dshmarket 1.66.1 → 1.66.2

package/client/client.js

@@ -272,6 +272,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			capRedInstallScriptScripts: "安装时会立刻运行 {0}，不需要你打开插件",
 			capRedCoreTamper: "会改动 DSH 自带的组件",
 			capRedCoreTamperDetail: "会改动 DSH 自带的组件（{0}）",
+			capRedCoreOverride: "会覆盖 DSH 自带的组件（{0}）",
+			capRedCoreDisable: "会禁用 DSH 自带的组件（{0}）",
 			favoriteAdd: "加入收藏",
 			favoriteRemove: "取消收藏",
 			favoritesEmpty: "还没有收藏。在「发现」或「主题」里点书签图标即可收藏。",
@@ -920,6 +922,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			capRedInstallScriptScripts: "runs {0} the moment you install — you do not have to open the plugin",
 			capRedCoreTamper: "replaces parts of DSH itself",
 			capRedCoreTamperDetail: "replaces parts of DSH itself ({0})",
+			capRedCoreOverride: "overrides a part of DSH itself ({0})",
+			capRedCoreDisable: "disables a part of DSH itself ({0})",
 			favoriteAdd: "Add to favorites",
 			favoriteRemove: "Remove from favorites",
 			favoritesEmpty: "No favorites yet. Click the bookmark icon in Discover or Themes to add one.",
@@ -9764,6 +9768,11 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				if (literalIp !== null) return t("capRedLiteralIp").replace("{0}", literalIp[1]);
 				const installScript = /^runs code at install time(?: \((.+)\))?$/.exec(line);
 				if (installScript !== null) return installScript[1] === void 0 ? t("capRedInstallScript") : t("capRedInstallScriptScripts").replace("{0}", installScript[1]);
+				const coreVerb = /^tampers with a core bundle \((overrides|disables) bundle (.+)\)$/.exec(line);
+				if (coreVerb !== null) {
+					const key = coreVerb[1] === "overrides" ? "capRedCoreOverride" : "capRedCoreDisable";
+					return t(key).replace("{0}", coreVerb[2]);
+				}
 				const coreTamper = /^tampers with a core bundle(?: \((.+)\))?$/.exec(line);
 				if (coreTamper !== null) return coreTamper[1] === void 0 ? t("capRedCoreTamper") : t("capRedCoreTamperDetail").replace("{0}", coreTamper[1]);
 				return line;

