'install', `pnpm appended a second minimumReleaseAgeExclude rule for ${mergedDuplicates.join(', ')} and honours only the first, shadowing its own entry (#732) — merged the duplicates and retrying once`);
+                result = await run(profile, pluginArgs);
+            }
+            else if (!marketFlags) {
+                unavailableOption = RELEASE_AGE_OVERRIDE;
+            }
+            else {
+                logEvent('warn', 'install', `a too-young release blocks pnpm's lockfile verification (#39) — retrying once with ${RELEASE_AGE_OVERRIDE}`);
+                result = await run(profile, [pluginArgs[0], RELEASE_AGE_OVERRIDE, ...pluginArgs.slice(1)]);
+            }
         }
         else if ((failure?.code === 'fetch-404' || failure?.code === 'no-matching-version')
             && isUnpublishedHostPeer(failure.pkg, profile, profileDirectory)
@@ -149,8 +179,13 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
             // and npm has never carried. Every fresh profile hits this, whatever
             // the plugin, so failing here would be failing for something the user
             // cannot fix and did not cause.
-            logEvent('warn', 'install', `${failure.pkg ?? 'a host package'} is a peer the runtime provides and npm does not carry (#289) — retrying once with ${AUTO_INSTALL_PEERS_OFF}`);
-            result = await run(profile, [pluginArgs[0], AUTO_INSTALL_PEERS_OFF, ...pluginArgs.slice(1)]);
+            if (!marketFlags) {
+                unavailableOption = AUTO_INSTALL_PEERS_OFF;
+            }
+            else {
+                logEvent('warn', 'install', `${failure.pkg ?? 'a host package'} is a peer the runtime provides and npm does not carry (#289) — retrying once with ${AUTO_INSTALL_PEERS_OFF}`);
+                result = await run(profile, [pluginArgs[0], AUTO_INSTALL_PEERS_OFF, ...pluginArgs.slice(1)]);
+            }
         }
         else if (failure?.code === 'transient-network'
             && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')) {
@@ -166,8 +201,13 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
             // Large tarball / slow network: pnpm's default 60s per-request limit
             // aborted the download. A plain retry fails again at the same limit,
             // so retry once with a longer fetchTimeout.
-            logEvent('warn', 'install', `pnpm's per-request fetch timeout aborted a large download — retrying once with ${FETCH_TIMEOUT_OVERRIDE}`);
-            result = await run(profile, [pluginArgs[0], FETCH_TIMEOUT_OVERRIDE, ...pluginArgs.slice(1)]);
+            if (!marketFlags) {
+                unavailableOption = FETCH_TIMEOUT_OVERRIDE;
+            }
+            else {
+                logEvent('warn', 'install', `pnpm's per-request fetch timeout aborted a large download — retrying once with ${FETCH_TIMEOUT_OVERRIDE}`);
+                result = await run(profile, [pluginArgs[0], FETCH_TIMEOUT_OVERRIDE, ...pluginArgs.slice(1)]);
+            }
         }
     }
     if (!ok(result) && !result.cancelled) {
@@ -207,6 +247,16 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
             result = { ...result, stderr: `${result.stderr}\n\n${code}${result.pnpmError}` };
         }
     }
+    if (unavailableOption !== null && !ok(result) && !result.cancelled) {
+        // #732: this step was skipped because the host runs pnpm itself and takes
+        // no options from us — but the classified message above says the market
+        // retried. Say that it did not, or the user reads a retry that never
+        // happened and looks for the wrong cause.
+        result = {
+            ...result,
+            stderr: `${result.stderr}\n\n这台宿主（官方桌面端）自己执行安装，不接受市场附加的 pnpm 参数（${unavailableOption}），所以这一步没有自动重试。 / This host (the official desktop app) runs the install itself and takes no pnpm options from the market (${unavailableOption}), so that automatic retry could not be attempted.`,
+        };
+    }
     return result;
 }
 /**

package/lib/official-desktop.js

@@ -41,7 +41,16 @@ export function createOfficialDesktopRuntime(managerLookup, profileName, _profil
         // manager are accepted; silently dropping pnpm flags would change intent.
         const [command, target, ...extra] = argv;
         if (extra.length !== 0 || typeof target !== 'string' || !TARGET_RE.test(target)) {
-            return Promise.resolve(failure('this desktop operation is not supported by the official plugin manager', 127));
+            // The market's own options are what usually lands here, and they are
+            // spelled with a leading `-` — and they sit in the TARGET slot, because
+            // the market writes `add <option> <target>`. The OPERATION is supported
+            // here; only the option is not, and reporting that as "this desktop
+            // operation is not supported" is what made #732 read as a broken
+            // profile. Name the option and the way out instead.
+            const options = argv.slice(1).filter(argument => argument.startsWith('-')).join(' ');
+            return Promise.resolve(failure(options === ''
+                ? 'this desktop operation is not supported by the official plugin manager'
+                : `官方桌面客户端自己执行这次安装，不接受市场附加的参数（${options}），这个选项在它这里用不了。可以改用普通 dsh web 安装，或等这个版本过了新版本等待期再试。 / The official desktop app runs this install itself and takes no options from the market (${options}); that option cannot be used here. Install from plain dsh web, or try again once the release is past the fresh-release wait.`, 127));
         }
         const spec = target;
         // Only `add` and `remove` map onto the manager. `update` reached here
@@ -122,6 +131,10 @@ export function createOfficialDesktopRuntime(managerLookup, profileName, _profil
             return true;
         },
         supportsExactRollbackTarget: target => TARGET_RE.test(target),
+        // The reason the flag exists (#732): this manager takes exactly
+        // `add <target>` or `remove <target>`, so every recovery step that needs
+        // an option has to be left out here rather than sent and refused.
+        acceptsMarketPnpmFlags: false,
         dispose: async () => {
             disposed = true;
             if (active?.requestId !== undefined) {

