dshmarket 1.66.0 → 1.66.2

package/client/client.js

@@ -272,6 +272,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			capRedInstallScriptScripts: "安装时会立刻运行 {0}，不需要你打开插件",
 			capRedCoreTamper: "会改动 DSH 自带的组件",
 			capRedCoreTamperDetail: "会改动 DSH 自带的组件（{0}）",
+			capRedCoreOverride: "会覆盖 DSH 自带的组件（{0}）",
+			capRedCoreDisable: "会禁用 DSH 自带的组件（{0}）",
 			favoriteAdd: "加入收藏",
 			favoriteRemove: "取消收藏",
 			favoritesEmpty: "还没有收藏。在「发现」或「主题」里点书签图标即可收藏。",
@@ -920,6 +922,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			capRedInstallScriptScripts: "runs {0} the moment you install — you do not have to open the plugin",
 			capRedCoreTamper: "replaces parts of DSH itself",
 			capRedCoreTamperDetail: "replaces parts of DSH itself ({0})",
+			capRedCoreOverride: "overrides a part of DSH itself ({0})",
+			capRedCoreDisable: "disables a part of DSH itself ({0})",
 			favoriteAdd: "Add to favorites",
 			favoriteRemove: "Remove from favorites",
 			favoritesEmpty: "No favorites yet. Click the bookmark icon in Discover or Themes to add one.",
@@ -9764,6 +9768,11 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				if (literalIp !== null) return t("capRedLiteralIp").replace("{0}", literalIp[1]);
 				const installScript = /^runs code at install time(?: \((.+)\))?$/.exec(line);
 				if (installScript !== null) return installScript[1] === void 0 ? t("capRedInstallScript") : t("capRedInstallScriptScripts").replace("{0}", installScript[1]);
+				const coreVerb = /^tampers with a core bundle \((overrides|disables) bundle (.+)\)$/.exec(line);
+				if (coreVerb !== null) {
+					const key = coreVerb[1] === "overrides" ? "capRedCoreOverride" : "capRedCoreDisable";
+					return t(key).replace("{0}", coreVerb[2]);
+				}
 				const coreTamper = /^tampers with a core bundle(?: \((.+)\))?$/.exec(line);
 				if (coreTamper !== null) return coreTamper[1] === void 0 ? t("capRedCoreTamper") : t("capRedCoreTamperDetail").replace("{0}", coreTamper[1]);
 				return line;

package/lib/install.js

@@ -8,7 +8,7 @@ import { closeSync, existsSync, lstatSync, openSync, readlinkSync, readSync, rmS
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { findDshInstallDir } from './dsh-install.js';
 import { classifyPnpmFailure, HOST_NAMESPACE_RE } from './pnpm-compat.js';
-import { conflictingEntryIds, dropFromManifest, hasDshManifest, hasLoadableEntry, pluginSubdirs, profileDir, readInstalled, readManifestDeps, readProfileBundles, dropUnparseableBuildKeys } from './profile.js';
+import { conflictingEntryIds, dropFromManifest, hasDshManifest, hasLoadableEntry, normalizeReleaseAgeExcludes, pluginSubdirs, profileDir, readInstalled, readManifestDeps, readProfileBundles, dropUnparseableBuildKeys } from './profile.js';
 import { logEvent } from './log.js';
 import { cleanOrphanedStore } from './store.js';
 /**
@@ -108,8 +108,31 @@ export function isUnpublishedHostPeer(pkg, profile, explicitDir) {
  * where it is not — there the bypass would be what installs the young
  * version, over a minimumReleaseAge the profile set on purpose — so the
  * install route declines it and falls back to the bare name instead.
+ *
+ * `marketFlags: false` says the host runs pnpm itself and takes no options
+ * from us (the official Desktop bridge, #732). The four recoveries below
+ * each decorate a command with an option, so on such a host they are skipped
+ * rather than sent and refused — and because their classifier messages say
+ * the market retried, the note appended at the end says it did not.
  */
 export async function withHoistRecovery(run, profile, pluginArgs, profileDirectory, options = {}) {
+    const marketFlags = options.marketFlags !== false;
+    /** The option a recovery step needed and this host does not accept (#732). */
+    let unavailableOption = null;
+    // Before the FIRST run, not after a failure: the two shapes pnpm writes into
+    // `minimumReleaseAgeExclude` (a shadowed duplicate rule, #732; a version
+    // union, #733) hurt pnpm while it RESOLVES the dependency graph, and the
+    // union one aborts the process on an 80 GiB allocation with no error output
+    // at all — nothing to classify, so a repair that waited for a failure would
+    // never fire. Every verb that resolves the graph is covered, not just add and
+    // remove: an `install` or an in-place `update` consults the same key.
+    const verb = pluginArgs.find(argument => !argument.startsWith('-'));
+    if (verb === 'add' || verb === 'remove' || verb === 'install' || verb === 'update') {
+        const normalized = normalizeReleaseAgeExcludes(profile, profileDirectory);
+        if (normalized.length > 0) {
+            logEvent('warn', 'install', `minimumReleaseAgeExclude held a form pnpm cannot read back for ${normalized.join(', ')} (a shadowed duplicate rule, #732, or a version union, which pnpm 12.4.1 aborts on — #733) — rewrote each as one bare package name before running`);
+        }
+    }
     let result = await run(profile, pluginArgs);
     const ok = (r) => r.exitCode === 0 && !r.timedOut && !r.cancelled;
     if (!ok(result) && !result.cancelled) {
@@ -127,19 +150,45 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
             }
         }
         else if (failure?.code === 'hoist-pattern-diff') {
-            logEvent('warn', 'install', `modules dir was built by a different pnpm major — rebuilding (pnpm install) and retrying once`);
-            // --no-frozen-lockfile: the market runs pnpm with CI=true (TTY hangs),
-            // where a lockfile written by the old major would otherwise be refused.
-            const rebuild = await run(profile, ['install', '--no-frozen-lockfile']);
-            if (ok(rebuild))
-                result = await run(profile, pluginArgs);
+            if (!marketFlags) {
+                unavailableOption = '--no-frozen-lockfile';
+            }
+            else {
+                logEvent('warn', 'install', `modules dir was built by a different pnpm major — rebuilding (pnpm install) and retrying once`);
+                // --no-frozen-lockfile: the market runs pnpm with CI=true (TTY hangs),
+                // where a lockfile written by the old major would otherwise be refused.
+                const rebuild = await run(profile, ['install', '--no-frozen-lockfile']);
+                if (ok(rebuild))
+                    result = await run(profile, pluginArgs);
+            }
         }
         else if (failure?.code === 'release-age-violation'
-            && options.releaseAgeBypass !== false
-            && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')
-            && !pluginArgs.includes(RELEASE_AGE_OVERRIDE)) {
-            logEvent('warn', 'install', `a too-young release blocks pnpm's lockfile verification (#39) — retrying once with ${RELEASE_AGE_OVERRIDE}`);
-            result = await run(profile, [pluginArgs[0], RELEASE_AGE_OVERRIDE, ...pluginArgs.slice(1)]);
+            && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')) {
+            // The repair ran before this command, so a rewrite here means pnpm wrote
+            // one of the two broken shapes DURING it — appending a shadowed rule
+            // (#732) or extending a version union (#733). Either way the same
+            // rewrite fixes it, needs no option at all, and so also works on the
+            // desktop bridge that refuses options. Retry the SAME argv afterwards.
+            const normalized = normalizeReleaseAgeExcludes(profile, profileDirectory);
+            if (normalized.length > 0) {
+                logEvent('warn', 'install', `pnpm wrote a minimumReleaseAgeExclude entry it cannot read back for ${normalized.join(', ')} (#732/#733) — rewrote each as one bare package name and retrying once`);
+                result = await run(profile, pluginArgs);
+            }
+            else if (options.releaseAgeBypass === false) {
+                // The caller declined the bypass (#594), and the duplicates were not
+                // what failed: this violation is the profile's own policy doing its
+                // job, so the command stands as it is.
+            }
+            else if (!marketFlags) {
+                unavailableOption = RELEASE_AGE_OVERRIDE;
+            }
+            else if (pluginArgs.includes(RELEASE_AGE_OVERRIDE)) {
+                // Already carrying it (a caller's forced retry): nothing left to add.
+            }
+            else {
+                logEvent('warn', 'install', `a too-young release blocks pnpm's lockfile verification (#39) — retrying once with ${RELEASE_AGE_OVERRIDE}`);
+                result = await run(profile, [pluginArgs[0], RELEASE_AGE_OVERRIDE, ...pluginArgs.slice(1)]);
+            }
         }
         else if ((failure?.code === 'fetch-404' || failure?.code === 'no-matching-version')
             && isUnpublishedHostPeer(failure.pkg, profile, profileDirectory)
@@ -149,8 +198,13 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
             // and npm has never carried. Every fresh profile hits this, whatever
             // the plugin, so failing here would be failing for something the user
             // cannot fix and did not cause.
-            logEvent('warn', 'install', `${failure.pkg ?? 'a host package'} is a peer the runtime provides and npm does not carry (#289) — retrying once with ${AUTO_INSTALL_PEERS_OFF}`);
-            result = await run(profile, [pluginArgs[0], AUTO_INSTALL_PEERS_OFF, ...pluginArgs.slice(1)]);
+            if (!marketFlags) {
+                unavailableOption = AUTO_INSTALL_PEERS_OFF;
+            }
+            else {
+                logEvent('warn', 'install', `${failure.pkg ?? 'a host package'} is a peer the runtime provides and npm does not carry (#289) — retrying once with ${AUTO_INSTALL_PEERS_OFF}`);
+                result = await run(profile, [pluginArgs[0], AUTO_INSTALL_PEERS_OFF, ...pluginArgs.slice(1)]);
+            }
         }
         else if (failure?.code === 'transient-network'
             && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')) {
@@ -166,8 +220,13 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
             // Large tarball / slow network: pnpm's default 60s per-request limit
             // aborted the download. A plain retry fails again at the same limit,
             // so retry once with a longer fetchTimeout.
-            logEvent('warn', 'install', `pnpm's per-request fetch timeout aborted a large download — retrying once with ${FETCH_TIMEOUT_OVERRIDE}`);
-            result = await run(profile, [pluginArgs[0], FETCH_TIMEOUT_OVERRIDE, ...pluginArgs.slice(1)]);
+            if (!marketFlags) {
+                unavailableOption = FETCH_TIMEOUT_OVERRIDE;
+            }
+            else {
+                logEvent('warn', 'install', `pnpm's per-request fetch timeout aborted a large download — retrying once with ${FETCH_TIMEOUT_OVERRIDE}`);
+                result = await run(profile, [pluginArgs[0], FETCH_TIMEOUT_OVERRIDE, ...pluginArgs.slice(1)]);
+            }
         }
     }
     if (!ok(result) && !result.cancelled) {
@@ -207,6 +266,16 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
             result = { ...result, stderr: `${result.stderr}\n\n${code}${result.pnpmError}` };
         }
     }
+    if (unavailableOption !== null && !ok(result) && !result.cancelled) {
+        // #732: this step was skipped because the host runs pnpm itself and takes
+        // no options from us — but the classified message above says the market
+        // retried. Say that it did not, or the user reads a retry that never
+        // happened and looks for the wrong cause.
+        result = {
+            ...result,
+            stderr: `${result.stderr}\n\n这台宿主（官方桌面端）自己执行安装，不接受市场附加的 pnpm 参数（${unavailableOption}），所以这一步没有自动重试。 / This host (the official desktop app) runs the install itself and takes no pnpm options from the market (${unavailableOption}), so that automatic retry could not be attempted.`,
+        };
+    }
     return result;
 }
 /**