package/lib/install.js

@@ -8,7 +8,7 @@ import { closeSync, existsSync, lstatSync, openSync, readlinkSync, readSync, rmS
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { findDshInstallDir } from './dsh-install.js';
 import { classifyPnpmFailure, HOST_NAMESPACE_RE } from './pnpm-compat.js';
-import { conflictingEntryIds, dropFromManifest, hasDshManifest, hasLoadableEntry, mergeDuplicateReleaseAgeExcludes, pluginSubdirs, profileDir, readInstalled, readManifestDeps, readProfileBundles, dropUnparseableBuildKeys } from './profile.js';
+import { conflictingEntryIds, dropFromManifest, hasDshManifest, hasLoadableEntry, normalizeReleaseAgeExcludes, pluginSubdirs, profileDir, readInstalled, readManifestDeps, readProfileBundles, dropUnparseableBuildKeys } from './profile.js';
 import { logEvent } from './log.js';
 import { cleanOrphanedStore } from './store.js';
 /**
@@ -119,6 +119,20 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
     const marketFlags = options.marketFlags !== false;
     /** The option a recovery step needed and this host does not accept (#732). */
     let unavailableOption = null;
+    // Before the FIRST run, not after a failure: the two shapes pnpm writes into
+    // `minimumReleaseAgeExclude` (a shadowed duplicate rule, #732; a version
+    // union, #733) hurt pnpm while it RESOLVES the dependency graph, and the
+    // union one aborts the process on an 80 GiB allocation with no error output
+    // at all — nothing to classify, so a repair that waited for a failure would
+    // never fire. Every verb that resolves the graph is covered, not just add and
+    // remove: an `install` or an in-place `update` consults the same key.
+    const verb = pluginArgs.find(argument => !argument.startsWith('-'));
+    if (verb === 'add' || verb === 'remove' || verb === 'install' || verb === 'update') {
+        const normalized = normalizeReleaseAgeExcludes(profile, profileDirectory);
+        if (normalized.length > 0) {
+            logEvent('warn', 'install', `minimumReleaseAgeExclude held a form pnpm cannot read back for ${normalized.join(', ')} (a shadowed duplicate rule, #732, or a version union, which pnpm 12.4.1 aborts on — #733) — rewrote each as one bare package name before running`);
+        }
+    }
     let result = await run(profile, pluginArgs);
     const ok = (r) => r.exitCode === 0 && !r.timedOut && !r.cancelled;
     if (!ok(result) && !result.cancelled) {
@@ -149,23 +163,28 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
             }
         }
         else if (failure?.code === 'release-age-violation'
-            && options.releaseAgeBypass !== false
-            && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')
-            && !pluginArgs.includes(RELEASE_AGE_OVERRIDE)) {
-            // #732 first, because it is the breakage itself: pnpm appends a second
-            // `minimumReleaseAgeExclude` rule for a package that already has one and
-            // then honours only the FIRST per name, so its own new entry is shadowed
-            // and verification fails for every later command in that profile.
-            // Merging the duplicates repairs the file and needs no option at all, so
-            // it is the one recovery that also works on the desktop bridge.
-            const mergedDuplicates = mergeDuplicateReleaseAgeExcludes(profile, profileDirectory);
-            if (mergedDuplicates.length > 0) {
-                logEvent('warn', 'install', `pnpm appended a second minimumReleaseAgeExclude rule for ${mergedDuplicates.join(', ')} and honours only the first, shadowing its own entry (#732) — merged the duplicates and retrying once`);
+            && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')) {
+            // The repair ran before this command, so a rewrite here means pnpm wrote
+            // one of the two broken shapes DURING it — appending a shadowed rule
+            // (#732) or extending a version union (#733). Either way the same
+            // rewrite fixes it, needs no option at all, and so also works on the
+            // desktop bridge that refuses options. Retry the SAME argv afterwards.
+            const normalized = normalizeReleaseAgeExcludes(profile, profileDirectory);
+            if (normalized.length > 0) {
+                logEvent('warn', 'install', `pnpm wrote a minimumReleaseAgeExclude entry it cannot read back for ${normalized.join(', ')} (#732/#733) — rewrote each as one bare package name and retrying once`);
                 result = await run(profile, pluginArgs);
             }
+            else if (options.releaseAgeBypass === false) {
+                // The caller declined the bypass (#594), and the duplicates were not
+                // what failed: this violation is the profile's own policy doing its
+                // job, so the command stands as it is.
+            }
             else if (!marketFlags) {
                 unavailableOption = RELEASE_AGE_OVERRIDE;
             }
+            else if (pluginArgs.includes(RELEASE_AGE_OVERRIDE)) {
+                // Already carrying it (a caller's forced retry): nothing left to add.
+            }
             else {
                 logEvent('warn', 'install', `a too-young release blocks pnpm's lockfile verification (#39) — retrying once with ${RELEASE_AGE_OVERRIDE}`);
                 result = await run(profile, [pluginArgs[0], RELEASE_AGE_OVERRIDE, ...pluginArgs.slice(1)]);