package/lib/profile.js

@@ -1198,3 +1198,116 @@ export function dropUnparseableBuildKeys(profile, explicitDir) {
     writeAllowBuildsMap(file, yaml, map, blockRe, blockMatch);
     return removed;
 }
+/**
+ * Split `name@1.2.3 || 1.4.0` into its package name and selector.
+ *
+ * A scoped name begins with `@`, so the separator is the first `@` AFTER
+ * position 0; an entry with no `@` at all excludes every version of that
+ * name. Anything this cannot read exactly returns null, and the caller then
+ * leaves the file alone rather than rewriting a line it misread.
+ */
+function splitReleaseAgeExclude(entry) {
+    let text = entry.trim();
+    if (text.length >= 2
+        && (text[0] === "'" && text[text.length - 1] === "'" || text[0] === '"' && text[text.length - 1] === '"')) {
+        text = text.slice(1, -1);
+    }
+    const at = text.indexOf('@', text.startsWith('@') ? 1 : 0);
+    if (at === -1)
+        return text === '' ? null : { name: text, selector: null };
+    const name = text.slice(0, at);
+    const selector = text.slice(at + 1).trim();
+    if (name === '' || selector === '')
+        return null;
+    return { name, selector };
+}
+/**
+ * Merge one package's several `minimumReleaseAgeExclude` entries into one
+ * (#732).
+ *
+ * pnpm 11.7.0 APPENDS an entry when it lets a version through a profile's
+ * `minimumReleaseAge` instead of folding it into the rule that already names
+ * that package — and its own `evaluateVersionPolicy` then honours only the
+ * FIRST rule per package name. The entry pnpm just wrote is therefore
+ * shadowed by the older one, the young version stays unexcluded, and pnpm
+ * fails lockfile verification with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION on
+ * EVERY later command in that profile: installs, updates and uninstalls
+ * alike, including ones that have nothing to do with the package. Reported
+ * as #732, where the market's own self-update planted exactly that pair and
+ * every plugin operation on the desktop profile stopped working.
+ *
+ * Merging keeps the union of what the file already says, so nothing is
+ * loosened or tightened: the entries pnpm wrote were meant to be read, and
+ * after the merge they are. A file with no same-name duplicate is untouched,
+ * as is one whose block this cannot read exactly (a flow list, an inline
+ * comment, a line it would have to guess at).
+ *
+ * @returns the package names whose entries were merged; empty when the file
+ *   needed no repair or could not be repaired, in which case it is left
+ *   byte-for-byte as it was.
+ */
+export function mergeDuplicateReleaseAgeExcludes(profile, explicitDir) {
+    const file = join(profileDir(profile, explicitDir), 'pnpm-workspace.yaml');
+    let yaml;
+    try {
+        yaml = readFileSync(file, 'utf8');
+    }
+    catch {
+        return [];
+    }
+    // Block form only: `minimumReleaseAgeExclude:` then `- <entry>` lines.
+    const blockRe = /^minimumReleaseAgeExclude:[ \t]*\r?\n((?:[ \t]+-[^\r\n]*\r?\n?)*)/m;
+    const block = blockRe.exec(yaml);
+    if (block === null)
+        return [];
+    const eol = /\r\n/.test(yaml) ? '\r\n' : '\n';
+    const indentMatch = /^([ \t]+)-/.exec(block[1]);
+    const indent = indentMatch === null ? '  ' : indentMatch[1];
+    const entries = [];
+    for (const line of block[1].split(/\r?\n/)) {
+        if (line.trim() === '')
+            continue;
+        const m = /^[ \t]+-[ \t]*(.*?)[ \t]*$/.exec(line);
+        // A `#` on the line is a comment this cannot re-emit without losing it.
+        if (m === null || m[1].includes('#'))
+            return [];
+        const rule = splitReleaseAgeExclude(m[1]);
+        if (rule === null)
+            return [];
+        entries.push({ rule, quoted: /^['"]/.test(m[1]) });
+    }
+    const byName = new Map();
+    const order = [];
+    for (const { rule, quoted } of entries) {
+        let group = byName.get(rule.name);
+        if (group === undefined) {
+            group = { selectors: new Set(), allVersions: false, quoted: false, count: 0 };
+            byName.set(rule.name, group);
+            order.push(rule.name);
+        }
+        group.count += 1;
+        group.quoted = group.quoted || quoted;
+        if (rule.selector === null)
+            group.allVersions = true;
+        else
+            group.selectors.add(rule.selector);
+    }
+    const merged = order.filter(name => (byName.get(name)?.count ?? 0) > 1);
+    if (merged.length === 0)
+        return [];
+    const lines = order.map(name => {
+        const group = byName.get(name);
+        if (group === undefined)
+            return '';
+        const text = group.allVersions ? name : `${name}@${[...group.selectors].join(' || ')}`;
+        // `@` cannot start a plain scalar in YAML, so a scoped name is written
+        // quoted — the way pnpm itself writes one.
+        const quoted = group.quoted || text.startsWith('@');
+        return `${indent}- ${quoted ? `'${text.replaceAll("'", "''")}'` : text}`;
+    });
+    const blockText = `minimumReleaseAgeExclude:${eol}${lines.join(eol)}${eol}`;
+    // A function replacement: `$&` and friends in a string replacement would
+    // be read as capture references.
+    writeFileSync(file, yaml.replace(blockRe, () => blockText));
+    return merged;
+}