package/lib/official-desktop.js

@@ -41,7 +41,16 @@ export function createOfficialDesktopRuntime(managerLookup, profileName, _profil
         // manager are accepted; silently dropping pnpm flags would change intent.
         const [command, target, ...extra] = argv;
         if (extra.length !== 0 || typeof target !== 'string' || !TARGET_RE.test(target)) {
-            return Promise.resolve(failure('this desktop operation is not supported by the official plugin manager', 127));
+            // The market's own options are what usually lands here, and they are
+            // spelled with a leading `-` — and they sit in the TARGET slot, because
+            // the market writes `add <option> <target>`. The OPERATION is supported
+            // here; only the option is not, and reporting that as "this desktop
+            // operation is not supported" is what made #732 read as a broken
+            // profile. Name the option and the way out instead.
+            const options = argv.slice(1).filter(argument => argument.startsWith('-')).join(' ');
+            return Promise.resolve(failure(options === ''
+                ? 'this desktop operation is not supported by the official plugin manager'
+                : `官方桌面客户端自己执行这次安装，不接受市场附加的参数（${options}），这个选项在它这里用不了。可以改用普通 dsh web 安装，或等这个版本过了新版本等待期再试。 / The official desktop app runs this install itself and takes no options from the market (${options}); that option cannot be used here. Install from plain dsh web, or try again once the release is past the fresh-release wait.`, 127));
         }
         const spec = target;
         // Only `add` and `remove` map onto the manager. `update` reached here
@@ -122,6 +131,10 @@ export function createOfficialDesktopRuntime(managerLookup, profileName, _profil
             return true;
         },
         supportsExactRollbackTarget: target => TARGET_RE.test(target),
+        // The reason the flag exists (#732): this manager takes exactly
+        // `add <target>` or `remove <target>`, so every recovery step that needs
+        // an option has to be left out here rather than sent and refused.
+        acceptsMarketPnpmFlags: false,
         dispose: async () => {
             disposed = true;
             if (active?.requestId !== undefined) {

package/lib/profile.js

@@ -1198,3 +1198,141 @@ export function dropUnparseableBuildKeys(profile, explicitDir) {
     writeAllowBuildsMap(file, yaml, map, blockRe, blockMatch);
     return removed;
 }
+/**
+ * Split `name@1.2.3 || 1.4.0` into its package name and selector.
+ *
+ * A scoped name begins with `@`, so the separator is the first `@` AFTER
+ * position 0; an entry with no `@` at all excludes every version of that
+ * name. Anything this cannot read exactly returns null, and the caller then
+ * leaves the file alone rather than rewriting a line it misread.
+ */
+function splitReleaseAgeExclude(entry) {
+    let text = entry.trim();
+    if (text.length >= 2
+        && (text[0] === "'" && text[text.length - 1] === "'" || text[0] === '"' && text[text.length - 1] === '"')) {
+        text = text.slice(1, -1);
+    }
+    const at = text.indexOf('@', text.startsWith('@') ? 1 : 0);
+    if (at === -1)
+        return text === '' ? null : { name: text, selector: null };
+    const name = text.slice(0, at);
+    const selector = text.slice(at + 1).trim();
+    if (name === '' || selector === '')
+        return null;
+    return { name, selector };
+}
+/**
+ * Make a profile's `minimumReleaseAgeExclude` readable again (#732, #733).
+ *
+ * pnpm WRITES this key in forms it then mishandles, and two separate defects
+ * come out of that:
+ *
+ * - pnpm 11.7.0 appends a second rule for a package that already has one,
+ *   while its `evaluateVersionPolicy` honours only the FIRST rule per name.
+ *   Its own new entry is therefore dead, and every later command in that
+ *   profile fails lockfile verification with
+ *   ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION — including commands that have
+ *   nothing to do with that package (#732).
+ * - pnpm 12.4.1 folds the versions it approves into a `name@v1 || v2 || …`
+ *   union, a form its OWN validator rejects ("Invalid versions union … Use
+ *   exact versions only"), and evaluating one aborts the process on a single
+ *   80 GiB allocation that takes the machine down for minutes (#733). The
+ *   entries are evaluated lazily, so this fires on any later install that
+ *   age-checks that package, with no pnpm error output to explain it.
+ *
+ * Both are avoided by writing each such package as ONE BARE NAME. A bare name
+ * cannot be shadowed (the first rule for it is already all of it), it stops
+ * pnpm's auto-collect for that package outright, and it carries no union for
+ * the parser to evaluate. It is also a wider statement than a version list —
+ * the package stops being age-gated at all — so it is spent only on entries
+ * pnpm has already written in one of those two broken forms, never on a
+ * package the file lists as a single exact version. A pure duplicate of one
+ * exact version collapses to that one line, which changes no policy at all.
+ *
+ * A file holding nothing but bare names and single exact versions is left
+ * untouched, as is one whose block this cannot read exactly (a flow list, an
+ * inline comment, a line it would have to guess at).
+ *
+ * @returns the package names whose entry was rewritten; empty when the file
+ *   needed no repair or could not be repaired, in which case it is left
+ *   byte-for-byte as it was.
+ */
+export function normalizeReleaseAgeExcludes(profile, explicitDir) {
+    const file = join(profileDir(profile, explicitDir), 'pnpm-workspace.yaml');
+    let yaml;
+    try {
+        yaml = readFileSync(file, 'utf8');
+    }
+    catch {
+        return [];
+    }
+    // Block form only: `minimumReleaseAgeExclude:` then `- <entry>` lines.
+    const blockRe = /^minimumReleaseAgeExclude:[ \t]*\r?\n((?:[ \t]+-[^\r\n]*\r?\n?)*)/m;
+    const block = blockRe.exec(yaml);
+    if (block === null)
+        return [];
+    const eol = /\r\n/.test(yaml) ? '\r\n' : '\n';
+    const indentMatch = /^([ \t]+)-/.exec(block[1]);
+    const indent = indentMatch === null ? '  ' : indentMatch[1];
+    const entries = [];
+    for (const line of block[1].split(/\r?\n/)) {
+        if (line.trim() === '')
+            continue;
+        const m = /^[ \t]+-[ \t]*(.*?)[ \t]*$/.exec(line);
+        // A `#` on the line is a comment this cannot re-emit without losing it.
+        if (m === null || m[1].includes('#'))
+            return [];
+        const rule = splitReleaseAgeExclude(m[1]);
+        if (rule === null)
+            return [];
+        entries.push({ rule, quoted: /^['"]/.test(m[1]), line });
+    }
+    const byName = new Map();
+    const order = [];
+    for (const { rule, quoted, line } of entries) {
+        let group = byName.get(rule.name);
+        if (group === undefined) {
+            group = { selectors: new Set(), originals: [], lines: [], allVersions: false, quoted: false, count: 0 };
+            byName.set(rule.name, group);
+            order.push(rule.name);
+        }
+        group.count += 1;
+        group.quoted = group.quoted || quoted;
+        group.originals.push(rule.selector ?? '');
+        group.lines.push(line);
+        if (rule.selector === null)
+            group.allVersions = true;
+        else
+            group.selectors.add(rule.selector);
+    }
+    /** The one line this package's entry is written as. */
+    const produced = (name) => {
+        const group = byName.get(name);
+        if (group === undefined)
+            return '';
+        // A bare name already covers every version, so it stays bare; a union or
+        // several rules for one name cannot both be read, so they become one.
+        const bare = group.allVersions
+            || group.originals.some(selector => selector.includes('||'))
+            || group.selectors.size > 1;
+        const text = bare ? name : `${name}@${[...group.selectors][0]}`;
+        // `@` cannot start a plain scalar in YAML, so a scoped name is written
+        // quoted — the way pnpm itself writes one.
+        const quoted = group.quoted || text.startsWith('@');
+        return `${indent}- ${quoted ? `'${text.replaceAll("'", "''")}'` : text}`;
+    };
+    const rewritten = order.filter(name => {
+        const group = byName.get(name);
+        if (group === undefined)
+            return false;
+        return group.count > 1 || group.lines[0] !== produced(name);
+    });
+    if (rewritten.length === 0)
+        return [];
+    const lines = order.map(produced);
+    const blockText = `minimumReleaseAgeExclude:${eol}${lines.join(eol)}${eol}`;
+    // A function replacement: `$&` and friends in a string replacement would
+    // be read as capture references.
+    writeFileSync(file, yaml.replace(blockRe, () => blockText));
+    return rewritten;
+}