package/lib/profile.js

@@ -1222,31 +1222,42 @@ function splitReleaseAgeExclude(entry) {
     return { name, selector };
 }
 /**
- * Merge one package's several `minimumReleaseAgeExclude` entries into one
- * (#732).
+ * Make a profile's `minimumReleaseAgeExclude` readable again (#732, #733).
  *
- * pnpm 11.7.0 APPENDS an entry when it lets a version through a profile's
- * `minimumReleaseAge` instead of folding it into the rule that already names
- * that package — and its own `evaluateVersionPolicy` then honours only the
- * FIRST rule per package name. The entry pnpm just wrote is therefore
- * shadowed by the older one, the young version stays unexcluded, and pnpm
- * fails lockfile verification with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION on
- * EVERY later command in that profile: installs, updates and uninstalls
- * alike, including ones that have nothing to do with the package. Reported
- * as #732, where the market's own self-update planted exactly that pair and
- * every plugin operation on the desktop profile stopped working.
+ * pnpm WRITES this key in forms it then mishandles, and two separate defects
+ * come out of that:
  *
- * Merging keeps the union of what the file already says, so nothing is
- * loosened or tightened: the entries pnpm wrote were meant to be read, and
- * after the merge they are. A file with no same-name duplicate is untouched,
- * as is one whose block this cannot read exactly (a flow list, an inline
- * comment, a line it would have to guess at).
+ * - pnpm 11.7.0 appends a second rule for a package that already has one,
+ *   while its `evaluateVersionPolicy` honours only the FIRST rule per name.
+ *   Its own new entry is therefore dead, and every later command in that
+ *   profile fails lockfile verification with
+ *   ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION — including commands that have
+ *   nothing to do with that package (#732).
+ * - pnpm 12.4.1 folds the versions it approves into a `name@v1 || v2 || …`
+ *   union, a form its OWN validator rejects ("Invalid versions union … Use
+ *   exact versions only"), and evaluating one aborts the process on a single
+ *   80 GiB allocation that takes the machine down for minutes (#733). The
+ *   entries are evaluated lazily, so this fires on any later install that
+ *   age-checks that package, with no pnpm error output to explain it.
  *
- * @returns the package names whose entries were merged; empty when the file
+ * Both are avoided by writing each such package as ONE BARE NAME. A bare name
+ * cannot be shadowed (the first rule for it is already all of it), it stops
+ * pnpm's auto-collect for that package outright, and it carries no union for
+ * the parser to evaluate. It is also a wider statement than a version list —
+ * the package stops being age-gated at all — so it is spent only on entries
+ * pnpm has already written in one of those two broken forms, never on a
+ * package the file lists as a single exact version. A pure duplicate of one
+ * exact version collapses to that one line, which changes no policy at all.
+ *
+ * A file holding nothing but bare names and single exact versions is left
+ * untouched, as is one whose block this cannot read exactly (a flow list, an
+ * inline comment, a line it would have to guess at).
+ *
+ * @returns the package names whose entry was rewritten; empty when the file
  *   needed no repair or could not be repaired, in which case it is left
  *   byte-for-byte as it was.
  */
-export function mergeDuplicateReleaseAgeExcludes(profile, explicitDir) {
+export function normalizeReleaseAgeExcludes(profile, explicitDir) {
     const file = join(profileDir(profile, explicitDir), 'pnpm-workspace.yaml');
     let yaml;
     try {
@@ -1274,40 +1285,54 @@ export function mergeDuplicateReleaseAgeExcludes(profile, explicitDir) {
         const rule = splitReleaseAgeExclude(m[1]);
         if (rule === null)
             return [];
-        entries.push({ rule, quoted: /^['"]/.test(m[1]) });
+        entries.push({ rule, quoted: /^['"]/.test(m[1]), line });
     }
     const byName = new Map();
     const order = [];
-    for (const { rule, quoted } of entries) {
+    for (const { rule, quoted, line } of entries) {
         let group = byName.get(rule.name);
         if (group === undefined) {
-            group = { selectors: new Set(), allVersions: false, quoted: false, count: 0 };
+            group = { selectors: new Set(), originals: [], lines: [], allVersions: false, quoted: false, count: 0 };
             byName.set(rule.name, group);
             order.push(rule.name);
         }
         group.count += 1;
         group.quoted = group.quoted || quoted;
+        group.originals.push(rule.selector ?? '');
+        group.lines.push(line);
         if (rule.selector === null)
             group.allVersions = true;
         else
             group.selectors.add(rule.selector);
     }
-    const merged = order.filter(name => (byName.get(name)?.count ?? 0) > 1);
-    if (merged.length === 0)
-        return [];
-    const lines = order.map(name => {
+    /** The one line this package's entry is written as. */
+    const produced = (name) => {
         const group = byName.get(name);
         if (group === undefined)
             return '';
-        const text = group.allVersions ? name : `${name}@${[...group.selectors].join(' || ')}`;
+        // A bare name already covers every version, so it stays bare; a union or
+        // several rules for one name cannot both be read, so they become one.
+        const bare = group.allVersions
+            || group.originals.some(selector => selector.includes('||'))
+            || group.selectors.size > 1;
+        const text = bare ? name : `${name}@${[...group.selectors][0]}`;
         // `@` cannot start a plain scalar in YAML, so a scoped name is written
         // quoted — the way pnpm itself writes one.
         const quoted = group.quoted || text.startsWith('@');
         return `${indent}- ${quoted ? `'${text.replaceAll("'", "''")}'` : text}`;
+    };
+    const rewritten = order.filter(name => {
+        const group = byName.get(name);
+        if (group === undefined)
+            return false;
+        return group.count > 1 || group.lines[0] !== produced(name);
     });
+    if (rewritten.length === 0)
+        return [];
+    const lines = order.map(produced);
     const blockText = `minimumReleaseAgeExclude:${eol}${lines.join(eol)}${eol}`;
     // A function replacement: `$&` and friends in a string replacement would
     // be read as capture references.
     writeFileSync(file, yaml.replace(blockRe, () => blockText));
-    return merged;
+    return rewritten;
 }