package/lib/routes.js

@@ -259,6 +259,19 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
     // re-applies the same choice on every boot (ported from dsh-plugin-hub).
     const userPatchPath = findUserPatchPath(host, activeProfileDir);
     const commands = commandRuntime ?? { runPlugin: runDshPlugin, probePnpm, provisionPnpm, cancelActive };
+    /**
+     * Whether this host runs pnpm itself and so takes the market's own options
+     * (`--config.*`, `--force`, `--no-frozen-lockfile`).
+     *
+     * The official Desktop bridge does not (#732): its in-process manager
+     * accepts exactly `add <target>` or `remove <target>` and answers anything
+     * else with exit 127. The market's recovery steps decorate commands with
+     * those options, so on such a host they have to be left out or rewritten as
+     * a bare exact target, instead of being sent and refused — which reported a
+     * supported operation as unsupported and sent the reporter looking for a
+     * broken profile.
+     */
+    const marketFlags = commands.acceptsMarketPnpmFlags !== false;
     const supportsExactRollbackTarget = (target) => commands.supportsExactRollbackTarget?.(target) ?? TARGET_RE.test(target);
     // Point every plugin build/install spawn at the configured build
     // environment (#336). Read LIVE from `config.buildEnv` because the settings
@@ -688,9 +701,34 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
         }
     }
     /** Every plugin command goes through the pnpm-drift recovery wrapper (#20). */
-    const runPlugin = (profile, args) => withHoistRecovery(commands.runPlugin, profile, args, activeProfileDir);
+    const runPlugin = (profile, args) => withHoistRecovery(commands.runPlugin, profile, args, activeProfileDir, { marketFlags });
     /** The same, minus the release-age bypass: for a fresh install pinned to a young release (#594). */
-    const runPluginKeepingReleaseAge = (profile, args) => withHoistRecovery(commands.runPlugin, profile, args, activeProfileDir, { releaseAgeBypass: false });
+    const runPluginKeepingReleaseAge = (profile, args) => withHoistRecovery(commands.runPlugin, profile, args, activeProfileDir, { releaseAgeBypass: false, marketFlags });
+    /**
+     * The argv that rematerializes a restored manifest's build on this host.
+     *
+     * On a host that takes the market's options, one `pnpm install` does it. A
+     * host that runs pnpm itself — the official Desktop bridge (#732) — accepts
+     * only `add <target>` and refuses `install` outright, so there it is an
+     * `add` of the exact version the restored manifest pins, which is what that
+     * host's own manager pipeline materializes. A range is deliberately not
+     * usable: it would re-resolve to whatever is newest and call that the
+     * previous build.
+     *
+     * @returns null when nothing expressible is left, in which case the caller
+     *   reports that rather than sending a command the host will refuse.
+     */
+    function rematerializeArgs(name, pinned) {
+        if (marketFlags)
+            return ['--no-frozen-lockfile', RELEASE_AGE_OVERRIDE, 'install'];
+        if (pinned !== undefined && /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(pinned))
+            return ['add', `${name}@${pinned}`];
+        return null;
+    }
+    /** Why a rematerialization could not even be attempted here (see above). */
+    function cannotRematerializeDetail(name, pinned) {
+        return `这台宿主只接受按精确版本重新安装，「${name}」改动前在 profile 里写作 ${pinned ?? '（不在 profile 里）'}，市场无法在它上面重建上一版 / this host can only reinstall an exact version, and "${name}" was declared as ${pinned ?? '(not in the profile)'}, so the previous build cannot be rematerialized there`;
+    }
     /**
      * Undo a clean-exit update whose new build cannot boot. Restoring only the
      * manifest pin (the original #159 behavior) leaves the bad package files
@@ -710,7 +748,15 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
         // Flags come BEFORE the command: preparePluginArgs treats the last arg as
         // the package target and rejects a trailing flag, while pnpm accepts the
         // same flags in front of `install`.
-        const reinstall = await runPlugin(config.profile, ['--no-frozen-lockfile', RELEASE_AGE_OVERRIDE, 'install']);
+        //
+        // On a host that runs pnpm itself neither flag exists and `install` is not
+        // accepted at all (#732), so there the build is rematerialized through the
+        // exact target — see `rematerializeArgs`.
+        const pinned = manifestBefore.dependencies[name];
+        const args = rematerializeArgs(name, pinned);
+        if (args === null)
+            return { ok: false, detail: cannotRematerializeDetail(name, pinned) };
+        const reinstall = await runPlugin(config.profile, args);
         const ok = reinstall.exitCode === 0 && !reinstall.timedOut && !reinstall.cancelled;
         if (ok)
             logEvent('info', 'update', `${name}: previous build rematerialized (${rolledBack.join(', ')})`);
@@ -842,7 +888,16 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
         // were replaced before the rejected update failed. A normal exact add is
         // then an "already up to date" no-op; --force is what rematerializes the
         // captured version/commit/archive instead of blessing corrupted bytes.
-        const add = await runPlugin(config.profile, ['add', '--force', RELEASE_AGE_OVERRIDE, target]);
+        //
+        // `--force` and the age override are market options, and the official
+        // Desktop bridge refuses them outright (#732). There the rollback is the
+        // bare exact target: the host's own manager pipeline is what installs it,
+        // and sending the options anyway failed the rollback with 127 — which
+        // read as "the previous build could not be verified" while node_modules
+        // still held the bad build.
+        const add = await runPlugin(config.profile, marketFlags
+            ? ['add', '--force', RELEASE_AGE_OVERRIDE, target]
+            : ['add', target]);
         // Exact recovery targets deliberately pin versions/commits. Keep the
         // user's durable range, tag, floating github shortcut, or release URL.
         restoreProfileManifest(config.profile, manifestBefore, activeProfileDir);
@@ -3086,7 +3141,11 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                             const prepared = restoreProfileLockfile(lockfileBefore);
                             if (!prepared.ok)
                                 return prepared;
-                            const reinstall = await runPlugin(config.profile, ['--no-frozen-lockfile', RELEASE_AGE_OVERRIDE, 'install']);
+                            const reinstallArgs = rematerializeArgs(name, manifestBefore.dependencies[name]);
+                            if (reinstallArgs === null) {
+                                return { ok: false, detail: cannotRematerializeDetail(name, manifestBefore.dependencies[name]) };
+                            }
+                            const reinstall = await runPlugin(config.profile, reinstallArgs);
                             restoreProfileManifest(config.profile, manifestBefore, activeProfileDir);
                             const finalLock = restoreProfileLockfile(lockfileBefore);
                             if (!finalLock.ok)
@@ -3552,9 +3611,16 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                         const reresolveInPlace = isGit && !restore && target === spec;
                         // force: the user chose to install a fresh release without the
                         // default one-day safety wait; scoped to this single command.
+                        //
+                        // The override is a market option, so a host that runs pnpm itself
+                        // does not take it (#732); there the plain form goes out and the
+                        // host's own manager pipeline applies its release policy. That is
+                        // the same trade the held-back fresh install already makes: the
+                        // version the host admits now, with the newer one still offered by
+                        // the update check.
                         const addArgs = reresolveInPlace
-                            ? (force ? ['update', RELEASE_AGE_OVERRIDE, name] : ['update', name])
-                            : (force ? ['add', RELEASE_AGE_OVERRIDE, target] : ['add', target]);
+                            ? (force && marketFlags ? ['update', RELEASE_AGE_OVERRIDE, name] : ['update', name])
+                            : (force && marketFlags ? ['add', RELEASE_AGE_OVERRIDE, target] : ['add', target]);
                         // Exact manifest snapshot for failure rollback (#65, #339) — the
                         // host can write dependencies AND dsh.profile.bundles before a
                         // hard-failed add, leaving residue that breaks the next boot.
@@ -5117,7 +5183,11 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                                 // the intent the fresh path otherwise refuses to assume it has
                                 // (#594): the bypass is safe to use HERE because it is no
                                 // longer the market's idea — it is what was clicked (#635).
-                                const bypass = heldBack && force;
+                                // The bypass is an option this host may not accept (#732). Where
+                                // it is not expressible the request falls to the same place as
+                                // a refused bypass below: the bare name, with `heldByAge` set
+                                // so the row says the profile's own age policy is why.
+                                const bypass = heldBack && force && marketFlags;
                                 logEvent('warn', 'install', bypass
                                     ? `${entry.name}: ${String(registryLatest)} is younger than this profile's minimumReleaseAge — installing it anyway, as asked, with ${RELEASE_AGE_OVERRIDE}`
                                     : heldBack