package/lib/routes.js

@@ -259,6 +259,19 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
     // re-applies the same choice on every boot (ported from dsh-plugin-hub).
     const userPatchPath = findUserPatchPath(host, activeProfileDir);
     const commands = commandRuntime ?? { runPlugin: runDshPlugin, probePnpm, provisionPnpm, cancelActive };
+    /**
+     * Whether this host runs pnpm itself and so takes the market's own options
+     * (`--config.*`, `--force`, `--no-frozen-lockfile`).
+     *
+     * The official Desktop bridge does not (#732): its in-process manager
+     * accepts exactly `add <target>` or `remove <target>` and answers anything
+     * else with exit 127. The market's recovery steps decorate commands with
+     * those options, so on such a host they have to be left out or rewritten as
+     * a bare exact target, instead of being sent and refused — which reported a
+     * supported operation as unsupported and sent the reporter looking for a
+     * broken profile.
+     */
+    const marketFlags = commands.acceptsMarketPnpmFlags !== false;
     const supportsExactRollbackTarget = (target) => commands.supportsExactRollbackTarget?.(target) ?? TARGET_RE.test(target);
     // Point every plugin build/install spawn at the configured build
     // environment (#336). Read LIVE from `config.buildEnv` because the settings
@@ -688,9 +701,34 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
         }
     }
     /** Every plugin command goes through the pnpm-drift recovery wrapper (#20). */
-    const runPlugin = (profile, args) => withHoistRecovery(commands.runPlugin, profile, args, activeProfileDir);
+    const runPlugin = (profile, args) => withHoistRecovery(commands.runPlugin, profile, args, activeProfileDir, { marketFlags });
     /** The same, minus the release-age bypass: for a fresh install pinned to a young release (#594). */
-    const runPluginKeepingReleaseAge = (profile, args) => withHoistRecovery(commands.runPlugin, profile, args, activeProfileDir, { releaseAgeBypass: false });
+    const runPluginKeepingReleaseAge = (profile, args) => withHoistRecovery(commands.runPlugin, profile, args, activeProfileDir, { releaseAgeBypass: false, marketFlags });
+    /**
+     * The argv that rematerializes a restored manifest's build on this host.
+     *
+     * On a host that takes the market's options, one `pnpm install` does it. A
+     * host that runs pnpm itself — the official Desktop bridge (#732) — accepts
+     * only `add <target>` and refuses `install` outright, so there it is an
+     * `add` of the exact version the restored manifest pins, which is what that
+     * host's own manager pipeline materializes. A range is deliberately not
+     * usable: it would re-resolve to whatever is newest and call that the
+     * previous build.
+     *
+     * @returns null when nothing expressible is left, in which case the caller
+     *   reports that rather than sending a command the host will refuse.
+     */
+    function rematerializeArgs(name, pinned) {
+        if (marketFlags)
+            return ['--no-frozen-lockfile', RELEASE_AGE_OVERRIDE, 'install'];
+        if (pinned !== undefined && /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(pinned))
+            return ['add', `${name}@${pinned}`];
+        return null;
+    }
+    /** Why a rematerialization could not even be attempted here (see above). */
+    function cannotRematerializeDetail(name, pinned) {
+        return `这台宿主只接受按精确版本重新安装，「${name}」改动前在 profile 里写作 ${pinned ?? '（不在 profile 里）'}，市场无法在它上面重建上一版 / this host can only reinstall an exact version, and "${name}" was declared as ${pinned ?? '(not in the profile)'}, so the previous build cannot be rematerialized there`;
+    }
     /**
      * Undo a clean-exit update whose new build cannot boot. Restoring only the
      * manifest pin (the original #159 behavior) leaves the bad package files
@@ -710,7 +748,15 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
         // Flags come BEFORE the command: preparePluginArgs treats the last arg as
         // the package target and rejects a trailing flag, while pnpm accepts the
         // same flags in front of `install`.
-        const reinstall = await runPlugin(config.profile, ['--no-frozen-lockfile', RELEASE_AGE_OVERRIDE, 'install']);
+        //
+        // On a host that runs pnpm itself neither flag exists and `install` is not
+        // accepted at all (#732), so there the build is rematerialized through the
+        // exact target — see `rematerializeArgs`.
+        const pinned = manifestBefore.dependencies[name];
+        const args = rematerializeArgs(name, pinned);
+        if (args === null)
+            return { ok: false, detail: cannotRematerializeDetail(name, pinned) };
+        const reinstall = await runPlugin(config.profile, args);
         const ok = reinstall.exitCode === 0 && !reinstall.timedOut && !reinstall.cancelled;
         if (ok)
             logEvent('info', 'update', `${name}: previous build rematerialized (${rolledBack.join(', ')})`);
@@ -842,7 +888,16 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
         // were replaced before the rejected update failed. A normal exact add is
         // then an "already up to date" no-op; --force is what rematerializes the
         // captured version/commit/archive instead of blessing corrupted bytes.
-        const add = await runPlugin(config.profile, ['add', '--force', RELEASE_AGE_OVERRIDE, target]);
+        //
+        // `--force` and the age override are market options, and the official
+        // Desktop bridge refuses them outright (#732). There the rollback is the
+        // bare exact target: the host's own manager pipeline is what installs it,
+        // and sending the options anyway failed the rollback with 127 — which
+        // read as "the previous build could not be verified" while node_modules
+        // still held the bad build.
+        const add = await runPlugin(config.profile, marketFlags
+            ? ['add', '--force', RELEASE_AGE_OVERRIDE, target]
+            : ['add', target]);
         // Exact recovery targets deliberately pin versions/commits. Keep the
         // user's durable range, tag, floating github shortcut, or release URL.
         restoreProfileManifest(config.profile, manifestBefore, activeProfileDir);
@@ -3086,7 +3141,11 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                             const prepared = restoreProfileLockfile(lockfileBefore);
                             if (!prepared.ok)
                                 return prepared;
-                            const reinstall = await runPlugin(config.profile, ['--no-frozen-lockfile', RELEASE_AGE_OVERRIDE, 'install']);
+                            const reinstallArgs = rematerializeArgs(name, manifestBefore.dependencies[name]);
+                            if (reinstallArgs === null) {
+                                return { ok: false, detail: cannotRematerializeDetail(name, manifestBefore.dependencies[name]) };
+                            }
+                            const reinstall = await runPlugin(config.profile, reinstallArgs);
                             restoreProfileManifest(config.profile, manifestBefore, activeProfileDir);
                             const finalLock = restoreProfileLockfile(lockfileBefore);
                             if (!finalLock.ok)
@@ -3552,9 +3611,16 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                         const reresolveInPlace = isGit && !restore && target === spec;
                         // force: the user chose to install a fresh release without the
                         // default one-day safety wait; scoped to this single command.
+                        //
+                        // The override is a market option, so a host that runs pnpm itself
+                        // does not take it (#732); there the plain form goes out and the
+                        // host's own manager pipeline applies its release policy. That is
+                        // the same trade the held-back fresh install already makes: the
+                        // version the host admits now, with the newer one still offered by
+                        // the update check.
                         const addArgs = reresolveInPlace
-                            ? (force ? ['update', RELEASE_AGE_OVERRIDE, name] : ['update', name])
-                            : (force ? ['add', RELEASE_AGE_OVERRIDE, target] : ['add', target]);
+                            ? (force && marketFlags ? ['update', RELEASE_AGE_OVERRIDE, name] : ['update', name])
+                            : (force && marketFlags ? ['add', RELEASE_AGE_OVERRIDE, target] : ['add', target]);
                         // Exact manifest snapshot for failure rollback (#65, #339) — the
                         // host can write dependencies AND dsh.profile.bundles before a
                         // hard-failed add, leaving residue that breaks the next boot.
@@ -3625,7 +3691,15 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                                                     && capturedNpmVersion(lockfileCapture.snapshot, name) !== beforeVersion
                                                     ? {
                                                         available: false,
-                                                        detail: `更新前安装的是 v${beforeVersion}，但 pnpm-lock.yaml 中的版本与它不一致，因此无法证明精确来源，自动回滚不可用。需要时请手工重新安装 ${name}@${beforeVersion}。 / The installed version before the update was v${beforeVersion}, but pnpm-lock.yaml does not match it, so the exact source cannot be proven and automatic rollback is unavailable. Reinstall ${name}@${beforeVersion} manually if needed.`,
+                                                        // Name all three: the version on disk, the version
+                                                        // the lockfile records, and the one a rollback
+                                                        // would install (#732). The old wording named the
+                                                        // first two only by implication, and a user who
+                                                        // reads "the exact source cannot be proven" has
+                                                        // nothing to act on — the reproducer's way out was
+                                                        // to align package.json with the installed build,
+                                                        // which is what this now says.
+                                                        detail: `更新前 node_modules 里装的是 v${beforeVersion}，但 pnpm-lock.yaml 里 ${name} 记的是 ${capturedNpmVersion(lockfileCapture.snapshot, name) ?? '（没有记录）'}，两者不一致，无法证明精确来源，因此自动回滚不可用（要回滚的是 ${name}@${beforeVersion}）。需要时请手工重新安装 ${name}@${beforeVersion}，或先把 package.json 与 pnpm-lock.yaml 对齐到 v${beforeVersion}。 / The build on disk before the update was v${beforeVersion}, but pnpm-lock.yaml records ${capturedNpmVersion(lockfileCapture.snapshot, name) ?? 'nothing'} for ${name}: they disagree, so the exact source cannot be proven and automatic rollback is unavailable. Reinstall ${name}@${beforeVersion} manually if needed, or align package.json and pnpm-lock.yaml with v${beforeVersion} first.`,
                                                         lockfileBefore: lockfileCapture.snapshot,
                                                     }
                                                     : !supportsExactRollbackTarget(`${name}@${beforeVersion}`)
@@ -5117,7 +5191,11 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                                 // the intent the fresh path otherwise refuses to assume it has
                                 // (#594): the bypass is safe to use HERE because it is no
                                 // longer the market's idea — it is what was clicked (#635).
-                                const bypass = heldBack && force;
+                                // The bypass is an option this host may not accept (#732). Where
+                                // it is not expressible the request falls to the same place as
+                                // a refused bypass below: the bare name, with `heldByAge` set
+                                // so the row says the profile's own age policy is why.
+                                const bypass = heldBack && force && marketFlags;
                                 logEvent('warn', 'install', bypass
                                     ? `${entry.name}: ${String(registryLatest)} is younger than this profile's minimumReleaseAge — installing it anyway, as asked, with ${RELEASE_AGE_OVERRIDE}`
                                     : heldBack