package/lib/routes.js

@@ -3691,7 +3691,15 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                                                     && capturedNpmVersion(lockfileCapture.snapshot, name) !== beforeVersion
                                                     ? {
                                                         available: false,
-                                                        detail: `更新前安装的是 v${beforeVersion}，但 pnpm-lock.yaml 中的版本与它不一致，因此无法证明精确来源，自动回滚不可用。需要时请手工重新安装 ${name}@${beforeVersion}。 / The installed version before the update was v${beforeVersion}, but pnpm-lock.yaml does not match it, so the exact source cannot be proven and automatic rollback is unavailable. Reinstall ${name}@${beforeVersion} manually if needed.`,
+                                                        // Name all three: the version on disk, the version
+                                                        // the lockfile records, and the one a rollback
+                                                        // would install (#732). The old wording named the
+                                                        // first two only by implication, and a user who
+                                                        // reads "the exact source cannot be proven" has
+                                                        // nothing to act on — the reproducer's way out was
+                                                        // to align package.json with the installed build,
+                                                        // which is what this now says.
+                                                        detail: `更新前 node_modules 里装的是 v${beforeVersion}，但 pnpm-lock.yaml 里 ${name} 记的是 ${capturedNpmVersion(lockfileCapture.snapshot, name) ?? '（没有记录）'}，两者不一致，无法证明精确来源，因此自动回滚不可用（要回滚的是 ${name}@${beforeVersion}）。需要时请手工重新安装 ${name}@${beforeVersion}，或先把 package.json 与 pnpm-lock.yaml 对齐到 v${beforeVersion}。 / The build on disk before the update was v${beforeVersion}, but pnpm-lock.yaml records ${capturedNpmVersion(lockfileCapture.snapshot, name) ?? 'nothing'} for ${name}: they disagree, so the exact source cannot be proven and automatic rollback is unavailable. Reinstall ${name}@${beforeVersion} manually if needed, or align package.json and pnpm-lock.yaml with v${beforeVersion} first.`,
                                                         lockfileBefore: lockfileCapture.snapshot,
                                                     }
                                                     : !supportsExactRollbackTarget(`${name}@${beforeVersion}`)

package/lib/types/profile.d.ts

@@ -351,28 +351,39 @@ export declare function setAllowBuilds(profile: string, packages: string[], expl
  */
 export declare function dropUnparseableBuildKeys(profile: string, explicitDir?: string): string[];
 /**
- * Merge one package's several `minimumReleaseAgeExclude` entries into one
- * (#732).
+ * Make a profile's `minimumReleaseAgeExclude` readable again (#732, #733).
  *
- * pnpm 11.7.0 APPENDS an entry when it lets a version through a profile's
- * `minimumReleaseAge` instead of folding it into the rule that already names
- * that package — and its own `evaluateVersionPolicy` then honours only the
- * FIRST rule per package name. The entry pnpm just wrote is therefore
- * shadowed by the older one, the young version stays unexcluded, and pnpm
- * fails lockfile verification with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION on
- * EVERY later command in that profile: installs, updates and uninstalls
- * alike, including ones that have nothing to do with the package. Reported
- * as #732, where the market's own self-update planted exactly that pair and
- * every plugin operation on the desktop profile stopped working.
+ * pnpm WRITES this key in forms it then mishandles, and two separate defects
+ * come out of that:
  *
- * Merging keeps the union of what the file already says, so nothing is
- * loosened or tightened: the entries pnpm wrote were meant to be read, and
- * after the merge they are. A file with no same-name duplicate is untouched,
- * as is one whose block this cannot read exactly (a flow list, an inline
- * comment, a line it would have to guess at).
+ * - pnpm 11.7.0 appends a second rule for a package that already has one,
+ *   while its `evaluateVersionPolicy` honours only the FIRST rule per name.
+ *   Its own new entry is therefore dead, and every later command in that
+ *   profile fails lockfile verification with
+ *   ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION — including commands that have
+ *   nothing to do with that package (#732).
+ * - pnpm 12.4.1 folds the versions it approves into a `name@v1 || v2 || …`
+ *   union, a form its OWN validator rejects ("Invalid versions union … Use
+ *   exact versions only"), and evaluating one aborts the process on a single
+ *   80 GiB allocation that takes the machine down for minutes (#733). The
+ *   entries are evaluated lazily, so this fires on any later install that
+ *   age-checks that package, with no pnpm error output to explain it.
  *
- * @returns the package names whose entries were merged; empty when the file
+ * Both are avoided by writing each such package as ONE BARE NAME. A bare name
+ * cannot be shadowed (the first rule for it is already all of it), it stops
+ * pnpm's auto-collect for that package outright, and it carries no union for
+ * the parser to evaluate. It is also a wider statement than a version list —
+ * the package stops being age-gated at all — so it is spent only on entries
+ * pnpm has already written in one of those two broken forms, never on a
+ * package the file lists as a single exact version. A pure duplicate of one
+ * exact version collapses to that one line, which changes no policy at all.
+ *
+ * A file holding nothing but bare names and single exact versions is left
+ * untouched, as is one whose block this cannot read exactly (a flow list, an
+ * inline comment, a line it would have to guess at).
+ *
+ * @returns the package names whose entry was rewritten; empty when the file
  *   needed no repair or could not be repaired, in which case it is left
  *   byte-for-byte as it was.
  */
-export declare function mergeDuplicateReleaseAgeExcludes(profile: string, explicitDir?: string): string[];
+export declare function normalizeReleaseAgeExcludes(profile: string, explicitDir?: string): string[];