package/lib/types/dsh-cli.d.ts

@@ -204,6 +204,19 @@ export interface PluginCommandRuntime {
     cancelActive(): boolean;
     /** Whether this host can execute an immutable rollback add target. */
     supportsExactRollbackTarget?(target: string): boolean;
+    /**
+     * Whether this runtime runs pnpm itself and therefore accepts the market's
+     * own arguments — `--config.*` overrides, `--force`, `--no-frozen-lockfile`.
+     *
+     * The official Electron profile does not (#732): its in-process manager
+     * takes exactly `add <target>` or `remove <target>` and answers any other
+     * argv with exit 127. Every recovery step that decorates a command with an
+     * option is impossible there, and sending it anyway turned a pnpm failure
+     * into "this desktop operation is not supported" — a message about an
+     * operation that is in fact supported, which sent the reporter looking for
+     * a broken profile instead of the option. Absent means "accepts".
+     */
+    acceptsMarketPnpmFlags?: boolean;
 }
 /** One running package operation, however it was started. */
 export interface DesktopPnpmHandleLike {

package/lib/types/install.d.ts

@@ -98,9 +98,16 @@ export declare function isUnpublishedHostPeer(pkg: string | undefined, profile:
  * where it is not — there the bypass would be what installs the young
  * version, over a minimumReleaseAge the profile set on purpose — so the
  * install route declines it and falls back to the bare name instead.
+ *
+ * `marketFlags: false` says the host runs pnpm itself and takes no options
+ * from us (the official Desktop bridge, #732). The four recoveries below
+ * each decorate a command with an option, so on such a host they are skipped
+ * rather than sent and refused — and because their classifier messages say
+ * the market retried, the note appended at the end says it did not.
  */
 export declare function withHoistRecovery(run: PluginRunner, profile: string, pluginArgs: string[], profileDirectory?: string, options?: {
     releaseAgeBypass?: boolean;
+    marketFlags?: boolean;
 }): Promise<InstallResult>;
 /**
  * The tail of the diagnostics file the dsh CLI pointed at, when it pointed at

package/lib/types/profile.d.ts

@@ -350,3 +350,29 @@ export declare function setAllowBuilds(profile: string, packages: string[], expl
  *   file is left untouched.
  */
 export declare function dropUnparseableBuildKeys(profile: string, explicitDir?: string): string[];
+/**
+ * Merge one package's several `minimumReleaseAgeExclude` entries into one
+ * (#732).
+ *
+ * pnpm 11.7.0 APPENDS an entry when it lets a version through a profile's
+ * `minimumReleaseAge` instead of folding it into the rule that already names
+ * that package — and its own `evaluateVersionPolicy` then honours only the
+ * FIRST rule per package name. The entry pnpm just wrote is therefore
+ * shadowed by the older one, the young version stays unexcluded, and pnpm
+ * fails lockfile verification with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION on
+ * EVERY later command in that profile: installs, updates and uninstalls
+ * alike, including ones that have nothing to do with the package. Reported
+ * as #732, where the market's own self-update planted exactly that pair and
+ * every plugin operation on the desktop profile stopped working.
+ *
+ * Merging keeps the union of what the file already says, so nothing is
+ * loosened or tightened: the entries pnpm wrote were meant to be read, and
+ * after the merge they are. A file with no same-name duplicate is untouched,
+ * as is one whose block this cannot read exactly (a flow list, an inline
+ * comment, a line it would have to guess at).
+ *
+ * @returns the package names whose entries were merged; empty when the file
+ *   needed no repair or could not be repaired, in which case it is left
+ *   byte-for-byte as it was.
+ */
+export declare function mergeDuplicateReleaseAgeExcludes(profile: string, explicitDir?: string): string[];

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.66.0",
+  "version": "1.66.1",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -30,7 +30,7 @@
     "prepack": "npm run build && node scripts/preflight.mjs",
     "prepare": "npm run build",
     "validate:registry": "node scripts/validate-registry.mjs",
-    "snapshot": "curl -sf https://awesome-dsh-plugin.com/plugins.json -o data/registry-snapshot.json && curl -sf https://awesome-dsh-plugin.com/readmes.json -o data/readmes-snapshot.json",
+    "snapshot": "mkdir -p data && curl -sf https://awesome-dsh-plugin.com/plugins.json -o data/registry-snapshot.json && curl -sf https://awesome-dsh-plugin.com/readmes.json -o data/readmes-snapshot.json",
     "check:web-auth-capture": "node scripts/check-web-auth-capture.mjs",
     "test:web": "node scripts/check-web-auth-capture.mjs && vitest run --config vitest.web.config.ts",
     "build:site": "node scripts/build-site.mjs"

package/src/client/index.ts

@@ -245,15 +245,22 @@ export function apply(ctx: MarketClientContext): void {
     ? null
     : h(SettingsCard, { t, onRemoved: () => { sectionGate.retire() } })))
 
-  // The seat on the 0.1.7 line (#722). That release moved a plugin's
-  // configuration off the settings list and into the Plugins section: the
-  // `settingsScope` service and the `settings.plugin.item` slot that hung off
-  // it are gone, and `settings.plugins.tab` is what its slot contract offers —
-  // "one page inside the Plugins settings section", rendered as a tab beside
-  // the host's own. Without it the market had NO card on that line at all: the
-  // `plugins.bundle.config` registration above never fires, because no host
-  // declares that slot, and a registration into a slot nobody declares is
-  // silent by construction. Reported as "the settings card disappeared".
+  // The seat on the 0.1.7 line (#722). That release renamed the client's
+  // `settingsScope` service to `settings`, so the nested inject above stopped
+  // firing and `settings.plugin.item` — the settings-list card — went silent
+  // with no error anywhere. `settings.plugins.tab` is what that line's slot
+  // contract offers instead: "one page inside the Plugins settings section",
+  // rendered as a tab beside the host's own. Reported as "the settings card
+  // disappeared".
+  //
+  // This does not replace the `plugins.bundle.config` registration above, and
+  // that one did not stop firing: 0.1.7 declares it (`ui-plugin-manager` — "a
+  // bundle's own configuration, keyed by the bundle's package name and
+  // rendered on the bundle's page"), so the market's card is also on the
+  // market bundle's page in the Plugins section. BOTH seats are deliberate:
+  // the tab is where a user opens the market's settings from that section, the
+  // bundle page is where the plugin manager shows them for the installed
+  // bundle. Keep both.
   //
   // Detection is the slot itself, as everywhere else here: a host that does
   // not declare it never runs this, and the older line keeps its card through