package/lib/types/dsh-cli.d.ts

@@ -204,6 +204,19 @@ export interface PluginCommandRuntime {
     cancelActive(): boolean;
     /** Whether this host can execute an immutable rollback add target. */
     supportsExactRollbackTarget?(target: string): boolean;
+    /**
+     * Whether this runtime runs pnpm itself and therefore accepts the market's
+     * own arguments — `--config.*` overrides, `--force`, `--no-frozen-lockfile`.
+     *
+     * The official Electron profile does not (#732): its in-process manager
+     * takes exactly `add <target>` or `remove <target>` and answers any other
+     * argv with exit 127. Every recovery step that decorates a command with an
+     * option is impossible there, and sending it anyway turned a pnpm failure
+     * into "this desktop operation is not supported" — a message about an
+     * operation that is in fact supported, which sent the reporter looking for
+     * a broken profile instead of the option. Absent means "accepts".
+     */
+    acceptsMarketPnpmFlags?: boolean;
 }
 /** One running package operation, however it was started. */
 export interface DesktopPnpmHandleLike {

package/lib/types/install.d.ts

@@ -98,9 +98,16 @@ export declare function isUnpublishedHostPeer(pkg: string | undefined, profile:
  * where it is not — there the bypass would be what installs the young
  * version, over a minimumReleaseAge the profile set on purpose — so the
  * install route declines it and falls back to the bare name instead.
+ *
+ * `marketFlags: false` says the host runs pnpm itself and takes no options
+ * from us (the official Desktop bridge, #732). The four recoveries below
+ * each decorate a command with an option, so on such a host they are skipped
+ * rather than sent and refused — and because their classifier messages say
+ * the market retried, the note appended at the end says it did not.
  */
 export declare function withHoistRecovery(run: PluginRunner, profile: string, pluginArgs: string[], profileDirectory?: string, options?: {
     releaseAgeBypass?: boolean;
+    marketFlags?: boolean;
 }): Promise<InstallResult>;
 /**
  * The tail of the diagnostics file the dsh CLI pointed at, when it pointed at

package/lib/types/profile.d.ts

@@ -350,3 +350,40 @@ export declare function setAllowBuilds(profile: string, packages: string[], expl
  *   file is left untouched.
  */
 export declare function dropUnparseableBuildKeys(profile: string, explicitDir?: string): string[];
+/**
+ * Make a profile's `minimumReleaseAgeExclude` readable again (#732, #733).
+ *
+ * pnpm WRITES this key in forms it then mishandles, and two separate defects
+ * come out of that:
+ *
+ * - pnpm 11.7.0 appends a second rule for a package that already has one,
+ *   while its `evaluateVersionPolicy` honours only the FIRST rule per name.
+ *   Its own new entry is therefore dead, and every later command in that
+ *   profile fails lockfile verification with
+ *   ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION — including commands that have
+ *   nothing to do with that package (#732).
+ * - pnpm 12.4.1 folds the versions it approves into a `name@v1 || v2 || …`
+ *   union, a form its OWN validator rejects ("Invalid versions union … Use
+ *   exact versions only"), and evaluating one aborts the process on a single
+ *   80 GiB allocation that takes the machine down for minutes (#733). The
+ *   entries are evaluated lazily, so this fires on any later install that
+ *   age-checks that package, with no pnpm error output to explain it.
+ *
+ * Both are avoided by writing each such package as ONE BARE NAME. A bare name
+ * cannot be shadowed (the first rule for it is already all of it), it stops
+ * pnpm's auto-collect for that package outright, and it carries no union for
+ * the parser to evaluate. It is also a wider statement than a version list —
+ * the package stops being age-gated at all — so it is spent only on entries
+ * pnpm has already written in one of those two broken forms, never on a
+ * package the file lists as a single exact version. A pure duplicate of one
+ * exact version collapses to that one line, which changes no policy at all.
+ *
+ * A file holding nothing but bare names and single exact versions is left
+ * untouched, as is one whose block this cannot read exactly (a flow list, an
+ * inline comment, a line it would have to guess at).
+ *
+ * @returns the package names whose entry was rewritten; empty when the file
+ *   needed no repair or could not be repaired, in which case it is left
+ *   byte-for-byte as it was.
+ */
+export declare function normalizeReleaseAgeExcludes(profile: string, explicitDir?: string): string[];