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.66.1",
+  "version": "1.66.2",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/client/MarketSection.tsx

@@ -3980,6 +3980,15 @@ export function MarketSection(props: MarketSectionProps) {
         ? t('capRedInstallScript')
         : t('capRedInstallScriptScripts').replace('{0}', installScript[1])
     }
+    // The parenthesised detail is not a name. The scanner emits exactly two
+    // shapes — "overrides bundle <id>" and "disables bundle <id>" — and pasting
+    // either through leaves the verb in English. That verb is the fact: the
+    // install would replace a part of DSH, or switch one off.
+    const coreVerb = /^tampers with a core bundle \((overrides|disables) bundle (.+)\)$/.exec(line)
+    if (coreVerb !== null) {
+      const key = coreVerb[1] === 'overrides' ? 'capRedCoreOverride' : 'capRedCoreDisable'
+      return t(key).replace('{0}', coreVerb[2]!)
+    }
     const coreTamper = /^tampers with a core bundle(?: \((.+)\))?$/.exec(line)
     if (coreTamper !== null) {
       return coreTamper[1] === undefined

package/src/client/locales.ts

@@ -81,6 +81,8 @@ export const zh = {
   capRedInstallScriptScripts: '安装时会立刻运行 {0}，不需要你打开插件',
   capRedCoreTamper: '会改动 DSH 自带的组件',
   capRedCoreTamperDetail: '会改动 DSH 自带的组件（{0}）',
+  capRedCoreOverride: '会覆盖 DSH 自带的组件（{0}）',
+  capRedCoreDisable: '会禁用 DSH 自带的组件（{0}）',
   favoriteAdd: '加入收藏',
   favoriteRemove: '取消收藏',
   favoritesEmpty: '还没有收藏。在「发现」或「主题」里点书签图标即可收藏。',
@@ -746,6 +748,8 @@ export const en: Record<MarketKey, string> = {
   capRedInstallScriptScripts: 'runs {0} the moment you install — you do not have to open the plugin',
   capRedCoreTamper: 'replaces parts of DSH itself',
   capRedCoreTamperDetail: 'replaces parts of DSH itself ({0})',
+  capRedCoreOverride: 'overrides a part of DSH itself ({0})',
+  capRedCoreDisable: 'disables a part of DSH itself ({0})',
   favoriteAdd: 'Add to favorites',
   favoriteRemove: 'Remove from favorites',
   favoritesEmpty: 'No favorites yet. Click the bookmark icon in Discover or Themes to add one.',

package/src/install.ts

@@ -10,7 +10,7 @@ import { dirname, isAbsolute, join, resolve } from 'node:path'
 import type { InstallResult, PluginRunner } from './dsh-cli.ts'
 import { findDshInstallDir } from './dsh-install.ts'
 import { classifyPnpmFailure, HOST_NAMESPACE_RE, isTransientPnpmFailure } from './pnpm-compat.ts'
-import { conflictingEntryIds, dropFromManifest, hasDshManifest, hasLoadableEntry, mergeDuplicateReleaseAgeExcludes, pluginSubdirs, profileDir, readInstalled, readManifestDeps, readProfileBundles, dropUnparseableBuildKeys } from './profile.ts'
+import { conflictingEntryIds, dropFromManifest, hasDshManifest, hasLoadableEntry, normalizeReleaseAgeExcludes, pluginSubdirs, profileDir, readInstalled, readManifestDeps, readProfileBundles, dropUnparseableBuildKeys } from './profile.ts'
 import { logEvent } from './log.ts'
 import { cleanOrphanedStore } from './store.ts'
 