package/src/dsh-cli.ts

@@ -531,6 +531,19 @@ export interface PluginCommandRuntime {
   cancelActive(): boolean
   /** Whether this host can execute an immutable rollback add target. */
   supportsExactRollbackTarget?(target: string): boolean
+  /**
+   * Whether this runtime runs pnpm itself and therefore accepts the market's
+   * own arguments — `--config.*` overrides, `--force`, `--no-frozen-lockfile`.
+   *
+   * The official Electron profile does not (#732): its in-process manager
+   * takes exactly `add <target>` or `remove <target>` and answers any other
+   * argv with exit 127. Every recovery step that decorates a command with an
+   * option is impossible there, and sending it anyway turned a pnpm failure
+   * into "this desktop operation is not supported" — a message about an
+   * operation that is in fact supported, which sent the reporter looking for
+   * a broken profile instead of the option. Absent means "accepts".
+   */
+  acceptsMarketPnpmFlags?: boolean
 }
 
 /** One running package operation, however it was started. */

package/src/install.ts

@@ -10,7 +10,7 @@ import { dirname, isAbsolute, join, resolve } from 'node:path'
 import type { InstallResult, PluginRunner } from './dsh-cli.ts'
 import { findDshInstallDir } from './dsh-install.ts'
 import { classifyPnpmFailure, HOST_NAMESPACE_RE, isTransientPnpmFailure } from './pnpm-compat.ts'
-import { conflictingEntryIds, dropFromManifest, hasDshManifest, hasLoadableEntry, pluginSubdirs, profileDir, readInstalled, readManifestDeps, readProfileBundles, dropUnparseableBuildKeys } from './profile.ts'
+import { conflictingEntryIds, dropFromManifest, hasDshManifest, hasLoadableEntry, mergeDuplicateReleaseAgeExcludes, pluginSubdirs, profileDir, readInstalled, readManifestDeps, readProfileBundles, dropUnparseableBuildKeys } from './profile.ts'
 import { logEvent } from './log.ts'
 import { cleanOrphanedStore } from './store.ts'
 
@@ -118,14 +118,23 @@ export function isUnpublishedHostPeer(
  * where it is not — there the bypass would be what installs the young
  * version, over a minimumReleaseAge the profile set on purpose — so the
  * install route declines it and falls back to the bare name instead.
+ *
+ * `marketFlags: false` says the host runs pnpm itself and takes no options
+ * from us (the official Desktop bridge, #732). The four recoveries below
+ * each decorate a command with an option, so on such a host they are skipped
+ * rather than sent and refused — and because their classifier messages say
+ * the market retried, the note appended at the end says it did not.
  */
 export async function withHoistRecovery(
   run: PluginRunner,
   profile: string,
   pluginArgs: string[],
   profileDirectory?: string,
-  options: { releaseAgeBypass?: boolean } = {},
+  options: { releaseAgeBypass?: boolean; marketFlags?: boolean } = {},
 ): Promise<InstallResult> {
+  const marketFlags = options.marketFlags !== false
+  /** The option a recovery step needed and this host does not accept (#732). */
+  let unavailableOption: string | null = null
   let result = await run(profile, pluginArgs)
   const ok = (r: InstallResult): boolean => r.exitCode === 0 && !r.timedOut && !r.cancelled
   if (!ok(result) && !result.cancelled) {
@@ -142,19 +151,37 @@ export async function withHoistRecovery(
         result = await run(profile, pluginArgs)
       }
     } else if (failure?.code === 'hoist-pattern-diff') {
-      logEvent('warn', 'install', `modules dir was built by a different pnpm major — rebuilding (pnpm install) and retrying once`)
-      // --no-frozen-lockfile: the market runs pnpm with CI=true (TTY hangs),
-      // where a lockfile written by the old major would otherwise be refused.
-      const rebuild = await run(profile, ['install', '--no-frozen-lockfile'])
-      if (ok(rebuild)) result = await run(profile, pluginArgs)
+      if (!marketFlags) {
+        unavailableOption = '--no-frozen-lockfile'
+      } else {
+        logEvent('warn', 'install', `modules dir was built by a different pnpm major — rebuilding (pnpm install) and retrying once`)
+        // --no-frozen-lockfile: the market runs pnpm with CI=true (TTY hangs),
+        // where a lockfile written by the old major would otherwise be refused.
+        const rebuild = await run(profile, ['install', '--no-frozen-lockfile'])
+        if (ok(rebuild)) result = await run(profile, pluginArgs)
+      }
     } else if (
       failure?.code === 'release-age-violation'
       && options.releaseAgeBypass !== false
       && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')
       && !pluginArgs.includes(RELEASE_AGE_OVERRIDE)
     ) {
-      logEvent('warn', 'install', `a too-young release blocks pnpm's lockfile verification (#39) — retrying once with ${RELEASE_AGE_OVERRIDE}`)
-      result = await run(profile, [pluginArgs[0], RELEASE_AGE_OVERRIDE, ...pluginArgs.slice(1)])
+      // #732 first, because it is the breakage itself: pnpm appends a second
+      // `minimumReleaseAgeExclude` rule for a package that already has one and
+      // then honours only the FIRST per name, so its own new entry is shadowed
+      // and verification fails for every later command in that profile.
+      // Merging the duplicates repairs the file and needs no option at all, so
+      // it is the one recovery that also works on the desktop bridge.
+      const mergedDuplicates = mergeDuplicateReleaseAgeExcludes(profile, profileDirectory)
+      if (mergedDuplicates.length > 0) {
+        logEvent('warn', 'install', `pnpm appended a second minimumReleaseAgeExclude rule for ${mergedDuplicates.join(', ')} and honours only the first, shadowing its own entry (#732) — merged the duplicates and retrying once`)
+        result = await run(profile, pluginArgs)
+      } else if (!marketFlags) {
+        unavailableOption = RELEASE_AGE_OVERRIDE
+      } else {
+        logEvent('warn', 'install', `a too-young release blocks pnpm's lockfile verification (#39) — retrying once with ${RELEASE_AGE_OVERRIDE}`)
+        result = await run(profile, [pluginArgs[0], RELEASE_AGE_OVERRIDE, ...pluginArgs.slice(1)])
+      }
     } else if (
       (failure?.code === 'fetch-404' || failure?.code === 'no-matching-version')
       && isUnpublishedHostPeer(failure.pkg, profile, profileDirectory)
@@ -165,8 +192,12 @@ export async function withHoistRecovery(
       // and npm has never carried. Every fresh profile hits this, whatever
       // the plugin, so failing here would be failing for something the user
       // cannot fix and did not cause.
-      logEvent('warn', 'install', `${failure.pkg ?? 'a host package'} is a peer the runtime provides and npm does not carry (#289) — retrying once with ${AUTO_INSTALL_PEERS_OFF}`)
-      result = await run(profile, [pluginArgs[0], AUTO_INSTALL_PEERS_OFF, ...pluginArgs.slice(1)])
+      if (!marketFlags) {
+        unavailableOption = AUTO_INSTALL_PEERS_OFF
+      } else {
+        logEvent('warn', 'install', `${failure.pkg ?? 'a host package'} is a peer the runtime provides and npm does not carry (#289) — retrying once with ${AUTO_INSTALL_PEERS_OFF}`)
+        result = await run(profile, [pluginArgs[0], AUTO_INSTALL_PEERS_OFF, ...pluginArgs.slice(1)])
+      }
     } else if (
       failure?.code === 'transient-network'
       && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')
@@ -184,8 +215,12 @@ export async function withHoistRecovery(
       // Large tarball / slow network: pnpm's default 60s per-request limit
       // aborted the download. A plain retry fails again at the same limit,
       // so retry once with a longer fetchTimeout.
-      logEvent('warn', 'install', `pnpm's per-request fetch timeout aborted a large download — retrying once with ${FETCH_TIMEOUT_OVERRIDE}`)
-      result = await run(profile, [pluginArgs[0], FETCH_TIMEOUT_OVERRIDE, ...pluginArgs.slice(1)])
+      if (!marketFlags) {
+        unavailableOption = FETCH_TIMEOUT_OVERRIDE
+      } else {
+        logEvent('warn', 'install', `pnpm's per-request fetch timeout aborted a large download — retrying once with ${FETCH_TIMEOUT_OVERRIDE}`)
+        result = await run(profile, [pluginArgs[0], FETCH_TIMEOUT_OVERRIDE, ...pluginArgs.slice(1)])
+      }
     }
   }
   if (!ok(result) && !result.cancelled) {
@@ -223,6 +258,16 @@ export async function withHoistRecovery(
       result = { ...result, stderr: `${result.stderr}\n\n${code}${result.pnpmError}` }
     }
   }
+  if (unavailableOption !== null && !ok(result) && !result.cancelled) {
+    // #732: this step was skipped because the host runs pnpm itself and takes
+    // no options from us — but the classified message above says the market
+    // retried. Say that it did not, or the user reads a retry that never
+    // happened and looks for the wrong cause.
+    result = {
+      ...result,
+      stderr: `${result.stderr}\n\n这台宿主（官方桌面端）自己执行安装，不接受市场附加的 pnpm 参数（${unavailableOption}），所以这一步没有自动重试。 / This host (the official desktop app) runs the install itself and takes no pnpm options from the market (${unavailableOption}), so that automatic retry could not be attempted.`,
+    }
+  }
   return result
 }
 