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.66.0",
+  "version": "1.66.2",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -30,7 +30,7 @@
     "prepack": "npm run build && node scripts/preflight.mjs",
     "prepare": "npm run build",
     "validate:registry": "node scripts/validate-registry.mjs",
-    "snapshot": "curl -sf https://awesome-dsh-plugin.com/plugins.json -o data/registry-snapshot.json && curl -sf https://awesome-dsh-plugin.com/readmes.json -o data/readmes-snapshot.json",
+    "snapshot": "mkdir -p data && curl -sf https://awesome-dsh-plugin.com/plugins.json -o data/registry-snapshot.json && curl -sf https://awesome-dsh-plugin.com/readmes.json -o data/readmes-snapshot.json",
     "check:web-auth-capture": "node scripts/check-web-auth-capture.mjs",
     "test:web": "node scripts/check-web-auth-capture.mjs && vitest run --config vitest.web.config.ts",
     "build:site": "node scripts/build-site.mjs"

package/src/client/MarketSection.tsx

@@ -3980,6 +3980,15 @@ export function MarketSection(props: MarketSectionProps) {
         ? t('capRedInstallScript')
         : t('capRedInstallScriptScripts').replace('{0}', installScript[1])
     }
+    // The parenthesised detail is not a name. The scanner emits exactly two
+    // shapes — "overrides bundle <id>" and "disables bundle <id>" — and pasting
+    // either through leaves the verb in English. That verb is the fact: the
+    // install would replace a part of DSH, or switch one off.
+    const coreVerb = /^tampers with a core bundle \((overrides|disables) bundle (.+)\)$/.exec(line)
+    if (coreVerb !== null) {
+      const key = coreVerb[1] === 'overrides' ? 'capRedCoreOverride' : 'capRedCoreDisable'
+      return t(key).replace('{0}', coreVerb[2]!)
+    }
     const coreTamper = /^tampers with a core bundle(?: \((.+)\))?$/.exec(line)
     if (coreTamper !== null) {
       return coreTamper[1] === undefined

package/src/client/index.ts

@@ -245,15 +245,22 @@ export function apply(ctx: MarketClientContext): void {
     ? null
     : h(SettingsCard, { t, onRemoved: () => { sectionGate.retire() } })))
 
-  // The seat on the 0.1.7 line (#722). That release moved a plugin's
-  // configuration off the settings list and into the Plugins section: the
-  // `settingsScope` service and the `settings.plugin.item` slot that hung off
-  // it are gone, and `settings.plugins.tab` is what its slot contract offers —
-  // "one page inside the Plugins settings section", rendered as a tab beside
-  // the host's own. Without it the market had NO card on that line at all: the
-  // `plugins.bundle.config` registration above never fires, because no host
-  // declares that slot, and a registration into a slot nobody declares is
-  // silent by construction. Reported as "the settings card disappeared".
+  // The seat on the 0.1.7 line (#722). That release renamed the client's
+  // `settingsScope` service to `settings`, so the nested inject above stopped
+  // firing and `settings.plugin.item` — the settings-list card — went silent
+  // with no error anywhere. `settings.plugins.tab` is what that line's slot
+  // contract offers instead: "one page inside the Plugins settings section",
+  // rendered as a tab beside the host's own. Reported as "the settings card
+  // disappeared".
+  //
+  // This does not replace the `plugins.bundle.config` registration above, and
+  // that one did not stop firing: 0.1.7 declares it (`ui-plugin-manager` — "a
+  // bundle's own configuration, keyed by the bundle's package name and
+  // rendered on the bundle's page"), so the market's card is also on the
+  // market bundle's page in the Plugins section. BOTH seats are deliberate:
+  // the tab is where a user opens the market's settings from that section, the
+  // bundle page is where the plugin manager shows them for the installed
+  // bundle. Keep both.
   //
   // Detection is the slot itself, as everywhere else here: a host that does
   // not declare it never runs this, and the older line keeps its card through

package/src/client/locales.ts

@@ -81,6 +81,8 @@ export const zh = {
   capRedInstallScriptScripts: '安装时会立刻运行 {0}，不需要你打开插件',
   capRedCoreTamper: '会改动 DSH 自带的组件',
   capRedCoreTamperDetail: '会改动 DSH 自带的组件（{0}）',
+  capRedCoreOverride: '会覆盖 DSH 自带的组件（{0}）',
+  capRedCoreDisable: '会禁用 DSH 自带的组件（{0}）',
   favoriteAdd: '加入收藏',
   favoriteRemove: '取消收藏',
   favoritesEmpty: '还没有收藏。在「发现」或「主题」里点书签图标即可收藏。',
@@ -746,6 +748,8 @@ export const en: Record<MarketKey, string> = {
   capRedInstallScriptScripts: 'runs {0} the moment you install — you do not have to open the plugin',
   capRedCoreTamper: 'replaces parts of DSH itself',
   capRedCoreTamperDetail: 'replaces parts of DSH itself ({0})',
+  capRedCoreOverride: 'overrides a part of DSH itself ({0})',
+  capRedCoreDisable: 'disables a part of DSH itself ({0})',
   favoriteAdd: 'Add to favorites',
   favoriteRemove: 'Remove from favorites',
   favoritesEmpty: 'No favorites yet. Click the bookmark icon in Discover or Themes to add one.',

package/src/dsh-cli.ts

@@ -531,6 +531,19 @@ export interface PluginCommandRuntime {
   cancelActive(): boolean
   /** Whether this host can execute an immutable rollback add target. */
   supportsExactRollbackTarget?(target: string): boolean
+  /**
+   * Whether this runtime runs pnpm itself and therefore accepts the market's
+   * own arguments — `--config.*` overrides, `--force`, `--no-frozen-lockfile`.
+   *
+   * The official Electron profile does not (#732): its in-process manager
+   * takes exactly `add <target>` or `remove <target>` and answers any other
+   * argv with exit 127. Every recovery step that decorates a command with an
+   * option is impossible there, and sending it anyway turned a pnpm failure
+   * into "this desktop operation is not supported" — a message about an
+   * operation that is in fact supported, which sent the reporter looking for
+   * a broken profile instead of the option. Absent means "accepts".
+   */
+  acceptsMarketPnpmFlags?: boolean
 }
 
 /** One running package operation, however it was started. */

package/src/install.ts

@@ -10,7 +10,7 @@ import { dirname, isAbsolute, join, resolve } from 'node:path'
 import type { InstallResult, PluginRunner } from './dsh-cli.ts'
 import { findDshInstallDir } from './dsh-install.ts'
 import { classifyPnpmFailure, HOST_NAMESPACE_RE, isTransientPnpmFailure } from './pnpm-compat.ts'
-import { conflictingEntryIds, dropFromManifest, hasDshManifest, hasLoadableEntry, pluginSubdirs, profileDir, readInstalled, readManifestDeps, readProfileBundles, dropUnparseableBuildKeys } from './profile.ts'
+import { conflictingEntryIds, dropFromManifest, hasDshManifest, hasLoadableEntry, normalizeReleaseAgeExcludes, pluginSubdirs, profileDir, readInstalled, readManifestDeps, readProfileBundles, dropUnparseableBuildKeys } from './profile.ts'
 import { logEvent } from './log.ts'
 import { cleanOrphanedStore } from './store.ts'
 