@@ -135,6 +135,20 @@ export async function withHoistRecovery(
   const marketFlags = options.marketFlags !== false
   /** The option a recovery step needed and this host does not accept (#732). */
   let unavailableOption: string | null = null
+  // Before the FIRST run, not after a failure: the two shapes pnpm writes into
+  // `minimumReleaseAgeExclude` (a shadowed duplicate rule, #732; a version
+  // union, #733) hurt pnpm while it RESOLVES the dependency graph, and the
+  // union one aborts the process on an 80 GiB allocation with no error output
+  // at all — nothing to classify, so a repair that waited for a failure would
+  // never fire. Every verb that resolves the graph is covered, not just add and
+  // remove: an `install` or an in-place `update` consults the same key.
+  const verb = pluginArgs.find(argument => !argument.startsWith('-'))
+  if (verb === 'add' || verb === 'remove' || verb === 'install' || verb === 'update') {
+    const normalized = normalizeReleaseAgeExcludes(profile, profileDirectory)
+    if (normalized.length > 0) {
+      logEvent('warn', 'install', `minimumReleaseAgeExclude held a form pnpm cannot read back for ${normalized.join(', ')} (a shadowed duplicate rule, #732, or a version union, which pnpm 12.4.1 aborts on — #733) — rewrote each as one bare package name before running`)
+    }
+  }
   let result = await run(profile, pluginArgs)
   const ok = (r: InstallResult): boolean => r.exitCode === 0 && !r.timedOut && !r.cancelled
   if (!ok(result) && !result.cancelled) {
@@ -162,22 +176,25 @@ export async function withHoistRecovery(
       }
     } else if (
       failure?.code === 'release-age-violation'
-      && options.releaseAgeBypass !== false
       && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')
-      && !pluginArgs.includes(RELEASE_AGE_OVERRIDE)
     ) {
-      // #732 first, because it is the breakage itself: pnpm appends a second
-      // `minimumReleaseAgeExclude` rule for a package that already has one and
-      // then honours only the FIRST per name, so its own new entry is shadowed
-      // and verification fails for every later command in that profile.
-      // Merging the duplicates repairs the file and needs no option at all, so
-      // it is the one recovery that also works on the desktop bridge.
-      const mergedDuplicates = mergeDuplicateReleaseAgeExcludes(profile, profileDirectory)
-      if (mergedDuplicates.length > 0) {
-        logEvent('warn', 'install', `pnpm appended a second minimumReleaseAgeExclude rule for ${mergedDuplicates.join(', ')} and honours only the first, shadowing its own entry (#732) — merged the duplicates and retrying once`)
+      // The repair ran before this command, so a rewrite here means pnpm wrote
+      // one of the two broken shapes DURING it — appending a shadowed rule
+      // (#732) or extending a version union (#733). Either way the same
+      // rewrite fixes it, needs no option at all, and so also works on the
+      // desktop bridge that refuses options. Retry the SAME argv afterwards.
+      const normalized = normalizeReleaseAgeExcludes(profile, profileDirectory)
+      if (normalized.length > 0) {
+        logEvent('warn', 'install', `pnpm wrote a minimumReleaseAgeExclude entry it cannot read back for ${normalized.join(', ')} (#732/#733) — rewrote each as one bare package name and retrying once`)
         result = await run(profile, pluginArgs)
+      } else if (options.releaseAgeBypass === false) {
+        // The caller declined the bypass (#594), and the duplicates were not
+        // what failed: this violation is the profile's own policy doing its
+        // job, so the command stands as it is.
       } else if (!marketFlags) {
         unavailableOption = RELEASE_AGE_OVERRIDE
+      } else if (pluginArgs.includes(RELEASE_AGE_OVERRIDE)) {
+        // Already carrying it (a caller's forced retry): nothing left to add.
       } else {
         logEvent('warn', 'install', `a too-young release blocks pnpm's lockfile verification (#39) — retrying once with ${RELEASE_AGE_OVERRIDE}`)
         result = await run(profile, [pluginArgs[0], RELEASE_AGE_OVERRIDE, ...pluginArgs.slice(1)])

package/src/profile.ts

@@ -1269,31 +1269,42 @@ function splitReleaseAgeExclude(entry: string): ReleaseAgeExcludeRule | null {
 }
 