package/src/official-desktop.ts

@@ -58,7 +58,16 @@ export function createOfficialDesktopRuntime(
     // manager are accepted; silently dropping pnpm flags would change intent.
     const [command, target, ...extra] = argv
     if (extra.length !== 0 || typeof target !== 'string' || !TARGET_RE.test(target)) {
-      return Promise.resolve(failure('this desktop operation is not supported by the official plugin manager', 127))
+      // The market's own options are what usually lands here, and they are
+      // spelled with a leading `-` — and they sit in the TARGET slot, because
+      // the market writes `add <option> <target>`. The OPERATION is supported
+      // here; only the option is not, and reporting that as "this desktop
+      // operation is not supported" is what made #732 read as a broken
+      // profile. Name the option and the way out instead.
+      const options = argv.slice(1).filter(argument => argument.startsWith('-')).join(' ')
+      return Promise.resolve(failure(options === ''
+        ? 'this desktop operation is not supported by the official plugin manager'
+        : `官方桌面客户端自己执行这次安装，不接受市场附加的参数（${options}），这个选项在它这里用不了。可以改用普通 dsh web 安装，或等这个版本过了新版本等待期再试。 / The official desktop app runs this install itself and takes no options from the market (${options}); that option cannot be used here. Install from plain dsh web, or try again once the release is past the fresh-release wait.`, 127))
     }
     const spec = target
     // Only `add` and `remove` map onto the manager. `update` reached here
@@ -136,6 +145,10 @@ export function createOfficialDesktopRuntime(
       return true
     },
     supportsExactRollbackTarget: target => TARGET_RE.test(target),
+    // The reason the flag exists (#732): this manager takes exactly
+    // `add <target>` or `remove <target>`, so every recovery step that needs
+    // an option has to be left out here rather than sent and refused.
+    acceptsMarketPnpmFlags: false,
     dispose: async () => {
       disposed = true
       if (active?.requestId !== undefined) {