@@ -118,14 +118,37 @@ export function isUnpublishedHostPeer(
  * where it is not — there the bypass would be what installs the young
  * version, over a minimumReleaseAge the profile set on purpose — so the
  * install route declines it and falls back to the bare name instead.
+ *
+ * `marketFlags: false` says the host runs pnpm itself and takes no options
+ * from us (the official Desktop bridge, #732). The four recoveries below
+ * each decorate a command with an option, so on such a host they are skipped
+ * rather than sent and refused — and because their classifier messages say
+ * the market retried, the note appended at the end says it did not.
  */
 export async function withHoistRecovery(
   run: PluginRunner,
   profile: string,
   pluginArgs: string[],
   profileDirectory?: string,
-  options: { releaseAgeBypass?: boolean } = {},
+  options: { releaseAgeBypass?: boolean; marketFlags?: boolean } = {},
 ): Promise<InstallResult> {
+  const marketFlags = options.marketFlags !== false
+  /** The option a recovery step needed and this host does not accept (#732). */
+  let unavailableOption: string | null = null
+  // Before the FIRST run, not after a failure: the two shapes pnpm writes into
+  // `minimumReleaseAgeExclude` (a shadowed duplicate rule, #732; a version
+  // union, #733) hurt pnpm while it RESOLVES the dependency graph, and the
+  // union one aborts the process on an 80 GiB allocation with no error output
+  // at all — nothing to classify, so a repair that waited for a failure would
+  // never fire. Every verb that resolves the graph is covered, not just add and
+  // remove: an `install` or an in-place `update` consults the same key.
+  const verb = pluginArgs.find(argument => !argument.startsWith('-'))
+  if (verb === 'add' || verb === 'remove' || verb === 'install' || verb === 'update') {
+    const normalized = normalizeReleaseAgeExcludes(profile, profileDirectory)
+    if (normalized.length > 0) {
+      logEvent('warn', 'install', `minimumReleaseAgeExclude held a form pnpm cannot read back for ${normalized.join(', ')} (a shadowed duplicate rule, #732, or a version union, which pnpm 12.4.1 aborts on — #733) — rewrote each as one bare package name before running`)
+    }
+  }
   let result = await run(profile, pluginArgs)
   const ok = (r: InstallResult): boolean => r.exitCode === 0 && !r.timedOut && !r.cancelled
   if (!ok(result) && !result.cancelled) {
@@ -142,19 +165,40 @@ export async function withHoistRecovery(
         result = await run(profile, pluginArgs)
       }
     } else if (failure?.code === 'hoist-pattern-diff') {
-      logEvent('warn', 'install', `modules dir was built by a different pnpm major — rebuilding (pnpm install) and retrying once`)
-      // --no-frozen-lockfile: the market runs pnpm with CI=true (TTY hangs),
-      // where a lockfile written by the old major would otherwise be refused.
-      const rebuild = await run(profile, ['install', '--no-frozen-lockfile'])
-      if (ok(rebuild)) result = await run(profile, pluginArgs)
+      if (!marketFlags) {
+        unavailableOption = '--no-frozen-lockfile'
+      } else {
+        logEvent('warn', 'install', `modules dir was built by a different pnpm major — rebuilding (pnpm install) and retrying once`)
+        // --no-frozen-lockfile: the market runs pnpm with CI=true (TTY hangs),
+        // where a lockfile written by the old major would otherwise be refused.
+        const rebuild = await run(profile, ['install', '--no-frozen-lockfile'])
+        if (ok(rebuild)) result = await run(profile, pluginArgs)
+      }
     } else if (
       failure?.code === 'release-age-violation'
-      && options.releaseAgeBypass !== false
       && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')
-      && !pluginArgs.includes(RELEASE_AGE_OVERRIDE)
     ) {
-      logEvent('warn', 'install', `a too-young release blocks pnpm's lockfile verification (#39) — retrying once with ${RELEASE_AGE_OVERRIDE}`)
-      result = await run(profile, [pluginArgs[0], RELEASE_AGE_OVERRIDE, ...pluginArgs.slice(1)])
+      // The repair ran before this command, so a rewrite here means pnpm wrote
+      // one of the two broken shapes DURING it — appending a shadowed rule
+      // (#732) or extending a version union (#733). Either way the same
+      // rewrite fixes it, needs no option at all, and so also works on the
+      // desktop bridge that refuses options. Retry the SAME argv afterwards.
+      const normalized = normalizeReleaseAgeExcludes(profile, profileDirectory)
+      if (normalized.length > 0) {
+        logEvent('warn', 'install', `pnpm wrote a minimumReleaseAgeExclude entry it cannot read back for ${normalized.join(', ')} (#732/#733) — rewrote each as one bare package name and retrying once`)
+        result = await run(profile, pluginArgs)
+      } else if (options.releaseAgeBypass === false) {
+        // The caller declined the bypass (#594), and the duplicates were not
+        // what failed: this violation is the profile's own policy doing its
+        // job, so the command stands as it is.
+      } else if (!marketFlags) {
+        unavailableOption = RELEASE_AGE_OVERRIDE
+      } else if (pluginArgs.includes(RELEASE_AGE_OVERRIDE)) {
+        // Already carrying it (a caller's forced retry): nothing left to add.
+      } else {
+        logEvent('warn', 'install', `a too-young release blocks pnpm's lockfile verification (#39) — retrying once with ${RELEASE_AGE_OVERRIDE}`)
+        result = await run(profile, [pluginArgs[0], RELEASE_AGE_OVERRIDE, ...pluginArgs.slice(1)])
+      }
     } else if (
       (failure?.code === 'fetch-404' || failure?.code === 'no-matching-version')
       && isUnpublishedHostPeer(failure.pkg, profile, profileDirectory)
@@ -165,8 +209,12 @@ export async function withHoistRecovery(
       // and npm has never carried. Every fresh profile hits this, whatever
       // the plugin, so failing here would be failing for something the user
       // cannot fix and did not cause.
-      logEvent('warn', 'install', `${failure.pkg ?? 'a host package'} is a peer the runtime provides and npm does not carry (#289) — retrying once with ${AUTO_INSTALL_PEERS_OFF}`)
-      result = await run(profile, [pluginArgs[0], AUTO_INSTALL_PEERS_OFF, ...pluginArgs.slice(1)])
+      if (!marketFlags) {
+        unavailableOption = AUTO_INSTALL_PEERS_OFF
+      } else {
+        logEvent('warn', 'install', `${failure.pkg ?? 'a host package'} is a peer the runtime provides and npm does not carry (#289) — retrying once with ${AUTO_INSTALL_PEERS_OFF}`)
+        result = await run(profile, [pluginArgs[0], AUTO_INSTALL_PEERS_OFF, ...pluginArgs.slice(1)])
+      }
     } else if (
       failure?.code === 'transient-network'
       && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')
@@ -184,8 +232,12 @@ export async function withHoistRecovery(
       // Large tarball / slow network: pnpm's default 60s per-request limit
       // aborted the download. A plain retry fails again at the same limit,
       // so retry once with a longer fetchTimeout.
-      logEvent('warn', 'install', `pnpm's per-request fetch timeout aborted a large download — retrying once with ${FETCH_TIMEOUT_OVERRIDE}`)
-      result = await run(profile, [pluginArgs[0], FETCH_TIMEOUT_OVERRIDE, ...pluginArgs.slice(1)])
+      if (!marketFlags) {
+        unavailableOption = FETCH_TIMEOUT_OVERRIDE
+      } else {
+        logEvent('warn', 'install', `pnpm's per-request fetch timeout aborted a large download — retrying once with ${FETCH_TIMEOUT_OVERRIDE}`)
+        result = await run(profile, [pluginArgs[0], FETCH_TIMEOUT_OVERRIDE, ...pluginArgs.slice(1)])
+      }
     }
   }
   if (!ok(result) && !result.cancelled) {
@@ -223,6 +275,16 @@ export async function withHoistRecovery(
       result = { ...result, stderr: `${result.stderr}\n\n${code}${result.pnpmError}` }
     }
   }
+  if (unavailableOption !== null && !ok(result) && !result.cancelled) {
+    // #732: this step was skipped because the host runs pnpm itself and takes
+    // no options from us — but the classified message above says the market
+    // retried. Say that it did not, or the user reads a retry that never
+    // happened and looks for the wrong cause.
+    result = {
+      ...result,
+      stderr: `${result.stderr}\n\n这台宿主（官方桌面端）自己执行安装，不接受市场附加的 pnpm 参数（${unavailableOption}），所以这一步没有自动重试。 / This host (the official desktop app) runs the install itself and takes no pnpm options from the market (${unavailableOption}), so that automatic retry could not be attempted.`,
+    }
+  }
   return result
 }
 

package/src/official-desktop.ts

@@ -58,7 +58,16 @@ export function createOfficialDesktopRuntime(
     // manager are accepted; silently dropping pnpm flags would change intent.
     const [command, target, ...extra] = argv
     if (extra.length !== 0 || typeof target !== 'string' || !TARGET_RE.test(target)) {
-      return Promise.resolve(failure('this desktop operation is not supported by the official plugin manager', 127))
+      // The market's own options are what usually lands here, and they are
+      // spelled with a leading `-` — and they sit in the TARGET slot, because
+      // the market writes `add <option> <target>`. The OPERATION is supported
+      // here; only the option is not, and reporting that as "this desktop
+      // operation is not supported" is what made #732 read as a broken
+      // profile. Name the option and the way out instead.
+      const options = argv.slice(1).filter(argument => argument.startsWith('-')).join(' ')
+      return Promise.resolve(failure(options === ''
+        ? 'this desktop operation is not supported by the official plugin manager'
+        : `官方桌面客户端自己执行这次安装，不接受市场附加的参数（${options}），这个选项在它这里用不了。可以改用普通 dsh web 安装，或等这个版本过了新版本等待期再试。 / The official desktop app runs this install itself and takes no options from the market (${options}); that option cannot be used here. Install from plain dsh web, or try again once the release is past the fresh-release wait.`, 127))
     }
     const spec = target
     // Only `add` and `remove` map onto the manager. `update` reached here
@@ -136,6 +145,10 @@ export function createOfficialDesktopRuntime(
       return true
     },
     supportsExactRollbackTarget: target => TARGET_RE.test(target),
+    // The reason the flag exists (#732): this manager takes exactly
+    // `add <target>` or `remove <target>`, so every recovery step that needs
+    // an option has to be left out here rather than sent and refused.
+    acceptsMarketPnpmFlags: false,
     dispose: async () => {
       disposed = true
       if (active?.requestId !== undefined) {