 /**
- * Merge one package's several `minimumReleaseAgeExclude` entries into one
- * (#732).
+ * Make a profile's `minimumReleaseAgeExclude` readable again (#732, #733).
  *
- * pnpm 11.7.0 APPENDS an entry when it lets a version through a profile's
- * `minimumReleaseAge` instead of folding it into the rule that already names
- * that package — and its own `evaluateVersionPolicy` then honours only the
- * FIRST rule per package name. The entry pnpm just wrote is therefore
- * shadowed by the older one, the young version stays unexcluded, and pnpm
- * fails lockfile verification with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION on
- * EVERY later command in that profile: installs, updates and uninstalls
- * alike, including ones that have nothing to do with the package. Reported
- * as #732, where the market's own self-update planted exactly that pair and
- * every plugin operation on the desktop profile stopped working.
+ * pnpm WRITES this key in forms it then mishandles, and two separate defects
+ * come out of that:
  *
- * Merging keeps the union of what the file already says, so nothing is
- * loosened or tightened: the entries pnpm wrote were meant to be read, and
- * after the merge they are. A file with no same-name duplicate is untouched,
- * as is one whose block this cannot read exactly (a flow list, an inline
- * comment, a line it would have to guess at).
+ * - pnpm 11.7.0 appends a second rule for a package that already has one,
+ *   while its `evaluateVersionPolicy` honours only the FIRST rule per name.
+ *   Its own new entry is therefore dead, and every later command in that
+ *   profile fails lockfile verification with
+ *   ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION — including commands that have
+ *   nothing to do with that package (#732).
+ * - pnpm 12.4.1 folds the versions it approves into a `name@v1 || v2 || …`
+ *   union, a form its OWN validator rejects ("Invalid versions union … Use
+ *   exact versions only"), and evaluating one aborts the process on a single
+ *   80 GiB allocation that takes the machine down for minutes (#733). The
+ *   entries are evaluated lazily, so this fires on any later install that
+ *   age-checks that package, with no pnpm error output to explain it.
  *
- * @returns the package names whose entries were merged; empty when the file
+ * Both are avoided by writing each such package as ONE BARE NAME. A bare name
+ * cannot be shadowed (the first rule for it is already all of it), it stops
+ * pnpm's auto-collect for that package outright, and it carries no union for
+ * the parser to evaluate. It is also a wider statement than a version list —
+ * the package stops being age-gated at all — so it is spent only on entries
+ * pnpm has already written in one of those two broken forms, never on a
+ * package the file lists as a single exact version. A pure duplicate of one
+ * exact version collapses to that one line, which changes no policy at all.
+ *
+ * A file holding nothing but bare names and single exact versions is left
+ * untouched, as is one whose block this cannot read exactly (a flow list, an
+ * inline comment, a line it would have to guess at).
+ *
+ * @returns the package names whose entry was rewritten; empty when the file
  *   needed no repair or could not be repaired, in which case it is left
  *   byte-for-byte as it was.
  */
-export function mergeDuplicateReleaseAgeExcludes(profile: string, explicitDir?: string): string[] {
+export function normalizeReleaseAgeExcludes(profile: string, explicitDir?: string): string[] {
   const file = join(profileDir(profile, explicitDir), 'pnpm-workspace.yaml')
   let yaml: string
   try { yaml = readFileSync(file, 'utf8') } catch { return [] }
@@ -1304,7 +1315,7 @@ export function mergeDuplicateReleaseAgeExcludes(profile: string, explicitDir?:
   const eol = /\r\n/.test(yaml) ? '\r\n' : '\n'
   const indentMatch = /^([ \t]+)-/.exec(block[1])
   const indent = indentMatch === null ? '  ' : indentMatch[1]
-  const entries: { rule: ReleaseAgeExcludeRule; quoted: boolean }[] = []
+  const entries: { rule: ReleaseAgeExcludeRule; quoted: boolean; line: string }[] = []
   for (const line of block[1].split(/\r?\n/)) {
     if (line.trim() === '') continue
     const m = /^[ \t]+-[ \t]*(.*?)[ \t]*$/.exec(line)
@@ -1312,36 +1323,56 @@ export function mergeDuplicateReleaseAgeExcludes(profile: string, explicitDir?:
     if (m === null || m[1].includes('#')) return []
     const rule = splitReleaseAgeExclude(m[1])
     if (rule === null) return []
-    entries.push({ rule, quoted: /^['"]/.test(m[1]) })
+    entries.push({ rule, quoted: /^['"]/.test(m[1]), line })
   }
-  const byName = new Map<string, { selectors: Set<string>; allVersions: boolean; quoted: boolean; count: number }>()
+  const byName = new Map<string, {
+    selectors: Set<string>
+    originals: string[]
+    lines: string[]
+    allVersions: boolean
+    quoted: boolean
+    count: number
+  }>()
   const order: string[] = []
-  for (const { rule, quoted } of entries) {
+  for (const { rule, quoted, line } of entries) {
     let group = byName.get(rule.name)
     if (group === undefined) {
-      group = { selectors: new Set(), allVersions: false, quoted: false, count: 0 }
+      group = { selectors: new Set(), originals: [], lines: [], allVersions: false, quoted: false, count: 0 }
       byName.set(rule.name, group)
       order.push(rule.name)
     }
     group.count += 1
     group.quoted = group.quoted || quoted
+    group.originals.push(rule.selector ?? '')
+    group.lines.push(line)
     if (rule.selector === null) group.allVersions = true
     else group.selectors.add(rule.selector)
   }
-  const merged = order.filter(name => (byName.get(name)?.count ?? 0) > 1)
-  if (merged.length === 0) return []
-  const lines = order.map(name => {
+  /** The one line this package's entry is written as. */
+  const produced = (name: string): string => {
     const group = byName.get(name)
     if (group === undefined) return ''
-    const text = group.allVersions ? name : `${name}@${[...group.selectors].join(' || ')}`
+    // A bare name already covers every version, so it stays bare; a union or
+    // several rules for one name cannot both be read, so they become one.
+    const bare = group.allVersions
+      || group.originals.some(selector => selector.includes('||'))
+      || group.selectors.size > 1
+    const text = bare ? name : `${name}@${[...group.selectors][0]}`
     // `@` cannot start a plain scalar in YAML, so a scoped name is written
     // quoted — the way pnpm itself writes one.
     const quoted = group.quoted || text.startsWith('@')
     return `${indent}- ${quoted ? `'${text.replaceAll("'", "''")}'` : text}`
+  }
+  const rewritten = order.filter(name => {
+    const group = byName.get(name)
+    if (group === undefined) return false
+    return group.count > 1 || group.lines[0] !== produced(name)
   })
+  if (rewritten.length === 0) return []
+  const lines = order.map(produced)
   const blockText = `minimumReleaseAgeExclude:${eol}${lines.join(eol)}${eol}`
   // A function replacement: `$&` and friends in a string replacement would
   // be read as capture references.
   writeFileSync(file, yaml.replace(blockRe, () => blockText))
-  return merged
+  return rewritten
 }