package/src/profile.ts

@@ -1238,3 +1238,110 @@ export function dropUnparseableBuildKeys(profile: string, explicitDir?: string):
   writeAllowBuildsMap(file, yaml, map, blockRe, blockMatch)
   return removed
 }
+
+/** One `minimumReleaseAgeExclude` entry, split into its name and its versions. */
+interface ReleaseAgeExcludeRule {
+  name: string
+  /** The version union exactly as written, or null when the entry names no version. */
+  selector: string | null
+}
+
+/**
+ * Split `name@1.2.3 || 1.4.0` into its package name and selector.
+ *
+ * A scoped name begins with `@`, so the separator is the first `@` AFTER
+ * position 0; an entry with no `@` at all excludes every version of that
+ * name. Anything this cannot read exactly returns null, and the caller then
+ * leaves the file alone rather than rewriting a line it misread.
+ */
+function splitReleaseAgeExclude(entry: string): ReleaseAgeExcludeRule | null {
+  let text = entry.trim()
+  if (text.length >= 2
+    && (text[0] === "'" && text[text.length - 1] === "'" || text[0] === '"' && text[text.length - 1] === '"')) {
+    text = text.slice(1, -1)
+  }
+  const at = text.indexOf('@', text.startsWith('@') ? 1 : 0)
+  if (at === -1) return text === '' ? null : { name: text, selector: null }
+  const name = text.slice(0, at)
+  const selector = text.slice(at + 1).trim()
+  if (name === '' || selector === '') return null
+  return { name, selector }
+}
+
+/**
+ * Merge one package's several `minimumReleaseAgeExclude` entries into one
+ * (#732).
+ *
+ * pnpm 11.7.0 APPENDS an entry when it lets a version through a profile's
+ * `minimumReleaseAge` instead of folding it into the rule that already names
+ * that package — and its own `evaluateVersionPolicy` then honours only the
+ * FIRST rule per package name. The entry pnpm just wrote is therefore
+ * shadowed by the older one, the young version stays unexcluded, and pnpm
+ * fails lockfile verification with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION on
+ * EVERY later command in that profile: installs, updates and uninstalls
+ * alike, including ones that have nothing to do with the package. Reported
+ * as #732, where the market's own self-update planted exactly that pair and
+ * every plugin operation on the desktop profile stopped working.
+ *
+ * Merging keeps the union of what the file already says, so nothing is
+ * loosened or tightened: the entries pnpm wrote were meant to be read, and
+ * after the merge they are. A file with no same-name duplicate is untouched,
+ * as is one whose block this cannot read exactly (a flow list, an inline
+ * comment, a line it would have to guess at).
+ *
+ * @returns the package names whose entries were merged; empty when the file
+ *   needed no repair or could not be repaired, in which case it is left
+ *   byte-for-byte as it was.
+ */
+export function mergeDuplicateReleaseAgeExcludes(profile: string, explicitDir?: string): string[] {
+  const file = join(profileDir(profile, explicitDir), 'pnpm-workspace.yaml')
+  let yaml: string
+  try { yaml = readFileSync(file, 'utf8') } catch { return [] }
+  // Block form only: `minimumReleaseAgeExclude:` then `- <entry>` lines.
+  const blockRe = /^minimumReleaseAgeExclude:[ \t]*\r?\n((?:[ \t]+-[^\r\n]*\r?\n?)*)/m
+  const block = blockRe.exec(yaml)
+  if (block === null) return []
+  const eol = /\r\n/.test(yaml) ? '\r\n' : '\n'
+  const indentMatch = /^([ \t]+)-/.exec(block[1])
+  const indent = indentMatch === null ? '  ' : indentMatch[1]
+  const entries: { rule: ReleaseAgeExcludeRule; quoted: boolean }[] = []
+  for (const line of block[1].split(/\r?\n/)) {
+    if (line.trim() === '') continue
+    const m = /^[ \t]+-[ \t]*(.*?)[ \t]*$/.exec(line)
+    // A `#` on the line is a comment this cannot re-emit without losing it.
+    if (m === null || m[1].includes('#')) return []
+    const rule = splitReleaseAgeExclude(m[1])
+    if (rule === null) return []
+    entries.push({ rule, quoted: /^['"]/.test(m[1]) })
+  }
+  const byName = new Map<string, { selectors: Set<string>; allVersions: boolean; quoted: boolean; count: number }>()
+  const order: string[] = []
+  for (const { rule, quoted } of entries) {
+    let group = byName.get(rule.name)
+    if (group === undefined) {
+      group = { selectors: new Set(), allVersions: false, quoted: false, count: 0 }
+      byName.set(rule.name, group)
+      order.push(rule.name)
+    }
+    group.count += 1
+    group.quoted = group.quoted || quoted
+    if (rule.selector === null) group.allVersions = true
+    else group.selectors.add(rule.selector)
+  }
+  const merged = order.filter(name => (byName.get(name)?.count ?? 0) > 1)
+  if (merged.length === 0) return []
+  const lines = order.map(name => {
+    const group = byName.get(name)
+    if (group === undefined) return ''
+    const text = group.allVersions ? name : `${name}@${[...group.selectors].join(' || ')}`
+    // `@` cannot start a plain scalar in YAML, so a scoped name is written
+    // quoted — the way pnpm itself writes one.
+    const quoted = group.quoted || text.startsWith('@')
+    return `${indent}- ${quoted ? `'${text.replaceAll("'", "''")}'` : text}`
+  })
+  const blockText = `minimumReleaseAgeExclude:${eol}${lines.join(eol)}${eol}`
+  // A function replacement: `$&` and friends in a string replacement would
+  // be read as capture references.
+  writeFileSync(file, yaml.replace(blockRe, () => blockText))
+  return merged
+}

package/src/routes.ts

@@ -357,6 +357,19 @@ export function mountMarketRoutes(
   // re-applies the same choice on every boot (ported from dsh-plugin-hub).
   const userPatchPath = findUserPatchPath(host, activeProfileDir)
   const commands: PluginCommandRuntime = commandRuntime ?? { runPlugin: runDshPlugin, probePnpm, provisionPnpm, cancelActive }
+  /**
+   * Whether this host runs pnpm itself and so takes the market's own options
+   * (`--config.*`, `--force`, `--no-frozen-lockfile`).
+   *
+   * The official Desktop bridge does not (#732): its in-process manager
+   * accepts exactly `add <target>` or `remove <target>` and answers anything
+   * else with exit 127. The market's recovery steps decorate commands with
+   * those options, so on such a host they have to be left out or rewritten as
+   * a bare exact target, instead of being sent and refused — which reported a
+   * supported operation as unsupported and sent the reporter looking for a
+   * broken profile.
+   */
+  const marketFlags = commands.acceptsMarketPnpmFlags !== false
   const supportsExactRollbackTarget = (target: string): boolean =>
     commands.supportsExactRollbackTarget?.(target) ?? TARGET_RE.test(target)
   // Point every plugin build/install spawn at the configured build
@@ -773,10 +786,36 @@ export function mountMarketRoutes(
   }
 