package/src/profile.ts

@@ -1238,3 +1238,141 @@ export function dropUnparseableBuildKeys(profile: string, explicitDir?: string):
   writeAllowBuildsMap(file, yaml, map, blockRe, blockMatch)
   return removed
 }
+
+/** One `minimumReleaseAgeExclude` entry, split into its name and its versions. */
+interface ReleaseAgeExcludeRule {
+  name: string
+  /** The version union exactly as written, or null when the entry names no version. */
+  selector: string | null
+}
+
+/**
+ * Split `name@1.2.3 || 1.4.0` into its package name and selector.
+ *
+ * A scoped name begins with `@`, so the separator is the first `@` AFTER
+ * position 0; an entry with no `@` at all excludes every version of that
+ * name. Anything this cannot read exactly returns null, and the caller then
+ * leaves the file alone rather than rewriting a line it misread.
+ */
+function splitReleaseAgeExclude(entry: string): ReleaseAgeExcludeRule | null {
+  let text = entry.trim()
+  if (text.length >= 2
+    && (text[0] === "'" && text[text.length - 1] === "'" || text[0] === '"' && text[text.length - 1] === '"')) {
+    text = text.slice(1, -1)
+  }
+  const at = text.indexOf('@', text.startsWith('@') ? 1 : 0)
+  if (at === -1) return text === '' ? null : { name: text, selector: null }
+  const name = text.slice(0, at)
+  const selector = text.slice(at + 1).trim()
+  if (name === '' || selector === '') return null
+  return { name, selector }
+}
+
+/**
+ * Make a profile's `minimumReleaseAgeExclude` readable again (#732, #733).
+ *
+ * pnpm WRITES this key in forms it then mishandles, and two separate defects
+ * come out of that:
+ *
+ * - pnpm 11.7.0 appends a second rule for a package that already has one,
+ *   while its `evaluateVersionPolicy` honours only the FIRST rule per name.
+ *   Its own new entry is therefore dead, and every later command in that
+ *   profile fails lockfile verification with
+ *   ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION — including commands that have
+ *   nothing to do with that package (#732).
+ * - pnpm 12.4.1 folds the versions it approves into a `name@v1 || v2 || …`
+ *   union, a form its OWN validator rejects ("Invalid versions union … Use
+ *   exact versions only"), and evaluating one aborts the process on a single
+ *   80 GiB allocation that takes the machine down for minutes (#733). The
+ *   entries are evaluated lazily, so this fires on any later install that
+ *   age-checks that package, with no pnpm error output to explain it.
+ *
+ * Both are avoided by writing each such package as ONE BARE NAME. A bare name
+ * cannot be shadowed (the first rule for it is already all of it), it stops
+ * pnpm's auto-collect for that package outright, and it carries no union for
+ * the parser to evaluate. It is also a wider statement than a version list —
+ * the package stops being age-gated at all — so it is spent only on entries
+ * pnpm has already written in one of those two broken forms, never on a
+ * package the file lists as a single exact version. A pure duplicate of one
+ * exact version collapses to that one line, which changes no policy at all.
+ *
+ * A file holding nothing but bare names and single exact versions is left
+ * untouched, as is one whose block this cannot read exactly (a flow list, an
+ * inline comment, a line it would have to guess at).
+ *
+ * @returns the package names whose entry was rewritten; empty when the file
+ *   needed no repair or could not be repaired, in which case it is left
+ *   byte-for-byte as it was.
+ */
+export function normalizeReleaseAgeExcludes(profile: string, explicitDir?: string): string[] {
+  const file = join(profileDir(profile, explicitDir), 'pnpm-workspace.yaml')
+  let yaml: string
+  try { yaml = readFileSync(file, 'utf8') } catch { return [] }
+  // Block form only: `minimumReleaseAgeExclude:` then `- <entry>` lines.
+  const blockRe = /^minimumReleaseAgeExclude:[ \t]*\r?\n((?:[ \t]+-[^\r\n]*\r?\n?)*)/m
+  const block = blockRe.exec(yaml)
+  if (block === null) return []
+  const eol = /\r\n/.test(yaml) ? '\r\n' : '\n'
+  const indentMatch = /^([ \t]+)-/.exec(block[1])
+  const indent = indentMatch === null ? '  ' : indentMatch[1]
+  const entries: { rule: ReleaseAgeExcludeRule; quoted: boolean; line: string }[] = []
+  for (const line of block[1].split(/\r?\n/)) {
+    if (line.trim() === '') continue
+    const m = /^[ \t]+-[ \t]*(.*?)[ \t]*$/.exec(line)
+    // A `#` on the line is a comment this cannot re-emit without losing it.
+    if (m === null || m[1].includes('#')) return []
+    const rule = splitReleaseAgeExclude(m[1])
+    if (rule === null) return []
+    entries.push({ rule, quoted: /^['"]/.test(m[1]), line })
+  }
+  const byName = new Map<string, {
+    selectors: Set<string>
+    originals: string[]
+    lines: string[]
+    allVersions: boolean
+    quoted: boolean
+    count: number
+  }>()
+  const order: string[] = []
+  for (const { rule, quoted, line } of entries) {
+    let group = byName.get(rule.name)
+    if (group === undefined) {
+      group = { selectors: new Set(), originals: [], lines: [], allVersions: false, quoted: false, count: 0 }
+      byName.set(rule.name, group)
+      order.push(rule.name)
+    }
+    group.count += 1
+    group.quoted = group.quoted || quoted
+    group.originals.push(rule.selector ?? '')
+    group.lines.push(line)
+    if (rule.selector === null) group.allVersions = true
+    else group.selectors.add(rule.selector)
+  }
+  /** The one line this package's entry is written as. */
+  const produced = (name: string): string => {
+    const group = byName.get(name)
+    if (group === undefined) return ''
+    // A bare name already covers every version, so it stays bare; a union or
+    // several rules for one name cannot both be read, so they become one.
+    const bare = group.allVersions
+      || group.originals.some(selector => selector.includes('||'))
+      || group.selectors.size > 1
+    const text = bare ? name : `${name}@${[...group.selectors][0]}`
+    // `@` cannot start a plain scalar in YAML, so a scoped name is written
+    // quoted — the way pnpm itself writes one.
+    const quoted = group.quoted || text.startsWith('@')
+    return `${indent}- ${quoted ? `'${text.replaceAll("'", "''")}'` : text}`
+  }
+  const rewritten = order.filter(name => {
+    const group = byName.get(name)
+    if (group === undefined) return false
+    return group.count > 1 || group.lines[0] !== produced(name)
+  })
+  if (rewritten.length === 0) return []
+  const lines = order.map(produced)
+  const blockText = `minimumReleaseAgeExclude:${eol}${lines.join(eol)}${eol}`
+  // A function replacement: `$&` and friends in a string replacement would
+  // be read as capture references.
+  writeFileSync(file, yaml.replace(blockRe, () => blockText))
+  return rewritten
+}

package/src/routes.ts

@@ -357,6 +357,19 @@ export function mountMarketRoutes(
   // re-applies the same choice on every boot (ported from dsh-plugin-hub).
   const userPatchPath = findUserPatchPath(host, activeProfileDir)
   const commands: PluginCommandRuntime = commandRuntime ?? { runPlugin: runDshPlugin, probePnpm, provisionPnpm, cancelActive }
+  /**
+   * Whether this host runs pnpm itself and so takes the market's own options
+   * (`--config.*`, `--force`, `--no-frozen-lockfile`).
+   *
+   * The official Desktop bridge does not (#732): its in-process manager
+   * accepts exactly `add <target>` or `remove <target>` and answers anything
+   * else with exit 127. The market's recovery steps decorate commands with
+   * those options, so on such a host they have to be left out or rewritten as
+   * a bare exact target, instead of being sent and refused — which reported a
+   * supported operation as unsupported and sent the reporter looking for a
+   * broken profile.
+   */
+  const marketFlags = commands.acceptsMarketPnpmFlags !== false
   const supportsExactRollbackTarget = (target: string): boolean =>
     commands.supportsExactRollbackTarget?.(target) ?? TARGET_RE.test(target)
   // Point every plugin build/install spawn at the configured build
@@ -773,10 +786,36 @@ export function mountMarketRoutes(
   }
 