package/src/routes.ts

@@ -3866,7 +3866,15 @@ sendJson(response, 200, { updates })
                           && capturedNpmVersion(lockfileCapture.snapshot, name) !== beforeVersion
                           ? {
                               available: false,
-                              detail: `更新前安装的是 v${beforeVersion}，但 pnpm-lock.yaml 中的版本与它不一致，因此无法证明精确来源，自动回滚不可用。需要时请手工重新安装 ${name}@${beforeVersion}。 / The installed version before the update was v${beforeVersion}, but pnpm-lock.yaml does not match it, so the exact source cannot be proven and automatic rollback is unavailable. Reinstall ${name}@${beforeVersion} manually if needed.`,
+                              // Name all three: the version on disk, the version
+                              // the lockfile records, and the one a rollback
+                              // would install (#732). The old wording named the
+                              // first two only by implication, and a user who
+                              // reads "the exact source cannot be proven" has
+                              // nothing to act on — the reproducer's way out was
+                              // to align package.json with the installed build,
+                              // which is what this now says.
+                              detail: `更新前 node_modules 里装的是 v${beforeVersion}，但 pnpm-lock.yaml 里 ${name} 记的是 ${capturedNpmVersion(lockfileCapture.snapshot, name) ?? '（没有记录）'}，两者不一致，无法证明精确来源，因此自动回滚不可用（要回滚的是 ${name}@${beforeVersion}）。需要时请手工重新安装 ${name}@${beforeVersion}，或先把 package.json 与 pnpm-lock.yaml 对齐到 v${beforeVersion}。 / The build on disk before the update was v${beforeVersion}, but pnpm-lock.yaml records ${capturedNpmVersion(lockfileCapture.snapshot, name) ?? 'nothing'} for ${name}: they disagree, so the exact source cannot be proven and automatic rollback is unavailable. Reinstall ${name}@${beforeVersion} manually if needed, or align package.json and pnpm-lock.yaml with v${beforeVersion} first.`,
                               lockfileBefore: lockfileCapture.snapshot,
                             }
                           : !supportsExactRollbackTarget(`${name}@${beforeVersion}`)