   /** Every plugin command goes through the pnpm-drift recovery wrapper (#20). */
-  const runPlugin = (profile: string, args: string[]) => withHoistRecovery(commands.runPlugin, profile, args, activeProfileDir)
+  const runPlugin = (profile: string, args: string[]) =>
+    withHoistRecovery(commands.runPlugin, profile, args, activeProfileDir, { marketFlags })
   /** The same, minus the release-age bypass: for a fresh install pinned to a young release (#594). */
   const runPluginKeepingReleaseAge = (profile: string, args: string[]) =>
-    withHoistRecovery(commands.runPlugin, profile, args, activeProfileDir, { releaseAgeBypass: false })
+    withHoistRecovery(commands.runPlugin, profile, args, activeProfileDir, { releaseAgeBypass: false, marketFlags })
+
+  /**
+   * The argv that rematerializes a restored manifest's build on this host.
+   *
+   * On a host that takes the market's options, one `pnpm install` does it. A
+   * host that runs pnpm itself — the official Desktop bridge (#732) — accepts
+   * only `add <target>` and refuses `install` outright, so there it is an
+   * `add` of the exact version the restored manifest pins, which is what that
+   * host's own manager pipeline materializes. A range is deliberately not
+   * usable: it would re-resolve to whatever is newest and call that the
+   * previous build.
+   *
+   * @returns null when nothing expressible is left, in which case the caller
+   *   reports that rather than sending a command the host will refuse.
+   */
+  function rematerializeArgs(name: string, pinned: string | undefined): string[] | null {
+    if (marketFlags) return ['--no-frozen-lockfile', RELEASE_AGE_OVERRIDE, 'install']
+    if (pinned !== undefined && /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(pinned)) return ['add', `${name}@${pinned}`]
+    return null
+  }
+
+  /** Why a rematerialization could not even be attempted here (see above). */
+  function cannotRematerializeDetail(name: string, pinned: string | undefined): string {
+    return `这台宿主只接受按精确版本重新安装，「${name}」改动前在 profile 里写作 ${pinned ?? '（不在 profile 里）'}，市场无法在它上面重建上一版 / this host can only reinstall an exact version, and "${name}" was declared as ${pinned ?? '(not in the profile)'}, so the previous build cannot be rematerialized there`
+  }
 
   /**
    * Undo a clean-exit update whose new build cannot boot. Restoring only the
@@ -800,7 +839,14 @@ export function mountMarketRoutes(
     // Flags come BEFORE the command: preparePluginArgs treats the last arg as
     // the package target and rejects a trailing flag, while pnpm accepts the
     // same flags in front of `install`.
-    const reinstall = await runPlugin(config.profile, ['--no-frozen-lockfile', RELEASE_AGE_OVERRIDE, 'install'])
+    //
+    // On a host that runs pnpm itself neither flag exists and `install` is not
+    // accepted at all (#732), so there the build is rematerialized through the
+    // exact target — see `rematerializeArgs`.
+    const pinned = manifestBefore.dependencies[name]
+    const args = rematerializeArgs(name, pinned)
+    if (args === null) return { ok: false, detail: cannotRematerializeDetail(name, pinned) }
+    const reinstall = await runPlugin(config.profile, args)
     const ok = reinstall.exitCode === 0 && !reinstall.timedOut && !reinstall.cancelled
     if (ok) logEvent('info', 'update', `${name}: previous build rematerialized (${rolledBack.join(', ')})`)
     return { ok, detail: ok ? null : failureDetail(reinstall) }
@@ -962,7 +1008,16 @@ export function mountMarketRoutes(
     // were replaced before the rejected update failed. A normal exact add is
     // then an "already up to date" no-op; --force is what rematerializes the
     // captured version/commit/archive instead of blessing corrupted bytes.
-    const add = await runPlugin(config.profile, ['add', '--force', RELEASE_AGE_OVERRIDE, target])
+    //
+    // `--force` and the age override are market options, and the official
+    // Desktop bridge refuses them outright (#732). There the rollback is the
+    // bare exact target: the host's own manager pipeline is what installs it,
+    // and sending the options anyway failed the rollback with 127 — which
+    // read as "the previous build could not be verified" while node_modules
+    // still held the bad build.
+    const add = await runPlugin(config.profile, marketFlags
+      ? ['add', '--force', RELEASE_AGE_OVERRIDE, target]
+      : ['add', target])
     // Exact recovery targets deliberately pin versions/commits. Keep the
     // user's durable range, tag, floating github shortcut, or release URL.
     restoreProfileManifest(config.profile, manifestBefore, activeProfileDir)
@@ -3256,7 +3311,11 @@ sendJson(response, 200, { updates })
               restoreProfileManifest(config.profile, manifestBefore, activeProfileDir)
               const prepared = restoreProfileLockfile(lockfileBefore)
               if (!prepared.ok) return prepared
-              const reinstall = await runPlugin(config.profile, ['--no-frozen-lockfile', RELEASE_AGE_OVERRIDE, 'install'])
+              const reinstallArgs = rematerializeArgs(name, manifestBefore.dependencies[name])
+              if (reinstallArgs === null) {
+                return { ok: false, detail: cannotRematerializeDetail(name, manifestBefore.dependencies[name]) }
+              }
+              const reinstall = await runPlugin(config.profile, reinstallArgs)
               restoreProfileManifest(config.profile, manifestBefore, activeProfileDir)
               const finalLock = restoreProfileLockfile(lockfileBefore)
               if (!finalLock.ok) return finalLock
@@ -3727,9 +3786,16 @@ sendJson(response, 200, { updates })
             const reresolveInPlace = isGit && !restore && target === spec
             // force: the user chose to install a fresh release without the
             // default one-day safety wait; scoped to this single command.
+            //
+            // The override is a market option, so a host that runs pnpm itself
+            // does not take it (#732); there the plain form goes out and the
+            // host's own manager pipeline applies its release policy. That is
+            // the same trade the held-back fresh install already makes: the
+            // version the host admits now, with the newer one still offered by
+            // the update check.
             const addArgs = reresolveInPlace
-              ? (force ? ['update', RELEASE_AGE_OVERRIDE, name] : ['update', name])
-              : (force ? ['add', RELEASE_AGE_OVERRIDE, target] : ['add', target])
+              ? (force && marketFlags ? ['update', RELEASE_AGE_OVERRIDE, name] : ['update', name])
+              : (force && marketFlags ? ['add', RELEASE_AGE_OVERRIDE, target] : ['add', target])
             // Exact manifest snapshot for failure rollback (#65, #339) — the
             // host can write dependencies AND dsh.profile.bundles before a
             // hard-failed add, leaving residue that breaks the next boot.
@@ -5308,7 +5374,11 @@ sendJson(response, 200, { updates })
                 // the intent the fresh path otherwise refuses to assume it has
                 // (#594): the bypass is safe to use HERE because it is no
                 // longer the market's idea — it is what was clicked (#635).
-                const bypass = heldBack && force
+                // The bypass is an option this host may not accept (#732). Where
+                // it is not expressible the request falls to the same place as
+                // a refused bypass below: the bare name, with `heldByAge` set
+                // so the row says the profile's own age policy is why.
+                const bypass = heldBack && force && marketFlags
                 logEvent('warn', 'install', bypass
                   ? `${entry.name}: ${String(registryLatest)} is younger than this profile's minimumReleaseAge — installing it anyway, as asked, with ${RELEASE_AGE_OVERRIDE}`
                   : heldBack