   /** Every plugin command goes through the pnpm-drift recovery wrapper (#20). */
-  const runPlugin = (profile: string, args: string[]) => withHoistRecovery(commands.runPlugin, profile, args, activeProfileDir)
+  const runPlugin = (profile: string, args: string[]) =>
+    withHoistRecovery(commands.runPlugin, profile, args, activeProfileDir, { marketFlags })
   /** The same, minus the release-age bypass: for a fresh install pinned to a young release (#594). */
   const runPluginKeepingReleaseAge = (profile: string, args: string[]) =>
-    withHoistRecovery(commands.runPlugin, profile, args, activeProfileDir, { releaseAgeBypass: false })
+    withHoistRecovery(commands.runPlugin, profile, args, activeProfileDir, { releaseAgeBypass: false, marketFlags })
+
+  /**
+   * The argv that rematerializes a restored manifest's build on this host.
+   *
+   * On a host that takes the market's options, one `pnpm install` does it. A
+   * host that runs pnpm itself — the official Desktop bridge (#732) — accepts
+   * only `add <target>` and refuses `install` outright, so there it is an
+   * `add` of the exact version the restored manifest pins, which is what that
+   * host's own manager pipeline materializes. A range is deliberately not
+   * usable: it would re-resolve to whatever is newest and call that the
+   * previous build.
+   *
+   * @returns null when nothing expressible is left, in which case the caller
+   *   reports that rather than sending a command the host will refuse.
+   */
+  function rematerializeArgs(name: string, pinned: string | undefined): string[] | null {
+    if (marketFlags) return ['--no-frozen-lockfile', RELEASE_AGE_OVERRIDE, 'install']
+    if (pinned !== undefined && /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(pinned)) return ['add', `${name}@${pinned}`]
+    return null
+  }
+
+  /** Why a rematerialization could not even be attempted here (see above). */
+  function cannotRematerializeDetail(name: string, pinned: string | undefined): string {
+    return `这台宿主只接受按精确版本重新安装，「${name}」改动前在 profile 里写作 ${pinned ?? '（不在 profile 里）'}，市场无法在它上面重建上一版 / this host can only reinstall an exact version, and "${name}" was declared as ${pinned ?? '(not in the profile)'}, so the previous build cannot be rematerialized there`
+  }
 
   /**
    * Undo a clean-exit update whose new build cannot boot. Restoring only the
@@ -800,7 +839,14 @@ export function mountMarketRoutes(
     // Flags come BEFORE the command: preparePluginArgs treats the last arg as
     // the package target and rejects a trailing flag, while pnpm accepts the
     // same flags in front of `install`.
-    const reinstall = await runPlugin(config.profile, ['--no-frozen-lockfile', RELEASE_AGE_OVERRIDE, 'install'])
+    //
+    // On a host that runs pnpm itself neither flag exists and `install` is not
+    // accepted at all (#732), so there the build is rematerialized through the
+    // exact target — see `rematerializeArgs`.
+    const pinned = manifestBefore.dependencies[name]
+    const args = rematerializeArgs(name, pinned)
+    if (args === null) return { ok: false, detail: cannotRematerializeDetail(name, pinned) }
+    const reinstall = await runPlugin(config.profile, args)
     const ok = reinstall.exitCode === 0 && !reinstall.timedOut && !reinstall.cancelled
     if (ok) logEvent('info', 'update', `${name}: previous build rematerialized (${rolledBack.join(', ')})`)
     return { ok, detail: ok ? null : failureDetail(reinstall) }
@@ -962,7 +1008,16 @@ export function mountMarketRoutes(
     // were replaced before the rejected update failed. A normal exact add is
     // then an "already up to date" no-op; --force is what rematerializes the
     // captured version/commit/archive instead of blessing corrupted bytes.
-    const add = await runPlugin(config.profile, ['add', '--force', RELEASE_AGE_OVERRIDE, target])
+    //
+    // `--force` and the age override are market options, and the official
+    // Desktop bridge refuses them outright (#732). There the rollback is the
+    // bare exact target: the host's own manager pipeline is what installs it,
+    // and sending the options anyway failed the rollback with 127 — which
+    // read as "the previous build could not be verified" while node_modules
+    // still held the bad build.
+    const add = await runPlugin(config.profile, marketFlags
+      ? ['add', '--force', RELEASE_AGE_OVERRIDE, target]
+      : ['add', target])
     // Exact recovery targets deliberately pin versions/commits. Keep the
     // user's durable range, tag, floating github shortcut, or release URL.
     restoreProfileManifest(config.profile, manifestBefore, activeProfileDir)
@@ -3256,7 +3311,11 @@ sendJson(response, 200, { updates })
               restoreProfileManifest(config.profile, manifestBefore, activeProfileDir)
               const prepared = restoreProfileLockfile(lockfileBefore)
               if (!prepared.ok) return prepared
-              const reinstall = await runPlugin(config.profile, ['--no-frozen-lockfile', RELEASE_AGE_OVERRIDE, 'install'])
+              const reinstallArgs = rematerializeArgs(name, manifestBefore.dependencies[name])
+              if (reinstallArgs === null) {
+                return { ok: false, detail: cannotRematerializeDetail(name, manifestBefore.dependencies[name]) }
+              }
+              const reinstall = await runPlugin(config.profile, reinstallArgs)
               restoreProfileManifest(config.profile, manifestBefore, activeProfileDir)
               const finalLock = restoreProfileLockfile(lockfileBefore)
               if (!finalLock.ok) return finalLock
@@ -3727,9 +3786,16 @@ sendJson(response, 200, { updates })
             const reresolveInPlace = isGit && !restore && target === spec
             // force: the user chose to install a fresh release without the
             // default one-day safety wait; scoped to this single command.
+            //
+            // The override is a market option, so a host that runs pnpm itself
+            // does not take it (#732); there the plain form goes out and the
+            // host's own manager pipeline applies its release policy. That is
+            // the same trade the held-back fresh install already makes: the
+            // version the host admits now, with the newer one still offered by
+            // the update check.
             const addArgs = reresolveInPlace
-              ? (force ? ['update', RELEASE_AGE_OVERRIDE, name] : ['update', name])
-              : (force ? ['add', RELEASE_AGE_OVERRIDE, target] : ['add', target])
+              ? (force && marketFlags ? ['update', RELEASE_AGE_OVERRIDE, name] : ['update', name])
+              : (force && marketFlags ? ['add', RELEASE_AGE_OVERRIDE, target] : ['add', target])
             // Exact manifest snapshot for failure rollback (#65, #339) — the
             // host can write dependencies AND dsh.profile.bundles before a
             // hard-failed add, leaving residue that breaks the next boot.
@@ -3800,7 +3866,15 @@ sendJson(response, 200, { updates })
                           && capturedNpmVersion(lockfileCapture.snapshot, name) !== beforeVersion
                           ? {
                               available: false,
-                              detail: `更新前安装的是 v${beforeVersion}，但 pnpm-lock.yaml 中的版本与它不一致，因此无法证明精确来源，自动回滚不可用。需要时请手工重新安装 ${name}@${beforeVersion}。 / The installed version before the update was v${beforeVersion}, but pnpm-lock.yaml does not match it, so the exact source cannot be proven and automatic rollback is unavailable. Reinstall ${name}@${beforeVersion} manually if needed.`,
+                              // Name all three: the version on disk, the version
+                              // the lockfile records, and the one a rollback
+                              // would install (#732). The old wording named the
+                              // first two only by implication, and a user who
+                              // reads "the exact source cannot be proven" has
+                              // nothing to act on — the reproducer's way out was
+                              // to align package.json with the installed build,
+                              // which is what this now says.
+                              detail: `更新前 node_modules 里装的是 v${beforeVersion}，但 pnpm-lock.yaml 里 ${name} 记的是 ${capturedNpmVersion(lockfileCapture.snapshot, name) ?? '（没有记录）'}，两者不一致，无法证明精确来源，因此自动回滚不可用（要回滚的是 ${name}@${beforeVersion}）。需要时请手工重新安装 ${name}@${beforeVersion}，或先把 package.json 与 pnpm-lock.yaml 对齐到 v${beforeVersion}。 / The build on disk before the update was v${beforeVersion}, but pnpm-lock.yaml records ${capturedNpmVersion(lockfileCapture.snapshot, name) ?? 'nothing'} for ${name}: they disagree, so the exact source cannot be proven and automatic rollback is unavailable. Reinstall ${name}@${beforeVersion} manually if needed, or align package.json and pnpm-lock.yaml with v${beforeVersion} first.`,
                               lockfileBefore: lockfileCapture.snapshot,
                             }
                           : !supportsExactRollbackTarget(`${name}@${beforeVersion}`)
@@ -5308,7 +5382,11 @@ sendJson(response, 200, { updates })
                 // the intent the fresh path otherwise refuses to assume it has
                 // (#594): the bypass is safe to use HERE because it is no
                 // longer the market's idea — it is what was clicked (#635).
-                const bypass = heldBack && force
+                // The bypass is an option this host may not accept (#732). Where
+                // it is not expressible the request falls to the same place as
+                // a refused bypass below: the bare name, with `heldByAge` set
+                // so the row says the profile's own age policy is why.
+                const bypass = heldBack && force && marketFlags
                 logEvent('warn', 'install', bypass
                   ? `${entry.name}: ${String(registryLatest)} is younger than this profile's minimumReleaseAge — installing it anyway, as asked, with ${RELEASE_AGE_OVERRIDE}`
                   : heldBack